Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Update Hello and Swap to authenticated calls #218
Update Hello and Swap to authenticated calls #218
Changes from 54 commits
2b827bc
afa11f1
b6a444d
a5e15a1
50e7217
f8357ad
b0f3d1b
3150e9c
d687d9c
ff28b85
e5f6c5f
b6886bf
d420ab7
936d399
7476874
c2410f0
ed3e800
68217a5
c5e2348
5e05fb0
deffb4d
382e08c
f05a97c
f7b583a
5eb0da9
1d72aee
5b6234f
44f7d72
57ceeb8
6513b52
c1ab35e
8331f22
01700ef
29bb170
0b7ac4c
34e87b4
822cb23
85f91be
1495357
1df6664
f5ad522
051ee41
cfaf6fb
9985dc7
757c438
0cbaa24
13f3299
75438c3
aa55fa3
fd03f00
91b8121
1bda9b7
84beed4
4cfaa55
16d8c13
5013b00
6a15652
c89c6da
786d629
a6d9809
83ab10b
File filter
Filter by extension
Conversations
Jump to
There are no files selected for viewing
This file was deleted.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🛠️ Refactor suggestion
Add zero address validation in constructor.
The constructor should validate that the gateway address is not zero to prevent deployment with an invalid gateway.
constructor(address payable gatewayAddress) { + if (gatewayAddress == address(0)) revert("Zero address"); gateway = GatewayEVM(gatewayAddress); }
📝 Committable suggestion
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Use SafeERC20 for token operations.
The current implementation uses unsafe ERC20 operations. Some tokens (like USDT) don't follow the standard return value pattern, which could cause the transfers to fail silently.
Apply similar changes to the
depositAndCall
function.There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
💡 Codebase verification
Return value should be IMessageDispatcher.onCall.selector
The empty bytes4 return value in the onCall function is incorrect. Based on the codebase analysis, this function is a callback from the gateway contract and should return the function selector for IMessageDispatcher.onCall to indicate successful processing.
🔗 Analysis chain
Verify the expected return value for onCall.
The function returns an empty bytes4 value. Verify if this is the expected return value by the gateway contract.
🏁 Scripts executed
The following scripts were executed for the analysis:
Script:
Length of output: 71
Script:
Length of output: 213
Script:
Length of output: 82222
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Critical: Handle approve return values to prevent silent failures.
The
approve
calls' return values are not checked, which could lead to silent failures. This is particularly critical for cross-chain operations.Apply this pattern to all approve calls in the contract:
🧰 Tools
🪛 GitHub Check: Slither
[warning] 43-65: Unused return
Universal.withdraw(bytes,uint256,address,RevertOptions) (contracts/Universal.sol#43-65) ignores return value by IZRC20(gasZRC20).approve(address(gateway),gasFee) (contracts/Universal.sol#62)
[warning] 43-65: Unused return
Universal.withdraw(bytes,uint256,address,RevertOptions) (contracts/Universal.sol#43-65) ignores return value by IZRC20(zrc20).approve(address(gateway),target) (contracts/Universal.sol#53)
Check warning
Code scanning / Slither
Unused return Medium
Check warning
Code scanning / Slither
Unused return Medium