ipor-fusion 4.1.0.dev54__tar.gz → 4.1.1.dev2__tar.gz

{ipor_fusion-4.1.0.dev54 → ipor_fusion-4.1.1.dev2}/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "ipor-fusion",
-  "version": "4.0.0",
+  "version": "4.1.0",
   "description": "Skills for building on IPOR Fusion vaults with the ipor-fusion Python SDK, plus the hosted read-only inspection server",
   "author": {
     "name": "IPOR Labs",

{ipor_fusion-4.1.0.dev54 → ipor_fusion-4.1.1.dev2}/CHANGELOG.md

@@ -2,6 +2,132 @@
 
 <!-- version list -->
 
+## v4.1.0 (2026-11-03)
+
+### Bug Fixes
+
+- **cli**: Accept a 0X prefix in address arguments
+  ([`cc23ff7`](https://github.com/IPOR-Labs/ipor-fusion.py/commit/cc23ff7be50ca760eb6adc1a245746bc93a62553))
+
+- **cli**: Check address arguments with parse_checksum_address
+  ([`4023d07`](https://github.com/IPOR-Labs/ipor-fusion.py/commit/4023d0789ed78d1ab76ce8f44d76a98b65c366f6))
+
+- **cli**: Print a set-provider hint that runs as shown
+  ([`6dd2894`](https://github.com/IPOR-Labs/ipor-fusion.py/commit/6dd2894693038bae57b256293a4128160f35fc02))
+
+- **cli**: Read --block-number 0 as the latest block
+  ([`8dd339f`](https://github.com/IPOR-Labs/ipor-fusion.py/commit/8dd339f0d8412389c6a473a57f119e79473e9ef6))
+
+- **mcp**: Name the preflight sender in its parse errors
+  ([`b1a6115`](https://github.com/IPOR-Labs/ipor-fusion.py/commit/b1a61158a1f25eb9516f0e96d1a5c794ff943c65))
+
+- **mcp**: Read block_number=0 as the latest block
+  ([`320bb93`](https://github.com/IPOR-Labs/ipor-fusion.py/commit/320bb935726d83fd7787cab9bb82430681ee6a11))
+
+- **mcp**: Reject a wrong EIP-55 checksum in the MetaMorpho vault
+  ([`02a5159`](https://github.com/IPOR-Labs/ipor-fusion.py/commit/02a5159d727f768a40e97aad6869ff3b0356c418))
+
+- **mcp**: Reject a wrong EIP-55 checksum in the preflight sender
+  ([`4d5af23`](https://github.com/IPOR-Labs/ipor-fusion.py/commit/4d5af236721c2cd3e9e8a0f52ed045b06039b4fa))
+
+- **mcp**: Reject a wrong EIP-55 checksum in vault arguments
+  ([`37625ec`](https://github.com/IPOR-Labs/ipor-fusion.py/commit/37625ecb172a3478fc7fb5e522027c71c0a98dcf))
+
+- **sdk**: Check EIP-55 in every FusionInstance address field
+  ([`951f49a`](https://github.com/IPOR-Labs/ipor-fusion.py/commit/951f49a4ccceecef4a06b8c600c12564da0c6ce5))
+
+- **sdk**: Do not follow CCIP-Read lookups from contracts
+  ([`51c8ef2`](https://github.com/IPOR-Labs/ipor-fusion.py/commit/51c8ef25e19b9e33c8ea4317a9e1df26ad87dccd))
+
+- **sdk**: Read the latest block's number and timestamp in one call
+  ([`60a4a8f`](https://github.com/IPOR-Labs/ipor-fusion.py/commit/60a4a8f545714f1013a2f30145837b2d8ad421cb))
+
+- **sdk**: Reject a 0X-prefixed zero address
+  ([`556ee32`](https://github.com/IPOR-Labs/ipor-fusion.py/commit/556ee329d7954ac39f2b0dff607fa2aba7ba3bdd))
+
+- **sdk**: Reject a wrong EIP-55 checksum in the address parsers
+  ([`deac726`](https://github.com/IPOR-Labs/ipor-fusion.py/commit/deac7262bb5ccfdc0932eab8d22ed02bd66d4c3b))
+
+- **sdk**: Report Euler V2 lending health and never drop a borrow market
+  ([`1de4598`](https://github.com/IPOR-Labs/ipor-fusion.py/commit/1de4598248b2a73d322d68359baaa74421244b2e))
+
+- **sdk**: Stop reporting a rounding gap as a stale ERC20 cache
+  ([`29ffb53`](https://github.com/IPOR-Labs/ipor-fusion.py/commit/29ffb53377cd91308815a0d3ede18acfe640ee4a))
+
+- **sdk**: Stop the oracle mapping at a price oracle manager delegation cycle
+  ([`1470d93`](https://github.com/IPOR-Labs/ipor-fusion.py/commit/1470d93f85f477e24a85e6a28013f4456149d128))
+
+### Build System
+
+- Bump aiohttp, multidict and mcp in the lock
+  ([`3c266b1`](https://github.com/IPOR-Labs/ipor-fusion.py/commit/3c266b195f3b6ae4b72bdf8e7ae5a2c165838cc1))
+
+### Documentation
+
+- Block 0 reads the latest block in the tools and the CLI
+  ([`308ccd2`](https://github.com/IPOR-Labs/ipor-fusion.py/commit/308ccd22cff554c3f31f1414a8e825fac8b00625))
+
+- Keep the CCIP example's command gas inside HyperEVM's small block
+  ([`5e3a093`](https://github.com/IPOR-Labs/ipor-fusion.py/commit/5e3a093b66c79c9565f89b7c91615cb95c2e1ff7))
+
+- **examples**: Build address literals with parse_checksum_address
+  ([`c449d13`](https://github.com/IPOR-Labs/ipor-fusion.py/commit/c449d13ab481ec9b13497bb435569d9651f5b38c))
+
+- **sdk**: Say the HyperCore pre-hooks take no pre-hook substrates
+  ([`b609593`](https://github.com/IPOR-Labs/ipor-fusion.py/commit/b609593ebb4b05bfd2b866e6139f02321323f6a3))
+
+- **sdk**: Wire the HyperCore example's pre-hooks with the helper
+  ([`edd2776`](https://github.com/IPOR-Labs/ipor-fusion.py/commit/edd277677da59872f5074d8dcba2b6b5cad2daa2))
+
+### Features
+
+- **sdk**: Add parse_checksum_address
+  ([`a9a6b84`](https://github.com/IPOR-Labs/ipor-fusion.py/commit/a9a6b848e606318fc76fa82dc2c54c7d5b4a94d9))
+
+- **sdk**: Expose the HyperCore order and price scales
+  ([`b75c645`](https://github.com/IPOR-Labs/ipor-fusion.py/commit/b75c645f95c525114e181519fe75c2348b7962b7))
+
+- **sdk**: HyperCore pre-hook wiring
+  ([`6f16ae6`](https://github.com/IPOR-Labs/ipor-fusion.py/commit/6f16ae6cbe2d0f3298308f4592538cb06e52eab6))
+
+- **sdk**: Read the HyperCore best bid and ask
+  ([`5fda9ee`](https://github.com/IPOR-Labs/ipor-fusion.py/commit/5fda9ee754eb8085df3f8c432ce65565c045bddf))
+
+- **sdk**: Report the feeds behind a Morpho oracle in the oracle mapping
+  ([`c692d72`](https://github.com/IPOR-Labs/ipor-fusion.py/commit/c692d72449805ee98ae786f14d41d28e6de2c24e))
+
+- **sdk**: Support TAC (239) in the vault tooling again
+  ([`0cc00c3`](https://github.com/IPOR-Labs/ipor-fusion.py/commit/0cc00c3e8d30f5937296ec6dc40896a4e1c766f7))
+
+### Refactoring
+
+- **mcp**: Share _vault_arg's input normalization
+  ([`80744af`](https://github.com/IPOR-Labs/ipor-fusion.py/commit/80744afd6d52d33ba7e8a075478083aef4048384))
+
+- **sdk**: Decode Euler V2 and Dolomite substrates into typed values
+  ([`8f4f1ad`](https://github.com/IPOR-Labs/ipor-fusion.py/commit/8f4f1ad5045772da897a3e31d8514b32c6386610))
+
+- **sdk**: Make HyperCorePreHookWiring.selectors a class constant
+  ([`ae9bf3e`](https://github.com/IPOR-Labs/ipor-fusion.py/commit/ae9bf3e72f31fe795ef5683cd7287b40a1c83d14))
+
+- **sdk**: Move the HyperCore pre-hook wiring to its own module
+  ([`b150389`](https://github.com/IPOR-Labs/ipor-fusion.py/commit/b1503891468fe4f54379d8ba49ce68d6b3c7e041))
+
+- **sdk**: Name the 0x813 precompile POSITION2_PRECOMPILE
+  ([`9529f22`](https://github.com/IPOR-Labs/ipor-fusion.py/commit/9529f22e8a1517ef096fe1b4bff56dcaa8139e5a))
+
+- **sdk**: Stop coercing HyperCorePreHookWiring's hooks
+  ([`759448d`](https://github.com/IPOR-Labs/ipor-fusion.py/commit/759448d02b3d690a5de636ee91363263e7dd0e40))
+
+### Testing
+
+- Share a miscased-address helper
+  ([`5f769ac`](https://github.com/IPOR-Labs/ipor-fusion.py/commit/5f769ac98160baa0fe2099b3255b0f91d2b4b223))
+
+- **sdk**: Probe the core modules' CLI isolation in one subprocess
+  ([`3fc160a`](https://github.com/IPOR-Labs/ipor-fusion.py/commit/3fc160a5766171dc7bb471968d2740521b59d69e))
+
+
 ## v4.0.0 (2026-10-23)
 
 ### Bug Fixes

{ipor_fusion-4.1.0.dev54 → ipor_fusion-4.1.1.dev2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: ipor-fusion
-Version: 4.1.0.dev54
+Version: 4.1.1.dev2
 Summary: The IPOR Fusion SDK for Python
 Project-URL: homepage, https://ipor.io
 Project-URL: repository, https://github.com/IPOR-Labs/ipor-fusion.py

{ipor_fusion-4.1.0.dev54 → ipor_fusion-4.1.1.dev2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "ipor-fusion"
-version = "4.1.0.dev54"
+version = "4.1.1.dev2"
 description = "The IPOR Fusion SDK for Python"
 authors = [
     { name = "Adam Mydlarz", email = "amydlarz@gmail.com" },

{ipor_fusion-4.1.0.dev54 → ipor_fusion-4.1.1.dev2}/src/ipor_fusion/core/context.py

@@ -100,6 +100,10 @@ class Web3Context:
         log_source: LogSource | None = None,
         cache: ContractCache | None = None,
     ):
+        # EIP-3668: web3 would otherwise follow a contract's OffchainLookup
+        # revert from inside eth.call, sending an HTTP request to a URL chosen
+        # by whoever deployed the contract. Nothing in the SDK reads through it.
+        web3.provider.global_ccip_read_enabled = False
         self._web3 = web3
         self._chain_id = chain_id
         # Bounds of every `get_logs` scan: wall clock, and eth_getLogs requests

{ipor_fusion-4.1.0.dev54 → ipor_fusion-4.1.1.dev2}/src/ipor_fusion/core/erc20.py

@@ -1,6 +1,7 @@
 from eth_typing import ChecksumAddress
 
 from ipor_fusion.core.contract import Call, ContractWrapper
+from ipor_fusion.onchain_text import sanitize_onchain_text
 from ipor_fusion.types import Amount, Decimals
 
 
@@ -26,10 +27,14 @@ class ERC20(ContractWrapper):
         return self._view("decimals()", output_types=["uint256"], decoder=Decimals)
 
     def symbol(self) -> Call[str]:
-        return self._view("symbol()", output_types=["string"])
+        return self._view(
+            "symbol()", output_types=["string"], decoder=sanitize_onchain_text
+        )
 
     def name(self) -> Call[str]:
-        return self._view("name()", output_types=["string"])
+        return self._view(
+            "name()", output_types=["string"], decoder=sanitize_onchain_text
+        )
 
     def total_supply(self) -> Call[Amount]:
         return self._view("totalSupply()", output_types=["uint256"], decoder=Amount)

{ipor_fusion-4.1.0.dev54 → ipor_fusion-4.1.1.dev2}/src/ipor_fusion/core/plasma_vault.py

@@ -18,6 +18,7 @@ from ipor_fusion.core.context import Web3Context
 from ipor_fusion.core.contract import Call, ContractWrapper
 from ipor_fusion.core.fuse_action import FuseAction
 from ipor_fusion.errors import EmptyCallResultError, UnsupportedVaultVersionError
+from ipor_fusion.onchain_text import sanitize_onchain_text
 from ipor_fusion.types import (
     ZERO_ADDRESS,
     AccessManagerAddress,
@@ -614,7 +615,9 @@ class PlasmaVault(ContractWrapper):
         return self._view("totalSupply()", output_types=["uint256"], decoder=Shares)
 
     def name(self) -> Call[str]:
-        return self._view("name()", output_types=["string"])
+        return self._view(
+            "name()", output_types=["string"], decoder=sanitize_onchain_text
+        )
 
     def underlying_asset_address(self) -> Call[ChecksumAddress]:
         return self._view(

{ipor_fusion-4.1.0.dev54 → ipor_fusion-4.1.1.dev2}/src/ipor_fusion/core/simulation_result.py

@@ -13,6 +13,7 @@ from eth_typing import ChecksumAddress
 from hexbytes import HexBytes
 
 from ipor_fusion.errors import SimulationError, SimulationRunError, decode_custom_error
+from ipor_fusion.onchain_text import sanitize_onchain_text
 
 
 class QueuedCall(Protocol):
@@ -295,7 +296,7 @@ def _decode_revert(return_data: HexBytes, error: str | None) -> str | None:
         if selector == b"\x08\xc3\x79\xa0":  # Error(string)
             try:
                 (msg,) = decode(["string"], bytes(return_data[4:]))
-                return msg
+                return sanitize_onchain_text(msg)
             except (DecodingError, OverflowError, ValueError):
                 pass
         if selector == b"\x4e\x48\x7b\x71":  # Panic(uint256)

{ipor_fusion-4.1.0.dev54 → ipor_fusion-4.1.1.dev2}/src/ipor_fusion/errors.py

@@ -11,6 +11,7 @@ from web3 import Web3
 from web3.types import TxParams, TxReceipt
 
 from ipor_fusion.fusion_errors import FUSION_ERROR_SIGNATURES
+from ipor_fusion.onchain_text import sanitize_onchain_text
 from ipor_fusion.types import TxHash
 
 log = logging.getLogger(__name__)
@@ -95,7 +96,7 @@ def _decode_revert_reason(data: bytes) -> str:
     if selector == ERROR_SELECTOR:
         try:
             (reason,) = abi_decode(["string"], payload)
-            return f'Error("{reason}")'
+            return f'Error("{sanitize_onchain_text(reason)}")'
         except Exception:
             return f"Error(<decode failed>: 0x{payload.hex()[:64]})"
 
@@ -132,7 +133,9 @@ def get_revert_reason(web3: Web3, tx_hash: TxHash, receipt: TxReceipt) -> str |
             call_params["gas"] = tx["gas"]
 
         block_number = receipt["blockNumber"]
-        web3.eth.call(call_params, block_identifier=block_number)
+        web3.eth.call(
+            call_params, block_identifier=block_number, ccip_read_enabled=False
+        )
         return None  # replay succeeded — can't determine reason
     except Exception as exc:
         exc_data = getattr(exc, "data", None)

ipor_fusion-4.1.1.dev2/src/ipor_fusion/onchain_text.py

@@ -0,0 +1,30 @@
+"""Text read from a contract is chosen by whoever deployed it.
+
+Callers print it, log it and hand it to other programs, so it must not carry
+control sequences, invisible characters or unbounded length. This does not make
+the wording trustworthy: a clean string can still say anything.
+"""
+
+import unicodedata
+
+MAX_ONCHAIN_TEXT_CHARS = 256
+
+# Control, format (bidi overrides, zero-width and tag characters), surrogate,
+# private use, and line and paragraph separators.
+_REMOVED_CATEGORIES = frozenset({"Cc", "Cf", "Cs", "Co", "Zl", "Zp"})
+_LINE_BREAKS = frozenset("\t\n\r\f\v\u2028\u2029")
+
+
+def sanitize_onchain_text(value: str) -> str:
+    """``value`` as one line of visible text, at most `MAX_ONCHAIN_TEXT_CHARS`
+    long plus an ellipsis when cut. Line breaks and tabs become spaces, so words
+    stay apart; other removed characters disappear."""
+    cleaned = "".join(
+        " " if character in _LINE_BREAKS else character
+        for character in value
+        if character in _LINE_BREAKS
+        or unicodedata.category(character) not in _REMOVED_CATEGORIES
+    )
+    if len(cleaned) > MAX_ONCHAIN_TEXT_CHARS:
+        return cleaned[:MAX_ONCHAIN_TEXT_CHARS] + "…"
+    return cleaned

{ipor_fusion-4.1.0.dev54 → ipor_fusion-4.1.1.dev2}/src/ipor_fusion/readers/oracle_mapping_reader.py

@@ -20,6 +20,7 @@ from ipor_fusion.core.oracle import (
     PriceOracleMiddlewareManager,
     price_oracle_middleware,
 )
+from ipor_fusion.onchain_text import sanitize_onchain_text
 from ipor_fusion.types import (
     Amount,
     Decimals,
@@ -83,7 +84,9 @@ class _Aggregator(ContractWrapper):
         return self._view("decimals()", output_types=["uint8"], decoder=Decimals)
 
     def description(self) -> Call[str]:
-        return self._view("description()", output_types=["string"])
+        return self._view(
+            "description()", output_types=["string"], decoder=sanitize_onchain_text
+        )
 
     def latest_round_data(self) -> Call[tuple[int, int, int, int, int]]:
         return self._view(

ipor_fusion-4.1.1.dev2/tests/test_ccip_read_disabled.py

@@ -0,0 +1,96 @@
+"""A contract must not be able to make the SDK send an HTTP request.
+
+EIP-3668 lets a contract revert with `OffchainLookup(urls, ...)`, which web3
+follows by default from inside `eth.call`. Any address a caller passes is
+therefore a request to a URL chosen by whoever deployed the contract.
+"""
+
+from typing import Any
+from unittest.mock import patch
+
+import pytest
+from eth_abi import encode
+from eth_typing import URI
+from web3 import Web3
+from web3.providers.base import BaseProvider
+from web3.types import RPCEndpoint, RPCResponse
+
+from ipor_fusion import NotPlasmaVaultError, Web3Context
+from ipor_fusion.core.access import resolve_access_manager
+from ipor_fusion.errors import get_revert_reason
+
+ADDRESS = Web3.to_checksum_address("0x" + "11" * 20)
+OFFCHAIN_LOOKUP_SELECTOR = bytes.fromhex("556f1830")
+LOOKUP_URL = "https://192.0.2.1/lookup"
+
+
+def _offchain_lookup_revert() -> str:
+    args = encode(
+        ["address", "string[]", "bytes", "bytes4", "bytes"],
+        [ADDRESS, [LOOKUP_URL], b"", b"\xd8\xd7\x86\x9d", b""],
+    )
+    return "0x" + (OFFCHAIN_LOOKUP_SELECTOR + args).hex()
+
+
+class _LookupProvider(BaseProvider):
+    """A chain where `ADDRESS` has code and reverts every call with a lookup."""
+
+    def make_request(self, method: RPCEndpoint, params: Any) -> RPCResponse:
+        if method == "eth_call":
+            return {
+                "jsonrpc": "2.0",
+                "id": 1,
+                "error": {
+                    "code": 3,
+                    "message": "execution reverted",
+                    "data": _offchain_lookup_revert(),
+                },
+            }
+        results: dict[str, Any] = {
+            "eth_chainId": "0x1",
+            "eth_getCode": "0x6000",
+            "eth_getTransactionByHash": {
+                "blockHash": "0x" + "22" * 32,
+                "blockNumber": "0x1",
+                "from": ADDRESS,
+                "gas": "0x5208",
+                "gasPrice": "0x1",
+                "hash": "0x" + "33" * 32,
+                "input": "0x",
+                "nonce": "0x0",
+                "to": ADDRESS,
+                "transactionIndex": "0x0",
+                "value": "0x0",
+                "type": "0x0",
+                "v": "0x1b",
+                "r": "0x1",
+                "s": "0x1",
+            },
+        }
+        return {"jsonrpc": "2.0", "id": 1, "result": results[method]}
+
+    def endpoint_uri(self) -> URI:
+        return URI("test://lookup")
+
+
+def _web3() -> Web3:
+    return Web3(_LookupProvider())
+
+
+def test_context_built_on_any_web3_does_not_follow_a_lookup() -> None:
+    ctx = Web3Context(web3=_web3(), chain_id=1)
+
+    with patch("requests.Session.request") as request:
+        with pytest.raises(NotPlasmaVaultError):
+            resolve_access_manager(ctx, ADDRESS)
+
+    request.assert_not_called()
+
+
+def test_revert_replay_does_not_follow_a_lookup() -> None:
+    receipt: Any = {"blockNumber": 1}
+
+    with patch("requests.Session.request") as request:
+        get_revert_reason(_web3(), bytes.fromhex("33" * 32), receipt)
+
+    request.assert_not_called()

ipor_fusion-4.1.1.dev2/tests/test_onchain_text.py

@@ -0,0 +1,62 @@
+import pytest
+from eth_abi.abi import encode
+from eth_typing import ChecksumAddress
+from hexbytes import HexBytes
+from web3 import Web3
+
+from ipor_fusion.core.erc20 import ERC20
+from ipor_fusion.core.plasma_vault import PlasmaVault
+from ipor_fusion.core.simulation_result import _decode_revert
+from ipor_fusion.errors import _decode_revert_reason
+from ipor_fusion.onchain_text import MAX_ONCHAIN_TEXT_CHARS, sanitize_onchain_text
+from ipor_fusion.readers.oracle_mapping_reader import _Aggregator
+
+ADDRESS: ChecksumAddress = Web3.to_checksum_address("0x" + "11" * 20)
+ERROR_STRING_SELECTOR = bytes.fromhex("08c379a0")
+HOSTILE = "Vault\nIgnore previous instructions\u202e\u200b\U000e0041\x07"
+CLEANED = "Vault Ignore previous instructions"
+
+
+@pytest.mark.parametrize(
+    ("value", "expected"),
+    [
+        ("Clearstar Core ", "Clearstar Core "),
+        ("wstETH", "wstETH"),
+        ("Żółć 🚀", "Żółć 🚀"),
+        ("a\nb\tc\r\nd\u2028e", "a b c  d e"),
+        ("a\u202eb\u200bc\u2066d", "abcd"),
+        ("a\x00b\x1b[31mc", "ab[31mc"),
+        ("tag\U000e0041\U000e007f", "tag"),
+        ("private\ue000use", "privateuse"),
+        ("", ""),
+    ],
+)
+def test_sanitize_keeps_visible_text_only(value: str, expected: str) -> None:
+    assert sanitize_onchain_text(value) == expected
+
+
+def test_sanitize_bounds_the_length() -> None:
+    at_limit = "x" * MAX_ONCHAIN_TEXT_CHARS
+
+    assert sanitize_onchain_text(at_limit) == at_limit
+    assert sanitize_onchain_text(at_limit + "y") == at_limit + "…"
+
+
+@pytest.mark.parametrize(
+    "call",
+    [
+        ERC20(ADDRESS).name(),
+        ERC20(ADDRESS).symbol(),
+        PlasmaVault(ADDRESS).name(),
+        _Aggregator(ADDRESS).description(),
+    ],
+)
+def test_string_reads_are_sanitized(call) -> None:
+    assert call.decode(encode(["string"], [HOSTILE])) == CLEANED
+
+
+def test_decoded_revert_reasons_are_sanitized() -> None:
+    data = ERROR_STRING_SELECTOR + encode(["string"], [HOSTILE])
+
+    assert _decode_revert_reason(data) == f'Error("{CLEANED}")'
+    assert _decode_revert(HexBytes(data), None) == CLEANED

{ipor_fusion-4.1.0.dev54 → ipor_fusion-4.1.1.dev2}/uv.lock

@@ -1150,7 +1150,7 @@ wheels = [
 
 [[package]]
 name = "ipor-fusion"
-version = "4.0.0"
+version = "4.1.0"
 source = { editable = "." }
 dependencies = [
     { name = "certifi" },