fix(verify): issue #312 podium-live verification follow-up #484

Merged

PlasticDigits merged 1 commit from verify/issue-312-autoroll-warbow-finalize into main 2026-06-14 05:46:13 +00:00

Conversation 4 Commits 1 Files changed 3 +1 -2

PlasticDigits commented 2026-06-14 05:34:01 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

Summary

Post-merge verification for GitLab #312 (MR !463 merged). Unblocks verify-podium-live-anvil.sh on current main:

• Remove stale AdminSellVault from yieldomega_verify_write_anvil_registry after #314 contract removal.
• Rename duplicate sqlx migration 20260613120000_idx_arena_buy_pay_kind_gl319 → 20260613120100 so fresh Postgres boots (was colliding with gl317 migration version).

Acceptance checklist (issue #312)

Criterion	Command / step	Result
Buys autoroll after Last Buy deadline	cd contracts && forge test --match-test test_buy_autorolls_after_last_buy_deadline	PASS
WarBow autoroll after Last Buy deadline	cd contracts && forge test --match-test test_warbow_steal_autorolls_after_last_buy_deadline	PASS
WarBow winners on-chain from BP rankings	cd contracts && forge test --match-test test_warbow_roll_auto_pays_onchain_winners	PASS
finalizeWarbowPodium superseded	cd contracts && forge test --match-test test_finalize_warbow_podium_reverts	PASS
Gas benchmark 10k players documented	cd contracts && forge test --match-contract TimeArenaWarbowBenchmark -vv	PASS (update 466,535; roll 127,536; steal 352,573)
Forge tests autoroll + ranking payout	cd contracts && forge test --match-contract TimeArena	PASS (137 tests)
No TimeArena: timer expired on buy when unpaused	_requireLive() has no deadline check; _requireLiveAndAutoroll() rolls expired podiums	PASS (code + tests)
On-chain top-3 vs brute-force ≤100	cd contracts && forge test --match-test test_warbow_ranking_matches_brute_force	PASS
Tie-break deterministic	cd contracts && forge test --match-test test_warbow_tie_break_lower_address_wins	PASS
Autoroll no double payout	cd contracts && forge test --match-test test_autoroll_no_double_payout_same_tx	PASS
Owner cannot pick arbitrary winners	finalizeWarbowPodium reverts TimeArena: superseded	PASS
New wallet enters ≤6 tracking when buffer full	cd contracts && forge test --match-test test_warbow_off_podium_tie_break_promotes_to_global + test_warbow_higher_bp_buy_enters_podium	PASS
Indexer podium live (verify-podium-live-anvil.sh)	bash scripts/verify-podium-live-anvil.sh	PARTIAL — HTTP/chain WarBow podium parity through read_block checks PASS; script exits on bundled integration_stage2 failure in postgres_stage2_persist_all_events_and_rollback_after (block_timestamp "1700000000" vs "1700000000.000000", unrelated to #312)

Follow-ups

• Fix integration_stage2 block_timestamp string parity assertion (pre-existing).
• Indexer durable WarbowPodiumFinalized projection (#112 bundle).
• Deprecate frontend warbowLeaderboardFinalizeAutofill admin tooling.

---

Note

Low Risk
Test/verify helper only; no runtime contract or indexer logic changes in this diff.

Overview
Follow-up for podium-live verification after AdminSellVault was removed from the deploy stack ([#314).

yieldomega_verify_write_anvil_registry no longer passes AV into jq or lists AdminSellVault under contracts. Written registries now only include TimeArena, PodiumVaults, and ReferralRegistry, matching what DeployDev exports so verify-podium-live-anvil.sh and indexer bootstrap do not reference a stale vault address.

^{Reviewed by Cursor Bugbot for commit 0388c86b3b. Bugbot is set up for automated code reviews on this repo. Configure here.}

## Summary Post-merge verification for GitLab #312 (MR !463 merged). Unblocks `verify-podium-live-anvil.sh` on current `main`: - Remove stale `AdminSellVault` from `yieldomega_verify_write_anvil_registry` after #314 contract removal. - Rename duplicate sqlx migration `20260613120000_idx_arena_buy_pay_kind_gl319` → `20260613120100` so fresh Postgres boots (was colliding with gl317 migration version). ## Acceptance checklist (issue #312) | Criterion | Command / step | Result | |-----------|----------------|--------| | Buys autoroll after Last Buy deadline | `cd contracts && forge test --match-test test_buy_autorolls_after_last_buy_deadline` | **PASS** | | WarBow autoroll after Last Buy deadline | `cd contracts && forge test --match-test test_warbow_steal_autorolls_after_last_buy_deadline` | **PASS** | | WarBow winners on-chain from BP rankings | `cd contracts && forge test --match-test test_warbow_roll_auto_pays_onchain_winners` | **PASS** | | `finalizeWarbowPodium` superseded | `cd contracts && forge test --match-test test_finalize_warbow_podium_reverts` | **PASS** | | Gas benchmark 10k players documented | `cd contracts && forge test --match-contract TimeArenaWarbowBenchmark -vv` | **PASS** (update **466,535**; roll **127,536**; steal **352,573**) | | Forge tests autoroll + ranking payout | `cd contracts && forge test --match-contract TimeArena` | **PASS** (137 tests) | | No `TimeArena: timer expired` on buy when unpaused | `_requireLive()` has no deadline check; `_requireLiveAndAutoroll()` rolls expired podiums | **PASS** (code + tests) | | On-chain top-3 vs brute-force ≤100 | `cd contracts && forge test --match-test test_warbow_ranking_matches_brute_force` | **PASS** | | Tie-break deterministic | `cd contracts && forge test --match-test test_warbow_tie_break_lower_address_wins` | **PASS** | | Autoroll no double payout | `cd contracts && forge test --match-test test_autoroll_no_double_payout_same_tx` | **PASS** | | Owner cannot pick arbitrary winners | `finalizeWarbowPodium` reverts `TimeArena: superseded` | **PASS** | | New wallet enters ≤6 tracking when buffer full | `cd contracts && forge test --match-test test_warbow_off_podium_tie_break_promotes_to_global` + `test_warbow_higher_bp_buy_enters_podium` | **PASS** | | Indexer podium live (`verify-podium-live-anvil.sh`) | `bash scripts/verify-podium-live-anvil.sh` | **PARTIAL** — HTTP/chain WarBow podium parity through `read_block` checks **PASS**; script exits on bundled `integration_stage2` failure in `postgres_stage2_persist_all_events_and_rollback_after` (`block_timestamp` `"1700000000"` vs `"1700000000.000000"`, unrelated to #312) | ## Follow-ups - Fix `integration_stage2` `block_timestamp` string parity assertion (pre-existing). - Indexer durable `WarbowPodiumFinalized` projection ([#112](https://gitlab.com/PlasticDigits/yieldomega/-/issues/112) bundle). - Deprecate frontend `warbowLeaderboardFinalizeAutofill` admin tooling. <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Low Risk** > Test/verify helper only; no runtime contract or indexer logic changes in this diff. > > **Overview** > Follow-up for podium-live verification after **AdminSellVault** was removed from the deploy stack ([#314). > > **`yieldomega_verify_write_anvil_registry`** no longer passes **`AV`** into **`jq`** or lists **`AdminSellVault`** under **`contracts`**. Written registries now only include **`TimeArena`**, **`PodiumVaults`**, and **`ReferralRegistry`**, matching what **`DeployDev`** exports so **`verify-podium-live-anvil.sh`** and indexer bootstrap do not reference a stale vault address. > > ^{Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 0388c86b3b4e7bec991356513de6c04ad168f408. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).} <!-- /CURSOR_SUMMARY -->

project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-14 05:34:08 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

changed the description

changed the description

project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-14 05:34:14 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

changed the description

changed the description

PlasticDigits commented 2026-06-14 05:38:25 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

Security review — MR !484

Commit reviewed: 0388c86b3b4e7bec991356513de6c04ad168f408

Scope: Diff vs main — migration version rename (20260613120000 → 20260613120100, content unchanged) and removal of stale AdminSellVault from yieldomega_verify_write_anvil_registry in scripts/lib/verify_indexer_stack.sh.

Method: Traced attacker-controlled input to sinks (shell/jq/SQL/registry JSON/indexer ingest). Re-checked prior MR security threads — none existed.

Findings

FINDINGS: 0 (no medium, high, or critical)

Outcome: NONE — Security review: no medium+ findings on this diff.

Notes (informational, below reporting threshold)

Change	Assessment
Migration rename	Identical SQL; fixes sqlx version collision on fresh Postgres. No injection surface (ADD COLUMN pay_kind SMALLINT).
Drop AdminSellVault from verify registry writer	Local Anvil verify helper only (verify_indexer_stack.sh → verify-*-anvil.sh). Aligns with DeployDev / yieldomega_export_deploy_addrs_from_log after #314 removal. Indexer already treats empty/missing AdminSellVault as optional (index_addresses skips empty; production validate_address_registry_for_production does not require it). No production registry path or on-chain contract logic changed.

Inline threads: none (no findings to anchor).

## Security review — MR !484 **Commit reviewed:** `0388c86b3b4e7bec991356513de6c04ad168f408` **Scope:** Diff vs `main` — migration version rename (`20260613120000` → `20260613120100`, content unchanged) and removal of stale `AdminSellVault` from `yieldomega_verify_write_anvil_registry` in `scripts/lib/verify_indexer_stack.sh`. **Method:** Traced attacker-controlled input to sinks (shell/`jq`/SQL/registry JSON/indexer ingest). Re-checked prior MR security threads — none existed. ### Findings **FINDINGS: 0** (no medium, high, or critical) **Outcome:** `NONE` — Security review: no medium+ findings on this diff. ### Notes (informational, below reporting threshold) | Change | Assessment | |--------|------------| | Migration rename | Identical SQL; fixes sqlx version collision on fresh Postgres. No injection surface (`ADD COLUMN pay_kind SMALLINT`). | | Drop `AdminSellVault` from verify registry writer | Local Anvil verify helper only (`verify_indexer_stack.sh` → `verify-*-anvil.sh`). Aligns with `DeployDev` / `yieldomega_export_deploy_addrs_from_log` after #314 removal. Indexer already treats empty/missing `AdminSellVault` as optional (`index_addresses` skips empty; production `validate_address_registry_for_production` does not require it). No production registry path or on-chain contract logic changed. | **Inline threads:** none (no findings to anchor).

PlasticDigits commented 2026-06-14 05:46:13 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

mentioned in commit 862964dbc7

mentioned in commit 862964dbc72db7b7fb78fb31451e989b7184ed9e

PlasticDigits (Migrated from gitlab.com) merged commit 862964dbc7 into main 2026-06-14 05:46:13 +00:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

agent:fix_bugfix

  

agent:fix_conflicts

  

agent:fix_security

  

agent:gap_analysis

  

agent:implement

  

agent:open_issues

  

agents

  

agent:security_audit

  

agent:verify

  

area

timecurve

  

arena

  

arena-v2

  

audit

  

block:feature_review

  

block:security

  

bug

  

contracts

  

design

  

devops

  

docs

Documentation

  

documentation

  

enhancement

  

epic

Epic / umbrella issue

  

feature

  

frontend

  

indexer

  

low priority

Low priority, investigate other issues first

  

megaeth

  

operations

  

ops

Deploy and operations

  

performance

  

QA

  

qa checklist

  

referrals

  

removal

Legacy removal

  

security

  

smart-contracts

  

tech-debt

  

testing

  

time-arena

TimeArena v2 revamp

  

timecurve

  

visual-qa

No labels

agent:fix_bugfix

agent:fix_conflicts

agent:fix_security

agent:gap_analysis

agent:implement

agent:open_issues

agents

agent:security_audit

agent:verify

area

timecurve

arena

arena-v2

audit

block:feature_review

block:security

bug

contracts

design

devops

docs

documentation

enhancement

epic

feature

frontend

indexer

low priority

megaeth

operations

ops

performance

QA

qa checklist

referrals

removal

security

smart-contracts

tech-debt

testing

time-arena

timecurve

visual-qa

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

code/yieldomega!484

No description provided.