From dbbc05f2921d2f2bcfe7192c6d863c7c59f9f04b Mon Sep 17 00:00:00 2001 From: thedavidmeister Date: Fri, 1 May 2026 11:37:26 +0400 Subject: [PATCH] test(failing): pin prod receipt vault authorizer consistency MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Adds the test #34 asks for: every prod receipt vault on Base must report a non-zero authorizer AND all 13 prod token sets must share the same authorizer contract. Currently fails on two tokens — fork run on Base shows drift: - 11 of 13 vaults: authorizer 0x35f9fA9d80aAF2B0fB27f0FF015641B3408d7456 - IBHG: authorizer 0x6E0F1c31Fca4Ff07cD0C3e8658b1e3a473f3393a - SGOV: authorizer 0xED3A1Ab65a25dfc82F4A7B89203EEc9BCb2D4f01 None of these match the V2 authorizer constants in `LibProdDeployV2` (`STOX_OFFCHAIN_ASSET_RECEIPT_VAULT_AUTHORIZER_V1`, `STOX_OFFCHAIN_ASSET_RECEIPT_VAULT_PAYMENT_MINT_AUTHORIZER_V1`) — these are V1-era authorizers without prod constants. Also bumps `lib/rain.vats` to f52c8b4 (PR rainlanguage/rain.vats#293, issue rainlanguage/rain.vats#292) which adds the `IAuthorizableV1` interface used here. Without the bump there is no typed way to read `OffchainAssetReceiptVault.authorizer()` without importing the concrete contract. Test landed deliberately failing as a forcing function for the team to investigate the IBHG/SGOV drift. Co-Authored-By: Claude Opus 4.7 (1M context) --- foundry.lock | 2 +- lib/rain.vats | 2 +- test/src/lib/LibProdTokensBase.t.sol | 9 +++++++++ 3 files changed, 11 insertions(+), 2 deletions(-) diff --git a/foundry.lock b/foundry.lock index f52506e..e946936 100644 --- a/foundry.lock +++ b/foundry.lock @@ -9,6 +9,6 @@ "rev": "67b81b417e3f2311f71058d526e4c16518b393cc" }, "lib/rain.vats": { - "rev": "cad9ca4c9f230c97d481c58f635a33c774e22c07" + "rev": "f52c8b471c557d672c1f0ecec5e39b8ae8f337fe" } } \ No newline at end of file diff --git a/lib/rain.vats b/lib/rain.vats index cad9ca4..f52c8b4 160000 --- a/lib/rain.vats +++ b/lib/rain.vats @@ -1 +1 @@ -Subproject commit cad9ca4c9f230c97d481c58f635a33c774e22c07 +Subproject commit f52c8b471c557d672c1f0ecec5e39b8ae8f337fe diff --git a/test/src/lib/LibProdTokensBase.t.sol b/test/src/lib/LibProdTokensBase.t.sol index 87a8889..e3d07c4 100644 --- a/test/src/lib/LibProdTokensBase.t.sol +++ b/test/src/lib/LibProdTokensBase.t.sol @@ -12,6 +12,7 @@ import {IReceiptVaultV3} from "rain.vats/interface/IReceiptVaultV3.sol"; import { IOffchainAssetReceiptVaultBeaconSetDeployerV1 } from "rain.vats/interface/IOffchainAssetReceiptVaultBeaconSetDeployerV1.sol"; +import {IAuthorizableV1} from "rain.vats/interface/IAuthorizableV1.sol"; import { ERC1967_BEACON_SLOT, LibExtrospectERC1967BeaconProxy @@ -89,6 +90,14 @@ contract LibProdTokensBaseTest is Test { LibExtrospectERC1967BeaconProxy.isBeaconOwner(wrappedVaultBeacon, LibProdDeployV1.BEACON_INITIAL_OWNER), "wrapped vault beacon owner mismatch" ); + + // Every prod receipt vault must report a non-zero authorizer, + // and all 13 prod token sets must share the same authorizer + // contract. Inconsistency would mean one vault is configured + // against a different permission boundary than its siblings. + address mstrAuthorizer = address(IAuthorizableV1(LibProdTokensBase.MSTR_RECEIPT_VAULT).authorizer()); + assertTrue(mstrAuthorizer != address(0), "mstr authorizer is zero"); + assertEq(address(IAuthorizableV1(receiptVault).authorizer()), mstrAuthorizer, "authorizer differs from mstr's"); } function testMstrTokenSetOnBase() external {