Skip to content

Fix reentrant desyndication custody attestations (WIRE-441) - #756

Merged
huangminghuang merged 3 commits into
masterfrom
fix/wire-441
Nov 11, 2026
Merged

huangminghuang merged 3 commits into
masterfrom
fix/wire-441

Conversation

@huangminghuang

@huangminghuang huangminghuang commented Nov 9, 2026 •

Copy link
Copy Markdown
Contributor

Summary

  • Emit each desyndication attestation from live outstanding shadow after its transfer and burn, including notification-driven nested requests.
  • Authenticate the self-inline continuation and preserve fees, bucket debits, recorded returns and request identities.
  • Cover holder reentry, rollback, forged emissions and trailing action bytes; synchronize the contract and callback-helper ABI/WASM artifacts.

Why

Desyndication previously encoded outstanding supply before its queued transfer and burn executed. A holder notification could re-enter, making the later outer attestation overstate outstanding shadow and falsely freeze a fully backed outpost. The final self-inline action reads the recorded request and live supply plus parked yield, then queues the attestation without an intervening external callback.

The one-shot unprivileged callback completes within the default inline depth of four. The combined contract preserves upstream return-envelope epoch tracking, automatic balance-row creation and strict action-data decoding.

Validation

  • Focused Synd, LIQ, message-channel, dispatch, token and swap suites under --sys-vm-jit: 243 cases and 21,068 assertions passed, including live nested/outer totals, fees and parked yield, rollback and emission authorization.
  • Scheduler, action-data and notification checks under JIT: 13 cases and 158 assertions passed.
  • ON/ON contract build succeeded with the selected CDT; all 56 tracked contract artifacts matched their native outputs.
  • Reproducer control from the original fix: the unfixed artifact reports stale outer outstanding of 67 instead of 47; the fixed callback regression passes.
  • Independent correctness, architecture, compliance and style reviews passed.

Companion PRs

  • wire-libraries-ts #147: generated SDK declaration for the internal continuation; targets master. Merge after Sysio. No current consumer requires a new npm release.
  • wire-ethereum #296: zero-tolerance ordered-payout regression with explicit already-paid replay assertions; targets next. Part of the same coordinated merge batch.
  • wire-solana #618 (merged): exact-custody ordered-payout regression; targets next.
  • wire-tools-ts #181 (merged): shared Solana AuthEx bootstrap fix using the already published SDK 1.0.110; targets master. Include the selected fix branch in coordinated validation.

Change-Id: I3c9ae88cbc907104bc27cbcceb042bc43db62b48
heifner
heifner previously approved these changes Nov 9, 2026
Resolve the generated sysio.synd WASM conflict by rebuilding the combined source with current CDT. Preserve upstream strict action decoding and cover trailing bytes on the internal continuation.

Change-Id: Ib835d2d8939a80e19c541e657850a761308bfa79
Change-Id: I4263ec3e02cb3c789b6fd1cacc330f804e7bed84
@huangminghuang
huangminghuang marked this pull request as ready for review November 11, 2026 00:12
@huangminghuang
huangminghuang merged commit 894975e into master Nov 11, 2026
12 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants