Skip to content

Commit b754440

Browse files
F3JouleF3Joule
authored
Merge branch 'master' into fix/hyperbridge-cleanup
2 parents c38bc24 + fa600a3 commit b754440

3 files changed

Lines changed: 181 additions & 1 deletion

File tree

‎.claude/skills/security_audit/SKILL.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
---
22
name: security_audit
33
description: Security audit of Substrate runtime built in Rust. Scans current dir by default, or a specific PR with --pr. Add --deep for adversarial reasoning.
4+
allowed-tools: Read, Glob, Grep, WebFetch, Bash, Agent
45
---
56

67
# Substrate Security Audit

‎scripts/mint-limit/createGlobalWithdrawLimitProposal.js‎

Lines changed: 178 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,178 @@
1+
import { ApiPromise, WsProvider } from '@polkadot/api';
2+
import { Keyring } from '@polkadot/keyring';
3+
import { cryptoWaitReady } from '@polkadot/util-crypto';
4+
import readline from 'node:readline';
5+
6+
const RPC = process.env.RPC || 'wss://rpc.hydradx.cloud';
7+
const IS_TESTNET = /^(1|true|yes)$/i.test(process.env.IS_TESTNET || '');
8+
const DEFAULT_TC_THRESHOLD = IS_TESTNET ? 1 : 4;
9+
const TC_THRESHOLD = Number(process.env.TC_THRESHOLD || String(DEFAULT_TC_THRESHOLD));
10+
const SUBMIT = /^(1|true|yes)$/i.test(process.env.SUBMIT || '');
11+
const ENV_SIGNER_URI = process.env.SIGNER_URI || '';
12+
const HDX_DECIMALS = 12n;
13+
const HDX_UNIT = 10n ** HDX_DECIMALS;
14+
const DEFAULT_GLOBAL_LIMIT_HDX_UNITS = IS_TESTNET ? 1_000_000n * HDX_UNIT : 1_000_000_000n * HDX_UNIT;
15+
const GLOBAL_LIMIT_HDX_UNITS = process.env.GLOBAL_LIMIT_HDX_UNITS || DEFAULT_GLOBAL_LIMIT_HDX_UNITS.toString();
16+
const WINDOW_MS = IS_TESTNET ? 1_800_000 : 21_600_000; // 30m or 6h
17+
18+
const EGRESS_ACCOUNTS = [
19+
// Parachain sovereign accounts
20+
'7LCt6dFqtxzdKVB2648jWW9d85doiFfLSbZJDNAMVJNxh5rJ', // Asset Hub Polkadot (1000)
21+
'7LCt6dFrhTDMPxtFNa3eHEhuWcHUHhPpqSSajnpbrUWqbhJ1', // People Polkadot (1004)
22+
'7LCt6dFm6ED8s6CoGTKmdmwktSDbwbbNNr7dd74ruE21MgAz', // Acala (2000)
23+
'7LCt6dFmtiRrwZv2YyEgQWW3GxsGX3Krmgzv9Xj7GQ9tG2j8', // Moonbeam (2004)
24+
'7LCt6dFnHxYDyomeCEC8nsnBUEC6omC6y7SZQk4ESzDpiDYo', // Astar (2006)
25+
'7LCt6dFs6sraSg31uKfbRH7soQ66GRb3LAkGZJ1ie3369crq', // Bifrost (2030)
26+
'7LCt6dFsW7xwUutdYad3oeQ1zfQvZ9THXbBupWLqpd72bmnM', // Interlay (2032)
27+
'7LCt6dFCdZxUErjoxSYYaygmgR37WdWHW3Gc1xaL1tdYCXAw', // Pendulum (2094)
28+
'7LCt6dFuhxZwCE6WaVt3vfRo4chW97idcQcwmBA2KrUh6QXS', // Neuroweb (2043)
29+
'7LCt6dF6pmXngyxLka1ZwFa1UzRmwfrT24gqujsXNbDKFVir', // Energy Web X (3345)
30+
'7LCt6dFBdgr99rDiTfV2ZeuhpAKmQLFPP7zZ4Hq1Ze2agqBW', // Mythos (3369)
31+
];
32+
33+
const LOCAL_ASSETS = [
34+
{ id: 0, label: 'HDX' },
35+
{ id: 222, label: 'HOLLAR' },
36+
];
37+
38+
const EXTERNAL_ASSETS = [
39+
2, 3, 4, 5, 6, 7, 9, 10, 11, 13, 14, 15, 16, 18, 19, 20, 21, 22, 23,
40+
30, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 252525, 1000081,
41+
1000085, 1000099, 1000100, 1000189, 1000190, 1000198, 1000624, 1000625,
42+
1000626, 1000745, 1000746, 1000752, 1000753, 1000765, 1000766, 1000767,
43+
1000771, 1000794, 1000795, 1000796, 1000809, 1000851,
44+
];
45+
46+
function buildTechnicalCommitteePropose(api, call, threshold) {
47+
const len = call.method.encodedLength ?? call.method.toU8a().length;
48+
return api.tx.technicalCommittee.propose(threshold, call.method, len);
49+
}
50+
51+
async function promptHidden(query) {
52+
const rl = readline.createInterface({
53+
input: process.stdin,
54+
output: process.stdout,
55+
terminal: true,
56+
});
57+
58+
return await new Promise((resolve) => {
59+
rl.question(query, { hideEchoBack: true }, (answer) => {
60+
rl.close();
61+
resolve(answer.trim());
62+
});
63+
});
64+
}
65+
66+
async function getSignerUri() {
67+
if (ENV_SIGNER_URI) {
68+
return ENV_SIGNER_URI;
69+
}
70+
71+
if (!SUBMIT) {
72+
return '';
73+
}
74+
75+
return await promptHidden('Enter SIGNER_URI (hidden): ');
76+
}
77+
78+
async function submitCall(call, signerUri) {
79+
if (!SUBMIT) {
80+
return;
81+
}
82+
83+
if (!signerUri) {
84+
throw new Error('SUBMIT=true requires SIGNER_URI to be set.');
85+
}
86+
87+
await cryptoWaitReady();
88+
const keyring = new Keyring({ type: 'sr25519' });
89+
const signer = keyring.addFromUri(signerUri);
90+
91+
console.log(`\n--- Submitting as ---\n${signer.address}`);
92+
93+
await new Promise((resolve, reject) => {
94+
let unsub = null;
95+
96+
call.signAndSend(signer, (result) => {
97+
if (result.status.isInBlock) {
98+
console.log(`\n--- Included in block ---\n${result.status.asInBlock.toHex()}`);
99+
}
100+
101+
if (result.status.isFinalized) {
102+
console.log(`\n--- Finalized in block ---\n${result.status.asFinalized.toHex()}`);
103+
console.log(`\n--- Extrinsic hash ---\n${call.hash.toHex()}`);
104+
if (unsub) unsub();
105+
resolve();
106+
}
107+
108+
if (result.isError) {
109+
if (unsub) unsub();
110+
reject(new Error('Extrinsic failed.'));
111+
}
112+
})
113+
.then((u) => {
114+
unsub = u;
115+
})
116+
.catch(reject);
117+
});
118+
}
119+
120+
async function main() {
121+
const signerUri = await getSignerUri();
122+
const provider = new WsProvider(RPC);
123+
const api = await ApiPromise.create({ provider, noInitWarn: true });
124+
125+
const calls = [];
126+
127+
calls.push(
128+
api.tx.circuitBreaker.setGlobalWithdrawLimitParams({
129+
limit: GLOBAL_LIMIT_HDX_UNITS,
130+
window: WINDOW_MS,
131+
})
132+
);
133+
134+
calls.push(api.tx.circuitBreaker.addEgressAccounts(EGRESS_ACCOUNTS));
135+
136+
for (const asset of LOCAL_ASSETS) {
137+
calls.push(api.tx.circuitBreaker.setAssetCategory(asset.id, 'Local'));
138+
}
139+
140+
for (const assetId of EXTERNAL_ASSETS) {
141+
calls.push(api.tx.circuitBreaker.setAssetCategory(assetId, 'External'));
142+
}
143+
144+
const batch = api.tx.utility.batchAll(calls);
145+
const preimage = api.tx.preimage.notePreimage(batch.method.toHex());
146+
const tcProposal = buildTechnicalCommitteePropose(api, batch, TC_THRESHOLD);
147+
const lengthBound = batch.method.encodedLength ?? batch.method.toU8a().length;
148+
149+
console.log('--- Config summary ---');
150+
console.log(`Mode: ${IS_TESTNET ? 'testnet' : 'mainnet'}`);
151+
console.log(`RPC: ${RPC}`);
152+
console.log(`TC threshold: ${TC_THRESHOLD}`);
153+
console.log(`Submit: ${SUBMIT ? 'yes' : 'no'}`);
154+
console.log(`Global withdraw limit units: ${GLOBAL_LIMIT_HDX_UNITS}`);
155+
console.log(`Window: ${WINDOW_MS} ms`);
156+
console.log(`Egress accounts: ${EGRESS_ACCOUNTS.length}`);
157+
console.log(`Local overrides: ${LOCAL_ASSETS.map((a) => `${a.label}(${a.id})`).join(', ')}`);
158+
console.log(`External overrides: ${EXTERNAL_ASSETS.length}`);
159+
160+
console.log('\n--- utility.batchAll (human) ---\n', batch.method.toHuman());
161+
console.log('\n--- utility.batchAll HEX ---\n', batch.method.toHex());
162+
163+
console.log('\n--- preimage.notePreimage (human) ---\n', preimage.method.toHuman());
164+
console.log('\n--- preimage.notePreimage HEX ---\n', preimage.method.toHex());
165+
166+
console.log('\n--- technicalCommittee.propose (human) ---\n', tcProposal.method.toHuman());
167+
console.log('\n--- technicalCommittee.propose HEX ---\n', tcProposal.method.toHex());
168+
console.log('\n--- Length bound ---\n', lengthBound);
169+
170+
await submitCall(tcProposal, signerUri);
171+
172+
await api.disconnect();
173+
}
174+
175+
main().catch((e) => {
176+
console.error('\nERROR:', e.message || e);
177+
process.exit(1);
178+
});

‎scripts/mint-limit/package.json‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,8 @@
33
"version": "1.0.0",
44
"main": "calcLength.js",
55
"scripts": {
6-
"test": "echo \"Error: no test specified\" && exit 1"
6+
"test": "echo \"Error: no test specified\" && exit 1",
7+
"withdraw-limit-proposal": "node createGlobalWithdrawLimitProposal.js"
78
},
89
"keywords": [],
910
"author": "",

0 commit comments

Comments
 (0)