code/yieldomega

Watch

Fork 0

fix(frontend): Last Buy YOU score shows No Buys when empty #369 #540

Merged

PlasticDigits merged 1 commit from fix/369-last-buy-you-no-buys into main

2026-07-11 01:37:05 +00:00

PlasticDigits commented

2026-07-09 07:58:52 +00:00

(Migrated from gitlab.com)

Summary

Side-rail Last Buy YOU row showed a huge countdown when the wallet had no buys in the epoch (indexer current_scores score "0" treated as unix epoch 0).
Treat missing / "0" last-buy scores as empty and render No Buys.

Closes #369

Test plan

cd frontend && npm test -- --run src/pages/arena/arenaSimplePodiumScore.test.ts
Manual: connect wallet with no buys → Last Buy side-rail YOU = No Buys
Manual: after a buy, YOU shows compact ago timer again

## Summary - Side-rail Last Buy **YOU** row showed a huge countdown when the wallet had no buys in the epoch (indexer `current_scores` score `"0"` treated as unix epoch 0). - Treat missing / `"0"` last-buy scores as empty and render **No Buys**. Closes #369 ## Test plan - [x] `cd frontend && npm test -- --run src/pages/arena/arenaSimplePodiumScore.test.ts` - [ ] Manual: connect wallet with no buys → Last Buy side-rail YOU = `No Buys` - [ ] Manual: after a buy, YOU shows compact ago timer again

project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented

2026-07-09 07:58:55 +00:00

(Migrated from gitlab.com)

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the [Cursor dashboard](https://www.cursor.com/dashboard/bugbot) to get automatic reviews on future PRs.

PlasticDigits commented

2026-07-09 08:02:02 +00:00

(Migrated from gitlab.com)

Security review

Commit reviewed: 1f600d150eb60f8f3e8334fb5cbd1a5c7df52f0f
Scope: frontend/src/pages/arena/arenaSimplePodiumScore.ts (+ unit tests) — treat missing / "0" indexer last_buy current_scores as empty and render No Buys instead of an epoch-0 countdown.

Outcome: FINDINGS: 0 medium+

Summary

Reviewed the MR diff and traced attacker-controlled inputs (indexer walletCurrentScores, podium row values) through resolveViewerPodiumValueRaw → formatViewerPodiumScoreLine → React render in ArenaPodiumTimerChip.

XSS: Output is rendered as React text (<strong>{viewerScoreLine}</strong>). The new branch returns the constant "No Buys". Non-empty Last Buy scores continue through numeric unix-sec parsing (parseUnixSecString / formatCountdown); raw indexer strings are not emitted to the DOM on this path.
Authn/authz / permission boundaries: No changes to unlock gates (isArenaLastBuyWalletSurfaceUnlocked), wallet actions, or on-chain interactions — display formatting only.
Injection / SSRF / secrets: No server-side, shell, SQL, or network surface touched; no new dependencies.
EVM / DeFi: No contract or indexer backend changes in this diff.

Prior MR notes: only automated Bugbot placeholder (not enabled); no prior security-review threads to re-validate.

Inline threads: none (no medium+ findings).

## Security review **Commit reviewed:** `1f600d150eb60f8f3e8334fb5cbd1a5c7df52f0f` **Scope:** `frontend/src/pages/arena/arenaSimplePodiumScore.ts` (+ unit tests) — treat missing / `"0"` indexer `last_buy` `current_scores` as empty and render **No Buys** instead of an epoch-0 countdown. **Outcome:** `FINDINGS: 0` medium+ ### Summary Reviewed the MR diff and traced attacker-controlled inputs (indexer `walletCurrentScores`, podium row values) through `resolveViewerPodiumValueRaw` → `formatViewerPodiumScoreLine` → React render in `ArenaPodiumTimerChip`. - **XSS:** Output is rendered as React text (`<strong>{viewerScoreLine}</strong>`). The new branch returns the constant `"No Buys"`. Non-empty Last Buy scores continue through numeric unix-sec parsing (`parseUnixSecString` / `formatCountdown`); raw indexer strings are not emitted to the DOM on this path. - **Authn/authz / permission boundaries:** No changes to unlock gates (`isArenaLastBuyWalletSurfaceUnlocked`), wallet actions, or on-chain interactions — display formatting only. - **Injection / SSRF / secrets:** No server-side, shell, SQL, or network surface touched; no new dependencies. - **EVM / DeFi:** No contract or indexer backend changes in this diff. Prior MR notes: only automated Bugbot placeholder (not enabled); no prior security-review threads to re-validate. **Inline threads:** none (no medium+ findings).

PlasticDigits commented

2026-07-11 01:37:06 +00:00

(Migrated from gitlab.com)

mentioned in commit 4b420e4ad5

mentioned in commit 4b420e4ad5d869dad4c825d9493c55b8ac7b667b

PlasticDigits (Migrated from gitlab.com) merged commit 4b420e4ad5 into main

2026-07-11 01:37:06 +00:00

No reviewers

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

code/yieldomega!540

No description provided.

Rows
Columns