-
Notifications
You must be signed in to change notification settings - Fork 178
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat(world): prevent the World
from calling itself
#1563
Conversation
🦋 Changeset detectedLatest commit: 0ad8bff The changes in this PR will be included in the next version bump. This PR includes changesets to release 29 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
chatted IRL about the world calling itself and @alvrs is gonna play with adding some reverts to keep this from happening (if it's behavior we expect not to happen and ideally want to prevent) |
The gas increase is insignificant, so I think it's worth it as an additional line of defence and to make this invariant more explicit |
address(this)
World
from calling itself
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Should fallback have this check too?
good catch, it should! |
packages/world/src/World.sol
Outdated
AccessControl.requireOwner(ROOT_NAMESPACE_ID, msg.sender); | ||
_installRootModule(module, args); | ||
} | ||
|
||
function _installRootModule(IModule module, bytes memory args) internal { | ||
function _installRootModule(IModule module, bytes memory args) internal requireNoCallback { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
given that this is internal, do we need this check?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
nope, already checked by installRootModule
and installModule
, good catch
packages/world/src/modules/keyswithvalue/KeysWithValueModule.sol
Outdated
Show resolved
Hide resolved
Bool.getFieldLayout(), | ||
defaultKeySchema, | ||
Bool.getValueSchema(), | ||
new string[](1), | ||
new string[](1) | ||
TwoFields.getFieldLayout(), | ||
TwoFields.getKeySchema(), | ||
TwoFields.getValueSchema(), | ||
new string[](0), | ||
new string[](2) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
the Bool
table used setField
internally because it only has a single field, but we're trying to test setRecord
here
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
A thing we might consider doing in a follow up is a TS test that parses the World contract, looks at all the public/external non-view/pure functions, and make sure they also use the modifier. (I don't think we can do this in foundry)
fixes #1551
The world should never call itself. All operations to internal tables should happen as internal library calls, and all calls to root system should happen as a delegatecall to the system.
If it was possible to make the
World
call itself, it would be possible to access internal tables that only theWorld
should have access to. It should already not be possible to make theWorld
call itself, but since this is a very important invariant, we decided to make it explicit and revert ifmsg.sender
isaddress(this)
in allWorld
methods.