Expand DirectDemocracyVoting tests - #8
Merged
hudsonhrh merged 1 commit intoMay 20, 2025
Conversation
hudsonhrh
added a commit
that referenced
this pull request
Mar 1, 2026
This commit implements all 16 critical and high-severity security fixes identified in the comprehensive smart contract audit: **Access Control & Authorization:** - Fix #1: Add caller allowlist to UniversalAccountRegistry.registerAccountQuickJoin **Protocol Compliance & Math:** - Fix #2: Fix WebAuthn signCount bypass (prevent newSignCount=0 with active counter) - Fix #3: Change quorum threshold from > to >= for proper majority calculation - Fix #8: Update PackedUserOperation struct for ERC-4337 v0.7 compatibility (bytes32 gasFees) **Paymaster & Gas Economics:** - Fix #4: Fix solidarity tier dead code (make all tiers reachable, proper 4-tier structure) - Fix #5: Properly account for solidarity fees in org.spent tracking - Fix #6: Move onboarding counter increment to validation (bundle-safe) with decrement on failure (DoS-resistant) - Fix #9: Add uint128 overflow protection for safe casting - Fix #10: Validate dataOffset to prevent arbitrary calldata pointer manipulation **Financial Accounting:** - Fix #11: Track distribution over-commitment via totalCommitted mapping to prevent double-booking **Storage & Reentrancy:** - Fix #12: Move EligibilityModule reentrancy guard to ERC-7201 namespaced storage **Account Recovery & Credential Management:** - Fix #13: Deactivate all existing credentials before installing recovery credential - Fix #14: Prune pendingRecoveryIds array to prevent unbounded growth - Fix #15: Verify closing quote in WebAuthn type string to prevent partial match attacks **Governance & Ownership:** - Fix #16: Add ownership transfer cancellation to SwitchableBeacon - Fix #7: Add 2-day timelock to Executor.setCaller for governance takeover protection All 847 tests passing. Formatted with forge fmt. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
hudsonhrh
added a commit
that referenced
this pull request
Mar 1, 2026
This commit implements all 16 critical and high-severity security fixes identified in the comprehensive smart contract audit: **Access Control & Authorization:** - Fix #1: Add caller allowlist to UniversalAccountRegistry.registerAccountQuickJoin **Protocol Compliance & Math:** - Fix #2: Fix WebAuthn signCount bypass (prevent newSignCount=0 with active counter) - Fix #3: Change quorum threshold from > to >= for proper majority calculation - Fix #8: Update PackedUserOperation struct for ERC-4337 v0.7 compatibility (bytes32 gasFees) **Paymaster & Gas Economics:** - Fix #4: Fix solidarity tier dead code (make all tiers reachable, proper 4-tier structure) - Fix #5: Properly account for solidarity fees in org.spent tracking - Fix #6: Move onboarding counter increment to validation (bundle-safe) with decrement on failure (DoS-resistant) - Fix #9: Add uint128 overflow protection for safe casting - Fix #10: Validate dataOffset to prevent arbitrary calldata pointer manipulation **Financial Accounting:** - Fix #11: Track distribution over-commitment via totalCommitted mapping to prevent double-booking **Storage & Reentrancy:** - Fix #12: Move EligibilityModule reentrancy guard to ERC-7201 namespaced storage **Account Recovery & Credential Management:** - Fix #13: Deactivate all existing credentials before installing recovery credential - Fix #14: Prune pendingRecoveryIds array to prevent unbounded growth - Fix #15: Verify closing quote in WebAuthn type string to prevent partial match attacks **Governance & Ownership:** - Fix #16: Add ownership transfer cancellation to SwitchableBeacon - Fix #7: Add 2-day timelock to Executor.setCaller for governance takeover protection All 847 tests passing. Formatted with forge fmt. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
hudsonhrh
added a commit
that referenced
this pull request
Mar 1, 2026
…date During rebase, the test file was incorrectly resolved with our branch's version (which still referenced removed registerOrgWithVoucher). Restored base branch version and applied gasFees field migration (Fix #8). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
hudsonhrh
added a commit
that referenced
this pull request
Mar 1, 2026
…ng (#96) * fix: Implement all 16 security audit fixes with comprehensive hardening This commit implements all 16 critical and high-severity security fixes identified in the comprehensive smart contract audit: **Access Control & Authorization:** - Fix #1: Add caller allowlist to UniversalAccountRegistry.registerAccountQuickJoin **Protocol Compliance & Math:** - Fix #2: Fix WebAuthn signCount bypass (prevent newSignCount=0 with active counter) - Fix #3: Change quorum threshold from > to >= for proper majority calculation - Fix #8: Update PackedUserOperation struct for ERC-4337 v0.7 compatibility (bytes32 gasFees) **Paymaster & Gas Economics:** - Fix #4: Fix solidarity tier dead code (make all tiers reachable, proper 4-tier structure) - Fix #5: Properly account for solidarity fees in org.spent tracking - Fix #6: Move onboarding counter increment to validation (bundle-safe) with decrement on failure (DoS-resistant) - Fix #9: Add uint128 overflow protection for safe casting - Fix #10: Validate dataOffset to prevent arbitrary calldata pointer manipulation **Financial Accounting:** - Fix #11: Track distribution over-commitment via totalCommitted mapping to prevent double-booking **Storage & Reentrancy:** - Fix #12: Move EligibilityModule reentrancy guard to ERC-7201 namespaced storage **Account Recovery & Credential Management:** - Fix #13: Deactivate all existing credentials before installing recovery credential - Fix #14: Prune pendingRecoveryIds array to prevent unbounded growth - Fix #15: Verify closing quote in WebAuthn type string to prevent partial match attacks **Governance & Ownership:** - Fix #16: Add ownership transfer cancellation to SwitchableBeacon - Fix #7: Add 2-day timelock to Executor.setCaller for governance takeover protection All 847 tests passing. Formatted with forge fmt. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * test: Restore valid recovery edge case tests Restore 4 tests that were incorrectly removed during the bulk test cleanup for Fix #13. These tests cover behaviors that are still valid after the recovery-deactivates-all-credentials change: - testCompleteCancelledRecovery_Reverts - testRecoveryNonExistentRecoveryId_Reverts - testInitiateRecoveryForExistingCredential_Reverts - testRecoveryCredentialArrayIntegrity (updated assertions for new behavior) 851 tests passing. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * test: Add missing coverage for security audit fixes New tests covering gaps identified in post-audit coverage review: - UAR: unauthorized caller rejected, authorized succeeds, deauthorize, batch onlyOwner - VotingMath: exact quorum boundary now passes with >= fix - Executor: timelock-not-expired revert, cancel clears pending, unauthorized proposer, zero address - PaymentManager: over-commitment rejected, finalize frees committed for reuse - PaymasterHub: uint128 overflow reverts on depositForOrg and donateToSolidarity 865 tests passing. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: Use base branch PasskeyPaymasterIntegration test with gasFees update During rebase, the test file was incorrectly resolved with our branch's version (which still referenced removed registerOrgWithVoucher). Restored base branch version and applied gasFees field migration (Fix #8). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com>
hudsonhrh
added a commit
that referenced
this pull request
Mar 1, 2026
* feat: Add direct metadata editing for org admins - Add updateOrgMetaAsAdmin function for admin hat wearers to edit metadata directly - Add setOrgAdminHat/getOrgAdminHat to configure per-org admin hats - Add setHatsProtocol/getHatsProtocol for Hats Protocol integration - Falls back to topHat if no admin hat is configured - Add IHats interface for checking hat wearers - Add NotOrgAdmin custom error - Add OrgAdminHatSet and HatsProtocolSet events This enables org admins (topHat or configured admin hat wearers) to update organization metadata (name, description, logo, links) without going through the governance proposal flow. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix: Rename IHats to IHatsMinimal to avoid collision The hats-protocol library already defines an IHats interface in lib/hats-protocol/src/Interfaces/IHats.sol. When OrgRegistry.sol is imported alongside files that import the full IHats, the compiler throws an "Identifier already declared" error. Renamed our minimal interface to IHatsMinimal to avoid the collision. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * refactor: Import IHats from hats-protocol instead of defining minimal interface Removes the custom IHatsMinimal interface and imports the actual IHats interface from the hats-protocol library. This is the proper approach: - Reuses the existing, well-tested interface - Follows the pattern used elsewhere in the codebase - Avoids interface duplication and potential inconsistencies Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * refactor: Simplify metadata admin feature - Remove setHatsProtocol/getHatsProtocol - hats address passed as param instead - Rename to OrgMetadataAdmin to clarify scope (metadata editing only, not full admin) - metadataAdminHatOf is optional - if 0, falls back to topHat - Cleaner interface: no global state, explicit hats address per call Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * refactor: Store hats address in OrgRegistry instead of passing as parameter Security fix: Previously updateOrgMetaAsAdmin took hats address as a parameter which could allow malicious callers to pass a fake contract. Now the hats address is stored in contract storage and set via initialize. Changes: - Add IHats hats to Layout storage struct - Add hats parameter to initialize() function - Add getHats() view function - Remove hats parameter from updateOrgMetaAsAdmin (now uses stored address) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * test: Add comprehensive tests for metadata admin functionality Tests cover: - updateOrgMetaAsAdmin with topHat (fallback) - updateOrgMetaAsAdmin with custom admin hat - updateOrgMetaAsAdmin reverts for non-hat wearers - updateOrgMetaAsAdmin reverts when no hats configured - updateOrgMetaAsAdmin reverts for unknown org - setOrgMetadataAdminHat by executor - setOrgMetadataAdminHat reverts for non-executor - setOrgMetadataAdminHat can reset to zero - getOrgMetadataAdminHat returns zero by default - Custom admin hat takes precedence over topHat - getHats returns correct address Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix: Use standard hyphen in SPDX license identifier Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix: Update DeployerTest to use new initialize signature with hats address Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix: emit ProjectCreated event before configuration events Fix event ordering in TaskManager._createProjectInternal to emit ProjectCreated before ProjectManagerUpdated and ProjectRolePermSet events. This ensures subgraph indexing can properly create the Project entity before receiving configuration events. Fixes #84 Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * feat: Implement four SwitchableBeacon upgrades and add task/role application systems (#86) ## Changes ### Fix 5: Emit MirrorSet event in constructor - Added MirrorSet event emission when SwitchableBeacon initializes in Mirror mode - Tests verify constructor emits event correctly for both modes ### Fix 2: Implement two-step ownership (Ownable2Step) - SwitchableBeacon: Added pendingOwner state, OwnershipTransferStarted event, acceptOwnership() - Executor: Added acceptBeaconOwnership() helper for deployment flow - GovernanceFactory: Added execBeacon to GovernanceResult, initiates transfer - OrgDeployer: Accepts executor beacon ownership after deployment - Comprehensive test coverage for all two-step scenarios ### Fix 1: Transfer eligibility/toggle beacon ownership to Executor - GovernanceFactory: Pass result.executor as beaconOwner to _deployEligibilityModule and _deployToggleModule - Eligibility/toggle beacons now owned by executor from creation (no transfer needed) - Added 3 tests verifying all module beacons owned by executor after deployment ### Fix 3: Remove setAutoUpgrade from OrgRegistry - Removed setAutoUpgrade() function and AutoUpgradeSet event - autoUpgrade now immutable (set at deployment, read-only thereafter) ### Earlier improvements (from prior context) - TaskManager: Added rejectTask(), TaskApplicationSubmitted, TaskApplicationApproved events - EligibilityModule: Added applyForRole(), withdrawApplication() with application system - Comprehensive tests for task rejection and role application flows All 627 tests pass. Code formatted with forge fmt. Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> * feat: Implement 11 security fixes and add comprehensive test coverage (#87) - Fix 1: Add replay protection to announceWinner in voting contracts - Fix 2: Enforce strict access control for Executor.setCaller - Fix 3: Restrict OrgDeployer.setUniversalPasskeyFactory to poaManager - Fix 4: Add access control to PaymasterHub.registerOrgWithVoucher - Fix 5: Fix PaymasterHub._checkOrgBalance underflow logic - Fix 6: Move bounty totalPaid increment to post-transfer in PaymasterHub - Fix 7: Add nonReentrant guard and fix CEI violation in claimVouchedHat - Fix 8: Remove unsafe dailyVouchCount decrement in vouch revocation - Fix 9: Add configurable SELF_REVIEW permission for task self-approval - Fix 10: Salt answer hashes with module ID to prevent brute-force - Fix 11: Validate zero public keys and max credentials in PasskeyAccount Added 19 comprehensive tests across 7 test files covering all security fixes. All 646 tests pass with zero failures. Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> * feat: Add solidarity fund distribution pause/unpause mechanism (#88) Enable fee collection without distribution: PaymasterHub now supports pausing solidarity fund distribution to allow fee accumulation before enabling the tier matching and grace period systems. When paused, organizations must fund 100% of transactions from their own deposits while 1% fees still accumulate in the solidarity fund. Key changes: - Add distributionPaused boolean flag to SolidarityFund struct - Implement pauseSolidarityDistribution() and unpauseSolidarityDistribution() (PoaManager only) - Update _checkSolidarityAccess, _updateOrgFinancials, and _checkOrgBalance to respect paused state - Block POA onboarding when distribution is paused - Fix getOrgGraceStatus to return accurate values (solidarity=0) when paused - Add idempotency guards to pause/unpause functions (no-op when already in that state) Tests: - 16 new tests covering initialization, access control, state transitions, idempotency, and view function behavior when paused - All 643 existing tests passing Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> * fix: Add upgrade safety hardening and comprehensive tests (#89) * fix: Add _disableInitializers() to 12 contracts and comprehensive upgrade safety tests - Added _disableInitializers() constructor to 8 contracts with no constructor (Executor, ParticipationToken, TaskManager, QuickJoin, EducationHub, PaymentManager, UniversalAccountRegistry, ImplementationRegistry) preventing re-initialization attacks on implementation contracts - Replaced weak constructor() initializer {} pattern in 4 contracts (HybridVoting, DirectDemocracyVoting, OrgRegistry, OrgDeployer) with _disableInitializers() for stronger initialization guards - Added implementation validation to PoaManager.upgradeBeacon() and addContractType() to reject EOA addresses - Added implementation validation to PaymasterHub._authorizeUpgrade() to prevent UUPS upgrades to invalid addresses - Removed misleading __gap[50] from PaymasterHub (unnecessary with ERC-7201 namespaced storage) - Fixed 8 test files to use BeaconProxy pattern instead of direct initialization of implementation contracts - Created UpgradeSafety.t.sol with 24 comprehensive tests covering re-initialization prevention, upgrade authorization, storage preservation, and SwitchableBeacon mode-switching safety - Created UpgradeEdgeCases.t.sol with 10 production-scenario tests covering full upgrade chains, multi-tenant isolation, mode cycling, sequential upgrades, and ownership transfer flows - All 696 tests pass with zero failures Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: Update 9 test files to use proxy pattern for initialization Tests were directly calling initialize() on implementation contracts, which now revert due to _disableInitializers(). Wrapped all test setups in UpgradeableBeacon + BeaconProxy before calling initialize(). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> * fix: Implement 6 security fixes for PaymasterHub and TaskManager (#90) * fix: Implement 6 security fixes for PaymasterHub and TaskManager Address critical and high-severity audit findings: - Fix onboarding path abuse by restricting to pure account creation - Replace sentinel-based detection with explicit isOnboarding flag in context - Bind vouch signatures to operation intent (initCode, callData) + paymaster address - Defer vouch consumption to postOp and gate on success to prevent griefing - Add solidarity fund liquidity checks and fix deposit accounting - Fix permission hat tracking in TaskManager with reference counting to prevent removal bugs All changes include comprehensive test coverage and are backwards compatible. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * refactor: Merge security tests into existing test suites Dissolve AuditCriticalHighValidation.t.sol into the proper test files: - 7 PaymasterHub tests → PaymasterHubSolidarity.t.sol (with helpers) - 2 TaskManager tests → TaskManager.t.sol (using existing base class) Tests use existing mock infrastructure and naming conventions. No duplicate mocks, no temporal "audit" naming. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: Clean up permission ref counts on project deletion deleteProject now decrements projectPermHatRefCount for all hats that had project-specific permissions, and removes them from permissionHatIds if they have no remaining permissions elsewhere. Prevents stale entries from accumulating in the tracking array over the contract's lifetime. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> * fix: Resolve 4 validated bugs with comprehensive test coverage (#91) Fix medium-severity solidarity grace model inconsistency (PaymasterHub _checkOrgBalance now grace-period-aware so zero-deposit orgs can use solidarity), passkey duplicate credential bug in recovery (added re-check in completeRecovery), and PaymentManager over-claim vulnerability (added cap enforcement). Fix low-severity deployment initializer mismatch (aligned ModuleDeploymentLib interface with actual 4-arg initializer). Add 35 new tests (705→740 total): harness-based balance check tests with fuzz (20), passkey recovery edge cases (9), payment manager boundary and fuzz tests (7), plus 9 earlier tests. All 740 tests pass. Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> * feat: Cross-chain beacon upgrade propagation (#92) * feat: Add cross-chain beacon upgrade propagation system Implements automatic upgrade propagation from home chain to satellite chains using Hyperlane messaging. Key components: - DeterministicDeployer: CREATE3-based contract deployment for same-address deploys across chains - PoaManagerHub: Home-chain wrapper that dispatches upgrades to satellites - PoaManagerSatellite: Remote-chain receiver that applies upgrades locally - Comprehensive test suite with unit and end-to-end integration tests All 34 new tests pass. Existing PoaManager, SwitchableBeacon, and per-org contracts remain unchanged. Only beacon upgrade propagation added—UniversalAccountRegistry and PaymasterHub stay per-chain. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * test: Harden cross-chain test suite with comprehensive coverage Add 31 new tests covering: - Constructor/input validation (zero addresses) - Access control for all owner-only functions - Event emission verification - Edge cases (no satellites, same impl, unknown type, pause/unpause toggle) - Integration: removed satellite exclusion, emergency direct upgrade, dynamic registration, multiple independent types, mixed pin/mirror, full E2E proxies on all chains Total: 65 cross-chain tests, 761 full suite (0 failures). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: Add input validation, ETH rescue, and edge case tests Source fixes: - Add zero-address validation to PoaManagerSatellite constructor (poaManager, mailbox, hubAddress) - Add withdrawETH() to PoaManagerHub for recovering stuck ETH New tests: - Satellite constructor rejects zero poaManager/mailbox/hubAddress - Hub withdrawETH rescues stuck funds, rejects zero address, non-owner - Hub withdrawETH with zero balance is a no-op - Duplicate satellite registration causes duplicate dispatches (documented) Total: 73 cross-chain tests, 769 full suite (0 failures). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat: Add E2E testnet cross-chain testing and fix bugs found during live test Add orchestrated E2E test script that deploys minimal cross-chain infrastructure on Sepolia + Base Sepolia and verifies beacon upgrades propagate via Hyperlane. Bugs fixed during live testnet run: - DeterministicDeployer: Ownable(msg.sender) set owner to CREATE2 factory instead of deployer EOA; changed to explicit constructor param - PoaManagerHub: mailbox.dispatch() requires protocol fee; added msg.value forwarding split across active satellites - DeployDeterministicDeployer: added idempotency check (skip if already deployed) New files: - script/testnet-e2e.sh: Bash orchestrator for full E2E flow - script/e2e/TestnetE2EHomeChain.s.sol: Minimal home chain deployment - script/e2e/TestnetE2ESatellite.s.sol: Minimal satellite deployment - script/e2e/RegisterSatellite.s.sol: Register satellite on Hub - script/e2e/DeployV2AndUpgrade.s.sol: Deploy V2 + trigger upgrade - script/e2e/VerifyUpgrade.s.sol: Polling verification script Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * test: Add governance-driven cross-chain upgrade integration test Verifies the full ownership chain: HybridVoting → Executor → Hub → PoaManager, with Hyperlane propagation to satellite. Tests vote-pass upgrades both chains, tied votes leave beacons unchanged, and direct Hub calls from non-owners revert. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: Add upgrade safety hardening and comprehensive tests - DeterministicDeployer: replace string revert with custom CannotRenounce error - PoaManagerHub: fix _refundExcess to only refund caller's overpayment (not sweep pre-existing balance), add transferPoaManagerOwnership escape hatch, block renounceOwnership, use TransferFailed custom error - PoaManagerSatellite: reorder handle() to check auth before pause (prevents info leak), block renounceOwnership, add CannotRenounce error - Scripts: add payable() casts for Hub address (required by receive()) - Tests: fix 14 bare vm.expectRevert() to use specific OwnableUnauthorizedAccount selectors, add 25 new tests covering ETH refund preservation, ownership transfer, renounce blocking, auth ordering, and edge cases (794 total) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat: Add MainDeploy.s.sol for complete cross-chain deployment (#93) * feat: Add MainDeploy.s.sol orchestrating full cross-chain protocol deployment Implements complete deployment automation for the Poa governance protocol across home and satellite chains. Includes four entry points: DeployHomeChain (infrastructure + governance org + hub), DeploySatellite (satellite infrastructure), RegisterAndTransfer (register satellites and wire governance), and VerifyDeployment (read-only ownership verification). The governance org is hardcoded with two roles: MEMBER (requires vouching from CONTRIBUTOR) and CONTRIBUTOR (deployer gets this, can create tasks/projects/approve). Hybrid voting with 60% participation (DIRECT) + 40% membership (ERC20_BAL with quadratic). Updated foundry.toml fs_permissions to allow reading/writing state JSON files in ./script/. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: Use explicit Hyperlane domain ID instead of block.chainid for hub block.chainid is not guaranteed to equal the Hyperlane domain ID. On chains where they differ, PoaManagerSatellite would reject all messages from the hub with UnauthorizedOrigin. This adds a HUB_DOMAIN env var consistent with how SATELLITE_DOMAIN is already handled. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * chore: Add cross-chain deployment vars to .env.example Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * chore: Fill .env.example with Arbitrum home chain config Pre-populate mailbox addresses, domain IDs, and satellite registration for Arbitrum (home) + Ethereum/Optimism/Gnosis (satellites). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat: Add deploy.sh orchestrating full cross-chain deployment Single command to deploy across Arbitrum (home) + Ethereum, Optimism, Gnosis (satellites). Includes pre-flight checks (RPC connectivity, wallet balances), confirmation prompt, per-step resumability (--step N --satellite N), dry-run mode, and Etherscan verification support. Also adds gnosis RPC endpoint to foundry.toml. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: Skip unnecessary pre-flight checks for read-only steps --step summary now runs without needing PRIVATE_KEY or RPC access. --step 4 only checks home chain RPC (no wallet balance checks or build). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> * fix: Critical deployment bugs and security hardening Fixes 3 critical bugs in MainDeploy.s.sol and deploy.sh that would cause deployment revert: - C-1: Fix OrgRegistry.initialize signature (now accepts 2 params) - C-2: Route setUniversalPasskeyFactory through PM.adminCall pattern - C-3: Set PaymasterHub.orgRegistrar before governance org deploy Adds adminCall delegation mechanism to PoaManager, PoaManagerHub, and PoaManagerSatellite: - Lets contract owner invoke admin functions on sub-contracts that gate on msg.sender == poaManager - Same pattern as OZ Governor.relay() and TimelockController.execute() - Enables post-deployment governance control over admin functions Security & robustness fixes to deploy.sh: - H-3: Private key piped through stdin (avoid ps aux exposure) - H-4: Fixed json_get Python injection vulnerability - H-5: Added idempotency guards with confirmation prompts - M-3: Prevent .env from overriding chain-specific variables - M-4: Added timestamped deployment log file - M-5: Added state files to .gitignore Additional improvements: - M-1: Added existence checks for hardcoded external contracts (Hats, EntryPoint) - M-7: Enhanced state JSON with factory addresses (governanceFactory, accessFactory, modulesFactory, hatsTreeSetup) - M-6: Enhanced VerifyDeployment contract with additional checks Tests: - Added 7 comprehensive tests for adminCall on PoaManager, Hub, and Satellite - All 801 tests pass (794 existing + 7 new) - Code formatted with forge fmt Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * fix: Cross-chain script bugs and satellite registration safety - CrossChainUpgrade.s.sol: Add HYPERLANE_FEE env var so TriggerUpgrade sends ETH for Hyperlane protocol fees (was sending 0, fails on mainnet) - DeploySatelliteInfrastructure.s.sol: Replace msg.sender with vm.addr(deployerKey) for correct proxy initialization ownership - DeployInfrastructure.s.sol: Fix same msg.sender bug (3 instances), OrgRegistry 2-param init, route setUniversalPasskeyFactory and setOrgRegistrar through PM.adminCall - PoaManagerHub: Add DuplicateDomain guard to registerSatellite, only blocks active duplicates (re-register after remove still works) - MainDeploy.s.sol RegisterAndTransfer: Skip already-registered domains for idempotent re-runs after partial failures Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * refactor: Consolidate deployment scripts and simplify JSON handling - Extract 13 app contract types into shared DeployHelper base contract (single source of truth, eliminates ~6x duplication) - Replace manual string.concat JSON building with vm.serializeJson - Replace python3 JSON parsing with jq in deploy.sh and testnet-e2e.sh Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> * refactor: Replace precomputed keccak256 hashes with inline computation (#94) Replace all storage slot hex constants with inline keccak256("namespace") calls so the compiler verifies hash correctness at compile time. Update ModuleTypes constants and PaymasterHub storage locations. Modify all _layout() functions to load constants into stack variables before assembly to work around Solidity's inline assembly restrictions. - 16 contracts: storage slots now computed inline via keccak256 - 3 shared libraries: synchronized with parent contracts - PaymasterHub: 11 storage locations updated (8 ERC-7201, 2 simple, 1 main) - ModuleTypes: 13 module type IDs now inline - All _layout() functions adapted for assembly compatibility Tests: 862 passing, build clean, formatting applied. Note: 6 storage slots changed values (old hex was incorrect). If contracts are deployed behind proxies, this requires migration handling. PaymasterHub ERC-7201 slots remain unchanged (verified). ModuleTypes.PAYMASTER_HUB_ID now matches actual keccak256("PaymasterHub"). Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> * feat: Replace ECDSA vouch path with EligibilityModule-based onboarding (#95) Replace the PaymasterHub's ECDSA-signature-based vouching system (SUBJECT_TYPE_VOUCHED, 0x02) with the existing EligibilityModule's on-chain vouchFor() system. Change SUBJECT_TYPE_HAT validation from isWearerOfHat to isEligible so vouched-but-not-yet-hatted users can be sponsored, and add hat active status check to preserve the security property that deactivated hats cannot be used for sponsorship. Remove all dead code related to the old ECDSA vouch path including ECDSA/MessageHashUtils imports, 5 vouch-specific errors, SUBJECT_TYPE_VOUCHED constant, vouch-related events/storage, registerOrgWithVoucher function, setVoucherHat setter, isVouchUsed view function, and _validateVouchedEligibility implementation. Deprecate voucherHatId in OrgConfig struct for storage layout compatibility (rename to __deprecated_voucherHatId). Simplify validatePaymasterUserOp and postOp: remove vouchedAccount/voucherSigner variables, remove SUBJECT_TYPE_VOUCHED branch, change context encoding from 9 fields to 7 fields. Add robust tests verifying hat eligibility, deactivation blocking, and reactivation behavior. Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> * fix: Implement all 16 security audit fixes with comprehensive hardening (#96) * fix: Implement all 16 security audit fixes with comprehensive hardening This commit implements all 16 critical and high-severity security fixes identified in the comprehensive smart contract audit: **Access Control & Authorization:** - Fix #1: Add caller allowlist to UniversalAccountRegistry.registerAccountQuickJoin **Protocol Compliance & Math:** - Fix #2: Fix WebAuthn signCount bypass (prevent newSignCount=0 with active counter) - Fix #3: Change quorum threshold from > to >= for proper majority calculation - Fix #8: Update PackedUserOperation struct for ERC-4337 v0.7 compatibility (bytes32 gasFees) **Paymaster & Gas Economics:** - Fix #4: Fix solidarity tier dead code (make all tiers reachable, proper 4-tier structure) - Fix #5: Properly account for solidarity fees in org.spent tracking - Fix #6: Move onboarding counter increment to validation (bundle-safe) with decrement on failure (DoS-resistant) - Fix #9: Add uint128 overflow protection for safe casting - Fix #10: Validate dataOffset to prevent arbitrary calldata pointer manipulation **Financial Accounting:** - Fix #11: Track distribution over-commitment via totalCommitted mapping to prevent double-booking **Storage & Reentrancy:** - Fix #12: Move EligibilityModule reentrancy guard to ERC-7201 namespaced storage **Account Recovery & Credential Management:** - Fix #13: Deactivate all existing credentials before installing recovery credential - Fix #14: Prune pendingRecoveryIds array to prevent unbounded growth - Fix #15: Verify closing quote in WebAuthn type string to prevent partial match attacks **Governance & Ownership:** - Fix #16: Add ownership transfer cancellation to SwitchableBeacon - Fix #7: Add 2-day timelock to Executor.setCaller for governance takeover protection All 847 tests passing. Formatted with forge fmt. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * test: Restore valid recovery edge case tests Restore 4 tests that were incorrectly removed during the bulk test cleanup for Fix #13. These tests cover behaviors that are still valid after the recovery-deactivates-all-credentials change: - testCompleteCancelledRecovery_Reverts - testRecoveryNonExistentRecoveryId_Reverts - testInitiateRecoveryForExistingCredential_Reverts - testRecoveryCredentialArrayIntegrity (updated assertions for new behavior) 851 tests passing. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * test: Add missing coverage for security audit fixes New tests covering gaps identified in post-audit coverage review: - UAR: unauthorized caller rejected, authorized succeeds, deauthorize, batch onlyOwner - VotingMath: exact quorum boundary now passes with >= fix - Executor: timelock-not-expired revert, cancel clears pending, unauthorized proposer, zero address - PaymentManager: over-commitment rejected, finalize frees committed for reuse - PaymasterHub: uint128 overflow reverts on depositForOrg and donateToSolidarity 865 tests passing. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: Use base branch PasskeyPaymasterIntegration test with gasFees update During rebase, the test file was incorrectly resolved with our branch's version (which still referenced removed registerOrgWithVoucher). Restored base branch version and applied gasFees field migration (Fix #8). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> * feat: Upgrade etherform workflow to main with slither and coverage (#97) * feat: Upgrade etherform workflow to main with slither and coverage Update the reusable workflow reference to the latest etherform main commit (214cc6e), enabling: - Slither static analysis with high severity threshold - Forge coverage reports with sticky PR comments - Automatic change detection to skip CI when no contracts change Remove deployment-foundry-profile input (no longer supported on main). Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * test: Add comment to trigger CI pipeline Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * revert: Remove CI test comment Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: Use comma-separated string for slither filter_paths Slither's parse_filter_paths expects a string, not a JSON array. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * test: Add comment to trigger CI Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: Exclude arbitrary-send-eth false positive from slither The _processBounty function intentionally sends ETH to bundler origins as part of the ERC-4337 bounty incentive system. This is by design. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> * refactor: Remove delegated username registration from QuickJoin Users now register usernames directly via UniversalAccountRegistry.registerAccount() using msg.sender, eliminating the need for authorizedCallers whitelisting. Smart account users can batch quickJoin + registerAccount in a single UserOp via executeBatch. - Remove registerAccountQuickJoin, authorizedCallers, setAuthorizedCaller from UniversalAccountRegistry - Remove username params from all QuickJoin join functions - Remove username registration block from HatsTreeSetup - Update all tests and scripts to match new signatures Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
hudsonhrh
added a commit
that referenced
this pull request
May 1, 2026
…ce-test-coverage-for-directdemocracyvoting
hudsonhrh
added a commit
that referenced
this pull request
May 1, 2026
* feat: Add direct metadata editing for org admins - Add updateOrgMetaAsAdmin function for admin hat wearers to edit metadata directly - Add setOrgAdminHat/getOrgAdminHat to configure per-org admin hats - Add setHatsProtocol/getHatsProtocol for Hats Protocol integration - Falls back to topHat if no admin hat is configured - Add IHats interface for checking hat wearers - Add NotOrgAdmin custom error - Add OrgAdminHatSet and HatsProtocolSet events This enables org admins (topHat or configured admin hat wearers) to update organization metadata (name, description, logo, links) without going through the governance proposal flow. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix: Rename IHats to IHatsMinimal to avoid collision The hats-protocol library already defines an IHats interface in lib/hats-protocol/src/Interfaces/IHats.sol. When OrgRegistry.sol is imported alongside files that import the full IHats, the compiler throws an "Identifier already declared" error. Renamed our minimal interface to IHatsMinimal to avoid the collision. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * refactor: Import IHats from hats-protocol instead of defining minimal interface Removes the custom IHatsMinimal interface and imports the actual IHats interface from the hats-protocol library. This is the proper approach: - Reuses the existing, well-tested interface - Follows the pattern used elsewhere in the codebase - Avoids interface duplication and potential inconsistencies Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * refactor: Simplify metadata admin feature - Remove setHatsProtocol/getHatsProtocol - hats address passed as param instead - Rename to OrgMetadataAdmin to clarify scope (metadata editing only, not full admin) - metadataAdminHatOf is optional - if 0, falls back to topHat - Cleaner interface: no global state, explicit hats address per call Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * refactor: Store hats address in OrgRegistry instead of passing as parameter Security fix: Previously updateOrgMetaAsAdmin took hats address as a parameter which could allow malicious callers to pass a fake contract. Now the hats address is stored in contract storage and set via initialize. Changes: - Add IHats hats to Layout storage struct - Add hats parameter to initialize() function - Add getHats() view function - Remove hats parameter from updateOrgMetaAsAdmin (now uses stored address) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * test: Add comprehensive tests for metadata admin functionality Tests cover: - updateOrgMetaAsAdmin with topHat (fallback) - updateOrgMetaAsAdmin with custom admin hat - updateOrgMetaAsAdmin reverts for non-hat wearers - updateOrgMetaAsAdmin reverts when no hats configured - updateOrgMetaAsAdmin reverts for unknown org - setOrgMetadataAdminHat by executor - setOrgMetadataAdminHat reverts for non-executor - setOrgMetadataAdminHat can reset to zero - getOrgMetadataAdminHat returns zero by default - Custom admin hat takes precedence over topHat - getHats returns correct address Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix: Use standard hyphen in SPDX license identifier Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix: Update DeployerTest to use new initialize signature with hats address Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix: emit ProjectCreated event before configuration events Fix event ordering in TaskManager._createProjectInternal to emit ProjectCreated before ProjectManagerUpdated and ProjectRolePermSet events. This ensures subgraph indexing can properly create the Project entity before receiving configuration events. Fixes #84 Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * feat: Implement four SwitchableBeacon upgrades and add task/role application systems (#86) ## Changes ### Fix 5: Emit MirrorSet event in constructor - Added MirrorSet event emission when SwitchableBeacon initializes in Mirror mode - Tests verify constructor emits event correctly for both modes ### Fix 2: Implement two-step ownership (Ownable2Step) - SwitchableBeacon: Added pendingOwner state, OwnershipTransferStarted event, acceptOwnership() - Executor: Added acceptBeaconOwnership() helper for deployment flow - GovernanceFactory: Added execBeacon to GovernanceResult, initiates transfer - OrgDeployer: Accepts executor beacon ownership after deployment - Comprehensive test coverage for all two-step scenarios ### Fix 1: Transfer eligibility/toggle beacon ownership to Executor - GovernanceFactory: Pass result.executor as beaconOwner to _deployEligibilityModule and _deployToggleModule - Eligibility/toggle beacons now owned by executor from creation (no transfer needed) - Added 3 tests verifying all module beacons owned by executor after deployment ### Fix 3: Remove setAutoUpgrade from OrgRegistry - Removed setAutoUpgrade() function and AutoUpgradeSet event - autoUpgrade now immutable (set at deployment, read-only thereafter) ### Earlier improvements (from prior context) - TaskManager: Added rejectTask(), TaskApplicationSubmitted, TaskApplicationApproved events - EligibilityModule: Added applyForRole(), withdrawApplication() with application system - Comprehensive tests for task rejection and role application flows All 627 tests pass. Code formatted with forge fmt. Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> * feat: Implement 11 security fixes and add comprehensive test coverage (#87) - Fix 1: Add replay protection to announceWinner in voting contracts - Fix 2: Enforce strict access control for Executor.setCaller - Fix 3: Restrict OrgDeployer.setUniversalPasskeyFactory to poaManager - Fix 4: Add access control to PaymasterHub.registerOrgWithVoucher - Fix 5: Fix PaymasterHub._checkOrgBalance underflow logic - Fix 6: Move bounty totalPaid increment to post-transfer in PaymasterHub - Fix 7: Add nonReentrant guard and fix CEI violation in claimVouchedHat - Fix 8: Remove unsafe dailyVouchCount decrement in vouch revocation - Fix 9: Add configurable SELF_REVIEW permission for task self-approval - Fix 10: Salt answer hashes with module ID to prevent brute-force - Fix 11: Validate zero public keys and max credentials in PasskeyAccount Added 19 comprehensive tests across 7 test files covering all security fixes. All 646 tests pass with zero failures. Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> * feat: Add solidarity fund distribution pause/unpause mechanism (#88) Enable fee collection without distribution: PaymasterHub now supports pausing solidarity fund distribution to allow fee accumulation before enabling the tier matching and grace period systems. When paused, organizations must fund 100% of transactions from their own deposits while 1% fees still accumulate in the solidarity fund. Key changes: - Add distributionPaused boolean flag to SolidarityFund struct - Implement pauseSolidarityDistribution() and unpauseSolidarityDistribution() (PoaManager only) - Update _checkSolidarityAccess, _updateOrgFinancials, and _checkOrgBalance to respect paused state - Block POA onboarding when distribution is paused - Fix getOrgGraceStatus to return accurate values (solidarity=0) when paused - Add idempotency guards to pause/unpause functions (no-op when already in that state) Tests: - 16 new tests covering initialization, access control, state transitions, idempotency, and view function behavior when paused - All 643 existing tests passing Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> * fix: Add upgrade safety hardening and comprehensive tests (#89) * fix: Add _disableInitializers() to 12 contracts and comprehensive upgrade safety tests - Added _disableInitializers() constructor to 8 contracts with no constructor (Executor, ParticipationToken, TaskManager, QuickJoin, EducationHub, PaymentManager, UniversalAccountRegistry, ImplementationRegistry) preventing re-initialization attacks on implementation contracts - Replaced weak constructor() initializer {} pattern in 4 contracts (HybridVoting, DirectDemocracyVoting, OrgRegistry, OrgDeployer) with _disableInitializers() for stronger initialization guards - Added implementation validation to PoaManager.upgradeBeacon() and addContractType() to reject EOA addresses - Added implementation validation to PaymasterHub._authorizeUpgrade() to prevent UUPS upgrades to invalid addresses - Removed misleading __gap[50] from PaymasterHub (unnecessary with ERC-7201 namespaced storage) - Fixed 8 test files to use BeaconProxy pattern instead of direct initialization of implementation contracts - Created UpgradeSafety.t.sol with 24 comprehensive tests covering re-initialization prevention, upgrade authorization, storage preservation, and SwitchableBeacon mode-switching safety - Created UpgradeEdgeCases.t.sol with 10 production-scenario tests covering full upgrade chains, multi-tenant isolation, mode cycling, sequential upgrades, and ownership transfer flows - All 696 tests pass with zero failures Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: Update 9 test files to use proxy pattern for initialization Tests were directly calling initialize() on implementation contracts, which now revert due to _disableInitializers(). Wrapped all test setups in UpgradeableBeacon + BeaconProxy before calling initialize(). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> * fix: Implement 6 security fixes for PaymasterHub and TaskManager (#90) * fix: Implement 6 security fixes for PaymasterHub and TaskManager Address critical and high-severity audit findings: - Fix onboarding path abuse by restricting to pure account creation - Replace sentinel-based detection with explicit isOnboarding flag in context - Bind vouch signatures to operation intent (initCode, callData) + paymaster address - Defer vouch consumption to postOp and gate on success to prevent griefing - Add solidarity fund liquidity checks and fix deposit accounting - Fix permission hat tracking in TaskManager with reference counting to prevent removal bugs All changes include comprehensive test coverage and are backwards compatible. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * refactor: Merge security tests into existing test suites Dissolve AuditCriticalHighValidation.t.sol into the proper test files: - 7 PaymasterHub tests → PaymasterHubSolidarity.t.sol (with helpers) - 2 TaskManager tests → TaskManager.t.sol (using existing base class) Tests use existing mock infrastructure and naming conventions. No duplicate mocks, no temporal "audit" naming. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: Clean up permission ref counts on project deletion deleteProject now decrements projectPermHatRefCount for all hats that had project-specific permissions, and removes them from permissionHatIds if they have no remaining permissions elsewhere. Prevents stale entries from accumulating in the tracking array over the contract's lifetime. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> * fix: Resolve 4 validated bugs with comprehensive test coverage (#91) Fix medium-severity solidarity grace model inconsistency (PaymasterHub _checkOrgBalance now grace-period-aware so zero-deposit orgs can use solidarity), passkey duplicate credential bug in recovery (added re-check in completeRecovery), and PaymentManager over-claim vulnerability (added cap enforcement). Fix low-severity deployment initializer mismatch (aligned ModuleDeploymentLib interface with actual 4-arg initializer). Add 35 new tests (705→740 total): harness-based balance check tests with fuzz (20), passkey recovery edge cases (9), payment manager boundary and fuzz tests (7), plus 9 earlier tests. All 740 tests pass. Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> * feat: Cross-chain beacon upgrade propagation (#92) * feat: Add cross-chain beacon upgrade propagation system Implements automatic upgrade propagation from home chain to satellite chains using Hyperlane messaging. Key components: - DeterministicDeployer: CREATE3-based contract deployment for same-address deploys across chains - PoaManagerHub: Home-chain wrapper that dispatches upgrades to satellites - PoaManagerSatellite: Remote-chain receiver that applies upgrades locally - Comprehensive test suite with unit and end-to-end integration tests All 34 new tests pass. Existing PoaManager, SwitchableBeacon, and per-org contracts remain unchanged. Only beacon upgrade propagation added—UniversalAccountRegistry and PaymasterHub stay per-chain. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * test: Harden cross-chain test suite with comprehensive coverage Add 31 new tests covering: - Constructor/input validation (zero addresses) - Access control for all owner-only functions - Event emission verification - Edge cases (no satellites, same impl, unknown type, pause/unpause toggle) - Integration: removed satellite exclusion, emergency direct upgrade, dynamic registration, multiple independent types, mixed pin/mirror, full E2E proxies on all chains Total: 65 cross-chain tests, 761 full suite (0 failures). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: Add input validation, ETH rescue, and edge case tests Source fixes: - Add zero-address validation to PoaManagerSatellite constructor (poaManager, mailbox, hubAddress) - Add withdrawETH() to PoaManagerHub for recovering stuck ETH New tests: - Satellite constructor rejects zero poaManager/mailbox/hubAddress - Hub withdrawETH rescues stuck funds, rejects zero address, non-owner - Hub withdrawETH with zero balance is a no-op - Duplicate satellite registration causes duplicate dispatches (documented) Total: 73 cross-chain tests, 769 full suite (0 failures). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat: Add E2E testnet cross-chain testing and fix bugs found during live test Add orchestrated E2E test script that deploys minimal cross-chain infrastructure on Sepolia + Base Sepolia and verifies beacon upgrades propagate via Hyperlane. Bugs fixed during live testnet run: - DeterministicDeployer: Ownable(msg.sender) set owner to CREATE2 factory instead of deployer EOA; changed to explicit constructor param - PoaManagerHub: mailbox.dispatch() requires protocol fee; added msg.value forwarding split across active satellites - DeployDeterministicDeployer: added idempotency check (skip if already deployed) New files: - script/testnet-e2e.sh: Bash orchestrator for full E2E flow - script/e2e/TestnetE2EHomeChain.s.sol: Minimal home chain deployment - script/e2e/TestnetE2ESatellite.s.sol: Minimal satellite deployment - script/e2e/RegisterSatellite.s.sol: Register satellite on Hub - script/e2e/DeployV2AndUpgrade.s.sol: Deploy V2 + trigger upgrade - script/e2e/VerifyUpgrade.s.sol: Polling verification script Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * test: Add governance-driven cross-chain upgrade integration test Verifies the full ownership chain: HybridVoting → Executor → Hub → PoaManager, with Hyperlane propagation to satellite. Tests vote-pass upgrades both chains, tied votes leave beacons unchanged, and direct Hub calls from non-owners revert. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: Add upgrade safety hardening and comprehensive tests - DeterministicDeployer: replace string revert with custom CannotRenounce error - PoaManagerHub: fix _refundExcess to only refund caller's overpayment (not sweep pre-existing balance), add transferPoaManagerOwnership escape hatch, block renounceOwnership, use TransferFailed custom error - PoaManagerSatellite: reorder handle() to check auth before pause (prevents info leak), block renounceOwnership, add CannotRenounce error - Scripts: add payable() casts for Hub address (required by receive()) - Tests: fix 14 bare vm.expectRevert() to use specific OwnableUnauthorizedAccount selectors, add 25 new tests covering ETH refund preservation, ownership transfer, renounce blocking, auth ordering, and edge cases (794 total) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat: Add MainDeploy.s.sol for complete cross-chain deployment (#93) * feat: Add MainDeploy.s.sol orchestrating full cross-chain protocol deployment Implements complete deployment automation for the Poa governance protocol across home and satellite chains. Includes four entry points: DeployHomeChain (infrastructure + governance org + hub), DeploySatellite (satellite infrastructure), RegisterAndTransfer (register satellites and wire governance), and VerifyDeployment (read-only ownership verification). The governance org is hardcoded with two roles: MEMBER (requires vouching from CONTRIBUTOR) and CONTRIBUTOR (deployer gets this, can create tasks/projects/approve). Hybrid voting with 60% participation (DIRECT) + 40% membership (ERC20_BAL with quadratic). Updated foundry.toml fs_permissions to allow reading/writing state JSON files in ./script/. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: Use explicit Hyperlane domain ID instead of block.chainid for hub block.chainid is not guaranteed to equal the Hyperlane domain ID. On chains where they differ, PoaManagerSatellite would reject all messages from the hub with UnauthorizedOrigin. This adds a HUB_DOMAIN env var consistent with how SATELLITE_DOMAIN is already handled. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * chore: Add cross-chain deployment vars to .env.example Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * chore: Fill .env.example with Arbitrum home chain config Pre-populate mailbox addresses, domain IDs, and satellite registration for Arbitrum (home) + Ethereum/Optimism/Gnosis (satellites). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat: Add deploy.sh orchestrating full cross-chain deployment Single command to deploy across Arbitrum (home) + Ethereum, Optimism, Gnosis (satellites). Includes pre-flight checks (RPC connectivity, wallet balances), confirmation prompt, per-step resumability (--step N --satellite N), dry-run mode, and Etherscan verification support. Also adds gnosis RPC endpoint to foundry.toml. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: Skip unnecessary pre-flight checks for read-only steps --step summary now runs without needing PRIVATE_KEY or RPC access. --step 4 only checks home chain RPC (no wallet balance checks or build). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> * fix: Critical deployment bugs and security hardening Fixes 3 critical bugs in MainDeploy.s.sol and deploy.sh that would cause deployment revert: - C-1: Fix OrgRegistry.initialize signature (now accepts 2 params) - C-2: Route setUniversalPasskeyFactory through PM.adminCall pattern - C-3: Set PaymasterHub.orgRegistrar before governance org deploy Adds adminCall delegation mechanism to PoaManager, PoaManagerHub, and PoaManagerSatellite: - Lets contract owner invoke admin functions on sub-contracts that gate on msg.sender == poaManager - Same pattern as OZ Governor.relay() and TimelockController.execute() - Enables post-deployment governance control over admin functions Security & robustness fixes to deploy.sh: - H-3: Private key piped through stdin (avoid ps aux exposure) - H-4: Fixed json_get Python injection vulnerability - H-5: Added idempotency guards with confirmation prompts - M-3: Prevent .env from overriding chain-specific variables - M-4: Added timestamped deployment log file - M-5: Added state files to .gitignore Additional improvements: - M-1: Added existence checks for hardcoded external contracts (Hats, EntryPoint) - M-7: Enhanced state JSON with factory addresses (governanceFactory, accessFactory, modulesFactory, hatsTreeSetup) - M-6: Enhanced VerifyDeployment contract with additional checks Tests: - Added 7 comprehensive tests for adminCall on PoaManager, Hub, and Satellite - All 801 tests pass (794 existing + 7 new) - Code formatted with forge fmt Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * fix: Cross-chain script bugs and satellite registration safety - CrossChainUpgrade.s.sol: Add HYPERLANE_FEE env var so TriggerUpgrade sends ETH for Hyperlane protocol fees (was sending 0, fails on mainnet) - DeploySatelliteInfrastructure.s.sol: Replace msg.sender with vm.addr(deployerKey) for correct proxy initialization ownership - DeployInfrastructure.s.sol: Fix same msg.sender bug (3 instances), OrgRegistry 2-param init, route setUniversalPasskeyFactory and setOrgRegistrar through PM.adminCall - PoaManagerHub: Add DuplicateDomain guard to registerSatellite, only blocks active duplicates (re-register after remove still works) - MainDeploy.s.sol RegisterAndTransfer: Skip already-registered domains for idempotent re-runs after partial failures Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * refactor: Consolidate deployment scripts and simplify JSON handling - Extract 13 app contract types into shared DeployHelper base contract (single source of truth, eliminates ~6x duplication) - Replace manual string.concat JSON building with vm.serializeJson - Replace python3 JSON parsing with jq in deploy.sh and testnet-e2e.sh Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> * refactor: Replace precomputed keccak256 hashes with inline computation (#94) Replace all storage slot hex constants with inline keccak256("namespace") calls so the compiler verifies hash correctness at compile time. Update ModuleTypes constants and PaymasterHub storage locations. Modify all _layout() functions to load constants into stack variables before assembly to work around Solidity's inline assembly restrictions. - 16 contracts: storage slots now computed inline via keccak256 - 3 shared libraries: synchronized with parent contracts - PaymasterHub: 11 storage locations updated (8 ERC-7201, 2 simple, 1 main) - ModuleTypes: 13 module type IDs now inline - All _layout() functions adapted for assembly compatibility Tests: 862 passing, build clean, formatting applied. Note: 6 storage slots changed values (old hex was incorrect). If contracts are deployed behind proxies, this requires migration handling. PaymasterHub ERC-7201 slots remain unchanged (verified). ModuleTypes.PAYMASTER_HUB_ID now matches actual keccak256("PaymasterHub"). Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> * feat: Replace ECDSA vouch path with EligibilityModule-based onboarding (#95) Replace the PaymasterHub's ECDSA-signature-based vouching system (SUBJECT_TYPE_VOUCHED, 0x02) with the existing EligibilityModule's on-chain vouchFor() system. Change SUBJECT_TYPE_HAT validation from isWearerOfHat to isEligible so vouched-but-not-yet-hatted users can be sponsored, and add hat active status check to preserve the security property that deactivated hats cannot be used for sponsorship. Remove all dead code related to the old ECDSA vouch path including ECDSA/MessageHashUtils imports, 5 vouch-specific errors, SUBJECT_TYPE_VOUCHED constant, vouch-related events/storage, registerOrgWithVoucher function, setVoucherHat setter, isVouchUsed view function, and _validateVouchedEligibility implementation. Deprecate voucherHatId in OrgConfig struct for storage layout compatibility (rename to __deprecated_voucherHatId). Simplify validatePaymasterUserOp and postOp: remove vouchedAccount/voucherSigner variables, remove SUBJECT_TYPE_VOUCHED branch, change context encoding from 9 fields to 7 fields. Add robust tests verifying hat eligibility, deactivation blocking, and reactivation behavior. Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> * fix: Implement all 16 security audit fixes with comprehensive hardening (#96) * fix: Implement all 16 security audit fixes with comprehensive hardening This commit implements all 16 critical and high-severity security fixes identified in the comprehensive smart contract audit: **Access Control & Authorization:** - Fix #1: Add caller allowlist to UniversalAccountRegistry.registerAccountQuickJoin **Protocol Compliance & Math:** - Fix #2: Fix WebAuthn signCount bypass (prevent newSignCount=0 with active counter) - Fix #3: Change quorum threshold from > to >= for proper majority calculation - Fix #8: Update PackedUserOperation struct for ERC-4337 v0.7 compatibility (bytes32 gasFees) **Paymaster & Gas Economics:** - Fix #4: Fix solidarity tier dead code (make all tiers reachable, proper 4-tier structure) - Fix #5: Properly account for solidarity fees in org.spent tracking - Fix #6: Move onboarding counter increment to validation (bundle-safe) with decrement on failure (DoS-resistant) - Fix #9: Add uint128 overflow protection for safe casting - Fix #10: Validate dataOffset to prevent arbitrary calldata pointer manipulation **Financial Accounting:** - Fix #11: Track distribution over-commitment via totalCommitted mapping to prevent double-booking **Storage & Reentrancy:** - Fix #12: Move EligibilityModule reentrancy guard to ERC-7201 namespaced storage **Account Recovery & Credential Management:** - Fix #13: Deactivate all existing credentials before installing recovery credential - Fix #14: Prune pendingRecoveryIds array to prevent unbounded growth - Fix #15: Verify closing quote in WebAuthn type string to prevent partial match attacks **Governance & Ownership:** - Fix #16: Add ownership transfer cancellation to SwitchableBeacon - Fix #7: Add 2-day timelock to Executor.setCaller for governance takeover protection All 847 tests passing. Formatted with forge fmt. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * test: Restore valid recovery edge case tests Restore 4 tests that were incorrectly removed during the bulk test cleanup for Fix #13. These tests cover behaviors that are still valid after the recovery-deactivates-all-credentials change: - testCompleteCancelledRecovery_Reverts - testRecoveryNonExistentRecoveryId_Reverts - testInitiateRecoveryForExistingCredential_Reverts - testRecoveryCredentialArrayIntegrity (updated assertions for new behavior) 851 tests passing. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * test: Add missing coverage for security audit fixes New tests covering gaps identified in post-audit coverage review: - UAR: unauthorized caller rejected, authorized succeeds, deauthorize, batch onlyOwner - VotingMath: exact quorum boundary now passes with >= fix - Executor: timelock-not-expired revert, cancel clears pending, unauthorized proposer, zero address - PaymentManager: over-commitment rejected, finalize frees committed for reuse - PaymasterHub: uint128 overflow reverts on depositForOrg and donateToSolidarity 865 tests passing. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: Use base branch PasskeyPaymasterIntegration test with gasFees update During rebase, the test file was incorrectly resolved with our branch's version (which still referenced removed registerOrgWithVoucher). Restored base branch version and applied gasFees field migration (Fix #8). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> * feat: Upgrade etherform workflow to main with slither and coverage (#97) * feat: Upgrade etherform workflow to main with slither and coverage Update the reusable workflow reference to the latest etherform main commit (214cc6e), enabling: - Slither static analysis with high severity threshold - Forge coverage reports with sticky PR comments - Automatic change detection to skip CI when no contracts change Remove deployment-foundry-profile input (no longer supported on main). Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * test: Add comment to trigger CI pipeline Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * revert: Remove CI test comment Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: Use comma-separated string for slither filter_paths Slither's parse_filter_paths expects a string, not a JSON array. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * test: Add comment to trigger CI Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: Exclude arbitrary-send-eth false positive from slither The _processBounty function intentionally sends ETH to bundler origins as part of the ERC-4337 bounty incentive system. This is by design. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> * refactor: Remove delegated username registration from QuickJoin Users now register usernames directly via UniversalAccountRegistry.registerAccount() using msg.sender, eliminating the need for authorizedCallers whitelisting. Smart account users can batch quickJoin + registerAccount in a single UserOp via executeBatch. - Remove registerAccountQuickJoin, authorizedCallers, setAuthorizedCaller from UniversalAccountRegistry - Remove username params from all QuickJoin join functions - Remove username registration block from HatsTreeSetup - Update all tests and scripts to match new signatures Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Testing
forge build --offlineforge test --offline