code/yieldomega
Watch
4
0
Fork
You've already forked yieldomega
 0
Code Issues 1 Pull requests 1 Projects Releases Packages Wiki Activity

Verify #322: fix indexer-first E2E registry #496

Merged
PlasticDigits merged 1 commit from verify/issue-322-indexer-registry into main 2026-06-14 13:32:10 +00:00
Conversation 2 Commits 1 Files changed 1 +1 -2
PlasticDigits commented 2026-06-14 13:00:47 +00:00 (Migrated from gitlab.com)

Summary

Verification of GitLab #322 found all acceptance criteria already on main except indexer-first E2E, which failed with AV: unbound variable because AdminSellVault was removed in #314. This MR drops the stale AdminSellVault key from the indexer registry JSON in scripts/e2e-anvil.sh, matching verify_indexer_stack.sh.

Acceptance checklist

Criterion Command / evidence Result
frontend-test runs lint grep 'npm run lint' .github/workflows/unit-tests.yml → line 106 PASS
Frontend lint clean (errors) cd frontend && npm run lint → exit 0 (2 warnings, 0 errors) PASS
E2E documents indexer-first mode docs/testing/e2e-anvil.md § indexer-first vs minimal; docs/testing/ci.md §322 PASS (on main)
E2E implements indexer-first mode YIELDOMEGA_E2E_INDEXER=1 bash scripts/e2e-anvil.sh → anvil-indexer-first.spec.ts ✓ PASS (after this fix)
anvil-referrals.spec.ts in default flow bash scripts/e2e-anvil.sh → includes e2e/anvil-referrals.spec.ts ✓ PASS (on main)
ci.md explains GitLab/GitHub split docs/testing/ci.md § GitLab vs GitHub CI (#322) PASS (on main)
No .gitlab-ci.yml by design test ! -f .gitlab-ci.yml PASS (on main)

Test plan

  • cd frontend && npm run lint
  • bash scripts/e2e-anvil.sh (default — referrals included)
  • YIELDOMEGA_E2E_INDEXER=1 bash scripts/e2e-anvil.sh (indexer-first spec)

Follow-ups

  • Clear the two remaining react-refresh/only-export-components ESLint warnings so CI can adopt --max-warnings 0 later.
## Summary Verification of GitLab #322 found all acceptance criteria already on `main` except indexer-first E2E, which failed with `AV: unbound variable` because `AdminSellVault` was removed in #314. This MR drops the stale `AdminSellVault` key from the indexer registry JSON in `scripts/e2e-anvil.sh`, matching `verify_indexer_stack.sh`. ## Acceptance checklist | Criterion | Command / evidence | Result | |-----------|-------------------|--------| | `frontend-test` runs lint | `grep 'npm run lint' .github/workflows/unit-tests.yml` → line 106 | **PASS** | | Frontend lint clean (errors) | `cd frontend && npm run lint` → exit 0 (2 warnings, 0 errors) | **PASS** | | E2E documents indexer-first mode | `docs/testing/e2e-anvil.md` § indexer-first vs minimal; `docs/testing/ci.md` §322 | **PASS** (on main) | | E2E implements indexer-first mode | `YIELDOMEGA_E2E_INDEXER=1 bash scripts/e2e-anvil.sh` → `anvil-indexer-first.spec.ts` ✓ | **PASS** (after this fix) | | `anvil-referrals.spec.ts` in default flow | `bash scripts/e2e-anvil.sh` → includes `e2e/anvil-referrals.spec.ts` ✓ | **PASS** (on main) | | `ci.md` explains GitLab/GitHub split | `docs/testing/ci.md` § GitLab vs GitHub CI (#322) | **PASS** (on main) | | No `.gitlab-ci.yml` by design | `test ! -f .gitlab-ci.yml` | **PASS** (on main) | ## Test plan - [x] `cd frontend && npm run lint` - [x] `bash scripts/e2e-anvil.sh` (default — referrals included) - [x] `YIELDOMEGA_E2E_INDEXER=1 bash scripts/e2e-anvil.sh` (indexer-first spec) ## Follow-ups - Clear the two remaining `react-refresh/only-export-components` ESLint warnings so CI can adopt `--max-warnings 0` later.
PlasticDigits commented 2026-06-14 13:02:33 +00:00 (Migrated from gitlab.com)

Security review — MR !496

Commit reviewed: f7055025098a764c8991333e84a13110b59cc4ce
Scope: scripts/e2e-anvil.sh — remove stale AdminSellVault / ${AV} from indexer-first E2E registry JSON (YIELDOMEGA_E2E_INDEXER=1), aligning with DeployDev #314 (AdminSellVault no longer deployed).

Outcome: FINDINGS: 0 medium+

Summary: This MR is a 3-line test-harness fix only. No production registry, indexer config defaults, smart contracts, frontend, or API handlers are changed. Prior security-review threads: none on this MR.

Areas examined

Category Result
Shell / command injection No issue. Registry JSON is built with jq -n --arg … (parameterized). ${TA}, ${PV}, ${RR} sourcing is unchanged and pre-existing. Removing --arg av "${AV}" fixes an unbound-variable failure; it does not widen injection surface.
SSRF / offchain service abuse No issue. Indexer E2E path still binds LISTEN_ADDR=127.0.0.1:${INDEXER_PORT} and uses local Anvil RPC — unchanged by this diff.
Authn / authz bypass No issue. No auth middleware or permission checks touched.
Secret leakage / logging No issue. No new logging or credential handling.
Registry validation bypass (INDEXER_PRODUCTION) No issue. E2E indexer startup does not set INDEXER_PRODUCTION; production validate_address_registry_for_production (which still requires AdminSellVault when ingestion is enabled) is unaffected.
EVM / DeFi contract risk N/A. No onchain code or deployment script changes in this diff.
Dependency / supply chain N/A. No manifest or lockfile changes.

Inline findings

None — no medium+ findings to thread on the diff.

Automated security review (EVM / Foundry / DeFi). Re-review if scope expands beyond this harness fix.

## Security review — MR !496 **Commit reviewed:** `f7055025098a764c8991333e84a13110b59cc4ce` **Scope:** `scripts/e2e-anvil.sh` — remove stale `AdminSellVault` / `${AV}` from indexer-first E2E registry JSON (`YIELDOMEGA_E2E_INDEXER=1`), aligning with DeployDev #314 (AdminSellVault no longer deployed). **Outcome:** `FINDINGS: 0` medium+ **Summary:** This MR is a 3-line test-harness fix only. No production registry, indexer config defaults, smart contracts, frontend, or API handlers are changed. Prior security-review threads: none on this MR. ### Areas examined | Category | Result | |----------|--------| | Shell / command injection | **No issue.** Registry JSON is built with `jq -n --arg …` (parameterized). `${TA}`, `${PV}`, `${RR}` sourcing is unchanged and pre-existing. Removing `--arg av "${AV}"` fixes an unbound-variable failure; it does not widen injection surface. | | SSRF / offchain service abuse | **No issue.** Indexer E2E path still binds `LISTEN_ADDR=127.0.0.1:${INDEXER_PORT}` and uses local Anvil RPC — unchanged by this diff. | | Authn / authz bypass | **No issue.** No auth middleware or permission checks touched. | | Secret leakage / logging | **No issue.** No new logging or credential handling. | | Registry validation bypass (`INDEXER_PRODUCTION`) | **No issue.** E2E indexer startup does not set `INDEXER_PRODUCTION`; production `validate_address_registry_for_production` (which still requires `AdminSellVault` when ingestion is enabled) is unaffected. | | EVM / DeFi contract risk | **N/A.** No onchain code or deployment script changes in this diff. | | Dependency / supply chain | **N/A.** No manifest or lockfile changes. | ### Inline findings None — no medium+ findings to thread on the diff. --- *Automated security review (EVM / Foundry / DeFi). Re-review if scope expands beyond this harness fix.*
PlasticDigits commented 2026-06-14 13:32:11 +00:00 (Migrated from gitlab.com)

mentioned in commit f83ad52f7b

mentioned in commit f83ad52f7bee79c73e0b8898e722adbfd2e053ce
PlasticDigits (Migrated from gitlab.com) merged commit f83ad52f7b into main 2026-06-14 13:32:11 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
agent:fix_bugfix

   
agent:fix_conflicts

   
agent:fix_security

   
agent:gap_analysis

   
agent:implement

   
agent:open_issues

   
agents

   
agent:security_audit

   
agent:verify
  
area
timecurve

  
arena

   
arena-v2

   
audit

   
block:feature_review

   
block:security

   
bug

   
contracts

   
design

   
devops

   
docs
Documentation

  
documentation

   
enhancement

   
epic
Epic / umbrella issue

  
feature

   
frontend

   
indexer

   
low priority
Low priority, investigate other issues first

  
megaeth

   
operations

   
ops
Deploy and operations

  
performance

   
QA

   
qa checklist

   
referrals

   
removal
Legacy removal

  
security

   
smart-contracts

   
tech-debt

   
testing

   
time-arena
TimeArena v2 revamp

  
timecurve

   
visual-qa
No labels
agent:fix_bugfix
agent:fix_conflicts
agent:fix_security
agent:gap_analysis
agent:implement
agent:open_issues
agents
agent:security_audit
agent:verify
area
timecurve
arena
arena-v2
audit
block:feature_review
block:security
bug
contracts
design
devops
docs
documentation
enhancement
epic
feature
frontend
indexer
low priority
megaeth
operations
ops
performance
QA
qa checklist
referrals
removal
security
smart-contracts
tech-debt
testing
time-arena
timecurve
visual-qa
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
code/yieldomega!496
No description provided.