7913364454

Committed 15 Feb 2024 08:57AM UTC coverage: 92.947% (-0.2%) from 93.138%

Build # 7913364454

Build Type

Pull #1148

github

Committed by

web-flow

Commit Message

Merge 528f8e76a into 50617ed27

Pull Request Pull Request #1148: Replace Safe/ERC-20 `ContractHelper`s with `AbiDecoder`s

Run Details

1551 of 1856 branches covered (83.57%)

Branch coverage included in aggregate %.

19 of 27 new or added lines in 6 files covered. (70.37%)

10 existing lines in 1 file now uncovered.

5895 of 6155 relevant lines covered (95.78%)

180.17 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

89.13

/src/domain/relay/limit-addresses.mapper.ts

import { Inject, Injectable } from '@nestjs/common';
import { Hex } from 'viem/types/misc';
import { Erc20Decoder } from '@/domain/relay/contracts/erc-20-decoder.helper';
import { ISafeRepository } from '@/domain/safe/safe.repository.interface';
import { MultiSendDecoder } from '@/domain/contracts/contracts/multi-send-decoder.helper';
import { ProxyFactoryDecoder } from '@/domain/relay/contracts/proxy-factory-decoder.helper';
import {
  getSafeSingletonDeployment,
  getSafeL2SingletonDeployment,
  getMultiSendCallOnlyDeployment,
} from '@safe-global/safe-deployments';
import { SafeDecoder } from '@/domain/contracts/contracts/safe-decoder.helper';

export interface RelayPayload {
  chainId: string;
  data: Hex;
  to: Hex;
  gasLimit?: bigint;
}

@Injectable()
export class LimitAddressesMapper {
  // TODO: Support all versions (decoders currently use 1.3.0 ABIs though interface is generic)
  private static SUPPORTED_SAFE_VERSION = '1.3.0';

  constructor(
    @Inject(ISafeRepository)
    private readonly safeRepository: ISafeRepository,
    private readonly erc20Decoder: Erc20Decoder,
    private readonly safeDecoder: SafeDecoder,
    private readonly multiSendDecoder: MultiSendDecoder,
    private readonly proxyFactoryDecoder: ProxyFactoryDecoder,
  ) {}

  async getLimitAddresses(args: RelayPayload): Promise<readonly Hex[]> {
    // Calldata matches that of execTransaction and meets validity requirements
    if (this.isValidExecTransactionCall(args)) {
      // Safe attempting to relay is official
      const isOfficial = await this.isOfficialMastercopy({
        chainId: args.chainId,
        address: args.to,
      });

      if (!isOfficial) {
        throw Error('Invalid Safe contract');
      }

      // Safe targetted by execTransaction will be limited
      return [args.to];
    }

    // Calldata matches that of multiSend and is from an official MultiSend contract
    if (
      this.multiSendDecoder.isMultiSend(args.data) &&
      this.isOfficialMultiSendDeployment({
        chainId: args.chainId,
        address: args.to,
      })
    ) {
      // multiSend calldata meets the validity requirements
      const safeAddress = this.getSafeAddressFromMultiSend(args.data);

      // Safe attempting to relay is official
      const isOfficial = await this.isOfficialMastercopy({
        chainId: args.chainId,
        address: safeAddress,
      });

      if (!isOfficial) {
        throw Error('Invalid Safe contract');
      }

      // Safe targetted in batch will be limited
      return [safeAddress];
    }

    // Calldata matches that of createProxyWithNonce and meets validity requirements
    if (this.isValidCreateProxyWithNonceCall(args)) {
      // Owners of safe-to-be-created will be limited
      return this.getOwnersFromCreateProxyWithNonce(args.data);
    }

    throw Error('Cannot get limit addresses – Invalid transfer');
  }

  private isValidExecTransactionCall(args: { to: string; data: Hex }): boolean {
    let execTransaction: { data: Hex; to: Hex; value: bigint };
    // If transaction is an execTransaction
    try {
      const safeDecodedData = this.safeDecoder.decodeFunctionData({
        data: args.data,
      });
      if (safeDecodedData.functionName !== 'execTransaction') {
        return false;
      }
      const [to, value, data] = safeDecodedData.args;
      execTransaction = { to, value, data };
    } catch (e) {
      return false;
    }

    // If data of execTransaction is an ERC20 transfer
    try {
      const erc20DecodedData = this.erc20Decoder.decodeFunctionData({
        data: execTransaction.data,
      });
      // If the ERC20 transfer targets 'self' (the Safe), we consider it to be invalid
      return (
        erc20DecodedData.functionName === 'transfer' &&
        erc20DecodedData.args[0] !== args.to
      );
    } catch {
      // swallow exception if data is not an ERC20 transfer
    }

    // If a transaction does not target 'self' consider it valid
    if (args.to !== execTransaction.to) {
      return true;
    }

    // Transaction targets 'self'
    // Block transactions targeting self with a value greater than 0
    if (execTransaction.value > BigInt(0)) {
      return false;
    }

    const isCancellation = execTransaction.data === '0x';
    return isCancellation || this.safeDecoder.isCall(execTransaction.data);
  }

  private async isOfficialMastercopy(args: {
    chainId: string;
    address: string;
  }): Promise<boolean> {
    try {
      await this.safeRepository.getSafe(args);
      return true;
    } catch {
      return false;
    }
  }

  private isOfficialMultiSendDeployment(args: {
    chainId: string;
    address: string;
  }): boolean {
    const multiSendDeployment = getMultiSendCallOnlyDeployment({
      version: LimitAddressesMapper.SUPPORTED_SAFE_VERSION,
      network: args.chainId,
    });
    return (
      multiSendDeployment?.networkAddresses[args.chainId] === args.address ||
      multiSendDeployment?.defaultAddress === args.address
    );
  }

  private getSafeAddressFromMultiSend = (data: Hex): Hex => {
    // Decode transactions within MultiSend
    const transactions = this.multiSendDecoder.mapMultiSendTransactions(data);

    // Every transaction is a valid execTransaction
    const isEveryValid = transactions.every((transaction) => {
      return this.isValidExecTransactionCall(transaction);
    });

    if (!isEveryValid) {
      throw Error('Invalid MultiSend transactions');
    }

    const firstRecipient = transactions[0].to;

    const isSameRecipient = transactions.every((transaction) => {
      return transaction.to === firstRecipient;
    });

    if (!isSameRecipient) {
      throw Error('MultiSend transactions target different addresses');
    }

    return firstRecipient;
  };

  private isValidCreateProxyWithNonceCall(args: {
    chainId: string;
    data: Hex;
  }): boolean {
    let singleton: string | null = null;

    try {
      const decoded = this.proxyFactoryDecoder.decodeFunctionData({
        data: args.data,
      });

      if (decoded.functionName !== 'createProxyWithNonce') {
        return false;
      }

      singleton = decoded.args[0];
    } catch (e) {
      return false;
    }

    const safeL1Deployment = getSafeSingletonDeployment({
      version: LimitAddressesMapper.SUPPORTED_SAFE_VERSION,
      network: args.chainId,
    });
    const safeL2Deployment = getSafeL2SingletonDeployment({
      version: LimitAddressesMapper.SUPPORTED_SAFE_VERSION,
      network: args.chainId,
    });

    const isL1Singleton =
      safeL1Deployment?.networkAddresses[args.chainId] === singleton;
    const isL2Singleton =
      safeL2Deployment?.networkAddresses[args.chainId] === singleton;

    return isL1Singleton || isL2Singleton;
  }

  private getOwnersFromCreateProxyWithNonce(data: Hex): readonly Hex[] {
    const decodedProxyFactory = this.proxyFactoryDecoder.decodeFunctionData({
      data,
    });

    if (decodedProxyFactory.functionName !== 'createProxyWithNonce') {
      throw Error('Not a createProxyWithNonce call');
    }

    const initializer = decodedProxyFactory.args[1];
    const decodedSafe = this.safeDecoder.decodeFunctionData({
      data: initializer,
    });

    if (decodedSafe.functionName !== 'setup') {
      throw Error('Not a setup call');
    }

