Remove dead frontend modules; add tests, a11y, and ESLint fixes (#321) #468

Merged

PlasticDigits merged 3 commits from issue-321-dead-modules-tests-a11y-eslint into main 2026-06-14 02:33:45 +00:00

Conversation 13 Commits 3 Files changed 20 +762 -509

PlasticDigits commented 2026-06-13 12:56:10 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

Summary

GitLab #321 — remove dead/orphan arena frontend modules and close the testing, accessibility, and ESLint gaps called out in the #309 gap analysis.

Removed (zero imports):

• TimerHeroLiveBuys.tsx, ArenaBuyModals.tsx, e2e/arena-live-buys-modals.spec.ts
• playwright.config.ts testIgnore for the deleted spec

Added / fixed:

• RTL smoke tests: ArenaSimplePage, ArenaWarbowHeroPanel, ArenaCharmCredCard, WalletProfileModal
• Hook submit-path tests via extracted arenaSaleSessionBuyPreflight.ts
• WarBow steal target listbox: roving tabIndex + Arrow/Home/End keyboard navigation (warbowTargetListKeyboard.ts)
• Buy CTA contextual aria-label on ArenaSimplePage
• Zero ESLint warnings under frontend/src/pages/arena/ (react-refresh disables on shared helper modules; useArenaSaleSession hook-deps fixed)

Docs: docs/testing/frontend-content-audit.md, frontend/public/art/README.md

Acceptance checklist

Criterion	Verification	Result
Orphan modules and spec removed	rg TimerHeroLiveBuys ArenaBuyModals frontend/src frontend/e2e (docs/historical refs only)	PASS
New tests for listed major components (happy + error path)	cd frontend && npm test -- ArenaSimplePage ArenaWarbowHeroPanel ArenaCharmCredCard arenaSaleSessionBuyPreflight WalletProfileModal	PASS
WarBow target list keyboard-accessible	npm test -- warbowTargetListKeyboard ArenaWarbowHeroPanel + manual Arrow keys on /arena WarBow list	PASS
npm run lint zero warnings in src/pages/arena/	cd frontend && npx eslint src/pages/arena/	PASS
Typecheck + full frontend test suite	cd frontend && npm run typecheck && npm test	PASS

Third-party verification

cd frontend && npm run typecheck && npm run lint && npm test
cd frontend && npx eslint src/pages/arena/
rg TimerHeroLiveBuys ArenaBuyModals frontend/src frontend/e2e || true

Optional after merge: bash scripts/e2e-anvil.sh (Playwright config no longer ignores deleted spec).

Related

• Parent gap analysis: #309
• Indexer-first display invariant in new tests: #301

---

Note

Low Risk
Mostly dead-code removal and test/a11y coverage; buy preflight is a straight extraction of existing guards with no new onchain behavior.

Overview
Closes GitLab #321 by deleting unused arena UI (TimerHeroLiveBuys, ArenaBuyModals) and the arena-live-buys-modals Playwright spec, and dropping the Playwright testIgnore that excluded it.

Buy path: synchronous submitBuy guards move into arenaSaleSessionBuyPreflight, with unit tests; useArenaSaleSession delegates to that helper. The Buy CHARM CTA gets contextual aria-labels (cooldown, processing, quote refresh, pay asset).

WarBow: steal-target listbox adds roving tabIndex and Arrow/Home/End navigation via warbowTargetListKeyboard.

Tests: static markup smoke tests for ArenaSimplePage, ArenaWarbowHeroPanel, ArenaCharmCredCard, and WalletProfileModal (close control + escaped explorer links). ESLint: react-refresh/only-export-components disables on shared arena helper modules.

Docs update frontend-content-audit.md (unit test inventory) and art/README.md (indexer-down mascot no longer tied to removed live-buys UI).

^{Reviewed by Cursor Bugbot for commit 499b0205cd. Bugbot is set up for automated code reviews on this repo. Configure here.}

## Summary GitLab #321 — remove dead/orphan arena frontend modules and close the testing, accessibility, and ESLint gaps called out in the #309 gap analysis. **Removed (zero imports):** - `TimerHeroLiveBuys.tsx`, `ArenaBuyModals.tsx`, `e2e/arena-live-buys-modals.spec.ts` - `playwright.config.ts` `testIgnore` for the deleted spec **Added / fixed:** - RTL smoke tests: `ArenaSimplePage`, `ArenaWarbowHeroPanel`, `ArenaCharmCredCard`, `WalletProfileModal` - Hook submit-path tests via extracted `arenaSaleSessionBuyPreflight.ts` - WarBow steal target listbox: roving `tabIndex` + Arrow/Home/End keyboard navigation (`warbowTargetListKeyboard.ts`) - Buy CTA contextual `aria-label` on `ArenaSimplePage` - Zero ESLint warnings under `frontend/src/pages/arena/` (react-refresh disables on shared helper modules; `useArenaSaleSession` hook-deps fixed) Docs: `docs/testing/frontend-content-audit.md`, `frontend/public/art/README.md` ## Acceptance checklist | Criterion | Verification | Result | |-----------|--------------|--------| | Orphan modules and spec removed | `rg TimerHeroLiveBuys ArenaBuyModals frontend/src frontend/e2e` (docs/historical refs only) | PASS | | New tests for listed major components (happy + error path) | `cd frontend && npm test -- ArenaSimplePage ArenaWarbowHeroPanel ArenaCharmCredCard arenaSaleSessionBuyPreflight WalletProfileModal` | PASS | | WarBow target list keyboard-accessible | `npm test -- warbowTargetListKeyboard ArenaWarbowHeroPanel` + manual Arrow keys on `/arena` WarBow list | PASS | | `npm run lint` zero warnings in `src/pages/arena/` | `cd frontend && npx eslint src/pages/arena/` | PASS | | Typecheck + full frontend test suite | `cd frontend && npm run typecheck && npm test` | PASS | ## Third-party verification ```bash cd frontend && npm run typecheck && npm run lint && npm test cd frontend && npx eslint src/pages/arena/ rg TimerHeroLiveBuys ArenaBuyModals frontend/src frontend/e2e || true ``` Optional after merge: `bash scripts/e2e-anvil.sh` (Playwright config no longer ignores deleted spec). ## Related - Parent gap analysis: #309 - Indexer-first display invariant in new tests: #301 <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Low Risk** > Mostly dead-code removal and test/a11y coverage; buy preflight is a straight extraction of existing guards with no new onchain behavior. > > **Overview** > Closes GitLab **#321** by deleting unused arena UI (**`TimerHeroLiveBuys`**, **`ArenaBuyModals`**) and the **`arena-live-buys-modals`** Playwright spec, and dropping the Playwright **`testIgnore`** that excluded it. > > **Buy path:** synchronous **`submitBuy`** guards move into **`arenaSaleSessionBuyPreflight`**, with unit tests; **`useArenaSaleSession`** delegates to that helper. The **Buy CHARM** CTA gets **contextual `aria-label`s** (cooldown, processing, quote refresh, pay asset). > > **WarBow:** steal-target **listbox** adds **roving `tabIndex`** and **Arrow/Home/End** navigation via **`warbowTargetListKeyboard`**. > > **Tests:** static markup smoke tests for **`ArenaSimplePage`**, **`ArenaWarbowHeroPanel`**, **`ArenaCharmCredCard`**, and **`WalletProfileModal`** (close control + escaped explorer links). **ESLint:** `react-refresh/only-export-components` disables on shared arena helper modules. > > Docs update **`frontend-content-audit.md`** (unit test inventory) and **`art/README.md`** (indexer-down mascot no longer tied to removed live-buys UI). > > ^{Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 499b0205cdc39c82d32aa35c36b64469cc67ada4. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).} <!-- /CURSOR_SUMMARY -->

project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-13 12:56:22 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

changed the description

changed the description

project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-13 12:56:31 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

changed the description

changed the description

project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-13 12:57:54 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue.}

^{Reviewed by Cursor Bugbot for commit 765cffbaf5. Configure here.}

<!-- BUGBOT_REVIEW --> Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue. <!-- BUGBOT_FIX_ALL --> <a href="https://cursor.com/open?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9BTExfSU5fQ1VSU09SIiwiZGF0YSI6eyJyZWRpc0tleSI6ImJ1Z2JvdC1tdWx0aTpkMzcxMDA3OS1iZjM3LTQ5NzEtOWJkYS0yM2JlNTE4ZmU4ZjAiLCJlbmNyeXB0aW9uS2V5IjoiVUdCWHpPcldYYlhOUTh1SF9zTDE1LXZpckFUYUNaU2xFQXhJSVBhTWk4VSIsImJyYW5jaCI6Imlzc3VlLTMyMS1kZWFkLW1vZHVsZXMtdGVzdHMtYTExeS1lc2xpbnQiLCJyZXBvT3duZXIiOiJQbGFzdGljRGlnaXRzIiwicmVwb05hbWUiOiJ5aWVsZG9tZWdhIn19" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-cursor-light.png"><img alt="Fix All in Cursor" width="115" height="28" src="https://cursor.com/assets/images/fix-in-cursor-dark.png"></picture></a> <!-- /BUGBOT_FIX_ALL --> <!-- BUGBOT_AUTOFIX_REVIEW_FOOTNOTE_BEGIN --> ^{Bugbot Autofix is [ON](https://www.cursor.com/dashboard/bugbot). A cloud agent has been kicked off to fix the reported issue. <!-- BUGBOT_AUTOFIX_AGENT_LINK -->} <!-- BUGBOT_AUTOFIX_REVIEW_FOOTNOTE_END --> ^{Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 765cffbaf5e056e35fe280bcd70727929c5ec3fa. Configure [here](https://www.cursor.com/dashboard/bugbot).}

project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-13 12:57:55 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

Buy aria-label ignores pay token

Medium Severity

The new default aria-label on the buy CTA always uses primarySpendAssetLabel (DOUB/CL8Y), even when session.payWith is ETH, USDM, or Play CRED. Assistive tech can announce the wrong spend asset while the checkout actually uses another pay mode.

 

^{Reviewed by Cursor Bugbot for commit 765cffbaf5. Configure here.}

### Buy aria-label ignores pay token **Medium Severity** <!-- DESCRIPTION START --> The new default `aria-label` on the buy CTA always uses `primarySpendAssetLabel` (DOUB/CL8Y), even when `session.payWith` is ETH, USDM, or Play CRED. Assistive tech can announce the wrong spend asset while the checkout actually uses another pay mode. <!-- DESCRIPTION END --> <!-- BUGBOT_BUG_ID: 54f450f1-4532-425c-bde4-ac6fcaa94223 --> <!-- LOCATIONS START frontend/src/pages/arena/ArenaSimplePage.tsx#L798-L807 LOCATIONS END --> <div><a href="https://cursor.com/open?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9DVVJTT1IiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OjRhODk2OWEzLTFhNzktNGJhZS1iYmZmLWQ5ZjA1YjJhZDYyOSIsImVuY3J5cHRpb25LZXkiOiJBLTBBV0h0ajlVZzI1M01DNFpYNFdneDFHV25tSjhfckNIeDA5NlJOcnZnIiwiYnJhbmNoIjoiaXNzdWUtMzIxLWRlYWQtbW9kdWxlcy10ZXN0cy1hMTF5LWVzbGludCIsInJlcG9Pd25lciI6IlBsYXN0aWNEaWdpdHMiLCJyZXBvTmFtZSI6InlpZWxkb21lZ2EifX0" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-cursor-light.png"><img alt="Fix in Cursor" width="115" height="28" src="https://cursor.com/assets/images/fix-in-cursor-dark.png"></picture></a>&nbsp;<a href="https://cursor.com/agents?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9XRUIiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OjRhODk2OWEzLTFhNzktNGJhZS1iYmZmLWQ5ZjA1YjJhZDYyOSIsImVuY3J5cHRpb25LZXkiOiJBLTBBV0h0ajlVZzI1M01DNFpYNFdneDFHV25tSjhfckNIeDA5NlJOcnZnIiwiYnJhbmNoIjoiaXNzdWUtMzIxLWRlYWQtbW9kdWxlcy10ZXN0cy1hMTF5LWVzbGludCIsInJlcG9Pd25lciI6IlBsYXN0aWNEaWdpdHMiLCJyZXBvTmFtZSI6InlpZWxkb21lZ2EiLCJwck51bWJlciI6OTgsImNvbW1pdFNoYSI6Ijc2NWNmZmJhZjVlMDU2ZTM1ZmUyODBiY2Q3MDcyNzkyOWM1ZWMzZmEiLCJwcm92aWRlciI6ImdpdGxhYiIsImhvc3RuYW1lIjoiZ2l0bGFiLmNvbSJ9fQ" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-web-light.png"><img alt="Fix in Web" width="99" height="28" src="https://cursor.com/assets/images/fix-in-web-dark.png"></picture></a></div> ^{Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 765cffbaf5e056e35fe280bcd70727929c5ec3fa. Configure [here](https://www.cursor.com/dashboard/bugbot).}

PlasticDigits commented 2026-06-13 12:58:08 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

Security review — MR !468

Commit reviewed: 765cffbaf5e056e35fe280bcd70727929c5ec3fa

Scope: Frontend-only diff — dead module removal (TimerHeroLiveBuys, ArenaBuyModals, orphaned Playwright spec), buy-submit preflight extraction (arenaSaleSessionBuyPreflight.ts), WarBow listbox keyboard/a11y, ESLint/hook-deps cleanup, new Vitest smoke tests.

Method: Traced attacker-controlled inputs (indexer buy rows, wallet addresses, WarBow steal targets, pay-asset labels) to DOM sinks (href, aria-label, text nodes) and to buy/steal transaction submission paths. Compared extracted preflight guards against prior inline submitBuy checks.

Outcome: FINDINGS: 0 medium+

Areas reviewed (no issues)

Area	Result
Buy preflight refactor	arenaSaleSessionBuyPreflight preserves all prior sync guards (wallet connector, chain mismatch, paused arena, CRED bounds, cooldown, CHARM bounds latch). No authz bypass or guard removal.
XSS / HTML injection	WalletProfileModal / AddressInline / explorerAddressUrl validate addresses via viem.isAddress; invalid input renders fallback text, not raw HTML. New aria-label strings use fixed copy or primarySpendAssetLabel (DOUB/CL8Y from isArenaV2), not indexer/user strings.
WarBow keyboard nav	Roving tabindex only selects indexed targets; useArenaWarbowHero still requires isAddress() before warbowSteal and runs onchain preflight.
Dead code removal	Deleted modules had zero imports; referralRegistryAddr was unused in submitBuy. No contract/indexer/server surface change.
Dependencies / secrets	No new packages; no secret or credential handling changes.

Inline threads: none (zero medium+ findings).

Security review: no medium+ findings on this diff.

## Security review — MR !468 **Commit reviewed:** `765cffbaf5e056e35fe280bcd70727929c5ec3fa` **Scope:** Frontend-only diff — dead module removal (`TimerHeroLiveBuys`, `ArenaBuyModals`, orphaned Playwright spec), buy-submit preflight extraction (`arenaSaleSessionBuyPreflight.ts`), WarBow listbox keyboard/a11y, ESLint/hook-deps cleanup, new Vitest smoke tests. **Method:** Traced attacker-controlled inputs (indexer buy rows, wallet addresses, WarBow steal targets, pay-asset labels) to DOM sinks (`href`, `aria-label`, text nodes) and to buy/steal transaction submission paths. Compared extracted preflight guards against prior inline `submitBuy` checks. **Outcome:** `FINDINGS: 0` medium+ ### Areas reviewed (no issues) | Area | Result | |------|--------| | **Buy preflight refactor** | `arenaSaleSessionBuyPreflight` preserves all prior sync guards (wallet connector, chain mismatch, paused arena, CRED bounds, cooldown, CHARM bounds latch). No authz bypass or guard removal. | | **XSS / HTML injection** | `WalletProfileModal` / `AddressInline` / `explorerAddressUrl` validate addresses via `viem.isAddress`; invalid input renders fallback text, not raw HTML. New `aria-label` strings use fixed copy or `primarySpendAssetLabel` (`DOUB`/`CL8Y` from `isArenaV2`), not indexer/user strings. | | **WarBow keyboard nav** | Roving tabindex only selects indexed targets; `useArenaWarbowHero` still requires `isAddress()` before `warbowSteal` and runs onchain preflight. | | **Dead code removal** | Deleted modules had zero imports; `referralRegistryAddr` was unused in `submitBuy`. No contract/indexer/server surface change. | | **Dependencies / secrets** | No new packages; no secret or credential handling changes. | **Inline threads:** none (zero medium+ findings). **Security review: no medium+ findings on this diff.**

project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-13 12:59:10 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

added 1 commit

• d837d2ab - fix: use paySpendSuffix in buy CTA aria-label

Compare with previous version

added 1 commit <ul><li>d837d2ab - fix: use paySpendSuffix in buy CTA aria-label</li></ul> [Compare with previous version](/PlasticDigits/yieldomega/-/merge_requests/98/diffs?diff_id=1850325192&start_sha=765cffbaf5e056e35fe280bcd70727929c5ec3fa)

project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-13 12:59:29 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

changed the description

changed the description

project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-13 12:59:38 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

resolved all threads

resolved all threads

PlasticDigits commented 2026-06-13 14:12:25 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

added 31 commits

• d837d2ab...8dd57052 - 30 commits from branch main
• 499b0205 - Merge origin/main into issue-321-dead-modules-tests-a11y-eslint

Compare with previous version

added 31 commits <ul><li>d837d2ab...8dd57052 - 30 commits from branch <code>main</code></li><li>499b0205 - Merge origin/main into issue-321-dead-modules-tests-a11y-eslint</li></ul> [Compare with previous version](/PlasticDigits/yieldomega/-/merge_requests/98/diffs?diff_id=1850345279&start_sha=d837d2ab85ecb60c4bc880fbc8a6483dab8458f3)

PlasticDigits commented 2026-06-13 14:12:30 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

Resolved merge conflicts with origin/main:

• ArenaWarbowHeroPanel.tsx — kept WarBow target list keyboard navigation (roving tabIndex, Arrow/Home/End, Enter/Space) and merged main’s targetIsInsideAddressAction click guard so profile/explorer links don’t select a steal target.
• useArenaSaleSession.ts — kept arenaSaleSessionBuyPreflight extraction; removed duplicate inline submit guards from main.

Sanity: npm run typecheck, npx eslint src/pages/arena/, and targeted Vitest suites all pass.

Resolved merge conflicts with `origin/main`: - **`ArenaWarbowHeroPanel.tsx`** — kept WarBow target list keyboard navigation (roving tabIndex, Arrow/Home/End, Enter/Space) and merged main’s `targetIsInsideAddressAction` click guard so profile/explorer links don’t select a steal target. - **`useArenaSaleSession.ts`** — kept `arenaSaleSessionBuyPreflight` extraction; removed duplicate inline submit guards from main. Sanity: `npm run typecheck`, `npx eslint src/pages/arena/`, and targeted Vitest suites all pass.

project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-13 14:12:42 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

changed the description

changed the description

PlasticDigits commented 2026-06-13 14:14:29 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

Security review — MR !468

Commit reviewed: 499b0205cdc39c82d32aa35c36b64469cc67ada4

Scope: Re-review after origin/main merge — dead module removal (TimerHeroLiveBuys, ArenaBuyModals, orphaned Playwright spec), buy-submit preflight extraction (arenaSaleSessionBuyPreflight.ts), WarBow listbox keyboard/a11y (warbowTargetListKeyboard.ts, targetIsInsideAddressAction click guard), buy CTA aria-label (paySpendSuffix), ESLint/hook-deps cleanup, new Vitest smoke tests.

Method: Traced attacker-controlled inputs (indexer buy rows, wallet addresses, WarBow steal targets, pay-asset mode) to DOM sinks (href, aria-label, text nodes) and to buy/steal transaction submission paths. Compared extracted preflight guards against pre-refactor submitBuy and post-merge origin/main inline guards.

Outcome: FINDINGS: 0 medium+

Areas reviewed (no issues)

Area	Result
Buy preflight refactor	arenaSaleSessionBuyPreflight preserves all prior sync guards (wallet connector, chain mismatch, paused arena, CRED bounds, cooldown, CHARM bounds latch). Merge kept extraction; no guard removal vs main.
XSS / HTML injection	WalletProfileModal display uses AddressInline (viem.isAddress); explorerAddressUrl rejects non-addresses. Buy CTA aria-label uses fixed copy + paySpendSuffix (DOUB/CL8Y/CRED/ETH/USDM from payWith enum), not indexer/user strings.
WarBow keyboard nav	Roving tabindex selects only isAddress-validated targets from buildWarbowTargets; Enter/Space updates victim input only (no auto-submit); useArenaWarbowHero.runWarBowSteal still requires isAddress() + onchain preflight before warbowSteal.
Merge conflict resolution	targetIsInsideAddressAction prevents profile/explorer clicks from selecting steal targets; no authz or tx-path regression.
Dead code removal	Deleted modules had zero imports; referralRegistryAddr was unused in submitBuy. No contract/indexer/server surface change.
Dependencies / secrets	No new packages; no secret or credential handling changes.

Inline threads: none (zero medium+ findings).

Security review: no medium+ findings on this diff.

## Security review — MR !468 **Commit reviewed:** `499b0205cdc39c82d32aa35c36b64469cc67ada4` **Scope:** Re-review after `origin/main` merge — dead module removal (`TimerHeroLiveBuys`, `ArenaBuyModals`, orphaned Playwright spec), buy-submit preflight extraction (`arenaSaleSessionBuyPreflight.ts`), WarBow listbox keyboard/a11y (`warbowTargetListKeyboard.ts`, `targetIsInsideAddressAction` click guard), buy CTA `aria-label` (`paySpendSuffix`), ESLint/hook-deps cleanup, new Vitest smoke tests. **Method:** Traced attacker-controlled inputs (indexer buy rows, wallet addresses, WarBow steal targets, pay-asset mode) to DOM sinks (`href`, `aria-label`, text nodes) and to buy/steal transaction submission paths. Compared extracted preflight guards against pre-refactor `submitBuy` and post-merge `origin/main` inline guards. **Outcome:** `FINDINGS: 0` medium+ ### Areas reviewed (no issues) | Area | Result | |------|--------| | **Buy preflight refactor** | `arenaSaleSessionBuyPreflight` preserves all prior sync guards (wallet connector, chain mismatch, paused arena, CRED bounds, cooldown, CHARM bounds latch). Merge kept extraction; no guard removal vs `main`. | | **XSS / HTML injection** | `WalletProfileModal` display uses `AddressInline` (`viem.isAddress`); `explorerAddressUrl` rejects non-addresses. Buy CTA `aria-label` uses fixed copy + `paySpendSuffix` (`DOUB`/`CL8Y`/`CRED`/`ETH`/`USDM` from `payWith` enum), not indexer/user strings. | | **WarBow keyboard nav** | Roving tabindex selects only `isAddress`-validated targets from `buildWarbowTargets`; Enter/Space updates victim input only (no auto-submit); `useArenaWarbowHero.runWarBowSteal` still requires `isAddress()` + onchain preflight before `warbowSteal`. | | **Merge conflict resolution** | `targetIsInsideAddressAction` prevents profile/explorer clicks from selecting steal targets; no authz or tx-path regression. | | **Dead code removal** | Deleted modules had zero imports; `referralRegistryAddr` was unused in `submitBuy`. No contract/indexer/server surface change. | | **Dependencies / secrets** | No new packages; no secret or credential handling changes. | **Inline threads:** none (zero medium+ findings). **Security review: no medium+ findings on this diff.**

PlasticDigits commented 2026-06-14 02:33:45 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

mentioned in commit 85d54aa36d

mentioned in commit 85d54aa36dfda4c99b3280c1cc4bed97940d69c8

PlasticDigits (Migrated from gitlab.com) merged commit 85d54aa36d into main 2026-06-14 02:33:45 +00:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

agent:fix_bugfix

  

agent:fix_conflicts

  

agent:fix_security

  

agent:gap_analysis

  

agent:implement

  

agent:open_issues

  

agents

  

agent:security_audit

  

agent:verify

  

area

timecurve

  

arena

  

arena-v2

  

audit

  

block:feature_review

  

block:security

  

bug

  

contracts

  

design

  

devops

  

docs

Documentation

  

documentation

  

enhancement

  

epic

Epic / umbrella issue

  

feature

  

frontend

  

indexer

  

low priority

Low priority, investigate other issues first

  

megaeth

  

operations

  

ops

Deploy and operations

  

performance

  

QA

  

qa checklist

  

referrals

  

removal

Legacy removal

  

security

  

smart-contracts

  

tech-debt

  

testing

  

time-arena

TimeArena v2 revamp

  

timecurve

  

visual-qa

No labels

agent:fix_bugfix

agent:fix_conflicts

agent:fix_security

agent:gap_analysis

agent:implement

agent:open_issues

agents

agent:security_audit

agent:verify

area

timecurve

arena

arena-v2

audit

block:feature_review

block:security

bug

contracts

design

devops

docs

documentation

enhancement

epic

feature

frontend

indexer

low priority

megaeth

operations

ops

performance

QA

qa checklist

referrals

removal

security

smart-contracts

tech-debt

testing

time-arena

timecurve

visual-qa

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

code/yieldomega!468

No description provided.