@bananapus/router-terminal-v6 0.0.39 → 0.0.41
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +6 -0
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -20,7 +20,13 @@ Indexer impact: read `defaultTerminalFor(projectId)` rather than `defaultTermina
|
|
|
20
20
|
|
|
21
21
|
Admin impact: the registry owner can no longer silently reroute payments for already-deployed projects by changing the default. See `ADMINISTRATION.md` for the updated boundary description.
|
|
22
22
|
|
|
23
|
+
### `0.0.41` — Document multi-hop forwarding-cycle as accepted risk
|
|
23
24
|
|
|
25
|
+
`JBRouterTerminalRegistry._requireNonCircularTerminalFor` only walks one hop of `IJBForwardingTerminal.terminalOf` when admitting a new explicit or default terminal. A multi-hop `A → B → registry` chain passes admission (the registry only sees `downstream == B ≠ self`), but once locked in, a subsequent `pay`/`addToBalanceOf` recurses through the registry until OOG. The `JBPayRouteResolver` swap-routing path already uses the bounded multi-hop helper `JBForwardingCheck.isCircularTerminal`; the registry admission path does not.
|
|
26
|
+
|
|
27
|
+
This is documented as accepted in `RISKS.md` (§Registry & Forwarding Risks). Impact is bounded to a self-locking DoS on the project that constructs the multi-hop chain — external actors cannot trigger it, and the project owner can rotate the registry default to recover. Per-PR retrofit cost was judged non-trivial relative to that impact. Project owners installing chained forwarding terminals should run a manual `JBForwardingCheck.isCircularTerminal({target: registry, projectId: …, terminal: candidate})` simulation before approving the candidate.
|
|
28
|
+
|
|
29
|
+
No runtime code change in this release — documentation only.
|
|
24
30
|
|
|
25
31
|
## Current v6 surface
|
|
26
32
|
|