diff --git a/audits/README.md b/audits/README.md new file mode 100644 index 0000000..8b92697 --- /dev/null +++ b/audits/README.md @@ -0,0 +1,5 @@ +## Audits +This section contains audit-related materials. + +### Internal audit +The latest internal audit is located in this folder: [internal audit](https://github.com/valory-xyz/registries-near/blob/main/audits/internal). diff --git a/audits/internal/README.md b/audits/internal/README.md new file mode 100644 index 0000000..d60d73e --- /dev/null +++ b/audits/internal/README.md @@ -0,0 +1,270 @@ +# Internal audit of near-governance-test +The review has been performed based on the contract code in the following repository:
+`https://github.com/valory-xyz/registries-near`
+commit: `62b77e3a7486f84c95dbf1889a8907eb8d00a2b2` or `0.1.0-pre-internal-audit`
+ +## Objectives +The audit focused on contracts in this repo. + +### Problems found instrumentally +Several checks are obtained automatically. They are commented. Some issues found need to be fixed.
+List of rust tools: +##### cargo tree +``` +cargo tree > audits/internal/analysis/cargo_tree.txt +``` +##### cargo-audit +https://docs.rs/cargo-audit/latest/cargo_audit/ +``` +cargo install cargo-audit +cargo-audit audit > audits/internal/analysis/cargo-audit.txt +``` + +##### cargo clippy +https://github.com/rust-lang/rust-clippy +``` +cargo clippy 2> audits/internal/analysis/cargo-clippy.txt +``` + +All automatic warnings are listed in the following file, concerns of which we address in more detail below:
+[cargo-tree.txt](https://github.com/valory-xyz/registries-near/blob/main/lockbox/audits/internal/analysis/cargo-tree.txt)
+[cargo-audit.txt](https://github.com/valory-xyz/registries-near/blob/main/lockbox/audits/internal/analysis/cargo-audit.txt)
+[cargo-clippy.txt](https://github.com/valory-xyz/registries-near/blob/main/lockbox/audits/internal/analysis/cargo-clippy.txt)
+ +### Issue by BlockSec list +#### find Promises that are not handled - Issue +yes. see `Critical issue. Incorrect logic ft_transfer` + +#### missing macro #[private] for callback functions +no +#### find functions that are vulnerable to reentrancy attack - Double checks +Look at: https://github.com/blocksecteam/rustle/blob/main/docs/detectors/reentrancy.md + +#### lack of overflow check for arithmetic operation - Issue +``` +*b += amount.0; +``` + +#### missing check of sender != receiver +no +#### incorrect type used in parameters or return values +no +#### changes to collections are not saved +no +#### find nft_transfer without check of approval id +no +#### find approve or revoke functions without owner check +no +#### precision loss due to incorrect operation order +no +#### rounding without specifying ceil or floor +no +#### panic in callback function may lock contract - Issue +``` +pub fn create_multisig_callback +``` + +#### no assert_one_yocto in privileged function - Issue +``` +Details: https://github.com/blocksecteam/rustle/blob/main/docs/detectors/yocto-attach.md +Details: https://docs.near.org/build/smart-contracts/security/one-yocto +Example: https://github.com/ref-finance/ref-contracts/blob/536a60c842e018a535b478c874c747bde82390dd/ref-exchange/src/owner.rs#L16 +This can be implemented in the contract by adding assert_one_yocto, which is recommended for all privileged functions. +1. pub fn set_paused +2. pub fn change_upgrade_hash or rewrite condition owner_or_self to only_self +3. pub fn update +4. pub fn activate_registration +5. pub fn register_agents +6. pub fn slash +7. pub fn terminate +8. pub fn drain +9. pub fn withdraw +10. pub fn storage_withdraw +11. pub fn set_operators_check +12. pub fn change_upgrade_hash +``` + +#### duplicate id uses in collections +no, StorageKey +#### no panic on unregistered transfer receivers +N/A +#### find all unimplemented NEP interface +no +#### missing check of prepaid gas in ft_transfer_call +no +#### macro #[private] used in non-callback function +no +#### function result not used or checked +no +#### no upgrade function in contract +no +#### tautology used in conditional branch +no +#### missing balance check for storage expansion +no +#### missing balance check before storage unregister +no + +## Other critical issues +### Critical issue 1. Incorrect logic ft_transfer +``` +https://docs.near.org/build/primitives/ft#transferring-tokens +#[near] +impl Contract { + #[payable] + pub fn send_tokens(&mut self, receiver_id: AccountId, amount: U128) -> Promise { + assert_eq!(env::attached_deposit(), 1, "Requires attached deposit of exactly 1 yoctoNEAR"); + + let promise = ext(self.ft_contract.clone()) + .with_attached_deposit(YOCTO_NEAR) + .ft_transfer(receiver_id, amount, None); + + return promise.then( // Create a promise to callback query_greeting_callback + Self::ext(env::current_account_id()) + .with_static_gas(Gas(30*TGAS)) + .external_call_callback() + ) + } + + #[private] // Public - but only callable by env::current_account_id() + pub fn external_call_callback(&self, #[callback_result] call_result: Result<(), PromiseError>) { + // Check if the promise succeeded + if call_result.is_err() { + log!("There was an error contacting external contract"); + } + } +} +``` + +### Critical issue 2. whitelisting setupped, but not used +``` + /// @param setCheck True if the whitelisting check is needed, and false otherwise. + // Call by the service owner + pub fn set_operators_check(&mut self, service_id: u32, set_check: bool) { +``` + +### Other medium issue +#### We need to clearly decide the logic of who has the right to change the contract as the owner (account in near or self via ???) +``` +pub fn change_owner +require!(self.owner == env::predecessor_account_id()); + +vs + +pub fn owner_or_self(&self) + let caller = env::predecessor_account_id(); + caller == self.tokens.owner_id || caller == env::current_account_id() +pub fn set_paused(&mut self, paused: bool) { + require!(self.owner_or_self()); + +The presence of alternatives is confusing. It is better not to make functions like owner_or_self() - because it makes it unclear how it will actually work set_paused via +require!(self.owner == env::predecessor_account_id()) OR env::predecessor_account_id() == env::current_account_id() +Please, use [#private] for self-calls +``` + +#### fixing, please, TODO (a lot of event) +``` +pub fn change_owner(&mut self, new_owner: AccountId) + // TODO: event +... etc +``` + +#### not panic, refund attached deposit + tests +``` + pub fn create_multisig_callback( + &mut self, + service_id: u32, + name_multisig: AccountId, + #[callback_result] call_result: Result<(), PromiseError>, + ) { + // Check if the promise succeeded by calling the method outlined in external.rs + if call_result.is_err() { + env::panic_str("Multisig creation failed"); + + // TODO refund +``` + +#### not refund by logic +``` + pub fn update_multisig_callback( + &mut self, + service_id: u32, + name_multisig: AccountId, + agent_instances: Vec, + #[callback_result] call_result: Result, PromiseError>, + ) -> bool { + // Check if the promise succeeded by calling the method outlined in external.rs + if call_result.is_err() { + env::panic_str("Multisig update failed"); + + // TODO refund +``` + +#### set_operators_statuses check service_id +``` +require!(self.services.contains_key(&service_id), "Service not found"); +``` + +#### return vs panic in ft_on_transfer? +``` +fn ft_on_transfer( + &mut self, + sender_id: AccountId, + amount: U128, + msg: String, + ) -> PromiseOrValue { + let token = env::predecessor_account_id(); + + // Get token balance the sender + if let Some(b) = self + .all_token_balances + .get_mut(&token) + .unwrap_or_else(|| env::panic_str("Token not registered")) + .get_mut(&sender_id) + { + // TODO saturated + // Increase for the provided amount + *b += amount.0; + log!("Increased the token amount! {}", amount.0); + + // No tokens will be returned + PromiseOrValue::Value(U128::from(0)) + } else { + // otherwise return + PromiseOrValue::Value(U128::from(amount.0)) + } + } +``` + +### Low issue (code) +#### not private pub fn refund_deposit_to_account +``` +#[private] + pub fn refund_deposit_to_account +``` +better "private pub fn" vs "fn". To discussing + +#### better code update_multisig_callback? +``` +let matching = agent_instances.iter().zip(multisig_members.iter()).all(|(ai, mm)| ai == mm); +``` + +#### better code drain? +``` +const NATIVE_TOKEN: &str = "near"; +``` + +### Low issue (doc) +1. Fixing README.md - `Build the code:` - incorrect. + +2. Fixing README.md - remove sandbox part as outdated. + +3. Fixing setup-env.sh to actual versions if needed + +4. Ref FungibleToken in README. + +5. Group all private functions in one place. + + + + diff --git a/audits/internal/analysis/cargo-audit.txt b/audits/internal/analysis/cargo-audit.txt new file mode 100644 index 0000000..a8f5222 --- /dev/null +++ b/audits/internal/analysis/cargo-audit.txt @@ -0,0 +1,42 @@ + Fetching advisory database from `https://github.com/RustSec/advisory-db.git` + Loaded 687 security advisories (from /home/andrey/.cargo/advisory-db) + Updating crates.io index + Scanning Cargo.lock for vulnerabilities (56 crate dependencies) +Crate:  proc-macro-error +Version:  1.0.4 +Warning:  unmaintained +Title:  proc-macro-error is unmaintained +Date:  2024-09-01 +ID:  RUSTSEC-2024-0370 +URL:  https://rustsec.org/advisories/RUSTSEC-2024-0370 +Dependency tree: +proc-macro-error 1.0.4 +└── syn_derive 0.1.8 + └── borsh-derive 1.5.1 + └── borsh 1.5.1 + ├── near-token 0.3.0 + │ └── near-sdk 5.5.0 + │ ├── registries_near 0.1.0 + │ └── near-contract-standards 5.5.0 + │ └── registries_near 0.1.0 + ├── near-sdk 5.5.0 + ├── near-gas 0.3.0 + │ └── near-sdk 5.5.0 + └── near-account-id 1.0.0 + └── near-sdk 5.5.0 + +Crate:  wee_alloc +Version:  0.4.5 +Warning:  unmaintained +Title:  wee_alloc is Unmaintained +Date:  2022-05-11 +ID:  RUSTSEC-2022-0054 +URL:  https://rustsec.org/advisories/RUSTSEC-2022-0054 +Dependency tree: +wee_alloc 0.4.5 +└── near-sdk 5.5.0 + ├── registries_near 0.1.0 + └── near-contract-standards 5.5.0 + └── registries_near 0.1.0 + +warning: 2 allowed warnings found diff --git a/audits/internal/analysis/cargo-clippy.txt b/audits/internal/analysis/cargo-clippy.txt new file mode 100644 index 0000000..98e16f8 --- /dev/null +++ b/audits/internal/analysis/cargo-clippy.txt @@ -0,0 +1,369 @@ + Compiling proc-macro2 v1.0.86 + Compiling unicode-ident v1.0.5 + Compiling version_check v0.9.4 + Compiling syn v1.0.103 + Compiling serde_derive v1.0.147 + Compiling equivalent v1.0.1 + Compiling hashbrown v0.14.5 + Compiling toml_datetime v0.6.8 + Compiling winnow v0.6.20 + Compiling cfg_aliases v0.2.1 + Compiling serde v1.0.147 + Compiling once_cell v1.19.0 + Compiling rustversion v1.0.9 + Compiling serde_json v1.0.87 + Compiling ident_case v1.0.1 + Compiling fnv v1.0.7 + Compiling ryu v1.0.11 + Compiling near-sdk-macros v5.5.0 + Compiling heck v0.5.0 + Compiling borsh v1.5.1 + Compiling itoa v1.0.4 + Compiling strum v0.26.3 + Compiling Inflector v0.11.4 + Checking bs58 v0.5.1 + Checking near-sys v0.2.2 + Checking base64 v0.22.1 + Checking hex v0.4.3 + Compiling proc-macro-error-attr v1.0.4 + Compiling proc-macro-error v1.0.4 + Compiling indexmap v2.5.0 + Compiling quote v1.0.37 + Compiling syn v2.0.77 + Compiling toml_edit v0.22.22 + Compiling proc-macro-crate v3.2.0 + Compiling darling_core v0.20.10 + Compiling syn_derive v0.1.8 + Compiling strum_macros v0.26.4 + Compiling borsh-derive v1.5.1 + Compiling darling_macro v0.20.10 + Compiling darling v0.20.10 + Checking near-gas v0.3.0 + Checking near-token v0.3.0 + Checking near-account-id v1.0.0 + Checking near-sdk v5.5.0 + Checking near-contract-standards v5.5.0 + Checking registries_near v0.1.0 (/home/andrey/valory/registries-near) +warning: use of deprecated macro `near_contract_standards::impl_non_fungible_token_core`: implement the near_contract_standards::non_fungible_token::NonFungibleTokenCore and near_contract_standards::non_fungible_token::NonFungibleTokenResolver traits manually instead. + --> src/lib.rs:1409:1 + | +1409 | near_contract_standards::impl_non_fungible_token_core!(ServiceRegistry, tokens); + | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + | + = note: `#[warn(deprecated)]` on by default + +warning: use of deprecated macro `near_contract_standards::impl_non_fungible_token_approval`: implement the near_contract_standards::non_fungible_token::NonFungibleTokenApproval trait manually instead. + --> src/lib.rs:1410:1 + | +1410 | near_contract_standards::impl_non_fungible_token_approval!(ServiceRegistry, tokens); + | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +warning: use of deprecated macro `near_contract_standards::impl_non_fungible_token_enumeration`: implement the near_contract_standards::non_fungible_token::NonFungibleTokenEnumeration trait manually instead. + --> src/lib.rs:1411:1 + | +1411 | near_contract_standards::impl_non_fungible_token_enumeration!(ServiceRegistry, tokens); + | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +warning: this `else { if .. }` block can be collapsed + --> src/lib.rs:1008:16 + | +1008 | } else { + | ________________^ +1009 | | if transfer_amount > 0 { +1010 | | *amount = 0; +1011 | | ext_ft_core::ext(token) +... | +1014 | | } +1015 | | } + | |_________^ + | + = help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#collapsible_else_if + = note: `#[warn(clippy::collapsible_else_if)]` on by default +help: collapse nested if block + | +1008 ~ } else if transfer_amount > 0 { +1009 + *amount = 0; +1010 + ext_ft_core::ext(token) +1011 + .with_static_gas(CALL_GAS) +1012 + .ft_transfer(env::predecessor_account_id(), U128::from(transfer_amount), None); +1013 + } + | + +warning: use of deprecated type alias `near_sdk::json_types::Base58PublicKey`: PublicKey type is now unified with Base58PublicKey. It is recommended to use PublicKey going forward to avoid using similar sounding types for the same thing. + --> src/lib.rs:8:28 + | +8 | use near_sdk::json_types::{Base58PublicKey, U128}; + | ^^^^^^^^^^^^^^^ + +warning: use of deprecated type alias `near_sdk::json_types::Base58PublicKey`: PublicKey type is now unified with Base58PublicKey. It is recommended to use PublicKey going forward to avoid using similar sounding types for the same thing. + --> src/lib.rs:18:29 + | +18 | AccessKey { public_key: Base58PublicKey }, + | ^^^^^^^^^^^^^^^ + +warning: unused variable: `msg` + --> src/lib.rs:1426:9 + | +1426 | msg: String, + | ^^^ help: if this is intentional, prefix it with an underscore: `_msg` + | + = note: `#[warn(unused_variables)]` on by default + +warning: trait `MultisigFactory` is never used + --> src/lib.rs:24:7 + | +24 | trait MultisigFactory { + | ^^^^^^^^^^^^^^^ + | + = note: `#[warn(dead_code)]` on by default + +warning: trait `Multisig2` is never used + --> src/lib.rs:37:7 + | +37 | trait Multisig2 { + | ^^^^^^^^^ + +warning: this function has too many arguments (9/7) + --> src/lib.rs:138:1 + | +138 | #[near] + | ^^^^^^^ + | + = help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#too_many_arguments + = note: `#[warn(clippy::too_many_arguments)]` on by default + = note: this warning originates in the attribute macro `::near_sdk::near_bindgen` (in Nightly builds, run with -Z macro-backtrace for more info) + +warning: this function has too many arguments (8/7) + --> src/lib.rs:138:1 + | +138 | #[near] + | ^^^^^^^ + | + = help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#too_many_arguments + = note: this warning originates in the attribute macro `::near_sdk::near_bindgen` (in Nightly builds, run with -Z macro-backtrace for more info) + +warning: casting integer literal to `u128` is unnecessary + --> src/lib.rs:160:22 + | +160 | balance: 0 as u128, + | ^^^^^^^^^ help: try: `0_u128` + | + = help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#unnecessary_cast + = note: `#[warn(clippy::unnecessary_cast)]` on by default + +warning: length comparison to zero + --> src/lib.rs:211:18 + | +211 | require!(agent_ids.len() > 0); + | ^^^^^^^^^^^^^^^^^^^ help: using `!is_empty` is clearer and more explicit: `!agent_ids.is_empty()` + | + = help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#len_zero + = note: `#[warn(clippy::len_zero)]` on by default + +warning: this function has too many arguments (9/7) + --> src/lib.rs:229:5 + | +229 | / fn fill_service_params( +230 | | &mut self, +231 | | service_owner: AccountId, +232 | | service_id: u32, +... | +238 | | threshold: u32 +239 | | ) { + | |_____^ + | + = help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#too_many_arguments + +warning: this function has too many arguments (9/7) + --> src/lib.rs:342:5 + | +342 | / pub fn create( +343 | | &mut self, +344 | | service_owner: AccountId, +345 | | metadata: TokenMetadata, +... | +351 | | threshold: u32 +352 | | ) -> bool { + | |_____________^ + | + = help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#too_many_arguments + +warning: this function has too many arguments (8/7) + --> src/lib.rs:424:5 + | +424 | / pub fn update( +425 | | &mut self, +426 | | service_id: u32, +427 | | token: Option, +... | +432 | | threshold: u32 +433 | | ) { + | |_____^ + | + = help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#too_many_arguments + +warning: useless conversion to the same type: `u128` + --> src/lib.rs:505:56 + | +505 | self.balance = self.balance.saturating_add(security_deposit.into()); + | ^^^^^^^^^^^^^^^^^^^^^^^ help: consider removing `.into()`: `security_deposit` + | + = help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#useless_conversion + = note: `#[warn(clippy::useless_conversion)]` on by default + +warning: casting integer literal to `u128` is unnecessary + --> src/lib.rs:558:26 + | +558 | balance: 0 as u128, + | ^^^^^^^^^ help: try: `0_u128` + | + = help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#unnecessary_cast + +warning: casting integer literal to `u128` is unnecessary + --> src/lib.rs:564:30 + | +564 | let mut total_bond = 0 as u128; + | ^^^^^^^^^ help: try: `0_u128` + | + = help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#unnecessary_cast + +warning: casting to the same type is unnecessary (`u32` -> `u32`) + --> src/lib.rs:574:57 + | +574 | require!(agent_params.num_agent_instances > agent_params.instances.len() as u32); + | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ help: try: `agent_params.instances.len()` + | + = help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#unnecessary_cast + +warning: useless conversion to the same type: `u128` + --> src/lib.rs:591:52 + | +591 | total_bond = total_bond.saturating_add(agent_params.bond.into()); + | ^^^^^^^^^^^^^^^^^^^^^^^^ help: consider removing `.into()`: `agent_params.bond` + | + = help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#useless_conversion + +warning: useless conversion to the same type: `u128` + --> src/lib.rs:600:70 + | +600 | operator_data.balance = operator_data.balance.saturating_add(total_bond.into()); + | ^^^^^^^^^^^^^^^^^ help: consider removing `.into()`: `total_bond` + | + = help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#useless_conversion + +warning: useless conversion to the same type: `u128` + --> src/lib.rs:634:56 + | +634 | self.balance = self.balance.saturating_add(total_bond.into()); + | ^^^^^^^^^^^^^^^^^ help: consider removing `.into()`: `total_bond` + | + = help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#useless_conversion + +warning: useless conversion to the same type: `u128` + --> src/lib.rs:840:66 + | +840 | *slashed_funds = (*slashed_funds).saturating_add(balance.into()); + | ^^^^^^^^^^^^^^ help: consider removing `.into()`: `balance` + | + = help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#useless_conversion + +warning: useless conversion to the same type: `u128` + --> src/lib.rs:843:66 + | +843 | *slashed_funds = (*slashed_funds).saturating_add(amount.into()); + | ^^^^^^^^^^^^^ help: consider removing `.into()`: `amount` + | + = help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#useless_conversion + +warning: useless conversion to the same type: `u128` + --> src/lib.rs:844:50 + | +844 | balance = balance.saturating_sub(amount.into()); + | ^^^^^^^^^^^^^ help: consider removing `.into()`: `amount` + | + = help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#useless_conversion + +warning: useless conversion to the same type: `u128` + --> src/lib.rs:892:52 + | +892 | self.balance = self.balance.saturating_sub(refund.into()); + | ^^^^^^^^^^^^^ help: consider removing `.into()`: `refund` + | + = help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#useless_conversion + +warning: casting integer literal to `u128` is unnecessary + --> src/lib.rs:943:26 + | +943 | let mut refund = 0 as u128; + | ^^^^^^^^^ help: try: `0_u128` + | + = help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#unnecessary_cast + +warning: this expression creates a reference which is immediately dereferenced by the compiler + --> src/lib.rs:948:49 + | +948 | let bond = service.agent_params.get(&agent_id).unwrap().bond; + | ^^^^^^^^^ help: change this to: `agent_id` + | + = help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#needless_borrow + = note: `#[warn(clippy::needless_borrow)]` on by default + +warning: useless conversion to the same type: `u128` + --> src/lib.rs:950:44 + | +950 | refund = refund.saturating_add(bond.into()); + | ^^^^^^^^^^^ help: consider removing `.into()`: `bond` + | + = help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#useless_conversion + +warning: useless conversion to the same type: `u128` + --> src/lib.rs:970:52 + | +970 | self.balance = self.balance.saturating_sub(refund.into()); + | ^^^^^^^^^^^^^ help: consider removing `.into()`: `refund` + | + = help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#useless_conversion + +warning: length comparison to zero + --> src/lib.rs:1137:18 + | +1137 | require!(operators.len() > 0); + | ^^^^^^^^^^^^^^^^^^^ help: using `!is_empty` is clearer and more explicit: `!operators.is_empty()` + | + = help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#len_zero + +warning: casting integer literal to `u128` is unnecessary + --> src/lib.rs:1159:30 + | +1159 | balance: 0 as u128, + | ^^^^^^^^^ help: try: `0_u128` + | + = help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#unnecessary_cast + +warning: this if-then-else expression returns a bool literal + --> src/lib.rs:1214:23 + | +1214 | self.paused = if paused { true } else { false }; + | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ help: you can reduce it to: `paused` + | + = help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#needless_bool + = note: `#[warn(clippy::needless_bool)]` on by default + +warning: this expression creates a reference which is immediately dereferenced by the compiler + --> src/lib.rs:1246:76 + | +1246 | agent_params_num_agent_instances.push(service.agent_params.get(&ai).unwrap().num_agent_instances); + | ^^^ help: change this to: `ai` + | + = help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#needless_borrow + +warning: this expression creates a reference which is immediately dereferenced by the compiler + --> src/lib.rs:1257:62 + | +1257 | agent_params_bonds.push(service.agent_params.get(&ai).unwrap().bond); + | ^^^ help: change this to: `ai` + | + = help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#needless_borrow + +warning: `registries_near` (lib) generated 37 warnings (1 duplicate) (run `cargo clippy --fix --lib -p registries_near` to apply 23 suggestions) + Finished `dev` profile [unoptimized + debuginfo] target(s) in 6.43s diff --git a/audits/internal/analysis/cargo_tree.txt b/audits/internal/analysis/cargo_tree.txt new file mode 100644 index 0000000..7c71512 --- /dev/null +++ b/audits/internal/analysis/cargo_tree.txt @@ -0,0 +1,90 @@ +registries_near v0.1.0 (/home/andrey/valory/registries-near) +├── hex v0.4.3 +├── near-contract-standards v5.5.0 +│ └── near-sdk v5.5.0 +│ ├── base64 v0.22.1 +│ ├── borsh v1.5.1 +│ │ └── borsh-derive v1.5.1 (proc-macro) +│ │ ├── once_cell v1.19.0 +│ │ ├── proc-macro-crate v3.2.0 +│ │ │ └── toml_edit v0.22.22 +│ │ │ ├── indexmap v2.5.0 +│ │ │ │ ├── equivalent v1.0.1 +│ │ │ │ └── hashbrown v0.14.5 +│ │ │ ├── toml_datetime v0.6.8 +│ │ │ └── winnow v0.6.20 +│ │ ├── proc-macro2 v1.0.86 +│ │ │ └── unicode-ident v1.0.5 +│ │ ├── quote v1.0.37 +│ │ │ └── proc-macro2 v1.0.86 (*) +│ │ ├── syn v2.0.77 +│ │ │ ├── proc-macro2 v1.0.86 (*) +│ │ │ ├── quote v1.0.37 (*) +│ │ │ └── unicode-ident v1.0.5 +│ │ └── syn_derive v0.1.8 (proc-macro) +│ │ ├── proc-macro-error v1.0.4 +│ │ │ ├── proc-macro-error-attr v1.0.4 (proc-macro) +│ │ │ │ ├── proc-macro2 v1.0.86 (*) +│ │ │ │ └── quote v1.0.37 (*) +│ │ │ │ [build-dependencies] +│ │ │ │ └── version_check v0.9.4 +│ │ │ ├── proc-macro2 v1.0.86 (*) +│ │ │ └── quote v1.0.37 (*) +│ │ │ [build-dependencies] +│ │ │ └── version_check v0.9.4 +│ │ ├── proc-macro2 v1.0.86 (*) +│ │ ├── quote v1.0.37 (*) +│ │ └── syn v2.0.77 (*) +│ │ [build-dependencies] +│ │ └── cfg_aliases v0.2.1 +│ ├── bs58 v0.5.1 +│ ├── near-account-id v1.0.0 +│ │ ├── borsh v1.5.1 (*) +│ │ └── serde v1.0.147 +│ │ └── serde_derive v1.0.147 (proc-macro) +│ │ ├── proc-macro2 v1.0.86 (*) +│ │ ├── quote v1.0.37 (*) +│ │ └── syn v1.0.103 +│ │ ├── proc-macro2 v1.0.86 (*) +│ │ ├── quote v1.0.37 (*) +│ │ └── unicode-ident v1.0.5 +│ ├── near-gas v0.3.0 +│ │ ├── borsh v1.5.1 (*) +│ │ └── serde v1.0.147 (*) +│ ├── near-sdk-macros v5.5.0 (proc-macro) +│ │ ├── Inflector v0.11.4 +│ │ ├── darling v0.20.10 +│ │ │ ├── darling_core v0.20.10 +│ │ │ │ ├── fnv v1.0.7 +│ │ │ │ ├── ident_case v1.0.1 +│ │ │ │ ├── proc-macro2 v1.0.86 (*) +│ │ │ │ ├── quote v1.0.37 (*) +│ │ │ │ └── syn v2.0.77 (*) +│ │ │ └── darling_macro v0.20.10 (proc-macro) +│ │ │ ├── darling_core v0.20.10 (*) +│ │ │ ├── quote v1.0.37 (*) +│ │ │ └── syn v2.0.77 (*) +│ │ ├── proc-macro2 v1.0.86 (*) +│ │ ├── quote v1.0.37 (*) +│ │ ├── serde v1.0.147 +│ │ │ └── serde_derive v1.0.147 (proc-macro) (*) +│ │ ├── serde_json v1.0.87 +│ │ │ ├── itoa v1.0.4 +│ │ │ ├── ryu v1.0.11 +│ │ │ └── serde v1.0.147 (*) +│ │ ├── strum v0.26.3 +│ │ ├── strum_macros v0.26.4 (proc-macro) +│ │ │ ├── heck v0.5.0 +│ │ │ ├── proc-macro2 v1.0.86 (*) +│ │ │ ├── quote v1.0.37 (*) +│ │ │ ├── rustversion v1.0.9 (proc-macro) +│ │ │ └── syn v2.0.77 (*) +│ │ └── syn v2.0.77 (*) +│ ├── near-sys v0.2.2 +│ ├── near-token v0.3.0 +│ │ ├── borsh v1.5.1 (*) +│ │ └── serde v1.0.147 (*) +│ ├── once_cell v1.19.0 +│ ├── serde v1.0.147 (*) +│ └── serde_json v1.0.87 (*) +└── near-sdk v5.5.0 (*) diff --git a/src/lib.rs b/src/lib.rs index 0b2cc5c..e5e0e1e 100644 --- a/src/lib.rs +++ b/src/lib.rs @@ -783,6 +783,7 @@ impl ServiceRegistry { // Check agent instances vs multisig members let multisig_members = call_result.unwrap(); let matching = agent_instances.iter().zip(multisig_members.iter()).filter(|&(ai, mm)| ai == mm).count(); + //let matching = agent_instances.iter().zip(multisig_members.iter()).filter(|&(ai, mm)| match ai {MultisigMember::Account(value) => value == mm, _ => {false}}).count(); if matching == agent_instances.len() && matching == multisig_members.len() { service.multisig = Some(name_multisig);