Sulkta-OSS/aldabra
3
0
Fork 0
Code Issues 1 Pull requests 5 Projects Releases Packages Wiki Activity Actions

chore: strip audit-ticket prefixes from code comments

Browse source 
Drops the ~60 ticket-prefix comments (CRIT-N, HIGH-N, MED-N, LOW-N,
L-N, M-N, AUDIT-N, PLUTUS-N, "audit fix (date):", "Phase N" labels,
"Adversarial-review fix:") that had accumulated in inline + doc
comments over several audit cycles. Where the surrounding prose
still carried useful WHY context it gets kept and tightened; where
the ticket WAS the comment it gets dropped entirely.

No logic, no renames, no behavior change. Audit history lives in
commit messages and the audits/ tree where it belongs — eternal
comments don't need to mirror it.

Net 138 LOC shorter. 253 tests pass, no new clippy or fmt warnings.
This commit is contained in:
Sulkta 2026-05-12 14:42:13 -07:00
parent 4e4becd0bb
commit b69d891a2b
12 changed files with 201 additions and 339 deletions
Download patch file Download diff file Expand all files Collapse all files

39
crates/aldabra-dao/src/builder/escrow_open.rs
View file

@ -89,16 +89,12 @@ pub struct UnsignedEscrowOpen {
pub fn build_unsigned_escrow_open(args: EscrowOpenArgs) -> DaoResult<UnsignedEscrowOpen> {
// ---- preflight ----
//
// HIGH-2 fix (2026-05-09 audit): refuse `initial_contributor=None`
// entirely. Previously this opened an escrow with `deposits=[]` and
// `initial_lovelace > 0`, which the validator (pre-fix) treated as
// a refundable-by-anyone escrow because `refund_outputs_satisfy(_, [])`
// is vacuously true. Even with the validator now enforcing
// `sum(deposits) == in_value`, the empty-deposits path produces a
// permanently-stuck escrow (no Veto/Refund possible until somebody
// deposits). Cleaner v1 invariant: every escrow has at least one
// contributor at open. The "open empty, top up later" UX was never
// useful anyway — party_a can just open + deposit in a single call.
// Every escrow needs at least one contributor at open. With
// `deposits=[]` the validator's `refund_outputs_satisfy(_, [])`
// returns vacuously true (drainable on Veto/Refund), and even
// post-fix the empty-deposits path produces a permanently-stuck
// escrow until someone deposits. Cleaner invariant: party_a can
// just open + deposit in a single call.
let initial_contributor = args.initial_contributor.ok_or_else(|| {
DaoError::State(
"initial_contributor is required — open an escrow with at least one contributor (party_a or party_b)"
@ -111,12 +107,11 @@ pub fn build_unsigned_escrow_open(args: EscrowOpenArgs) -> DaoResult<UnsignedEsc
));
}
// MED-5 fix (2026-05-09 audit): the escrow output bears an inline
// datum + sits at a script address — Conway-era min-utxo computes
// to ~1.4-1.7 ADA depending on datum size, NOT the 1 ADA default.
// Bump our floor to match the deposit/spend builders' constant
// (2 ADA) so an open tx that passes preflight also passes
// pallas-txbuilder's actual min-utxo computation.
// The escrow output bears an inline datum + sits at a script
// address — Conway-era min-utxo computes to ~1.4-1.7 ADA depending
// on datum size, not the 1 ADA default. Floor matches the
// deposit/spend builders' 2 ADA constant so an open tx that
// passes preflight also passes pallas-txbuilder's min-utxo check.
const ESCROW_OPEN_MIN_LOVELACE: u64 = 2_000_000;
if args.initial_lovelace < ESCROW_OPEN_MIN_LOVELACE {
return Err(DaoError::State(format!(
@ -127,9 +122,8 @@ pub fn build_unsigned_escrow_open(args: EscrowOpenArgs) -> DaoResult<UnsignedEsc
// ---- build the datum ----
//
// initial_contributor is now mandatory (see HIGH-2 fix above). Build
// the EscrowValue mirroring what's actually paid into the script
// output: lovelace + any native assets.
// Build the EscrowValue mirroring what's actually paid into the
// script output: lovelace plus any native assets.
let mut value = EscrowValue::ada(args.initial_lovelace);
for a in &args.initial_assets {
let policy = hex::decode(&a.policy_id_hex)
@ -197,10 +191,9 @@ mod tests {
#[test]
fn rejects_no_initial_contributor() {
// HIGH-2 fix: opening an escrow with `None` initial_contributor
// is now refused (formerly produced a deposits=[] escrow that
// could be drained on Veto / Refund via vacuous-true
// refund_outputs_satisfy).
// Opening with `None` is refused — a deposits=[] escrow used
// to be drainable on Veto / Refund via vacuous-true
// refund_outputs_satisfy.
let args = EscrowOpenArgs {
network: Network::Preprod,
escrow_script_address: "addr_test1wpyt48l...".to_string(),