Merge branch 'main' into joel/validator-hot-swaps

wormhole-foundation · Jan 28, 2025 · f52e8a6 · f52e8a6
2 parents b0af4b1 + c888252
commit f52e8a6
Show file tree

Hide file tree

Showing 120 changed files with 12,506 additions and 5,000 deletions.
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
@@ -40,21 +40,21 @@
 
 # Protobuf for node
 
-/proto/node/ @evan-gray @bruce-riley
+/proto/node/ @evan-gray @bruce-riley @panoel
 
 # Guardiand node
 
 ## Fallback
 
-/node/ @bruce-riley @evan-gray @SEJeff
+/node/ @bruce-riley @evan-gray @panoel @SEJeff
 
 ## Entrypoint / RPC
 
 /node/cmd/ @bruce-riley @panoel @evan-gray
 
 ## DB
 
-/node/pkg/db/ @bruce-riley @panoel
+/node/pkg/db/ @bruce-riley @evan-gray @panoel
 
 ## Accountant
 
@@ -78,11 +78,11 @@
 
 ## Public RPC
 
-/node/pkg/publicrpc/ @bruce-riley @panoel
+/node/pkg/publicrpc/ @bruce-riley @evan-gray @panoel
 
 ## Supervisor Framework
 
-/node/pkg/supervisor/ @bruce-riley @evan-gray
+/node/pkg/supervisor/ @bruce-riley @evan-gray @panoel
 
 ## Watchers
 
@@ -91,6 +91,7 @@
 ## Hacks / Tools
 
 /node/hack/ @bruce-riley @panoel @evan-gray
+/node/hack/governor @claudijd @SEJeff @djb15 @johnsaigle
 
 ## Documentation
 

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -332,7 +332,7 @@ jobs:
           go-version: "1.23.3"
       # The go-ethereum and celo-blockchain packages both implement secp256k1 using the exact same header, but that causes duplicate symbols.
       - name: Run golang tests
-        run: cd node && go test -v -timeout 5m -race -ldflags '-extldflags "-Wl,--allow-multiple-definition" ' ./...
+        run: cd node && go test -v -timeout 5m -race ./...
 
   # Run Rust lints and tests
   rust-lint-and-tests:

diff --git a/.github/workflows/wormchain-icts.yml b/.github/workflows/wormchain-icts.yml
@@ -63,6 +63,7 @@ jobs:
           - "ictest-wormchain"
           - "ictest-ibc-receiver"
           - "ictest-validator-hotswap"
+          - "ictest-cw-wormhole"
       fail-fast: false
 
     steps:

diff --git a/.golangci.yml b/.golangci.yml
@@ -28,3 +28,7 @@ issues:
       text: "^func.*supervisor.*(waitSettle|waitSettleError).*$"
       linters:
         - unused
+    # This file contains hard-coded Sui core contract addresses that are marked as hardcoded credentials.
+    - path: pkg/txverifier/sui_test.go
+
+      text: "G101: Potential hardcoded credentials"
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -23,9 +23,7 @@ and code reviews are our most important tools to accomplish that.
   Small commits, meaningful commit messages and useful comments make it easier to review code and improve the
   quality of code review as well as review turnaround times. It's much easier to spot mistakes in small,
   well-defined changes.
-- We welcome typo and grammar fixes to *public facing* documents. This includes
-  things like the whitepapers, but excludes inline code comments. PRs that touch
-  only the latter will be rejected. Fixing typos in comments alongside other non-trivial engineering work is welcome.
+- PRs that only correct typos or make minor wording adjustments will be rejected. Fixing typos alongside other non-trivial engineering work is welcome.
 - Pull requests that modify dependencies must be well-documented so that the benefits of updating can be weighed against
   security and compatibility concerns. Low-effort PRs that update dependencies without any documentation will be rejected.
 

diff --git a/Makefile b/Makefile
@@ -38,7 +38,6 @@ node: $(BIN)/guardiand
 .PHONY: $(BIN)/guardiand
 $(BIN)/guardiand: CGO_ENABLED=1
 $(BIN)/guardiand: dirs generate
-	@# The go-ethereum and celo-blockchain packages both implement secp256k1 using the exact same header, but that causes duplicate symbols.
-	cd node && go build -ldflags "-X github.com/certusone/wormhole/node/pkg/version.version=${VERSION} -extldflags -Wl,--allow-multiple-definition" \
+	cd node && go build -ldflags "-X github.com/certusone/wormhole/node/pkg/version.version=${VERSION}" \
 	  -mod=readonly -o ../$(BIN)/guardiand \
 	  github.com/certusone/wormhole/node
diff --git a/Tiltfile b/Tiltfile
@@ -604,6 +604,11 @@ if evm2:
     )
 
 
+# Note that ci_tests requires other resources in order to build properly:
+# - eth-devnet  -- required by: accountant_tests, ntt_accountant_tests, tx-verifier
+# - eth-devnet2 -- required by: accountant_tests, ntt_accountant_tests
+# - wormchain   -- required by: accountant_tests, ntt_accountant_tests
+# - solana      -- required by: spydk-ci-tests
 if ci_tests:
     docker_build(
         ref = "sdk-test-image",
@@ -635,6 +640,16 @@ if ci_tests:
             sync("./testing", "/app/testing"),
         ],
     )
+    docker_build(
+        ref = "tx-verifier-monitor", 
+        context = "./devnet/tx-verifier-monitor/",
+        dockerfile = "./devnet/tx-verifier-monitor/Dockerfile"
+    )
+    docker_build(
+        ref = "tx-verifier-test", 
+        context = "./devnet/tx-verifier-monitor/",
+        dockerfile = "./devnet/tx-verifier-monitor/Dockerfile.cast"
+    )
 
     k8s_yaml_with_ns(
         encode_yaml_stream(
@@ -644,6 +659,11 @@ if ci_tests:
                     "BOOTSTRAP_PEERS", str(ccqBootstrapPeers)),
                     "MAX_WORKERS", max_workers))
     )
+
+    # transfer-verifier -- daemon and log monitoring
+    k8s_yaml_with_ns("devnet/tx-verifier.yaml")
+
+    k8s_yaml_with_ns("devnet/tx-verifier-test.yaml")
 
     # separate resources to parallelize docker builds
     k8s_resource(
@@ -676,6 +696,20 @@ if ci_tests:
         trigger_mode = trigger_mode,
         resource_deps = [], # testing/querysdk.sh handles waiting for query-server, not having deps gets the build earlier
     )
+    # launches tx-verifier binary and sets up monitoring script
+    k8s_resource(
+        "tx-verifier-with-monitor",
+        resource_deps = ["eth-devnet"],
+        labels = ["tx-verifier"],
+        trigger_mode = trigger_mode,
+    )
+    # triggers the integration tests that will be detected by the monitor
+    k8s_resource(
+        "tx-verifier-test",
+        resource_deps = ["eth-devnet", "tx-verifier-with-monitor"],
+        labels = ["tx-verifier"],
+        trigger_mode = trigger_mode,
+    )
 
 if terra_classic:
     docker_build(

diff --git a/clients/js/src/chains/sui/utils.ts b/clients/js/src/chains/sui/utils.ts
@@ -416,7 +416,7 @@ export const setMaxGasBudgetDevnet = (
   network: Network,
   tx: TransactionBlock
 ) => {
-  if (network === "Devnet") {
+  if (network === "Devnet" || network === "Testnet") {
     // Avoid Error checking transaction input objects: GasBudgetTooHigh { gas_budget: 50000000000, max_budget: 10000000000 }
     tx.setGasBudget(10000000000);
   }

diff --git a/clients/js/src/cmds/aptos.ts b/clients/js/src/cmds/aptos.ts
@@ -57,12 +57,19 @@ export const builder = (y: typeof yargs) =>
       "init-token-bridge",
       "Init token bridge contract",
       (yargs) =>
-        yargs.option("network", NETWORK_OPTIONS).option("rpc", RPC_OPTIONS),
+        yargs
+          .option("network", NETWORK_OPTIONS)
+          .option("rpc", RPC_OPTIONS)
+          .option("contract-address", {
+            describe: "Core contract address",
+            type: "string",
+            demandOption: false,
+          }),
       async (argv) => {
         const network = getNetwork(argv.network);
-        const contract_address = evm_address(
-          contracts.tokenBridge(network, "Aptos")
-        );
+        const contract_address =
+          argv["contract-address"] ||
+          evm_address(contracts.tokenBridge(network, "Aptos"));
         const rpc = argv.rpc ?? NETWORKS[network].Aptos.rpc;
         await callEntryFunc(
           network,
@@ -104,13 +111,18 @@ export const builder = (y: typeof yargs) =>
             demandOption: true,
             describe: "Initial guardian's addresses (CSV)",
             type: "string",
+          })
+          .option("contract-address", {
+            describe: "Core contract address",
+            type: "string",
+            demandOption: false,
           }),
       async (argv) => {
         const network = getNetwork(argv.network);
 
-        const contract_address = evm_address(
-          contracts.coreBridge(network, "Aptos")
-        );
+        const contract_address =
+          argv["contract-address"] ||
+          evm_address(contracts.coreBridge(network, "Aptos"));
         const guardian_addresses = argv["guardian-address"]
           .split(",")
           .map((address) => evm_address(address).substring(24));
@@ -196,11 +208,15 @@ export const builder = (y: typeof yargs) =>
         const b = serializePackage(p);
         const seed = Buffer.from(argv["seed"], "ascii");
 
-        let module_name = APTOS_DEPLOYER_ADDRESS_DEVNET + "::deployer";
-        if (network == "Testnet" || network == "Mainnet") {
-          module_name =
-            "0x0108bc32f7de18a5f6e1e7d6ee7aff9f5fc858d0d87ac0da94dd8d2a5d267d6b::deployer";
+        let deployer = APTOS_DEPLOYER_ADDRESS_DEVNET;
+        const addresses = argv["named-addresses"]?.split(",") || [];
+        for (const addressPair of addresses) {
+          const [name, address] = addressPair.split("=");
+          if (name === "deployer") {
+            deployer = address;
+          }
         }
+        const module_name = deployer + "::deployer";
         const rpc = argv.rpc ?? NETWORKS[network].Aptos.rpc;
         await callEntryFunc(
           network,
@@ -223,12 +239,19 @@ export const builder = (y: typeof yargs) =>
             describe: "Message to send",
             demandOption: true,
           })
-          .option("network", NETWORK_OPTIONS),
+          .option("network", NETWORK_OPTIONS)
+          .option("rpc", RPC_OPTIONS)
+          .option("sender", {
+            describe: "Sender address",
+            type: "string",
+            demandOption: false,
+          }),
       async (argv) => {
         const network = getNetwork(argv.network);
-        const rpc = NETWORKS[network].Aptos.rpc;
-        let module_name = APTOS_DEPLOYER_ADDRESS_DEVNET + "::sender";
-        if (network == "Testnet" || network == "Mainnet") {
+        const rpc = argv.rpc ?? NETWORKS[network].Aptos.rpc;
+        let module_name =
+          (argv.sender || APTOS_DEPLOYER_ADDRESS_DEVNET) + "::sender";
+        if (!argv.sender && (network == "Testnet" || network == "Mainnet")) {
           module_name =
             "0x0108bc32f7de18a5f6e1e7d6ee7aff9f5fc858d0d87ac0da94dd8d2a5d267d6b::sender";
         }

diff --git a/clients/js/src/cmds/verifyVaa.ts b/clients/js/src/cmds/verifyVaa.ts
@@ -24,13 +24,18 @@ export const handler = async (
   const network = getNetwork(argv.network);
 
   const buf = Buffer.from(String(argv.vaa), "hex");
-  const contract_address = contracts.coreBridge(network, "Ethereum");
+  const contract_address =
+    network === "Testnet"
+      ? contracts.coreBridge(network, "Sepolia")
+      : contracts.coreBridge(network, "Ethereum");
   if (!contract_address) {
     throw Error(`Unknown core contract on ${network} for ethereum`);
   }
 
   const provider = new ethers.providers.JsonRpcProvider(
-    NETWORKS[network].Ethereum.rpc
+    network === "Testnet"
+      ? NETWORKS[network].Sepolia.rpc
+      : NETWORKS[network].Ethereum.rpc
   );
   const contract = Implementation__factory.connect(contract_address, provider);
   const result = await contract.parseAndVerifyVM(buf);

diff --git a/deployments/testnet/tokenBridgeVAAs.csv b/deployments/testnet/tokenBridgeVAAs.csv
@@ -30,10 +30,13 @@ Blast (36) Testnet Token Bridge,0100000000010052b4615add1ca354feb81a7f90b70a0d78
 XLayer (37) Testnet Token Bridge,01000000000100c983babda02e84e346e49f823aa201d65c82e19c51cdfb555cc9aa2fa6809f4500f6344d86722b1a8023906d185c96bc9b4e332402ae2e05ec69d0d95c39ea81000000000100000001000100000000000000000000000000000000000000000000000000000000000000040000000005b1293100000000000000000000000000000000000000000000546f6b656e4272696467650100000025000000000000000000000000da91a06299bbf302091b053c6b9ef86eff0f930d
 Linea (38) Testnet Token Bridge,01000000000100411f65a20405ad0d85d6718a91bc16cf645a7eb7dbd29d4b2d0b9cc2d872dc01112cf96dc40c07ddf648325a5dcdba42c70612179126178e7fb9e9bcfef1cb4a01000000010000000100010000000000000000000000000000000000000000000000000000000000000004000000000183785600000000000000000000000000000000000000000000546f6b656e4272696467650100000026000000000000000000000000c7a204bdbfe983fcd8d8e61d02b475d4073ff97e
 Berachain (39) Testnet Token Bridge,01000000000100c19d35faa10139fef5b3244f120efb67ad22d2d9ece7d777bcb6e957506ba9f15e2e6fd91a18dcdd6bf434d96d624fd725f957437f2e86dfdcbb6d0e97f3eeb100000000010000000100010000000000000000000000000000000000000000000000000000000000000004000000000404250300000000000000000000000000000000000000000000546f6b656e4272696467650100000027000000000000000000000000a10f2ef61de1f19f586ab8b6f2eba89bace63f7a
+SeiEVM (40) Testnet Token Bridge,0100000000010095c3bd258103e0ba1b26f63753ffd5468c3c7434ecc731e2f3e3cd84ce8e76087d7307c261470b83b4b756bed6ebd88ff5d4c9fa85d1fc9463c6802eba5e2e230000000001000000010001000000000000000000000000000000000000000000000000000000000000000400000000041ba71f00000000000000000000000000000000000000000000546f6b656e427269646765010000002800000000000000000000000023908a62110e21c04f3a4e011d24f901f911744a
 Snaxchain (43) Testnet Token Bridge,010000000001008ed60dec76f13f6da695fc5f134c8cf3527f264712e7bb98d2e54a5f457759e0491e3f1cb42eed9b84edc60a96836df98a3752c8a4e10977801e6c35a39f211b000000000100000001000100000000000000000000000000000000000000000000000000000000000000040000000005ba971e00000000000000000000000000000000000000000000546f6b656e427269646765010000002b000000000000000000000000a10f2ef61de1f19f586ab8b6f2eba89bace63f7a
 Unichain (44) Testnet Token Bridge,010000000001004f9c7be0694bcabbf1fec2300004b9d82f6a122c459fababcfdc897e894769290c9a9655015909b5c17667d63f8edcec9ad9ee2d05e7cdb24a7a64136a4312c70100000001000000010001000000000000000000000000000000000000000000000000000000000000000400000000008006e100000000000000000000000000000000000000000000546f6b656e427269646765010000002c000000000000000000000000a10f2ef61de1f19f586ab8b6f2eba89bace63f7a
 Worldchain (45) Testnet Token Bridge,01000000000100f1ae141e77e67110aecade87c6a5f9b34545638aba1a3a7dbf6a311fe58c99fd351650c8593a8161a03cc7f94b76cdc0a5978fa3e0ffbfb3738085a070172cc5010000000100000001000100000000000000000000000000000000000000000000000000000000000000040000000004f3500a00000000000000000000000000000000000000000000546f6b656e427269646765010000002d000000000000000000000000430855b4d43b8aeb9d2b9869b74d58dda79c0db2
 HyperEVM (47) Testnet Token Bridge,010000000001003f9a225a8b004c871374f69c29e8a3335614270886719a9ce30b1e5afb1df04d144208fb42b74fbfb140977a13e4fb4fa6107e625745ede6d6ddca0e4eafcb3c01000000010000000100010000000000000000000000000000000000000000000000000000000000000004000000000456642800000000000000000000000000000000000000000000546f6b656e427269646765010000002f0000000000000000000000004a8bc80ed5a4067f1ccf107057b8270e0cc11a78
+Monad (48) Testnet Token Bridge,01000000000100f55193326b0cf4dc1fe356b47a9842ff751c033e0b002b1d572ccbf8b1cb45b6770d4ce7f415fb29b4d87f75fec9e5dd15df56fc20ba401a4f07e5956394225501000000010000000100010000000000000000000000000000000000000000000000000000000000000004000000000521e4d200000000000000000000000000000000000000000000546f6b656e4272696467650100000030000000000000000000000000f323dcde4d33efe83cf455f78f9f6cc656e6b659
+Movement (49) Testnet Token Bridge,010000000001006e366ef014166b9618721b6e7c37d6a0dab510a6526061c219f88d46f39ada887a870c4aeff812795a4a78d0334567af817c54c1bfe197f0b92c357f4e49a311000000000100000001000100000000000000000000000000000000000000000000000000000000000000040000000003d9804a00000000000000000000000000000000000000000000546f6b656e42726964676501000000310000000000000000000000000000000000000000000000000000000000000002
 Gateway (3104) Testnet Token Bridge,01000000000100117d1c7a124a9e2e29d82b3803b825be7c8a1dc7f19013669f7d11d42d448aa72339fe3657e4bd156c5c28dd10e78aab3e06e9e76c4bbd38c81e057533d577c40000000000d09296c5000100000000000000000000000000000000000000000000000000000000000000049ea4b9942b23298c20000000000000000000000000000000000000000000546f6b656e4272696467650100000c20ef5251ea1e99ae48732800ccc7b83b57881232a73eb796b63b1d86ed2ea44e27
 Sepolia (10002) (Ethereum) Testnet Token Bridge,01000000000100a03841125d40e9df3cd80d027bc660191755587980e49f6a46e9baa1b5c3f6b46e51256c225bd242139ae11d3c84439acdc204a5f39a2e1acb750ae98bb759f1000000000100000001000100000000000000000000000000000000000000000000000000000000000000040000000005491ea100000000000000000000000000000000000000000000546f6b656e4272696467650100002712000000000000000000000000db5492265f6038831e89f495670ff909ade94bd9
 Arbitrum Sepolia (10003) Testnet Token Bridge,010000000001001b0fbbcc7a3e8c491dc25f0a611075513032fe444d8e6585153e6ae2cf8c7514152b050e95a3e0af11e5b2705b2efb717bec3cfaa3b1617ff623c14e61a69224000000000100000001000100000000000000000000000000000000000000000000000000000000000000040000000001b8de3c00000000000000000000000000000000000000000000546f6b656e4272696467650100002713000000000000000000000000c7a204bdbfe983fcd8d8e61d02b475d4073ff97e

diff --git a/devnet/eth-devnet.yaml b/devnet/eth-devnet.yaml
@@ -33,13 +33,16 @@ spec:
       containers:
         - name: anvil
           image: eth-node
+          # This command generates additional accounts compared to the default of 10. The purpose is to use dedicated
+          # accounts for different aspects of the test suite. When adding new integration tests, consider increasing
+          # the number of accounts below and using a fresh key for the new tests.
           command:
             - anvil
             - --silent
             - --mnemonic=myth like bonus scare over problem client lizard pioneer submit female collect
             - --block-time=1
             - --host=0.0.0.0
-            - --accounts=13
+            - --accounts=14
             - --chain-id=1337
           ports:
             - containerPort: 8545

diff --git a/devnet/eth-devnet2.yaml b/devnet/eth-devnet2.yaml
@@ -34,13 +34,16 @@ spec:
       containers:
         - name: anvil
           image: eth-node
+          # This command generates additional accounts compared to the default of 10. The purpose is to use dedicated
+          # accounts for different aspects of the test suite. When adding new integration tests, consider increasing
+          # the number of accounts below and using a fresh key for the new tests.
           command:
             - anvil
             - --silent
             - --mnemonic=myth like bonus scare over problem client lizard pioneer submit female collect
             - --block-time=1
             - --host=0.0.0.0
-            - --accounts=13
+            - --accounts=14
             - --chain-id=1397
           ports:
             - containerPort: 8545

diff --git a/devnet/tx-verifier-monitor/Dockerfile b/devnet/tx-verifier-monitor/Dockerfile
@@ -0,0 +1,10 @@
+# There's nothing special about this version, it is simply the `latest` as of
+# the creation date of this file.
+FROM alpine:3.20.3@sha256:1e42bbe2508154c9126d48c2b8a75420c3544343bf86fd041fb7527e017a4b4a
+
+RUN apk add --no-cache inotify-tools
+
+COPY monitor.sh /monitor.sh
+RUN chmod +x /monitor.sh
+
+CMD ["/monitor.sh"]
diff --git a/devnet/tx-verifier-monitor/Dockerfile.cast b/devnet/tx-verifier-monitor/Dockerfile.cast
@@ -0,0 +1,13 @@
+# These versions are pinned to match the Dockerfile in the `ethereum/`
+# directory. Otherwise, there is nothing special about them and they can be
+# updated alongside the other Dockerfile.
+FROM --platform=linux/amd64 ghcr.io/foundry-rs/foundry:nightly-55bf41564f605cae3ca4c95ac5d468b1f14447f9@sha256:8c15d322da81a6deaf827222e173f3f81c653136a3518d5eeb41250a0f2e17ea as foundry
+# node is required to install Foundry
+FROM node:19.6.1-slim@sha256:a1ba21bf0c92931d02a8416f0a54daad66cb36a85d2b73af9d73b044f5f57cfc
+
+COPY --from=foundry /usr/local/bin/cast /bin/cast
+
+COPY transfer-verifier-test.sh /transfer-verifier-test.sh
+RUN chmod +x /transfer-verifier-test.sh
+
+CMD ["/transfer-verifier-test.sh"]