code/cl8y-bridge-monorepo
4
0
Fork 0
Code Issues 38 Pull requests 4 Projects Releases Packages Wiki Activity

QA: Verify Solana bridge security hardening #68

New issue
Closed
opened 2026-03-23 12:10:41 +00:00 by PlasticDigits · 2 comments
PlasticDigits commented 2026-03-23 12:10:41 +00:00 (Migrated from gitlab.com)
Copy link

QA checklist for @brouie

  • Rebuild and deploy Solana programs on local validator — confirm BridgeConfig and TokenMapping account shapes match IDL
  • Run anchor test — all existing + new tests pass
  • Verify SPL LockUnlock deposit/withdraw E2E flow
  • Verify SPL MintBurn deposit/withdraw E2E flow
  • Verify native fee withdrawal is capped at accrued_native_fees
  • Verify SPL fee withdrawal is capped at token_mapping.accrued_fees
  • Verify withdraw_fees rejects non-admin callers
  • Verify withdraw_execute_native preserves rent-exempt reserve
  • Verify frontend withdraw_submit uses correct PDA seed ("executed", not "executed_hash")
  • Run cross-chain E2E harness: make solana-test-e2e (or cargo test --test test_solana_flows -- --ignored --nocapture in packages/e2e)
  • Regression: existing native deposit/withdraw, cancel/reenable, pause, hash parity tests still pass
  • Confirm faucet rejects zero claim amount and negative cooldown
## QA checklist for @brouie - [ ] Rebuild and deploy Solana programs on local validator — confirm `BridgeConfig` and `TokenMapping` account shapes match IDL - [ ] Run `anchor test` — all existing + new tests pass - [ ] Verify SPL LockUnlock deposit/withdraw E2E flow - [ ] Verify SPL MintBurn deposit/withdraw E2E flow - [ ] Verify native fee withdrawal is capped at `accrued_native_fees` - [ ] Verify SPL fee withdrawal is capped at `token_mapping.accrued_fees` - [ ] Verify `withdraw_fees` rejects non-admin callers - [ ] Verify `withdraw_execute_native` preserves rent-exempt reserve - [ ] Verify frontend `withdraw_submit` uses correct PDA seed (`"executed"`, not `"executed_hash"`) - [ ] Run cross-chain E2E harness: `make solana-test-e2e` (or `cargo test --test test_solana_flows -- --ignored --nocapture` in `packages/e2e`) - [ ] Regression: existing native deposit/withdraw, cancel/reenable, pause, hash parity tests still pass - [ ] Confirm faucet rejects zero claim amount and negative cooldown
PlasticDigits commented 2026-03-23 12:10:41 +00:00 (Migrated from gitlab.com)
Copy link

assigned to @Brouie

assigned to @Brouie
Brouie commented 2026-03-24 03:58:48 +00:00 (Migrated from gitlab.com)
Copy link

119/119 ALL PASS on localnet (35 existing + 84 new security/hardening/spl tests). Checklist: (1) Rebuild+deploy both programs — done. (2) anchor test 119/119 — done. (3) SPL LockUnlock E2E — pass (tests 18,20). (4) SPL MintBurn E2E — pass (tests 18,20). (5) Native fee capped at accrued_native_fees — pass (test 12). (6) SPL fee capped at accrued_fees — pass (test 12). (7) withdraw_fees rejects non-admin — pass (test 19). (8) withdraw_execute_native preserves rent-exempt — pass (test 13). (9) Frontend PDA seed verified: 'executed' matches ExecutedHash::SEED. (10) Cross-chain E2E — blocked, needs full docker infra (make start/deploy), would conflict with running DEX LocalTerra. (11) Regression all pass. (12) Faucet zero claim/negative cooldown — guards verified in code (initialize.rs:28-29), singleton PDA prevents re-init unit testing. Stack overflow warning on bridge build (4104>4096 by 8 bytes) but .so deploys and runs fine.

119/119 ALL PASS on localnet (35 existing + 84 new security/hardening/spl tests). Checklist: (1) Rebuild+deploy both programs — done. (2) anchor test 119/119 — done. (3) SPL LockUnlock E2E — pass (tests 18,20). (4) SPL MintBurn E2E — pass (tests 18,20). (5) Native fee capped at accrued_native_fees — pass (test 12). (6) SPL fee capped at accrued_fees — pass (test 12). (7) withdraw_fees rejects non-admin — pass (test 19). (8) withdraw_execute_native preserves rent-exempt — pass (test 13). (9) Frontend PDA seed verified: 'executed' matches ExecutedHash::SEED. (10) Cross-chain E2E — blocked, needs full docker infra (make start/deploy), would conflict with running DEX LocalTerra. (11) Regression all pass. (12) Faucet zero claim/negative cooldown — guards verified in code (initialize.rs:28-29), singleton PDA prevents re-init unit testing. Stack overflow warning on bridge build (4104>4096 by 8 bytes) but .so deploys and runs fine.
PlasticDigits (Migrated from gitlab.com) closed this issue 2026-03-24 09:20:12 +00:00
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
issue/165
issue/187
issue/170
issue/195
renovate/configure
review/brouie-solana-e2e-70
Labels
Clear labels   
agent:implement
Queue implement gate

  
agent:ready

   
backend

   
bug

   
cannot-reproduce

   
confirmed

   
desktop

   
docs

   
documentation

   
duplicate

   
enhancement

   
feature

   
frontend

   
good first issue

   
help wanted

   
high-risk

   
in-review

   
invalid

   
mobile

   
needs-triage

   
P0-critical

   
P1-high

   
P2-medium

   
P3-low

   
qa

   
QA

   
question

   
ready
Definition of Ready

  
report

   
responsive

   
security

   
security-escalate

   
smart-contract

   
solana

   
tablet

   
test-pass

   
ux

   
wallet-issue

   
wallet:keplr

   
wallet:metamask

   
wallet:station

   
wallet:walletconnect

   
wontfix
No labels
agent:implement
agent:ready
backend
bug
cannot-reproduce
confirmed
desktop
docs
documentation
duplicate
enhancement
feature
frontend
good first issue
help wanted
high-risk
in-review
invalid
mobile
needs-triage
P0-critical
P1-high
P2-medium
P3-low
qa
QA
question
ready
report
responsive
security
security-escalate
smart-contract
solana
tablet
test-pass
ux
wallet-issue
wallet:keplr
wallet:metamask
wallet:station
wallet:walletconnect
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
code/cl8y-bridge-monorepo#68
No description provided.