Contributing guidelines

Local Development

Changing Rust Code

Please make sure that the following commands pass if you have changed the code:

cargo check --all
cargo test --all --all-features
cargo +nightly fmt -- --check
cargo +nightly clippy --workspace --all-features --all-targets -- -D warnings

We are using the stable toolchain for building and testing, but the nightly toolchain for formatting and linting, as it allows us to use the latest features of rustfmt and clippy.

If you are working in VSCode, we recommend you install the rust-analyzer extension, and use the following VSCode user settings:

"editor.formatOnSave": true,
"rust-analyzer.rustfmt.extraArgs": ["+nightly"],
"rust-analyzer.check.overrideCommand": [
"cargo",
"+nightly",
"clippy",
"--workspace",
"--all-features",
"--all-targets",
"--message-format=json"
],
"[rust]": {
"editor.defaultFormatter": "rust-lang.rust-analyzer"
}

Changing Solidity code

Setup

Install foudryup and foundry

curl -L https://foundry.paradigm.xyz | bash
foundryup

Executors

For security purposes, new Executors must have:

• No ERC20 token transfers

• No delegatecalls

• Only perform native ETH transfers if this behaviour is safely reflected in getTransferData or getCallbackTransferData

• Selector allowlist for caller-controlled calldata: If swap() forwards caller-supplied calldata to an external contract, validate the first 4 bytes against an explicit allowlist of permitted function selectors before making the call. Without this check, an attacker can supply a selector for an arbitrary function on the settlement contract — for example, one that withdraws the router's balance to an attacker-controlled address.

Running tests

Run from crates/tycho-execution/contracts/:

export ETH_RPC_URL=<url>
forge test

Code formatting

Run from crates/tycho-execution/contracts/:

forge fmt

Assembly

Please minimize use of assembly for security reasons.

Contract Analysis

We use Slither to detect any potential vulnerabilities in our contracts.

To run locally, simply install Slither in your conda env and run it inside the contracts directory.

conda create --name tycho-execution python=3.10
conda activate tycho-execution

pip install slither-analyzer
cd crates/tycho-execution/contracts
slither .

Creating a Pull Request

We use conventional commits as our convention for formatting commit messages and PR titles.