✨ exa: add crosschain mint and burn support by itofarina · Pull Request #797 · exactly/protocol

itofarina · 2026-02-25T14:00:46Z

Summary by CodeRabbit

New Features
- EXA adds bridge-controlled cross-chain minting/burning and a v2 initialization path with upgraded access control and interface support.
Tests
- Added comprehensive EXA tests covering initialization, bridge access, mint/burn, interface support, plus large-scale test renames and updated gas snapshots.
Dependencies
- Updated dependency versions for OpenZeppelin packages.
Chores
- Added release metadata for a patch release.

changeset-bot · 2026-02-25T14:00:52Z

🦋 Changeset detected

Latest commit: ebde601

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@exactly/protocol	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

gemini-code-assist · 2026-02-25T14:01:10Z

Summary of Changes

Hello @itofarina, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request significantly upgrades the EXA token contract by incorporating ERC-7802 support, which standardizes cross-chain interactions for minting and burning tokens. The changes include a robust access control system to secure these operations, alongside essential dependency updates and a new, comprehensive test suite to ensure the reliability and correctness of the new features.

Highlights

ERC-7802 Support: The EXA token contract now implements the ERC-7802 standard, enabling standardized cross-chain minting and burning capabilities.
Access Control Integration: OpenZeppelin's AccessControlUpgradeable has been integrated into the EXA contract, introducing a BRIDGE_ROLE to manage permissions for cross-chain operations.
Dependency Updates: OpenZeppelin contract dependencies have been upgraded to version 5.4.0 across package.json and pnpm-lock.yaml.
Comprehensive Testing: A new dedicated test file, test/EXA.t.sol, has been added to thoroughly validate the ERC-7802 implementation, access control mechanisms, and core mint/burn functionalities.
Gas Snapshot Updates: Gas consumption values in .gas-snapshot have been updated to reflect the changes introduced by the new features and contract logic.

Changelog

.gas-snapshot
- Updated gas consumption values for numerous tests.
contracts/periphery/EXA.sol
- Implemented ERC-7802 interface.
- Integrated AccessControl for managing bridge roles.
- Introduced initializeV2 for admin role setup.
- Added mint, burn, crosschainMint, and crosschainBurn functions with event emissions.
- Updated supportsInterface to reflect new interfaces.
package.json
- Updated OpenZeppelin contract dependencies to version 5.4.0.
pnpm-lock.yaml
- Updated OpenZeppelin contract dependencies to version 5.4.0.
test/EXA.t.sol
- Added new test suite for the EXA contract.
- Covered initialization, role management, mint/burn operations, and interface support.

Activity

itofarina created this pull request.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

coderabbitai · 2026-02-25T14:01:11Z

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

📥 Commits

Reviewing files that changed from the base of the PR and between 0c63b60 and ebde601.

📒 Files selected for processing (5)

.changeset/silent-chefs-marry.md
.gas-snapshot
contracts/periphery/EXA.sol
test/EXA.t.sol
test/EscrowedEXA.t.sol

_{✏️ Tip: You can disable in-progress messages and the fortune message in your review settings.}

Tip

You can disable sequence diagrams in the walkthrough.

Disable the reviews.sequence_diagrams setting to disable sequence diagrams in the walkthrough.

Walkthrough

Adds bridge-aware cross-chain mint/burn support to EXA (BRIDGE_ROLE, crosschainMint/crosschainBurn, IERC7802 support), a reinitializer-based proxy initializer, Forge tests for bridge flows and interface checks, OpenZeppelin dependency bumps, and updated gas snapshot/test renames.

Changes

Cohort / File(s)	Summary
Core Contract `contracts/periphery/EXA.sol`	Adds `BRIDGE_ROLE`, inherits `AccessControlUpgradeable` and `IERC7802`, disables initializers in constructor, adds `initialize2(address)` reinitializer, `mint`/`burn` wrappers, `crosschainMint`/`crosschainBurn` guarded by `BRIDGE_ROLE`, new errors, and updates `supportsInterface`.
New Tests `test/EXA.t.sol`	New Forge test suite deploying EXA behind an `ERC1967Proxy`/`ProxyAdmin`, exercising `initialize`/`initialize2`, `BRIDGE_ROLE` behavior, mint/burn and cross-chain flows, event emissions, and interface checks.
Test Update `test/EscrowedEXA.t.sol`	Test setup switched to proxy-based deployment (ERC1967Proxy + abi.encodeCall initialize) during setUp; no API changes.
Gas Snapshot `.gas-snapshot`	Large-scale test identifier renames/reclassifications and updated gas measurements across many tests (gas deltas recorded).
Dependencies `package.json`	Bumps `@openzeppelin/contracts` and `@openzeppelin/contracts-upgradeable` from `^5.0.2` to `^5.4.0`.
Release Metadata `.changeset/silent-chefs-marry.md`	Adds changeset entry noting a patch release and cross-chain mint/burn support.

Sequence Diagram(s)

mermaid
sequenceDiagram
rect rgba(220,220,255,0.5)
participant Admin
end
rect rgba(200,255,200,0.5)
participant Proxy as ERC1967Proxy
end
rect rgba(255,240,200,0.5)
participant EXA
end
rect rgba(255,200,200,0.5)
participant Bridge
end

Admin->>Proxy: deploy proxy pointing to EXA implementation
Admin->>Proxy: call initialize(...)
Admin->>Proxy: call initialize2(admin_)
Proxy->>EXA: delegatecall initialize / initialize2
Admin->>EXA: grantRole(BRIDGE_ROLE, Bridge)
Bridge->>EXA: crosschainMint(to, amount)
EXA-->>Bridge: emit CrosschainMint; update balances
Bridge->>EXA: crosschainBurn(from, amount)
EXA-->>Bridge: emit CrosschainBurn; update balances

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title directly and clearly describes the main change: adding cross-chain mint and burn support to the EXA contract, which aligns with the primary modifications in contracts/periphery/EXA.sol.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment
Commit unit tests in branch exa-crosschain

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

gemini-code-assist

Code Review

The pull request introduces ERC-7802 support to the EXA token, enabling cross-chain minting and burning capabilities, and includes AccessControl for bridge operations, along with OpenZeppelin dependency updates. A critical vulnerability was identified in the new version 2 initializer: the initializeV2 function is unprotected, allowing any user to claim administrative control if the upgrade is not performed atomically, which could lead to unauthorized token minting and a total loss of value. Additionally, a minor improvement opportunity exists in the EXA.sol contract regarding function redundancy.

contracts/periphery/EXA.sol

openzeppelin-code · 2026-02-25T14:06:35Z

✨ exa: add crosschain mint and burn support

Generated at commit: ebde6016779d8a9590d8419b19c7159f2379553e

🚨 Report Summary

	Severity Level	Results
Contracts	Critical High Medium Low Note Total	2 4 0 7 26 39
Dependencies	Critical High Medium Low Note Total	0 0 0 0 0 0

For more details view the full report in OpenZeppelin Code Inspector

coderabbitai

Actionable comments posted: 4

ℹ️ Review info

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between c62bf4c and ff43169.

⛔ Files ignored due to path filters (1)

pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (4)

.gas-snapshot
contracts/periphery/EXA.sol
package.json
test/EXA.t.sol

contracts/periphery/EXA.sol

test/EXA.t.sol

coderabbitai

Actionable comments posted: 2

ℹ️ Review info

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between ff43169 and df5529c.

⛔ Files ignored due to path filters (1)

pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (6)

.changeset/silent-chefs-marry.md
.gas-snapshot
contracts/periphery/EXA.sol
package.json
test/EXA.t.sol
test/EscrowedEXA.t.sol

contracts/periphery/EXA.sol

test/EXA.t.sol

coderabbitai

♻️ Duplicate comments (1)

contracts/periphery/EXA.sol (1)
26-29: ⚠️ Potential issue | 🟠 Major

Validate admin_ in initialize2 to prevent irreversible admin lockout.

Line 28 grants DEFAULT_ADMIN_ROLE without validating admin_. Passing address(0) would leave admin control effectively unusable.
🛠️ Proposed fix
 contract EXA is ERC20VotesUpgradeable, AccessControlUpgradeable, IERC7802 {
   bytes32 public constant BRIDGE_ROLE = keccak256("BRIDGE_ROLE");
+  error InvalidAdmin();
@@
   function initialize2(address admin_) external reinitializer(2) {
+    if (admin_ == address(0)) revert InvalidAdmin();
     __AccessControl_init();
     _grantRole(DEFAULT_ADMIN_ROLE, admin_);
   }
#!/bin/bash
set -euo pipefail

echo "== Verify EXA.initialize2 has/hasn't zero-address guard =="
rg -n -C3 'function initialize2|admin_ == address$0$|_grantRole$DEFAULT_ADMIN_ROLE, admin_$' contracts/periphery/EXA.sol

echo
echo "== Inspect OZ AccessControlUpgradeable _grantRole behavior =="
fd -HI '^AccessControlUpgradeable\.sol$' | while read -r f; do
  echo "-- $f"
  rg -n -C3 'function _grantRole|address$0$' "$f"
done
Expected result: no admin_ == address(0) guard in initialize2, and _grantRole itself does not enforce non-zero accounts.

ℹ️ Review info

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between df5529c and be4bd71.

📒 Files selected for processing (5)

.changeset/silent-chefs-marry.md
.gas-snapshot
contracts/periphery/EXA.sol
test/EXA.t.sol
test/EscrowedEXA.t.sol

gemini-code-assist bot reviewed Feb 25, 2026

View reviewed changes

contracts/periphery/EXA.sol Outdated Show resolved Hide resolved

contracts/periphery/EXA.sol Outdated Show resolved Hide resolved

coderabbitai bot reviewed Feb 25, 2026

View reviewed changes

contracts/periphery/EXA.sol Outdated Show resolved Hide resolved

contracts/periphery/EXA.sol Outdated Show resolved Hide resolved

contracts/periphery/EXA.sol Outdated Show resolved Hide resolved

test/EXA.t.sol Outdated Show resolved Hide resolved

⬆️ dependencies: upgrade openzeppelin contracts

946d9bf

itofarina force-pushed the exa-crosschain branch 2 times, most recently from 5edfce9 to df5529c Compare February 25, 2026 15:46

itofarina changed the title ~~✨ exa: add ERC-7802 support~~ ✨ exa: add crosschain mint and burn support Feb 25, 2026

coderabbitai bot reviewed Feb 25, 2026

View reviewed changes

contracts/periphery/EXA.sol Outdated Show resolved Hide resolved

test/EXA.t.sol Outdated Show resolved Hide resolved

itofarina force-pushed the exa-crosschain branch from df5529c to be4bd71 Compare February 25, 2026 16:53

coderabbitai bot reviewed Feb 25, 2026

View reviewed changes

itofarina force-pushed the exa-crosschain branch from be4bd71 to 0c63b60 Compare February 25, 2026 21:46

✨ exa: add crosschain mint and burn support

ebde601

itofarina force-pushed the exa-crosschain branch from 0c63b60 to ebde601 Compare February 26, 2026 16:40

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

✨ exa: add crosschain mint and burn support#797

✨ exa: add crosschain mint and burn support#797
itofarina wants to merge 2 commits intomainfrom
exa-crosschain

itofarina commented Feb 25, 2026 •

edited by coderabbitai bot

Loading

Uh oh!

changeset-bot bot commented Feb 25, 2026 •

edited

Loading

Uh oh!

gemini-code-assist bot commented Feb 25, 2026

Uh oh!

coderabbitai bot commented Feb 25, 2026 •

edited

Loading

Uh oh!

gemini-code-assist bot left a comment

Uh oh!

Uh oh!

Uh oh!

openzeppelin-code bot commented Feb 25, 2026 •

edited

Loading

Uh oh!

coderabbitai bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

coderabbitai bot left a comment

Uh oh!

Uh oh!

Uh oh!

coderabbitai bot left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

itofarina commented Feb 25, 2026 • edited by coderabbitai bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

changeset-bot bot commented Feb 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

gemini-code-assist bot commented Feb 25, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

coderabbitai bot commented Feb 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Sequence Diagram(s)

Estimated code review effort

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

openzeppelin-code bot commented Feb 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✨ exa: add crosschain mint and burn support

🚨 Report Summary

Uh oh!

coderabbitai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

coderabbitai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

coderabbitai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

itofarina commented Feb 25, 2026 •

edited by coderabbitai bot

Loading

changeset-bot bot commented Feb 25, 2026 •

edited

Loading

coderabbitai bot commented Feb 25, 2026 •

edited

Loading

openzeppelin-code bot commented Feb 25, 2026 •

edited

Loading