Fix increaseLiquidity calls do not check operator, token0, or token1 …

…with merkle leaf
Se7en-Seas · Apr 3, 2024 · d400d07 · d400d07
1 parent 939c77e
commit d400d07
Show file tree

Hide file tree

Showing 3 changed files with 49 additions and 4 deletions.
diff --git a/src/base/DecodersAndSanitizers/Protocols/UniswapV3DecoderAndSanitizer.sol b/src/base/DecodersAndSanitizers/Protocols/UniswapV3DecoderAndSanitizer.sol
@@ -65,8 +65,10 @@ abstract contract UniswapV3DecoderAndSanitizer is BaseDecoderAndSanitizer {
         if (uniswapV3NonFungiblePositionManager.ownerOf(params.tokenId) != boringVault) {
             revert UniswapV3DecoderAndSanitizer__BadTokenId();
         }
-        // No addresses in data
-        return addressesFound;
+        // Extract addresses from uniswapV3NonFungiblePositionManager.positions(params.tokenId).
+        (, address operator, address token0, address token1,,,,,,,,) =
+            uniswapV3NonFungiblePositionManager.positions(params.tokenId);
+        addressesFound = abi.encodePacked(operator, token0, token1);
     }
 
     function decreaseLiquidity(DecoderCustomTypes.DecreaseLiquidityParams calldata params)

diff --git a/src/interfaces/RawDataDecoderAndSanitizerInterfaces.sol b/src/interfaces/RawDataDecoderAndSanitizerInterfaces.sol
@@ -3,5 +3,42 @@ pragma solidity 0.8.21;
 
 // Swell
 interface INonFungiblePositionManager {
+    struct Position {
+        // the nonce for permits
+        uint96 nonce;
+        // the address that is approved for spending this token
+        address operator;
+        // the ID of the pool with which this token is connected
+        uint80 poolId;
+        // the tick range of the position
+        int24 tickLower;
+        int24 tickUpper;
+        // the liquidity of the position
+        uint128 liquidity;
+        // the fee growth of the aggregate position as of the last action on the individual position
+        uint256 feeGrowthInside0LastX128;
+        uint256 feeGrowthInside1LastX128;
+        // how many uncollected tokens are owed to the position, as of the last computation
+        uint128 tokensOwed0;
+        uint128 tokensOwed1;
+    }
+
     function ownerOf(uint256 tokenId) external view returns (address);
+    function positions(uint256 tokenId)
+        external
+        view
+        returns (
+            uint96 nonce,
+            address operator,
+            address token0,
+            address token1,
+            uint24 fee,
+            int24 tickLower,
+            int24 tickUpper,
+            uint128 liquidity,
+            uint256 feeGrowthInside0LastX128,
+            uint256 feeGrowthInside1LastX128,
+            uint128 tokensOwed0,
+            uint128 tokensOwed1
+        );
 }
diff --git a/test/ManagerWithMerkleVerification.t.sol b/test/ManagerWithMerkleVerification.t.sol
@@ -444,8 +444,11 @@ contract ManagerWithMerkleVerificationTest is Test, MainnetAddresses {
             uniswapV3NonFungiblePositionManager,
             false,
             "increaseLiquidity((uint256,uint256,uint256,uint256,uint256,uint256))",
-            new address[](0)
+            new address[](3)
         );
+        leafs[5].argumentAddresses[0] = address(0);
+        leafs[5].argumentAddresses[1] = address(RETH);
+        leafs[5].argumentAddresses[2] = address(WEETH);
         leafs[6] = ManageLeaf(
             uniswapV3NonFungiblePositionManager,
             false,
@@ -2275,8 +2278,11 @@ contract ManagerWithMerkleVerificationTest is Test, MainnetAddresses {
             uniswapV3NonFungiblePositionManager,
             false,
             "increaseLiquidity((uint256,uint256,uint256,uint256,uint256,uint256))",
-            new address[](0)
+            new address[](3)
         );
+        leafs[5].argumentAddresses[0] = address(0);
+        leafs[5].argumentAddresses[1] = address(RETH);
+        leafs[5].argumentAddresses[2] = address(WEETH);
         leafs[6] = ManageLeaf(
             uniswapV3NonFungiblePositionManager,
             false,