Skip to content

Add TRON support to Contracts Wizard#806

Open
km631 wants to merge 21 commits into
OpenZeppelin:masterfrom
km631:feat/tron-support
Open

Add TRON support to Contracts Wizard#806
km631 wants to merge 21 commits into
OpenZeppelin:masterfrom
km631:feat/tron-support

Conversation

@km631

@km631 km631 commented May 27, 2026

Copy link
Copy Markdown

Summary

Adds a TRON variant to the Contracts Wizard, alongside the existing Solidity / Cairo / Stellar / Stylus / Polkadot / Confidential / Uniswap-Hooks tabs. The variant targets the TRON Virtual Machine via @openzeppelin/hardhat-tron and the @openzeppelin/tron-contracts library.

  • New top-level TRON tab in the nav (route: /tron)
  • Generated contract source uses TRC20 / TRC721 / TRC1155 / TRC4626 and @openzeppelin/tron-contracts/... paths via a centralized rewriteForTron post-processor
  • pragma solidity capped at ^0.8.26 (the current tron-solc maximum)
  • Hardhat (TRON) download — emits a project configured against @openzeppelin/hardhat-tron (TRE network, tron-solc 0.8.26 + cancun + viaIR, plain ethers deploy script — no hardhat-toolbox, no hardhat-ignition)
  • TronBox download — replaces the Foundry tab on TRON; emits a tronbox-config.js, migrations/, and a Mocha test using artifacts.require()
  • Open in Remix wired with a @openzeppelin/tron-contracts remappings override (TVM is EVM-compatible enough to compile + deploy via Remix once the npm package is published)
  • Top tab labels overridable via new tabLabels override — TRC* names show only on /tron, mainline Solidity is unaffected
  • Account tab + superchain cross-chain bridging hidden on TRON (no EntryPoint deployment / OP-stack pattern)

⚠️ Awaiting upgradeables

The upgradeable proxy flow is intentionally not enabled for TRON in this PR. @openzeppelin/tron-contracts does not yet ship the transpiled *Upgradeable variants that the wizard's upgradeable path depends on (e.g. TRC20Upgradeable, OwnableUpgradeable, etc.) — and @openzeppelin/hardhat-tron doesn't pull in @openzeppelin/hardhat-upgrades. So:

  • The "Upgradeability" toggle is still visible in the controls panel for parity with the rest of the wizard,
  • but if the user enables it, omitZipHardhat: (opts) => !!opts.upgradeable hides the Hardhat (TRON) download button so we don't ship a zip that fails to install.
  • TronBox doesn't have an upgradeable workflow anyway and isn't affected.

When @openzeppelin/tron-contracts ships the upgradeable transpiled variants and a compatible TRON upgrades plugin is published, the next PR can remove the omitZipHardhat gate and wire the TRC*Upgradeable names into rewriteForTron.

Other dependencies awaiting publish

The following packages exist in their GitHub repos but are not yet on the npm registry:

The wizard download zips reference them in package.json. Until they publish, npm install inside the zip will 404 — same situation Remix's import resolver will see. No code changes are required here when they do publish; the package-lock.json for the Hardhat (TRON) env is intentionally omitted so npm install resolves fresh on first run.

Files changed

Core (packages/core/solidity):

  • src/utils/transform-tron.ts + .test.ts — the post-processor
  • src/zip-hardhat-tron.ts + .test.ts (+ snapshots) — hardhat-tron download
  • src/zip-tronbox.ts + .test.ts (+ snapshots) — TronBox download
  • src/environments/hardhat/tron/package.json — hardhat-tron env deps
  • zip-env-hardhat-tron.{ts,js}, zip-env-tronbox.{ts,js} — UI entry-point re-exports
  • src/index.ts — exports rewriteForTron

UI (packages/ui):

  • src/tron/App.svelte + handle-unsupported-features.ts — TRON wizard variant
  • src/solidity/overrides.ts — extended with tabLabels, overrideZipFoundry, secondaryDownloadLabel, secondaryDownloadAction, omitOpenInRemix, overrideVersionedRemappings, transformPrintedContract
  • src/solidity/App.svelte — wired all new override hooks
  • src/main.ts, src/common/languages-types.ts, src/common/post-config.ts, api/ai.ts, api/ai-assistant/types/languages.ts, api/ai-assistant/function-definitions/tron.ts — new tron language wiring
  • public/tron.html + nav entry on all 7 other per-language pages
  • public/icons/tron.svg, public/icons/tron_active.svg — placeholder TRON brand icon (happy to swap for the official mark)
  • src/standalone.css.switch-tron.active brand color (#ff060a)

Test plan

  • yarn ava in packages/core/solidity: 15 new tests pass (transform-tron unit + zip-hardhat-tron snapshots + zip-tronbox snapshots)
  • npx tsc --noEmit clean on packages/core/solidity
  • yarn validate (svelte-check) clean on packages/ui (one pre-existing a11y warning in Dropdown.svelte, unrelated)
  • yarn lint clean on all new files
  • Local manual check: /, /tron, /polkadot all render with TRON in the nav; TRON shows TRC* tab labels, hides Account + Remix imports resolve correctly; mainline Solidity unaffected
  • Verify zip downloads compile end-to-end (blocked on npm publication of @openzeppelin/hardhat-tron and @openzeppelin/tron-contracts)

⚠️ // Compatible with OpenZeppelin Contracts ^5.6.0 header

Generated TRON sources still emit the standard wizard provenance comment at the top of every contract, e.g.:

// SPDX-License-Identifier: MIT
// Compatible with OpenZeppelin Contracts ^5.6.0
pragma solidity ^0.8.26;

The version (^5.6.0) is pinned to mainline @openzeppelin/contracts via packages/core/solidity/openzeppelin-contracts-version.json and rendered by printCompatibleLibraryVersions in packages/core/solidity/src/print.ts. For TRON output this is misleading — the imports are from @openzeppelin/tron-contracts, not mainline contracts, so the comment should say something like // Compatible with OpenZeppelin TRON Contracts ^X.Y.Z (or be omitted) once the TRON contracts library has a stable release line. This needs to be updated when @openzeppelin/tron-contracts is adjusted to a published, semver-tracked version. Tracking as a follow-up below; intentionally left as-is in this PR because changing the print pipeline to be ecosystem-aware deserves its own focused review.

Follow-ups (not in scope for this PR)

  • Update the // Compatible with OpenZeppelin Contracts ^5.6.0 header for TRON output when @openzeppelin/tron-contracts lands a tagged release. Options: (a) extend printCompatibleLibraryVersions to be ecosystem-aware so it can emit OpenZeppelin TRON Contracts ^X.Y.Z when the imports resolve to @openzeppelin/tron-contracts, or (b) rewrite the line inside rewriteForTron. Either way, the version source needs to track the tron-contracts package, not mainline.
  • Wire upgradeable flow when tron-contracts ships *Upgradeable variants (see above)
  • Swap the placeholder tron.svg icon for the official TRON brand mark
  • Optionally add an overrideRemixURL to point TRON users at TronIDE (a TRON-configured Remix fork) instead of remix.ethereum.org
  • Once the contracts library is on npm, regenerate the env package-lock.json via the existing update-env script

🤖 Generated with Claude Code

Introduces a TRON variant of the Solidity Wizard, targeting the TRON
Virtual Machine via @openzeppelin/hardhat-tron and the
@openzeppelin/tron-contracts library.

What's included:
- New top-level "TRON" tab in the UI nav (wizard URL: /tron)
- New core utility `rewriteForTron` that maps ERC20/721/1155/4626 to
  TRC*, rewrites @openzeppelin/contracts paths to
  @openzeppelin/tron-contracts, and caps pragma at the tron-solc
  maximum (^0.8.26).
- New `zip-hardhat-tron` generator emitting an @openzeppelin/hardhat-tron
  project (TRE network, tron-solc 0.8.26 + cancun + viaIR, plain ethers
  deploy script).
- New `zip-tronbox` generator emitting a TronBox project with
  migrations and a Mocha test, in place of the Foundry download for
  TRON.
- "Open in Remix" enabled for TRON with an @openzeppelin/tron-contracts
  remappings override (TVM is EVM-compatible enough for Remix).
- Account tab and superchain cross-chain bridging omitted on TRON
  (no EntryPoint deployment / OP-stack pattern).
- Per-tab labels overridable via `tabLabels` (TRC20/TRC721/TRC1155 on
  TRON; ERC* unchanged elsewhere).

Tests: 15 new ava tests (rewriteForTron unit + hardhat-tron snapshot +
tronbox snapshot). svelte-check passes on the UI package.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@km631 km631 requested review from a team as code owners May 27, 2026 16:19
@coderabbitai

coderabbitai Bot commented May 27, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

Important

Review skipped

Auto incremental reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 96c73db0-6ec6-4d9c-a10a-a9ff0f884d44

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Walkthrough

This PR adds complete TRON ecosystem support to the OpenZeppelin Contracts Wizard. It introduces Solidity source code transformation for TRON compatibility, specialized project generators for Hardhat and TronBox environments, an extensible overrides system for UI customization, a dedicated TRON app component, and navigation/AI integration across the platform.

Changes

TRON Ecosystem and Wizard Integration

Layer / File(s) Summary
Type system extensions for TRON support
packages/ui/src/common/languages-types.ts, packages/ui/src/common/post-config.ts, packages/ui/api/ai-assistant/types/languages.ts
Language type adds 'tron-solidity', DownloadAction adds 'download-tronbox', and LanguagesContractsOptions includes TRON with Solidity options (excluding Account).
Core TRON Solidity source transformation
packages/core/solidity/src/utils/transform-tron.ts, packages/core/solidity/src/utils/transform-tron.test.ts, packages/core/solidity/src/index.ts
rewriteForTron() utility rewrites OpenZeppelin import roots, token paths, ERC interface names, and pragma version caps for TRON compatibility, with test coverage for edge cases and realistic wizard outputs.
Overrides system for UI customization hooks
packages/ui/src/solidity/overrides.ts
Overrides interface adds optional hooks for tab labels, secondary download (zip function/action/label), Remix behavior (omit/remappings), and source transformation, with sensible defaults.
Solidity App with overrides integration
packages/ui/src/solidity/App.svelte
App now conditionally uses override hooks for tab labels, Remix remappings, contract transformation, secondary download function/action, and secondary download UI text.
Hardhat TRON project generator
packages/core/solidity/src/zip-hardhat-tron.ts, packages/core/solidity/src/zip-hardhat-tron.test.ts, packages/core/solidity/src/zip-hardhat-tron.test.ts.md, packages/core/solidity/zip-env-hardhat-tron.ts, packages/core/solidity/zip-env-hardhat-tron.js
Generator produces Hardhat projects configured for TRON (Solidity 0.8.26, TRE network, hardhat-tron imports) with contracts transformed via rewriteForTron, complete with config, tests, deploy scripts, and README; snapshot tests validate output for ERC20/721/1155 templates.
TronBox project generator
packages/core/solidity/src/zip-tronbox.ts, packages/core/solidity/src/zip-tronbox.test.ts, packages/core/solidity/src/zip-tronbox.test.ts.md, packages/core/solidity/zip-env-tronbox.ts, packages/core/solidity/zip-env-tronbox.js, packages/core/solidity/src/environments/hardhat/tron/package.json
Generator creates TronBox projects with Solidity contracts, migration deployment scripts, Mocha test files, TronBox configuration, and environment setup; snapshot tests validate output for multiple ERC templates.
TRON app wrapper and feature constraints
packages/ui/src/tron/App.svelte, packages/ui/src/tron/handle-unsupported-features.ts, packages/ui/src/main.ts
TRON app component wraps Solidity app with overrides for TRC tab labels, custom zip generators (Hardhat/TronBox), Remix remappings, contract transformation, and feature omission (superchain bridging); main app routing integrates TronApp for TRON-compatible selections.
AI assistant TRON language support
packages/ui/api/ai-assistant/function-definitions/tron.ts, packages/ui/api/ai.ts
Tron AI definitions are created as re-exports of Solidity definitions with TRON-specific names and wired into the per-language function context map.
Navigation and styling across all public pages
packages/ui/public/index.html, packages/ui/public/cairo.html, packages/ui/public/polkadot.html, packages/ui/public/stellar.html, packages/ui/public/stylus.html, packages/ui/public/confidential.html, packages/ui/public/uniswap-hooks.html, packages/ui/public/tron.html, packages/ui/src/standalone.css
All public pages gain TRON navigation switches; new tron.html landing page configures the wizard with data-lang="tron"; CSS adds active state color for TRON navigation.

🎯 3 (Moderate) | ⏱️ ~25 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 8.70% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Title check ✅ Passed The pull request title 'Add TRON support to Contracts Wizard' directly and clearly summarizes the main change: adding TRON as a new blockchain variant to the Contracts Wizard platform, which is the primary objective of this PR.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Description check ✅ Passed The PR description is comprehensive and directly related to the changeset, detailing TRON support additions including new UI tabs, code generation, imports rewriting, and download options.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@socket-security

socket-security Bot commented May 27, 2026

Copy link
Copy Markdown

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. It is recommended to resolve "Warn" alerts too. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Block Low
Potential code anomaly (AI signal): npm hardhat is 75.0% likely to have a medium risk anomaly

Notes: The code implements a subprocess-based transport to offload event sending. While this can reduce main-process dependencies, it creates a cross-process data path that exposes the serialized event via environment variables to an external subprocess. The subprocess script (not present here) becomes a critical trust boundary. Without inspecting the subprocess implementation and package contents, there is a non-trivial risk of data leakage or tampering via the external process. No explicit malware detected in this fragment, but the design warrants careful review of the subprocess code and supply chain integrity.

Confidence: 0.75

Severity: 0.60

From: ?npm/@nomicfoundation/hardhat-chai-matchers@2.1.2npm/hardhat@2.28.6

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/hardhat@2.28.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Potential code anomaly (AI signal): npm yargs is 68.0% likely to have a medium risk anomaly

Notes: The code is a standard implementation for generating CLI completions with support for zsh and sh/bash, including handling of commands, options, and negative option forms. It delegates potentially untrusted logic to user-provided callbacks (completionFunction and command builders), which is typical for extensible CLI frameworks. The primary risk is the usual risk of executing user-supplied code, which is expected in this context, not a covert malware pattern.

Confidence: 0.68

Severity: 0.50

From: ?npm/@nomicfoundation/hardhat-chai-matchers@2.1.2npm/yargs@16.2.2

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/yargs@16.2.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Potential code anomaly (AI signal): npm yargs is 61.0% likely to have a medium risk anomaly

Notes: The analyzed fragment is a non-malicious environment shim for an OpenVSX extension, exposing safe utilities and deliberately blocking dynamic requires. While it does expose an interface to read environment variables, there is no active data exfiltration, persistence, or external network interaction. Risk is low to moderate due to potential misuse of getEnv, but within this isolated module there is no malicious behavior detected.

Confidence: 0.61

Severity: 0.58

From: ?npm/@nomicfoundation/hardhat-chai-matchers@2.1.2npm/yargs@16.2.2

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/yargs@16.2.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm js-yaml is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: ?npm/@nomicfoundation/hardhat-chai-matchers@2.1.2npm/js-yaml@4.2.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/js-yaml@4.2.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 6

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@packages/core/solidity/src/utils/transform-tron.test.ts`:
- Around line 67-84: The test block for rewriteForTron has Prettier formatting
violations in the pragma-cap assertions; update the assertions in
transform-tron.test.ts to conform to project Prettier rules (consistent commas,
spacing, and line breaks) by reformatting the t.is(...) calls for the cases
using 'pragma solidity ^0.8.27', 'pragma solidity ^0.8.30', '^0.8.26', and
'^0.8.20' so they match the repository's prettier style (ensure proper trailing
commas, indentation and newline placement) without changing the expected strings
or the rewriteForTron function behavior.

In `@packages/core/solidity/src/zip-hardhat-tron.ts`:
- Around line 119-123: The generated README includes a plain "## Installing
dependencies" block with just "npm install" which will fail because the
template's package.json depends on not-yet-published TRON packages; update the
README template in zip-hardhat-tron.ts (the section that currently uses
this.getReadmePrerequisitesSection() and emits the "## Installing dependencies"
/ "npm install" snippet) to note that the TRON packages are not yet published
and either (a) instruct users to skip running npm install until those packages
are published or (b) provide a local development alternative (e.g., linking the
local packages via npm link / pnpm workspace or installing from local paths) and
remove the misleading bare "npm install" command.

In `@packages/core/solidity/src/zip-tronbox.ts`:
- Around line 206-207: The generated tronbox-sample README (created by
packages/core/solidity/src/zip-tronbox.ts) instructs users to run "npm install"
but does not warn that the dependency "`@openzeppelin/tron-contracts`" (^0.1.0)
may not be published; update the README generation in zip-tronbox.ts to add a
pre-install warning in the "## Installing dependencies" section that explicitly
calls out "`@openzeppelin/tron-contracts`" and tells users to verify the package
exists (or to run an alternative install command) before running npm install so
they won't hit a 404 during install.

In `@packages/ui/public/tron.html`:
- Around line 8-14: The /tron page is missing OpenGraph meta tags and Google Tag
Manager/Analytics snippets present on other public pages; update
packages/ui/public/tron.html to add the same OG tags (e.g., meta
property="og:title", "og:description", "og:image", "og:type", "og:url")
alongside the existing Twitter card tags and insert the GTM/GA snippets (the GTM
<script> in the head and GTM <noscript> iframe in the body plus the gtag init
snippet if used) so the page has parity with other wizard pages; mirror the
exact tag names and placement used in the other public HTML files to ensure
consistent social previews and analytics.

In `@packages/ui/src/tron/App.svelte`:
- Line 31: The tabLabels mapping is missing the ERC4626 key so TRC4626 tabs
don't match the TRON naming; update the tabLabels object (the property currently
listing ERC20, ERC721, ERC1155) to include ERC4626: 'TRC4626' so components
referencing tabLabels.ERC4626 will render the correct TRON label.
- Around line 38-42: The overrideZipFoundry currently always returns zipTronbox,
exposing a TronBox download even when opts.upgradeable is true; update the
overrideZipFoundry function to first check opts?.upgradeable and if true return
undefined (or otherwise short-circuit) to suppress the secondary TronBox
download, otherwise await zipTronboxModule and return zipTronbox(c, opts);
reference overrideZipFoundry, opts.upgradeable, zipTronboxModule, and zipTronbox
to locate and modify the code.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 5c829279-1582-4e6b-a48e-8dfa7336018c

📥 Commits

Reviewing files that changed from the base of the PR and between ac47720 and 86e4377.

⛔ Files ignored due to path filters (4)
  • packages/core/solidity/src/zip-hardhat-tron.test.ts.snap is excluded by !**/*.snap
  • packages/core/solidity/src/zip-tronbox.test.ts.snap is excluded by !**/*.snap
  • packages/ui/public/icons/tron.svg is excluded by !**/*.svg
  • packages/ui/public/icons/tron_active.svg is excluded by !**/*.svg
📒 Files selected for processing (33)
  • packages/core/solidity/src/environments/hardhat/tron/package.json
  • packages/core/solidity/src/index.ts
  • packages/core/solidity/src/utils/transform-tron.test.ts
  • packages/core/solidity/src/utils/transform-tron.ts
  • packages/core/solidity/src/zip-hardhat-tron.test.ts
  • packages/core/solidity/src/zip-hardhat-tron.test.ts.md
  • packages/core/solidity/src/zip-hardhat-tron.ts
  • packages/core/solidity/src/zip-tronbox.test.ts
  • packages/core/solidity/src/zip-tronbox.test.ts.md
  • packages/core/solidity/src/zip-tronbox.ts
  • packages/core/solidity/zip-env-hardhat-tron.js
  • packages/core/solidity/zip-env-hardhat-tron.ts
  • packages/core/solidity/zip-env-tronbox.js
  • packages/core/solidity/zip-env-tronbox.ts
  • packages/ui/api/ai-assistant/function-definitions/tron.ts
  • packages/ui/api/ai-assistant/types/languages.ts
  • packages/ui/api/ai.ts
  • packages/ui/public/cairo.html
  • packages/ui/public/confidential.html
  • packages/ui/public/index.html
  • packages/ui/public/polkadot.html
  • packages/ui/public/stellar.html
  • packages/ui/public/stylus.html
  • packages/ui/public/tron.html
  • packages/ui/public/uniswap-hooks.html
  • packages/ui/src/common/languages-types.ts
  • packages/ui/src/common/post-config.ts
  • packages/ui/src/main.ts
  • packages/ui/src/solidity/App.svelte
  • packages/ui/src/solidity/overrides.ts
  • packages/ui/src/standalone.css
  • packages/ui/src/tron/App.svelte
  • packages/ui/src/tron/handle-unsupported-features.ts

Comment thread packages/core/solidity/src/utils/transform-tron.test.ts Outdated
Comment thread packages/core/solidity/src/zip-hardhat-tron.ts
Comment thread packages/core/solidity/src/zip-tronbox.ts Outdated
Comment thread packages/ui/public/tron.html
Comment thread packages/ui/src/tron/App.svelte
Comment thread packages/ui/src/tron/App.svelte Outdated
Mirrors the existing per-ecosystem tool surface for TRON, so AI agents
(via MCP) and CLI users get TRC-correct source out of the box instead of
needing to manually rewrite imports/symbol names from solidity-* output.

What's new:
- packages/common/src/ai/descriptions/tron.ts -- TRON-flavored prompts
  ("Make a fungible token per the TRC-20 standard, ..."). Reused by both
  MCP and CLI.
- packages/mcp/src/tron/ -- seven new MCP tools:
    tron-trc20, tron-trc721, tron-trc1155,
    tron-stablecoin, tron-rwa, tron-governor, tron-custom
  Each wraps the corresponding @openzeppelin/wizard print function with
  rewriteForTron(...). Schemas are reused verbatim from the Solidity
  schemas (options are identical; only the source-level rendering
  differs). Account is intentionally excluded -- same as the UI.
- packages/cli/src/registry.ts -- seven new tron-* CLI commands, same
  shape and same rewriteForTron wrapping.

Notes:
- Solidity schemas are deliberately reused; no separate tron-* schemas
  were added. If TRON ever diverges in option shape (e.g. an upgradeable
  enum value that doesn't apply), the schemas can fork at that point.
- Upgradeable options stay accepted in the schemas. When upgradeable is
  set on a TRON tool, the rewriter still produces TRC* names + tron
  paths. Downstream usability of those imports still depends on
  @openzeppelin/tron-contracts shipping upgradeable variants -- same gap
  noted in the main PR description.

Tests:
- 15 new MCP ava tests across the 7 tools (all 78 mcp tests passing)
- 12 new CLI ava tests (7 auto-generated tron-* --help snapshots + 5
  direct equivalence checks; all 89 cli tests passing)
- Lint clean on all new files

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@km631

km631 commented May 27, 2026

Copy link
Copy Markdown
Author

Added MCP + CLI surface (commit 83046f7)

Followed up with tron-* tools for the MCP server and CLI registry so AI agents and CLI users get TRC-correct source out of the box (no manual ERC* -> TRC* rewrite needed when targeting TRON).

MCP tools (7):

  • tron-trc20, tron-trc721, tron-trc1155
  • tron-stablecoin, tron-rwa, tron-governor, tron-custom

CLI commands (7, same names). Try locally:

npx contracts-cli tron-trc20 --name MyToken --symbol MTK

Design notes:

  • Schemas are reused verbatim from solidityERC20Schema/solidityERC721Schema/etc. — TRON options are identical to Solidity, only the source-level rendering differs. If TRON ever needs option-shape divergence, the schemas can fork at that point without touching the existing solidity ones.
  • TRON prompts (e.g. "Make a fungible token per the TRC-20 standard, targeting the TRON Virtual Machine.") live in packages/common/src/ai/descriptions/tron.ts so they're shared across MCP + CLI.
  • Account is intentionally excluded from the TRON tool set (same as the UI — ERC-4337 EntryPoint is out of scope).
  • Upgradeable options are still accepted in the schemas; the upgradeables-pending caveat in the PR description applies to those imports regardless of whether they come from the UI download or an MCP/CLI tool.

Tests: 15 new MCP tests (78 total passing) + 12 new CLI tests (89 total passing). Lint clean.

km631 and others added 3 commits May 27, 2026 19:57
Targets the 5 actionable comments on PR OpenZeppelin#806:

- transform-tron.test.ts: fold the four pragma-cap assertions into
  single-line t.is(...) calls so they conform to project Prettier rules
  (was flagged as a CI-blocker on the static-checks job).
- zip-hardhat-tron.ts: prepend a temporary-limitation warning to the
  generated README's "Installing dependencies" section noting that
  @openzeppelin/hardhat-tron and @openzeppelin/tron-contracts may not
  yet be on the npm registry. Users get a clear hint when npm install
  404s instead of a confusing failure.
- zip-tronbox.ts: same warning for the TronBox template, mentioning
  @openzeppelin/tron-contracts.
- tron.html: add parity meta tags + Google Tag Manager + GA snippets
  that all the other per-language pages already have so /tron has
  matching social previews and traffic analytics.
- tron App.svelte: hide the TronBox download button when
  opts.upgradeable is set, mirroring the existing hardhat-tron gate
  (TronBox doesn't have an upgradeable workflow either, so the
  secondary download was reachable even when it would emit an
  unbuildable project).
- Refactor Overrides.omitZipFoundry from `boolean` to
  `(opts?: GenericOptions) => boolean` so ecosystems can gate on
  per-call options the same way `omitZipHardhat` already does.
  Polkadot's existing `omitZipFoundry: true` becomes `() => true`.

