feat: upgrade script

[simonas-notcat]

No description provided.

[github-actions]

Summary of Test Results if Merged To Main:

• Full logs & artifacts are available in the Actions tab
• This comment will update automatically with new CI runs

✅ All 148 tests passed! (2 skipped, Total: 150)

Test Results for Merge

Test Suite	Status	Coverage	Time
test/unit/EthMultiVault/CreateAtom.t.sol	✅	100% (6/6)	0.004s
test/unit/EthMultiVault/RedeemAtomCurve.t.sol	✅	100% (4/4)	0.004s
test/unit/EthMultiVault/AdminMultiVault.t.sol	✅	100% (16/16)	0.007s
test/unit/EthMultiVault/CreateTriple.t.sol	✅	100% (6/6)	0.007s
test/unit/EthMultiVault/Approvals.t.sol	✅	100% (2/2)	0.005s
test/unit/EthMultiVault/RedeemTriple.t.sol	✅	100% (5/5)	0.008s
test/unit/EthMultiVault/EmergencyRedeemTriple.t.sol	✅	100% (5/5)	0.016s
test/unit/EthMultiVault/CurveComparison.t.sol	✅	100% (6/6)	0.009s
test/unit/EthMultiVault/RedeemTripleCurve.t.sol	✅	100% (5/5)	0.012s
test/unit/EthMultiVault/EmergencyReedemAtom.t.sol	✅	100% (4/4)	0.012s
test/BaseTest.sol	✅	100% (2/2)	0.017s
test/unit/EthMultiVault/BatchCreateAtom.t.sol	✅	100% (2/2)	0.007s
test/unit/EthMultiVault/DepositAtom.t.sol	✅	100% (4/4)	0.004s
test/unit/EthMultiVault/DepositAtomCurve.t.sol	✅	100% (4/4)	0.004s
test/unit/EthMultiVault/BatchCreateTriple.t.sol	✅	100% (4/4)	0.009s
test/unit/EthMultiVault/DepositTriple.t.sol	✅	100% (4/4)	0.006s
test/unit/EthMultiVault/DepositTripleCurve.t.sol	✅	100% (4/4)	0.006s
test/unit/EthMultiVault/BatchDeposit.t.sol	✅	100% (6/6)	0.008s
test/unit/EthMultiVault/BatchRedeem.t.sol	✅	100% (8/8)	0.007s
test/unit/EthMultiVault/UseCases.t.sol	✅	100% (6/6)	0.043s
test/unit/EthMultiVault/Fees.t.sol	✅	100% (2/2)	0.451s
test/unit/EthMultiVault/Helpers.t.sol	✅	100% (4/4)	0.004s
test/unit/EthMultiVault/Profit.t.sol	✅	100% (11/11)	0.022s
test/unit/EthMultiVault/RedeemAtom.t.sol	✅	100% (4/4)	0.003s
test/UpgradeTest.t.sol	⚠️	86% (13/15)	18.350s

🔒 Security Analysis

⚠️ Found 3 High and 3 Medium severity issues

High Severity Issues

arbitrary-send-eth

Impact: AtomWallet._call(address,uint256,bytes) (src/AtomWallet.sol#214-221) sends eth to arbitrary user Dangerous calls: - (success,result) = target.call{value: value}(data) (src/AtomWallet.sol#215)

Affected Files:

• src/AtomWallet.sol

View Detailed Findings

• src/AtomWallet.sol:214 in _call

reentrancy-eth

Impact: Reentrancy in EthMultiVault.batchDeposit(address,uint256[],uint256[]) (src/EthMultiVault.sol#1244-1277): External calls: - _transferFeesToProtocolMultisig(protocolFee) (src/EthMultiVault.sol#1273) - (success,None) = address(generalConfig.protocolMultisig).call{value: value}() (src/EthMultiVault.sol#1443) State variables written after the call(s): - shares[i] = _deposit(receiver,termIds[i],userDepositAfterprotocolFee) (src/EthMultiVault.sol#1272) - vaults[id].balanceOf[to] += amount (src/EthMultiVault.sol#1739) - vaults[id].totalAssets = totalAssets (src/EthMultiVault.sol#1784) - vaults[id].totalShares = totalShares (src/EthMultiVault.sol#1785) EthMultiVault.vaults (src/EthMultiVault.sol#97) can be used in cross function reentrancies: - EthMultiVault.convertToAssets(uint256,uint256) (src/EthMultiVault.sol#2191-2195) - EthMultiVault.convertToShares(uint256,uint256) (src/EthMultiVault.sol#2156-2160) - EthMultiVault.currentSharePrice(uint256) (src/EthMultiVault.sol#2092-2098) - EthMultiVault.getDepositSharesAndFees(uint256,uint256) (src/EthMultiVault.sol#1884-1911) - EthMultiVault.getRedeemAssetsAndFees(uint256,uint256) (src/EthMultiVault.sol#1951-1985) - EthMultiVault.getVaultStateForUser(uint256,address) (src/EthMultiVault.sol#2328-2332) - EthMultiVault.maxRedeem(address,uint256) (src/EthMultiVault.sol#2130-2133) - EthMultiVault.vaults (src/EthMultiVault.sol#97)

Affected Files:

• src/EthMultiVault.sol

View Detailed Findings

• src/EthMultiVault.sol:1244 in batchDeposit
• src/EthMultiVault.sol:1294 in batchDepositCurve

Medium Severity Issues

View Medium Severity Issues

##### incorrect-equality **Impact**: EthMultiVault._validateTimelock(bytes32) (src/EthMultiVault.sol#2425-2437) uses a dangerous strict equality: - timelock.readyTime == 0 (src/EthMultiVault.sol#2428)

Affected Files:

• src/EthMultiVault.sol

• src/EthMultiVault.sol:2425 in _validateTimelock

uninitialized-local

Impact: EthMultiVault.batchCreateAtom(bytes[]).protocolDepositFeeTotal (src/EthMultiVault.sol#628) is a local variable never initialized

Affected Files:

• src/EthMultiVault.sol

• src/EthMultiVault.sol:628 in protocolDepositFeeTotal

• src/EthMultiVault.sol:761 in protocolDepositFeeTotal

Recommended Actions

1. Review and fix all high severity issues before deployment
2. Implement thorough testing for affected components
3. Consider additional security measures:
   • Access controls
   • Input validation
   • Invariant checks

⛽ Gas Analysis

📊 First gas snapshot created