fix: merge develop into inbound-tracker and unified proof verification #1292

ws4charlie · 2023-10-13T17:43:35Z

Description

Merge develop into inbound-tracker branch.
Unified proof verification logic for both EVM and Bitcoin proof in outTx tracker and restored some old authorization logic.
Unified proof verfication logic in inTx tracker.
Fixed gosec errors.

Closes:

Type of change

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to not work as expected)
This change requires a documentation update

How Has This Been Tested?

Please describe the tests that you ran to verify your changes. Include instructions and any relevant details so others can reproduce.

Checklist:

I have added unit tests that prove my fix feature works

* update index * remove deprecated functions * make generate * add return value in message * initialize test * whitelist tests * make generate

* update function * regenerate interfaces * update for crosschain

…cksum format (#1261) * fix error message * compare with ETH address type * tests * goimport --------- Co-authored-by: brewmaster012 <[email protected]>

* add new field * update message type * message new logic

* initial commit * added queries and unit tests * added cli * fix parse error * fix parse error 2 * fix lint and test errors * ran make generate * update index for keygen * refactor query name * refactor key calculation * refactor lib name

* feed sataoshi/B to zetacore and check size limit * removed fee cap * replaced magic number 1000 with constant bytesPerKB * put lowerbound, upperbound limit on sizeLimit * use actual txSize for fee calculation --------- Co-authored-by: charliec <[email protected]>

….) (#1235) * cherry pick all hotfix from v10.0.x * adjusted code to for nosec * adusted error handling and code comments according to PR review feedback * cherry pick hotfix for bitcoin outbound performance and updated some log prints * cherry pick mock mainnet hotfix for duplicate payment on nonce 0 --------- Co-authored-by: charliec <[email protected]>

* initiated bitcoin header and proof * added smoke test for bitcoin merkle proof and RPC query * make generate * fix gosec and unit test * Update common/headers_test.go Co-authored-by: Lucas Bertrand <[email protected]> * code adjustment according to feedback of PR review * corrected a typo and added more comment to function * fix gosec error --------- Co-authored-by: charliec <[email protected]> Co-authored-by: Lucas Bertrand <[email protected]> Co-authored-by: brewmaster012 <[email protected]>

* read gas limit from smart contract * add more checks for gas limit

* fix proto * fix filename * add cli query

…1285) * change comment * add notice for ledger

github-actions · 2023-10-13T17:43:59Z

!!!WARNING!!!
nosec detected in the following files: common/utils.go, common/coin.go, common/headers.go, common/proof.go, x/crosschain/client/querytests/in_tx_tracker.go, x/crosschain/keeper/cctx_utils.go, x/fungible/keeper/msg_server_deploy_fungible_coin_zrc20.go, zetaclient/bitcoin_client.go, zetaclient/btc_signer.go, zetaclient/evm_client.go, zetaclient/inbound_tracker.go, zetaclient/zetacore_observer.go

Be very careful about using #nosec in code. It can be a quick way to suppress security warnings and move forward with development, it should be employed with caution. Suppressing warnings with #nosec can hide potentially serious vulnerabilities. Only use #nosec when you're absolutely certain that the security issue is either a false positive or has been mitigated in another way.

Only suppress a single rule (or a specific set of rules) within a section of code, while continuing to scan for other problems. To do this, you can list the rule(s) to be suppressed within the #nosec annotation, e.g: /* #nosec G401 */ or //#nosec G201 G202 G203
Broad #nosec annotations should be avoided, as they can hide other vulnerabilities. The CI will block you from merging this PR until you remove #nosec annotations that do not target specific rules.

Pay extra attention to the way #nosec is being used in the files listed above.

kevinssgh · 2023-10-13T18:17:15Z

x/crosschain/keeper/msg_server_add_to_outtx_tracker.go

+		if strings.EqualFold(hash.TxHash, msg.TxHash) {
+			isDup = true
+			if isProven {
+				hash.Proved = true


Does this value get modified in the tracker? If not then the variable has no use here.

The hash.Proved value is used nowhere for now. Moving forward, we'll gradually utilize the Proved flag in a way that whenever a tracker hash gets its Proved flag set to true, it will be treated as a true hash of outTx/inTx and be trusted by any party.

lumtis and others added 14 commits October 10, 2023 09:12

refactor: change default mempool version in config (#1238)

d754423

fix(MsgWhitelistERC20): set unique index for generate cctx (#1245)

996f35d

* update index * remove deprecated functions * make generate * add return value in message * initialize test * whitelist tests * make generate

fix(observer): remove error return in IsAuthorized (#1250)

23d7724

* update function * regenerate interfaces * update for crosschain

fix(GetForeignCoinFromAsset): Ethereum comparaison checksum/non-che…

aa94a91

…cksum format (#1261) * fix error message * compare with ETH address type * tests * goimport --------- Co-authored-by: brewmaster012 <[email protected]>

feat(fungible): add ability to update gas limit (#1260)

ed35305

* add new field * update message type * message new logic

fix: Blame index update (#1264)

a1d7be0

* initial commit * added queries and unit tests * added cli * fix parse error * fix parse error 2 * fix lint and test errors * ran make generate * update index for keygen * refactor query name * refactor key calculation * refactor lib name

fix: register emissions grpc server (#1257)

0001806

fix: read gas limit from smart contract (#1277)

48f3a44

* read gas limit from smart contract * add more checks for gas limit

fix(fungible): add CLI command to query system contract (#1252)

db3e507

* fix proto * fix filename * add cli query

fix(cmd): add notice when using --ledger with Ethereum HD path (#…

8a308fc

…1285) * change comment * add notice for ledger

merge develop into inbound-tracker and unified proof verification

6f04e8a

ws4charlie requested review from brewmaster012, kingpinXD, kevinssgh, fadeev and lumtis as code owners October 13, 2023 17:43

github-actions bot added breaking:proto breaking:cli labels Oct 13, 2023

github-actions bot added the nosec label Oct 13, 2023

kevinssgh reviewed Oct 13, 2023

View reviewed changes

ws4charlie added 2 commits October 13, 2023 13:22

sync with develop branch

c4459ec

fixed gosec errors

1efa308

ws4charlie merged commit 1ab1338 into inbound-tracker Oct 13, 2023

lumtis deleted the inbound-tracker-code-unification branch October 27, 2023 23:19

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: merge develop into inbound-tracker and unified proof verification #1292

fix: merge develop into inbound-tracker and unified proof verification #1292

ws4charlie commented Oct 13, 2023 •

edited

Loading

github-actions bot commented Oct 13, 2023 •

edited

Loading

kevinssgh Oct 13, 2023

ws4charlie Oct 13, 2023

fix: merge develop into inbound-tracker and unified proof verification #1292

fix: merge develop into inbound-tracker and unified proof verification #1292

Conversation

ws4charlie commented Oct 13, 2023 • edited Loading

Description

Type of change

How Has This Been Tested?

Checklist:

github-actions bot commented Oct 13, 2023 • edited Loading

kevinssgh Oct 13, 2023

Choose a reason for hiding this comment

ws4charlie Oct 13, 2023

Choose a reason for hiding this comment

ws4charlie commented Oct 13, 2023 •

edited

Loading

github-actions bot commented Oct 13, 2023 •

edited

Loading