chore: Typechain generation with foundry & export foundry artifacts #1215

fusmanii · 2025-12-10T21:07:19Z

Removing hardhat typechain plugin and generating typechain types using foundry artifacts. Also exposing foundry artifacts that other repos (like sdk) can use instead of hardhat artifacts

Note: foundry and typechain wasn't playing nice with deploy script having leading number, so I renamed all deploy script

Closes: https://linear.app/uma/issue/ACP-22/export-foundry-artifacts

Signed-off-by: Faisal Usmani <faisal.of.usmani@gmail.com>

socket-security · 2025-12-10T21:07:57Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Critical CVE: npm `cipher-base` is missing type checks, leading to hash rewind and passing on crafted data CVE: GHSA-cpq7-6gpm-g9rc cipher-base is missing type checks, leading to hash rewind and passing on crafted data (CRITICAL) Affected versions: < 1.0.5 Patched version: 1.0.5 From: `?` → `npm/cipher-base@1.0.4` ℹ Read more on: This package \| This alert \| What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/cipher-base@1.0.4`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `safer-buffer` is 94.0% likely obfuscated Confidence: 0.94 Location: Package overview From: `?` → `npm/safer-buffer@2.1.2` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/safer-buffer@2.1.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

Signed-off-by: Faisal Usmani <faisal.of.usmani@gmail.com>

.github/actions/generate-evm-artifacts/action.yml

Signed-off-by: Faisal Usmani <faisal.of.usmani@gmail.com>

…isal/foundry-typechain

Signed-off-by: Faisal Usmani <faisal.of.usmani@gmail.com>

…isal/foundry-typechain

Signed-off-by: Faisal Usmani <faisal.of.usmani@gmail.com>

…isal/foundry-typechain

Signed-off-by: Faisal Usmani <faisal.of.usmani@gmail.com>

…isal/foundry-typechain

Signed-off-by: Faisal Usmani <faisal.of.usmani@gmail.com>

…isal/foundry-typechain

fusmanii · 2026-01-13T23:40:46Z

@claude explain the changes this pr is proposing

claude · 2026-01-13T23:41:03Z

Claude finished @fusmanii's task in 1m 50s —— View job

PR Changes Explanation

This PR migrates the TypeChain type generation process from Hardhat-based artifacts to Foundry-based artifacts. Here's what's changing:

Key Changes

1. TypeChain Generation Source Migration

Before: TypeChain types were generated using the Hardhat TypeChain plugin (@typechain/hardhat) which automatically generated types from Hardhat compilation artifacts.

After: TypeChain types are now generated manually from Foundry build artifacts using a custom deduplication script.

2. New TypeChain Generation Workflow

The new process involves three steps:

Compile contracts with both Hardhat and Foundry
- Hardhat compilation: yarn build-evm (produces artifacts in artifacts/)
- Foundry compilation: forge build (produces artifacts in out/)
Deduplicate Foundry artifacts (scripts/typechainArtifacts.ts)
- Scans all JSON files in the out/ directory
- Removes duplicate contract names (keeps first occurrence)
- Stages unique artifacts to typechain-artifacts/ directory
- This is necessary because Foundry can produce multiple artifacts for the same contract name
Generate TypeChain types from deduplicated artifacts
- Runs typechain CLI directly: npx typechain --target ethers-v5 "typechain-artifacts/**/*.json" --out-dir typechain
- Produces the same TypeChain types but sourced from Foundry artifacts instead of Hardhat

3. Package Changes (package.json)

Removed:

@typechain/hardhat package (Hardhat TypeChain plugin)

Changed:

generate-evm-artifacts script now uses the new three-step process instead of just running yarn hardhat typechain

4. GitHub Actions Updates (.github/actions/generate-evm-artifacts/action.yml)

The CI workflow now:

Builds with Hardhat (yarn build-evm)
Installs Foundry
Builds with Foundry (forge build)
Runs the deduplication script (npx ts-node scripts/typechainArtifacts.ts)
Generates TypeChain types (npx typechain --target ethers-v5 "typechain-artifacts/**/*.json" --out-dir typechain)

5. Artifact Export (package.json - files field)

The package now exports both Hardhat artifacts (/artifacts/**/*) and Foundry artifacts (/out/**/*), allowing consumer packages (like the SDK) to use Foundry artifacts instead of Hardhat artifacts.

6. .gitignore Updates

Added typechain-artifacts/ to .gitignore since it's a temporary staging directory for the deduplication process.

Why This Change?

Based on the PR description and comments:

Consumer compatibility: Other repos (like the SDK) can now consume Foundry artifacts directly instead of relying on Hardhat artifacts
Build system consolidation: The team appears to be moving toward Foundry as the primary build tool while maintaining Hardhat for compatibility
Flexibility: By decoupling TypeChain generation from Hardhat, the team has more control over which artifacts are used for type generation

Current State & Discussion Points

From the review comments, there's ongoing discussion about:

Whether to keep both Hardhat and Foundry typechain generation or fully migrate to Foundry only
Testing with consumer repos before merging to ensure compatibility
Potentially removing typechain generation from the contracts repo entirely and letting consumers generate their own types

grasphoper · 2026-01-15T04:53:27Z

.github/actions/generate-evm-artifacts/action.yml

-    - name: Build EVM
+    - name: Build Hardhat
      shell: bash
      run: yarn build-evm


2 questions:

do we need this step here if we're using foundry exclusively?

should we rename build-evm into build-hardhat? Otherwise it's confusing

Good point, I am not removing this just yet because I dont want to force other repos to migrate. The plan is to still support hardhat artifacts and only remove once all other repos have migrated to foundry

+1 on build-hardhat

grasphoper · 2026-01-15T04:57:54Z

.github/workflows/pr.yml

+      - name: Download EVM artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: evm-artifacts-${{ runner.os }}-node-${{ env.NODE_VERSION }}


Why did we not need this before? Is this just an optimization to not recompile?
Won't a different foundry profile force a recompile anyway (local). Esp. after Taylor's changes where we change a strip_strings settings between local and default

Yeah my thinking was that this will re-use artifacts but you are right tests are run using a different profile. I think I can generate the artifacts in the same manner (with FOUNDRY_PROFILE=local) then it can be reused

grasphoper · 2026-01-15T04:59:22Z

broadcast/deployed-addresses.json

+        "PermissionedMulticallHandler": {
+          "address": "0x64a43393866dba0044879979faa7ad3d000622e9",
+          "block_number": 24021499,
+          "transaction_hash": "0x70b3edf99db66aac34338c3686cd708ddfc2b503c2f707f51ced67dc50e5022f"


Why are these changing? I see, this is just reshuffling? Is our generation deterministic? If so, let's just update master with it, wdyt? To remove these changes

Typechain doesn't like deploy scripts having a leading number so I removed them which caused reshuffling. Yeah I can update master

grasphoper · 2026-01-15T04:59:55Z

broadcast/deployed-addresses.json

+          "address": "0x039d62c549f27ead0eb9b567d8776289e5020583",
          "block_number": 21416410,
-          "transaction_hash": "0x9c7604f9254450f13b0941008f5272f68ec58db61f32e5ee6713e72b4b56de0b"
+          "transaction_hash": "0x6875ef9c89d6855fb5019ce5d20f1466ecdced640b3be009fe6de82932469664"


Related to https://github.com/across-protocol/contracts/pull/1215/changes#r2693003352, but it seems like DonationBox address actually changed here?

0x3d589d40312bf2d20f13cd0af26a11144a9ca844 -> 0x039d62c549f27ead0eb9b567d8776289e5020583

yeah might be some local changes I had, going to revert this

grasphoper · 2026-01-15T05:08:49Z

hardhat.config.ts

 const { subtask } = require("hardhat/config");
 const { TASK_COMPILE_SOLIDITY_GET_SOURCE_PATHS } = require("hardhat/builtin-tasks/task-names");

+const isTest = process.env.IS_TEST === "true" || process.env.CI === "true";


I remember there was a problem with defining isTest like this. It means that we don't export certain artifacts for consumers. With this PR we're moving to ONLY exporting foundry artifacts, so this is OK?

The issue was with hardhat and typechian, but since we are moving away from hardhat we longer need this. But I will add this back and remove in future pr once everything is migrated

grasphoper · 2026-01-15T05:10:20Z

scripts/typechainArtifacts.ts

One thing I worry about here is the custom dedupe logic we're using here. Is there analogous logic in hardhat that we can use as reference?

On the other hand, even if the dedupe doesn't 100% work as expected, what's our biggest risk?

Signed-off-by: Faisal Usmani <faisal.of.usmani@gmail.com>

linear · 2026-01-15T22:54:52Z

ACP-22 Export foundry artifacts

…isal/foundry-typechain

socket-security · 2026-01-15T23:11:27Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	yargs@17.7.2

View full report

Signed-off-by: Faisal Usmani <faisal.of.usmani@gmail.com>

chore: Typechain generation with foundry

52a153d

Signed-off-by: Faisal Usmani <faisal.of.usmani@gmail.com>

fusmanii added 3 commits December 10, 2025 16:30

install foundry

7ec12ba

Signed-off-by: Faisal Usmani <faisal.of.usmani@gmail.com>

add shell

0c9cbd5

Signed-off-by: Faisal Usmani <faisal.of.usmani@gmail.com>

update path

9a520d0

Signed-off-by: Faisal Usmani <faisal.of.usmani@gmail.com>

fusmanii requested review from grasphoper and tbwebb22 December 10, 2025 22:02

fusmanii marked this pull request as ready for review December 10, 2025 22:02

fusmanii requested review from bmzig, mrice32, nicholaspai and pxrl as code owners December 10, 2025 22:02

tbwebb22 reviewed Dec 10, 2025

View reviewed changes

.github/actions/generate-evm-artifacts/action.yml Outdated Show resolved Hide resolved

grasphoper reviewed Dec 10, 2025

View reviewed changes

.github/actions/generate-evm-artifacts/action.yml Outdated Show resolved Hide resolved

fusmanii added 6 commits December 11, 2025 15:11

remove hardhat hypechain generation

0158dbb

Signed-off-by: Faisal Usmani <faisal.of.usmani@gmail.com>

version bump

94a5035

Signed-off-by: Faisal Usmani <faisal.of.usmani@gmail.com>

typo

c183404

Signed-off-by: Faisal Usmani <faisal.of.usmani@gmail.com>

remove @typechain/hardhat

0e41cff

Signed-off-by: Faisal Usmani <faisal.of.usmani@gmail.com>

fixed tests

5706013

Signed-off-by: Faisal Usmani <faisal.of.usmani@gmail.com>

fix more tests

798b46d

Signed-off-by: Faisal Usmani <faisal.of.usmani@gmail.com>

fusmanii marked this pull request as draft December 11, 2025 21:09

fusmanii added 7 commits December 17, 2025 10:46

Merge branch 'master' of github.com:across-protocol/contracts into fa…

3bacb72

…isal/foundry-typechain

updated typechain command

3147301

Signed-off-by: Faisal Usmani <faisal.of.usmani@gmail.com>

typechain artifacts

4a83f8f

Signed-off-by: Faisal Usmani <faisal.of.usmani@gmail.com>

update tests

60c6e4b

Signed-off-by: Faisal Usmani <faisal.of.usmani@gmail.com>

folder name

f52ae99

Signed-off-by: Faisal Usmani <faisal.of.usmani@gmail.com>

version bump

4e21e97

Signed-off-by: Faisal Usmani <faisal.of.usmani@gmail.com>

version bump

588f1cf

Signed-off-by: Faisal Usmani <faisal.of.usmani@gmail.com>

fusmanii marked this pull request as ready for review December 17, 2025 21:31

version bump

e34633b

Signed-off-by: Faisal Usmani <faisal.of.usmani@gmail.com>

fusmanii added 12 commits January 7, 2026 10:41

Merge branch 'master' of github.com:across-protocol/contracts into fa…

9b8da33

…isal/foundry-typechain

version bump

1945020

Signed-off-by: Faisal Usmani <faisal.of.usmani@gmail.com>

version bump

d9baa47

Signed-off-by: Faisal Usmani <faisal.of.usmani@gmail.com>

remove both artifacts

db4e190

Signed-off-by: Faisal Usmani <faisal.of.usmani@gmail.com>

remove hardhat artifacts

a7b1875

Signed-off-by: Faisal Usmani <faisal.of.usmani@gmail.com>

add foundry out

3071f1e

Signed-off-by: Faisal Usmani <faisal.of.usmani@gmail.com>

Merge branch 'master' of github.com:across-protocol/contracts into fa…

9439421

…isal/foundry-typechain

add foundry out

2d22cfd

Signed-off-by: Faisal Usmani <faisal.of.usmani@gmail.com>

rename script names

b99d6c0

Signed-off-by: Faisal Usmani <faisal.of.usmani@gmail.com>

Merge branch 'master' of github.com:across-protocol/contracts into fa…

e0a3b0b

…isal/foundry-typechain

reuse foundry build

94a56f2

Signed-off-by: Faisal Usmani <faisal.of.usmani@gmail.com>

version bump

5ff5bca

Signed-off-by: Faisal Usmani <faisal.of.usmani@gmail.com>

fusmanii changed the title ~~chore: Typechain generation with foundry~~ chore: Typechain generation with foundry & export foundry artifacts Jan 13, 2026

fusmanii mentioned this pull request Jan 13, 2026

chore: Support foundry typechain & artifacts migration across-protocol/sdk#1306

Draft

fusmanii added 2 commits January 13, 2026 11:23

version update

9835710

Signed-off-by: Faisal Usmani <faisal.of.usmani@gmail.com>

Merge branch 'master' of github.com:across-protocol/contracts into fa…

da8f845

…isal/foundry-typechain

rename broadcast folders

ad5c85d

grasphoper reviewed Jan 15, 2026

View reviewed changes

Add back hardhat typechain

3ec5fb3

Signed-off-by: Faisal Usmani <faisal.of.usmani@gmail.com>

Merge branch 'master' of github.com:across-protocol/contracts into fa…

3db5705

…isal/foundry-typechain

remove typechain-types

5b9d623

Signed-off-by: Faisal Usmani <faisal.of.usmani@gmail.com>

chore: Typechain generation with foundry & export foundry artifacts #1215

Are you sure you want to change the base?

chore: Typechain generation with foundry & export foundry artifacts #1215

Uh oh!

Conversation

fusmanii commented Dec 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security bot commented Dec 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

fusmanii commented Jan 13, 2026

Uh oh!

claude bot commented Jan 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Changes Explanation

Key Changes

1. TypeChain Generation Source Migration

2. New TypeChain Generation Workflow

3. Package Changes (package.json)

4. GitHub Actions Updates (.github/actions/generate-evm-artifacts/action.yml)

5. Artifact Export (package.json - files field)

6. .gitignore Updates

Why This Change?

Current State & Discussion Points

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

grasphoper Jan 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

linear bot commented Jan 15, 2026

Uh oh!

socket-security bot commented Jan 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

fusmanii commented Dec 10, 2025 •

edited

Loading

socket-security bot commented Dec 10, 2025 •

edited

Loading

claude bot commented Jan 13, 2026 •

edited

Loading

grasphoper Jan 15, 2026 •

edited

Loading

socket-security bot commented Jan 15, 2026 •

edited

Loading