Edr reth

[Dargon789]

Motivation

Solution

PR Checklist

• Added Tests
• Added Documentation
• Breaking changes

[codesandbox]

Review or Edit in CodeSandbox

Open the branch in Web Editor • VS Code • Insiders

Open Preview

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
next	Ready	Preview, Comment	Mar 26, 2026 0:20am
react	Ready	Preview, Comment	Mar 26, 2026 0:20am

[sourcery-ai]

Sorry @Dargon789, your pull request is larger than the review limit of 150000 diff characters

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request significantly refactors the codebase to improve network and transaction type genericity, particularly impacting Anvil, Cast, Cheatcodes, Forge, and Script functionalities. It introduces new traits and updates existing ones to align with the more flexible design, while also integrating enhanced support for the Tempo network and its access key mechanisms. The changes aim to streamline EVM environment management and ensure better compatibility across different blockchain networks.

Highlights

• Network Genericity Refactoring: Numerous structs and functions across Anvil, Cast, Cheatcodes, Forge, and Script crates have been updated to be generic over Network and TxEnvelope types, enhancing flexibility and reusability.
• EVM Environment Handling: The handling of EVM environments (EvmEnv and TxEnv) has been refactored, removing the Env struct and updating various executor and inspector methods to directly use these environment components.
• Tempo Network and Access Key Support: Enhanced support for the Tempo network has been integrated, including new transaction builders, access key configuration, and specific signing logic for Tempo access key transactions.
• Cheatcode and Inspector Updates: New cheatcodes like currentFilePath() have been added, and existing cheatcode and inspector implementations have been adapted to the new generic network and EVM environment structures.
• Dependency Updates: A wide array of dependencies in Cargo.lock have been updated, including various alloy-* crates, revm, clap, aws-sdk-*, and others, ensuring compatibility and incorporating the latest features and fixes.
• Build and Install Improvements: The forge install command now includes logic to clean up nested .git directories from submodules, and the forge inspect command has new features for displaying contract linearization.

Ignored Files

• Ignored by pattern: .github/workflows/** (7)
  • .github/workflows/ci.yml
  • .github/workflows/docs.yml
  • .github/workflows/nix.yml
  • .github/workflows/npm.yml
  • .github/workflows/test-flaky.yml
  • .github/workflows/test-isolate.yml
  • .github/workflows/test.yml

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request introduces significant refactoring across the Foundry codebase, primarily focusing on enhancing network and transaction type genericity. Key changes include making many core components in Anvil, Cast, Forge, and Cheatcodes generic over Network and TxEnvelope/ReceiptEnvelope types, improving flexibility for different EVM-compatible chains like Optimism and Tempo. Explicit support for the Tempo network has been added, including handling of Tempo-specific transaction types and access keys in Cast and Script commands. The EVM environment has been refactored, removing the Env struct in favor of passing EvmEnv and TxEnv directly in many executor and backend functions. New cheatcodes like currentFilePath have been added, and existing ones have been made more robust (e.g., writeJson now creates files if they don't exist). Build system improvements include forge install --no-git now correctly cleaning up nested submodule contents, and forge inspect linearization providing detailed contract inheritance information. Numerous Rust dependencies have also been updated. A notable improvement is the addition of a expected_reason.len() >= 4 check in crates/cheatcodes/src/test/revert_handlers.rs, which prevents a potential panic when e.decode_error is called with revert data shorter than a 4-byte selector, making the cheatcode more robust against edge cases.

[gemini-code-assist]

This is a great fix. The previous implementation would have failed for tuple structs with more than one field by always accessing .0. Using the index from Member::Unnamed(idx) makes the macro correctly handle tuple structs of any arity.

[gemini-code-assist]

Adding the expected_reason.len() >= 4 check is a good defensive measure. It prevents a potential panic when e.decode_error is called with revert data that is shorter than a 4-byte selector, which could happen with vm.expectRevert(bytes("")) and an empty revert. This makes the cheatcode more robust against edge cases.

[gemini-code-assist]

The updated logic for with_verbosity at level 5 and above is a significant improvement. The previous implementation could incorrectly downgrade the trace mode (e.g., from Debug to Steps). The new logic using max(self, RecordStateDiff) correctly enhances the tracing level to include state diffs for high verbosity, providing more useful information without unintended side effects.

In general, to fix uncontrolled path usage you either (1) validate the path against an allowlist or ensure it is within a trusted base directory, or (2) treat the input only as a single, non-hierarchical component (e.g., a file name) and reject any separators or ... Here, the function is meant to clean nested .git artifacts only within the cloned dependency directory. The best fix while preserving behavior is to ensure the recursive traversal in remove_nested_git_dirs_inner never leaves the root directory tree, even if a malicious repository structure or symlinks attempt to redirect traversal.

Concretely, we can add a guard at the top of remove_nested_git_dirs_inner that canonicalizes both root and dir and returns early if dir is not under root. This confines std::fs::read_dir(dir) to directories that are guaranteed to be within the originally requested root, addressing the uncontrolled path issue that CodeQL flagged. Because canonicalization can fail (e.g., broken symlink), we treat such failures as non-fatal and simply stop recursing into that subtree, which maintains robustness without broadening the scope of traversal. This change is localized to remove_nested_git_dirs_inner in crates/forge/src/cmd/install.rs and requires only use std::path::Path; / PathBuf that are already in use elsewhere in the file, so no new external dependencies are needed.

In general, to fix uncontrolled path usage, we ensure any path derived from untrusted data is either validated/normalized (and rejected if it escapes an allowed root) or we avoid recursively following paths that might point outside an expected directory tree. For this case, the issue is in a recursive helper that walks directories; the best fix is to explicitly bind the traversal to a known root and avoid ever calling fs::read_dir on something that is not under that root.

Concretely, we can modify assert_no_git to take both the current directory and a root directory, and before recursing into path, we check that path is still within root using starts_with. We then initially call assert_no_git with root set to dep_dir, which is our safe base. This ensures we never traverse outside dep_dir even if somehow a symlink or other mechanism introduced an unexpected path component. To avoid changing existing functionality for valid trees, we simply skip recursion into any path that is not under root; in the normal test setup nothing changes, because all children of dep_dir are under that root. This change is local to the test function; no new imports are needed because we already import Path. Only the function signature, its recursive call, and the initial call site need to be updated.

Specifically:

• Change fn assert_no_git(dir: &Path) to fn assert_no_git(dir: &Path, root: &Path).
• Inside the loop, before recursing, check if path.is_dir() && path.starts_with(root) { assert_no_git(&path, root); }.
• Update the initial invocation from assert_no_git(&dep_dir); to assert_no_git(&dep_dir, &dep_dir);.