Skip to content

Commit 7e96a42

Browse files
trinnodetrinnode
authored
Merge branch 'main' into issues-resolved-trinnode
2 parents 80efa1d + 4963eb4 commit 7e96a42

146 files changed

Lines changed: 29447 additions & 1355 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.cargo/config.toml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
[target.wasm32-unknown-unknown]
2+
rustflags = [
3+
"-C", "target-feature=+bulk-memory",
4+
]

‎.github/PULL_REQUEST_TEMPLATE.md‎

Lines changed: 184 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,184 @@
1+
# Pull Request Template
2+
3+
## 📋 Description
4+
<!-- Provide a brief description of the changes in this PR -->
5+
6+
## 🔗 Type of Change
7+
- [ ] 🐛 Bug fix (non-breaking change that fixes an issue)
8+
- [ ] ✨ New feature (non-breaking change that adds functionality)
9+
- [ ] ⚠️ Breaking change (fix or feature that would cause existing functionality to change)
10+
- [ ] 📚 Documentation update
11+
- [ ] 🔒 Security improvement
12+
13+
---
14+
15+
## 🔒 SECURITY REVIEW (⭐ MANDATORY FOR SMART CONTRACT CHANGES)
16+
17+
**For all smart contract code changes, complete the following checklist.**
18+
19+
See [`docs/SECURITY_CHECKLIST.md`](/docs/SECURITY_CHECKLIST.md) for detailed guidance.
20+
21+
### Required: Security Checklist Sign-Off
22+
- [ ] **I have reviewed this PR against the Internal Security Checklist** (`docs/SECURITY_CHECKLIST.md`)
23+
- [ ] Reentrancy: Verified Checks-Effects-Interactions (CEI) pattern
24+
- [ ] Access Control: Confirmed all sensitive functions are protected (`onlyOwner`, `onlyRole()`, etc.)
25+
- [ ] Input Validation: Validated all parameters have appropriate bounds checks
26+
- [ ] Unchecked Returns: All external calls have return value checks (`require(success, ...)`)
27+
- [ ] Gas Limits: No unbounded loops or potential DOS vectors
28+
29+
**If any checkbox cannot be verified, explain below:**
30+
```
31+
[Explanation here]
32+
```
33+
34+
### Slither Static Analysis Results
35+
- [ ] Ran Slither locally: `slither . --config-file slither.config.json`
36+
- **Result**: ✅ No High/Medium findings OR 🟡 Documented false positives (see below)
37+
38+
- [ ] GitHub Actions Slither workflow passed:
39+
- 🟢 All High/Medium findings fixed OR
40+
- 🟡 All false positives documented with FP references
41+
42+
**If this PR has security findings, document them below:**
43+
44+
### Handling Security Findings
45+
46+
#### Option A: Fixed in This PR ✅
47+
- [ ] Vulnerability identified and resolved
48+
- [ ] Test case added to verify fix
49+
- [ ] Explain fix below:
50+
```
51+
[Explanation of fix]
52+
```
53+
54+
#### Option B: False Positive 🟡
55+
- [ ] Identified as false positive (tool limitation or misleading check)
56+
- [ ] Added entry to `contracts/.false-positives.md` with:
57+
- Detector rule name
58+
- Technical reasoning (3+ sentences why it's safe)
59+
- Evidence (code snippet, test case, or reference)
60+
- [ ] Reference number (e.g., FP-001):
61+
```
62+
[FP number and explanation]
63+
```
64+
- [ ] Inline suppression added to code:
65+
```solidity
66+
// slither-disable-next-line <detector-name>
67+
// Reason: [one-line reason]
68+
```
69+
70+
#### Option C: Accepted Risk ⚠️
71+
- [ ] Acknowledged as low-priority style issue (naming conventions, etc.)
72+
- [ ] Added to Slither exclusions
73+
- [ ] Explain below:
74+
```
75+
[Explanation]
76+
```
77+
78+
---
79+
80+
## 📝 Testing
81+
82+
### Functional Testing
83+
- [ ] Unit tests added/updated for changes
84+
- [ ] Integration tests passing
85+
- [ ] Manual testing completed and documented below:
86+
```
87+
[Testing steps or scenarios]
88+
```
89+
90+
### Security Testing
91+
- For state-changing functions:
92+
- [ ] Reentrancy test (if applicable): Verify re-entry is blocked
93+
- [ ] Access control test: Verify unauthorized access is rejected
94+
- [ ] Boundary test: Verify edge cases are handled
95+
96+
- For external integrations:
97+
- [ ] Return value verification test
98+
- [ ] Failure scenario test
99+
100+
### Test Coverage
101+
- [ ] All new code paths have test coverage
102+
- [ ] Security-critical paths have comprehensive test cases
103+
- [ ] Coverage report: `[Link or reference]`
104+
105+
---
106+
107+
## 🚀 Deployment Notes
108+
109+
<!-- Any deployment considerations, migration steps, or special instructions -->
110+
111+
### Mainnet Readiness
112+
- [ ] This code is ready for production deployment
113+
- [ ] All critical tests pass
114+
- [ ] Security review approved
115+
- [ ] No temporary debug code
116+
- [ ] No TODO comments
117+
118+
### Breaking Changes
119+
If this PR introduces breaking changes:
120+
- [ ] Migration guide provided
121+
- [ ] Deprecation period defined: `[timeframe]`
122+
- [ ] Legacy code deprecated with warnings
123+
124+
---
125+
126+
## 📊 Automated Scan Results
127+
128+
<!-- GitHub Actions will update this section -->
129+
130+
### Slither Analysis
131+
- ✓ Status: [Pending workflow execution]
132+
- 🔴 High/Medium findings: [Number] ([View in Security tab](../../security/code-scanning))
133+
- 🟡 Low/Informational findings: [Number]
134+
- 🟢 No issues detected: [If applicable]
135+
136+
### Related Documentation
137+
- [Security Checklist](docs/SECURITY_CHECKLIST.md) — Use for code review
138+
- [False Positive Process](docs/FALSE_POSITIVE_HANDLING.md) — For non-vulnerabilities
139+
- [Slither Configuration](slither.config.json) — Current scanner settings
140+
141+
---
142+
143+
## ✅ Reviewer Checklist
144+
145+
**For code reviewers** (use this to guide your security-focused review):
146+
147+
- [ ] PR author completed security checklist ✓
148+
- [ ] All findings documented and categorized (fixed/false positive/excluded)
149+
- [ ] Inline security comments are clear and justified
150+
- [ ] Tests cover security-critical code paths
151+
- [ ] No external calls bypass return value checks
152+
- [ ] Access control is properly enforced
153+
- [ ] State updates follow CEI pattern
154+
- [ ] Input validation is comprehensive
155+
- [ ] Follow-up actions (if any) tracked in issues
156+
157+
---
158+
159+
## 📞 Questions or Issues?
160+
161+
- 🤔 Confused about security checklist? → See [`docs/SECURITY_CHECKLIST.md`](/docs/SECURITY_CHECKLIST.md)
162+
- 🔍 Marking finding as false positive? → Follow [`docs/FALSE_POSITIVE_HANDLING.md`](/docs/FALSE_POSITIVE_HANDLING.md)
163+
- 🆘 Need security review help? → Tag `@security-team` in comments
164+
165+
---
166+
167+
## 📋 Pre-Submit Checklist
168+
169+
Before marking PR as ready for review:
170+
171+
- [ ] Description is clear and concise
172+
- [ ] All security checklist items checked (✅ or explanation provided)
173+
- [ ] All tests passing locally: `npm test`
174+
- [ ] Linter passing: `npm run lint`
175+
- [ ] Slither passing locally OR findings documented: `slither . --config-file slither.config.json`
176+
- [ ] Code follows project style guide
177+
- [ ] No merge conflicts
178+
- [ ] Commits are clean and well-documented
179+
- [ ] Branch is up-to-date with main/develop
180+
181+
---
182+
183+
**✅ Ready for Review?** Ensure all items above are checked before requesting review.
184+

‎.github/workflows/README.md‎

Lines changed: 194 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,194 @@
1+
# GitHub Workflows - Security Scanning
2+
3+
This directory contains automated security scanning workflows for the YieldVault-RWA project.
4+
5+
## 📁 Files
6+
7+
### Security Workflows (New)
8+
9+
| Workflow | Trigger | Purpose | Duration |
10+
|----------|---------|---------|----------|
11+
| **`slither.yml`** | PR to main/develop | Ethereum/Solidity static analysis | 5-10 min |
12+
| **`rust-security.yml`** | PR to main/develop | Rust dependency audit + linting | 2-4 min |
13+
14+
### Existing Workflows
15+
16+
| Workflow | Trigger | Purpose |
17+
|----------|---------|---------|
18+
| `e2e.yml` | PR, push to main | Playwright E2E tests |
19+
| `docs.yml` | PR, push to main | API documentation generation |
20+
21+
---
22+
23+
## 🚀 Quick Start
24+
25+
### For Developers
26+
1. **Install local tools**:
27+
```bash
28+
pip install slither-analyzer
29+
cargo install cargo-audit
30+
```
31+
32+
2. **Run before committing**:
33+
```bash
34+
slither . --config-file slither.config.json
35+
cargo audit
36+
cargo clippy --all-targets
37+
```
38+
39+
3. **Create PR** → Workflows run automatically
40+
41+
### For DevOps
42+
1. **Verify workflows**: Check Actions tab
43+
2. **Adjust config**: Edit `slither.config.json` if needed
44+
3. **Monitor**: Review SARIF uploads to Security tab
45+
46+
---
47+
48+
## 📊 Workflow Details
49+
50+
### Slither (slither.yml)
51+
```yaml
52+
Triggers: Pull Request to main or develop
53+
Checks: Solidity vulnerabilities
54+
Fails On: High or Medium severity
55+
Output: SARIF + PR comment
56+
Config: slither.config.json
57+
```
58+
59+
**Security Checks**:
60+
- Reentrancy attacks
61+
- Unchecked external calls
62+
- Integer overflow/underflow
63+
- Access control violations
64+
- Delegatecall abuse
65+
66+
**Excluded** (Low Priority):
67+
- Naming conventions
68+
- Assembly usage
69+
- Tool version warnings
70+
71+
### Rust Security (rust-security.yml)
72+
```yaml
73+
Triggers: Pull Request to main or develop
74+
Checks: Dependencies + Code quality + Unsafe code
75+
Tools: cargo-audit, cargo-clippy, cargo-deny
76+
Fails On: Cargo audit warnings
77+
Output: PR comment + artifact
78+
```
79+
80+
**Security Checks**:
81+
- Vulnerable dependencies
82+
- Code quality issues
83+
- Clippy lint warnings
84+
- Unsafe code blocks
85+
- Supply chain verification
86+
87+
---
88+
89+
## 🔧 Configuration
90+
91+
### Slither Configuration (`slither.config.json`)
92+
93+
**Current Settings**:
94+
- **Fail On**: High severity (only breaks build on High/Medium)
95+
- **Excluded Detectors**: naming-convention, solc-version, low-level-calls
96+
- **Filter Paths**: node_modules, lib, test, mock
97+
- **Output Format**: JSON (for SARIF conversion)
98+
99+
**To Adjust**:
100+
```json
101+
{
102+
"exclude": ["detector-name"], // Add to skip checks
103+
"filter_paths": ["ignore/path"], // Paths to ignore
104+
"fail_on": "high" // Raise to "medium" for stricter
105+
}
106+
```
107+
108+
### Rust Configuration (Cargo.toml)
109+
110+
Use `[build]` section for Clippy options (if needed):
111+
```toml
112+
[profile.dev]
113+
opt-level = 0
114+
115+
[profile.release]
116+
opt-level = 3
117+
```
118+
119+
---
120+
121+
## 📈 Monitoring & Maintenance
122+
123+
### Weekly
124+
- [ ] Review PR security comments
125+
- [ ] Address High findings immediately
126+
127+
### Monthly
128+
- [ ] Update dependencies: `cargo update`
129+
- [ ] Rerun: `cargo audit`
130+
131+
### Quarterly
132+
- [ ] Review workflow configuration
133+
- [ ] Check GitHub Security tab for historical findings
134+
- [ ] Update exclusions if necessary
135+
136+
---
137+
138+
## 🆘 Troubleshooting
139+
140+
### "Workflow failed: Slither compilation error"
141+
1. Check that code compiles locally: `npm run build`
142+
2. Workflow has fallback: continues even if build fails
143+
3. Review PR comments for actual issues
144+
145+
### "Cargo audit keeps finding vulnerability"
146+
1. Run locally: `cargo audit`
147+
2. Update: `cargo update vulnerable_crate`
148+
3. If unfixable: Document in [docs/FALSE_POSITIVE_HANDLING.md](../docs/FALSE_POSITIVE_HANDLING.md)
149+
150+
### "My code was flagged as false positive"
151+
1. Don't suppress yet! Document first
152+
2. See: [docs/FALSE_POSITIVE_HANDLING.md](../docs/FALSE_POSITIVE_HANDLING.md)
153+
3. Tag @security-team in PR for approval
154+
155+
---
156+
157+
## 📚 Documentation
158+
159+
- **Setup Guide**: [docs/SECURITY_SCANNING_GUIDE.md](../docs/SECURITY_SCANNING_GUIDE.md)
160+
- **Manual Checklist**: [docs/SECURITY_CHECKLIST.md](../docs/SECURITY_CHECKLIST.md)
161+
- **False Positive Handling**: [docs/FALSE_POSITIVE_HANDLING.md](../docs/FALSE_POSITIVE_HANDLING.md)
162+
- **Implementation Details**: [docs/IMPLEMENTATION_SUMMARY.md](../docs/IMPLEMENTATION_SUMMARY.md)
163+
164+
---
165+
166+
## 🔐 Security Best Practices
167+
168+
✅ **Do**:
169+
- Review all security warnings
170+
- Fix real issues first
171+
- Document false positives
172+
- Run tools locally before pushing
173+
- Use the security checklist
174+
175+
❌ **Don't**:
176+
- Suppress warnings without understanding
177+
- Skip security reviews
178+
- Merge with High-severity findings
179+
- Disable entire workflow checks
180+
- Ignore Cargo audit vulnerabilities
181+
182+
---
183+
184+
## 📞 Support
185+
186+
- **Questions?** → Check documentation above
187+
- **Issue with workflow?** → Contact @devops-team
188+
- **Security concern?** → Contact @security-team
189+
- **False positive?** → Follow [FALSE_POSITIVE_HANDLING.md](../docs/FALSE_POSITIVE_HANDLING.md)
190+
191+
---
192+
193+
**Last Updated**: 2024-01-15
194+
**Maintained By**: DevSecOps Team

0 commit comments

Comments
 (0)