feat: use latest initiad & initia.js

[beer-1]

Summary of Changes

• Allow usage with the latest Initiad release
• Update dependency to the latest initia.js
• Fix to correctly pass local decimal values when creating MoveOFTAdapter on Initia
  • In many cases, tokens on Initia have 0 decimals because the IBC transfer module does not support transmitting decimal metadata

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​rimraf@​6.0.1 ⏵ 6.1.0	+1			+4

View full report

[cursor]

PR Summary

Updates Initia support and OFT tooling, plus minor configs/docs.

• Move VM: oft_adapter_fa::initialize now accepts local_decimals (optional); computes from FA metadata if not provided. All tests and SDKs (IOFT, aptosOFT, initiaOFT) updated to pass localDecimals. New CLI path init-fa-adapter wires this through, and example READMEs/scripts show localDecimals usage
• Initia tooling: upgrade to @initia/initia.js@^1.0.0; drop strict Initiad version checks; add helpers to derive Initia deployer address (bech32/sequence/deploy count hashing) and centralize INITIA_RPC_URL. Deployment uses computed deployer for named addresses
• EVM/CLI: add --native-token to evm:send and include amount in tx value when sending native; Gnosis Safe signer now constructs SafeApiKit with ethAdapter and uses getNextNonce result directly
• Examples/config: switch example EVM networks to bsc-testnet; adjust ULN confirmations and gas options; add explicit gasLimit in MyEVMOFT deploy; docs add flags/args and minor command fixes; ignore deployments/ in examples

^{Written by Cursor Bugbot for commit 2fd6c64. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

[cursor]

SafeApiKit constructor uses deprecated/invalid API parameters

High Severity

The SafeApiKit constructor changed from using chainId and apiKey to using ethAdapter. However, the package uses @safe-global/api-kit version ~4.0.0, which requires chainId as a mandatory parameter and does not accept ethAdapter. The ethAdapter pattern was deprecated in SafeApiKit v2.x. This will cause the Gnosis Safe multisig functionality to fail at runtime when instantiating the GnosisOmniSignerEVM class.

 

[cursor]

Boolean CLI flag incorrectly parses string "false" as true

High Severity

The --native-token CLI argument is parsed using args.native_token ? true : false, which treats the string "false" as truthy. If a user explicitly passes --native-token false, sendingNativeToken will be true because non-empty strings are truthy in JavaScript. This causes the transaction to include the token amount in the ETH value when the user explicitly tried to disable native token sending. The correct pattern used elsewhere in the codebase is args.xxx === 'true'.