Merge branch 'v2.5.0-fixes' into fix/FLY-2216-clean

Author: Luisfc68

.github/workflows/ci.yml

@@ -7,6 +7,7 @@ on: [push, pull_request, workflow_dispatch]
 
 permissions:
   contents: read
+  packages: read
 
 # A workflow run is made up of one or more jobs that can run sequentially or in parallel
 jobs:

.github/workflows/fuzz.yml

@@ -0,0 +1,53 @@
+name: Fuzz test smart contracts
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - QA-Test
+      - Stable-Test
+      - master
+      - "v*.*.*"
+  pull_request:
+    branches:
+      - QA-Test
+      - Stable-Test
+      - master
+      - "v*.*.*"
+
+permissions:
+  contents: read
+  packages: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Use Node.js 20.15.1
+        uses: actions/setup-node@0a44ba7841725637a19e28fa30b79a866c81b0a6 # v4.0.4
+        with:
+          node-version: "20.15.1"
+
+      - name: NPM Login
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: npm config set //npm.pkg.github.com/:_authToken $GITHUB_TOKEN
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: "Install Foundry"
+        uses: "foundry-rs/foundry-toolchain@50d5a8956f2e319df19e6b57539d7e2acb9f8c1e" # v1.5.0
+        with:
+          version: stable
+
+      - name: Lint contracts
+        run: npm run lint:sol
+
+      - name: Compile contracts
+        run: npm run compile
+
+      - name: Fuzz test smart contracts
+        run: npm run test:fuzz

README.md

@@ -48,7 +48,6 @@ PegIn Quotes consist of:
         uint callTime;                          // the time (in seconds) that the LP has to perform the call on behalf of the user after the deposit achieves the number of confirmations
         uint depositConfirmations;              // the number of confirmations that the LP requires before making the call
         bool callOnRegister:                    // a boolean value indicating whether the callForUser can be called on registerPegIn.
-        uint256 productFeeAmount;               // the fee payed to the network DAO
         uint256 gasFee;                         // the fee payed to the LP to cover the gas of the RSK transaction
     }
 
@@ -72,7 +71,6 @@ PegOut Quotes consist of:
         uint transferTime;                      // the time (in seconds) that the LP has to transfer on behalf of the user after the deposit achieves the number of confirmations
         uint expireDate;                        // the timestamp to consider the quote expired
         uint expireBlock;                       // the block number to consider the quote expired
-        uint256 productFeeAmount;               // the fee payed to the network DAO
         uint256 gasFee;                         // the fee payed to the LP to cover the fee of the BTC transaction
     }
 
@@ -242,6 +240,17 @@ Validates that the LP made the deposit of the service and applies the correspond
     * partialMerkleTree: PMT to validate transaction
     * merkleBranchHashes: merkleBranchHashes used by the bridge to validate transaction
 
+#### Peg-out BTC transaction structure (required)
+
+For `refundPegOut`, the contract expects a Bitcoin transaction with two specific outputs used to prove the LP delivered the service:
+
+1. **Payment output** at index `0`: pays the user destination (`quote.depositAddress`) with the peg-out amount.
+2. **Quote-hash output** at index `1`: an `OP_RETURN` output containing the peg-out quote hash.
+
+The structure is intentionally enforced by contract validation for peg-out refunding. Bitcoin consensus does not enforce output ordering, but `refundPegOut` currently validates these outputs using fixed positions. If the required outputs are present but swapped, validation fails and the LP cannot be refunded through this function.
+
+`btcTx` must be the raw Bitcoin transaction serialization without witness data.
+
 ### **refundUserPegOut**
 
     function refundUserPegOut(

package-lock.json

@@ -6,6 +6,7 @@
   "scripts": {
     "compile": "npm run lint:sol && forge build",
     "test": "npm run compile && make test-unit",
+    "test:fuzz": "npm run compile && make test-fuzz",
     "coverage": "forge coverage",
     "lint:ts": "npx prettier --check . && npx eslint .",
     "lint:sol": "solhint 'src/**/*.sol'",
@@ -48,6 +49,6 @@
   "dependencies": {
     "@openzeppelin/contracts": "^5.3.0",
     "@openzeppelin/contracts-upgradeable": "^5.3.0",
-    "@rsksmart/btc-transaction-solidity-helper": "^0.2.1"
+    "@rsksmart/btc-transaction-solidity-helper": "^0.3.0"
   }
 }