Include sections for Safeharbor/BugBounties updates #47

0xBasset · 2025-05-30T17:12:44Z

No description provided.

amusingaxl · 2025-09-18T20:27:54Z

spell/spell-crafter-mainnet-workflow.md

+    * [ ] Update safeharbor script
+      ```bash
+      cd scripts/safeharbor
+      npm install
+      ```
+    * [ ] Run `npm run generate` command in the `spells-mainnet` repo to check for bug bounty updates
+    * [ ] IF the command outputs hex encoded call:


Shouldn't make all that available from the main Makefile?
Check the cast-on-tenderly entry there for reference.

amusingaxl · 2025-09-18T20:28:12Z

spell/spell-crafter-mainnet-workflow.md

+    * [ ] Run `npm run generate` command in the `spells-mainnet` repo to check for bug bounty updates
+    * [ ] IF the command outputs hex encoded call:
+      * [ ] Add ALL output call to the spell using low-level Solidity call.
+      * [ ] The call MUST use the pattern: `(bool succ, bytes memory err) = AGREEMENT.call(<encodedDATA>);`


Aren't we using multicall now?
This way we can just pass the data and make a higher level call, which won't require us to check the success status.

The issue is that the multicall accepts:

struct Call { address target; bytes callData; } function aggregate(Call[] memory calls);

Therefore, if there are multiple calls, we would need to use the annoying syntax of:

Call memory calls = new Call[](x); calls[0] = { ... }; ... calls[x] = { ...}; multicall.aggregate(calls);

Which I personally think it's much worse in terms of clutter and amount of outputs.

I see, makes sense.
However there's another point, the script already provides the raw data for a low-level call to MULTICALL, so the checklist should reference this contract, not the agreement:

Suggested change

* [ ] The call MUST use the pattern: `(bool succ, bytes memory err) = AGREEMENT.call(<encodedDATA>);`

* [ ] The call MUST use the pattern: `(bool succ, bytes memory err) = MULTICALL.call(<encodedDATA>);`

spell/spell-reviewer-mainnet-checklist.md

amusingaxl · 2025-09-19T22:44:07Z

spell/spell-reviewer-mainnet-checklist.md

  * [ ] All actions are executed in the transaction trace
  * [ ] No reverts are present that block execution
  * [ ] No out-of-gas errors are present
+  * [ ] Confirm `make update-bug-bounty` returns empty


Suggested change

* [ ] Confirm `make update-bug-bounty` returns empty

* [ ] Confirm `make safeharbor-generate` returns empty

amusingaxl · 2025-09-19T22:44:33Z

spell/spell-crafter-mainnet-workflow.md

    * [ ] End-to-end "happy path" interaction with the module
+  * IF bug bounty updates are present
+    * [ ] Test that all bug bounty registry calls execute successfully
+    * [ ] Verify `make update-bug-bounty` returns empty diff in test environment after spell execution


Suggested change

* [ ] Verify `make update-bug-bounty` returns empty diff in test environment after spell execution

* [ ] Verify `make safeharbor-generate` returns empty diff in test environment after spell execution

amusingaxl · 2025-09-19T22:45:32Z

spell/spell-crafter-mainnet-workflow.md

    * [ ] End-to-end "happy path" interaction with the module
+  * IF bug bounty updates are present
+    * [ ] Test that all bug bounty registry calls execute successfully
+    * [ ] Verify `make update-bug-bounty` returns empty diff in test environment after spell execution


This specific step should probably be in the checklist right after "cast on tenderly".

amusingaxl · 2025-09-19T22:46:25Z

spell/spell-reviewer-mainnet-checklist.md

  * [ ] Target Contract is included in the ChainLog
  * [ ] Test Coverage is comprehensive
+* IF bug bounty registry updates are present
+  * [ ] Run `make safeharbor-verify calldata=0xhexEncodedData` command in the `spells-mainnet` repo, passing the calldata in the spell to check for it's validity.


You don't need to explicitly mention the spells-mainnet repo, as it's implied. All other actions in the checklist happen there.

Suggested change

* [ ] Run `make safeharbor-verify calldata=0xhexEncodedData` command in the `spells-mainnet` repo, passing the calldata in the spell to check for it's validity.

* [ ] Run `make safeharbor-verify calldata=<encodedDATA>` command, passing the calldata in the spell to check for it's validity.

amusingaxl · 2025-09-19T22:47:35Z

spell/spell-reviewer-mainnet-checklist.md

  * [ ] Test Coverage is comprehensive
+* IF bug bounty registry updates are present
+  * [ ] Run `make safeharbor-verify calldata=0xhexEncodedData` command in the `spells-mainnet` repo, passing the calldata in the spell to check for it's validity.
+  * [ ] Verify the call uses the correct pattern: `(bool succ, bytes memory err) = AGREEMENT.call(<encodedDATA>);`


Suggested change

* [ ] Verify the call uses the correct pattern: `(bool succ, bytes memory err) = AGREEMENT.call(<encodedDATA>);`

* [ ] Verify the call uses the correct pattern: `(bool succ, bytes memory err) = MULTICALL.call(<encodedDATA>);`

amusingaxl · 2025-09-22T19:49:36Z

spell/spell-reviewer-mainnet-checklist.md

+* IF bug bounty registry updates are present
+  * [ ] Run `make safeharbor-verify calldata=<encodedDATA>` command passing the calldata in the spell to check for it's validity.
+  * [ ] Verify the call uses the correct pattern: `(bool succ, bytes memory err) = MULTICALL.call(<encodedDATA>);`
+  * [ ] Confirm proper error handling is implemented for each call


There will be only one call. Using "for each" here might be confusing.

Suggested change

* [ ] Confirm proper error handling is implemented for each call

* [ ] Confirm proper error handling is implemented for the call

amusingaxl · 2025-09-22T19:51:24Z

spell/spell-reviewer-mainnet-checklist.md

+  * [ ] Run `make safeharbor-verify calldata=<encodedDATA>` command passing the calldata in the spell to check for it's validity.
+  * [ ] Verify the call uses the correct pattern: `(bool succ, bytes memory err) = MULTICALL.call(<encodedDATA>);`
+  * [ ] Confirm proper error handling is implemented for each call
+  * [ ] Verify the bug bounty section has appropriate comments/documentation


"Appropriate" here is too subjective.
It's probably worth expanding which are the exact comments/documentation expectations.
Probably we should take the more detailed crafter check items and adapt them here.

amusingaxl · 2025-10-13T18:28:49Z

spell/spell-crafter-mainnet-workflow.md

+      * [ ] If not already present, add the helper function to perform the call:
+```solidity
+function _updateSafeHarbor(bytes[] memory calldatas) public {
+  for (uint256 i = 0; i < calldatas.length; i++) {
+    (bool success, ) = address(AGREEMENT_ADDRESS).call(calldatas[i]);
+    require(success, "SaferHarbor call failed");
+  }
+}
+```


Hmm, not sure we want to have the function in the checklist. Maybe we just reference the archive:

Suggested change

* [ ] If not already present, add the helper function to perform the call:

```solidity

function _updateSafeHarbor(bytes[] memory calldatas) public {

for (uint256 i = 0; i < calldatas.length; i++) {

(bool success, ) = address(AGREEMENT_ADDRESS).call(calldatas[i]);

require(success, "SaferHarbor call failed");

}

}

```

* [ ] If not already present, add the helper function to perform the call, using the established archive pattern.

spell/spell-crafter-mainnet-workflow.md

SidestreamBurningBanana · 2025-10-16T13:42:37Z

spell/spell-crafter-mainnet-workflow.md

    * [ ] Sanity checks of all values added/updated by the spell function
    * [ ] End-to-end "happy path" interaction with the module
+  * IF bug bounty updates are present
+    * [ ] Test that all bug bounty registry calls execute successfully


Q: Could you please elaborate on what kind of tests should be written by the crafter? Is vm.expectCall sufficient or would the crafter have to test every new addition or deletion?

Yes, I think making sure that there are no reverts.

nit: I would still recommend adding an example of how to test it. You can omit it, however, if we are going to add a permanent test for it

Hmm, I don't think we should include testing examples on this checklist. I think a permanent set of helper functions on the spells-mainnet repo would be enough to make sure a crafter can easily test.

For example a assertAccountIsPresent(address), or general tests that check the number of items on each chain, like there are with chainlog stuff. Either way, I don't think this is the place to add those.

SidestreamBurningBanana · 2025-10-16T13:54:01Z

spell/spell-crafter-mainnet-workflow.md

  * [ ] Ensure every spell variable is declared as public/internal
+  * Bug Bounty Registry Updates
+    * [ ] Run `make safeharbor-generate` command in the `spells-mainnet` repo to check for bug bounty updates
+    * [ ] IF the command outputs a solidity snippet:


This places the Safeharbor update responsibility on the crafter. IMHO this has to come from GovFac, meaning that crafter should:

check that output of make safeharbor-generate matches the instructions provided by GovFac (who should've used the script in Week 1);

if no instructions were provided and script produces "no changes" - all is good;

if there is a mismatch, crafter should notify GovFac;

when there are instructions to execute, crafter should paste the code and follow the rest of the process as you already outlined

spell/spell-reviewer-mainnet-checklist.md

SidestreamBurningBanana · 2025-10-16T13:58:22Z

spell/spell-crafter-mainnet-workflow.md

+    * [ ] Run `make safeharbor-generate` command in the `spells-mainnet` repo to check for bug bounty updates
+    * [ ] IF the command outputs a solidity snippet:
+      * [ ] Paste the generated code into the spell as is. The code should not be modified. You may adjust formatting.
+      * [ ] Import the `AGREEMENT_ADDRESS` from the `ChainLog`


nit:

The address is fetched and not imported;

Let's not specify the exact chainlog key in the checklist, otherwise this item will get outdated after the adoption when a different key is used.

Suggested change

* [ ] Import the `AGREEMENT_ADDRESS` from the `ChainLog`

* [ ] Fetch the agreement address from the `ChainLog`

spell/spell-reviewer-mainnet-checklist.md

spell/spell-crafter-mainnet-workflow.md

SidestreamBurningBanana · 2025-10-16T14:07:20Z

spell/spell-reviewer-mainnet-checklist.md

  * [ ] Target Contract is included in the ChainLog
  * [ ] Test Coverage is comprehensive
+* IF bug bounty registry updates are present
+  * [ ] Run `make safeharbor-generate` command passing the calldata in the spell to check for it's validity.


Reviewers should also make sure that no warnings are produced by the script - neither before nor after deployment

SidestreamBurningBanana · 2025-10-28T10:29:20Z

spell/spell-reviewer-mainnet-checklist.md

  * [ ] All actions are executed in the transaction trace
  * [ ] No reverts are present that block execution
  * [ ] No out-of-gas errors are present
+  * [ ] `make safeharbor-generate` against the testnet returns "no updates"


Please also add a check for the warnings, according to this comment #47 (comment)

SidestreamBurningBanana · 2025-10-28T10:30:03Z

spell/spell-crafter-mainnet-workflow.md

  * [ ] Create testnet and cast deployed spell there using `make cast-on-tenderly spell=0x...` command
  * [ ] Check that returned `public explorer url` is publicly accessible (e.g. using incognito browser mode)
  * [ ] IF `cast-on-tenderly` command is executed several times for the same spell, delete all testnets of the same name except the last one
+* [ ] `make safeharbor-generate` returns empty diff in the testnet environment after spell was cast


nit: "empty diff" can be replaced with "no updates"

SidestreamBurningBanana · 2025-10-28T10:33:04Z

spell/spell-crafter-mainnet-workflow.md

    * [ ] Sanity checks of all values added/updated by the spell function
    * [ ] End-to-end "happy path" interaction with the module
+  * IF bug bounty updates are present
+    * [ ] Test that all bug bounty registry calls execute successfully


nit: I would still recommend adding an example of how to test it. You can omit it, however, if we are going to add a permanent test for it

SidestreamBurningBanana · 2025-10-28T10:38:52Z

spell/spell-crafter-mainnet-workflow.md

+      * [ ] If there is a mismatch, crafter should notify Governance Facilitators
+      * [ ] If the scripts outputs a warning indicated by ⚠️ ❗, notify Governance Facilitators.


There's one point about the process which I don't think has been resolved yet - timing. Currently both crafter and reviewer Safe Harbor sections are quite far into the checklists, after the tests, which leaves very little time for reacting to missing instructions (sections would probably be executed after Exec Doc was already merged).

I would therefore strongly recommend coming up with an earlier crafter and/or reviewer check to ensure that SafeHarbor instructions are as expected. As suggested in #47 (comment), this should preferably happen at one of the earliest stages as it's a simple script run + check instructions + notify govfac if needed.

Of course, GovFac would also need to amend their internal checklists, but this is out of scope of this review.

I've added a new item on the beginning of both the crafter and reviewer checklist. Please let me know your thoughts.

SidestreamBurningBanana · 2025-10-28T10:40:10Z

spell/spell-crafter-mainnet-workflow.md

+      * [ ] If the scripts outputs a warning indicated by ⚠️ ❗, notify Governance Facilitators.
+      * [ ] If the command outputs a solidity snippet that matches the instructions provided by Governance Facilitators:
+        * [ ] Paste the generated code into the spell as is. The code should not be modified. You may adjust formatting
+        * [ ] Import the `AGREEMENT_ADDRESS` from the `ChainLog`


This hasn't been addressed yet: #47 (comment)

SidestreamBurningBanana · 2025-10-28T11:00:20Z

spell/spell-crafter-mainnet-workflow.md

  * [ ] Adjust system values, collateral values inside `config.sol`
  * [ ] Ensure every spell variable is declared as public/internal
+  * Bug Bounty Registry Updates
+    * [ ] Check that output of make safeharbor-generate matches the instructions provided by Governance Facilitators


nit:

Suggested change

* [ ] Check that output of make safeharbor-generate matches the instructions provided by Governance Facilitators

* [ ] Check that output of `make safeharbor-generate` matches the instructions provided by Governance Facilitators

0xBasset requested review from 0x3phemeralsoul and amusingaxl May 30, 2025 17:12

0xBasset self-assigned this May 30, 2025

0x3phemeralsoul requested a review from oddaf June 4, 2025 13:39

0x3phemeralsoul previously approved these changes Jul 7, 2025

View reviewed changes

oddaf previously approved these changes Jul 17, 2025

View reviewed changes

0xBasset dismissed stale reviews from oddaf and 0x3phemeralsoul via b336b8f September 17, 2025 13:13

amusingaxl reviewed Sep 18, 2025

View reviewed changes

spell/spell-reviewer-mainnet-checklist.md Outdated Show resolved Hide resolved

amusingaxl reviewed Sep 19, 2025

View reviewed changes

amusingaxl reviewed Sep 22, 2025

View reviewed changes

0xBasset added 8 commits September 24, 2025 09:26

add sections for safeharbor adoption

2fef81d

update sections to reflect latest script

1f5dce0

adjust to use make commands

f0c79a5

add calldata to dictionary

4060365

fix script name error and other comments adjustments

ffbea9f

remame script elsewhere too

0766476

remove required comments

18f5fab

remove item on comment verification

10ee338

0xBasset force-pushed the safeHarbor branch from fa99756 to 10ee338 Compare September 24, 2025 12:29

adjust list to adhere to new code format

11f6ac4

amusingaxl reviewed Oct 13, 2025

View reviewed changes

remove function from checklist

93cbffa

SidestreamBurningBanana reviewed Oct 16, 2025

View reviewed changes

addressed PR comments

5a1528b

SidestreamBurningBanana reviewed Oct 28, 2025

View reviewed changes

address another round of PR reviews

fd2383a

	* [ ] The call MUST use the pattern: `(bool succ, bytes memory err) = AGREEMENT.call(<encodedDATA>);`
	* [ ] The call MUST use the pattern: `(bool succ, bytes memory err) = MULTICALL.call(<encodedDATA>);`

	* [ ] Confirm `make update-bug-bounty` returns empty
	* [ ] Confirm `make safeharbor-generate` returns empty

	* [ ] Verify `make update-bug-bounty` returns empty diff in test environment after spell execution
	* [ ] Verify `make safeharbor-generate` returns empty diff in test environment after spell execution

	* [ ] Run `make safeharbor-verify calldata=0xhexEncodedData` command in the `spells-mainnet` repo, passing the calldata in the spell to check for it's validity.
	* [ ] Run `make safeharbor-verify calldata=<encodedDATA>` command, passing the calldata in the spell to check for it's validity.

	* [ ] Verify the call uses the correct pattern: `(bool succ, bytes memory err) = AGREEMENT.call(<encodedDATA>);`
	* [ ] Verify the call uses the correct pattern: `(bool succ, bytes memory err) = MULTICALL.call(<encodedDATA>);`

	* [ ] Confirm proper error handling is implemented for each call
	* [ ] Confirm proper error handling is implemented for the call

	* [ ] Import the `AGREEMENT_ADDRESS` from the `ChainLog`
	* [ ] Fetch the agreement address from the `ChainLog`

		* [ ] If there is a mismatch, crafter should notify Governance Facilitators
		* [ ] If the scripts outputs a warning indicated by ⚠️ ❗, notify Governance Facilitators.

	* [ ] Check that output of make safeharbor-generate matches the instructions provided by Governance Facilitators
	* [ ] Check that output of `make safeharbor-generate` matches the instructions provided by Governance Facilitators

Include sections for Safeharbor/BugBounties updates #47

Are you sure you want to change the base?

Include sections for Safeharbor/BugBounties updates #47

Uh oh!

Conversation

0xBasset commented May 30, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

amusingaxl Sep 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

amusingaxl Sep 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

amusingaxl Sep 18, 2025 •

edited

Loading

amusingaxl Sep 19, 2025 •

edited

Loading