Merge branch 'master' into audit-svm-oct-2025

Signed-off-by: Reinis Martinsons <reinis@umaproject.org>

Author: Reinis-FRP

.github/actions/setup-node-if-needed/action.yml

@@ -15,7 +15,7 @@ runs:
       id: check-node
       shell: bash
       run: |
-        if command -v node >/dev/null 2>&1; then
+        if node --version 2>/dev/null | grep -q "v${{ inputs.node_version }}"; then
           echo "installed=true" >> "$GITHUB_OUTPUT"
         else
           echo "installed=false" >> "$GITHUB_OUTPUT"

.github/workflows/pr.yml

@@ -5,7 +5,7 @@ on:
     branches:
       - "master"
 env:
-  NODE_VERSION: 20
+  NODE_VERSION: 22.18
 jobs:
   # Multiple jobs depend on having EVM and SVM artifacts available, so we upload them first in separate jobs.
   upload-svm-artifacts:

.github/workflows/publish.yml

@@ -14,8 +14,9 @@ on:
     types: [created]
 permissions:
   contents: write
+  id-token: write
 env:
-  NODE_VERSION: "20.x"
+  NODE_VERSION: 22.18
   EVM_ARTIFACTS_PATHS: |
     artifacts
     cache
@@ -29,21 +30,23 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
 
       # Note we set an `id` called `release`. We'll use that later...
       - name: Validate and extract release information
         id: release
         uses: manovotny/github-releases-for-automated-package-publishing-action@v2.0.1
 
-      # Setup .npmrc file to publish to npm
-      - uses: actions/setup-node@v3
+      # Enable npm trusted publishing (OIDC) for releases
+      - uses: actions/setup-node@v4
         with:
           node-version: "${{ env.NODE_VERSION }}"
-          always-auth: true
           registry-url: "https://registry.npmjs.org"
           cache: "yarn"
 
+      - name: Update npm
+        run: npm install -g npm@latest
+
       - name: Install packages
         run: yarn install --frozen-lockfile
 
@@ -88,25 +91,23 @@ jobs:
       # If there *is not* a tag (ie. `beta`, `canary`, etc.), we publish a
       # version of a package (ie. 1.2.3).
       #
-      # This example is using npm to publish, but you could just as easily
-      # use yarn, if you prefer. It's also publishing to the NPM registry,
-      # thus, it's using `NPM_TOKEN`, but you could just as easily use
-      # `GITHUB_TOKEN` if you were publishing to the GitHub Package registry.
+      # This workflow publishes via npm using GitHub's OIDC integration for
+      # trusted publishing, so no long-lived tokens are required.
 
       # This will publish a "pre-release" or "tagged" version of a package.
 
       # This will publish a version of a package.
       - name: Publish version
         if: steps.release.outputs.tag == ''
-        run: yarn publish
+        run: npm publish
         env:
-          NPM_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NPM_CONFIG_PROVENANCE: "false"
 
       - name: Publish tagged version
         if: steps.release.outputs.tag != ''
-        run: yarn publish --tag ${{ steps.release.outputs.tag }}
+        run: npm publish --tag ${{ steps.release.outputs.tag }}
         env:
-          NPM_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NPM_CONFIG_PROVENANCE: "false"
 
   # Due to GitHub cache scoping, we cannot easily share the cache between releases even if the cache key is the same.
   # In order to not slow down the NPM package publishing, we move the building of SVM binaries for GitHub release to a
@@ -115,7 +116,7 @@ jobs:
     name: Release SVM production binaries on GitHub
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
 
       - name: Setup Anchor & Solana
         uses: ./.github/actions/setup-solana-anchor
@@ -138,7 +139,7 @@ jobs:
     name: Release SVM test binaries on GitHub
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
 
       - name: Setup Anchor & Solana
         uses: ./.github/actions/setup-solana-anchor

.gitignore

@@ -29,6 +29,7 @@ artifacts-zk
 # Foundry files
 out
 zkout
+cache-foundry
 
 # Upgradeability files
 .openzeppelin

.solhint.json

@@ -3,6 +3,7 @@
   "rules": {
     "compiler-version": ["error", "^0.8.0"],
     "func-visibility": ["warn", { "ignoreConstructors": true }],
-    "const-name-snakecase": "off"
+    "const-name-snakecase": "off",
+    "no-console": "off"
   }
 }

broadcast/113DeploySponsoredCCTPSrcPeriphery.sol/42161/run-latest.json

@@ -0,0 +1,66 @@
+{
+  "transactions": [
+    {
+      "hash": "0x6c4f6d7537530911757ecc317e0b5a39b5caf7089ab5549cb4299c830a9d854c",
+      "transactionType": "CREATE",
+      "contractName": "SponsoredCCTPSrcPeriphery",
+      "contractAddress": "0xce1ffe01ebb4f8521c12e74363a396ee3d337e1b",
+      "function": null,
+      "arguments": ["0x28b5a0e9C621a5BadaA536219b3a228C8168cf5d", "3", "0x9A8f92a830A5cB89a3816e3D267CB7791c16b04D"],
+      "transaction": {
+        "from": "0x9a8f92a830a5cb89a3816e3d267cb7791c16b04d",
+        "gas": "0x1271f2",
+        "value": "0x0",
+        "input": "0x60c03461012157601f61100738819003918201601f19168301916001600160401b03831184841017610125578084926060946040528339810103126101215761004781610139565b60208201519163ffffffff831683036101215760406100669101610139565b905f549260018060a01b03908160018060a01b03199333858816175f5560405196823391167f8be0079c531659141344cd1fd0a4f28419497f9722a3daafe3b4186f6b6457e05f80a31660805260a0527ff0a1b42b86a218bb35dbc2254545839ce4b1bf1d3780b5099e3e0abfc7a5b200921690825416179055610eb9908161014e8239608051818181610170015281816107b701528181610826015281816108b001526109b3015260a0518181816101b1015261061c0152f35b5f80fd5b634e487b7160e01b5f52604160045260245ffd5b51906001600160a01b03821682036101215756fe6080806040526004361015610012575f80fd5b5f905f3560e01c908163238ac93314610b645750806363cd663b146102d45780636c19e78314610261578063715018a6146101fb5780638da5cb5b146101d55780638ddb4a89146101945780639748cf7c14610150578063f2fde38b146100d15763feb6172414610081575f80fd5b346100ce5760203660031901126100ce5760ff604060209260043581527ff0a1b42b86a218bb35dbc2254545839ce4b1bf1d3780b5099e3e0abfc7a5b20184522054166040519015158152f35b80fd5b50346100ce5760203660031901126100ce576004356001600160a01b0380821680920361014c57610100610cb2565b811561014c575f548273ffffffffffffffffffffffffffffffffffffffff198216175f55167f8be0079c531659141344cd1fd0a4f28419497f9722a3daafe3b4186f6b6457e05f80a380f35b8280fd5b50346100ce57806003193601126100ce5760206040516001600160a01b037f0000000000000000000000000000000000000000000000000000000000000000168152f35b50346100ce57806003193601126100ce57602060405163ffffffff7f0000000000000000000000000000000000000000000000000000000000000000168152f35b50346100ce57806003193601126100ce576001600160a01b036020915416604051908152f35b50346100ce57806003193601126100ce57610214610cb2565b5f6001600160a01b03815473ffffffffffffffffffffffffffffffffffffffff1981168355167f8be0079c531659141344cd1fd0a4f28419497f9722a3daafe3b4186f6b6457e08280a380f35b50346100ce5760203660031901126100ce576004356001600160a01b0381168091036102d05761028f610cb2565b7ff0a1b42b86a218bb35dbc2254545839ce4b1bf1d3780b5099e3e0abfc7a5b2009073ffffffffffffffffffffffffffffffffffffffff1982541617905580f35b5080fd5b5034610995576003196040368201126109955767ffffffffffffffff60043511610995576102008091600435360301126109955760405190810181811067ffffffffffffffff82111761097657604052610332600435600401610c01565b8152610342602460043501610c01565b602082015260043560448101356040830152606481013560608301526084810135608083015260a481013560a083015260c481013560c08301526103889060e401610c01565b60e08201526004356101048101356101008301526101248101356101208301526101448101356101408301526101648101356101608301526101848101356101808301526101a48101356101a08301526101c4013560ff81169003610995576004356101c48101356101c08301526101e4013567ffffffffffffffff81116109955761041b906004369181350101610c2e565b6101e082015267ffffffffffffffff602435116109955761044136602435600401610c2e565b6001600160a01b037ff0a1b42b86a218bb35dbc2254545839ce4b1bf1d3780b5099e3e0abfc7a5b200541663ffffffff83511663ffffffff60208501511660408501516060860151608087015160a08801519060c08901519263ffffffff60e08b01511694604051966020880198895260408801526060870152608086015260a085015260c084015260e083015261010082015261010081526104e381610ba6565b5190206101008401516101208501516101408601516101608701516101808801516101a08901519060ff6101c08b015116926101e08b01516020815191012094604051966020880198895260408801526060870152608086015260a085015260c084015260e0830152610100820152610100815261056081610ba6565b51902060405191602083015260408201526040815280606081011067ffffffffffffffff6060830111176109765760608101604052602081519101206105a68382610daa565b6005819492941015610b5057159283610b3d575b508215610aac575b505015610a9a576101008201515f527ff0a1b42b86a218bb35dbc2254545839ce4b1bf1d3780b5099e3e0abfc7a5b20160205260ff60405f205416610a88576101208201514211610a765763ffffffff82511663ffffffff7f00000000000000000000000000000000000000000000000000000000000000001603610a6457606082015163ffffffff602084015116906040840151916080850151918260a01c610a525760a08601519260c087015163ffffffff60e089015116610100890151916107036101208b0151936106f56101408d01518d6101608101516101808201516101a0830151916101e060ff6101c086015116940151946040519b8c9860208a015260408901526060880152608087015260a086015260c085015260e084015261010080840152610120830190610c74565b03601f198101855284610bdf565b6101008a01515f527ff0a1b42b86a218bb35dbc2254545839ce4b1bf1d3780b5099e3e0abfc7a5b20160205260405f20600160ff198254161790556040516323b872dd60e01b6020820152336024820152306044820152856064820152606481528060a081011067ffffffffffffffff60a083011117610976578060a061079792016040526001600160a01b038616610cdd565b60405160208101905f8063095ea7b360e01b938481526001600160a01b037f0000000000000000000000000000000000000000000000000000000000000000166024850152896044850152604484526107ef84610bc3565b835190826001600160a01b038b165af1610807610d7b565b81610a23575b5080610a10575b15610999575b50506001600160a01b037f0000000000000000000000000000000000000000000000000000000000000000163b15610995575f966001600160a01b036108a3956040519a8b998a9963779b432d60e01b8b5260048b015260248a01526044890152166064870152608486015260a485015260c484015261010060e4840152610104830190610c74565b0381836001600160a01b037f0000000000000000000000000000000000000000000000000000000000000000165af1801561098a57610959575b506101008201517f42d1b5f3692944aee65b659fda3e120f817f17d8f2ac9a256f6fc5d642a591fe6101808401519361012081015190610140810151906101a06101608201519101519160405193845260208401526040830152606082015260a0608082015280610953339560a0830190610c74565b0390a480f35b90925067ffffffffffffffff8111610976576040525f915f6108dd565b634e487b7160e01b5f52604160045260245ffd5b6040513d5f823e3d90fd5b5f80fd5b6109fa610a09926040519060208201526001600160a01b037f00000000000000000000000000000000000000000000000000000000000000001660248201525f6044820152604481526109eb81610bc3565b6001600160a01b038816610cdd565b6001600160a01b038616610cdd565b5f8061081a565b506001600160a01b0386163b1515610814565b8051801592508215610a38575b50505f61080d565b610a4b9250602080918301019101610cc5565b5f80610a30565b6040516379ec0ed760e11b8152600490fd5b604051631b91204960e01b8152600490fd5b604051631da7447960e21b8152600490fd5b604051633ab3447f60e11b8152600490fd5b604051638baa579f60e01b8152600490fd5b5f91925081906040516020810190630b135d3f60e11b95868352602482015260406044820152610af181610ae3606482018a610c74565b03601f198101835282610bdf565b51915afa90610afe610d7b565b82610b2f575b82610b13575b50505f806105c2565b9091506020818051810103126109955760200151145f80610b0a565b915060208251101591610b04565b6001600160a01b0316811492505f6105ba565b634e487b7160e01b5f52602160045260245ffd5b34610995575f366003190112610995576020906001600160a01b037ff0a1b42b86a218bb35dbc2254545839ce4b1bf1d3780b5099e3e0abfc7a5b20054168152f35b610120810190811067ffffffffffffffff82111761097657604052565