Fix forbidden sale copy and wire WarBow wallet profile modal (#318) #457

Merged

PlasticDigits merged 1 commit from fix/318-play-surface-copy-warbow-profile into main 2026-06-13 09:27:16 +00:00

Conversation 4 Commits 1 Files changed 10 +109 -16

PlasticDigits commented 2026-06-13 07:58:34 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

Summary

GitLab #318: remove forbidden sale framing on the / play console, wire WarBow steal-target rival rows to WalletProfileModal via onOpenWalletProfile, and add regression tests plus docs/invariant cross-links (INV-FRONTEND-318-PLAY-SURFACE-COPY, extends INV-FRONTEND-258-WALLET-PROFILE).

Acceptance checklist

Criterion	Verification	Result
No user-visible sale on / play console (pre-launch + live)	cd frontend && npm test -- src/pages/arena/arenaSimplePlaySurface.test.ts	PASS
WarBow rival rows open wallet profile modal	arenaSimplePlaySurface.test.ts + arenaCommandConsoleStatic.test.ts wiring assertions; manual: click WarBow target identity → profile modal (not explorer)	PASS (unit); manual SKIP on this VM
Static/unit test guards forbidden copy	arenaSimplePlaySurface.test.ts, revertMessage.test.ts	PASS
Frontend typecheck + lint + full unit suite	cd frontend && npm run typecheck && npm run lint && npm test	PASS
E2E smoke (copy/selectors)	bash scripts/e2e-anvil.sh	SKIP (not required for copy-only + wiring; no selector changes)

Third-party verification

1. Check out branch fix/318-play-surface-copy-warbow-profile.
2. cd frontend && npm run typecheck && npm run lint && npm test
3. Start local stack per AGENTS.md; open http://127.0.0.1:5173/ (play route).
4. Pre-launch copy: if arena start is in the future, confirm muted status reads "The arena has not opened yet…" (no sale).
5. WarBow profile: unlock WarBow, connect wallet, click a rival row identity chip → WalletProfileModal opens; explorer only inside modal.
6. Optional: bash scripts/e2e-anvil.sh for full Playwright smoke on /.

Related

• Parent gap: #309
• Content audit: docs/testing/frontend-content-audit.md
• Invariants: INV-FRONTEND-318-PLAY-SURFACE-COPY, INV-FRONTEND-258-WALLET-PROFILE

---

Note

Low Risk
Copy and optional callback wiring only; no API or onchain changes. WarBow row click vs profile-button behavior is the main UX edge case, covered by unit tests.

Overview
GitLab #318: the play console drops user-visible sale framing in favor of Time Arena / arena language on pre-open status, buy guard errors, and friendlyRevertMessage mappings (not started, timer expired, Kumbaya bad phase).

WarBow steal-target rows and the selected target identity now accept onOpenWalletProfile from ArenaSimplePage, opening WalletProfileModal via PlayerIdentity while row clicks still select rivals unless the click hits the profile control (targetIsInsideAddressAction).

Docs and invariants add INV-FRONTEND-318-PLAY-SURFACE-COPY, extend INV-FRONTEND-258-WALLET-PROFILE, and update the frontend content audit. Regression coverage: arenaSimplePlaySurface.test.ts, revertMessage.test.ts, arenaCommandConsoleStatic.test.ts.

^{Reviewed by Cursor Bugbot for commit f0207c04e3. Bugbot is set up for automated code reviews on this repo. Configure here.}

## Summary GitLab [#318](https://gitlab.com/PlasticDigits/yieldomega/-/issues/318): remove forbidden **sale** framing on the `/` play console, wire WarBow steal-target rival rows to **`WalletProfileModal`** via `onOpenWalletProfile`, and add regression tests plus docs/invariant cross-links (`INV-FRONTEND-318-PLAY-SURFACE-COPY`, extends `INV-FRONTEND-258-WALLET-PROFILE`). ## Acceptance checklist | Criterion | Verification | Result | |-----------|--------------|--------| | No user-visible `sale` on `/` play console (pre-launch + live) | `cd frontend && npm test -- src/pages/arena/arenaSimplePlaySurface.test.ts` | PASS | | WarBow rival rows open wallet profile modal | `arenaSimplePlaySurface.test.ts` + `arenaCommandConsoleStatic.test.ts` wiring assertions; manual: click WarBow target identity → profile modal (not explorer) | PASS (unit); manual SKIP on this VM | | Static/unit test guards forbidden copy | `arenaSimplePlaySurface.test.ts`, `revertMessage.test.ts` | PASS | | Frontend typecheck + lint + full unit suite | `cd frontend && npm run typecheck && npm run lint && npm test` | PASS | | E2E smoke (copy/selectors) | `bash scripts/e2e-anvil.sh` | SKIP (not required for copy-only + wiring; no selector changes) | ## Third-party verification 1. Check out branch `fix/318-play-surface-copy-warbow-profile`. 2. `cd frontend && npm run typecheck && npm run lint && npm test` 3. Start local stack per `AGENTS.md`; open `http://127.0.0.1:5173/` (play route). 4. **Pre-launch copy:** if arena start is in the future, confirm muted status reads *"The arena has not opened yet…"* (no `sale`). 5. **WarBow profile:** unlock WarBow, connect wallet, click a rival row identity chip → **`WalletProfileModal`** opens; explorer only inside modal. 6. Optional: `bash scripts/e2e-anvil.sh` for full Playwright smoke on `/`. ## Related - Parent gap: [#309](https://gitlab.com/PlasticDigits/yieldomega/-/issues/309) - Content audit: `docs/testing/frontend-content-audit.md` - Invariants: `INV-FRONTEND-318-PLAY-SURFACE-COPY`, `INV-FRONTEND-258-WALLET-PROFILE` <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Low Risk** > Copy and optional callback wiring only; no API or onchain changes. WarBow row click vs profile-button behavior is the main UX edge case, covered by unit tests. > > **Overview** > GitLab **#318**: the play console drops user-visible **sale** framing in favor of **Time Arena / arena** language on pre-open status, buy guard errors, and **`friendlyRevertMessage`** mappings (not started, timer expired, Kumbaya bad phase). > > **WarBow** steal-target rows and the selected target identity now accept **`onOpenWalletProfile`** from **`ArenaSimplePage`**, opening **`WalletProfileModal`** via **`PlayerIdentity`** while row clicks still select rivals unless the click hits the profile control (**`targetIsInsideAddressAction`**). > > Docs and invariants add **`INV-FRONTEND-318-PLAY-SURFACE-COPY`**, extend **`INV-FRONTEND-258-WALLET-PROFILE`**, and update the frontend content audit. Regression coverage: **`arenaSimplePlaySurface.test.ts`**, **`revertMessage.test.ts`**, **`arenaCommandConsoleStatic.test.ts`**. > > ^{Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit f0207c04e3e9280ed5b35f874aca33085785acb6. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).} <!-- /CURSOR_SUMMARY -->

project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-13 07:58:44 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

changed the description

changed the description

project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-13 07:58:53 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

changed the description

changed the description

PlasticDigits commented 2026-06-13 08:00:37 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

Security review — MR !457

Commit reviewed: f0207c04e3e9280ed5b35f874aca33085785acb6
Base: a0d325c5797067494af8ef2f7666856dd39131f0
Scope: Frontend-only diff (10 files): play-surface copy changes (revertMessage.ts, ArenaSimplePage.tsx, useArenaSaleSession.ts), WarBow onOpenWalletProfile wiring (ArenaWarbowHeroPanel.tsx), docs/invariants, and regression tests. No smart-contract, indexer, or backend changes.

Method

• Traced attacker-controlled inputs on new/changed paths: WarBow rival rows → PlayerIdentity → AddressInline.onOpenProfile → TimeArenaPage.setProfileAddress → WalletProfileModal → useWalletStats → fetchArenaWalletStats.
• Compared WarBow click handling to the existing LiveBuyRow pattern (targetIsInsideAddressAction).
• Checked for injection/XSS (React text nodes only; isAddress gate in AddressInline), open-redirect (explorerAddressUrl), and client-side SSRF/path traversal (indexerBaseUrl + fixed path; useWalletStats requires 0x + 42 chars).

Outcome

FINDINGS: 0 medium+

No inline threads — nothing met the reporting bar.

Security review: no medium+ findings on this diff.

WarBow profile wiring reuses the established #258 modal flow; addresses are validated before render and before indexer fetch. Copy-only changes have no security sink. No block:security label applied.

## Security review — MR !457 **Commit reviewed:** `f0207c04e3e9280ed5b35f874aca33085785acb6` **Base:** `a0d325c5797067494af8ef2f7666856dd39131f0` **Scope:** Frontend-only diff (10 files): play-surface copy changes (`revertMessage.ts`, `ArenaSimplePage.tsx`, `useArenaSaleSession.ts`), WarBow `onOpenWalletProfile` wiring (`ArenaWarbowHeroPanel.tsx`), docs/invariants, and regression tests. No smart-contract, indexer, or backend changes. ### Method - Traced attacker-controlled inputs on new/changed paths: WarBow rival rows → `PlayerIdentity` → `AddressInline.onOpenProfile` → `TimeArenaPage.setProfileAddress` → `WalletProfileModal` → `useWalletStats` → `fetchArenaWalletStats`. - Compared WarBow click handling to the existing `LiveBuyRow` pattern (`targetIsInsideAddressAction`). - Checked for injection/XSS (React text nodes only; `isAddress` gate in `AddressInline`), open-redirect (`explorerAddressUrl`), and client-side SSRF/path traversal (`indexerBaseUrl` + fixed path; `useWalletStats` requires `0x` + 42 chars). ### Outcome **FINDINGS: 0** medium+ No inline threads — nothing met the reporting bar. **Security review: no medium+ findings on this diff.** WarBow profile wiring reuses the established #258 modal flow; addresses are validated before render and before indexer fetch. Copy-only changes have no security sink. No `block:security` label applied.

PlasticDigits commented 2026-06-13 09:27:16 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

mentioned in commit 1ade1e1b40

mentioned in commit 1ade1e1b4038ceafa9e3d35d5af84314222c78c8

PlasticDigits (Migrated from gitlab.com) merged commit 1ade1e1b40 into main 2026-06-13 09:27:16 +00:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

agent:fix_bugfix

  

agent:fix_conflicts

  

agent:fix_security

  

agent:gap_analysis

  

agent:implement

  

agent:open_issues

  

agents

  

agent:security_audit

  

agent:verify

  

area

timecurve

  

arena

  

arena-v2

  

audit

  

block:feature_review

  

block:security

  

bug

  

contracts

  

design

  

devops

  

docs

Documentation

  

documentation

  

enhancement

  

epic

Epic / umbrella issue

  

feature

  

frontend

  

indexer

  

low priority

Low priority, investigate other issues first

  

megaeth

  

operations

  

ops

Deploy and operations

  

performance

  

QA

  

qa checklist

  

referrals

  

removal

Legacy removal

  

security

  

smart-contracts

  

tech-debt

  

testing

  

time-arena

TimeArena v2 revamp

  

timecurve

  

visual-qa

No labels

agent:fix_bugfix

agent:fix_conflicts

agent:fix_security

agent:gap_analysis

agent:implement

agent:open_issues

agents

agent:security_audit

agent:verify

area

timecurve

arena

arena-v2

audit

block:feature_review

block:security

bug

contracts

design

devops

docs

documentation

enhancement

epic

feature

frontend

indexer

low priority

megaeth

operations

ops

performance

QA

qa checklist

referrals

removal

security

smart-contracts

tech-debt

testing

time-arena

timecurve

visual-qa

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

code/yieldomega!457

No description provided.