feat: implement Indexing Agreements #1134

matiasedgeandnode · 2025-03-26T15:02:34Z

Included in the changes is a markdown file with a TODO

Additional reading: Indexing Payments technical specification v0.1

openzeppelin-code · 2025-03-26T15:19:09Z

feat: implement Indexing Agreements

Generated at commit: f33e23d6c4935958af7730c35ca0392a7c622f6c

🚨 Report Summary

	Severity Level	Results
Contracts	Critical High Medium Low Note Total	2 4 0 15 39 60
Dependencies	Critical High Medium Low Note Total	0 0 0 0 0 0

For more details view the full report in OpenZeppelin Code Inspector

socket-security · 2025-04-18T13:15:33Z

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

packages/subgraph-service/contracts/libraries/IndexingAgreement.sol

packages/horizon/contracts/data-service/utilities/ProvisionManager.sol

packages/horizon/contracts/interfaces/IRecurringCollector.sol

packages/horizon/contracts/utilities/GraphDirectory.sol

packages/horizon/contracts/payments/collectors/RecurringCollector.sol

packages/subgraph-service/contracts/DisputeManager.sol

pcarranzav · 2025-05-22T13:41:26Z

packages/subgraph-service/contracts/DisputeManager.sol

+            wrapper.collectorAgreement.serviceProvider,
+            address(_getSubgraphService())
+        );
+        require(provision.tokens != 0, DisputeManagerZeroTokens());


This check means we can't slash delegators (if delegation slashing is enabled some day) in a case of multiple disputes where the indexer is already fully slashed. So maybe use a different check or check if there's nonzero delegation?

This condition is also present in _createQueryDisputeWithAttestation and _createIndexingDisputeWithAllocation. Should we fix those instances as well?

It sounds reasonable. I looked at previous audits to see if this was discussed but did not find anything.

Fixed it for Indexing and query fee disputes here: d89440a (#1183)

Going to include it in the fix review OZ is going to do for us.

I'll port the fix...

rebase on top of Tommy's fix, port fix to indexing feees and let Trust know about this change.

packages/subgraph-service/contracts/SubgraphService.sol

pcarranzav · 2025-05-22T16:18:44Z

packages/subgraph-service/contracts/libraries/UnsafeDecoder.sol

+
+import { IndexingAgreement } from "./IndexingAgreement.sol";
+
+library UnsafeDecoder {


Why is it unsafe?

And I'm not sure I see the benefit of implementing these separately from Decoder.sol, is there a size/performance improvement?

naming could use some improvement. It's "unsafe" in the sense that it reverts with a generic error.

Decoder and UnsafeDecoder are two separate libs, because:

Decoder is a lib to reduce size in the service.

try / catch can only be used on external function call.

A lib can't call itself externally.

All of these together resulted in the two separate implementations. Maybe there is a better way to do it that I'm missing?

im confused by this as well, cant we put everything into a Decoder library that has only external functions?

I think the benefit of catching and re throwing is that we can be more descriptive with the error. iirc abi.decode tends to fail with Reverted without reason. I don't mind either approach but I think if we try/catch we could combine both libraries into a single one.

I believe we can't combine both libraries into one. As I mentioned before try / catch needs to call an external function and a library can't call it's own external functions. I'd prefer to keep the custom errors because the amount of time I spent debugging Reverted without reason dwarfs the added complexity of having two libs. Would be very happy to find a better name for either lib though.

Find a new name. Decoder is too generic. Unsafe sounds dangerous. Maybe IndexingAgreementDecoder

packages/subgraph-service/contracts/libraries/IndexingAgreement.sol

socket-security · 2025-06-06T16:58:14Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	debug@4.4.0
	hardhat@2.14.1
	hardhat@2.23.0

View full report

matiasedgeandnode · 2025-06-06T18:49:37Z

ok, NatSpec added, pnpm lint:sol:natspec reporting same warnings as in horizon

matiasedgeandnode requested review from tmigone, Maikol and pcarranzav March 26, 2025 15:02

matiasedgeandnode force-pushed the ma/indexing-payments-003 branch 10 times, most recently from b0f7e7f to ae910c4 Compare April 2, 2025 13:41

matiasedgeandnode force-pushed the ma/indexing-payments-003 branch from b53a31a to d0a4db2 Compare April 3, 2025 20:06

matiasedgeandnode force-pushed the ma/indexing-payments-003 branch from 32252c4 to de6b7a1 Compare April 15, 2025 20:07

matiasedgeandnode force-pushed the ma/indexing-payments-003 branch from f4ea27a to 8776a18 Compare April 22, 2025 19:03

matiasedgeandnode force-pushed the ma/indexing-payments-003 branch 7 times, most recently from 753442f to 7ba3dd1 Compare May 19, 2025 16:34

matiasedgeandnode force-pushed the ma/indexing-payments-003 branch from 65f7f1d to ef651a6 Compare May 20, 2025 18:32

pcarranzav reviewed May 21, 2025

View reviewed changes

pcarranzav reviewed May 22, 2025

View reviewed changes

matiasedgeandnode force-pushed the ma/indexing-payments-003 branch from ef651a6 to aac9682 Compare May 30, 2025 18:29

matiasedgeandnode added 2 commits June 5, 2025 12:22

f: remove unused extension references

4c5573f

f: rename Manager to StorageManager

7dee19f

matiasedgeandnode force-pushed the ma/indexing-payments-003 branch from 5ebb424 to 7dee19f Compare June 5, 2025 16:29

matiasedgeandnode added 10 commits June 5, 2025 13:31

f: add to IndexingAgreementWrongDataService

21961c4

f: comment one agreement per alloc

03ed657

f: remove RecurringCollectorAgreementInvalidParameters

19a4270

f: validate before setting in storage

003dd61

f: natspec

bd49826

f: add now to RecurringCollectorAgreementDeadlineElapsed

b900097

f: natspec

1857e15

f: add CancelAgreementBy.ThirdParty

eb81d79

f: reword and document onCloseAllocation

415bc5b

f: add natspec explaining the stake lock mechanism

56c86a7

This comment was marked as resolved.

Sign in to view

matiasedgeandnode added 2 commits June 6, 2025 13:49

f: add natspec from smells

93f7342

f: fully commit to DataServiceFeesLib

8e65d22

matiasedgeandnode added 2 commits June 6, 2025 14:33

f: remove unused getGraphStaking()

948d257

f: more NatSpec

f0d158f

matiasedgeandnode force-pushed the ma/indexing-payments-003 branch from 6765c56 to f0d158f Compare June 6, 2025 17:33

matiasedgeandnode added 9 commits June 6, 2025 14:58

f: more NatSpec

c984e24

f: more NatSpec

f6fe0cd

f: more NatSpec

2e881b5

f: more NatSpec

8f8a0d2

f: more NatSpec

7ca134d

f: more NatSpec

6c373c8

f: more NatSpec

84a5edc

f: more NatSpec

bfe97fe

f: more NatSpec

f33e23d


		import { IndexingAgreement } from "./IndexingAgreement.sol";

		library UnsafeDecoder {

feat: implement Indexing Agreements #1134

Are you sure you want to change the base?

feat: implement Indexing Agreements #1134

Uh oh!

Conversation

matiasedgeandnode commented Mar 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openzeppelin-code bot commented Mar 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

feat: implement Indexing Agreements

🚨 Report Summary

Uh oh!

socket-security bot commented Apr 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

This comment was marked as resolved.

Uh oh!

tmigone Jun 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

matiasedgeandnode Jun 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

matiasedgeandnode May 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

This comment was marked as resolved.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

matiasedgeandnode Jun 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

This comment was marked as resolved.

socket-security bot commented Jun 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

matiasedgeandnode commented Jun 6, 2025

Uh oh!

Uh oh!

matiasedgeandnode commented Mar 26, 2025 •

edited

Loading

openzeppelin-code bot commented Mar 26, 2025 •

edited

Loading

socket-security bot commented Apr 18, 2025 •

edited

Loading

tmigone Jun 5, 2025 •

edited

Loading

matiasedgeandnode Jun 6, 2025 •

edited

Loading

matiasedgeandnode May 26, 2025 •

edited

Loading

matiasedgeandnode Jun 6, 2025 •

edited

Loading

socket-security bot commented Jun 6, 2025 •

edited

Loading