Repository navigation
feat(contract): emit lifecycle events on create, release, and refund (%239) - #238
Conversation
|
@shakourllahfashola-dev Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
|
@shakourllahfashola-dev This PR now has merge conflicts with git fetch upstream # upstream = https://github.com/DocForum/docforum-escrow.git
git rebase upstream/main
# resolve the conflicts, re-run the tests, then:
git push --force-with-leaseThe usual culprits are shared docs like Automated message. It won't repeat unless the PR conflicts again after your next push. |
|
@shakourllahfashola-dev CI is failing on this branch against the latest Soroban contract (test + wasm build), Reproducible WASM across checkout paths, SDK bindings match contract WASM The contract code references |
|
@shakourllahfashola-dev This PR now has merge conflicts with git fetch upstream # upstream = https://github.com/DocForum/docforum-escrow.git
git rebase upstream/main
# resolve the conflicts, re-run the tests, then:
git push --force-with-leaseThe usual culprits are shared docs like Automated message. It won't repeat unless the PR conflicts again after your next push. |
4299948 to
b9a1c8d
Compare
|
Kindly review. |
|
@shakourllahfashola-dev After updating this branch with Please bump |
|
@shakourllahfashola-dev This PR now has merge conflicts with git fetch upstream # upstream = https://github.com/DocForum/docforum-escrow.git
git rebase upstream/main
# resolve the conflicts, re-run the tests, then:
git push --force-with-leaseThe usual culprits are shared docs like Automated message. It won't repeat unless the PR conflicts again after your next push. |
|
@shakourllahfashola-dev Heads-up: #268 just changed how contract PRs work in this repo. Your PR changes
This should also make your next merge from |
…ocForum#9) Emit minimal lifecycle events on create, release, and refund keyed by escrow_id. Topic is ("ESCROW", action, escrow_id); payload is (payer, destination, token, amount). condition_ref is intentionally omitted per threat model T9. Error paths emit nothing. Closes DocForum#9
c2e0f3b to
57cef81
Compare
afeezorobsco-cyber
left a comment
There was a problem hiding this comment.
Sweep: malware scan clean, CI green.
…ts.rs The merge of main (DocForum#238, lifecycle events) left two jobs failing: - `sdk/src/generated/contract-client.ts` was hand-mangled: the `/**` that opens the `transfer_payee` doc block was lost (TS1131), and the file predated the provisional pause error codes. It is now exactly what the pinned stellar CLI (28.1.0, scripts/stellar-cli-version) generates from the current contract WASM, so "SDK bindings match contract WASM" passes too. Never hand-edited. - main's `contracts/escrow/tests/events.rs` still registered the contract with the one-argument constructor, so its 13 tests panicked with `Error(WasmVm, InvalidAction)` ("2 expected, got 1"). All five `env.register` sites now pass a pause admin, and their snapshots are regenerated for the `PauseAdmin`/`Paused` instance entries. `cargo test` passes for every suite in contracts/escrow (events 13, pause 23, create_escrow 7, release_refund 8, timeout_refund 17, top_up 3, cancel 18, payee_acceptance 3, pooled 19, settle_many 13, liabilities 14, protocol_fee 17, quorum 19, transfer_payee 12, undeliverable 2, token_allowlist 2, token_edge_cases 1, malicious_token 7, sponsored_refund 16, releaser_rotation 3, release_callback 6, time_locked_release 5, model 4). Generated with Codebuff 🤖 Co-Authored-By: Codebuff <noreply@codebuff.com>
Brings in DocForum#238 (lifecycle events) and DocForum#270, the contract-change fold that bumped CONTRACT_VERSION to 2.4.0 and renumbered main's provisional `InvalidNewPayee` from 4500 to 37. The only conflict was sdk/src/generated/contract-client.ts, resolved as the repo requires: regenerated from the merged contract WASM with the pinned stellar CLI 28.1.0 (scripts/stellar-cli-version), never hand-merged. The contract-changes.d and changelog.d fragments that DocForum#270 folded are dropped; this PR's own 35-emergency-pause fragments stay, and the pause error codes stay provisional (3500-3502) for the next fold. Generated with Codebuff 🤖 Co-Authored-By: Codebuff <noreply@codebuff.com>
* feat(contract): add a deposit-only emergency pause (ADR 0005) There was no on-chain way to slow down a live bug: the only defence was telling integrators to stop. This adds a narrow lever instead — a single custodian set by the contract's constructor can block `create_escrow` and nothing else, so new exposure stops while every existing escrow can still be released, refunded, or timeout-refunded. Blocking outbound paths would have turned a possible loss into a certain lock, which is why the pause deliberately does not read the flag there (and the 16 new tests prove it). Records the decision in ADR 0005, adds the role to the threat model (T11, invariant I6), and regenerates/bumps the SDK to 0.4.0 for the new pause/unpause/is_paused/get_pause_admin surface. Closes #35 🤖 Generated with Codebuff Co-Authored-By: Codebuff <noreply@codebuff.com> * feat(contract): add a deposit-only emergency pause (ADR 0011) Adds a constructor-set custodian that can pause every deposit path (create_escrow and its variants, plus top_up) and nothing else, so new exposure stops while existing escrows can still be released, refunded or timeout-refunded. Pause/unpause are custodian-only, non-idempotent, and emit Paused/Unpaused events; is_paused/get_pause_admin are read-only. Rebased onto current main: the constructor is merged with the existing token allowlist (__constructor(allowed_tokens, pause_admin)), top_up is gated as the ADR requires of any deposit path, error codes are 26-28 to avoid colliding with existing codes, and the ADR is renumbered to 0011 so it does not clash with the protocol-fee ADR. * fix: reconcile emergency pause with pooled escrows from main The last merge of main (#257 pooled escrows, #193/#248 SDK work) left the branch broken: - contract: `DataKey::Pooled`/`Contribution` had been spliced into the `Unpaused` event struct; restore them to `DataKey`. - contract: `Paused`/`AlreadyPaused`/`NotPaused` collided with `NotPooled`/`FundingDeadlinePassed`/`FundingTargetReached` (26-28). Main's codes keep their on-chain values; the pause codes are appended as 35/36/37 (docs, ADR 0011, README, threat model, ROADMAP, changelog updated). - contract: gate the new pooled deposit paths (`create_pooled_escrow`, `contribute`) on the pause; `claim_refund` and `release` stay ungated. Three new tests in tests/pause.rs cover this. - tests: main's new tests (cancel, pooled, model, malicious_token) registered the contract with the old one-argument constructor; pass a pause admin. Snapshots regenerated with `cargo test`. - sdk: regenerate src/generated/contract-client.ts with the pinned stellar CLI 28.1.0 (it contained a broken hand merge); close the unterminated `getPauseAdmin` method in src/index.ts; drop the duplicate `test:unit` script key in package.json. - ci: the Go SDK local-network deploy passes `--pause_admin`. * ci(sdk-go): pin stellar/quickstart to the digest main last passed with The 2026-10-26 quickstart:latest (core/RPC v30) fails the pinned Stellar CLI 28.1.0's first simulation, `stellar contract asset deploy --asset native`, with HostError: Error(Context, InternalError). It fails the same way on unrelated PRs, before the escrow contract (and its constructor args, which match __constructor(allowed_tokens, pause_admin)) is touched. Pin to the digest from main's last green run (39607326690). * test(fuzz): seed lifecycle corpus with the pause-admin constructor crash CI's cargo-fuzz crash (input AQEAAAgBAA==, [1, 1, 0, 0, 8, 1, 0]) was the harness registering the escrow with main's one-argument constructor; every input hit 'invalid number of input arguments: 2 expected, got 1'. The harness now passes (allowed_tokens, pause_admin). Keeping the input in the corpus replays it on every PR and nightly run. * chore: bump CONTRACT_VERSION to 2.1.0 Emergency pause is a backward-compatible feature on top of 2.0.0 (#209). Satisfies the CI rule requiring a CONTRACT_VERSION bump whenever contracts/escrow/src/lib.rs changes. * chore: bump CONTRACT_VERSION to 2.2.0 main is now at 2.1.0 (#242), so the PR head must move past it for the 'Require a contract version bump when lib.rs changes' CI check. * fix(sdk-go): send fee_recipient/fee_bps on create_escrow and create_escrow_release_time #209 added two optional trailing args (fee_recipient, fee_bps) to create_escrow and create_escrow_release_time. The Go SDK still sent the old argument count, so the integration job failed with Error(WasmVm, UnexpectedSize) / MismatchingParameterLen. Send None for both (no protocol fee) until the Go SDK exposes the fee; create_escrow_with_releasers is unchanged. * test(releaser-account): refresh snapshot for per-token liability entry (#242) * feat(contract): settle_many is never blocked by the emergency pause; bump to 2.3.0 Follow-up to the upstream main merge (#254). Per ADR 0011 the pause stops new deposits only and never blocks outbound paths, so settle_many's release and refund ops ignore the pause flag exactly like single release/refund (invariant I8). Documents this in lib.rs, README and the threat model, adds pause tests showing settle_many release, refund and a mixed batch all succeed while paused (with their snapshots), bumps CONTRACT_VERSION to 2.3.0 (main is 2.2.0) and applies cargo fmt. * fix(contract): repair the merge of main that broke the emergency pause The last merge of main (#169/#199) left the branch uncompilable and its tests failing: - `Error` lost `Paused`, `AlreadyPaused` and `NotPaused` while `lib.rs` still returns them (E0599). Re-added with the provisional codes 3500-3502 that contract-changes.d/README.md asks for, since main already spent 35 (`InvalidFee`) and 36 (`Undeliverable`); the maintainer fold assigns the final numbers. README, ADR 0011, ROADMAP, the threat model and the changelog fragment no longer claim 36-38. - `use soroban_sdk::{...}` was spliced into itself, so every imported name was defined twice (E0252). - main's newer `tests/transfer_payee.rs` and `tests/undeliverable.rs` still registered the contract with the old one-argument constructor, so all 14 of their tests panicked ("invalid number of input arguments: 2 expected, got 1"). They now pass a pause admin and their snapshots are regenerated. - Added the required `contract-changes.d/35-emergency-pause.md` fragment (`bump: minor`); `CONTRACT_VERSION` stays at main's 2.3.0, as the new CI rule requires. `cargo test` passes for every suite in contracts/escrow (pause 23, create_escrow 7, release_refund 8, timeout_refund 17, top_up 3, cancel 18, payee_acceptance 3, pooled 19, settle_many 13, liabilities 14, protocol_fee 17, quorum 19, transfer_payee 12, undeliverable 2, token_allowlist 2, token_edge_cases 1, malicious_token 7, sponsored_refund 16, releaser_rotation 3, release_callback 6, time_locked_release 5, model 4). Generated with Codebuff 🤖 Co-Authored-By: Codebuff <noreply@codebuff.com> * fix(sdk,contract): regenerate bindings and pass a pause admin in events.rs The merge of main (#238, lifecycle events) left two jobs failing: - `sdk/src/generated/contract-client.ts` was hand-mangled: the `/**` that opens the `transfer_payee` doc block was lost (TS1131), and the file predated the provisional pause error codes. It is now exactly what the pinned stellar CLI (28.1.0, scripts/stellar-cli-version) generates from the current contract WASM, so "SDK bindings match contract WASM" passes too. Never hand-edited. - main's `contracts/escrow/tests/events.rs` still registered the contract with the one-argument constructor, so its 13 tests panicked with `Error(WasmVm, InvalidAction)` ("2 expected, got 1"). All five `env.register` sites now pass a pause admin, and their snapshots are regenerated for the `PauseAdmin`/`Paused` instance entries. `cargo test` passes for every suite in contracts/escrow (events 13, pause 23, create_escrow 7, release_refund 8, timeout_refund 17, top_up 3, cancel 18, payee_acceptance 3, pooled 19, settle_many 13, liabilities 14, protocol_fee 17, quorum 19, transfer_payee 12, undeliverable 2, token_allowlist 2, token_edge_cases 1, malicious_token 7, sponsored_refund 16, releaser_rotation 3, release_callback 6, time_locked_release 5, model 4). Generated with Codebuff 🤖 Co-Authored-By: Codebuff <noreply@codebuff.com> * fix(sdk): regenerate bindings with the pinned Rust toolchain The bindings committed with the merge were generated from a WASM built with the sandbox's stable Rust (1.99), but the repo pins 1.96 in rust-toolchain.toml and CI builds with it. The compiler changes the order of the ContractSpec entries in the WASM, so the committed file had the PayeeRefunded event spec in a different slot than CI's regeneration and "SDK bindings match contract WASM" failed. Rebuilt the WASM with the pinned 1.96.0 toolchain and regenerated with stellar CLI 28.1.0 as scripts/check-generated-bindings.sh does, so the diff is only that one entry moving; the script now reports OK. Generated with Codebuff 🤖 Co-Authored-By: Codebuff <noreply@codebuff.com> --------- Co-authored-by: Codebuff Agent <noreply@codebuff.com> Co-authored-by: Azintar <Azintar@users.noreply.github.com> Co-authored-by: Azintar <342361479+Azintar@users.noreply.github.com> Co-authored-by: afeez <afeezorobsco@gmail.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Closes #9