feat: tron batch payments contracts and tests#1724
Conversation
Greptile SummaryThis PR introduces
Confidence Score: 4/5The contract and test suite are safe to merge; the remaining risk is in the mainnet deployment script, which can crash on a truly fresh environment where mainnet.json does not yet exist. The core contract logic, ABI, and artifact coordinates are correct and well-tested. Issues flagged in earlier review rounds (wrong artifact name, stale creation block, missing threw declaration, internal function in ABI) have all been resolved in this revision. The only outstanding concern is in deploy-mainnet.js, where accessing existingDeployment.contracts on a null value (when no prior deployment file exists) would crash the script before writing the deployment JSON — a risk for anyone running a completely fresh mainnet deployment. packages/smart-contracts/scripts/tron/deploy-mainnet.js — null-guard on the existingDeployment value before accessing .contracts Important Files Changed
Flowchart%%{init: {'theme': 'neutral'}}%%
flowchart TD
A[Payer calls batch function] --> B{Arrays same length?}
B -->|fail| Z[Revert]
B -->|pass| C{Which function?}
C -->|Single-token batch| D[Sum all amounts plus fees]
D --> E{total greater than zero?}
E -->|yes| F[Pull total from payer via transferFrom]
F --> G{proxy already approved for token?}
G -->|no| H[Approve proxy with max allowance and cache flag]
H --> J
G -->|yes| J[Payment loop]
E -->|no| J
J --> K{paymentSum == 0?}
K -->|yes| L[skip entry]
K -->|no| M[Validate recipient and feeAddr]
M --> N[Invoke ERC20FeeProxy per payment]
C -->|Multi-token batch| P[Deduplicate tokens via inner loop per entry]
P --> Q[Pull each unique token total from payer and approve proxy once]
Q --> R[Payment loop identical to single-token path]
R --> N
Reviews (16): Last reviewed commit: "update global files" | Re-trigger Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
|
@LeoSlrRf is this still true? If not, please update the PR description. > Currently, both contracts provide methods for managing the underlying proxies. |
|
@MantisClone It wasn't the case. I just pushed the ownership removal and updated the PR description |
|
Post-approval optional hardening note:
|
Improvements implemented. |
|
Want your agent to iterate on Greptile's feedback? Try greploops. |
Security Review —
|
Gas Improvements1. Remove redundant pre-flight checks — 2. Cache proxy approval in storage — the 3. Require sorted token input to drop O(n²) dedup — 4. Priority: #2 pays on every batch, #3 scales with batch size — those two are most worthwhile. |
Other Smart Contract / Infra Findings
|
|
@rodrigopavezi I applied most changes from you comment. Here are the only one I skipped. Security reviewLow —
|
|
Sounds great! Thanks |
❌ Echidna Fuzzing ResultsMode: ( test sequences) Property Test Results
📄 Full report and corpus available in workflow artifacts. ℹ️ About Echidna FuzzingEchidna is a property-based fuzzer that generates random sequences of transactions Properties tested:
|
|
| Severity | Count | Status |
|---|---|---|
| ✅ High | 0 | Pass |
| ✅ Medium | 0 | Pass |
| 🔵 Low | 0 | Info |
| ℹ️ Informational | 0 | Info |
📄 Full report available in workflow artifacts.
🔍 View detailed findings in the Security tab.
|
| Severity | Count | Status |
|---|---|---|
| ✅ High | 0 | Pass |
| ✅ Medium | 0 | Pass |
| 🔵 Low | 0 | Info |
| ℹ️ Informational | 0 | Info |
📄 Full report available in workflow artifacts.
🔍 View detailed findings in the Security tab.
❌ Echidna Fuzzing ResultsMode: ( test sequences) Property Test Results
📄 Full report and corpus available in workflow artifacts. ℹ️ About Echidna FuzzingEchidna is a property-based fuzzer that generates random sequences of transactions Properties tested:
|
✅ Slither Security AnalysisStatus: Passed Findings Summary
📄 Full report available in workflow artifacts. |
✅ Echidna Fuzzing ResultsMode: ci (50000 test sequences) Property Test Results
📄 Full report and corpus available in workflow artifacts. ℹ️ About Echidna FuzzingEchidna is a property-based fuzzer that generates random sequences of transactions Properties tested:
|
|
Greptile encountered an error while reviewing this PR. Please reach out to support@greptile.com for assistance. |
3 participants
Description of the changes
Adds Tron-specific batch payment contracts and test infrastructure to the
smart-contractspackage.This PR introduces
ERC20BatchPayments,an ERC20-specific version of the BatchPayments contract.This version offers better performance and increased security on Tron.
The fil itself is stored with the solidity contracts so it benefits from types generation at build time.
ERC20BatchPayments.test.jscoversERC20BatchPayments, including happy-path single-token and multi-token payments, zero-amount payments, zero-fee payments,BadTRC20token handling, and error cases such as insufficient funds, missing allowance, and mismatched input arrays.A shared
helpers.jsmodule provides utilities, including token deployment, approval helpers, balance diffing, batch fee computation, and revert/no-balance-change assertion helpers.The root
package.jsonworkspace configuration is updated to prevent hoisting of@openzeppelindependencies for thesmart-contractspackage, ensuring the Tron build resolves its own copy of those contracts.The Trondeployments scripts have been updated to support the deployment of
ERC20BatchPaymentsContracts Scope
This is the same contract as the
BatchPaymentscontract from EVM without th following features:EthFeeProxymethodsIt also includes several minor improvements.
Security Consideration
The
ERC20BatchPaymentcontract no longer has an owner compared to the original version, reducing the attack surface.Additionally, the following updates have been made compared to the original BatchPayments contract:
Gas Consideration
ERC20BatchPaymenthas a lower gas footprint asBatchPaymentsas it does not include batch-fee-related logic.Additionally, the following updates have been made compared to the original BatchPayments contract:
Deloyment Information
Nile: https://nile.tronscan.org/#/contract/TBAtFt46T7LUW5Sya6PNjw7MQrKkzKEFMx
Tron: https://tronscan.org/#/address/TRZbXXuLd3HW5utzVysA3rpLgU7sVBrd1D
Both contracts are verified ✅