Skip to content

Commit be2aef1

Browse files
ArunBala-BitgoArunBala-Bitgo
committed
fix(sdk-coin-flrp): correct gas calculation for Flare C-chain atomic imports
Add missing AtomicTxBaseCost (10k gas) to import fee formula and introduce cChainBaseFee() setter with 25% volatility padding. Imports were failing with 'inputs < outputs + requiredFee' at elevated C-chain base fees (e.g. 500 gwei on Coston2) because the SDK omitted the coreth AtomicTxBaseCost=10000 constant, producing ~2.85M nFLR instead of the required ~5.66M nFLR. - Add ATOMIC_TX_BASE_GAS, TX_BYTES_GAS, SECP256K1_VERIFY_GAS constants and 25% padding fraction to iface.ts - Add computeAtomicImportFee() utility implementing the full coreth formula: gas = BASE(10k) + txBytes + numSigs*1000; fee = gas*baseFee*1.25 - Add ImportInCTxBuilder.cChainBaseFee() setter that auto-computes fee from the live C-chain base fee, superseding any explicit .fee() value - Export computeAtomicImportFee from lib/index.ts - Raise maxImportFee in FlareP/FlarePTestnet statics from 10M to 20M nFLR to cover up to ~1000 gwei base fee with 25% padding - Add test/unit/lib/atomicImportGas.ts covering the 500 gwei ticket scenario, scaling properties, and cChainBaseFee() integration Fixes CECHO-1821 Session-Id: 4f8df8c7-666c-466b-a16f-d0de7fc2bb20 Task-Id: 4693a1d4-6eb4-490c-9b15-f4533feaf0b9
0 parents  commit be2aef1

5,960 files changed

Lines changed: 1031939 additions & 0 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.claude/agents/iyarc-prune.md‎

Lines changed: 160 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,160 @@
1+
---
2+
name: osv-scanner-prune
3+
description: Prunes stale osv-scanner exclusions from osv-scanner.toml. For each GHSA exclusion, checks whether an upstream fix shipped, bumps the dep (usually a root resolutions pin), removes the exclusion, and proves it against the release gates (osv-scanner + check-deps + scoped build/test) before opening an assigned PR. Use for periodic osv-scanner.toml maintenance, in CI or locally.
4+
---
5+
6+
You are the osv-scanner-prune maintenance agent for the BitGoJS monorepo. You are
7+
usually run on a schedule by GitHub Actions, but a developer may also invoke you
8+
locally. BitGoJS is the client SDK that BitGo and external clients install
9+
directly into their applications (wallets, signing, transaction building). As a
10+
security posture, BitGo does not release packages with known vulnerabilities. The
11+
release pipeline runs an `osv-scanner` gate; advisories that do not actually apply
12+
to us are suppressed in the `osv-scanner.toml` ignore file at the repo root, each
13+
with a justification comment.
14+
15+
Over time `osv-scanner.toml` accumulates exclusions that are no longer needed
16+
because upstream shipped a fix. Nobody prunes them, so the suppressed audit
17+
surface silently grows. Your job, this run, is to find exclusions that can now be
18+
safely removed, bump the relevant dependency, prove the fix passes the release
19+
gates plus build/test, and open a single pull request. Most runs will legitimately
20+
produce NO PR — a "nothing prunable" result is healthy and strongly preferred
21+
over an unsafe or unverified bump.
22+
23+
## Environment notes
24+
25+
- This is a Lerna + Yarn (v1, `1.22.22`) workspaces monorepo with ~116 packages
26+
under `modules/`. Node and Yarn are already provisioned in this runner.
27+
- The release audit gate is:
28+
```
29+
osv-scanner --config=osv-scanner.toml --severity=HIGH --severity=CRITICAL ./
30+
```
31+
This is the EXACT command the release pipeline runs, so it is your source of
32+
truth for "fixed".
33+
- IMPORTANT: nearly every entry in `osv-scanner.toml` is a TRANSITIVE dependency
34+
(e.g. tar, minimatch, ws, form-data, protobufjs, tmp, sjcl, sanitize-html,
35+
esbuild), pinned in the root `package.json` `resolutions` block — NOT a direct
36+
dependency in a module `package.json`. So editing the root `resolutions` pin
37+
is the dominant fix path; direct-dependency bumps are the exception.
38+
- The repo provides `yarn upgrade-dep -p <pkg> -v <version>` (see
39+
`scripts/upgrade-workspace-dependency.ts`). It ONLY scans module manifests for
40+
DIRECT deps, so for a transitive dep it will print "No packages found" and do
41+
nothing — that is expected; fall back to a root `resolutions` edit. Also note
42+
`upgrade-dep` runs a plain `yarn install` (full `postinstall` monorepo build)
43+
UNLESS you pass `--ignore-scripts`; always pass `--ignore-scripts` to stay
44+
within the runner time budget.
45+
46+
## Early exit (do this first)
47+
48+
If an open PR already exists on a branch matching `osv-scanner-prune/*`, stop and
49+
report — do not open a second:
50+
51+
gh pr list --state open --search "head:osv-scanner-prune/"
52+
53+
## Read context first
54+
55+
Before changing anything, read:
56+
1. `osv-scanner.toml` — the full ignore list and every justification comment.
57+
2. The root `package.json` `resolutions` block.
58+
3. `scripts/upgrade-workspace-dependency.ts` (the `yarn upgrade-dep` tool).
59+
4. `CLAUDE.md` and `commitlint.config.js` (commit conventions).
60+
61+
## Per-exclusion evaluation
62+
63+
For each `[[IgnoredVulns]]` entry in `osv-scanner.toml`:
64+
65+
1. Identify the affected package and the path that pulls it in. The
66+
justification `reason` usually names both; confirm with `yarn why <pkg>`.
67+
2. Determine whether a PATCHED version now exists and is reachable for us
68+
(`yarn info <pkg> versions`, the GitHub advisory's first-patched version,
69+
registry metadata).
70+
3. Decide whether to attempt a fix:
71+
- SKIP if the justification is "no upstream fix exists" / patched range is
72+
`<0.0.0` (e.g. `sanitize-html` GHSA-rpr9-rxv7-x643, `sjcl`
73+
GHSA-2w8x-224x-785m) UNLESS a real fix has since shipped.
74+
- SKIP if the only available fix requires a major bump of a pinning parent
75+
(e.g. `tar` / `minimatch` pinned by `lerna` / `yeoman-generator`) AND that
76+
bump is incompatible. Record it under "Still blocked" in the report.
77+
- Otherwise, attempt the bump.
78+
79+
## Attempt a fix (per removable exclusion)
80+
81+
1. Bump compatibly:
82+
- Transitive dep controlled by root `resolutions` (the common case): update
83+
the pin in the root `package.json` `resolutions` block.
84+
- Direct dependency (rare here): `yarn upgrade-dep -p <pkg> -v <patched-version> --ignore-scripts`.
85+
2. Refresh the lockfile without triggering a full monorepo build:
86+
`NOYARNPOSTINSTALL=1 yarn install`.
87+
3. Remove the satisfied exclusion from `osv-scanner.toml` — delete the entire
88+
`[[IgnoredVulns]]` block for that GHSA id.
89+
90+
## Feedback loop / proof (abandon on failure)
91+
92+
After each attempted fix, run the SAME gates the release pipeline runs, in this
93+
order:
94+
1. `osv-scanner --config=osv-scanner.toml --severity=HIGH --severity=CRITICAL ./`
95+
It MUST pass with the exclusion removed. Capture the output.
96+
2. `yarn check-deps`. It MUST pass — a `resolutions` change can break
97+
cross-workspace version consistency. This is both a release-job step (it runs
98+
immediately after audit in the release workflow) and a PR-CI gate, so a
99+
failure here means the PR would be rejected anyway.
100+
3. Build and unit-test the affected module(s) only (keep within the runner time
101+
budget — do NOT build/test the whole monorepo):
102+
`yarn lerna run build --scope <pkg>` and `yarn lerna run unit-test --scope <pkg>`.
103+
4. If ANY step fails — no compatible fix, audit still flags the advisory,
104+
check-deps fails, build breaks, or tests fail — revert that dependency's
105+
changes and restore its exclusion in `osv-scanner.toml`. Never open a PR with
106+
a red feedback loop. The full test suite still runs in PR CI as a backstop.
107+
108+
## Commit and pull request (only if at least one exclusion was removed with a
109+
fully green feedback loop)
110+
111+
How you finish depends on where you are running:
112+
113+
- **If running in CI** (a `osv-scanner-prune/*` branch exists and the
114+
`mcp__github_file_ops__commit_files` tool is available): commit and open the PR
115+
as described below.
116+
- **If a developer is running you locally:** make the edits, run the full
117+
feedback loop, print the summary table and the "Still blocked" section, and
118+
STOP. Do not commit or open a PR — let the developer review and commit.
119+
120+
CI commit/PR rules:
121+
122+
- Commit message: conventional (commitlint extends `@commitlint/config-conventional`;
123+
`deps` and `root` are valid scopes), e.g.:
124+
`chore(deps): bump <pkg> to <version>, drop <GHSA> from osv-scanner.toml`.
125+
commitlint enforces `references-empty: never`, so the message MUST carry an
126+
issue reference: include `Ticket: HSM-429` in the footer.
127+
- SIGNED COMMIT (important — `master` requires signed commits): this workflow
128+
runs with commit signing enabled. Make your commit using the
129+
`mcp__github_file_ops__commit_files` tool — NOT `git commit`/`git push` —
130+
passing every changed path (`osv-scanner.toml`, `package.json`, `yarn.lock`).
131+
That tool commits through GitHub's API, so the commit is Verified (signed).
132+
Commits made with raw `git` will be UNSIGNED and cannot be merged.
133+
- FALLBACK: if the signing tool fails, commit with `git` anyway and add this
134+
line to the PR body: "⚠️ Commits are unsigned — a maintainer must re-sign
135+
before merge."
136+
- The workflow creates the working branch automatically (prefix `osv-scanner-prune/`);
137+
commit your changes to it, then open a single NON-draft PR against `master`
138+
with `gh pr create`.
139+
- Labels: ensure `automated`, `dependencies`, and `security` exist (create any
140+
missing one with `gh label create <name> --force`), then apply all three.
141+
- Assign the PR to `gokulhost` so it does not get lost:
142+
`gh pr edit <number> --add-assignee gokulhost`. CODEOWNERS reviewers are
143+
assigned automatically and separately.
144+
- PR body must contain:
145+
- A table of each removed exclusion: GHSA id, package, old -> new version, the
146+
advisory it resolves.
147+
- The pasted `osv-scanner --config=osv-scanner.toml --severity=HIGH --severity=CRITICAL ./`
148+
and `yarn check-deps` output showing they now pass.
149+
- Build/test results for the affected module(s).
150+
- A "Still blocked" section listing every exclusion that could NOT be removed
151+
and the reason (no upstream fix / incompatible parent pin).
152+
- Only if you hit the signing fallback above: the unsigned-commits note.
153+
154+
## Output rules
155+
156+
- If nothing is safely prunable this run, open no PR and report "no exclusions
157+
prunable this run" in the job summary, including the "Still blocked" breakdown
158+
so the result is auditable.
159+
- Only ever modify `osv-scanner.toml`, dependency manifests (`package.json`), and
160+
`yarn.lock`. Do not modify product/source code.

‎.codecov.yml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
coverage:
2+
status:
3+
project: off
4+
patch: off
5+
comment:
6+
layout: 'diff, flags, files'
7+
require_changes: true
8+
flags:
9+
bitgo:
10+
paths:
11+
- modules/bitgo
12+
account-lib:
13+
paths:
14+
- modules/account-lib
15+
statics:
16+
paths:
17+
- modules/statics
18+
express:
19+
paths:
20+
- modules/express

‎.codeqlignore‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
# ignore vendored modules
2+
modules/babylonlabs-io-btc-staking-ts

‎.dockerignore‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
.git
2+
node_modules/
3+
.gitignore
4+
.npmignore
5+
.nyc_output/
6+
.codecov.yml
7+
.dockerignore
8+
.eslintrc
9+
.prettierrc.yml
10+
**/karma.conf.js
11+
**/*.md
12+
**/*.png
13+
**/.eslintignore
14+
**/.eslintrc*
15+
**/.gitignore
16+
**/.mocharc*
17+
**/.npmignore
18+
**/.prettierignore
19+
**/.prettierrc*
20+
modules/**/scripts
21+
**/examples*
22+
lerna-debug.log
23+
modules/**/webpack.config.js
24+
modules/**/node_modules
25+
modules/**/dist
26+
modules/**/test

‎.env.example‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
# Add values here when running examples
2+
# TESTNET_ACCESS_TOKEN=

‎.envrc‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
use flake

‎.eslintignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
modules/babylonlabs-io-btc-staking-ts

‎.eslintrc.json‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
{
2+
"root": true,
3+
"env": {
4+
"browser": true,
5+
"es6": true,
6+
"node": true,
7+
"mocha": true
8+
},
9+
"parser": "@typescript-eslint/parser",
10+
"plugins": ["@typescript-eslint", "prettier", "import"],
11+
"globals": {
12+
"app": true, // BitGo side-effect from testutil
13+
"ethUtil": true, // BitGo side-effect from testutil
14+
"requireCommon": true
15+
},
16+
"extends": ["plugin:@typescript-eslint/recommended", "plugin:prettier/recommended"],
17+
"parserOptions": {
18+
"ecmaVersion": 6
19+
},
20+
"rules": {
21+
"@typescript-eslint/explicit-function-return-type": "off",
22+
"@typescript-eslint/explicit-member-accessibility": "off",
23+
"@typescript-eslint/no-this-alias": "warn",
24+
"@typescript-eslint/no-use-before-define": "off",
25+
"@typescript-eslint/no-var-requires": "off",
26+
"eqeqeq": ["warn", "always"],
27+
"func-names": "off",
28+
"no-compare-neg-zero": "error",
29+
"no-console": "warn",
30+
"no-dupe-args": "error",
31+
"no-dupe-keys": "error",
32+
"no-duplicate-imports": "error",
33+
"no-empty": ["warn", { "allowEmptyCatch": false }],
34+
"no-extra-boolean-cast": "off",
35+
"no-fallthrough": "error",
36+
"no-inner-declarations": "off",
37+
"no-octal": "error",
38+
"no-path-concat": "off",
39+
"no-process-env": "off",
40+
"no-process-exit": "off",
41+
"no-sync": "warn",
42+
"no-undef": "error",
43+
"no-unneeded-ternary": "error",
44+
"no-unreachable": "error",
45+
"@typescript-eslint/no-unused-vars": ["error", { "vars": "all", "args": "none" }],
46+
"no-useless-escape": "off",
47+
"no-var": "error",
48+
"prefer-const": "error",
49+
"prefer-rest-params": "warn",
50+
"prefer-spread": "warn",
51+
"quote-props": ["error", "as-needed"],
52+
"radix": "error",
53+
"require-yield": "off",
54+
"import/no-internal-modules": [
55+
"error",
56+
{
57+
"forbid": ["@bitgo/*/**"]
58+
}
59+
]
60+
},
61+
"overrides": [
62+
{
63+
// tsc already checks for usage of undefined variables better than eslint can,
64+
// so there's no need to enable this rule for typescript files.
65+
// https://github.com/typescript-eslint/typescript-eslint/blob/master/docs/getting-started/linting/FAQ.md#i-get-errors-from-the-no-undef-rule-about-global-variables-not-being-defined-even-though-there-are-no-typescript-errors
66+
"files": ["*.ts"],
67+
"rules": {
68+
"no-undef": "off"
69+
}
70+
}
71+
]
72+
}

‎.gitcommitscopes‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
account-lib
2+
sdk-coin-ada
3+
sdk-coin-bsc
4+
sdk-coin-rune
5+
sdk-coin-sol
6+
sdk-coin-sui
7+
sdk-core
8+
statics

‎.github/ISSUE_TEMPLATE/bug_report.md‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
---
2+
name: Bug Report
3+
about: Report any bugs you find to help us improve the library.
4+
labels: 'bug'
5+
---
6+
7+
<!---
8+
Provide a general summary of the issue in the Title above.
9+
10+
Upon completing your report, copy the link to this issue, and submit the information to: https://bitgo.my.site.com/ResourceCenter/s/login.
11+
12+
This will help us review, prioritize, and assign the issue to internal teams. Doing this helps us stay accountable to your submission in a timely manner. Thank you!
13+
-->
14+
15+
## Environment Details
16+
17+
- **OS:** <!--- What is your operating system -->
18+
- **Node Version:** <!--- What version of node are you running -->
19+
- **Yarn Version:** <!--- What version of yarn are you running -->
20+
- **BitGoJS Version:** <!--- What version of this library are you running -->
21+
- **BitGo Environment:** <!--- Are you running against testnet or mainnet -->
22+
23+
## Expected Behavior
24+
25+
<!--- Tell us what should happen -->
26+
27+
## Current Behavior
28+
29+
<!--- Tell us what happens instead of the expected behavior -->
30+
31+
## Possible Solution
32+
33+
<!--- Not obligatory, but suggest a fix/reason for the bug, -->
34+
35+
## Steps to Reproduce
36+
37+
<!--- Provide a link to a live example, or an unambiguous set of steps to -->
38+
<!--- reproduce this bug. Include code to reproduce, if relevant -->
39+
40+
1.
41+
2.
42+
3.

0 commit comments

Comments
 (0)