Skip to content

Releases: sentrix-labs/canonical-contracts

Release list

v1.1.0

v1.1.0 Latest
Latest

Choose a tag to compare

View all tags
@satyakwok satyakwok released this 07 May 15:39
v1.1.0
ebeb1b9
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

SentrixSafe v1.1 — security patch

Fixes from the 2026-05-07 internal audit:

  • C1 (CRITICAL): delegatecall data-location mismatch. The data parameter was a calldata reference but the inline assembly DELEGATECALL passed it as if it were memory, leading to a wrong dataptr/datasize pair under stack-pressure paths. Fix: copy data into a local bytes memory before the assembly block.
  • C2 (CRITICAL): zero test coverage for execTransaction — added 17 forge tests covering EOA signature recovery, replay protection, threshold-quorum enforcement, delegatecall correctness, owner add/remove, and threshold updates.
  • H1: silent failure on signatures.length < threshold * 65 — now reverts with Safe: signature length mismatch.
  • H2: DOMAIN_SEPARATOR was immutable and captured block.chainid at deploy. Replaced with a function that re-computes per call, with a fallback that handles chain forks and chain_id rotation.
  • H3: minimum-owner floor was 0 (constructor accepted address(0) owners + zero-length lists). Added Safe: invalid owner count revert.

CoinBlastCurve — H4 + H5

  • H4 (HIGH): srxRaised underflow when (srxNet + fee) > srxRaised. Fixed by clamped subtraction (srxRaised >= debit ? srxRaised - debit : 0).
  • H5 (HIGH): shadow-pair griefing — an attacker could pre-create the (TOKEN, WSRX) pair on the V2 factory before bonding curve graduation, capturing the LP-add reward. Now reverts on graduation if pair already exists.

22 forge tests pass on the H4+H5 patch path.

License

BUSL-1.1 / MIT mix per file. See per-contract headers.

Verify

forge test

All 39 tests across test/Safe.t.sol + test/CoinBlastCurve.t.sol pass on this tag.

Assets 6
Loading

v1.0.0

v1.0.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 27 Apr 19:24
v1.0.0
02c59c3
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode. 
v1.0.0 — first coordinated deploy of canonical contracts

Sentrix Mainnet (chain 7119):
  WSRX         0x4693b113e523A196d9579333c4ab8358e2656553
  Multicall3   0xFd4b34b5763f54a580a0d9f7997A2A993ef9ceE9
  TokenFactory 0xc753199b723649ab92c6db8A45F158921CFDEe49
  SentrixSafe  0x6272dC0C842F05542f9fF7B5443E93C0642a3b26

Sentrix Testnet (chain 7120):
  WSRX         0x85d5E7694AF31C2Edd0a7e66b7c6c92C59fF949A
  Multicall3   0x7900826De548425c6BE56caEbD4760AB0155Cd54
  TokenFactory 0x7A2992af0d4979aDD076347666023d66d29276Fc
  SentrixSafe  0xc9D7a61D7C2F428F6A055916488041fD00532110

Deployer: 0x5acb04058fc4dfa258f29ce318282377cac176fd
Activation: end-to-end EVM CREATE flow validated against the live
EVM CREATE nonce fix (sentrix-labs/sentrix#381) shipped to mainnet
at sentrix-labs/sentrix@3ee0316 (v2.1.45 tag).
Loading