Ecosystem metrics
- New Repos
- 4
- New
- Commits
- 1,000
- up 24.1%
- Releases
- 10
- up 0.0%
- Contributors
- 54
- up 1.9%
- Merges
- 22
- up 46.7%
Activity Overview
Commits and releases over time
- Commits
- Releases
- Authors
Repository Explorer
No repositories match that filter.
10773 commits in all time
May 17, 2026 20:52 – Aug 15, 2026 20:52 UTC
Deploying to gh-pages from @ scholtz/wallet@798e72f5f36ead5a572b396292230ab398ee29ea 🚀
0a706417
gh-pages
9/15 ++ 15 --
feat: Add health check endpoint for Kubernetes readiness and liveness probes
798e72f5
master
1/9 ++ 0 --
Merge af76dfd6ce71827f48cddc8bedd405633408b606 into c1e451f3864d614d28a54c6e5beacd19cdb71592
d0416ecb
pull/26/merge
5/216 ++ 9 --
Make the release gate build the library it exists to test
TCE-23's fix was incomplete, and this is my own gate. release.yml gained a `test` job so a tag could not produce a signed, SLSA-attested artifact without tests running. It runs `pytest tests` with a floor of 15 executed -- but with no `env:` block and no Falcon library build step. So on a release tag every lib-gated test SKIPS, and the floor is satisfied entirely by tests that touch no cryptography. Measured on this machine: tests executed (old floor of 15): 59 -> OLD gate PASSES, signs the release crypto tests skipped: 12 A gate that passes while the thing it exists to check did not run is the exact defect class this repo's register documents, and it was sitting in the fix for a previous instance of it. Now mirrors ci.yml's signature-kat job: fetch the pinned Falcon source (ce15e75, the commit go-algorand vendors), assert the pinned-build digest and the emulated FP backend, build the shared library, then run the suite with TRELYAN_REQUIRE_KAT=1 and grep the log for the skip marker. Keeps the 15-test floor AND adds the skip check, because they catch different things: the floor catches a suite that silently shrank, the grep catches a suite that ran without the crypto. The floor alone was satisfied by a run in which every Falcon test skipped, which is how this survived. A release must not be held to a weaker standard than a pull request. Verified both directions on a lib-less run: 59 executed clears the old floor, 12 skip markers trip the new guard.
af76dfd6
fix/verify-pubkey-length-oob
1/45 ++ 6 --
Reject a mis-sized pubkey in verify() — it was a reachable OOB read
HIGH. `falcon_det1024_verify_compressed` takes NO pubkey length parameter:
deterministic.c calls falcon_verify(..., pubkey, FALCON_DET1024_PUBKEY_SIZE,
...), so it reads exactly 1793 bytes from that pointer regardless of what the
caller allocated. `sig` and `message` are length-delimited and bounded; pubkey
alone was not.
FalconDet1024.verify() passed pubkey straight through as a bare c_char_p with
no check, so a shorter buffer read up to 1729 bytes past the end. Reachable
from the shipped public API -- trelyan_pq.verify is exported from __init__ --
so a verifier reading a pubkey from an arbitrary box or file could crash, or
compute a verdict partly from unrelated adjacent heap memory.
Proved with a guard page (two pages, only the first committed, payload flush
against the boundary):
full 1793-byte pubkey -> returns cleanly, reads exactly 1793
1792-byte pubkey -> ACCESS VIOLATION at the first byte past the buffer
64-byte pubkey -> ACCESS VIOLATION
The one-byte-short case is the one that matters: it is the realistic
truncation. Reaching it needs no valid signature -- junk bytes with the right
two header values get there.
The asymmetry is what marks it an oversight rather than a decision: sign() has
always checked len(privkey) != PRIVKEY_SIZE. verify() checked nothing.
WHY NOTHING CAUGHT IT, which is the part worth keeping:
* tests/fuzz/fuzz_falcon_verify.cc (C/ASan, 13.8M execs) DOCUMENTS this exact
invariant and honours it -- it always hands the function a fixed 1793-byte
buffer, and its comment calls a smaller one "a caller-side over-read -- a
harness bug, not a finding". Correct, and it means that harness could never
surface this by construction.
* tests/fuzz/fuzz_encoding_atheris.py DID feed short pubkeys and asserted
verify() "must return False, not raise" -- an assertion the code could not
satisfy, because it crashed instead. That file is referenced by no
workflow, so it has never run.
* No test varied pubkey length; the KAT and fuzz suites vary the signature
only, always with a full-size key.
The invariant was written down in one file, violated in another, and the
harness that would have caught it was never wired up.
Fixed in BOTH copies. contracts/falcon_det1024.py is the one deploy_testnet.py
signs real TestNet inscriptions with, and fixing only the SDK is exactly how
TCE-03's cwd hijack survived its first fix.
Raises rather than returning False, matching sign(): a mis-sized key is a
caller error, not a failed verification, and returning False would let a
truncated key read as "signature invalid". The Atheris harness's contract is
corrected to expect that, with the reason recorded inline.
9 regression tests, none needing the C library so they run everywhere.
Mutation-proved: removing either guard fails all 9. SDK suite 50 -> 59 passed,
19 skipped.
Security impact: closes a memory-safety defect reachable from the public API of
an audit-bound crypto SDK. No protocol, wire-format or on-chain change; the
contract's own ABI already pins committed_pubkey to 1793 bytes, so on-chain
state was never the exposure -- the off-chain verifier path was.
906715ca
fix/verify-pubkey-length-oob
4/171 ++ 3 --
Merge 97a5d16c1dde54714d5b6330bcb06dd8b9964164 into 8d7f8f778c8668bb5162fad3179bbb4cbb1082bb
7f8d48b3
pull/6707/merge
14/1,363 ++ 37 --
Merge 5fedc0fbbdc30073db774f16a5cca46dc735c1ca into 4bb8bde04aa890c23cdd067bd167c1f0375a632d
76f647a6
pull/318/merge
26/3,114 ++ 1,214 --
Merge afc947b1ecb97bada388e509c232dbcb5f4beeea into 75c72bf720cdf08705f25d121fcce3e3150f72e6
19b5e0d7
pull/1025/merge
1/13 ++ 3 --
perf(ui): load validator and pool state in bulk, persist the query cache
The dashboard opened with roughly 900 algod requests: four simulate calls per
validator (config/state/pools/nodePoolAssignments), one global state read per
pool, then enrichment lookups on top. All four validator reads come out of the
same `v` + validatorId box, and every pool is created by the registry's app
account, so both collapse into a single request each.
Bulk reads:
- `fetchAppBoxes` reads box names and values together using algosdk 3.6's
`include('values')` with cursor pagination, pinning every page after the
first to the round the first returned so a multi-page read is one snapshot.
It throws if a node returns names without values rather than rendering an
app's state as empty.
- `fetchAllValidatorData` decodes those boxes through the generated ARC-56
struct and seeds the per-validator query caches inside the queryFn, so
components and route loaders reading the individual keys resolve from cache.
The validator detail route seeds the same four keys from one box read when
arriving cold.
- `fetchPoolGlobalStates` reads every pool's `lastPayout`/`algodVer` from one
`accountInformation` call on the registry address, and warns when algod
truncates the created-app list. `processPoolData` takes that state as an
argument, falling back to a per-pool read only for what the bulk read missed.
- xGov request boxes move off the typed client's `requestBox.getMap()`, which
issued a request per box across the whole registry.
- `validatorMetricsQueryOptions` takes its per-validator inputs explicitly
instead of re-deriving them through `ensureQueryData`, which would refetch
once those entries are garbage collected. The per-row Rewards and Status
queries observe rather than fetch, keeping metrics traffic inside the
metered queue.
Caching and pacing:
- `queryPersister` persists an allowlist of query key roots to IndexedDB,
chosen over localStorage because protocol data is full of bigints and
structured clone handles them natively. Busted on `__APP_VERSION__`.
main.tsx hydrates before the router runs, so the table paints from disk and
refreshes underneath; index.html holds a static spinner and applies the
stored theme before first paint.
- `useQueuedQueries` meters only work that will actually hit the network,
returns results positionally aligned with its input, and learns a per-host
batch size by AIMD (`utils/rateLimit`) - additive increase on clean ticks,
halving on 429/503, persisted so the next load starts near a known-good rate.
- `axiosNfdApi` gains a localStorage-backed HTTP cache and exponential backoff.
The retry has to register after `setupCache`: registered first it swallows
the rejection before the cache settles the entry it opened, and the retry
then blocks forever on that entry. Covered by a test.
algosdk 3.6 types `asset.params` as optional, hence the `?.` on every params
access. axios and axios-cache-interceptor are bumped alongside.
Specs added for the box reads, pool global state decoding, the batching queue,
the persister, the rate limit controller, and the NFD interceptor ordering.
d3865871
perf/ui-bulk-data-loading
52/2,764 ++ 469 --
chore: add repo agent instructions and ignore bare .env / .idea
AGENTS.md documents the three deliverables, the localnet-dependent dev loop, the per-package commands CI enforces, and which paths are generated build output. CLAUDE.md points at it. .gitignore only had `.env.*`, which doesn't match a bare `.env` - and bootstrap writes mnemonics into nodemgr env files.
6ff8dda9
perf/ui-bulk-data-loading
3/120 ++ 0 --