fix: apply changes from external audit (#42)

Author: 0xstepit

.github/workflows/vuln_nancy.yaml

@@ -1,38 +1,32 @@
 name: Scan Vulnerabilities
-
 on:
   pull_request:
     paths:
       - 'go.mod'
       - 'go.sum'
-
 jobs:
   nancy-scan:
     runs-on: ubuntu-latest
-    
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v4
-
-    - name: Set up Go
-      uses: actions/setup-go@v5
-      with:
-        go-version-file: go.mod
-
-    - name: Run Nancy vulnerability scanner
-      run: make nancy
-
+      - name: Checkout code
+        uses: actions/checkout@v4
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+      - name: Run Nancy vulnerability scanner
+        run: make nancy
+        env:
+          NANCY_TOKEN: ${{secrets.NANCY_TOKEN}}
+          NANCY_USER: ${{secrets.NANCY_USER}}
   vulncheck:
     runs-on: ubuntu-latest
-
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
-
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
           go-version-file: go.mod
-
       - name: Run vulncheck
         run: go tool govulncheck ./...

Makefile

@@ -96,7 +96,11 @@ nancy:
 	@go list -json -deps ./... | docker run --rm -i \
 	  --volume "$(PWD)":/workspace \
 	  --workdir /workspace \
+	  -e NANCY_USER \
+	  -e NANCY_TOKEN \
 	  $(NANCY_IMAGE) sleuth \
+       --username $(NANCY_USER) \
+       --token $(NANCY_TOKEN) \
 	  --exclude-vulnerability-file .nancy-ignore
 	@echo "Completed Nancy vulnerability scan!"
 

api/component/dispatcher/v1/query.pulsar.go

@@ -240,5 +240,5 @@ func ComputeFeeAmount(amount math.Int, basisPoints uint64) (math.Int, error) {
 		return math.ZeroInt(), err
 	}
 
-	return fee.QuoRaw(core.BPSNormalizer), nil
+	return fee.QuoRaw(actiontypes.BPSNormalizer), nil
 }

api/component/forwarder/v1/query.pulsar.go

@@ -220,7 +220,7 @@ func TestComputeFeesToDistribute(t *testing.T) {
 			feesInfo: []*actiontypes.FeeInfo{
 				{
 					Recipient:   recipient1.String(),
-					BasisPoints: core.BPSNormalizer, // 100%
+					BasisPoints: actiontypes.BPSNormalizer, // 100%
 				},
 			},
 			expFeeToDistribute: &actiontypes.FeesToDistribute{
@@ -390,7 +390,7 @@ func TestValidateAttributes(t *testing.T) {
 				FeesInfo: []*actiontypes.FeeInfo{
 					{
 						Recipient:   recipient.String(),
-						BasisPoints: core.BPSNormalizer + 1,
+						BasisPoints: actiontypes.BPSNormalizer + 1,
 					},
 				},
 			},
@@ -446,7 +446,7 @@ func TestValidateAttributes(t *testing.T) {
 				FeesInfo: []*actiontypes.FeeInfo{
 					{
 						Recipient:   recipient.String(),
-						BasisPoints: core.BPSNormalizer,
+						BasisPoints: actiontypes.BPSNormalizer,
 					},
 				},
 			},

controller/action/fee.go

@@ -21,6 +21,7 @@
 package adapter_test
 
 import (
+	"encoding/json"
 	"testing"
 
 	"github.com/stretchr/testify/require"
@@ -34,6 +35,7 @@ import (
 	"github.com/noble-assets/orbiter/testutil"
 	"github.com/noble-assets/orbiter/testutil/testdata"
 	"github.com/noble-assets/orbiter/types"
+	forwardingtypes "github.com/noble-assets/orbiter/types/controller/forwarding"
 	"github.com/noble-assets/orbiter/types/core"
 )
 
@@ -109,6 +111,42 @@ func TestParsePayload(t *testing.T) {
 				},
 			},
 		},
+		// NOTE: the following test case comes from an external audit report.
+		{
+			name: "success - orbiter payload with incomplete CCTP attributes",
+			setup: func(reg codectypes.InterfaceRegistry) {
+				reg.RegisterImplementations(
+					(*core.ForwardingAttributes)(nil),
+					&forwardingtypes.CCTPAttributes{},
+				)
+			},
+			payloadBz: func() []byte {
+				memo := map[string]any{
+					"orbiter": map[string]any{
+						"forwarding": map[string]any{
+							"protocol_id": 2,
+							"attributes": map[string]any{
+								"@type":          "/noble.orbiter.controller.forwarding.v1.CCTPAttributes",
+								"mint_recipient": "PNWAxASH2RPmgMV+/Tb4e78ON1WL8SoFGnwbWWHxfuA=",
+							},
+						},
+					},
+				}
+
+				memoBz, err := json.MarshalIndent(memo, "", "  ")
+				require.NoError(t, err)
+
+				return memoBz
+			}(),
+			expectPayload: &core.Payload{
+				Forwarding: &core.Forwarding{
+					ProtocolId: core.PROTOCOL_CCTP,
+					Attributes: &codectypes.Any{
+						TypeUrl: "/noble.orbiter.controller.forwarding.v1.CCTPAttributes",
+					},
+				},
+			},
+		},
 	}
 
 	for _, tc := range testCases {
@@ -120,8 +158,7 @@ func TestParsePayload(t *testing.T) {
 			}
 
 			parser, err := adapterctrl.NewIBCParser(encCfg.Codec)
-			require.NoError(t, err)
-
+			require.NoError(t, err, "expected no error creating parser")
 			payload, err := parser.ParsePayload(tc.payloadBz)
 
 			if tc.expErr != "" {
@@ -132,12 +169,10 @@ func TestParsePayload(t *testing.T) {
 				require.Equal(t, tc.expectPayload.Forwarding.ProtocolId, payload.Forwarding.ProtocolId, "expected different id")
 				require.Equal(t, tc.expectPayload.Forwarding.Attributes.TypeUrl, payload.Forwarding.Attributes.TypeUrl, "expected different forwarding attributes type url")
 
-				if tc.expectPayload.PreActions != nil {
-					require.Len(t, payload.PreActions, len(tc.expectPayload.PreActions))
-					if len(payload.PreActions) > 0 {
-						require.Equal(t, tc.expectPayload.PreActions[0].Id, payload.PreActions[0].Id)
-						require.Equal(t, tc.expectPayload.PreActions[0].Attributes.TypeUrl, payload.PreActions[0].Attributes.TypeUrl)
-					}
+				require.Len(t, payload.PreActions, len(tc.expectPayload.PreActions))
+				if len(tc.expectPayload.PreActions) != 0 {
+					require.Equal(t, tc.expectPayload.PreActions[0].Id, payload.PreActions[0].Id)
+					require.Equal(t, tc.expectPayload.PreActions[0].Attributes.TypeUrl, payload.PreActions[0].Attributes.TypeUrl)
 				}
 			}
 		})

controller/action/fee_test.go

@@ -138,7 +138,9 @@ func InjectForwardingControllers(in ComponentsInputs) {
 		panic(errorsmod.Wrap(err, "error creating internal controller"))
 	}
 
-	in.Orbiters.SetForwardingControllers(cctp, hyperlane, internal)
+	if err := in.Orbiters.SetForwardingControllers(cctp, hyperlane, internal); err != nil {
+		panic(errorsmod.Wrap(err, "error setting forwarder controllers"))
+	}
 }
 
 func InjectActionControllers(in ComponentsInputs) {
@@ -151,7 +153,9 @@ func InjectActionControllers(in ComponentsInputs) {
 		panic(errorsmod.Wrap(err, "error creating fee controller"))
 	}
 
-	in.Orbiters.SetActionControllers(fee)
+	if err := in.Orbiters.SetActionControllers(fee); err != nil {
+		panic(errorsmod.Wrap(err, "error setting action controllers"))
+	}
 }
 
 func InjectAdapterControllers(in ComponentsInputs) {
@@ -163,5 +167,7 @@ func InjectAdapterControllers(in ComponentsInputs) {
 		panic(errorsmod.Wrap(err, "error creating IBC adapter"))
 	}
 
-	in.Orbiters.SetAdapterControllers(ibc)
+	if err := in.Orbiters.SetAdapterControllers(ibc); err != nil {
+		panic(errorsmod.Wrap(err, "error setting adapter controllers"))
+	}
 }

controller/adapter/ibc_test.go

@@ -5,6 +5,7 @@ go 1.24
 require (
 	cosmossdk.io/errors v1.0.2
 	cosmossdk.io/math v1.5.1
+	github.com/bcp-innovations/hyperlane-cosmos v1.0.1
 	github.com/circlefin/noble-cctp v0.0.0-20241031192117-4285c94ec194
 	github.com/circlefin/noble-fiattokenfactory v0.0.0-20250123235012-5f9bd9dd2c5b
 	github.com/cometbft/cometbft v0.38.17
@@ -13,14 +14,14 @@ require (
 	github.com/cosmos/ibc-go/v8 v8.6.1
 	github.com/noble-assets/orbiter v0.0.0-00010101000000-000000000000
 	github.com/strangelove-ventures/interchaintest/v8 v8.8.0
-	github.com/stretchr/testify v1.10.0
+	github.com/stretchr/testify v1.11.1
 	go.uber.org/zap v1.27.0
 )
 
 require (
-	cel.dev/expr v0.23.0 // indirect
+	cel.dev/expr v0.24.0 // indirect
 	cloud.google.com/go v0.121.2 // indirect
-	cloud.google.com/go/auth v0.16.2 // indirect
+	cloud.google.com/go/auth v0.16.3 // indirect
 	cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
 	cloud.google.com/go/compute/metadata v0.7.0 // indirect
 	cloud.google.com/go/iam v1.5.2 // indirect
@@ -56,15 +57,14 @@ require (
 	github.com/StirlingMarketingGroup/go-namecase v1.0.0 // indirect
 	github.com/avast/retry-go/v4 v4.5.1 // indirect
 	github.com/aws/aws-sdk-go v1.44.224 // indirect
-	github.com/bcp-innovations/hyperlane-cosmos v1.0.1 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/bgentry/go-netrc v0.0.0-20140422174119-9fd32a8b3d3d // indirect
 	github.com/bgentry/speakeasy v0.1.1-0.20220910012023-760eaf8b6816 // indirect
 	github.com/bits-and-blooms/bitset v1.20.0 // indirect
 	github.com/cenkalti/backoff/v4 v4.1.3 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/chzyer/readline v1.5.1 // indirect
-	github.com/cncf/xds/go v0.0.0-20250326154945-ae57f3c0d45f // indirect
+	github.com/cncf/xds/go v0.0.0-20250501225837-2ac532fd4443 // indirect
 	github.com/cockroachdb/apd/v3 v3.2.1 // indirect
 	github.com/cockroachdb/errors v1.12.0 // indirect
 	github.com/cockroachdb/fifo v0.0.0-20240606204812-0bbfbd93a7ce // indirect
@@ -124,7 +124,7 @@ require (
 	github.com/godbus/dbus v0.0.0-20190726142602-4481cbc300e2 // indirect
 	github.com/gogo/googleapis v1.4.1 // indirect
 	github.com/gogo/protobuf v1.3.3 // indirect
-	github.com/golang/glog v1.2.4 // indirect
+	github.com/golang/glog v1.2.5 // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/golang/mock v1.7.0-rc.1 // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
@@ -137,7 +137,7 @@ require (
 	github.com/google/s2a-go v0.1.9 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/googleapis/enterprise-certificate-proxy v0.3.6 // indirect
-	github.com/googleapis/gax-go/v2 v2.14.2 // indirect
+	github.com/googleapis/gax-go/v2 v2.15.0 // indirect
 	github.com/gorilla/handlers v1.5.2 // indirect
 	github.com/gorilla/mux v1.8.1 // indirect
 	github.com/gorilla/websocket v1.5.3 // indirect
@@ -204,6 +204,7 @@ require (
 	github.com/oasisprotocol/curve25519-voi v0.0.0-20230904125328-1f23a7beb09a // indirect
 	github.com/oklog/run v1.1.0 // indirect
 	github.com/onsi/ginkgo/v2 v2.23.4 // indirect
+	github.com/onsi/gomega v1.38.0 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.1.0-rc2 // indirect
 	github.com/pelletier/go-toml v1.9.5 // indirect
@@ -231,8 +232,8 @@ require (
 	github.com/spaolacci/murmur3 v1.1.0 // indirect
 	github.com/spf13/afero v1.14.0 // indirect
 	github.com/spf13/cast v1.8.0 // indirect
-	github.com/spf13/cobra v1.9.1 // indirect
-	github.com/spf13/pflag v1.0.6 // indirect
+	github.com/spf13/cobra v1.10.1 // indirect
+	github.com/spf13/pflag v1.0.10 // indirect
 	github.com/spf13/viper v1.19.0 // indirect
 	github.com/spiffe/go-spiffe/v2 v2.5.0 // indirect
 	github.com/subosito/gotenv v1.6.0 // indirect
@@ -243,8 +244,8 @@ require (
 	github.com/tidwall/gjson v1.17.1 // indirect
 	github.com/tidwall/match v1.1.1 // indirect
 	github.com/tidwall/pretty v1.2.0 // indirect
-	github.com/tklauser/go-sysconf v0.3.12 // indirect
-	github.com/tklauser/numcpus v0.6.1 // indirect
+	github.com/tklauser/go-sysconf v0.3.15 // indirect
+	github.com/tklauser/numcpus v0.10.0 // indirect
 	github.com/tyler-smith/go-bip32 v1.0.0 // indirect
 	github.com/tyler-smith/go-bip39 v1.1.0 // indirect
 	github.com/ulikunitz/xz v0.5.11 // indirect
@@ -254,7 +255,7 @@ require (
 	go.etcd.io/bbolt v1.4.0-alpha.0.0.20240404170359-43604f3112c5 // indirect
 	go.opencensus.io v0.24.0 // indirect
 	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
-	go.opentelemetry.io/contrib/detectors/gcp v1.35.0 // indirect
+	go.opentelemetry.io/contrib/detectors/gcp v1.36.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect
 	go.opentelemetry.io/otel v1.36.0 // indirect
@@ -263,22 +264,22 @@ require (
 	go.opentelemetry.io/otel/sdk/metric v1.36.0 // indirect
 	go.opentelemetry.io/otel/trace v1.36.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
-	golang.org/x/crypto v0.39.0 // indirect
+	golang.org/x/crypto v0.42.0 // indirect
 	golang.org/x/exp v0.0.0-20240909161429-701f63a606c0 // indirect
-	golang.org/x/mod v0.26.0 // indirect
-	golang.org/x/net v0.41.0 // indirect
+	golang.org/x/mod v0.28.0 // indirect
+	golang.org/x/net v0.44.0 // indirect
 	golang.org/x/oauth2 v0.30.0 // indirect
-	golang.org/x/sync v0.15.0 // indirect
-	golang.org/x/sys v0.34.0 // indirect
-	golang.org/x/term v0.32.0 // indirect
-	golang.org/x/text v0.26.0 // indirect
+	golang.org/x/sync v0.17.0 // indirect
+	golang.org/x/sys v0.36.0 // indirect
+	golang.org/x/term v0.35.0 // indirect
+	golang.org/x/text v0.29.0 // indirect
 	golang.org/x/time v0.12.0 // indirect
-	golang.org/x/tools v0.34.0 // indirect
-	google.golang.org/api v0.237.0 // indirect
-	google.golang.org/genproto v0.0.0-20250505200425-f936aa4a68b2 // indirect
+	golang.org/x/tools v0.37.0 // indirect
+	google.golang.org/api v0.246.0 // indirect
+	google.golang.org/genproto v0.0.0-20250603155806-513f23925822 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20250603155806-513f23925822 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20250603155806-513f23925822 // indirect
-	google.golang.org/grpc v1.73.0 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250728155136-f173205681a0 // indirect
+	google.golang.org/grpc v1.74.2 // indirect
 	google.golang.org/protobuf v1.36.6 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/natefinch/npipe.v2 v2.0.0-20160621034901-c1b8fa8bdcce // indirect
@@ -299,10 +300,10 @@ require (
 )
 
 replace (
+	cosmossdk.io/collections => github.com/noble-assets/cosmos-sdk/collections v0.0.0-20250923134424-edd65694c2f7
 	github.com/ChainSafe/go-schnorrkel => github.com/ChainSafe/go-schnorrkel v0.0.0-20200405005733-88cbf1b4c40d
 	github.com/ChainSafe/go-schnorrkel/1 => github.com/ChainSafe/go-schnorrkel v1.0.0
 	github.com/gogo/protobuf => github.com/regen-network/protobuf v1.3.3-alpha.regen.1
+	github.com/noble-assets/orbiter => ../
 	github.com/vedhavyas/go-subkey => github.com/strangelove-ventures/go-subkey v1.0.7
 )
-
-replace github.com/noble-assets/orbiter => ../