feat(contracts): add pyth pro verifier#2079
Open
chalabi2 wants to merge 3 commits into
Open
Conversation
Adds a query-only CosmWasm verifier for upgraded Pyth Core payloads. The verifier preserves the VerifyVAA query shape used by pyth.wasm while checking the Pyth Pro router set, expected emitter, and 3-of-5 quorum. Includes a live upgraded Hermes AKT/USD fixture test proving the existing PNAU parser still accepts the upgraded payload format. Signed-off-by: Joseph Chalabi <chalabi.joseph@gmail.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (11)
💤 Files with no reviewable changes (1)
🚧 Files skipped from review as they are similar to previous changes (2)
WalkthroughAdds a new ChangesPyth Pro Verifier Contract
Estimated code review effort: 4 (Complex) | ~60 minutes Verifier Deployment and Upgrade Wiring
Estimated code review effort: 4 (Complex) | ~60 minutes Sequence Diagram(s)sequenceDiagram
participant Client
participant Contract
participant Config
Client->>Contract: query(VerifyVAA { vaa, block_time })
Contract->>Config: load stored config
Contract->>Contract: check version/guardian_set_index/emitter
Contract->>Contract: verify_router_signatures (recover keys, derive router_address)
Contract-->>Client: ParsedVAA as JSON
sequenceDiagram
participant UpgradeHandler
participant PythProVerifier
participant PythContract
participant OracleParams
UpgradeHandler->>PythProVerifier: StoreAndInstantiateContract(newPythProVerifierInstantiateMsg())
PythProVerifier-->>UpgradeHandler: verifierResp.Address
UpgradeHandler->>UpgradeHandler: newPythVerifierMigrationMsg(verifierResp.Address)
UpgradeHandler->>PythContract: StoreAndMigrateContract(pythContractAddr, migrationMsg)
UpgradeHandler->>OracleParams: set Sources = pythContractAddr
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (2)
contracts/pyth-pro-verifier/src/contract.rs (1)
93-142: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueSignature verification logic is sound.
The quorum threshold, strictly-increasing index enforcement, bounds checking, ECDSA recovery, and router address comparison are all correct. The
router_addressderivation follows standard Ethereum address format (Keccak256 of uncompressed EC point minus prefix, last 20 bytes).One minor semantic issue at lines 116-118: when an individual router index exceeds
config.routers.len(),TooManySignaturesis returned. This is misleading — the count is valid but the index is out of bounds. Consider a dedicatedInvalidRouterIndexvariant or reusingInvalidRouterSetIndex.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@contracts/pyth-pro-verifier/src/contract.rs` around lines 93 - 142, The per-signature router index bounds check in verify_router_signatures is returning TooManySignatures when an individual index is out of range, which is the wrong semantic error. Update that branch to use a dedicated invalid-index error such as InvalidRouterIndex or the existing InvalidRouterSetIndex variant, and keep the rest of the signature validation flow unchanged.contracts/pyth-pro-verifier/src/testing.rs (1)
234-379: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winTest helpers are well-structured and consistent with contract logic.
body_hash(double Keccak256) matchesparse_vaa's hash computation, andsign_hash(sign_prehash_recoverable) is the correct counterpart torecover_from_prehashin the contract.address_from_keycorrectly implements Ethereum-style address derivation. The separation ofsigned_vaa(index→key mapping) vssigned_vaa_with_keys(explicit keys) enables testing both valid and adversarial signer configurations.One minor gap: no test exercises the
TooManySignaturespath (signer_count > routers.len()). Consider adding a case with 6 signers against the 5-router config.🧪 Suggested test for TooManySignatures
#[test] fn rejects_too_many_signatures() { let keys = router_keys(); let deps = setup(&keys); let vaa = signed_vaa( &keys, &[0, 1, 2, 3, 4, 0], // 6 signers, but index 0 is reused — order check catches first ROUTER_SET_INDEX, EMITTER_CHAIN, EMITTER_ADDRESS, vec![], ); let err = query( deps.as_ref(), mock_env(), QueryMsg::VerifyVAA { vaa: Binary::from(vaa), block_time: 0, }, ) .unwrap_err(); // With 6 signers > 5 routers, expect TooManySignatures assert!(err.to_string().contains("TooManySignatures")); }Note: the signer indices must be strictly increasing to reach the
signer_count > config.routers.len()check, so use indices like[0, 1, 2, 3, 4, 5]with 6 distinct keys.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@contracts/pyth-pro-verifier/src/testing.rs` around lines 234 - 379, Add a test in testing.rs that covers the TooManySignatures branch in the verification flow. Use the existing helpers setup, router_keys, signed_vaa_with_keys, and query to build a VAA with 6 distinct signatures against the 5-router config so it reaches the signer_count > config.routers.len() check in the contract’s VerifyVAA path. Assert the query fails with TooManySignatures, and make sure the signer indexes are strictly increasing so the failure comes from signature count rather than ordering.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@contracts/pyth-pro-verifier/src/contract.rs`:
- Around line 93-142: The per-signature router index bounds check in
verify_router_signatures is returning TooManySignatures when an individual index
is out of range, which is the wrong semantic error. Update that branch to use a
dedicated invalid-index error such as InvalidRouterIndex or the existing
InvalidRouterSetIndex variant, and keep the rest of the signature validation
flow unchanged.
In `@contracts/pyth-pro-verifier/src/testing.rs`:
- Around line 234-379: Add a test in testing.rs that covers the
TooManySignatures branch in the verification flow. Use the existing helpers
setup, router_keys, signed_vaa_with_keys, and query to build a VAA with 6
distinct signatures against the 5-router config so it reaches the signer_count >
config.routers.len() check in the contract’s VerifyVAA path. Assert the query
fails with TooManySignatures, and make sure the signer indexes are strictly
increasing so the failure comes from signature count rather than ordering.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 3323207f-57a0-4265-8717-3ccf6926765c
⛔ Files ignored due to path filters (1)
Cargo.lockis excluded by!**/*.lock
📒 Files selected for processing (10)
Cargo.tomlcontracts/pyth-pro-verifier/Cargo.tomlcontracts/pyth-pro-verifier/src/contract.rscontracts/pyth-pro-verifier/src/error.rscontracts/pyth-pro-verifier/src/lib.rscontracts/pyth-pro-verifier/src/msg.rscontracts/pyth-pro-verifier/src/state.rscontracts/pyth-pro-verifier/src/testing.rscontracts/pyth-pro-verifier/src/vaa.rscontracts/pyth/src/accumulator.rs
Reuses the existing Wormhole VAA parser in the Pyth Pro verifier so the new contract only owns router quorum and emitter validation logic. This removes the duplicate parser added in the initial implementation. Signed-off-by: Joseph Chalabi <chalabi.joseph@gmail.com>
Instantiate the Pyth Pro verifier during the v2.1.0 upgrade and migrate the existing Pyth contract to use that verifier address. Local init now follows the same contract path and skips the old Wormhole deployment. Signed-off-by: Joseph Chalabi <chalabi.joseph@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a query-only CosmWasm verifier for upgraded Pyth Core payloads. The upgraded flow replaces Wormhole guardian signature verification with the Pyth router signer model, so Akash needs a verifier that checks the router set, expected emitter, and 3-of-5 quorum.
The verifier preserves the existing
VerifyVAA { vaa, block_time }query shape used bypyth.wasm. It reuses the existing VAA envelope parser, but signature verification is router-quorum based, not Wormhole guardian based.This also wires the contract side into the v2.1.0 upgrade: the upgrade embeds and instantiates the verifier, then migrates the existing Pyth contract to use the new verifier address. Local init now follows the same path and no longer deploys the old Wormhole contract for Pyth.
Hermes/API-key changes are intentionally out of scope for this PR.
Validation
bash -n _run/init.sh script/wasm2go.shcargo test -p pythcargo test -p pyth-pro-verifiercargo clippy -p pyth-pro-verifier --all-targets -- -D warningscargo build --release --target wasm32-unknown-unknown -p wormhole -p pyth -p pyth-pro-verifierGOWORK=off go test ./upgrades/...git diff --checkNote:
make generate-contractscould not run locally because no Docker daemon was available, so the generated embedding was produced from local release wasm artifacts.