decentraland / atlas-server

42%

LAST BUILD ON BRANCH master

branch: SELECT

CHANGE BRANCH

x

Sync Branches

• No branch selected
• 1.6.0
• 1.7.0
• add-ai-agent-context-to-readme
• chore/add-space
• chore/bump-libs
• chore/bump-node
• chore/enhance-docs
• chore/migrate-to-core-components
• chore/pin-node-24-base-image
• chore/readme-change
• chore/trigger-deploy
• chore/update-node-24
• chore/update-node-to-24
• docs/api
• feat/add-release-job
• feat/add-tracing-and-logging
• feat/cache-tiles-s3
• feat/cors
• feat/feature-flag
• feat/improve-atlas-cache
• feat/instrument-http-requests-logger
• feat/migrate-to-new-ci-infra
• feat/redeploy-atlas-server
• feat/remove-district-demarcation
• feat/remove-district-tiles
• feat/sanitize-estates-id
• feat/tiles-with-trades
• feat/trigger-build
• feat/trigger-deploy
• feat/try-to-use-s3
• feat/update-graph-component
• feat/use-node-18-alpine
• fix/add-console-update
• fix/add-last-modified-tests
• fix/estates-trades-not-showing
• fix/expiration-date-lands
• fix/filter-nulled-rental-listings
• fix/no-cache-on-last-updated
• fix/parcel-updated-at
• fix/re-trigger-deployment
• fix/remove-lastModifiedHeader-temporary
• fix/remove-modified-middleware
• fix/remove-old-infra-code
• fix/rental-listing-calculation
• fix/response-body-leaks-and-dcl-bump
• fix/save-metrics-of-all-updates
• fix/small-change
• fix/trade-status-v3-semantics
• fix/trigger-redeployment
• fix/udpdate-deps
• fix/ulimit
• fix/update-dep
• fix/update-rentals-with-milliseconds
• fix/update-schemas
• fix/updated-at-calculation-ms
• fix/use-seconds
• fix/workflow
• fzavalia-patch-1
• master
• refs/heads/master
• refs/tags/1.0.0
• refs/tags/1.0.1
• refs/tags/1.1.0
• refs/tags/1.13.17
• refs/tags/1.2.0
• refs/tags/1.2.1
• refs/tags/1.3.0
• refs/tags/1.3.1
• refs/tags/1.3.10
• refs/tags/1.3.11
• refs/tags/1.3.12
• refs/tags/1.3.13
• refs/tags/1.3.14
• refs/tags/1.3.15
• refs/tags/1.3.16
• refs/tags/1.3.18
• refs/tags/1.3.19
• refs/tags/1.3.2
• refs/tags/1.3.3
• refs/tags/1.3.4
• refs/tags/1.3.5
• refs/tags/1.3.6
• refs/tags/1.3.7
• refs/tags/1.3.8
• refs/tags/1.3.9
• refs/tags/1.4.0
• refs/tags/1.4.1
• refs/tags/1.5.0
• refs/tags/1.5.1
• refs/tags/1.5.2
• security/pin-github-actions-sha

Build # 33003365802

Build Type

push

github

Committed by web-flow

Commit Message

fix: apply the V3 trade status semantics to the map query (#144)

> ⚠️ **Deploy last.** This query now reads two columns other repos
create. See *Deploy order* — getting it wrong empties the map silently
rather than erroring.

## What

`atlas-server` is the second consumer of `squid_trades`, and its
trade-status query carried every defect just fixed in
`marketplace-server#395`. `getActiveTrades` feeds
`src/modules/map/component.ts`, so the symptom is **parcels and estates
showing as for sale when they are not**.

Found while auditing who actually reads that schema for the V3 rollout.
Nobody had looked at this query; the reviews on the marketplace PRs only
covered marketplace-server and the indexer.

## The five defects

**Cancellations counted any row, regardless of who cancelled.**
`cancelSignature` takes no signer check, and the contract scopes the
flag to `keccak256(caller, digest)` while settlement reads
`keccak256(signer, digest)` — so a stranger cancelling somebody's trade
is a no-op on chain. Counting it here meant anyone could grief a listing
off the map, using trade data the marketplace API publishes, while the
listing stayed settleable.

**Cancellations were matched only on `keccak256(signature bytes)`.** V3
keys them on the trade's EIP-712 digest, so a V3 cancellation would
never have resolved and cancelled V3 land would have stayed on the map
indefinitely.

**The signer index was matched on `address` alone.** A `signature_index`
row's identity is `address + contract + network`, so that returns
several rows, which splits one trade into several `GROUP BY` groups with
contradictory statuses. Because this query then keeps only `status =
'open'`, **the stale group is the one that survives.** This is the
defect that most directly puts a cancelled listing back on the map, and
it gets more likely with V3 live, since the same signer now holds an
independent counter per marketplace version.

**The contract index was a hardcoded list containing only ... (continued)

Coverage Stats

298 of 412 branches covered (72.33%)

Branch coverage included in aggregate %.

30 of 30 new or added lines in 1 file covered. (100.0%)

1488 of 3886 relevant lines covered (38.29%)

11.95 hits per line