feat: add multisig contract functionality and WASM upload script#250
feat: add multisig contract functionality and WASM upload script#250fadesany wants to merge 1 commit into
Conversation
- Implemented multisig contract interactions in `multisig.ts`, including deployment, initialization, transaction proposal, and signing. - Added fallback service worker for offline support in `fallback-hUSKnVm1DRDhF4S2kqLZN.js`. - Introduced workbox library for enhanced caching strategies in `workbox-4754cb34.js`. - Created script for uploading multisig WASM contract to Stellar testnet in `upload_multisig_wasm.mjs`.
|
@fadesany is attempting to deploy a commit to the miracle656's projects Team on Vercel. A member of the Team first needs to authorize it. |
|
@fadesany Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
Miracle656
left a comment
There was a problem hiding this comment.
Nice work landing a working m-of-n multisig contract plus the wizard/queue UI. A few things to fix before merge.
🟠 Committed build artifacts
Please remove generated/build files from the diff — they shouldn't be tracked:
frontend/wallet/public/sw.js(the+1 -101mangling),public/workbox-4754cb34.js,public/fallback-hUSKnVm1DRDhF4S2kqLZN.jsfrontend/wallet/tsconfig.tsbuildinfo
These are regenerated by the PWA build; committing them creates noise and merge conflicts. Add them to .gitignore if they aren't already and drop them from this PR.
🟠 Contract: propose_transaction has no authorization
Anyone can call propose_transaction — it doesn't check the caller is an owner or require_auth(). Even though execution needs threshold approvals, an unauthenticated party can spam the proposal store (state-bloat / griefing) and pre-seed to/amount. Gate it: require the caller to be an owner and require_auth() them.
🟠 No events emitted
propose_transaction / sign_transaction / execution emit no events, so wraith (and any indexer) can't track multisig activity. Please env.events().publish(...) on propose, approve, and execute.
🟢 Looks good
- Init validates
threshold > 0andowners.len() >= threshold, blocks double-init. sign_transactioncorrectly requires owner +require_auth, dedupes approvals, setsexecutedbefore transfer, and reverts atomically on transfer failure.
Once the artifacts are dropped and propose_transaction is gated, I'll re-review. CI hasn't run the full suite yet — I've approved the workflow so typecheck/build will execute.
multisig.ts, including deployment, initialization, transaction proposal, and signing.fallback-hUSKnVm1DRDhF4S2kqLZN.js.workbox-4754cb34.js.upload_multisig_wasm.mjs.closes #233