code/yieldomega
Watch
4
0
Fork
You've already forked yieldomega
 0
Code Issues 1 Pull requests 1 Projects Releases Packages Wiki Activity

fix(devops): idempotent Anvil dev-wallet seed with minter alignment (#281) #405

Merged
PlasticDigits merged 1 commit from cursor/idempotent-anvil-dev-wallet-seed-a984 into main 2026-06-03 11:32:36 +00:00
Conversation 4 Commits 1 Files changed 11 +243 -42
PlasticDigits commented 2026-06-03 11:31:58 +00:00 (Migrated from gitlab.com)

Fixes #281

Fixes #281
PlasticDigits commented 2026-06-03 11:32:36 +00:00 (Migrated from gitlab.com)

mentioned in commit ec10a7acb5

mentioned in commit ec10a7acb500fa076dfd1953b8f7b836321250f5
PlasticDigits (Migrated from gitlab.com) merged commit ec10a7acb5 into main 2026-06-03 11:32:36 +00:00
PlasticDigits commented 2026-06-03 11:32:45 +00:00 (Migrated from gitlab.com)

mentioned in issue #281

mentioned in issue #281
ghost1 commented 2026-06-03 11:36:12 +00:00 (Migrated from gitlab.com)

Security review

Commit reviewed: 707e48a704327e9d8773183ca4111ddcf7382cfa

Scope: Dev-only Anvil dev-wallet seed alignment (GitLab #281): scripts/lib/anvil_deployer_key.sh, scripts/seed-evm-dev-wallets-anvil.sh, scripts/lib/anvil_deploy_dev.sh, contracts/script/DeployDev.s.sol (YIELDOMEGA_SEED_MINTER_ADDRESS), scripts/verify-evm-dev-wallet-seed-anvil.sh, and related docs/skills.

Outcome: FINDINGS: 0 — no medium, high, or critical issues on this diff.

Security review: no medium+ findings on this diff.

Summary

This MR tightens local-dev safety: seed minter follows PRIVATE_KEY / DEPLOYER_PK (not KEY_EVM_1), adds loopback RPC + dev chain-id guards, pre-flight MINTER_ROLE checks, and idempotent minting. DeployDev extra minter grants remain behind DevOnlyChainGuard (31337/6342/6343 only). No attacker-controlled remote input path; well-known Anvil keys are documented dev-only defaults.

Inline threads: none (no findings to anchor).

Automated security review — MR !405

<!-- cursor-security-review --> ## Security review **Commit reviewed:** `707e48a704327e9d8773183ca4111ddcf7382cfa` **Scope:** Dev-only Anvil dev-wallet seed alignment (GitLab #281): `scripts/lib/anvil_deployer_key.sh`, `scripts/seed-evm-dev-wallets-anvil.sh`, `scripts/lib/anvil_deploy_dev.sh`, `contracts/script/DeployDev.s.sol` (`YIELDOMEGA_SEED_MINTER_ADDRESS`), `scripts/verify-evm-dev-wallet-seed-anvil.sh`, and related docs/skills. **Outcome:** `FINDINGS: 0` — **no medium, high, or critical issues** on this diff. Security review: no medium+ findings on this diff. ### Summary This MR tightens local-dev safety: seed minter follows `PRIVATE_KEY` / `DEPLOYER_PK` (not `KEY_EVM_1`), adds loopback RPC + dev chain-id guards, pre-flight `MINTER_ROLE` checks, and idempotent minting. `DeployDev` extra minter grants remain behind `DevOnlyChainGuard` (31337/6342/6343 only). No attacker-controlled remote input path; well-known Anvil keys are documented dev-only defaults. **Inline threads:** none (no findings to anchor). --- *Automated security review — MR !405*
PlasticDigits commented 2026-06-03 13:35:24 +00:00 (Migrated from gitlab.com)

mentioned in merge request !413

mentioned in merge request !413
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
agent:fix_bugfix

   
agent:fix_conflicts

   
agent:fix_security

   
agent:gap_analysis

   
agent:implement

   
agent:open_issues

   
agents

   
agent:security_audit

   
agent:verify
  
area
timecurve

  
arena

   
arena-v2

   
audit

   
block:feature_review

   
block:security

   
bug

   
contracts

   
design

   
devops

   
docs
Documentation

  
documentation

   
enhancement

   
epic
Epic / umbrella issue

  
feature

   
frontend

   
indexer

   
low priority
Low priority, investigate other issues first

  
megaeth

   
operations

   
ops
Deploy and operations

  
performance

   
QA

   
qa checklist

   
referrals

   
removal
Legacy removal

  
security

   
smart-contracts

   
tech-debt

   
testing

   
time-arena
TimeArena v2 revamp

  
timecurve

   
visual-qa
No labels
agent:fix_bugfix
agent:fix_conflicts
agent:fix_security
agent:gap_analysis
agent:implement
agent:open_issues
agents
agent:security_audit
agent:verify
area
timecurve
arena
arena-v2
audit
block:feature_review
block:security
bug
contracts
design
devops
docs
documentation
enhancement
epic
feature
frontend
indexer
low priority
megaeth
operations
ops
performance
QA
qa checklist
referrals
removal
security
smart-contracts
tech-debt
testing
time-arena
timecurve
visual-qa
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
code/yieldomega!405
No description provided.