Merge pull request #658 from VenusProtocol/develop

New release

Author: fred-venus

.github/prepare_slim_package.sh

@@ -0,0 +1,17 @@
+# Create a slim folder with the minium content we want, and remove unneeded files
+mkdir slim && cp -r artifacts* package.json README.md deployments slim && cd slim
+find deployments -mindepth 1 -depth -not -name "*_addresses.json*" -exec rm -r "{}" +
+find artifacts -mindepth 1 -depth -not -regex "artifacts/contracts.*" -exec rm -r "{}" +
+find artifacts-zk -mindepth 1 -depth -not -regex "artifacts-zk/contracts.*" -exec rm -r "{}" +
+find artifacts -mindepth 1 -depth -regex "artifacts/.*dbg\.json" -exec rm -r "{}" +
+
+# Add "-slim" to the version in the npm package, keeping the tag "-dev" if it exists
+jq '.version |= sub("^(?<core>[0-9]+\\.[0-9]+\\.[0-9]+)"; "\(.core)-slim")' package.json > package.tmp.json && mv package.tmp.json package.json 
+
+# Remove the "prepare" and "postinstall" scripts, they won't work for this slim version
+jq 'del(.scripts.prepare)' package.json > package.tmp.json && mv package.tmp.json package.json
+jq 'del(.scripts.postinstall)' package.json > package.tmp.json && mv package.tmp.json package.json
+
+# Empty devDependencies and dependencies
+jq '.dependencies = {}' package.json > package.tmp.json && mv package.tmp.json package.json
+jq '.devDependencies = {}' package.json > package.tmp.json && mv package.tmp.json package.json

.github/workflows/cd.yml

@@ -6,9 +6,15 @@ on:
       - main
       - develop
 
+permissions:
+  id-token: write # Required for OIDC
+  contents: read
+
 jobs:
   release:
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
     steps:
       - name: Checkout
         uses: actions/checkout@v3
@@ -18,8 +24,9 @@ jobs:
 
       - uses: actions/setup-node@v3
         with:
-          node-version: 18
           cache: "yarn"
+          node-version: "22.14.0"
+          registry-url: "https://registry.npmjs.org"
 
       - name: Install dependencies
         # Hack to get around failing "ethereumjs-abi The remote archive doesn't match the expected checksum" error
@@ -34,9 +41,24 @@ jobs:
       - name: Release
         env:
           GITHUB_TOKEN: ${{ secrets.VENUS_TOOLS_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
           GIT_AUTHOR_NAME: Venus Tools
           GIT_AUTHOR_EMAIL: tools@venus.io
           GIT_COMMITTER_NAME: Venus Tools
           GIT_COMMITTER_EMAIL: tools@venus.io
         run: yarn semantic-release
+
+      - name: Prepare slim package
+        run: bash .github/prepare_slim_package.sh
+
+      - name: Publish slim package
+        run: |
+          # Ensure npm 11.5.1 or later is installed
+          npm install -g npm@latest
+
+          cd slim
+
+          # Extract to PRE_RELEASE_TAG the tag in the version field of the package json, or the empty string if it doesn't exist
+          PRE_RELEASE_TAG=$(jq -r '.version | if test("-") then capture("^[0-9]+\\.[0-9]+\\.[0-9]+-(?<tag>[a-zA-Z-]+)") | .tag else "" end' package.json)
+
+          # Publish the package to a custom tag for slim versions
+          npm publish --access public --tag $PRE_RELEASE_TAG

CHANGELOG.md

@@ -130,7 +130,7 @@ $ yarn hardhat --network <network-name> --export ./deployments/<network-name>.js
 ### Source Code Verification
 
 In order to verify the source code of already deployed contracts, run:
-`npx hardhat etherscan-verify --network <network_name>`
+`npx hardhat verify --network <network-name> <contract-address> <constructor-arg1> <constructor-arg2>`
 
 Make sure you have added `ETHERSCAN_API_KEY` in `.env` file.
 

README.md

@@ -44,6 +44,14 @@ interface ComptrollerInterface {
 
     function borrowVerify(address vToken, address borrower, uint borrowAmount) external;
 
+    function executeFlashLoan(
+        address payable onBehalf,
+        address payable receiver,
+        VToken[] calldata vTokens,
+        uint256[] calldata underlyingAmounts,
+        bytes calldata param
+    ) external;
+
     function repayBorrowAllowed(
         address vToken,
         address payer,
@@ -160,6 +168,8 @@ interface ComptrollerInterface {
 
     function vaiMintRate() external view returns (uint);
 
+    function authorizedFlashLoan(address account) external view returns (bool);
+
     function userPoolId(address account) external view returns (uint96);
 
     function getLiquidationIncentive(address vToken) external view returns (uint256);
@@ -197,6 +207,8 @@ interface ComptrollerInterface {
             uint96 marketPoolId,
             bool isBorrowAllowed
         );
+
+    function isFlashLoanPaused() external view returns (bool);
 }
 
 interface IVAIVault {

audits/153_flashloan_certik_20251014.pdf

@@ -320,3 +320,11 @@ contract ComptrollerV17Storage is ComptrollerV16Storage {
      */
     uint96 public lastPoolId;
 }
+
+contract ComptrollerV18Storage is ComptrollerV17Storage {
+    /// @notice Mapping of accounts authorized to execute flash loans
+    mapping(address => bool) public authorizedFlashLoan;
+
+    /// @notice Whether flash loans are paused system-wide
+    bool public flashLoanPaused;
+}

audits/154_flashloan_quantstamp_20252210.pdf

@@ -4,14 +4,14 @@ pragma solidity 0.8.25;
 
 import { IDiamondCut } from "./interfaces/IDiamondCut.sol";
 import { Unitroller } from "../Unitroller.sol";
-import { ComptrollerV17Storage } from "../ComptrollerStorage.sol";
+import { ComptrollerV18Storage } from "../ComptrollerStorage.sol";
 
 /**
  * @title Diamond
  * @author Venus
  * @notice This contract contains functions related to facets
  */
-contract Diamond is IDiamondCut, ComptrollerV17Storage {
+contract Diamond is IDiamondCut, ComptrollerV18Storage {
     /// @notice Emitted when functions are added, replaced or removed to facets
     event DiamondCut(IDiamondCut.FacetCut[] _diamondCut);
 
@@ -72,7 +72,7 @@ contract Diamond is IDiamondCut, ComptrollerV17Storage {
      */
     function facetAddress(
         bytes4 functionSelector
-    ) external view returns (ComptrollerV17Storage.FacetAddressAndPosition memory) {
+    ) external view returns (ComptrollerV18Storage.FacetAddressAndPosition memory) {
         return _selectorToFacetAndPosition[functionSelector];
     }