Skip to content

Create spec and security audit #1149

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ebma merged 94 commits into from
May 20, 2026
Merged

Create spec and security audit #1149

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
94 commits
Select commit Hold shift + click to select a range
e44f7cd
Create spec documents
ebma Apr 2, 2026
0183b6e
Perform audit
ebma Apr 2, 2026
e4824c0
Adjust typechain types for relayer contract
ebma Apr 2, 2026
78ef7d3
Amend audit
ebma Apr 2, 2026
c1a2b21
Merge branch 'staging' into create-spec-and-security-audit
ebma Apr 2, 2026
92af457
Implement audit fixes
ebma Apr 2, 2026
7f47678
Replace constants with config values
ebma Apr 7, 2026
0b9cfb3
Add to FINDINGS.md
ebma Apr 7, 2026
6d0c246
Rewrite FINDINGS.md
ebma Apr 7, 2026
ec74e26
Run x-ray on token-relayer
ebma Apr 7, 2026
efa3da1
Add SECURITY_AUDIT.md for relayer-contract
ebma Apr 7, 2026
70c0e7e
Remove extra fee column from QuoteTicket model
ebma Apr 7, 2026
c50d734
Start auditing of ramp engine details
ebma Apr 7, 2026
43808bc
Amend audit FINDINGS.md
ebma Apr 7, 2026
a141d4b
Add more findings for ramp-engine to security spec
ebma Apr 9, 2026
14ef118
Improve transaction validation
ebma Apr 10, 2026
ee6120a
Improve handler idempotency checks
ebma Apr 10, 2026
449071c
Don't allow sandbox in production
ebma Apr 10, 2026
51db58f
Add more post process/cleanup handlers
ebma Apr 10, 2026
a4d505b
Ensure only one ramp can be created for a quote
ebma Apr 10, 2026
631133b
Improve max amount validation in finalize engine
ebma Apr 10, 2026
531c7ed
Improve misc checks
ebma Apr 10, 2026
c7df1a7
Add to FINDINGS.md
ebma Apr 10, 2026
da44f75
Rewrite AUDIT-RESULTS.md
ebma Apr 13, 2026
f68a958
Merge branch 'speedy-brl-flow' into create-spec-and-security-audit
ebma May 8, 2026
6d9dd9a
Adjust type issues
ebma May 8, 2026
c0ac13a
Adjust the security spec
ebma May 8, 2026
aa41edc
Adjust the security spec to remove changelog style
ebma May 8, 2026
0bd2c44
Refactor funding account retrieval to use getEvmFundingAccount function
ebma May 11, 2026
8db720d
Add validation for BRL offramp metadata in AssetHub to BRL flow
ebma May 11, 2026
a23e547
Add MAX_EVM_SWAP_SUBSIDY_QUOTE_FRACTION and implement subsidy cap che…
ebma May 11, 2026
76cad3e
Add fallback for EVM payout address and enhance error handling for fe…
ebma May 11, 2026
8bb2446
Adjust security spec files
ebma May 11, 2026
859174c
WIP
ebma May 11, 2026
0dd180f
Enforce dual-track auth and ownership guards on ramp and quote routes
ebma May 12, 2026
e64a890
Add public-release readiness report
ebma May 12, 2026
5549da4
Add customizable max retries
ebma May 12, 2026
cbee977
Add base cleanup
ebma May 12, 2026
fa323e0
Move Sentry DSN to env var and broaden .env gitignore
ebma May 12, 2026
ccb1b12
Update security spec for dual-track auth, F-013 resolution, and Base …
ebma May 12, 2026
0120bb6
Add on-ramp and off-ramp phase transition mermaid diagrams
ebma May 12, 2026
0e315c6
Amend spec and architecture
ebma May 12, 2026
cd09bb5
Fix BRL on-ramp skipping subsidizePreSwapEvm phase
ebma May 12, 2026
d37e3e4
Merge branch 'staging' into create-spec-and-security-audit
ebma May 12, 2026
1498ee6
fix(api): enforce user quote ownership
ebma May 12, 2026
2f0d247
fix(api): validate signed presigned payloads
ebma May 12, 2026
0af9497
fix(api): preserve unrecoverable EVM subsidy caps
ebma May 12, 2026
f2b7ee5
docs(security): refresh fixed finding statuses
ebma May 12, 2026
0f4ea7b
fix(api): keep EVM subsidy caps recoverable
ebma May 12, 2026
2dc080c
fix(api): raise request body limit
ebma May 12, 2026
eb61e3d
docs(security): document BRL AssetHub disablement
ebma May 12, 2026
e971ea1
refactor(api): name ramp transaction preparation routes
ebma May 12, 2026
f4d323c
refactor(api): define quote routes as data
ebma May 12, 2026
99efcae
refactor(frontend): extract ramp machine helpers
ebma May 12, 2026
47b7cdc
fix(frontend): use bundler module resolution
ebma May 12, 2026
0169ca2
fix(shared): keep declarations within dist
ebma May 12, 2026
4cb059c
refactor(shared): drop *Evm variants from RampPhase union
ebma May 13, 2026
1b71402
refactor(api): unify *Evm phase handlers into polymorphic counterparts
ebma May 13, 2026
faefea6
refactor(frontend): drop *Evm progress phase entries
ebma May 13, 2026
fd48737
docs(security-spec): align phase names with polymorphic handlers
ebma May 13, 2026
124badf
fix(frontend): align BRL progress phase flows
ebma May 14, 2026
f0547de
test(api): cover Base polymorphic phase validation
ebma May 14, 2026
b2ca1b8
fix stuck createRamp call
gianfra-t May 15, 2026
d749b9f
fix pre-sign transactions validator
gianfra-t May 15, 2026
c98014f
Merge remote-tracking branch 'external-repo/staging' into create-spec…
gianfra-t May 15, 2026
c298549
APIDOG WIP
ebma May 16, 2026
85a9e1f
feat(docs): add API documentation for apidog and scripts to generate …
ebma May 18, 2026
9a2a00c
Move scripts
ebma May 18, 2026
64b3015
Refactor docs pages
ebma May 18, 2026
740e385
Refactor docs pages and add ai agent integration page
ebma May 18, 2026
aa0bdd2
validate content of pre-signed transactions
gianfra-t May 18, 2026
8f6132c
unify pre-signed transaction validation function, simplify test
gianfra-t May 18, 2026
0ff69bc
add more test coverage
gianfra-t May 18, 2026
a7ef755
cover backup evm transaction signed data as well
gianfra-t May 18, 2026
2dee89a
fix types issues
gianfra-t May 18, 2026
a0696ca
Revise page for widget integration
ebma May 19, 2026
e8e8dca
Fix broken links
ebma May 19, 2026
4e49e93
Amend sandbox page
ebma May 19, 2026
d6bf89f
Replace console with logger
ebma May 19, 2026
20bd31b
Enhance presigned transaction validation to support partial submissions
ebma May 19, 2026
b694c12
Add more improvements to transaction validation
ebma May 19, 2026
bcdc8c7
Rewrite spec of transaction-validation.md
ebma May 19, 2026
6cc4663
Create SKILLS.md
ebma May 19, 2026
1f544c9
Also validate minimum gas limit in transactions
ebma May 19, 2026
9bf1f33
Reject user-wallet presigned txs and verify SELL squid hashes on-chain
ebma May 19, 2026
d569c47
Fix typecheck error on tamperedDomain.verifyingContract
ebma May 19, 2026
c6812b1
Accept missing gas fee fields when minimum is zero
ebma May 19, 2026
8295402
Add support for AXLUSDC cleanup in Polygon and Base processes
ebma May 19, 2026
96e15c9
Fix sandbox wrongly enabled
ebma May 20, 2026
39debcc
Fix issue with gas not set properly in frontend signing
ebma May 20, 2026
d5cc629
Remove testing error
ebma May 20, 2026
69904d1
Fix review comments: remove unused vars, fix duplicate constant, wait…
Copilot May 20, 2026
8613105
Add support for optional SSL CA certificate in Sequelize configuration
ebma May 20, 2026
41caaf1
Revert secret key mnemonic change
ebma May 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 9 additions & 1 deletion .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,15 @@ node_modules
dist
dist-ssr
*.local
apps/api/.env

# Environment files (any package, any name)
**/.env
**/.env.local
**/.env.*.local
**/.env.development
**/.env.production
**/.env.staging
!**/.env.example

# Editor directories and files
.vscode/*
Expand Down
Loading
Loading