feat(contracts): add pyth pro verifier

[chalabi2]

Summary

Adds a query-only CosmWasm verifier for upgraded Pyth Core payloads. The upgraded flow replaces Wormhole guardian signature verification with the Pyth router signer model, so Akash needs a verifier that checks the router set, expected emitter, and 3-of-5 quorum.

The verifier preserves the existing VerifyVAA { vaa, block_time } query shape used by pyth.wasm. It reuses the existing VAA envelope parser, but signature verification is router-quorum based, not Wormhole guardian based.

This also wires the contract side into the v2.1.0 upgrade: the upgrade embeds and instantiates the verifier, then migrates the existing Pyth contract to use the new verifier address. Local init now follows the same path and no longer deploys the old Wormhole contract for Pyth.

Hermes/API-key changes are intentionally out of scope for this PR.

Validation

• bash -n _run/init.sh script/wasm2go.sh
• cargo test -p pyth
• cargo test -p pyth-pro-verifier
• cargo clippy -p pyth-pro-verifier --all-targets -- -D warnings
• cargo build --release --target wasm32-unknown-unknown -p wormhole -p pyth -p pyth-pro-verifier
• GOWORK=off go test ./upgrades/...
• git diff --check

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

Walkthrough

The Pyth contract migrates from Wormhole and trusted data-source verification to router-signed VAA verification for upgraded PNAU accumulator updates, including new configuration schemas, signature validation, deployment wiring, and updated Rust and Go test coverage.

Changes

Pyth Router Verifier Migration

Layer / File(s)	Summary
Contract models and VAA parsing contracts/pyth/Cargo.toml, contracts/pyth/src/{msg.rs,state.rs,error.rs,vaa.rs,wormhole.rs,pyth.rs,lib.rs}	Adds router verifier message/state types, VAA deserialization, router-specific errors, and k256 ECDSA support while removing Wormhole-oriented public APIs.
Router configuration and signature verification contracts/pyth/src/router.rs	Validates five-router configurations, checks VAA metadata, recovers router keys, enforces quorum, and tests successful and rejected signatures.
Pyth contract configuration and update flow contracts/pyth/src/{contract.rs,accumulator.rs}	Stores router configuration, exposes it through queries and updates, and accepts only upgraded PNAU accumulator updates with router VAA and Merkle-proof verification.
Contract and message validation coverage contracts/pyth/src/{accumulator.rs,contract.rs,integration_tests.rs}, tests/e2e/pyth_contract_test.go	Updates fixtures and schemas, validates router configuration, tests PNAU execution and message encoding, and adds invalid configuration cases.
Deployment artifact and initialization updates _run/init.sh	Replaces Wormhole deployment inputs with router verifier parameters, encodes router addresses, and initializes the Pyth contract with router verification settings.

Estimated code review effort: 4 (Complex) | ~60 minutes

Poem

I’m a rabbit with routers in a neat little row,
Signing each VAA before prices can flow.
Merkle roots sparkle, PNAU hops bright,
Five guardians? No—routers verify the night.
The old Wormhole sails away,
While tested proofs now guide the way.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 63.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title matches the main change: adding a Pyth router/pro verifier for upgraded payloads.
Description check	✅ Passed	The description accurately describes the router-verifier migration and local init changes in this PR.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chalabi/pyth-pro-verifier

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (2)

contracts/pyth-pro-verifier/src/contract.rs (1)

93-142: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Signature verification logic is sound.

The quorum threshold, strictly-increasing index enforcement, bounds checking, ECDSA recovery, and router address comparison are all correct. The router_address derivation follows standard Ethereum address format (Keccak256 of uncompressed EC point minus prefix, last 20 bytes).

One minor semantic issue at lines 116-118: when an individual router index exceeds config.routers.len(), TooManySignatures is returned. This is misleading — the count is valid but the index is out of bounds. Consider a dedicated InvalidRouterIndex variant or reusing InvalidRouterSetIndex.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@contracts/pyth-pro-verifier/src/contract.rs` around lines 93 - 142, The
per-signature router index bounds check in verify_router_signatures is returning
TooManySignatures when an individual index is out of range, which is the wrong
semantic error. Update that branch to use a dedicated invalid-index error such
as InvalidRouterIndex or the existing InvalidRouterSetIndex variant, and keep
the rest of the signature validation flow unchanged.

contracts/pyth-pro-verifier/src/testing.rs (1)

234-379: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Test helpers are well-structured and consistent with contract logic.

body_hash (double Keccak256) matches parse_vaa's hash computation, and sign_hash (sign_prehash_recoverable) is the correct counterpart to recover_from_prehash in the contract. address_from_key correctly implements Ethereum-style address derivation. The separation of signed_vaa (index→key mapping) vs signed_vaa_with_keys (explicit keys) enables testing both valid and adversarial signer configurations.

One minor gap: no test exercises the TooManySignatures path (signer_count > routers.len()). Consider adding a case with 6 signers against the 5-router config.

🧪 Suggested test for TooManySignatures

#[test]
fn rejects_too_many_signatures() {
    let keys = router_keys();
    let deps = setup(&keys);
    let vaa = signed_vaa(
        &keys,
        &[0, 1, 2, 3, 4, 0], // 6 signers, but index 0 is reused — order check catches first
        ROUTER_SET_INDEX,
        EMITTER_CHAIN,
        EMITTER_ADDRESS,
        vec![],
    );

    let err = query(
        deps.as_ref(),
        mock_env(),
        QueryMsg::VerifyVAA {
            vaa: Binary::from(vaa),
            block_time: 0,
        },
    )
    .unwrap_err();

    // With 6 signers > 5 routers, expect TooManySignatures
    assert!(err.to_string().contains("TooManySignatures"));
}

Note: the signer indices must be strictly increasing to reach the signer_count > config.routers.len() check, so use indices like [0, 1, 2, 3, 4, 5] with 6 distinct keys.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@contracts/pyth-pro-verifier/src/testing.rs` around lines 234 - 379, Add a
test in testing.rs that covers the TooManySignatures branch in the verification
flow. Use the existing helpers setup, router_keys, signed_vaa_with_keys, and
query to build a VAA with 6 distinct signatures against the 5-router config so
it reaches the signer_count > config.routers.len() check in the contract’s
VerifyVAA path. Assert the query fails with TooManySignatures, and make sure the
signer indexes are strictly increasing so the failure comes from signature count
rather than ordering.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@contracts/pyth-pro-verifier/src/contract.rs`:
- Around line 93-142: The per-signature router index bounds check in
verify_router_signatures is returning TooManySignatures when an individual index
is out of range, which is the wrong semantic error. Update that branch to use a
dedicated invalid-index error such as InvalidRouterIndex or the existing
InvalidRouterSetIndex variant, and keep the rest of the signature validation
flow unchanged.

In `@contracts/pyth-pro-verifier/src/testing.rs`:
- Around line 234-379: Add a test in testing.rs that covers the
TooManySignatures branch in the verification flow. Use the existing helpers
setup, router_keys, signed_vaa_with_keys, and query to build a VAA with 6
distinct signatures against the 5-router config so it reaches the signer_count >
config.routers.len() check in the contract’s VerifyVAA path. Assert the query
fails with TooManySignatures, and make sure the signer indexes are strictly
increasing so the failure comes from signature count rather than ordering.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 3323207f-57a0-4265-8717-3ccf6926765c

📥 Commits

Reviewing files that changed from the base of the PR and between d7d0205 and 6653c83.

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (10)

• Cargo.toml
• contracts/pyth-pro-verifier/Cargo.toml
• contracts/pyth-pro-verifier/src/contract.rs
• contracts/pyth-pro-verifier/src/error.rs
• contracts/pyth-pro-verifier/src/lib.rs
• contracts/pyth-pro-verifier/src/msg.rs
• contracts/pyth-pro-verifier/src/state.rs
• contracts/pyth-pro-verifier/src/testing.rs
• contracts/pyth-pro-verifier/src/vaa.rs
• contracts/pyth/src/accumulator.rs

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@contracts/pyth/src/contract.rs`:
- Around line 366-369: Update migrate to read CONFIG using a legacy config type
that omits router_verifier before deserializing the new Config, then construct
the current Config with the parsed router configuration and save it. Preserve
handling for already-migrated state as appropriate, and add a migration test
that seeds legacy-serialized CONFIG data and verifies successful migration to
the new schema.

In `@contracts/pyth/src/state.rs`:
- Around line 37-48: The migration must support legacy Config records that lack
router_verifier. Add a dedicated LegacyConfig matching the old schema, update
the migration in contract.rs to load LegacyConfig, construct Config with the
supplied router settings, and persist the converted configuration atomically
rather than deserializing the legacy record as Config.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 873fe62d-aafd-42ec-ade5-5e6ae0361813

📥 Commits

Reviewing files that changed from the base of the PR and between 45e3864 and 6717339.

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (16)

• _run/init.sh
• contracts/pyth/Cargo.toml
• contracts/pyth/src/accumulator.rs
• contracts/pyth/src/contract.rs
• contracts/pyth/src/error.rs
• contracts/pyth/src/integration_tests.rs
• contracts/pyth/src/lib.rs
• contracts/pyth/src/msg.rs
• contracts/pyth/src/pyth.rs
• contracts/pyth/src/router.rs
• contracts/pyth/src/state.rs
• contracts/pyth/src/wormhole.rs
• script/wasm2go.sh
• tests/e2e/pyth_contract_test.go
• upgrades/software/v2.1.0/contracts.go
• upgrades/software/v2.1.0/upgrade.go

💤 Files with no reviewable changes (2)

• script/wasm2go.sh
• upgrades/software/v2.1.0/upgrade.go

🚧 Files skipped from review as they are similar to previous changes (1)

• contracts/pyth/src/accumulator.rs