0 Fork 0

mirror of https://github.com/Twigpine/openlaunch.git synced 2026-11-10 05:01:52 -10:00

Files

T

Kevin Codex 9a65ad4edf fix: signed-or-insert-only metadata, salt-search-stable URI, atomic trade/fee accounting; CI, contributing, security policy

- Metadata registration is INSERT-only for unsigned callers: the creator registers before broadcasting
  (salt still private); replaying the public launch params returns 409 and cannot overwrite image /
  description / website. Later changes go through the wallet-signed edit flow. (review finding 1)
- The on-chain metadataURI is keyed by a client-chosen meta_key instead of the salt, so findSalt's
  result stays valid for USDG / stock quotes. Proven on the live Robinhood factory: 17/100 deterministic
  USDG launches reverted with the old scheme, 0/100 with the new one. (finding 2)
- Swap and fee ingestion commit the event row and the launch totals in one transaction; a rebuild script
  recomputes totals from raw events if ever needed (production checked: no drift). (finding 3)
- Fresh checkout: npm run migrate reads DATABASE_URL from .env.local/.env; fly-secrets.sh is self-contained
  (FLY_APP, SECRETS_ENV); README run + deploy steps corrected.
- CI workflow (lint, typecheck, unit tests, production build; forge build + unit tests), CONTRIBUTING.md,
  SECURITY.md with private reporting.

2026-09-07 11:48:37 +08:00

1.7 KiB

Raw Permalink Blame History

Contributing

Thanks for looking. openlaunch is small on purpose: three contracts, one site, no platform fee. Changes that keep it that way are welcome.

Ground rules

No fee, no owner, no admin. Pull requests that add a fee switch, an owner, a pause, an allowlist or an upgrade path to the contracts will not be merged. That is the product.
Facts over scores. UI that ranks or flags tokens must be derived from on-chain data the reader can verify (see the holders panel and the trending strip for the pattern).
Tests with the change. Pure logic lives in app/src/lib/launchpad/*.ts and is unit-tested with node --test; contracts are tested with Foundry. CI runs both on every pull request.

Setup

git clone --recurse-submodules https://github.com/Gitlawb/openlaunch.git
cd openlaunch/app && npm install && cp .env.example .env.local   # fill in RPCs + DATABASE_URL
npm run migrate && npm run dev
cd ../contracts && forge test --match-path test/LaunchFactory.t.sol

app/README.md covers running against anvil forks of both chains. app/LAUNCH.md is the production runbook.

Before you open a pull request

cd app && npm run lint && npx tsc --noEmit -p . && npm test && npm run build
cd ../contracts && forge build && forge test --match-path test/LaunchFactory.t.sol

For contract changes, also run the live-fork suites locally (FORK_TESTS=true forge test) and say so in the PR.

Style

TypeScript strict, ESLint clean, no new dependencies without a reason in the PR.
Commit messages: short imperative subject, a body that says why.
Keep the design system: shared class tokens live in app/src/components/ui.ts.

Security issues

Do not open a public issue. See SECURITY.md.

1.7 KiB Raw Permalink Blame History