ethereum: fix helper scripts; stop sourcing env files

ethereum/Makefile

@@ -59,7 +59,11 @@ flattened: $(patsubst contracts/%, flattened/%, $(FLATTEN_FILES))
 .env: .env.test
 	cp $< $@
 
-test: test-forge test-identifiers
+test: test-forge test-identifiers test-release-helpers
+
+.PHONY: test-release-helpers
+test-release-helpers:
+	./sh/tests/release_helpers_test.sh
 
 .PHONY: test-upgrade
 test-upgrade: build .env node_modules

ethereum/README.md

@@ -15,17 +15,16 @@ To build the contracts:
 
 ### Deploying using Forge
 
-#### Create the ENV file
+#### Provide the deployment environment
 
-Before you can deploy the contracts, you need to create a file in `ethereum/env` with a name like `.env.blast` for mainnet
-or `.env.blast.testnet` for testnet. Substitute the appropriate chain name (as it will be in the worm client) and use the
-mentioned one as an example.
+Release helpers do not source repository `.env` files. Export the required values
+from a trusted operator environment before running them. Files under `ethereum/env`
+may be used as reviewed references, but must not be sourced.
 
-#### Create a symbolic link
-
-```shell
-ethereum$ ln -s env/.env.blast.testnet .env
-```
+`upgrade.sh` resolves an RPC with `worm info rpc` when `RPC_URL` is absent;
+register-all requires an explicit `RPC_URL`. Bulk upgrades clear inherited RPC
+overrides, so use `upgrade.sh` directly for a custom endpoint. `FORGE_ARGS` remains
+a whitespace-separated list of trusted operator-provided Foundry arguments.
 
 #### Deploy the Core contract
 
@@ -70,20 +69,24 @@ This will put the flattened files in `ethereum/flattened`.
 #### Upgrade the Core or TokenBridge Implementation
 
 ```shell
-ethereum$ MNEMONIC= ./sh/upgrade.sh testnet Core blast
-ethereum$ MNEMONIC= ./sh/upgrade.sh testnet TokenBridge blast
+ethereum$ MNEMONIC=<redacted> GUARDIAN_MNEMONIC=<redacted> ./sh/upgrade.sh testnet Core blast
+ethereum$ MNEMONIC=<redacted> GUARDIAN_MNEMONIC=<redacted> ./sh/upgrade.sh testnet TokenBridge blast
+ethereum$ MNEMONIC=<redacted> ./sh/upgrade.sh mainnet Core blast
 ```
 
 #### Registering Other Chains on a New TokenBridge
 
 ```shell
-ethereum$ MNEMONIC= ./sh/registerAllChainsOnTokenBridge.sh <network> <chainName> <tokenBridgeAddress>
+ethereum$ MNEMONIC=<redacted> RPC_URL=<reviewed> ./sh/registerAllChainsOnTokenBridge.sh <network> <chainName> <tokenBridgeAddress>
 ```
 
 ### Testing
 
 Run all ethereum tests using `make test`
 
+Run the release-helper compatibility and security tests without building the
+contracts using `make test-release-helpers`.
+
 ### User methods
 
 `submitVAA(bytes vaa)` can be used to execute a VAA.

ethereum/sh/deployCoreBridge.sh

@@ -2,8 +2,6 @@
 
 # MNEMONIC=<redacted> ./sh/deployCoreBridge.sh
 
-. .env
-
 [[ -z $INIT_SIGNERS ]] && { echo "Missing INIT_SIGNERS"; exit 1; }
 [[ -z $INIT_CHAIN_ID ]] && { echo "Missing INIT_CHAIN_ID"; exit 1; }
 [[ -z $INIT_GOV_CHAIN_ID ]] && { echo "Missing INIT_GOV_CHAIN_ID"; exit 1; }
@@ -29,4 +27,4 @@ echo "-- Wormhole Core Addresses -----------------------------------------------
 echo "| Setup address                | $SETUP_ADDRESS |"
 echo "| Implementation address       | $IMPLEMENTATION_ADDRESS |"
 echo "| Wormhole address             | $WORMHOLE_ADDRESS |"
-echo "-----------------------------------------------------------------------------"
+echo "-----------------------------------------------------------------------------"

ethereum/sh/deployCoreBridgeTron.js

@@ -15,8 +15,7 @@ const FEE_LIMIT_SUN = Number(process.env.TRON_FEE_LIMIT_SUN || 5_000_000_000); /
 const ORIGIN_ENERGY_LIMIT = Number(process.env.TRON_ORIGIN_ENERGY_LIMIT || 10_000_000);
 const USER_FEE_PERCENT = Number(process.env.TRON_USER_FEE_PERCENT || 100);
 
-// .env is shell-sourced, which strips the double quotes around array elements.
-// Re-quote any bare 0x-hex strings so JSON.parse can handle either form.
+// Accept both JSON arrays and the legacy bare-hex array format.
 const INIT_SIGNERS = JSON.parse(
   (process.env.INIT_SIGNERS || '[]')
     .replace(/"/g, '')

ethereum/sh/deployCoreBridgeTron.sh

@@ -1,13 +1,11 @@
 #!/bin/bash
 # Deploy Wormhole Core to Tron via tronweb-style HTTP API.
-# Usage: from ethereum/, copy env/.env.tron.testnet to .env, fill in TRON_PRIVATE_KEY,
-# then run ./sh/deployCoreBridgeTron.sh
+# Usage: from ethereum/, provide the required values in the operator environment,
+# then run ./sh/deployCoreBridgeTron.sh.
 
 set -euo pipefail
 
-set -a
-. .env
-set +a
+# Configuration must be supplied by the operator environment.
 
 [[ -z "${TRON_PRIVATE_KEY:-${MNEMONIC:-}}" ]] && { echo "Missing TRON_PRIVATE_KEY (or MNEMONIC)"; exit 1; }
 [[ -z "${INIT_SIGNERS:-}" ]] && { echo "Missing INIT_SIGNERS"; exit 1; }

ethereum/sh/deployCoreShutdown.sh

@@ -2,8 +2,6 @@
 
 # MNEMONIC=<redacted> ./sh/deployCoreShutdown.sh
 
-. .env
-
 [[ -z $INIT_EVM_CHAIN_ID ]] && { echo "Missing INIT_EVM_CHAIN_ID"; exit 1; }
 
 [[ -z $MNEMONIC ]] && { echo "Missing MNEMONIC"; exit 1; }

ethereum/sh/deployDelegatedGuardians.sh

@@ -1,8 +1,5 @@
 #!/bin/bash
 
-. .env
-
-
 [[ -z $MNEMONIC ]] && { echo "Missing MNEMONIC"; exit 1; }
 [[ -z $RPC_URL ]] && { echo "Missing RPC_URL"; exit 1; }
 [[ -z $WORMHOLE_ADDRESS ]] && { echo "Missing WORMHOLE_ADDRESS"; exit 1; }

ethereum/sh/deployNFTBridge.sh

@@ -2,8 +2,6 @@
 
 # MNEMONIC=<redacted> WORMHOLE_ADDRESS=<from_the_previous_command> ./sh/deployNFTBridge.sh
 
-. .env
-
 [[ -z $INIT_EVM_CHAIN_ID ]] && { echo "Missing INIT_EVM_CHAIN_ID"; exit 1; }
 
 [[ -z $BRIDGE_INIT_CHAIN_ID ]] && { echo "Missing BRIDGE_INIT_CHAIN_ID"; exit 1; }

ethereum/sh/deployTokenBridge.sh

@@ -2,8 +2,6 @@
 
 # MNEMONIC=<redacted> WORMHOLE_ADDRESS=<from_the_previous_command> ./sh/deployTokenBridge.sh
 
-. .env
-
 [[ -z $INIT_EVM_CHAIN_ID ]] && { echo "Missing INIT_EVM_CHAIN_ID"; exit 1; }
 
 [[ -z $BRIDGE_INIT_CHAIN_ID ]] && { echo "Missing BRIDGE_INIT_CHAIN_ID"; exit 1; }

ethereum/sh/deployTokenBridgeShutdown.sh

@@ -2,8 +2,6 @@
 
 # MNEMONIC=<redacted> ./sh/deployTokenBridgeShutdown.sh
 
-. .env
-
 [[ -z $INIT_EVM_CHAIN_ID ]] && { echo "Missing INIT_EVM_CHAIN_ID"; exit 1; }
 
 [[ -z $MNEMONIC ]] && { echo "Missing MNEMONIC"; exit 1; }

ethereum/sh/devnetInitialization.sh

@@ -14,10 +14,8 @@ else
   fi
 fi
 
-# Load the environment variables from .env
-if [ -f .env ]; then
-  source .env
-else
+# Keep .env as data for registration VAA collection below; do not execute it.
+if [ ! -f .env ]; then
   echo "The .env file does not exist."
   exit 1
 fi

ethereum/sh/registerAllChainsOnTokenBridge.sh

@@ -13,33 +13,34 @@ if [ $# != 3 ]; then
 	exit 1
 fi
 
-[[ -z $MNEMONIC ]] && { echo "Missing MNEMONIC"; exit 1; }
+[[ -z ${MNEMONIC:-} ]] && { echo "Missing MNEMONIC"; exit 1; }
 
 network=$1
 chain=$2
 token_bridge_address=$3
 
-# Figure out which env file and VAA files to use.
-env_file=""
+# Figure out which VAA file to use.
 input_file=""
 case "$network" in
     mainnet)
-				env_file="env/.env.${chain}"
         input_file="../deployments/mainnet/tokenBridgeVAAs.csv"
     ;;
     testnet)
-				env_file="env/.env.${chain}.testnet"
         input_file="../deployments/testnet/tokenBridgeVAAs.csv"
 		;;
 		*) echo "unknown network $network, must be testnet or mainnet" >&2
 		exit 1
     ;;
 esac
 
-# Source in the env file to get the RPC and forge arguments.
-. ${env_file}
+# Do not continue with an empty registration batch when the CSV is unavailable.
+[[ -r "$input_file" ]] || { echo "Unable to read $input_file" >&2; exit 1; }
 
-[[ -z $RPC_URL ]] && { echo "Missing RPC_URL"; exit 1; }
+# Configuration must be supplied by the operator environment.
+[[ -z ${RPC_URL:-} ]] && { echo "Missing RPC_URL"; exit 1; }
+
+# Match the target by Wormhole chain ID, not an ambiguous name substring.
+worm_chain_id=$(worm info chain-id "$chain") || exit 1
 
 # Build one long string of all the vaas in the input file.
 vaas=""
@@ -57,8 +58,8 @@ do
 	vaa=`echo $line | cut -d, -f2`
 
 	# Skip this chain. (We don't want to register this chain on itself.)
-	echo $tag | grep -i ${chain} > /dev/null
-	if [ $? == 0 ]; then
+	if [[ "$tag" == *"($worm_chain_id)"* ]]; then
+		found_us=$((found_us + 1))
 		continue
 	fi
 
@@ -68,16 +69,20 @@ do
 	fi
 
 	vaas="${vaas}0x${vaa}"
-	count=$(($count+1))  
+	count=$(($count+1))
 done < "$input_file"
 
+# The target row is required as a sanity check and must be unambiguous.
+[ "$found_us" -eq 1 ] || { echo "Expected exactly one VAA for $chain" >&2; exit 1; }
+
 # Make it look like an array.
 vaas="[${vaas}]"
 echo $vaas
 
 echo "Submitting ${count} VAAs to ${network} ${chain} token bridge at address ${token_bridge_address} and rpc ${RPC_URL}"
+# Keep the repository-derived VAA list inside one Forge argument.
 forge script ./forge-scripts/RegisterChainsTokenBridge.s.sol:RegisterChainsTokenBridge \
-	--sig "run(address,bytes[])" $token_bridge_address $vaas \
-	--rpc-url $RPC_URL \
-	--private-key $MNEMONIC \
+	--sig "run(address,bytes[])" "$token_bridge_address" "$vaas" \
+	--rpc-url "$RPC_URL" \
+	--private-key "$MNEMONIC" \
 	--broadcast ${FORGE_ARGS}

ethereum/sh/registerChainsNFTBridge.sh

@@ -2,15 +2,14 @@
 
 # MNEMONIC=<redacted> ./sh/registerChainsNFTBridge.sh
 
-. .env
-
-[[ -z $MNEMONIC ]] && { echo "Missing MNEMONIC"; exit 1; }
-[[ -z $RPC_URL ]] && { echo "Missing RPC_URL"; exit 1; }
-[[ -z $NFT_BRIDGE_ADDRESS ]] && { echo "Missing NFT_BRIDGE_ADDRESS"; exit 1; }
-[[ -z $NFT_BRIDGE_REGISTRATION_VAAS ]] && { echo "Missing NFT_BRIDGE_REGISTRATION_VAAS"; exit 1; }
+[[ -z ${MNEMONIC:-} ]] && { echo "Missing MNEMONIC"; exit 1; }
+[[ -z ${RPC_URL:-} ]] && { echo "Missing RPC_URL"; exit 1; }
+[[ -z ${NFT_BRIDGE_ADDRESS:-} ]] && { echo "Missing NFT_BRIDGE_ADDRESS"; exit 1; }
+[[ -z ${NFT_BRIDGE_REGISTRATION_VAAS:-} ]] && { echo "Missing NFT_BRIDGE_REGISTRATION_VAAS"; exit 1; }
 
+# Keep each operator value in its intended Forge argument.
 forge script ./forge-scripts/RegisterChainsNFTBridge.s.sol:RegisterChainsNFTBridge \
-	--sig "run(address,bytes[])" $NFT_BRIDGE_ADDRESS $NFT_BRIDGE_REGISTRATION_VAAS \
-	--rpc-url $RPC_URL \
-	--private-key $MNEMONIC \
+	--sig "run(address,bytes[])" "$NFT_BRIDGE_ADDRESS" "$NFT_BRIDGE_REGISTRATION_VAAS" \
+	--rpc-url "$RPC_URL" \
+	--private-key "$MNEMONIC" \
 	--broadcast

ethereum/sh/registerChainsTokenBridge.sh

@@ -2,15 +2,14 @@
 
 # MNEMONIC=<redacted> ./sh/registerChainsTokenBridge.sh
 
-. .env
-
-[[ -z $MNEMONIC ]] && { echo "Missing MNEMONIC"; exit 1; }
-[[ -z $RPC_URL ]] && { echo "Missing RPC_URL"; exit 1; }
-[[ -z $TOKEN_BRIDGE_ADDRESS ]] && { echo "Missing TOKEN_BRIDGE_ADDRESS"; exit 1; }
-[[ -z $TOKEN_BRIDGE_REGISTRATION_VAAS ]] && { echo "Missing TOKEN_BRIDGE_REGISTRATION_VAAS"; exit 1; }
+[[ -z ${MNEMONIC:-} ]] && { echo "Missing MNEMONIC"; exit 1; }
+[[ -z ${RPC_URL:-} ]] && { echo "Missing RPC_URL"; exit 1; }
+[[ -z ${TOKEN_BRIDGE_ADDRESS:-} ]] && { echo "Missing TOKEN_BRIDGE_ADDRESS"; exit 1; }
+[[ -z ${TOKEN_BRIDGE_REGISTRATION_VAAS:-} ]] && { echo "Missing TOKEN_BRIDGE_REGISTRATION_VAAS"; exit 1; }
 
+# Keep each operator value in its intended Forge argument.
 forge script ./forge-scripts/RegisterChainsTokenBridge.s.sol:RegisterChainsTokenBridge \
-	--sig "run(address,bytes[])" $TOKEN_BRIDGE_ADDRESS $TOKEN_BRIDGE_REGISTRATION_VAAS \
-	--rpc-url $RPC_URL \
-	--private-key $MNEMONIC \
+	--sig "run(address,bytes[])" "$TOKEN_BRIDGE_ADDRESS" "$TOKEN_BRIDGE_REGISTRATION_VAAS" \
+	--rpc-url "$RPC_URL" \
+	--private-key "$MNEMONIC" \
 	--broadcast