Vault migration withdrawal validator#13
Conversation
There was a problem hiding this comment.
Pull request overview
Adds a new HydraAccount “migration” path to support migrating account UTxOs from an old hydra_account script hash to a new one using an oracle-provided target script hash and updated hydra_order_book_script_hash.
Changes:
- Introduces a new
migrationwithdrawal validator and wires it intohydra_account/core.akviaHydraAccountMigrate/ProcessMigration. - Tightens hydra internal transferal rules to disallow unrelated hydra_account inputs/outputs (beyond the
from/toaccounts) while allowing non-account inputs/outputs. - Adds specs and tests for the migration flow and updates types to include the new redeemer/operation.
Reviewed changes
Copilot reviewed 11 out of 12 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| validators/hydra_account/migration.ak | New withdrawal validator enforcing migration rules (old → new script) and trading logic update. |
| validators/hydra_account/core.ak | Adds HydraAccountMigrate spend handling + ProcessMigration withdrawal dispatch. |
| validators/hydra_account/transferal.ak | Updates “no other inputs/outputs” rule to be specific to hydra_account address. |
| lib/hydra_dex/types.ak | Adds HydraAccountMigrate and ProcessMigration variants. |
| validators/tests/hydra_account/migration.ak | New test suite for migration withdrawal validator. |
| validators/tests/hydra_account/spend.ak | Adds spend-path tests for the new migrate redeemer. |
| validators/tests/hydra_account/transferal.ak | Updates transferal tests to cover the new “no other hydra_account inputs/outputs” rule. |
| validators/tests/utils.ak | Adds migration-related mock hashes, datum, and helper account constructors. |
| spec/8_hydra_account/w_migration.md | New spec describing migration withdrawal behavior and workflow. |
| spec/8_hydra_account/core.md | Documents HydraAccountMigrate spend behavior. |
| spec/8_hydra_account/w_transferal.md | Updates transferal spec to match the new filtering rule. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| - Same `master_key` | ||
| - Same `operation_key` | ||
| - `trading_logic` updated to new `hydra_order_book_script_hash` from oracle | ||
| - Total value preserved: `inputs_value(AI) == outputs_value(AO)` |
There was a problem hiding this comment.
The spec says migration preserves total value: inputs_value(AI) == outputs_value(AO), but the implementation currently preserves only without_lovelace() value. Please clarify whether lovelace is intentionally excluded (and update the spec wording accordingly) or update the validator to preserve full value.
| - Total value preserved: `inputs_value(AI) == outputs_value(AO)` | |
| - Total non-ADA value preserved (excluding lovelace): `inputs_value(AI).without_lovelace() == outputs_value(AO).without_lovelace()` |
| 1. Cancel all existing orders | ||
| 2. Combine `hydra_account` utxos into 1 utxo per user | ||
| 3. Update the `dex_order_book` oracle datum with new script hashes (`hydra_account` and `hydra_order_book` mainly) and `hydra_signers` keys | ||
| 4. Migrate all `hydra_account` UTxOs using `ProcessMigration` withdrawal on the **new** script |
There was a problem hiding this comment.
Migration workflow step 4 says to use ProcessMigration withdrawal on the new script, but the surrounding description (and HydraAccountMigrate spend logic) implies the withdrawal script that must be present is the old hydra_account script hash being spent. Please fix this to avoid confusing integrators about which withdrawal script hash must be included in the transaction.
| 4. Migrate all `hydra_account` UTxOs using `ProcessMigration` withdrawal on the **new** script | |
| 4. Migrate all `hydra_account` UTxOs using `ProcessMigration` withdrawal on the **old** `hydra_account` script |
| // - Total value preserved | ||
| let ai_value = inputs_value(account_inputs) |> without_lovelace() | ||
| let ao_value = outputs_value(account_outputs) |> without_lovelace() | ||
| let is_value_preserved = ai_value == ao_value |
There was a problem hiding this comment.
is_value_preserved compares inputs_value/outputs_value after without_lovelace(). This means a migration can pass while moving arbitrary lovelace out of the old account UTxO(s) (and, if an account UTxO only holds lovelace, the check becomes 0 == 0 and account_outputs can even be empty). If the intent is to preserve full value (as the spec/PR description suggest), compare full Value (including lovelace) and/or add explicit constraints for lovelace (e.g., allow only fee-related delta) and require at least one migrated output at the new script address.
kenlau666
force-pushed
the
feat/vault-migration
branch
from
b918e50 to
dfa8776
Compare
Summary
Add a new
migrationwithdrawal validator to the hydra account module, enabling safe migration of account UTxOs from an old script to a new script while preserving value and updating thetrading_logicreference.Changes
Core Changes
trading_logicto newhydra_order_book_script_hashHydraAccountMigrateredeemer handling andProcessMigrationoperation dispatch to the core account validatorHydraAccountMigrateredeemer variant andProcessMigrationoperation typeSpecs
Tests
Build
Commits
2 commits
Generated by
/wf:create-pr