feat: update contracts to hayabusa release by josemarinas · Pull Request #23 · vechain/stargate-contracts

josemarinas · 2025-11-05T15:42:13Z

Description

This PR aligns the contracts folder with the contracts in the main stargate repo post hayabusa upgrade.

Docs: https://docs.stargate.vechain.org/hayabusa/for-developers/contracts

Aligned with commit hash: 23125ccfd8888e4379a3c7f10aa78157a1be85c8

+    name: Check Changes in PR
+    runs-on: ubuntu-latest
+    outputs:
+      contracts-changed: ${{ steps.changes.outputs.contracts }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v3
+
+      - name: Check for changes
+        id: changes
+        uses: dorny/paths-filter@v3
+        with:
+          filters: |
+            contracts:
+              - 'packages/contracts/**'
+
+  format-contracts:


The best way to fix the issue is to explicitly set the permissions key in the workflow file, thereby restricting the permissions of the GITHUB_TOKEN to only those needed. For this workflow, setting contents: read at the root level will ensure all jobs inherit read-only access unless further privileges are needed (none are observed here). Add the following block to the top-level of the workflow (after the name: line and before the on: block). No imports or further changes elsewhere are necessary.

+    name: Format Contracts
+    runs-on: ubuntu-latest
+    needs: check-changes
+    if: needs.check-changes.outputs.contracts-changed == 'true'
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v3
+
+      - name: Use Node v20
+        uses: actions/setup-node@v3
+        with:
+          node-version-file: .nvmrc
+          cache: "yarn"
+
+      - name: Cache node_modules
+        uses: actions/cache@v3
+        with:
+          path: |
+            node_modules
+            packages/*/node_modules
+          key: ${{ runner.os }}-node-modules-${{ hashFiles('**/yarn.lock') }}
+
+      - name: Install dependencies
+        run: yarn install --frozen-lockfile
+
+      - name: Format Contracts
+        run: yarn format:contracts


To fix this issue, you should explicitly set a minimal permissions block for each job, or at the top-level of the workflow. The best way, given the limited scope, is to add a permissions: key under each job (or at the root if both jobs have the same minimal need) with contents: read. Since the workflow contains two jobs, and both only check changes or run formatters (no pushes or PR modifications), both only need contents: read. You can place the following block at the top level (after name:) or inside each job:

permissions: contents: read

For maintainability, it's conventional to place the block at the workflow root if all jobs have the same needs, but if you expect jobs to have varying permissions, you could set them per job.

Since the CodeQL error specifically flags the absence of permissions for the format-contracts job, adding the block at the root ensures that both jobs are covered by least privilege (unless they ever need more).

+    name: Check Changes in PR
+    runs-on: ubuntu-latest
+    outputs:
+      contracts-changed: ${{ steps.changes.outputs.contracts }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+
+      - name: Check for changes
+        id: changes
+        uses: dorny/paths-filter@v3
+        with:
+          filters: |
+            contracts:
+              - 'packages/contracts/**'
+
+  run-contracts-tests:


To fix the problem, add a permissions block specifying minimal (least privilege) permissions required for this workflow. Since the workflow appears to only check out code, filter paths, cache files, run tests, and invoke a reusable workflow for Slither analysis (which also looks to not require write access), the minimal set should be:

At the top-level (recommended):
Add permissions: contents: read immediately after the name: field. This will limit the built-in GITHUB_TOKEN to read-only access to repository contents for all jobs, unless overridden at the job level.

If a specific job needs more permissions, add or override a permissions block at that job.

No additional imports or methods are needed for this YAML-only change.
Edit:
Insert

permissions: contents: read

after the existing name: Thor Integration Testing (i.e., before the on: block).

+    name: SC Test ${{ matrix.label }}
+    runs-on: ubuntu-latest
+    needs: check-changes
+    if: needs.check-changes.outputs.contracts-changed == 'true'
+    env:
+      NODE_OPTIONS: "--max-old-space-size=8192"
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - shard: shard-i1
+            label: Protocol Contracts Getters
+          - shard: shard-i2
+            label: Stargate Delegation
+          - shard: shard-i3
+            label: Stargate Rewards
+          - shard: shard-i4
+            label: Boost Maturity Period
+          - shard: shard-i5
+            label: Stargate Delegation Status
+          - shard: shard-i6
+            label: Node Migration
+          - shard: shard-i7
+            label: Stargate Pausing
+          - shard: shard-i8
+            label: StargateNFT Upgradeability
+          - shard: shard-i9
+            label: Token Manager
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+
+      - name: Use Node v20
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
+        with:
+          node-version-file: .nvmrc
+          cache: "yarn"
+
+      - name: Cache node_modules
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: |
+            node_modules
+            packages/*/node_modules
+          key: ${{ runner.os }}-node-modules-${{ hashFiles('**/yarn.lock') }}
+
+      - name: Cache Solidity compilers
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: ~/.cache/hardhat-nodejs
+          key: ${{ runner.os }}-solc-${{ hashFiles('./packages/contracts/hardhat.config.ts') }}
+          restore-keys: |
+            ${{ runner.os }}-solc-
+
+      - name: Install dependencies
+        run: yarn install --frozen-lockfile
+
+      - name: Set shard environment variable
+        run: echo "SHARD=${{ matrix.shard }}" >> $GITHUB_ENV
+
+      - name: Run tests
+        run: npx dotenv -e .env.example -- yarn contracts:test:integration
+
+
+  run-slither:


To fix this issue, explicitly set the permissions key in the workflow file .github/workflows/integration-tests.yml to restrict the permissions of the GitHub Actions runner's GITHUB_TOKEN. The safest general approach is to set permissions: contents: read either at the root level (applying to all jobs by default) or to the individual job(s) flagged (in this case, the run-contracts-tests job). Since none of the existing jobs appear to require anything more than read permissions to repository contents, adding the block at the root level (top of file, under name: and on:) suffices and is most maintainable. No changes to logic or functionality elsewhere are required.

+       name: Slither Analysis
+       uses: vechain/github-actions/.github/workflows/slither.yaml@72c47d9d8d3f9ed4404f9056f48967e524b43ae9 # v.1.13.0
+       needs: check-changes
+       secrets: inherit
+       if: needs.check-changes.outputs.contracts-changed == 'true'
+       with:
+         target: "packages/contracts/"
+         solc-version: "0.8.20"
+         ignore-compile: true
+         fail-on: none
+         compile-command: 'yarn contracts:compile'
+         slither-args: '--filter-paths "(openzeppelin|mocks|interfaces|deprecated|templates|NodeManagement/NodeManagementV1.sol|NodeManagement/NodeManagementV2.sol)" --config-file slither.config.json --checklist --json slither.raw.json --markdown-root ${{ github.server_url }}/${{ github.repository }}/blob/${{ github.sha }}/'


The best way to fix this problem is to explicitly add a permissions key to your workflow YAML to restrict the scope of the GITHUB_TOKEN for all jobs or set it per-job for more granularity. Since none of the jobs appear to require write access (for example, they checkout, filter paths, run tests, and analysis), you can safely set the minimum recommended permissions, typically contents: read. You should add:

A block at the workflow root (just after name: and before or after on:), e.g.
permissions: contents: read

Alternatively, set stricter or more granular permissions under each job if any of them needs something different, but in the absence of evidence, the root block is preferred and simplest.

aikido-pr-checks · 2025-11-07T13:58:00Z

GHSA-q7jf-gf43-6x6p

GHSA-q7jf-gf43-6x6p in hono - medium severity

Summary

A flaw in the CORS middleware allowed request Vary headers to be reflected into the response, enabling attacker-controlled Vary values and potentially affecting cache behavior.

Details

The middleware previously copied the Vary header from the request when origin was not set to "*". Since Vary is a response header that should only be managed by the server, this could allow an attacker to influence caching behavior or cause inconsistent CORS handling.

Most environments will see impact only when shared caches or proxies rely on the Vary header. The practical effect varies by configuration.

Impact

May cause cache key pollution and inconsistent CORS enforcement in certain setups. No direct confidentiality, integrity, or availability impact in default configurations.

Resolution

Update to the latest patched release. The CORS middleware has been corrected to handle Vary exclusively as a response header.

Remediation Aikido suggests bumping this package to version 4.10.3 to resolve this issue
^{View details in Aikido Security}

socket-security · 2025-11-07T14:05:55Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality	Maintenance
@emotion/styled@11.14.1
dotenv-cli@8.0.0 ⏵ 10.0.0	⁺¹	⁺¹
hardhat@2.26.2 ⏵ 2.26.3	⁺¹	⁺¹	^-2

View full report

aikido-pr-checks · 2025-12-04T10:07:24Z

+  "results": [
+    {
+      "tokenId": 8,
+      "tokenManager": "0x196eBd07aB158999307B3a154AA2B1318B036407",


Exposed secret in packages/contracts/scripts/token-manager/results/migration-results-mainnet.json - high severity
Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
^{View details in Aikido Security}

aikido-pr-checks · 2025-12-04T10:07:25Z

+    },
+    {
+      "tokenId": 16,
+      "tokenManager": "0x6f54d4a2839D315fa0c5a024a94Fc33d52cb8831",


Exposed secret in packages/contracts/scripts/token-manager/results/migration-results-mainnet.json - high severity
Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
^{View details in Aikido Security}

aikido-pr-checks · 2025-12-04T10:07:26Z

+    },
+    {
+      "tokenId": 55,
+      "tokenManager": "0x3B1A4b40C48F409da974faA6F9B46FdFa94b7F81",


Exposed secret in packages/contracts/scripts/token-manager/results/migration-results-mainnet.json - high severity
Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
^{View details in Aikido Security}

aikido-pr-checks · 2025-12-04T10:07:27Z

+    },
+    {
+      "tokenId": 86,
+      "tokenManager": "0x24eB2Abd0740E9C9805355fac2Ed0325C1fD32f6",


Exposed secret in packages/contracts/scripts/token-manager/results/migration-results-mainnet.json - high severity
Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
^{View details in Aikido Security}

aikido-pr-checks · 2025-12-04T10:07:27Z

+    },
+    {
+      "tokenId": 125,
+      "tokenManager": "0xbCCa70f4179EF6b3111Bea9E4D119935A472186c",


Exposed secret in packages/contracts/scripts/token-manager/results/migration-results-mainnet.json - high severity
Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
^{View details in Aikido Security}

aikido-pr-checks · 2025-12-04T10:07:28Z

+    },
+    {
+      "tokenId": 145,
+      "tokenManager": "0x1d23d7EBA77C8cb60e6b02c9C1be520385399b54",


Exposed secret in packages/contracts/scripts/token-manager/results/migration-results-mainnet.json - high severity
Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
^{View details in Aikido Security}

aikido-pr-checks · 2025-12-04T10:07:29Z

+    },
+    {
+      "tokenId": 247,
+      "tokenManager": "0x46064958F2467053e6B395ec319D26ec3536b8de",


Exposed secret in packages/contracts/scripts/token-manager/results/migration-results-mainnet.json - high severity
Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
^{View details in Aikido Security}

aikido-pr-checks · 2025-12-04T10:07:30Z

+    },
+    {
+      "tokenId": 262,
+      "tokenManager": "0xb0545EE3eD104e1e5717B92eaaEc63C013D2253f",


Exposed secret in packages/contracts/scripts/token-manager/results/migration-results-mainnet.json - high severity
Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
^{View details in Aikido Security}

aikido-pr-checks · 2025-12-04T10:07:30Z

+    },
+    {
+      "tokenId": 427,
+      "tokenManager": "0x957c28fF311Cc81e3131E0205E9e8704132BaEbb",


Exposed secret in packages/contracts/scripts/token-manager/results/migration-results-mainnet.json - high severity
Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
^{View details in Aikido Security}

aikido-pr-checks · 2025-12-04T10:07:31Z

+    },
+    {
+      "tokenId": 451,
+      "tokenManager": "0x2312F48CB552314e73f5839d86397A7C157d9b91",


Exposed secret in packages/contracts/scripts/token-manager/results/migration-results-mainnet.json - high severity
Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
^{View details in Aikido Security}

aikido-pr-checks · 2025-12-04T10:07:32Z

+    },
+    {
+      "tokenId": 470,
+      "tokenManager": "0x55aFBbAd1dC8aC5Ce6bd4c52FFB69fCd59dDe2FB",


Exposed secret in packages/contracts/scripts/token-manager/results/migration-results-mainnet.json - high severity
Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
^{View details in Aikido Security}

aikido-pr-checks · 2025-12-04T10:07:32Z

+    },
+    {
+      "tokenId": 479,
+      "tokenManager": "0xb48F1c1FF9cf61aED70fd3A2559dfd40C07b2e79",


Exposed secret in packages/contracts/scripts/token-manager/results/migration-results-mainnet.json - high severity
Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
^{View details in Aikido Security}

aikido-pr-checks · 2025-12-04T10:07:33Z

+    },
+    {
+      "tokenId": 487,
+      "tokenManager": "0xeD1dCFf98Fb9acAb6C9c06E68D48aFd1461a0843",


Exposed secret in packages/contracts/scripts/token-manager/results/migration-results-mainnet.json - high severity
Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
^{View details in Aikido Security}

aikido-pr-checks · 2025-12-04T10:07:34Z

+    },
+    {
+      "tokenId": 503,
+      "tokenManager": "0x4e5762276a97e248d75Af6a3a67F42Fb92cc3f26",


Exposed secret in packages/contracts/scripts/token-manager/results/migration-results-mainnet.json - high severity
Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
^{View details in Aikido Security}

aikido-pr-checks · 2025-12-04T10:07:35Z

+    },
+    {
+      "tokenId": 534,
+      "tokenManager": "0xe8B723cfc0F2F63FD893263CB9AA1d1f85510ce2",


Exposed secret in packages/contracts/scripts/token-manager/results/migration-results-mainnet.json - high severity
Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
^{View details in Aikido Security}

aikido-pr-checks · 2025-12-04T10:07:36Z

+    },
+    {
+      "tokenId": 549,
+      "tokenManager": "0xCFe8f654bd1D9c1768dD883De03979763C29c3D4",


Exposed secret in packages/contracts/scripts/token-manager/results/migration-results-mainnet.json - high severity
Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
^{View details in Aikido Security}

aikido-pr-checks · 2025-12-04T10:07:36Z

+    },
+    {
+      "tokenId": 582,
+      "tokenManager": "0xB833983375081AA90037006C9FA77Af3A02FfD39",


Exposed secret in packages/contracts/scripts/token-manager/results/migration-results-mainnet.json - high severity
Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
^{View details in Aikido Security}

aikido-pr-checks · 2025-12-04T10:31:29Z

+    {
+      "tokenId": 2028,
+      "owner": "0x6066d4a02bFa80f5262d05008914F7E4e1Abc0F1",
+      "tokenManager": "0xEB29b62F78A0bCa69Ce71603815a088c47Eb595b"
