Repository navigation
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
A new rust-checks job runs cargo fmt --check, clippy with warnings as errors and cargo deny on every pull request. deny.toml allows the five licences the dependency graph needs. It ignores two advisories that come in through soroban-env-host, each with its reason: paste is unmaintained, and crypto-bigint 0.5 has a timing issue that no soroban-env-host release has picked up the fix for yet. The devshell gains cargo-deny, and docs/TESTING.md lists the three commands to run before pushing.
An attestation carried only the price and its expiry, so nothing on chain linked the number to its evidence. attest now takes a NavInput with a 32-byte proof hash and an optional URI. The oracle stores both with the acceptance time, returns them from latest() and emits them in NavAttested. It anchors the proof and never verifies it. An all-zero hash is refused (EmptyProofHash, 3023), and so is a URI over 256 bytes (ProofUriTooLong, 3024). The input no longer carries a timestamp the oracle ignored; the stored report names its acceptance time accepted_at. An oracle upgraded in place cannot read a report an earlier release stored. No migration rewrites it: governance pauses the NAV, clears the report, lifts the pause, and the attester posts a new one. A test stores a report of the earlier shape and recovers it that way, and the kit spec lists the steps.
The oracle now needs a proof with every report. The harness attests with the SHA-256 of docs/evidence/sample-valuation.md, a sample marked as test data, and its URL on main, or PROOF_URI when set. The happy path checks that the latest report carries both, and the guard that an account with no role cannot attest sends the same input.
The test of a report of the earlier shape checked only that latest, state and attest failed. Its attest was also past the deviation cap, so a contract error would have passed it too. Each call must now fail with the host refusal a decode failure gives, and the attest stays inside the cap and past the cooldown, so only the old entry can refuse it. A URI of exactly 256 bytes is now attested end to end: it is stored and emitted. The attested_at test no longer says the caller can send a time.
The test guide said every testnet attestation points at a file whose bytes match its hash. That holds only for the harness's own attestations, and only once the file is on main or when PROOF_URI points at a release tag's copy. It now says so. The design doc's list of what the chain sees now includes the proof hash and URI. The upgrade runbook says to pause the NAV at once if the upgrade applied first, since neither pause_nav nor clear_latest reads the report. The test guide lists the new 256-byte URI test.
After setup, a compliance swap refused any contract that does not answer VaultBinding, though the vault's finish_setup accepts such an external module. A standard compliance contract, such as OpenZeppelin's, could never replace the testnet stub. The swap check now follows the rule finish_setup uses. The new contract must list the token in linked_tokens. If it answers vault() and setup_open(), they must name the token's vault with setup closed. If either view does not answer, the contract is external and accepted on trust. The check still runs when the change is proposed and again when it applies, and ComplianceNotBound (7017) is still the error. The design notes, the error and entrypoint docs, the kit spec, the design doc, the authorization matrix and the test map now say so.
A compliance contract that answers vault() with None now has a test: the swap is refused at apply. A rule that treated that answer as external would have passed every test. The test for a contract that stops answering one binding view now gives the other view an answer that would fail the check. It passes only under the vault's rule: once either view fails, the other is ignored. The guard test that said every rule is refused before a vault is bound now says it refuses rules that name a vault before one is bound. The vault's external stub comment says it has no binding view.
on_the_vaults_clock returned true for an external module, which is not on the vault's clock. It is now bound_here_or_external, and the vault's matching local has the same name. The comment on the catch-all arm now says that either view failing marks an external module, not only a contract that answers neither. The ComplianceNotBound and propose_change docs said "another vault or an open setup", which left out a contract that names no vault. They now say the contract does not name this token's vault with its setup closed.
fix: extend new balances and roles when created
docs: document entrypoints and errors in the spec
docs: explain each contract's design choices
fix(compliance): extend new modules and bound tokens when created
fix(token): check the contract a swap installs
ci: run a wind-down on a throwaway vault
ci: check formatting, lints and dependencies
feat(oracle): anchor a proof reference to every attestation
Member
|
Replaced by #359, opened from |
This branch had an error being deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Merges
feedbackintomain: the reviewed work on the contracts, the harness and the docs. This pull request stays a draft untilmainis ready to take it.GitHub closes an issue from
Closes #Nonly when a pull request merges into the default branch. The pull requests below merged intofeedback, so their issues are listed here, each with the pull request that did the work. Issues whose pull requests are still open are listed apart.Open issues this closes
Waiting for their pull requests to merge into
feedbackListed now so each issue links to this pull request. A line moves up when its pull request merges.
Already closed by hand
These were closed when their pull requests merged into
feedback. They are listed so each one links to this pull request.Test plan
CI on this pull request builds and tests
feedback's head againstmain.