Merge 18f6f3d into e870f51

contracts/base/ModuleManager.sol

@@ -3,6 +3,21 @@ pragma solidity >=0.7.0 <0.9.0;
 import "../common/Enum.sol";
 import "../common/SelfAuthorized.sol";
 import "./Executor.sol";
+import "../interfaces/IERC165.sol";
+
+interface ModuleGuard is IERC165 {
+    function checkTransaction(address to, uint256 value, bytes memory data, Enum.Operation operation, address msgSender) external;
+
+    function checkAfterExecution(bytes32 txHash, bool success) external;
+}
+
+abstract contract BaseModuleGuard is ModuleGuard {
+    function supportsInterface(bytes4 interfaceId) external view virtual override returns (bool) {
+        return
+            interfaceId == type(ModuleGuard).interfaceId || // TODO
+            interfaceId == type(IERC165).interfaceId; // 0x01ffc9a7
+    }
+}
 
 /**
  * @title Module Manager - A contract managing Safe modules
@@ -18,9 +33,13 @@ abstract contract ModuleManager is SelfAuthorized, Executor {
     event DisabledModule(address indexed module);
     event ExecutionFromModuleSuccess(address indexed module);
     event ExecutionFromModuleFailure(address indexed module);
+    event ChangedModuleGuard(address indexed guard);
 
     address internal constant SENTINEL_MODULES = address(0x1);
 
+    // keccak256("module_manager.module_guard.address")
+    bytes32 internal constant MODULE_GUARD_STORAGE_SLOT = 0xb104e0b93118902c651344349b610029d694cfdec91c589c91ebafbcd0289947;
+
     mapping(address => address) internal modules;
 
     /**
@@ -86,10 +105,22 @@ abstract contract ModuleManager is SelfAuthorized, Executor {
     ) public virtual returns (bool success) {
         // Only whitelisted modules are allowed.
         require(msg.sender != SENTINEL_MODULES && modules[msg.sender] != address(0), "GS104");
+
+        address moduleGuard = getModuleGuard();
+
+        if (moduleGuard != address(0)) {
+            ModuleGuard(moduleGuard).checkTransaction(to, value, data, operation, msg.sender);
+        }
+
         // Execute transaction without further confirmations.
         success = execute(to, value, data, operation, type(uint256).max);
         if (success) emit ExecutionFromModuleSuccess(msg.sender);
         else emit ExecutionFromModuleFailure(msg.sender);
+
+        if (moduleGuard != address(0)) {
+            bytes32 dataHash = keccak256(data);
+            ModuleGuard(moduleGuard).checkAfterExecution(dataHash, success);
+        }
     }
 
     /**
@@ -188,4 +219,37 @@ abstract contract ModuleManager is SelfAuthorized, Executor {
         }
         return size > 0;
     }
+
+    /**
+     * @dev Set a module guard that checks transactions initiated by the module before execution
+     *      This can only be done via a Safe transaction.
+     *      ⚠️ IMPORTANT: Since a module guard has full power to block Safe transaction execution initiatied via a module,
+     *        a broken module guard can cause a denial of service for the Safe modules. Make sure to carefully
+     *        audit the module guard code and design recovery mechanisms.
+     * @notice Set Module Guard `moduleGuard` for the Safe. Make sure you trust the module guard.
+     * @param moduleGuard The address of the module guard to be used or the 0 address to disable the module guard.
+     */
+    function setModuleGuard(address moduleGuard) external authorized {
+        if (moduleGuard != address(0)) {
+            require(ModuleGuard(moduleGuard).supportsInterface(type(ModuleGuard).interfaceId), "GS300");
+        }
+        bytes32 slot = MODULE_GUARD_STORAGE_SLOT;
+        // solhint-disable-next-line no-inline-assembly
+        assembly {
+            sstore(slot, moduleGuard)
+        }
+        emit ChangedModuleGuard(moduleGuard);
+    }
+
+    /**
+     * @dev Internal method to retrieve the current module guard
+     * @return moduleGuard The address of the guard
+     */
+    function getModuleGuard() internal view returns (address moduleGuard) {
+        bytes32 slot = MODULE_GUARD_STORAGE_SLOT;
+        // solhint-disable-next-line no-inline-assembly
+        assembly {
+            moduleGuard := sload(slot)
+        }
+    }
 }

hardhat.config.ts

@@ -6,6 +6,7 @@ import "hardhat-deploy";
 import dotenv from "dotenv";
 import yargs from "yargs";
 import { getSingletonFactoryInfo } from "@gnosis.pm/safe-singleton-factory";
+import "hardhat-contract-sizer";
 
 const argv = yargs
     .option("network", {

package.json

@@ -68,6 +68,7 @@
         "ethereum-waffle": "^3.3.0",
         "ethers": "5.4.0",
         "hardhat": "^2.2.1",
+        "hardhat-contract-sizer": "^2.8.0",
         "hardhat-deploy": "0.11.26",
         "husky": "^5.1.3",
         "prettier": "^2.8.4",

yarn.lock

@@ -23,6 +23,11 @@
     chalk "^2.0.0"
     js-tokens "^4.0.0"
 
+"@colors/colors@1.5.0":
+  version "1.5.0"
+  resolved "https://registry.yarnpkg.com/@colors/colors/-/colors-1.5.0.tgz#bb504579c1cae923e6576a4f5da43d25f97bdbd9"
+  integrity sha512-ooWCrlZP11i8GImSjTHYHLkvFDP48nS4+204nGb1RiX/WXYHmJA2III9/e2DWVabCESdW7hBAEzHRqUn9OUVvQ==
+
 "@ensdomains/ens@^0.4.4":
   version "0.4.5"
   resolved "https://registry.yarnpkg.com/@ensdomains/ens/-/ens-0.4.5.tgz#e0aebc005afdc066447c6e22feb4eda89a5edbfc"
@@ -3153,6 +3158,15 @@ cli-cursor@^2.1.0:
   dependencies:
     restore-cursor "^2.0.0"
 
+cli-table3@^0.6.0:
+  version "0.6.3"
+  resolved "https://registry.yarnpkg.com/cli-table3/-/cli-table3-0.6.3.tgz#61ab765aac156b52f222954ffc607a6f01dbeeb2"
+  integrity sha512-w5Jac5SykAeZJKntOxJCrm63Eg5/4dhMWIcuTbo9rpE+brgaSZo0RuNJZeOyMgsUdhDeojvgyQLmjI+K50ZGyg==
+  dependencies:
+    string-width "^4.2.0"
+  optionalDependencies:
+    "@colors/colors" "1.5.0"
+
 cli-width@^2.0.0:
   version "2.2.1"
   resolved "https://registry.yarnpkg.com/cli-width/-/cli-width-2.2.1.tgz#b0433d0b4e9c847ef18868a4ef16fd5fc8271c48"
@@ -5454,6 +5468,15 @@ har-validator@~5.1.3:
     ajv "^6.12.3"
     har-schema "^2.0.0"
 
+hardhat-contract-sizer@^2.8.0:
+  version "2.8.0"
+  resolved "https://registry.yarnpkg.com/hardhat-contract-sizer/-/hardhat-contract-sizer-2.8.0.tgz#730a9bf35ed200ba57b6865bd3f459a91c90f205"
+  integrity sha512-jXt2Si3uIDx5z99J+gvKa0yvIw156pE4dpH9X/PvTQv652BUd+qGj7WT93PXnHXGh5qhQLkjDYeZMYNOThfjFg==
+  dependencies:
+    chalk "^4.0.0"
+    cli-table3 "^0.6.0"
+    strip-ansi "^6.0.0"
+
 hardhat-deploy@0.11.26:
   version "0.11.26"
   resolved "https://registry.yarnpkg.com/hardhat-deploy/-/hardhat-deploy-0.11.26.tgz#df2698cbafb575a014be6226e559ef467168cbdd"