Repository navigation
Fix/1526 1528 1543 1544 - #1646
Merged
Junirezz merged 3 commits intoOct 18, 2026
Merged
Conversation
…idation build - bridge-compat: transfer_out checks the sender's balance instead of the contract's and enforces min_transfer <= amount <= provider.max_transfer (shared with estimate_transfer); admin-settable min_transfer (Junirezz#1528) - vault: replace instant upgrade with propose_upgrade / execute_upgrade / cancel_upgrade behind max(24h, sensitive timelock); write and verify the EIP-1967 implementation slot and emit upg_prop / upg_cncl / upgraded; emergency ForceUpgrade also records the slot (Junirezz#1543) - vault: strategy_validation builds for wasm (zero address from strkey); exact-error unit tests for every strategy_validation and rounding_consistency error path; docs list the real error codes (Junirezz#1526) - fix pre-existing compile errors in rounding.rs, total_assets, the bridge-compat test module and vault lib tests so the tests run Closes Junirezz#1526 Closes Junirezz#1528 Closes Junirezz#1543
- generate-openapi: repair the script and add --check / --fail-on-drift, which load the app, diff every operation against openapi.json and exit non-zero on drift or when the app cannot be loaded; npm run check:openapi replaces the git-status check in backend-governance CI - regenerate openapi.json from the router stack (165 operations, incl. /admin/exports/bulk, /admin/impersonate/*, /admin/events/replay) and mount the existing diagnostics handler at GET /api/v1/admin/diagnostics - repair the corruption that kept src/index.ts from loading: base64-encoded healthProbe.ts / apiKeyAuth.ts, duplicated merge blocks in eventOutbox, idempotency (store now only re-exported from idempotencyStore), apiError, pagination, tracing, outboxPoller, vaultEndpoints and routes/vaults (keeps the Junirezz#1430 public listing), the @yieldvault/api-schemas dependency name, the lockfile, and a trailing comma in the root package.json Closes Junirezz#1544
|
@francisdouglas-ux Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| res: Response, | ||
| next: NextFunction | ||
| ): Promise<void> { | ||
| const authHeader = req.get?.('Authorization') || ''; |
| }); | ||
| } | ||
|
|
||
| export function hashApiKey(key: string): string { |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🚀 Overview
This Pull Request resolves four critical smart contract security, operational governance, and backend documentation issues for Junirezz/YieldVault-RWA:
min_transfer/max_transferbounds intransfer_out.propose_upgrade,execute_upgrade,cancel_upgrade) backed by EIP-1967 implementation slot updates and audit events.strategy_validation.rsandrounding_consistency.rs, restoring target release WASM compilation.openapi.jsoncoverage from ~20 to 165 endpoints (including admin, bulk export, impersonation, and event replay routes) and added an automated CI drift check (npm run check:openapi).🔑 Linked Issues
🛠️ Summary of Changes
🌉 1. Bridge Balance & Transfer Limits (
contracts/bridge-compat/src/lib.rs) (#1528)transfer_outto verify thesenderaddress balance rather thanenv.current_contract_address().min_transfer <= amount <= provider.max_transferprior to initiating cross-chain transfers in bothtransfer_outandestimate_transfer.⏱️ 2. Timelocked Upgrades & EIP-1967 Slot Writes (
contracts/vault/src/) (#1543)upgrade()with a staged flow:propose_upgrade(staging WASM hash with a 24-hour delay or configured timelock),execute_upgrade, andcancel_upgrade.IMPLEMENTATION_SLOTand reads it back to verify storage integrity. Emergency force-upgrade paths also populate the slot.upg_prop,upg_cncl, andupgradedaudit events.🛡️ 3. Validation Error Alignment & WASM Build Fix (
contracts/vault/src/) (#1526)strategy_validation.rs, restoring successful release WASM builds (cargo build --target wasm32v1-none --release).strategy_validation.rsandrounding_consistency.rs.📜 4. Backend OpenAPI Sync & CI Drift Check (
backend/) (#1544)backend/openapi.jsonto document 165 API operations (up from 18), covering/admin/exports/bulk,/admin/impersonate/*,/admin/events/replay, and/api/v1/admin/diagnostics.generate-openapiscript with--check --fail-on-driftflag and wirednpm run check:openapiinto CI.healthProbe.ts,apiKeyAuth.ts), removed duplicate merge blocks across 8 backend utilities, fixed dependency typos, and normalizedpackage.json.📁 Files Touched
contracts/bridge-compat/src/lib.rscontracts/vault/src/lib.rs&upgrade.rscontracts/vault/src/strategy_validation.rsbackend/openapi.jsonbackend/scripts/generate-openapi.ts--check --fail-on-driftflags for CI drift validation.backend/src/🧪 Verification Logs
bridge-compatunit and limit tests passed cleanly.npm run check:openapipasses locally without drift.routes/vaults.tscontained duplicate glued definitions. We retained the public page-limited implementation from GET /vaults query does not enforce max limit and allows limit=100000 to OOM the API #1430 to matchswagger.ts.ApiKeymodel definition causingprisma generateto fail in CI. A database cleanup PR should decide whichApiKeymodel and migration to retain.godamongstmen897branch; whichever PR merges second can rebase cleanly.