diff --git a/target_chains/ethereum/contracts/README.md b/target_chains/ethereum/contracts/README.md index c23f1194a2..a64625e68b 100644 --- a/target_chains/ethereum/contracts/README.md +++ b/target_chains/ethereum/contracts/README.md @@ -130,3 +130,18 @@ optimization with it. For more information, please refer to [Gas Snapshots docum Once you optimized the code, please share the snapshot difference (generated using `forge snapshot --diff `) in the PR too. This snapshot gas value also includes an initial transaction cost as well as reading from the contract storage itself. You can get the most accurate result by looking at the gas report or the gas shown in the call trace with `-vvvv` argument to `forge test`. + +## Important Integration Notes + +### On-Chain Payload Validation + +> [!WARNING] +> Price update payloads (for example, those retrieved from Hermes) are **authoritatively validated on-chain** during transaction execution. +> +> Applications and SDKs forward the provided payload bytes and do not perform full validation of: +> - Wormhole VAA integrity or structure +> - Data source / emitter identity +> +> If an invalid or malformed payload is supplied to `updatePriceFeeds` (or equivalent methods), the application or SDK will not reject it before submission. Instead, the transaction will revert on-chain with native contract errors such as `InvalidWormholeVaa()` or `InvalidUpdateDataSource()`. +> +> To minimize failed transactions, obtain payloads from trusted providers (such as Hermes) and consider simulating transactions before broadcasting. diff --git a/target_chains/ethereum/sdk/js/README.md b/target_chains/ethereum/sdk/js/README.md index 8d541be0a6..894d0be1f3 100644 --- a/target_chains/ethereum/sdk/js/README.md +++ b/target_chains/ethereum/sdk/js/README.md @@ -75,3 +75,18 @@ if (pythUpdate) { console.log("No Pyth data needed for this transaction"); } ``` + +## Important Integration Notes + +### On-Chain Payload Validation + +> [!WARNING] +> Price update payloads (for example, those retrieved from Hermes) are **authoritatively validated on-chain** during transaction execution. +> +> Client SDKs forward the provided payload bytes and do not perform full validation of: +> - Wormhole VAA integrity or structure +> - Data source / emitter identity +> +> If an invalid or malformed payload is supplied to `updatePriceFeeds` (or equivalent methods), the SDK will not reject it before submission. Instead, the transaction will revert on-chain with native contract errors such as `InvalidWormholeVaa()` or `InvalidUpdateDataSource()`. +> +> To minimize failed transactions, obtain payloads from trusted providers (such as Hermes) and consider simulating transactions before broadcasting. diff --git a/target_chains/ethereum/sdk/solidity/README.md b/target_chains/ethereum/sdk/solidity/README.md index 8546fda666..c768f1e02d 100644 --- a/target_chains/ethereum/sdk/solidity/README.md +++ b/target_chains/ethereum/sdk/solidity/README.md @@ -100,3 +100,18 @@ We use [Semantic Versioning](https://semver.org/) for our releases. In order to 1. Run `npm version --no-git-tag-version`. This command will update the version of the package. Then push your changes to github. 2. Once your change is merged into `main`, create a release with tag `v` like `v1.5.2`, and a github action will automatically publish the new version of this package to npm. + +## Important Integration Notes + +### On-Chain Payload Validation + +> [!WARNING] +> Price update payloads (for example, those retrieved from Hermes) are **authoritatively validated on-chain** during transaction execution. +> +> Client SDKs forward the provided payload bytes and do not perform full validation of: +> - Wormhole VAA integrity or structure +> - Data source / emitter identity +> +> If an invalid or malformed payload is supplied to `updatePriceFeeds` (or equivalent methods), the SDK will not reject it before submission. Instead, the transaction will revert on-chain with native contract errors such as `InvalidWormholeVaa()` or `InvalidUpdateDataSource()`. +> +> To minimize failed transactions, obtain payloads from trusted providers (such as Hermes) and consider simulating transactions before broadcasting.