mirror of
https://github.com/pezkuwichain/pwap.git
synced 2026-07-26 10:55:41 +00:00
pezkuwichain
25ed29edcb
A bounded adversarial re-verification of the new fund-custody auth found two real bypasses that the fix rounds missed; both fixed here, plus executable proof. - BYPASS #1 (CRITICAL, external): p2p_fiat_trades/p2p_fiat_offers kept USING(true) anon UPDATE, and confirm-payment / admin_resolve_dispute read the fund DESTINATION (buyer_id), amount and token straight from those rows. An anon attacker could `UPDATE p2p_fiat_trades SET buyer_id=<attacker>` so the honest seller's correctly- signed release paid the attacker. Fix: BEFORE UPDATE triggers freeze the fund-routing columns (offer_id, seller_id, buyer_id, crypto_amount, fiat_amount, price_per_unit, escrow_locked_amount on trades; seller_id, token, amount_crypto on offers) for any non-service-role writer — trigger-level, independent of RLS/grants; status/proof/chat stay open. (Corrects the earlier triage that dismissed these tables as non-custodial.) - BYPASS #2 (double-release TOCTOU): confirm-payment checked status then released non-atomically, so two concurrent differently-nonced valid requests could both release and drain other buyers' escrow. Fix: atomic compare-and-swap of payment_sent->completed BEFORE the escrow move (loser gets 409; revert on release failure). - Hardening: REVOKE EXECUTE on the dead legacy resolve_p2p_dispute mover from PUBLIC/anon/authenticated. - Proof: 34 executable tests (Deno) — identity-auth unit tests (sr25519 sign/verify, challenge money-param binding, citizen/visa ownership, nonce single-use+concurrency, freshness) + per-handler authorization-flow tests (bad-sig/cross-id/wrong-state/replay, CAS double-release). All pass.
Pezkuwi Web App Projects (PWAP)
Monorepo for Pezkuwi blockchain frontend applications.
Project Structure
pwap/
├── web/ # Main web application
├── mobile/ # Mobile application (React Native + Expo)
├── backend/ # Backend API services
├── shared/ # Shared code and utilities
└── package.json # Root package with build scripts
Related Repositories
| Repository | Description | URL |
|---|---|---|
| pezkuwi-sdk-ui | Blockchain Explorer & Developer Tools | https://github.com/pezkuwichain/pezkuwi-sdk-ui |
| pezkuwi-extension | Browser Wallet Extension | https://github.com/pezkuwichain/pezkuwi-extension |
Projects
1. web/ - Main Web Application
Status: ✅ Production Ready
The primary web interface for Pezkuwi blockchain at app.pezkuwichain.io
Tech Stack:
- React 18 + TypeScript
- Vite
- @pezkuwi/api
- Supabase (Auth & Database)
- Tailwind CSS + shadcn/ui
- i18next
Features:
- Wallet integration (Pezkuwi Extension)
- Live blockchain data
- Staking dashboard
- DEX/Swap interface
- P2P Fiat Trading with atomic escrow
- Transaction history
- Multi-language support (EN, TR, KMR, CKB, AR, FA)
- Governance with live blockchain integration
cd web
npm install
npm run dev
2. mobile/ - Mobile Application
Status: 🚧 In Development
React Native Expo app for iOS and Android.
Features:
- Welcome screen with language selection
- Multi-language support (6 languages with RTL)
- Authentication (Sign In/Up)
- Main dashboard navigation (5-tab bottom nav)
- Wallet integration with @pezkuwi/api
- Live blockchain data (HEZ, PEZ, USDT)
- Send/receive transactions
- Biometric authentication
cd mobile
npm install
npm start
3. backend/ - Backend Services
API services for the applications.
cd backend
npm install
npm run dev
4. shared/ - Shared Code
Common code, types, and utilities used across all platforms.
shared/
├── types/ # TypeScript type definitions
├── utils/ # Helper functions
├── blockchain/ # Blockchain utilities
├── constants/ # App constants
├── images/ # Shared images and logos
└── i18n/ # Internationalization
Quick Start
Prerequisites
- Node.js 18+
- npm
Installation
# Clone repository
git clone https://github.com/pezkuwichain/pwap.git
cd pwap
# Install all dependencies
npm install
# Or install individually
npm run install:web
npm run install:mobile
npm run install:backend
Build All Projects
npm run build
This builds:
web- Vite production buildpezkuwi-sdk-ui- Full SDK UI build (separate repo)mobile- Expo web export
Development
# Run web and mobile in parallel
npm run dev
# Or run individually
npm run dev:web
npm run dev:mobile
Multi-Language Support
All applications support:
- 🇬🇧 English (EN)
- 🇹🇷 Türkçe (TR)
- ☀️ Kurmancî (KMR)
- ☀️ سۆرانی (CKB)
- 🇸🇦 العربية (AR)
- 🇮🇷 فارسی (FA)
RTL support for CKB, AR, FA.
Scripts
| Command | Description |
|---|---|
npm run build |
Build all projects |
npm run dev |
Start development servers |
npm run lint |
Run linters |
npm run test |
Run tests |
npm run install:all |
Install all dependencies |
Links
- Website: https://app.pezkuwichain.io
- Website (alt): https://pex.mom
- Exchange: https://pex.network
- Documentation: https://docs.pezkuwichain.io
License
Apache-2.0