Escrow proxy

.cargo/audit.toml

@@ -0,0 +1,10 @@
+# cargo-audit configuration
+# https://docs.rs/cargo-audit/latest/cargo_audit/config/
+
+[advisories]
+# Ignore the lru unsound advisory - it comes from near-vm-runner which is
+# locked to lru ^0.12.3 and cannot be updated to the fixed 0.16.3 version.
+# The advisory relates to IterMut's Stacked Borrows violation, which does
+# not affect our usage as we don't use IterMut directly.
+# Tracked: https://github.com/near/nearcore/issues/XXXXX (upstream)
+ignore = ["RUSTSEC-2026-0002"]

.github/workflows/ci.yml

@@ -162,7 +162,8 @@ jobs:
         with:
           cache: false
       - name: Install cargo-audit
-        run: cargo install cargo-audit --version "^0.21" --locked
+        # Require 0.22+ for CVSS 4.0 support (advisory-db now contains CVSS 4.0 entries)
+        run: cargo install cargo-audit --version "^0.22" --locked
       - uses: rustsec/audit-check@v2.0.0
         with:
           token: ${{ secrets.GITHUB_TOKEN }}

Cargo.toml

@@ -13,6 +13,7 @@ members = [
     "defuse",
     "erc191",
     "escrow-swap",
+    "escrow-proxy",
     "fees",
     "io-utils",
     "map-utils",
@@ -33,6 +34,7 @@ members = [
     "tip191",
     "token-id",
     "ton-connect",
+    "oneshot-condvar",
     "wnear",
 ]
 default-members = ["defuse"]
@@ -56,6 +58,7 @@ defuse-deadline.path = "deadline"
 defuse-decimal.path = "decimal"
 defuse-erc191.path = "erc191"
 defuse-escrow-swap.path = "escrow-swap"
+defuse-escrow-proxy.path = "escrow-proxy"
 defuse-fees.path = "fees"
 defuse-io-utils.path = "io-utils"
 defuse-map-utils.path = "map-utils"
@@ -70,6 +73,7 @@ defuse-poa-token.path = "poa-token"
 defuse-sandbox.path = "sandbox"
 defuse-sep53.path = "sep53"
 defuse-serde-utils.path = "serde-utils"
+defuse-oneshot-condvar.path = "oneshot-condvar"
 defuse-tip191.path = "tip191"
 defuse-token-id = { path = "token-id", default-features = false }
 defuse-ton-connect = { path = "ton-connect", default-features = false, features = [
@@ -82,8 +86,9 @@ defuse-test-utils.path = "test-utils"
 
 cargo-near-build = "0.9.0"
 near-account-id = "2.4.0"
-near-api = "0.8.2"
-near-api-types = "0.8.2"
+near-api = "0.8.3"
+near-api-types = "0.8.3"
+near-openapi-client = "0.7"
 near-openapi-types = "0.6.0"
 near-contract-standards = "5.24"
 near-crypto = "0.34.1"

Makefile.toml

@@ -11,6 +11,12 @@ POA_TOKEN_WASM_NO_REGISTRATION_WASM = "${POA_TOKEN_WITH_NO_REGISTRATION_DIR}/def
 MT_RECEIVER_STUB_DIR = "${TARGET_DIR}/multi-token-receiver-stub"
 MT_RECEIVER_STUB_WASM = "${MT_RECEIVER_STUB_DIR}/multi_token_receiver_stub.wasm"
 
+ESCROW_PROXY_DIR = "${TARGET_DIR}/"
+ESCROW_PROXY_WASM = "${ESCROW_PROXY_DIR}/defuse_escrow_proxy.wasm"
+
+ONESHOT_CONDVAR_DIR = "${TARGET_DIR}/"
+ONESHOT_CONDVAR_WASM = "${ONESHOT_CONDVAR_DIR}/defuse_oneshot_condvar.wasm"
+
 [tasks.default]
 alias = "build"
 
@@ -25,6 +31,8 @@ dependencies = [
     "build-escrow-swap",
     "build-poa-factory",
     "build-poa-token-no-registration",
+    "build-escrow-proxy",
+    "build-oneshot-condvar",
     "contract-stats",
     "build-multi-token-receiver-stub",
 ]
@@ -114,6 +122,40 @@ args = [
     "--no-embed-abi",
 ]
 
+[tasks.build-escrow-proxy]
+dependencies = ["add-cache-dir-tag"]
+command = "cargo"
+args = [
+    "near",
+    "build",
+    "non-reproducible-wasm",
+    "--locked",
+    "--manifest-path",
+    "./escrow-proxy/Cargo.toml",
+    "--features",
+    "abi,contract,escrow-swap",
+    "--out-dir",
+    "${ESCROW_PROXY_DIR}",
+    "--no-embed-abi",
+]
+
+[tasks.build-oneshot-condvar]
+dependencies = ["add-cache-dir-tag"]
+command = "cargo"
+args = [
+    "near",
+    "build",
+    "non-reproducible-wasm",
+    "--locked",
+    "--manifest-path",
+    "./oneshot-condvar/Cargo.toml",
+    "--features",
+    "abi,contract,auth-call",
+    "--out-dir",
+    "${ONESHOT_CONDVAR_DIR}",
+    "--no-abi",
+]
+
 # ============================================================================
 # Build reproducible tasks
 # ============================================================================

defuse/Cargo.toml

@@ -69,6 +69,7 @@ contract = [
 
 sandbox = [
     "arbitrary",
+    "contract",
     "dep:defuse-sandbox",
     "dep:defuse-test-utils",
 ]

defuse/src/contract/tokens/mod.rs

@@ -4,7 +4,7 @@ mod nep245;
 
 use super::Contract;
 use defuse_core::{DefuseError, Result, token_id::TokenId};
-use defuse_near_utils::{Lock, UnwrapOrPanic};
+use defuse_near_utils::{Lock, UnwrapOrPanic, max_list_u128_json_len};
 use defuse_nep245::{MtBurnEvent, MtEvent, MtMintEvent};
 use itertools::{Either, Itertools};
 use near_sdk::{AccountId, AccountIdRef, Gas, env, json_types::U128, serde_json};
@@ -152,7 +152,7 @@ impl Contract {
         let tokens_count = tokens_iter.len();
 
         let requested_refunds =
-            env::promise_result_checked(0, Self::mt_on_transfer_max_result_len(tokens_count))
+            env::promise_result_checked(0, max_list_u128_json_len(tokens_count))
                 .ok()
                 .and_then(|value| serde_json::from_slice::<Vec<U128>>(&value).ok())
                 .filter(|refunds| refunds.len() == tokens_count);
@@ -211,16 +211,6 @@ impl Contract {
             MtEvent::MtBurn([burn_event].as_slice().into()).emit();
         }
     }
-
-    const fn mt_on_transfer_max_result_len(amounts_count: usize) -> usize {
-        // we allow at most one newline char and up to 8 spaces/tabs if the JSON was prettified
-        const MAX_LEN_PER_AMOUNT: usize =
-            "        \"+340282366920938463463374607431768211455\",\n".len(); // u128::MAX
-
-        amounts_count
-            .saturating_mul(MAX_LEN_PER_AMOUNT)
-            .saturating_add("[\n]".len())
-    }
 }
 
 const MAX_TOKEN_ID_LEN: usize = 127;

defuse/src/contract/tokens/nep245/resolver.rs

@@ -1,6 +1,6 @@
 use std::borrow::Cow;
 
-use defuse_near_utils::{Lock, UnwrapOrPanic, UnwrapOrPanicError};
+use defuse_near_utils::{Lock, UnwrapOrPanic, UnwrapOrPanicError, max_list_u128_json_len};
 use defuse_nep245::{
     ClearedApproval, MtEventEmit, MtTransferEvent, TokenId, resolver::MultiTokenResolver,
 };
@@ -27,12 +27,11 @@ impl MultiTokenResolver for Contract {
             "invalid args"
         );
 
-        let mut refunds =
-            env::promise_result_checked(0, Self::mt_on_transfer_max_result_len(amounts.len()))
-                .ok()
-                .and_then(|value| serde_json::from_slice::<Vec<U128>>(&value).ok())
-                .filter(|refund| refund.len() == amounts.len())
-                .unwrap_or_else(|| amounts.clone());
+        let mut refunds = env::promise_result_checked(0, max_list_u128_json_len(amounts.len()))
+            .ok()
+            .and_then(|value| serde_json::from_slice::<Vec<U128>>(&value).ok())
+            .filter(|refund| refund.len() == amounts.len())
+            .unwrap_or_else(|| amounts.clone());
 
         let sender_id = previous_owner_ids.first().cloned().unwrap_or_panic();