CEP18 - Casper Association

The TypeScript client is missing two events that are defined and emitted by the Rust contract:

• ChangeSecurity, emitted when security settings are modified.

• ChangeEventsMode, emitted when the events mode is changed.

Update the TypeScript SDK’s contract ABI to incorporate the ChangeSecurity and ChangeEventsMode event definitions. Additionally, add the corresponding event interfaces and listener logic to enable the client to emit these events.

SOLVED: The Casper team added ChangeSecurity and ChangeEventsMode event types to client-js/src/events.ts, extending the CEP-18 event union and EventsMap so the TypeScript client now recognizes and handles these contract events correctly.

The SDK exposes types for each entry points in the CEP18 contract, however does not declare the ChangeEventsMode params.

Code Location

For example, the ChangeSecurityArgs type in client-js/src/types.ts:

export type ChangeSecurityArgs = {
    adminList?: Entity[];
    minterList?: Entity[];
// [...]
};

Reflects the change_security function in contracts/contract/src/main.rs:

pub extern "C" fn change_security() {
    if 0 == get_stored_value::<u8>(ARG_ENABLE_MINT_BURN) {
        revert(Cep18Error::MintBurnDisabled);
    }
    sec_check(vec![SecurityBadge::Admin]);
    let admin_list: Option<Vec<Key>> =
        get_optional_named_arg_with_user_errors(ADMIN_LIST, Cep18Error::InvalidAdminList);
    let minter_list: Option<Vec<Key>> =
        get_optional_named_arg_with_user_errors(MINTER_LIST, Cep18Error::InvalidMinterList);
    let none_list: Option<Vec<Key>> =
        get_optional_named_arg_with_user_errors(NONE_LIST, Cep18Error::InvalidNoneList);

Implement and export a ChangeEventsModeParams interface in the SDK’s TypeScript definitions that corresponds to the ChangeEventsMode entry point parameters of the CEP18 contract.

SOLVED: The Casper team added the missing ChangeEventsModeArgs interface so the SDK now has typed parameters for the change_events_mode entry-point.

The SDK declares an interface that is not up to date with the latest contract version. The SDK shows burnerList and mintAndBurnList arguments that are not used in the CEP18 contract:

export type ChangeSecurityArgs = {
  adminList?: Entity[];
  minterList?: Entity[];
  burnerList?: Entity[];
  mintAndBurnList?: Entity[];
  noneList?: Entity[];
};

For reference, in the contract side:

pub extern "C" fn change_security() {
    if 0 == get_stored_value::<u8>(ARG_ENABLE_MINT_BURN) {
        revert(Cep18Error::MintBurnDisabled);
    }
    sec_check(vec![SecurityBadge::Admin]);
    let admin_list: Option<Vec<Key>> =
        get_optional_named_arg_with_user_errors(ADMIN_LIST, Cep18Error::InvalidAdminList);
    let minter_list: Option<Vec<Key>> =
        get_optional_named_arg_with_user_errors(MINTER_LIST, Cep18Error::InvalidMinterList);
    let none_list: Option<Vec<Key>> =
        get_optional_named_arg_with_user_errors(NONE_LIST, Cep18Error::InvalidNoneList);

Calling the entry point with these arguments will therefore not work as intended.

Update the ChangeSecurityArgs type in the SDK to align with the latest CEP18 contract by removing the deprecated burnerList and mintAndBurnList fields, and regenerate the client bindings to include only adminList, minterList, and noneList.

SOLVED: The Casper team successfully remediated this issue.

The get_immediate_caller function retrieves the information about the caller, that could be either an externally owned account or a contract. The function consider some items as caller_info.kind that will never be provided by the node codebase, such as: PACKAGE and CONTRACT_PACKAGE.

The node codebase only consider three branches:

• ACCOUNT

• ENTITY

• CONTRACT

Therefore, the other kinds will never be reached in the get_immediate_caller implementation.

Code Location

In the get_immediate_caller function, many kinds are defined:

pub fn get_immediate_caller() -> Key {
    const ACCOUNT: u8 = 0;
    const PACKAGE: u8 = 1;
    const CONTRACT_PACKAGE: u8 = 2;
    const ENTITY: u8 = 3;
    const CONTRACT: u8 = 4;

    let caller_info = casper_get_immediate_caller().unwrap_or_revert();

    match caller_info.kind() {
        ACCOUNT => caller_info
            .get_field_by_index(ACCOUNT)
            .unwrap()
            .to_t::<Option<AccountHash>>()
            .unwrap_or_revert()
            .unwrap_or_revert_with(Cep18Error::InvalidContext)
            .into(),
        PACKAGE => caller_info
            .get_field_by_index(PACKAGE)
            .unwrap()
            .to_t::<Option<PackageHash>>()
            .unwrap_or_revert()
            .unwrap_or_revert_with(Cep18Error::InvalidContext)
            .into(),
        CONTRACT_PACKAGE | CONTRACT => caller_info
            .get_field_by_index(CONTRACT_PACKAGE)
            .unwrap()
            .to_t::<Option<ContractPackageHash>>()
            .unwrap_or_revert()
            .unwrap_or_revert_with(Cep18Error::InvalidContext)
            .into(),
        ENTITY => caller_info
            .get_field_by_index(ENTITY)
            .unwrap()
            .to_t::<Option<EntityAddr>>()
            .unwrap_or_revert()
            .unwrap_or_revert_with(Cep18Error::InvalidContext)
            .into(),
        _ => revert(Cep18Error::InvalidContext),
    }
}

In the Casper codebase (types/src/system/caller.rs), the system only branches through the three aforementioned kinds:

impl TryFrom<Caller> for CallerInfo {
    type Error = CLValueError;

    fn try_from(value: Caller) -> Result<Self, Self::Error> {
        match value {
            Caller::Initiator { account_hash } => {
                let kind = ACCOUNT;

                let mut ret = BTreeMap::new();
                ret.insert(ACCOUNT, CLValue::from_t(Some(account_hash))?);
                ret.insert(PACKAGE, CLValue::from_t(Option::<PackageHash>::None)?);
                ret.insert(
                    CONTRACT_PACKAGE,
                    CLValue::from_t(Option::<ContractPackageHash>::None)?,
                );
                ret.insert(ENTITY, CLValue::from_t(Option::<EntityAddr>::None)?);
                ret.insert(CONTRACT, CLValue::from_t(Option::<ContractHash>::None)?);
                Ok(CallerInfo { kind, fields: ret })
            }
            Caller::Entity {
                package_hash,
                entity_addr,
            } => {
                let kind = ENTITY;

                let mut ret = BTreeMap::new();
                ret.insert(ACCOUNT, CLValue::from_t(Option::<AccountHash>::None)?);
                ret.insert(PACKAGE, CLValue::from_t(Some(package_hash))?);
                ret.insert(
                    CONTRACT_PACKAGE,
                    CLValue::from_t(Option::<ContractPackageHash>::None)?,
                );
                ret.insert(ENTITY, CLValue::from_t(Some(entity_addr))?);
                ret.insert(CONTRACT, CLValue::from_t(Option::<ContractHash>::None)?);
                Ok(CallerInfo { kind, fields: ret })
            }
            Caller::SmartContract {
                contract_package_hash,
                contract_hash,
            } => {
                let kind = CONTRACT;

                let mut ret = BTreeMap::new();
                ret.insert(ACCOUNT, CLValue::from_t(Option::<AccountHash>::None)?);
                ret.insert(PACKAGE, CLValue::from_t(Option::<PackageHash>::None)?);
                ret.insert(
                    CONTRACT_PACKAGE,
                    CLValue::from_t(Some(contract_package_hash))?,
                );

                ret.insert(ENTITY, CLValue::from_t(Option::<EntityAddr>::None)?);
                ret.insert(CONTRACT, CLValue::from_t(Some(contract_hash))?);
                Ok(CallerInfo { kind, fields: ret })
            }
        }
    }
}

Refactor the get_immediate_caller implementation to align with the node’s CallerInfo kinds by removing the PACKAGE and CONTRACT_PACKAGE constants and their corresponding match arms, and handle only ACCOUNT, ENTITY, and CONTRACT types to eliminate unreachable code paths.

SOLVED: The over-broad variant list (PACKAGE, CONTRACT_PACKAGE, …) inside get_immediate_caller is not present in this version of the contract; the helper now uses CallStackElement instead.

The codebase contains duplicate checks for recipient to caller inequality:

pub extern "C" fn transfer() {
    let caller = get_immediate_caller();
    let recipient: Key = runtime::get_named_arg(ARG_RECIPIENT);
    if caller == recipient {
        revert(Cep18Error::CannotTargetSelfUser);
    }
    let amount: U256 = runtime::get_named_arg(ARG_AMOUNT);
    transfer_balance(caller, recipient, amount).unwrap_or_revert();
    events::record_event_dictionary(Event::Transfer(Transfer {
        sender: caller,
        recipient,
        amount,
    }))
}

pub fn transfer_balance(sender: Key, recipient: Key, amount: U256) -> Result<(), Cep18Error> {
    if sender == recipient || amount.is_zero() {
        return Ok(());
    }
    let new_sender_balance = {
        let sender_balance = read_balance_from(sender);
        sender_balance
            .checked_sub(amount)
            .ok_or(Cep18Error::InsufficientBalance)?
    };

    let new_recipient_balance = {
        let recipient_balance = read_balance_from(recipient);
        recipient_balance
            .checked_add(amount)
            .ok_or(Cep18Error::Overflow)?
    };

    write_balance_to(sender, new_sender_balance);
    write_balance_to(recipient, new_recipient_balance);

    Ok(())
}

Eliminate the redundant sender == recipient check from transfer() and centralize the self-transfer validation within transfer_balance by returning Err(Cep18Error::CannotTargetSelfUser) when sender == recipient. Propagate this error upstream to enforce the validation consistently in a single location.

ACKNOWLEDGED: Duplicate sender == recipient check remains in both transfer() and transfer_balance().

The ENTRY_POINT_UPGRADE constant defined in constants.rs is not used in the entry points. This endpoint is not expected to be implemented because of the way Casper handles upgrades.

Remove the unused ENTRY_POINT_UPGRADE constant from constants.rs to eliminate dead code and ensure alignment with Casper’s native upgrade mechanism.

SOLVED: The Casper team successfully remediated this issue.