Skip to content

Commit 4e53b8b

Browse files
zengzengzenghuyzengzengzenghuy
authored
feat(bridges): add governor decision (#844)
* fix: pinning webpack to ~5.98.0 resolved the ProgressPlugin incompatibility * chore: use yarn * chore: add yarn.lock * chore: update .nvmrc to satisfy security audit workflow * fix: security audit failure * feat(bridges): add governors decision for freezing major tokens * fix(ci): resolve high-severity audit vulns and gate audit on high/critical only
1 parent 3815f15 commit 4e53b8b

4 files changed

Lines changed: 150 additions & 14 deletions

File tree

‎.github/workflows/security-audit.yml‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,4 +29,14 @@ jobs:
2929
run: yarn install --frozen-lockfile
3030

3131
- name: Run security audit
32-
run: yarn audit --level high
32+
# `yarn audit` (Yarn Classic) returns a severity bitmask as its exit code:
33+
# 1=info, 2=low, 4=moderate, 8=high, 16=critical. The `--level` flag only
34+
# filters the printed table, NOT the exit code, so the step would otherwise
35+
# fail on any low/moderate finding. Gate the pass/fail on the high+critical bits only.
36+
run: |
37+
yarn audit --level high || EXIT=$?
38+
if [ $(( ${EXIT:-0} & 8 )) -ne 0 ] || [ $(( ${EXIT:-0} & 16 )) -ne 0 ]; then
39+
echo "::error::High or critical severity vulnerabilities found in dependencies"
40+
exit 1
41+
fi
42+
echo "No high or critical severity vulnerabilities found"

‎docs/bridges/management/decisions.md‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,36 @@ keywords: [governance board, bridge governance]
88

99
The [Bridge Governance Board](./#current-bridge-governors) is responsible for enacting updates related to bridge functionality, contract upgrades, and other parameters impacting bridge operations. The following items have been implemented by the board.
1010

11+
## Freeze outflow of major tokens on canonical bridges
12+
🗳 Justification:
13+
1. Due to the [hack](https://x.com/gnosispay/status/2061372038628196356?s=20) related to Gnosis Pay's Delay Module, we decided to halt the outflow ot major tokens on Omnibridge & xDAI bridge from Gnosis Chain to Ethereum as precautionary measure.
14+
|Token | Address on Gnosis Chain |
15+
|------------|---------------------------------------------|
16+
| GNO | 0x9C58BAcC331c9aa871AFD802DB6379a98e80CEdb |
17+
| wstETH | 0x6C76971f98945AE98dD7d4DFcA8711ebea946eA6 |
18+
| USDC | 0xDDAfbb505ad214D7b80b1f830fcCc89B60fb7A83 |
19+
| WETH | 0x6A023CCd1ff6F2045C3309768eAd9E68F978f6e1 |
20+
| TRACE | 0xEddd81E0792E764501AaE206EB432399a0268DB5 |
21+
| COW | 0x177127622c4A00F3d409B75571e12cB3c8973d3c |
22+
| WBTC | 0x8e5bBbb09Ed1ebdE8674Cda39A0c169401db425 |
23+
| HOPR | 0xD057604A14982FE8D88c5fC25Aac3267eA142a08 |
24+
| USDT | 0x4ECaBa5870353805a9F068101A40E0f32ed605C6 |
25+
| BDT | 0x778aa03021B0CD2b798b0b506403e070125D81C9 |
26+
| OLAS | 0xcE11e14225575945b8E6Dc0D4F2dD4C570f79d9f |
27+
| SAFE | 0x4d18815D14fe5c3304e87B3FA18318baa5c23820 |
28+
| ROCKETPOOL | 0xc791240D1F2dEf5938E2031364Ff4ed887133C3d |
29+
| GIVETH | 0x4f4F9b8D5B4d0Dc10506e5551B0513B61fD59e75 |
30+
| PNK | 0x37b60f4E9A31A64cCc0024dce7D0fD07eAA0F7B3 |
31+
| CLNY | 0xc9B6218AffE8Aba68a13899Cbf7cF7f14DDd304C |
32+
| EURC | 0x54E4cB2a4Fa0ee46E3d9A98D13Bea119666E09f6 |
33+
| LINK | 0xE2e73A1c69ecF83F464EFCE6A5be353a37cA09b2 |
34+
| BAL | 0x7eF541E2a22058048904fE5744f9c7E4C57AF717 |
35+
| xDAI | Native token on Gnosis Chain |
36+
37+
Tx on Gnosis Chain: [url](https://gnosisscan.io/tx/0xc2d0f232b065c65416acea2201019546f72352c28d9dfb45877d7a2ecef394d2/)
38+
39+
✅ Implemented: Jun 01, 2026.
40+
1141
## Replace CoW brodge validator address
1242

1343
🗳 Justification:

‎package.json‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,9 @@
4040
},
4141
"resolutions": {
4242
"webpack": "~5.98.0",
43-
"serialize-javascript": ">=7.0.3"
43+
"serialize-javascript": ">=7.0.3",
44+
"@babel/plugin-transform-modules-systemjs": ">=7.29.4",
45+
"fast-uri": ">=3.1.1"
4446
},
4547
"browserslist": {
4648
"production": [

‎yarn.lock‎

Lines changed: 106 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -162,6 +162,15 @@
162162
js-tokens "^4.0.0"
163163
picocolors "^1.1.1"
164164

165+
"@babel/code-frame@^7.29.7":
166+
version "7.29.7"
167+
resolved "https://registry.yarnpkg.com/@babel/code-frame/-/code-frame-7.29.7.tgz#f2fbbfea87c44a21590ec515b778b2c26d8866e7"
168+
integrity sha512-Aup7aUOfpbAUg2ROOJN6Iw5f9DMBlzu0mIkm/malLQFN/YQgO48wCj0Kxa3sEHJvPVFg7siR+qRInwXd2qhQKw==
169+
dependencies:
170+
"@babel/helper-validator-identifier" "^7.29.7"
171+
js-tokens "^4.0.0"
172+
picocolors "^1.1.1"
173+
165174
"@babel/compat-data@^7.28.6", "@babel/compat-data@^7.29.0":
166175
version "7.29.0"
167176
resolved "https://registry.yarnpkg.com/@babel/compat-data/-/compat-data-7.29.0.tgz#00d03e8c0ac24dd9be942c5370990cbe1f17d88d"
@@ -199,6 +208,17 @@
199208
"@jridgewell/trace-mapping" "^0.3.28"
200209
jsesc "^3.0.2"
201210

211+
"@babel/generator@^7.29.7":
212+
version "7.29.7"
213+
resolved "https://registry.yarnpkg.com/@babel/generator/-/generator-7.29.7.tgz#cca0b8827e6bcf3ba176788e7f3b180ad6db2fa3"
214+
integrity sha512-DkXD5OJQaAQIdZ1bt3UZdEnHAn9Imd3IVBdX03UFe+ony9Ojw5pzr9YVKGDY1jt+Gcn/FnGkNf8r+Vj5NOJWtQ==
215+
dependencies:
216+
"@babel/parser" "^7.29.7"
217+
"@babel/types" "^7.29.7"
218+
"@jridgewell/gen-mapping" "^0.3.12"
219+
"@jridgewell/trace-mapping" "^0.3.28"
220+
jsesc "^3.0.2"
221+
202222
"@babel/helper-annotate-as-pure@^7.27.1", "@babel/helper-annotate-as-pure@^7.27.3":
203223
version "7.27.3"
204224
resolved "https://registry.yarnpkg.com/@babel/helper-annotate-as-pure/-/helper-annotate-as-pure-7.27.3.tgz#f31fd86b915fc4daf1f3ac6976c59be7084ed9c5"
@@ -255,6 +275,11 @@
255275
resolved "https://registry.yarnpkg.com/@babel/helper-globals/-/helper-globals-7.28.0.tgz#b9430df2aa4e17bc28665eadeae8aa1d985e6674"
256276
integrity sha512-+W6cISkXFa1jXsDEdYA8HeevQT/FULhxzR99pxphltZcVaugps53THCeiWA8SguxxpSp3gKPiuYfSWopkLQ4hw==
257277

278+
"@babel/helper-globals@^7.29.7":
279+
version "7.29.7"
280+
resolved "https://registry.yarnpkg.com/@babel/helper-globals/-/helper-globals-7.29.7.tgz#f04a96fbd8473241b1079243f5b3f03a3010ab7b"
281+
integrity sha512-3nQVUAtvkKH9zahfWgw96Jc/uFOmjACE1kQz82E2lqWmHBgjzbNlsC22nuQTfahmWeQtTq5nQ/4Nnd2A1wj4zA==
282+
258283
"@babel/helper-member-expression-to-functions@^7.28.5":
259284
version "7.28.5"
260285
resolved "https://registry.yarnpkg.com/@babel/helper-member-expression-to-functions/-/helper-member-expression-to-functions-7.28.5.tgz#f3e07a10be37ed7a63461c63e6929575945a6150"
@@ -271,6 +296,14 @@
271296
"@babel/traverse" "^7.28.6"
272297
"@babel/types" "^7.28.6"
273298

299+
"@babel/helper-module-imports@^7.29.7":
300+
version "7.29.7"
301+
resolved "https://registry.yarnpkg.com/@babel/helper-module-imports/-/helper-module-imports-7.29.7.tgz#ef25048a518e828d7393fac5882ddd73921d7396"
302+
integrity sha512-ejHwrQQYcm9xnTivShn2IDOlIzInN34AXskvq9QicvCtEzq1Vzclu/tKF8Jq1Cg8JG2GL6/EmjgsCT7lXepE3g==
303+
dependencies:
304+
"@babel/traverse" "^7.29.7"
305+
"@babel/types" "^7.29.7"
306+
274307
"@babel/helper-module-transforms@^7.27.1", "@babel/helper-module-transforms@^7.28.6":
275308
version "7.28.6"
276309
resolved "https://registry.yarnpkg.com/@babel/helper-module-transforms/-/helper-module-transforms-7.28.6.tgz#9312d9d9e56edc35aeb6e95c25d4106b50b9eb1e"
@@ -280,6 +313,15 @@
280313
"@babel/helper-validator-identifier" "^7.28.5"
281314
"@babel/traverse" "^7.28.6"
282315

316+
"@babel/helper-module-transforms@^7.29.7":
317+
version "7.29.7"
318+
resolved "https://registry.yarnpkg.com/@babel/helper-module-transforms/-/helper-module-transforms-7.29.7.tgz#b062747a5997ba138637201328bbff77960574ae"
319+
integrity sha512-UPUVSyXbOh627KiCIGQSgwWzGeBKLkaJ9PJEdrngIwMSzxLR4jS4+f1f1jb7VzBbg8nFLaYotvVPFCTqdrmTAg==
320+
dependencies:
321+
"@babel/helper-module-imports" "^7.29.7"
322+
"@babel/helper-validator-identifier" "^7.29.7"
323+
"@babel/traverse" "^7.29.7"
324+
283325
"@babel/helper-optimise-call-expression@^7.27.1":
284326
version "7.27.1"
285327
resolved "https://registry.yarnpkg.com/@babel/helper-optimise-call-expression/-/helper-optimise-call-expression-7.27.1.tgz#c65221b61a643f3e62705e5dd2b5f115e35f9200"
@@ -292,6 +334,11 @@
292334
resolved "https://registry.yarnpkg.com/@babel/helper-plugin-utils/-/helper-plugin-utils-7.28.6.tgz#6f13ea251b68c8532e985fd532f28741a8af9ac8"
293335
integrity sha512-S9gzZ/bz83GRysI7gAD4wPT/AI3uCnY+9xn+Mx/KPs2JwHJIz1W8PZkg2cqyt3RNOBM8ejcXhV6y8Og7ly/Dug==
294336

337+
"@babel/helper-plugin-utils@^7.29.7":
338+
version "7.29.7"
339+
resolved "https://registry.yarnpkg.com/@babel/helper-plugin-utils/-/helper-plugin-utils-7.29.7.tgz#c0a0766f1a13617d8a17407d7ab8f9d486225ea4"
340+
integrity sha512-G7sHYigPY17oO5SYWnfD/0MTBwVR781S/JI643e/JhUYgVgWE/61SoW3NH9KWUKyKq5LVh3npif99Wkt6j86Jw==
341+
295342
"@babel/helper-remap-async-to-generator@^7.27.1":
296343
version "7.27.1"
297344
resolved "https://registry.yarnpkg.com/@babel/helper-remap-async-to-generator/-/helper-remap-async-to-generator-7.27.1.tgz#4601d5c7ce2eb2aea58328d43725523fcd362ce6"
@@ -323,11 +370,21 @@
323370
resolved "https://registry.yarnpkg.com/@babel/helper-string-parser/-/helper-string-parser-7.27.1.tgz#54da796097ab19ce67ed9f88b47bb2ec49367687"
324371
integrity sha512-qMlSxKbpRlAridDExk92nSobyDdpPijUq2DW6oDnUqd0iOGxmQjyqhMIihI9+zv4LPyZdRje2cavWPbCbWm3eA==
325372

373+
"@babel/helper-string-parser@^7.29.7":
374+
version "7.29.7"
375+
resolved "https://registry.yarnpkg.com/@babel/helper-string-parser/-/helper-string-parser-7.29.7.tgz#7f0871d99824d23137d60f86fcf6130fd5a1b51f"
376+
integrity sha512-Pb5ijPrZ89GDH8223L4UP8i6QApWxs04RbPQJTeWDV0/keR2E36MeKnyr6LYmUUvqRRI+Iv87SuF1W6ErINzYw==
377+
326378
"@babel/helper-validator-identifier@^7.28.5":
327379
version "7.28.5"
328380
resolved "https://registry.yarnpkg.com/@babel/helper-validator-identifier/-/helper-validator-identifier-7.28.5.tgz#010b6938fab7cb7df74aa2bbc06aa503b8fe5fb4"
329381
integrity sha512-qSs4ifwzKJSV39ucNjsvc6WVHs6b7S03sOh2OcHF9UHfVPqWWALUsNUVzhSBiItjRZoLHx7nIarVjqKVusUZ1Q==
330382

383+
"@babel/helper-validator-identifier@^7.29.7":
384+
version "7.29.7"
385+
resolved "https://registry.yarnpkg.com/@babel/helper-validator-identifier/-/helper-validator-identifier-7.29.7.tgz#bd87084ced0c796ec46bda492de6e83d29e89fc2"
386+
integrity sha512-qehxGkRj55h/ff8EMaJ+cYhyaKlHIxqYDn682wQD7RNp9UujOQsHog2uS0r2vzr4pW+sXf90NeeayjcNaX3fFg==
387+
331388
"@babel/helper-validator-option@^7.22.15", "@babel/helper-validator-option@^7.27.1":
332389
version "7.27.1"
333390
resolved "https://registry.yarnpkg.com/@babel/helper-validator-option/-/helper-validator-option-7.27.1.tgz#fa52f5b1e7db1ab049445b421c4471303897702f"
@@ -357,6 +414,13 @@
357414
dependencies:
358415
"@babel/types" "^7.29.0"
359416

417+
"@babel/parser@^7.29.7":
418+
version "7.29.7"
419+
resolved "https://registry.yarnpkg.com/@babel/parser/-/parser-7.29.7.tgz#837b87387cbf5ec5530cb634b3c622f68edb9334"
420+
integrity sha512-hnORnjP/1P/zFEndoeX+n+t1RwWRJiJpM/jO7FW32Kn9r5+sJB2JWOdYo4L6k78j15eCwY3Gm/7364B1EMwtNg==
421+
dependencies:
422+
"@babel/types" "^7.29.7"
423+
360424
"@babel/plugin-bugfix-firefox-class-in-computed-class-key@^7.28.5":
361425
version "7.28.5"
362426
resolved "https://registry.yarnpkg.com/@babel/plugin-bugfix-firefox-class-in-computed-class-key/-/plugin-bugfix-firefox-class-in-computed-class-key-7.28.5.tgz#fbde57974707bbfa0376d34d425ff4fa6c732421"
@@ -640,15 +704,15 @@
640704
"@babel/helper-module-transforms" "^7.28.6"
641705
"@babel/helper-plugin-utils" "^7.28.6"
642706

643-
"@babel/plugin-transform-modules-systemjs@^7.29.0":
644-
version "7.29.0"
645-
resolved "https://registry.yarnpkg.com/@babel/plugin-transform-modules-systemjs/-/plugin-transform-modules-systemjs-7.29.0.tgz#e458a95a17807c415924106a3ff188a3b8dee964"
646-
integrity sha512-PrujnVFbOdUpw4UHiVwKvKRLMMic8+eC0CuNlxjsyZUiBjhFdPsewdXCkveh2KqBA9/waD0W1b4hXSOBQJezpQ==
707+
"@babel/plugin-transform-modules-systemjs@>=7.29.4", "@babel/plugin-transform-modules-systemjs@^7.29.0":
708+
version "7.29.7"
709+
resolved "https://registry.yarnpkg.com/@babel/plugin-transform-modules-systemjs/-/plugin-transform-modules-systemjs-7.29.7.tgz#e575dd2ab9882906de120ff7dc9dee9914d8b6f3"
710+
integrity sha512-TM2ZcQLoG2/y4HODiStCo10DibYhWhGWAwVv+EQKmG/7GFl0N+AAmUiXOMKM+aiJ9XBJ9AHVZBvTzMnJ2sM3cQ==
647711
dependencies:
648-
"@babel/helper-module-transforms" "^7.28.6"
649-
"@babel/helper-plugin-utils" "^7.28.6"
650-
"@babel/helper-validator-identifier" "^7.28.5"
651-
"@babel/traverse" "^7.29.0"
712+
"@babel/helper-module-transforms" "^7.29.7"
713+
"@babel/helper-plugin-utils" "^7.29.7"
714+
"@babel/helper-validator-identifier" "^7.29.7"
715+
"@babel/traverse" "^7.29.7"
652716

653717
"@babel/plugin-transform-modules-umd@^7.27.1":
654718
version "7.27.1"
@@ -1045,6 +1109,15 @@
10451109
"@babel/parser" "^7.28.6"
10461110
"@babel/types" "^7.28.6"
10471111

1112+
"@babel/template@^7.29.7":
1113+
version "7.29.7"
1114+
resolved "https://registry.yarnpkg.com/@babel/template/-/template-7.29.7.tgz#4d9d4004f645cdd304de958c725162784ecac700"
1115+
integrity sha512-puq+Gf35oI24FeN11LkoUQFqv9uwNeWpxXZi/Ji3rRIoKAzKnxRaZ+Gkj0vKS9ZCiTESfng1N9LyOyXvo+m+Gg==
1116+
dependencies:
1117+
"@babel/code-frame" "^7.29.7"
1118+
"@babel/parser" "^7.29.7"
1119+
"@babel/types" "^7.29.7"
1120+
10481121
"@babel/traverse@^7.25.9", "@babel/traverse@^7.27.1", "@babel/traverse@^7.28.5", "@babel/traverse@^7.28.6", "@babel/traverse@^7.29.0":
10491122
version "7.29.0"
10501123
resolved "https://registry.yarnpkg.com/@babel/traverse/-/traverse-7.29.0.tgz#f323d05001440253eead3c9c858adbe00b90310a"
@@ -1058,6 +1131,19 @@
10581131
"@babel/types" "^7.29.0"
10591132
debug "^4.3.1"
10601133

1134+
"@babel/traverse@^7.29.7":
1135+
version "7.29.7"
1136+
resolved "https://registry.yarnpkg.com/@babel/traverse/-/traverse-7.29.7.tgz#c47b07a41b95da0907d026b5dd894d98de7d2f2d"
1137+
integrity sha512-EhlfNQtZ+NK22w5BM61ciuiq1m58ed33Wr1Xan//ZRTy6hgjnwyCffRYwzsGXdASJSUJ1guZILsErh1eQcl+zw==
1138+
dependencies:
1139+
"@babel/code-frame" "^7.29.7"
1140+
"@babel/generator" "^7.29.7"
1141+
"@babel/helper-globals" "^7.29.7"
1142+
"@babel/parser" "^7.29.7"
1143+
"@babel/template" "^7.29.7"
1144+
"@babel/types" "^7.29.7"
1145+
debug "^4.3.1"
1146+
10611147
"@babel/types@^7.21.3", "@babel/types@^7.27.1", "@babel/types@^7.27.3", "@babel/types@^7.28.5", "@babel/types@^7.28.6", "@babel/types@^7.29.0", "@babel/types@^7.4.4":
10621148
version "7.29.0"
10631149
resolved "https://registry.yarnpkg.com/@babel/types/-/types-7.29.0.tgz#9f5b1e838c446e72cf3cd4b918152b8c605e37c7"
@@ -1066,6 +1152,14 @@
10661152
"@babel/helper-string-parser" "^7.27.1"
10671153
"@babel/helper-validator-identifier" "^7.28.5"
10681154

1155+
"@babel/types@^7.29.7":
1156+
version "7.29.7"
1157+
resolved "https://registry.yarnpkg.com/@babel/types/-/types-7.29.7.tgz#8005e31d82712ee7adaef6e23c63b71a62770a92"
1158+
integrity sha512-4zBIxpPzowiZpusoFkyGVwakdRJUyuH5PxQ/PrqghfdFWWasvnCdPfQXHrenDai+gyLARulZjZowCOj6fjT4pA==
1159+
dependencies:
1160+
"@babel/helper-string-parser" "^7.29.7"
1161+
"@babel/helper-validator-identifier" "^7.29.7"
1162+
10691163
"@colors/colors@1.5.0":
10701164
version "1.5.0"
10711165
resolved "https://registry.yarnpkg.com/@colors/colors/-/colors-1.5.0.tgz#bb504579c1cae923e6576a4f5da43d25f97bdbd9"
@@ -4826,10 +4920,10 @@ fast-json-stable-stringify@^2.0.0:
48264920
resolved "https://registry.yarnpkg.com/fast-json-stable-stringify/-/fast-json-stable-stringify-2.1.0.tgz#874bf69c6f404c2b5d99c481341399fd55892633"
48274921
integrity sha512-lhd/wF+Lk98HZoTCtlVraHtfh5XYijIjalXck7saUtuanSDyLMxnHhSXEDJqHxD7msR8D0uCmqlkwjCV8xvwHw==
48284922

4829-
fast-uri@^3.0.1:
4830-
version "3.1.0"
4831-
resolved "https://registry.yarnpkg.com/fast-uri/-/fast-uri-3.1.0.tgz#66eecff6c764c0df9b762e62ca7edcfb53b4edfa"
4832-
integrity sha512-iPeeDKJSWf4IEOasVVrknXpaBV0IApz/gp7S2bb7Z4Lljbl2MGJRqInZiUrQwV16cpzw/D3S5j5Julj/gT52AA==
4923+
fast-uri@>=3.1.1, fast-uri@^3.0.1:
4924+
version "3.1.2"
4925+
resolved "https://registry.yarnpkg.com/fast-uri/-/fast-uri-3.1.2.tgz#8af3d4fc9d3e71b11572cc2673b514a7d1a8c8ec"
4926+
integrity sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ==
48334927

48344928
fastq@^1.6.0:
48354929
version "1.20.1"

0 commit comments

Comments
 (0)