    return decodedSafe.args[0];
  }
}

1	import { Inject, Injectable } from '@nestjs/common';	2✔
2	import { Hex } from 'viem/types/misc';
3	import { Erc20Decoder } from '@/domain/relay/contracts/erc-20-decoder.helper';	2✔
4	import { ISafeRepository } from '@/domain/safe/safe.repository.interface';	2✔
5	import { MultiSendDecoder } from '@/domain/contracts/contracts/multi-send-decoder.helper';	2✔
6	import { ProxyFactoryDecoder } from '@/domain/relay/contracts/proxy-factory-decoder.helper';	2✔
7	import {	2✔
8	getSafeSingletonDeployment,
9	getSafeL2SingletonDeployment,
10	getMultiSendCallOnlyDeployment,
11	} from '@safe-global/safe-deployments';
12	import { SafeDecoder } from '@/domain/contracts/contracts/safe-decoder.helper';	2✔
13
14	export interface RelayPayload {
15	chainId: string;
16	data: Hex;
17	to: Hex;
18	gasLimit?: bigint;
19	}
20
21	@Injectable()
22	export class LimitAddressesMapper {	2✔
23	// TODO: Support all versions (decoders currently use 1.3.0 ABIs though interface is generic)
24	private static SUPPORTED_SAFE_VERSION = '1.3.0';	2✔
25
26	constructor(
27	@Inject(ISafeRepository)
28	private readonly safeRepository: ISafeRepository,	50✔
29	private readonly erc20Decoder: Erc20Decoder,	50✔
30	private readonly safeDecoder: SafeDecoder,	50✔
31	private readonly multiSendDecoder: MultiSendDecoder,	50✔
32	private readonly proxyFactoryDecoder: ProxyFactoryDecoder,	50✔
33	) {}
34
35	async getLimitAddresses(args: RelayPayload): Promise<readonly Hex[]> {
36	// Calldata matches that of execTransaction and meets validity requirements
37	if (this.isValidExecTransactionCall(args)) {	50✔
38	// Safe attempting to relay is official
39	const isOfficial = await this.isOfficialMastercopy({	28✔
40	chainId: args.chainId,
41	address: args.to,
42	});
43
44	if (!isOfficial) {	28✔
45	throw Error('Invalid Safe contract');	4✔
46	}
47
48	// Safe targetted by execTransaction will be limited
49	return [args.to];	24✔
50	}
51
52	// Calldata matches that of multiSend and is from an official MultiSend contract
53	if (	22✔
54	this.multiSendDecoder.isMultiSend(args.data) &&	17✔
55	this.isOfficialMultiSendDeployment({
56	chainId: args.chainId,
57	address: args.to,
58	})
59	) {
60	// multiSend calldata meets the validity requirements
61	const safeAddress = this.getSafeAddressFromMultiSend(args.data);	8✔
62
63	// Safe attempting to relay is official
64	const isOfficial = await this.isOfficialMastercopy({	4✔
65	chainId: args.chainId,
66	address: safeAddress,
67	});
68
69	if (!isOfficial) {	4✔
70	throw Error('Invalid Safe contract');	2✔
71	}
72
73	// Safe targetted in batch will be limited
74	return [safeAddress];	2✔
75	}
76
77	// Calldata matches that of createProxyWithNonce and meets validity requirements
78	if (this.isValidCreateProxyWithNonceCall(args)) {	14✔
79	// Owners of safe-to-be-created will be limited
80	return this.getOwnersFromCreateProxyWithNonce(args.data);	4✔
81	}
82
83	throw Error('Cannot get limit addresses – Invalid transfer');	10✔
84	}
85
86	private isValidExecTransactionCall(args: { to: string; data: Hex }): boolean {
87	let execTransaction: { data: Hex; to: Hex; value: bigint };
88	// If transaction is an execTransaction
89	try {	66✔
90	const safeDecodedData = this.safeDecoder.decodeFunctionData({	66✔
91	data: args.data,
92	});
93	if (safeDecodedData.functionName !== 'execTransaction') {	44!
NEW 94	return false;	×
95	}
96	const [to, value, data] = safeDecodedData.args;	44✔
97	execTransaction = { to, value, data };	44✔
98	} catch (e) {
99	return false;	22✔
100	}
101
102	// If data of execTransaction is an ERC20 transfer
103	try {	44✔
104	const erc20DecodedData = this.erc20Decoder.decodeFunctionData({	44✔
105	data: execTransaction.data,
106	});
107	// If the ERC20 transfer targets 'self' (the Safe), we consider it to be invalid
108	return (	4✔
109	erc20DecodedData.functionName === 'transfer' &&	4✔
110	erc20DecodedData.args[0] !== args.to
111	);
112	} catch {
113	// swallow exception if data is not an ERC20 transfer
114	}
115
116	// If a transaction does not target 'self' consider it valid
117	if (args.to !== execTransaction.to) {	40✔
118	return true;	14✔
119	}
120
121	// Transaction targets 'self'
122	// Block transactions targeting self with a value greater than 0
123	if (execTransaction.value > BigInt(0)) {	26!
124	return false;	×
125	}
126
127	const isCancellation = execTransaction.data === '0x';	26✔
128	return isCancellation \|\| this.safeDecoder.isCall(execTransaction.data);	26✔
129	}
130
131	private async isOfficialMastercopy(args: {
132	chainId: string;
133	address: string;
134	}): Promise<boolean> {
135	try {	32✔
136	await this.safeRepository.getSafe(args);	32✔
137	return true;	26✔
138	} catch {
139	return false;	6✔
140	}
141	}
142
143	private isOfficialMultiSendDeployment(args: {
144	chainId: string;
145	address: string;
146	}): boolean {
147	const multiSendDeployment = getMultiSendCallOnlyDeployment({	12✔
148	version: LimitAddressesMapper.SUPPORTED_SAFE_VERSION,
149	network: args.chainId,
150	});
151	return (	12✔
152	multiSendDeployment?.networkAddresses[args.chainId] === args.address \|\|	26✔
153	multiSendDeployment?.defaultAddress === args.address	6✔
154	);
155	}
156
157	private getSafeAddressFromMultiSend = (data: Hex): Hex => {	50✔
158	// Decode transactions within MultiSend
159	const transactions = this.multiSendDecoder.mapMultiSendTransactions(data);	8✔
160
161	// Every transaction is a valid execTransaction
162	const isEveryValid = transactions.every((transaction) => {	8✔
163	return this.isValidExecTransactionCall(transaction);	16✔
164	});
165
166	if (!isEveryValid) {	8✔
167	throw Error('Invalid MultiSend transactions');	2✔
168	}
169
170	const firstRecipient = transactions[0].to;	6✔
171
172	const isSameRecipient = transactions.every((transaction) => {	6✔
173	return transaction.to === firstRecipient;	12✔
174	});
175
176	if (!isSameRecipient) {	6✔
177	throw Error('MultiSend transactions target different addresses');	2✔
178	}
179
180	return firstRecipient;	4✔
181	};
182
183	private isValidCreateProxyWithNonceCall(args: {
184	chainId: string;
185	data: Hex;
186	}): boolean {
187	let singleton: string \| null = null;	14✔
188
189	try {	14✔
190	const decoded = this.proxyFactoryDecoder.decodeFunctionData({	14✔
191	data: args.data,
192	});
193
194	if (decoded.functionName !== 'createProxyWithNonce') {	6!
195	return false;	×
196	}
197
198	singleton = decoded.args[0];	6✔
199	} catch (e) {
200	return false;	8✔
201	}
202
203	const safeL1Deployment = getSafeSingletonDeployment({	6✔
204	version: LimitAddressesMapper.SUPPORTED_SAFE_VERSION,
205	network: args.chainId,
206	});
207	const safeL2Deployment = getSafeL2SingletonDeployment({	6✔
208	version: LimitAddressesMapper.SUPPORTED_SAFE_VERSION,
209	network: args.chainId,
210	});
211
212	const isL1Singleton =
213	safeL1Deployment?.networkAddresses[args.chainId] === singleton;	6✔
214	const isL2Singleton =
215	safeL2Deployment?.networkAddresses[args.chainId] === singleton;	6✔
216
217	return isL1Singleton \|\| isL2Singleton;	6✔
218	}
219
220	private getOwnersFromCreateProxyWithNonce(data: Hex): readonly Hex[] {
221	const decodedProxyFactory = this.proxyFactoryDecoder.decodeFunctionData({	4✔
222	data,
223	});
224
225	if (decodedProxyFactory.functionName !== 'createProxyWithNonce') {	4!
226	throw Error('Not a createProxyWithNonce call');	×
227	}
228
229	const initializer = decodedProxyFactory.args[1];	4✔
230	const decodedSafe = this.safeDecoder.decodeFunctionData({	4✔
231	data: initializer,
232	});
233
234	if (decodedSafe.functionName !== 'setup') {	4!
235	throw Error('Not a setup call');	×
236	}
237
238	return decodedSafe.args[0];	4✔
239	}
240	}

safe-global / safe-client-gateway / 7913364454

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous