Reimplement OutboundQueue pallet

.github/workflows/ethereum.yml

@@ -39,7 +39,7 @@ jobs:
         run: forge test
       - name: Coverage
         working-directory: core/packages/contracts
-        run: forge coverage --report=lcov
+        run: forge coverage --report=lcov --via-ir
       - name: Lint
         working-directory: core/packages/contracts
         run: pnpm lint
@@ -48,4 +48,3 @@ jobs:
         with:
           working-directory: core/packages/contracts
           files: lcov.info
-

core/packages/contracts/scripts/helpers.ts

@@ -67,7 +67,7 @@ class ValidatorSet {
         let leaves = wallets.map((w) => keccakFromHexString(w.address))
         let tree = new MerkleTree(leaves, keccak, {
             sortLeaves: false,
-            sortPairs: true,
+            sortPairs: false,
         })
 
         this.wallets = wallets

core/packages/contracts/src/Auth.sol

@@ -0,0 +1,13 @@
+// SPDX-License-Identifier: Apache-2.0
+pragma solidity ^0.8.19;
+
+import {AccessControl} from "openzeppelin/access/AccessControl.sol";
+
+contract Auth is AccessControl {
+    bytes32 public constant ADMIN_ROLE = keccak256("ADMIN_ROLE");
+
+    constructor() {
+        _grantRole(ADMIN_ROLE, msg.sender);
+        _setRoleAdmin(ADMIN_ROLE, ADMIN_ROLE);
+    }
+}

core/packages/contracts/src/BeefyClient.sol

@@ -3,7 +3,7 @@ pragma solidity ^0.8.19;
 
 import {ECDSA} from "openzeppelin/utils/cryptography/ECDSA.sol";
 import {Ownable} from "openzeppelin/access/Ownable.sol";
-import {MerkleProof} from "openzeppelin/utils/cryptography/MerkleProof.sol";
+import {MerkleProof} from "./utils/MerkleProof.sol";
 import {Bitfield} from "./utils/Bitfield.sol";
 import {MMRProof} from "./utils/MMRProof.sol";
 import {ScaleCodec} from "./ScaleCodec.sol";
@@ -441,10 +441,7 @@ contract BeefyClient is Ownable {
             }
 
             // Check that validator is actually in a validator set
-            //
-            // NOTE: This currently insecure due to a regression documented in SNO-427.
-            // Basically `proof.index` (the merkle leaf index) is not being validated.
-            if (!isValidatorInSet(vset, proof.account, proof.proof)) {
+            if (!isValidatorInSet(vset, proof.account, proof.index, proof.proof)) {
                 revert InvalidValidatorProof();
             }
 
@@ -498,13 +495,13 @@ contract BeefyClient is Ownable {
      * @param proof Merkle proof required for validation of the address
      * @return true if the validator is in the set
      */
-    function isValidatorInSet(ValidatorSet memory vset, address addr, bytes32[] calldata proof)
+    function isValidatorInSet(ValidatorSet memory vset, address addr, uint256 index, bytes32[] calldata proof)
         internal
         pure
         returns (bool)
     {
         bytes32 hashedLeaf = keccak256(abi.encodePacked(addr));
-        return MerkleProof.verify(proof, vset.root, hashedLeaf);
+        return MerkleProof.verify(vset.root, hashedLeaf, index, vset.length, proof);
     }
 
     /**

core/packages/contracts/src/DeployScript.sol

@@ -11,55 +11,73 @@ import {OutboundQueue} from "../src/OutboundQueue.sol";
 import {NativeTokens} from "../src/NativeTokens.sol";
 import {TokenVault} from "../src/TokenVault.sol";
 import {Vault} from "../src/Vault.sol";
-import {IVault} from "../src/IVault.sol";
 import {UpgradeProxy} from "../src/UpgradeProxy.sol";
 import {SovereignTreasury} from "../src/SovereignTreasury.sol";
+import {Registry} from "../src/Registry.sol";
 import {ParaID} from "../src/Types.sol";
 
 contract DeployScript is Script {
+    Registry public registry;
+    Vault public vault;
+    BeefyClient public beefyClient;
+    ParachainClient public parachainClient;
+    InboundQueue public inboundQueue;
+    OutboundQueue public outboundQueue;
+    TokenVault public tokenVault;
+    NativeTokens public nativeTokens;
+    UpgradeProxy public upgradeProxy;
+
     function setUp() public {}
 
     function run() public {
         uint256 privateKey = vm.envUint("PRIVATE_KEY");
         address deployer = vm.rememberKey(privateKey);
         vm.startBroadcast(deployer);
 
