Skip to content

fix: reject placeholder bridge recipients before posting#7622

Closed
fairlighteth wants to merge 11 commits into
developfrom
deepsec/medium-06-quote-signing-consistency
Closed

fix: reject placeholder bridge recipients before posting#7622
fairlighteth wants to merge 11 commits into
developfrom
deepsec/medium-06-quote-signing-consistency

Conversation

@fairlighteth

@fairlighteth fairlighteth commented Jun 6, 2026

Copy link
Copy Markdown
Contributor

What changed

  • Extracted the existing swap-flow placeholder bridge recipient check into a shared trade-flow guard.
  • Reused that guard before posting/signing in swap, EthFlow, Safe approval bundle, and Safe ETH bundle flows.

Why

  • Non-EVM bridge placeholder recipients are valid only for quote fetching before the user enters a real destination.
  • Those placeholders must never reach order posting, even if UI validation is bypassed or a stale quote path calls a posting flow directly.
  • This keeps the PR scoped to the DeepSec bridge-recipient posting-path finding; quote freshness/signability work is left out of this PR.

Validation

  • pnpm agents:check
  • CI covers the usual lint, typecheck, and test gates.

@vercel

vercel Bot commented Jun 6, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
cowfi Building Building Preview Jun 17, 2026 4:05pm
explorer-dev Ready Ready Preview Jun 17, 2026 4:05pm
storybook Ready Ready Preview Jun 17, 2026 4:05pm
swap-dev Ready Ready Preview Jun 17, 2026 4:05pm
widget-configurator Ready Ready Preview Jun 17, 2026 4:05pm
2 Skipped Deployments
Project Deployment Actions Updated (UTC)
cosmos Ignored Ignored Jun 17, 2026 4:05pm
sdk-tools Ignored Ignored Preview Jun 17, 2026 4:05pm

Request Review

@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Jun 6, 2026

Copy link
Copy Markdown

Deploying explorer-dev with  Cloudflare Pages  Cloudflare Pages

Latest commit: 53328cd
Status: ✅  Deploy successful!
Preview URL: https://7911bbc7.explorer-dev-dxz.pages.dev
Branch Preview URL: https://deepsec-medium-06-quote-sign.explorer-dev-dxz.pages.dev

View logs

@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Jun 6, 2026

Copy link
Copy Markdown

Deploying swap-dev with  Cloudflare Pages  Cloudflare Pages

Latest commit: 1e45a58
Status: ✅  Deploy successful!
Preview URL: https://59c74e5e.swap-dev-5u6.pages.dev
Branch Preview URL: https://deepsec-medium-06-quote-sign.swap-dev-5u6.pages.dev

View logs

@fairlighteth fairlighteth self-assigned this Jun 6, 2026
- keep a quote non-signable when the latest optimal fetch failed
- add a regression for fast-success then optimal-error state
- ignore same-cycle fast errors once an optimal quote is active
- add a regression for optimal-success then fast-error ordering
fairlighteth

This comment was marked as outdated.

@fairlighteth fairlighteth marked this pull request as draft June 17, 2026 15:58
- Share the existing placeholder recipient guard across trade posting paths
- Remove the broader quote freshness changes from this PR

Refs #7622
@cowprotocol cowprotocol deleted a comment from coderabbitai Bot Jun 17, 2026
@fairlighteth fairlighteth changed the title fix: block stale quotes and invalid bridge recipients fix: reject placeholder bridge recipients before posting Jun 17, 2026
@fairlighteth

Copy link
Copy Markdown
Contributor Author

Superseded by #7670 after renaming the head branch to deepsec/medium-06-bridge-recipient-guard.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant