Bump SDK pin to 3.4.11; refresh vendored daml-props DAR - #4
Closed
goozang-records wants to merge 1 commit into
Closed
Bump SDK pin to 3.4.11; refresh vendored daml-props DAR#4goozang-records wants to merge 1 commit into
goozang-records wants to merge 1 commit into
Conversation
simple-token and simple-token-test daml.yaml manifests move from 3.4.10 to 3.4.11. Forward-looking docs (README.md, docs/SCOPE.md, docs/PLAN.md current state and version-pinning section) updated to match. dars/daml-props-0.1.0.dar is rebuilt from daml-props at SDK 3.4.11. Historical records left at 3.4.10: - docs/AUDIT.md (audit results from the prior audit pass) - docs/PLAN.md "Step 1 ✅ COMPLETE" line (records the original creation) Verified 2026-05-18 on OpenJDK 21.0.11 / DPM SDK 3.4.11: - simple-token dpm build clean - simple-token-test dpm test 42/42 ok, 0 failures Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
All contributors have signed the CLA ✍️ ✅ |
Contributor
Author
|
I confirm that I have read and hereby agree to the OpenZeppelin Contributor License Agreement |
Contributor
Author
|
recheck |
goozang-records
added a commit
to goozang-records/canton-token-template
that referenced
this pull request
Jun 7, 2026
…elin#4) Hardening from the high-effort code review of the AL-10 account-freeze. #1 Mint-into-frozen via the cold path: Rules_Mint checked freeze at propose time, but the holding was created later in MintProposal_Accept with no re-check, so a recipient frozen in the propose→accept window still received fresh supply. Acceptance now goes THROUGH the factory — new `Rules_AcceptMintProposal` (recipient-controlled) re-checks `frozenAccounts` at holding-creation and consumes the proposal. The bare `MintProposal_Accept` choice is removed (a proposal-side choice cannot read the live factory state without a Supply→Rules import cycle). #3 V2 guards checked only the owner principal: `accountPrincipal` resolves to `account.owner`, so freezing a provider-managed account's acting PROVIDER did not block flows it authorized. V2 chokepoints (transfer/allocation/settlement) now check `accountParties` (owner AND provider) — freezing either blocks. This also factors the per-account party extraction through one helper. #2 V2 freeze path was untested (all freeze tests drove the V1 interface). Added: test_freezeBlocksV2BasicTransfer, test_freezeProviderBlocksProviderManaged- Transfer (freezes the provider, proves #3), test_mintProposalAcceptBlockedWhen- RecipientFrozen (proves #1). Suite 155 -> 158. OpenZeppelin#4 "Cannot send nor receive" was overstated: freeze is origination control (like pause, INV-33) — inbound flows committed before the freeze still complete; clawing those back is AL-11, not freeze. Reconciled INV-40 (AUDIT), the assertAccountsNotFrozen / eAccountFrozen comments, ADMIN-LAYER-PLAN §11.3, and AL-9 §3. daml-lint unchanged (7 pre-existing unbounded-fields, no new findings). PLAN.md roadmap row left unstaged (still contended with the parallel AL-8 doc edit). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
goozang-records
added a commit
to goozang-records/canton-token-template
that referenced
this pull request
Jun 7, 2026
Code-review follow-ups on the AL-11 seizure (none required design input; the three that do are documented as open design calls). #1 Separation of duties: two-person control only checked `approver /= proposer`, not that the BENEFICIARY differs from the officers — an approver could approve a seizure into their own account. Added `newOwner /= proposer` at propose and `newOwner /= approver && /= proposer` at approve (`eSeizureBeneficiaryIsOfficer`). OpenZeppelin#4 Dead code / phantom doc: `Admin_ProposeSeizure`'s comment promised an approval-time tamper check via `eSeizureHoldingMismatch` that never existed and never ran, and `seizedOwner` was written-never-read. Reworded the comment (cid immutability already forces a re-propose on a stale target) and relabelled `seizedOwner` as audit-only. #8 Dedup: `TransferPreapproval_ReceiveSeized` was byte-for-byte `MintInto`. Factor a shared `createViaPreapproval` body; the two remain distinct CHOICES (for the reconciler's mint-vs-reallocation distinction) but share one implementation. #2/#3 Docs: documented that `ReceiveSeized` is a root-callable create whose supply-neutrality is a caller property (the off-ledger D2 reconciler must net the seizure pair and must not treat a standalone ReceiveSeized as value-neutral), in ADMIN-LAYER-PLAN §11.4. #7/#10 Tests: added test_seizeBeneficiaryCannotBeOfficer, ...ForeignHoldingRejected (cross-registry), ...ForeignPreapprovalRejected (the preapproval.admin guard half), ...ScopedLegalAdmin (instrument-scoped cap, both directions); strengthened the stale-target test to assert no recovery holding was created. Suite 166 -> 170. OpenZeppelin#5/OpenZeppelin#6/#9 design calls recorded as TT-Q-011a/b/c (PLAN §17.7): locked-fund seizure, structural-vs-convention two-person control, court-order onboarding — with recommendations, for your decision (not blockers). daml-lint baseline-clean; 170/170 green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
simple-token/daml.yamlandsimple-token-test/daml.yamlbumped tosdk-version: 3.4.11.README.md(Prerequisites),docs/SCOPE.md(Mission),docs/PLAN.md(current state + version-pinning section).dars/daml-props-0.1.0.darrebuilt fromdaml-propsat SDK 3.4.11.Historical records intentionally left at 3.4.10
docs/AUDIT.md— audit results from the prior audit pass.docs/PLAN.md"Step 1 ✅ COMPLETE" — records the original creation at 3.4.10.Coordinating PR
The rebuilt
dars/daml-props-0.1.0.daris fromOpenZeppelin/daml-props#1. Merge this after that PR lands, or accept the DAR as-built for now.Verification
Built and tested locally on 2026-05-18 with OpenJDK 21.0.11 / DPM SDK 3.4.11:
simple-tokendpm build— cleansimple-token-testdpm test— 42/42 ok, 0 failuresTest plan
simple-token-testmatches what gets rebuilt fromdaml-propsat HEAD🤖 Generated with Claude Code