feat: upgrade + audits fixes #87
Conversation
WalkthroughThis pull request updates various components across the project. It bumps the Changes
Possibly related PRs
Suggested reviewers
Poem
✨ Finishing Touches
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (2)
client/docs/swagger-ui/swagger.yaml (1)
73436-73571: Review of Schema Definitions for SDK Auction and MempoolThe new schema definitions (
sdk.auction.v1.Params,sdk.auction.v1.QueryParamsResponse, andsdk.mempool.v1.GetTxDistributionResponse) are clearly articulated. The properties, types, and descriptions are well detailed, making it clear to API consumers what to expect.
- For
sdk.auction.v1.Paramsandsdk.auction.v1.QueryParamsResponse, ensure that property values (e.g.,max_bundle_size,escrow_account_address, etc.) match the underlying data model and that any required validations are documented.- Consider normalizing the YAML scalar style (e.g., use of
>-versus|-) throughout the definitions for improved readability.- Confirm that the structure of
QueryParamsResponse, which includes both the nestedparamsobject and the standaloneescrow_address_stringproperty, precisely reflects the API response from the backend.go.mod (1)
288-291: Temporary Replace Directive for Cosmos IAVL
A temporary replace directive has been added to substitutegithub.com/cosmos/iavlwithgithub.com/initia-labs/iavl(v0.0.0-20250223141407-caf697dd4712) to address a statesync problem (see cosmos/cosmos-sdk#23740). Consider adding a TODO comment for future re-evaluation so that this temporary fix can be removed once the upstream issue is resolved.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (9)
Dockerfile(1 hunks)app/app.go(3 hunks)app/genesis.go(1 hunks)app/keepers/keepers.go(0 hunks)app/upgrade.go(2 hunks)client/docs/config.json(1 hunks)client/docs/swagger-ui/swagger.yaml(2 hunks)go.mod(3 hunks)scripts/protoc-swagger-gen.sh(3 hunks)
💤 Files with no reviewable changes (1)
- app/keepers/keepers.go
⏰ Context from checks skipped due to timeout of 90000ms (2)
- GitHub Check: Run test and upload codecov
- GitHub Check: Minitiad
🔇 Additional comments (20)
Dockerfile (1)
9-9: Version update for LIBMOVEVM looks good.The upgrade from v0.6.0 to v0.7.0 aligns with the overall dependency updates mentioned in the PR objectives.
client/docs/config.json (1)
199-209: Block SDK integration looks good.The addition of Block SDK's auction and mempool Swagger configurations follows the existing pattern and is properly formatted.
app/upgrade.go (2)
12-12: Version bump approved.The upgrade from 0.7.0 to 0.7.1 is consistent with the dependency updates in this PR.
33-33: Verify migration handling is properly tested.The change from simply returning the version map to running migrations is a significant functional change that alters the upgrade flow.
Have you thoroughly tested the migration process to ensure it doesn't cause issues during the upgrade? Particularly, verify that the migration handlers for all modules work as expected with the new version map.
app/genesis.go (1)
126-126: Confirm appropriate gas limit for hooks.The addition of a 3,000,000 gas limit for hooks seems reasonable, but should be verified against expected hook operations.
Did you benchmark typical hook operations to ensure this gas limit is sufficient but not excessive? This value could impact performance and security in hook execution contexts.
scripts/protoc-swagger-gen.sh (4)
14-15: Block SDK integration properly initializedThe addition of Block SDK URL and version variables follows the established pattern for dependency management in this script.
23-23: Version extraction correctly implementedThe extraction of the Block SDK version from go.mod is consistent with the approach used for other dependencies.
33-33: SDK repository cloning properly configuredThe git clone command for Block SDK follows the same pattern as other dependencies, ensuring consistency.
47-47: Proto directory inclusion correctly addedThe addition of Block SDK proto directory in the proto_dirs variable ensures proper Swagger generation for the new dependency.
app/app.go (3)
72-73: Block SDK imports properly addedThe imports for Block SDK components are correctly added with appropriate versioning (v2).
474-475: Block SDK API routes registration properly implementedThe registration of Block SDK mempool API routes follows the established pattern for service registration within the application.
505-511: Block SDK mempool service integration is completeThe integration includes proper type assertion to ensure the mempool implements the required interface, with appropriate error handling (panic) if the assertion fails.
The mempool service registration follows the same pattern as other service registrations in the application.
client/docs/swagger-ui/swagger.yaml (1)
44990-45142: Detailed Review of Auction & Mempool Endpoints DefinitionThe Swagger definitions for the
/block-sdk/auction/v1/paramsendpoint and the/block-sdk/mempool/v1/distributionendpoint are very comprehensive. The response schemas are clearly provided with detailed descriptions and proper types for each property.
- Ensure that the usage of
format: bytefor fields likeescrow_account_addressandescrow_address_stringis consistent with similar definitions elsewhere in your API.- Verify that the use of
additionalPropertieswithtype: stringandformat: uint64for thedistributionfield is intentional (rather than a numeric type) so that consumers of the API know what to expect.- Double-check that the instructions in the multi-line descriptions (using both
>-and|-scalars) are aligned with your preferred YAML style guidelines for consistency.go.mod (7)
18-19: Dependency Version Bump for Cosmos DB and Cosmos SDK
Bothgithub.com/cosmos/cosmos-dbandgithub.com/cosmos/cosmos-sdkhave been bumped to v1.1.1 and v0.50.12 respectively. Please ensure downstream modules and integrations remain fully compatible with these newer versions.
22-22: Packet Forward Middleware Update
The dependency forgithub.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v8has been updated to v8.1.1. Verify that all API contracts and middleware integration points are still functioning as expected after this change.
28-29: Initia Libraries Upgrade
Bothgithub.com/initia-labs/OPinitandgithub.com/initia-labs/initiahave been updated to v0.7.2. Confirm that these updates do not introduce any breaking changes and that all dependent functionalities are adequately tested post-upgrade.
36-36: MoveVM Dependency Alignment
The version forgithub.com/initia-labs/movevmhas been updated to v0.7.0. This change aligns with the Dockerfile’sLIBMOVEVM_VERSIONvariable, ensuring consistent versioning across the system.
37-37: Forwarding Module Upgrade
github.com/noble-assets/forwarding/v2is now at v2.0.1. As this is a patch-level update, please confirm that all interfaces utilizing this module continue to work as expected.
42-42: Cast Library Update
The dependencygithub.com/spf13/casthas been updated to v1.7.1. Review any associated deprecations or API adjustments to ensure seamless type conversions within the project.
97-97: Ledger Cosmos Go Upgrade (Indirect)
The indirect dependencygithub.com/cosmos/ledger-cosmos-gohas been updated to v0.14.0. Please verify that any ledger integrations relying on this package are unaffected by the update.
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #87 +/- ##
==========================================
- Coverage 77.39% 76.89% -0.51%
==========================================
Files 14 14
Lines 1420 1428 +8
==========================================
- Hits 1099 1098 -1
- Misses 271 280 +9
Partials 50 50
|
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
client/docs/swagger-ui/swagger.yaml (1)
65169-65181: Minor Typographical Correction in Revision Height DescriptionThere is a minor typo in the description text ("monitonically" should be "monotonically"). This small correction will enhance the clarity and professionalism of the documentation.
Suggested diff:
- height continues to be monitonically increasing even as the RevisionHeight + height continues to be monotonically increasing even as the RevisionHeight
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (7)
.github/workflows/docker.yml(0 hunks)app/app.go(3 hunks)app/genesis.go(1 hunks)app/keepers/keepers.go(0 hunks)app/upgrade.go(2 hunks)client/docs/swagger-ui/swagger.yaml(3 hunks)go.mod(3 hunks)
💤 Files with no reviewable changes (2)
- .github/workflows/docker.yml
- app/keepers/keepers.go
🚧 Files skipped from review as they are similar to previous changes (3)
- app/upgrade.go
- app/genesis.go
- go.mod
⏰ Context from checks skipped due to timeout of 90000ms (1)
- GitHub Check: Run test and upload codecov
🔇 Additional comments (5)
app/app.go (3)
73-74: Appropriate import additions for Block SDK integration.The imports for the Block SDK packages are correctly placed under the "skip-mev modules" section, maintaining the code organization.
475-476: Block SDK mempool API routes properly registered.The integration registers the Block SDK's gRPC gateway routes at the correct point in the application's API registration flow.
506-512: Block SDK mempool service registration looks good.The code correctly:
- Retrieves the application's mempool
- Performs a type assertion to ensure it implements the Block.Mempool interface
- Registers the mempool service with the application's gRPC query router
The panic is appropriate as a fail-fast mechanism if the mempool does not implement the required interface.
client/docs/swagger-ui/swagger.yaml (2)
44790-44941: New API Endpoints for Auction and Mempool ModulesThe newly added endpoints (
/block-sdk/auction/v1/paramsand/block-sdk/mempool/v1/distribution) have well-detailed response schemas, including nested properties for auction parameters and mempool transaction distribution. The descriptions are comprehensive and the use of proper types (e.g.integerwith formatint64,stringwith formatbyte, andboolean) appears consistent.One suggestion is to verify that the use of
type: stringwithformat: uint64for the mempool distribution values is intentional, as numeric values might typically use a numerical type. If this choice is dictated by backend constraints or client-side requirements, it’s acceptable. Otherwise, consider using a numeric type to better reflect the data.
73000-73135: New Schema Definitions for Auction and Mempool Response TypesThe new definitions for
sdk.auction.v1.Params,sdk.auction.v1.QueryParamsResponse, andsdk.mempool.v1.GetTxDistributionResponseprovide a clear, structured description for the API responses. Their properties and nested object structures mirror the details provided in the endpoint responses, ensuring consistency across the documentation.A couple of points for review:
- Double-check that the descriptions, especially multiline texts (using
>-and|-), are rendered as intended in Swagger UI.- Ensure that these definitions align with the actual backend implementations to avoid discrepancies between the API documentation and runtime behavior.
Overall, these additions enhance the API's clarity and usability.
Description
This PR includes dependency upgrades and also includes audit fixes.
need to wait: initia-labs/initia#349
Author Checklist
All items are required. Please add a note to the item if the item is not applicable and
please add links to any relevant follow up issues.
I have...
!in the type prefix if API or client breaking changeReviewers Checklist
All items are required. Please add a note if the item is not applicable and please add
your handle next to the items reviewed if you only reviewed selected items.
I have...
Summary by CodeRabbit
New Features
Documentation
Chores/Updates
block-sdk, in the Swagger generation process.