Skip to content

feat: upgrade SUI token bridge on testnet - #4940

Open
douglasgalico wants to merge 1 commit into
wormhole-foundation:mainfrom
wormholelabs-xyz:feat/update_sui_tokenbrige_testnet
Open

feat: upgrade SUI token bridge on testnet#4940
douglasgalico wants to merge 1 commit into
wormhole-foundation:mainfrom
wormholelabs-xyz:feat/update_sui_tokenbrige_testnet

Conversation

@douglasgalico

Copy link
Copy Markdown
Contributor

No description provided.

@douglasgalico
douglasgalico force-pushed the feat/update_sui_tokenbrige_testnet branch from 361d3c0 to 632d568 Compare August 7, 2026 14:16
@socket-security

socket-security Bot commented Aug 7, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Addednpm/​tsx@​4.23.9881008195100
Addednpm/​@​mysten/​sui@​2.23.29910010099100

View full report

@douglasgalico
douglasgalico force-pushed the feat/update_sui_tokenbrige_testnet branch from 632d568 to f01abeb Compare August 12, 2026 14:32

@djb15 djb15 left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just some small comments, generally looks good, need to give the VAA building function another review. Could you confirm the following just for my understanding:

  1. This updated script was used to upgrade the testnet token bridge to test out the new pausing changes?
  2. The changes are required to use the new gRPC endpoints?
  3. This script will also be used for the eventual mainnet upgrade?

Comment on lines +7 to +9
* npx tsx scripts/upgrade-token-bridge-grpc.ts
*
* npx tsx scripts/upgrade-token-bridge-grpc.ts --build-only

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Comments are referencing a non-existent file

Comment on lines +21 to +22
import { secp256k1 } from "@noble/curves/secp256k1";
import { keccak_256 } from "@noble/hashes/sha3";

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This package isn't listed as an explicit direct dependency in the package.json and lock file?

/// UpgradeContract governance VAA: module "TokenBridge", action 2, chain 21,
/// payload = 32-byte build digest. Signed by the single testnet guardian
/// (guardian set index 0).
function makeUpgradeVaa(digest: Buffer, guardianKeyHex: string): Buffer {

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Mind adding some more inline comments to this function to explain the structure? Tbf the original file wasn't much better but it would be nice to verify what's going on by referring to a whitepaper or explaining in plain english how we're building the payload.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants