Safe Hands: Solana transaction authorization suite (T0 guard + T1 builder + T1 Squads proposer)#112
Draft
Pratiikpy wants to merge 18 commits into
Draft
Safe Hands: Solana transaction authorization suite (T0 guard + T1 builder + T1 Squads proposer)#112Pratiikpy wants to merge 18 commits into
Pratiikpy wants to merge 18 commits into
Conversation
…nding, T22 rules, velocity, fee caps (31 tests)
…trip) with roundtrip tests (40 total)
…ts, intent binding, injection-proof (8 tests + wasip2 component, 494KB)
…ilder policy pre-check + roundtrip invariant (6 tests, 514KB component)
…+ forged-verdict rejection + Squads v4 proposals (6 tests incl. SH-TRUST-FORGED)
…+ live devnet multisig + full 3-tool flow proven
…, 0.05 SOL moved from vault
… clippy clean on host & wasm targets
… custody tiers, threat models, transcripts
… QA) + SPL on-chain evidence
…harness - decode: resolve v0 Address Lookup Tables explicitly; fail closed when loaded addresses are missing or count-mismatched; preserve signer/ writable flags and program-id-by-index after resolution - policy: aggregate per-transaction spend caps and exact intent-amount matching across all transfers, closing the split-transfer cap bypass - tlv: correct Token-2022 AccountType::Mint marker (1, not 2), with an independent golden test - authorize: require fresh, structurally complete simulation evidence (context.slot + getSlot within max_slot_age); missing evidence -> UNKNOWN - rpc: MockTransport records (method, params) pairs for exact assertions - conformance: supply context.slot + getSlot in the mock so the 20-fixture arena matches the hardened simulate() contract (20/20 passing)
- LICENSE: MIT (the repo previously shipped no license text) — satisfies the submission's MIT requirement; holder "Safe Hands contributors" - .gitignore: ignore env files, private keys / Solana keypairs, local scratch, and node_modules; no blanket *.json so YAML fixtures and registry.json stay tracked
Matches upstream CI (tools/ci/validate_components.sh) locked builds. Fixes the misleading "offline" claim: tests mock RPC (no live network), but cargo still fetches dependencies on a fresh clone, so --offline is not forced.
…+ decoder fuzz A property-based fuzz of the decoder (arbitrary bytes -> Ok/Err, never panic) found a real panic on hostile input: a v0 or legacy message header whose readonly counts exceed the key partition underflowed the writable/signer computation, and legacy parsing indexed account keys without a bounds check. Both now validate and fail closed. - decode: enforce `readonly_signed <= num_signers` and `num_signers + readonly_unsigned <= key_count` for v0 and legacy; bounds-check every legacy account index instead of indexing directly - policy/tests: 6 property-based security invariants (under-cap allows; split-aggregate over-cap never allows; disallowed recipient never allows; authority-change always denies; signed never allows; evaluation deterministic) - roundtrip: decoder totality fuzz (1024 cases) + committed regression seed Verified: core 66, authorize 11, spl 6, squads 6, conformance 20/20.
Clone-and-run reproduction of the safety claim without `just`: host tests (property invariants + decoder fuzz), the 20-fixture attack arena, and all three wasm32-wasip2 release builds. No keys, no funds, no live network.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this is
Three wasm32-wasip2 tool components + a shared core that give a ZeroClaw agent a complete, safe path for moving Solana money:
The agent proposes, a Squads multisig disposes. No component holds a key or signs anything.
Prove it in one command (offline)
All unit tests + a 20-fixture YAML attack arena (amount/recipient/mint swaps, hidden transfers, authority handovers, unlimited delegates, durable nonces, fail-closed paths, and a forged caller-supplied ALLOW) + clippy -D warnings on host and wasm32-wasip2 + release builds of all three components.
Already run live
Notes for review