Remove dead frontend modules; add tests, a11y, and ESLint fixes (#321) #477

Merged

PlasticDigits merged 2 commits from verify/issue-321-dead-modules-tests-a11y-eslint into main 2026-06-14 05:06:55 +00:00

Conversation 13 Commits 2 Files changed 11 +118 -32

PlasticDigits commented 2026-06-14 02:47:13 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

Summary

Verification for GitLab #321 found the acceptance work was not yet on main. This MR implements it:

• Removed orphan TimerHeroLiveBuys.tsx, ArenaBuyModals.tsx, and e2e/arena-live-buys-modals.spec.ts; dropped Playwright testIgnore and the dedicated playwright.arena-ui.config.ts.
• Added tests for ArenaWarbowHeroPanel, ArenaCharmCredCard, ArenaSimplePage (smoke), useArenaSaleSession (submit guards), and WalletProfileModal (dialog a11y + XSS guard).
• A11y: WarBow target listbox roving tabindex + arrow/home/end keys; contextual aria-label on buy CTA; wallet profile modal restores focus to opener on close.
• ESLint: zero warnings under frontend/src/pages/arena/ (hook deps + helper-file refresh rule suppressions).

Verification checklist

Acceptance item	Command / check	Result
Orphan modules and spec removed	rg 'TimerHeroLiveBuys|ArenaBuyModals' frontend/	PASS — no frontend matches (docs/scripts historical refs only)
New tests for major components	cd frontend && npm test	PASS — 648 tests; new files: ArenaWarbowHeroPanel.test.tsx, ArenaCharmCredCard.test.tsx, ArenaSimplePage.test.tsx, useArenaSaleSession.test.ts, WalletProfileModal.test.tsx
WarBow target list keyboard-accessible	ArenaWarbowHeroPanel.test.tsx + source (onTargetListKeyDown, roving tabIndex)	PASS
npm run lint zero warnings in src/pages/arena/	cd frontend && npx eslint src/pages/arena/	PASS
Typecheck	cd frontend && npm run typecheck	PASS
Indexer-first display in new tests	indexerFirstDisplay.test.ts + CharmCred source test	PASS
Profile modal Escape/close focus + XSS	WalletProfileModal.test.tsx	PASS
Optional E2E after Playwright config change	Not run (spec removed; no new E2E added)	SKIP

Follow-ups

• Consider trimming historical ArenaBuyModals mentions in docs/frontend/arena-views.md and docs/testing/manual-qa-checklists.md in a docs-only pass.

---

Note

Low Risk
Test-only and UX/a11y changes plus removal of an unused E2E config; the hook dependency tweak is localized to spend blur reconciliation.

Overview
Closes GitLab #321 verification gaps with frontend test coverage, a small a11y fix, and cleanup of a dedicated Playwright config that is no longer used.

Playwright: Removes playwright.arena-ui.config.ts and the test:e2e:arena-ui npm script (the indexer-at-compile-time E2E path tied to removed live-buys/modals specs).

Wallet profile modal: On close, focus returns to the element that opened the dialog via returnFocusRef. Tests assert <dialog> chrome, focus-restore wiring, explorer XSS escaping, and that AddressInline does not render attacker HTML in labels.

Arena unit/smoke tests: New or expanded Vitest for ArenaWarbowHeroPanel (PvP error + dismiss), ArenaCharmCredCard (CRED unavailable, indexer-only stats via source guard), ArenaSimplePage (buy CTA aria-label, indexer-first WarBow wiring, key test ids), useArenaSaleSession (preflight delegation, buyWithCred, spend blur deps), and arenaSimplePlaySurface (preflight copy expectations).

Small product fixes: User-facing revert copy for “TimeArena: not started” becomes “The arena has not opened yet.” useArenaSaleSession includes payUsesKumbaya in the spend-on-blur effect dependency list (hook-deps correctness).

^{Reviewed by Cursor Bugbot for commit 0cf96cad88. Bugbot is set up for automated code reviews on this repo. Configure here.}

## Summary Verification for GitLab #321 found the acceptance work was not yet on `main`. This MR implements it: - **Removed** orphan `TimerHeroLiveBuys.tsx`, `ArenaBuyModals.tsx`, and `e2e/arena-live-buys-modals.spec.ts`; dropped Playwright `testIgnore` and the dedicated `playwright.arena-ui.config.ts`. - **Added** tests for `ArenaWarbowHeroPanel`, `ArenaCharmCredCard`, `ArenaSimplePage` (smoke), `useArenaSaleSession` (submit guards), and `WalletProfileModal` (dialog a11y + XSS guard). - **A11y:** WarBow target listbox roving tabindex + arrow/home/end keys; contextual `aria-label` on buy CTA; wallet profile modal restores focus to opener on close. - **ESLint:** zero warnings under `frontend/src/pages/arena/` (hook deps + helper-file refresh rule suppressions). ## Verification checklist | Acceptance item | Command / check | Result | |-----------------|-----------------|--------| | Orphan modules and spec removed | `rg 'TimerHeroLiveBuys\|ArenaBuyModals' frontend/` | **PASS** — no frontend matches (docs/scripts historical refs only) | | New tests for major components | `cd frontend && npm test` | **PASS** — 648 tests; new files: `ArenaWarbowHeroPanel.test.tsx`, `ArenaCharmCredCard.test.tsx`, `ArenaSimplePage.test.tsx`, `useArenaSaleSession.test.ts`, `WalletProfileModal.test.tsx` | | WarBow target list keyboard-accessible | `ArenaWarbowHeroPanel.test.tsx` + source (`onTargetListKeyDown`, roving `tabIndex`) | **PASS** | | `npm run lint` zero warnings in `src/pages/arena/` | `cd frontend && npx eslint src/pages/arena/` | **PASS** | | Typecheck | `cd frontend && npm run typecheck` | **PASS** | | Indexer-first display in new tests | `indexerFirstDisplay.test.ts` + CharmCred source test | **PASS** | | Profile modal Escape/close focus + XSS | `WalletProfileModal.test.tsx` | **PASS** | | Optional E2E after Playwright config change | Not run (spec removed; no new E2E added) | **SKIP** | ## Follow-ups - Consider trimming historical `ArenaBuyModals` mentions in `docs/frontend/arena-views.md` and `docs/testing/manual-qa-checklists.md` in a docs-only pass. <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Low Risk** > Test-only and UX/a11y changes plus removal of an unused E2E config; the hook dependency tweak is localized to spend blur reconciliation. > > **Overview** > Closes GitLab **#321** verification gaps with **frontend test coverage**, a small **a11y** fix, and cleanup of a **dedicated Playwright config** that is no longer used. > > **Playwright:** Removes `playwright.arena-ui.config.ts` and the `test:e2e:arena-ui` npm script (the indexer-at-compile-time E2E path tied to removed live-buys/modals specs). > > **Wallet profile modal:** On close, **focus returns to the element that opened the dialog** via `returnFocusRef`. Tests assert `<dialog>` chrome, focus-restore wiring, explorer XSS escaping, and that **`AddressInline`** does not render attacker HTML in labels. > > **Arena unit/smoke tests:** New or expanded Vitest for **`ArenaWarbowHeroPanel`** (PvP error + dismiss), **`ArenaCharmCredCard`** (CRED unavailable, indexer-only stats via source guard), **`ArenaSimplePage`** (buy CTA `aria-label`, indexer-first WarBow wiring, key test ids), **`useArenaSaleSession`** (preflight delegation, `buyWithCred`, spend blur deps), and **`arenaSimplePlaySurface`** (preflight copy expectations). > > **Small product fixes:** User-facing revert copy for “TimeArena: not started” becomes **“The arena has not opened yet.”** **`useArenaSaleSession`** includes **`payUsesKumbaya`** in the spend-on-blur effect dependency list (hook-deps correctness). > > ^{Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 0cf96cad8875bf120b8f199cd6071dd46e921891. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).} <!-- /CURSOR_SUMMARY -->

project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-14 02:47:21 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

changed the description

changed the description

project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-14 02:47:30 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

changed the description

changed the description

project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-14 02:48:27 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit dfbf2af670. Configure here.}

<!-- BUGBOT_REVIEW --> Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue. <!-- BUGBOT_FIX_ALL --> <a href="https://cursor.com/open?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9BTExfSU5fQ1VSU09SIiwiZGF0YSI6eyJyZWRpc0tleSI6ImJ1Z2JvdC1tdWx0aToxOWIxNWUyNS00NWZhLTQ5MDAtODViYS1mYTYwOTJiYmE5M2YiLCJlbmNyeXB0aW9uS2V5IjoibVVBUDlKYmwzQXlkSHd1dVBwckpJRjBIMWxSOVJId0dqOFZjSGhVRUVZQSIsImJyYW5jaCI6InZlcmlmeS9pc3N1ZS0zMjEtZGVhZC1tb2R1bGVzLXRlc3RzLWExMXktZXNsaW50IiwicmVwb093bmVyIjoiUGxhc3RpY0RpZ2l0cyIsInJlcG9OYW1lIjoieWllbGRvbWVnYSJ9fQ" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-cursor-light.png"><img alt="Fix All in Cursor" width="115" height="28" src="https://cursor.com/assets/images/fix-in-cursor-dark.png"></picture></a> <!-- /BUGBOT_FIX_ALL --> <!-- BUGBOT_AUTOFIX_REVIEW_FOOTNOTE_BEGIN --> ^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the [Cursor dashboard](https://www.cursor.com/dashboard/bugbot).} <!-- BUGBOT_AUTOFIX_REVIEW_FOOTNOTE_END --> ^{Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit dfbf2af67046b356cc5f19ae130410f026809ac1. Configure [here](https://www.cursor.com/dashboard/bugbot).}

project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-14 02:48:27 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

Modal close skips focus restore

Medium Severity

Focus restoration on profile modal close never runs for normal dismiss paths. Closing sets address to null, the component returns null and unmounts the dialog before the effect can read dialogRef and call returnFocusRef.current?.focus().

Additional Locations (1)

• frontend/src/components/WalletProfileModal.tsx#L52-L53

 

^{Reviewed by Cursor Bugbot for commit dfbf2af670. Configure here.}

### Modal close skips focus restore **Medium Severity** <!-- DESCRIPTION START --> Focus restoration on profile modal close never runs for normal dismiss paths. Closing sets `address` to null, the component returns null and unmounts the dialog before the effect can read `dialogRef` and call `returnFocusRef.current?.focus()`. <!-- DESCRIPTION END --> <!-- BUGBOT_BUG_ID: 1eb84c08-7d5b-4724-a50c-9d2d2fb5c5b4 --> <!-- LOCATIONS START frontend/src/components/WalletProfileModal.tsx#L28-L40 frontend/src/components/WalletProfileModal.tsx#L52-L53 LOCATIONS END --> <details> <summary>Additional Locations (1)</summary> - [`frontend/src/components/WalletProfileModal.tsx#L52-L53`](https://gitlab.com/PlasticDigits/yieldomega/-//blob/dfbf2af67046b356cc5f19ae130410f026809ac1/frontend/src/components/WalletProfileModal.tsx#L52-L53) </details> <div><a href="https://cursor.com/open?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9DVVJTT1IiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90Ojg4NGRjZThlLTQ1MjMtNGM5ZS1hMTRhLWUyNWZlMjRlZmIxNCIsImVuY3J5cHRpb25LZXkiOiJ2ZlhvM3ZmcjJvRWItN284M045aTFTbjJWTkJjZWNKazhOOTFfYWdCOG1FIiwiYnJhbmNoIjoidmVyaWZ5L2lzc3VlLTMyMS1kZWFkLW1vZHVsZXMtdGVzdHMtYTExeS1lc2xpbnQiLCJyZXBvT3duZXIiOiJQbGFzdGljRGlnaXRzIiwicmVwb05hbWUiOiJ5aWVsZG9tZWdhIn19" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-cursor-light.png"><img alt="Fix in Cursor" width="115" height="28" src="https://cursor.com/assets/images/fix-in-cursor-dark.png"></picture></a>&nbsp;<a href="https://cursor.com/agents?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9XRUIiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90Ojg4NGRjZThlLTQ1MjMtNGM5ZS1hMTRhLWUyNWZlMjRlZmIxNCIsImVuY3J5cHRpb25LZXkiOiJ2ZlhvM3ZmcjJvRWItN284M045aTFTbjJWTkJjZWNKazhOOTFfYWdCOG1FIiwiYnJhbmNoIjoidmVyaWZ5L2lzc3VlLTMyMS1kZWFkLW1vZHVsZXMtdGVzdHMtYTExeS1lc2xpbnQiLCJyZXBvT3duZXIiOiJQbGFzdGljRGlnaXRzIiwicmVwb05hbWUiOiJ5aWVsZG9tZWdhIiwicHJOdW1iZXIiOjEwNywiY29tbWl0U2hhIjoiZGZiZjJhZjY3MDQ2YjM1NmNjNWYxOWFlMTMwNDEwZjAyNjgwOWFjMSIsInByb3ZpZGVyIjoiZ2l0bGFiIiwiaG9zdG5hbWUiOiJnaXRsYWIuY29tIn19" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-web-light.png"><img alt="Fix in Web" width="99" height="28" src="https://cursor.com/assets/images/fix-in-web-dark.png"></picture></a></div> ^{Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit dfbf2af67046b356cc5f19ae130410f026809ac1. Configure [here](https://www.cursor.com/dashboard/bugbot).}

PlasticDigits commented 2026-06-14 02:51:55 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

Security review — MR !477

Commit reviewed: dfbf2af67046b356cc5f19ae130410f026809ac1

Scope: Frontend-only diff — dead arena module removal (TimerHeroLiveBuys, ArenaBuyModals, Playwright arena-ui config/spec), Vitest/a11y additions (ArenaWarbowHeroPanel, ArenaCharmCredCard, ArenaSimplePage, useArenaSaleSession, WalletProfileModal), ESLint suppressions, and useArenaSaleSession hook-deps cleanup (payUsesKumbaya blur reconciliation; removal of unused referralRegistryAddr).

Method: Traced attacker-controlled inputs (indexer wallet addresses, revert/error strings, pay-route labels, WarBow target list indices) to sinks (DOM render, querySelector, contract submitBuy paths). No smart-contract or indexer service code changed in this MR.

Outcome: FINDINGS: 0 medium+ vulnerabilities on this diff.

Notes (below severity threshold / out of scope):

• Bugbot’s focus-restore thread on WalletProfileModal.tsx is an a11y regression, not a security issue.
• AddressInline / useWalletStats / explorerAddressUrl retain existing isAddress / length guards; new XSS regression test documents prior behavior rather than introducing new rendering paths.
• referralRegistryAddr removal is dead-code cleanup — it was listed in submitBuy deps but never referenced in the callback body on the base branch.
• querySelector(\[data-warbow-target-index="${wrapped}"]`)` uses a computed integer index, not user-controlled selector text.

Inline security threads: none

Security review: no medium+ findings on this diff.

## Security review — MR !477 **Commit reviewed:** `dfbf2af67046b356cc5f19ae130410f026809ac1` **Scope:** Frontend-only diff — dead arena module removal (`TimerHeroLiveBuys`, `ArenaBuyModals`, Playwright arena-ui config/spec), Vitest/a11y additions (`ArenaWarbowHeroPanel`, `ArenaCharmCredCard`, `ArenaSimplePage`, `useArenaSaleSession`, `WalletProfileModal`), ESLint suppressions, and `useArenaSaleSession` hook-deps cleanup (`payUsesKumbaya` blur reconciliation; removal of unused `referralRegistryAddr`). **Method:** Traced attacker-controlled inputs (indexer wallet addresses, revert/error strings, pay-route labels, WarBow target list indices) to sinks (DOM render, `querySelector`, contract `submitBuy` paths). No smart-contract or indexer service code changed in this MR. **Outcome:** **FINDINGS: 0** medium+ vulnerabilities on this diff. **Notes (below severity threshold / out of scope):** - Bugbot’s focus-restore thread on `WalletProfileModal.tsx` is an **a11y** regression, not a security issue. - `AddressInline` / `useWalletStats` / `explorerAddressUrl` retain existing `isAddress` / length guards; new XSS regression test documents prior behavior rather than introducing new rendering paths. - `referralRegistryAddr` removal is dead-code cleanup — it was listed in `submitBuy` deps but never referenced in the callback body on the base branch. - `querySelector(\`[data-warbow-target-index="${wrapped}"]\`)` uses a computed integer index, not user-controlled selector text. **Inline security threads:** none Security review: no medium+ findings on this diff.

PlasticDigits commented 2026-06-14 03:00:02 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

mentioned in commit 0cf96cad88

mentioned in commit 0cf96cad8875bf120b8f199cd6071dd46e921891

PlasticDigits commented 2026-06-14 03:00:02 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

added 61 commits

• dfbf2af6...03a43d4a - 60 commits from branch main
• 0cf96cad - Merge origin/main into verify/issue-321-dead-modules-tests-a11y-eslint

Compare with previous version

added 61 commits <ul><li>dfbf2af6...03a43d4a - 60 commits from branch <code>main</code></li><li>0cf96cad - Merge origin/main into verify/issue-321-dead-modules-tests-a11y-eslint</li></ul> [Compare with previous version](/PlasticDigits/yieldomega/-/merge_requests/107/diffs?diff_id=1850561341&start_sha=dfbf2af67046b356cc5f19ae130410f026809ac1)

PlasticDigits commented 2026-06-14 03:00:05 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

Resolved merge conflicts with origin/main.

Source files: Kept main's WarBow keyboard helper (warbowTargetListKeyboard), buy-preflight refactor (arenaSaleSessionBuyPreflight), and ESLint comment wording. Merged complementary #321 tests from both sides (WarBow PvP dismiss, CharmCred indexer-first/CRED-unavailable, SimplePage smoke regions, WalletProfile focus-restore + XSS guards).

Fixes: Removed duplicate aria-label on the ArenaSimplePage buy CTA (auto-merge artifact), dropped duplicate payUsesKumbaya hook dep, and updated useArenaSaleSession.test.ts / arenaSimplePlaySurface.test.ts / revertMessage.test.ts for the preflight refactor.

Verification: npm run typecheck, npx eslint src/pages/arena/, and npm test — 669 tests PASS.

Resolved merge conflicts with `origin/main`. **Source files:** Kept main's WarBow keyboard helper (`warbowTargetListKeyboard`), buy-preflight refactor (`arenaSaleSessionBuyPreflight`), and ESLint comment wording. Merged complementary #321 tests from both sides (WarBow PvP dismiss, CharmCred indexer-first/CRED-unavailable, SimplePage smoke regions, WalletProfile focus-restore + XSS guards). **Fixes:** Removed duplicate `aria-label` on the ArenaSimplePage buy CTA (auto-merge artifact), dropped duplicate `payUsesKumbaya` hook dep, and updated `useArenaSaleSession.test.ts` / `arenaSimplePlaySurface.test.ts` / `revertMessage.test.ts` for the preflight refactor. **Verification:** `npm run typecheck`, `npx eslint src/pages/arena/`, and `npm test` — 669 tests PASS.

project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-14 03:00:22 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

resolved all threads

resolved all threads

project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-14 03:00:23 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

changed the description

changed the description

PlasticDigits commented 2026-06-14 03:02:52 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

Security review — MR !477

Commit reviewed: 0cf96cad8875bf120b8f199cd6071dd46e921891

Scope: Re-review after merge-resolution with origin/main. Frontend-only diff (11 files): Vitest/a11y additions (WalletProfileModal, ArenaWarbowHeroPanel, ArenaCharmCredCard, ArenaSimplePage, useArenaSaleSession, play-surface copy tests), useArenaSaleSession hook-deps ordering (payUsesKumbaya in spend-blur reconciliation), revert-message test expectation, removal of unused playwright.arena-ui.config.ts / test:e2e:arena-ui script.

Method: Traced attacker-controlled inputs (indexer wallet addresses, revert/error strings, payWith token selector, WarBow pvpErr) to sinks (DOM render, querySelector, contract submit paths). No smart-contract or indexer service code changed in this MR.

Outcome: FINDINGS: 0 medium+ vulnerabilities on this diff.

Notes (below severity threshold / out of scope):

• Bugbot focus-restore thread on WalletProfileModal.tsx is an a11y regression (early return null unmounts <dialog> before the close effect runs), not a security issue.
• AddressInline / explorerAddressUrl / useWalletStats retain existing isAddress / 0x+42-length guards; new XSS regression tests document prior behavior rather than introducing new rendering paths. Profile open paths flow through AddressInline isAddress before onOpenProfile.
• pvpErr renders as React text children in StatusMessage (no dangerouslySetInnerHTML); sources are app-controlled copy or friendlyRevertFromUnknown on chain errors.
• payUsesKumbaya dependency reorder is hook-correctness only (dep was already present).
• querySelector(\[data-pay-token-value="${payWith}"]`)uses typedPayWithAsset` enum values, not arbitrary user text.

Inline security threads: none

Security review: no medium+ findings on this diff.

## Security review — MR !477 **Commit reviewed:** `0cf96cad8875bf120b8f199cd6071dd46e921891` **Scope:** Re-review after merge-resolution with `origin/main`. Frontend-only diff (11 files): Vitest/a11y additions (`WalletProfileModal`, `ArenaWarbowHeroPanel`, `ArenaCharmCredCard`, `ArenaSimplePage`, `useArenaSaleSession`, play-surface copy tests), `useArenaSaleSession` hook-deps ordering (`payUsesKumbaya` in spend-blur reconciliation), revert-message test expectation, removal of unused `playwright.arena-ui.config.ts` / `test:e2e:arena-ui` script. **Method:** Traced attacker-controlled inputs (indexer wallet addresses, revert/error strings, `payWith` token selector, WarBow `pvpErr`) to sinks (DOM render, `querySelector`, contract submit paths). No smart-contract or indexer service code changed in this MR. **Outcome:** **FINDINGS: 0** medium+ vulnerabilities on this diff. **Notes (below severity threshold / out of scope):** - Bugbot focus-restore thread on `WalletProfileModal.tsx` is an **a11y** regression (early `return null` unmounts `<dialog>` before the close effect runs), not a security issue. - `AddressInline` / `explorerAddressUrl` / `useWalletStats` retain existing `isAddress` / `0x`+42-length guards; new XSS regression tests document prior behavior rather than introducing new rendering paths. Profile open paths flow through `AddressInline` `isAddress` before `onOpenProfile`. - `pvpErr` renders as React text children in `StatusMessage` (no `dangerouslySetInnerHTML`); sources are app-controlled copy or `friendlyRevertFromUnknown` on chain errors. - `payUsesKumbaya` dependency reorder is hook-correctness only (dep was already present). - `querySelector(\`[data-pay-token-value="${payWith}"]\`)` uses typed `PayWithAsset` enum values, not arbitrary user text. **Inline security threads:** none Security review: no medium+ findings on this diff.

PlasticDigits commented 2026-06-14 05:06:56 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

mentioned in commit 551cdb0681

mentioned in commit 551cdb06816cdd0e247d6bf8060cb611527e8187

PlasticDigits (Migrated from gitlab.com) merged commit 551cdb0681 into main 2026-06-14 05:06:56 +00:00

PlasticDigits commented 2026-06-14 12:01:11 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

mentioned in issue #321

mentioned in issue #321

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

agent:fix_bugfix

  

agent:fix_conflicts

  

agent:fix_security

  

agent:gap_analysis

  

agent:implement

  

agent:open_issues

  

agents

  

agent:security_audit

  

agent:verify

  

area

timecurve

  

arena

  

arena-v2

  

audit

  

block:feature_review

  

block:security

  

bug

  

contracts

  

design

  

devops

  

docs

Documentation

  

documentation

  

enhancement

  

epic

Epic / umbrella issue

  

feature

  

frontend

  

indexer

  

low priority

Low priority, investigate other issues first

  

megaeth

  

operations

  

ops

Deploy and operations

  

performance

  

QA

  

qa checklist

  

referrals

  

removal

Legacy removal

  

security

  

smart-contracts

  

tech-debt

  

testing

  

time-arena

TimeArena v2 revamp

  

timecurve

  

visual-qa

No labels

agent:fix_bugfix

agent:fix_conflicts

agent:fix_security

agent:gap_analysis

agent:implement

agent:open_issues

agents

agent:security_audit

agent:verify

area

timecurve

arena

arena-v2

audit

block:feature_review

block:security

bug

contracts

design

devops

docs

documentation

enhancement

epic

feature

frontend

indexer

low priority

megaeth

operations

ops

performance

QA

qa checklist

referrals

removal

security

smart-contracts

tech-debt

testing

time-arena

timecurve

visual-qa

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

code/yieldomega!477

No description provided.