Ecosystem metrics
- New Repos
- 3
- down 88.0%
- Commits
- 872
- up 18.2%
- Releases
- 11
- up 120.0%
- Contributors
- 59
- up 22.9%
- Merges
- 12
- down 55.6%
Activity Overview
Commits and releases over time
- Commits
- Releases
- Authors
Repository Explorer
No repositories match that filter.
10605 commits in all time
May 14, 2026 14:16 – Aug 12, 2026 14:16 UTC
Merge 6ae14362bf21d6cd8cfd32579e4f7157e7f7838c into 2bb186e0a27bcf0b321e530f202ed6b7ecc5d1f0
2f415d9f
pull/15/merge
2/143 ++ 1 --
Close the cwd library-hijack in the loader that actually signs
There are two ctypes loaders for the same Falcon signing core:
sdk/src/trelyan_pq/falcon.py used by the SDK
contracts/falcon_det1024.py used by deploy_testnet.py and
test_inscription.py
Commit eb67e4a (2026-08-10, "close two local library/module load-path
hijack vectors", pre-audit findings TF-01/TF-02) removed the cwd-relative
default. `git show --stat eb67e4a` confirms it touched only two files, both
under sdk/. contracts/falcon_det1024.py has not been modified since the
initial commit a806f63 and still read:
_LIB_PATH = os.environ.get("FALCON_DET1024_LIB", "./libfalcondet1024.so")
A dlopen path containing a slash resolves against the process working
directory, so that default loads keygen, sign and verify out of whatever
./libfalcondet1024.so happens to be in cwd (CWE-426).
The unfixed copy is the one on the documented deployment path: README.md
tells the operator to run `python contracts/deploy_testnet.py` from the repo
root, and that script imports this module and calls keygen(),
sign_compressed() and verify_compressed() to mint a real inscription. So an
explicit pre-audit security fix was applied everywhere except the path that
signs. Two aggravating details: .gitignore excludes *.so/*.dylib/*.dll, so a
planted library never appears in `git status`; and until yesterday the CI
path filter excluded contracts/ entirely, so nothing here was ever executed.
Fix: default to "" and fail closed with the same message the SDK uses.
sdk/tests/test_loader_parity.py plants a decoy libfalcondet1024.{so,dylib,dll}
in a temp directory, runs each loader from there in a subprocess with
FALCON_DET1024_LIB unset, and requires refusal BEFORE the decoy is touched -
asserting the error names the missing variable and does NOT name the decoy.
Checking the constant alone would only prove a literal changed. A second test
guards the constant too, so a re-introduced relative default is obvious in
review.
Note the SDK case needs m.keygen(), not m.default_signer(): the loader is
lazy, so constructing the signer loads nothing and the test would pass
vacuously. Verified by mutation - restoring the old default turns both the
behavioural and the source test red; the fix turns them green.
The test lives in sdk/tests/ because that is what CI runs; contracts/ has no
test job, and a parity test parked where nothing executes it is the same
defect it exists to prevent.
Found by an adversarial claim-vs-enforcement sweep (TCE-03).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
6ae14362
fix/contracts-loader-cwd-hijack
2/143 ++ 1 --
Merge e16c50c2888a6e481ab000458033956951cc18b1 into 75c72bf720cdf08705f25d121fcce3e3150f72e6
ed85b23c
pull/1115/merge
16/916 ++ 32 --
Merge 7c3ec16cd7f80798554a98e90606463cba694a48 into 3373832646a00d4285576642c42c4776cbf71f24
85ee4257
pull/640/merge
1/20 ++ 0 --
docs: add simulate fee estimation section
7c3ec16c
docs/simulate-usage-fees
1/20 ++ 0 --
Merge f8eee9bba75c22d10918be9c0c36d7e64c6856cf into 75c72bf720cdf08705f25d121fcce3e3150f72e6
efaa9247
pull/1115/merge
16/916 ++ 32 --
feat: challenge discout, empty refs, and new deltas
f8eee9bb
feat/v42
6/133 ++ 0 --
Merge branch 'generate/68e0f84a' into feat/v42
873d2e78
feat/v42
1/169 ++ 0 --
Merge remote-tracking branch 'origin/main' into feat/v42
# Conflicts: # examples/falcon.ts # src/falcon-signer.ts # src/logicsig.ts # src/pq-signer.ts # src/signer.ts # src/signing.ts # tests/12.PQ.ts # tests/cucumber/steps/steps.js
686e9f29
feat/v42
26/726 ++ 259 --
Merge 5196f9ee568136a55964876c38c434af2f1d83a7 into c16958b8238c18f3d0762c3772e296e9b7976a02
b172fcb7
pull/30/merge
40/3,356 ++ 98 --
docs(migrations): document adoption in application extensions and baselining
5196f9ee
pull/30/head
2/158 ++ 2 --
Merge 1d0195b41a72d3a9e9b90cabd0f2b422f489b8b6 into 3373832646a00d4285576642c42c4776cbf71f24
b3ea7b78
pull/639/merge
5/186 ++ 14 --
docs: updated Sharing Boxes Between Applications links
1d0195b4
feat/box-family-read-write
1/1 ++ 1 --
docs: clarify family box re-entrancy wording in avm.md
36dd1bd3
feat/box-family-read-write
1/12 ++ 8 --
Merge 5800ed6947941f49d69a419081d24af29d8450f7 into f8a1376be4bde38b83eac7c40df89a3a7a0127fa
909aed23
pull/90/merge
2/270 ++ 155 --
Merge 164d06c71e8401891894a4a02f2059aac3e7930a into f8a1376be4bde38b83eac7c40df89a3a7a0127fa
aae88c48
pull/80/merge
2/408 ++ 459 --
Merge 7d30f921287e64aa52a0e8cceb07eb75ec89d258 into c16958b8238c18f3d0762c3772e296e9b7976a02
cec0076e
pull/30/merge
40/3,200 ++ 98 --
Added high level concept for 'Family box writing' & 'Foreign box reading'
2dfe44d7
feat/box-family-read-write
1/31 ++ 21 --
fix: address final review findings
7d30f921
pull/30/head
9/287 ++ 19 --
feat(react-native-keystore): track legacy passkey flagging as migration 0001
BREAKING CHANGE: legacy passkey flagging no longer runs automatically on engine start. It is now revision 0001 of the package's migration manifest and requires WithMigrations from @algorandfoundation/provider-migrations to be installed on the provider. Applications that do not add it will never flag legacy passkeys.
7ab0e90f
pull/30/head
12/247 ++ 47 --
feat(example): wire the migrations engine into the react-native wallet
ad0a2f43
pull/30/head
7/142 ++ 38 --
feat(react-native-keystore): gate engine hydration behind an optional `before` promise
af602290
pull/30/head
2/88 ++ 10 --