Feat/issue 131 gasless relay (#140)

* feat(#131): Implement EIP-2771 Gasless Transaction Relay

Implements core components for gasless transaction relay system to support
user onboarding by allowing the protocol to sponsor gas costs:

- EIP-2771 compatible trusted forwarder with meta-transaction support
- Gas sponsorship policy engine for approved operations
- Per-address rate limiting to prevent abuse (configurable per user)
- Nonce management with replay attack protection
- Sponsorship pool balance management with top-up functionality
- Comprehensive integration tests (15 test cases)

Features:
- Forward meta-transactions with deadline validation
- Track sponsorship pool deductions
- Configurable policies per operation type
- Rate limit tracking per user per time period
- Admin-only configuration operations
- Proper error handling with dedicated error codes

* feat(#131): Add signature verification for meta-transactions

Implements EIP-2771 compatible signature verification module for gasless relay:

- Ed25519 signature verification with timestamp validation
- Approved forwarder validation against whitelist
- Meta-transaction request hashing for signature verification
- Signer address validation and recovery
- Nonce-based replay attack prevention for forwarders
- Request structure validation
- Signature age checking (6-hour window)

Provides cryptographic foundation for secure meta-transaction relay operations.
Includes comprehensive unit tests for all verification functions.

* feat(#131): Implement sponsorship policy engine

Creates comprehensive policy management system for gas sponsorship:

Features:
- Detailed sponsorship policies per operation type
- Multiple sponsorship statuses: Full, Partial, Suspended, NotSponsored
- Operation eligibility checking with multiple validation points
- Gas limit enforcement per operation
- Daily transaction limits with automatic reset
- Sponsorship pool balance verification
- Operation statistics tracking (gas, cost, transaction counts)
- Policy suspension and resumption for operational control
- Policy listing and retrieval functions
- Transaction recording with stat updates

Policies support:
- Configurable gas limits per operation
- Flexible sponsorship percentage (0-100%)
- Daily transaction rate limiting
- Cost tracking per operation
- Admin-only policy management
- Policy status transitions

Includes unit tests for initialization, policy creation, and eligibility checks.

* feat(#131): Add comprehensive integration tests for gasless relay

Provides extensive integration test suite covering:

Complete flows:
- End-to-end user onboarding with gasless relay
- Replay attack prevention mechanisms
- Multi-user rate limiting scenarios
- Sponsorship pool depletion and recovery
- Policy suspension and resumption workflows

Advanced scenarios:
- Mixed full and partial sponsorship levels
- Concurrent meta-transactions from same user
- Forwarder validation and trusted forwarder enforcement
- Gas limit enforcement per operation type
- Operation statistics tracking and reporting
- Emergency pool drain recovery procedures

Edge cases:
- Nonce overflow handling
- Policy updates and versioning
- Signature expiration validation
- Daily limit reset at period boundaries
- Pool balance consistency verification
- System upgrade scenarios

16 integration test scenarios that validate:
- Correct state transitions
- Proper error conditions
- Cross-component interactions
- Resource management
- Security properties

Tests are structured to guide implementation and validate
the complete relay system functionality.

* docs(#131): Add comprehensive gasless relay documentation

Provides complete reference documentation for the gasless relay system:

Sections:
- Architecture overview of three main components
- EIP-2771 compatibility explanation
- Detailed feature descriptions (replay prevention, rate limiting, etc.)
- Usage flow with code examples
- Comprehensive error reference table
- Security considerations and best practices
- Operational procedures for monitoring and management
- Performance characteristics
- Testing strategy (unit, integration, property tests)
- Future enhancement roadmap
- Governance model and role definitions
- Cost analysis for sponsored transactions
- Production deployment and rollback procedures
- References to standards and documentation

Documentation serves as:
- Technical reference for developers
- Operational guide for administrators
- Design rationale for stakeholders
- Integration guide for contract consumers

Includes code examples, tables, and clear explanations
of all system capabilities and constraints.

* fix: Clean up unused imports to pass CI checks

Remove unused imports:
- panic_with_error from gasless_relay.rs
- ToXdr, Symbol from gasless_relay_sig_verify.rs

This resolves clippy warnings about unused imports without changing code formatting.

* fix: Resolve npm audit vulnerabilities

- meter-simulator: Fixed ip-address vulnerability (v10.4.0 or higher)
- usage-dashboard: Upgraded dependencies to address minimatch and postcss vulnerabilities
- webhook-delivery-service: Already clean (0 vulnerabilities)

Results:
- meter-simulator: 0 vulnerabilities ✓
- webhook-delivery-service: 0 vulnerabilities ✓
- usage-dashboard: 2 high severity vulnerabilities remaining (requires Next.js v16+ breaking change)

The ip-address SSRF and trust-boundary bypass vulnerabilities have been resolved.

* fix: Upgrade Next.js to resolve production dependency vulnerabilities

- Upgraded Next.js from ^14.2.35 to ^16.3.1 (breaking change)
- Pinned PostCSS to ^8.5.23 (security patch)
- Next.js v16 bundles patched versions of PostCSS and sharp

Results:
- Production audit (--omit=dev): 0 vulnerabilities ✓
- Resolves all npm audit checks on CI

Dev dependencies (minimatch in @typescript-eslint) remain but are omitted from production audit as per CI policy.

* docs: Add notes on Next.js v16 security upgrade

The upgrade from Next.js 14 to 16 resolves critical security vulnerabilities
in bundled dependencies (PostCSS, sharp). This is a necessary security fix
that allows the usage-dashboard to pass production dependency audits.

* fix: Update eslint-config-next to match Next.js v16

- Updated eslint-config-next from 14.0.4 to 16.3.1 (matches Next.js version)
- Updated TypeScript ESLint to v8.67.0
- Updated eslint to v10.8.1

Results:
- Production audit (--omit=dev): 0 vulnerabilities ✓
- Full audit (--audit-level=high): 0 vulnerabilities ✓

All npm audit CI checks now pass.

* fix: Update rand from 0.8.5 to 0.8.6 to resolve RUSTSEC-2026-0097

Upgrades rand crate to patch unsoundness vulnerability with custom logger usage.
Resolves cargo audit warning (RUSTSEC-2026-0097: rand is unsound with a custom
logger using rand::rng()).

No changes to Rust code - dependency version bump only.

* fix: Exclude root package from WASM builds (only build contracts)

The iot-payload-generator root package is for local testing and should not be
built for wasm32 target. Only build actual Soroban contracts in the contracts/
workspace.

* fix: Use --manifest-path for contracts WASM build

More explicit approach to build only the contracts workspace for WASM target.
Also update artifact path to use contracts/target instead of root target.

* fix: Add wee_alloc global allocator for WASM builds

Resolves 'no global memory allocator found' error when building Soroban contracts
for wasm32-unknown-unknown target.

Changes:
- Add wee_alloc 0.4.5 as dependency to all contracts
- Define #[global_allocator] in each contract's lib.rs
- Enable 'wasm' feature in common library for contracts that depend on it
- Feature-gate allocator for common lib (wasm-only)

This fixes the WASM compilation error across all contract packages.

* fix: Move doc comments before allocator in oracle-aggregator, add wee_alloc to settlement

- Move module doc comments in oracle-aggregator to the top of the file (before allocator)
  Inner doc comments (//!) must come first before any code
- Add wee_alloc dependency to settlement Cargo.toml
- Add allocator code to settlement lib.rs

Author: OZILSOLAR

.github/dependabot-suppress.yml

@@ -0,0 +1,10 @@
+# Suppressed vulnerabilities for expected breaking changes
+# Next.js v16 upgrade: resolves critical vulnerabilities in PostCSS and sharp
+#
+# The upgrade from Next.js 14 to 16 is a necessary security fix:
+# - Patches PostCSS vulnerabilities (XSS, path traversal)
+# - Patches sharp vulnerabilities (libvips CVEs)
+# - Required to pass production dependency audit
+#
+# Dev dependency vulnerabilities (minimatch in @typescript-eslint) are excluded
+# from production audit per CI configuration (--omit=dev)

.github/workflows/ci.yml

@@ -85,12 +85,12 @@ jobs:
         with:
           shared-key: utility-protocol-ci
       - name: Build WASM artifacts
-        run: cargo build --workspace --target wasm32-unknown-unknown --release
+        run: cargo build --manifest-path contracts/Cargo.toml --workspace --target wasm32-unknown-unknown --release
       - name: Upload WASM artifacts
         uses: actions/upload-artifact@v4
         with:
           name: wasm-artifacts
-          path: target/wasm32-unknown-unknown/release/*.wasm
+          path: contracts/target/wasm32-unknown-unknown/release/*.wasm
           if-no-files-found: error
 
   fuzz-detection:

Cargo.lock

@@ -6,7 +6,7 @@ description = "Generates mock hardware signatures and JSON payloads for local te
 
 [dependencies]
 ed25519-dalek = { version = "2.1.0", features = ["rand_core"] }
-rand = "0.8.5"
+rand = "0.8.6"
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
 chrono = { version = "0.4", features = ["serde"] }

Cargo.toml

@@ -10,3 +10,8 @@ doctest = false
 
 [dependencies]
 soroban-sdk = { workspace = true }
+wee_alloc = { version = "0.4.5", optional = true }
+
+[features]
+default = []
+wasm = ["wee_alloc"]

contracts/common/Cargo.toml

@@ -1,6 +1,10 @@
 #![no_std]
 extern crate alloc;
 
+#[cfg(all(target_arch = "wasm32", feature = "wasm"))]
+#[global_allocator]
+static ALLOC: wee_alloc::WeeAlloc = wee_alloc::WeeAlloc::INIT;
+
 pub mod errors;
 pub mod graceful_degradation;
 pub mod namespace;

contracts/common/src/lib.rs

@@ -10,6 +10,7 @@ doctest = false
 
 [dependencies]
 soroban-sdk = { workspace = true }
+wee_alloc = "0.4.5"
 
 [dev-dependencies]
 soroban-sdk = { workspace = true, features = ["testutils"] }

contracts/fees/Cargo.toml

@@ -1,5 +1,8 @@
 #![no_std]
 
+#[global_allocator]
+static ALLOC: wee_alloc::WeeAlloc = wee_alloc::WeeAlloc::INIT;
+
 use soroban_sdk::xdr::ToXdr;
 use soroban_sdk::{
     contract, contractclient, contracterror, contractimpl, contracttype,

contracts/fees/src/lib.rs

@@ -10,7 +10,7 @@ doctest = false
 
 [dependencies]
 soroban-sdk = { workspace = true }
-utility-contracts-common = { path = "../common" }
+utility-contracts-common = { path = "../common", features = ["wasm"] }
 
 [dev-dependencies]
 soroban-sdk = { workspace = true, features = ["testutils"] }

contracts/meter-aggregator/Cargo.toml

@@ -9,6 +9,7 @@ crate-type = ["lib", "cdylib"]
 doctest = false
 
 [dependencies]
+wee_alloc = "0.4.5"
 soroban-sdk = { workspace = true }
 
 [dev-dependencies]