code/yieldomega

Watch

Fork 0

fix(frontend): refresh WarBow flag UI after buy plants #370 #541

Merged

PlasticDigits merged 1 commit from fix/370-warbow-flag-refetch-after-buy into main

2026-07-11 01:37:20 +00:00

PlasticDigits commented

2026-07-09 07:59:46 +00:00

(Migrated from gitlab.com)

Summary

After Plant Flag on Next Buy + top Buy CHARM, pending-flag UI stayed stale until a later WarBow action (e.g. steal) refreshed reads.
refetchAll now also refetches the indexer-first WarBow flag RPC supplement (warbowPendingFlagOwner / PlantAt).

Closes #370

Test plan

cd frontend && npm test -- --run src/pages/arena/useArenaSaleSession.test.ts
cd frontend && npm run typecheck
Manual (level ≥ 5): check Plant Flag → Buy CHARM (DOUB/Kumbaya) → flag owner/silence UI updates without steal
Confirm CRED buy still cannot plant (contract); steal still works as before

## Summary - After Plant Flag on Next Buy + top Buy CHARM, pending-flag UI stayed stale until a later WarBow action (e.g. steal) refreshed reads. - `refetchAll` now also refetches the indexer-first WarBow flag RPC supplement (`warbowPendingFlagOwner` / `PlantAt`). Closes #370 ## Test plan - [x] `cd frontend && npm test -- --run src/pages/arena/useArenaSaleSession.test.ts` - [x] `cd frontend && npm run typecheck` - [ ] Manual (level ≥ 5): check Plant Flag → Buy CHARM (DOUB/Kumbaya) → flag owner/silence UI updates without steal - [ ] Confirm CRED buy still cannot plant (contract); steal still works as before

project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented

2026-07-09 08:01:01 +00:00

(Migrated from gitlab.com)

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the [Cursor dashboard](https://www.cursor.com/dashboard/bugbot) to get automatic reviews on future PRs.

PlasticDigits commented

2026-07-09 08:03:25 +00:00

(Migrated from gitlab.com)

Security review — MR !541

Commit reviewed: fa467f918111cbdcb16f2e41c8601b60be1472ce

Scope: frontend/src/pages/arena/useArenaSaleSession.ts (wire refetchWarbowFlagSupplement into refetchAll after buy/claim success) and matching unit test in useArenaSaleSession.test.ts.

Method: Diff review; traced refetchWarbowFlagSupplement to the existing useReadContracts hook over arenaV2WarbowFlagSupplementContracts(tc) (view calls: warbowPendingFlagOwner, warbowPendingFlagPlantAt, WARBOW_FLAG_CLAIM_BP, WARBOW_FLAG_SILENCE_SEC on configured TimeArena tc). Compared with prior refetchAll refetches (refetchCore, refetchUser, etc.). Checked WarBow claim gating (deriveWarbowClaimFlagFields / submitClaimWarBowFlag) for UI-only authorization bypass.

Outcome: FINDINGS: 0 medium+

Notes:

Change only triggers an additional client-side RPC refetch of public on-chain view data after successful buy/claim — same trust model as existing refetches; no new attacker-controlled sinks, endpoints, shell/SQL, or contract writes.
WarBow claim eligibility remains enforced on-chain in claimWarBowFlag; frontend reads are display/gating UX. This MR reduces stale-flag UI after buy/claim rather than widening trust boundaries.
No new dependencies or secrets handling.

Inline threads: none (no medium+ findings).

Prior security-review threads on this MR: none to re-report.

## Security review — MR !541 **Commit reviewed:** `fa467f918111cbdcb16f2e41c8601b60be1472ce` **Scope:** `frontend/src/pages/arena/useArenaSaleSession.ts` (wire `refetchWarbowFlagSupplement` into `refetchAll` after buy/claim success) and matching unit test in `useArenaSaleSession.test.ts`. **Method:** Diff review; traced `refetchWarbowFlagSupplement` to the existing `useReadContracts` hook over `arenaV2WarbowFlagSupplementContracts(tc)` (view calls: `warbowPendingFlagOwner`, `warbowPendingFlagPlantAt`, `WARBOW_FLAG_CLAIM_BP`, `WARBOW_FLAG_SILENCE_SEC` on configured TimeArena `tc`). Compared with prior `refetchAll` refetches (`refetchCore`, `refetchUser`, etc.). Checked WarBow claim gating (`deriveWarbowClaimFlagFields` / `submitClaimWarBowFlag`) for UI-only authorization bypass. **Outcome:** `FINDINGS: 0` medium+ **Notes:** - Change only triggers an additional client-side RPC refetch of public on-chain view data after successful buy/claim — same trust model as existing refetches; no new attacker-controlled sinks, endpoints, shell/SQL, or contract writes. - WarBow claim eligibility remains enforced on-chain in `claimWarBowFlag`; frontend reads are display/gating UX. This MR reduces stale-flag UI after buy/claim rather than widening trust boundaries. - No new dependencies or secrets handling. **Inline threads:** none (no medium+ findings). Prior security-review threads on this MR: none to re-report.

PlasticDigits commented

2026-07-11 01:37:21 +00:00

(Migrated from gitlab.com)

mentioned in commit e6fb5f8bea

mentioned in commit e6fb5f8bea542454864d0c2703db1d7cc57ae67a

PlasticDigits (Migrated from gitlab.com) merged commit e6fb5f8bea into main

2026-07-11 01:37:21 +00:00

No reviewers

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

code/yieldomega!541

No description provided.

Rows
Columns