chore(soroban): mark audited vault crates v1#472
Merged
Conversation
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (12)
📝 WalkthroughSummary1) Permissionless TTL extension (custodial adapter)
2) Vault CLI
|
| Layer / File(s) | Summary |
|---|---|
Workspace member relocation and dependency path fixes Cargo.toml, contract/vault/soroban/proxy-4626/Cargo.toml, contract/vault/soroban/curator-proxy/Cargo.toml, tools/soroban-vault-cli/Cargo.toml |
Root workspace removes contract/proxy-4626-soroban and contract/proxy-curator-soroban, adds contract/vault/soroban/proxy-4626 and contract/vault/soroban/curator-proxy; proxy-4626 and curator-proxy manifests define metadata, library config, and internal dependency paths to shared-types, kernel, curator-primitives, governance, and runtime; CLI manifest updates the curator-proxy-soroban dependency path. |
Crate version and license updates contract/vault/curator-primitives/Cargo.toml, contract/vault/kernel/Cargo.toml, contract/vault/soroban/Cargo.toml, contract/vault/soroban/blend-adapter/Cargo.toml, contract/vault/soroban/custodial-adapter/Cargo.toml, contract/vault/soroban/governance/Cargo.toml, contract/vault/soroban/share-token/Cargo.toml, contract/vault/soroban/shared-types/Cargo.toml, contract/vault/macros/Cargo.toml, contract/vault/near/Cargo.toml |
All Soroban and vault contract crate versions bumped from 0.1.0 to 1.0.0; all licenses changed from MIT to GPL-3.0-only. |
Permissionless Custodial Adapter extend_ttl
| Layer / File(s) | Summary |
|---|---|
Custodial adapter extend_ttl signature and tests contract/vault/soroban/custodial-adapter/src/lib.rs, contract/vault/soroban/README.md |
extend_ttl(env, caller: Address) is changed to extend_ttl(env) by removing the caller parameter and require_auth check; existing tests updated to match new signature and remove authorization rejection assertions; new test extend_ttl_is_open_liveness_maintenance added; README documents the permissionless rationale and storage liveness behavior. |
CLI extend_ttl logic and docs update tools/soroban-vault-cli/src/commands.rs, tools/soroban-vault-cli/README.md |
Custodial adapters excluded from caller-requirement computation; custodial adapter invocation loop drops skip-reason checking and --caller forwarding, invoking with no arguments; custodial_ttl_skip_reason and custodial_adapter_admin helpers removed; CLI unit test renamed and updated to assert custodial adapter is invoked without --caller; README updated to describe permissionless behavior. |
Estimated code review effort
🎯 2 (Simple) | ⏱️ ~15 minutes
Possibly related PRs
- Templar-Protocol/contracts#470: Introduced the custodial adapter with the original admin-only
extend_ttl(env, caller)that this PR makes permissionless. - Templar-Protocol/contracts#419: Added the original
contract/proxy-curator-sorobanworkspace member that this PR replaces withcontract/vault/soroban/curator-proxy.
Suggested reviewers
- peer2f00l
- royalf00l
🚥 Pre-merge checks | ✅ 2
✅ Passed checks (2 passed)
| Check name | Status | Explanation |
|---|---|---|
| Linked Issues check | ✅ Passed | Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | ✅ Passed | Check skipped because no linked issues were found for this pull request. |
✏️ Tip: You can configure your own custom pre-merge checks in the settings.
✨ Finishing Touches
🧪 Generate unit tests (beta)
- Create PR with unit tests
- Commit unit tests in branch
chore/vault-soroban-v1-open-custodial-ttl
Warning
Review ran into problems
🔥 Problems
Errors were encountered while retrieving linked issues.
Errors (1)
- LINEAR integration encountered authorization issues. Please disconnect and reconnect the integration in the CodeRabbit UI.
Comment @coderabbitai help to get the list of available commands and usage tips.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Warning
CodeRabbit couldn't request changes on this pull request because it doesn't have sufficient GitHub permissions.
Please grant CodeRabbit Pull requests: Read and write permission and re-run the review.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@contract/vault/soroban/proxy-4626/Cargo.toml`:
- Line 18: The soroban-sdk dependency is pinned to version 25.0.1 which contains
unfixed security vulnerabilities (GHSA-96xm-fv9w-pf3f and GHSA-4chv-4c6w-w254)
that were resolved in versions 25.0.2, 25.1.1, and 25.3.0. Either update the
soroban-sdk version specification from 25.0.1 to 25.3.0 to incorporate these
security fixes and improvements, or if version 25.0.1 is intentionally locked
for compatibility reasons (such as matching an audit scope), add a comment above
the soroban-sdk dependency line in Cargo.toml explaining the pinning reason and
confirming that the documented vulnerabilities do not impact the proxy
contracts.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: f291655f-7449-4515-b8cd-36c852c702f0
⛔ Files ignored due to path filters (1)
Cargo.lockis excluded by!**/*.lock
📒 Files selected for processing (27)
Cargo.tomlcontract/vault/curator-primitives/Cargo.tomlcontract/vault/kernel/Cargo.tomlcontract/vault/soroban/Cargo.tomlcontract/vault/soroban/README.mdcontract/vault/soroban/blend-adapter/Cargo.tomlcontract/vault/soroban/curator-proxy/Cargo.tomlcontract/vault/soroban/curator-proxy/src/contract.rscontract/vault/soroban/curator-proxy/src/error.rscontract/vault/soroban/curator-proxy/src/governance_abi.rscontract/vault/soroban/curator-proxy/src/lib.rscontract/vault/soroban/curator-proxy/src/tests.rscontract/vault/soroban/curator-proxy/tests/integration_tests.rscontract/vault/soroban/custodial-adapter/Cargo.tomlcontract/vault/soroban/custodial-adapter/src/lib.rscontract/vault/soroban/governance/Cargo.tomlcontract/vault/soroban/proxy-4626/Cargo.tomlcontract/vault/soroban/proxy-4626/src/contract.rscontract/vault/soroban/proxy-4626/src/error.rscontract/vault/soroban/proxy-4626/src/lib.rscontract/vault/soroban/proxy-4626/src/tests.rscontract/vault/soroban/proxy-4626/tests/integration_tests.rscontract/vault/soroban/share-token/Cargo.tomlcontract/vault/soroban/shared-types/Cargo.tomltools/soroban-vault-cli/Cargo.tomltools/soroban-vault-cli/README.mdtools/soroban-vault-cli/src/commands.rs
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Validation
Note: clippy exits 0 but the CLI package still emits the existing unknown-lint warning for clippy::ignore_without_reason under this local toolchain.
This change is