Skip to content

Conversation

@mmarfinetz
Copy link

@mmarfinetz mmarfinetz commented Oct 29, 2025

Implementation Summary

This PR implements a local block explorer and transaction analysis suite for the CoW Protocol
Playground, in response to the RFP posted on the
forum
.

What's Included

Core Services:

  • Block Explorer API (Fastify + SQLite) - Port 8081
  • Block Explorer Web UI (Next.js) - Port 8083
  • Sourcify integration for contract verification
  • Background indexer with auto-pruning

Key Features:

  • Real-time block and transaction feeds with auto-refresh
  • Transaction debugging with call traces and gas profiling
  • Step-by-step opcode debugger with source mapping
  • Search functionality (blocks, transactions, addresses)
  • Prometheus metrics integration
  • Grafana dashboard templates

Integration:

  • Updated docker-compose.fork.yml and docker-compose.local.yml
  • Nginx rewrites for seamless Etherscan URL replacement in Cowswap UI
  • Maintains backward compatibility with existing Playground functionality

Testing

Comprehensive testing documentation is included:

  • RFP_COMPLIANCE.md - Full compliance report covering all deliverables
  • TESTING_GUIDE.md - Testing procedures and validation steps

All services tested locally with forked and local chains.

Technical Notes

  • Minimal dependencies (5 runtime deps for API)
  • SQLite with WAL mode for efficient caching
  • No breaking changes to existing services
  • Services can run independently (optional feature)

Happy to address any feedback or make adjustments to align with project standards.

…e; update Cowswap nginx rewrite; add dashboards and Prometheus scrape; docs and scripts.

- Explorer API (Fastify + SQLite) and Explorer Web (Next.js)
- Local Sourcify service and repository volume
- Frontend build/env: NEXT_PUBLIC_LOCAL_EXPLORER_URL + nginx sub_filter for explorer links
- docker-compose (fork & non-interactive) new services and volumes
- Prometheus scrape job and Grafana dashboards provisioning
- README docs and testing scripts
- Ignore node_modules in explorer-api
@mmarfinetz mmarfinetz requested a review from a team as a code owner October 29, 2025 15:18
@github-actions
Copy link


Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.


I have read the CLA Document and I hereby sign the CLA


You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.

@socket-security
Copy link

socket-security bot commented Oct 29, 2025

@socket-security
Copy link

socket-security bot commented Oct 29, 2025

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn Critical
Critical CVE: Authorization Bypass in Next.js Middleware

CVE: GHSA-f82v-jwr5-mffw Authorization Bypass in Next.js Middleware (CRITICAL)

Affected versions: >= 13.0.0 < 13.5.9; >= 14.0.0 < 14.2.25; >= 15.0.0 < 15.2.3; >= 11.1.4 < 12.3.5

Patched version: 14.2.25

From: playground/explorer-web/package.jsonnpm/[email protected]

ℹ Read more on: This package | This alert | What is a critical CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@mmarfinetz
Copy link
Author

mmarfinetz commented Oct 29, 2025

I have read the CLA Document and I hereby sign the CLA.

https://forum.cow.fi/t/grant-application-cow-protocol-playground-block-explorer-transaction-analysis/3233

@mfw78
Copy link
Contributor

mfw78 commented Oct 29, 2025

This PR implements a local block explorer and transaction analysis suite for the CoW Protocol
Playground, in response to the RFP posted on the forum.

As noted in the RFP mentioned:

All applications will follow the standard Grants DAO process. This request should not be interpreted as an offer.

The Grants DAO process can be found here.

Additionally, not establishing communication with the maintainers prior to a large feature request (i.e. via the process that has been intimated in the RFP w.r.t the Grants DAO process) is in violation of the Contributing guidelines.

Please continue subsequent communication via the forum.

const addr = address.toLowerCase();
const base = apiUrl.replace(/\/$/, '');
// 1) Fast check endpoint first
const url = `${base}/check-by-addresses?addresses=${encodeURIComponent(addr)}&chainIds=${encodeURIComponent(String(chainId))}`;
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi Sourcify maintainer here.

Please use the v2 APIs if the chainId is already known. These check-by-address is deprecated.

https://docs.sourcify.dev/docs/api/

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for pointing this out @kuzdogan. I’ve updated the PR to use the v2 API as suggested. Appreciate the guidance!

- Replace deprecated check-by-addresses endpoint with files/any/{chainId}/{address}
- Update response parsing logic for v2 API structure
- Maintain existing functionality while addressing maintainer feedback

Fixes deprecated API usage as requested by @kuzdogan in PR cowprotocol#3841
- Use correct v2 endpoint: /v2/contract/{chainId}/{address}
- Add proper TypeScript types for ContractV2Response
- Implement proper response parsing for v2 API structure
- Add comprehensive source file fetching with v2 API
- Include repository endpoint fallback for file access
- Maintain backward compatibility with existing local repo functions

Addresses kuzdogan's feedback with complete v2 API implementation
@github-actions
Copy link

This pull request has been marked as stale because it has been inactive a while. Please update this pull request or it will be automatically closed.

@github-actions github-actions bot added the stale label Nov 17, 2025
@mmarfinetz mmarfinetz requested a review from kuzdogan November 17, 2025 16:05
@github-actions github-actions bot removed the stale label Nov 18, 2025
@github-actions
Copy link

This pull request has been marked as stale because it has been inactive a while. Please update this pull request or it will be automatically closed.

@github-actions github-actions bot added the stale label Nov 26, 2025
@mfw78
Copy link
Contributor

mfw78 commented Dec 1, 2025

The grants committee has elected to not proceed with the associated grant. May we please have a maintain closer this PR 🙏 @MartinquaXD

@github-actions github-actions bot removed the stale label Dec 2, 2025
@MartinquaXD
Copy link
Contributor

Closing as suggested by the grants committee.

@MartinquaXD MartinquaXD closed this Dec 3, 2025
@github-actions github-actions bot locked and limited conversation to collaborators Dec 3, 2025
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants