Skip to content

chore: updated deployment scripts - #455

Open
Serhii-Apriorit wants to merge 18 commits into
mainfrom
chore/updated_deployment_scripts
Open

chore: updated deployment scripts#455
Serhii-Apriorit wants to merge 18 commits into
mainfrom
chore/updated_deployment_scripts

Conversation

@Serhii-Apriorit

Copy link
Copy Markdown

No description provided.

@KevinMehrabi
KevinMehrabi self-requested a review July 13, 2026 17:21

@KevinMehrabi KevinMehrabi left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you for the update. I am holding approval until the findings in TEZFIN_PR_455_V3_1_FOLLOW_UP_SECURITY_REVIEW_2026_07_21.md are addressed.

Required before approval:

  • Correct the supply-cap and borrow-cap checks. marketTotals returns post-operation totals, so the current transaction amount must not be added again.
  • Add end-to-end ꜰToken tests covering transactions below, exactly at, and above each cap.
  • Update MainnetGovernancePayloads.json. The current 86400 maximum price age is rejected by the new 3600-second limit.
  • Add price bounds, supply caps, borrow caps, liquidation pause states, and independent activation controls to the governance payload.
  • Make oracle verification mandatory from every mainnet deployment path.
  • Reject priceExp = 0 in supportMarket.
  • Correct the H-02/M-03 documentation: independent liquidation pausing was implemented; the separate guardian/timelock recommendation was not.
  • Repeat the complete deployment and governance activation sequence on Previewnet.

The replacement production oracle remains a prerequisite before minting or borrowing can be opened.

@KevinMehrabi

Copy link
Copy Markdown
Contributor

Thanks, I reviewed the latest commit d91db5f. Most of the requested contract and deployment changes have now been implemented correctly.

The remaining blockers are:

  1. The CI size result reports the Comptroller at 32,579 bytes against a 32,768-byte limit, leaving only 189 bytes. The current static check counts contract code plus storage, but not necessarily the complete origination-operation envelope. Please either:

    • originate the exact d91db5f Comptroller successfully on Previewnet and provide the operation/address, or
    • provide the exact Taquito estimate.originate() opSize using the final compiled artifact.

    Given the extremely small margin, reducing the Comptroller size further would be preferable.

  2. Please repeat the complete Previewnet deployment and governance configuration using this exact commit. The earlier Previewnet deployment predates these latest contract changes.

  3. In docs/MainnetGovernancePayloads.json, change the activation precondition from XTZUSDT and BTCUSDT to the actual required feeds: XTZUSDT, USDTUSDT, and TZBTCUSDT.

  4. Please remove the trailing whitespace reported in deploy/compile_targets/tests/test_deploy_pipeline_wiring.py.

The unresolved replacement production oracle remains a blocker to mainnet activation, although it does not need to block merging the deployment code once the items above are resolved.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants