feat: NEP-641 reference impl - #335
Merged
Merged
Conversation
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.cargo/audit.toml:
- Around line 5-8: Remove the global RUSTSEC-2026-0222 entry from the shared
audit configuration and scope the suppression to the test-only audit command or
configuration that covers near-sdk/unit-testing dev-dependency graphs. Preserve
the ignore only for those test audits, and document its test-only rationale
there.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 4ec6cfe0-d942-4f8c-8d3a-f2c8c635b988
⛔ Files ignored due to path filters (1)
Cargo.lockis excluded by!**/*.lock
📒 Files selected for processing (11)
.cargo/audit.tomlcontracts/wallet/src/error.rscontracts/wallet/src/nonces.rscontracts/wallet/src/request/ops.rscrates/signatures/nep641/Cargo.tomlcrates/signatures/nep641/src/lib.rscrates/signatures/nep641/src/message.rscrates/signatures/nep641/src/resolver/error.rscrates/wallet/sdk/Cargo.tomlcrates/wallet/sdk/src/relayer/near_kit.rscrates/wallet/sdk/tests/test.rs
🚧 Files skipped from review as they are similar to previous changes (8)
- crates/signatures/nep641/src/resolver/error.rs
- crates/wallet/sdk/tests/test.rs
- crates/signatures/nep641/Cargo.toml
- crates/wallet/sdk/Cargo.toml
- crates/wallet/sdk/src/relayer/near_kit.rs
- contracts/wallet/src/error.rs
- crates/signatures/nep641/src/lib.rs
- crates/signatures/nep641/src/message.rs
Comment on lines
+5
to
+8
| ignore = [ | ||
| # transitive wasmtime dependency is only currently used for `near-sdk/unit-testing` feature | ||
| "RUSTSEC-2026-0222", # TODO: remove | ||
| ] |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
echo "Dependency and audit references:"
fd -a -t f -e toml -e lock -e yml -e yaml -e sh . \
| xargs -r rg -n -C 5 \
'near-sdk|unit-testing|wasmtime|cargo audit|RUSTSEC-2026-0222'
echo
echo "Wasmtime versions in lockfiles:"
while IFS= read -r lockfile; do
echo "== $lockfile =="
rg -n -A3 -B1 '^name = "wasmtime"$' "$lockfile"
done < <(fd -a -t f -g 'Cargo.lock' .)Repository: near/intents
Length of output: 50368
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
echo "Cargo.lock wasmtime package entries:"
python3 - <<'PY'
from pathlib import Path
p = Path('Cargo.lock')
text = p.read_text()
# Extract package blocks with name = "wasmtime" including metadata/dependencies if present.
start_indices = [i for i in range(len(text)) if text.startswith('[[package]]', i)]
blocks = []
for idx in start_indices:
nxt = min(start_indices[start_indices.index(idx)+1:]) if idx != start_indices[-1] else len(text)
blocks.append((idx,nxt))
for idx,nxt in blocks:
block = text[idx:nxt].splitlines()
name = None
for line in block:
if line.startswith('name = ') and '"' in line:
name = line.split('"',2)[1]
break
if name == 'wasmtime':
print('\n'.join(block[:80]))
PY
echo
echo "Dependencies on wasmtime in lockfile package blocks:"
python3 - <<'PY'
from pathlib import Path
import re
p = Path('Cargo.lock')
text = p.read_text()
blocks = re.findall(r'^{(?P<body>.*?)^}$', text, re.S | re.M)
for body in blocks:
name = re.search(r'^name = "(.*?)"', body, re.M)
deps = re.findall(r'^\s{1,4}"(wasmtime[^"]*)"', body, re.M)
if name and (name.group(1) == 'wasmtime' or deps):
print(name.group(1), deps[:10])
PY
echo
echo "Workspace/package references to unit-testing or wasmtime in dependency sections:"
python3 - <<'PY'
from pathlib import Path
files = list(Path('.').glob('**/Cargo.toml'))
for f in files:
if any(part in {'.git','target'} for part in f.parts):
continue
s = f.read_text()
if 'unit-testing' in s or 'wasmtime' in s:
print(f)
for sec in ['[dependencies]','[dev-dependencies]','[build-dependencies]']:
if sec in s:
i=s.index(sec); ss=s.find('\n[',i+1); end=len(s) if ss==-1 else ss
print(s[i:end].splitlines()[:25])
PY
echo
echo "Audit configuration and CI audit references:"
rg -n -C 4 'audit|cargo-audit|RUSTSEC-2026-0222|features\s*=|\[.*\]' ./.cargo audit -g 'Cargo.toml' .github workflows .github/workflows 2>/dev/null || trueRepository: near/intents
Length of output: 16434
🌐 Web query:
RUSTSEC-2026-0222 wasmtime vulnerability fixed version
💡 Result:
The vulnerability RUSTSEC-2026-0222, which involves type index confusion between Wasmtime engines, was patched in the following versions [1][2]: - 24.0.12 - 36.0.13 - 46.0.2 - 47.0.3 Users are advised to update to these versions or higher to remediate the vulnerability [3].
Citations:
- 1: https://rustsec.org/advisories/RUSTSEC-2026-0222.html
- 2: https://osv.dev/vulnerability/RUSTSEC-2026-0222
- 3: https://vulert.com/vuln-db/stores-can-mix-up-type-indices-between-engines
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
echo "Cargo.lock wasmtime resolution and reverse dependencies:"
python3 - <<'PY'
from pathlib import Path
import re
lock = Path('Cargo.lock').read_text()
blocks = re.findall(r'(?m)^\[\[package\]\].*?^(?=\[\[package\]\]|$)', lock, re.S)
pkgs = {}
for block in blocks:
m = re.search(r'^name = "(.*?)"\n', block, re.M)
if not m: continue
name = m.group(1)
version = re.search(r'^version = "(.*?)"\n', block, re.M)
deps = re.findall(r'^\n{0,1} {4}"(.*?)"\n', block, re.M)
pkgs[name] = {"version": version.group(1) if version else None, "dependencies": deps}
print("wasmtime =", pkgs.get("wasmtime", {}))
for name, info in pkgs.items():
if info.get("version") == "wasmtime" or info.get("dependencies") and "wasmtime" in info["dependencies"]:
print(name, "version=", pkgs[name]["version"], "depends on wasmtime")
print("\nLock references to unit-testing:")
for f in list(Path('.').glob('**/Cargo.toml')):
text = f.read_text()
if 'unit-testing' in text or 'wasmtime' in text:
print(f)
for sec in ('[dependencies]', '[dev-dependencies]', '[build-dependencies]'):
if sec in text:
print(text[sec:sec.text(text.find(sec)).text])
PYRepository: near/intents
Length of output: 474
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
echo "Lockfile reverse dependencies on wasmtime:"
python3 - <<'PY'
from pathlib import Path
import re
lock = Path('Cargo.lock').read_text()
blocks = re.findall(r'(?ms)^\[\[package\]\].*?^(?=\[\[package\]\]|$)', lock)
pkgs = {}
for block in blocks:
m = re.search(r'^name = "(.*?)"\n', block, re.M)
if not m: continue
version_match = re.search(r'^version = "(.*?)"\n', block, re.M)
deps = re.findall(r'^\n{0,1} {4}"(.*?)"\n', block, re.M)
pkgs[m.group(1)] = {"version": version_match.group(1) if version_match else None, "dependencies": deps}
print("wasmtime in lock:", pkgs.get("wasmtime"))
for name, info in pkgs.items():
if info["dependencies"] and "wasmtime" in info["dependencies"]:
print(name, "version=", info["version"], "depends on wasmtime")
PY
echo
echo "Manifest direct dependency references:"
python3 - <<'PY'
from pathlib import Path
for f in Path('.').glob('**/Cargo.toml'):
if any(part in {'.git','target'} for part in f.parts):
continue
text = f.read_text()
if 'unit-testing' in text or 'wasmtime' in text:
print(f)
for sec in ('[dependencies]', '[dev-dependencies]', '[build-dependencies]'):
if sec in text:
print(text[text.index(sec):])
PY
echo
echo "Audit configuration contents:"
cat -n .cargo/audit.toml 2>/dev/null || trueRepository: near/intents
Length of output: 33036
Security Misconfiguration (CWE-693)
Reachability: Internal
Scope this global advisory suppression to the test-only graph.
The shared .cargo/audit.toml suppresses RUSTSEC-2026-0222 for every cargo-audit invocation. The affected wasmtime 45.0.3 package is only reachable through manifests that enable near-sdk/unit-testing in dev-dependencies/target.'cfg(near)'.dev-dependencies, so document or move this ignore to the test-only audit command to avoid suppressing future non-test release dependency paths.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.cargo/audit.toml around lines 5 - 8, Remove the global RUSTSEC-2026-0222
entry from the shared audit configuration and scope the suppression to the
test-only audit command or configuration that covers near-sdk/unit-testing
dev-dependency graphs. Preserve the ignore only for those test audits, and
document its test-only rationale there.
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@crates/signatures/nep641/src/message.rs`:
- Line 246: Run cargo fmt to normalize the formatting of the changed
documentation example near the timestamp in message.rs, then include the
formatter’s output in the commit without making unrelated changes.
- Around line 242-255: Update the example message around into_nep413_payload so
its expected nonce matches the complete path being hashed: either regenerate the
nonce for the two-hop path and keep its corresponding recipient, or change the
path to the one-hop form used by the existing expected hash and adjust the
recipient accordingly.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: e78418e7-1e4b-4df7-a45c-8b0102799766
📒 Files selected for processing (3)
crates/signatures/nep641/Cargo.tomlcrates/signatures/nep641/src/access_keys.rscrates/signatures/nep641/src/message.rs
🚧 Files skipped from review as they are similar to previous changes (1)
- crates/signatures/nep641/Cargo.toml
…lisions with other authorization schemas
frol
reviewed
Aug 6, 2026
mitinarseny
force-pushed
the
feat/nep641
branch
from
August 6, 2026 21:19
139b0b6 to
04e1e9b
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit