Skip to content

fix: address 11 accepted security audit findings#46

Merged
nekomoto911 merged 2 commits intoaptos-nodefrom
dev-0228-secure
Mar 10, 2026
Merged

fix: address 11 accepted security audit findings#46
nekomoto911 merged 2 commits intoaptos-nodefrom
dev-0228-secure

Conversation

@Lchangliang
Copy link
Collaborator

CRITICAL:

  • GAPTOS-001: fix NewEpochEvent serialization (serde_json → bcs)

HIGH:

  • GAPTOS-003: restore on-chain RandomnessConfigSeqNum read, remove hardcoded 0
  • GAPTOS-004: replace unwrap() with ? in validator set deserialization
  • GAPTOS-005: filter invalid validators with warning instead of panic in DKG
  • GAPTOS-006: replace panic!() with Err on unknown JWK type

MEDIUM:

  • GAPTOS-013: add tracing::warn! for network address parsing fallback

LOW:

  • GAPTOS-015: fix ChainId FromStr to parse as u64 instead of u8
  • GAPTOS-017: include g_ext in SignedTransaction PartialEq
  • GAPTOS-020: replace eprintln!() with tracing::error!()

INFO:

  • GAPTOS-INFO-001: translate Chinese comments to English in consensus_config.rs
  • GAPTOS-INFO-005: change impl Into to impl From for GravityEvent

CRITICAL:
- GAPTOS-001: fix NewEpochEvent serialization (serde_json → bcs)

HIGH:
- GAPTOS-003: restore on-chain RandomnessConfigSeqNum read, remove hardcoded 0
- GAPTOS-004: replace unwrap() with ? in validator set deserialization
- GAPTOS-005: filter invalid validators with warning instead of panic in DKG
- GAPTOS-006: replace panic!() with Err on unknown JWK type

MEDIUM:
- GAPTOS-013: add tracing::warn! for network address parsing fallback

LOW:
- GAPTOS-015: fix ChainId FromStr to parse as u64 instead of u8
- GAPTOS-017: include g_ext in SignedTransaction PartialEq
- GAPTOS-020: replace eprintln!() with tracing::error!()

INFO:
- GAPTOS-INFO-001: translate Chinese comments to English in consensus_config.rs
- GAPTOS-INFO-005: change impl Into to impl From for GravityEvent
@nekomoto911 nekomoto911 merged commit a5cea29 into aptos-node Mar 10, 2026
38 of 43 checks passed
@nekomoto911 nekomoto911 deleted the dev-0228-secure branch March 10, 2026 11:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants