Release executor 1.0.0 (#11)
* add security txt and policy * set version number for autobahn executor * add github workflow
This commit is contained in:
Maximilian Schneider
GitHub
parent
dd34dbf658
commit
e7029e846e
|
|
@ -0,0 +1,50 @@
|
|||
name: Verifiable Build
|
||||
on:
|
||||
push:
|
||||
tags:
|
||||
- 'executor-v*'
|
||||
|
||||
env:
|
||||
APP_NAME: autobahn_executor
|
||||
|
||||
jobs:
|
||||
build:
|
||||
name: Build Verifiable Artifact
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v3
|
||||
with:
|
||||
submodules: 'recursive'
|
||||
|
||||
- name: Setup Anchor
|
||||
run: |
|
||||
cargo install --git https://github.com/coral-xyz/anchor --rev 4e5280be46d859ba1c57fabe4c3916bec742fd69 anchor-cli --locked --force
|
||||
|
||||
- name: Verifiable Build
|
||||
run: |
|
||||
anchor build --verifiable --docker-image backpackapp/build:v0.28.0 --solana-version 1.17.34 --env GITHUB_SHA --env GITHUB_REF_NAME
|
||||
|
||||
- name: Generate Checksum
|
||||
run: |
|
||||
echo "CHECKSUM=$(sha256sum ./target/verifiable/${{ env.APP_NAME }}.so | head -c 64)" >> $GITHUB_ENV
|
||||
|
||||
- name: Generate SBOM
|
||||
uses: aquasecurity/trivy-action@master
|
||||
with:
|
||||
scan-type: 'fs'
|
||||
format: 'cyclonedx'
|
||||
output: '${{ env.APP_NAME }}-${{ github.ref_name }}-sbom.json'
|
||||
|
||||
- name: Create Release
|
||||
id: create_release
|
||||
uses: softprops/action-gh-release@v1
|
||||
with:
|
||||
tag_name: ${{ github.ref_name }}
|
||||
name: ${{ github.ref_name }}
|
||||
body: |
|
||||
sha256 checksum: ${{ env.CHECKSUM }}
|
||||
github commit: ${{ github.sha }}
|
||||
files: |
|
||||
./target/verifiable/${{ env.APP_NAME }}.so
|
||||
./${{ env.APP_NAME }}-${{ github.ref_name }}-sbom.json
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
[toolchain]
|
||||
anchor_version = "0.28.0"
|
||||
solana_version = "1.17.34"
|
||||
|
||||
[features]
|
||||
resolution = true
|
||||
skip-lint = false
|
||||
|
||||
[programs.mainnet]
|
||||
autobahn_executor = "AutobNFLMzX1rFCDgwWpwr3ztG5c1oDbSrGq7Jj2LgE"
|
||||
|
||||
[registry]
|
||||
url = "https://api.apr.dev"
|
||||
|
||||
[provider]
|
||||
cluster = "Mainnet"
|
||||
wallet = "~/.config/solana/id.json"
|
||||
|
||||
[workspace]
|
||||
members = ["programs/autobahn-executor"]
|
||||
|
|
@ -681,13 +681,15 @@ dependencies = [
|
|||
|
||||
[[package]]
|
||||
name = "autobahn-executor"
|
||||
version = "0.1.0"
|
||||
version = "1.0.0"
|
||||
dependencies = [
|
||||
"bonfida-test-utils",
|
||||
"bytemuck",
|
||||
"default-env",
|
||||
"solana-program",
|
||||
"solana-program-test",
|
||||
"solana-sdk",
|
||||
"solana-security-txt",
|
||||
"spl-token 3.5.0",
|
||||
"test-case",
|
||||
"tokio",
|
||||
|
|
@ -6153,8 +6155,8 @@ dependencies = [
|
|||
"sanctum-token-ratio",
|
||||
"solana-program",
|
||||
"solana-readonly-account",
|
||||
"spl-associated-token-account 1.1.3",
|
||||
"spl-token 3.5.0",
|
||||
"spl-associated-token-account 2.3.0",
|
||||
"spl-token 4.0.0",
|
||||
"spl-token-metadata-interface",
|
||||
"static_assertions",
|
||||
]
|
||||
|
|
@ -6267,7 +6269,7 @@ source = "git+https://github.com/igneous-labs/sanctum-solana-utils.git?rev=2d171
|
|||
dependencies = [
|
||||
"solana-program",
|
||||
"solana-readonly-account",
|
||||
"spl-associated-token-account 1.1.3",
|
||||
"spl-associated-token-account 2.3.0",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
|
|
@ -6320,7 +6322,7 @@ source = "git+https://github.com/igneous-labs/sanctum-solana-utils.git?rev=2d171
|
|||
dependencies = [
|
||||
"solana-program",
|
||||
"solana-readonly-account",
|
||||
"spl-token-2022 0.6.1",
|
||||
"spl-token-2022 1.0.0",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
|
|
|
|||
|
|
@ -0,0 +1,31 @@
|
|||
# Important Notice
|
||||
Please **DO NOT** create a GitHub issue to report a security problem. Instead, please send an email to security@mango.markets with a detailed description of the attack vector and security risk you have identified.
|
||||
|
||||
# Bug Bounty Overview
|
||||
Mango Markets offers bug bounties for Mango Markets' on-chain program code; UI only bugs are omitted.
|
||||
|
||||
|Severity|Description|Bug Bounty|
|
||||
|-----------|--------------|-------------|
|
||||
|Critical|Bugs that freeze user funds or drain the contract's holdings or involve theft of funds without user signatures|10% of the value of the hack up to $1,000,000|
|
||||
|High|Bugs that could temporarily freeze user funds or incorrectly assign value to user funds|$10,000 to $50,000 per bug, assessed on a case by case basis|
|
||||
|Medium/Low|Bugs that don't threaten user funds|$1,000 to $5,000 per bug, assessed on a case by case basis|
|
||||
|
||||
The severity guidelines are based on [Immunefi's classification system](https://immunefi.com/severity-updated/).
|
||||
Note that these are simply guidelines for the severity of the bugs. Each bug bounty submission will be evaluated on a case-by-case basis.
|
||||
|
||||
## Submission
|
||||
Please email security@mango.markets with a detailed description of the attack vector. For critical and moderate bugs, we require a proof of concept done on a privately deployed mainnet contract. We will reach out in 1 business day with additional questions or next steps on the bug bounty.
|
||||
|
||||
## Bug Bounty Payment
|
||||
Bug bounties will be paid in USDC or locked MNGO, after a DAO vote. The Mango DAO has never refused a valid bug bounty so far.
|
||||
|
||||
## Invalid Bug Bounties
|
||||
The following are out of scope for the bug bounty:
|
||||
1. Attacks that the reporter has already exploited themselves, leading to damage.
|
||||
2. Attacks requiring access to leaked keys/credentials.
|
||||
3. Attacks requiring access to privileged addresses (governance, admin).
|
||||
4. Incorrect data supplied by third party oracles (this does not exclude oracle manipulation/flash loan attacks).
|
||||
5. Lack of liquidity.
|
||||
6. Third party, off-chain bot errors (for instance bugs with an arbitrage bot running on the smart contracts).
|
||||
7. Best practice critiques.
|
||||
8. Sybil attacks.
|
||||
|
|
@ -13,7 +13,7 @@ tokio = { workspace = true }
|
|||
anyhow = { workspace = true }
|
||||
solana-sdk = { workspace = true }
|
||||
solana-client = { workspace = true }
|
||||
autobahn-executor = { path = "../../programs/autobahn-executor", version = "0.1.0" }
|
||||
autobahn-executor = { path = "../../programs/autobahn-executor" }
|
||||
router-lib = { path = "../../lib/router-lib/", version = "0.0.1" }
|
||||
router-config-lib = { path = "../../lib/router-config-lib/", version = "0.0.1" }
|
||||
serde = "1.0"
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
[package]
|
||||
name = "autobahn-executor"
|
||||
version = "0.1.0"
|
||||
version = "1.0.0"
|
||||
edition = "2021"
|
||||
|
||||
[features]
|
||||
|
|
@ -11,6 +11,8 @@ test-bpf = ["no-entrypoint"]
|
|||
solana-program = "1.17"
|
||||
spl-token = { version = "3.5.0", features = ["no-entrypoint"] }
|
||||
bytemuck = "1.16.1"
|
||||
solana-security-txt = "1.1.1"
|
||||
default-env = "0.1.1"
|
||||
|
||||
[lib]
|
||||
name = "autobahn_executor"
|
||||
|
|
|
|||
|
|
@ -13,14 +13,26 @@ use solana_program::program_error::ProgramError;
|
|||
use solana_program::program_pack::Pack;
|
||||
use solana_program::{account_info::AccountInfo, pubkey::Pubkey};
|
||||
|
||||
#[cfg(not(feature = "no-entrypoint"))]
|
||||
use solana_program::entrypoint;
|
||||
|
||||
declare_id!("AutobNFLMzX1rFCDgwWpwr3ztG5c1oDbSrGq7Jj2LgE");
|
||||
#[cfg(not(feature = "no-entrypoint"))]
|
||||
use {default_env::default_env, solana_program::entrypoint, solana_security_txt::security_txt};
|
||||
|
||||
#[cfg(not(feature = "no-entrypoint"))]
|
||||
security_txt! {
|
||||
name: "Autobahn Executor",
|
||||
project_url: "https://autobahn.ag",
|
||||
contacts: "email:security@mango.markets",
|
||||
policy: "https://github.com/blockworks-foundation/autobahn/blob/master/SECURITY.md",
|
||||
source_code: "https://github.com/blockworks-foundation/autobahn",
|
||||
source_revision: default_env!("GITHUB_SHA", ""),
|
||||
source_release: default_env!("GITHUB_REF_NAME", "")
|
||||
}
|
||||
|
||||
#[cfg(not(feature = "no-entrypoint"))]
|
||||
entrypoint!(process_instruction);
|
||||
|
||||
declare_id!("AutobNFLMzX1rFCDgwWpwr3ztG5c1oDbSrGq7Jj2LgE");
|
||||
|
||||
#[repr(u8)]
|
||||
pub enum Instructions {
|
||||
ExecuteSwapV3 = 1,
|
||||
|
|
|
|||
Loading…
Reference in New Issue