feat(erc20-bridge): issue TRUF tokens to layer-1

[williamrusdyputra]

Related Problem

resolves: https://github.com/trufnetwork/truf-network/issues/1155

How Has This Been Tested?

Before (look at the CCIP-BnM token)

Lock and Issue tokens to layer-1 (Ethereum)

List Rewards for Claim (at first, the pending status will be true)

After a while, it will be confirmed (pending status false)

you can use these params from list_wallet_rewards to claim the tokens.

After Claim

https://sepolia.etherscan.io/tx/0x1fee4f4c449f4240bae64bd5f5cc485deeffc49b5a01fa7518e86b8218ce575b
https://sepolia.etherscan.io/address/0x2D4f435867066737bA1617ef024E073413909Ad2#events

Summary by CodeRabbit

• New Features
  • Added admin actions to issue tokens via the ERC-20 bridge on Sepolia and Mainnet, enabling controlled minting to specified addresses. Improves operational responsiveness without altering existing user flows.
• Documentation
  • Added a high-level overview of the bridge lifecycle (lock, issue, prove, claim) to improve clarity for operators and support.

[coderabbitai]

Walkthrough

Adds two new public admin issuance actions in the ERC20 bridge migration: one for sepolia and one for mainnet. Each action forwards to the corresponding bridge’s issue function with the address and amount cast to NUMERIC(78,0). No existing actions are modified.

Changes

Cohort / File(s)	Summary
ERC20 bridge admin issuance actions internal/migrations/erc20-bridge/001-actions.sql	Added public actions: sepolia_admin_issue_tokens(text, text) → sepolia_bridge.issue(...) and mainnet_admin_issue_tokens(text, text) → mainnet_bridge.issue(...); includes a doc block outlining bridge flow.

Sequence Diagram(s)

sequenceDiagram
  autonumber
  actor Admin
  participant DB as DB Actions
  participant Sepolia as sepolia_bridge
  participant Mainnet as mainnet_bridge

  rect rgb(235, 245, 255)
    note over Admin,DB: Admin issues tokens (environment-specific)
    Admin->>DB: sepolia_admin_issue_tokens(to, amount)
    DB->>Sepolia: issue(to, amount::NUMERIC(78,0))
    Sepolia-->>DB: ack
    DB-->>Admin: result
  end

  rect rgb(245, 235, 255)
    note over Admin,DB: Alternative: mainnet issuance
    Admin->>DB: mainnet_admin_issue_tokens(to, amount)
    DB->>Mainnet: issue(to, amount::NUMERIC(78,0))
    Mainnet-->>DB: ack
    DB-->>Admin: result
  end

Loading

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• feat(erc20-bridge): view TRUF wallet balance #1144 — Also modifies ERC20 bridge actions using the same sepolia_bridge/mainnet_bridge aliases, likely coordinating bridge behavior.

Suggested reviewers

• MicBun

Pre-merge checks (5 passed)

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title Check	✅ Passed	The current title “feat: issue TRUF tokens to layer-1” directly and concisely summarizes the primary change of adding token issuance functionality for layer-1, matching the PR’s main objective without unrelated noise.
Linked Issues Check	✅ Passed	The PR adds the missing reward issuance actions by introducing public admin functions for both Sepolia and Mainnet bridges, directly addressing issue #1155’s requirement to create the “issue reward” action within the code.
Out of Scope Changes Check	✅ Passed	All modifications are confined to adding the required issuance actions and accompanying documentation, with no unrelated files or features altered beyond the linked issue’s scope.
Docstring Coverage	✅ Passed	No functions found in the changes. Docstring coverage check skipped.

Poem

A bunny taps the ledger keys—hop, hop, approve!
New routes for minting, tidy and smooth.
Sepolia springs, Mainnet sings,
Numbers cast in precise rings.
Carrots tall, balances true—
Bridges built, rewards come through. 🥕✨

Tip

👮 Agentic pre-merge checks are now available in preview!

Pro plan users can now enable pre-merge checks in their settings to enforce checklists before merging PRs.

• Built-in checks – Quickly apply ready-made checks to enforce title conventions, require pull request descriptions that follow templates, validate linked issues for compliance, and more.
• Custom agentic checks – Define your own rules using CodeRabbit’s advanced agentic capabilities to enforce organization-specific policies and workflows. For example, you can instruct CodeRabbit’s agent to verify that API documentation is updated whenever API schema files are modified in a PR. Note: Upto 5 custom checks are currently allowed during the preview period. Pricing for this feature will be announced in a few weeks.

Please see the documentation for more information.

Example:

reviews:
  pre_merge_checks:
    custom_checks:
      - name: "Undocumented Breaking Changes"
        mode: "warning"
        instructions: |
          Pass/fail criteria: All breaking changes to public APIs, CLI flags, environment variables, configuration keys, database schemas, or HTTP/GraphQL endpoints must be documented in the "Breaking Change" section of the PR description and in CHANGELOG.md. Exclude purely internal or private changes (e.g., code not exported from package entry points or explicitly marked as internal).

Please share your feedback with us on this Discord post.

✨ Finishing Touches

🧪 Generate unit tests

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch feat/issue-tokens

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 0

🧹 Nitpick comments (1)

internal/migrations/erc20-bridge/001-actions.sql (1)

1-8: Doc block is helpful; clarify auth and idempotency in the flow.

Please note explicitly that step 2 is an admin-only operation and how double-issue is prevented (e.g., by a unique lock/message ID). Also consider adding a short CLI example showing list_wallet_rewards filtered by namespace and receiver.

Can you confirm the doc reflects the actual guarantees (RBAC + idempotency) of the underlying bridge.issue implementation?

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between a699da9 and fd1c19e.

📒 Files selected for processing (1)

• internal/migrations/erc20-bridge/001-actions.sql (3 hunks)

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)

• GitHub Check: acceptance-test
• GitHub Check: lint

🔇 Additional comments (5)

internal/migrations/erc20-bridge/001-actions.sql (5)

24-27: Type choice looks correct for uint256-sized amounts.

Casting to NUMERIC(78,0) is appropriate for 256-bit integer ranges. LGTM.

Also applies to: 42-43

---

40-41: No-op formatting change.

Nothing to address here.

---

24-27: Restrict PUBLIC exposure or assert RBAC checks
No policies or grants were found restricting sepolia_admin_issue_tokens or sepolia_bridge.issue, so this action remains callable by anyone. Either change the action to PRIVATE and grant EXECUTE only to an admin role, or verify and document that sepolia_bridge.issue (and its mainnet counterpart) enforce proper RBAC internally.

---

24-27: Idempotency: include a unique message identifier in issue actions
The sepolia_admin_issue_tokens and mainnet_admin_issue_tokens actions currently don’t accept or propagate any lock/message ID. Confirm whether sepolia_bridge.issue/mainnet_bridge.issue deduplicates internally; if not, extend these actions to take a message_id (or similar) and return it for safe retry/de-duplication.

---

24-27: Verify input validation for sepolia_admin_issue_tokens: ensure $amount is a positive integer (no decimals), within the token cap, and $to_address is a non-zero, 0x-prefixed, 42-char address. Confirm whether sepolia_bridge.issue or the UI already enforce these; if not, add pre-cast guards to fail fast with clear errors.

[holdex]

Time Submission Status

Member	Status	Time	Action	Last Update
williamrusdyputra	✅ Submitted	3h	Update time	Sep 10, 2025, 8:30 AM
MicBun	✅ Submitted	20min	Update time	Sep 10, 2025, 11:57 AM