7958678133

Committed 19 Feb 2024 11:15AM UTC coverage: 93.748% (-0.2%) from 93.936%

Build # 7958678133

Build Type

Pull #1148

github

Committed by

iamacook

Commit Message

Merge branch 'main' into use-abiencoders

Pull Request Pull Request #1148: Replace Safe/ERC-20 `ContractHelper`s with `AbiDecoder`s

Run Details

1635 of 1950 branches covered (83.85%)

Branch coverage included in aggregate %.

21 of 22 new or added lines in 5 files covered. (95.45%)

11 existing lines in 2 files now uncovered.

6073 of 6272 relevant lines covered (96.83%)

194.55 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

90.36

/src/domain/relay/limit-addresses.mapper.ts

import { Inject, Injectable } from '@nestjs/common';
import { Hex } from 'viem/types/misc';
import { Erc20Decoder } from '@/domain/relay/contracts/erc-20-decoder.helper';
import { ISafeRepository } from '@/domain/safe/safe.repository.interface';
import { MultiSendDecoder } from '@/domain/contracts/contracts/multi-send-decoder.helper';
import { ProxyFactoryDecoder } from '@/domain/relay/contracts/proxy-factory-decoder.helper';
import {
  getSafeSingletonDeployment,
  getSafeL2SingletonDeployment,
  getMultiSendCallOnlyDeployment,
  getMultiSendDeployment,
} from '@safe-global/safe-deployments';
import { SafeDecoder } from '@/domain/contracts/contracts/safe-decoder.helper';
import { isAddress, isHex } from 'viem';

@Injectable()
export class LimitAddressesMapper {
  // TODO: Support all versions (decoders currently use 1.3.0 ABIs though interface is generic)
  private static SUPPORTED_SAFE_VERSION = '1.3.0';

  constructor(
    @Inject(ISafeRepository)
    private readonly safeRepository: ISafeRepository,
    private readonly erc20Decoder: Erc20Decoder,
    private readonly safeDecoder: SafeDecoder,
    private readonly multiSendDecoder: MultiSendDecoder,
    private readonly proxyFactoryDecoder: ProxyFactoryDecoder,
  ) {}

  async getLimitAddresses(args: {
    chainId: string;
    to: string;
    data: string;
  }): Promise<readonly Hex[]> {
    if (!isAddress(args.to)) {
      throw Error('Invalid to provided');
    }

    if (!isHex(args.data)) {
      throw Error('Invalid data provided');
    }

    // Calldata matches that of execTransaction and meets validity requirements
    if (
      this.isValidExecTransactionCall({
        to: args.to,
        data: args.data,
      })
    ) {
      // Safe attempting to relay is official
      const isOfficial = await this.isOfficialMastercopy({
        chainId: args.chainId,
        address: args.to,
      });

      if (!isOfficial) {
        throw Error('execTransaction via unofficial Safe mastercopy');
      }

      // Safe targeted by execTransaction will be limited
      return [args.to];
    }

    // Calldata matches that of multiSend and is from an official MultiSend contract
    if (this.multiSendDecoder.isMultiSend(args.data)) {
      if (
        !this.isOfficialMultiSendDeployment({
          chainId: args.chainId,
          address: args.to,
        })
      ) {
        throw Error('multiSend via unofficial MultiSend contract');
      }

      // multiSend calldata meets the validity requirements
      const safeAddress = this.getSafeAddressFromMultiSend(args.data);

      // Safe attempting to relay is official
      const isOfficial = await this.isOfficialMastercopy({
        chainId: args.chainId,
        address: safeAddress,
      });

      if (!isOfficial) {
        throw Error('multiSend via unofficial Safe mastercopy');
      }

      // Safe targeted in batch will be limited
      return [safeAddress];
    }

    // Calldata matches that of createProxyWithNonce and meets validity requirements
    if (
      this.isValidCreateProxyWithNonceCall({
        chainId: args.chainId,
        data: args.data,
      })
    ) {
      // Owners of safe-to-be-created will be limited
      return this.getOwnersFromCreateProxyWithNonce(args.data);
    }

    throw Error('Cannot get limit addresses – Invalid transfer');
  }

  private isValidExecTransactionCall(args: { to: string; data: Hex }): boolean {
    let execTransaction: { data: Hex; to: Hex; value: bigint };
    // If transaction is an execTransaction
    try {
      const safeDecodedData = this.safeDecoder.decodeFunctionData({
        data: args.data,
      });
      if (safeDecodedData.functionName !== 'execTransaction') {
        return false;
      }
      const [to, value, data] = safeDecodedData.args;
      execTransaction = { to, value, data };
    } catch (e) {
      return false;
    }

    // If data of execTransaction is an ERC20 transfer
    try {
      const erc20DecodedData = this.erc20Decoder.decodeFunctionData({
        data: execTransaction.data,
      });
      // If the ERC20 transfer targets 'self' (the Safe), we consider it to be invalid
      return (
        erc20DecodedData.functionName === 'transfer' &&
        erc20DecodedData.args[0] !== args.to
      );
    } catch {
      // swallow exception if data is not an ERC20 transfer
    }

    // If a transaction does not target 'self' consider it valid
    if (args.to !== execTransaction.to) {
      return true;
    }

    // Transaction targets 'self'
    // Block transactions targeting self with a value greater than 0
    if (execTransaction.value > BigInt(0)) {
      return false;
    }

    const isCancellation = execTransaction.data === '0x';
    return isCancellation || this.safeDecoder.isCall(execTransaction.data);
  }

  private async isOfficialMastercopy(args: {
    chainId: string;
    address: string;
  }): Promise<boolean> {
    try {
      await this.safeRepository.getSafe(args);
      return true;
    } catch {
      return false;
    }
  }

  private isOfficialMultiSendDeployment(args: {
    chainId: string;
    address: string;
  }): boolean {
    const multiSendCallOnlyDeployment = getMultiSendCallOnlyDeployment({
      version: LimitAddressesMapper.SUPPORTED_SAFE_VERSION,
      network: args.chainId,
    });

    const isCallOnly =
      multiSendCallOnlyDeployment?.networkAddresses[args.chainId] ===
        args.address ||
      multiSendCallOnlyDeployment?.defaultAddress === args.address;

    if (isCallOnly) {
      return true;
    }

    const multiSendCallDeployment = getMultiSendDeployment({
      version: LimitAddressesMapper.SUPPORTED_SAFE_VERSION,
      network: args.chainId,
    });
    return (
      multiSendCallDeployment?.networkAddresses[args.chainId] ===
        args.address || multiSendCallDeployment?.defaultAddress === args.address
    );
  }

  private getSafeAddressFromMultiSend = (data: Hex): Hex => {
    // Decode transactions within MultiSend
    const transactions = this.multiSendDecoder.mapMultiSendTransactions(data);

    // Every transaction is a valid execTransaction
    const isEveryValid = transactions.every((transaction) => {
      return this.isValidExecTransactionCall(transaction);
    });

    if (!isEveryValid) {
      throw Error('Invalid MultiSend transactions');
    }

    const firstRecipient = transactions[0].to;

    const isSameRecipient = transactions.every((transaction) => {
      return transaction.to === firstRecipient;
    });

    if (!isSameRecipient) {
      throw Error('MultiSend transactions target different addresses');
    }

    return firstRecipient;
  };

  private isValidCreateProxyWithNonceCall(args: {
    chainId: string;
    data: Hex;
  }): boolean {
    let singleton: string | null = null;

    try {
      const decoded = this.proxyFactoryDecoder.decodeFunctionData({
        data: args.data,
      });

      if (decoded.functionName !== 'createProxyWithNonce') {
        return false;
      }

      singleton = decoded.args[0];
    } catch (e) {
      return false;
    }

    const safeL1Deployment = getSafeSingletonDeployment({
      version: LimitAddressesMapper.SUPPORTED_SAFE_VERSION,
      network: args.chainId,
    });
    const safeL2Deployment = getSafeL2SingletonDeployment({
      version: LimitAddressesMapper.SUPPORTED_SAFE_VERSION,
      network: args.chainId,
    });

    const isL1Singleton =
      safeL1Deployment?.networkAddresses[args.chainId] === singleton;
    const isL2Singleton =
      safeL2Deployment?.networkAddresses[args.chainId] === singleton;

    return isL1Singleton || isL2Singleton;
  }

  private getOwnersFromCreateProxyWithNonce(data: Hex): readonly Hex[] {
    const decodedProxyFactory = this.proxyFactoryDecoder.decodeFunctionData({
      data,
    });

    if (decodedProxyFactory.functionName !== 'createProxyWithNonce') {
      throw Error('Not a createProxyWithNonce call');
    }

    const initializer = decodedProxyFactory.args[1];
    const decodedSafe = this.safeDecoder.decodeFunctionData({
      data: initializer,
    });

    if (decodedSafe.functionName !== 'setup') {
      throw Error('Not a setup call');
    }

    return decodedSafe.args[0];
  }
}

1	import { Inject, Injectable } from '@nestjs/common';	82✔
2	import { Hex } from 'viem/types/misc';
3	import { Erc20Decoder } from '@/domain/relay/contracts/erc-20-decoder.helper';	82✔
4	import { ISafeRepository } from '@/domain/safe/safe.repository.interface';	82✔
5	import { MultiSendDecoder } from '@/domain/contracts/contracts/multi-send-decoder.helper';	82✔
6	import { ProxyFactoryDecoder } from '@/domain/relay/contracts/proxy-factory-decoder.helper';	82✔
7	import {	82✔
8	getSafeSingletonDeployment,
9	getSafeL2SingletonDeployment,
10	getMultiSendCallOnlyDeployment,
11	getMultiSendDeployment,
12	} from '@safe-global/safe-deployments';
13	import { SafeDecoder } from '@/domain/contracts/contracts/safe-decoder.helper';	82✔
14	import { isAddress, isHex } from 'viem';	82✔
15
16	@Injectable()
17	export class LimitAddressesMapper {	82✔
18	// TODO: Support all versions (decoders currently use 1.3.0 ABIs though interface is generic)
19	private static SUPPORTED_SAFE_VERSION = '1.3.0';	82✔
20
21	constructor(
22	@Inject(ISafeRepository)
23	private readonly safeRepository: ISafeRepository,	712✔
24	private readonly erc20Decoder: Erc20Decoder,	712✔
25	private readonly safeDecoder: SafeDecoder,	712✔
26	private readonly multiSendDecoder: MultiSendDecoder,	712✔
27	private readonly proxyFactoryDecoder: ProxyFactoryDecoder,	712✔
28	) {}
29
30	async getLimitAddresses(args: {
31	chainId: string;
32	to: string;
33	data: string;
34	}): Promise<readonly Hex[]> {
35	if (!isAddress(args.to)) {	146✔
36	throw Error('Invalid to provided');	4✔
37	}
38
39	if (!isHex(args.data)) {	142✔
40	throw Error('Invalid data provided');	2✔
41	}
42
43	// Calldata matches that of execTransaction and meets validity requirements
44	if (	140✔
45	this.isValidExecTransactionCall({
46	to: args.to,
47	data: args.data,
48	})
49	) {
50	// Safe attempting to relay is official
51	const isOfficial = await this.isOfficialMastercopy({	88✔
52	chainId: args.chainId,
53	address: args.to,
54	});
55
56	if (!isOfficial) {	88✔
57	throw Error('execTransaction via unofficial Safe mastercopy');	4✔
58	}
59
60	// Safe targeted by execTransaction will be limited
61	return [args.to];	84✔
62	}
63
64	// Calldata matches that of multiSend and is from an official MultiSend contract
65	if (this.multiSendDecoder.isMultiSend(args.data)) {	52✔
66	if (	26✔
67	!this.isOfficialMultiSendDeployment({
68	chainId: args.chainId,
69	address: args.to,
70	})
71	) {
72	throw Error('multiSend via unofficial MultiSend contract');	4✔
73	}
74
75	// multiSend calldata meets the validity requirements
76	const safeAddress = this.getSafeAddressFromMultiSend(args.data);	22✔
77
78	// Safe attempting to relay is official
79	const isOfficial = await this.isOfficialMastercopy({	14✔
80	chainId: args.chainId,
81	address: safeAddress,
82	});
83
84	if (!isOfficial) {	14✔
85	throw Error('multiSend via unofficial Safe mastercopy');	4✔
86	}
87
88	// Safe targeted in batch will be limited
89	return [safeAddress];	10✔
90	}
91
92	// Calldata matches that of createProxyWithNonce and meets validity requirements
93	if (	26✔
94	this.isValidCreateProxyWithNonceCall({
95	chainId: args.chainId,
96	data: args.data,
97	})
98	) {
99	// Owners of safe-to-be-created will be limited
100	return this.getOwnersFromCreateProxyWithNonce(args.data);	10✔
101	}
102
103	throw Error('Cannot get limit addresses – Invalid transfer');	16✔
104	}
105
106	private isValidExecTransactionCall(args: { to: string; data: Hex }): boolean {
107	let execTransaction: { data: Hex; to: Hex; value: bigint };
108	// If transaction is an execTransaction
109	try {	184✔
110	const safeDecodedData = this.safeDecoder.decodeFunctionData({	184✔
111	data: args.data,
112	});
113	if (safeDecodedData.functionName !== 'execTransaction') {	136!
NEW 114	return false;	×
115	}
116	const [to, value, data] = safeDecodedData.args;	136✔
117	execTransaction = { to, value, data };	136✔
118	} catch (e) {
119	return false;	48✔
120	}
121
122	// If data of execTransaction is an ERC20 transfer
123	try {	136✔
124	const erc20DecodedData = this.erc20Decoder.decodeFunctionData({	136✔
125	data: execTransaction.data,
126	});
127	// If the ERC20 transfer targets 'self' (the Safe), we consider it to be invalid
128	return (	8✔
129	erc20DecodedData.functionName === 'transfer' &&	8✔
130	erc20DecodedData.args[0] !== args.to
131	);
132	} catch {
133	// swallow exception if data is not an ERC20 transfer
134	}
135
136	// If a transaction does not target 'self' consider it valid
137	if (args.to !== execTransaction.to) {	128✔
138	return true;	94✔
139	}
140
141	// Transaction targets 'self'
142	// Block transactions targeting self with a value greater than 0
143	if (execTransaction.value > BigInt(0)) {	34✔
144	return false;	4✔
145	}
146
147	const isCancellation = execTransaction.data === '0x';	30✔
148	return isCancellation \|\| this.safeDecoder.isCall(execTransaction.data);	30✔
149	}
150
151	private async isOfficialMastercopy(args: {
152	chainId: string;
153	address: string;
154	}): Promise<boolean> {
155	try {	102✔
156	await this.safeRepository.getSafe(args);	102✔
157	return true;	94✔
158	} catch {
159	return false;	8✔
160	}
161	}
162
163	private isOfficialMultiSendDeployment(args: {
164	chainId: string;
165	address: string;
166	}): boolean {
167	const multiSendCallOnlyDeployment = getMultiSendCallOnlyDeployment({	26✔
168	version: LimitAddressesMapper.SUPPORTED_SAFE_VERSION,
169	network: args.chainId,
170	});
171
172	const isCallOnly =
173	multiSendCallOnlyDeployment?.networkAddresses[args.chainId] ===	26!
174	args.address \|\|
175	multiSendCallOnlyDeployment?.defaultAddress === args.address;	12!
176
177	if (isCallOnly) {	26✔
178	return true;	18✔
179	}
180
181	const multiSendCallDeployment = getMultiSendDeployment({	8✔
182	version: LimitAddressesMapper.SUPPORTED_SAFE_VERSION,
183	network: args.chainId,
184	});
185	return (	8✔
186	multiSendCallDeployment?.networkAddresses[args.chainId] ===	18!
187	args.address \|\| multiSendCallDeployment?.defaultAddress === args.address	6!
188	);
189	}
190
191	private getSafeAddressFromMultiSend = (data: Hex): Hex => {	712✔
192	// Decode transactions within MultiSend
193	const transactions = this.multiSendDecoder.mapMultiSendTransactions(data);	22✔
194
195	// Every transaction is a valid execTransaction
196	const isEveryValid = transactions.every((transaction) => {	22✔
197	return this.isValidExecTransactionCall(transaction);	44✔
198	});
199
200	if (!isEveryValid) {	22✔
201	throw Error('Invalid MultiSend transactions');	4✔
202	}
203
204	const firstRecipient = transactions[0].to;	18✔
205
206	const isSameRecipient = transactions.every((transaction) => {	18✔
207	return transaction.to === firstRecipient;	36✔
208	});
209
210	if (!isSameRecipient) {	18✔
211	throw Error('MultiSend transactions target different addresses');	4✔
212	}
213
214	return firstRecipient;	14✔
215	};
216
217	private isValidCreateProxyWithNonceCall(args: {
218	chainId: string;
219	data: Hex;
220	}): boolean {
221	let singleton: string \| null = null;	26✔
222
223	try {	26✔
224	const decoded = this.proxyFactoryDecoder.decodeFunctionData({	26✔
225	data: args.data,
226	});
227
228	if (decoded.functionName !== 'createProxyWithNonce') {	14!
229	return false;	×
230	}
231
232	singleton = decoded.args[0];	14✔
233	} catch (e) {
234	return false;	12✔
235	}
236
237	const safeL1Deployment = getSafeSingletonDeployment({	14✔
238	version: LimitAddressesMapper.SUPPORTED_SAFE_VERSION,
239	network: args.chainId,
240	});
241	const safeL2Deployment = getSafeL2SingletonDeployment({	14✔
242	version: LimitAddressesMapper.SUPPORTED_SAFE_VERSION,
243	network: args.chainId,
244	});
245
246	const isL1Singleton =
247	safeL1Deployment?.networkAddresses[args.chainId] === singleton;	14✔
248	const isL2Singleton =
249	safeL2Deployment?.networkAddresses[args.chainId] === singleton;	14✔
250
251	return isL1Singleton \|\| isL2Singleton;	14✔
252	}
253
254	private getOwnersFromCreateProxyWithNonce(data: Hex): readonly Hex[] {
255	const decodedProxyFactory = this.proxyFactoryDecoder.decodeFunctionData({	10✔
256	data,
257	});
258
259	if (decodedProxyFactory.functionName !== 'createProxyWithNonce') {	10!
260	throw Error('Not a createProxyWithNonce call');	×
261	}
262
263	const initializer = decodedProxyFactory.args[1];	10✔
264	const decodedSafe = this.safeDecoder.decodeFunctionData({	10✔
265	data: initializer,
266	});
267
268	if (decodedSafe.functionName !== 'setup') {	10!
269	throw Error('Not a setup call');	×
270	}
271
272	return decodedSafe.args[0];	10✔
273	}
274	}

safe-global / safe-client-gateway / 7958678133

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous