fix(scripts): e2e-anvil EXIT trap and MockReserveCl8y extraction (#279) #409

2026-06-03T11:42:05Z

PlasticDigits commented

2026-06-03 11:42:05 +00:00

(Migrated from gitlab.com)

Summary

Fixes GitLab #279.

Guard EXIT trap (_yieldomega_kill_pid_if_set)
MockReserveCl8y: log + broadcast fallback
Seed failure visibility; unset Cloud KEY_EVM_* in e2e-anvil
Hermetic tests in scripts-smoke

Closes #279

## Summary Fixes GitLab #279. - Guard EXIT trap (`_yieldomega_kill_pid_if_set`) - `MockReserveCl8y:` log + broadcast fallback - Seed failure visibility; unset Cloud `KEY_EVM_*` in e2e-anvil - Hermetic tests in `scripts-smoke` Closes #279

ghost1 commented

2026-06-03 11:46:00 +00:00

(Migrated from gitlab.com)

Security review (automation)

Commit reviewed: 7f2cce93839962de73d36858cbb1a1ca26c21e05

Scope: Anvil E2E / dev-deploy script reliability (#279) — scripts/e2e-anvil.sh, scripts/lib/anvil_deploy_dev.sh, DeployDev.s.sol log alignment, broadcast JSON fallback for MockReserveCl8y extraction, hermetic regressions, and unset KEY_EVM_* in e2e-anvil.

Method: Diff-only review; traced env/file inputs through grep/jq/python extractors, seed minter PK resolution, and EXIT-trap cleanup. Checked for injection, secret leakage, authz bypass, and unsafe deserialization on attacker-controlled paths.

Outcome: FINDINGS: 0 medium+

Summary: No exploitable medium-or-higher issues on this diff. Changes are confined to local Anvil / CI dev tooling (loopback RPC + chain-id guards in seed script unchanged). Labels passed to _yieldomega_extract_addr_from_log are hardcoded contract names, not external input. Broadcast fallback reads a fixed relative path under ROOT, validates 0x+40-hex addresses, and does not eval JSON contents. Unsetting Cloud KEY_EVM_* overrides before deploy reduces risk of seeding non-Anvil keys during E2E. EXIT trap guard prevents accidental kill 0 process-group signaling.

Inline threads: none (no medium+ findings).

## Security review (automation) **Commit reviewed:** `7f2cce93839962de73d36858cbb1a1ca26c21e05` **Scope:** Anvil E2E / dev-deploy script reliability ([#279](https://gitlab.com/PlasticDigits/yieldomega/-/issues/279)) — `scripts/e2e-anvil.sh`, `scripts/lib/anvil_deploy_dev.sh`, `DeployDev.s.sol` log alignment, broadcast JSON fallback for MockReserveCl8y extraction, hermetic regressions, and `unset KEY_EVM_*` in e2e-anvil. **Method:** Diff-only review; traced env/file inputs through grep/jq/python extractors, seed minter PK resolution, and EXIT-trap cleanup. Checked for injection, secret leakage, authz bypass, and unsafe deserialization on attacker-controlled paths. **Outcome:** `FINDINGS: 0` medium+ **Summary:** No exploitable medium-or-higher issues on this diff. Changes are confined to local Anvil / CI dev tooling (loopback RPC + chain-id guards in seed script unchanged). Labels passed to `_yieldomega_extract_addr_from_log` are hardcoded contract names, not external input. Broadcast fallback reads a fixed relative path under `ROOT`, validates `0x`+40-hex addresses, and does not eval JSON contents. Unsetting Cloud `KEY_EVM_*` overrides before deploy **reduces** risk of seeding non-Anvil keys during E2E. EXIT trap guard prevents accidental `kill 0` process-group signaling. **Inline threads:** none (no medium+ findings).

PlasticDigits commented

2026-06-03 11:54:33 +00:00

(Migrated from gitlab.com)

mentioned in commit c373b32777

mentioned in commit c373b32777eb5062dd7a7ca7927f78e02787b0b2

PlasticDigits (Migrated from gitlab.com) merged commit c373b32777 into main

2026-06-03 11:54:33 +00:00

Sign in to join this conversation.

No reviewers

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

code/yieldomega!409

Rows
Columns