Upgrade hardhat-waffle / ethereum-waffle toolchain in solidity/ecdsa (unblocks dependabot)

[piotr-roslaniec]

Background

Two Dependabot PRs in solidity/ecdsa (#3942 and #3924) have been held because they bundle a @nomiclabs/hardhat-waffle + ethereum-waffle major-version bump alongside an otherwise unrelated transitive bump. The waffle major break is real and out of scope for a dependency-update PR.

What fails

Both PRs fail the same four jobs on the bundled waffle bump:

• contracts-lint
• contracts-slither
• contracts-build-and-test
• contracts-deployment-dry-run

The underlying cause is the chai matchers API break when going from ethereum-waffle v3 to v4 (the chai plugin moved from ethereum-waffle/chai to @nomicfoundation/hardhat-chai-matchers, and several assertion signatures changed). Test files using expect(...).to.be.revertedWith(...) and friends need to be updated, and hardhat.config.ts needs to register the new plugin.

Proposed work, in order

1. Toolchain upgrade PR (standalone, scoped to solidity/ecdsa)

   • Bump @nomiclabs/hardhat-waffle and ethereum-waffle to the versions Dependabot is pushing in chore(deps): bump node-fetch, @nomiclabs/hardhat-waffle and ethereum-waffle in /solidity/ecdsa #3942
   • Replace the chai integration with @nomicfoundation/hardhat-chai-matchers in hardhat.config.ts
   • Migrate test files using waffle's chai matchers to the new API (.to.be.revertedWithCustomError(...), .changeTokenBalance(...), etc.)
   • Confirm contracts-build-and-test, contracts-lint, contracts-slither, contracts-deployment-dry-run all pass
   • Apply the same upgrade to solidity/random-beacon if the toolchain is shared

2. Close the held Dependabot PRs

   • chore(deps): bump node-fetch, @nomiclabs/hardhat-waffle and ethereum-waffle in /solidity/ecdsa #3942 (also bumps node-fetch) — Dependabot will regenerate cleanly against the new toolchain
   • chore(deps): bump lodash, @nomiclabs/hardhat-waffle and ethereum-waffle in /solidity/ecdsa #3924 (also bumps lodash) — same

Acceptance

• solidity/ecdsa (and solidity/random-beacon if shared) build and test green on the upgraded toolchain.
• Dependabot can re-open the node-fetch and lodash bumps without dragging the waffle major in.

References

• Held PRs: chore(deps): bump node-fetch, @nomiclabs/hardhat-waffle and ethereum-waffle in /solidity/ecdsa #3942, chore(deps): bump lodash, @nomiclabs/hardhat-waffle and ethereum-waffle in /solidity/ecdsa #3924
• Mirror of the same pattern used for the Go toolchain in Bump Go toolchain to 1.25 to unblock dependabot updates (was #3955) #3991

[linear]

ENG-656