fix(absmate): secure paymaster against unauthorized drain and harden CI workflows

[mertcano]

Motivation

This PR addresses a Blocker-severity smart contract vulnerability and associated CI/CD hazards identified during the workspace-wide security audit[cite: 60]. Previously, Paymaster.validateAndPayForPaymasterTransaction lacked a caller authorization check[cite: 60]. This critical flaw allowed any arbitrary address to pass a crafted Transaction payload and force the paymaster to forward gasLimit * maxFeePerGas wei to the bootloader outside of a legitimate fee flow, effectively draining the paymaster's balance[cite: 60, 61]. Additionally, the repository's GitHub Action workflows operated with excessively broad default permissions and insecurely interpolated release tags directly into shell scripts[cite: 61].

Modifications

• Unauthenticated Paymaster Drain Guard (src/Paymaster.sol):
  • Introduced the NotBootloader() custom error and added a strict msg.sender != BOOTLOADER_FORMAL_ADDRESS guard as the first statement in validateAndPayForPaymasterTransaction[cite: 60, 61]. This ensures that only the official system bootloader can drive paymaster validation and trigger ETH transfers[cite: 61].
• CI/CD Least Privilege (.github/workflows/test.yml, .github/workflows/release.yml):
  • Added explicit permissions: contents: read blocks to drop the default write scopes[cite: 62, 63]. This restricts malicious dependencies or compromised build steps from pushing commits, tags, or releases, which is especially critical for workflows running on pull requests[cite: 62, 63].
• Shell Injection Mitigation (.github/workflows/release.yml):
  • Bound ${{ github.ref_name }} to the RELEASE_TAG environment variable rather than interpolating it directly into the run script[cite: 61, 62]. This safely handles tag names containing shell metacharacters and prevents expression injection in a job that holds Soldeer publishing credentials[cite: 62].

Checklist

• Format your code according to the Contributor Guide.
• Add unit tests as outlined in the Contributor Guide.
• Update documentation as needed, including docstrings or example tutorials.

---

PR-Codex overview

This PR focuses on updating GitHub Actions workflows for CI/CD processes and enhancing the Paymaster smart contract with additional error handling.

Detailed summary

• Updated .github/workflows/release.yml and .github/workflows/test.yml to restrict GITHUB_TOKEN permissions to read-only.
• Added NotBootloader error in Paymaster contract to restrict access to the validateAndPayForPaymasterTransaction function.
• Improved comments and documentation for clarity in the Paymaster contract.

✨ Ask PR-Codex anything about this PR by commenting with /codex {your question}