Snapshots regenerated for both zip-hardhat-tron and zip-tronbox.

Not addressed: CodeRabbit also flagged a missing `ERC4626: 'TRC4626'`
entry in tabLabels. The wizard does not have an `ERC4626` Kind/tab
(the kinds are ERC20/721/1155/Stablecoin/RealWorldAsset/Account/
Governor/Custom), so tabLabels has no key to add. ERC4626 references
that appear in generated source (e.g. from a tokenized-vault Custom
contract) are already handled by `rewriteForTron`'s symbol pattern.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The `check` job requires a changeset for any package-affecting diff.
This PR bumps four packages (wizard, wizard-common, contracts-mcp,
contracts-cli) — all patch-level, matching the project's existing
convention of using `patch` for new features pre-1.0.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Empty commit to force Socket Security to re-evaluate the PR after
@SocketSecurity ignore-all was posted. The flagged packages
(@aws-sdk/core, @aws-sdk/credential-provider-process) are transitive
deps inside hardhat/upgradeable/package-lock.json which this PR
doesn't modify.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@ericglau

Copy link
Copy Markdown
Member

Thanks for the PR! Some initial comments:

  • We should remove the Upgradeability options for now (or hide them in the UI and use a low-touch approach to disable the options in the API/CLI/MCP), otherwise it results in using @openzeppelin/contracts-upgradeable which won't compile together with the Tron contracts.
  • Should we remove Stablecoin and RWA? Those require ERC20Freezable and ERC20Restricted from @openzeppelin/community-contracts so those do not work here either, unless they are added to the Tron contracts. cc @luiz-lvj
  • According to Tron docs it appears block time is 3 seconds. There are some calculations that use block time, particularly Governor's Token Clock Mode if using Block Number, where it assumes 1 block is 12 seconds. This is configurable in the user-facing options, but we should update this default for Tron.

km631 and others added 3 commits May 28, 2026 09:24
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@ericglau

ericglau commented May 29, 2026

Copy link
Copy Markdown
Member

Consider replacing rewriteForTron (regex over rendered source) with a structured print transform

rewriteForTron rewrites the final Solidity text, so it can't distinguish what should be renamed (OZ library symbols + @openzeppelin/contracts import paths) from what shouldn't (user-supplied strings and the user's own identifiers). Because it substitutes globally over the whole string, real inputs get corrupted:

  • Name/symbol literals: \bERC(20|721|1155|4626) matches inside constructor string literals. Symbol "ERC20" or name "My ERC20 Token""TRC20" / "My TRC20 Token", silently changing the deployed name()/symbol(). The generated Hardhat/TronBox test asserts the original opts.name, so it fails by construction when the name contains a standard token.
  • Contract name: a contract named ERC20Tokencontract TRC20Token, but the zip still writes contracts/ERC20Token.sol and emits artifacts.require('./ERC20Token.sol') / getContractFactory("ERC20Token") → name/artifact mismatch, won't compile.
  • securityContact: ERC20-team@x.comTRC20-team@x.com.
  • Pragma cap only matches pragma solidity ^0.8.NN; and only clamps the minor; any change to the emitted pragma shape silently ships an uncompilable version.

(Aside, non-blocking: the regex also renames ERC20TRC20 inside other roots like @openzeppelin/community-contracts/ and -upgradeable/. The direction may be what you'd eventually want if TRC-flavored counterparts ship, so this isn't a bug to fix now — it just can't be decided correctly by one blanket rule, and overlaps the deferred library/upgradeable items. Another symptom of operating on text rather than structure.)

A structured transform avoids the corruption above because the generator already has the information the regex is missing. printContract(contract, opts) renders the structured Contract IR through two helpers — transformName (every inherited symbol: inheritance list, override lists, arg types, using libs) and transformImport (every import path). This is exactly how @openzeppelin/contracts-upgradeable output is produced today: upgradeableName/upgradeableImport in options.ts rename ERC20ERC20Upgradeable and rewrite the path root. Options.transformImport is already a public hook.

Suggested shape — define a TRON "library profile" Options and drop rewriteForTron:

  • transformImport: rewrite the @openzeppelin/contracts/ root → @openzeppelin/tron-contracts/ and rename token/ERC20|721|1155 + symbol to TRC*. Because it sees each import's full path, it can make the right per-package decision — leave community-contracts/contracts-upgradeable as-is now, or map them to TRC equivalents later — instead of one blanket regex rule.
  • add a transformName hook in Options/withHelpers (today only transformImport is exposed) that renames only OZ token-standard symbols.
  • carry the capped solc version in the profile and parameterize the pragma line, instead of the pragma regex (and source the hardhat/tronbox config versions from the same constant).
  • use the existing additionalCompatibleLibraries to emit // Compatible with OpenZeppelin TRON Contracts … (also closes the deferred header follow-up).

