Repository navigation
fix(vault): enforce admin auth on divest and restrict emergency access (#1630) - #1688
Merged
Junirezz merged 1 commit intoOct 19, 2026
Merged
Conversation
… dedupe routes (Junirezz#1648) - ConfirmationModal & WithdrawalConfirmationModal now use the shared useFocusTrap hook, ignore backdrop clicks and Escape while processing, expose dialog/aria-modal/aria-labelledby, and route all copy through t() - Drawer adopts useFocusTrap so focus is restored on both close and unmount - ToastCenter closes on Escape, moves focus into the panel, and stays a non-modal, non-scroll-locking popover - useFocusTrap gains trapTab and lockScroll options (backward compatible) - App.tsx drops duplicate route/ErrorBoundary definitions and wraps the not-found route in RouteErrorBoundary - Remove stale tracked build/test artifacts and extend .gitignore + README - Repair invalid root package.json (duplicate test script + trailing comma) - Add modal, drawer, toast-center and routing smoke tests Closes Junirezz#1620 Closes Junirezz#1621 Closes Junirezz#1629 Closes Junirezz#1564 Co-authored-by: trinnode <trinnode@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
admin.require_auth()) on thedivestentrypoint incontracts/vault/src/lib.rs.vault/tests/access_control_test.rsvalidating that non-admin calls todivestfail.confirm_emergency_actioncontinues to execute seamlessly.Why
divestwas previously exposed as an unauthenticated public function, allowing unauthorized actors to move strategy funds and mutate core vault accounting (watermarkandstate.total_assets).How tested
cargo testacross contract test suites, confirming non-admindivestattempts are rejected and emergency path tests pass.Closes
Closes #1630