feat(indexer): registry cleanup, Kumbaya ingest, platform-usage API (#319) #481

Merged

PlasticDigits merged 2 commits from verify/issue-319-indexer-registry-platform-usage into main 2026-06-14 05:31:05 +00:00

Conversation 13 Commits 2 Files changed 10 +137 -28

PlasticDigits commented 2026-06-14 02:55:52 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

Summary

Implements GitLab #319 gap-analysis follow-up:

• Remove DoubPresaleVesting from address-registry.megaeth-mainnet.json
• Ingest TimeArenaBuyRouter.BuyViaKumbaya into idx_arena_buy_router_kumbaya and enrich GET /v1/arena/buys with pay_kind / entry_pay_asset
• Restore GET /v1/arena/platform-usage (schema 2.12.0) from Arena v2 tables
• Replace silent filter_map row drops on referral list handlers with 500 on corrupt rows
• Add cursor=block:log_index pagination to GET /v1/arena/buys and GET /v1/arena/activity (offset retained for compatibility)
• Wire INDEXER_REGISTRY_REQUIRE_BUY_ROUTER and include TimeArenaBuyRouter in index_addresses()
• Frontend: remove fetchArenaPlatformUsage stub; point arenaPlatformUsageApiPath at /v1/arena/platform-usage

Verification checklist

Acceptance item	Command / evidence	Result
No vesting address in active registry	rg DoubPresaleVesting indexer/address-registry.megaeth-mainnet.json → no matches	PASS
Kumbaya-routed buys in /v1/arena/buys with pay kind	cd indexer && cargo test — api_issue319_smoke asserts entry_pay_asset=eth, pay_kind=0	PASS
Platform-usage API + frontend stub removed	cd indexer && cargo test — platform-usage route smoke; cd frontend && npm test — indexerApi.test.ts	PASS
Corrupt rows surface error	Referral handlers use try_row_get + corrupt_row_response (500) instead of filter_map drop	PASS (code)
Buys/activity cursor param	api_issue319_smoke — next_cursor round-trip; bad cursor → 400	PASS
Indexer unit + integration	cd indexer && cargo clippy --all-targets -- -D warnings && cargo test	PASS
Anvil buy router	bash scripts/verify-time-arena-buy-router-anvil.sh	PASS
Frontend tests	cd frontend && npm test	PASS

Follow-ups

• End-to-end Anvil stack smoke: indexer ingest of live BuyViaKumbaya tx → API row (requires full stack + indexer restart after registry merge).
• Extend cursor pagination to referral list routes if high-churn surfaces need it.

---

Note

Medium Risk
Changes indexer ingest, a new migration, and public buys API shape; mis-join or missing router registry could omit Kumbaya fields without breaking core buy rows.

Overview
Adds first-class ingest for TimeArenaBuyRouter.BuyViaKumbaya: new Postgres table idx_arena_buy_router_kumbaya, full row persist (buyer, charm, gross DOUB, pay kind), reorg rollback, and integration coverage alongside the existing idx_arena_buy.pay_kind update on the same tx.

GET /v1/arena/buys now LEFT JOINs the Kumbaya table (match tx + buyer + charm) and returns entry_pay_asset (eth / stable / cl8y from pay kind) and router_attested_gross_doub. List queries share a common ARENA_BUYS_SELECT_SQL fragment for cursor and offset pagination.

Production registry wiring: TimeArenaBuyRouter is documented as active for log filters when set; optional INDEXER_REGISTRY_REQUIRE_BUY_ROUTER strict-parses the router address at startup. Invariant docs (INV-INDEXER-112, INV-REMOVAL-243) reflect DoubPresaleVesting removal and Kumbaya persistence expectations.

^{Reviewed by Cursor Bugbot for commit f1d01175ee. Bugbot is set up for automated code reviews on this repo. Configure here.}

## Summary Implements GitLab #319 gap-analysis follow-up: - Remove `DoubPresaleVesting` from `address-registry.megaeth-mainnet.json` - Ingest `TimeArenaBuyRouter.BuyViaKumbaya` into `idx_arena_buy_router_kumbaya` and enrich `GET /v1/arena/buys` with `pay_kind` / `entry_pay_asset` - Restore `GET /v1/arena/platform-usage` (schema 2.12.0) from Arena v2 tables - Replace silent `filter_map` row drops on referral list handlers with 500 on corrupt rows - Add `cursor=block:log_index` pagination to `GET /v1/arena/buys` and `GET /v1/arena/activity` (offset retained for compatibility) - Wire `INDEXER_REGISTRY_REQUIRE_BUY_ROUTER` and include `TimeArenaBuyRouter` in `index_addresses()` - Frontend: remove `fetchArenaPlatformUsage` stub; point `arenaPlatformUsageApiPath` at `/v1/arena/platform-usage` ## Verification checklist | Acceptance item | Command / evidence | Result | |-----------------|-------------------|--------| | No vesting address in active registry | `rg DoubPresaleVesting indexer/address-registry.megaeth-mainnet.json` → no matches | PASS | | Kumbaya-routed buys in `/v1/arena/buys` with pay kind | `cd indexer && cargo test` — `api_issue319_smoke` asserts `entry_pay_asset=eth`, `pay_kind=0` | PASS | | Platform-usage API + frontend stub removed | `cd indexer && cargo test` — platform-usage route smoke; `cd frontend && npm test` — `indexerApi.test.ts` | PASS | | Corrupt rows surface error | Referral handlers use `try_row_get` + `corrupt_row_response` (500) instead of `filter_map` drop | PASS (code) | | Buys/activity cursor param | `api_issue319_smoke` — `next_cursor` round-trip; bad cursor → 400 | PASS | | Indexer unit + integration | `cd indexer && cargo clippy --all-targets -- -D warnings && cargo test` | PASS | | Anvil buy router | `bash scripts/verify-time-arena-buy-router-anvil.sh` | PASS | | Frontend tests | `cd frontend && npm test` | PASS | ## Follow-ups - End-to-end Anvil stack smoke: indexer ingest of live `BuyViaKumbaya` tx → API row (requires full stack + indexer restart after registry merge). - Extend cursor pagination to referral list routes if high-churn surfaces need it. <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Medium Risk** > Changes indexer ingest, a new migration, and public buys API shape; mis-join or missing router registry could omit Kumbaya fields without breaking core buy rows. > > **Overview** > Adds **first-class ingest** for **`TimeArenaBuyRouter.BuyViaKumbaya`**: new Postgres table **`idx_arena_buy_router_kumbaya`**, full row persist (buyer, charm, gross DOUB, pay kind), reorg rollback, and integration coverage alongside the existing **`idx_arena_buy.pay_kind`** update on the same tx. > > **`GET /v1/arena/buys`** now **LEFT JOIN**s the Kumbaya table (match tx + buyer + charm) and returns **`entry_pay_asset`** (`eth` / `stable` / `cl8y` from pay kind) and **`router_attested_gross_doub`**. List queries share a common **`ARENA_BUYS_SELECT_SQL`** fragment for cursor and offset pagination. > > Production registry wiring: **`TimeArenaBuyRouter`** is documented as active for log filters when set; optional **`INDEXER_REGISTRY_REQUIRE_BUY_ROUTER`** strict-parses the router address at startup. Invariant docs (**`INV-INDEXER-112`**, **`INV-REMOVAL-243`**) reflect **`DoubPresaleVesting`** removal and Kumbaya persistence expectations. > > ^{Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit f1d01175eed1487475c20c9ed0322db49795672d. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).} <!-- /CURSOR_SUMMARY -->

project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-14 02:56:03 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

changed the description

changed the description

project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-14 02:56:10 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

changed the description

changed the description

project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-14 02:57:05 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 0f34b77db6. Configure here.}

<!-- BUGBOT_REVIEW --> Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue. <!-- BUGBOT_FIX_ALL --> <a href="https://cursor.com/open?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9BTExfSU5fQ1VSU09SIiwiZGF0YSI6eyJyZWRpc0tleSI6ImJ1Z2JvdC1tdWx0aTowZWNhNmMxNS00OGI5LTQ5MGEtOTg2Ni1iMmUyMzRhMTg5N2EiLCJlbmNyeXB0aW9uS2V5IjoieG4tNlZYcnNEUjBvaXhyYTI5TmM4LWhHZzVibU1tVk8wUVRGSUlnUFhRUSIsImJyYW5jaCI6InZlcmlmeS9pc3N1ZS0zMTktaW5kZXhlci1yZWdpc3RyeS1wbGF0Zm9ybS11c2FnZSIsInJlcG9Pd25lciI6IlBsYXN0aWNEaWdpdHMiLCJyZXBvTmFtZSI6InlpZWxkb21lZ2EifX0" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-cursor-light.png"><img alt="Fix All in Cursor" width="115" height="28" src="https://cursor.com/assets/images/fix-in-cursor-dark.png"></picture></a> <!-- /BUGBOT_FIX_ALL --> <!-- BUGBOT_AUTOFIX_REVIEW_FOOTNOTE_BEGIN --> ^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the [Cursor dashboard](https://www.cursor.com/dashboard/bugbot).} <!-- BUGBOT_AUTOFIX_REVIEW_FOOTNOTE_END --> ^{Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 0f34b77db6ee3a6d85b6b847b3843f9bd4bb18a3. Configure [here](https://www.cursor.com/dashboard/bugbot).}

project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-14 02:57:06 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

Buys cursor mismatches sort order

Medium Severity

GET /v1/arena/buys paginates with a (block_number, log_index) cursor and filter, but rows are ordered by block_timestamp first. When timestamps are not monotonic with block height, later pages can skip buys that still belong in the feed or stop early while older rows remain.

 

^{Reviewed by Cursor Bugbot for commit 0f34b77db6. Configure here.}

### Buys cursor mismatches sort order **Medium Severity** <!-- DESCRIPTION START --> `GET /v1/arena/buys` paginates with a `(block_number, log_index)` cursor and filter, but rows are ordered by `block_timestamp` first. When timestamps are not monotonic with block height, later pages can skip buys that still belong in the feed or stop early while older rows remain. <!-- DESCRIPTION END --> <!-- BUGBOT_BUG_ID: f4969abf-2fad-4e0f-97dd-7c0ce551ddd2 --> <!-- LOCATIONS START indexer/src/api_arena.rs#L400-L446 LOCATIONS END --> <div><a href="https://cursor.com/open?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9DVVJTT1IiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OjVjMDBiNWJmLWEzZGYtNDVmZC1hNDM0LTMwMDc3N2YyMTQxOSIsImVuY3J5cHRpb25LZXkiOiI1SlF5STBjb1VQa2o3dFNUNGoxM2I4b0tsZ1VSa0xiaG45U0k4RzVLNVRRIiwiYnJhbmNoIjoidmVyaWZ5L2lzc3VlLTMxOS1pbmRleGVyLXJlZ2lzdHJ5LXBsYXRmb3JtLXVzYWdlIiwicmVwb093bmVyIjoiUGxhc3RpY0RpZ2l0cyIsInJlcG9OYW1lIjoieWllbGRvbWVnYSJ9fQ" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-cursor-light.png"><img alt="Fix in Cursor" width="115" height="28" src="https://cursor.com/assets/images/fix-in-cursor-dark.png"></picture></a>&nbsp;<a href="https://cursor.com/agents?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9XRUIiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OjVjMDBiNWJmLWEzZGYtNDVmZC1hNDM0LTMwMDc3N2YyMTQxOSIsImVuY3J5cHRpb25LZXkiOiI1SlF5STBjb1VQa2o3dFNUNGoxM2I4b0tsZ1VSa0xiaG45U0k4RzVLNVRRIiwiYnJhbmNoIjoidmVyaWZ5L2lzc3VlLTMxOS1pbmRleGVyLXJlZ2lzdHJ5LXBsYXRmb3JtLXVzYWdlIiwicmVwb093bmVyIjoiUGxhc3RpY0RpZ2l0cyIsInJlcG9OYW1lIjoieWllbGRvbWVnYSIsInByTnVtYmVyIjoxMTEsImNvbW1pdFNoYSI6IjBmMzRiNzdkYjZlZTNhNmQ4NWI2Yjg0N2IzODQzZjliZDRiYjE4YTMiLCJwcm92aWRlciI6ImdpdGxhYiIsImhvc3RuYW1lIjoiZ2l0bGFiLmNvbSJ9fQ" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-web-light.png"><img alt="Fix in Web" width="99" height="28" src="https://cursor.com/assets/images/fix-in-web-dark.png"></picture></a></div> ^{Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 0f34b77db6ee3a6d85b6b847b3843f9bd4bb18a3. Configure [here](https://www.cursor.com/dashboard/bugbot).}

PlasticDigits commented 2026-06-14 02:59:06 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

Security review — MR !481

Commit reviewed: 0f34b77db6ee3a6d85b6b847b3843f9bd4bb18a3

Scope: Indexer registry cleanup (DoubPresaleVesting removal), TimeArenaBuyRouter.BuyViaKumbaya ingest + /v1/arena/buys enrichment, restored GET /v1/arena/platform-usage, cursor pagination on buys/activity, referral corrupt-row 500 handling, INDEXER_REGISTRY_REQUIRE_BUY_ROUTER wiring, frontend platform-usage client.

Outcome: FINDINGS: 0 medium+

Areas reviewed

Area	Result
SQL injection (platform-usage, cursor params, Kumbaya join, warbow totals)	User-controlled inputs are allowlisted or bound as parameters; fetch_warbow_action_totals interpolates only compile-time &'static str table/WHERE fragments.
Authn/authz	New routes match existing public read-only indexer surface; no privileged actions exposed.
Kumbaya entry_pay_asset enrichment	Join keys (tx_hash, buyer, charm_wad) come from co-indexed on-chain events; pay_kind is router-emitted and path-validated on-chain. Mis-association risk is limited to same-tx duplicate buyer/charm edge cases (display only).
Ingest / reorg	idx_arena_buy_router_kumbaya persisted with parameterized INSERT and included in ARENA_INDEX_TABLES rollback.
Production registry	INDEXER_REGISTRY_REQUIRE_BUY_ROUTER correctly enforced; buy router added to index_addresses() only when configured.
Error handling / leakage	corrupt_row_response + generic internal_db_error_response avoid silent row drops and do not echo SQL details.
Frontend	URLSearchParams for query building; no new dangerously-rendered HTML from API fields in this diff.
EVM contract changes	None in this MR.

Prior threads

• Bugbot cursor/sort-order mismatch on GET /v1/arena/buys — not re-reported: pagination completeness bug on public on-chain data; no attacker-controlled privilege boundary or injection path.

Inline threads: none (zero medium+ findings).

block:security not applied.

## Security review — MR !481 **Commit reviewed:** `0f34b77db6ee3a6d85b6b847b3843f9bd4bb18a3` **Scope:** Indexer registry cleanup (`DoubPresaleVesting` removal), `TimeArenaBuyRouter.BuyViaKumbaya` ingest + `/v1/arena/buys` enrichment, restored `GET /v1/arena/platform-usage`, cursor pagination on buys/activity, referral corrupt-row 500 handling, `INDEXER_REGISTRY_REQUIRE_BUY_ROUTER` wiring, frontend platform-usage client. **Outcome:** `FINDINGS: 0` medium+ ### Areas reviewed | Area | Result | |------|--------| | SQL injection (platform-usage, cursor params, Kumbaya join, warbow totals) | User-controlled inputs are allowlisted or bound as parameters; `fetch_warbow_action_totals` interpolates only compile-time `&'static str` table/WHERE fragments. | | Authn/authz | New routes match existing public read-only indexer surface; no privileged actions exposed. | | Kumbaya `entry_pay_asset` enrichment | Join keys (`tx_hash`, buyer, `charm_wad`) come from co-indexed on-chain events; `pay_kind` is router-emitted and path-validated on-chain. Mis-association risk is limited to same-tx duplicate buyer/charm edge cases (display only). | | Ingest / reorg | `idx_arena_buy_router_kumbaya` persisted with parameterized INSERT and included in `ARENA_INDEX_TABLES` rollback. | | Production registry | `INDEXER_REGISTRY_REQUIRE_BUY_ROUTER` correctly enforced; buy router added to `index_addresses()` only when configured. | | Error handling / leakage | `corrupt_row_response` + generic `internal_db_error_response` avoid silent row drops and do not echo SQL details. | | Frontend | `URLSearchParams` for query building; no new dangerously-rendered HTML from API fields in this diff. | | EVM contract changes | None in this MR. | ### Prior threads - Bugbot cursor/sort-order mismatch on `GET /v1/arena/buys` — **not re-reported**: pagination completeness bug on public on-chain data; no attacker-controlled privilege boundary or injection path. **Inline threads:** none (zero medium+ findings). `block:security` not applied.

PlasticDigits commented 2026-06-14 05:14:35 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

changed this line in version 2 of the diff

changed this line in [version 2 of the diff](/PlasticDigits/yieldomega/-/merge_requests/111/diffs?diff_id=1850591076&start_sha=0f34b77db6ee3a6d85b6b847b3843f9bd4bb18a3#0e907c6fd2005016e3e09f7602a84cce65264acc_446_522)

PlasticDigits commented 2026-06-14 05:14:35 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

mentioned in commit f1d01175ee

mentioned in commit f1d01175eed1487475c20c9ed0322db49795672d

PlasticDigits commented 2026-06-14 05:14:35 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

added 87 commits

• 0f34b77d...e8448334 - 86 commits from branch main
• f1d01175 - Merge branch 'main' into verify/issue-319-indexer-registry-platform-usage

Compare with previous version

added 87 commits <ul><li>0f34b77d...e8448334 - 86 commits from branch <code>main</code></li><li>f1d01175 - Merge branch &#39;main&#39; into verify/issue-319-indexer-registry-platform-usage</li></ul> [Compare with previous version](/PlasticDigits/yieldomega/-/merge_requests/111/diffs?diff_id=1850591076&start_sha=0f34b77db6ee3a6d85b6b847b3843f9bd4bb18a3)

PlasticDigits commented 2026-06-14 05:14:39 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

Resolved merge conflicts with main (merge commit f1d01175).

Resolution summary

• Kept main's api_cursor pagination helpers and pg_row_required corrupt-row handling; removed duplicate api_pagination.rs.
• Unified BuyViaKumbaya on ArenaBuyViaKumbaya: updates idx_arena_buy.pay_kind and inserts idx_arena_buy_router_kumbaya.
• GET /v1/arena/buys now joins Kumbaya rows for entry_pay_asset / router_attested_gross_doub on top of main's timestamp cursor paging.
• Docs/invariants merged (#317 event table + #319 registry/Kumbaya/platform-usage checks).
• Integration smokes: api_platform_usage_smoke, api_buys_cursor_smoke (incl. bad-cursor 400), api_buy_via_kumbaya_pay_kind_smoke.

Checks: cargo clippy --all-targets -- -D warnings, cargo test, npm run typecheck, npm test — all PASS.

Resolved merge conflicts with `main` (merge commit `f1d01175`). **Resolution summary** - Kept `main`'s `api_cursor` pagination helpers and `pg_row_required` corrupt-row handling; removed duplicate `api_pagination.rs`. - Unified `BuyViaKumbaya` on `ArenaBuyViaKumbaya`: updates `idx_arena_buy.pay_kind` and inserts `idx_arena_buy_router_kumbaya`. - `GET /v1/arena/buys` now joins Kumbaya rows for `entry_pay_asset` / `router_attested_gross_doub` on top of main's timestamp cursor paging. - Docs/invariants merged (#317 event table + #319 registry/Kumbaya/platform-usage checks). - Integration smokes: `api_platform_usage_smoke`, `api_buys_cursor_smoke` (incl. bad-cursor 400), `api_buy_via_kumbaya_pay_kind_smoke`. **Checks:** `cargo clippy --all-targets -- -D warnings`, `cargo test`, `npm run typecheck`, `npm test` — all PASS.

project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-14 05:14:53 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

resolved all threads

resolved all threads

project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-14 05:14:54 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

changed the description

changed the description

PlasticDigits commented 2026-06-14 05:16:42 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

Security review — MR !481

Commit reviewed: f1d01175eed1487475c20c9ed0322db49795672d (post-merge with main)

Scope: Delta vs main — Kumbaya ingest (idx_arena_buy_router_kumbaya migration + persist/reorg), GET /v1/arena/buys Kumbaya LEFT JOIN enrichment (entry_pay_asset, router_attested_gross_doub), INDEXER_REGISTRY_REQUIRE_BUY_ROUTER wiring, decoder reorder, invariant doc updates. Platform-usage API, cursor pagination, referral corrupt-row handling, and frontend platform-usage client were already on main at merge; re-checked those paths for regressions introduced by this delta.

Outcome: FINDINGS: 0 medium+

Security review: no medium+ findings on this diff.

Areas reviewed

Area	Result
SQL injection (ARENA_BUYS_SELECT_SQL format!, Kumbaya INSERT, cursor binds)	Only compile-time SQL fragments interpolated; limit/offset/cursor components parsed and bound as parameters.
Authn/authz	Changed surface remains public read-only indexer APIs; no privileged actions added.
Kumbaya ingest integrity	BuyViaKumbaya decoded only from registry-filtered router address; router validates payKind on-chain (_validatePath); persist uses parameterized INSERT + reorg table list. pay_kind UPDATE scoped by tx_hash — display metadata only; router emits one buy per call (nonReentrant).
API enrichment join	LATERAL join keys (tx_hash, buyer, charm_wad) are co-indexed on-chain fields; mis-join limited to same-tx duplicate buyer/charm edge cases (display only, no fund impact).
Production registry	INDEXER_REGISTRY_REQUIRE_BUY_ROUTER fail-closed via strict_parse; buy router included in index_addresses() when configured.
Error handling / leakage	pg_row_required + internal_db_error_response unchanged; no SQL echo in responses.
EVM contract changes	None in this diff.

Prior threads

• Bugbot buys cursor/sort-order mismatch — not re-reported: fixed on main merge (TimestampBlockLogCursor matches block_timestamp sort); pagination completeness on public on-chain data, not a privilege-boundary issue.
• Prior security review (0f34b77) — superseded by this pass on merge commit f1d01175.

Inline threads: none (zero medium+ findings).

block:security not applied.

## Security review — MR !481 **Commit reviewed:** `f1d01175eed1487475c20c9ed0322db49795672d` (post-merge with `main`) **Scope:** Delta vs `main` — Kumbaya ingest (`idx_arena_buy_router_kumbaya` migration + persist/reorg), `GET /v1/arena/buys` Kumbaya LEFT JOIN enrichment (`entry_pay_asset`, `router_attested_gross_doub`), `INDEXER_REGISTRY_REQUIRE_BUY_ROUTER` wiring, decoder reorder, invariant doc updates. Platform-usage API, cursor pagination, referral corrupt-row handling, and frontend platform-usage client were already on `main` at merge; re-checked those paths for regressions introduced by this delta. **Outcome:** `FINDINGS: 0` medium+ Security review: no medium+ findings on this diff. ### Areas reviewed | Area | Result | |------|--------| | SQL injection (`ARENA_BUYS_SELECT_SQL` `format!`, Kumbaya INSERT, cursor binds) | Only compile-time SQL fragments interpolated; `limit`/`offset`/cursor components parsed and bound as parameters. | | Authn/authz | Changed surface remains public read-only indexer APIs; no privileged actions added. | | Kumbaya ingest integrity | `BuyViaKumbaya` decoded only from registry-filtered router address; router validates `payKind` on-chain (`_validatePath`); persist uses parameterized INSERT + reorg table list. `pay_kind` UPDATE scoped by `tx_hash` — display metadata only; router emits one buy per call (`nonReentrant`). | | API enrichment join | LATERAL join keys (`tx_hash`, buyer, `charm_wad`) are co-indexed on-chain fields; mis-join limited to same-tx duplicate buyer/charm edge cases (display only, no fund impact). | | Production registry | `INDEXER_REGISTRY_REQUIRE_BUY_ROUTER` fail-closed via `strict_parse`; buy router included in `index_addresses()` when configured. | | Error handling / leakage | `pg_row_required` + `internal_db_error_response` unchanged; no SQL echo in responses. | | EVM contract changes | None in this diff. | ### Prior threads - Bugbot buys cursor/sort-order mismatch — **not re-reported**: fixed on `main` merge (`TimestampBlockLogCursor` matches `block_timestamp` sort); pagination completeness on public on-chain data, not a privilege-boundary issue. - Prior security review (`0f34b77`) — superseded by this pass on merge commit `f1d01175`. **Inline threads:** none (zero medium+ findings). `block:security` not applied.

PlasticDigits commented 2026-06-14 05:31:05 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

mentioned in commit f7cf193dd7

mentioned in commit f7cf193dd7508ae52a0d68f856dfd0d39964888a

PlasticDigits (Migrated from gitlab.com) merged commit f7cf193dd7 into main 2026-06-14 05:31:05 +00:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

agent:fix_bugfix

  

agent:fix_conflicts

  

agent:fix_security

  

agent:gap_analysis

  

agent:implement

  

agent:open_issues

  

agents

  

agent:security_audit

  

agent:verify

  

area

timecurve

  

arena

  

arena-v2

  

audit

  

block:feature_review

  

block:security

  

bug

  

contracts

  

design

  

devops

  

docs

Documentation

  

documentation

  

enhancement

  

epic

Epic / umbrella issue

  

feature

  

frontend

  

indexer

  

low priority

Low priority, investigate other issues first

  

megaeth

  

operations

  

ops

Deploy and operations

  

performance

  

QA

  

qa checklist

  

referrals

  

removal

Legacy removal

  

security

  

smart-contracts

  

tech-debt

  

testing

  

time-arena

TimeArena v2 revamp

  

timecurve

  

visual-qa

No labels

agent:fix_bugfix

agent:fix_conflicts

agent:fix_security

agent:gap_analysis

agent:implement

agent:open_issues

agents

agent:security_audit

agent:verify

area

timecurve

arena

arena-v2

audit

block:feature_review

block:security

bug

contracts

design

devops

docs

documentation

enhancement

epic

feature

frontend

indexer

low priority

megaeth

operations

ops

performance

QA

qa checklist

referrals

removal

security

smart-contracts

tech-debt

testing

time-arena

timecurve

visual-qa

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

code/yieldomega!481

No description provided.