fix: audit hardening bundle (M-2/M-3/M-8/M-12–14/M-19 + L-8–10/L-16/L-20/L-21) (#25)

PlasticDigits commented

2026-08-08 04:59:56 +00:00

(Migrated from gitlab.com)

Summary

Implements the #25 audit hardening bundle from audits/INTERNAL_KIMIK3_1786162831.md:

M-2/M-3: Window deposit/withdraw revert on zero output (INV-SWAP-003/004) before mint/burn/treasury msgs
M-8: Bump cw20-mintable to PlasticDigits/cw20-mintable#1 (INV-MINTER-001 — UpdateMinter clears MINTERS)
M-12: BSC HTTP transport timeouts + tick wall-clock timeout
M-13: Fail-hard Terra account JSON parse (BaseAccount / vesting)
M-14: Adaptive gas max(configured, network_min) with documented fallback
M-19: wiremock oracle-service network tests; window multitest backfills (stale withdraw, rolling reset, governance)
L-8: .env.* gitignore + gitleaks allowlists for public docs/addresses
L-9: liveness mutex recovers via into_inner
L-10: SIGTERM/SIGINT graceful shutdown
L-16: GET /healthz process-up probe (not rate-freshness)
L-20: ust1-common u128::MAX / proptest edge tests
L-21: instantiate/migrate require vFDUSD decimals ≥ UST1 (INV-DECIMALS-001)

Docs/skills: README invariants, docs/DEPLOYMENT.md env table, skills/audit-hardening-bundle.

Acceptance checklist

M-2/M-3 dust deposit/withdraw revert; multitests green
M-8 UpdateMinter(None) removes map entry; rev bumped; fork tests
M-12 hung RPC cannot block past tick timeout
M-13 malformed account JSON fails clearly
M-14 gas uses at least network minimum when probe available; fallback documented
M-19 oracle-service network tests + named window gaps backfilled
L-8 .env.* ignored; gitleaks clean on intentional scan
L-9 poisoned mutex does not abort via expect
L-10 SIGTERM exits gracefully (select + clean log)
L-16 /healthz shipped; docs updated (process-up only)
L-20 new property/edge tests merged
L-21 instantiate rejects decimal inversion; 6/6 happy path works

Out of scope / follow-ups

H-1 deposit min_ust1_out / fee cap (separate)
C-1/C-2/C-3 (wire drift, circuit breaker, ConfirmTx) — other issues
H-3 poll vs silence defaults — issue #24
Re-storing mainnet UST1 wasm for M-8 (fork fix applies to future stores unless migrated)

Test plan

cargo test -p ust1-window --lib (20)
cargo test -p ust1-common --lib (22)
cargo test -p ust1-oracle-service (30)
cargo clippy -p ust1-oracle-service -p ust1-window -p ust1-common -- -D warnings
git check-ignore -v .env.local
gitleaks detect --config .gitleaks.toml (clean)
Manual: SIGTERM against running oracle-service → exit 0 after log
Manual: curl $HEALTHZ_BIND/healthz → 200

Closes #25

## Summary Implements the [#25](https://gitlab.com/PlasticDigits/ust1-window/-/issues/25) audit hardening bundle from `audits/INTERNAL_KIMIK3_1786162831.md`: - **M-2/M-3:** Window deposit/withdraw revert on zero output (`INV-SWAP-003/004`) before mint/burn/treasury msgs - **M-8:** Bump `cw20-mintable` to [PlasticDigits/cw20-mintable#1](https://github.com/PlasticDigits/cw20-mintable/pull/1) (`INV-MINTER-001` — `UpdateMinter` clears `MINTERS`) - **M-12:** BSC HTTP transport timeouts + tick wall-clock timeout - **M-13:** Fail-hard Terra account JSON parse (BaseAccount / vesting) - **M-14:** Adaptive gas `max(configured, network_min)` with documented fallback - **M-19:** wiremock oracle-service network tests; window multitest backfills (stale withdraw, rolling reset, governance) - **L-8:** `.env.*` gitignore + gitleaks allowlists for public docs/addresses - **L-9:** liveness mutex recovers via `into_inner` - **L-10:** SIGTERM/SIGINT graceful shutdown - **L-16:** `GET /healthz` process-up probe (not rate-freshness) - **L-20:** `ust1-common` u128::MAX / proptest edge tests - **L-21:** instantiate/migrate require vFDUSD decimals ≥ UST1 (`INV-DECIMALS-001`) Docs/skills: README invariants, `docs/DEPLOYMENT.md` env table, `skills/audit-hardening-bundle`. ## Acceptance checklist - [x] M-2/M-3 dust deposit/withdraw revert; multitests green - [x] M-8 UpdateMinter(None) removes map entry; rev bumped; fork tests - [x] M-12 hung RPC cannot block past tick timeout - [x] M-13 malformed account JSON fails clearly - [x] M-14 gas uses at least network minimum when probe available; fallback documented - [x] M-19 oracle-service network tests + named window gaps backfilled - [x] L-8 `.env.*` ignored; gitleaks clean on intentional scan - [x] L-9 poisoned mutex does not abort via expect - [x] L-10 SIGTERM exits gracefully (select + clean log) - [x] L-16 `/healthz` shipped; docs updated (process-up only) - [x] L-20 new property/edge tests merged - [x] L-21 instantiate rejects decimal inversion; 6/6 happy path works ## Out of scope / follow-ups - H-1 deposit `min_ust1_out` / fee cap (separate) - C-1/C-2/C-3 (wire drift, circuit breaker, ConfirmTx) — other issues - H-3 poll vs silence defaults — issue #24 - Re-storing mainnet UST1 wasm for M-8 (fork fix applies to future stores unless migrated) ## Test plan - [x] `cargo test -p ust1-window --lib` (20) - [x] `cargo test -p ust1-common --lib` (22) - [x] `cargo test -p ust1-oracle-service` (30) - [x] `cargo clippy -p ust1-oracle-service -p ust1-window -p ust1-common -- -D warnings` - [x] `git check-ignore -v .env.local` - [x] `gitleaks detect --config .gitleaks.toml` (clean) - [ ] Manual: SIGTERM against running oracle-service → exit 0 after log - [ ] Manual: `curl $HEALTHZ_BIND/healthz` → 200 Closes #25

PlasticDigits commented

2026-08-08 05:10:50 +00:00

(Migrated from gitlab.com)

mentioned in issue #25

PlasticDigits commented

2026-08-08 05:21:46 +00:00

(Migrated from gitlab.com)

Closing as duplicate of !41 (same original tip). !41 rebased onto !35 (C-3) and merged.

PlasticDigits (Migrated from gitlab.com) closed this pull request

2026-08-08 05:21:48 +00:00

Pull request closed

This pull request cannot be reopened because the branch was deleted.

Rows
Columns

fix: audit hardening bundle (M-2/M-3/M-8/M-12–14/M-19 + L-8–10/L-16/L-20/L-21) (#25) #44

Summary

Acceptance checklist

Out of scope / follow-ups

Test plan

Pull request closed