Skip to content

fix(core): align export contract with desktop verifier, augment replay witness with singleton#176

Merged
Th0rgal merged 9 commits intomainfrom
fix/export-contract-replay-witness-176
Feb 26, 2026
Merged

fix(core): align export contract with desktop verifier, augment replay witness with singleton#176
Th0rgal merged 9 commits intomainfrom
fix/export-contract-replay-witness-176

Conversation

@Th0rgal
Copy link
Owner

@Th0rgal Th0rgal commented Feb 25, 2026

Summary

  • Export contract fix: isFullyVerifiable in finalizeEvidenceExport() no longer requires replay-capable simulation witness inputs for full (non-witness-only) simulations. This resolves the mismatch where the generator showed "Partial" while the desktop correctly showed "Fully Verified" for the same package (e.g. Gnosis Chain transactions with full simulations).
  • Replay witness augmentation: fetchSimulationWitness now augments replay accounts with the Safe proxy's slot 0 (singleton pointer) and the singleton contract itself, so local EVM replay can execute the DELEGATECALL chain correctly. Both the prestateTracer and simple-transfer fallback paths are covered.
  • Cleanup: Removes em dashes from all .ts/.tsx files for consistent punctuation, removes leading bullet from generator partial-reason display, removes now-unnecessary missing-simulation-witness UI filter.

Test plan

  • bun test packages/core/src/lib/package/__tests__/creator.test.ts (25 pass) -- updated 3 existing tests, added 2 new witness-only companion tests
  • bun test packages/core/src/lib/simulation/__tests__/summary.test.ts (34 pass)
  • New Rust test proxy_delegatecall_fails_without_slot0_and_singleton in simulation_replay.rs
  • Manual: generate package for gno:0xba260842B007FaB4119C9747D709119DE4257276 queue tx, verify generator now shows "Fully verifiable"

Note

Medium Risk
Changes the criteria for marking packages fully-verifiable and adjusts desktop local replay execution behavior via new replayCalldata handling, which could affect user-facing verification status and replay results. Most other changes are documentation and UI copy updates, limiting blast radius.

Overview
Fixes the export contract logic in packages/core so full simulations no longer require replay-capable witness inputs to be labeled fully-verifiable (replay inputs only gate witness-only simulations), with updated unit coverage.

Enhances desktop Rust replay (simulation_replay.rs) by adding optional simulationWitness.replayCalldata and using it to replay execTransaction against the Safe proxy when present, plus a regression test covering proxy delegatecall behavior.

Adds/updates audit and release-review documentation (new docs/audit/AUDITOR_PACKET.md, new RELEASE_INTEGRITY.md, expanded SECURITY.md/AUDIT.md/DEPENDENCIES.md/VERIFY.md/TRUST_ASSUMPTIONS.md), commits a large dependency footprint baseline, ignores generated drift diffs, and makes minor generator/desktop UI wording tweaks (including showing all partial reasons unfiltered).

Written by Cursor Bugbot for commit e939cea. This will update automatically on new commits. Configure here.

…y witness with singleton (#176)

The generator's `isFullyVerifiable` flag required replay-capable simulation
witness inputs even for full (non-witness-only) simulations, causing a
"partial" badge in the generator while the desktop correctly showed "Fully
Verified". Now replay inputs only gate the flag for witness-only packages.

Also ensures replay witness accounts include the Safe proxy's slot 0
(singleton pointer) and the singleton contract itself so local EVM replay
can execute the DELEGATECALL chain correctly.

Removes em dashes from all .ts/.tsx files for consistent punctuation.
@vercel
Copy link

vercel bot commented Feb 25, 2026

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
safe-lens-generator Ready Ready Preview, Comment Feb 26, 2026 7:58am

Request Review

@chatgpt-codex-connector
Copy link

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

…eplay

The local replay now calls execTransaction on the Safe proxy instead of
the inner transaction directly when replayCalldata is present. This
ensures the replay return data matches the simulation's ABI-encoded
execTransaction response (e.g. abi.encode(true)).
@Th0rgal Th0rgal merged commit cb29e4a into main Feb 26, 2026
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant