chore: release v15 #608
chore: release v15 #608
Conversation
Co-authored-by: lumtis <lucas.bertrand.22@gmail.com> Co-authored-by: s2imonovic <s2imonovic@gmail.com>
…from onRevert() (#604)
|
Important Review skippedReview was skipped as selected files did not have any reviewable changes. 💤 Files selected but had no reviewable changes (1)
⛔ Files ignored due to path filters (2)
You can disable this status message by setting the 📝 WalkthroughWalkthroughThis PR renames the module from Changes
Sequence Diagram(s)sequenceDiagram
actor User
participant GatewayEVM
participant TSS Address
participant ZEVM
User->>GatewayEVM: First deposit() in transaction
note over GatewayEVM: _getNextActionIndex() = 1
note over GatewayEVM: First action: NO FEE
GatewayEVM->>ZEVM: Execute deposit (no fee charged)
User->>GatewayEVM: Second call() in same transaction
note over GatewayEVM: _getNextActionIndex() = 2
note over GatewayEVM: Subsequent action: CHARGE FEE
GatewayEVM->>GatewayEVM: _processFee() validates and deducts additionalActionFeeWei
GatewayEVM->>TSS Address: Transfer fee
GatewayEVM->>ZEVM: Execute call (fee charged)
Estimated code review effort🎯 4 (Complex) | ⏱️ ~50 minutes Rationale: The GatewayEVM.sol changes introduce substantial new logic including a transient per-transaction action counter, cross-action fee mechanism with multiple validation paths, and five new function overloads with varying signatures. This requires careful review of fee calculations, validation order, and interaction with both ETH and ERC20 deposit paths. IGatewayEVM interface changes are correspondingly extensive. GatewayZEVM refactoring centralizes gas fee handling into a new helper. Multiple heterogeneous changes across configuration, package metadata, and contract logic files compound review complexity. Pre-merge checks and finishing touches❌ Failed checks (1 warning, 1 inconclusive)
✅ Passed checks (1 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
# Conflicts: # contracts/evm/interfaces/IGatewayEVM.sol # contracts/zevm/GatewayZEVM.sol # docs/index.md # pkg/coreregistry.sol/coreregistry.go # pkg/coreregistry.t.sol/coreregistrytest.go # pkg/coreregistry.t.sol/mockgatewayzevm.go # pkg/erc20custody.sol/erc20custody.go # pkg/erc20custody.t.sol/erc20custodytest.go # pkg/erc20custodyupgradetest.sol/erc20custodyupgradetest.go # pkg/gatewayevm.sol/gatewayevm.go # pkg/gatewayevm.t.sol/gatewayevminboundtest.go # pkg/gatewayevm.t.sol/gatewayevmtest.go # pkg/gatewayevmupgradetest.sol/gatewayevmupgradetest.go # pkg/gatewayevmzevm.t.sol/gatewayevmzevmtest.go # pkg/gatewayzevm.sol/gatewayzevm.go # pkg/gatewayzevm.t.sol/gatewayzevminboundtest.go # pkg/gatewayzevm.t.sol/gatewayzevmoutboundtest.go # pkg/gatewayzevmupgradetest.sol/gatewayzevmupgradetest.go # pkg/receiverevm.sol/receiverevm.go # pkg/registry.sol/registry.go # pkg/registry.t.sol/mockgatewayevm.go # pkg/registry.t.sol/registrytest.go # pkg/senderzevm.sol/senderzevm.go # pkg/systemcontract.sol/systemcontract.go # pkg/systemcontractmock.sol/systemcontractmock.go # pkg/testuniversalcontract.sol/testuniversalcontract.go # pkg/zetaconnector.base.sol/zetaconnectorbase.go # pkg/zetaconnector.eth.sol/zetaconnectoreth.go # pkg/zetaconnector.non-eth.sol/zetaconnectornoneth.go # pkg/zetaconnectornative.sol/zetaconnectornative.go # pkg/zetaconnectornative.t.sol/zetaconnectornativetest.go # pkg/zetaconnectornativeupgradetest.sol/zetaconnectornativeupgradetest.go # pkg/zetaconnectornonnative.sol/zetaconnectornonnative.go # pkg/zetaconnectornonnative.t.sol/zetaconnectornonnativetest.go # pkg/zetaconnectornonnativeupgradetest.sol/zetaconnectornonnativeupgradetest.go # pkg/zetaconnectorzevm.sol/zetaconnectorzevm.go # pkg/zrc20.sol/zrc20.go # pkg/zrc20.t.sol/zrc20test.go # types/factories/CoreRegistry__factory.ts # types/factories/ERC20CustodyUpgradeTest__factory.ts # types/factories/ERC20Custody__factory.ts # types/factories/GatewayEVMUpgradeTest__factory.ts # types/factories/GatewayEVM__factory.ts # types/factories/GatewayZEVMUpgradeTest__factory.ts # types/factories/GatewayZEVM__factory.ts # types/factories/ReceiverEVM__factory.ts # types/factories/Registry__factory.ts # types/factories/SenderZEVM__factory.ts # types/factories/SystemContract.sol/SystemContract__factory.ts # types/factories/SystemContractMock.sol/SystemContractMock__factory.ts # types/factories/TestUniversalContract__factory.ts # types/factories/ZRC20.sol/ZRC20__factory.ts # types/factories/ZetaConnector.base.sol/ZetaConnectorBase__factory.ts # types/factories/ZetaConnector.eth.sol/ZetaConnectorEth__factory.ts # types/factories/ZetaConnector.non-eth.sol/ZetaConnectorNonEth__factory.ts # types/factories/ZetaConnectorNativeUpgradeTest__factory.ts # types/factories/ZetaConnectorNative__factory.ts # types/factories/ZetaConnectorNonNativeUpgradeTest__factory.ts # types/factories/ZetaConnectorNonNative__factory.ts # types/factories/ZetaConnectorZEVM.sol/ZetaConnectorZEVM__factory.ts
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
contracts/evm/GatewayEVM.sol (1)
526-531: Use SafeERC20.forceApprove for connector allowance.Raw
approvemay fail for non‑standard tokens; SafeERC20 handles zero‑first semantics.- // approve connector to handle tokens depending on connector version (eg. lock or burn) - if (!IERC20(token).approve(zetaConnector, amount)) revert ApprovalFailed(); + // approve connector to handle tokens depending on connector version (eg. lock or burn) + IERC20(token).forceApprove(zetaConnector, 0); + IERC20(token).forceApprove(zetaConnector, amount);
🧹 Nitpick comments (21)
contracts/zevm/interfaces/UniversalContract.sol (1)
4-7: Trim unused imports and simplify pathsAbortContext, RevertOptions, IWZETA, and IZRC20 aren’t used here; drop them to reduce compile surface. Also prefer absolute "contracts/Revert.sol" or "../../Revert.sol" for clarity over "../../../contracts/...".
-import { AbortContext, RevertContext, RevertOptions } from "../../../contracts/Revert.sol"; +import { RevertContext } from "contracts/Revert.sol"; -import "../interfaces/IWZETA.sol"; -import "../interfaces/IZRC20.sol";contracts/zevm/GatewayZEVM.sol (1)
373-373: call(): consider surfacing paid gas fee for observabilityHelper burns fees but Called event carries no gasFee. Optional: emit a separate GasFeePaid(zrc20, payer, gasFee) to aid off-chain accounting without breaking ABI.
contracts/evm/GatewayEVM.sol (13)
55-59: Use a namespaced transient slot to avoid collisions.
_TRANSACTION_ACTION_COUNT_KEY = 0x01is terse and risks future clashes. Prefer a namespaced keccak-based key.-uint256 private constant _TRANSACTION_ACTION_COUNT_KEY = 0x01; +bytes32 private constant _TRANSACTION_ACTION_COUNT_KEY = + bytes32(uint256(uint160(uint256(keccak256("zeta.gateway.tx_action_count.v1"))))));And update assembly to use the bytes32-typed constant (no functional change).
112-121: Admin fee update looks good; add bounds/emit already present.Optionally clamp to a sane upper bound to prevent misconfig by ops; otherwise LGTM.
- function updateAdditionalActionFee(uint256 newFeeWei) external onlyRole(DEFAULT_ADMIN_ROLE) { + function updateAdditionalActionFee(uint256 newFeeWei) external onlyRole(DEFAULT_ADMIN_ROLE) { + // Optional: cap to 2 ether to prevent fat‑finger; tune as needed + if (newFeeWei > 2 ether) revert(); uint256 oldFee = additionalActionFeeWei; additionalActionFeeWei = newFeeWei; emit UpdatedAdditionalActionFee(oldFee, newFeeWei); }
258-270: Legacy ETH deposit: reentrancy hardening.This transfers ETH to
tssAddressviacall. While TSS is trusted, addingnonReentrantis a cheap defense-in-depth.-function deposit(address receiver, RevertOptions calldata revertOptions) external payable whenNotPaused { +function deposit(address receiver, RevertOptions calldata revertOptions) + external + payable + whenNotPaused + nonReentrant +{
279-306: ETH deposit with amount: add nonReentrant.Same rationale as above; fee path sends ETH to TSS.
- { + nonReentrant {
318-328: ERC20 deposit: payable for fee is fine; doc the exactmsg.valuerule.Implementation enforces exact fee (0 for first action). Add NatSpec comment to guide integrators.
- function deposit( + /// @dev msg.value must equal the required fee (0 for first action; `additionalActionFeeWei` otherwise). + function deposit(
338-360: Legacy depositAndCall: add nonReentrant.Transfers ETH to TSS; mirror the hardening.
- { + nonReentrant {
367-395: ETH depositAndCall with amount: add nonReentrant.Fee transfer + deposit transfer happen here.
- { + nonReentrant {
411-420: ERC20 depositAndCall: payable for fee is fine; docmsg.valuerule.Mirror deposit(…asset…) NatSpec for consistency.
- function depositAndCall( + /// @dev msg.value must equal the required fee (0 for first action; `additionalActionFeeWei` otherwise). + function depositAndCall(
436-445: Call without assets: consider nonReentrant or restrict TSS fallback.
_processFeetransfers ETH totssAddresswhich could reenter via fallback. Low risk, but guarding aligns all feeed entrypoints.- { + nonReentrant {
502-502: TODO/link note.Once ZETA is re-enabled, remove the TODO and ensure unit/integration tests cover ZETA paths. Until then, consider a require with a clear message in public surfaces to fail fast.
585-616: Fee processing logic: OK; add config validation guardrail.Consider reverting if
additionalActionFeeWeiis absurdly high to avoid accidental lockouts.- if (additionalActionFeeWei == 0) { + if (additionalActionFeeWei == 0) { revert AdditionalActionDisabled(); } + if (additionalActionFeeWei > 2 ether) revert(); // optional: safety cap
617-626: ERC20 fee validation: matches processFee semantics.Minor: rename error to mention “fee” vs “ETH” for clarity in logs, or add a dedicated
IncorrectFeeProvidederror.
41-45: Storage layout is sound; add storage gap for future extensibility.The new
additionalActionFeeWei(uint256) correctly appends at storage slot 4 after the four address variables (slots 0-3). No collision risk exists for deployed proxies. However, as a best practice for upgradeable contracts, add a storage gap array to prevent future slot conflicts during upgrades:uint256[49] private __gap;This follows OpenZeppelin's pattern and reserves space for future state variable additions without breaking compatibility.
contracts/evm/interfaces/IGatewayEVM.sol (6)
119-140: New errors cover fee/amount invariants.LGTM. Consider aligning names with implementation messages (e.g., “IncorrectValueProvided”) across docs.
208-213: ETH deposit with amount: payable signature OK.Add NatSpec that
msg.value == amount + feeand that first action has fee 0.- /// @param revertOptions Revert options. + /// @param revertOptions Revert options. + /// @dev msg.value must equal `amount + requiredFee` (requiredFee is 0 for the first action).
225-227: ERC20 deposit now payable for fee: clarify NatSpec.State that
msg.valuemust equal the required fee (0 oradditionalActionFeeWei).
240-253: ETH depositAndCall with amount: payable OK; doc equality rule.Mirror the deposit doc note.
267-269: ERC20 depositAndCall: payable for fee is consistent.Doc the
msg.valuerule for integrators.
274-281: call(...) now payable for fee: ergonomic but consider overloading ergonomics.Overloaded methods plus payable can be error‑prone in clients (ethers.js typing). Consider unique names or explicit structs in the next major.
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Disabled knowledge base sources:
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
⛔ Files ignored due to path filters (134)
docs/index.mdis excluded by!docs/**pkg/address.sol/address.gois excluded by!pkg/**pkg/beaconproxy.sol/beaconproxy.gois excluded by!pkg/**pkg/console.sol/console.gois excluded by!pkg/**pkg/core.sol/core.gois excluded by!pkg/**pkg/coreregistry.sol/coreregistry.gois excluded by!pkg/**pkg/coreregistry.t.sol/coreregistrytest.gois excluded by!pkg/**pkg/coreregistry.t.sol/mockgatewayzevm.gois excluded by!pkg/**pkg/defender.sol/defender.gois excluded by!pkg/**pkg/defenderdeploy.sol/defenderdeploy.gois excluded by!pkg/**pkg/erc1967proxy.sol/erc1967proxy.gois excluded by!pkg/**pkg/erc1967utils.sol/erc1967utils.gois excluded by!pkg/**pkg/erc20custody.sol/erc20custody.gois excluded by!pkg/**pkg/erc20custody.t.sol/erc20custodytest.gois excluded by!pkg/**pkg/erc20custodyupgradetest.sol/erc20custodyupgradetest.gois excluded by!pkg/**pkg/gatewayevm.sol/gatewayevm.gois excluded by!pkg/**pkg/gatewayevm.t.sol/gatewayevminboundtest.gois excluded by!pkg/**pkg/gatewayevm.t.sol/gatewayevmtest.gois excluded by!pkg/**pkg/gatewayevmupgradetest.sol/gatewayevmupgradetest.gois excluded by!pkg/**pkg/gatewayevmzevm.t.sol/gatewayevmzevmtest.gois excluded by!pkg/**pkg/gatewayzevm.sol/gatewayzevm.gois excluded by!pkg/**pkg/gatewayzevm.t.sol/gatewayzevminboundtest.gois excluded by!pkg/**pkg/gatewayzevm.t.sol/gatewayzevmoutboundtest.gois excluded by!pkg/**pkg/gatewayzevmupgradetest.sol/gatewayzevmupgradetest.gois excluded by!pkg/**pkg/igatewayevm.sol/igatewayevm.gois excluded by!pkg/**pkg/igatewayevm.sol/igatewayevmerrors.gois excluded by!pkg/**pkg/igatewayevm.sol/igatewayevmevents.gois excluded by!pkg/**pkg/math.sol/math.gois excluded by!pkg/**pkg/mockerc20.sol/mockerc20.gois excluded by!pkg/**pkg/mockerc721.sol/mockerc721.gois excluded by!pkg/**pkg/nonreturnapprovaltoken.sol/nonreturnapprovaltoken.gois excluded by!pkg/**pkg/proxyadmin.sol/proxyadmin.gois excluded by!pkg/**pkg/receiverevm.sol/receiverevm.gois excluded by!pkg/**pkg/registry.sol/registry.gois excluded by!pkg/**pkg/registry.t.sol/mockgatewayevm.gois excluded by!pkg/**pkg/registry.t.sol/registrytest.gois excluded by!pkg/**pkg/revert.sol/revertable.gois excluded by!pkg/**pkg/revertonzeroapprovaltoken.sol/revertonzeroapprovaltoken.gois excluded by!pkg/**pkg/safeconsole.sol/safeconsole.gois excluded by!pkg/**pkg/safeerc20.sol/safeerc20.gois excluded by!pkg/**pkg/senderzevm.sol/senderzevm.gois excluded by!pkg/**pkg/signedmath.sol/signedmath.gois excluded by!pkg/**pkg/src/strings.sol/strings.gois excluded by!pkg/**pkg/stderror.sol/stderror.gois excluded by!pkg/**pkg/stdjson.sol/stdjson.gois excluded by!pkg/**pkg/stdmath.sol/stdmath.gois excluded by!pkg/**pkg/stdstorage.sol/stdstorage.gois excluded by!pkg/**pkg/stdstorage.sol/stdstoragesafe.gois excluded by!pkg/**pkg/stdstyle.sol/stdstyle.gois excluded by!pkg/**pkg/stdtoml.sol/stdtoml.gois excluded by!pkg/**pkg/storageslot.sol/storageslot.gois excluded by!pkg/**pkg/strings.sol/strings.gois excluded by!pkg/**pkg/systemcontract.sol/systemcontract.gois excluded by!pkg/**pkg/systemcontractmock.sol/systemcontractmock.gois excluded by!pkg/**pkg/testerc20.sol/testerc20.gois excluded by!pkg/**pkg/testuniversalcontract.sol/testuniversalcontract.gois excluded by!pkg/**pkg/transparentupgradeableproxy.sol/transparentupgradeableproxy.gois excluded by!pkg/**pkg/upgradeablebeacon.sol/upgradeablebeacon.gois excluded by!pkg/**pkg/upgrades.sol/unsafeupgrades.gois excluded by!pkg/**pkg/upgrades.sol/upgrades.gois excluded by!pkg/**pkg/utils.sol/utils.gois excluded by!pkg/**pkg/utils/wzeta.sol/weth9.gois excluded by!pkg/**pkg/versions.sol/versions.gois excluded by!pkg/**pkg/wzeta.sol/weth9.gois excluded by!pkg/**pkg/wzeta.t.sol/wzetatest.gois excluded by!pkg/**pkg/zeta.non-eth.sol/zetanoneth.gois excluded by!pkg/**pkg/zetaconnector.base.sol/zetaconnectorbase.gois excluded by!pkg/**pkg/zetaconnector.eth.sol/zetaconnectoreth.gois excluded by!pkg/**pkg/zetaconnector.non-eth.sol/zetaconnectornoneth.gois excluded by!pkg/**pkg/zetaconnectornative.sol/zetaconnectornative.gois excluded by!pkg/**pkg/zetaconnectornative.t.sol/zetaconnectornativetest.gois excluded by!pkg/**pkg/zetaconnectornativeupgradetest.sol/zetaconnectornativeupgradetest.gois excluded by!pkg/**pkg/zetaconnectornonnative.sol/zetaconnectornonnative.gois excluded by!pkg/**pkg/zetaconnectornonnative.t.sol/zetaconnectornonnativetest.gois excluded by!pkg/**pkg/zetaconnectornonnativeupgradetest.sol/zetaconnectornonnativeupgradetest.gois excluded by!pkg/**pkg/zetaconnectorzevm.sol/zetaconnectorzevm.gois excluded by!pkg/**pkg/zetaeth.sol/zetaeth.gois excluded by!pkg/**pkg/zetanoneth.sol/zetanoneth.gois excluded by!pkg/**pkg/zrc20.sol/zrc20.gois excluded by!pkg/**pkg/zrc20.t.sol/zrc20test.gois excluded by!pkg/**types/GatewayEVM.tsis excluded by!types/**types/GatewayEVMUpgradeTest.tsis excluded by!types/**types/IGatewayEVM.sol/IGatewayEVM.tsis excluded by!types/**types/IGatewayEVM.sol/IGatewayEVMEvents.tsis excluded by!types/**types/Revert.sol/Revertable.tsis excluded by!types/**types/TestUniversalContract.tsis excluded by!types/**types/factories/Address__factory.tsis excluded by!types/**types/factories/BeaconProxy__factory.tsis excluded by!types/**types/factories/CoreRegistry__factory.tsis excluded by!types/**types/factories/ERC1967Proxy__factory.tsis excluded by!types/**types/factories/ERC1967Utils__factory.tsis excluded by!types/**types/factories/ERC20CustodyUpgradeTest__factory.tsis excluded by!types/**types/factories/ERC20Custody__factory.tsis excluded by!types/**types/factories/GatewayEVMUpgradeTest__factory.tsis excluded by!types/**types/factories/GatewayEVM__factory.tsis excluded by!types/**types/factories/GatewayZEVMUpgradeTest__factory.tsis excluded by!types/**types/factories/GatewayZEVM__factory.tsis excluded by!types/**types/factories/IGatewayEVM.sol/IGatewayEVMErrors__factory.tsis excluded by!types/**types/factories/IGatewayEVM.sol/IGatewayEVMEvents__factory.tsis excluded by!types/**types/factories/IGatewayEVM.sol/IGatewayEVM__factory.tsis excluded by!types/**types/factories/Math__factory.tsis excluded by!types/**types/factories/MockERC20__factory.tsis excluded by!types/**types/factories/MockERC721__factory.tsis excluded by!types/**types/factories/NonReturnApprovalToken__factory.tsis excluded by!types/**types/factories/ProxyAdmin__factory.tsis excluded by!types/**types/factories/ReceiverEVM__factory.tsis excluded by!types/**types/factories/Registry__factory.tsis excluded by!types/**types/factories/Revert.sol/Revertable__factory.tsis excluded by!types/**types/factories/RevertOnZeroApprovalToken__factory.tsis excluded by!types/**types/factories/SafeERC20__factory.tsis excluded by!types/**types/factories/SenderZEVM__factory.tsis excluded by!types/**types/factories/StdError.sol/StdError__factory.tsis excluded by!types/**types/factories/StdStorage.sol/StdStorageSafe__factory.tsis excluded by!types/**types/factories/Strings__factory.tsis excluded by!types/**types/factories/SystemContract.sol/SystemContract__factory.tsis excluded by!types/**types/factories/SystemContractMock.sol/SystemContractMock__factory.tsis excluded by!types/**types/factories/TestERC20__factory.tsis excluded by!types/**types/factories/TestUniversalContract__factory.tsis excluded by!types/**types/factories/TransparentUpgradeableProxy.sol/TransparentUpgradeableProxy__factory.tsis excluded by!types/**types/factories/UpgradeableBeacon__factory.tsis excluded by!types/**types/factories/WZETA.sol/WETH9__factory.tsis excluded by!types/**types/factories/ZRC20.sol/ZRC20__factory.tsis excluded by!types/**types/factories/Zeta.non-eth.sol/ZetaNonEth__factory.tsis excluded by!types/**types/factories/ZetaConnector.base.sol/ZetaConnectorBase__factory.tsis excluded by!types/**types/factories/ZetaConnector.eth.sol/ZetaConnectorEth__factory.tsis excluded by!types/**types/factories/ZetaConnector.non-eth.sol/ZetaConnectorNonEth__factory.tsis excluded by!types/**types/factories/ZetaConnectorNativeUpgradeTest__factory.tsis excluded by!types/**types/factories/ZetaConnectorNative__factory.tsis excluded by!types/**types/factories/ZetaConnectorNonNativeUpgradeTest__factory.tsis excluded by!types/**types/factories/ZetaConnectorNonNative__factory.tsis excluded by!types/**types/factories/ZetaConnectorZEVM.sol/ZetaConnectorZEVM__factory.tsis excluded by!types/**types/factories/ZetaEth__factory.tsis excluded by!types/**types/factories/ZetaNonEth__factory.tsis excluded by!types/**types/factories/utils/WZETA.sol/WETH9__factory.tsis excluded by!types/**
📒 Files selected for processing (11)
README.md(1 hunks)contracts/Revert.sol(1 hunks)contracts/evm/GatewayEVM.sol(11 hunks)contracts/evm/ZetaConnectorNative.sol(3 hunks)contracts/evm/interfaces/IGatewayEVM.sol(6 hunks)contracts/zevm/GatewayZEVM.sol(5 hunks)contracts/zevm/interfaces/UniversalContract.sol(1 hunks)foundry.toml(2 hunks)go.mod(1 hunks)hardhat.config.ts(1 hunks)package.json(2 hunks)
🧰 Additional context used
📓 Path-based instructions (1)
contracts/**
⚙️ CodeRabbit configuration file
Review the Solidity contracts for security vulnerabilities and best practices.
Files:
contracts/zevm/GatewayZEVM.solcontracts/evm/ZetaConnectorNative.solcontracts/Revert.solcontracts/evm/GatewayEVM.solcontracts/evm/interfaces/IGatewayEVM.solcontracts/zevm/interfaces/UniversalContract.sol
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (4)
- GitHub Check: test
- GitHub Check: slither
- GitHub Check: generate
- GitHub Check: semgrep/ci
🔇 Additional comments (15)
README.md (1)
73-73: LGTM!The X social media link has been correctly updated to reflect the consolidated handle.
contracts/evm/ZetaConnectorNative.sol (1)
31-31: LGTM!The GitHub issue references have been consistently updated across all three locations to reflect the repository rename from
protocol-contractstoprotocol-contracts-evm.Also applies to: 54-54, 83-83
contracts/zevm/GatewayZEVM.sol (4)
134-134: _withdrawZRC20WithGasLimit now uses helperLGTM. Centralization reduces duplication and error surface.
283-283: Updated issue linkLGTM.
326-326: Updated issue linkLGTM.
105-120: Add reentrancy protection to user-facing fee-charging functionsThe review comment is correct. External functions
withdraw()(lines 160, 196),withdrawAndCall()(line 233), andcall()(line 346) that invoke_burnProtocolFees()lacknonReentrantguards. Since_burnProtocolFees()makes external calls to potentially malicious ZRC20 implementations (withdrawGasFeeWithGasLimit,transferFrom,burn), these functions are vulnerable to reentrancy attacks.Additionally,
_burnProtocolFees()should validategasFee > 0to fail fast on misconfigured tokens rather than silently succeeding with zero fees.Recommendation: Apply
nonReentrantmodifier to the four external functions listed above, and add a guard clauseif (gasFee == 0) revert InvalidGasFee();in_burnProtocolFees().foundry.toml (1)
4-4: Foundry config changes verified—no conflicts detectedThe libs addition and evm_version "cancun" are consistent. Verification confirms only one evm_version setting exists (foundry.toml:26), with no conflicting profiles. Both changes are aligned with Hardhat and the intended Cancun target.
contracts/Revert.sol (1)
57-57: onRevert signature change verified—no breaking changesChange from
payableto non-payable is security-positive and safe. Verification confirms:
- No implementations use
payablemodifier- All callers pass onRevert as a zero-value external call; value transfers occur separately (before the onRevert call)
- All existing implementations (TestUniversalContract, ReceiverEVM, ZetaConnectorZEVM, etc.) are already compatible
The hardening is effective with no updates needed.
hardhat.config.ts (1)
15-15: evmVersion "cancun" configuration verifiedThe Solidity compiler configuration in hardhat.config.ts is consistent and compatible. Etherscan and Sourcify both support contracts compiled with Cancun EVM version, and the project uses Solidity 0.8.26, which includes Cancun support (available since 0.8.24). No configuration conflicts detected.
package.json (1)
2-2: Package rename verified: no internal breaking references foundComprehensive verification confirms no references to the old package name
@zetachain/protocol-contractsexist in docs, imports, scripts, or configuration files. The rename to@zetachain/protocol-contracts-evmis clean within the codebase.go.mod (1)
1-1: Module rename verified—no stale imports foundThe rename from
github.com/zeta-chain/protocol-contractstogithub.com/zeta-chain/protocol-contracts-evmis complete and clean. Verification confirms:
- No stale imports of the old path in any of the 168 Go source files
- go.mod correctly reflects the new module path
- go.sum dependencies are clean and valid
contracts/evm/GatewayEVM.sol (2)
627-636: ETH amount validation: succinct and correct.LGTM.
638-649: The verification confirms that the project properly targets Cancun for both build systems:
- Hardhat (
hardhat.config.ts:15):evmVersion: "cancun"- Foundry (
foundry.toml:26):evm_version = "cancun"This validates that the
tload/tstoretransient storage operations in_getNextActionIndex()are fully supported and the assembly implementation is appropriate.contracts/evm/interfaces/IGatewayEVM.sol (2)
69-73: Event for TSS updates: good addition.LGTM.
74-78: Event for fee updates: good operational signal.LGTM.
Sherlock AI FindingsThe automated tool completed its analysis of the codebase and found no potential security issues. Next Steps: No immediate actions are required. Continue monitoring the codebase with future scans. Full report available at: https://ai.sherlock.xyz/runs/cf177078-b894-4132-bb7b-f9674d878ebf |
Merging release/v15 to main
Summary by CodeRabbit
Release Notes
New Features
Chores