Add Superchain interop message passing #595

ericglau · 2025-07-04T21:18:41Z

Remaining items:

gonzaotc · 2025-07-28T23:33:15Z

Solid!, just one thing that you are probably aware of; the ai assistant seems to be generating crosschain messaging code very well, however the changes aren't getting correctly reflected on the UI, the contract code appears, but the checkboxes are kept unchecked as if nothing happened, they're not in sync with the code changes made by the ai

gonzaotc · 2025-07-29T00:43:19Z

packages/ui/src/solidity/superchain-tooltip.ts

  content:
-    '<strong>Important:</strong> Only available on chains in the Superchain. Requires deploying your contract to the same address on every chain in the Superchain. <a class="light-link" href="https://docs.optimism.io/stack/interop/superchain-erc20#requirements" target="_blank" rel="noopener noreferrer">Read more.</a>',
+    '<strong>Important:</strong> Only available on chains in the Superchain. Requires deploying your contract to the same address on every chain in the Superchain.',


I noticed the current comment in this tooltip suggests that same-address deployment across chains is always required for Superchain messaging passing, but given my current understanding I think this isn't true for all scenarios, and that it only applies when it is desired to allow only the same contract to call itself across chains.

I think there may be other valid cross-chain messaging patterns using the Superchain where contracts accept messages from different origin senders than themselves, and those wouldn't need same-address deployment.

Maybe we could adjust the comment to clarify that this requirement is conditional based on the authentication pattern being used?, wdyt?

I've removed the same address requirement from the tooltip, and reworded the NatSpec message to be clearer in commit 5bb6fe5. Let me know if you think that conveys the points.

socket-security · 2025-07-29T21:08:47Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Vulnerability	Maintenance
@nomicfoundation/hardhat-toolbox@6.0.0
@eth-optimism/contracts-bedrock@0.17.3
hardhat@2.26.1 ⏵ 2.22.19		^-1
@openzeppelin/contracts@5.4.0 ⏵ 5.3.0	^-4

View full report

socket-security · 2025-07-29T23:07:31Z

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Block		`[email protected]` has a Critical CVE. CVE: GHSA-vjh7-7g9h-fjfh Elliptic's private key extraction in ECDSA upon signing a malformed input (e.g. a string) (CRITICAL) Affected versions: < 6.6.1 Patched version: 6.6.1 From: packages/core/solidity/src/environments/hardhat/optimism/package-lock.json → `npm/[email protected]` → `npm/@nomicfoundation/[email protected]` → `npm/[email protected]` ℹ Read more on: This package \| This alert \| What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `[email protected]`. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/[email protected]`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		`[email protected]` has a Critical CVE. CVE: GHSA-fjxv-7rqg-78g4 form-data uses unsafe random function in form-data for choosing boundary (CRITICAL) Affected versions: < 2.5.4; >= 3.0.0 < 3.0.4; >= 4.0.0 < 4.0.4 Patched version: 4.0.4 From: packages/core/solidity/src/environments/hardhat/optimism/package-lock.json → `npm/@nomicfoundation/[email protected]` → `npm/[email protected]` ℹ Read more on: This package \| This alert \| What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `[email protected]`. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/[email protected]`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		`[email protected]` has a Critical CVE. CVE: GHSA-h7cp-r72f-jxh6 pbkdf2 returns predictable uninitialized/zero-filled memory for non-normalized or unimplemented algos (CRITICAL) Affected versions: >= 3.0.10 < 3.1.3 Patched version: 3.1.3 From: packages/core/solidity/src/environments/hardhat/optimism/package-lock.json → `npm/[email protected]` → `npm/@nomicfoundation/[email protected]` → `npm/[email protected]` ℹ Read more on: This package \| This alert \| What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `[email protected]`. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/[email protected]`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		`[email protected]` has a Critical CVE. CVE: GHSA-v62p-rq8g-8h59 pbkdf2 silently disregards Uint8Array input, returning static keys (CRITICAL) Affected versions: < 3.1.3 Patched version: 3.1.3 From: packages/core/solidity/src/environments/hardhat/optimism/package-lock.json → `npm/[email protected]` → `npm/@nomicfoundation/[email protected]` → `npm/[email protected]` ℹ Read more on: This package \| This alert \| What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `[email protected]`. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/[email protected]`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		`[email protected]` has a High CVE. CVE: GHSA-xq7p-g2vc-g82p Homograph attack allows Unicode lookalike characters to bypass validation. (HIGH) Affected versions: = 5.0.0, 4.0.0; >= 5.0.0 < 5.0.1; >= 4.0.0 < 4.0.1; < 3.0.11 Patched version: 3.0.11 From: packages/core/solidity/src/environments/hardhat/optimism/package-lock.json → `npm/[email protected]` → `npm/@nomicfoundation/[email protected]` → `npm/[email protected]` ℹ Read more on: This package \| This alert \| What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `[email protected]`. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/[email protected]`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		`[email protected]` has a Low CVE. CVE: GHSA-49q7-c7j4-3p7m Elliptic allows BER-encoded signatures (LOW) Affected versions: >= 5.2.1 < 6.5.7 Patched version: 6.5.7 From: packages/core/solidity/src/environments/hardhat/optimism/package-lock.json → `npm/[email protected]` → `npm/@nomicfoundation/[email protected]` → `npm/[email protected]` ℹ Read more on: This package \| This alert \| What is a mild CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `[email protected]`. Suggestion: Remove or replace dependencies that include known low severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/[email protected]`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		`[email protected]` has a Low CVE. CVE: GHSA-f7q4-pwc6-w24p Elliptic's EDDSA missing signature length check (LOW) Affected versions: >= 4.0.0 < 6.5.7 Patched version: 6.5.7 From: packages/core/solidity/src/environments/hardhat/optimism/package-lock.json → `npm/[email protected]` → `npm/@nomicfoundation/[email protected]` → `npm/[email protected]` ℹ Read more on: This package \| This alert \| What is a mild CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `[email protected]`. Suggestion: Remove or replace dependencies that include known low severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/[email protected]`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		`[email protected]` has a Low CVE. CVE: GHSA-977x-g7h5-7qgw Elliptic's ECDSA missing check for whether leading bit of r and s is zero (LOW) Affected versions: >= 2.0.0 < 6.5.7 Patched version: 6.5.7 From: packages/core/solidity/src/environments/hardhat/optimism/package-lock.json → `npm/[email protected]` → `npm/@nomicfoundation/[email protected]` → `npm/[email protected]` ℹ Read more on: This package \| This alert \| What is a mild CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `[email protected]`. Suggestion: Remove or replace dependencies that include known low severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/[email protected]`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		`[email protected]` has a Low CVE. CVE: GHSA-434g-2637-qmqr Elliptic's verify function omits uniqueness validation (LOW) Affected versions: < 6.5.6 Patched version: 6.5.6 From: packages/core/solidity/src/environments/hardhat/optimism/package-lock.json → `npm/[email protected]` → `npm/@nomicfoundation/[email protected]` → `npm/[email protected]` ℹ Read more on: This package \| This alert \| What is a mild CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `[email protected]`. Suggestion: Remove or replace dependencies that include known low severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/[email protected]`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		`[email protected]` has a Low CVE. CVE: GHSA-fc9h-whq2-v747 Valid ECDSA signatures erroneously rejected in Elliptic (LOW) Affected versions: < 6.6.0 Patched version: 6.6.0 From: packages/core/solidity/src/environments/hardhat/optimism/package-lock.json → `npm/[email protected]` → `npm/@nomicfoundation/[email protected]` → `npm/[email protected]` ℹ Read more on: This package \| This alert \| What is a mild CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `[email protected]`. Suggestion: Remove or replace dependencies that include known low severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/[email protected]`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		`[email protected]` has a Low CVE. CVE: GHSA-cxrh-j4jr-qwg3 undici Denial of Service attack via bad certificate data (LOW) Affected versions: < 5.29.0; >= 6.0.0 < 6.21.2; >= 7.0.0 < 7.5.0 Patched version: 5.29.0 From: packages/core/solidity/src/environments/hardhat/optimism/package-lock.json → `npm/[email protected]` → `npm/@nomicfoundation/[email protected]` → `npm/[email protected]` ℹ Read more on: This package \| This alert \| What is a mild CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `[email protected]`. Suggestion: Remove or replace dependencies that include known low severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/[email protected]`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

ericglau added 24 commits June 17, 2025 11:39

prototype

b6f21a9

Adjust look

9f8d50b

Add placeholder checkbox

8bddafb

Add separate options

9248727

Use svelte component for crosschain messaging

7a02121

Simplify options passing

ce336b9

Sanitize

4302bc9

Adjust min width

bb68267

Track errors

b4a85d9

Update help info

2d36384

Update access control

1f1d881

Add custom errors, doc comments

2916ce8

Add modifier def

ae753fd

avoid infer transpile

5206bfd

Refactor

7d78177

Lint

22b67cf

Update snapshots

21d2c52

Add contracts-bedrock

048bffb

Merge remote-tracking branch 'upstream/master' into superchaininterop

6e26410

add tests

3c52b72

Update AI fn defs

c927b52

Add changeset

84ca34d

Fix import

d45742c

lint svelte

4c6e35f

ericglau requested a review from a team July 7, 2025 03:53

ericglau requested a review from gonzaotc July 21, 2025 16:32

ericglau added 4 commits July 28, 2025 16:51

Add tooltip when enabled

019c9ba

Merge branch 'master' into superchaininterop

6beff7c

Fix compile

2e3dd4d

WIP test get imports

c12b388

gonzaotc reviewed Jul 29, 2025

View reviewed changes

ericglau added 2 commits July 29, 2025 17:06

Fix minimum cover to get all imports

65cce15

Lint

716aed2

ericglau added 3 commits July 29, 2025 17:55

Update tooltip and natspec messages

5bb6fe5

Fix reactivity for ai assistant

beeb31a

Lint

d415620

ericglau added 11 commits July 30, 2025 11:48

Update prompts and schemas for clarity

68f8293

Add zip hardhat environments and test cases

9d40c46

Add natspec tag to allow immutable

af6c210

Lint

e0efb37

WIP Add zip foundry test

4f809de

Add Optimism dependencies to Foundry package

8b01556

Use Optimism npm package version

6310e3e

Fix remapping

9d59528

Add fallback when modifying remappings

17ad272

Rename instead of add remapping

ed36ec9

Lint

4ed8218

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Add Superchain interop message passing #595

Add Superchain interop message passing #595

Uh oh!

ericglau commented Jul 4, 2025 •

edited

Loading

Uh oh!

gonzaotc commented Jul 28, 2025 •

edited

Loading

Uh oh!

gonzaotc Jul 29, 2025 •

edited

Loading

Uh oh!

ericglau Jul 29, 2025

Uh oh!

socket-security bot commented Jul 29, 2025 •

edited

Loading

Uh oh!

socket-security bot commented Jul 29, 2025 •

edited

Loading

Uh oh!

Uh oh!

Add Superchain interop message passing #595

Are you sure you want to change the base?

Add Superchain interop message passing #595

Uh oh!

Conversation

ericglau commented Jul 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gonzaotc commented Jul 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gonzaotc Jul 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ericglau Jul 29, 2025

Choose a reason for hiding this comment

Uh oh!

socket-security bot commented Jul 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security bot commented Jul 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

ericglau commented Jul 4, 2025 •

edited

Loading

gonzaotc commented Jul 28, 2025 •

edited

Loading

gonzaotc Jul 29, 2025 •

edited

Loading

socket-security bot commented Jul 29, 2025 •

edited

Loading

socket-security bot commented Jul 29, 2025 •

edited

Loading