Repository navigation
fix: bind vault initialization to creator and creation salt - #35
Closed
qingfeng312 wants to merge 1 commit into
Closed
qingfeng312 wants to merge 1 commit into
qingfeng312 wants to merge 1 commit into
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #8.
The current contract already requires
admin.require_auth(), but a first callercan still select itself and authorize its own initialization. Implement issue
option 2: derive the current contract address from the supplied creator and exact
creation salt, reject mismatches, require creator authorization, and also require
any distinct admin's consent. Keep
AlreadyInit, storage layout, event encodingand existing error numbers; append
BadDeployer(17).This changes the initialization ABI for new builds. Update input validation,
transaction encoding, error descriptions and both deploy scripts together. The
creation helper now returns the exact salt used, even when omitted by the caller.
Single-signer scripts reject a distinct admin before creation; callers needing a
different admin must provide both parties' authorization separately. SDK stays at
locked 21.7.7. Existing deployed Wasm is not upgraded by this change.
Verified locally on macOS arm64 with Node24.22.1, pnpm9.15.0 and Rust1.99.1:
pnpm run test: 228 TypeScript tests and 25 contract tests pass. Six new nativeauthorization regressions use explicit mocked authorization; the original
self-signed capture regression fails against the unmodified initialize logic.
pnpm run contract:clippy(-D warnings), typecheck, format:check,contract:fmt:check and shell syntax checks pass.
pnpm run lintexits 0 with three pre-existing warnings in the unchangedwallet context. Wasm release and full application/service builds pass.
Native Soroban and stub-RPC checks are not live Testnet verification. No real
account signing, deployment or ledger Wasm execution was performed. Historical
deployment records remain historical. The initialization method has a local
too_many_argumentsallowance, propagated by the SDK to its generated clients,to preserve the original metadata parameters while appending creation proof.
Implementation, tests and this PR description were prepared with OpenAI Codex.
Human review and maintainer acceptance of this ABI choice are pending.