Skip to content

chore: bring audit fixes onto testnet/donut #371

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
0xNilesh merged 63 commits into from
Sep 11, 2026
Merged

chore: bring audit fixes onto testnet/donut #371

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
63 commits
Select commit Hold shift + click to select a range
295248d
fix: summary no. corrections
Aman035 Jul 9, 2026
4a1096d
fix: gate TSS libp2p inbound to eligible universal validators (F-2026…
Aman035 Aug 12, 2026
d28d095
fix: F-2026-18145 | [Dual Defense] Missing OP-Stack L1 Data-Fee Accou…
Aman035 Aug 17, 2026
8af9cd2
fix: F-2026-18190 | [Dual Defense] Obsolete TSS Keyshares Survive Quo…
Aman035 Aug 18, 2026
49de107
fix: F-2026-18191 | [Dual Defense] Byzantine TSS Coordinator Can Fre…
Aman035 Aug 18, 2026
6ae6dcb
fix: F-2026-18199 | [Dual Defense] TSS Setup Message Signs an Unverif…
Aman035 Aug 19, 2026
7db9b89
test: F-2026-18199 | [Dual Defense] TSS Setup Message Signs an Unveri…
Aman035 Aug 19, 2026
3bddedc
fix: F-2026-18198 | [Dual Defense] Solana Inbound Event Forgery Enabl…
Aman035 Aug 19, 2026
f176bfa
fix: treat receipt RPC failure as an error instead of tx-not-found (F…
Aman035 Aug 19, 2026
e6ba904
fix: F-2026-18804 | [Dual Defense] EVM ABI readDynamicBytes Uint64 Ov…
Aman035 Aug 21, 2026
f0083a3
fix: F-2026-18797 | [Dual Defense] Universal Client Chain Registry Li…
Aman035 Aug 21, 2026
b93ea41
fix: F-2026-18802 | [Dual Defense] EVM FilterLogs Fixed 9000-Block Ch…
Aman035 Aug 21, 2026
757157d
fix: F-2026-18201 | [Dual Defense] Staking Precompile and Vesting Und…
0xNilesh Aug 24, 2026
6a1403e
fix: F-2026-18200 | [Dual Defense] Variable-Length Signer Addresses E…
0xNilesh Aug 24, 2026
8e28eed
fix: F-2026-18197 | [Dual Defense] Nested Message Dispatch Bypasses E…
0xNilesh Aug 24, 2026
3deb6d7
fix: F-2026-18195 | [Dual Defense] isCEA Smart-Contract Inbound Lifec…
0xNilesh Aug 24, 2026
c63e0af
fix: F-2026-18829 | [Dual Defense] UEA_SVM Hardcodes Ed25519 Verifier…
0xNilesh Aug 24, 2026
9b05ec7
fix: F-2026-18825 | [Dual Defense] One Invalid Gateway Sibling Erases…
0xNilesh Aug 24, 2026
8ad6728
fix: F-2026-18194 | [Dual Defense] Unbacked Gas PRC20 Mint on INBOUND…
0xNilesh Aug 24, 2026
f119cd2
fix: F-2026-18799 | [Dual Defense] SIGN_FUND_MIGRATE Selects Current …
Aman035 Aug 24, 2026
b5be6a7
fix: F-2026-18800 | [Dual Defense] Short SVM send_funds Defaults TxTy…
Aman035 Aug 24, 2026
bb73afb
fix: F-2026-18827 | [Dual Defense] Normal EVM Outbound Resolution Use…
Aman035 Aug 25, 2026
49f8e7c
fix: F-2026-18196 | [Dual Defense] Native SOL Misclassified as SPL Du…
Aman035 Aug 25, 2026
115951e
fix: F-2026-18139 | [Dual Defense] Cross-RPC Height Skew Can Underflo…
Aman035 Aug 25, 2026
83c145f
fix: use a valid 20-byte signer in the gasless module-sender test (#331)
0xNilesh Aug 26, 2026
258061f
fix: F-2026-18142 | [Dual Defense] Fund Migration Signing Hash Uses L…
Aman035 Aug 26, 2026
51c2dd7
fix: F-2026-18817 | [Dual Defense] SVM Log Truncation + Resolver No S…
Aman035 Aug 26, 2026
b3a2058
fix: skip quadratic base58 decode outside the 64-byte signature lengt…
0xNilesh Aug 26, 2026
4f6a125
fix: F-2026-18823 | [Dual Defense] buildRevertOutbound Fail-Open Leav…
0xNilesh Aug 26, 2026
b851fde
fix: reject empty authz.MsgExec in IsGaslessTx (F-2026-18816) (#332)
0xNilesh Aug 26, 2026
5b4b744
fix: F-2026-18803 | [Dual Defense] Gasless MsgVoteChainMeta Can Infla…
