Feat/issue 131 gasless relay - #140
Merged
elizabetheonoja-art merged 15 commits intoAug 20, 2026
Merged
Conversation
Implements core components for gasless transaction relay system to support user onboarding by allowing the protocol to sponsor gas costs: - EIP-2771 compatible trusted forwarder with meta-transaction support - Gas sponsorship policy engine for approved operations - Per-address rate limiting to prevent abuse (configurable per user) - Nonce management with replay attack protection - Sponsorship pool balance management with top-up functionality - Comprehensive integration tests (15 test cases) Features: - Forward meta-transactions with deadline validation - Track sponsorship pool deductions - Configurable policies per operation type - Rate limit tracking per user per time period - Admin-only configuration operations - Proper error handling with dedicated error codes
…actions Implements EIP-2771 compatible signature verification module for gasless relay: - Ed25519 signature verification with timestamp validation - Approved forwarder validation against whitelist - Meta-transaction request hashing for signature verification - Signer address validation and recovery - Nonce-based replay attack prevention for forwarders - Request structure validation - Signature age checking (6-hour window) Provides cryptographic foundation for secure meta-transaction relay operations. Includes comprehensive unit tests for all verification functions.
Creates comprehensive policy management system for gas sponsorship: Features: - Detailed sponsorship policies per operation type - Multiple sponsorship statuses: Full, Partial, Suspended, NotSponsored - Operation eligibility checking with multiple validation points - Gas limit enforcement per operation - Daily transaction limits with automatic reset - Sponsorship pool balance verification - Operation statistics tracking (gas, cost, transaction counts) - Policy suspension and resumption for operational control - Policy listing and retrieval functions - Transaction recording with stat updates Policies support: - Configurable gas limits per operation - Flexible sponsorship percentage (0-100%) - Daily transaction rate limiting - Cost tracking per operation - Admin-only policy management - Policy status transitions Includes unit tests for initialization, policy creation, and eligibility checks.
…asless relay Provides extensive integration test suite covering: Complete flows: - End-to-end user onboarding with gasless relay - Replay attack prevention mechanisms - Multi-user rate limiting scenarios - Sponsorship pool depletion and recovery - Policy suspension and resumption workflows Advanced scenarios: - Mixed full and partial sponsorship levels - Concurrent meta-transactions from same user - Forwarder validation and trusted forwarder enforcement - Gas limit enforcement per operation type - Operation statistics tracking and reporting - Emergency pool drain recovery procedures Edge cases: - Nonce overflow handling - Policy updates and versioning - Signature expiration validation - Daily limit reset at period boundaries - Pool balance consistency verification - System upgrade scenarios 16 integration test scenarios that validate: - Correct state transitions - Proper error conditions - Cross-component interactions - Resource management - Security properties Tests are structured to guide implementation and validate the complete relay system functionality.
…tion Provides complete reference documentation for the gasless relay system: Sections: - Architecture overview of three main components - EIP-2771 compatibility explanation - Detailed feature descriptions (replay prevention, rate limiting, etc.) - Usage flow with code examples - Comprehensive error reference table - Security considerations and best practices - Operational procedures for monitoring and management - Performance characteristics - Testing strategy (unit, integration, property tests) - Future enhancement roadmap - Governance model and role definitions - Cost analysis for sponsored transactions - Production deployment and rollback procedures - References to standards and documentation Documentation serves as: - Technical reference for developers - Operational guide for administrators - Design rationale for stakeholders - Integration guide for contract consumers Includes code examples, tables, and clear explanations of all system capabilities and constraints.
Remove unused imports: - panic_with_error from gasless_relay.rs - ToXdr, Symbol from gasless_relay_sig_verify.rs This resolves clippy warnings about unused imports without changing code formatting.
OZILSOLAR
force-pushed
the
feat/issue-131-gasless-relay
branch
from
August 20, 2026 03:42
06bd695 to
ed8cdcf
Compare
- meter-simulator: Fixed ip-address vulnerability (v10.4.0 or higher) - usage-dashboard: Upgraded dependencies to address minimatch and postcss vulnerabilities - webhook-delivery-service: Already clean (0 vulnerabilities) Results: - meter-simulator: 0 vulnerabilities ✓ - webhook-delivery-service: 0 vulnerabilities ✓ - usage-dashboard: 2 high severity vulnerabilities remaining (requires Next.js v16+ breaking change) The ip-address SSRF and trust-boundary bypass vulnerabilities have been resolved.
- Upgraded Next.js from ^14.2.35 to ^16.3.1 (breaking change) - Pinned PostCSS to ^8.5.23 (security patch) - Next.js v16 bundles patched versions of PostCSS and sharp Results: - Production audit (--omit=dev): 0 vulnerabilities ✓ - Resolves all npm audit checks on CI Dev dependencies (minimatch in @typescript-eslint) remain but are omitted from production audit as per CI policy.
The upgrade from Next.js 14 to 16 resolves critical security vulnerabilities in bundled dependencies (PostCSS, sharp). This is a necessary security fix that allows the usage-dashboard to pass production dependency audits.
- Updated eslint-config-next from 14.0.4 to 16.3.1 (matches Next.js version) - Updated TypeScript ESLint to v8.67.0 - Updated eslint to v10.8.1 Results: - Production audit (--omit=dev): 0 vulnerabilities ✓ - Full audit (--audit-level=high): 0 vulnerabilities ✓ All npm audit CI checks now pass.
Upgrades rand crate to patch unsoundness vulnerability with custom logger usage. Resolves cargo audit warning (RUSTSEC-2026-0097: rand is unsound with a custom logger using rand::rng()). No changes to Rust code - dependency version bump only.
The iot-payload-generator root package is for local testing and should not be built for wasm32 target. Only build actual Soroban contracts in the contracts/ workspace.
More explicit approach to build only the contracts workspace for WASM target. Also update artifact path to use contracts/target instead of root target.
Resolves 'no global memory allocator found' error when building Soroban contracts for wasm32-unknown-unknown target. Changes: - Add wee_alloc 0.4.5 as dependency to all contracts - Define #[global_allocator] in each contract's lib.rs - Enable 'wasm' feature in common library for contracts that depend on it - Feature-gate allocator for common lib (wasm-only) This fixes the WASM compilation error across all contract packages.
…_alloc to settlement - Move module doc comments in oracle-aggregator to the top of the file (before allocator) Inner doc comments (//!) must come first before any code - Add wee_alloc dependency to settlement Cargo.toml - Add allocator code to settlement lib.rs
elizabetheonoja-art
merged commit Aug 20, 2026
6a8901e
into
Utility-Protocol:main
6 of 10 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Gasless Transaction Relay for User Onboarding (Issue #131)
Implements a complete EIP-2771 compatible gasless transaction relay system to sponsor gas costs for approved operations during user onboarding, removing
barriers to protocol adoption.
Features Implemented
Changes
Security
Testing
Closes #131