Merge pull request #14 from Trust-Machines/low_fixes

Low issue fixes

contracts/pyth-governance-v2.clar

@@ -52,6 +52,8 @@
 (define-constant ERR_NOT_STANDARD_PRINCIPAL (err u4007))
 ;; Error Ptgm overlay bytes
 (define-constant ERR_PTGM_CHECK_OVERLAY (err u4008))
+;; Error invalid price data source
+(define-constant ERR_INVALID_PRICE_DATA_SOURCES (err u4009))
 
 (define-data-var governance-data-source 
   { emitter-chain: uint, emitter-address: (buff 32) }
@@ -444,7 +446,8 @@
           limit: (get value cursor-num-data-sources) 
         }))
         (data-sources (get result data-sources-bundle)))
-    (asserts! (is-eq (get next-update-index (get cursor data-sources-bundle)) (len cursor-data-sources-bytes)) ERR_PTGM_CHECK_OVERLAY)    
+    (asserts! (is-eq (get next-update-index (get cursor data-sources-bundle)) (len cursor-data-sources-bytes)) ERR_PTGM_CHECK_OVERLAY)
+    (asserts! (is-eq (get value cursor-num-data-sources) (len data-sources)) ERR_INVALID_PRICE_DATA_SOURCES)  
     (ok data-sources)))
 
 (define-private (parse-data-source

contracts/wormhole/wormhole-core-v3.clar

@@ -68,6 +68,10 @@
 (define-constant ERR_NOT_DEPLOYER (err u1306))
 ;; Overlay present in vaa bytes
 (define-constant ERR_GSU_CHECK_OVERLAY (err u1307))
+;; Empty guardian set
+(define-constant ERR_EMPTY_GUARIDIAN_SET (err u1308))
+;; Guardian Set Update emission payload unauthorized
+(define-constant ERR_DUPLICATED_GUARDIAN_ADDRESSES (err u1309))
 
 ;; Guardian set upgrade emitting address
 (define-constant GSU-EMITTING-ADDRESS 0x0000000000000000000000000000000000000000000000000000000000000004)
@@ -223,6 +227,8 @@
     (asserts! (is-eq (get emitter-address vaa) GSU-EMITTING-ADDRESS) ERR_GSU_CHECK_EMITTER)
     ;; Check emitting address
     (asserts! (is-eq (get emitter-chain vaa) GSU-EMITTING-CHAIN) ERR_GSU_CHECK_EMITTER)
+    ;; ensure guardian set has atleast one member
+    (asserts! (>= (len result) u1) ERR_EMPTY_GUARIDIAN_SET)
     ;; Update storage
     (map-set guardian-sets set-id result)
     (var-set active-guardian-set-id set-id)
@@ -330,10 +336,13 @@
   (let (
     (cursor-address-bytes (unwrap-panic (contract-call? 'SP2J933XB2CP2JQ1A4FGN8JA968BBG3NK3EKZ7Q9F.hk-cursor-v2 read-buff-20 { bytes: (get bytes acc), pos: cue-position })))
   )
-  {
-    bytes: (get bytes acc),
-    result: (unwrap-panic (as-max-len? (append (get result acc) (get value cursor-address-bytes)) u19))
-  }))
+  (if (is-none (index-of? (get result acc) (get value cursor-address-bytes)))
+    {
+      bytes: (get bytes acc),
+      result: (unwrap-panic (as-max-len? (append (get result acc) (get value cursor-address-bytes)) u19))
+    }
+    acc
+  )))
 
 ;; @desc Parse and verify payload's VAA  
 (define-private (parse-and-verify-guardians-set (bytes (buff 8192)))
@@ -353,6 +362,8 @@
       (guardians-cues (get result (fold is-guardian-cue (get value guardians-bytes) { cursor: u0, result: (list) })))
       (eth-addresses (get result (fold parse-guardian guardians-cues { bytes: (get value guardians-bytes), result: (list) }))))
     (asserts! (is-eq (get pos (get next guardians-bytes)) (len bytes)) ERR_GSU_CHECK_OVERLAY)
+    ;; Ensure there are no duplicated addresses
+    (asserts! (is-eq (len eth-addresses) (get value cursor-guardians-count)) ERR_DUPLICATED_GUARDIAN_ADDRESSES)
     ;; Ensure that this message was emitted from authorized module
     (asserts! (is-eq (get value cursor-module) CORE_STRING_MODULE) 
       ERR_GSU_CHECK_MODULE)