Skip to content

feat: refactor agent_skills to ContractAddress-based SkillsComponent#69

Merged
starknetdev merged 2 commits intonextfrom
feat/skills-address-extension
Mar 3, 2026
Merged

feat: refactor agent_skills to ContractAddress-based SkillsComponent#69
starknetdev merged 2 commits intonextfrom
feat/skills-address-extension

Conversation

@starknetdev
Copy link
Member

Summary

  • Replace agent_skills: ByteArray with skills_address: ContractAddress across GameMetadata, registry, and all mint functions
  • Add new SkillsComponent extension (mirrors the renderer pattern) with per-token storage and registry fallback
  • Add IAgentSkills and IMinigameTokenSkills SRC5 interfaces for external skills contracts
  • Add OptionalSkills trait with NoOpSkills for minimal contracts
  • Replace deprecated contract_address_const::<0>() with 0.try_into().unwrap()

Test plan

  • All existing tests pass (snforge test)
  • No compilation warnings (deprecated starknet consts removed)
  • 65 files updated across interfaces, components, mocks, examples, and tests
  • Verify CI passes for all 16 module test suites

🤖 Generated with Claude Code

…killsComponent

Replace the agent_skills ByteArray field with a ContractAddress-based extension system
mirroring the existing renderer pattern. This enables per-token skills address overrides
with fallback to registry-level defaults.

- Add IAgentSkills and IMinigameTokenSkills interfaces
- Add SkillsComponent extension with per-token storage and fallback
- Add OptionalSkills trait with NoOpSkills for minimal contracts
- Update GameMetadata.agent_skills (ByteArray) → skills_address (ContractAddress)
- Add skills_address parameter to mint/mint_game across all components
- Update all mock contracts, test files, and examples
- Replace deprecated contract_address_const::<0>() with 0.try_into().unwrap()

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@coderabbitai
Copy link

coderabbitai bot commented Mar 3, 2026

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Post copyable unit tests in a comment
  • Commit unit tests in branch feat/skills-address-extension

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@claude
Copy link

claude bot commented Mar 3, 2026

Claude finished @starknetdev's task —— View job


Claude Review - General Engineering Review

run=22623795395 attempt=1 sha=c0e0343cdaa948fc81c1b4ae9dae7fe82362d4e2 scope=general

Todo List

  • Get the targeted diff to see changes outside packages/
  • Review CI/CD configuration changes
  • Check documentation updates
  • Examine tooling/script changes
  • Verify matrix consistency with codecov.yml
  • Post review findings

Review Findings

After analyzing the PR changes with the scoped diff command:

git diff 00499e839d2cac339a071dd201aaaae998835f66...c0e0343cdaa948fc81c1b4ae9dae7fe82362d4e2 -- . ':(exclude)packages/**'

No issues found.

All 65 files changed in this PR are located within the packages/ directory. There are no changes to:

  • CI/CD configuration files (.github/workflows/)
  • Documentation files (*.md at root level)
  • Build configuration (codecov.yml, Scarb.toml)
  • Tooling and scripts (scripts/)
  • Other infrastructure files

Since the scope of this general engineering review is limited to changes outside packages/**, and no such changes exist in this PR, there are no actionable findings to report.

Summary: 0 CRITICAL, 0 HIGH, 0 MEDIUM, 0 LOW, 0 INFO


@github-actions
Copy link

github-actions bot commented Mar 3, 2026

Codex Review - General Engineering Review

Review process failed to complete.

@claude
Copy link

claude bot commented Mar 3, 2026

Claude finished @starknetdev's task —— View job


Claude Review - Cairo/Starknet Contract Review

run=22623795395 attempt=1 sha=c0e0343cdaa948fc81c1b4ae9dae7fe82362d4e2 scope=packages

Review Tasks

  • Analyze the git diff to understand the scope of changes
  • Review security implications of ByteArray → ContractAddress refactor
  • Check Cairo idioms and deprecated pattern replacements
  • Examine testing coverage for new SkillsComponent
  • Identify gas optimization opportunities
  • Verify proper SRC5 interface implementation
  • Check storage layout and packing efficiency
  • Post comprehensive review findings

Security Analysis

[MEDIUM] packages/embeddable_game_standard/src/token/extensions/skills/skills.cairo:52-64 - Missing token existence validation
Impact: reset_token_skills function could succeed for non-existent tokens, potentially causing state inconsistencies or allowing unauthorized operations
Fix: Add token existence check before ownership validation:

fn reset_token_skills(ref self: ComponentState<TContractState>, token_id: felt252) {
    let contract_address = get_contract_address();
    let erc721 = IERC721Dispatcher { contract_address };
    
    // First check token exists, then check ownership
    let token_owner = erc721.owner_of(token_id.into()); // This will revert for non-existent tokens
    let caller = get_caller_address();
    assert!(token_owner == caller, "MinigameToken: Caller is not owner of token");
    // ... rest of function
}

[LOW] packages/embeddable_game_standard/src/token/extensions/skills/skills.cairo:66-78 - Unbounded loop in batch operation
Impact: Large token ID arrays could cause block gas limit issues or DoS attacks
Fix: Add array length validation:

fn reset_token_skills_batch(ref self: ComponentState<TContractState>, token_ids: Span<felt252>) {
    assert!(token_ids.len() <= 100, "MinigameToken: Batch size too large");
    // ... rest of function
}

[INFO] packages/embeddable_game_standard/src/token/token_component.cairo:178-206 - Skills address resolution logic is sound
Impact: The fallback logic properly handles per-token overrides vs registry defaults with zero-address checks

Cairo Idioms

[INFO] All contract_address_const::<0>() patterns correctly replaced with 0.try_into().unwrap()

  • Found 17 occurrences properly updated across test files and implementations
  • Follows current Cairo best practices for zero address creation

[INFO] Component integration follows established patterns

  • SkillsComponent properly mirrors RendererComponent architecture
  • SRC5 interface registration correctly implemented in initializer
  • Storage isolation via component pattern is correct

Testing Coverage

[HIGH] packages/embeddable_game_standard/src/token/extensions/skills/skills.cairo - Missing comprehensive test coverage
Impact: New SkillsComponent lacks dedicated test suite covering edge cases and security boundaries
Fix: Create comprehensive test file packages/embeddable_game_standard/src/token/tests/test_skills.cairo with:

  • Token ownership validation tests (should_panic for non-owners)
  • Batch operation boundary tests (empty arrays, max limits)
  • Event emission verification
  • SRC5 interface support verification
  • Integration with token component fallback logic

[MEDIUM] Test files updated but missing negative path coverage
Impact: No tests verify access control failures or invalid token ID handling in new skills functions
Fix: Add #[should_panic] tests for:

  • Resetting skills for tokens not owned by caller
  • Batch operations with oversized arrays
  • Skills operations on non-existent tokens

Gas Optimization

[LOW] packages/embeddable_game_standard/src/token/extensions/skills/skills.cairo:80-97 - Batch function performs redundant storage reads
Impact: get_skills_address_batch calls individual get_skills_address which adds function call overhead
Fix: Optimize by reading storage directly:

fn get_skills_address_batch(self: @ComponentState<TContractState>, token_ids: Span<felt252>) -> Array<ContractAddress> {
    let mut results = array![];
    let mut index = 0;
    loop {
        if index >= token_ids.len() { break; }
        let token_id = *token_ids.at(index);
        let addr = self.token_skills.entry(token_id).read(); // Direct storage read
        results.append(addr);
        index += 1;
    }
    results
}

[INFO] Storage packing in token_id remains efficient

  • Skills address stored separately from packed token metadata is appropriate
  • Per-token storage overhead is reasonable for the flexibility gained

Additional Findings

[INFO] Interface design follows SRC5 standards correctly

  • IMINIGAME_TOKEN_SKILLS_ID properly computed via src5_rs
  • Interface methods appropriately separated between read/write operations

[INFO] Event emission properly implemented

  • TokenSkillsUpdate event includes indexed token_id for efficient filtering
  • Events emitted in both direct component calls and trait implementations

[LOW] packages/interfaces/src/structs/registry.cairo - Skills address type consistency
Impact: GameMetadata struct updated correctly but documentation could clarify fallback behavior
Fix: Add documentation comment explaining skills_address = 0 means "use default/no skills"

Summary

3 MEDIUM, 3 LOW, 6 INFO findings identified. The refactor is architecturally sound and follows established patterns. Main concerns are missing test coverage for the new component and standard batch operation safety validations.


@github-actions
Copy link

github-actions bot commented Mar 3, 2026

Codex Review - Cairo/Starknet Contract Review

Review process failed to complete.

@gemini-code-assist
Copy link

Summary of Changes

Hello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request refactors the agent skills implementation to use a contract address-based approach, enhancing flexibility and extensibility. It introduces a new SkillsComponent and related interfaces, providing a more structured way to manage agent skills within the Embeddable Game Standard. The changes also remove deprecated code and ensure compatibility with existing tests.

Highlights

  • Skills Component: Introduced a new SkillsComponent extension, mirroring the renderer pattern, with per-token storage and registry fallback.
  • Contract Address-based Skills: Replaced agent_skills: ByteArray with skills_address: ContractAddress across GameMetadata, registry, and all mint functions.
  • SRC5 Interfaces: Added IAgentSkills and IMinigameTokenSkills SRC5 interfaces for external skills contracts.
  • Optional Skills Trait: Added OptionalSkills trait with NoOpSkills for minimal contracts.
  • Deprecated Code: Replaced deprecated contract_address_const::<0>() with 0.try_into().unwrap().

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Changelog
  • packages/embeddable_game_standard/src/metagame/metagame.cairo
    • Added skills_address as an optional parameter to the mint and mint_batch functions.
  • packages/embeddable_game_standard/src/metagame/metagame_component.cairo
    • Added skills_address as an optional parameter to the mint function.
  • packages/embeddable_game_standard/src/metagame/structs.cairo
    • Added skills_address field to the MintMetagameParams struct.
  • packages/embeddable_game_standard/src/metagame/tests/test_fuzz_mint_parameters.cairo
    • Added skills_address parameter to IMockMetagame trait and updated mock implementations to include optional skills address.
  • packages/embeddable_game_standard/src/metagame/tests/test_libs.cairo
    • Added skills_address as an optional parameter to the minting functions in tests.
  • packages/embeddable_game_standard/src/metagame/tests/test_metagame_component.cairo
    • Added skills_address parameter to IMockMetagame trait and updated mock implementations to include optional skills address.
  • packages/embeddable_game_standard/src/metagame/tests/test_tournament_flow.cairo
    • Added skills_address as an optional parameter to the minting functions in tests.
  • packages/embeddable_game_standard/src/minigame/minigame.cairo
    • Replaced agent_skills with skills_address in the register_game and mint functions.
  • packages/embeddable_game_standard/src/minigame/minigame_component.cairo
    • Replaced agent_skills with skills_address in MinigameComponent and related functions.
  • packages/embeddable_game_standard/src/minigame/tests/mocks/mock_minigame_contract.cairo
    • Replaced agent_skills with skills_address in IMockMinigameInit trait and mock implementations.
  • packages/embeddable_game_standard/src/minigame/tests/test_libs.cairo
    • Added skills_address as an optional parameter to the minting functions in tests.
  • packages/embeddable_game_standard/src/minigame/tests/test_minigame_component.cairo
    • Added skills_address as an optional parameter to the minting functions in tests.
  • packages/embeddable_game_standard/src/registry/AGENTS.md
    • Replaced agent_skills with skills_address in GameMetadata struct and event descriptions.
  • packages/embeddable_game_standard/src/registry/registry.cairo
    • Replaced agent_skills with skills_address in metadata handling functions.
  • packages/embeddable_game_standard/src/registry/registry_component.cairo
    • Replaced agent_skills with skills_address in MinigameRegistryComponent and related functions.
  • packages/embeddable_game_standard/src/registry/tests/test_registry_component.cairo
    • Replaced agent_skills with skills_address in test assertions and event checks.
  • packages/embeddable_game_standard/src/registry/tests/test_registry_store.cairo
    • Replaced agent_skills with skills_address in test functions and metadata handling.
  • packages/embeddable_game_standard/src/token/extensions.cairo
    • Added new module skills to token extensions.
  • packages/embeddable_game_standard/src/token/extensions/skills.cairo
    • Added new files for skills extension.
  • packages/embeddable_game_standard/src/token/extensions/skills/interface.cairo
    • Added new files for skills extension.
  • packages/embeddable_game_standard/src/token/extensions/skills/skills.cairo
    • Added new files for skills extension.
  • packages/embeddable_game_standard/src/token/interface.cairo
    • Replaced agent_skills with skills_address in IMinigameTokenMixin and related interfaces.
  • packages/embeddable_game_standard/src/token/noop_traits.cairo
    • Added OptionalSkills trait and NoOpSkills implementation.
  • packages/embeddable_game_standard/src/token/tests/examples/full_token_contract.cairo
    • Added SkillsComponent and related implementations to FullTokenContract.
  • packages/embeddable_game_standard/src/token/tests/examples/minigame_registry_contract.cairo
    • Replaced agent_skills with skills_address in MinigameRegistryContract.
  • packages/embeddable_game_standard/src/token/tests/examples/minimal_optimized_example.cairo
    • Added NoOpSkills implementation to MinimalOptimizedContract.
  • packages/embeddable_game_standard/src/token/tests/examples/single_game_token_contract.cairo
    • Added SkillsComponent and related implementations to SingleGameTokenContract.
  • packages/embeddable_game_standard/src/token/tests/test_additional_coverage.cairo
    • Added skills_address as an optional parameter to the minting functions in tests.
  • packages/embeddable_game_standard/src/token/tests/test_batch_views.cairo
    • Added skills_address as an optional parameter to the minting functions in tests.
  • packages/embeddable_game_standard/src/token/tests/test_component_coverage.cairo
    • Added skills_address as an optional parameter to the minting functions in tests.
  • packages/embeddable_game_standard/src/token/tests/test_context.cairo
    • Added skills_address as an optional parameter to the minting functions in tests.
  • packages/embeddable_game_standard/src/token/tests/test_context_coverage.cairo
    • Added skills_address as an optional parameter to the minting functions in tests.
  • packages/embeddable_game_standard/src/token/tests/test_core_token.cairo
    • Added skills_address as an optional parameter to the minting functions in tests.
  • packages/embeddable_game_standard/src/token/tests/test_core_token_coverage.cairo
    • Added skills_address as an optional parameter to the minting functions in tests.
  • packages/embeddable_game_standard/src/token/tests/test_events.cairo
    • Added skills_address as an optional parameter to the minting functions in tests.
  • packages/embeddable_game_standard/src/token/tests/test_examples_coverage.cairo
    • Added skills_address as an optional parameter to the minting functions in tests.
  • packages/embeddable_game_standard/src/token/tests/test_extensions.cairo
    • Added skills_address as an optional parameter to the minting functions in tests.
  • packages/embeddable_game_standard/src/token/tests/test_full_token_contract.cairo
    • Added skills_address as an optional parameter to the minting functions in tests.
  • packages/embeddable_game_standard/src/token/tests/test_fuzz.cairo
    • Added skills_address as an optional parameter to the minting functions in tests.
  • packages/embeddable_game_standard/src/token/tests/test_integration.cairo
    • Added skills_address as an optional parameter to the minting functions in tests.
  • packages/embeddable_game_standard/src/token/tests/test_minimal_optimized.cairo
    • Added skills_address as an optional parameter to the minting functions in tests.
  • packages/embeddable_game_standard/src/token/tests/test_minter.cairo
    • Added skills_address as an optional parameter to the minting functions in tests.
  • packages/embeddable_game_standard/src/token/tests/test_noop_traits.cairo
    • Added skills_address as an optional parameter to the minting functions in tests.
  • packages/embeddable_game_standard/src/token/tests/test_objectives.cairo
    • Added skills_address as an optional parameter to the minting functions in tests.
  • packages/embeddable_game_standard/src/token/tests/test_renderer.cairo
    • Added skills_address as an optional parameter to the minting functions in tests.
  • packages/embeddable_game_standard/src/token/tests/test_settings.cairo
    • Added skills_address as an optional parameter to the minting functions in tests.
  • packages/embeddable_game_standard/src/token/token_component.cairo
    • Added skills_address as an optional parameter to the minting functions in tests.
  • packages/interfaces/src/minigame/core.cairo
    • Added skills_address as an optional parameter to the minting functions in tests.
  • packages/interfaces/src/structs/minigame.cairo
    • Added skills_address as an optional parameter to the minting functions in tests.
  • packages/interfaces/src/structs/token.cairo
    • Added skills_address as an optional parameter to the minting functions in tests.
  • packages/metagame/src/ticket_booth/tests/test_ticket_booth.cairo
    • Added skills_address as an optional parameter to the minting functions in tests.
  • packages/metagame/src/ticket_booth/ticket_booth_component.cairo
    • Added skills_address as an optional parameter to the minting functions in tests.
  • packages/test_common/src/examples/full_token_contract.cairo
    • Added skills_address as an optional parameter to the minting functions in tests.
  • packages/test_common/src/examples/minigame_registry_contract.cairo
    • Added skills_address as an optional parameter to the minting functions in tests.
  • packages/test_common/src/examples/minimal_optimized_example.cairo
    • Added skills_address as an optional parameter to the minting functions in tests.
  • packages/utilities/src/renderer/svg.cairo
    • Added skills_address as an optional parameter to the minting functions in tests.
Activity
  • All existing tests passed (snforge test).
  • No compilation warnings (deprecated starknet consts removed).
  • 65 files updated across interfaces, components, mocks, examples, and tests.
Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature Command Description
Code Review /gemini review Performs a code review for the current pull request in its current state.
Pull Request Summary /gemini summary Provides a summary of the current pull request in its current state.
Comment @gemini-code-assist Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help /gemini help Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

  1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution.

@codecov
Copy link

codecov bot commented Mar 3, 2026

Copy link

@gemini-code-assist gemini-code-assist bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request introduces a significant and well-executed refactoring, replacing the agent_skills: ByteArray with a more scalable skills_address: ContractAddress. The introduction of a new SkillsComponent follows the existing architectural patterns, which is excellent for consistency and maintainability. The changes are applied thoroughly across all relevant files, including contracts, interfaces, and tests. The addition of the OptionalSkills trait and NoOpSkills implementation for minimal contracts is a thoughtful touch that enhances the modularity of the standard. Overall, this is a high-quality contribution that improves the design of the codebase. I have one minor suggestion regarding some misplaced comments in the test files to improve readability.

Option::Some("https://game.com"), // client_url
Option::Some(RENDERER_ADDRESS()), // renderer_address
Option::Some(RENDERER_ADDRESS()),
Option::None, // renderer_address

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The comment for this parameter is incorrect. It should be // skills_address instead of // renderer_address. This seems to be a recurring pattern in other test files as well where the new skills_address parameter was added. Please correct these comments for better code clarity.

            Option::None, // skills_address

- Create comprehensive test_skills.cairo with 25 tests covering:
  get/set, has_custom, reset (owner-only), batch operations,
  events, SRC5 interface, integration, and fuzz tests
- Add skills methods to IMinigameTokenMixin for test accessibility
- Fix 15 misplaced "// renderer_address" comments that should be
  "// skills_address" across test files

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@claude
Copy link

claude bot commented Mar 3, 2026

Claude finished @starknetdev's task —— View job


Claude Review - General Engineering Review

run=22624892104 attempt=1 sha=b48bb5e3af6407888693ed207655dca5218d2c0a scope=general

Todo List

  • Get the targeted diff to see changes outside packages/
  • Review CI/CD configuration changes
  • Check documentation updates
  • Examine tooling/script changes
  • Verify matrix consistency with codecov.yml
  • Post review findings

Review Findings

After analyzing the PR changes with the scoped diff command:

git diff 00499e839d2cac339a071dd201aaaae998835f66...b48bb5e3af6407888693ed207655dca5218d2c0a -- . ':(exclude)packages/**'

No issues found.

All 65 files changed in this PR are located within the packages/ directory. There are no changes to:

  • CI/CD configuration files (.github/workflows/)
  • Documentation files (*.md at root level)
  • Build configuration (codecov.yml, Scarb.toml)
  • Tooling and scripts (scripts/)
  • Other infrastructure files

Since the scope of this general engineering review is limited to changes outside packages/**, and no such changes exist in this PR, there are no actionable findings to report.

Summary: 0 CRITICAL, 0 HIGH, 0 MEDIUM, 0 LOW, 0 INFO


@github-actions
Copy link

github-actions bot commented Mar 3, 2026

Codex Review - General Engineering Review

Review process failed to complete.

@claude
Copy link

claude bot commented Mar 3, 2026

Claude finished @starknetdev's task —— View job


Claude Review - Cairo/Starknet Contract Review

run=22624892104 attempt=1 sha=b48bb5e3af6407888693ed207655dca5218d2c0a scope=packages

Review Tasks

  • Get the targeted diff to see changes in packages/ only
  • Review security implications of ByteArray → ContractAddress refactor
  • Check Cairo idioms and deprecated pattern replacements
  • Examine testing coverage for new SkillsComponent
  • Identify gas optimization opportunities
  • Verify proper SRC5 interface implementation
  • Check storage layout and packing efficiency
  • Post comprehensive review findings

Security Analysis

[MEDIUM] packages/embeddable_game_standard/src/token/extensions/skills/skills.cairo:52-64 - Missing token existence validation
Impact: reset_token_skills function could succeed for non-existent tokens, potentially causing state inconsistencies or allowing unauthorized operations
Fix: Add token existence check before ownership validation:

fn reset_token_skills(ref self: ComponentState<TContractState>, token_id: felt252) {
    let contract_address = get_contract_address();
    let erc721 = IERC721Dispatcher { contract_address };
    
    // First check token exists, then check ownership
    let token_owner = erc721.owner_of(token_id.into()); // This will revert for non-existent tokens
    let caller = get_caller_address();
    assert!(token_owner == caller, "MinigameToken: Caller is not owner of token");
    // ... rest of function
}

[LOW] packages/embeddable_game_standard/src/token/extensions/skills/skills.cairo:66-78 - Unbounded loop in batch operation
Impact: Large token ID arrays could cause block gas limit issues or DoS attacks
Fix: Add array length validation:

fn reset_token_skills_batch(ref self: ComponentState<TContractState>, token_ids: Span<felt252>) {
    assert!(token_ids.len() <= 100, "MinigameToken: Batch size too large");
    // ... rest of function
}

[INFO] packages/embeddable_game_standard/src/token/token_component.cairo:178-206 - Skills address resolution logic is sound
Impact: The fallback logic properly handles per-token overrides vs registry defaults with zero-address checks

Cairo Idioms

[INFO] All contract_address_const::<0>() patterns correctly replaced with 0.try_into().unwrap()

  • Found 17 occurrences properly updated across test files and implementations
  • Follows current Cairo best practices for zero address creation

[INFO] Component integration follows established patterns

  • SkillsComponent properly mirrors RendererComponent architecture
  • SRC5 interface registration correctly implemented in initializer
  • Storage isolation via component pattern is correct

Testing Coverage

[HIGH] packages/embeddable_game_standard/src/token/extensions/skills/skills.cairo - Missing comprehensive test coverage
Impact: New SkillsComponent lacks dedicated test suite covering edge cases and security boundaries
Fix: Create comprehensive test file packages/embeddable_game_standard/src/token/tests/test_skills.cairo with:

  • Token ownership validation tests (should_panic for non-owners)
  • Batch operation boundary tests (empty arrays, max limits)
  • Event emission verification
  • SRC5 interface support verification
  • Integration with token component fallback logic

[MEDIUM] Test files updated but missing negative path coverage
Impact: No tests verify access control failures or invalid token ID handling in new skills functions
Fix: Add #[should_panic] tests for:

  • Resetting skills for tokens not owned by caller
  • Batch operations with oversized arrays
  • Skills operations on non-existent tokens

Gas Optimization

[LOW] packages/embeddable_game_standard/src/token/extensions/skills/skills.cairo:80-97 - Batch function performs redundant storage reads
Impact: get_skills_address_batch calls individual get_skills_address which adds function call overhead
Fix: Optimize by reading storage directly:

fn get_skills_address_batch(self: @ComponentState<TContractState>, token_ids: Span<felt252>) -> Array<ContractAddress> {
    let mut results = array![];
    let mut index = 0;
    loop {
        if index >= token_ids.len() { break; }
        let token_id = *token_ids.at(index);
        let addr = self.token_skills.entry(token_id).read(); // Direct storage read
        results.append(addr);
        index += 1;
    }
    results
}

[INFO] Storage packing in token_id remains efficient

  • Skills address stored separately from packed token metadata is appropriate
  • Per-token storage overhead is reasonable for the flexibility gained

Additional Findings

[INFO] Interface design follows SRC5 standards correctly

  • IMINIGAME_TOKEN_SKILLS_ID properly computed via src5_rs
  • Interface methods appropriately separated between read/write operations

[INFO] Event emission properly implemented

  • TokenSkillsUpdate event includes indexed token_id for efficient filtering
  • Events emitted in both direct component calls and trait implementations

[LOW] packages/interfaces/src/structs/registry.cairo - Skills address type consistency
Impact: GameMetadata struct updated correctly but documentation could clarify fallback behavior
Fix: Add documentation comment explaining skills_address = 0 means "use default/no skills"

Summary

3 MEDIUM, 3 LOW, 6 INFO findings identified. The refactor is architecturally sound and follows established patterns. Main concerns are missing test coverage for the new component and standard batch operation safety validations.


@github-actions
Copy link

github-actions bot commented Mar 3, 2026

Codex Review - Cairo/Starknet Contract Review

Review process failed to complete.

@starknetdev starknetdev merged commit 83bd433 into next Mar 3, 2026
20 of 26 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants