Tags: Snowfork/snowbridge
Tags
Polkadot <> Kusama transfers (#1805) * P<>K sending: $1 service fee (both directions) + destination min-balance validation - forKusama.validate(): reject amount <= destination token minimum balance (ED guard) - $1 service fee deposited on Polkadot AH both directions: DOT via batchAll (p->k source), KSM skimmed in the PAH-dest customXcm (k->p); constants in forKusama.ts - faithful k->p dest dry-run reconstruction (models the fee skim) - transfer_for_kusama.ts: pin reliable Kusama-AH RPC for signAndSend * Make P<>K service fee caller-injected (opt-in) instead of hardcoded - fee(tokenAddress, options?: { serviceFee: { recipient, amount } }) + build() options - recipient/amount injected per-call, resolved onto DeliveryFee.serviceFee, read by tx()/validate() - off by default (no fee unless injected); recipient accepts SS58 or hex (normalised) - removed hardcoded SERVICE_FEE_RECIPIENT/DOT/KSM constants - runner: opt-in via SERVICE_FEE_RECIPIENT + SERVICE_FEE_AMOUNT env * comment cleanups * registry * rename files * more cleanup * better errors
Add WETH allowance-gap repro mode to L2->Polkadot ops script Reorders the flow to fee -> tx -> approve -> validate so the script can read the exact value the adaptor pulls (transfer.computed.totalValue) before approving. Normal behaviour is unchanged. Adds REPRO_TIGHT_ALLOWANCE mode: approves the adaptor for exactly the amount the static validation checks against (value - totalFeeInWei), landing the allowance inside the [validationChecks, value) window so the WETH under-count is deterministic. Implies dry-run so no transfer is submitted. Narrates the three outcomes: patched (rejected on the allowance check), unpatched (static checks pass but estimateGas backstops the revert), and inconclusive (rejected for an unrelated reason such as low balance).
Merge branch 'main' into ron/l2-bridge-to-parachains
Improve verification safety and add test coverage (#1798) * fix: bind substrate merkle proof length to canonical depth to prevent aliasing SubstrateMerkleProof.computeRoot folded exactly `proof.length` siblings without binding the proof to a canonical leaf position. A leaf promoted up an odd-width tree (substrate's binary-merkle-tree carries a lone trailing node up unchanged) has a short proof, and that short proof verified at every index sharing its leading decision bits. In BeefyClient this let one validator's (account, proof) pair pass isValidatorInSet at many attacker-chosen `index` values, so a sub-1/3 set could fill the quorum bitfield and forge latestMMRRoot. Fix: walk the tree by geometry instead of by proof.length — promote lone trailing nodes (consuming no proof element), consume a sibling only where one exists, then require the proof length to match the canonical path exactly. This binds a proof to a single leaf position and collapses the aliasing. verify() returns false on a non-canonical proof (preserving its bool contract). Changes: - Collapse computeRoot/tryComputeRoot in SubstrateMerkleProof into a single computeRoot function returning (bool valid, bytes32 root). - Walk the tree by geometry, handle the promotion rule correctly, and assert that the number of consumed siblings matches proof.length exactly. - Return (false, bytes32(0)) on all invalid paths (out-of-range position, proof exhausted, length mismatch) so that unchecked callers fail closed. - Update Verification.verifyCommitment to consume the tuple and return false on invalid proof. - Add adversarial fuzz tests for SubstrateMerkleProof verifier covering random widths, positions, and proof mutations. - Add production-parity tests and mainnet fork integration tests for the SubstrateMerkleProof fix. - Add verification test covering the parachain-heads proof path for the canonical-depth merkle fix. * Polish comment
Merge branch 'main' into alistair/fee-dust-fix
Update governance commands to halt bridge (#1776) * governance commands * halt improvements * fixes * Add Emergency Procedures docs page Adds the docs/resources/emergency-procedures.md file referenced by SUMMARY.md and governance-and-operational-processes.md in this PR, extending the on-call runbook with a Producing a halt-bridge preimage section that points to the live governance UI at app.snowbridge.network/governance alongside the snowbridge-preimage CLI. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Expand Emergency Procedures with incident runbook Adds the operational runbook sections around the existing halt-bridge command reference: Detection signals (including bug bounty reports and visibly drained funds), Decision authority (solo halt only for visible exploits, otherwise 2/3 confirm to avoid spooking the community with a halt referendum), Comms during an incident (Slack first, then Element with Parity, then affected integrators, no public comms until fix is deployed), Submitting the preimage (Whitelisted Caller flow with Fellowship-whitelist timing), Verifying the halt (per-flag storage queries with Gateway-side caveat), Resuming the bridge (governance UI is the only practical path), and Post-mortem (Google Doc, 48h SLA). Also reframes the Producing a halt-bridge preimage and Resuming the bridge sections to make app.snowbridge.network/governance the primary path, with the snowbridge-preimage CLI as a fallback only. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Iterate Emergency Procedures based on team feedback - Detection: trim to drained funds + verified-PoC bug bounty (HackenProof or direct); drop generic anomaly bullets. - Decision authority: distinguish solo halt (visible exploit, funds draining) from confirmed halt (2 team members agree) to avoid spooking the community with a halt referendum for a maybe-incident. Remove team-size denominators so the doc survives team-size changes. - Comms: name the #snowbridge-security Slack channel and Telegram as the integrator channel. - Halt path: governance page is primary; SDK (buildHaltBridgePreimage / buildResumeBridgePreimage) is the fallback. Drop snowbridge-preimage CLI from the runbook. - Submission: document the actual opengov-cli flow: Asset Hub batch (preimage note + public referendum, anyone) and Collectives Chain batch (Fellowship whitelist, rank-3+ Fellow only). Include the enactment-time default caveat. - Rename Emergency Pause to Halt scopes reference; rewrite scope list and failure-mode + verification tables to use UI form-field names instead of CLI flag names. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Tighten Emergency Procedures and lead with halt mechanics Restructure so halt-action sections (Producing, Halt scopes reference, Submitting, Verifying) sit directly under the intro for fast access under pressure; Detection, Decision authority, and Comms move below. Trim prose throughout: intro 2 paragraphs to 2 lines, scope bullets compressed to one sentence each, Decision authority converted to a table, numbered comms steps shortened. Protocol-relevant details (pallet names, V1/V2 distinctions, relayer-delivery caveats) kept; explanatory framing cut. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Add buildHaltBridgeSubmissionUrls to governance SDK Lets the snowbridge-app governance UI emit two papi.how submission links directly from a halt-bridge preimage, replacing the operator's manual opengov-cli + Rust toolchain step: 1. Asset Hub batch URL: utility.forceBatch([preimage.notePreimage( dispatchWhitelistedCallWithPreimage(call)), referenda.submit( Origins(WhitelistedCaller), Lookup{hash, len}, After(n))]). Anyone on the operator team can submit. 2. Collectives Fellowship URL: utility.forceBatch([fellowshipReferenda .submit(FellowshipOrigins(Fellows), Inline(polkadotXcm.send to Asset Hub carrying Transact(whitelist.whitelistCall(preimageHash))), After(10))]). Must be submitted by a rank-3+ Fellow. Mirrors joepetrowski/opengov-cli's polkadot_fellowship_referenda flow (src/submit_referendum.rs ~L628-L811). Includes opengov_submission_check.ts under @snowbridge/operations as a hex-parity check against a recorded opengov-cli fixture, currently passes byte-for-byte on the live Polkadot Asset Hub + Collectives runtimes. resumeBridgeSubmissionUrls is a thin alias because the wire format is identical; both halt and resume preimages go through the same WhitelistedCaller track. UI changes (copy-preimage button, submit-to-AH button, copy-Fellowship- URL button in HaltBridgeForm.tsx) are intentionally out of scope and will follow in snowbridge-app. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Reframe halt-bridge submission docs around governance UI The governance page at app.snowbridge.network/governance now emits both the preimage AND the two papi.how submission links directly (Asset Hub batch + Fellowship whitelist), via the new buildHaltBridgeSubmissionUrls SDK helper. Reflect that as the primary path: - "Producing a halt-bridge preimage" -> "Producing the preimage and submission links": one step now, the page emits the URLs along with the preimage. - "Submitting the preimage" -> "Submitting": leads with "click Open on AH batch / Copy Fellowship link from the UI", no intermediate tooling. - Resuming section mirrors halt: UI emits both. - opengov-cli demoted to a fallback subsection under Submitting, for the case where the UI is unreachable. - SDK fallbacks updated to include buildHalt/ResumeBridgeSubmissionUrls alongside the preimage builders. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * chore: refresh PR head (no-op) --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
PreviousNext