whitelist: add spotr.tv and dapp.spotr.tv#1819
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
✅ Files skipped from review due to trivial changes (1)
📝 WalkthroughWalkthrough
ChangesURL Allowlist Update
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@whitelist.yaml`:
- Around line 34-35: The whitelist entry for domains spotr.tv and dapp.spotr.tv
references a non-existent GitHub repo
(https://github.com/cnpierrepapi/spotr-mvp); update the whitelist.yaml to
replace that URL with the correct repository URL (or add a new source_repo
field) that actually hosts the Spotr source code, and include a verifiable
reference (commit hash, tag or release) for the Solana program id
4i5etYNKfu7zfYxCtWxPjxaD6KNmgvrr22CZqLTWv16u so reviewers can inspect the code;
ensure the entry for the domains (spotr.tv, dapp.spotr.tv) and the Solana
program id remain unchanged but point to the corrected GitHub link.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
| - url: spotr.tv | ||
| - url: dapp.spotr.tv |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: Verify SPOTR domains and project authenticity
echo "=== Checking domain accessibility ==="
for domain in "spotr.tv" "dapp.spotr.tv"; do
echo "Checking https://${domain}..."
status=$(curl -s -o /dev/null -w "%{http_code}" -L "https://${domain}" --max-time 10)
if [ "$status" -eq 200 ] || [ "$status" -eq 301 ] || [ "$status" -eq 302 ]; then
echo "✓ ${domain} is accessible (HTTP ${status})"
else
echo "✗ ${domain} returned HTTP ${status} or failed"
fi
done
echo ""
echo "=== Checking GitHub repository ==="
gh repo view cnpierrepapi/spotr-mvp --json name,description,createdAt,isPrivate,owner,url,stargazerCount || echo "✗ Repository not found or not accessible"
echo ""
echo "=== Checking Solana program existence ==="
echo "Note: Verifying program 4i5etYNKfu7zfYxCtWxPjxaD6KNmgvrr22CZqLTWv16u on Solana mainnet..."
curl -s -X POST -H "Content-Type: application/json" -d '{
"jsonrpc": "2.0",
"id": 1,
"method": "getAccountInfo",
"params": [
"4i5etYNKfu7zfYxCtWxPjxaD6KNmgvrr22CZqLTWv16u",
{"encoding": "base64"}
]
}' https://api.mainnet-beta.solana.com | jq -r '.result // "✗ Program not found"' | head -5Repository: phantom/blocklist
Length of output: 639
🏁 Script executed:
#!/bin/bash
echo "=== Verifying GitHub user and searching for alternatives ==="
# Check if user exists
curl -s "https://api.github.com/users/cnpierrepapi" | jq -r '.login // "User not found"'
echo ""
echo "=== Searching for SPOTR project on GitHub ==="
# Search for spotr-mvp repo
curl -s "https://api.github.com/search/repositories?q=spotr-mvp" | jq -r '.items[0:3] | .[] | "\(.full_name): \(.description) - \(.html_url)"'
echo ""
echo "=== Complete Solana program info ==="
# Get full account info for the program
curl -s -X POST -H "Content-Type: application/json" -d '{
"jsonrpc": "2.0",
"id": 1,
"method": "getAccountInfo",
"params": [
"4i5etYNKfu7zfYxCtWxPjxaD6KNmgvrr22CZqLTWv16u",
{"encoding": "base64"}
]
}' https://api.mainnet-beta.solana.com | jq '.' | head -20Repository: phantom/blocklist
Length of output: 650
Correct the GitHub repository link — the cited repository does not exist.
Domain accessibility is confirmed (both spotr.tv and dapp.spotr.tv return HTTP 200), and the Solana program 4i5etYNKfu7zfYxCtWxPjxaD6KNmgvrr22CZqLTWv16u is deployed on mainnet. However, the PR cites https://github.com/cnpierrepapi/spotr-mvp as source code verification, but this repository does not exist on GitHub. The GitHub user cnpierrepapi exists, but the spotr-mvp repository is not found.
Whitelisting domains is security-critical and requires verifying the underlying source code for red flags. Please provide the correct GitHub repository link so the code can be reviewed before approval.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@whitelist.yaml` around lines 34 - 35, The whitelist entry for domains
spotr.tv and dapp.spotr.tv references a non-existent GitHub repo
(https://github.com/cnpierrepapi/spotr-mvp); update the whitelist.yaml to
replace that URL with the correct repository URL (or add a new source_repo
field) that actually hosts the Spotr source code, and include a verifiable
reference (commit hash, tag or release) for the Solana program id
4i5etYNKfu7zfYxCtWxPjxaD6KNmgvrr22CZqLTWv16u so reviewers can inspect the code;
ensure the entry for the domains (spotr.tv, dapp.spotr.tv) and the Solana
program id remain unchanged but point to the corrected GitHub link.
SPOTR is a cultural opinion market on Solana. Users deposit USDC via standard SPL token transfers to a program-owned vault. A sponsor wallet pays SOL gas fees on behalf of users (sponsor-pays-gas pattern). - Landing site: spotr.tv - Dapp: dapp.spotr.tv - Program: 4i5etYNKfu7zfYxCtWxPjxaD6KNmgvrr22CZqLTWv16u (mainnet) - Verify on-chain: https://solscan.io/account/4i5etYNKfu7zfYxCtWxPjxaD6KNmgvrr22CZqLTWv16u
cnpierrepapi
force-pushed
the
whitelist-spotr-tv
branch
from
44ec160 to
00e4a93
Compare
|
Repository is now public: https://github.com/cnpierrepapi/spotr-mvp Solana program source code: Verifiable references:
The program has two instructions: |
1 participant
Request
Add
spotr.tvanddapp.spotr.tvto the whitelist.About SPOTR
SPOTR is a cultural opinion market on Solana. Players deposit USDC, pick a side on cultural debate questions, and write a 140-character argument. An AI judge evaluates both sides and picks a winner. Winners split the pool proportional to their stake (pari-mutuel payouts).
Why flagged
We use a sponsor-pays-gas pattern where a backend wallet pays SOL transaction fees on behalf of users. The deposit itself is a standard SPL token transfer (
createTransferInstruction) to a program-owned vault. Phantom/Blowfish flags the different fee payer as potentially malicious.Details
4i5etYNKfu7zfYxCtWxPjxaD6KNmgvrr22CZqLTWv16u(mainnet, verifiable on Solscan)4hvK5WnL7YbYQCkhxqfoPbcuvhNjKiw3DUM5RLRCEYQtM54pSDvuoFC7gddBhpThB8HWeancxTWjkY1trMuTivRVOn-chain verification
The program can be verified on-chain at the Solscan link above. It has two instructions:
Initialize(sets admin + USDC mint) andAdminWithdrawAll(admin claims vault). User deposits are standard SPL token transfers — they do not invoke the program.Summary by CodeRabbit