Skip to content

Add notes about audit PRs, comments #16

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
zhongeric wants to merge 2 commits into from
Closed

Add notes about audit PRs, comments #16

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0f9e501
Add audit branch comments
zhongeric Jul 7, 2025
68ecbd7
fix gas part
zhongeric Jul 7, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 6 additions & 2 deletions CONTRIBUTING.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,6 +62,10 @@ The main branch is supposed to reflect the deployed state on all networks. Any p

The staging branch reflects new code complete deployments or upgrades containing fixes and/or features. Any pull requests into this branch MUST come from the dev branch. The staging branch is used for security audits and deployments. Once the deployment is complete and verified as well as deployment log files are generated, the branch can be merged into main. For more information on the deployment and log file generation check [here](#deployment).

### Audit

Each fix in response to an audit finding should be developed on its own branch. The naming convention for these branches is `audit/<provider>/<issue_number>`. The PR title should include the provider and the issue number at minimum. Sometimes it is desireable to have all of the fixes in a single PR for review. In this case, each fix PR should be included via the `merge` strategy, and the combined PR can be merged into the staging branch via `merge` to preserve the order of the fix commits.
Comment thread
gretzke marked this conversation as resolved.

### Dev

This is the active development branch. All pull requests into this branch MUST come from fix or feature branches. Upon code completion this branch is merged into staging for auditing and deployment. PRs into this branch should squash all commits into a single commit.
Expand Down Expand Up @@ -135,13 +139,13 @@ New features must be merged with associated tests. Bug fixes should have a corre

### Gas Metering

The [Forge Gas Snapshot](https://github.com/marktoda/forge-gas-snapshot) library is used to measure the gas cost of individual actions. To ensure that the measured gas is accurate, tests have to be run using the isolate argument to generate the correct snapshot and ensure that CI passes:
Gas for function calls should be metered using the built in `vm.snapshotGasLastCall` function in forge. To meter across multiple calls `vm.startSnapshotGas` and `vm.stopSnapshotGas` can be used. Running the tests with `--isolate` is recommended to ensure that the gas is measured correctly.
Comment thread
gretzke marked this conversation as resolved.

```sh
$ forge test --isolate
```

When adding new functionality, a new gas snapshot should be added, preferably using `snapLastCall`.
For more information on gas metering see the [Forge cheatcodes reference](https://getfoundry.sh/reference/cheatcodes/gas-snapshots/#snapshotgas-cheatcodes).

## Deployment

Expand Down
Loading