0xNilesh Aug 26, 2026
3eed921
docs: record why admin revert refuses REJECTED inbound ballots (#334)
0xNilesh Aug 26, 2026
ac3ee3a
fix: bound uexecutor uint256 string fields (F-2026-18798) (#335)
0xNilesh Aug 26, 2026
a8a997e
fix: refuse RecomputeBallotQuorum on non-2/3 ballot types (#336)
0xNilesh Aug 26, 2026
64b8aff
fix(uvalidator): index pending ballots by expiry height and sweep the…
0xNilesh Aug 26, 2026
5b50e76
fix(svm): stop creating the recipient ATA; the gateway meters that re…
Aman035 Aug 26, 2026
2f161b0
fix: drop SIGN_MODE_DIRECT_AUX from the enabled sign modes (#340)
0xNilesh Aug 26, 2026
a42effa
fix(uexecutor): keep the module EVM nonce and the manual nonce counte…
0xNilesh Aug 26, 2026
aa5ad0e
fix(uexecutor): derive rescue asset from the original inbound, not th…
0xNilesh Aug 26, 2026
ecccfb8
fix: accept provably unreachable PENDING ballots in RevertStuckInboun…
0xNilesh Aug 26, 2026
d5d8ee8
fix: allocate fund migration ids from 1 so the first one is votable (…
0xNilesh Aug 26, 2026
7473e48
fix: F-2026-18140 price ed25519 raw-message verification by length (#…
0xNilesh Aug 26, 2026
2b07bcc
fix: F-2026-18184 | [Dual Defense] Empty SVM CEA Recipient Encodes to…
0xNilesh Aug 26, 2026
c4d2b02
test(uexecutor): align unreachable-pending revert assertions with F-2…
0xNilesh Aug 26, 2026
861fca0
fix: F-2026-18133 | [Dual Defense] Same-Block Validator Jailing Can S…
0xNilesh Aug 26, 2026
bd3c2d8
fix: F-2026-18148 | [Dual Defense] Removed Universal Validator Retain…
0xNilesh Aug 26, 2026
9fd3a39
fix: F-2026-18146 | [Dual Defense] Unbounded Universal Payload Size a…
0xNilesh Aug 26, 2026
f96eed0
chore: adapt push-chain-node to cosmos/evm v0.6.0 (#339)
0xNilesh Aug 26, 2026
a5aead7
fix: cap the gas a gasless tx may declare, as a governance parameter …
0xNilesh Aug 26, 2026
c2a8e3f
fix(ante): gate gasless new-account creation on bonded universal vali…
0xNilesh Aug 26, 2026
7f9e50f
fix: F-2026-18817 | read SVM gateway events from emit_cpi inner instr…
Aman035 Sep 1, 2026
f38bf13
fix(uexecutor): bill reverted inbound payloads for gas used (F-2026-1…
0xNilesh Sep 2, 2026
05996bb
fix: F-2026-18815 | follow the gateway recipient ATA creation on SVM …
Aman035 Sep 2, 2026
bbad4a6
fix(uexecutor): bound remaining uint256 string parses; remove MsgMigr…
0xNilesh Sep 2, 2026
9a3a536
feat(uexecutor): add MsgExecuteStuckInbound admin hatch (F-2026-18147…
0xNilesh Sep 2, 2026
5f0341e
fix(uexecutor): cap the outbound gateway payload at admission (F-2026…
0xNilesh Sep 3, 2026
b0541bd
Merge develop into audit-fixes
Aman035 Sep 8, 2026
6063049
chore: pin evm to the audit-fixes merge
0xNilesh Sep 11, 2026
209e319
chore: bump evm pin to the merged audit-fixes develop
0xNilesh Sep 11, 2026
d264e6a
Merge pull request #370 from pushchain/audit-fixes-merge-develop
0xNilesh Sep 11, 2026
fd7d91d
Merge testnet/donut into develop for the donut audit-fixes branch
0xNilesh Sep 11, 2026
a39fa1a
fix: activate both verifier addresses in genesis, drop dead utxhashve…
0xNilesh Sep 11, 2026
e217f35
chore: add audit-fixes upgrade handler
0xNilesh Sep 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4,099 changes: 2,609 additions & 1,490 deletions api/uexecutor/v1/tx.pulsar.go
View file
Open in desktop

Large diffs are not rendered by default.

139 changes: 94 additions & 45 deletions api/uexecutor/v1/tx_grpc.pb.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading
Loading