❄️ Graph Horizon and Subgraph Service ❄️ #944

pcarranzav · 2024-02-20T12:50:02Z

No description provided.

openzeppelin-code · 2024-02-20T12:58:34Z

❄️ Graph Horizon and Subgraph Service ❄️

Generated at commit: 1eb425080df31143186e0f60606c57d7e9fd93ca

🚨 Report Summary

	Severity Level	Results
Contracts	Critical High Medium Low Note Total	2 4 0 15 39 60
Dependencies	Critical High Medium Low Note Total	0 0 0 0 0 0

For more details view the full report in OpenZeppelin Code Inspector

socket-security · 2024-02-21T20:53:48Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		`@openzeppelin/[email protected]` has a Critical CVE. CVE: GHSA-fg47-3c2x-m2wr TimelockController vulnerability in OpenZeppelin Contracts (CRITICAL) Affected versions: >= 4.0.0 < 4.3.1; >= 3.3.0 < 3.4.2 Patched version: 3.4.2 From: packages/contracts/package.json → `npm/@openzeppelin/[email protected]` ℹ Read more on: This package \| This alert \| What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `[email protected]`. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@openzeppelin/[email protected]`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

codecov · 2024-02-21T21:12:34Z

Codecov Report

❌ Patch coverage is 86.76471% with 9 lines in your changes missing coverage. Please review.
✅ Project coverage is 82.84%. Comparing base (cbda0fc) to head (1eb4250).
⚠️ Report is 665 commits behind head on main.

Files with missing lines	Patch %	Lines
...ges/contracts/contracts/rewards/RewardsManager.sol	82.14%	5 Missing ⚠️
...ges/contracts/contracts/l2/curation/L2Curation.sol	50.00%	2 Missing ⚠️
packages/contracts/contracts/staking/Staking.sol	75.00%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #944      +/-   ##
==========================================
- Coverage   86.06%   82.84%   -3.22%     
==========================================
  Files          47       47              
  Lines        2074     2093      +19     
  Branches      613      620       +7     
==========================================
- Hits         1785     1734      -51     
- Misses        289      359      +70

Flag	Coverage Δ
unittests	`82.84% <86.76%> (-3.22%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

socket-security · 2024-03-14T20:05:03Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Vulnerability	Quality	Maintenance
@openzeppelin/contracts@5.3.0 ⏵ 3.4.1		^-70	^-5
@types/json5@2.2.0
@openzeppelin/foundry-upgrades@0.4.0
@graphql-yoga/plugin-persisted-operations@3.13.6 ⏵ 3.15.2	⁺¹		⁺³	⁺³
@graphprotocol/sdk@0.6.0
@nomicfoundation/hardhat-foundry@1.2.0
@nomicfoundation/hardhat-toolbox@4.0.0
@wagmi/cli@2.5.1
@ethersproject/providers@5.7.2
@nomicfoundation/ignition-core@0.15.13
@typechain/ethers-v6@0.5.1
@typechain/hardhat@9.1.0
@types/node@20.17.58 ⏵ 20.19.14	⁺¹		⁺¹
@nomicfoundation/hardhat-network-helpers@1.0.12 ⏵ 1.1.0	⁺¹		⁺²	^-2
@nomicfoundation/hardhat-ignition-ethers@0.15.14
@nomicfoundation/hardhat-chai-matchers@2.1.0
@openzeppelin/contracts-upgradeable@5.3.0 ⏵ 5.4.0		⁺⁵		⁺¹
@openzeppelin/contracts@5.3.0 ⏵ 5.4.0		⁺⁵		⁺¹
@nomicfoundation/hardhat-ignition@0.15.13
@eslint/js@9.28.0 ⏵ 9.35.0			⁺¹	^-1
@changesets/cli@2.29.4 ⏵ 2.29.7	⁺¹		⁺¹	⁺⁴
axios@1.9.0 ⏵ 1.12.2		⁺¹⁵		⁺¹
@nomicfoundation/hardhat-ethers@3.0.8
@nomicfoundation/hardhat-verify@2.1.1
@typescript-eslint/eslint-plugin@8.33.1 ⏵ 8.44.0	⁺²		⁺²³	⁺⁴
@typescript-eslint/parser@8.33.1 ⏵ 8.44.0	⁺¹		⁺³²	⁺⁴

View full report

pcarranzav

A few comments for now - still reviewing

packages/contracts/contracts/arbitrum/ITokenGateway.sol

packages/contracts/contracts/rewards/RewardsManager.sol

packages/horizon/README.md

pcarranzav

A few more comments, still reviewing...

packages/horizon/contracts/data-service/DataService.sol

packages/horizon/contracts/data-service/extensions/DataServiceFees.sol

packages/horizon/contracts/libraries/LinkedList.sol

packages/horizon/contracts/data-service/extensions/DataServiceFees.sol

packages/horizon/contracts/libraries/LinkedList.sol

pcarranzav

Moar

packages/contracts/CHANGELOG.md

packages/horizon/contracts/data-service/interfaces/IDataService.sol

packages/horizon/contracts/data-service/utilities/ProvisionManager.sol

packages/horizon/contracts/interfaces/IBridgeEscrow.sol

packages/horizon/contracts/libraries/Denominations.sol

pcarranzav

A couple more comments - finished going through the main Solidity code

packages/horizon/package.json

packages/subgraph-service/contracts/DisputeManager.sol

Signed-off-by: Tomás Migone <[email protected]>

…cript Signed-off-by: Tomás Migone <[email protected]>

…ibility

…s-book package

chore: extract horizon and subgraph-service addresses to a new address-book package

…erface

Signed-off-by: Tomás Migone <[email protected]>

…on params Signed-off-by: Tomás Migone <[email protected]>

Signed-off-by: Tomás Migone <[email protected]>

…#1219)

Signed-off-by: Tomás Migone <[email protected]>

Maikol

🔥

tmigone force-pushed the horizon branch from b382928 to c532184 Compare February 20, 2024 20:22

tmigone changed the title ~~[WIP/Experimental] Horizon draft changes~~ [WIP/Experimental] BREAKING CHANGE: Horizon draft changes Feb 20, 2024

tmigone force-pushed the horizon branch 2 times, most recently from 76aa677 to 33b5790 Compare March 14, 2024 18:40

tmigone force-pushed the horizon branch 4 times, most recently from 1b27dfa to cae2490 Compare March 21, 2024 20:37

pcarranzav force-pushed the horizon branch from ce1d28f to 2585495 Compare April 9, 2024 15:12

tmigone added horizon protocol change labels Apr 12, 2024

tmigone changed the title ~~[WIP/Experimental] BREAKING CHANGE: Horizon draft changes~~ [WIP] Horizon draft changes Apr 12, 2024

tmigone changed the title ~~[WIP] Horizon draft changes~~ [WIP] Horizon changes Apr 12, 2024

tmigone changed the title ~~[WIP] Horizon changes~~ [WIP] Graph Horizon May 17, 2024

pcarranzav commented Jun 6, 2024

View reviewed changes

packages/contracts/contracts/arbitrum/ITokenGateway.sol Outdated Show resolved Hide resolved

packages/contracts/contracts/rewards/RewardsManager.sol Show resolved Hide resolved

packages/horizon/README.md Outdated Show resolved Hide resolved

pcarranzav commented Jun 6, 2024

View reviewed changes

pcarranzav commented Jun 7, 2024

View reviewed changes

packages/horizon/package.json Outdated Show resolved Hide resolved

packages/subgraph-service/contracts/DisputeManager.sol Outdated Show resolved Hide resolved

tmigone marked this pull request as ready for review June 7, 2024 23:56

tmigone changed the title ~~[WIP] Graph Horizon~~ Graph Horizon and Subgraph Service Jun 7, 2024

tmigone changed the title ~~Graph Horizon and Subgraph Service~~ ❄️ Graph Horizon and Subgraph Service ❄️ Jun 8, 2024

tmigone changed the title ~~❄️ Graph Horizon and Subgraph Service ❄️~~ ☀️ Graph Horizon and Subgraph Service ☀️ Sep 6, 2024

Maikol changed the title ~~☀️ Graph Horizon and Subgraph Service ☀️~~ ❄️ Graph Horizon and Subgraph Service ❄️ Oct 11, 2024

Maikol changed the title ~~❄️ Graph Horizon and Subgraph Service ❄️~~ ☀️ Graph Horizon and Subgraph Service ☀️ Dec 17, 2024

tmigone added 2 commits January 28, 2025 13:05

Merge pull request #1094 from graphprotocol/tmigone/tooling-improvements

4799228

feat: breakout ignition migration script by runner

5711907

Signed-off-by: Tomás Migone <[email protected]>

tmigone and others added 28 commits July 10, 2025 15:41

ci: remove unnecessary workflows

a32f413

Signed-off-by: Tomás Migone <[email protected]>

chore: add script to compare bytecode

9d85394

Signed-off-by: Tomás Migone <[email protected]>

chore: use bytecode instead of deployedBytecode in bytecode compare s…

523d3b1

…cript Signed-off-by: Tomás Migone <[email protected]>

Merge pull request #1187 from graphprotocol/tmigone/horizon-interfaces

8812eb1

fix: interfaces architecture and add missing GNS functions

51c2c1d

feat: add vesting interfaces for Horizon protocol

bd38c83

chore: release [email protected] and [email protected]

59e87cf

fix: export conditions order in interfaces package for Next.js compat…

d28477f

…ibility

chore: extract horizon and subgraph-service addresses to a new addres…

4689fec

…s-book package

Merge pull request #1211 from graphprotocol/mde/address-book-package

ef8b05d

chore: extract horizon and subgraph-service addresses to a new address-book package

chore: release [email protected]

0834478

chore: add CHANGELOG for [email protected]

db7fd6d

fix: add missing nextAccountSeqID and multicall to IL2GNSToolshed int…

f22e83a

…erface

chore: release [email protected]

f3107aa

fix: ensure published toolshed does not use workspace nomenclature

d939135

Signed-off-by: Tomás Migone <[email protected]>

fix(toolshed): address book path resolution

eaff905

Signed-off-by: Tomás Migone <[email protected]>

chore: bump package version

3ac3614

Signed-off-by: Tomás Migone <[email protected]>

fix: allow indexers from registering multiple times to set registrati…

6927618

…on params Signed-off-by: Tomás Migone <[email protected]>

feat: add receipt recover signer function for graph tally

3e95a5e

Signed-off-by: Tomás Migone <[email protected]>

fix: update toolshed interface and ops scripts

b8f84ae

Signed-off-by: Tomás Migone <[email protected]>

Merge pull request #1215 from graphprotocol/tmigone/register-fix

8e7f89a

chore: bump package versions

1fcda4c

Signed-off-by: Tomás Migone <[email protected]>

fix: timestampNs in RAV type should be a bigint

40bfff9

Signed-off-by: Tomás Migone <[email protected]>

chore: bump toolshed version

32b53c1

Signed-off-by: Tomás Migone <[email protected]>

fix: rav signing and recovering bug

ac4e1ea

Signed-off-by: Tomás Migone <[email protected]>

chore: create vesting contracts auth functions for horizon deployment (…

d5aacb2

…#1219)

Merge branch 'main' into horizon

31a1275

ci: lint and format

1eb4250

Signed-off-by: Tomás Migone <[email protected]>

Maikol approved these changes Sep 15, 2025

View reviewed changes

tmigone merged commit d7dd62d into main Sep 15, 2025
4 checks passed

❄️ Graph Horizon and Subgraph Service ❄️ #944

❄️ Graph Horizon and Subgraph Service ❄️ #944

Uh oh!

Conversation

pcarranzav commented Feb 20, 2024

Uh oh!

openzeppelin-code bot commented Feb 20, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

❄️ Graph Horizon and Subgraph Service ❄️

🚨 Report Summary

Uh oh!

socket-security bot commented Feb 21, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov bot commented Feb 21, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

socket-security bot commented Mar 14, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pcarranzav left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

pcarranzav left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

pcarranzav left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

pcarranzav left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Maikol left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

openzeppelin-code bot commented Feb 20, 2024 •

edited

Loading

socket-security bot commented Feb 21, 2024 •

edited

Loading

codecov bot commented Feb 21, 2024 •

edited

Loading

socket-security bot commented Mar 14, 2024 •

edited

Loading