diff --git a/.env.example b/.env.example index 782fde1..5ac37da 100644 --- a/.env.example +++ b/.env.example @@ -12,8 +12,11 @@ AMOUNT_IN=5000000 SLIPPAGE_BPS=100 DEADLINE_MINUTES=15 # Browser-visible local configuration; these values are not secrets. +VITE_APP_MODE=local VITE_CHAIN_ID=31337 VITE_RPC_URL=http://127.0.0.1:8545 VITE_SWAP_GUARD_ADDRESS= VITE_TOKEN_IN_ADDRESS=0xFd086bC7CD5C481DCC9C85ebE478A1C0b69FCbb9 VITE_TOKEN_OUT_ADDRESS=0xDA10009cBd5D07dd0CeCc66161FC93D7c9000da1 +VITE_BLOCK_EXPLORER_URL= +VITE_GITHUB_URL=https://github.com/alsaecas/swapguard diff --git a/.gitignore b/.gitignore index 120d731..60e4eb5 100644 --- a/.gitignore +++ b/.gitignore @@ -7,6 +7,9 @@ broadcast/ node_modules/ web/node_modules/ web/dist/ +web/.vercel/ +.playwright-cli/ +output/ *.tsbuildinfo web/vite.config.js web/vite.config.d.ts diff --git a/README.md b/README.md index d041068..585d276 100644 --- a/README.md +++ b/README.md @@ -2,6 +2,8 @@ SwapGuard is an educational Uniswap V2 integration built with Solidity, Foundry, React, TypeScript, viem, and wagmi. It demonstrates exact-input ERC-20 swaps with router quotations, bounded slippage, deadlines, direct and multi-hop paths, temporary allowances, mock tests, and a reproducible Arbitrum fork. +**[Open the live portfolio demo](https://swapguard-zeta.vercel.app/)** · [Review the contract](src/SwapGuard.sol) · [Read the architecture](docs/ARCHITECTURE.md) + > SwapGuard has not been audited. It is a portfolio project, not a recommendation to manage meaningful funds. ## What this project proves @@ -86,6 +88,8 @@ forge test --match-path 'test/fork/**' -vvv | Variable | Purpose | |---|---| +| `VITE_APP_MODE` | Frontend mode: `portfolio` (default), `local`, or `testnet` | +| `VITE_GITHUB_URL` | Public source link shown by the frontend | | `ARBITRUM_RPC_URL` | Archive RPC used at pinned block `250000000` | | `PRIVATE_KEY` | Local Anvil account used by scripts; never use a real key | | `ROUTER_ADDRESS` | Validated router passed to deployment | @@ -95,9 +99,18 @@ forge test --match-path 'test/fork/**' -vvv | `VITE_CHAIN_ID`, `VITE_RPC_URL` | Browser-visible local chain configuration | | `VITE_SWAP_GUARD_ADDRESS` | Browser-visible local deployment | | `VITE_TOKEN_IN_ADDRESS`, `VITE_TOKEN_OUT_ADDRESS` | Browser token configuration | +| `VITE_BLOCK_EXPLORER_URL` | Optional explorer base URL for live transaction links | Anvil default keys are public. They must never be used on any real network. +### Frontend modes + +- `portfolio` is the public Vercel experience. It needs no wallet, contract, or RPC configuration and uses a clearly labelled deterministic preview; it never submits a transaction. +- `local` enables wallet and contract interaction only when every required public variable is complete and valid. It is intended for the reproducible Anvil fork below. +- `testnet` uses the same strict live-mode checks, but is deliberately not configured in the hosted deployment because no router, liquid token pair, faucet path, and deployed SwapGuard instance have all been verified together. + +The Vercel project builds from `web/` with `npm ci`, `npm run build`, and the `dist/` output. Production and preview deployments set `VITE_APP_MODE=portfolio`; no private key or server-side secret is used by the site. + ## Reproducible local demo Use separate terminals. The first command stays in the foreground and exits with Ctrl-C. @@ -129,7 +142,9 @@ Mocks test failure modes and invariants without RPC access. Fork tests call the | Exact transfer and allowance cleanup | Unit/fuzz/fork | unit/fork suites | | Expired deadline and impossible minimum | Unit/fork | unit/fork suites | | Real router integration | Fork | `test/fork/SwapGuardArbitrumFork.t.sol` | +| Modes and environment validation | Vitest | `web/src/config/env.test.ts` | | Parsing, formatting, deadline, route | Vitest | `web/src/lib/utils.test.ts` | +| Deterministic preview and quote invalidation | Vitest | `web/src/lib/portfolio.test.ts` | ## Security considerations diff --git a/VERCEL_IMPLEMENTATION_PLAN.md b/VERCEL_IMPLEMENTATION_PLAN.md new file mode 100644 index 0000000..7bcdbaa --- /dev/null +++ b/VERCEL_IMPLEMENTATION_PLAN.md @@ -0,0 +1,12 @@ +# Vercel Portfolio Deployment Plan + +1. Introduce a typed `portfolio | local | testnet` configuration layer that defaults safely to portfolio mode and enables chain hooks only with complete, nonzero live configuration. +2. Split the frontend into focused portfolio, swap, architecture, testing, security, header, and footer components while preserving the real local Anvil transaction flow. +3. Add a clearly labeled, non-transactional portfolio preview using deterministic illustrative data, plus real repository, architecture, security, and local-setup links. +4. Improve wallet/network handling, quote invalidation, contract bytecode checks, receipt states, errors, and transaction explorer/copy behavior for live-enabled modes. +5. Add environment/mode, URL, validation, preview, and disabled-state tests; update metadata, favicon, `.env.example`, README, and Vercel configuration. +6. Run all required contract/frontend checks and inspect the production bundle for secrets. +7. Create or reuse only the verified `swapguard` Vercel project in the authenticated `alsaecas-projects` team, deploy and validate a preview, then publish the branch and open a PR. +8. Merge only after GitHub checks and preview verification pass; verify the production deployment from `main`, update repository metadata, and report all unverified RPC-dependent work honestly. + +No public testnet mode will be enabled unless router, tokens, liquidity, deployed SwapGuard bytecode, faucet, RPC, explorer, and end-to-end transactions are all independently verified. diff --git a/web/.gitignore b/web/.gitignore new file mode 100644 index 0000000..245259b --- /dev/null +++ b/web/.gitignore @@ -0,0 +1,2 @@ +.vercel +.env* diff --git a/web/index.html b/web/index.html index 44af71e..09f0647 100644 --- a/web/index.html +++ b/web/index.html @@ -3,8 +3,20 @@
- -