fix(gmx-v2-plugin): sync to okx + biz-type/strategy attribution (v0.2.7)#81
Conversation
mig-pre and okx are at the same v0.2.6 version but code diverged
(4 files / 30 insertions / 93 deletions on okx-side). This PR brings
mig-pre's source in line with okx, then layers biz-type/strategy on top.
== New in v0.2.7 ==
Add `--biz-type dapp --strategy gmx-v2-plugin` to all onchainos
`wallet contract-call` invocations. Attribution lives in 2 functions:
`wallet_contract_call` and `wallet_contract_call_with_gas`.
`env!("CARGO_PKG_NAME")` keeps the strategy name in sync with Cargo.toml.
Also fixed pre-existing version drift in `.claude-plugin/plugin.json`
(was "0.2.2" while plugin.yaml/Cargo.toml were "0.2.6"; now consistent
at "0.2.7").
EVM-012 sweep deferred to a follow-up PR; this PR's scope is attribution.
Version bump: 0.2.6 → 0.2.7 (PATCH).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
GeoGu360
added
the
ci-approved
🔨 Phase 2: Build Verification — ✅ PASSED
Build succeeded. Compiled artifact uploaded as workflow artifact. Source integrity: commit SHA `` is the content fingerprint. |
📋 Phase 3: AI Code Review Report — Score: 92/100
1. Plugin Overview
Summary: A Rust-based plugin for trading perpetuals and managing GM pool liquidity on GMX V2 (Arbitrum and Avalanche). It supports opening/closing leveraged positions, placing limit/stop orders, depositing/withdrawing liquidity, and claiming funding fees, with all write operations routed through Target Users: DeFi traders who want to interact with GMX V2 perpetuals via an AI agent, including those running leveraged strategies, providing liquidity, or managing existing positions. 2. Architecture AnalysisComponents: Skill (SKILL.md) + Rust binary (gmx-v2-plugin) Skill Structure: Well-structured SKILL.md with sections for Pre-flight Dependencies, Architecture, Supported Chains, GMX V2 Key Concepts, Execution Flow, Pre-flight Checks, 11 commands (quickstart, list-markets, get-prices, get-positions, get-orders, open-position, close-position, place-order, cancel-order, deposit-liquidity, withdraw-liquidity, claim-funding-fees), Risk Warnings, Example Workflow, and Changelog. Data Flow:
Dependencies:
3. Auto-Detected Permissionsonchainos Commands Used
Wallet Operations
External APIs / URLs
Chains Operated OnArbitrum (42161) and Avalanche (43114) — EVM chains for GMX V2 perpetuals trading. Overall Permission SummaryThis plugin can: query GMX markets, prices, positions, and orders (read-only); construct calldata for opening/closing leveraged positions, placing conditional orders, depositing/withdrawing GM pool liquidity, and claiming funding fees. All transaction signing and broadcasting is delegated to 4. onchainos API ComplianceDoes this plugin use onchainos CLI for all on-chain write operations?Yes — all write operations are routed through On-Chain Write Operations (MUST use onchainos)
Data Queries (allowed to use external sources)
External APIs / Libraries Detected
Verdict: ✅ Fully CompliantThe plugin correctly delegates all signing and broadcasting to 5. Security AssessmentStatic Rule Scan (C01-C09, H01-H09, M01-M08, L01-L02)
LLM Judge Analysis (L-PINJ, L-MALI, L-MEMA, L-IINJ, L-AEXE, L-FINA, L-FISO)
Toxic Flow Detection (TF001-TF006)No toxic flows detected. The plugin has H05 (financial operations) but pairs it with proper M07 boundary declaration and M08 field filtering, so TF006 does not trigger. No C01 in plugin code (only in CI-injected pre-flight, skipped per instructions), so TF005 does not trigger. Prompt Injection ScanNo instruction override, identity manipulation, hidden behavior, base64-encoded content, or invisible characters detected. SKILL.md is clear, well-structured documentation. Result: ✅ Clean Dangerous Operations CheckThe plugin involves leveraged perpetual trades, liquidity deposits/withdrawals, and contract calls. SKILL.md explicitly documents: (1) Result: ✅ Safe Data Exfiltration RiskNo environment variable access beyond standard reqwest behavior. No paths read from filesystem outside cargo standard build. All API calls are to declared GMX/RPC endpoints. No credential capture or upload patterns. Result: ✅ No Risk Overall Security Rating: 🟢 Low Risk6. Source Code SecurityLanguage & Build Config
Dependency AnalysisDependencies are well-known, actively maintained crates:
No suspicious or unmaintained dependencies. No known vulnerabilities flagged. Code Safety Audit
Does SKILL.md accurately describe what the source code does?Yes — commands described in SKILL.md map directly to source code modules in src/commands/. Pre-flight checks documented (token balance, ETH for fees, GMX min collateral) match the actual implementation. Multicall structure (sendWnt + sendTokens + createOrder) matches abi.rs. Verdict: ✅ Source Safe7. Code ReviewQuality Score: 92/100
Strengths
Issues Found
8. Language Check
9. SUMMARY.md Review
11. Recommendations
12. Reviewer SummaryOne-line verdict: A well-architected GMX V2 plugin with strong security boundaries, proper delegation to onchainos for signing, and comprehensive pre-flight checks — ready to merge. Merge recommendation: ✅ Ready to merge Blockers (if any — list every issue that MUST be fixed before merge, each prefixed with ❌): No blockers found. Non-blocking improvements:
Generated by Claude AI via Anthropic API — review the full report before approving. |
GeoGu360
added
the
approved-for-publish
✅ Phase 4: Publish CompletePlugins:
Published by Plugin Store CI |
1 participant
Both mig-pre and okx are at v0.2.6 but code diverged (4 files / 30+ / 93- on okx). Sync mig-pre to okx state + add biz-type/strategy attribution. 2 wallet_contract_call wrapper functions both covered. Also fixes pre-existing version drift in plugin.json (was 0.2.2 vs 0.2.6 in plugin.yaml/Cargo.toml). EVM-012 sweep deferred to follow-up.