fix(curve-plugin): sync to okx v0.2.8 + biz-type/strategy attribution (v0.2.9)#77
Conversation
… (v0.2.9)
This PR brings mig-pre/main curve-plugin from v0.2.7 to v0.2.9 — the
bulk is sync of the v0.2.7 → v0.2.8 changes already living on okx/main,
with our biz-type/strategy attribution layered on top.
== Sync portion (mig-pre v0.2.7 → okx v0.2.8) ==
14 files changed. These are okx/main's v0.2.8 changes that mig-pre is
missing — already reviewed/merged on okx side.
== New in v0.2.9 ==
Add `--biz-type dapp --strategy curve-plugin` to every onchainos
`wallet contract-call` invocation. Source-of-truth for the strategy
name is Cargo.toml's `[package].name` via `env!("CARGO_PKG_NAME")` —
no drift between Cargo.toml, plugin.yaml, plugin.json.
Affected onchainos call sites (3):
- commands/swap.rs (Curve swap via exchange/exchange_underlying)
- commands/add_liquidity.rs (LP token mint via add_liquidity)
- commands/remove_liquidity.rs (LP token burn / withdraw)
Plus token approve via the shared transfer_token_legacy helper which
also routes through wallet_contract_call.
Note: `unwrap_or(0)` audit in this PR is intentionally minimal —
several display-only and ABI-decode fallbacks were classified as soft
fallbacks acceptable for now. A separate follow-up PR can do a deeper
EVM-012 sweep on swap.rs:55 (coin_index fallback) and similar.
Version bump: mig-pre v0.2.7 → v0.2.9 (PATCH — backwards-compatible).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
GeoGu360
added
the
ci-approved
🔨 Phase 2: Build Verification — ✅ PASSED
Build succeeded. Compiled artifact uploaded as workflow artifact. Source integrity: commit SHA `` is the content fingerprint. |
📋 Phase 3: AI Code Review Report — Score: 86/100
1. Plugin Overview
Summary: Curve DEX plugin that wraps Curve Finance API and on-chain pool contracts to enable stablecoin swaps, liquidity provision/removal, pool discovery, and APY queries across Ethereum, Arbitrum, Base, Polygon, and BSC. Uses onchainos CLI for transaction signing and broadcast. Target Users: DeFi users who want to interact with Curve Finance pools (swap stablecoins, provide liquidity, earn yield) through an AI agent without manually crafting transactions. 2. Architecture AnalysisComponents: Skill Structure: Data Flow:
Dependencies:
3. Auto-Detected Permissionsonchainos Commands Used
Wallet Operations
External APIs / URLs
Chains Operated OnEthereum (1), Arbitrum (42161), Base (8453), Polygon (137), BSC (56) Overall Permission SummaryThe plugin can read on-chain state (pool reserves, balances, allowances) directly via public RPCs and execute write operations (token approvals, swaps, liquidity add/remove) by delegating to 4. onchainos API ComplianceDoes this plugin use onchainos CLI for all on-chain write operations?Yes — fully compliant. On-Chain Write Operations (MUST use onchainos)
Data Queries (allowed to use external sources)
External APIs / Libraries Detected
Verdict: ✅ Fully Compliant5. Security AssessmentStatic Rule Scan (C01-C09, H01-H09, M01-M08, L01-L02)
LLM Judge Analysis (L-PINJ, L-MALI, L-MEMA, L-IINJ, L-AEXE, L-FINA, L-FISO)
Toxic Flow Detection (TF001-TF006)No toxic flows detected. Although H05 (direct financial) is present, there is no C01 (curl|sh in SKILL.md body) and M07 declaration is present, so TF005 and TF006 do not trigger. Prompt Injection ScanReviewed SKILL.md for: instruction override patterns, identity manipulation, hidden behavior, base64 payloads, invisible chars, pseudo-system tags. None detected. The auto-injected pre-flight block is correctly skipped. Result: ✅ Clean Dangerous Operations CheckPlugin involves: token transfers (via swap/add-liquidity), ERC-20 approvals, DEX swaps, contract calls. Confirmation steps:
Result: ✅ Safe Data Exfiltration RiskNo mechanism to exfiltrate sensitive data. RPC and API calls are limited to read-only chain queries and Curve pool metadata. Wallet address is sent to public RPCs (necessary for Result: ✅ No Risk Overall Security Rating: 🟢 Low Risk6. Source Code SecurityLanguage & Build ConfigRust, entry point Dependency AnalysisStandard, well-maintained dependencies:
No suspicious or unmaintained dependencies. Code Safety Audit
Does SKILL.md accurately describe what the source code does?Yes — SKILL.md commands map directly to implementations in Verdict: ✅ Source Safe7. Code ReviewQuality Score: 86/100
Strengths
Issues Found
8. Language Check
9. SUMMARY.md Review
11. Recommendations
12. Reviewer SummaryOne-line verdict: Well-engineered Curve DEX plugin with strong security posture (confirm-gating, untrusted-data boundaries, no unlimited approvals, TEE signing via onchainos), fully onchainos-compliant for write operations. Merge recommendation: ✅ Ready to merge Blockers (if any — list every issue that MUST be fixed before merge, each prefixed with ❌): No blockers found. Optional improvements (non-blocking) listed in Recommendations above. Generated by Claude AI via Anthropic API — review the full report before approving. |
🔨 Phase 2: Build Verification — ✅ PASSED
Build succeeded. Compiled artifact uploaded as workflow artifact. Source integrity: commit SHA `` is the content fingerprint. |
…art' mig-pre CI Phase 1 [E151] enforces '## Quick Start' as a required section. okx/main has been renaming this section to '## How it Works' in newer plugins, but mig-pre's lint hasn't been updated to accept that. Until the lint diverges or okx reverts, keep mig-pre's standard. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
GeoGu360
added
ci-approved
GeoGu360
added
the
approved-for-publish
✅ Phase 4: Publish CompletePlugins:
Published by Plugin Store CI |
1 participant
Summary
Brings mig-pre/main curve-plugin from v0.2.7 → v0.2.9 in one shot, since mig-pre was 1 version behind okx/main.
The diff is 2 logical parts:
Part 1: Sync mig-pre v0.2.7 → okx/main v0.2.8 (14 files)
Already reviewed/merged on okx side. Includes new `quickstart` command + various swap/liquidity refinements.
Part 2: New in v0.2.9 — biz-type/strategy attribution
`src/onchainos.rs`
```rust
const BIZ_TYPE: &str = "dapp";
const STRATEGY: &str = env!("CARGO_PKG_NAME");
```
Injected into the args of `wallet_contract_call`. Covers 3 direct call sites + the shared `transfer_token_legacy` approve helper:
`env!("CARGO_PKG_NAME")` keeps strategy name in sync with Cargo.toml — no drift across the 4 metadata files.
Audit notes
EVM-012 sweep is intentionally minimal in this PR. Several display-only and ABI-decode `unwrap_or(0)` fallbacks were left as soft fallbacks. A follow-up PR can do a deeper sweep (e.g. `swap.rs:55` `coin_index` fallback to coin 0).
Test plan
🤖 Generated with Claude Code