b6080810190811067ffffffffffffffff82111761097657604052565b90601f8019910116810190811067ffffffffffffffff82111761097657604052565b359063ffffffff8216820361099557565b67ffffffffffffffff811161097657601f01601f191660200190565b81601f8201121561099557803590610c4582610c12565b92610c536040519485610bdf565b8284526020838301011161099557815f926020809301838601378301015290565b91908251928382525f5b848110610c9e575050825f602080949584010152601f8019910116010190565b602081830181015184830182015201610c7e565b6001600160a01b035f5416330361099557565b90816020910312610995575180151581036109955790565b6001600160a01b03166040516040810181811067ffffffffffffffff82111761097657610d4b937f5361666545524332303a206c6f772d6c6576656c2063616c6c206661696c656460205f948594604052818152015260208151910182855af1610d45610d7b565b91610e5a565b8051908115918215610d61575b50501561099557565b610d749250602080918301019101610cc5565b5f80610d58565b3d15610da5573d90610d8c82610c12565b91610d9a6040519384610bdf565b82523d5f602084013e565b606090565b9060418151145f14610dd657610dd291602082015190606060408401519301515f1a90610ddf565b9091565b50505f90600290565b7f7fffffffffffffffffffffffffffffff5d576e7357a4501ddfe92f46681b20a08411610e4f576020935f9360ff60809460405194855216868401526040830152606082015282805260015afa1561098a575f516001600160a01b03811615610e4757905f90565b505f90600190565b505050505f90600390565b9015610e7457815115610e6b575090565b3b156109955790565b50805190811561099557602001fdfea26469706673582212208c663c4d9608c58c567c60bd0a3b59cd34b106eb0822cc185cd73394904c00ef64736f6c6343000818003300000000000000000000000028b5a0e9c621a5badaa536219b3a228c8168cf5d00000000000000000000000000000000000000000000000000000000000000030000000000000000000000009a8f92a830a5cb89a3816e3d267cb7791c16b04d",
+        "nonce": "0x1491",
+        "chainId": "0xa4b1"
+      },
+      "additionalContracts": [],
+      "isFixedGasLimit": false
+    }
+  ],
+  "receipts": [
+    {
+      "status": "0x1",
+      "cumulativeGasUsed": "0x1566bc",
+      "logs": [
+        {
+          "address": "0xce1ffe01ebb4f8521c12e74363a396ee3d337e1b",
+          "topics": [
+            "0x8be0079c531659141344cd1fd0a4f28419497f9722a3daafe3b4186f6b6457e0",
+            "0x0000000000000000000000000000000000000000000000000000000000000000",
+            "0x0000000000000000000000009a8f92a830a5cb89a3816e3d267cb7791c16b04d"
+          ],
+          "data": "0x",
+          "blockHash": "0xb96390ff4cb98b461e0035779e43c62874dd281b874612d90ceb474c7af460e7",
+          "blockNumber": "0x183aa1d0",
+          "blockTimestamp": "0x692f41c1",
+          "transactionHash": "0x6c4f6d7537530911757ecc317e0b5a39b5caf7089ab5549cb4299c830a9d854c",
+          "transactionIndex": "0x5",
+          "logIndex": "0xc",
+          "removed": false
+        }
+      ],
+      "logsBloom": "0x00000000000000020000000000000000000000000000000000800000000000000000000000000000000000000000004000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000020000000000000000000800000000000000000000000000040000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000010000000000000000000000000000020000001000000000000000000000000000000000000000000000000000000000000",
+      "type": "0x2",
+      "transactionHash": "0x6c4f6d7537530911757ecc317e0b5a39b5caf7089ab5549cb4299c830a9d854c",
+      "transactionIndex": "0x5",
+      "blockHash": "0xb96390ff4cb98b461e0035779e43c62874dd281b874612d90ceb474c7af460e7",
+      "blockNumber": "0x183aa1d0",
+      "gasUsed": "0xe0c5d",
+      "effectiveGasPrice": "0xa67930",
+      "from": "0x9a8f92a830a5cb89a3816e3d267cb7791c16b04d",
+      "to": null,
+      "contractAddress": "0xce1ffe01ebb4f8521c12e74363a396ee3d337e1b",
+      "gasUsedForL1": "0xc55",
+      "l1BlockNumber": "0x16d1c86",
+      "timeboosted": false
+    }
+  ],
+  "libraries": [],
+  "pending": [],
+  "returns": {},
+  "timestamp": 1764704723344,
+  "chain": 42161,
+  "commit": "4b103fe"
+}