Verify #362: WarBow viewer-summary flag timer indexer supplement #535

2026-07-07T04:08:01Z

PlasticDigits commented

2026-07-07 04:08:01 +00:00

(Migrated from gitlab.com)

Summary

Verification of GitLab #362 found the viewer-summary FLAG: line was implemented in ArenaWarbowHeroPanel but never appeared in indexer-first play (VITE_INDEXER_URL set): coreReadRowsFromArenaTimers zeroed warbowPendingFlagOwner / warbowPendingFlagPlantAt because GET /v1/arena/timers omits planted-flag fields.

This MR adds targeted onchain supplement reads (arenaV2WarbowFlagSupplementContracts) when indexer-first Arena v2 is active, merges them into useArenaSaleSession, and documents the invariant.

Verification checklist

Acceptance item	Command / evidence	Result
Viewer summary shows flag timer when planted	Manual Anvil + Playwright mock wallet: `warbow-hero-viewer-summary-flag` visible with `FLAG: MM:SS until claim`, synced with Flag subcard	PASS
No flag line when unplanted	`ArenaWarbowHeroPanel.test.tsx` — omits line when `showClaimFlagControl` false	PASS
Countdown uses same clock as Flag subcard	Manual: summary `00:02:12` matched subcard `Silence ends in 00:02:12`	PASS
Flag subcard unchanged	Manual: `warbow-hero-flag-silence-countdown` + claim CTA still render	PASS
`npm run typecheck`	`cd frontend && npm run typecheck`	PASS
`npm run lint`	`cd frontend && npm run lint`	PASS (4 pre-existing warnings)
`ArenaWarbowHeroPanel.test.tsx`	`cd frontend && npm test -- ArenaWarbowHeroPanel.test.tsx`	PASS (15/15)
Supplement mapper + indexer-first guard	`cd frontend && npm test -- arenaV2SaleSessionBridge.test.ts indexerFirstDisplay.test.ts`	PASS
Full frontend regression	`cd frontend && npm test`	SKIP — `ArenaSimplePage.test.tsx` 7 failures pre-existing on `main` (react-query mock / `shouldShowLevelLock` rename); unrelated to #362

Test plan

Unit tests for panel flag summary line
Unit tests for warbow flag supplement mapper
Manual Anvil stack (start-qa-local-full-stack.sh) + preview build with mock wallet

## Summary Verification of GitLab #362 found the viewer-summary `FLAG:` line was implemented in `ArenaWarbowHeroPanel` but never appeared in indexer-first play (`VITE_INDEXER_URL` set): `coreReadRowsFromArenaTimers` zeroed `warbowPendingFlagOwner` / `warbowPendingFlagPlantAt` because `GET /v1/arena/timers` omits planted-flag fields. This MR adds targeted onchain supplement reads (`arenaV2WarbowFlagSupplementContracts`) when indexer-first Arena v2 is active, merges them into `useArenaSaleSession`, and documents the invariant. ## Verification checklist | Acceptance item | Command / evidence | Result | |-----------------|-------------------|--------| | Viewer summary shows flag timer when planted | Manual Anvil + Playwright mock wallet: `warbow-hero-viewer-summary-flag` visible with `FLAG: MM:SS until claim`, synced with Flag subcard | **PASS** | | No flag line when unplanted | `ArenaWarbowHeroPanel.test.tsx` — omits line when `showClaimFlagControl` false | **PASS** | | Countdown uses same clock as Flag subcard | Manual: summary `00:02:12` matched subcard `Silence ends in 00:02:12` | **PASS** | | Flag subcard unchanged | Manual: `warbow-hero-flag-silence-countdown` + claim CTA still render | **PASS** | | `npm run typecheck` | `cd frontend && npm run typecheck` | **PASS** | | `npm run lint` | `cd frontend && npm run lint` | **PASS** (4 pre-existing warnings) | | `ArenaWarbowHeroPanel.test.tsx` | `cd frontend && npm test -- ArenaWarbowHeroPanel.test.tsx` | **PASS** (15/15) | | Supplement mapper + indexer-first guard | `cd frontend && npm test -- arenaV2SaleSessionBridge.test.ts indexerFirstDisplay.test.ts` | **PASS** | | Full frontend regression | `cd frontend && npm test` | **SKIP** — `ArenaSimplePage.test.tsx` 7 failures pre-existing on `main` (react-query mock / `shouldShowLevelLock` rename); unrelated to #362 | ## Test plan - [x] Unit tests for panel flag summary line - [x] Unit tests for warbow flag supplement mapper - [x] Manual Anvil stack (`start-qa-local-full-stack.sh`) + preview build with mock wallet

PlasticDigits commented

2026-07-07 04:09:46 +00:00

(Migrated from gitlab.com)

Security review — MR !535

Commit reviewed: e7c87b44c7482b1f97d85e52dc10b5a8b534c4a5
Scope: Frontend indexer-first WarBow flag supplement (arenaV2WarbowFlagSupplementContracts, mapArenaV2WarbowFlagSupplementRows, useArenaSaleSession merge), docs/invariant updates, unit tests.

Outcome: FINDINGS: 0 medium+

Security review: no medium+ findings on this diff.

Review summary

Traced attacker-controlled inputs through the changed paths:

Supplement reads — Four read-only eth_calls against configured timeArena (warbowPendingFlagOwner, warbowPendingFlagPlantAt, WARBOW_FLAG_CLAIM_BP, WARBOW_FLAG_SILENCE_SEC). Enabled only when tc && indexerOn && isArenaV2; refetchInterval: false (one-shot, not recurring polling). Contract address comes from build-time addresses.timeArena, not user input.
Mapper — mapArenaV2WarbowFlagSupplementRows tolerates partial failures; merged fields feed existing deriveWarbowClaimFlagFields, which requires matching wallet + plantAt > 0 before exposing claim UI.
Write path unchanged — submitClaimWarBowFlag still calls parameterless claimWarBowFlag; onchain TimeArena enforces msg.sender == warbowPendingFlagOwner and silence via WARBOW_FLAG_SILENCE_SEC. A hostile RPC could only mislead display/gating; the transaction reverts onchain without transferring value.
Rendering — New FLAG: summary line renders formatCountdown output only; owner address is not injected into DOM from supplement data.
Out of scope / unchanged — No indexer, contract, shell, SQL, or dependency changes in this diff.

Checked prior MR discussions: none present.

Inline threads: none (no medium+ findings).

## Security review — MR !535 **Commit reviewed:** `e7c87b44c7482b1f97d85e52dc10b5a8b534c4a5` **Scope:** Frontend indexer-first WarBow flag supplement (`arenaV2WarbowFlagSupplementContracts`, `mapArenaV2WarbowFlagSupplementRows`, `useArenaSaleSession` merge), docs/invariant updates, unit tests. **Outcome:** `FINDINGS: 0` medium+ Security review: no medium+ findings on this diff. ### Review summary Traced attacker-controlled inputs through the changed paths: - **Supplement reads** — Four read-only `eth_call`s against configured `timeArena` (`warbowPendingFlagOwner`, `warbowPendingFlagPlantAt`, `WARBOW_FLAG_CLAIM_BP`, `WARBOW_FLAG_SILENCE_SEC`). Enabled only when `tc && indexerOn && isArenaV2`; `refetchInterval: false` (one-shot, not recurring polling). Contract address comes from build-time `addresses.timeArena`, not user input. - **Mapper** — `mapArenaV2WarbowFlagSupplementRows` tolerates partial failures; merged fields feed existing `deriveWarbowClaimFlagFields`, which requires matching wallet + `plantAt > 0` before exposing claim UI. - **Write path unchanged** — `submitClaimWarBowFlag` still calls parameterless `claimWarBowFlag`; onchain `TimeArena` enforces `msg.sender == warbowPendingFlagOwner` and silence via `WARBOW_FLAG_SILENCE_SEC`. A hostile RPC could only mislead display/gating; the transaction reverts onchain without transferring value. - **Rendering** — New `FLAG:` summary line renders `formatCountdown` output only; owner address is not injected into DOM from supplement data. - **Out of scope / unchanged** — No indexer, contract, shell, SQL, or dependency changes in this diff. Checked prior MR discussions: none present. **Inline threads:** none (no medium+ findings).

PlasticDigits commented

2026-07-07 06:27:27 +00:00

(Migrated from gitlab.com)

mentioned in commit 667f2f370a

mentioned in commit 667f2f370a025bed84aed3bdb67e683b13fd654d

PlasticDigits (Migrated from gitlab.com) merged commit 667f2f370a into main

2026-07-07 06:27:27 +00:00

Sign in to join this conversation.

No reviewers

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

code/yieldomega!535

Rows
Columns