mirror of
https://github.com/pezkuwichain/pwap.git
synced 2026-07-26 14:25:41 +00:00
pezkuwichain
165cb47c64
Round 2 — fixes the CRITICAL discovered during round 1 (as severe as the withdrawal BOLA): lock_/release_/refund_escrow_internal had default PUBLIC EXECUTE and the client called release_escrow_internal directly with the anon key, so anyone could drain any victim's LOCKED balance. - release_escrow_internal now reachable only via new signed confirm-payment edge function: verifies seller wallet signature (raw + <Bytes>), asserts the wallet owns the seller identity, derived user_id == trade.seller_id, trade == payment_sent, single-use nonce, then release runs with the service role. confirmPaymentReceived now invokes confirm-payment (no more anon rpc). - lock_escrow_internal now behind new signed lock-escrow edge function (a caller can only lock its own balance; stops griefing a victim's balance). Removed a zero-amount no-op lock call. - Migration 20260725030000: REVOKE EXECUTE on lock_/release_/refund_escrow_internal from PUBLIC/anon/authenticated; GRANT to service_role only. refund has no direct client caller (service-role + admin_resolve_dispute only). - DEPLOY_RUNBOOK.md consolidates the ordered migrations, edge functions and secrets for both security rounds. Migration 20260725030000 must ship WITH the two new edge functions + frontend or offer-create/payment-release break. Remaining (non-fund, Round 2+ follow-up): read RPCs still key on a non-secret user_id (binding to a signed session would force a sign-prompt on every passive balance read — deferred); p2p_fiat_offers/trades/messages retain USING(true) (status labels move no funds now that all escrow movement is service-role-gated).
Pezkuwi Web App Projects (PWAP)
Monorepo for Pezkuwi blockchain frontend applications.
Project Structure
pwap/
├── web/ # Main web application
├── mobile/ # Mobile application (React Native + Expo)
├── backend/ # Backend API services
├── shared/ # Shared code and utilities
└── package.json # Root package with build scripts
Related Repositories
| Repository | Description | URL |
|---|---|---|
| pezkuwi-sdk-ui | Blockchain Explorer & Developer Tools | https://github.com/pezkuwichain/pezkuwi-sdk-ui |
| pezkuwi-extension | Browser Wallet Extension | https://github.com/pezkuwichain/pezkuwi-extension |
Projects
1. web/ - Main Web Application
Status: ✅ Production Ready
The primary web interface for Pezkuwi blockchain at app.pezkuwichain.io
Tech Stack:
- React 18 + TypeScript
- Vite
- @pezkuwi/api
- Supabase (Auth & Database)
- Tailwind CSS + shadcn/ui
- i18next
Features:
- Wallet integration (Pezkuwi Extension)
- Live blockchain data
- Staking dashboard
- DEX/Swap interface
- P2P Fiat Trading with atomic escrow
- Transaction history
- Multi-language support (EN, TR, KMR, CKB, AR, FA)
- Governance with live blockchain integration
cd web
npm install
npm run dev
2. mobile/ - Mobile Application
Status: 🚧 In Development
React Native Expo app for iOS and Android.
Features:
- Welcome screen with language selection
- Multi-language support (6 languages with RTL)
- Authentication (Sign In/Up)
- Main dashboard navigation (5-tab bottom nav)
- Wallet integration with @pezkuwi/api
- Live blockchain data (HEZ, PEZ, USDT)
- Send/receive transactions
- Biometric authentication
cd mobile
npm install
npm start
3. backend/ - Backend Services
API services for the applications.
cd backend
npm install
npm run dev
4. shared/ - Shared Code
Common code, types, and utilities used across all platforms.
shared/
├── types/ # TypeScript type definitions
├── utils/ # Helper functions
├── blockchain/ # Blockchain utilities
├── constants/ # App constants
├── images/ # Shared images and logos
└── i18n/ # Internationalization
Quick Start
Prerequisites
- Node.js 18+
- npm
Installation
# Clone repository
git clone https://github.com/pezkuwichain/pwap.git
cd pwap
# Install all dependencies
npm install
# Or install individually
npm run install:web
npm run install:mobile
npm run install:backend
Build All Projects
npm run build
This builds:
web- Vite production buildpezkuwi-sdk-ui- Full SDK UI build (separate repo)mobile- Expo web export
Development
# Run web and mobile in parallel
npm run dev
# Or run individually
npm run dev:web
npm run dev:mobile
Multi-Language Support
All applications support:
- 🇬🇧 English (EN)
- 🇹🇷 Türkçe (TR)
- ☀️ Kurmancî (KMR)
- ☀️ سۆرانی (CKB)
- 🇸🇦 العربية (AR)
- 🇮🇷 فارسی (FA)
RTL support for CKB, AR, FA.
Scripts
| Command | Description |
|---|---|
npm run build |
Build all projects |
npm run dev |
Start development servers |
npm run lint |
Run linters |
npm run test |
Run tests |
npm run install:all |
Install all dependencies |
Links
- Website: https://app.pezkuwichain.io
- Website (alt): https://pex.mom
- Exchange: https://pex.network
- Documentation: https://docs.pezkuwichain.io
License
Apache-2.0