-
Notifications
You must be signed in to change notification settings - Fork 208
fix: limit singletons access #247
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
fix: limit singletons access #247
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Caution
Changes requested ❌
Reviewed everything up to 2b1be92 in 6 minutes and 6 seconds. Click for details.
- Reviewed
2365lines of code in15files - Skipped
0files when reviewing. - Skipped posting
4draft comments. View those below. - Modify your settings and rules to customize what types of comments Ellipsis leaves. And don't forget to react with 👍 or 👎 to teach Ellipsis.
1. crates/lib/src/validator/transaction_validator.rs:52
- Draft comment:
When converting allowed_tokens from strings to Pubkeys in the 'new' method, consider trimming whitespace to avoid parsing errors from accidental spaces. - Reason this comment was not posted:
Comment was not on a location in the diff, so it can't be submitted as a review comment.
2. crates/lib/src/validator/transaction_validator.rs:369
- Draft comment:
Document and/or clarify the units for fee amounts in validate_strict_pricing_with_fee so that maintainers understand that fees are in lamports and the logic for the strict pricing check. - Reason this comment was not posted:
Comment was on unchanged code.
3. crates/lib/src/validator/transaction_validator.rs:305
- Draft comment:
In validate_disallowed_accounts, ensure that checking each account in instruction.accounts against the disallowed list covers all desired cases. Consider whether additional metadata should be inspected. - Reason this comment was not posted:
Comment was not on a location in the diff, so it can't be submitted as a review comment.
4. crates/lib/src/admin/token_util.rs:378
- Draft comment:
Typo in assertion message: consider revising "Should return 1 missing ATAs" to "Should return 1 missing ATA" for grammatical consistency. - Reason this comment was not posted:
Comment was not on a location in the diff, so it can't be submitted as a review comment.
Workflow ID: wflow_qugYfhPsqJYbAIGo
You can customize by changing your verbosity settings, reacting with 👍 or 👎, replying to comments, or adding code review rules.
dev-jodee
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks for the PR ! Appreciate the work, left a couple of comments to fix before we can bring this in main :)
dev-jodee
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Looks good, I won't merge it not just because we're finalizing the pr for the audit, I'll merge it into main as soon as we merge that other one just to keep them both separate :) shouldn't be too long ! thanks for the work
|
Amazing! I'll point our project back to canonical version of kora when the changes are live, thanks so much for the quick review @dev-jodee ! |
|
Reopened there #263 |

Howdy team!
First - Thank you so much for open sourcing this project, it's a gold mine!
We're pulling kora as a library in the context of a new project and we quickly experienced a blocker related to the way the config was being managed.
We have to rely on our fork for now but we'd love to contribute back, let us know this PR make sense to you!
Summary
Refactored functions to accept config as a parameter instead of calling
get_config()internally. Config is now fetched once at the RPC method level and passeddown through the call chain.
Motivation
Kora is available as a library, and the current global config approach adds constraints
for library consumers. This refactoring:
function calls
Important
Refactor code to pass
configas a parameter instead of using global configuration, affecting multiple functions and tests.configas a parameter instead of usingget_config().configis fetched once at the RPC method level and passed down.initialize_atas_with_chunk_size()andfind_missing_atas()intoken_util.rsto acceptconfig.CacheUtil::get_account()incache.rsto requireconfig.estimate_transaction_fee()andsign_and_send_transaction()inrpc_server/methodto useconfig.validate_account()inaccount_validator.rsto takeconfig.validate_transaction()intransaction_validator.rsto useconfig.configparameter changes.transaction_validator.rs,account_validator.rs, andconfig_validator.rsreflect newconfigparameter usage.This description was created by
for 2b1be92. You can customize this summary. It will automatically update as commits are pushed.