Skip to content

Fix/rpc domain validated fetch - #300

Merged
Lakes41 merged 3 commits into
Adamantine-guild:mainfrom
abojeEdwin:fix/rpc-domain-validated-fetch
Sep 14, 2026
Merged

Lakes41 merged 3 commits into
Adamantine-guild:mainfrom
abojeEdwin:fix/rpc-domain-validated-fetch

Conversation

@abojeEdwin

Copy link
Copy Markdown
Contributor

Closes #175

Description

Linked Issue

Closes #

Type of Change

  • 🐛 Bug fix (screen or component)
  • ✨ New feature / screen
  • 🎨 UI/UX improvement
  • 📝 Documentation update
  • 🔧 Chore / refactor / dependency update
  • 🧪 Tests only

Changes Made

Screenshots / Recordings

iOS Android

Test Evidence

pnpm test:run output:

Checklist

  • I have read CONTRIBUTING.md
  • This PR is linked to an open issue
  • pnpm typecheck passes
  • pnpm lint passes
  • pnpm test:run passes — all tests green
  • UI changes include a screenshot or screen recording
  • New screens handle loading, empty, and error states
  • NativeWind (Tailwind) classes used — no StyleSheet.create for new UI without justification
  • No native modules added that break Expo Go compatibility (without prior discussion)
  • No secrets, keys, or wallet credentials included
  • .env.example updated if new environment variables were added
  • Accessibility: interactive elements are keyboard-navigable and have accessibility labels

Additional Notes

abojeEdwin and others added 3 commits September 14, 2026 01:59
… check

Add RPC endpoint domain guard (Control 3): rpcEthCall now validates every
RPC URL against the rpcConfig-derived allowlist before dispatch and logs
unknown endpoints with a distinct warning. Documents the boundary in
threat-model.md and adds allowlist behavior tests.
@Lakes41
Lakes41 merged commit 794dbad into Adamantine-guild:main Sep 14, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Route the on-chain RPC resolver's requests through domain-validated fetch

2 participants