Skip to content

Conversation

@rodrigopavezi
Copy link
Member

@rodrigopavezi rodrigopavezi commented Jan 26, 2026

Add Tron blockchain support with smart contract deployment and testing

This PR adds comprehensive support for the Tron blockchain to the Request Network protocol, including:

  • Implementation of TRC20 token support in the currency package
  • Deployment of the ERC20FeeProxy contract on Tron mainnet and Nile testnet
  • Comprehensive test suite for Tron smart contracts
  • Deployment scripts and verification utilities
  • GitHub Actions workflow for CI/CD automation

The implementation moves Tron from a declarative chain to a fully supported VM chain with smart contract capabilities, enabling payment requests with TRC20 tokens like USDT and USDC.

Summary by CodeRabbit

  • New Features

    • Tron support: deploy, verify and interact with contracts on Nile testnet and mainnet; TRC20 test tokens and ERC20FeeProxy integrated; Tron added to currency/chains/types surface.
  • Documentation

    • Comprehensive Tron deployment and testing guide added.
  • Chores

    • CI workflow for Tron pipelines added; CLI scripts and automation for compile/migrate/deploy/verify/wallet/setup/test-token flows; TronWeb tooling included.
  • Tests

    • End-to-end Tron test suite validating proxy and various token behaviors.

✏️ Tip: You can customize this high-level summary in your review settings.


Closes RequestNetwork/private-issues#222
Closes RequestNetwork/private-issues#230
Closes RequestNetwork/private-issues#231
Closes RequestNetwork/private-issues#232

- Add ERC20FeeProxy contract for Tron (TronBox compatible copy)
- Add deployment scripts for Nile testnet and mainnet
- Add TronBox configuration and build artifacts
- Add CI workflow for Tron smart contracts
- Add test contracts (TestTRC20, BadTRC20)
@coderabbitai
Copy link
Contributor

coderabbitai bot commented Jan 26, 2026

Walkthrough

Adds comprehensive Tron support: CI workflow, TronBox config, TRC20/ERC20 test contracts and Truffle tests, TronWeb deployment/verification/util scripts, migrations and deployment records for Nile/mainnet, artifact & package updates, type/chain registry additions, and deployment documentation.

Changes

Cohort / File(s) Summary
CI workflow
​.github/workflows/tron-smart-contracts.yml
New GitHub Actions workflow with jobs to compile Tron contracts, run Tron payment-processor tests, and validate artifact registry & deployment artifacts.
Tron smart-contract sources
packages/smart-contracts/src/contracts/TestTRC20.sol, packages/smart-contracts/tron/contracts/BadTRC20.sol, packages/smart-contracts/tron/contracts/TestTRC20.sol, packages/smart-contracts/tron/contracts/Migrations.sol, packages/smart-contracts/tron/contracts/ERC20FeeProxy.sol
Adds multiple TRC20/ERC20 test variants, Migrations contract, and a reference for ERC20FeeProxy build artifact.
Truffle tests (Tron)
packages/smart-contracts/test/tron/ERC20FeeProxy.test.js
New comprehensive Truffle test suite exercising ERC20FeeProxy across multiple TRC20 behaviors and edge cases.
Migrations & deployments
packages/smart-contracts/migrations/tron/1_deploy_contracts.js, packages/smart-contracts/deployments/tron/nile.json, packages/smart-contracts/deployments/tron/mainnet.json
Adds migration script to deploy Tron contracts and static deployment JSON records for Nile and mainnet.
TronBox config
packages/smart-contracts/tronbox-config.js
New TronBox/TronSuite configuration (development, shasta, nile, mainnet) and Solidity compiler settings.
Tron deployment & utility scripts
packages/smart-contracts/scripts/tron/deploy-nile.js, packages/smart-contracts/scripts/tron/deploy-mainnet.js, packages/smart-contracts/scripts/tron/deploy-test-token.js, packages/smart-contracts/scripts/tron/setup-test-wallet.js, packages/smart-contracts/scripts/tron/test-deployed-nile.js, packages/smart-contracts/scripts/tron/verify-deployment.js
Adds TronWeb-based scripts for deploying to Nile/mainnet, deploying a test token, wallet inspection, testing deployed contracts, and verifying deployments (artifact loading, balance checks, persistence).
Package config & artifacts
packages/smart-contracts/package.json, packages/smart-contracts/src/lib/artifacts/ERC20FeeProxy/index.ts
Adds Tron npm scripts and tronweb dependency; adds Tron deployment entries (nile & mainnet) to ERC20FeeProxy artifact.
Chain types & registry
packages/types/src/currency-types.ts, packages/currency/src/chains/tron/*, packages/currency/src/chains/index.ts, packages/currency/src/chains/declarative/index.ts
Introduces TronChainName and updates Chain/VM unions, adds tron/nile chain data and TronChains module, updates barrel exports, and removes Tron from declarative mapping.
Deployment docs
packages/smart-contracts/TRON_DEPLOYMENT.md
New documentation covering prerequisites, deployment, verification, testing, and troubleshooting for Tron (Nile & mainnet).
Tests timeout adjustments
packages/request-client.js/test/index.test.ts
Increased several test timeouts to accommodate longer execution durations.

Sequence Diagram(s)

sequenceDiagram
    participant User
    participant Script as Deploy Script
    participant TronWeb
    participant Chain as Tron Network
    participant FS as File System

    User->>Script: run deploy command (e.g. yarn tron:deploy:nile)
    Script->>Script: validate env (TRON_PRIVATE_KEY, CONFIRM flags)
    Script->>TronWeb: initialize with network fullHost
    Script->>TronWeb: derive deployer address, check balance
    TronWeb->>Chain: query account/balance
    Chain-->>TronWeb: balance result
    TronWeb-->>Script: deployer info
    Script->>FS: load contract artifacts (ABI/bytecode)
    loop per contract
        Script->>TronWeb: deploy contract (ABI + bytecode + args)
        TronWeb->>Chain: broadcast deployment tx
        Chain-->>TronWeb: tx receipt + contract address
        TronWeb-->>Script: deployment receipt
        Script->>Script: record address
    end
    Script->>FS: write deployments/tron/{network}.json
    FS-->>Script: persisted
    Script->>User: print summary & verification instructions
Loading
sequenceDiagram
    participant User
    participant Script as Verify Script
    participant FS as File System
    participant TronWeb
    participant Chain as Tron Network

    User->>Script: run verify command (e.g. yarn tron:verify:nile)
    Script->>Script: validate env (TRON_PRIVATE_KEY)
    Script->>FS: read deployments/tron/nile.json
    FS-->>Script: deployment addresses
    loop per deployed contract
        Script->>FS: load ABI from tron/build
        FS-->>Script: ABI
        Script->>TronWeb: instantiate contract at address
        TronWeb->>Chain: query contract/account info
        Chain-->>TronWeb: contract presence/metadata
        TronWeb-->>Script: verification result
    end
    alt ERC20FeeProxy + TestTRC20 present
        Script->>TronWeb: run test payment flow (approve + transferFromWithReferenceAndFee)
        TronWeb->>Chain: broadcast test tx
        Chain-->>TronWeb: receipt
        TronWeb-->>Script: test outcome
    end
    Script->>User: print verification summary
Loading

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~60 minutes

🚥 Pre-merge checks | ✅ 2 | ❌ 1
❌ Failed checks (1 warning)
Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (2 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly and concisely describes the main purpose of the PR: adding Tron smart contracts and deployment infrastructure. It accurately represents the core changes.
Description check ✅ Passed The pull request description provides a clear, well-structured overview of changes including objectives, implementation details, and related issues.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing touches
  • 📝 Generate docstrings

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

Copy link
Member Author

rodrigopavezi commented Jan 26, 2026

@github-actions
Copy link

✅ Slither Security Analysis

Status: Passed

Findings Summary

Severity Count Status
✅ High 0 Pass
🟡 Medium 2 Review Recommended
🔵 Low 0 Info
ℹ️ Informational 1 Info

⚠️ Please review the findings in the Security tab or download the artifacts.

📄 Full report available in workflow artifacts.
🔍 View detailed findings in the Security tab.

@github-actions
Copy link

✅ Echidna Fuzzing Results

Mode: ci (50000 test sequences)
Status: All Properties Passed

Property Test Results

Status Count
✅ Passed 16
❌ Failed 0
Total 16
Pass Rate 100.0%

📄 Full report and corpus available in workflow artifacts.

ℹ️ About Echidna Fuzzing

Echidna is a property-based fuzzer that generates random sequences of transactions
to test invariants (properties that should always hold true).

Properties tested:

  • Fee calculation bounds
  • Access control enforcement
  • Amount constraints
  • No duplicate payments
  • Zero address validation
  • Integer overflow protection

@greptile-apps
Copy link
Contributor

greptile-apps bot commented Jan 26, 2026

Greptile Overview

Greptile Summary

Adds comprehensive Tron blockchain support to Request Network smart contracts, deploying the ERC20FeeProxy contract to both Nile testnet and mainnet.

Key Changes:

  • Duplicates ERC20FeeProxy contract to src/contracts/tron/ for TronBox compatibility (TronBox requires contracts in specific directory structure)
  • Adds TronBox configuration with support for development, Nile testnet, Shasta testnet, and mainnet networks
  • Implements comprehensive test suite (11 test cases) mirroring EVM test coverage for feature parity
  • Adds deployment scripts with safety confirmations for mainnet deployments
  • Registers Tron addresses in artifact registry: Nile testnet (THK5rNmrvCujhmrXa5DB1dASepwXTr9cJs) and mainnet (TCUDPYnS9dH3WvFEaE7wN7vnDa51J4R4fd)
  • Includes CI workflow for contract compilation validation and address verification

Issues Found:

  • Significant code duplication: entire tron/ directory duplicates content from src/contracts/tron/, scripts/tron/, test/tron/, and migrations/tron/
  • TestTRC20.sol mint function lacks access control, allowing anyone to mint unlimited tokens (test-only contract, but should follow best practices)

Confidence Score: 4/5

  • Safe to merge with minor cleanup recommended
  • The PR implements a well-tested port of existing ERC20FeeProxy functionality to Tron. The main contract code is identical to the proven EVM implementation, comprehensive tests mirror EVM test coverage, and deployment scripts include proper safety checks. Score reduced from 5 to 4 due to significant file duplication and a missing access control in test contract.
  • Review packages/smart-contracts/src/contracts/tron/TestTRC20.sol for mint access control and consider removing duplicate files in packages/smart-contracts/tron/ directory

Important Files Changed

Filename Overview
packages/smart-contracts/src/contracts/tron/TestTRC20.sol Adds test TRC20 token contracts; mint function lacks access control
packages/smart-contracts/src/contracts/tron/ERC20FeeProxy.sol Duplicates main ERC20FeeProxy contract for Tron compatibility
packages/smart-contracts/tronbox-config.js Adds TronBox configuration for Tron deployment
packages/smart-contracts/tron/contracts/TestTRC20.sol Duplicate of src/contracts/tron/TestTRC20.sol - creates confusion
packages/smart-contracts/tron/scripts/deploy-mainnet.js Duplicate of scripts/tron/deploy-mainnet.js - creates confusion

Sequence Diagram

sequenceDiagram
    participant Payer
    participant Proxy as ERC20FeeProxy
    participant Token as TRC20 Token
    participant Recipient
    participant FeeAddr

    Payer->>Token: 1. approve(Proxy, totalAmount)
    Token-->>Payer: approved
    
    Payer->>Proxy: 2. transferFromWithReferenceAndFee()
    
    Proxy->>Token: 3. transferFrom(Payer, Recipient, paymentAmt)
    Token-->>Proxy: transferred
    
    alt feeAmount exists
        Proxy->>Token: 4. transferFrom(Payer, FeeAddr, feeAmt)
        Token-->>Proxy: transferred
    end
    
    Proxy-->>Proxy: 5. emit event
    Proxy-->>Payer: complete
Loading

Copy link
Contributor

@greptile-apps greptile-apps bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

3 files reviewed, 3 comments

Edit Code Review Agent Settings | Greptile

Copy link
Contributor

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 3

🤖 Fix all issues with AI agents
In `@packages/smart-contracts/scripts/tron/deploy-test-token.js`:
- Around line 107-108: The deployment output path uses path.join to write to
'../deployments' which resolves relative to the scripts folder; update the
outputPath construction (the path.join call that sets outputPath) to point to
the correct tron deployments directory (e.g., '../../tron/deployments' or
path.join(__dirname, '..', '..', 'tron', 'deployments')) so the file is written
to the expected packages/smart-contracts/tron/deployments location; ensure the
variable outputPath and the fs.writeFileSync call remain unchanged except for
the corrected path join segments and create the deployments directory if it
doesn't exist before writing.

In `@packages/smart-contracts/scripts/tron/verify-deployment.js`:
- Around line 35-41: The loadDeployment function builds deploymentPath
incorrectly; change the path to point into the tron subfolder where files
actually live. Update the deploymentPath construction in loadDeployment (the
variable named deploymentPath inside the loadDeployment function) to reference
../deployments/tron/${network}.json (or equivalent path.join call including
'tron') so it loads deployments/tron/nile.json and deployments/tron/mainnet.json
instead of deployments/${network}.json.

In `@packages/smart-contracts/src/lib/artifacts/ERC20FeeProxy/index.ts`:
- Around line 185-198: The TypeScript error is caused because the deployment
keys 'tron' and 'nile' are not part of the VMChainName union used by the
artifact's deployment typing; update the type system so these declarative chains
are allowed by either (a) adding 'tron' and 'nile' to the VMChainName (or to
EvmChainName/NearChainName if appropriate) or (b) relaxing the artifact
deployment type to accept declarative chains (e.g., extend the union or
introduce a DeclarativeChainName and include it in the deployment typing);
update the types referenced by the artifact (VMChainName, EvmChainName,
NearChainName and the deployment property used in ERC20FeeProxy index.ts) so the
tron/nile entries compile.

- Fix deploy-nile.js, deploy-mainnet.js, deploy-test-token.js
- Output paths now correctly write to tron/deployments/ instead of scripts/deployments/
@github-actions
Copy link

✅ Slither Security Analysis

Status: Passed

Findings Summary

Severity Count Status
✅ High 0 Pass
🟡 Medium 2 Review Recommended
🔵 Low 0 Info
ℹ️ Informational 1 Info

⚠️ Please review the findings in the Security tab or download the artifacts.

📄 Full report available in workflow artifacts.
🔍 View detailed findings in the Security tab.

- Remove duplicate tron/ folder
- Keep files in standard locations:
  - deployments/tron/
  - migrations/tron/
  - scripts/tron/
  - src/contracts/tron/
  - test/tron/
- Move TRON_DEPLOYMENT.md to package root
- Update deploy scripts output paths accordingly
@github-actions
Copy link

✅ Echidna Fuzzing Results

Mode: ci (50000 test sequences)
Status: All Properties Passed

Property Test Results

Status Count
✅ Passed 16
❌ Failed 0
Total 16
Pass Rate 100.0%

📄 Full report and corpus available in workflow artifacts.

ℹ️ About Echidna Fuzzing

Echidna is a property-based fuzzer that generates random sequences of transactions
to test invariants (properties that should always hold true).

Properties tested:

  • Fee calculation bounds
  • Access control enforcement
  • Amount constraints
  • No duplicate payments
  • Zero address validation
  • Integer overflow protection

@github-actions
Copy link

✅ Slither Security Analysis

Status: Passed

Findings Summary

Severity Count Status
✅ High 0 Pass
🟡 Medium 2 Review Recommended
🔵 Low 0 Info
ℹ️ Informational 1 Info

⚠️ Please review the findings in the Security tab or download the artifacts.

📄 Full report available in workflow artifacts.
🔍 View detailed findings in the Security tab.

- Move TronBox build artifacts from tron-build/ to build/tron/
- Update tronbox-config.js contracts_build_directory accordingly
- Aligns with Hardhat build structure under build/
Copy link
Contributor

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Fix all issues with AI agents
In `@packages/smart-contracts/scripts/tron/deploy-mainnet.js`:
- Around line 167-168: The outputPath currently uses path.join(__dirname,
'../deployments/tron/mainnet.json') which resolves to scripts/deployments/...
because __dirname is scripts/tron; update the path calculation in
deploy-mainnet.js (the outputPath constant) to point to the package root
deployments folder (e.g. join or resolve using
'../../deployments/tron/mainnet.json' or use process.cwd() to build
'deployments/tron/mainnet.json') so the JSON is written to the correct
deployments/tron/mainnet.json location.

@github-actions
Copy link

✅ Echidna Fuzzing Results

Mode: ci (50000 test sequences)
Status: All Properties Passed

Property Test Results

Status Count
✅ Passed 16
❌ Failed 0
Total 16
Pass Rate 100.0%

📄 Full report and corpus available in workflow artifacts.

ℹ️ About Echidna Fuzzing

Echidna is a property-based fuzzer that generates random sequences of transactions
to test invariants (properties that should always hold true).

Properties tested:

  • Fee calculation bounds
  • Access control enforcement
  • Amount constraints
  • No duplicate payments
  • Zero address validation
  • Integer overflow protection

- Remove build/tron/ from git tracking (like Hardhat builds)
- Build artifacts should be generated, not committed
- Run 'tronbox compile' to regenerate when needed
@github-actions
Copy link

✅ Slither Security Analysis

Status: Passed

Findings Summary

Severity Count Status
✅ High 0 Pass
🟡 Medium 2 Review Recommended
🔵 Low 0 Info
ℹ️ Informational 1 Info

⚠️ Please review the findings in the Security tab or download the artifacts.

📄 Full report available in workflow artifacts.
🔍 View detailed findings in the Security tab.

1 similar comment
@github-actions
Copy link

✅ Slither Security Analysis

Status: Passed

Findings Summary

Severity Count Status
✅ High 0 Pass
🟡 Medium 2 Review Recommended
🔵 Low 0 Info
ℹ️ Informational 1 Info

⚠️ Please review the findings in the Security tab or download the artifacts.

📄 Full report available in workflow artifacts.
🔍 View detailed findings in the Security tab.

@github-actions
Copy link

✅ Echidna Fuzzing Results

Mode: ci (50000 test sequences)
Status: All Properties Passed

Property Test Results

Status Count
✅ Passed 16
❌ Failed 0
Total 16
Pass Rate 100.0%

📄 Full report and corpus available in workflow artifacts.

ℹ️ About Echidna Fuzzing

Echidna is a property-based fuzzer that generates random sequences of transactions
to test invariants (properties that should always hold true).

Properties tested:

  • Fee calculation bounds
  • Access control enforcement
  • Amount constraints
  • No duplicate payments
  • Zero address validation
  • Integer overflow protection

@github-actions
Copy link

✅ Echidna Fuzzing Results

Mode: ci (50000 test sequences)
Status: All Properties Passed

Property Test Results

Status Count
✅ Passed 16
❌ Failed 0
Total 16
Pass Rate 100.0%

📄 Full report and corpus available in workflow artifacts.

ℹ️ About Echidna Fuzzing

Echidna is a property-based fuzzer that generates random sequences of transactions
to test invariants (properties that should always hold true).

Properties tested:

  • Fee calculation bounds
  • Access control enforcement
  • Amount constraints
  • No duplicate payments
  • Zero address validation
  • Integer overflow protection

@github-actions
Copy link

✅ Slither Security Analysis

Status: Passed

Findings Summary

Severity Count Status
✅ High 0 Pass
🟡 Medium 2 Review Recommended
🔵 Low 0 Info
ℹ️ Informational 1 Info

⚠️ Please review the findings in the Security tab or download the artifacts.

📄 Full report available in workflow artifacts.
🔍 View detailed findings in the Security tab.

@github-actions
Copy link

✅ Echidna Fuzzing Results

Mode: ci (50000 test sequences)
Status: All Properties Passed

Property Test Results

Status Count
✅ Passed 16
❌ Failed 0
Total 16
Pass Rate 100.0%

📄 Full report and corpus available in workflow artifacts.

ℹ️ About Echidna Fuzzing

Echidna is a property-based fuzzer that generates random sequences of transactions
to test invariants (properties that should always hold true).

Properties tested:

  • Fee calculation bounds
  • Access control enforcement
  • Amount constraints
  • No duplicate payments
  • Zero address validation
  • Integer overflow protection

- Move tron contracts from src/contracts/tron/ to tron/contracts/
- This prevents Hardhat from finding duplicate ERC20FeeProxy contracts
- Update tronbox-config.js to use new path
- Update CI workflow paths accordingly
@github-actions
Copy link

✅ Slither Security Analysis

Status: Passed

Findings Summary

Severity Count Status
✅ High 0 Pass
🟡 Medium 2 Review Recommended
🔵 Low 0 Info
ℹ️ Informational 1 Info

⚠️ Please review the findings in the Security tab or download the artifacts.

📄 Full report available in workflow artifacts.
🔍 View detailed findings in the Security tab.

@github-actions
Copy link

✅ Echidna Fuzzing Results

Mode: ci (50000 test sequences)
Status: All Properties Passed

Property Test Results

Status Count
✅ Passed 16
❌ Failed 0
Total 16
Pass Rate 100.0%

📄 Full report and corpus available in workflow artifacts.

ℹ️ About Echidna Fuzzing

Echidna is a property-based fuzzer that generates random sequences of transactions
to test invariants (properties that should always hold true).

Properties tested:

  • Fee calculation bounds
  • Access control enforcement
  • Amount constraints
  • No duplicate payments
  • Zero address validation
  • Integer overflow protection

@github-actions
Copy link

✅ Slither Security Analysis

Status: Passed

Findings Summary

Severity Count Status
✅ High 0 Pass
🟡 Medium 2 Review Recommended
🔵 Low 0 Info
ℹ️ Informational 1 Info

⚠️ Please review the findings in the Security tab or download the artifacts.

📄 Full report available in workflow artifacts.
🔍 View detailed findings in the Security tab.

@github-actions
Copy link

✅ Echidna Fuzzing Results

Mode: ci (50000 test sequences)
Status: All Properties Passed

Property Test Results

Status Count
✅ Passed 16
❌ Failed 0
Total 16
Pass Rate 100.0%

📄 Full report and corpus available in workflow artifacts.

ℹ️ About Echidna Fuzzing

Echidna is a property-based fuzzer that generates random sequences of transactions
to test invariants (properties that should always hold true).

Properties tested:

  • Fee calculation bounds
  • Access control enforcement
  • Amount constraints
  • No duplicate payments
  • Zero address validation
  • Integer overflow protection

The test was still timing out at 60s due to Etherscan rate limiting.
@github-actions
Copy link

✅ Slither Security Analysis

Status: Passed

Findings Summary

Severity Count Status
✅ High 0 Pass
🟡 Medium 2 Review Recommended
🔵 Low 0 Info
ℹ️ Informational 1 Info

⚠️ Please review the findings in the Security tab or download the artifacts.

📄 Full report available in workflow artifacts.
🔍 View detailed findings in the Security tab.

@github-actions
Copy link

✅ Echidna Fuzzing Results

Mode: ci (50000 test sequences)
Status: All Properties Passed

Property Test Results

Status Count
✅ Passed 16
❌ Failed 0
Total 16
Pass Rate 100.0%

📄 Full report and corpus available in workflow artifacts.

ℹ️ About Echidna Fuzzing

Echidna is a property-based fuzzer that generates random sequences of transactions
to test invariants (properties that should always hold true).

Properties tested:

  • Fee calculation bounds
  • Access control enforcement
  • Amount constraints
  • No duplicate payments
  • Zero address validation
  • Integer overflow protection

- Fix ARTIFACTS_DIR to point to ../../tron/build instead of ../build/tron
- Fix output paths to point to ../../deployments/tron instead of ../deployments/tron
- Fix verify-deployment.js to use correct deployment and artifact paths
@github-actions
Copy link

✅ Slither Security Analysis

Status: Passed

Findings Summary

Severity Count Status
✅ High 0 Pass
🟡 Medium 2 Review Recommended
🔵 Low 0 Info
ℹ️ Informational 1 Info

⚠️ Please review the findings in the Security tab or download the artifacts.

📄 Full report available in workflow artifacts.
🔍 View detailed findings in the Security tab.

Copy link
Contributor

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Fix all issues with AI agents
In `@packages/smart-contracts/scripts/tron/deploy-test-token.js`:
- Around line 107-109: The script computes outputPath and calls fs.writeFileSync
to save deploymentInfo but doesn’t ensure the target directory exists, causing
ENOENT if deployments/tron/ is missing; update the deployment save logic around
outputPath (the block that writes deploymentInfo using fs.writeFileSync) to
create the directory first (e.g., use fs.mkdirSync or fs.promises.mkdir with {
recursive: true } on path.dirname(outputPath)) before writing, then proceed to
JSON.stringify(deploymentInfo, null, 2) and write the file.

@github-actions
Copy link

✅ Echidna Fuzzing Results

Mode: ci (50000 test sequences)
Status: All Properties Passed

Property Test Results

Status Count
✅ Passed 16
❌ Failed 0
Total 16
Pass Rate 100.0%

📄 Full report and corpus available in workflow artifacts.

ℹ️ About Echidna Fuzzing

Echidna is a property-based fuzzer that generates random sequences of transactions
to test invariants (properties that should always hold true).

Properties tested:

  • Fee calculation bounds
  • Access control enforcement
  • Amount constraints
  • No duplicate payments
  • Zero address validation
  • Integer overflow protection

Add fs.mkdirSync with recursive: true to create the deployments/tron
directory if it doesn't exist before writing the deployment file.
@github-actions
Copy link

✅ Slither Security Analysis

Status: Passed

Findings Summary

Severity Count Status
✅ High 0 Pass
🟡 Medium 2 Review Recommended
🔵 Low 0 Info
ℹ️ Informational 1 Info

⚠️ Please review the findings in the Security tab or download the artifacts.

📄 Full report available in workflow artifacts.
🔍 View detailed findings in the Security tab.

@github-actions
Copy link

✅ Echidna Fuzzing Results

Mode: ci (50000 test sequences)
Status: All Properties Passed

Property Test Results

Status Count
✅ Passed 16
❌ Failed 0
Total 16
Pass Rate 100.0%

📄 Full report and corpus available in workflow artifacts.

ℹ️ About Echidna Fuzzing

Echidna is a property-based fuzzer that generates random sequences of transactions
to test invariants (properties that should always hold true).

Properties tested:

  • Fee calculation bounds
  • Access control enforcement
  • Amount constraints
  • No duplicate payments
  • Zero address validation
  • Integer overflow protection

@rodrigopavezi rodrigopavezi requested review from MantisClone, bassgeta and vrolland and removed request for LeoSlrRf, alexandre-abrioux-rf and dave-rf January 27, 2026 10:16
The test 'can disable and enable the get the balance of a request' was
timing out at 60s in slow CI environments. Increased to 120s to match
other similar tests in the file.
@github-actions
Copy link

✅ Slither Security Analysis

Status: Passed

Findings Summary

Severity Count Status
✅ High 0 Pass
🟡 Medium 2 Review Recommended
🔵 Low 0 Info
ℹ️ Informational 1 Info

⚠️ Please review the findings in the Security tab or download the artifacts.

📄 Full report available in workflow artifacts.
🔍 View detailed findings in the Security tab.

@github-actions
Copy link

✅ Echidna Fuzzing Results

Mode: ci (50000 test sequences)
Status: All Properties Passed

Property Test Results

Status Count
✅ Passed 16
❌ Failed 0
Total 16
Pass Rate 100.0%

📄 Full report and corpus available in workflow artifacts.

ℹ️ About Echidna Fuzzing

Echidna is a property-based fuzzer that generates random sequences of transactions
to test invariants (properties that should always hold true).

Properties tested:

  • Fee calculation bounds
  • Access control enforcement
  • Amount constraints
  • No duplicate payments
  • Zero address validation
  • Integer overflow protection

MantisClone

This comment was marked as duplicate.

Copy link
Member

@MantisClone MantisClone left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me so far.

Reviewed with Claude Code Opus 4.5

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants