code/yieldomega

Watch

Fork 0

Verify #364: fix arena events Anvil verify and E2E seeding #538

Merged

PlasticDigits merged 1 commit from verify/364-arena-event-pages-fix into main

2026-07-07 12:25:18 +00:00

PlasticDigits commented

2026-07-07 10:00:33 +00:00

(Migrated from gitlab.com)

Summary

Issue #364 implementation is on main; verification found the Anvil smoke script and Playwright spec did not actually trigger LastBuyEpochStarted ingest (hard-reset warp vs podium-deadline autoroll). This MR fixes verify/E2E seeding and wires the audit-events spec into indexer-first e2e-anvil.sh.

Verification checklist

Acceptance / verification item	Command / evidence	Result
Indexer clippy + unit/integration	`cd indexer && cargo clippy --all-targets -- -D warnings && cargo test`	PASS
Frontend typecheck/lint/unit	`cd frontend && npm run typecheck && npm run lint && npm test`	PASS (896 tests)
Arena events Anvil API smoke	`bash scripts/verify-arena-events-anvil.sh`	PASS (after fix)
Playwright audit directory → event page	`YIELDOMEGA_E2E_INDEXER=1 PLAYWRIGHT_SPECS=e2e/anvil-audit-events.spec.ts bash scripts/e2e-anvil.sh`	PASS (2 tests incl. mobile 390×844)
`/audit` filter + searchable directory	E2E `arena-event-directory` visible; unit `ArenaEventDirectorySection.test.tsx`	PASS
Permanent `/audit/events/{id}` pages	E2E: title, tx replay, CTAs	PASS
Indexer list/detail endpoints (no browser RPC)	`verify-arena-events-anvil.sh` + `integration_stage2::api_arena_events_smoke`	PASS
Referral routing guard	`referralPathReserved.test.ts`; routes before `/:referralSegment` in `LaunchGate.tsx`	PASS (existing)
Offline/empty indexer degrade	`useArenaEventDirectory` note string; directory tests	PASS (existing)
Yield Omega copy audit	`ArenaEventDirectorySection` / event page strings; `frontendContentAudit` suite	PASS (existing)
Attack/abuse: bad id → 400, limit clamp	`integration_stage2` events smoke + verify script `not-valid` probe	PASS
Manual mobile legibility	Playwright mobile-width test in `anvil-audit-events.spec.ts`	PASS

Follow-ups

verify-last-buy-epoch-anvil.sh still uses the old hard-reset warp sequence; consider aligning it with podium-deadline autoroll (same root cause as this fix).

## Summary Issue #364 implementation is on `main`; verification found the Anvil smoke script and Playwright spec did not actually trigger `LastBuyEpochStarted` ingest (hard-reset warp vs podium-deadline autoroll). This MR fixes verify/E2E seeding and wires the audit-events spec into indexer-first `e2e-anvil.sh`. ## Verification checklist | Acceptance / verification item | Command / evidence | Result | |---|---|---| | Indexer clippy + unit/integration | `cd indexer && cargo clippy --all-targets -- -D warnings && cargo test` | **PASS** | | Frontend typecheck/lint/unit | `cd frontend && npm run typecheck && npm run lint && npm test` | **PASS** (896 tests) | | Arena events Anvil API smoke | `bash scripts/verify-arena-events-anvil.sh` | **PASS** (after fix) | | Playwright audit directory → event page | `YIELDOMEGA_E2E_INDEXER=1 PLAYWRIGHT_SPECS=e2e/anvil-audit-events.spec.ts bash scripts/e2e-anvil.sh` | **PASS** (2 tests incl. mobile 390×844) | | `/audit` filter + searchable directory | E2E `arena-event-directory` visible; unit `ArenaEventDirectorySection.test.tsx` | **PASS** | | Permanent `/audit/events/{id}` pages | E2E: title, tx replay, CTAs | **PASS** | | Indexer list/detail endpoints (no browser RPC) | `verify-arena-events-anvil.sh` + `integration_stage2::api_arena_events_smoke` | **PASS** | | Referral routing guard | `referralPathReserved.test.ts`; routes before `/:referralSegment` in `LaunchGate.tsx` | **PASS** (existing) | | Offline/empty indexer degrade | `useArenaEventDirectory` note string; directory tests | **PASS** (existing) | | Yield Omega copy audit | `ArenaEventDirectorySection` / event page strings; `frontendContentAudit` suite | **PASS** (existing) | | Attack/abuse: bad id → 400, limit clamp | `integration_stage2` events smoke + verify script `not-valid` probe | **PASS** | | Manual mobile legibility | Playwright mobile-width test in `anvil-audit-events.spec.ts` | **PASS** | ## Follow-ups - `verify-last-buy-epoch-anvil.sh` still uses the old hard-reset warp sequence; consider aligning it with podium-deadline autoroll (same root cause as this fix).

project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented

2026-07-07 10:00:36 +00:00

(Migrated from gitlab.com)

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the [Cursor dashboard](https://www.cursor.com/dashboard/bugbot) to get automatic reviews on future PRs.

PlasticDigits commented

2026-07-07 10:02:36 +00:00

(Migrated from gitlab.com)

Security review — MR !538

Commit reviewed: c6229c6dd19cce4594c9d93bf3cbc4ca5a7fe319
Scope: 3 files — frontend/e2e/anvil-audit-events.spec.ts, scripts/e2e-anvil.sh, scripts/verify-arena-events-anvil.sh (Anvil verify/E2E seeding for LastBuyEpochStarted ingest; no production contract, indexer API, or frontend runtime changes).

Prior review threads: None (only automated Bugbot-disabled notice). Re-report N/A.

Method

Diff and call-path review for injection, authz, secret leakage, SSRF/XSS, and EVM/DeFi surfaces.
Traced attacker-controlled input to sinks in modified code; unchanged production paths referenced only where needed for exploitability.

Findings

FINDINGS: 0 (no medium, high, or critical issues on this diff)

Inline threads: None — nothing to anchor on the diff.

Notes (informational, below reporting threshold)

cast_u256 now forwards fixed positional args to cast call; all callers in this MR pass hardcoded contract selectors and "0" — no user-controlled shell metacharacters.
psql uses a static SELECT COUNT(*) against a local DATABASE_URL default; no dynamic SQL from external input.
E2E on-chain helpers (buyCharmViaCast, rollPodiumEpochOnchain, etc.) read deploy addresses from harness env (VITE_*) and run only under ANVIL_E2E / YIELDOMEGA_E2E_INDEXER gates — dev/CI test infrastructure, not deployed attack surface.
e2e-anvil.sh default spec list change is opt-in via YIELDOMEGA_E2E_INDEXER=1; no production behavior change.

Outcome: Security review: no medium+ findings on this diff. No block:security label applied.

## Security review — MR !538 **Commit reviewed:** `c6229c6dd19cce4594c9d93bf3cbc4ca5a7fe319` **Scope:** 3 files — `frontend/e2e/anvil-audit-events.spec.ts`, `scripts/e2e-anvil.sh`, `scripts/verify-arena-events-anvil.sh` (Anvil verify/E2E seeding for `LastBuyEpochStarted` ingest; no production contract, indexer API, or frontend runtime changes). **Prior review threads:** None (only automated Bugbot-disabled notice). Re-report N/A. ### Method - Diff and call-path review for injection, authz, secret leakage, SSRF/XSS, and EVM/DeFi surfaces. - Traced attacker-controlled input to sinks in modified code; unchanged production paths referenced only where needed for exploitability. ### Findings **FINDINGS: 0** (no medium, high, or critical issues on this diff) **Inline threads:** None — nothing to anchor on the diff. ### Notes (informational, below reporting threshold) - `cast_u256` now forwards fixed positional args to `cast call`; all callers in this MR pass hardcoded contract selectors and `"0"` — no user-controlled shell metacharacters. - `psql` uses a static `SELECT COUNT(*)` against a local `DATABASE_URL` default; no dynamic SQL from external input. - E2E on-chain helpers (`buyCharmViaCast`, `rollPodiumEpochOnchain`, etc.) read deploy addresses from harness env (`VITE_*`) and run only under `ANVIL_E2E` / `YIELDOMEGA_E2E_INDEXER` gates — dev/CI test infrastructure, not deployed attack surface. - `e2e-anvil.sh` default spec list change is opt-in via `YIELDOMEGA_E2E_INDEXER=1`; no production behavior change. **Outcome:** Security review: no medium+ findings on this diff. No `block:security` label applied.

PlasticDigits commented

2026-07-07 12:25:18 +00:00

(Migrated from gitlab.com)

mentioned in commit 25329b9e81

mentioned in commit 25329b9e81ef46ba48e0cc51e90d3400cd5df55d

PlasticDigits (Migrated from gitlab.com) merged commit 25329b9e81 into main

2026-07-07 12:25:20 +00:00

No reviewers

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

code/yieldomega!538

No description provided.

Rows
Columns