[Preview] Rewards Eligibility Oracle (REO) #1235

RembrandtK · 2025-10-07T07:26:40Z

Currently comparing to build-lint-upgrade, when that merged to main (via #1233) can create as new PR against main for easier audit and merge.

socket-security · 2025-10-07T07:28:01Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@nomicfoundation/hardhat-toolbox@5.0.0
	debug@4.4.3
	@openzeppelin/hardhat-upgrades@3.9.1
	hardhat@2.26.3

View full report

Copilot

Pull Request Overview

This PR introduces a new Rewards Eligibility Oracle (REO) system that allows authorized oracles to manage indexer eligibility for receiving rewards on The Graph network. The system implements a "deny by default" approach where indexers must be explicitly marked as eligible by oracles to receive rewards.

Key changes:

New RewardsEligibilityOracle contract with time-based eligibility management
Integration with existing RewardsManager to check eligibility before distributing rewards
Comprehensive test suite with consolidated patterns and shared fixtures

Reviewed Changes

Copilot reviewed 34 out of 36 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
packages/issuance/contracts/eligibility/RewardsEligibilityOracle.sol	Core oracle contract implementing eligibility management with role-based access control
packages/contracts/contracts/rewards/RewardsManager.sol	Updated to integrate with eligibility oracle and check indexer eligibility before rewards
packages/interfaces/contracts/issuance/eligibility/IRewardsEligibilityOracle.sol	Interface definition for rewards eligibility oracle
packages/issuance/test/tests/RewardsEligibilityOracle.test.ts	Comprehensive test suite for the oracle contract
packages/contracts/test/tests/unit/rewards/rewards.test.ts	Enabled previously skipped eligibility oracle tests

Files not reviewed (1)

pnpm-lock.yaml: Language not supported

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

packages/contracts/contracts/rewards/RewardsManagerStorage.sol

packages/issuance/test/tests/helpers/sharedFixtures.ts

packages/issuance/test/tests/helpers/fixtures.ts

packages/issuance/test/scripts/generateInterfaceIds.js

openzeppelin-code · 2025-10-07T07:43:58Z

[Preview] Rewards Eligibility Oracle (REO)

Generated at commit: f2dca1036e38a566e2d1c29c240738206d5ca10b

🚨 Report Summary

	Severity Level	Results
Contracts	Critical High Medium Low Note Total	2 4 0 15 38 59
Dependencies	Critical High Medium Low Note Total	0 0 0 0 0 0

For more details view the full report in OpenZeppelin Code Inspector

codecov · 2025-10-07T07:49:28Z

Codecov Report

❌ Patch coverage is 96.55172% with 3 lines in your changes missing coverage. Please review.
✅ Project coverage is 83.69%. Comparing base (804da6c) to head (f2dca10).
⚠️ Report is 8 commits behind head on build-lint-upgrade.

Files with missing lines	Patch %	Lines
...s/contracts/tests/MockRewardsEligibilityOracle.sol	66.66%	3 Missing ⚠️

Additional details and impacted files

@@                  Coverage Diff                   @@
##           build-lint-upgrade    #1235      +/-   ##
======================================================
+ Coverage               83.15%   83.69%   +0.53%     
======================================================
  Files                      48       51       +3     
  Lines                    2096     2183      +87     
  Branches                  620      643      +23     
======================================================
+ Hits                     1743     1827      +84     
- Misses                    353      356       +3

Flag	Coverage Δ
unittests	`83.69% <96.55%> (+0.53%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

• Consolidated duplicate test fixture files into single fixtures.ts • Removed circular dependency between fixtures.ts and sharedFixtures.ts • Fixed incorrect function calls (grantOperatorRole → grantRole, setValidityPeriod → setEligibilityPeriod) • Updated default eligibility period from 7 days to 14 days (matches contract default) • Updated all test imports to use consolidated fixtures • Fixed RewardsManagerV6Storage class documentation comment

Copilot

Pull Request Overview

Copilot reviewed 33 out of 35 changed files in this pull request and generated 7 comments.

Files not reviewed (1)

pnpm-lock.yaml: Language not supported

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

packages/issuance/test/utils/testPatterns.ts

packages/issuance/test/tests/consolidated/AccessControl.test.ts

packages/issuance/test/tests/RewardsEligibilityOracle.test.ts

packages/issuance/test/scripts/generateInterfaceIds.js

packages/issuance/test/tests/helpers/fixtures.ts

packages/issuance/test/tests/RewardsEligibilityOracle.test.ts

packages/issuance/hardhat.config.cjs

• Convert require() to ES6 imports for consistency (chai, ethers) • Add descriptive comments to empty catch blocks in generateInterfaceIds.js • Add mocha configuration to hardhat.config.cjs • Remove commented-out paths configuration • Add test:coverage script to package.json • Improve error handling in fixtures.ts (console.warn → console.error + throw)

Copilot

Pull Request Overview

Copilot reviewed 34 out of 35 changed files in this pull request and generated 6 comments.

Files not reviewed (1)

pnpm-lock.yaml: Language not supported

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

packages/issuance/test/tests/helpers/fixtures.ts

packages/issuance/test/tests/RewardsEligibilityOracle.test.ts

packages/contracts/contracts/rewards/RewardsManager.sol

packages/issuance/test/scripts/generateInterfaceIds.js

packages/issuance/test/package.json

RembrandtK · 2025-10-07T11:49:58Z

See also: graph-improvement-proposals PR#80 GIP-0079: Indexer Rewards Eligibility Oracle (REO)

…tance - Convert from CommonJS to TypeScript for consistency - Create issuance-specific base config that inherits from toolshed - Remove unnecessary configuration duplication: - Remove unused hardhat-abi-exporter, hardhat-gas-reporter, solidity-coverage - Remove unnecessary mocha config (tests run in separate package) - Remove redundant etherscan customChains (arbitrumSepolia is built-in) - Remove manual etherscan API key config (inherited from toolshed) - Set evmVersion to 'cancun' for issuance contracts - Eliminate ~95% duplication across 3 config files - Follow established inheritance pattern like horizon/subgraph-service Before: 289 lines across 3 files with massive duplication After: ~90 lines with proper inheritance and minimal duplication

socket-security · 2025-10-07T14:20:39Z

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

- Updates issuance package from 5.3.0 to 5.4.0 (latest stable) - Updates issuance test package from 5.3.0 to 5.4.0 - Maintains compatibility with Solidity 0.8.27 - All tests passing with updated dependencies

…uilding - Add timestamp-based checks for WAGMI, ethers-v5, and TypeScript compilation - Skip type generation when output files are newer than source files - Improve file-by-file comparison for dist directory organization - Reduce build time from 5+ seconds to ~600ms when no changes needed - Maintain build correctness while improving developer experience

The testSlash_RoundDown_TokensThawing_Delegation test was failing because it could generate scenarios where undelegating would leave less than the minimum delegation amount (1 ether) in the pool, which violates the protocol's minimum delegation constraint. Added assumption to ensure undelegation either removes all tokens or leaves at least MIN_DELEGATION in the pool, making the test compliant with the protocol's validation rules introduced in commit 91cda56.

- Update test script to use main hardhat config instead of test-specific config - Remove unused test/hardhat.config.ts file - Fixes OpenZeppelin upgrades plugin contract resolution issue - All 40 RewardsEligibilityOracle tests now pass Resolves issue introduced in 39b161c where test config couldn't properly resolve contract sources for OpenZeppelin upgrades plugin validation.

The build:dep step already compiles @graphprotocol/issuance as a dependency, so the explicit --filter @graphprotocol/issuance compile in build:self was redundant and inefficient. Now follows the same pattern as packages/contracts/test which only builds dependencies without redundant compilation steps.

- Remove 'html' from istanbulReporter in .solcover.js files - Keep only ['lcov', 'text', 'json'] reporters to avoid duplicates - HTML reports now only generated in lcov-report/ subdirectory - Use default ./coverage output directory for modern pattern - Apply fix to both contracts and issuance packages

- Replace manual environment variable management with hre.__SOLIDITY_COVERAGE_RUNNING - Add centralized isRunningUnderCoverage() utility function - Simplify test coverage detection using clean if statements - Remove duplicate .solcover.js file (keep only test/.solcover.js) - Update coverage configuration for better reporting

Update CI to look for coverage files in packages/contracts/coverage/ instead of packages/contracts/test/reports/coverage/ to match the updated .solcover.js configuration.

feat: add Rewards Eligibility Oracle (REO)

fed7913

RembrandtK mentioned this pull request Oct 7, 2025

Rewards Eligibility Oracle (REO) #1221

Closed

RembrandtK requested a review from Copilot October 7, 2025 07:29

Copilot AI reviewed Oct 7, 2025

View reviewed changes

RembrandtK changed the title ~~[Placeholder] Rewards Eligibility Oracle (REO)~~ [Preview] Rewards Eligibility Oracle (REO) Oct 7, 2025

RembrandtK requested a review from Copilot October 7, 2025 07:54

Copilot AI reviewed Oct 7, 2025

View reviewed changes

RembrandtK self-assigned this Oct 7, 2025

RembrandtK added 3 commits October 7, 2025 09:42

feat: add test:coverage script to packages/contracts

e198a3b

chore: not sure if this file format is stable or keeps changing

61e32c9

RembrandtK requested a review from Copilot October 7, 2025 09:31

Copilot AI reviewed Oct 7, 2025

View reviewed changes

RembrandtK mentioned this pull request Oct 7, 2025

GIP-0079: Indexer Rewards Eligibility Oracle (REO) graphprotocol/graph-improvement-proposals#80

Open

RembrandtK added 8 commits October 7, 2025 18:26

chore: upgrade @openzeppelin/contracts to 5.4.0 in issuance packages

a9ba749

- Updates issuance package from 5.3.0 to 5.4.0 (latest stable) - Updates issuance test package from 5.3.0 to 5.4.0 - Maintains compatibility with Solidity 0.8.27 - All tests passing with updated dependencies

ci: update coverage path for contracts package

f2dca10

Update CI to look for coverage files in packages/contracts/coverage/ instead of packages/contracts/test/reports/coverage/ to match the updated .solcover.js configuration.

[Preview] Rewards Eligibility Oracle (REO) #1235

Are you sure you want to change the base?

[Preview] Rewards Eligibility Oracle (REO) #1235

Uh oh!

Conversation

RembrandtK commented Oct 7, 2025

Uh oh!

socket-security bot commented Oct 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

openzeppelin-code bot commented Oct 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

[Preview] Rewards Eligibility Oracle (REO)

🚨 Report Summary

Uh oh!

codecov bot commented Oct 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

RembrandtK commented Oct 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security bot commented Oct 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

socket-security bot commented Oct 7, 2025 •

edited

Loading

openzeppelin-code bot commented Oct 7, 2025 •

edited

Loading

codecov bot commented Oct 7, 2025 •

edited

Loading

RembrandtK commented Oct 7, 2025 •

edited

Loading

socket-security bot commented Oct 7, 2025 •

edited

Loading