Ecosystem metrics

New Repos
18
down 28.0%
Commits
884
up 27.2%
Releases
11
up 175.0%
Contributors
59
up 22.9%
Merges
15
down 34.8%

Repository Explorer

10609 commits in all time May 14, 2026 20:32 – Aug 12, 2026 20:32 UTC
Test the untested half of C1: the recorded owner who no longer holds
C1 is a conjunction - inscribe requires that the sender (a) currently holds
the Cell ASA AND (b) is the controlling owner recorded at mint - but only (b)
had coverage.

test_flash_custody_rejected builds a holder who is not the owner. Every other
test mints with mint_cell(algorand, admin, admin), so the sender is always
both, and mint_cell's transfer branch is itself dead. The state in which
`assert exists and balance == UInt64(1)` is the DECIDING assert - recorded
owner, no longer holding - was never constructed.

It is not a hypothetical. update_owner is a separate, voluntary call, so a
seller who transfers the Cell ASA on a secondary market stays the recorded
controlling owner until someone calls it. Without (a) that seller can inscribe
the buyer's cell; C2 makes inscription write-once and update_owner is blocked
afterwards, so the buyer's cell is PERMANENTLY consumed with the seller's
artifact. That is the exact inverse of the flash-custody vector the suite does
cover.

The test also asserts WHICH conjunct fired. A bare pytest.raises(Exception) -
the pattern every other negative test here uses - would pass if the rejection
came from (b) or from anything unrelated, leaving (a) untested while looking
covered.

MUTATION PROOF, end to end rather than by inspection:
  - deleted the C1(a) assert from inscription.py
  - recompiled with the pinned puyapy 5.8.1 and regenerated the typed client
  - confirmed the string is gone from the TEAL and the client
  - ran the suite against a LocalNet deployment of the mutated contract

    1 failed, 22 passed
    test_recorded_owner_who_no_longer_holds_is_rejected: DID NOT RAISE

The 22 pre-existing tests stayed green, exactly as predicted, and the failure
mode is the vulnerability itself: the inscribe SUCCEEDED. Restored and
re-verified: 23 passed.

Reproducing this needs LocalNet, a built Falcon library, and the pinned
compile venv; see the PR for the build notes.

Found by an adversarial claim-vs-enforcement sweep (TCE-14).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Git Commit 3ac8d445 Branch test/c1-holding-conjunct-untested Document 1/45 ++ 0 --
Merge 3a21c29e74c5c3b342964d34ffc385a0f9739a5a into a06f0e8e671d1760d708fab4da7bfa240de2448c
Git Commit 7fa5f0a7 Branch pull/187/merge Document 1/1 ++ 0 --
PhearZero liquid-auth
Merge 4933a4a1081af83bb80512a44199ef683f5df8c8 into 5202ec1658b5d9d2171c375d30504b3bdce5534d
Git Commit 301d7204 Branch pull/67/merge Document 5/514 ++ 10 --
PhearZero liquid-auth
chore: harden existing links by checking for wallet claims
Git Commit 4933a4a1 Branch chore/harden-existing-links Document 5/514 ++ 10 --
Merge 873f1e60df1ffd49a3e820286ba1d88cb53499cc into d2de6fadecafa220eaa47dbd00ea1221fc6af26f
Git Commit b5391cfd Branch pull/167/merge Document 2/2,050 ++ 2,392 --
chore(deps-dev): bump semantic-release from 23.0.6 to 25.0.9
Bumps [semantic-release](https://github.com/semantic-release/semantic-release) from 23.0.6 to 25.0.9.
- [Release notes](https://github.com/semantic-release/semantic-release/releases)
- [Commits](https://github.com/semantic-release/semantic-release/compare/v23.0.6...v25.0.9)

---
updated-dependencies:
- dependency-name: semantic-release
  dependency-version: 25.0.9
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Git Commit 873f1e60 Branch dependabot/npm_and_yarn/semantic-release-25.0.9 Document 2/2,050 ++ 2,392 --
Merge 1346787e2f23c4b91a7f9c40835ea71060af689f into d2de6fadecafa220eaa47dbd00ea1221fc6af26f
Git Commit 72d11470 Branch pull/166/merge Document 2/215 ++ 72 --
chore(deps-dev): bump typedoc from 0.25.12 to 0.28.20
Bumps [typedoc](https://github.com/TypeStrong/TypeDoc) from 0.25.12 to 0.28.20.
- [Release notes](https://github.com/TypeStrong/TypeDoc/releases)
- [Changelog](https://github.com/TypeStrong/typedoc/blob/master/CHANGELOG.md)
- [Commits](https://github.com/TypeStrong/TypeDoc/compare/v0.25.12...v0.28.20)

---
updated-dependencies:
- dependency-name: typedoc
  dependency-version: 0.28.20
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Git Commit 1346787e Branch dependabot/npm_and_yarn/typedoc-0.28.20 Document 2/215 ++ 72 --
Merge 42d5a07fd74d365e8072a037e2a3f252f888096f into d2de6fadecafa220eaa47dbd00ea1221fc6af26f
Git Commit a1b6ce62 Branch pull/165/merge Document 83/12,017 ++ 11,515 --
Merge cd3fdb4916565631eea4c4a1d5f30f9be498719a into d2de6fadecafa220eaa47dbd00ea1221fc6af26f
Git Commit 874ae35d Branch pull/163/merge Document 142/19,683 ++ 13,051 --
Merge 92edec2d4fc471818f5b247bc135ad395b885b33 into d2de6fadecafa220eaa47dbd00ea1221fc6af26f
Git Commit 88a6a87a Branch pull/161/merge Document 142/19,685 ++ 13,052 --
Merge f131b95a4cea7f1657ab8c703caa09836cdae81c into d2de6fadecafa220eaa47dbd00ea1221fc6af26f
Git Commit aa899c33 Branch pull/162/merge Document 142/17,706 ++ 11,117 --
ipaleka frontend
Changed liquidity buttons' image text
Git Commit 2cb4527a Branch main Document 5/4 ++ 3 --
Merge 3ce7d70965caeae51bef5a9ec692437e32f74845 into f8a1376be4bde38b83eac7c40df89a3a7a0127fa
Git Commit 417c7028 Branch pull/91/merge Document 9/1,582 ++ 1,024 --
Merge 92420b294b832280110daa3eaef9ff0fcc4ecc6a into b0a3e71a91adfd1dfb97b5060d054618c2a147aa
Git Commit a81a01c1 Branch pull/66/merge Document 10/1,149 ++ 1,264 --
chore(deps): Update all non-major dependencies
Git Commit 92420b29 Branch renovate/all-non-major-dependencies Document 10/1,149 ++ 1,264 --
Argimirodelpozo puya
feat: "ussemble" layer changes to support multi-byte ops (`sub_code` field)
Git Commit a7442eea Branch main Document 2/14 ++ 10 --
Argimirodelpozo puya
test: add op tests for sha512, poseidon2, appBox family of ops, and `app_params_set` and new appParams fields
Git Commit bfc12de3 Branch main Document 60/9,674 ++ 1,003 --
Argimirodelpozo puya
chore: get augmented langspec from go-algorand
Git Commit bb0cadd5 Branch main Document 1/4,388 ++ 2,847 --
Argimirodelpozo puya
chore: changelog
Git Commit 1562a6f3 Branch main Document 1/47 ++ 0 --