Then route every surface — UI display, zip generators, CLI/MCP — through that profile instead of rewriteForTron, collapsing five rewriteForTron(...) sites into one shared profile. *.print(opts) doesn't accept a print-Options today, but there's no need to widen it: printContract and buildGeneric are both exported from @openzeppelin/wizard, so a surface can call, for example, printContract(buildGeneric({ kind, ...opts }), tronProfile) in place of rewriteForTron(erc20.print(opts)) (the zip generators already hold a built Contract, so they just pass the profile: printContract(c, tronProfile)). Because transformName/transformImport only see structured ReferencedContract/ImportContract nodes, user name/symbol (rendered by printValue), the contract name (printed directly), and securityContact (a NatSpec tag) are never touched. It's also more correct: a user contract named ERC20Token stays ERC20Token while only the inherited bases become TRC*.

This resolves the rewrite-rooted issues only; a few feature-gating, packaging, and consistency items are noted inline.

@ericglau ericglau left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Inline notes from a focused review of the TRON variant — correctness plus consistency with the patterns established by the other Wizard languages. The larger rewriteForTron → structured-transform suggestion is in a separate top-level comment.

Comment thread packages/cli/src/registry.ts Outdated
Comment thread packages/core/solidity/src/environments/hardhat/tron/package.json Outdated
Comment thread packages/core/solidity/src/zip-tronbox.ts Outdated
Comment thread packages/core/solidity/src/zip-hardhat-tron.ts
Comment thread packages/ui/src/tron/App.svelte Outdated
Comment thread packages/common/src/ai/descriptions/solidity.ts Outdated
km631 and others added 6 commits June 17, 2026 17:24
- Gate `superchain` cross-chain bridging on the CLI and MCP TRON surfaces
  (previously only the UI sanitized it). Promote the gate to a shared
  `sanitizeTronOptions` helper in `@openzeppelin/wizard`, consumed by the UI,
  CLI registry, and MCP tron-* handlers so all three behave identically.
- Fix unresolvable dependency ranges in the generated projects: the Hardhat
  template pinned `@openzeppelin/hardhat-tron: ^1.0.0` (excludes 0.x) and
  `tron-contracts: ^0.1.0` (excludes 0.0.1); align with the intended publish
  versions (`^0.1.0` / `^0.0.1`), and the same for the TronBox `package.json`.
- Stop the TronBox migration from silently deploying `undefined`: non-address
  constructor args now emit commented-out declarations and the deploy call is
  commented out behind a TODO when any arg is unset, matching mainline
  zip-hardhat/zip-foundry behaviour (an unedited migrate errors or no-ops).
- Add `override` to every method in `HardhatTronZipGenerator` that overrides
  `HardhatZipGenerator`, so it stays correct under `noImplicitOverride`.
- Extract the TRON brand colour into a `--tron-red` CSS variable in vars.css,
  referenced from both App.svelte and standalone.css.
- Keep the TRON-specific Governor `blockTime` note out of the shared Solidity
  description: revert `solidityGovernorDescriptions.blockTime` and add a
  TRON-only `tronGovernorSchema`/`tronGovernorDescriptions`, consumed by the
  tron-governor CLI registry entry and MCP tool.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Now that @openzeppelin/tron-contracts-upgradeable exists, wire it up end to
end so upgradeable contracts work on TRON instead of being hidden.

- rewriteForTron now maps @openzeppelin/contracts-upgradeable ->
  @openzeppelin/tron-contracts-upgradeable (run before the base-package
  pattern). The transpiled `*Upgradeable` parents resolve from the upgradeable
  package; the stateless proxy utilities (Initializable, UUPSUpgradeable) and
  interfaces stay on @openzeppelin/tron-contracts, which is its peer.
- New utils/tron-upgradeable.ts: detects UUPS vs transparent, picks the right
  proxy (TRC1967Proxy / TransparentUpgradeableProxy from @openzeppelin/
  tron-contracts), and emits the throwaway Proxy.sol that pulls the proxy into
  the build.
- Hardhat (hardhat-tron) and TronBox downloads now deploy the proxy by hand —
  OpenZeppelin's Upgrades plugins target EVM chains and don't deploy to TRON.
  Each upgradeable project ships a Proxy.sol, a deploy script / migration that
  deploys the implementation then a proxy running initialize() atomically, an
  upgradeable-aware test that reads through the proxy, and the
  tron-contracts-upgradeable dependency. Initializer args with no safe default
  are left as gated TODOs so an unedited deploy never runs with missing values.
- UI: un-hide the upgradeable Hardhat/TronBox downloads, add a Remix remapping
  for the upgradeable package, and hyperlink @openzeppelin/tron-contracts-
  upgradeable imports to that repo.
- Tests: cover UUPS, transparent, and gated (non-address init args) cases for
  both generators, plus rewriteForTron's upgradeable mapping.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…urce

`rewriteForTron` ran a global regex over the rendered Solidity, so it couldn't
tell OpenZeppelin library symbols (which should be renamed) from user data
(which must not be). That silently corrupted real inputs:

- a token name/symbol containing a standard ("My ERC20 Token" / "ERC20") had
  its `name()`/`symbol()` rewritten to TRC*, and the generated test then failed
  by construction;
- a contract named `ERC20Token` became `contract TRC20Token` while the zip still
  wrote `ERC20Token.sol` / `getContractFactory("ERC20Token")` — a name/artifact
  mismatch that wouldn't compile;
- `securityContact` like `ERC20-team@…` was mangled;
- upgradeable initializers were left as `__ERC20_init(...)` (the `\b` boundary
  fails after `__`), which doesn't exist in `@openzeppelin/tron-contracts-upgradeable`
  (it ships `__TRC20_init`), so the upgradeable output didn't compile either.

Replace it with a structured `tronPrintProfile` plugged into `printContract` via
the `transformName` / `transformImport` hooks — the same mechanism the
upgradeable transpilation already uses. Because the hooks only see structured
`ReferencedContract` / `ImportContract` nodes, they remap only library symbols
and import paths; user data is never touched, and a `ERC20Token` contract keeps
its name while its inherited bases still become TRC*.

- options.ts: add `transformName` (symbol rename) and `solidityVersion` hooks;
  add `transformInitName` so the upgradeable `__{Name}_init` keeps the base name
  with the symbol rename applied (no `Upgradeable` suffix).
- print.ts: source the pragma from `opts.solidityVersion`; route parent
  constructor / initializer names through the transforms. Mainline output is
  byte-identical (full core suite passes unchanged).
- transform-tron.ts: export `tronPrintProfile` + `TRON_SOLIDITY_VERSION`
  (capped); drop `rewriteForTron`. Hardhat/TronBox configs source the compiler
  version from the same constant.
- Route every surface (UI display via `Overrides.printOptions`, zip generators,
  CLI registry, MCP tron tools) through the one profile.
- Tests assert against the same profile and add coverage for the previously
  corrupting cases; the upgradeable snapshots now correctly use `__TRC20_init`.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Both rely on @openzeppelin/community-contracts (ERC20Restricted / ERC20Freezable
for restrictions + freezable), which is not being ported to TRON — so they can't
generate valid TRON output. Remove them from every TRON surface; TRON now covers
TRC20 / TRC721 / TRC1155 / Governor / Custom (Account remains out of scope too).

- UI: hide the Stablecoin + RealWorldAsset tabs (`omitTabs`); `defineOmitFeatures`
  / `sanitizeOmittedFeatures` now only handle ERC20's `superchain` gate.
- UI API: drop the Stablecoin/RWA TRON AI function definitions, and narrow the
  `tron` contract-names type (`Omit<…, 'Account' | 'Stablecoin' | 'RealWorldAsset'>`)
  so the function-definition map stays in sync.
- CLI: remove the `tron-stablecoin` / `tron-rwa` registry entries.
- MCP: unregister and delete the `tron-stablecoin` / `tron-rwa` tools and tests.
- common: remove `Stablecoin` / `RWA` from `tronPrompts`.
- Drop the obsolete cli `tron-stablecoin` test; regenerate `--help` snapshots.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@socket-security

socket-security Bot commented Jun 19, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Added@​nomicfoundation/​hardhat-chai-matchers@​2.1.2991009683100

View full report

@ericglau

ericglau commented Jun 19, 2026

Copy link
Copy Markdown
Member

Thanks, this mostly looks good to me, pending some of the below TODOs below (some are blocked on @openzeppelin/tron-contracts npm publish):

  • Enable the TRON compile test. packages/core/solidity/src/tron-compile.test.ts is currently test.skip (placeholder). Once @openzeppelin/tron-contracts (+ -upgradeable) is on npm: add them as devDependencies, point Hardhat at a tron-solc compile target for the generated sources, and remove .skip. It compiles every TRON option combination against the real library — that's what catches ERC→TRC import/symbol mismatches the content snapshots can't.
  • Decide how (if at all) we want to verify the download zips beyond snapshots, once the packages publish. The hardhat-tron / tronbox download tests (zip-hardhat-tron.test.ts / zip-tronbox.test.ts) currently only snapshot the generated files — they don't install or build the project. Mainline (zip-hardhat / zip-foundry) extracts and runs npm install + test, but TRON's npm test deploys to a local TRON node via Docker/TRE, which we likely don't want in the standard suite. Open question: leave as snapshot-only (the compile test above already covers the contract source), add a lighter npm-install-and-compile check, or a full Dockerized run — and where that would live.
  • Resolve the ERC→TRC alias boundary (e.g. ERC-1363 vs TRC-1363), then align the wizard's name mapping (and tron-contracts if needed). The compile test above will validate whatever convention we settle on.
    • Changed to alias all ERC/EIP to TRC/TIP
  • Wizard output and tron-contracts-upgradeable still use namespace struct annotations as @custom:storage-location erc7201:<id> instead of @custom:storage-location trc7201:<id>. Consider approach for when/whether to switch this to use trc7201 -- tooling such as Hardhat Upgrades plugin would need to support trc7201 annotations to detect that they are identical to erc7201.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants