[new-plugin] solv-solvbtc v0.1.0#180
Conversation
skylavis-sky
temporarily deployed
to
summary-generation
GitHub Actions
Inactive
Phase 4: Summary + Pre-flight for
|
| Command | Description |
|---|---|
get-nav |
Fetch current SolvBTC/xSolvBTC prices and protocol TVL |
get-balance |
Query SolvBTC and xSolvBTC balances on specified chain |
mint |
Deposit WBTC to receive SolvBTC tokens |
redeem |
Submit non-instant withdrawal request to get WBTC back |
cancel-redeem |
Cancel pending redemption request |
wrap |
Wrap SolvBTC into yield-bearing xSolvBTC (Ethereum only) |
unwrap |
Unwrap xSolvBTC back to SolvBTC (Ethereum only) |
Triggers
Activate when users want to interact with liquid BTC protocols, earn yield on Bitcoin holdings, or perform operations involving SolvBTC, xSolvBTC, or WBTC deposits/withdrawals. This skill is specifically for Solv Protocol operations on Arbitrum and Ethereum networks.
Auto-injected Pre-flight
## Pre-flight Dependencies (auto-injected by Plugin Store CI)
> Run once per session before first use. These checks ensure required tools are installed.
### Install solv-solvbtc binary (auto-injected)
```bash
if ! command -v solv-solvbtc >/dev/null 2>&1; then
OS=$(uname -s | tr A-Z a-z)
ARCH=$(uname -m)
case "${OS}_${ARCH}" in
darwin_arm64) TARGET="aarch64-apple-darwin" ;;
darwin_x86_64) TARGET="x86_64-apple-darwin" ;;
linux_x86_64) TARGET="x86_64-unknown-linux-gnu" ;;
linux_aarch64) TARGET="aarch64-unknown-linux-gnu" ;;
esac
curl -fsSL "https://github.com/MigOKG/plugin-store/releases/download/plugins/solv-solvbtc@0.1.0/solv-solvbtc-${TARGET}" -o ~/.local/bin/solv-solvbtc
chmod +x ~/.local/bin/solv-solvbtc
fiReport install (auto-injected, runs once)
REPORT_FLAG="$HOME/.plugin-store/reported/solv-solvbtc"
if [ ! -f "$REPORT_FLAG" ]; then
mkdir -p "$HOME/.plugin-store/reported"
# Device fingerprint → SHA256 → 32-char device ID
DEV_RAW="$(hostname):$(uname -s):$(uname -m):$HOME"
DEV_ID=$(echo -n "$DEV_RAW" | shasum -a 256 | head -c 32)
# HMAC signature (obfuscated key, same as CLI binary)
_K=$(echo 'OE9nNWFRUFdfSVJkektrMExOV2RNeTIzV2JibXo3ZWNTbExJUDFIWnVoZw==' | base64 -d 2>/dev/null || echo 'OE9nNWFRUFdfSVJkektrMExOV2RNeTIzV2JibXo3ZWNTbExJUDFIWnVoZw==' | openssl base64 -d)
HMAC_SIG=$(echo -n "${_K}${DEV_ID}" | shasum -a 256 | head -c 8)
DIV_ID="${DEV_ID}${HMAC_SIG}"
unset _K
# Report to Vercel stats
curl -s -X POST "https://plugin-store-dun.vercel.app/install" \
-H "Content-Type: application/json" \
-d '{"name":"solv-solvbtc","version":"0.1.0"}' >/dev/null 2>&1 || true
# Report to OKX API (with HMAC-signed device token)
curl -s -X POST "https://www.okx.com/priapi/v1/wallet/plugins/download/report" \
-H "Content-Type: application/json" \
-d '{"pluginName":"solv-solvbtc","divId":"'"$DIV_ID"'"}' >/dev/null 2>&1 || true
touch "$REPORT_FLAG"
fi
</details>
---
*Generated by Plugin Store CI after maintainer approval.*
📋 Phase 3: AI Code Review Report — Score: 78/100
1. Plugin Overview
Summary: This plugin enables interaction with Solv Protocol's SolvBTC system — allowing users to mint SolvBTC by depositing WBTC, redeem SolvBTC back to WBTC, wrap SolvBTC into yield-bearing xSolvBTC, and unwrap it. It also provides NAV/price queries and balance checking on Arbitrum and Ethereum. Target Users: BTC holders seeking yield through Solv Protocol's liquid BTC products on Arbitrum and Ethereum. 2. Architecture AnalysisComponents:
Skill Structure: Data Flow:
Dependencies:
3. Auto-Detected Permissionsonchainos Commands Used
Wallet Operations
External APIs / URLs
Chains Operated On
Overall Permission SummaryThis plugin has high-risk financial capabilities: it constructs ERC-20 approval transactions and deposit/withdrawal calls to Solv Protocol smart contracts, then delegates signing and broadcasting to 4. onchainos API ComplianceDoes this plugin use onchainos CLI for all on-chain write operations?Yes — All write operations (approve, deposit, withdraw, cancel) are routed through On-Chain Write Operations (MUST use onchainos)
Data Queries (allowed to use external sources)
External APIs / Libraries Detected
Verdict: ✅ Fully CompliantAll on-chain write operations use 5. Security AssessmentStatic Rule Scan (C01-C09, H01-H09, M01-M08, L01-L02)
All other static rules (C01-C09, H01-H04, H06-H09, M01-M06, L01-L02) — not matched. LLM Judge Analysis (L-PINJ, L-MALI, L-MEMA, L-IINJ, L-AEXE, L-FINA, L-FISO)
Toxic Flow Detection (TF001-TF006)
No toxic flows detected. Prompt Injection Scan
Result: ✅ Clean Dangerous Operations Check
Result: Data Exfiltration Risk
Result: ✅ No Risk Overall Security Rating: 🟡 Medium RiskMedium risk due to:
6. Source Code SecuritySource code is referenced (Rust binary at Language & Build Config
Dependency AnalysisCannot analyze without full source code. Key external dependencies inferred:
Code Safety Audit
Does SKILL.md accurately describe what the source code does?Cannot fully verify without source code. The SKILL.md description is internally consistent and the declared API endpoints match the described functionality. Verdict:
|
| Dimension | Score | Notes |
|---|---|---|
| Completeness (pre-flight, commands, error handling) | 18/25 | 7 commands well-documented with parameters, options, triggers. Missing: no pre-flight checks section (no onchainos install/version verification). No error handling section for common failures (RPC timeouts, insufficient balance, approval failures). |
| Clarity (descriptions, no ambiguity) | 22/25 | Clear token hierarchy diagram, explicit chain support table, contract addresses documented. Minor: could better explain the approve+deposit two-step flow for users unfamiliar with DeFi. |
| Security Awareness (confirmations, slippage, limits) | 18/25 | Explicit user confirmation requirement for transactions. Trust boundary declaration present. xSolvBTC NAV vs market price warning included. Concerns: automatic --force flag, no explicit slippage warnings for wrap/unwrap, no mention of approval amount limits (unlimited vs exact). |
| Skill Routing (defers correctly, no overreach) | 13/15 | Correct "Do NOT use for" section. Properly delegates to onchainos for signing. Does not attempt to handle non-Solv operations. Minor: no explicit routing to okx-security for pre-transaction scanning. |
| Formatting (markdown, tables, code blocks) | 7/10 | Good use of tables for chains, contracts, function selectors. Command documentation uses consistent format. Missing code block examples for full command invocations with onchainos integration. |
Strengths
- Explicit data trust boundary declaration — matches best practices from the security rules
- User confirmation requirement clearly stated before any write operation
- Comprehensive contract address documentation — all addresses, function selectors, and chain mappings are transparent and verifiable
- Clear token hierarchy explanation (WBTC → SolvBTC → xSolvBTC) with operation mapping
Issues Found
-
🔴 Critical: Automatic
--forceflag — The binary automatically passes--forcetoonchainos wallet contract-call, bypassing onchainos's backend confirmation/risk-warning system. This is stated in SKILL.md: "All transactions require --force (handled automatically by the binary)". While SKILL.md instructs the agent to confirm with the user first, the backend safety net is removed. If the agent fails to confirm (due to prompt injection or bug), the transaction executes without any safety check. Recommendation: Remove automatic--force; let the agent handle the confirming response flow as designed by onchainos. -
🟡 Important: No pre-flight checks section — Unlike official OKX skills, this plugin has no onchainos installation/version verification flow. The binary depends on
onchainos wallet contract-callbeing available but doesn't verify this. -
🟡 Important: No approval amount specification — The SKILL.md mentions ERC-20 approve but doesn't specify whether it uses unlimited approval (
type(uint256).max) or exact amounts. Unlimited approvals are a security risk per onchainos's own security notes. -
🟡 Important: Missing pre-transaction security scan recommendation — The plugin should recommend running
onchainos security tx-scanbefore executing contract calls, following the pattern established byokx-agentic-wallet("Runonchainos security tx-scanfirst"). -
🔵 Minor: No error handling documentation — No guidance on what happens when: RPC is down, balance is insufficient, approval fails, nonce conflicts occur during the 3-second delay between approve and deposit.
-
🔵 Minor: Third-party install tracking —
plugin-store-dun.vercel.app/installis a Vercel-hosted endpoint controlled by the plugin author. While not actively malicious, this should be disclosed more prominently or removed if not essential.
8. Recommendations
-
🔴 Remove automatic
--forceflag — Let the binary respect onchainos's confirming response flow (exit code 2). The agent should handle the confirm →--forceretry pattern as documented inokx-agentic-wallet. This preserves the backend safety net for high-risk transactions. -
🟡 Add pre-flight checks section — Include onchainos installation/version verification following the pattern from official skills (check version, verify binary integrity).
-
🟡 Document approval amounts — Specify whether the plugin uses exact or unlimited ERC-20 approvals. If unlimited, add a warning per onchainos security guidelines. Prefer exact amount approvals.
-
🟡 Add security scan recommendation — Before
mint,redeem,wrap,unwrap, recommendonchainos security tx-scanto validate the transaction calldata. -
🟡 Add error handling section — Document common failure modes: insufficient balance, RPC timeout, nonce mismatch during approve→deposit sequence, unsupported chain.
-
🔵 Enumerate display fields — To fully satisfy M08, explicitly list which fields should be displayed to users (e.g., "Display: token symbol, balance in UI units, USD value, chain name. Do NOT render raw API response fields directly.").
-
🔵 Clarify install tracking endpoint — Document the purpose of
plugin-store-dun.vercel.app/installin the SKILL.md or README. Consider whether this telemetry is necessary. -
🔵 Add full command examples — Show complete end-to-end examples including the onchainos wallet contract-call invocations that the binary generates internally, so auditors can verify the calldata flow.
9. Reviewer Summary
One-line verdict: Well-structured DeFi plugin with correct onchainos API compliance and good security practices, but the automatic --force flag bypasses backend safety checks and must be addressed before merge.
Merge recommendation: 🔍 Needs changes before merge
Specific items to address:
- [Critical] Remove automatic
--forcefrom the binary — let the confirming response flow work as designed - [Important] Add pre-flight checks for onchainos availability
- [Important] Document and prefer exact-amount ERC-20 approvals over unlimited
- [Important] Add security scan recommendation before write operations
Generated by Claude AI via Anthropic API — review the full report before approving.
🔨 Phase 2: Build Verification — ❌ FAILED
Build failed. Check the workflow logs. Source integrity: commit SHA |
✅ Phase 1: Structure Validation — PASSED→ Proceeding to Phase 2: Build Verification |
1 participant
New Plugin Submission: solv-solvbtc v0.1.0
Plugin: Solv Protocol SolvBTC — mint yield-bearing BTC on Arbitrum/Ethereum
Author: skylavis-sky
Category: defi-protocol
Source