Audit readiness for the Seismic shielded SRC-20 branch

.env.example

@@ -44,6 +44,22 @@ export BSC_TESTNET_VERIFIER_URL="https://api.etherscan.io/v2/api?chainid=97"
 export OPTIMISM_SEPOLIA_VERIFIER_URL="https://api.etherscan.io/v2/api?chainid=11155420"
 export SONEIUM_TESTNET_VERIFIER_URL="https://soneium-minato.blockscout.com/api"
 
+# Seismic
+# Verifier URL must be the FULL socialscan command_api path, not the bare host.
+export SEISMIC_TESTNET_RPC_URL=https://testnet-1.seismictest.net/rpc
+export SEISMIC_TESTNET_VERIFIER_URL=https://api.socialscan.io/seismic-testnet/v1/explorer/command_api/contract
+# Set when Seismic mainnet is live (deploy targets fail closed until then).
+# export SEISMIC_MAINNET_RPC_URL=
+# export SEISMIC_MAINNET_CHAIN_ID=
+# export SEISMIC_MAINNET_VERIFIER_URL=
+
+# Seismic post-deploy ops (configure-extension-*, set-contract-key-*)
+# Contract encryption keys live in 1Password, never here.
+export SWAP_FACILITY=
+export EXTENSION_PROXY=
+export PORTAL=
+export LIMIT_ORDER_PROTOCOL=
+
 # Extension-specific deployment configuration
 # Uncomment and set the variables for the extension you want to deploy
 

.github/workflows/coverage.yml

@@ -1,10 +1,10 @@
+# Disabled on the Seismic branch: stock forge cannot compile shielded types
+# (suint256) and this branch never merges to main. CI runs test-seismic.yml
+# instead; a manual dispatch of this workflow will fail at compile.
 name: Forge Coverage
 
 on:
-  push:
-    branches:
-      - main
-  pull_request:
+  workflow_dispatch:
 
 permissions: write-all
 

.github/workflows/test-gas.yml

@@ -1,10 +1,10 @@
+# Disabled on the Seismic branch: stock forge cannot compile shielded types
+# (suint256) and this branch never merges to main. CI runs test-seismic.yml
+# instead; a manual dispatch of this workflow will fail at compile.
 name: Forge Tests Gas Report
 
 on:
-  push:
-    branches:
-      - main
-  pull_request:
+  workflow_dispatch:
 
 permissions: write-all
 

.github/workflows/test-integration.yml

@@ -1,10 +1,11 @@
+# Disabled on the Seismic branch: stock forge cannot compile shielded types
+# (suint256), mainnet-fork RPCs lack eth_getFlaggedStorageAt, and this branch
+# never merges to main. CI runs test-seismic.yml instead; a manual dispatch of
+# this workflow will fail at compile.
 name: Forge Integration Tests
 
 on:
-  push:
-    branches:
-      - main
-  pull_request:
+  workflow_dispatch:
 
 permissions: write-all
 

.github/workflows/test-seismic.yml

@@ -0,0 +1,80 @@
+# Seismic CI — the only workflow that can compile this branch (shielded types
+# need the sforge/ssolc toolchain; see scripts/seismic-env.sh). Installs the
+# toolchain repo-locally into .seismic-toolchain (the path the Makefile and
+# .husky/pre-commit auto-detect), cached on the pinned sforge version.
+name: Seismic Tests
+
+on:
+  push:
+    branches:
+      - feat/seismic
+      - seismic-audit-readiness
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  # Pinned toolchain version: bump deliberately (also rolls the cache key).
+  SFORGE_VERSION: 1.3.5-v0.2.0
+  # Toolchain-cache layout version: bump to invalidate caches when the contents of
+  # .seismic-toolchain change shape (independent of SFORGE_VERSION). v2 added the
+  # co-located `ssolc` binary; v1 caches only held sforge/sanvil/scast, so cache-hit
+  # runs failed at compile time with "`ssolc` not found in PATH".
+  TOOLCHAIN_CACHE_VERSION: v2
+
+jobs:
+  test:
+    name: Unit tests + sizes (sforge)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: recursive
+
+      - name: Cache Seismic toolchain
+        id: toolchain-cache
+        uses: actions/cache@v4
+        with:
+          path: .seismic-toolchain
+          key: seismic-toolchain-${{ runner.os }}-sforge-${{ env.SFORGE_VERSION }}-${{ env.TOOLCHAIN_CACHE_VERSION }}
+
+      - name: Install Seismic toolchain
+        if: steps.toolchain-cache.outputs.cache-hit != 'true'
+        run: |
+          set -euo pipefail
+          export FOUNDRY_DIR="$PWD/.seismic-toolchain"
+          export FOUNDRY_BIN_DIR="$FOUNDRY_DIR/bin"
+          export PATH="$FOUNDRY_BIN_DIR:$PATH"
+          curl -L -H "Accept: application/vnd.github.v3.raw" \
+            "https://api.github.com/repos/SeismicSystems/seismic-foundry/contents/sfoundryup/install?ref=seismic" | bash
+          sfoundryup
+          # sfoundryup installs `ssolc` to /usr/local/bin (its install_ssolc ignores
+          # FOUNDRY_BIN_DIR), which is NOT under the cached .seismic-toolchain dir — so
+          # the compiler is lost on cache-hit runs. Co-locate it in the toolchain bin
+          # (the only dir the Makefile adds to PATH) so it's cached and restored too.
+          if [ ! -x "$FOUNDRY_BIN_DIR/ssolc" ]; then
+            cp "$(command -v ssolc)" "$FOUNDRY_BIN_DIR/ssolc"
+          fi
+
+      - name: Assert pinned toolchain (sforge + ssolc)
+        run: |
+          ./.seismic-toolchain/bin/sforge --version
+          ./.seismic-toolchain/bin/sforge --version | grep -F "$SFORGE_VERSION" \
+            || { echo "sfoundryup installed sforge != $SFORGE_VERSION (installer tracks upstream latest); bump SFORGE_VERSION deliberately"; exit 1; }
+          # ssolc must live in the cached toolchain dir, else cache-hit runs fail at
+          # compile time with "`ssolc` not found in PATH" (the Makefile only prepends
+          # .seismic-toolchain/bin to PATH). Fail fast here instead.
+          test -x ./.seismic-toolchain/bin/ssolc \
+            || { echo "ssolc missing from .seismic-toolchain/bin (stale cache predating ssolc co-location); bump TOOLCHAIN_CACHE_VERSION to invalidate"; exit 1; }
+          ./.seismic-toolchain/bin/ssolc --version
+
+      - name: Run unit tests (seismic profile)
+        run: make tests profile=seismic
+
+      - name: Run in-process Seismic integration suite (real precompiles)
+        run: make integration-seismic profile=seismic
+
+      - name: Check contract sizes (EIP-170)
+        run: make sizes profile=seismic

.gitignore

@@ -11,7 +11,7 @@ out/
 coverage/
 lcov.info
 
-# Docs
+# Docs (generated `forge doc` output, design notes, and drafts — all internal, not tracked)
 docs/
 
 # Dotenv file

.husky/pre-commit

@@ -1,12 +1,12 @@
-# If the repo-local Seismic toolchain is installed (see scripts/seismic-env.sh),
-# put sforge/ssolc on PATH and pin FOUNDRY_PROFILE=seismic so the test step
-# below compiles shielded-type code (suint256, etc.) that stock solc rejects.
-# When the toolchain isn't present, the hook falls back to stock forge.
-if [ -x ".seismic-toolchain/bin/sforge" ]; then
-    PATH="$PWD/.seismic-toolchain/bin:$PATH"
-    export PATH
-    FOUNDRY_PROFILE=seismic
-    export FOUNDRY_PROFILE
+# Shielded-type sources need the repo-local Seismic toolchain — fail fast with the install hint instead of a stock-forge parse error.
+if [ ! -x ".seismic-toolchain/bin/sforge" ]; then
+    echo "Seismic toolchain missing — run: source scripts/seismic-env.sh && sfoundryup" >&2
+    exit 1
 fi
 
+PATH="$PWD/.seismic-toolchain/bin:$PATH"
+export PATH
+FOUNDRY_PROFILE=seismic
+export FOUNDRY_PROFILE
+
 npm run lint-staged && npm test