From 0b2af5d303413b875b497bc853f233a6ce642eda Mon Sep 17 00:00:00 2001 From: SidestreamStrongStrawberry Date: Tue, 13 Jan 2026 09:45:56 +0100 Subject: [PATCH 1/3] chore: update checklist --- spell/star-spell-reviewer-checklist.md | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/spell/star-spell-reviewer-checklist.md b/spell/star-spell-reviewer-checklist.md index 6c63e31..e755f03 100644 --- a/spell/star-spell-reviewer-checklist.md +++ b/spell/star-spell-reviewer-checklist.md @@ -121,10 +121,16 @@ This section outlines the review process and provides concrete action items for - [ ] Content matches description: no unrelated changes. - [ ] No security-related changes are present in this commit. - [ ] Verify solc version matches the Prime Agent protocol standard based on prior contracts. +- [ ] Specify the correct spell target data: + ``` + YYYY-MM-DD + ``` #### Spell Description & Comments -- [ ] Spell PR has clear description. +- [ ] Spell PR has a clear description. +- [ ] Spell PR has a correct spell target date. - [ ] Spell contract has a clear description. +- [ ] Spell contract has a correct spell target date. - [ ] Every significant action and parameter change are clearly commented in the code. - [ ] Every significant action has valid source url (forum post, poll, atlas). - [ ] Every parameter change is clearly commented with before/after values. @@ -165,6 +171,7 @@ This section outlines the review process and provides concrete action items for - [ ] IF source code is not audited, there is a clear explanation that was agreed upon by governance beforehand (i.e.: reusing unaudited contracts with lots of Lindy effect). - [ ] Compilation optimizations match deployment settings defined in the source code repo. - [ ] Consistent license. + - [ ] Deployer address was not used to deploy contracts on other chains UNLESS there is specific reasons for it (i.e. external contract, the same deployer was used to keep the address same across different chains) - LIST every constructor argument: - `CONSTRUCTOR_ARGUMENT_NAME` being `CONSTRUCTOR_ARGUMENT_VALUE` from EXTERNAL_SOURCE_URL - [ ] The value has valid external source. @@ -172,6 +179,7 @@ This section outlines the review process and provides concrete action items for - [ ] Expected admin address for this chain has full access (`SubProxy` on mainnet, `Executor` on other chains). - [ ] Contract deployer address has no access (e.g. `wards(deployer)` is `0`). - [ ] No other addresses has access to this contract. + - [ ] IF the contract is multisig wallet and has access to assets in the contract, all the signers should be verified. (i.e.: the same signers were used in the previous spell) #### Dependency checks - LIST every submodule or any other imported code used in this spell: @@ -284,5 +292,5 @@ EXECUTED_TESTS_LOGS - [ ] Posted spell codehash matches codehash that you verified locally. - [ ] Posted direct execution value matches the forum post. - [ ] Confirm the address (via a separate "reply to" message, restating the address to avoid edits). -- [ ] Ensure that no changes were made to the code since the spell was deployed and archived. +- [ ] Ensure that no changes were made to the code since the spell was approved at the `Deployment Stage`. - [ ] IF no blockers were found, post the completed "Handover Stage" checklist stage with the explicit pull request approval via 'Approve' review option. From c7b8951e62e5677388a300d4b73eb97a30384aa2 Mon Sep 17 00:00:00 2001 From: SidestreamStrongStrawberry Date: Tue, 13 Jan 2026 20:44:17 +0100 Subject: [PATCH 2/3] chore: updating checklist --- spell/star-spell-reviewer-checklist.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/spell/star-spell-reviewer-checklist.md b/spell/star-spell-reviewer-checklist.md index e755f03..7c18189 100644 --- a/spell/star-spell-reviewer-checklist.md +++ b/spell/star-spell-reviewer-checklist.md @@ -171,7 +171,7 @@ This section outlines the review process and provides concrete action items for - [ ] IF source code is not audited, there is a clear explanation that was agreed upon by governance beforehand (i.e.: reusing unaudited contracts with lots of Lindy effect). - [ ] Compilation optimizations match deployment settings defined in the source code repo. - [ ] Consistent license. - - [ ] Deployer address was not used to deploy contracts on other chains UNLESS there is specific reasons for it (i.e. external contract, the same deployer was used to keep the address same across different chains) + - [ ] Deployer address was not used on other chains UNLESS there is a valid reason for it (e.g., external contract, the same deployer was used to keep addresses the same across chains, etc). - LIST every constructor argument: - `CONSTRUCTOR_ARGUMENT_NAME` being `CONSTRUCTOR_ARGUMENT_VALUE` from EXTERNAL_SOURCE_URL - [ ] The value has valid external source. @@ -179,7 +179,7 @@ This section outlines the review process and provides concrete action items for - [ ] Expected admin address for this chain has full access (`SubProxy` on mainnet, `Executor` on other chains). - [ ] Contract deployer address has no access (e.g. `wards(deployer)` is `0`). - [ ] No other addresses has access to this contract. - - [ ] IF the contract is multisig wallet and has access to assets in the contract, all the signers should be verified. (i.e.: the same signers were used in the previous spell) + - [ ] IF the contract is a vault, each vault role that can have access to the funds has to be validated against trusted external sources (i.e. docs listing contracts which have that role in the vault) or against other verifiable sources. #### Dependency checks - LIST every submodule or any other imported code used in this spell: @@ -292,5 +292,5 @@ EXECUTED_TESTS_LOGS - [ ] Posted spell codehash matches codehash that you verified locally. - [ ] Posted direct execution value matches the forum post. - [ ] Confirm the address (via a separate "reply to" message, restating the address to avoid edits). -- [ ] Ensure that no changes were made to the code since the spell was approved at the `Deployment Stage`. +- [ ] Confirm that no changes have been made to the code since the "Good to deploy" comment was posted, EXCEPT for changes related to deployment. (i.e. adding the deployed spell payload, updating test code to use the deployed contract for testing). - [ ] IF no blockers were found, post the completed "Handover Stage" checklist stage with the explicit pull request approval via 'Approve' review option. From 0e5592e0f1dc5889ce188ce56a4f9544b9684639 Mon Sep 17 00:00:00 2001 From: SidestreamStrongStrawberry Date: Tue, 20 Jan 2026 09:06:36 +0100 Subject: [PATCH 3/3] chore: update structure --- spell/star-spell-reviewer-checklist.md | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/spell/star-spell-reviewer-checklist.md b/spell/star-spell-reviewer-checklist.md index 7c18189..39c0fea 100644 --- a/spell/star-spell-reviewer-checklist.md +++ b/spell/star-spell-reviewer-checklist.md @@ -121,10 +121,7 @@ This section outlines the review process and provides concrete action items for - [ ] Content matches description: no unrelated changes. - [ ] No security-related changes are present in this commit. - [ ] Verify solc version matches the Prime Agent protocol standard based on prior contracts. -- [ ] Specify the correct spell target data: - ``` - YYYY-MM-DD - ``` +- [ ] Specify the correct spell target data: `YYYY-MM-DD` #### Spell Description & Comments - [ ] Spell PR has a clear description. @@ -171,7 +168,7 @@ This section outlines the review process and provides concrete action items for - [ ] IF source code is not audited, there is a clear explanation that was agreed upon by governance beforehand (i.e.: reusing unaudited contracts with lots of Lindy effect). - [ ] Compilation optimizations match deployment settings defined in the source code repo. - [ ] Consistent license. - - [ ] Deployer address was not used on other chains UNLESS there is a valid reason for it (e.g., external contract, the same deployer was used to keep addresses the same across chains, etc). + - [ ] Deployer address was not used on other chains that star is onboarded UNLESS there is a valid reason for it (e.g., external contract, the same deployer was used to keep addresses the same across chains, etc). - LIST every constructor argument: - `CONSTRUCTOR_ARGUMENT_NAME` being `CONSTRUCTOR_ARGUMENT_VALUE` from EXTERNAL_SOURCE_URL - [ ] The value has valid external source.