Escrow proxy

.cargo/audit.toml

@@ -0,0 +1,10 @@
+# cargo-audit configuration
+# https://docs.rs/cargo-audit/latest/cargo_audit/config/
+
+[advisories]
+# Ignore the lru unsound advisory - it comes from near-vm-runner which is
+# locked to lru ^0.12.3 and cannot be updated to the fixed 0.16.3 version.
+# The advisory relates to IterMut's Stacked Borrows violation, which does
+# not affect our usage as we don't use IterMut directly.
+# Tracked: https://github.com/near/nearcore/issues/XXXXX (upstream)
+ignore = ["RUSTSEC-2026-0002"]

.github/workflows/ci.yml

@@ -162,7 +162,8 @@ jobs:
         with:
           cache: false
       - name: Install cargo-audit
-        run: cargo install cargo-audit --version "^0.21" --locked
+        # Require 0.22+ for CVSS 4.0 support (advisory-db now contains CVSS 4.0 entries)
+        run: cargo install cargo-audit --version "^0.22" --locked
       - uses: rustsec/[email protected]
         with:
           token: ${{ secrets.GITHUB_TOKEN }}

Cargo.toml

@@ -13,6 +13,7 @@ members = [
     "defuse",
     "erc191",
     "escrow-swap",
+    "escrow-proxy",
     "fees",
     "io-utils",
     "map-utils",
@@ -33,6 +34,7 @@ members = [
     "tip191",
     "token-id",
     "ton-connect",
+    "oneshot-condvar",
     "wnear",
 ]
 default-members = ["defuse"]
@@ -56,6 +58,7 @@ defuse-deadline.path = "deadline"
 defuse-decimal.path = "decimal"
 defuse-erc191.path = "erc191"
 defuse-escrow-swap.path = "escrow-swap"
+defuse-escrow-proxy.path = "escrow-proxy"
 defuse-fees.path = "fees"
 defuse-io-utils.path = "io-utils"
 defuse-map-utils.path = "map-utils"
@@ -70,6 +73,7 @@ defuse-poa-token.path = "poa-token"
 defuse-sandbox.path = "sandbox"
 defuse-sep53.path = "sep53"
 defuse-serde-utils.path = "serde-utils"
+defuse-oneshot-condvar.path = "oneshot-condvar"
 defuse-tip191.path = "tip191"
 defuse-token-id = { path = "token-id", default-features = false }
 defuse-ton-connect = { path = "ton-connect", default-features = false, features = [
@@ -84,12 +88,13 @@ cargo-near-build = "0.9.0"
 near-account-id = "2.4.0"
 near-api = "0.8.2"
 near-api-types = "0.8.2"
+near-openapi-client = "0.7"
 near-openapi-types = "0.6.0"
 near-contract-standards = "5.24"
 near-crypto = "0.34.1"
 near-plugins = { git = "https://github.com/Near-One/near-plugins", tag = "v0.5.0" }
 near-sandbox = "0.3.4"
-near-sdk = "5.24"
+near-sdk = { version = "5.24", features = ["deterministic-account-ids"] }
 near-workspaces = "0.22"
 
 anyhow = "1"
@@ -136,6 +141,12 @@ unreadable_literal = "allow"
 similar_names = "allow"
 too_long_first_doc_paragraph = "allow"
 
+# workaround for near-api-rs not being able to handle state_init for global contracts
+# should be removed once near-api 0.8.3 is released
+[patch.crates-io]
+near-api = { git = "https://github.com/near/near-api-rs", rev = "091bc53bb01167f8d1332520065ce92f492531a5" }
+near-api-types = { git = "https://github.com/near/near-api-rs", rev = "091bc53bb01167f8d1332520065ce92f492531a5" }
+
 [profile.release]
 codegen-units = 1
 opt-level = 3

Makefile.toml

@@ -11,6 +11,12 @@ POA_TOKEN_WASM_NO_REGISTRATION_WASM = "${POA_TOKEN_WITH_NO_REGISTRATION_DIR}/def
 MT_RECEIVER_STUB_DIR = "${TARGET_DIR}/multi-token-receiver-stub"
 MT_RECEIVER_STUB_WASM = "${MT_RECEIVER_STUB_DIR}/multi_token_receiver_stub.wasm"
 
+ESCROW_PROXY_DIR = "${TARGET_DIR}/"
+ESCROW_PROXY_WASM = "${ESCROW_PROXY_DIR}/defuse_escrow_proxy.wasm"
+
+ONESHOT_CONDVAR_DIR = "${TARGET_DIR}/"
+ONESHOT_CONDVAR_WASM = "${ONESHOT_CONDVAR_DIR}/defuse_oneshot_condvar.wasm"
+
 [tasks.default]
 alias = "build"
 
@@ -25,6 +31,8 @@ dependencies = [
     "build-escrow-swap",
     "build-poa-factory",
     "build-poa-token-no-registration",
+    "build-escrow-proxy",
+    "build-oneshot-condvar",
     "contract-stats",
     "build-multi-token-receiver-stub",
 ]
@@ -114,6 +122,40 @@ args = [
     "--no-embed-abi",
 ]
 
+[tasks.build-escrow-proxy]
+dependencies = ["add-cache-dir-tag"]
+command = "cargo"
+args = [
+    "near",
+    "build",
+    "non-reproducible-wasm",
+    "--locked",
+    "--manifest-path",
+    "./escrow-proxy/Cargo.toml",
+    "--features",
+    "abi,contract,escrow-swap",
+    "--out-dir",
+    "${ESCROW_PROXY_DIR}",
+    "--no-embed-abi",
+]
+
+[tasks.build-oneshot-condvar]
+dependencies = ["add-cache-dir-tag"]
+command = "cargo"
+args = [
+    "near",
+    "build",
+    "non-reproducible-wasm",
+    "--locked",
+    "--manifest-path",
+    "./oneshot-condvar/Cargo.toml",
+    "--features",
+    "abi,contract,auth-call",
+    "--out-dir",
+    "${ONESHOT_CONDVAR_DIR}",
+    "--no-abi",
+]
+
 # ============================================================================
 # Build reproducible tasks
 # ============================================================================

defuse/Cargo.toml

@@ -69,6 +69,7 @@ contract = [
 
 sandbox = [
     "arbitrary",
+    "contract",
     "dep:defuse-sandbox",
     "dep:defuse-test-utils",
 ]