Skip to content

Implement contract security guards and advanced dependencies#488

Open
Dopezapha wants to merge 1 commit into
SoroLabs:mainfrom
Dopezapha:feature/contract-security-dependencies
Open

Implement contract security guards and advanced dependencies#488
Dopezapha wants to merge 1 commit into
SoroLabs:mainfrom
Dopezapha:feature/contract-security-dependencies

Conversation

@Dopezapha
Copy link
Copy Markdown
Contributor

Closes #472
Closes #458

Summary

This PR implements two contract-level improvements for SoroTask:

  1. Reentrancy protection and security guards for state-mutating flows.
  2. Advanced task dependency rules based on explicit execution outcomes.

Changes

#472 Contract Security Guards

  • Added a contract-wide reentrancy lock backed by instance storage.
  • Protected state-mutating functions from nested mutation during external calls.
  • Guarded execution paths that call resolver contracts, target contracts, and token contracts.
  • Added a dedicated ReentrantCall contract error.
  • Preserved existing authorization checks using require_auth for creators, keepers, and gas depositors.
  • Added a regression test that proves a target contract cannot reenter and pause another task during execute.

#458 Advanced Task Dependencies

  • Added execution status tracking for each task.
  • Added support for dependency rules that can require:
    • successful execution
    • skipped execution
    • any completed execution
  • Added completed_at and run_count tracking for dependency evaluation.
  • Added add_dependency_with_rule, get_task_status, get_dependency_rules, and is_dependency_satisfied.
  • Kept the existing add_dependency API compatible by mapping it to a default success-based dependency rule.
  • Added bounded dependency fan-in and dependency depth checks to keep graph validation predictable.
  • Added focused tests for skipped-outcome dependencies and minimum completion timestamp rules.

Security Notes

  • Reentrancy-sensitive external calls are protected by the mutation lock.
  • Read-only contract calls remain available while the guard protects writes.
  • If a guarded transaction fails, Soroban rollback reverts the lock state with the rest of the transaction.
  • Dependency graph writes are bounded to avoid unbounded traversal cost.

@drips-wave
Copy link
Copy Markdown

drips-wave Bot commented May 27, 2026

@Dopezapha Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Contract] Implement Reentrancy Protection and Security Guards [Contract] Implement Advanced Task Dependency Logic

1 participant