bcnmy / nexus

Nexus by Biconomy: ERC-7579 Modular Smart Account for Enhanced Account Abstraction
https://github.com/bcnmy/nexus/wiki
MIT License
27 stars 5 forks source link

Remediations re 7739 update #216

Closed filmakarov closed 6 days ago

filmakarov commented 1 week ago
Screenshot 2024-11-11 at 11 51 24
codecov[bot] commented 1 week ago

Codecov Report

Attention: Patch coverage is 46.15385% with 7 lines in your changes missing coverage. Please review.

Project coverage is 84.45%. Comparing base (bbe68ea) to head (0fd6769). Report is 8 commits behind head on dev.

Files with missing lines Patch % Lines
contracts/Nexus.sol 46.15% 7 Missing :warning:
Additional details and impacted files ```diff @@ Coverage Diff @@ ## dev #216 +/- ## ========================================== - Coverage 84.68% 84.45% -0.24% ========================================== Files 13 13 Lines 849 849 Branches 271 249 -22 ========================================== - Hits 719 717 -2 - Misses 115 117 +2 Partials 15 15 ``` | [Files with missing lines](https://app.codecov.io/gh/bcnmy/nexus/pull/216?dropdown=coverage&src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=bcnmy) | Coverage Δ | | |---|---|---| | [contracts/modules/validators/K1Validator.sol](https://app.codecov.io/gh/bcnmy/nexus/pull/216?src=pr&el=tree&filepath=contracts%2Fmodules%2Fvalidators%2FK1Validator.sol&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=bcnmy#diff-Y29udHJhY3RzL21vZHVsZXMvdmFsaWRhdG9ycy9LMVZhbGlkYXRvci5zb2w=) | `70.12% <ø> (+1.45%)` | :arrow_up: | | [contracts/Nexus.sol](https://app.codecov.io/gh/bcnmy/nexus/pull/216?src=pr&el=tree&filepath=contracts%2FNexus.sol&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=bcnmy#diff-Y29udHJhY3RzL05leHVzLnNvbA==) | `82.41% <46.15%> (-2.25%)` | :arrow_down: | ------ [Continue to review full report in Codecov by Sentry](https://app.codecov.io/gh/bcnmy/nexus/pull/216?dropdown=coverage&src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=bcnmy). > **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=bcnmy) > `Δ = absolute (impact)`, `ø = not affected`, `? = missing data` > Powered by [Codecov](https://app.codecov.io/gh/bcnmy/nexus/pull/216?dropdown=coverage&src=pr&el=footer&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=bcnmy). Last update [d015436...0fd6769](https://app.codecov.io/gh/bcnmy/nexus/pull/216?dropdown=coverage&src=pr&el=lastupdated&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=bcnmy). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=bcnmy).
openzeppelin-code[bot] commented 1 week ago

Remediations re 7739 update

Generated at commit: 0fd6769c7aa33c76ce0226bc435319475aea723e

🚨 Report Summary

Severity Level Results
Contracts Critical
High
Medium
Low
Note
Total
1
1
0
6
27
35

For more details view the full report in OpenZeppelin Code Inspector

github-actions[bot] commented 6 days ago

Changes to gas cost

Generated at commit: c4021ebc40f20b984ae8a173d2e0605f3bfac4cf, compared to commit: d015436cd84f554ed22033dd399387a494b7a0dd

🧾 Summary (5% most significant diffs)

Contract Method Avg (+/-) %
Nexus validateUserOp +6 ❌ +0.04%

Full diff report 👇
| Contract | Deployment Cost (+/-) | Method | Min (+/-) | % | Avg (+/-) | % | Median (+/-) | % | Max (+/-) | % | # Calls (+/-) | |:-|-:|:-|-:|-:|-:|-:|-:|-:|-:|-:|-:| | **Nexus** | 4,762,675 (+30,870) | _validateUserOp_ | 13,865 (+6) | **+0.04%** | 15,436 (+6) | **+0.04%** | 13,865 (+6) | **+0.04%** | 42,634 (+6) | **+0.01%** | 347 (0) | | **MockValidator** | 990,635 (+12,833) | | | | | | | | | | |
github-actions[bot] commented 6 days ago

:robot: Slither Analysis Report :mag_right:

Slither report

# Slither report **THIS CHECKLIST IS NOT COMPLETE**. Use `--show-ignored-findings` to show all the results. Summary :yellow_circle: - [locked-ether](#locked-ether) (1 results) (Medium) - [constable-states](#constable-states) (2 results) (Optimization) ## locked-ether :yellow_circle: Impact: Medium :red_circle: Confidence: High - [ ] ID-0 Contract locking ether found: Contract [NexusBootstrap]([utils/NexusBootstrap.sol#L33-L165](https://github.com/bcnmy/nexus/blob/c4021ebc40f20b984ae8a173d2e0605f3bfac4cf/contracts/contracts/utils/NexusBootstrap.sol#L33-L165)) has payable functions: - [ModuleManager.receive()]([base/ModuleManager.sol#L64](https://github.com/bcnmy/nexus/blob/c4021ebc40f20b984ae8a173d2e0605f3bfac4cf/contracts/contracts/base/ModuleManager.sol#L64)) - [ModuleManager.fallback(bytes)]([base/ModuleManager.sol#L67-L69](https://github.com/bcnmy/nexus/blob/c4021ebc40f20b984ae8a173d2e0605f3bfac4cf/contracts/contracts/base/ModuleManager.sol#L67-L69)) But does not have a function to withdraw the ether [utils/NexusBootstrap.sol#L33-L165](https://github.com/bcnmy/nexus/blob/c4021ebc40f20b984ae8a173d2e0605f3bfac4cf/contracts/contracts/utils/NexusBootstrap.sol#L33-L165) ## constable-states Impact: Optimization :red_circle: Confidence: High - [ ] ID-1 [RegistryAdapter.registry]([base/RegistryAdapter.sol#L10](https://github.com/bcnmy/nexus/blob/c4021ebc40f20b984ae8a173d2e0605f3bfac4cf/contracts/contracts/base/RegistryAdapter.sol#L10)) should be constant [base/RegistryAdapter.sol#L10](https://github.com/bcnmy/nexus/blob/c4021ebc40f20b984ae8a173d2e0605f3bfac4cf/contracts/contracts/base/RegistryAdapter.sol#L10) - [ ] ID-2 [RegistryFactory.threshold]([factory/RegistryFactory.sol#L39](https://github.com/bcnmy/nexus/blob/c4021ebc40f20b984ae8a173d2e0605f3bfac4cf/contracts/contracts/factory/RegistryFactory.sol#L39)) should be constant [factory/RegistryFactory.sol#L39](https://github.com/bcnmy/nexus/blob/c4021ebc40f20b984ae8a173d2e0605f3bfac4cf/contracts/contracts/factory/RegistryFactory.sol#L39)

This comment was automatically generated by the GitHub Actions workflow.