Skip to content

Address AuditAgent report for 0.1.0 - #5

Merged
rya-sge merged 9 commits into
CMTA:mainfrom
NethermindEth:main
Mar 29, 2026
Merged

Address AuditAgent report for 0.1.0#5
rya-sge merged 9 commits into
CMTA:mainfrom
NethermindEth:main

Conversation

@swapnilraj

Copy link
Copy Markdown
Contributor

Release / version

  • Engine VersionModule set to 0.2.0; CHANGELOG updated for 0.2.0.

Contracts

  • FixDescriptorEngine: use immutable TOKEN instead of this.token() in descriptor auth hooks (same behavior, less overhead).
  • FixDescriptorEngineModule: emit FixDescriptorEngineSet when the engine is set via __fixDescriptorEngineModuleInitUnchained; doc clarifications for optional init hook vs post-initialize setFixDescriptorEngine.
  • Fix: FIX_DESCRIPTOR_ENGINE_MODULE_STORAGE_LOCATION corrected to match the documented ERC-7201 formula for "CMTAT.storage.FixDescriptorEngineModule"; regression test added.

Docs

  • README: deployment/audit notes, Nethermind Audit Agent v0.1.0 and v0.2.0 report + feedback links; design text corrected (set/replace vs “detach”).
  • doc/audit/tools/nethermind-audit-agent/: v0.1.0 / v0.2.0 PDFs and *-feedback.md files.

swapnilraj and others added 9 commits March 25, 2026 14:09
Align with CMTA CMTAT-FIX audit artifacts by adding the v0.1.0 report and a finding-by-finding feedback file, documenting the intentional post-initialize engine binding flow, and applying best-practice fixes for init event emission and engine auth gas usage.

Made-with: Cursor
…-feedback-sync

chore(audit): sync Nethermind audit agent feedback
Align with CMTA CMTAT-FIX audit artifacts by adding the v0.1.0 report and a finding-by-finding feedback file, documenting the intentional post-initialize engine binding flow, and applying best-practice fixes for init event emission and engine auth gas usage.

Made-with: Cursor
…hermind-changes

chore(sync): apply Nethermind main changes on top of CMTA main
Version reflects Nethermind Audit Agent follow-up (event on init hook,
TOKEN auth optimization, documented post-init engine binding).
CHANGELOG documents 0.2.0 vs 0.1.0.

Made-with: Cursor
The previous literal did not match keccak256(abi.encode(uint256(keccak256(
"CMTAT.storage.FixDescriptorEngineModule")) - 1)) & ~bytes32(uint256(0xff)).

Add regression test and changelog note.

Made-with: Cursor
- finding-by-finding response for audit_agent_report_v0.2.0.pdf
- README: single Audit Agent table (v0.2.0 + v0.1.0), fix duplicate block
- clarify set/replace vs detach in design principles
- CHANGELOG Unreleased entry

Made-with: Cursor
@swapnilraj

Copy link
Copy Markdown
Contributor Author

auditagent report for 0.1.0 is addressed and I've attached the results of running it again along with feedback file.
@rya-sge you'll need to tag 0.2.0

@rya-sge
rya-sge merged commit b726256 into CMTA:main Mar 29, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants