Harden propose_admin_transfer against unauthorized caller and illegal source state (#346) - #365
Harden propose_admin_transfer against unauthorized caller and illegal source state (#346)#365d3vobed wants to merge 3 commits into
Conversation
|
@d3vobed Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
|
FIX FAILED CI @d3vobed |
The merge of main into issue-346 (734b99e) removed the require_initialized function definition while keeping its call site in propose_admin_transfer, which broke compilation (E0599) and failed CI on Goldii-locks#365. Re-add the definition next to require_admin. No logic change to the hardened behavior. Fixes Goldii-locks#365
88a47d2 to
b2ad18a
Compare
|
Heads-up for reviewers: the 2 failing CI checks (
This PR's own |
…oldii-locks#346) - Add require_initialized() guard checked before any other ledger access. - propose_admin_transfer now rejects unauthorised callers (Unauthorized) and illegal source states (AdminTransferPending / InvalidAddress / NotInitialized) and performs no ledger mutation on rejected paths. - Add comprehensive tests asserting the typed errors and no-mutation guarantee for each rejected path plus the happy path.
- make test modules cfg(test) so testutils and crate::test are available only in test builds (fixes main-wide compile break where admin_override etc. were unconditional) - make setup_funded_escrow pub(crate) and add missing imports (crate::test::setup_funded_escrow and testutils::Address) to 6 test modules - fixes 16 compile errors (E0425/E0599/E0432) that blocked CI on main and PR Goldii-locks#365
…th and invalid test setup - Remove the redundant top-level admin.require_auth() in admin_override_cancel_refund; require_admin already performs the SDK auth check, so the duplicate call panicked with Error(Auth, ExistingValue) under mock_all_auths (frame already authorized). - Fix test_cancel_refund_all_terminal_returns_invalid_amount: the contract balance reaches zero after approving the only milestone, so the cancel boundary guard rejects before CancelLock can be set. Replenish the contract with a token donation so the guard passes while all milestones remain terminal, preserving the intended InvalidAmount assertion.
|
Fix the remaining CI failures on this branch:
Full local run: 468 passed, 0 failed. CI is running on head |
2 participants
Summary
Closes #346
Hardens
propose_admin_transferso it rejects unauthorised callers and illegal source states with specific typed errors, performing no ledger mutation on any rejected path.require_initialized()precondition, checked before any other ledger access (the contract's init marker isDataKey::Version, set byinitialize).require_admin(auth + stored-admin match →Unauthorized) and theAdminTransferPending/InvalidAddresspreconditions; the new init check sits first so an uninitialised contract is rejected up-front.Unauthorized,AdminTransferPending,InvalidAddress,NotInitialized) and verifying the pending-admin-transfer ledger entry is never written on a rejected call.Verification
cargo testincontracts/milestone-escrow— all tests pass (incl. the 5 new ones).