mirror of
https://github.com/pezkuwichain/pwap.git
synced 2026-07-26 14:25:41 +00:00
pezkuwichain
a8f41cd47f
Critical/high audit remediation on the custodial P2P ledger. Auth model is wallet-based; identity (citizen/visa) is cryptographically bound to a wallet (People Chain tiki.citizenNft / active p2p_visa), which enables a correct fix. - Withdrawal BOLA (CRITICAL): process-withdraw now requires a wallet-SIGNED challenge; server verifies signature (raw + <Bytes> forms), asserts the signer OWNS the identity, consumes a single-use nonce (replay), and derives user_id server-side — the client-supplied user_id is ignored. process-withdrawal (batch) now requires the service-role key (was: any bearer, incl. public anon key). request_withdraw is REVOKEd from anon/authenticated + service-role guarded. - Financial RLS (HIGH): drop the blanket USING(true) SELECT on user_internal_balances, p2p_balance_transactions, p2p_deposit_withdraw_requests; lock p2p_user_payment_methods (IBAN PII) + p2p_fiat_disputes UPDATE to service_role; legitimate reads move behind scoped SECURITY DEFINER RPCs. - Deposit integrity: verify-deposit now binds the on-chain sender to identity ownership before crediting. - Admin dispute (CRITICAL fund-logic): DisputeResolutionPanel relabeled trades without moving escrow. New admin-signed resolve-dispute function + admin_resolve_dispute RPC moves escrow (release/refund/split) atomically with correct accounting (avoids the double-count in the legacy resolve_p2p_dispute). Client isAdmin documented as cosmetic. DEPLOY RUNBOOK (gated; owner runs): 1) apply migrations 20260225/20260725* in order; 2) deploy edge functions process-withdraw, process-withdrawal, verify-deposit, resolve-dispute; 3) set edge secrets PEOPLE_RPC_ENDPOINT (+ optional ADMIN_WALLETS); 4) ship frontend. Migrations + functions + frontend must go together or the app breaks. KNOWN RESIDUAL (Round 2 — as severe as the withdrawal BOLA): release_/lock_/refund_ escrow_internal still have PUBLIC EXECUTE and the client calls release_escrow_internal directly with the anon key from confirmPaymentReceived -> an anon caller can drain any victim's LOCKED balance. Fix = a wallet-signed confirm-payment edge function (same pattern as withdrawals) before revoking PUBLIC execute. Not yet fixed.
Shared Code
This directory contains code shared between web, mobile, and SDK UI applications.
Structure
-
types/ - TypeScript type definitions and interfaces
blockchain.ts- Blockchain-related types (WalletAccount, Transaction, etc.)tokens.ts- Token and DEX types (TokenInfo, PoolInfo, SwapQuote, etc.)
-
constants/ - Shared constants and configuration values
KNOWN_TOKENS- Token definitions (HEZ, PEZ, USDT)KURDISTAN_COLORS- Color palette (Kesk, Sor, Zer, Spî, Reş)SUPPORTED_LANGUAGES- Available languages (EN, TR, KMR, CKB, AR, FA)TOKEN_DISPLAY_SYMBOLS- Display vs blockchain symbol mapping
-
blockchain/ - Blockchain-related utilities
polkadot.ts- Polkadot/Substrate utilities and endpointsDEFAULT_ENDPOINT- Current blockchain endpoint (beta testnet)
-
i18n/ - Internationalization
locales/- Translation files for 6 languagesLANGUAGES- Language configurations with RTL supporttranslations- All locale data
-
utils/ - Utility functions and helpers
formatting.ts- Address and number formattingvalidation.ts- Input validation utilities
Usage
Import shared code in your projects:
// Token types and constants
import { TokenInfo, KNOWN_TOKENS } from '../../../shared/types/tokens';
import { KURDISTAN_COLORS, TOKEN_DISPLAY_SYMBOLS } from '../../../shared/constants';
// Blockchain utilities
import { DEFAULT_ENDPOINT, BLOCKCHAIN_ENDPOINTS } from '../../../shared/blockchain/polkadot';
// i18n
import { translations, LANGUAGES, isRTL } from '../../../shared/i18n';
// Formatting utilities
import { formatAddress, formatTokenAmount } from '../../../shared/utils/formatting';
Guidelines
- Keep code framework-agnostic when possible
- Add comprehensive JSDoc comments
- Write unit tests for utilities
- Avoid platform-specific dependencies
- Use relative imports:
../../../shared/...from web/mobile/SDK UI