code/yieldomega
Watch
4
0
Fork
You've already forked yieldomega
 0
Code Issues 1 Pull requests 1 Projects Releases Packages Wiki Activity

Remove AdminSellVault from arena deploy path (#314) #464

Merged
PlasticDigits merged 2 commits from issue-314-remove-admin-sell-vault into main 2026-06-13 10:01:09 +00:00
Conversation 11 Commits 2 Files changed 49 +80 -353
PlasticDigits commented 2026-06-13 08:15:54 +00:00 (Migrated from gitlab.com)

Summary

Removes legacy AdminSellVault from the Arena v2 deploy path (#314):

  • TimeArena.initialize no longer accepts an admin vault; reserved storage slot kept for UUPS upgrade safety.
  • AdminSellVault.sol and AdminSellVault.t.sol deleted.
  • DeployDev, DeployProduction, Anvil registry scripts, indexer production validation, and frontend env no longer require AdminSellVault / VITE_ADMIN_SELL_VAULT_ADDRESS.
  • Kumbaya doubSurplusRecipient on Anvil → deployer (not admin vault).
  • Buy routing unchanged: 100% podiums, 0% admin take (#300).

Acceptance checklist

Criterion Command / step Result
Arena deploy no longer requires AdminSellVault cd contracts && forge test --match-contract DevStackIntegration PASS
Buy routing tests still show 0% admin take cd contracts && forge test --match-test test_buy_routes_doub_split PASS
Anvil stack scripts deploy without AdminSellVault bash scripts/verify-evm-dev-wallet-seed-anvil.sh PASS
DeployDev succeeds on fresh Anvil SKIP_ANVIL_RICH_STATE=1 bash scripts/start-local-anvil-stack.sh --no-frontend (stack up; registry omits AdminSellVault) PASS
Full contract suite cd contracts && forge test (5 pre-existing doub.csv fork tests fail without gitignored CSV) PASS (153/158)
Frontend cd frontend && npm run typecheck && npm run lint && npm test PASS
Indexer config cd indexer && cargo test config:: PASS

Third-party verification

cd contracts && forge test --match-contract "TimeArenaTest|DevStackIntegration"
bash scripts/verify-evm-dev-wallet-seed-anvil.sh
bash scripts/test-anvil-deploy-caller-scope.sh
SKIP_ANVIL_RICH_STATE=1 bash scripts/start-local-anvil-stack.sh --no-frontend
# Registry should list TimeArena, PodiumVaults, ReferralRegistry only:
jq .contracts contracts/deployments/local-anvil-registry.json
curl -sf http://127.0.0.1:3100/v1/status
cd frontend && npm run typecheck && npm test

Follow-ups

  • Existing mainnet proxies that already deployed AdminSellVault can keep the legacy contract at its address; new deploys omit it entirely. Upgrade path: deploy new TimeArena implementation without reusing the reserved slot.

Note

Medium Risk
Changes UUPS TimeArena.initialize and deploy wiring; reserved storage preserves upgrades but new proxies must not reuse the old slot. Buy economics unchanged but deploy/indexer/env contracts shift for all new stacks.

Overview
Removes AdminSellVault from the Arena v2 stack (#314) — deletes the contract and its Forge tests, drops it from DeployDev, DeployProduction, UUPSDeployLib, ABI export, and local Anvil registry JSON, and updates agent guardrails, deployment docs, invariants (INV-DEPLOY-314-*), and frontend/.env.example so VITE_ADMIN_SELL_VAULT_ADDRESS is no longer required.

TimeArena no longer takes an admin vault in initialize; the old adminSellVault slot is kept as __reservedAdminSellVault for upgrade safety. Buy and top-up behavior stays 100% podiums / 0% admin take (#300) — tests drop admin-vault balance assertions and rename surplus routing checks.

Anvil Kumbaya fixtures send TimeArenaBuyRouter DOUB surplus to the deployer instead of AdminSellVault. Indexer production registry validation no longer requires an AdminSellVault key (legacy optional).

Reviewed by Cursor Bugbot for commit 868a79120c. Bugbot is set up for automated code reviews on this repo. Configure here.

## Summary Removes legacy **`AdminSellVault`** from the Arena v2 deploy path ([#314](https://gitlab.com/PlasticDigits/yieldomega/-/issues/314)): - **`TimeArena.initialize`** no longer accepts an admin vault; reserved storage slot kept for UUPS upgrade safety. - **`AdminSellVault.sol`** and **`AdminSellVault.t.sol`** deleted. - **`DeployDev`**, **`DeployProduction`**, Anvil registry scripts, indexer production validation, and frontend env no longer require **`AdminSellVault`** / **`VITE_ADMIN_SELL_VAULT_ADDRESS`**. - Kumbaya **`doubSurplusRecipient`** on Anvil → deployer (not admin vault). - Buy routing unchanged: **100% podiums, 0% admin take** ([#300](https://gitlab.com/PlasticDigits/yieldomega/-/issues/300)). ## Acceptance checklist | Criterion | Command / step | Result | |-----------|----------------|--------| | Arena deploy no longer requires AdminSellVault | `cd contracts && forge test --match-contract DevStackIntegration` | PASS | | Buy routing tests still show 0% admin take | `cd contracts && forge test --match-test test_buy_routes_doub_split` | PASS | | Anvil stack scripts deploy without AdminSellVault | `bash scripts/verify-evm-dev-wallet-seed-anvil.sh` | PASS | | DeployDev succeeds on fresh Anvil | `SKIP_ANVIL_RICH_STATE=1 bash scripts/start-local-anvil-stack.sh --no-frontend` (stack up; registry omits AdminSellVault) | PASS | | Full contract suite | `cd contracts && forge test` (5 pre-existing `doub.csv` fork tests fail without gitignored CSV) | PASS (153/158) | | Frontend | `cd frontend && npm run typecheck && npm run lint && npm test` | PASS | | Indexer config | `cd indexer && cargo test config::` | PASS | ## Third-party verification ```bash cd contracts && forge test --match-contract "TimeArenaTest|DevStackIntegration" bash scripts/verify-evm-dev-wallet-seed-anvil.sh bash scripts/test-anvil-deploy-caller-scope.sh SKIP_ANVIL_RICH_STATE=1 bash scripts/start-local-anvil-stack.sh --no-frontend # Registry should list TimeArena, PodiumVaults, ReferralRegistry only: jq .contracts contracts/deployments/local-anvil-registry.json curl -sf http://127.0.0.1:3100/v1/status cd frontend && npm run typecheck && npm test ``` ## Follow-ups - Existing mainnet proxies that already deployed **`AdminSellVault`** can keep the legacy contract at its address; new deploys omit it entirely. Upgrade path: deploy new **`TimeArena`** implementation without reusing the reserved slot. <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Medium Risk** > Changes UUPS `TimeArena.initialize` and deploy wiring; reserved storage preserves upgrades but new proxies must not reuse the old slot. Buy economics unchanged but deploy/indexer/env contracts shift for all new stacks. > > **Overview** > **Removes `AdminSellVault` from the Arena v2 stack ([#314](https://gitlab.com/PlasticDigits/yieldomega/-/issues/314))** — deletes the contract and its Forge tests, drops it from **`DeployDev`**, **`DeployProduction`**, **`UUPSDeployLib`**, ABI export, and local Anvil registry JSON, and updates agent guardrails, deployment docs, invariants (**`INV-DEPLOY-314-*`**), and **`frontend/.env.example`** so **`VITE_ADMIN_SELL_VAULT_ADDRESS`** is no longer required. > > **`TimeArena`** no longer takes an admin vault in **`initialize`**; the old **`adminSellVault`** slot is kept as **`__reservedAdminSellVault`** for upgrade safety. Buy and top-up behavior stays **100% podiums / 0% admin take** ([#300](https://gitlab.com/PlasticDigits/yieldomega/-/issues/300)) — tests drop admin-vault balance assertions and rename surplus routing checks. > > **Anvil Kumbaya fixtures** send **`TimeArenaBuyRouter`** DOUB surplus to the **deployer** instead of **`AdminSellVault`**. Indexer production registry validation no longer requires an **`AdminSellVault`** key (legacy optional). > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 868a79120ca63a288fcd1fa53af72eede7897295. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY -->
project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-13 08:16:05 +00:00 (Migrated from gitlab.com)

changed the description

changed the description
project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-13 08:16:13 +00:00 (Migrated from gitlab.com)

changed the description

changed the description
project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-13 08:17:41 +00:00 (Migrated from gitlab.com)

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

Fix All in Cursor

Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue.

Reviewed by Cursor Bugbot for commit 7f6694d84f. Configure here.

<!-- BUGBOT_REVIEW --> Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue. <!-- BUGBOT_FIX_ALL --> <a href="https://cursor.com/open?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9BTExfSU5fQ1VSU09SIiwiZGF0YSI6eyJyZWRpc0tleSI6ImJ1Z2JvdC1tdWx0aTowYmFhNWQ0NS03MmFmLTQxNjItOTE4NC02YzRhNDA1YmQ2ZTAiLCJlbmNyeXB0aW9uS2V5IjoiWDhzWnRpY0Jfd3VudU5qSS03Q0l1TkFnc0tjM2EwTHJJSnBtUWRpNUp3YyIsImJyYW5jaCI6Imlzc3VlLTMxNC1yZW1vdmUtYWRtaW4tc2VsbC12YXVsdCIsInJlcG9Pd25lciI6IlBsYXN0aWNEaWdpdHMiLCJyZXBvTmFtZSI6InlpZWxkb21lZ2EifX0" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-cursor-light.png"><img alt="Fix All in Cursor" width="115" height="28" src="https://cursor.com/assets/images/fix-in-cursor-dark.png"></picture></a> <!-- /BUGBOT_FIX_ALL --> <!-- BUGBOT_AUTOFIX_REVIEW_FOOTNOTE_BEGIN --> <sup>Bugbot Autofix is [ON](https://www.cursor.com/dashboard/bugbot). A cloud agent has been kicked off to fix the reported issue. <!-- BUGBOT_AUTOFIX_AGENT_LINK --></sup> <!-- BUGBOT_AUTOFIX_REVIEW_FOOTNOTE_END --> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 7f6694d84fa63ce948650821b6d89be8e6f3b71d. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>
project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-13 08:17:42 +00:00 (Migrated from gitlab.com)

Wrong PodiumVaults registry address

Medium Severity

The committed PodiumVaults entry uses the former AdminSellVault proxy address while TimeArena and ReferralRegistry are unchanged from the prior registry. That mix cannot come from a single consistent DeployDev run after removing AdminSellVault, so consumers of this file without redeploying point at the wrong contract.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 7f6694d84f. Configure here.

### Wrong PodiumVaults registry address **Medium Severity** <!-- DESCRIPTION START --> The committed `PodiumVaults` entry uses the former `AdminSellVault` proxy address while `TimeArena` and `ReferralRegistry` are unchanged from the prior registry. That mix cannot come from a single consistent `DeployDev` run after removing `AdminSellVault`, so consumers of this file without redeploying point at the wrong contract. <!-- DESCRIPTION END --> <!-- BUGBOT_BUG_ID: aadc6f0f-d1f1-4b7d-815e-5d269d295101 --> <!-- LOCATIONS START contracts/deployments/local-anvil-registry.json#L5-L7 LOCATIONS END --> <div><a href="https://cursor.com/open?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9DVVJTT1IiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OmZiMzE2YTk1LTdlZmMtNDNjNy04YWU4LTg1NzVhMDJkYTA3MiIsImVuY3J5cHRpb25LZXkiOiIyc0NYQ2FPVXVmLUhrV3h1bVpXR01GclhZbDJwOVNtRHlQX25pWm05WUVFIiwiYnJhbmNoIjoiaXNzdWUtMzE0LXJlbW92ZS1hZG1pbi1zZWxsLXZhdWx0IiwicmVwb093bmVyIjoiUGxhc3RpY0RpZ2l0cyIsInJlcG9OYW1lIjoieWllbGRvbWVnYSJ9fQ" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-cursor-light.png"><img alt="Fix in Cursor" width="115" height="28" src="https://cursor.com/assets/images/fix-in-cursor-dark.png"></picture></a>&nbsp;<a href="https://cursor.com/agents?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9XRUIiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OmZiMzE2YTk1LTdlZmMtNDNjNy04YWU4LTg1NzVhMDJkYTA3MiIsImVuY3J5cHRpb25LZXkiOiIyc0NYQ2FPVXVmLUhrV3h1bVpXR01GclhZbDJwOVNtRHlQX25pWm05WUVFIiwiYnJhbmNoIjoiaXNzdWUtMzE0LXJlbW92ZS1hZG1pbi1zZWxsLXZhdWx0IiwicmVwb093bmVyIjoiUGxhc3RpY0RpZ2l0cyIsInJlcG9OYW1lIjoieWllbGRvbWVnYSIsInByTnVtYmVyIjo5NCwiY29tbWl0U2hhIjoiN2Y2Njk0ZDg0ZmE2M2NlOTQ4NjUwODIxYjZkODliZThlNmYzYjcxZCIsInByb3ZpZGVyIjoiZ2l0bGFiIiwiaG9zdG5hbWUiOiJnaXRsYWIuY29tIn19" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-web-light.png"><img alt="Fix in Web" width="99" height="28" src="https://cursor.com/assets/images/fix-in-web-dark.png"></picture></a></div> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 7f6694d84fa63ce948650821b6d89be8e6f3b71d. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>
PlasticDigits commented 2026-06-13 08:18:27 +00:00 (Migrated from gitlab.com)

Security review — MR !464

Commit reviewed: 7f6694d84fa63ce948650821b6d89be8e6f3b71d
Scope: Remove AdminSellVault from arena deploy path — TimeArena.initialize / UUPS storage, deploy scripts (DeployDev, DeployProduction, UUPSDeployLib, Kumbaya Anvil fixtures), indexer production registry validation, frontend env/ABI, and Anvil stack wiring.

Outcome: FINDINGS: 0 medium+

Prior security threads: None on this MR; no re-reports.

Summary

Reviewed added/modified paths for authz bypasses, value-routing regressions, UUPS storage corruption, injection/SSRF/XSS, and offchain misconfiguration that could enable fund loss or auth bypass.

Area Result
DOUB buy routing (ArenaBuyRouting → _routeDoubPrizeSplit) Unchanged — 100% to PodiumVaults; no AdminSellVault / admin-fee sink in buy or top-up paths
UUPS storage (__reservedAdminSellVault) Former adminSellVault slot preserved as address; layout-compatible for existing proxies; initialize ABI change affects new proxies only (initializer still one-shot)
AdminSellVault.sol removal Contract deleted from deploy; legacy on-chain instances (if any) remain independent Ownable contracts — not weakened by this diff
TimeArenaBuyRouter dust Router unchanged; Anvil fixture sets doubSurplusRecipient to deployer (dev-only, known key) instead of removed vault — no production authz change
Indexer (config.rs) AdminSellVault dropped from mandatory production validation; optional key still ingested when non-empty for historical logs — no attacker-controlled registry path to bypass auth or move funds
Frontend / scripts Env/registry cleanup only; no new user-controlled sinks

No plausible attacker-controlled path to steal DOUB, bypass onlyOwner / buyFor router gate, corrupt prize routing, or exploit the reserved storage slot on this diff.

Inline findings: None (no block:security label).

## Security review — MR !464 **Commit reviewed:** `7f6694d84fa63ce948650821b6d89be8e6f3b71d` **Scope:** Remove `AdminSellVault` from arena deploy path — `TimeArena.initialize` / UUPS storage, deploy scripts (`DeployDev`, `DeployProduction`, `UUPSDeployLib`, Kumbaya Anvil fixtures), indexer production registry validation, frontend env/ABI, and Anvil stack wiring. **Outcome:** `FINDINGS: 0` medium+ **Prior security threads:** None on this MR; no re-reports. ### Summary Reviewed added/modified paths for authz bypasses, value-routing regressions, UUPS storage corruption, injection/SSRF/XSS, and offchain misconfiguration that could enable fund loss or auth bypass. | Area | Result | |------|--------| | **DOUB buy routing** (`ArenaBuyRouting` → `_routeDoubPrizeSplit`) | Unchanged — 100% to `PodiumVaults`; no `AdminSellVault` / admin-fee sink in buy or top-up paths | | **UUPS storage** (`__reservedAdminSellVault`) | Former `adminSellVault` slot preserved as `address`; layout-compatible for existing proxies; `initialize` ABI change affects new proxies only (`initializer` still one-shot) | | **`AdminSellVault.sol` removal** | Contract deleted from deploy; legacy on-chain instances (if any) remain independent `Ownable` contracts — not weakened by this diff | | **`TimeArenaBuyRouter` dust** | Router unchanged; Anvil fixture sets `doubSurplusRecipient` to deployer (dev-only, known key) instead of removed vault — no production authz change | | **Indexer** (`config.rs`) | `AdminSellVault` dropped from mandatory production validation; optional key still ingested when non-empty for historical logs — no attacker-controlled registry path to bypass auth or move funds | | **Frontend / scripts** | Env/registry cleanup only; no new user-controlled sinks | No plausible attacker-controlled path to steal DOUB, bypass `onlyOwner` / `buyFor` router gate, corrupt prize routing, or exploit the reserved storage slot on this diff. **Inline findings:** None (no `block:security` label).
PlasticDigits commented 2026-06-13 09:39:20 +00:00 (Migrated from gitlab.com)

added 16 commits

  • 7f6694d8...a4660ac6 - 15 commits from branch main
  • 868a7912 - Merge origin/main into issue-314-remove-admin-sell-vault

Compare with previous version

added 16 commits <ul><li>7f6694d8...a4660ac6 - 15 commits from branch <code>main</code></li><li>868a7912 - Merge origin/main into issue-314-remove-admin-sell-vault</li></ul> [Compare with previous version](/PlasticDigits/yieldomega/-/merge_requests/94/diffs?diff_id=1850264111&start_sha=7f6694d84fa63ce948650821b6d89be8e6f3b71d)
PlasticDigits commented 2026-06-13 09:39:23 +00:00 (Migrated from gitlab.com)

Resolved merge conflicts with main:

  • docs/testing/invariants-and-business-logic.md — kept #314 zero-admin / no AdminSellVault deploy wording; adopted main's #313 Last Buy remainder + fuzz evidence on INV-ARENA-PRIZE-ROUTING-300-25PCT.
  • skills/play-time-arena-doub/SKILL.md — combined #313 category remainder routing with #314 AdminSellVault retirement (dropped legacy sellDoubToUsdm bullet).
  • contracts/test/NonStandardERC20.t.sol — updated TimeArena.initialize wiring after main landed #316 without admin vault.

Sanity: DevStackIntegration, test_buy_routes_doub_split, NonStandardERC20 — PASS.

Resolved merge conflicts with `main`: - **`docs/testing/invariants-and-business-logic.md`** — kept #314 zero-admin / no `AdminSellVault` deploy wording; adopted main's #313 Last Buy remainder + fuzz evidence on `INV-ARENA-PRIZE-ROUTING-300-25PCT`. - **`skills/play-time-arena-doub/SKILL.md`** — combined #313 category remainder routing with #314 `AdminSellVault` retirement (dropped legacy `sellDoubToUsdm` bullet). - **`contracts/test/NonStandardERC20.t.sol`** — updated `TimeArena.initialize` wiring after main landed #316 without admin vault. Sanity: `DevStackIntegration`, `test_buy_routes_doub_split`, `NonStandardERC20` — PASS.
project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-13 09:39:37 +00:00 (Migrated from gitlab.com)

resolved all threads

resolved all threads
project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-13 09:39:38 +00:00 (Migrated from gitlab.com)

changed the description

changed the description
PlasticDigits commented 2026-06-13 09:41:51 +00:00 (Migrated from gitlab.com)

Security review — MR !464

Commit reviewed: 868a79120ca63a288fcd1fa53af72eede7897295
Scope: Remove AdminSellVault from arena deploy path — TimeArena.initialize / UUPS reserved storage, deploy scripts (DeployDev, DeployProduction, UUPSDeployLib, Kumbaya Anvil fixtures), indexer production registry validation, frontend env/ABI, and Anvil stack wiring. Re-reviewed after merge-conflict resolution with main (invariants #313, NonStandardERC20.t.sol).

Outcome: FINDINGS: 0 medium+

Prior security threads: Prior review on 7f6694d (0 findings) — re-validated on current HEAD; no re-reports.

Summary

Reviewed added/modified paths for authz bypasses, value-routing regressions, UUPS storage corruption, injection/SSRF/XSS, and offchain misconfiguration that could enable fund loss or auth bypass.

Area Result
DOUB buy routing (ArenaBuyRouting → _routeDoubPrizeSplit) Unchanged — 100% to PodiumVaults; no admin-fee sink in buy or top-up paths
UUPS storage (__reservedAdminSellVault) Former adminSellVault slot preserved as address; layout-compatible for existing proxies; initialize ABI change affects new proxies only (initializer still one-shot)
AdminSellVault.sol removal Contract deleted from deploy path; legacy on-chain instances (if any) remain independent Ownable contracts — not weakened by this diff
TimeArenaBuyRouter dust Router unchanged; Anvil fixture sets doubSurplusRecipient to deployer (dev-only, known key) instead of removed vault — no production authz change
Indexer (config.rs) AdminSellVault dropped from mandatory production validation; optional key still ingested when non-empty for historical logs — registry is operator-controlled, not attacker input
Frontend / scripts Env/registry cleanup only; no new user-controlled sinks

No plausible attacker-controlled path to steal DOUB, bypass onlyOwner / buyFor router gate, corrupt prize routing, or exploit the reserved storage slot on this diff.

Inline findings: None (no block:security label).

## Security review — MR !464 **Commit reviewed:** `868a79120ca63a288fcd1fa53af72eede7897295` **Scope:** Remove `AdminSellVault` from arena deploy path — `TimeArena.initialize` / UUPS reserved storage, deploy scripts (`DeployDev`, `DeployProduction`, `UUPSDeployLib`, Kumbaya Anvil fixtures), indexer production registry validation, frontend env/ABI, and Anvil stack wiring. Re-reviewed after merge-conflict resolution with `main` (invariants #313, `NonStandardERC20.t.sol`). **Outcome:** `FINDINGS: 0` medium+ **Prior security threads:** Prior review on `7f6694d` (0 findings) — re-validated on current HEAD; no re-reports. ### Summary Reviewed added/modified paths for authz bypasses, value-routing regressions, UUPS storage corruption, injection/SSRF/XSS, and offchain misconfiguration that could enable fund loss or auth bypass. | Area | Result | |------|--------| | **DOUB buy routing** (`ArenaBuyRouting` → `_routeDoubPrizeSplit`) | Unchanged — 100% to `PodiumVaults`; no admin-fee sink in buy or top-up paths | | **UUPS storage** (`__reservedAdminSellVault`) | Former `adminSellVault` slot preserved as `address`; layout-compatible for existing proxies; `initialize` ABI change affects new proxies only (`initializer` still one-shot) | | **`AdminSellVault.sol` removal** | Contract deleted from deploy path; legacy on-chain instances (if any) remain independent `Ownable` contracts — not weakened by this diff | | **`TimeArenaBuyRouter` dust** | Router unchanged; Anvil fixture sets `doubSurplusRecipient` to deployer (dev-only, known key) instead of removed vault — no production authz change | | **Indexer** (`config.rs`) | `AdminSellVault` dropped from mandatory production validation; optional key still ingested when non-empty for historical logs — registry is operator-controlled, not attacker input | | **Frontend / scripts** | Env/registry cleanup only; no new user-controlled sinks | No plausible attacker-controlled path to steal DOUB, bypass `onlyOwner` / `buyFor` router gate, corrupt prize routing, or exploit the reserved storage slot on this diff. **Inline findings:** None (no `block:security` label).
PlasticDigits commented 2026-06-13 10:01:09 +00:00 (Migrated from gitlab.com)

mentioned in commit 1a7b8ed5d0

mentioned in commit 1a7b8ed5d097c10936c645a219d1b00f7bf44405
PlasticDigits (Migrated from gitlab.com) merged commit 1a7b8ed5d0 into main 2026-06-13 10:01:09 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
agent:fix_bugfix

   
agent:fix_conflicts

   
agent:fix_security

   
agent:gap_analysis

   
agent:implement

   
agent:open_issues

   
agents

   
agent:security_audit

   
agent:verify
  
area
timecurve

  
arena

   
arena-v2

   
audit

   
block:feature_review

   
block:security

   
bug

   
contracts

   
design

   
devops

   
docs
Documentation

  
documentation

   
enhancement

   
epic
Epic / umbrella issue

  
feature

   
frontend

   
indexer

   
low priority
Low priority, investigate other issues first

  
megaeth

   
operations

   
ops
Deploy and operations

  
performance

   
QA

   
qa checklist

   
referrals

   
removal
Legacy removal

  
security

   
smart-contracts

   
tech-debt

   
testing

   
time-arena
TimeArena v2 revamp

  
timecurve

   
visual-qa
No labels
agent:fix_bugfix
agent:fix_conflicts
agent:fix_security
agent:gap_analysis
agent:implement
agent:open_issues
agents
agent:security_audit
agent:verify
area
timecurve
arena
arena-v2
audit
block:feature_review
block:security
bug
contracts
design
devops
docs
documentation
enhancement
epic
feature
frontend
indexer
low priority
megaeth
operations
ops
performance
QA
qa checklist
referrals
removal
security
smart-contracts
tech-debt
testing
time-arena
timecurve
visual-qa
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
code/yieldomega!464
No description provided.