decentraland / transactions-server
70%
master: 70%

LAST BUILD BRANCH: refs/tags/1.13.0
DEFAULT BRANCH: master
Repo Added
Files 37
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

LAST BUILD ON BRANCH refs/tags/1.13.0
branch: SELECT
CHANGE BRANCH
x

coverage: 70.254% (+0.2%) from 70.09%
25521527543

push

github

web-flow 
feat: validate the relayed method is executeMetaTransaction (#137)

* feat: validate the relayed method is executeMetaTransaction

* fix: drop user-controlled selector label from rejection counter

The selector label on dcl_error_invalid_function_selector was derived
from untrusted input (the calldata's first 4 bytes), giving an attacker
unbounded cardinality on a Prometheus time series. The counter is now
scalar; the offending selector still rides on the typed error and the
warn log for triage.

* test: align checkFunctionSelector spec with dcl-testing conventions

Rename the drain-attack describe to use the "when ..." form, drop the
forbidden "when" from the it.each title, and replace generic "should not
throw" descriptions with ones that surface the metric assertion the
tests already make.

* feat: reject meta-tx whose userAddress matches a broadcaster EOA

Extends checkFunctionSelector with a self-relay guard: decodes the
executeMetaTransaction calldata and rejects when the inner userAddress
is one of the EOAs we use to broadcast on chain.

Wires getRelayerAddresses through the relay-router so the validator
stays provider-agnostic. Gelato funds its own broadcasters and omits
the method; OpenZeppelin lazily fetches and caches the set with a 1h
TTL — refresh failures are metric-only.

Public rejection message is generic ("Invalid transaction data.");
offending details stay on the error instance for structured warn logs.

- new SelfRelayUserAddressError -> 400 with generic body
- counters for rejection (dcl_error_self_relay_user_address) and
  cache-refresh failures (dcl_error_relayer_addresses_refresh_failed)
- integration spec hitting the real OZ API (skips when creds absent)

* feat: harden relayer against quota TOCTOU and sale-price bypass

- Atomic reserveQuota (advisory-locked SELECT/INSERT) plus session_id-keyed
  confirmReservation/releaseReservation; replaces the post-broadcast quota
  write and closes the per-user TOCTOU window.
- Read-only... (continued)

119 of 189 branches covered (62.96%)

Branch coverage included in aggregate %.

153 of 199 new or added lines in 15 files covered. (76.88%)

1 existing line in 1 file now uncovered.

573 of 796 relevant lines covered (71.98%)

7.1 hits per line

Relevant lines Covered
796 RELEVANT LINES 573 COVERED LINES
7.1 HITS PER LINE
Source Files on master

Recent builds

Builds Branch Commit Type Ran Committer Via Coverage
25521527543 refs/tags/1.13.0 feat: validate the relayed method is executeMetaTransaction (#137) * feat: validate the relayed method is executeMetaTransaction * fix: drop user-controlled selector label from rejection counter The selector label on dcl_error_invalid_function_... push web-flow github
70.25
25520590475 master feat: validate the relayed method is executeMetaTransaction (#137) * feat: validate the relayed method is executeMetaTransaction * fix: drop user-controlled selector label from rejection counter The selector label on dcl_error_invalid_function_... push web-flow github
70.25
25520349205 feat/enhance-relayer-security fix: remove unrequired test Pull #137 cyaiox github
70.25
25499722363 feat/enhance-relayer-security refactor: extract shared META_TX_ABI and dedupe OZ relayer-address fetches - Move the duplicated executeMetaTransaction parseAbi block from checkFunctionSelector, extractMetaTxUserAddress, and checkSalePrice into a single src/ports/transactio... Pull #137 cyaiox github
70.62
25497779301 feat/enhance-relayer-security fix: linting Pull #137 cyaiox github
70.35
25395811329 master feat: enhance OpenZeppelin relayer metrics for Gelato parity (#135) * feat: enhance OpenZeppelin relayer metrics for Gelato parity Adds four counters to OpenZeppelin so its observability matches Gelato's: cancelled, reverted, no-balance, and hig... push web-flow github
70.09
25393176832 master docs: add AGENTS.md, CLAUDE.md, and Claude Code project config (#136) * docs: add AGENTS.md, CLAUDE.md, and Claude Code project config - AGENTS.md follows the team template; CLAUDE.md points at @AGENTS.md - Decentraland AI-toolkit skills (dcl-te... push web-flow github
67.72
25336610976 docs/add-ai-files chore: Add skills to .gitignore Pull #136 cyaiox github
67.72
25335578426 feat/enhance-oz-relayer-metrics docs: Add grafana dashboard Pull #135 cyaiox github
70.09
25329250636 feat/enhance-oz-relayer-metrics refactor: consolidate per-relayer metrics behind a relayer label Collapses the dcl_*_gelato / dcl_*_openzeppelin metric pairs (and the gelato-only no_balance counter) into single names with a 'relayer' label, following Prometheus naming guidance.... Pull #135 cyaiox github
70.09
See All Builds (303)