8752432596

Committed 19 Apr 2024 10:54AM UTC coverage: 92.173% (-0.5%) from 92.677%

Build # 8752432596

Build Type

push

github

Committed by

iamacook

Commit Message

Filter immediately poisoned outgoing transfer events

Run Details

1937 of 2359 branches covered (82.11%)

Branch coverage included in aggregate %.

1 of 27 new or added lines in 1 file covered. (3.7%)

1 existing line in 1 file now uncovered.

6860 of 7185 relevant lines covered (95.48%)

306.85 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

60.71

/src/routes/transactions/mappers/transactions-history.mapper.ts

import { Inject, Injectable } from '@nestjs/common';
import { groupBy } from 'lodash';
import { CreationTransaction } from '@/domain/safe/entities/creation-transaction.entity';
import { EthereumTransaction } from '@/domain/safe/entities/ethereum-transaction.entity';
import { ModuleTransaction } from '@/domain/safe/entities/module-transaction.entity';
import { MultisigTransaction } from '@/domain/safe/entities/multisig-transaction.entity';
import { Safe } from '@/domain/safe/entities/safe.entity';
import {
  isCreationTransaction,
  isEthereumTransaction,
  isModuleTransaction,
  isMultisigTransaction,
  Transaction as TransactionDomain,
} from '@/domain/safe/entities/transaction.entity';
import {
  Transfer,
  isERC20Transfer,
} from '@/domain/safe/entities/transfer.entity';
import { DateLabel } from '@/routes/common/entities/date-label.entity';
import { TransactionItem } from '@/routes/transactions/entities/transaction-item.entity';
import { CreationTransactionMapper } from '@/routes/transactions/mappers/creation-transaction/creation-transaction.mapper';
import { ModuleTransactionMapper } from '@/routes/transactions/mappers/module-transactions/module-transaction.mapper';
import { MultisigTransactionMapper } from '@/routes/transactions/mappers/multisig-transactions/multisig-transaction.mapper';
import { TransferMapper } from '@/routes/transactions/mappers/transfers/transfer.mapper';
import { IConfigurationService } from '@/config/configuration.service.interface';

class TransactionDomainGroup {
  timestamp!: number;
  transactions!: (
    | MultisigTransaction
    | ModuleTransaction
    | EthereumTransaction
    | CreationTransaction
  )[];
}

@Injectable()
export class TransactionsHistoryMapper {
  private readonly maxNestedTransfers: number;

  constructor(
    @Inject(IConfigurationService) configurationService: IConfigurationService,
    private readonly multisigTransactionMapper: MultisigTransactionMapper,
    private readonly moduleTransactionMapper: ModuleTransactionMapper,
    private readonly transferMapper: TransferMapper,
    private readonly creationTransactionMapper: CreationTransactionMapper,
  ) {
    this.maxNestedTransfers = configurationService.getOrThrow(
      'mappings.history.maxNestedTransfers',
    );
  }

  async mapTransactionsHistory(
    chainId: string,
    transactionsDomain: TransactionDomain[],
    safe: Safe,
    offset: number,
    timezoneOffset: number,
    onlyTrusted: boolean,
  ): Promise<Array<TransactionItem | DateLabel>> {
    if (transactionsDomain.length == 0) {
      return [];
    }
    const previousTransaction = this.getPreviousItem(
      offset,
      transactionsDomain,
    );
    let prevPageTimestamp = 0;
    if (previousTransaction !== null) {
      prevPageTimestamp = this.getDayFromTransactionDate(
        previousTransaction,
        timezoneOffset,
      ).getTime();
      // Filter poisoned transactions
      transactionsDomain = this.getLegitimateTransactions(
        safe.address,
        transactionsDomain,
      );
      // Remove first transaction that was requested to get previous day timestamp
      transactionsDomain = transactionsDomain.slice(1);
    }

    const transactionsDomainGroups = this.groupByDay(
      transactionsDomain,
      timezoneOffset,
    );

    const transactionList = await Promise.all(
      transactionsDomainGroups.map(async (transactionGroup) => {
        const items: (TransactionItem | DateLabel)[] = [];
        const groupTransactions = (
          await this.mapGroupTransactions(
            transactionGroup,
            chainId,
            safe,
            onlyTrusted,
          )
        )
          .filter(<T>(x: T | undefined): x is T => x != null)
          .flat();

        // If the current group is a follow-up from the previous page,
        // or the group is empty, the date label shouldn't be added.
        const isFollowUp = transactionGroup.timestamp == prevPageTimestamp;
        if (!isFollowUp && groupTransactions.length) {
          items.push(new DateLabel(transactionGroup.timestamp));
        }
        items.push(...groupTransactions);
        return items;
      }),
    );

    return transactionList.flat();
  }

  private getLegitimateTransactions(
    safeAddress: string,
    transactions: TransactionDomainGroup['transactions'],
  ): TransactionDomainGroup['transactions'] {
    /**
     * The following filters poisoned events that are:
     * - immediately after legitimate transfers
     * - outgoing transfers
     * - of the same value
     * - by 4-char. vanity addresses
     *
     * It does not:
     * - support referencing transfers within multiSends
     * - have dynamic heuristics
     * - depend on the trusted flag or have a feature flag
     */

    return transactions.map((item, i, arr) => {
      // Address poisoning only targets transfers
      if (!isEthereumTransaction(item) || !item.transfers) {
        return item;
      }

      // Get the previous transaction...
      const prevItem = arr[i - 1];
      if (
        !prevItem ||
        !isEthereumTransaction(prevItem) ||
        !prevItem.transfers
      ) {
        return item;
      }

      // ...get the last transfer
      const prevTransfers = prevItem.transfers
        .filter(isERC20Transfer)
        .filter((prev) => safeAddress === prev.from);
      const prevTransfer = prevTransfers.at(-1);

      if (!prevTransfer) {
        return item;
      }

      const legitTransfers = item.transfers.filter((transfer) => {
        // Non-ERC20 transfers are always considered legitimate
        if (!isERC20Transfer(transfer)) return true;

        const isOutgoing = safeAddress === transfer.from;
        if (isOutgoing) return true;

        const isSameValue = transfer.value === prevTransfer.value;
        if (!isSameValue) return true;

        const sender = transfer.from.toLowerCase();
        const prevSender = prevTransfer.from.toLowerCase();

        const isSameAddress = sender === prevSender;
        return !isSameAddress && !this.isVanityAddress(sender, prevSender);
      });

      item.transfers = legitTransfers.length === 0 ? null : legitTransfers;

      return item;
    });
  }

  private isVanityAddress(address1: string, address2: string): boolean {
    const VANITY_THRESHOLD = 4;
    return (
      // Ignore `0x` prefix
      address1.slice(2, VANITY_THRESHOLD) ===
        address2.slice(2, VANITY_THRESHOLD) ||
      address1.slice(-VANITY_THRESHOLD) === address2.slice(-VANITY_THRESHOLD)
    );
  }

  private getTransactionTimestamp(transaction: TransactionDomain): Date {
    let timestamp: Date | null;
    if (isMultisigTransaction(transaction)) {
      const executionDate = transaction.executionDate;
      timestamp = executionDate ?? transaction.submissionDate;
    } else if (isEthereumTransaction(transaction)) {
      timestamp = transaction.executionDate;
    } else if (isModuleTransaction(transaction)) {
      timestamp = transaction.executionDate;
    } else if (isCreationTransaction(transaction)) {
      timestamp = transaction.created;
    } else {
      throw Error('Unknown transaction type');
    }
    if (timestamp == null) {
      throw Error('ExecutionDate cannot be null');
    }
    return timestamp;
  }

  private getPreviousItem(
    offset: number,
    transactions: TransactionDomain[],
  ): TransactionDomain | null {
    // More than 1 element is required to get the previous page date
    if (offset <= 0 || transactions.length <= 1) return null;
    return transactions[0];
  }

  private getDayFromTransactionDate(
    transaction: TransactionDomain,
    timezoneOffset: number,
  ): Date {
    const timestamp = this.getTransactionTimestamp(transaction);
    return this.getDayStartForDate(timestamp, timezoneOffset);
  }

  private groupByDay(
    transactions: TransactionDomain[],
    timezoneOffset: number,
  ): TransactionDomainGroup[] {
    return Object.entries(
      groupBy(transactions, (transaction) => {
        return this.getDayFromTransactionDate(
          transaction,
          timezoneOffset,
        ).getTime();
      }),
    ).map(([, transactions]): TransactionDomainGroup => {
      // The groups respect the timezone offset – this was done for grouping only.
      // The actual value of the group should be in the UTC timezone instead
      // A group should always have at least one transaction.
      return {
        timestamp: this.getTransactionTimestamp(transactions[0]).getTime(),
        transactions: transactions,
      };
    });
  }

  /**
   * Returns a day {@link Date } at 00:00:00 from the input timestamp.
   *
   * @param timestamp - date to convert
   * @param timezoneOffset - Offset of time zone in milliseconds
   */
  private getDayStartForDate(timestamp: Date, timezoneOffset: number): Date {
    const date = structuredClone(timestamp);
    date.setTime(date.getTime() + timezoneOffset);
    return new Date(
      Date.UTC(date.getUTCFullYear(), date.getUTCMonth(), date.getUTCDate()),
    );
  }

  private async mapTransfers(
    transfers: Transfer[],
    chainId: string,
    safe: Safe,
    onlyTrusted: boolean,
  ): Promise<TransactionItem[]> {
    const limitedTransfers = transfers.slice(0, this.maxNestedTransfers);

    const nestedTransactions = await this.transferMapper.mapTransfers({
      chainId,
      transfers: limitedTransfers,
      safe,
      onlyTrusted,
    });

    return nestedTransactions.map(
      (nestedTransaction) => new TransactionItem(nestedTransaction),
    );
  }

  private mapGroupTransactions(
    transactionGroup: TransactionDomainGroup,
    chainId: string,
    safe: Safe,
    onlyTrusted: boolean,
  ): Promise<(TransactionItem | TransactionItem[] | undefined)[]> {
    return Promise.all(
      transactionGroup.transactions.map(async (transaction) => {
        if (isMultisigTransaction(transaction)) {
          return new TransactionItem(
            await this.multisigTransactionMapper.mapTransaction(
              chainId,
              transaction,
              safe,
            ),
          );
        } else if (isModuleTransaction(transaction)) {
          return new TransactionItem(
            await this.moduleTransactionMapper.mapTransaction(
              chainId,
              transaction,
            ),
          );
        } else if (isEthereumTransaction(transaction)) {
          const transfers = transaction.transfers;
          if (transfers != null) {
            return await this.mapTransfers(
              transfers,
              chainId,
              safe,
              onlyTrusted,
            );
          }
        } else if (isCreationTransaction(transaction)) {
          return new TransactionItem(
            await this.creationTransactionMapper.mapTransaction(
              chainId,
              transaction,
              safe,
            ),
          );
        } else {
          // This should never happen as AJV would not allow an unknown transaction to get to this stage
          throw Error('Unrecognized transaction type');
        }
      }),
    );
  }
}

1	import { Inject, Injectable } from '@nestjs/common';	96✔
2	import { groupBy } from 'lodash';	96✔
3	import { CreationTransaction } from '@/domain/safe/entities/creation-transaction.entity';
4	import { EthereumTransaction } from '@/domain/safe/entities/ethereum-transaction.entity';
5	import { ModuleTransaction } from '@/domain/safe/entities/module-transaction.entity';
6	import { MultisigTransaction } from '@/domain/safe/entities/multisig-transaction.entity';
7	import { Safe } from '@/domain/safe/entities/safe.entity';
8	import {	96✔
9	isCreationTransaction,
10	isEthereumTransaction,
11	isModuleTransaction,
12	isMultisigTransaction,
13	Transaction as TransactionDomain,
14	} from '@/domain/safe/entities/transaction.entity';
15	import {	96✔
16	Transfer,
17	isERC20Transfer,
18	} from '@/domain/safe/entities/transfer.entity';
19	import { DateLabel } from '@/routes/common/entities/date-label.entity';	96✔
20	import { TransactionItem } from '@/routes/transactions/entities/transaction-item.entity';	96✔
21	import { CreationTransactionMapper } from '@/routes/transactions/mappers/creation-transaction/creation-transaction.mapper';	96✔
22	import { ModuleTransactionMapper } from '@/routes/transactions/mappers/module-transactions/module-transaction.mapper';	96✔
23	import { MultisigTransactionMapper } from '@/routes/transactions/mappers/multisig-transactions/multisig-transaction.mapper';	96✔
24	import { TransferMapper } from '@/routes/transactions/mappers/transfers/transfer.mapper';	96✔
25	import { IConfigurationService } from '@/config/configuration.service.interface';	96✔
26
27	class TransactionDomainGroup {
28	timestamp!: number;
29	transactions!: (
30	\| MultisigTransaction
31	\| ModuleTransaction
32	\| EthereumTransaction
33	\| CreationTransaction
34	)[];
35	}
36
37	@Injectable()
38	export class TransactionsHistoryMapper {	96✔
39	private readonly maxNestedTransfers: number;
40
41	constructor(
42	@Inject(IConfigurationService) configurationService: IConfigurationService,
43	private readonly multisigTransactionMapper: MultisigTransactionMapper,	1,220✔
44	private readonly moduleTransactionMapper: ModuleTransactionMapper,	1,220✔
45	private readonly transferMapper: TransferMapper,	1,220✔
46	private readonly creationTransactionMapper: CreationTransactionMapper,	1,220✔
47	) {
48	this.maxNestedTransfers = configurationService.getOrThrow(	1,220✔
49	'mappings.history.maxNestedTransfers',
50	);
51	}
52
53	async mapTransactionsHistory(
54	chainId: string,
55	transactionsDomain: TransactionDomain[],
56	safe: Safe,
57	offset: number,
58	timezoneOffset: number,
59	onlyTrusted: boolean,
60	): Promise<Array<TransactionItem \| DateLabel>> {
61	if (transactionsDomain.length == 0) {	28!
62	return [];	×
63	}
64	const previousTransaction = this.getPreviousItem(	28✔
65	offset,
66	transactionsDomain,
67	);
68	let prevPageTimestamp = 0;	28✔
69	if (previousTransaction !== null) {	28!
70	prevPageTimestamp = this.getDayFromTransactionDate(	×
71	previousTransaction,
72	timezoneOffset,
73	).getTime();
74	// Filter poisoned transactions
NEW 75	transactionsDomain = this.getLegitimateTransactions(	×
76	safe.address,
77	transactionsDomain,
78	);
79	// Remove first transaction that was requested to get previous day timestamp
80	transactionsDomain = transactionsDomain.slice(1);	×
81	}
82
83	const transactionsDomainGroups = this.groupByDay(	28✔
84	transactionsDomain,
85	timezoneOffset,
86	);
87
88	const transactionList = await Promise.all(	28✔
89	transactionsDomainGroups.map(async (transactionGroup) => {
90	const items: (TransactionItem \| DateLabel)[] = [];	44✔
91	const groupTransactions = (	44✔
92	await this.mapGroupTransactions(
93	transactionGroup,
94	chainId,
95	safe,
96	onlyTrusted,
97	)
98	)
99	.filter(<T>(x: T \| undefined): x is T => x != null)	46✔
100	.flat();
101
102	// If the current group is a follow-up from the previous page,
103	// or the group is empty, the date label shouldn't be added.
104	const isFollowUp = transactionGroup.timestamp == prevPageTimestamp;	44✔
105	if (!isFollowUp && groupTransactions.length) {	44✔
106	items.push(new DateLabel(transactionGroup.timestamp));	38✔
107	}
108	items.push(...groupTransactions);	44✔
109	return items;	44✔
110	}),
111	);
112
113	return transactionList.flat();	28✔
114	}
115
116	private getLegitimateTransactions(
117	safeAddress: string,
118	transactions: TransactionDomainGroup['transactions'],
119	): TransactionDomainGroup['transactions'] {
120	/**
121	* The following filters poisoned events that are:
122	* - immediately after legitimate transfers
123	* - outgoing transfers
124	* - of the same value
125	* - by 4-char. vanity addresses
126	*
127	* It does not:
128	* - support referencing transfers within multiSends
129	* - have dynamic heuristics
130	* - depend on the trusted flag or have a feature flag
131	*/
132
NEW 133	return transactions.map((item, i, arr) => {	×
134	// Address poisoning only targets transfers
NEW 135	if (!isEthereumTransaction(item) \|\| !item.transfers) {	×
NEW 136	return item;	×
137	}
138
139	// Get the previous transaction...
NEW 140	const prevItem = arr[i - 1];	×
NEW 141	if (	×
142	!prevItem \|\|	×
143	!isEthereumTransaction(prevItem) \|\|
144	!prevItem.transfers
145	) {
NEW 146	return item;	×
147	}
148
149	// ...get the last transfer
NEW 150	const prevTransfers = prevItem.transfers	×
151	.filter(isERC20Transfer)
NEW 152	.filter((prev) => safeAddress === prev.from);	×
NEW 153	const prevTransfer = prevTransfers.at(-1);	×
154
NEW 155	if (!prevTransfer) {	×
NEW 156	return item;	×
157	}
158
NEW 159	const legitTransfers = item.transfers.filter((transfer) => {	×
160	// Non-ERC20 transfers are always considered legitimate
NEW 161	if (!isERC20Transfer(transfer)) return true;	×
162
NEW 163	const isOutgoing = safeAddress === transfer.from;	×
NEW 164	if (isOutgoing) return true;	×
165
NEW 166	const isSameValue = transfer.value === prevTransfer.value;	×
NEW 167	if (!isSameValue) return true;	×
168
NEW 169	const sender = transfer.from.toLowerCase();	×
NEW 170	const prevSender = prevTransfer.from.toLowerCase();	×
171
NEW 172	const isSameAddress = sender === prevSender;	×
NEW 173	return !isSameAddress && !this.isVanityAddress(sender, prevSender);	×
174	});
175
NEW 176	item.transfers = legitTransfers.length === 0 ? null : legitTransfers;	×
177
NEW 178	return item;	×
179	});
180	}
181
182	private isVanityAddress(address1: string, address2: string): boolean {
NEW 183	const VANITY_THRESHOLD = 4;	×
NEW 184	return (	×
185	// Ignore `0x` prefix
186	address1.slice(2, VANITY_THRESHOLD) ===	×
187	address2.slice(2, VANITY_THRESHOLD) \|\|
188	address1.slice(-VANITY_THRESHOLD) === address2.slice(-VANITY_THRESHOLD)
189	);
190	}
191
192	private getTransactionTimestamp(transaction: TransactionDomain): Date {
193	let timestamp: Date \| null;
194	if (isMultisigTransaction(transaction)) {	90✔
195	const executionDate = transaction.executionDate;	8✔
196	timestamp = executionDate ?? transaction.submissionDate;	8!
197	} else if (isEthereumTransaction(transaction)) {	82✔
198	timestamp = transaction.executionDate;	48✔
199	} else if (isModuleTransaction(transaction)) {	34✔
200	timestamp = transaction.executionDate;	28✔
201	} else if (isCreationTransaction(transaction)) {	6!
202	timestamp = transaction.created;	6✔
203	} else {
204	throw Error('Unknown transaction type');	×
205	}
206	if (timestamp == null) {	90!
207	throw Error('ExecutionDate cannot be null');	×
208	}
209	return timestamp;	90✔
210	}
211
212	private getPreviousItem(
213	offset: number,
214	transactions: TransactionDomain[],
215	): TransactionDomain \| null {
216	// More than 1 element is required to get the previous page date
217	if (offset <= 0 \|\| transactions.length <= 1) return null;	28✔
218	return transactions[0];	×
219	}
220
221	private getDayFromTransactionDate(
222	transaction: TransactionDomain,
223	timezoneOffset: number,
224	): Date {
225	const timestamp = this.getTransactionTimestamp(transaction);	46✔
226	return this.getDayStartForDate(timestamp, timezoneOffset);	46✔
227	}
228
229	private groupByDay(
230	transactions: TransactionDomain[],
231	timezoneOffset: number,
232	): TransactionDomainGroup[] {
233	return Object.entries(	28✔
234	groupBy(transactions, (transaction) => {
235	return this.getDayFromTransactionDate(	46✔
236	transaction,
237	timezoneOffset,
238	).getTime();
239	}),
240	).map(([, transactions]): TransactionDomainGroup => {
241	// The groups respect the timezone offset – this was done for grouping only.
242	// The actual value of the group should be in the UTC timezone instead
243	// A group should always have at least one transaction.
244	return {	44✔
245	timestamp: this.getTransactionTimestamp(transactions[0]).getTime(),
246	transactions: transactions,
247	};
248	});
249	}
250
251	/**
252	* Returns a day {@link Date } at 00:00:00 from the input timestamp.
253	*
254	* @param timestamp - date to convert
255	* @param timezoneOffset - Offset of time zone in milliseconds
256	*/
257	private getDayStartForDate(timestamp: Date, timezoneOffset: number): Date {
258	const date = structuredClone(timestamp);	46✔
259	date.setTime(date.getTime() + timezoneOffset);	46✔
260	return new Date(	46✔
261	Date.UTC(date.getUTCFullYear(), date.getUTCMonth(), date.getUTCDate()),
262	);
263	}
264
265	private async mapTransfers(
266	transfers: Transfer[],
267	chainId: string,
268	safe: Safe,
269	onlyTrusted: boolean,
270	): Promise<TransactionItem[]> {
271	const limitedTransfers = transfers.slice(0, this.maxNestedTransfers);	24✔
272
273	const nestedTransactions = await this.transferMapper.mapTransfers({	24✔
274	chainId,
275	transfers: limitedTransfers,
276	safe,
277	onlyTrusted,
278	});
279
280	return nestedTransactions.map(	24✔
281	(nestedTransaction) => new TransactionItem(nestedTransaction),	30✔
282	);
283	}
284
285	private mapGroupTransactions(
286	transactionGroup: TransactionDomainGroup,
287	chainId: string,
288	safe: Safe,
289	onlyTrusted: boolean,
290	): Promise<(TransactionItem \| TransactionItem[] \| undefined)[]> {
291	return Promise.all(	44✔
292	transactionGroup.transactions.map(async (transaction) => {
293	if (isMultisigTransaction(transaction)) {	46✔
294	return new TransactionItem(	4✔
295	await this.multisigTransactionMapper.mapTransaction(
296	chainId,
297	transaction,
298	safe,
299	),
300	);
301	} else if (isModuleTransaction(transaction)) {	42✔
302	return new TransactionItem(	14✔
303	await this.moduleTransactionMapper.mapTransaction(
304	chainId,
305	transaction,
306	),
307	);
308	} else if (isEthereumTransaction(transaction)) {	28✔
309	const transfers = transaction.transfers;	24✔
310	if (transfers != null) {	24✔
311	return await this.mapTransfers(	24✔
312	transfers,
313	chainId,
314	safe,
315	onlyTrusted,
316	);
317	}
318	} else if (isCreationTransaction(transaction)) {	4!
319	return new TransactionItem(	4✔
320	await this.creationTransactionMapper.mapTransaction(
321	chainId,
322	transaction,
323	safe,
324	),
325	);
326	} else {
327	// This should never happen as AJV would not allow an unknown transaction to get to this stage
328	throw Error('Unrecognized transaction type');	×
329	}
330	}),
331	);
332	}
333	}

safe-global / safe-client-gateway / 8752432596

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous