Skip to content

August 2025 Audit fixes #137

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 7 commits into from
Aug 15, 2025
Merged

August 2025 Audit fixes #137

merged 7 commits into from
Aug 15, 2025

Conversation

stevieraykatz
Copy link
Collaborator

@stevieraykatz stevieraykatz commented Aug 13, 2025 •
edited
Loading

  1. Add strict pragma to foundry.toml
  2. Add input validation to AddrResolver and add default coinType handling to AddrResolver

@cb-heimdall
Copy link
Collaborator

cb-heimdall commented Aug 13, 2025 •
edited
Loading

✅ Heimdall Review Status

Requirement Status More Info
Reviews ✅ 1/1
Denominator calculation
Show calculation
1 if user is bot 0
1 if user is external 0
2 if repo is sensitive 0
From .codeflow.yml 1
Additional review requirements
Show calculation
Max 0
0
From CODEOWNERS 0
Global minimum 0
Max 1
1
1 if commit is unverified 0
Sum 1

@stevieraykatz stevieraykatz marked this pull request as ready for review August 13, 2025 19:01
amiecorso
amiecorso reviewed Aug 14, 2025
View reviewed changes
src/L2/resolver/AddrResolver.sol
///
/// @dev Complies with ENSIP-9 and ENSIP-11.
/// @dev Complies with ENSIP-9, ENSIP-11 and ENSIP-19.
/// Will return `default` address if there is no address set for a specific EVM cointype.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm assuming this behavior is defined in one of these ENSIPs, since returning something based on the default cointype v.s. returning nothing is definitely a meaningful change in behavior.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

does the addr get set for the default coinType when registered?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Default was a late addition to the ENSIP-19 spec.

amiecorso
amiecorso reviewed Aug 14, 2025
View reviewed changes
@amiecorso amiecorso self-requested a review August 14, 2025 02:30
@amiecorso
Copy link
Contributor

Having just added an audit to a repo, it occurs to me this could be a nice place to add the audit report that's inspiring these changes too, or just to make a ticket so as not to forget

amiecorso
amiecorso approved these changes Aug 14, 2025
View reviewed changes
Copy link
Contributor

@amiecorso amiecorso left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

mostly just some questions and a nit, otherwise lgtm! congrats on such minimal audit findings 🎉

@cb-heimdall
Copy link
Collaborator

Review Error for amiecorso @ 2025-08-14 02:33:25 UTC
User failed mfa authentication, either user does not exist or public email is not set on your github profile. \ see go/mfa-help

@amiecorso amiecorso self-requested a review August 14, 2025 02:34
amiecorso
amiecorso approved these changes Aug 14, 2025
View reviewed changes
Copy link
Contributor

@amiecorso amiecorso left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

oops gotta reapprove and hit 2fa

@cb-heimdall
Copy link
Collaborator

Review Error for amiecorso @ 2025-08-14 02:34:38 UTC
User failed mfa authentication, either user does not exist or public email is not set on your github profile. \ see go/mfa-help

@amiecorso amiecorso self-requested a review August 14, 2025 02:49
amiecorso
amiecorso previously approved these changes Aug 14, 2025
View reviewed changes
Copy link
Contributor

@amiecorso amiecorso left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

3rd time's a charm after updating iOS

@cb-heimdall
Copy link
Collaborator

Review Error for OGraham-cb @ 2025-08-14 21:49:08 UTC
User must have write permissions to review

@cb-heimdall
Copy link
Collaborator

Review Error for OGraham-cb @ 2025-08-14 22:20:22 UTC
User failed mfa authentication, either user does not exist or public email is not set on your github profile. \ see go/mfa-help

OGraham-cb
OGraham-cb previously approved these changes Aug 14, 2025
View reviewed changes
@cb-heimdall
Copy link
Collaborator

Review Error for OGraham-cb @ 2025-08-14 22:24:41 UTC
User failed mfa authentication, either user does not exist or public email is not set on your github profile. \ see go/mfa-help

@stevieraykatz stevieraykatz merged commit ba6ab36 into main Aug 15, 2025
7 checks passed
@stevieraykatz stevieraykatz deleted the audit-fixes-20250813 branch August 15, 2025 02:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@OGraham-cb OGraham-cb OGraham-cb approved these changes

@amiecorso amiecorso Awaiting requested review from amiecorso

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@stevieraykatz @cb-heimdall @amiecorso @OGraham-cb