Read fee values from kvstore in the escrow contract#3812
Read fee values from kvstore in the escrow contract#3812
Conversation
- Introduced a dedicated subgraph to index HMToken statistics. - Updated network configurations for Ethereum, BSC, Polygon, and Sepolia. - Implemented event handlers for Transfer, Approval, BulkTransfer, and BulkApproval events. - Created entities for HMTokenStatistics, Holder, UniqueSender, UniqueReceiver, and EventDayData. - Added tests to validate statistics calculations and daily metrics. - Included necessary configurations, scripts, and dependencies in package.json. - Set up ESLint and Prettier configurations for code quality. -Updated TS SDK with new Subgraph data
|
The latest updates on your projects. Learn more about Vercel for GitHub. 5 Skipped Deployments
|
dnechay
left a comment
dnechay
left a comment
There was a problem hiding this comment.
Don't forget to add changesets
…ow contract - rename manifestUrl to manifest
dnechay
left a comment
dnechay
left a comment
There was a problem hiding this comment.
lgtm in general, some minor questions
packages/sdk/python/human-protocol-sdk/scripts/build-contracts.sh
Outdated
Show resolved
Hide resolved
packages/sdk/typescript/human-protocol-sdk/src/escrow/escrow_client.ts
Outdated
Show resolved
Hide resolved
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
flopez7
force-pushed
the
escrow-fee-kvstore
branch
from
2355735 to
6226ef1
Compare
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 6 hours ago
In general, the fix is to explicitly limit the GITHUB_TOKEN permissions in this workflow to the minimum required. Since this workflow only checks out code and interacts with external services using a secret API key, it can safely run with read-only repository access. The minimal, recommended baseline is contents: read. We can add this either at the workflow root (so it applies to all jobs) or under the specific subgraph job. To avoid changing functionality, we should not grant any unnecessary write scopes.
The single best fix here is to add a top-level permissions: block immediately after the name: (or on:) section, setting contents: read. This will constrain GITHUB_TOKEN for the entire workflow without altering any steps or behavior, because none of them currently rely on elevated GitHub API permissions. Concretely, in .github/workflows/cd-subgraph-hmt.yaml, insert:
permissions:
contents: readbetween the existing name: HMT Subgraph Deployment and on: (or just after on: if you prefer), keeping indentation consistent with other top-level keys.
| @@ -1,5 +1,8 @@ | ||
| name: HMT Subgraph Deployment | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| on: | ||
| workflow_dispatch: | ||
| inputs: |
| name: Deploy Human Protocol Subgraph | ||
| runs-on: ubuntu-latest | ||
| strategy: | ||
| matrix: | ||
| network: | ||
| - name: amoy | ||
| - name: bsc-testnet | ||
| - name: bsc | ||
| - name: ethereum | ||
| - name: polygon | ||
| - name: sepolia | ||
| fail-fast: true | ||
| max-parallel: 3 | ||
| steps: | ||
| - uses: actions/checkout@v6 | ||
| - uses: actions/setup-node@v6 | ||
| with: | ||
| node-version-file: .nvmrc | ||
| cache: yarn | ||
| - name: Filter Networks | ||
| id: filter_networks | ||
| run: | | ||
| INPUT_NETWORKS="${{ github.event.inputs.networks }}" | ||
| IFS=',' read -ra NETWORK_LIST <<< "$INPUT_NETWORKS" | ||
| echo "Input networks: $INPUT_NETWORKS" | ||
| echo "Current matrix network: ${{ matrix.network.name }}" | ||
| MATCH=false | ||
| for network in "${NETWORK_LIST[@]}"; do | ||
| if [[ "${network}" == "${{ matrix.network.name }}" ]]; then | ||
| MATCH=true | ||
| break | ||
| fi | ||
| done | ||
| echo "Match found: $MATCH" | ||
| echo "continue=$MATCH" >> "$GITHUB_OUTPUT" | ||
| - name: Install dependencies | ||
| if: steps.filter_networks.outputs.continue == 'true' | ||
| run: yarn workspaces focus @tools/subgraph-human-protocol | ||
| - name: Build packages (scoped) | ||
| if: steps.filter_networks.outputs.continue == 'true' | ||
| run: yarn workspaces foreach -Rpt --from @tools/subgraph-human-protocol run build | ||
| - name: Generate and build Subgraph | ||
| if: steps.filter_networks.outputs.continue == 'true' | ||
| run: yarn generate && yarn build | ||
| working-directory: ./packages/subgraph/human-protocol | ||
| env: | ||
| NETWORK: ${{ matrix.network.name }} | ||
| - name: Authenticate & Deploy | ||
| if: steps.filter_networks.outputs.continue == 'true' | ||
| env: | ||
| API_KEY: ${{ secrets.HP_GRAPH_API_KEY }} | ||
| NETWORK: ${{ matrix.network.name }} | ||
| LABEL: ${{ github.event.inputs.label }} | ||
| working-directory: ./packages/subgraph/human-protocol | ||
| run: | | ||
| yarn dlx @graphprotocol/graph-cli@0.71.2 \ | ||
| auth --studio "$API_KEY" | ||
| yarn dlx @graphprotocol/graph-cli@0.71.2 \ | ||
| deploy --studio human-${NETWORK} -l ${LABEL} |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 6 hours ago
In general, the fix is to add an explicit permissions: block to the workflow (either at the top level or for the specific job) that grants only the minimal permissions required. Since this workflow checks out code and builds/deploys to an external Graph protocol service and does not interact with GitHub resources (issues, PRs, etc.), contents: read is sufficient for GITHUB_TOKEN, and other scopes can be omitted.
The best fix with minimal functional impact is to add a top-level permissions: block right after the name: or on: section in .github/workflows/cd-subgraph-human.yaml, setting contents: read. This will apply to all jobs (there is only subgraph) that do not override permissions. No changes to the steps, environment variables, or external behavior are needed.
Concretely:
- Edit
.github/workflows/cd-subgraph-human.yaml. - Insert:
permissions:
contents: readafter the name: line (line 1) or after the on: block. This documents and enforces least-privilege token usage without changing the workflow logic.
| @@ -1,5 +1,8 @@ | ||
| name: Human Protocol Subgraph Deployment | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| on: | ||
| workflow_dispatch: | ||
| inputs: |
4 participants
Issue tracking
Closes #3811
Context behind the change
Core contracts:
Escrow.setup(...)to remove fee arguments and fetch per-oracle fee fromKVStore.get(oracle, "fee").<= 25)<= 100)kvstoredependency to escrow deployment path:EscrowconstructorEscrowFactoryEscrowFactory.initialize(...)to accept_kvstoresetKVStoreAddress(...)admin method for upgrades.IEscrow.setup(...)without fee paramsEscrowFactory.createFundAndSetupEscrow(...)without fee params.TypeScript SDK:
EscrowClient.setup(...)andcreateFundAndSetupEscrow(...).Python SDK:
setupandcreate_fund_and_setup_escrow.EscrowConfigfor compatibility, but ignore them in calls.How has this been tested?
Release plan
Potential risks; What to monitor; Rollback plan