code/yieldomega
Watch
4
0
Fork
You've already forked yieldomega
 0
Code Issues 1 Pull requests 1 Projects Releases Packages Wiki Activity

WarBow steal daily-cap UX: UTC reset in summary and inline cap warning (#361) #533

Merged
PlasticDigits merged 2 commits from issue-361-warbow-steal-cap-ux into main 2026-07-07 03:32:46 +00:00
Conversation 7 Commits 2 Files changed 12 +373 -32
PlasticDigits commented 2026-07-07 02:39:25 +00:00 (Migrated from gitlab.com)

Summary

Implements GitLab #361 (parent #360): WarBow play surface now surfaces UTC-day steal quota and pre-submit cap warnings.

  • Viewer summary — third line STEAL QUOTA: X / 3 · resets in HH:MM:SS using onchain stealsCommittedByAttackerOnDay and warbowUtcDayResetSec (matches TimeArena floor division).
  • Steal card — describeStealPreflight renders directly above Steal when a victim is selected; Steal disabled on preflight error; submit path reads fresh attacker + victim cap counts.
  • Indexer-first (#301) — clock from indexer head; victim BP from indexed targets when configured; UTC-day cap reads remain targeted onchain only (indexer has no daily-cap mirror).
  • Docs/skills — INV-FRONTEND-361-WARBOW-STEAL-CAP-UX, arena-views §361, play-time-arena-warbow skill.

Acceptance checklist

Criterion Verification Result
Connected viewer summary shows attacker steal X/3 + UTC-day reset countdown cd frontend && npm test -- ArenaWarbowHeroPanel.test.ts PASS
Inline cap warning in steal card above Steal via describeStealPreflight cd frontend && npm test -- ArenaWarbowHeroPanel.test.ts timeArenaUx.test.ts PASS
Warning updates with victim / bypass / clock (no failed tx required) useArenaWarbowHero stealPreflight useMemo + contract reads; unit tests PASS
Indexer-first stack: correct countdown/caps, no extra BP/guard RPC mirrors cd frontend && npm test -- indexerFirstDisplay.test.ts PASS
No contract changes diff scope PASS
npm run typecheck && npm run lint && npm test (frontend) cd frontend && npm run typecheck && npm run lint — PASS; npm test — 7 pre-existing failures in ArenaSimplePage.test.tsx (useQuery mock); issue-targeted suites PASS PARTIAL
Manual Anvil play / quota + inline warning Not run this session (stack not started) SKIP
No new browser RPC mirrors for indexer-first display (#301) indexerFirstDisplay.test.ts PASS

Blockers: Full npm test still has unrelated ArenaSimplePage.test.tsx react-query mock failures on main; issue-specific suites pass.

Third-party verification

cd frontend && npm run typecheck && npm run lint
cd frontend && npm test -- warbowUtcDayReset.test.ts ArenaWarbowHeroPanel.test.ts timeArenaUx.test.ts indexerFirstDisplay.test.ts

Manual (Anvil stack):

export PATH="$HOME/.foundry/bin:$PATH"
SKIP_ANVIL_RICH_STATE=1 YIELDOMEGA_DEPLOY_NO_COOLDOWN=1 START_BOT_SWARM=0 \
  bash scripts/start-qa-local-full-stack.sh --live-sale --no-swarm --no-frontend
cd frontend && npm run dev

At / with a connected wallet: viewer summary shows STEAL QUOTA + countdown; select a capped victim with bypass off → warning appears above Steal before submit.

## Summary Implements GitLab #361 (parent #360): WarBow play surface now surfaces UTC-day steal quota and pre-submit cap warnings. - **Viewer summary** — third line `STEAL QUOTA: X / 3 · resets in HH:MM:SS` using onchain `stealsCommittedByAttackerOnDay` and `warbowUtcDayResetSec` (matches `TimeArena` floor division). - **Steal card** — `describeStealPreflight` renders directly above **Steal** when a victim is selected; **Steal** disabled on preflight `error`; submit path reads fresh attacker + victim cap counts. - **Indexer-first (#301)** — clock from indexer head; victim BP from indexed targets when configured; UTC-day cap reads remain targeted onchain only (indexer has no daily-cap mirror). - Docs/skills — `INV-FRONTEND-361-WARBOW-STEAL-CAP-UX`, arena-views §361, `play-time-arena-warbow` skill. ## Acceptance checklist | Criterion | Verification | Result | |-----------|--------------|--------| | Connected viewer summary shows attacker steal `X/3` + UTC-day reset countdown | `cd frontend && npm test -- ArenaWarbowHeroPanel.test.ts` | PASS | | Inline cap warning in steal card above Steal via `describeStealPreflight` | `cd frontend && npm test -- ArenaWarbowHeroPanel.test.ts timeArenaUx.test.ts` | PASS | | Warning updates with victim / bypass / clock (no failed tx required) | `useArenaWarbowHero` stealPreflight `useMemo` + contract reads; unit tests | PASS | | Indexer-first stack: correct countdown/caps, no extra BP/guard RPC mirrors | `cd frontend && npm test -- indexerFirstDisplay.test.ts` | PASS | | No contract changes | diff scope | PASS | | `npm run typecheck && npm run lint && npm test` (frontend) | `cd frontend && npm run typecheck && npm run lint` — PASS; `npm test` — 7 pre-existing failures in `ArenaSimplePage.test.tsx` (`useQuery` mock); issue-targeted suites PASS | PARTIAL | | Manual Anvil play `/` quota + inline warning | Not run this session (stack not started) | SKIP | | No new browser RPC mirrors for indexer-first display (#301) | `indexerFirstDisplay.test.ts` | PASS | **Blockers:** Full `npm test` still has unrelated `ArenaSimplePage.test.tsx` react-query mock failures on `main`; issue-specific suites pass. ## Third-party verification ```bash cd frontend && npm run typecheck && npm run lint cd frontend && npm test -- warbowUtcDayReset.test.ts ArenaWarbowHeroPanel.test.ts timeArenaUx.test.ts indexerFirstDisplay.test.ts ``` Manual (Anvil stack): ```bash export PATH="$HOME/.foundry/bin:$PATH" SKIP_ANVIL_RICH_STATE=1 YIELDOMEGA_DEPLOY_NO_COOLDOWN=1 START_BOT_SWARM=0 \ bash scripts/start-qa-local-full-stack.sh --live-sale --no-swarm --no-frontend cd frontend && npm run dev ``` At `/` with a connected wallet: viewer summary shows **STEAL QUOTA** + countdown; select a capped victim with bypass off → warning appears above **Steal** before submit.
project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-07-07 02:39:30 +00:00 (Migrated from gitlab.com)

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the [Cursor dashboard](https://www.cursor.com/dashboard/bugbot) to get automatic reviews on future PRs.
PlasticDigits commented 2026-07-07 02:42:59 +00:00 (Migrated from gitlab.com)

Security review — MR !533

Commit reviewed: 78f57e5fccc3c80496075f1dded250ab1f2c083d
Base: 7623e590c5da80c37eefc47998da41ed48345ad9

Scope

Frontend-only WarBow steal daily-cap UX (#361): UTC-day reset countdown, inline describeStealPreflight warnings, targeted onchain stealsCommittedByAttackerOnDay / stealsReceivedOnDay reads, and submit-time fresh attacker cap read in readFreshWarbowStealSubmitPreflight. No contract, indexer API, or dependency changes.

Method

  • Traced attacker-controlled inputs (victim address, indexer warbowTargets BP, chainNowSec) to sinks (React render, eth_call args, warbowSteal submit).
  • Verified submit path still blocks on fresh onchain preflight error tone before allowance/tx; cap enforcement remains onchain in TimeArena.
  • Checked XSS surface (StatusMessage text children; describeStealPreflight uses static copy + shortAddress on validated 0x addresses).
  • Re-read prior MR discussions: no prior security-review threads to reconcile.

Outcome

FINDINGS: 0 (no medium, high, or critical issues on this diff)

Security review: no medium+ findings on this diff.

Inline threads: none.

Notes (informational, below threshold)

  • Indexer-sourced victim BP for display preflight when VITE_INDEXER_URL is set is unchanged from #301; submit still uses fresh onchain victim BP/caps/guard. Stale indexer data may mislead UI but does not bypass onchain checks.
  • UI disables Steal only on preflight error; warning (daily cap) still allows submit — intentional, with onchain revert if bypass not selected.
## Security review — MR !533 **Commit reviewed:** `78f57e5fccc3c80496075f1dded250ab1f2c083d` **Base:** `7623e590c5da80c37eefc47998da41ed48345ad9` ### Scope Frontend-only WarBow steal daily-cap UX (#361): UTC-day reset countdown, inline `describeStealPreflight` warnings, targeted onchain `stealsCommittedByAttackerOnDay` / `stealsReceivedOnDay` reads, and submit-time fresh attacker cap read in `readFreshWarbowStealSubmitPreflight`. No contract, indexer API, or dependency changes. ### Method - Traced attacker-controlled inputs (victim address, indexer `warbowTargets` BP, `chainNowSec`) to sinks (React render, `eth_call` args, `warbowSteal` submit). - Verified submit path still blocks on fresh onchain preflight `error` tone before allowance/tx; cap enforcement remains onchain in `TimeArena`. - Checked XSS surface (`StatusMessage` text children; `describeStealPreflight` uses static copy + `shortAddress` on validated `0x` addresses). - Re-read prior MR discussions: no prior security-review threads to reconcile. ### Outcome **FINDINGS: 0** (no medium, high, or critical issues on this diff) **Security review: no medium+ findings on this diff.** Inline threads: none. ### Notes (informational, below threshold) - Indexer-sourced victim BP for *display* preflight when `VITE_INDEXER_URL` is set is unchanged from #301; submit still uses fresh onchain victim BP/caps/guard. Stale indexer data may mislead UI but does not bypass onchain checks. - UI disables **Steal** only on preflight `error`; `warning` (daily cap) still allows submit — intentional, with onchain revert if bypass not selected.
PlasticDigits commented 2026-07-07 02:54:38 +00:00 (Migrated from gitlab.com)

added 3 commits

  • 78f57e5f...b29ccf01 - 2 commits from branch main
  • 824be4bf - Merge origin/main into issue-361-warbow-steal-cap-ux

Compare with previous version

added 3 commits <ul><li>78f57e5f...b29ccf01 - 2 commits from branch <code>main</code></li><li>824be4bf - Merge origin/main into issue-361-warbow-steal-cap-ux</li></ul> [Compare with previous version](/PlasticDigits/yieldomega/-/merge_requests/163/diffs?diff_id=1889055789&start_sha=78f57e5fccc3c80496075f1dded250ab1f2c083d)
project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-07-07 02:54:40 +00:00 (Migrated from gitlab.com)

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the [Cursor dashboard](https://www.cursor.com/dashboard/bugbot) to get automatic reviews on future PRs.
PlasticDigits commented 2026-07-07 02:54:41 +00:00 (Migrated from gitlab.com)

Resolved merge conflicts with main by keeping both viewer-summary features:

  • #361 — STEAL QUOTA line (warbow-hero-steal-quota-summary) with UTC-day reset countdown
  • #362 — conditional FLAG: line (warbow-hero-viewer-summary-flag) when the viewer holds a planted flag

skills/play-time-arena-warbow/SKILL.md documents both invariants. Sanity: npm run typecheck and targeted tests (ArenaWarbowHeroPanel, warbowUtcDayReset, timeArenaUx, indexerFirstDisplay) — all PASS.

Resolved merge conflicts with `main` by keeping **both** viewer-summary features: - **#361** — `STEAL QUOTA` line (`warbow-hero-steal-quota-summary`) with UTC-day reset countdown - **#362** — conditional `FLAG:` line (`warbow-hero-viewer-summary-flag`) when the viewer holds a planted flag `skills/play-time-arena-warbow/SKILL.md` documents both invariants. Sanity: `npm run typecheck` and targeted tests (`ArenaWarbowHeroPanel`, `warbowUtcDayReset`, `timeArenaUx`, `indexerFirstDisplay`) — all PASS.
PlasticDigits commented 2026-07-07 02:57:04 +00:00 (Migrated from gitlab.com)

Security review — MR !533

Commit reviewed: 824be4bf42221c9ce87e8e745c8a48cbca9989d0
Base: b29ccf014063701fa055d87fc64d01e705089718

Scope

Frontend-only WarBow steal daily-cap UX (#361): UTC-day reset countdown in viewer summary, inline describeStealPreflight warnings above Steal, targeted onchain stealsCommittedByAttackerOnDay / stealsReceivedOnDay reads, and submit-time fresh attacker cap read in readFreshWarbowStealSubmitPreflight. Merge commit also retains #362 viewer-summary FLAG: line from conflict resolution. No contract, indexer API, or dependency changes.

Method

  • Traced attacker-controlled inputs (victim address text field, indexer warbowTargets.battlePoints, indexer chainNowSec) to sinks (React render via StatusMessage, eth_call args on fixed TimeArena address, warbowSteal submit).
  • Verified victim addresses pass isAddress before contract reads; narrative copy uses shortAddress on validated 0x addresses (React text children, no dangerouslySetInnerHTML).
  • Verified submit path blocks on fresh onchain preflight error tone before allowance/tx; daily-cap enforcement remains onchain in TimeArena.warbowSteal (stealsReceivedOnDay / stealsCommittedByAttackerOnDay with block.timestamp / SECONDS_PER_DAY).
  • Re-read prior security-review note on 78f57e5f: findings still do not apply; merge delta (#362 FLAG summary line) is static copy + formatCountdown(number) only.

Outcome

FINDINGS: 0 (no medium, high, or critical issues on this diff)

Security review: no medium+ findings on this diff.

Inline threads: none.

Notes (informational, below threshold)

  • Indexer-sourced victim BP for display preflight when VITE_INDEXER_URL is set follows existing #301 pattern; submit still uses fresh onchain victim BP/caps/guard. Stale indexer data may mislead UI but cannot bypass onchain checks.
  • UI disables Steal only on preflight error; warning (daily cap) still allows submit — intentional, with onchain revert if bypass not selected.
  • utcDayId in submit preflight is derived from cached chainNowSec; day-boundary skew may affect warning accuracy but not cap enforcement onchain.
## Security review — MR !533 **Commit reviewed:** `824be4bf42221c9ce87e8e745c8a48cbca9989d0` **Base:** `b29ccf014063701fa055d87fc64d01e705089718` ### Scope Frontend-only WarBow steal daily-cap UX (#361): UTC-day reset countdown in viewer summary, inline `describeStealPreflight` warnings above **Steal**, targeted onchain `stealsCommittedByAttackerOnDay` / `stealsReceivedOnDay` reads, and submit-time fresh attacker cap read in `readFreshWarbowStealSubmitPreflight`. Merge commit also retains #362 viewer-summary **FLAG:** line from conflict resolution. No contract, indexer API, or dependency changes. ### Method - Traced attacker-controlled inputs (victim address text field, indexer `warbowTargets.battlePoints`, indexer `chainNowSec`) to sinks (React render via `StatusMessage`, `eth_call` args on fixed `TimeArena` address, `warbowSteal` submit). - Verified victim addresses pass `isAddress` before contract reads; narrative copy uses `shortAddress` on validated `0x` addresses (React text children, no `dangerouslySetInnerHTML`). - Verified submit path blocks on fresh onchain preflight `error` tone before allowance/tx; daily-cap enforcement remains onchain in `TimeArena.warbowSteal` (`stealsReceivedOnDay` / `stealsCommittedByAttackerOnDay` with `block.timestamp / SECONDS_PER_DAY`). - Re-read prior security-review note on `78f57e5f`: findings still do not apply; merge delta (#362 FLAG summary line) is static copy + `formatCountdown(number)` only. ### Outcome **FINDINGS: 0** (no medium, high, or critical issues on this diff) **Security review: no medium+ findings on this diff.** Inline threads: none. ### Notes (informational, below threshold) - Indexer-sourced victim BP for *display* preflight when `VITE_INDEXER_URL` is set follows existing #301 pattern; submit still uses fresh onchain victim BP/caps/guard. Stale indexer data may mislead UI but cannot bypass onchain checks. - UI disables **Steal** only on preflight `error`; `warning` (daily cap) still allows submit — intentional, with onchain revert if bypass not selected. - `utcDayId` in submit preflight is derived from cached `chainNowSec`; day-boundary skew may affect warning accuracy but not cap enforcement onchain.
PlasticDigits commented 2026-07-07 03:32:47 +00:00 (Migrated from gitlab.com)

mentioned in commit 6550fe97a0

mentioned in commit 6550fe97a010c59e02b6a8e02856e75e71ab5f84
PlasticDigits (Migrated from gitlab.com) merged commit 6550fe97a0 into main 2026-07-07 03:32:47 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
agent:fix_bugfix

   
agent:fix_conflicts

   
agent:fix_security

   
agent:gap_analysis

   
agent:implement

   
agent:open_issues

   
agents

   
agent:security_audit

   
agent:verify
  
area
timecurve

  
arena

   
arena-v2

   
audit

   
block:feature_review

   
block:security

   
bug

   
contracts

   
design

   
devops

   
docs
Documentation

  
documentation

   
enhancement

   
epic
Epic / umbrella issue

  
feature

   
frontend

   
indexer

   
low priority
Low priority, investigate other issues first

  
megaeth

   
operations

   
ops
Deploy and operations

  
performance

   
QA

   
qa checklist

   
referrals

   
removal
Legacy removal

  
security

   
smart-contracts

   
tech-debt

   
testing

   
time-arena
TimeArena v2 revamp

  
timecurve

   
visual-qa
No labels
agent:fix_bugfix
agent:fix_conflicts
agent:fix_security
agent:gap_analysis
agent:implement
agent:open_issues
agents
agent:security_audit
agent:verify
area
timecurve
arena
arena-v2
audit
block:feature_review
block:security
bug
contracts
design
devops
docs
documentation
enhancement
epic
feature
frontend
indexer
low priority
megaeth
operations
ops
performance
QA
qa checklist
referrals
removal
security
smart-contracts
tech-debt
testing
time-arena
timecurve
visual-qa
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
code/yieldomega!533
No description provided.