Merged
Conversation
dorin-iancu
reviewed
Sep 25, 2024
Coverage SummaryTotals
FilesExpand
|
dorin-iancu
previously approved these changes
Nov 18, 2025
Contributor
There was a problem hiding this comment.
Pull request overview
This PR implements fixes from a security audit for the lottery-esdt smart contract. The changes significantly refactor the contract architecture and address several security and functionality concerns identified in the audit.
Key Changes:
- Refactored contract into modular structure (basics/ and specific/ modules) for better organization
- Changed token support from EGLD/ESDT to ESDT-only (TokenIdentifier instead of EgldOrEsdtTokenIdentifier)
- Implemented two-phase prize claiming mechanism: prizes accumulate in storage, users explicitly claim rewards
- Introduced address-to-ID mapping for storage optimization
- Made determine_winner callable multiple times with MAX_OPERATIONS limit per call for better gas management
- Renamed endpoint from "start"/"createLotteryPool" to "startLottery" for consistency
- Added shard validation requirement for determine_winner calls
Reviewed changes
Copilot reviewed 47 out of 48 changed files in this pull request and generated 13 comments.
Show a summary per file
| File | Description |
|---|---|
src/lottery.rs |
Complete refactor from monolithic to modular trait composition architecture |
src/specific/award.rs |
New awarding module with batched prize distribution and accumulated rewards pattern |
src/specific/claim.rs |
New claim module allowing users to withdraw accumulated rewards |
src/specific/buy.rs |
Extracted ticket purchase logic with address-to-ID mapper integration |
src/specific/setup.rs |
Extracted lottery setup logic, enforces ESDT-only tokens |
src/basics/storage.rs |
Centralized storage mappers using u64 IDs instead of addresses |
src/basics/utils.rs |
Refactored random selection from array-based to single random value |
src/lottery_proxy.rs |
Auto-generated proxy file (has type mismatches with actual contract) |
scenarios/*.scen.json |
Updated test scenarios to reflect new storage patterns and shard requirements |
wasm/src/lib.rs |
Updated endpoint list order and naming |
tests/*.rs |
Added ignore attributes for tests requiring shard simulation |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
contracts/examples/lottery-esdt/scenarios/buy-ticket-all-options.scen.json
Show resolved
Hide resolved
dorin-iancu
approved these changes
Dec 11, 2025
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes based on the following audit: https://docs.google.com/document/d/1ky-H_dGx3oPRSQkP83UKzkZRXl9V-SOc5cSvr8hq-Ow/edit#heading=h.bgyek48ody10