Security audit: Rounds 1-4 findings in gravity-aptos (GAPTOS-001 ~ R4-018)

.config/nextest.toml

@@ -5,6 +5,9 @@ status-level = "skip"
 failure-output = "immediate-final"
 # Cancel test run on the first failure. Accounts for retries.
 fail-fast = true
+# To avoid CPU saturation and test timeouts (due to heavy/multithreaded
+# tests), we increase the number of threads required per test.
+threads-required = 3
 
 junit = { path = "junit.xml" }
 

.dockerignore

@@ -25,12 +25,13 @@
 !aptos-move/framework/
 !aptos-move/move-examples/hello_blockchain/
 !crates/aptos/src/move_tool/*.bpl
-!crates/aptos/src/node/local_testnet/hasura_metadata.json
+!crates/aptos-localnet/src/hasura_metadata.json
 !crates/aptos-faucet/doc/
+!crates/transaction-emitter-lib/src/emitter/test_proofs_for_localnet_txn_emitter.txt
 !api/doc/
 !crates/indexer/migrations/**/*.sql
 !ecosystem/indexer-grpc/indexer-grpc-parser/migrations/**/*.sql
-!ecosystem/nft-metadata-crawler-parser/migrations/**/*.sql
+!ecosystem/nft-metadata-crawler/migrations/**/*.sql
 !rust-toolchain.toml
 !scripts/
 !terraform/helm/aptos-node/

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,6 +1,20 @@
 ## Description
 <!-- Please include a summary of the change, including which issue it fixes or what feature it adds. Include relevant motivation, context and documentation as appropriate. List dependencies that are required for this change, if any. -->
 
+## How Has This Been Tested?
+<!--
+- Please ensure that the functionality introduced by this change is well tested and verified to work as expected.
+- Ensure tests cover both happy and unhappy paths.
+- List and link relevant tests.
+-->
+
+## Key Areas to Review
+<!--
+- Identify any critical parts of the code that require special attention or understanding. Explain why these parts are crucial to the functionality or architecture of the project.
+- Point out any areas where complex logic has been implemented. Provide a brief explanation of the logic and your approach to make it easier for reviewers to follow.
+- Highlight any areas where you are particularly concerned or unsure about the code's impact on the change. This can include potential performance or security issues, or compatibility with existing features.
+-->
+
 ## Type of Change
 - [ ] New feature
 - [ ] Bug fix
@@ -18,22 +32,9 @@
 - [ ] Aptos Framework
 - [ ] Aptos CLI/SDK
 - [ ] Developer Infrastructure
+- [ ] Move Compiler
 - [ ] Other (specify)
 
-## How Has This Been Tested?
-<!--
-- Please ensure that the functionality introduced by this change is well tested and verified to work as expected.
-- Ensure tests cover both happy and unhappy paths.
-- List and link relevant tests.
--->
-
-## Key Areas to Review
-<!--
-- Identify any critical parts of the code that require special attention or understanding. Explain why these parts are crucial to the functionality or architecture of the project.
-- Point out any areas where complex logic has been implemented. Provide a brief explanation of the logic and your approach to make it easier for reviewers to follow.
-- Highlight any areas where you are particularly concerned or unsure about the code's impact on the change. This can include potential performance or security issues, or compatibility with existing features.
--->
-
 ## Checklist
 - [ ] I have read and followed the [CONTRIBUTING](https://github.com/aptos-labs/aptos-core/blob/main/CONTRIBUTING.md) doc
 - [ ] I have performed a self-review of my own code

.github/actions/buildx-setup/action.yml

@@ -3,7 +3,7 @@ description: Sets up buildx for docker builds
 
 runs:
   using: composite
-  steps: 
+  steps:
     - name: setup docker context for buildx
       id: buildx-context
       shell: bash
@@ -26,4 +26,4 @@ runs:
               filters = [ "type==source.local", "type==exec.cachemount", "type==source.git.checkout"]
             [[worker.oci.gcpolicy]]
               all = true
-              keepBytes = 900000000000
+              keepBytes = 900000000000

.github/actions/determine-or-use-target-branch-and-get-last-released-image/action.yaml

@@ -0,0 +1,88 @@
+name: "Determine or Use Target Branch and Get Latest Docker Image"
+description: |
+  Determine the branch to fetch the latest docker image tag from, or use a target branch directly.
+  - If base-branch is set, determine the target branch to fetch the latest docker image tag from
+    - Determine the IMAGE_TAG based on the latest release R and check for images built on branch R - 1:
+      - For commits on the aptos-release-v1.19 branch, the IMAGE_TAG should be the latest commit built on aptos-release-v1.18
+      - For commits on the main branch, the IMAGE_TAG should be the latest commit on the max release aptos-release-v<X.X> branch
+      - For commits on other branches, the IMAGE_TAG should be the latest commit on the branch's last release aptos-release-v<X.X> branch
+  - If branch is set, use it directly
+
+inputs:
+  base-branch:
+    description: "The base branch to determine the target from, or use a target branch directly"
+    required: false
+  branch:
+    description: "Use this branch directly if set"
+    required: false
+  variants:
+    description: "The variants to check, as a space-separated string, e.g. 'performance failpoints'"
+    required: false
+
+outputs:
+  TARGET_BRANCH:
+    description: "The determined or target target branch"
+    value: ${{ steps.set-target-branch.outputs.TARGET_BRANCH }}
+  IMAGE_TAG:
+    description: "The latest docker image tag for the given branch and variants"
+    value: ${{ steps.determine-test-image-tag.outputs.IMAGE_TAG }}
+
+runs:
+  using: composite
+  steps:
+    # Checkout repository based on base branch or target branch
+    - name: Checkout branch
+      uses: actions/checkout@v4
+      with:
+        ref: ${{ inputs.base-branch || inputs.branch }}
+        path: checkout_branch
+        fetch-depth: 0
+
+    - name: Setup Python environment
+      uses: ./checkout_branch/.github/actions/python-setup
+      with:
+        pyproject_directory: checkout_branch/testsuite
+
+    # Determine the target branch if base-branch is used
+    - name: Set target branch
+      id: set-target-branch
+      run: |
+        if [[ -n "${{ inputs.base-branch }}" ]]; then
+          base_branch="${{ inputs.base-branch }}"
+          echo "Determining target branch from base branch: $base_branch"
+          ./testrun determine_target_branch_to_fetch_last_released_image.py "$base_branch"
+        else
+          echo "Using target branch: ${{ inputs.branch }}"
+          echo "TARGET_BRANCH=${{ inputs.branch }}" >> $GITHUB_OUTPUT
+        fi
+      shell: bash
+      working-directory: checkout_branch/testsuite
+
+    # Checkout the determined or target branch
+    - name: Checkout target branch
+      if: ${{ steps.set-target-branch.outputs.TARGET_BRANCH != inputs.branch }}
+      uses: actions/checkout@v4
+      with:
+        ref: ${{ steps.set-target-branch.outputs.TARGET_BRANCH }}
+        path: checkout_branch
+        fetch-depth: 0
+
+    # Setup Python environment again after second checkout, as branches are different
+    - name: Setup Python environment again
+      if: ${{ steps.set-target-branch.outputs.TARGET_BRANCH != inputs.branch }}
+      uses: ./checkout_branch/.github/actions/python-setup
+      with:
+        pyproject_directory: checkout_branch/testsuite
+
+    # Determine image tag using the target branch
+    - name: Determine image tag
+      id: determine-test-image-tag
+      run: |
+        variants=(${{ inputs.variants }}) # split the variants string into an array
+        variants_args=()
+        for variant in "${variants[@]}"; do
+          variants_args+=("--variant" "$variant")
+        done
+        ./testrun find_latest_image.py "${variants_args[@]}"
+      shell: bash
+      working-directory: checkout_branch/testsuite

.github/actions/fullnode-sync/action.yaml

@@ -27,11 +27,6 @@ inputs:
 runs:
   using: composite
   steps:
-    - name: Install Dependencies
-      shell: bash
-      run: |
-        echo "${HOME}/bin/" >> $GITHUB_PATH # default INSTALL_DIR to path
-        scripts/dev_setup.sh -b # Install dependencies
     - name: Run fullnode sync
       shell: bash
       run: |

.github/actions/fullnode-sync/fullnode_sync.py

@@ -250,6 +250,9 @@ def setup_fullnode_config(bootstrapping_mode, continuous_syncing_mode, data_dir_
   data_streaming_service_config = {"max_concurrent_requests": 10, "max_concurrent_state_requests": 12}
   fullnode_config['state_sync'] = {"state_sync_driver": state_sync_driver_config, "data_streaming_service":data_streaming_service_config}
 
+  # Avoid having to set ulimit configurations
+  fullnode_config['storage'] = {"ensure_rlimit_nofile": 0}
+
   # Write the config file back to disk
   with open(FULLNODE_CONFIG_NAME, "w") as file:
     yaml.dump(fullnode_config, file)

.github/actions/general-lints/action.yaml

@@ -16,27 +16,3 @@ runs:
         sudo apt-get install shellcheck --assume-yes --no-install-recommends
         shellcheck scripts/dev_setup.sh
       shell: bash
-
-    # Run the python lints and tests
-    - name: Run python lints and tests
-      uses: ./.github/actions/python-lint-tests
-
-    # Setup node
-    - name: Setup node
-      uses: actions/setup-node@v3
-      with:
-        node-version-file: .node-version
-
-    # Setup pnpm
-    - name: Setup pnpm
-      uses: pnpm/action-setup@v4
-
-    # Install packages for examples and run package build, lint and tests
-    - name: Run ecosystem lint
-      run: |
-        cd ./ecosystem/typescript/sdk/examples/typescript && pnpm install && cd -
-        cd ./ecosystem/typescript/sdk/examples/javascript && pnpm install && cd -
-        cd ./ecosystem/typescript/sdk && pnpm install && cd -
-        cd ./ecosystem/typescript/sdk && pnpm lint && cd -
-        cd ./ecosystem/typescript/sdk && pnpm fmt:check && cd -
-      shell: bash

.github/actions/get-latest-docker-image-tag/action.yml

@@ -18,7 +18,7 @@ outputs:
 runs:
   using: composite
   steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
       with:
         ref: ${{ inputs.branch }}
         path: checkout_branch

.github/actions/move-prover-setup/action.yaml

@@ -14,7 +14,7 @@ runs:
     # rust-cache action will cache ~/.cargo and ./target
     # https://github.com/Swatinem/rust-cache#cache-details
     - name: Run cargo cache
-      uses: Swatinem/rust-cache@359a70e43a0bb8a13953b04a90f76428b4959bb6 # pin@v2.2.0
+      uses: Swatinem/rust-cache@23bce251a8cd2ffc3c1075eaa2367cf899916d84 # pin@v2.7.3
 
     - name: install related tools and prover dependencies
       shell: bash

.github/actions/python-setup/action.yaml

@@ -13,7 +13,9 @@ runs:
   using: composite
   steps:
     - name: Setup python
-      uses: actions/setup-python@v4
+      uses: actions/setup-python@v5
+      with:
+        python-version: 3.10.12
 
     # Install Poetry.
     - uses: snok/install-poetry@d45b6d76012debf457ab49dffc7fb7b2efe8071d # pin@v1.3.3