code/yieldomega
Watch
4
0
Fork
You've already forked yieldomega
 0
Code Issues 1 Pull requests 1 Projects Releases Packages Wiki Activity

Add chain 4326 TWAP hard-reset Forge test (#352) #523

Merged
PlasticDigits merged 1 commit from issue-352-twap-hard-reset-4326 into main 2026-06-26 03:37:43 +00:00
Conversation 2 Commits 1 Files changed 4 +125 -3
PlasticDigits commented 2026-06-25 22:38:17 +00:00 (Migrated from gitlab.com)

Summary

Adds Forge coverage for GitLab #352: TimeArena Last Buy hard reset on MegaETH chain 4326 uses ArenaCharmPriceTwap (production Kumbaya V3 TWAP path), not the Anvil spot oracle.

What changed

  • New contracts/test/TimeArenaTwapHardReset4326.t.sol — vm.chainId(4326) with mocked MegaETH factory/pools (vm.etch); triggers Last Buy hard reset; asserts lastBuyEpoch, epochCharmAnchorWad, doubOwedForBuy, and buy DOUB pull match TWAP-derived anchor.
  • Docs/invariants: INV-TIME-ARENA-EPOCH-CHARM-TWAP-4326; cross-links in time-arena.md, invariants-and-business-logic.md, skills/play-time-arena-doub/SKILL.md.

Why: Anvil spot tests (#305/#315) did not exercise the block.chainid == 4326 branch in _sampleCharmAnchor, risking transition divergence at epoch boundary.

Acceptance checklist

Criterion Command / step Result
New Forge test passes with vm.chainId(4326) on default Anvil setup cd contracts && forge test --match-contract TimeArenaTwapHardReset4326Test PASS
Asserts transition fields after hard reset (lastBuyEpoch, epochCharmAnchorWad, doubOwedForBuy) same test (test_chain4326_last_buy_hard_reset_twap_reanchor) PASS
forge test clean excluding optional fork/airdrop skips cd contracts && forge test --no-match-contract "DoubAirdropMegaethFork|TimeArenaWarbowBenchmark" PASS (225/225)
Invariants documented + cross-linked docs/testing/invariants-and-business-logic.md, docs/product/time-arena.md, skills/play-time-arena-doub/SKILL.md PASS

Verification for third parties

cd contracts && forge test --match-contract TimeArenaTwapHardReset4326Test -vv
cd contracts && forge test --no-match-contract "DoubAirdropMegaethFork|TimeArenaWarbowBenchmark"

Confirm test comments reference MegaETH 4326 and that charmAnchorKumbayaRouter stays zero (TWAP path, not Anvil spot).

Related issue: #352 (leave open until merge).

## Summary Adds Forge coverage for GitLab #352: **TimeArena Last Buy hard reset on MegaETH chain 4326** uses `ArenaCharmPriceTwap` (production Kumbaya V3 TWAP path), not the Anvil spot oracle. **What changed** - New `contracts/test/TimeArenaTwapHardReset4326.t.sol` — `vm.chainId(4326)` with mocked MegaETH factory/pools (`vm.etch`); triggers Last Buy hard reset; asserts `lastBuyEpoch`, `epochCharmAnchorWad`, `doubOwedForBuy`, and buy DOUB pull match TWAP-derived anchor. - Docs/invariants: `INV-TIME-ARENA-EPOCH-CHARM-TWAP-4326`; cross-links in `time-arena.md`, `invariants-and-business-logic.md`, `skills/play-time-arena-doub/SKILL.md`. **Why:** Anvil spot tests (#305/#315) did not exercise the `block.chainid == 4326` branch in `_sampleCharmAnchor`, risking transition divergence at epoch boundary. ## Acceptance checklist | Criterion | Command / step | Result | |-----------|----------------|--------| | New Forge test passes with `vm.chainId(4326)` on default Anvil setup | `cd contracts && forge test --match-contract TimeArenaTwapHardReset4326Test` | PASS | | Asserts transition fields after hard reset (`lastBuyEpoch`, `epochCharmAnchorWad`, `doubOwedForBuy`) | same test (`test_chain4326_last_buy_hard_reset_twap_reanchor`) | PASS | | `forge test` clean excluding optional fork/airdrop skips | `cd contracts && forge test --no-match-contract "DoubAirdropMegaethFork\|TimeArenaWarbowBenchmark"` | PASS (225/225) | | Invariants documented + cross-linked | `docs/testing/invariants-and-business-logic.md`, `docs/product/time-arena.md`, `skills/play-time-arena-doub/SKILL.md` | PASS | ## Verification for third parties ```bash cd contracts && forge test --match-contract TimeArenaTwapHardReset4326Test -vv cd contracts && forge test --no-match-contract "DoubAirdropMegaethFork|TimeArenaWarbowBenchmark" ``` Confirm test comments reference MegaETH **4326** and that `charmAnchorKumbayaRouter` stays zero (TWAP path, not Anvil spot). Related issue: #352 (leave open until merge).
PlasticDigits commented 2026-06-25 22:40:23 +00:00 (Migrated from gitlab.com)

Security review — MR !523

Commit reviewed: e006e48698eb377c5940501b43bf1d43114f24d1
Base: fd6da035719d8096b21c7c91b8032f2f7dea2c69

Scope

  • contracts/test/TimeArenaTwapHardReset4326.t.sol (new Forge test)
  • Doc/invariant cross-links: time-arena.md, invariants-and-business-logic.md, skills/play-time-arena-doub/SKILL.md

Method

Traced attacker-controlled inputs through the diff and exercised production paths referenced by the test (TimeArena._sampleCharmAnchor chain-4326 branch, ArenaCharmPriceTwap.computeMegaethMainnet, doubOwedForBuy at hard-reset boundary). Checked for injection, authz, secret leakage, SSRF/XSS, supply-chain, and EVM-specific risks (reentrancy, oracle manipulation, access control). No prior security-review threads on this MR.

Outcome

FINDINGS: 0 medium+

Security review: no medium+ findings on this diff.

This MR adds test-only coverage and documentation. It does not modify production contracts, scripts, indexer, or frontend runtime code. The new test uses standard Foundry cheatcodes (vm.chainId, vm.etch, vm.warp) with existing test/mocks/* helpers and hardcoded MegaETH addresses already present in ArenaCharmPriceTwap.sol. No secrets, credentials, or new dependencies were introduced. Mock contracts and vm.etch cannot affect mainnet deployment artifacts.

The test validates that Last Buy hard reset on chain 4326 re-anchors from ArenaCharmPriceTwap and that doubOwedForBuy matches the subsequent buy DOUB pull — consistent with existing nonReentrant buy flow and pre-existing TWAP safeguards (15-minute horizon, observation cardinality, spot/TWAP deviation band). No new exploitable sink or permission-boundary regression was identified.

Inline threads

None (no medium+ findings).

## Security review — MR !523 **Commit reviewed:** `e006e48698eb377c5940501b43bf1d43114f24d1` **Base:** `fd6da035719d8096b21c7c91b8032f2f7dea2c69` ### Scope - `contracts/test/TimeArenaTwapHardReset4326.t.sol` (new Forge test) - Doc/invariant cross-links: `time-arena.md`, `invariants-and-business-logic.md`, `skills/play-time-arena-doub/SKILL.md` ### Method Traced attacker-controlled inputs through the diff and exercised production paths referenced by the test (`TimeArena._sampleCharmAnchor` chain-4326 branch, `ArenaCharmPriceTwap.computeMegaethMainnet`, `doubOwedForBuy` at hard-reset boundary). Checked for injection, authz, secret leakage, SSRF/XSS, supply-chain, and EVM-specific risks (reentrancy, oracle manipulation, access control). No prior security-review threads on this MR. ### Outcome **FINDINGS: 0 medium+** Security review: **no medium+ findings** on this diff. This MR adds test-only coverage and documentation. It does **not** modify production contracts, scripts, indexer, or frontend runtime code. The new test uses standard Foundry cheatcodes (`vm.chainId`, `vm.etch`, `vm.warp`) with existing `test/mocks/*` helpers and hardcoded MegaETH addresses already present in `ArenaCharmPriceTwap.sol`. No secrets, credentials, or new dependencies were introduced. Mock contracts and `vm.etch` cannot affect mainnet deployment artifacts. The test validates that Last Buy hard reset on chain 4326 re-anchors from `ArenaCharmPriceTwap` and that `doubOwedForBuy` matches the subsequent `buy` DOUB pull — consistent with existing `nonReentrant` buy flow and pre-existing TWAP safeguards (15-minute horizon, observation cardinality, spot/TWAP deviation band). No new exploitable sink or permission-boundary regression was identified. ### Inline threads None (no medium+ findings).
PlasticDigits (Migrated from gitlab.com) merged commit 87b4f06ce1 into main 2026-06-26 03:37:43 +00:00
PlasticDigits commented 2026-06-26 03:37:44 +00:00 (Migrated from gitlab.com)

mentioned in commit 87b4f06ce1

mentioned in commit 87b4f06ce127da9023939ceb4fcb43b6ba48a960
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
agent:fix_bugfix

   
agent:fix_conflicts

   
agent:fix_security

   
agent:gap_analysis

   
agent:implement

   
agent:open_issues

   
agents

   
agent:security_audit

   
agent:verify
  
area
timecurve

  
arena

   
arena-v2

   
audit

   
block:feature_review

   
block:security

   
bug

   
contracts

   
design

   
devops

   
docs
Documentation

  
documentation

   
enhancement

   
epic
Epic / umbrella issue

  
feature

   
frontend

   
indexer

   
low priority
Low priority, investigate other issues first

  
megaeth

   
operations

   
ops
Deploy and operations

  
performance

   
QA

   
qa checklist

   
referrals

   
removal
Legacy removal

  
security

   
smart-contracts

   
tech-debt

   
testing

   
time-arena
TimeArena v2 revamp

  
timecurve

   
visual-qa
No labels
agent:fix_bugfix
agent:fix_conflicts
agent:fix_security
agent:gap_analysis
agent:implement
agent:open_issues
agents
agent:security_audit
agent:verify
area
timecurve
arena
arena-v2
audit
block:feature_review
block:security
bug
contracts
design
devops
docs
documentation
enhancement
epic
feature
frontend
indexer
low priority
megaeth
operations
ops
performance
QA
qa checklist
referrals
removal
security
smart-contracts
tech-debt
testing
time-arena
timecurve
visual-qa
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
code/yieldomega!523
No description provided.