Pin toolchain, document crates, add deploy scripts and threat model - #1221
Merged
yusuftomilola merged 2 commits intoJul 27, 2026
Conversation
SC-53: pin the toolchain - Add contracts/rust-toolchain.toml pinning Rust 1.96.0 with rustfmt, clippy and the wasm32-unknown-unknown target. - Every contracts CI job now reads the channel from that file instead of floating `stable`, so a new stable release cannot spontaneously break CI and local builds match CI exactly. SC-54: per-crate documentation - Add a README to each of the five crates covering purpose, invariants, storage layout, an entrypoint table with auth requirements, emitted events, errors, and a worked example. - Add a workspace README with the crate map and an explicit explanation of the assetsup/contrib relationship. - Add crate-level //! docs to every lib.rs; cargo doc --no-deps is now warning-free. SC-55: reproducible deployment - Add scripts/deploy.sh handling build, optimize, deploy, initialize and verify, wiring cross-contract addresses in dependency order. - Contract ids are written to a git-ignored deployments/<network>.json with a committed example. No key material is read, written, or logged. SC-56: threat model and checklist - Add contracts/SECURITY.md with the trust model, per-contract assets at risk, known accepted risks, a pre-deployment checklist, and a disclosure process. - Add a PR template that references the checklist for contract changes. The entrypoint tables record the authorization gaps found while documenting: assetsup's register_asset, update_asset_metadata, transfer_asset_ownership and retire_asset check a caller-supplied address without calling require_auth on it, and several asset-maintenance entrypoints have no authorization at all. These are documented here and tracked for fixing in SC-42. Closes DistinctCodes#1217 Closes DistinctCodes#1218 Closes DistinctCodes#1219 Closes DistinctCodes#1220
|
@northersubair is attempting to deploy a commit to the naijabuz's projects Team on Vercel. A member of the Team first needs to authorize it. |
|
@northersubair Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
Verifying the documentation against the compiled crates turned up three inaccuracies in the tables added earlier in this branch. contrib is mostly dead code. Its lib.rs declares only audit, pause, types, insurance and lease; escrow, KYC, staking, oracle, tokenization, detokenization, restrictions and error.rs have no mod declaration and are not part of the crate — about 1,670 lines. The deployed ContribContract therefore has none of those capabilities and no typed errors at all, so describing contrib as "the crate that owns escrow and KYC" was wrong. The crate README now leads with this, and the workspace README, entrypoint tables, event table and SECURITY.md are corrected to match. Recorded as an accepted risk since anyone reading the source would reasonably assume otherwise. asset-maintenance: update_maintenance_schedule and complete_scheduled_maintenance were listed as having no authorization. They do authenticate, indirectly, by delegating to schedule_maintenance and add_maintenance_record. The genuinely unguarded entrypoints are init, add_warranty_information, update_warranty_information, file_warranty_claim and create_maintenance_alert; SECURITY.md is narrowed to those. multisig-wallet: emergency_unfreeze and set_daily_limit require an owner and return NotAnOwner, not Unauthorized. Refs DistinctCodes#1218 Refs DistinctCodes#1220
yusuftomilola
approved these changes
Jul 27, 2026
yusuftomilola
left a comment
yusuftomilola
left a comment
Collaborator
There was a problem hiding this comment.
Excellent infrastructure work! Toolchain pinning ensures reproducible builds, comprehensive documentation aids maintenance, deploy scripts streamline releases, and threat model documentation enhances security posture.
8 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #1217
Closes #1218
Closes #1219
Closes #1220