code/yieldomega
Watch
4
0
Fork
You've already forked yieldomega
 0
Code Issues 1 Pull requests 1 Projects Releases Packages Wiki Activity

Wire WarBow ambush/streak-break BP and route WarBow DOUB like buys (#310) #465

Merged
PlasticDigits merged 3 commits from issue-310-warbow-bp-routing into main 2026-06-13 14:09:21 +00:00
Conversation 13 Commits 3 Files changed 6 +157 -23
PlasticDigits commented 2026-06-13 10:19:32 +00:00 (Migrated from gitlab.com)

Summary

Implements GitLab #310 — economic parity for WarBow:

  1. BP wiring — _applyBuyWarBowBp now awards streak-break (prior active defended streak × 100 BP when a different buyer buys under DEFENDED_STREAK_WINDOW_SEC) and ambush (+200 BP on hard reset + streak break), using defended-streak state captured before _processDefendedStreak (matches warbow_buy_bp_delta in simulations/timecurve_sim/model.py).
  2. DOUB routing — warbowSteal, warbowRevenge, and warbowActivateGuard route pulled DOUB through _routeDoubPrizeSplit and increment totalDoubRaised, same as buy (#300). No DOUB stranded on TimeArena.

Docs: PARAMETERS.md, arena-v2.md, invariants §310, play-time-arena-warbow skill.

Acceptance checklist

Criterion Verification Result
Ambush and streak-break BP on qualifying buys cd contracts && forge test --match-test "test_warbow_streak_break_bp|test_warbow_ambush" PASS
WarBow DOUB increments totalDoubRaised and lands in podium vaults cd contracts && forge test --match-test "test_warbow_steal_pulls_doub|test_warbow_guard_pulls_doub|test_warbow_revenge_pulls_doub|test_warbow_steal_routes_doub_split" PASS
No DOUB stranded on TimeArena after WarBow actions Same tests assert doub.balanceOf(arena) unchanged / vault delta equals spend PASS
PARAMETERS.md and progression docs updated Review diff in PARAMETERS.md, arena-v2.md, invariants-and-business-logic.md, skills/play-time-arena-warbow/SKILL.md PASS
Full TimeArena suite cd contracts && forge test --match-contract TimeArena PASS (100 tests)
Full contracts suite (excl. fork CSV) cd contracts && forge test PASS (160 pass; 5 doub.csv fork tests SKIP — file absent)
Anvil podium verify (routing / indexer path) bash scripts/verify-podium-live-anvil.sh SKIP — on-chain routing only; no indexer schema change; PodiumEpochFunded already indexed from any TimeArena tx

Third-party verification

export PATH="$HOME/.foundry/bin:$PATH"
cd contracts
forge test --match-contract TimeArena
forge test --match-test "test_warbow_streak_break_bp|test_warbow_ambush|test_warbow_steal_routes"

Confirm in TimeArena.sol:

  • _applyBuyWarBowBp adds streak-break / ambush when prevDsBuyer != buyer under the defended-streak window.
  • _routeWarbowDoubSpend calls _routeDoubPrizeSplit + totalDoubRaised += amount from steal/guard/revenge paths.

Related: #309 (gap analysis), #300 (100% podium routing), #252 (WarBow PvP).

Note

Medium Risk
Changes WarBow prize inflows and buy-path BP scoring on TimeArena, affecting podium funding and leaderboard outcomes; covered by targeted Forge tests but not a trivial doc-only change.

Overview
Implements GitLab #310 — WarBow economic and scoring parity with buys and the warbow_buy_bp_delta simulation.

DOUB routing: warbowSteal, warbowRevenge, and warbowActivateGuard call new _routeWarbowDoubSpend, which runs _routeDoubPrizeSplit and bumps totalDoubRaised — same 100% podium path as buy (#300). Steal-limit bypass DOUB is included in the routed total. DOUB no longer accumulates on TimeArena.

Buy-path BP: _applyBuyWarBowBp now takes defended-streak state before _processDefendedStreak. When another buyer purchases under DEFENDED_STREAK_WINDOW_SEC, it awards streak-break BP (prior active streak × 100) and ambush (+200 BP on hard reset + streak break). _processDefendedStreak also clears the prior under-window buyer’s streak when remaining time is above the window.

Docs (PARAMETERS.md, arena-v2.md, invariants §310, play skill) and TimeArena.t.sol tests are updated for vault routing and BP cases.

Reviewed by Cursor Bugbot for commit 28fbbba370. Bugbot is set up for automated code reviews on this repo. Configure here.

## Summary Implements GitLab #310 — economic parity for WarBow: 1. **BP wiring** — `_applyBuyWarBowBp` now awards **streak-break** (`prior active defended streak × 100 BP` when a different buyer buys under `DEFENDED_STREAK_WINDOW_SEC`) and **ambush** (+200 BP on hard reset + streak break), using defended-streak state captured before `_processDefendedStreak` (matches `warbow_buy_bp_delta` in `simulations/timecurve_sim/model.py`). 2. **DOUB routing** — `warbowSteal`, `warbowRevenge`, and `warbowActivateGuard` route pulled DOUB through `_routeDoubPrizeSplit` and increment `totalDoubRaised`, same as `buy` (#300). No DOUB stranded on `TimeArena`. Docs: `PARAMETERS.md`, `arena-v2.md`, invariants §310, `play-time-arena-warbow` skill. ## Acceptance checklist | Criterion | Verification | Result | |-----------|--------------|--------| | Ambush and streak-break BP on qualifying buys | `cd contracts && forge test --match-test "test_warbow_streak_break_bp\|test_warbow_ambush"` | PASS | | WarBow DOUB increments `totalDoubRaised` and lands in podium vaults | `cd contracts && forge test --match-test "test_warbow_steal_pulls_doub\|test_warbow_guard_pulls_doub\|test_warbow_revenge_pulls_doub\|test_warbow_steal_routes_doub_split"` | PASS | | No DOUB stranded on `TimeArena` after WarBow actions | Same tests assert `doub.balanceOf(arena)` unchanged / vault delta equals spend | PASS | | `PARAMETERS.md` and progression docs updated | Review diff in `PARAMETERS.md`, `arena-v2.md`, `invariants-and-business-logic.md`, `skills/play-time-arena-warbow/SKILL.md` | PASS | | Full `TimeArena` suite | `cd contracts && forge test --match-contract TimeArena` | PASS (100 tests) | | Full contracts suite (excl. fork CSV) | `cd contracts && forge test` | PASS (160 pass; 5 `doub.csv` fork tests SKIP — file absent) | | Anvil podium verify (routing / indexer path) | `bash scripts/verify-podium-live-anvil.sh` | SKIP — on-chain routing only; no indexer schema change; `PodiumEpochFunded` already indexed from any `TimeArena` tx | ## Third-party verification ```bash export PATH="$HOME/.foundry/bin:$PATH" cd contracts forge test --match-contract TimeArena forge test --match-test "test_warbow_streak_break_bp|test_warbow_ambush|test_warbow_steal_routes" ``` Confirm in `TimeArena.sol`: - `_applyBuyWarBowBp` adds streak-break / ambush when `prevDsBuyer != buyer` under the defended-streak window. - `_routeWarbowDoubSpend` calls `_routeDoubPrizeSplit` + `totalDoubRaised += amount` from steal/guard/revenge paths. Related: #309 (gap analysis), #300 (100% podium routing), #252 (WarBow PvP). <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Medium Risk** > Changes WarBow prize inflows and buy-path BP scoring on `TimeArena`, affecting podium funding and leaderboard outcomes; covered by targeted Forge tests but not a trivial doc-only change. > > **Overview** > Implements GitLab **#310** — WarBow **economic and scoring parity** with buys and the `warbow_buy_bp_delta` simulation. > > **DOUB routing:** `warbowSteal`, `warbowRevenge`, and `warbowActivateGuard` call new **`_routeWarbowDoubSpend`**, which runs **`_routeDoubPrizeSplit`** and bumps **`totalDoubRaised`** — same **100% podium** path as **`buy`** ([#300](https://gitlab.com/PlasticDigits/yieldomega/-/issues/300)). Steal-limit bypass DOUB is included in the routed total. DOUB no longer accumulates on **`TimeArena`**. > > **Buy-path BP:** **`_applyBuyWarBowBp`** now takes defended-streak state **before** **`_processDefendedStreak`**. When another buyer purchases under **`DEFENDED_STREAK_WINDOW_SEC`**, it awards **streak-break** BP (`prior active streak × 100`) and **ambush** (+200 BP on hard reset + streak break). **`_processDefendedStreak`** also clears the prior under-window buyer’s streak when remaining time is above the window. > > Docs (`PARAMETERS.md`, `arena-v2.md`, invariants §310, play skill) and **`TimeArena.t.sol`** tests are updated for vault routing and BP cases. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 28fbbba37045376e6af1aac1cc6700db0c483a28. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY -->
project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-13 10:19:41 +00:00 (Migrated from gitlab.com)

changed the description

changed the description
project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-13 10:19:49 +00:00 (Migrated from gitlab.com)

changed the description

changed the description
project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-13 10:21:29 +00:00 (Migrated from gitlab.com)

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

Fix All in Cursor

Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue.

Reviewed by Cursor Bugbot for commit cec216b8b6. Configure here.

<!-- BUGBOT_REVIEW --> Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue. <!-- BUGBOT_FIX_ALL --> <a href="https://cursor.com/open?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9BTExfSU5fQ1VSU09SIiwiZGF0YSI6eyJyZWRpc0tleSI6ImJ1Z2JvdC1tdWx0aTpkNjkwMjU2Yy1jYWJlLTRkNjItOTFhMS03ODA3YjM4YzkzYmQiLCJlbmNyeXB0aW9uS2V5IjoiZE1EZHRnWWl6NXhnNHlRUnNZVldmbGdnTnBMNGl3cWhMZlBwU1VPSDR0MCIsImJyYW5jaCI6Imlzc3VlLTMxMC13YXJib3ctYnAtcm91dGluZyIsInJlcG9Pd25lciI6IlBsYXN0aWNEaWdpdHMiLCJyZXBvTmFtZSI6InlpZWxkb21lZ2EifX0" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-cursor-light.png"><img alt="Fix All in Cursor" width="115" height="28" src="https://cursor.com/assets/images/fix-in-cursor-dark.png"></picture></a> <!-- /BUGBOT_FIX_ALL --> <!-- BUGBOT_AUTOFIX_REVIEW_FOOTNOTE_BEGIN --> <sup>Bugbot Autofix is [ON](https://www.cursor.com/dashboard/bugbot). A cloud agent has been kicked off to fix the reported issue. <!-- BUGBOT_AUTOFIX_AGENT_LINK --></sup> <!-- BUGBOT_AUTOFIX_REVIEW_FOOTNOTE_END --> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit cec216b8b6cdb0e5db2081a0aa405398a893464b. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>
project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-13 10:21:30 +00:00 (Migrated from gitlab.com)

Stale streak-break after window

Medium Severity

Streak-break WarBow BP reads activeDefendedStreak for _dsLastUnderWindowBuyer before _processDefendedStreak, but on-chain streak state is not cleared when a later buy happens with Last Buy remaining at or above DEFENDED_STREAK_WINDOW_SEC. The sim clears that defender in process_defended_streak_sim, so a subsequent under-window buy from another wallet can award streak-break and ambush BP that warbow_buy_bp_delta would not.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit cec216b8b6. Configure here.

### Stale streak-break after window **Medium Severity** <!-- DESCRIPTION START --> Streak-break WarBow BP reads `activeDefendedStreak` for `_dsLastUnderWindowBuyer` before `_processDefendedStreak`, but on-chain streak state is not cleared when a later buy happens with Last Buy remaining at or above `DEFENDED_STREAK_WINDOW_SEC`. The sim clears that defender in `process_defended_streak_sim`, so a subsequent under-window buy from another wallet can award streak-break and ambush BP that `warbow_buy_bp_delta` would not. <!-- DESCRIPTION END --> <!-- BUGBOT_BUG_ID: 3932b68a-3f60-4cf3-9e52-e6ed104ff70f --> <!-- LOCATIONS START contracts/src/arena/TimeArena.sol#L629-L739 LOCATIONS END --> <div><a href="https://cursor.com/open?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9DVVJTT1IiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OmU3NTMwNjQ3LWYxMTItNGNhNy1iY2I5LTZmYjJhZDE3YTljZSIsImVuY3J5cHRpb25LZXkiOiJNSm9LQ3hRbmVJTEJDX1YwY0RSZC1Ba21Zc3FuaVBfV05xM1RwOHRPRTVVIiwiYnJhbmNoIjoiaXNzdWUtMzEwLXdhcmJvdy1icC1yb3V0aW5nIiwicmVwb093bmVyIjoiUGxhc3RpY0RpZ2l0cyIsInJlcG9OYW1lIjoieWllbGRvbWVnYSJ9fQ" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-cursor-light.png"><img alt="Fix in Cursor" width="115" height="28" src="https://cursor.com/assets/images/fix-in-cursor-dark.png"></picture></a>&nbsp;<a href="https://cursor.com/agents?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9XRUIiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OmU3NTMwNjQ3LWYxMTItNGNhNy1iY2I5LTZmYjJhZDE3YTljZSIsImVuY3J5cHRpb25LZXkiOiJNSm9LQ3hRbmVJTEJDX1YwY0RSZC1Ba21Zc3FuaVBfV05xM1RwOHRPRTVVIiwiYnJhbmNoIjoiaXNzdWUtMzEwLXdhcmJvdy1icC1yb3V0aW5nIiwicmVwb093bmVyIjoiUGxhc3RpY0RpZ2l0cyIsInJlcG9OYW1lIjoieWllbGRvbWVnYSIsInByTnVtYmVyIjo5NSwiY29tbWl0U2hhIjoiY2VjMjE2YjhiNmNkYjBlNWRiMjA4MWEwYWE0MDUzOThhODkzNDY0YiIsInByb3ZpZGVyIjoiZ2l0bGFiIiwiaG9zdG5hbWUiOiJnaXRsYWIuY29tIn19" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-web-light.png"><img alt="Fix in Web" width="99" height="28" src="https://cursor.com/assets/images/fix-in-web-dark.png"></picture></a></div> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit cec216b8b6cdb0e5db2081a0aa405398a893464b. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>
project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-13 10:24:12 +00:00 (Migrated from gitlab.com)

added 1 commit

  • daf39b30 - fix(arena): clear stale defended streak after window expires

Compare with previous version

added 1 commit <ul><li>daf39b30 - fix(arena): clear stale defended streak after window expires</li></ul> [Compare with previous version](/PlasticDigits/yieldomega/-/merge_requests/95/diffs?diff_id=1850277766&start_sha=cec216b8b6cdb0e5db2081a0aa405398a893464b)
PlasticDigits commented 2026-06-13 10:24:26 +00:00 (Migrated from gitlab.com)

Security review — MR !465

Commit reviewed: cec216b8b6cdb0e5db2081a0aa405398a893464b
Scope: TimeArena.sol WarBow DOUB routing (_routeWarbowDoubSpend) + buy-path streak-break/ambush BP (_applyBuyWarBowBp); associated tests and docs.

Method

  • Diff and call-path trace for warbowSteal, warbowRevenge, warbowActivateGuard, and _finishBuy → _applyBuyWarBowBp.
  • Checked attacker-controlled inputs against sinks: token pulls, external safeTransfer / notifyPodiumEpochFunded, totalDoubRaised, and _addBattlePoints.
  • Verified existing controls: nonReentrant on all WarBow externals and buys, require(received == expected) on _pullDoubExact, msg.sender == arena on PodiumVaults notify paths, steal-band / revenge-window / level gates unchanged.
  • Compared BP logic to simulations/timecurve_sim/model.py::warbow_buy_bp_delta (ordering and conditions align).

Outcome

FINDINGS: 0 medium+

No inline threads — nothing met the reporting bar.

Notes (below threshold / not introduced here)

  • WarBow DOUB routing before steal-band check: _routeWarbowDoubSpend runs before require(abp > 0 && vbp >= 2 * abp …). A failing band still reverts the whole transaction (including transferFrom and vault transfers); no partial fund movement.
  • totalDoubRaised on WarBow spends: Accounting/display metric only; podium payouts use doub.balanceOf(pool), not this counter. Intended parity with buy (#300 / #310).
  • Streak-break / ambush BP: Requires remainingBefore < DEFENDED_STREAK_WINDOW_SEC, prevDsBuyer != buyer, and prevDsStreak > 0; state is snapshotted before _processDefendedStreak as specified. CRED-path BP parity is pre-existing product design, not new auth bypass.
  • Offchain: Indexer warbow_buy_bp replay omits new bonuses — display drift only; out of scope for onchain security on this diff.

Security review: no medium+ findings on this diff.

## Security review — MR !465 **Commit reviewed:** `cec216b8b6cdb0e5db2081a0aa405398a893464b` **Scope:** `TimeArena.sol` WarBow DOUB routing (`_routeWarbowDoubSpend`) + buy-path streak-break/ambush BP (`_applyBuyWarBowBp`); associated tests and docs. ### Method - Diff and call-path trace for `warbowSteal`, `warbowRevenge`, `warbowActivateGuard`, and `_finishBuy` → `_applyBuyWarBowBp`. - Checked attacker-controlled inputs against sinks: token pulls, external `safeTransfer` / `notifyPodiumEpochFunded`, `totalDoubRaised`, and `_addBattlePoints`. - Verified existing controls: `nonReentrant` on all WarBow externals and buys, `require(received == expected)` on `_pullDoubExact`, `msg.sender == arena` on `PodiumVaults` notify paths, steal-band / revenge-window / level gates unchanged. - Compared BP logic to `simulations/timecurve_sim/model.py::warbow_buy_bp_delta` (ordering and conditions align). ### Outcome **FINDINGS: 0** medium+ No inline threads — nothing met the reporting bar. ### Notes (below threshold / not introduced here) - **WarBow DOUB routing before steal-band check:** `_routeWarbowDoubSpend` runs before `require(abp > 0 && vbp >= 2 * abp …)`. A failing band still reverts the whole transaction (including `transferFrom` and vault transfers); no partial fund movement. - **`totalDoubRaised` on WarBow spends:** Accounting/display metric only; podium payouts use `doub.balanceOf(pool)`, not this counter. Intended parity with `buy` (#300 / #310). - **Streak-break / ambush BP:** Requires `remainingBefore < DEFENDED_STREAK_WINDOW_SEC`, `prevDsBuyer != buyer`, and `prevDsStreak > 0`; state is snapshotted before `_processDefendedStreak` as specified. CRED-path BP parity is pre-existing product design, not new auth bypass. - **Offchain:** Indexer `warbow_buy_bp` replay omits new bonuses — display drift only; out of scope for onchain security on this diff. **Security review: no medium+ findings on this diff.**
project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-13 10:24:27 +00:00 (Migrated from gitlab.com)

changed the description

changed the description
project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-13 10:24:40 +00:00 (Migrated from gitlab.com)

resolved all threads

resolved all threads
PlasticDigits commented 2026-06-13 12:58:34 +00:00 (Migrated from gitlab.com)

added 22 commits

  • daf39b30...1a7b8ed5 - 21 commits from branch main
  • 28fbbba3 - Merge origin/main into issue-310-warbow-bp-routing

Compare with previous version

added 22 commits <ul><li>daf39b30...1a7b8ed5 - 21 commits from branch <code>main</code></li><li>28fbbba3 - Merge origin/main into issue-310-warbow-bp-routing</li></ul> [Compare with previous version](/PlasticDigits/yieldomega/-/merge_requests/95/diffs?diff_id=1850325014&start_sha=daf39b309984c5f1a0c8b2897854d516b4307009)
PlasticDigits commented 2026-06-13 12:58:38 +00:00 (Migrated from gitlab.com)

Resolved merge conflicts with main:

  • TimeArena.sol: Kept #310 WarBow streak-break/ambush BP (prevDsBuyer / prevDsStreak before _processDefendedStreak), _routeWarbowDoubSpend on steal/guard/revenge, and stale defended-streak clear. Integrated main changes: AdminSellVault removal (#314), batch podium vault routing (#316), cred-buy epoch pool accrual (#311), and related API/view updates.
  • TimeArena.t.sol: Rebased warbow routing assertions and #310 streak/ambush tests onto main’s test harness (no AdminSellVault).

Sanity: forge test --match-contract TimeArena — 121 passed.

Resolved merge conflicts with `main`: - **`TimeArena.sol`**: Kept #310 WarBow streak-break/ambush BP (`prevDsBuyer` / `prevDsStreak` before `_processDefendedStreak`), `_routeWarbowDoubSpend` on steal/guard/revenge, and stale defended-streak clear. Integrated main changes: AdminSellVault removal (#314), batch podium vault routing (#316), cred-buy epoch pool accrual (#311), and related API/view updates. - **`TimeArena.t.sol`**: Rebased warbow routing assertions and #310 streak/ambush tests onto main’s test harness (no `AdminSellVault`). Sanity: `forge test --match-contract TimeArena` — 121 passed.
project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-13 12:58:53 +00:00 (Migrated from gitlab.com)

changed the description

changed the description
PlasticDigits commented 2026-06-13 13:05:15 +00:00 (Migrated from gitlab.com)

Security review — MR !465

Commit reviewed: 28fbbba37045376e6af1aac1cc6700db0c483a28
Scope: TimeArena.sol WarBow DOUB routing (_routeWarbowDoubSpend → _routeDoubPrizeSplit + totalDoubRaised), buy-path streak-break/ambush BP (_applyBuyWarBowBp + defended-streak snapshot/clear), merge with main (#314/#316 batch vault routing, #311 cred epoch pool). Tests/docs in diff reviewed for exploit paths only.

Method

  • Traced attacker-controlled inputs (msg.sender, victim, payBypassBurn, buy timing) to sinks: _pullDoubExact, _routeDoubPrizeSplit / safeTransfer, notifyPodiumEpochFunded, totalDoubRaised, _addBattlePoints.
  • Verified controls: nonReentrant on all WarBow externals and buys; require(received == expected) on pulls; PodiumVaults notify paths require msg.sender == arena; steal-band / revenge-window / level gates unchanged; Solidity revert atomicity on steal-band failure after routing.
  • Re-checked prior Bugbot stale streak-break thread: fix at daf39b30 (clear _dsLastUnderWindowBuyer / activeDefendedStreak when remainingBefore >= DEFENDED_STREAK_WINDOW_SEC) is present post-merge; aligns with process_defended_streak_sim.
  • Compared _applyBuyWarBowBp ordering/conditions to simulations/timecurve_sim/model.py::warbow_buy_bp_delta.
  • Ran targeted tests: forge test --match-test "test_warbow_streak_break_bp|test_warbow_ambush|test_warbow_steal_routes" — PASS.

Outcome

FINDINGS: 0 medium+

No inline threads — nothing met the reporting bar on this diff.

Notes (below threshold / not introduced here)

  • DOUB routed before steal-band check: whole tx reverts on band failure; no partial fund movement.
  • totalDoubRaised on WarBow spends: display/event metric only; payouts use doub.balanceOf(pool), not this counter. Intended #300/#310 parity.
  • CRED buys earning WarBow BP (incl. new bonuses): pre-existing progression design; not an auth bypass introduced by this MR.
  • Indexer warbow_buy_bp replay: omits new bonuses — offchain display drift only.

Security review: no medium+ findings on this diff.

## Security review — MR !465 **Commit reviewed:** `28fbbba37045376e6af1aac1cc6700db0c483a28` **Scope:** `TimeArena.sol` WarBow DOUB routing (`_routeWarbowDoubSpend` → `_routeDoubPrizeSplit` + `totalDoubRaised`), buy-path streak-break/ambush BP (`_applyBuyWarBowBp` + defended-streak snapshot/clear), merge with `main` (#314/#316 batch vault routing, #311 cred epoch pool). Tests/docs in diff reviewed for exploit paths only. ### Method - Traced attacker-controlled inputs (`msg.sender`, `victim`, `payBypassBurn`, buy timing) to sinks: `_pullDoubExact`, `_routeDoubPrizeSplit` / `safeTransfer`, `notifyPodiumEpochFunded`, `totalDoubRaised`, `_addBattlePoints`. - Verified controls: `nonReentrant` on all WarBow externals and buys; `require(received == expected)` on pulls; `PodiumVaults` notify paths require `msg.sender == arena`; steal-band / revenge-window / level gates unchanged; Solidity revert atomicity on steal-band failure after routing. - Re-checked prior Bugbot **stale streak-break** thread: fix at `daf39b30` (clear `_dsLastUnderWindowBuyer` / `activeDefendedStreak` when `remainingBefore >= DEFENDED_STREAK_WINDOW_SEC`) is present post-merge; aligns with `process_defended_streak_sim`. - Compared `_applyBuyWarBowBp` ordering/conditions to `simulations/timecurve_sim/model.py::warbow_buy_bp_delta`. - Ran targeted tests: `forge test --match-test "test_warbow_streak_break_bp|test_warbow_ambush|test_warbow_steal_routes"` — PASS. ### Outcome **FINDINGS: 0** medium+ No inline threads — nothing met the reporting bar on this diff. ### Notes (below threshold / not introduced here) - **DOUB routed before steal-band check:** whole tx reverts on band failure; no partial fund movement. - **`totalDoubRaised` on WarBow spends:** display/event metric only; payouts use `doub.balanceOf(pool)`, not this counter. Intended #300/#310 parity. - **CRED buys earning WarBow BP (incl. new bonuses):** pre-existing progression design; not an auth bypass introduced by this MR. - **Indexer `warbow_buy_bp` replay:** omits new bonuses — offchain display drift only. **Security review: no medium+ findings on this diff.**
PlasticDigits commented 2026-06-13 14:09:21 +00:00 (Migrated from gitlab.com)

mentioned in commit 0bc2582912

mentioned in commit 0bc25829124980e1004c90a92d11e964b6dcd9c5
PlasticDigits (Migrated from gitlab.com) merged commit 0bc2582912 into main 2026-06-13 14:09:21 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
agent:fix_bugfix

   
agent:fix_conflicts

   
agent:fix_security

   
agent:gap_analysis

   
agent:implement

   
agent:open_issues

   
agents

   
agent:security_audit

   
agent:verify
  
area
timecurve

  
arena

   
arena-v2

   
audit

   
block:feature_review

   
block:security

   
bug

   
contracts

   
design

   
devops

   
docs
Documentation

  
documentation

   
enhancement

   
epic
Epic / umbrella issue

  
feature

   
frontend

   
indexer

   
low priority
Low priority, investigate other issues first

  
megaeth

   
operations

   
ops
Deploy and operations

  
performance

   
QA

   
qa checklist

   
referrals

   
removal
Legacy removal

  
security

   
smart-contracts

   
tech-debt

   
testing

   
time-arena
TimeArena v2 revamp

  
timecurve

   
visual-qa
No labels
agent:fix_bugfix
agent:fix_conflicts
agent:fix_security
agent:gap_analysis
agent:implement
agent:open_issues
agents
agent:security_audit
agent:verify
area
timecurve
arena
arena-v2
audit
block:feature_review
block:security
bug
contracts
design
devops
docs
documentation
enhancement
epic
feature
frontend
indexer
low priority
megaeth
operations
ops
performance
QA
qa checklist
referrals
removal
security
smart-contracts
tech-debt
testing
time-arena
timecurve
visual-qa
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
code/yieldomega!465
No description provided.