Skip to content

Commit f89a6a3

Browse files
Unique-DivineUnique-Divine
authored
Merge branch 'main' into main
2 parents 29de4cf + 03204c6 commit f89a6a3

253 files changed

Lines changed: 20082 additions & 844 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/e2e-evm.yml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -94,7 +94,7 @@ jobs:
9494
steps:
9595
- uses: actions/checkout@v6
9696

97-
- name: "Check for EVM-related changes"
97+
- name: "Check for changes"
9898
id: check_changes
9999
uses: dorny/paths-filter@v3
100100
with:
@@ -103,6 +103,8 @@ jobs:
103103
- "sai-trading/**/*.ts"
104104
- "sai-trading/artifacts/*"
105105
- "sai-trading/**/*.go"
106+
- "sai-trading/go.mod"
107+
- "sai-trading/go.sum"
106108
107109
- name: Set up Go
108110
if: steps.check_changes.outputs.check_changes == 'true'

‎.github/workflows/passkey-bundler-docker.yml‎

Lines changed: 161 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,161 @@
1+
name: Passkey Bundler Docker
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
tags:
8+
- "passkey-bundler/v*"
9+
workflow_dispatch:
10+
11+
permissions:
12+
contents: read
13+
packages: write
14+
15+
concurrency:
16+
group: passkey-bundler-docker-${{ github.ref }}
17+
cancel-in-progress: true
18+
19+
jobs:
20+
changes:
21+
name: Detect changes
22+
runs-on: ubuntu-latest
23+
outputs:
24+
bundler: ${{ steps.determine.outputs.bundler }}
25+
steps:
26+
- name: Checkout
27+
uses: actions/checkout@v6
28+
with:
29+
fetch-depth: 0
30+
31+
- name: Determine whether to build
32+
id: determine
33+
run: |
34+
set -euo pipefail
35+
36+
if [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" ]]; then
37+
echo "bundler=true" >> "$GITHUB_OUTPUT"
38+
exit 0
39+
fi
40+
41+
if [[ "${GITHUB_REF}" == refs/tags/passkey-bundler/v* ]]; then
42+
echo "bundler=true" >> "$GITHUB_OUTPUT"
43+
exit 0
44+
fi
45+
46+
before="${{ github.event.before }}"
47+
if [[ -z "${before}" || "${before}" == "0000000000000000000000000000000000000000" ]]; then
48+
echo "bundler=true" >> "$GITHUB_OUTPUT"
49+
exit 0
50+
fi
51+
52+
if git diff --name-only "${before}" "${GITHUB_SHA}" -- "passkey-bundler" ".github/workflows/passkey-bundler-docker.yml" | grep -q .; then
53+
echo "bundler=true" >> "$GITHUB_OUTPUT"
54+
exit 0
55+
fi
56+
57+
echo "bundler=false" >> "$GITHUB_OUTPUT"
58+
59+
build:
60+
name: Build (${{ matrix.build.platform }})
61+
needs: [changes]
62+
if: |
63+
github.event_name == 'workflow_dispatch' ||
64+
startsWith(github.ref, 'refs/tags/passkey-bundler/v') ||
65+
needs.changes.outputs.bundler == 'true'
66+
strategy:
67+
fail-fast: true
68+
matrix:
69+
build:
70+
- platform: linux/amd64
71+
runner: ubuntu-22.04
72+
- platform: linux/arm64
73+
runner: ubuntu-22.04-arm
74+
runs-on: ${{ matrix.build.runner }}
75+
76+
steps:
77+
- name: Checkout
78+
uses: actions/checkout@v6
79+
with:
80+
fetch-depth: 0
81+
82+
- name: Prepare env vars
83+
run: |
84+
ARCH="$(echo "${{ matrix.build.platform }}" | cut -d '/' -f 2)"
85+
echo "ARCH=$ARCH" >> "$GITHUB_ENV"
86+
echo "SHORT_SHA=${GITHUB_SHA::7}" >> "$GITHUB_ENV"
87+
OWNER="${{ github.repository_owner }}"
88+
OWNER="${OWNER,,}"
89+
echo "IMAGE=ghcr.io/${OWNER}/passkey-bundler" >> "$GITHUB_ENV"
90+
if [[ "${GITHUB_REF}" == refs/tags/passkey-bundler/v* ]]; then
91+
VERSION="${GITHUB_REF#refs/tags/passkey-bundler/v}"
92+
echo "TAG_PREFIX=$VERSION" >> "$GITHUB_ENV"
93+
else
94+
echo "TAG_PREFIX=main" >> "$GITHUB_ENV"
95+
fi
96+
97+
- name: Set up Docker Buildx
98+
uses: docker/setup-buildx-action@v3
99+
100+
- name: Login to GHCR
101+
uses: docker/login-action@v3
102+
with:
103+
registry: ghcr.io
104+
username: ${{ github.actor }}
105+
password: ${{ secrets.GITHUB_TOKEN }}
106+
107+
- name: Build and push (arch)
108+
uses: docker/build-push-action@v6
109+
with:
110+
context: passkey-bundler
111+
push: true
112+
platforms: ${{ matrix.build.platform }}
113+
tags: ${{ env.IMAGE }}:${{ env.TAG_PREFIX }}-${{ env.ARCH }}
114+
115+
merge:
116+
name: Create multi-arch image
117+
needs: [build]
118+
runs-on: ubuntu-latest
119+
120+
steps:
121+
- name: Prepare env vars
122+
run: |
123+
echo "SHORT_SHA=${GITHUB_SHA::7}" >> "$GITHUB_ENV"
124+
OWNER="${{ github.repository_owner }}"
125+
OWNER="${OWNER,,}"
126+
echo "IMAGE=ghcr.io/${OWNER}/passkey-bundler" >> "$GITHUB_ENV"
127+
if [[ "${GITHUB_REF}" == refs/tags/passkey-bundler/v* ]]; then
128+
VERSION="${GITHUB_REF#refs/tags/passkey-bundler/v}"
129+
echo "TAG_PREFIX=$VERSION" >> "$GITHUB_ENV"
130+
echo "IS_RELEASE=true" >> "$GITHUB_ENV"
131+
else
132+
echo "TAG_PREFIX=main" >> "$GITHUB_ENV"
133+
echo "IS_RELEASE=false" >> "$GITHUB_ENV"
134+
fi
135+
136+
- name: Set up Docker Buildx
137+
uses: docker/setup-buildx-action@v3
138+
139+
- name: Login to GHCR
140+
uses: docker/login-action@v3
141+
with:
142+
registry: ghcr.io
143+
username: ${{ github.actor }}
144+
password: ${{ secrets.GITHUB_TOKEN }}
145+
146+
- name: Create and push manifest list
147+
run: |
148+
set -euo pipefail
149+
if [[ "${IS_RELEASE}" == "true" ]]; then
150+
docker buildx imagetools create \
151+
--tag "${IMAGE}:${TAG_PREFIX}" \
152+
--tag "${IMAGE}:latest" \
153+
"${IMAGE}:${TAG_PREFIX}-amd64" \
154+
"${IMAGE}:${TAG_PREFIX}-arm64"
155+
else
156+
docker buildx imagetools create \
157+
--tag "${IMAGE}:main" \
158+
--tag "${IMAGE}:sha-${SHORT_SHA}" \
159+
"${IMAGE}:main-amd64" \
160+
"${IMAGE}:main-arm64"
161+
fi

‎.github/workflows/release.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ name: Release
33
on:
44
push:
55
tags:
6-
- "*"
6+
- "v*"
77

88
permissions:
99
contents: write
@@ -289,4 +289,4 @@ jobs:
289289
body: ${{ steps.changes.outputs.changes }}
290290
files: |
291291
dist/**/*.tar.gz
292-
dist/nibid_${{ needs.version.outputs.value }}_checksums.txt
292+
dist/nibid_${{ needs.version.outputs.value }}_checksums.txt

‎.gitignore‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -357,3 +357,12 @@ playwright/chrome-extensions/keplr/
357357
playwright/yarn.lock
358358

359359
debug_container.dot
360+
361+
.gocache
362+
AGENTS.md
363+
precompile.test
364+
tx_log.json
365+
passkey-bundler/.tmp
366+
evm-e2e/.nibid-*/
367+
evm-e2e/.passkey-*-privkey.txt
368+
evm-e2e/.passkey-*-wallet.json

‎CHANGELOG.md‎

Lines changed: 123 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -40,15 +40,134 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
4040

4141
## Unreleased
4242

43-
* ci(dependabot.yml): ignore updates to Cosmos-SDK, CometBFT, and Wasmd, as they are often breaking changes
43+
* ...
44+
45+
## v2.11.0
46+
47+
EVM reliability got tighter, gasless onboarding got broader, and CometBFT got a
48+
critical security patch. Plus: passkey (ERC-4337) building blocks and better
49+
consensus determinism.
50+
51+
- [Release Link: v2.11.0](https://github.com/NibiruChain/nibiru/releases/tag/v2.11.0).
52+
- Date: 2026-02-11
53+
- The prior upgrade on mainnet was [v2.9.0](#v290).
54+
55+
### 1 - Main Highlights
56+
57+
- **Fixed** - Successful EVM transactions were sometimes shown as failed due to Cosmos SDK gas-meter issues. No longer. ([#2521](https://github.com/NibiruChain/nibiru/pull/2521))
58+
- **New** - Governance-allowlisted "always zero gas" EVM contracts can be called by any sender with no gas balance, as long as value is 0. ([#2517](https://github.com/NibiruChain/nibiru/pull/2517))
59+
- **Improved** - Precompiles now report gas cleanly with dynamic handling, and SDK out-of-gas panics are recovered into normal errors instead of crashing the node. ([#2516](https://github.com/NibiruChain/nibiru/pull/2516))
60+
- **Security** - Upgraded CometBFT to patched v0.37.18 for CSA-2026-001 (Tachyon), a critical consensus-level issue affecting block time guarantees. ([#2512](https://github.com/NibiruChain/nibiru/pull/2512))
61+
- **Consensus safety** - Removed nondeterministic Go map iteration in consensus-critical paths (oracle + EVM state commit), addressing intermittent apphash mismatches. ([#2503](https://github.com/NibiruChain/nibiru/pull/2503))
62+
- **New** - Passkey-secured smart accounts (ERC-4337 style) with P-256 signatures: contracts, SDK, and bundler tooling for developers. ([#2443](https://github.com/NibiruChain/nibiru/pull/2443), [#2493](https://github.com/NibiruChain/nibiru/pull/2493), [#2500](https://github.com/NibiruChain/nibiru/pull/2500))
63+
- **New** - Sai trading: EVM trader service. Trades against local network. ([#2440](https://github.com/NibiruChain/nibiru/pull/2440))
64+
65+
### 2 - Added Passkeys + Account Abstraction (ERC-4337)
66+
67+
**What it enables:** A passkey-secured smart account flow (ERC-4337 style) for Nibiru EVM development and end-to-end testing, built around P-256 signatures.
68+
69+
Includes:
70+
71+
- `PasskeyAccount` and `PasskeyAccountFactory` contracts (minimal ERC-4337 account abstraction, P-256–secured) ([#2443](https://github.com/NibiruChain/nibiru/pull/2443))
72+
- TypeScript `passkey-sdk` for building UserOperations and talking to a bundler ([#2443](https://github.com/NibiruChain/nibiru/pull/2443))
73+
- Bundler for passkey transactions ([#2493](https://github.com/NibiruChain/nibiru/pull/2493))
74+
- Published passkey-bundler package ([#2500](https://github.com/NibiruChain/nibiru/pull/2500))
75+
- Tooling and docs updates for deploying the factory, running a bundler, and E2E testing the flow
76+
77+
**Status:** This is primarily a developer-facing foundation (contracts + SDK + bundler workflow). Available for integrators today; coming to end-user surfaces as apps integrate.
78+
79+
### 3 - Expanded Gasless EVM Calls ("Zero Gas")
80+
81+
**What it enables:** First-time onboarding and "no gas balance" execution for calls into governance-allowlisted contracts.
82+
83+
**How it works:**
84+
- If a transaction calls a **governance-allowlisted contract** and `value == 0`, the chain marks it as "zero gas" early in the ante handler.
85+
- It then skips gas-related checks (fee deduction, balance-vs-cost checks, mempool min gas price checks, and `RefundGas`) while still enforcing account checks and `CanTransfer`.
86+
- A governance-managed list `ZeroGasActors.always_zero_gas_contracts` allows **any sender** to invoke specific EVM contracts with zero gas.
87+
88+
**Governance:** This is controlled by a governance-managed allowlist. Manage via `sudo edit-zero-gas` and the `always_zero_gas_contracts` field.
89+
90+
### 4 - Precompiles: Dynamic Gas + Clean Failure Mode
91+
92+
**Key Takeaway:** More predictable gas reporting around precompiles and fewer confusing failure modes under OOG.
93+
- FunToken precompile now supports the dynamic-precompile flow so gas accounting and reporting match the EVM's expectations (better tracing and estimation behavior). ([#2516](https://github.com/NibiruChain/nibiru/pull/2516))
94+
- Removed redundant internal gas deductions that could double-report gas changes to tracers.
95+
- SDK out-of-gas panics inside bounded meters are recovered and returned as normal out-of-gas errors, so execution fails cleanly instead of crashing the process. ([#2447](https://github.com/NibiruChain/nibiru/pull/2447))
96+
97+
98+
### 5 - Fixed - EVM "False Failed" Transactions
99+
100+
**Symptom:** Explorers and receipts could show failure even when the EVM execution actually succeeded, triggered by late Cosmos SDK gas-meter errors.
101+
102+
**Fix:** EVM execution is treated as the ground truth. If the SDK gas meter errors after a successful EVM result, the node logs the issue but does **not** flip the transaction to failed. ([#2521](https://github.com/NibiruChain/nibiru/pull/2521))
103+
104+
**What to expect after upgrading:** Successful EVM transactions should no longer appear as failed solely due to gas-meter misalignment. Any remaining SDK gas-meter issues should surface as logs, not incorrect tx status.
105+
106+
### 6 - Fixed - Consensus Determinism (No More Random Map Order)
107+
108+
**Why it matters:** Go map iteration is nondeterministic and can cause consensus failures when order affects state writes or event emission.
109+
110+
**Fixes included:**
111+
- Sorted iteration for oracle validator performance processing and event emission
112+
- Sorted account address processing in the EVM StateDB commit path
113+
- Addresses intermittent apphash mismatches observed on long-running mainnet nodes ([#2503](https://github.com/NibiruChain/nibiru/pull/2503))
114+
115+
### 7 - Security Patch - CometBFT CSA-2026-001 (Tachyon)
116+
117+
This release upgrades CometBFT to **v0.37.18**, which includes the required fix for **CSA-2026-001**. ([#2512](https://github.com/NibiruChain/nibiru/pull/2512))
118+
119+
**What class of issue is this?** A consensus-level vulnerability in CometBFT's "BFT Time" implementation, stemming from an inconsistency between commit signature verification and block time derivation. The advisory labels it **Critical** and notes it impacts validators and protocols that rely on block timestamps.
120+
121+
**Operator guidance:** Treat this upgrade as high priority if you run validators or timestamp-sensitive applications. Upgrade to `nibid v2.11.0` (or later) to receive the patched CometBFT.
122+
123+
### 8 - Appendix for v2.11.0
124+
125+
#### For Builders
126+
- **Tx status correctness** — Successful EVM calls should no longer be mislabeled as failed due to SDK gas-meter issues.
127+
- **Gasless calls** — If your contract is allowlisted under `always_zero_gas_contracts`, any sender can call it with `value == 0` and no gas balance.
128+
- **Precompile behavior** — Expect cleaner out-of-gas error surfaces and more accurate gas reporting around dynamic precompiles.
129+
- **Passkeys / account abstraction** — New contracts and SDK exist for passkey-secured ERC-4337 flows; good time to prototype onboarding without seed phrases.
130+
- **CLI flags** — Transaction flags are more concise by default so developers can see command-specific flags more clearly. ([#2449](https://github.com/NibiruChain/nibiru/pull/2449))
131+
132+
#### For Operators / Validators
133+
- **Upgrade type:** Release tag and GitHub release; mainnet upgrade applies the same workflow as other versions.
134+
- **Steps:** Upgrade binary to `nibid v2.11.0`, restart. Standard upgrade procedure—no extra state migrations or config changes known.
135+
- **Priority:** High. The CometBFT CSA-2026-001 fix is critical for consensus safety.
136+
- **Monitoring checklist:**
137+
- Watch for any lingering "gas-meter misalignment" logs (should not flip tx status).
138+
- Validate precompile-heavy workloads (FunToken, Wasm, oracle precompiles) for expected behavior under load.
139+
- Confirm determinism fixes reduce apphash mismatch risk on long-running nodes.
140+
141+
#### For Contributors / Repo Maintainers
142+
143+
- Internal Cosmos-SDK moved under `internal/cosmos-sdk` for smoother core edits. ([#2451](https://github.com/NibiruChain/nibiru/pull/2451))
144+
- Collections library merged into repo; gnark-crypto and go-kzg-4844 updated for compatibility. ([#2490](https://github.com/NibiruChain/nibiru/pull/2490))
145+
- CI / Docker workflow cleanup; release tag trigger fixes.
146+
- Duplicate `nibid add-genesis-account` command removed (use `nibid genesis add-genesis-account`). ([#2448](https://github.com/NibiruChain/nibiru/pull/2448))
147+
* fix(ci): fix release tag trigger
148+
* feat: upgrade v2.10 in [#2504](https://github.com/NibiruChain/nibiru/pull/2504) - ([5cfc50e](https://github.com/NibiruChain/nibiru/commit/5cfc50e0c532c2612b9738147245d671c2a81eff))
149+
* refactor: omit unnecessary reassignment in [#2470](https://github.com/NibiruChain/nibiru/pull/2470) - ([8916455](https://github.com/NibiruChain/nibiru/commit/8916455863e33de9dd8231eff347b3149c66b509))
44150
* fix(Dockerfile): copy over files before "go mod download"
45-
* refactor: move cosmos-sdk to internal/cosmos-sdk for smoother edits to baseapp and the SDK types in [#2451](https://github.com/NibiruChain/nibiru/pull/2451) - ([2abb6c9](https://github.com/NibiruChain/nibiru/commit/2abb6c9610e3a0785eefc7dac23c7b3a82dc42ac))
46-
* refactor(cmd): remove duplicate nibid add-genesis-account command, since it's one of the nibid genesis subcommands in [#2448](https://github.com/NibiruChain/nibiru/pull/2448) - ([7dbfe7d](https://github.com/NibiruChain/nibiru/commit/7dbfe7d05db6a10ab93673e10907cc5c37726146))
151+
152+
153+
#### Refactors and Tech Debt Improvements
154+
* fix(internal/cosmos-sdk): resolve ledger error in tests using build tags in [#2505](https://github.com/NibiruChain/nibiru/pull/2505) - ([9547d17](https://github.com/NibiruChain/nibiru/commit/9547d1719f7a870056cc800351839bd790dbed38))
47155
* docs: remove duplicate word in comment in [#2430](https://github.com/NibiruChain/nibiru/pull/2430) - ([798b6d2](https://github.com/NibiruChain/nibiru/commit/798b6d208010199cb970d4b776807cafb5993963))
48156
* sai-trading: project scaffolding with script to deploy all Sai contracts in [#2433](https://github.com/NibiruChain/nibiru/pull/2433) - ([f77f32f](https://github.com/NibiruChain/nibiru/commit/f77f32ff5239732454ccefc07a76a62e2f4df628))
49157

50-
## [v2.9.0](https://github.com/NibiruChain/nibiru/releases/tag/v2.9.0) - 2025-11-10
158+
#### Dependencies and CI
159+
* ci(docker): simplify workflows; free more disk space to fix docker builds; combine into docker.yml
160+
* docs(changelog): update with version 2.9 and 2.8; fix(justfile/gen-changelog): use config from current branch, not main in [#2465](https://github.com/NibiruChain/nibiru/pull/2465) - ([9acdf4e](https://github.com/NibiruChain/nibiru/commit/9acdf4e8eb6e60272f73d477993b88c4549b0051))
161+
* ci(dependabot.yml): ignore updates to Cosmos-SDK, CometBFT, and Wasmd, as they are often breaking changes
162+
163+
---
164+
165+
## v2.9.0
166+
167+
- [Release Link: v2.9.0](https://github.com/NibiruChain/nibiru/releases/tag/v2.9.0).
168+
- Date: 2025-11-10
51169

170+
Changes:
52171
* fix(evmante): use deterministic ResponseDeliverTx gas wanted and gas consumed on failed EVM tx; nonce increment on the ctx should only happen in DeliverTx and ReCheckTx, not CheckTx in [#2434](https://github.com/NibiruChain/nibiru/pull/2434) - ([68bb5ba](https://github.com/NibiruChain/nibiru/commit/68bb5ba3d1b4655ed3aa0c71cd7904688147c0c7))
53172
* ci(golangci-lint): update linter version to latest (v2.6.1); improve CI caching in [#2431](https://github.com/NibiruChain/nibiru/pull/2431) - ([ba418d7](https://github.com/NibiruChain/nibiru/commit/ba418d746441753bf6872a29a3d9258a0581b00f))
54173

0 commit comments

Comments
 (0)