fix(contracts): OZ-M04 Use of Non-Production-Ready Trusted Forwarder (#…

…843) Co-authored-by: Haichen Shen <shenhaichen@gmail.com> Co-authored-by: icemelon <icemelon@users.noreply.github.com>
scroll-tech · Sep 2, 2023 · d668180 · d668180
1 parent d3c2e34
commit d668180
Show file tree

Hide file tree

Showing 4 changed files with 466 additions and 11 deletions.
diff --git a/common/version/version.go b/common/version/version.go
@@ -5,7 +5,7 @@ import (
 	"runtime/debug"
 )
 
-var tag = "v4.2.17"
+var tag = "v4.2.18"
 
 var commit = func() string {
 	if info, ok := debug.ReadBuildInfo(); ok {

diff --git a/contracts/integration-test/GasSwap.spec.ts b/contracts/integration-test/GasSwap.spec.ts
@@ -1,7 +1,7 @@
 /* eslint-disable node/no-unpublished-import */
 /* eslint-disable node/no-missing-import */
 import { ethers } from "hardhat";
-import { GasSwap, MinimalForwarder, MockERC20, MockGasSwapTarget } from "../typechain";
+import { GasSwap, ERC2771Forwarder, MockERC20, MockGasSwapTarget } from "../typechain";
 import { SignerWithAddress } from "@nomiclabs/hardhat-ethers/signers";
 import { expect } from "chai";
 import { BigNumber, constants } from "ethers";
@@ -11,16 +11,16 @@ describe("GasSwap.spec", async () => {
   let deployer: SignerWithAddress;
   let signer: SignerWithAddress;
 
-  let forwarder: MinimalForwarder;
+  let forwarder: ERC2771Forwarder;
   let swap: GasSwap;
   let target: MockGasSwapTarget;
   let token: MockERC20;
 
   beforeEach(async () => {
     [deployer, signer] = await ethers.getSigners();
 
-    const MinimalForwarder = await ethers.getContractFactory("MinimalForwarder", deployer);
-    forwarder = await MinimalForwarder.deploy();
+    const ERC2771Forwarder = await ethers.getContractFactory("ERC2771Forwarder", deployer);
+    forwarder = await ERC2771Forwarder.deploy("ERC2771Forwarder");
     await forwarder.deployed();
 
     const GasSwap = await ethers.getContractFactory("GasSwap", deployer);
@@ -253,12 +253,13 @@ describe("GasSwap.spec", async () => {
           await swap.updateFeeRatio(ethers.utils.parseEther(feeRatio).div(100));
           const fee = amountOut.mul(feeRatio).div(100);
 
-          const req = {
+          const reqWithoutSignature = {
             from: signer.address,
             to: swap.address,
             value: constants.Zero,
             gas: 1000000,
-            nonce: 0,
+            nonce: await forwarder.nonces(signer.address),
+            deadline: 2000000000,
             data: swap.interface.encodeFunctionData("swap", [
               {
                 token: token.address,
@@ -278,8 +279,8 @@ describe("GasSwap.spec", async () => {
 
           const signature = await signer._signTypedData(
             {
-              name: "MinimalForwarder",
-              version: "0.0.1",
+              name: "ERC2771Forwarder",
+              version: "1",
               chainId: (await ethers.provider.getNetwork()).chainId,
               verifyingContract: forwarder.address,
             },
@@ -305,17 +306,29 @@ describe("GasSwap.spec", async () => {
                   name: "nonce",
                   type: "uint256",
                 },
+                {
+                  name: "deadline",
+                  type: "uint48",
+                },
                 {
                   name: "data",
                   type: "bytes",
                 },
               ],
             },
-            req
+            reqWithoutSignature
           );
 
           const balanceBefore = await signer.getBalance();
-          await forwarder.execute(req, signature);
+          await forwarder.execute({
+            from: reqWithoutSignature.from,
+            to: reqWithoutSignature.to,
+            value: reqWithoutSignature.value,
+            gas: reqWithoutSignature.gas,
+            deadline: reqWithoutSignature.deadline,
+            data: reqWithoutSignature.data,
+            signature,
+          });
           const balanceAfter = await signer.getBalance();
           expect(balanceAfter.sub(balanceBefore)).to.eq(amountOut.sub(fee));
           expect(await token.balanceOf(signer.address)).to.eq(amountIn.mul(refundRatio).div(100));