From 582089c1e38b06b3a5d06bd7274950f1f90a6fad Mon Sep 17 00:00:00 2001 From: SkateSpots Date: Fri, 2 Oct 2026 21:39:11 +0700 Subject: [PATCH] =?UTF-8?q?docs:=20record=20audit=20fixes=20(tiers=201?= =?UTF-8?q?=E2=80=932,=20H15)=20+=20deferred=20items?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- AGENTS.md | 42 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 42 insertions(+) diff --git a/AGENTS.md b/AGENTS.md index 091d333..7d2a839 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -1822,6 +1822,48 @@ similar are internal endpoints/hook names, not credits — leave them.) - ⚠️ **When wiring a file, keep `en.ts`/`es.ts` key-for-key in sync** and run `node scripts/check-i18n.mjs` before committing. +## Security & correctness audit fixes (2026-10-04) + +A five-part audit (security · bugs/logic · UI/UX · Nostr interop · flows) was run; +this is what was FIXED (each behind `npm test` + smoke) and what remains. + +**Fixed — money & auth.** Marketplace payments verify the invoice amount +(`usePayPaymentPointer` → `assertInvoiceAmount`), so a seller can't overcharge via +a raw BOLT11 or an inflated LNURL invoice. NIP-17 DMs call `verifyEvent(seal)` in +all four read paths (sender impersonation). `push-service` enforces endpoint +ownership on subscribe/unsubscribe and validates the endpoint (`isSafePushEndpoint`, +SSRF) — ⚠️ **requires `npm run deploy:push` to take effect**. The Amber callback no +longer logs in from a bare `?event=` (must match a pending +`get_public_key`) and no longer logs the pending-op payload. `usePlatformFee` +records are per-pubkey (was device-global). + +**Fixed — trust/data integrity.** `useAdminModeration` fetches the `cleared` label +(Admin Undo now propagates cross-device). Admin takedowns publish the NIP-32 +`hidden` label instead of an ignored kind-5. The `/stats` "partial outage" banner +works (`queryCanonical` gained an `onError` hook). `useShops` has its own cache +namespace (no longer collides with `useSkateShops`). Listing NIP-05 is verified +(`verifyNip05`), not self-asserted. NIP-22 spot comments/transfers use uppercase +root `A`/`K`/`P` and readers accept legacy `#a`. Lab profile edits preserve foreign +`a` spot refs; collections preserve foreign NIP-51 tags; `LAB_KINDS` = all 13. +Skip-to-content is a button that focuses `
` (HashRouter-safe). +`CustomizeNavSheet` is translated; `useLocalStorage` re-reads on key change and +keeps `stateRef` in sync cross-tab; the backup flag is per-account +(`lib/backup.ts`). Listing detail / Events render `ErrorState` on outage. + +**Deferred (documented, NOT fixed).** +- `H1` — a spot "claim" CLONES rather than transferring (`claim-from` is written + but **never read**); needs a designed handoff/resolution, not a patch. +- `C5b` — a self-asserted `featured` tag still drives **ranking** (ProBadge + verifies, ordering doesn't); needs a batch provider-receipt verification pass. +- `H12` — `paymentVerified` preimage branch is replayable (not bound to the trade). +- `H13` — offer threads trust the self-declared `role` tag for seller identity. +- `H14` — an NWC timeout can fall through to a second rail with no + `lookupInvoice`, risking a double payment. +- Medium/Low (offline `publishing` rows never retried; `user-listings` query key + built from `Date.now()`; route-cache key ignores origin; Overpass `.elements` + crash; number `.toLocaleString()`; assorted i18n/a11y). Ask for the full audit + report if needed — it was produced but not stored in the repo. + ## Nostr Protocol Integration This project comes with custom hooks for querying and publishing events on the Nostr network.