Skip to content

fix(BOP-506): remove dead TransferredFromSeizable event from frozen IB20V1 ABI - #4315

Open
rayyan224 wants to merge 2 commits into
mainfrom
rayyanalam/bop-506-audit-i-02-frozen-ib20v1-abi-declares
Open

fix(BOP-506): remove dead TransferredFromSeizable event from frozen IB20V1 ABI#4315
rayyan224 wants to merge 2 commits into
mainfrom
rayyanalam/bop-506-audit-i-02-frozen-ib20v1-abi-declares

Conversation

@rayyan224

Copy link
Copy Markdown
Contributor

Summary

  • Audit finding I-02 (BlockSec, "Base B20 V2 / PolicyRegistry Precompiles"): the frozen IB20V1 ABI declared TransferredFromSeizable, which was never part of the v1.1.1 / base-std Beryl surface and has no emit site on the V1 path. Seize logging on V2 emits Seized instead.
  • Removed the dead event from crates/common/precompiles/src/common/abi/v1.rs.
  • Updated the pinned V1_ABI_FINGERPRINT in crates/common/precompiles/src/common/abi/v2.rs to match the corrected event set.

Confirmed via grep that TransferredFromSeizable had no emit site or decode-path reference anywhere in the crate before removal, so this does not change any historical returndata/log output.

Linear: https://linear.app/coinbase/issue/BOP-506

Test plan

  • cargo test -p base-common-precompiles --lib — 648 passed
  • cargo test -p base-common-precompiles --features test-utils --test b20_asset_v1_golden --test b20_stablecoin_v1_golden --test b20_asset_v2_golden --test b20_policy_v1_golden --test b20_factory_v1_golden — 369 passed
  • cargo clippy -p base-common-precompiles --lib --features test-utils -- -D warnings — clean

…B20V1 ABI

Audit finding I-02: the frozen IB20V1 wire surface declared TransferredFromSeizable,
which was never part of the v1.1.1 / base-std Beryl surface and has no emit site.
Seize logging on V2 emits Seized instead. Update the pinned V1 ABI fingerprint to
match the corrected event set.

Co-Authored-By: Claude <noreply@anthropic.com>
@linear

linear Bot commented Aug 7, 2026

Copy link
Copy Markdown

BOP-506

@cb-heimdall

cb-heimdall commented Aug 7, 2026

Copy link
Copy Markdown
Collaborator

✅ Heimdall Review Status

Requirement Status More Info
Reviews 1/1
Denominator calculation
Show calculation
1 if user is bot 0
1 if user is external 0
2 if repo is sensitive 0
From .codeflow.yml 1
Additional review requirements
Show calculation
Max 0
0
From CODEOWNERS 0
Global minimum 0
Max 1
1
1 if commit is unverified 0
Sum 1

@github-actions

github-actions Bot commented Aug 7, 2026

Copy link
Copy Markdown
Contributor

No issues found.

The change is clean and correct:

  • TransferredFromSeizable had no emit site, decode path, or any other reference in the codebase — confirmed via grep. Removing it from the frozen V1 ABI is safe.
  • The V1_ABI_FINGERPRINT in v2.rs is updated to match the corrected event set, and the fingerprint pinning test (v1_abi_fingerprint_is_pinned) will catch any future drift.
  • The V2 ABI is unaffected (it uses Seized instead, which remains in place).

@github-actions

github-actions Bot commented Aug 7, 2026

Copy link
Copy Markdown
Contributor

Base Std historical fork tests

Fork Result Passed Failed Skipped base/base base-anvil base-std
Beryl pass 616 0 13 14cfa4e0 6d744e03 4658f1b7
Cobalt pass 711 0 14 14cfa4e0 ae7557c4 5a5605a3

View run

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants