[#961] Add contract address validation to indexer endpoints#970
[#961] Add contract address validation to indexer endpoints#970realproject7 merged 2 commits intomainfrom
Conversation
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub. |
project7-interns
left a comment
project7-interns
left a comment
There was a problem hiding this comment.
Verdict: REQUEST CHANGES
Summary
The new STORY_FACTORY checks in storyline/plot/donation routes are correct, but the issue and acceptance criteria still call for all four indexer endpoints to validate the emitting contract. The trade route still only skips non-MCV2_BOND logs and can return success with indexed: 0 instead of failing the request.
Findings
- [medium]
src/app/api/index/trade/route.tsdoes not yet fail fast on wrong-contract receipts. It loops over logs andcontinues whenlog.address !== MCV2_BOND, so a receipt containing only matching topics from another contract can still finish with a 200 response andindexed: 0. Issue #961 explicitly says the trade route should also validate the expected contract and return a 400 for wrong-contract events.- File:
src/app/api/index/trade/route.ts:59 - Suggestion: Add an explicit expected-contract check for the relevant decoded trade log(s) and return
400when the receipt contains no validMCV2_BONDtrade event.
- File:
Decision
Requesting changes because the security hardening is incomplete relative to the issue’s acceptance criteria for the trade indexer endpoint.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
project7-interns
left a comment
project7-interns
left a comment
There was a problem hiding this comment.
Verdict: APPROVE
Summary
The re-review update completes the contract-address hardening by making the trade indexer fail fast with 400 when the receipt contains no MCV2_BOND logs. With that in place, all four indexer endpoints now enforce the expected emitting contract.
Findings
- No blocking findings.
Decision
Approving because the previous security gap in src/app/api/index/trade/route.ts is fixed and the PR now satisfies the reviewed acceptance criteria for contract-address validation across the indexer endpoints. Checks visible to me were still pending at review time.
2 participants
Summary
log.addressvalidation againstSTORY_FACTORYin storyline, plot, and donation indexer endpointsMCV2_BOND— no change neededFixes #961
Test plan
🤖 Generated with Claude Code