thefux 667f9bf6bb test: money-path audit — 8 RED tests for live fund-loss vulnerabilities ...

Comprehensive audit of all money-moving code paths on current main.
Found 8 live vulnerabilities where users, providers, or node runners
can lose funds, plus 1 false-green in the existing emergency refund
test suite.

Live vulnerabilities (all RED — tests assert correct/safe behaviour):

V-E1  send_refund() swallows DB failure after minting a refund token
      base.py ~line 3625 — except Exception: pass
V-E2  Emergency refund (chat) — same except: pass
      base.py ~line 3992 (existing test is a false green — 500-char
      window too short)
V-E3  Emergency refund (responses API) — identical pattern
      base.py ~line 4972
V-E4  Balance refund endpoint swallows DB failure
      balance.py ~line 628
V-E5  credit_balance() swallows 'in' transaction DB failure
      wallet.py ~line 1715
V-E6  EHBP refund token — except: pass after store
      ehbp.py ~line 762
V-E7  EHBP 'in' transaction — except: pass after store
      ehbp.py ~line 1028
V-E8  Admin withdraw returns token even when DB store fails
      admin.py ~line 475

V-E9  Window regression guard (GREEN) — documents the false-green in
      the existing test_emergency_refund_no_try_except_pass

Test results: 8 failed, 1 passed.

2026-08-06 20:58:06 +00:00

..

integration

harden autotopup

2026-08-04 01:32:25 +02:00

unit

test: money-path audit — 8 RED tests for live fund-loss vulnerabilities

2026-08-06 20:58:06 +00:00

conftest.py

feat(db): add encrypted Secret store and migration

2026-07-23 10:50:51 +02:00

run_integration.py

dump wip stash

2025-08-06 20:31:55 -03:00