Skip to content

docs(ethereum): clarify on-chain validation of price update payloads #3852

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Ysh204 wants to merge 2 commits into
base: main
Choose a base branch
from
Open

docs(ethereum): clarify on-chain validation of price update payloads #3852

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
762b42b
docs: clarify on-chain payload validation and revert behavior
Ysh204 Jun 29, 2026
30f6407
docs(ethereum): clarify on-chain validation of price update payloads
Ysh204 Jun 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 15 additions & 0 deletions target_chains/ethereum/contracts/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -130,3 +130,18 @@ optimization with it. For more information, please refer to [Gas Snapshots docum
Once you optimized the code, please share the snapshot difference (generated using `forge snapshot --diff <old-snapshot>`) in the PR too.
This snapshot gas value also includes an initial transaction cost as well as reading from the contract storage itself. You can get the
most accurate result by looking at the gas report or the gas shown in the call trace with `-vvvv` argument to `forge test`.

## Important Integration Notes

### On-Chain Payload Validation

> [!WARNING]
> Price update payloads (for example, those retrieved from Hermes) are **authoritatively validated on-chain** during transaction execution.
>
> Applications and SDKs forward the provided payload bytes and do not perform full validation of:
> - Wormhole VAA integrity or structure
> - Data source / emitter identity
>
> If an invalid or malformed payload is supplied to `updatePriceFeeds` (or equivalent methods), the application or SDK will not reject it before submission. Instead, the transaction will revert on-chain with native contract errors such as `InvalidWormholeVaa()` or `InvalidUpdateDataSource()`.
>
> To minimize failed transactions, obtain payloads from trusted providers (such as Hermes) and consider simulating transactions before broadcasting.
15 changes: 15 additions & 0 deletions target_chains/ethereum/sdk/js/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,3 +75,18 @@ if (pythUpdate) {
console.log("No Pyth data needed for this transaction");
}
```

## Important Integration Notes

### On-Chain Payload Validation

> [!WARNING]
> Price update payloads (for example, those retrieved from Hermes) are **authoritatively validated on-chain** during transaction execution.
>
> Client SDKs forward the provided payload bytes and do not perform full validation of:
> - Wormhole VAA integrity or structure
> - Data source / emitter identity
>
> If an invalid or malformed payload is supplied to `updatePriceFeeds` (or equivalent methods), the SDK will not reject it before submission. Instead, the transaction will revert on-chain with native contract errors such as `InvalidWormholeVaa()` or `InvalidUpdateDataSource()`.
>
> To minimize failed transactions, obtain payloads from trusted providers (such as Hermes) and consider simulating transactions before broadcasting.
15 changes: 15 additions & 0 deletions target_chains/ethereum/sdk/solidity/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -100,3 +100,18 @@ We use [Semantic Versioning](https://semver.org/) for our releases. In order to

1. Run `npm version <new version number> --no-git-tag-version`. This command will update the version of the package. Then push your changes to github.
2. Once your change is merged into `main`, create a release with tag `v<new version number>` like `v1.5.2`, and a github action will automatically publish the new version of this package to npm.

## Important Integration Notes

### On-Chain Payload Validation

> [!WARNING]
> Price update payloads (for example, those retrieved from Hermes) are **authoritatively validated on-chain** during transaction execution.
>
> Client SDKs forward the provided payload bytes and do not perform full validation of:
> - Wormhole VAA integrity or structure
> - Data source / emitter identity
>
> If an invalid or malformed payload is supplied to `updatePriceFeeds` (or equivalent methods), the SDK will not reject it before submission. Instead, the transaction will revert on-chain with native contract errors such as `InvalidWormholeVaa()` or `InvalidUpdateDataSource()`.
>
> To minimize failed transactions, obtain payloads from trusted providers (such as Hermes) and consider simulating transactions before broadcasting.