Indexer registry cleanup, BuyViaKumbaya ingest, platform-usage API (#319) #472

Merged

PlasticDigits merged 5 commits from issue-319-indexer-registry-platform-usage into main 2026-06-14 02:35:03 +00:00

Conversation 23 Commits 5 Files changed 17 +1305 -165

PlasticDigits commented 2026-06-13 13:15:42 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

Summary

Indexer registry cleanup and Arena HTTP improvements for #319:

• Remove retired DoubPresaleVesting from address-registry.megaeth-mainnet.json (#243).
• Ingest BuyViaKumbaya from TimeArenaBuyRouter (log filter + decode + idx_arena_buy.pay_kind annotation on matching tx_hash).
• Restore GET /v1/arena/platform-usage (schema ≥ 2.12.0) aggregating idx_arena_buy + WarBow tables; wire frontend fetchArenaPlatformUsage.
• Add cursor / next_cursor (block_number:log_index) on GET /v1/arena/buys and GET /v1/arena/activity; keep offset for compatibility.
• Replace referral list filter_map silent drops with pg_row_required → 500 on corrupt projections.

Acceptance checklist

Criterion	Command / step	Result
No vesting address in active registry	rg DoubPresaleVesting indexer/address-registry.megaeth-mainnet.json → no matches	PASS
Kumbaya-routed buys in /v1/arena/buys with pay kind	cd indexer && YIELDOMEGA_PG_TEST_URL=… cargo test postgres_stage2 (api_buy_via_kumbaya_pay_kind_smoke)	PASS
Platform-usage API + frontend stub removed	cd indexer && cargo test postgres_stage2 (api_platform_usage_smoke); cd frontend && npm test -- --run src/lib/indexerApi.test.ts	PASS
Corrupt rows surface error, not silent drop	cd indexer && cargo test (referral handlers use pg_row_required)	PASS
Buys/activity support cursor param	cd indexer && cargo test postgres_stage2 (api_buys_cursor_smoke)	PASS
Buy router Anvil parity	bash scripts/verify-time-arena-buy-router-anvil.sh	PASS
Indexer clippy + unit tests	cd indexer && cargo clippy --all-targets -- -D warnings && cargo test	PASS (see SKIP)
Wallet stats integration (pre-existing)	cargo test arena_wallet_stats_two_epochs	SKIP — fails on main before this MR (warbow_battle_points 1000 vs 750)

Verification for third parties

1. bash scripts/bootstrap-cloud-postgres-native.sh and export YIELDOMEGA_PG_TEST_URL.
2. cd indexer && cargo test postgres_stage2_persist_all_events_and_rollback_after
3. cd frontend && npm test -- --run src/lib/indexerApi.test.ts
4. Optional full router gate: bash scripts/verify-time-arena-buy-router-anvil.sh
5. After deploy, smoke curl -sS "$INDEXER_URL/v1/arena/platform-usage?limit=5&velocity_window=1h" | jq .total_buys

Blockers

• None for #319 scope. arena_wallet_stats_two_epochs_and_bonus_fields remains flaky on current main (out of scope).

---

Note

Medium Risk
Adds a new public aggregate API and changes list pagination on high-churn routes, plus ingest that annotates buys from router logs; offset compatibility limits breakage, and integration tests cover the new paths.

Overview
Restores GET /v1/arena/platform-usage (schema ≥ 2.12.0) with buy + WarBow aggregates, velocity windows, and a paginated wallet leaderboard, and rewires the frontend so fetchArenaPlatformUsage hits that route instead of the retired /v1/arena/timers stub.

Indexer ingest and registry: Drops DoubPresaleVesting from the MegaETH mainnet registry, adds TimeArenaBuyRouter to log filters (with TimeCurveBuyRouter fallback), decodes BuyViaKumbaya, and sets nullable idx_arena_buy.pay_kind on the matching buy tx. Optional INDEXER_REGISTRY_REQUIRE_BUY_ROUTER=1 fail-closes production config when the router is missing.

Pagination and API hygiene: GET /v1/arena/buys and GET /v1/arena/activity accept cursor and return next_cursor (timestamp-aware for buys); offset remains for compatibility. Referral list handlers use pg_row_required so bad SQL projections return 500 instead of silently dropping rows.

^{Reviewed by Cursor Bugbot for commit 5b201b5bab. Bugbot is set up for automated code reviews on this repo. Configure here.}

## Summary Indexer registry cleanup and Arena HTTP improvements for #319: - Remove retired **`DoubPresaleVesting`** from `address-registry.megaeth-mainnet.json` ([#243](https://gitlab.com/PlasticDigits/yieldomega/-/issues/243)). - Ingest **`BuyViaKumbaya`** from **`TimeArenaBuyRouter`** (log filter + decode + `idx_arena_buy.pay_kind` annotation on matching `tx_hash`). - Restore **`GET /v1/arena/platform-usage`** (schema **≥ 2.12.0**) aggregating `idx_arena_buy` + WarBow tables; wire frontend `fetchArenaPlatformUsage`. - Add **`cursor`** / **`next_cursor`** (`block_number:log_index`) on **`GET /v1/arena/buys`** and **`GET /v1/arena/activity`**; keep **`offset`** for compatibility. - Replace referral list **`filter_map`** silent drops with **`pg_row_required`** → **500** on corrupt projections. ## Acceptance checklist | Criterion | Command / step | Result | |-----------|----------------|--------| | No vesting address in active registry | `rg DoubPresaleVesting indexer/address-registry.megaeth-mainnet.json` → no matches | PASS | | Kumbaya-routed buys in `/v1/arena/buys` with pay kind | `cd indexer && YIELDOMEGA_PG_TEST_URL=… cargo test postgres_stage2` (`api_buy_via_kumbaya_pay_kind_smoke`) | PASS | | Platform-usage API + frontend stub removed | `cd indexer && cargo test postgres_stage2` (`api_platform_usage_smoke`); `cd frontend && npm test -- --run src/lib/indexerApi.test.ts` | PASS | | Corrupt rows surface error, not silent drop | `cd indexer && cargo test` (referral handlers use `pg_row_required`) | PASS | | Buys/activity support cursor param | `cd indexer && cargo test postgres_stage2` (`api_buys_cursor_smoke`) | PASS | | Buy router Anvil parity | `bash scripts/verify-time-arena-buy-router-anvil.sh` | PASS | | Indexer clippy + unit tests | `cd indexer && cargo clippy --all-targets -- -D warnings && cargo test` | PASS (see SKIP) | | Wallet stats integration (pre-existing) | `cargo test arena_wallet_stats_two_epochs` | SKIP — fails on `main` before this MR (`warbow_battle_points` 1000 vs 750) | ## Verification for third parties 1. `bash scripts/bootstrap-cloud-postgres-native.sh` and export `YIELDOMEGA_PG_TEST_URL`. 2. `cd indexer && cargo test postgres_stage2_persist_all_events_and_rollback_after` 3. `cd frontend && npm test -- --run src/lib/indexerApi.test.ts` 4. Optional full router gate: `bash scripts/verify-time-arena-buy-router-anvil.sh` 5. After deploy, smoke `curl -sS "$INDEXER_URL/v1/arena/platform-usage?limit=5&velocity_window=1h" | jq .total_buys` ## Blockers - None for #319 scope. **`arena_wallet_stats_two_epochs_and_bonus_fields`** remains flaky on current `main` (out of scope). <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Medium Risk** > Adds a new public aggregate API and changes list pagination on high-churn routes, plus ingest that annotates buys from router logs; offset compatibility limits breakage, and integration tests cover the new paths. > > **Overview** > Restores **`GET /v1/arena/platform-usage`** (schema **≥ 2.12.0**) with buy + WarBow aggregates, velocity windows, and a paginated wallet leaderboard, and rewires the frontend so **`fetchArenaPlatformUsage`** hits that route instead of the retired **`/v1/arena/timers`** stub. > > **Indexer ingest and registry:** Drops **`DoubPresaleVesting`** from the MegaETH mainnet registry, adds **`TimeArenaBuyRouter`** to log filters (with **`TimeCurveBuyRouter`** fallback), decodes **`BuyViaKumbaya`**, and sets nullable **`idx_arena_buy.pay_kind`** on the matching buy tx. Optional **`INDEXER_REGISTRY_REQUIRE_BUY_ROUTER=1`** fail-closes production config when the router is missing. > > **Pagination and API hygiene:** **`GET /v1/arena/buys`** and **`GET /v1/arena/activity`** accept **`cursor`** and return **`next_cursor`** (timestamp-aware for buys); **`offset`** remains for compatibility. Referral list handlers use **`pg_row_required`** so bad SQL projections return **500** instead of silently dropping rows. > > ^{Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 5b201b5bab6e27286a972014f60540bd060c36cc. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).} <!-- /CURSOR_SUMMARY -->

project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-13 13:15:52 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

changed the description

changed the description

project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-13 13:16:01 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

changed the description

changed the description

PlasticDigits commented 2026-06-13 13:18:10 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

Security review — MR !472

Commit reviewed: c2f9dc9383c3b0aa5243c17b684f30cf95988d2e
Scope: Indexer registry cleanup (DoubPresaleVesting removal), BuyViaKumbaya ingest + pay_kind annotation, restored GET /v1/arena/platform-usage, cursor pagination on buys/activity, referral pg_row_required hardening, frontend platform-usage wiring.

Outcome: FINDINGS: 0 medium+

Areas reviewed

Area	Result
SQL injection (cursor, velocity_window, pagination, fetch_warbow_action_totals)	User-controlled values are allowlisted or bound as parameters; dynamic SQL fragments use compile-time 'static str table/where literals only.
Authn/authz	New routes are public read-only aggregates/lists, consistent with existing arena/referral HTTP surface.
BuyViaKumbaya ingest	Logs are fetched only from registry-resolved addresses; decode is topic-gated; pay_kind UPDATE is keyed by on-chain tx_hash (same-tx Buy pairing). No off-chain trust boundary bypass identified.
Registry / production gates	INDEXER_REGISTRY_REQUIRE_BUY_ROUTER fail-closed wiring is a hardening change.
XSS / injection (frontend)	Query params built via URLSearchParams; pay_kind is not rendered in new UI paths in this diff.
DoS (platform-usage aggregates)	Endpoint runs multiple full-table aggregates per request; same unauthenticated, un-rate-limited indexer pattern as existing leaderboard/stats routes — not a new exploitable trust boundary at medium+ severity.
Secret / error leakage	internal_db_error_response unchanged; no new sensitive logging.

Inline threads

None — no medium+ findings to anchor on specific diff lines.

Security review: no medium+ findings on this diff.

## Security review — MR !472 **Commit reviewed:** `c2f9dc9383c3b0aa5243c17b684f30cf95988d2e` **Scope:** Indexer registry cleanup (`DoubPresaleVesting` removal), `BuyViaKumbaya` ingest + `pay_kind` annotation, restored `GET /v1/arena/platform-usage`, cursor pagination on buys/activity, referral `pg_row_required` hardening, frontend platform-usage wiring. **Outcome:** `FINDINGS: 0` medium+ ### Areas reviewed | Area | Result | |------|--------| | SQL injection (cursor, velocity_window, pagination, `fetch_warbow_action_totals`) | User-controlled values are allowlisted or bound as parameters; dynamic SQL fragments use compile-time `'static str` table/where literals only. | | Authn/authz | New routes are public read-only aggregates/lists, consistent with existing arena/referral HTTP surface. | | `BuyViaKumbaya` ingest | Logs are fetched only from registry-resolved addresses; decode is topic-gated; `pay_kind` UPDATE is keyed by on-chain `tx_hash` (same-tx Buy pairing). No off-chain trust boundary bypass identified. | | Registry / production gates | `INDEXER_REGISTRY_REQUIRE_BUY_ROUTER` fail-closed wiring is a hardening change. | | XSS / injection (frontend) | Query params built via `URLSearchParams`; `pay_kind` is not rendered in new UI paths in this diff. | | DoS (platform-usage aggregates) | Endpoint runs multiple full-table aggregates per request; same unauthenticated, un-rate-limited indexer pattern as existing leaderboard/stats routes — not a new exploitable trust boundary at medium+ severity. | | Secret / error leakage | `internal_db_error_response` unchanged; no new sensitive logging. | ### Inline threads None — no medium+ findings to anchor on specific diff lines. **Security review: no medium+ findings on this diff.**

project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-13 13:19:01 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

Stale Security Review comment

Stale Security Review comment

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
^{Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue.}

^{Reviewed by Cursor Bugbot for commit c2f9dc9383. Configure here.}

<details> <summary>Stale Security Review comment</summary> <details> <summary>Stale Security Review comment</summary> <!-- BUGBOT_REVIEW --> Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.<!-- BUGBOT_AUTOFIX_REVIEW_FOOTNOTE_BEGIN --> ^{Bugbot Autofix is [ON](https://www.cursor.com/dashboard/bugbot). A cloud agent has been kicked off to fix the reported issue. <!-- BUGBOT_AUTOFIX_AGENT_LINK -->} <!-- BUGBOT_AUTOFIX_REVIEW_FOOTNOTE_END --> ^{Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit c2f9dc9383c3b0aa5243c17b684f30cf95988d2e. Configure [here](https://www.cursor.com/dashboard/bugbot).} </details> </details>

project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-13 13:19:03 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

Buys list drops timestamp ordering

Medium Severity

GET /v1/arena/buys now sorts only by block_number and log_index, replacing the prior block_timestamp DESC NULLS LAST ordering. Recent-buy views and offset pagination can disagree with RPC time order when timestamps are missing or not aligned with block height, and no longer match how platform-usage velocity filters buys by block_timestamp.

Additional Locations (1)

• indexer/src/api_arena.rs#L371-L374

 

^{Reviewed by Cursor Bugbot for commit c2f9dc9383. Configure here.}

### Buys list drops timestamp ordering **Medium Severity** <!-- DESCRIPTION START --> `GET /v1/arena/buys` now sorts only by `block_number` and `log_index`, replacing the prior `block_timestamp DESC NULLS LAST` ordering. Recent-buy views and offset pagination can disagree with RPC time order when timestamps are missing or not aligned with block height, and no longer match how platform-usage velocity filters buys by `block_timestamp`. <!-- DESCRIPTION END --> <!-- BUGBOT_BUG_ID: 4fb474c0-042b-46a3-b36a-ebc41b4d5f7b --> <!-- LOCATIONS START indexer/src/api_arena.rs#L390-L393 indexer/src/api_arena.rs#L371-L374 LOCATIONS END --> <details> <summary>Additional Locations (1)</summary> - [`indexer/src/api_arena.rs#L371-L374`](https://gitlab.com/PlasticDigits/yieldomega/-//blob/c2f9dc9383c3b0aa5243c17b684f30cf95988d2e/indexer/src/api_arena.rs#L371-L374) </details> <div><a href="https://cursor.com/open?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9DVVJTT1IiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90Ojc0MWU0NWE5LTRmYTktNGU4MC04NzdkLTY0MmRlM2E3OGRlZCIsImVuY3J5cHRpb25LZXkiOiJjSlpwaW0tTEo4bGRuQlZIVmNXSXJmZ2NoS3BHOUdNaEMzd0VBd09hQjlFIiwiYnJhbmNoIjoiaXNzdWUtMzE5LWluZGV4ZXItcmVnaXN0cnktcGxhdGZvcm0tdXNhZ2UiLCJyZXBvT3duZXIiOiJQbGFzdGljRGlnaXRzIiwicmVwb05hbWUiOiJ5aWVsZG9tZWdhIn19" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-cursor-light.png"><img alt="Fix in Cursor" width="115" height="28" src="https://cursor.com/assets/images/fix-in-cursor-dark.png"></picture></a>&nbsp;<a href="https://cursor.com/agents?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9XRUIiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90Ojc0MWU0NWE5LTRmYTktNGU4MC04NzdkLTY0MmRlM2E3OGRlZCIsImVuY3J5cHRpb25LZXkiOiJjSlpwaW0tTEo4bGRuQlZIVmNXSXJmZ2NoS3BHOUdNaEMzd0VBd09hQjlFIiwiYnJhbmNoIjoiaXNzdWUtMzE5LWluZGV4ZXItcmVnaXN0cnktcGxhdGZvcm0tdXNhZ2UiLCJyZXBvT3duZXIiOiJQbGFzdGljRGlnaXRzIiwicmVwb05hbWUiOiJ5aWVsZG9tZWdhIiwicHJOdW1iZXIiOjEwMiwiY29tbWl0U2hhIjoiYzJmOWRjOTM4M2MzYjBhYTUyNDNjMTdiNjg0ZjMwY2Y5NTk4OGQyZSIsInByb3ZpZGVyIjoiZ2l0bGFiIiwiaG9zdG5hbWUiOiJnaXRsYWIuY29tIn19" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-web-light.png"><img alt="Fix in Web" width="99" height="28" src="https://cursor.com/assets/images/fix-in-web-dark.png"></picture></a></div> ^{Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit c2f9dc9383c3b0aa5243c17b684f30cf95988d2e. Configure [here](https://www.cursor.com/dashboard/bugbot).}

project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-13 13:22:08 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

added 1 commit

• eb908c58 - fix(indexer): restore block_timestamp ordering on GET /v1/arena/buys

Compare with previous version

added 1 commit <ul><li>eb908c58 - fix(indexer): restore block_timestamp ordering on GET /v1/arena/buys</li></ul> [Compare with previous version](/PlasticDigits/yieldomega/-/merge_requests/102/diffs?diff_id=1850331550&start_sha=c2f9dc9383c3b0aa5243c17b684f30cf95988d2e)

project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-13 13:22:31 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

changed the description

changed the description

project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-13 13:22:43 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

resolved all threads

resolved all threads

project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-13 13:23:20 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

Stale Security Review comment

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
^{Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue.}

^{Reviewed by Cursor Bugbot for commit eb908c587e. Configure here.}

<details> <summary>Stale Security Review comment</summary> <!-- BUGBOT_REVIEW --> Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.<!-- BUGBOT_AUTOFIX_REVIEW_FOOTNOTE_BEGIN --> ^{Bugbot Autofix is [ON](https://www.cursor.com/dashboard/bugbot). A cloud agent has been kicked off to fix the reported issue. <!-- BUGBOT_AUTOFIX_AGENT_LINK -->} <!-- BUGBOT_AUTOFIX_REVIEW_FOOTNOTE_END --> ^{Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit eb908c587e3e471367677d905b8b538ac748d210. Configure [here](https://www.cursor.com/dashboard/bugbot).} </details>

project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-13 13:23:21 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

Cursor filter mismatches buy sort

Medium Severity

GET /v1/arena/buys cursor pages now sort by block_timestamp first, but the cursor path still filters with (block_number, log_index) < ($1, $2) and next_cursor only encodes those two fields. When timestamps and block height disagree (e.g. NULL block_timestamp), clients can see duplicate or skipped buys across pages.

Additional Locations (1)

• indexer/src/api_arena.rs#L482-L489

 

^{Reviewed by Cursor Bugbot for commit eb908c587e. Configure here.}

### Cursor filter mismatches buy sort **Medium Severity** <!-- DESCRIPTION START --> `GET /v1/arena/buys` cursor pages now sort by `block_timestamp` first, but the cursor path still filters with `(block_number, log_index) < ($1, $2)` and `next_cursor` only encodes those two fields. When timestamps and block height disagree (e.g. NULL `block_timestamp`), clients can see duplicate or skipped buys across pages. <!-- DESCRIPTION END --> <!-- BUGBOT_BUG_ID: f4900e0d-1f6c-4163-9e21-d6f4442f4f5f --> <!-- LOCATIONS START indexer/src/api_arena.rs#L371-L374 indexer/src/api_arena.rs#L482-L489 LOCATIONS END --> <details> <summary>Additional Locations (1)</summary> - [`indexer/src/api_arena.rs#L482-L489`](https://gitlab.com/PlasticDigits/yieldomega/-//blob/eb908c587e3e471367677d905b8b538ac748d210/indexer/src/api_arena.rs#L482-L489) </details> <div><a href="https://cursor.com/open?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9DVVJTT1IiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OmJjMTZlZjU0LTg4NWMtNDIxOS04MDg2LWNiNjQwZTdiZDZhMyIsImVuY3J5cHRpb25LZXkiOiJwNWVhTm5yX0M1NWxSalpJbmlnRXJjMk5pbk81bm1rUTNrTzZHLVA2Y0RNIiwiYnJhbmNoIjoiaXNzdWUtMzE5LWluZGV4ZXItcmVnaXN0cnktcGxhdGZvcm0tdXNhZ2UiLCJyZXBvT3duZXIiOiJQbGFzdGljRGlnaXRzIiwicmVwb05hbWUiOiJ5aWVsZG9tZWdhIn19" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-cursor-light.png"><img alt="Fix in Cursor" width="115" height="28" src="https://cursor.com/assets/images/fix-in-cursor-dark.png"></picture></a>&nbsp;<a href="https://cursor.com/agents?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9XRUIiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OmJjMTZlZjU0LTg4NWMtNDIxOS04MDg2LWNiNjQwZTdiZDZhMyIsImVuY3J5cHRpb25LZXkiOiJwNWVhTm5yX0M1NWxSalpJbmlnRXJjMk5pbk81bm1rUTNrTzZHLVA2Y0RNIiwiYnJhbmNoIjoiaXNzdWUtMzE5LWluZGV4ZXItcmVnaXN0cnktcGxhdGZvcm0tdXNhZ2UiLCJyZXBvT3duZXIiOiJQbGFzdGljRGlnaXRzIiwicmVwb05hbWUiOiJ5aWVsZG9tZWdhIiwicHJOdW1iZXIiOjEwMiwiY29tbWl0U2hhIjoiZWI5MDhjNTg3ZTNlNDcxMzY3Njc3ZDkwNWI4YjUzOGFjNzQ4ZDIxMCIsInByb3ZpZGVyIjoiZ2l0bGFiIiwiaG9zdG5hbWUiOiJnaXRsYWIuY29tIn19" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-web-light.png"><img alt="Fix in Web" width="99" height="28" src="https://cursor.com/assets/images/fix-in-web-dark.png"></picture></a></div> ^{Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit eb908c587e3e471367677d905b8b538ac748d210. Configure [here](https://www.cursor.com/dashboard/bugbot).}

project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-13 13:26:26 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

added 1 commit

• 1a72a6e0 - fix(indexer): align arena buys cursor with timestamp sort

Compare with previous version

added 1 commit <ul><li>1a72a6e0 - fix(indexer): align arena buys cursor with timestamp sort</li></ul> [Compare with previous version](/PlasticDigits/yieldomega/-/merge_requests/102/diffs?diff_id=1850332653&start_sha=eb908c587e3e471367677d905b8b538ac748d210)

project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-13 13:26:42 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

changed the description

changed the description

project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-13 13:27:10 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

resolved all threads

resolved all threads

project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-13 13:28:17 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue.}

^{Reviewed by Cursor Bugbot for commit 1a72a6e0a9. Configure here.}

<!-- BUGBOT_REVIEW --> Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue. <!-- BUGBOT_FIX_ALL --> <a href="https://cursor.com/open?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9BTExfSU5fQ1VSU09SIiwiZGF0YSI6eyJyZWRpc0tleSI6ImJ1Z2JvdC1tdWx0aTo2MjFjNGRmNC0yNzcwLTQ2OGEtYTVkYy1lYjRiM2IyNWE3OGMiLCJlbmNyeXB0aW9uS2V5IjoicmVwZzNJekt1WVpteHo5dWpjQkFRVnRPMzNpc3VuLTF3RnNzN1RUaWQzSSIsImJyYW5jaCI6Imlzc3VlLTMxOS1pbmRleGVyLXJlZ2lzdHJ5LXBsYXRmb3JtLXVzYWdlIiwicmVwb093bmVyIjoiUGxhc3RpY0RpZ2l0cyIsInJlcG9OYW1lIjoieWllbGRvbWVnYSJ9fQ" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-cursor-light.png"><img alt="Fix All in Cursor" width="115" height="28" src="https://cursor.com/assets/images/fix-in-cursor-dark.png"></picture></a> <!-- /BUGBOT_FIX_ALL --> <!-- BUGBOT_AUTOFIX_REVIEW_FOOTNOTE_BEGIN --> ^{Bugbot Autofix is [ON](https://www.cursor.com/dashboard/bugbot). A cloud agent has been kicked off to fix the reported issue. <!-- BUGBOT_AUTOFIX_AGENT_LINK -->} <!-- BUGBOT_AUTOFIX_REVIEW_FOOTNOTE_END --> ^{Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 1a72a6e0a992058ebf40437e4058269ca8a43e4b. Configure [here](https://www.cursor.com/dashboard/bugbot).}

project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-13 13:28:18 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

Buy cursor misparses epoch text

High Severity

next_cursor for buys builds TimestampBlockLogCursor by parsing block_timestamp_sec with parse::<i64>, but the query returns EXTRACT(EPOCH FROM block_timestamp)::text, which PostgreSQL often formats with a fractional part. Failed parses become a null-timestamp cursor (-) while the row sorts with a real epoch in the SQL watermark, so cursor pages can skip or repeat buys.

 

^{Reviewed by Cursor Bugbot for commit 1a72a6e0a9. Configure here.}

### Buy cursor misparses epoch text **High Severity** <!-- DESCRIPTION START --> `next_cursor` for buys builds `TimestampBlockLogCursor` by parsing `block_timestamp_sec` with `parse::&lt;i64&gt;`, but the query returns `EXTRACT(EPOCH FROM block_timestamp)::text`, which PostgreSQL often formats with a fractional part. Failed parses become a null-timestamp cursor (`-`) while the row sorts with a real epoch in the SQL watermark, so cursor pages can skip or repeat buys. <!-- DESCRIPTION END --> <!-- BUGBOT_BUG_ID: b2401ecb-e4f8-4a21-8b0f-75ac0aeff5d5 --> <!-- LOCATIONS START indexer/src/api_arena.rs#L493-L505 LOCATIONS END --> <div><a href="https://cursor.com/open?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9DVVJTT1IiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OmNmZWM1YTgwLWFmNGMtNGZjOS1iZDM0LTg5MGY3MWIxMTY5NyIsImVuY3J5cHRpb25LZXkiOiJqT1FKT2ZPUWQ2SFFTUElkNGM5QmY0NUp5WmlIR1NYdmhQTFZBZ01xR3hBIiwiYnJhbmNoIjoiaXNzdWUtMzE5LWluZGV4ZXItcmVnaXN0cnktcGxhdGZvcm0tdXNhZ2UiLCJyZXBvT3duZXIiOiJQbGFzdGljRGlnaXRzIiwicmVwb05hbWUiOiJ5aWVsZG9tZWdhIn19" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-cursor-light.png"><img alt="Fix in Cursor" width="115" height="28" src="https://cursor.com/assets/images/fix-in-cursor-dark.png"></picture></a>&nbsp;<a href="https://cursor.com/agents?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9XRUIiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OmNmZWM1YTgwLWFmNGMtNGZjOS1iZDM0LTg5MGY3MWIxMTY5NyIsImVuY3J5cHRpb25LZXkiOiJqT1FKT2ZPUWQ2SFFTUElkNGM5QmY0NUp5WmlIR1NYdmhQTFZBZ01xR3hBIiwiYnJhbmNoIjoiaXNzdWUtMzE5LWluZGV4ZXItcmVnaXN0cnktcGxhdGZvcm0tdXNhZ2UiLCJyZXBvT3duZXIiOiJQbGFzdGljRGlnaXRzIiwicmVwb05hbWUiOiJ5aWVsZG9tZWdhIiwicHJOdW1iZXIiOjEwMiwiY29tbWl0U2hhIjoiMWE3MmE2ZTBhOTkyMDU4ZWJmNDA0MzdlNDA1ODI2OWNhOGE0M2U0YiIsInByb3ZpZGVyIjoiZ2l0bGFiIiwiaG9zdG5hbWUiOiJnaXRsYWIuY29tIn19" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-web-light.png"><img alt="Fix in Web" width="99" height="28" src="https://cursor.com/assets/images/fix-in-web-dark.png"></picture></a></div> ^{Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 1a72a6e0a992058ebf40437e4058269ca8a43e4b. Configure [here](https://www.cursor.com/dashboard/bugbot).}

project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-13 13:30:11 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

added 1 commit

• b6d9b350 - fix(indexer): use integer epoch text for buys cursor #319

Compare with previous version

added 1 commit <ul><li>b6d9b350 - fix(indexer): use integer epoch text for buys cursor #319</li></ul> [Compare with previous version](/PlasticDigits/yieldomega/-/merge_requests/102/diffs?diff_id=1850333620&start_sha=1a72a6e0a992058ebf40437e4058269ca8a43e4b)

project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-13 13:30:26 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

changed the description

changed the description

project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-13 13:30:36 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

resolved all threads

resolved all threads

PlasticDigits commented 2026-06-13 14:14:27 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

added 31 commits

• b6d9b350...8dd57052 - 30 commits from branch main
• 5b201b5b - Merge origin/main into issue-319-indexer-registry-platform-usage

Compare with previous version

added 31 commits <ul><li>b6d9b350...8dd57052 - 30 commits from branch <code>main</code></li><li>5b201b5b - Merge origin/main into issue-319-indexer-registry-platform-usage</li></ul> [Compare with previous version](/PlasticDigits/yieldomega/-/merge_requests/102/diffs?diff_id=1850345794&start_sha=b6d9b3501fb2f39e7b3e46d530d8c86bc4caaedf)

PlasticDigits commented 2026-06-13 14:14:29 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

Resolved merge conflicts with main:

• indexer/src/persist.rs: kept #319 BuyViaKumbaya pay_kind UPDATE alongside #317 ArenaWarbowFlagClaimed / ArenaWarbowPodiumFinalized INSERT handlers (replacing the temporary no-op stub).
• docs/testing/invariants-and-business-logic.md: merged #317 TimeArena event coverage with #319 registry/Kumbaya/platform-usage invariants.

Sanity: cargo clippy --all-targets -- -D warnings and cargo test pass on the merge commit.

Resolved merge conflicts with `main`: - **`indexer/src/persist.rs`**: kept #319 `BuyViaKumbaya` pay_kind UPDATE alongside #317 `ArenaWarbowFlagClaimed` / `ArenaWarbowPodiumFinalized` INSERT handlers (replacing the temporary no-op stub). - **`docs/testing/invariants-and-business-logic.md`**: merged #317 TimeArena event coverage with #319 registry/Kumbaya/platform-usage invariants. Sanity: `cargo clippy --all-targets -- -D warnings` and `cargo test` pass on the merge commit.

project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-13 14:15:01 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

changed the description

changed the description

PlasticDigits commented 2026-06-13 14:17:01 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

Security review — MR !472

Commit reviewed: 5b201b5bab6e27286a972014f60540bd060c36cc
Scope: Indexer registry cleanup (DoubPresaleVesting removal), BuyViaKumbaya ingest + pay_kind annotation, restored GET /v1/arena/platform-usage, timestamp-aware cursor pagination on buys/activity, referral pg_row_required hardening, frontend platform-usage wiring.

Outcome: FINDINGS: 0 medium+

Areas reviewed

Area	Result
SQL injection (cursor, velocity_window, pagination, fetch_warbow_action_totals)	User-controlled values are allowlisted or bound as parameters; dynamic SQL uses compile-time 'static str table/where literals only (arena_platform_usage.rs).
Authn/authz	New/changed routes are public read-only aggregates/lists, consistent with existing arena/referral HTTP surface. No auth boundary regression.
BuyViaKumbaya ingest	Logs fetched only from registry-resolved index_addresses() (router + arena contracts). Decode is topic-gated; pay_kind UPDATE is keyed by on-chain tx_hash and pairs with TimeArenaBuyRouter.buyViaKumbaya emitting after buyFor in the same tx (TimeArenaBuyRouter.sol). Annotation is indexer metadata only — no fund-moving off-chain trust path.
Registry / production gates	INDEXER_REGISTRY_REQUIRE_BUY_ROUTER fail-closed wiring is a hardening change; vesting removal is intentional registry cleanup.
XSS / injection (frontend)	Query params built via URLSearchParams; pay_kind is typed in API client only and not rendered in new UI paths in this diff.
DoS (platform-usage aggregates)	Endpoint runs multiple full-table aggregates per request; same unauthenticated, un-rate-limited indexer pattern as existing leaderboard/stats routes — not a new exploitable trust boundary at medium+ severity.
Secret / error leakage	internal_db_error_response unchanged (generic 500 body); no new sensitive logging.

Prior threads

Re-checked Bugbot cursor-pagination notes on buys ordering — correctness/data-integrity issues on a public read API, not an authn/authz or injection attack path at medium+ severity. No re-report.

Inline threads

None — no medium+ findings to anchor on specific diff lines.

Security review: no medium+ findings on this diff.

## Security review — MR !472 **Commit reviewed:** `5b201b5bab6e27286a972014f60540bd060c36cc` **Scope:** Indexer registry cleanup (`DoubPresaleVesting` removal), `BuyViaKumbaya` ingest + `pay_kind` annotation, restored `GET /v1/arena/platform-usage`, timestamp-aware cursor pagination on buys/activity, referral `pg_row_required` hardening, frontend platform-usage wiring. **Outcome:** `FINDINGS: 0` medium+ ### Areas reviewed | Area | Result | |------|--------| | SQL injection (`cursor`, `velocity_window`, pagination, `fetch_warbow_action_totals`) | User-controlled values are allowlisted or bound as parameters; dynamic SQL uses compile-time `'static str` table/where literals only (`arena_platform_usage.rs`). | | Authn/authz | New/changed routes are public read-only aggregates/lists, consistent with existing arena/referral HTTP surface. No auth boundary regression. | | `BuyViaKumbaya` ingest | Logs fetched only from registry-resolved `index_addresses()` (router + arena contracts). Decode is topic-gated; `pay_kind` UPDATE is keyed by on-chain `tx_hash` and pairs with `TimeArenaBuyRouter.buyViaKumbaya` emitting after `buyFor` in the same tx (`TimeArenaBuyRouter.sol`). Annotation is indexer metadata only — no fund-moving off-chain trust path. | | Registry / production gates | `INDEXER_REGISTRY_REQUIRE_BUY_ROUTER` fail-closed wiring is a hardening change; vesting removal is intentional registry cleanup. | | XSS / injection (frontend) | Query params built via `URLSearchParams`; `pay_kind` is typed in API client only and not rendered in new UI paths in this diff. | | DoS (platform-usage aggregates) | Endpoint runs multiple full-table aggregates per request; same unauthenticated, un-rate-limited indexer pattern as existing leaderboard/stats routes — not a new exploitable trust boundary at medium+ severity. | | Secret / error leakage | `internal_db_error_response` unchanged (generic 500 body); no new sensitive logging. | ### Prior threads Re-checked Bugbot cursor-pagination notes on buys ordering — correctness/data-integrity issues on a public read API, not an authn/authz or injection attack path at medium+ severity. No re-report. ### Inline threads None — no medium+ findings to anchor on specific diff lines. **Security review: no medium+ findings on this diff.**

PlasticDigits commented 2026-06-14 02:35:04 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

mentioned in commit 889ab2e0ae

mentioned in commit 889ab2e0aef4891717fae2b9f44d931e9042fee2

PlasticDigits (Migrated from gitlab.com) merged commit 889ab2e0ae into main 2026-06-14 02:35:04 +00:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

agent:fix_bugfix

  

agent:fix_conflicts

  

agent:fix_security

  

agent:gap_analysis

  

agent:implement

  

agent:open_issues

  

agents

  

agent:security_audit

  

agent:verify

  

area

timecurve

  

arena

  

arena-v2

  

audit

  

block:feature_review

  

block:security

  

bug

  

contracts

  

design

  

devops

  

docs

Documentation

  

documentation

  

enhancement

  

epic

Epic / umbrella issue

  

feature

  

frontend

  

indexer

  

low priority

Low priority, investigate other issues first

  

megaeth

  

operations

  

ops

Deploy and operations

  

performance

  

QA

  

qa checklist

  

referrals

  

removal

Legacy removal

  

security

  

smart-contracts

  

tech-debt

  

testing

  

time-arena

TimeArena v2 revamp

  

timecurve

  

visual-qa

No labels

agent:fix_bugfix

agent:fix_conflicts

agent:fix_security

agent:gap_analysis

agent:implement

agent:open_issues

agents

agent:security_audit

agent:verify

area

timecurve

arena

arena-v2

audit

block:feature_review

block:security

bug

contracts

design

devops

docs

documentation

enhancement

epic

feature

frontend

indexer

low priority

megaeth

operations

ops

performance

QA

qa checklist

referrals

removal

security

smart-contracts

tech-debt

testing

time-arena

timecurve

visual-qa

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

code/yieldomega!472

No description provided.