mirror of
https://github.com/pezkuwichain/pwap.git
synced 2026-07-26 12:05:41 +00:00
pezkuwichain
165cb47c64
Round 2 — fixes the CRITICAL discovered during round 1 (as severe as the withdrawal BOLA): lock_/release_/refund_escrow_internal had default PUBLIC EXECUTE and the client called release_escrow_internal directly with the anon key, so anyone could drain any victim's LOCKED balance. - release_escrow_internal now reachable only via new signed confirm-payment edge function: verifies seller wallet signature (raw + <Bytes>), asserts the wallet owns the seller identity, derived user_id == trade.seller_id, trade == payment_sent, single-use nonce, then release runs with the service role. confirmPaymentReceived now invokes confirm-payment (no more anon rpc). - lock_escrow_internal now behind new signed lock-escrow edge function (a caller can only lock its own balance; stops griefing a victim's balance). Removed a zero-amount no-op lock call. - Migration 20260725030000: REVOKE EXECUTE on lock_/release_/refund_escrow_internal from PUBLIC/anon/authenticated; GRANT to service_role only. refund has no direct client caller (service-role + admin_resolve_dispute only). - DEPLOY_RUNBOOK.md consolidates the ordered migrations, edge functions and secrets for both security rounds. Migration 20260725030000 must ship WITH the two new edge functions + frontend or offer-create/payment-release break. Remaining (non-fund, Round 2+ follow-up): read RPCs still key on a non-secret user_id (binding to a signed session would force a sign-prompt on every passive balance read — deferred); p2p_fiat_offers/trades/messages retain USING(true) (status labels move no funds now that all escrow movement is service-role-gated).
Shared Code
This directory contains code shared between web, mobile, and SDK UI applications.
Structure
-
types/ - TypeScript type definitions and interfaces
blockchain.ts- Blockchain-related types (WalletAccount, Transaction, etc.)tokens.ts- Token and DEX types (TokenInfo, PoolInfo, SwapQuote, etc.)
-
constants/ - Shared constants and configuration values
KNOWN_TOKENS- Token definitions (HEZ, PEZ, USDT)KURDISTAN_COLORS- Color palette (Kesk, Sor, Zer, Spî, Reş)SUPPORTED_LANGUAGES- Available languages (EN, TR, KMR, CKB, AR, FA)TOKEN_DISPLAY_SYMBOLS- Display vs blockchain symbol mapping
-
blockchain/ - Blockchain-related utilities
polkadot.ts- Polkadot/Substrate utilities and endpointsDEFAULT_ENDPOINT- Current blockchain endpoint (beta testnet)
-
i18n/ - Internationalization
locales/- Translation files for 6 languagesLANGUAGES- Language configurations with RTL supporttranslations- All locale data
-
utils/ - Utility functions and helpers
formatting.ts- Address and number formattingvalidation.ts- Input validation utilities
Usage
Import shared code in your projects:
// Token types and constants
import { TokenInfo, KNOWN_TOKENS } from '../../../shared/types/tokens';
import { KURDISTAN_COLORS, TOKEN_DISPLAY_SYMBOLS } from '../../../shared/constants';
// Blockchain utilities
import { DEFAULT_ENDPOINT, BLOCKCHAIN_ENDPOINTS } from '../../../shared/blockchain/polkadot';
// i18n
import { translations, LANGUAGES, isRTL } from '../../../shared/i18n';
// Formatting utilities
import { formatAddress, formatTokenAmount } from '../../../shared/utils/formatting';
Guidelines
- Keep code framework-agnostic when possible
- Add comprehensive JSDoc comments
- Write unit tests for utilities
- Avoid platform-specific dependencies
- Use relative imports:
../../../shared/...from web/mobile/SDK UI