+        // Registry
+        registry = new Registry();
+        registry.grantRole(registry.REGISTER_ROLE(), deployer);
+
         // SovereignTreasury
-        Vault vault = new Vault();
-        SovereignTreasury treasury = new SovereignTreasury(vault);
+        vault = new Vault();
+        SovereignTreasury treasury = new SovereignTreasury(registry, vault);
 
         // BeefyClient
         uint256 randaoCommitDelay = vm.envUint("RANDAO_COMMIT_DELAY");
         uint256 randaoCommitExpiration = vm.envUint("RANDAO_COMMIT_EXP");
-        BeefyClient beefyClient = new BeefyClient(randaoCommitDelay, randaoCommitExpiration);
+        beefyClient = new BeefyClient(randaoCommitDelay, randaoCommitExpiration);
 
         // ParachainClient
         uint32 paraId = uint32(vm.envUint("BRIDGE_HUB_PARAID"));
-        ParachainClient parachainClient = new ParachainClient(beefyClient, paraId);
+        parachainClient = new ParachainClient(beefyClient, paraId);
 
         // InboundQueue
         uint256 relayerReward = vm.envUint("RELAYER_REWARD");
-        InboundQueue inboundQueue = new InboundQueue(parachainClient, vault, relayerReward);
+        inboundQueue = new InboundQueue(registry, parachainClient, vault, relayerReward);
+        registry.registerContract(keccak256("InboundQueue"), address(inboundQueue));
 
         // OutboundQueue
         uint256 relayerFee = vm.envUint("RELAYER_FEE");
-        OutboundQueue outboundQueue = new OutboundQueue(vault, relayerFee);
+        outboundQueue = new OutboundQueue(registry, vault, relayerFee);
+        registry.registerContract(keccak256("OutboundQueue"), address(outboundQueue));
 
         // NativeTokens
-        TokenVault tokenVault = new TokenVault();
-        NativeTokens nativeTokens = new NativeTokens(
+        tokenVault = new TokenVault();
+        nativeTokens = new NativeTokens(
+            registry,
             tokenVault,
-            outboundQueue,
             ParaID.wrap(uint32(vm.envUint("ASSET_HUB_PARAID"))),
-            vm.envUint("CREATE_TOKEN_FEE")
+            vm.envUint("CREATE_TOKEN_FEE"),
+            bytes2(vm.envBytes("CREATE_CALL_INDEX")),
+            bytes2(vm.envBytes("SET_METADATA_CALL_INDEX"))
         );
-        inboundQueue.updateHandler(1, IRecipient(nativeTokens));
+        registry.registerContract(keccak256("NativeTokens"), address(nativeTokens));
 
         // Deploy WETH for testing
         new WETH9();
 
         // Upgrades
-        UpgradeProxy upgradeProxy = new UpgradeProxy(ParaID.wrap(paraId));
+        upgradeProxy = new UpgradeProxy(registry, ParaID.wrap(paraId));
 
         // Allow inbound queue to send messages to handlers
         nativeTokens.grantRole(nativeTokens.SENDER_ROLE(), address(inboundQueue));
@@ -82,24 +100,27 @@ contract DeployScript is Script {
         // Move ownership of everything to Upgrades app
 
         treasury.grantRole(treasury.ADMIN_ROLE(), address(upgradeProxy));
-        treasury.revokeRole(treasury.ADMIN_ROLE(), address(this));
+        treasury.revokeRole(treasury.ADMIN_ROLE(), deployer);
 
         nativeTokens.grantRole(nativeTokens.ADMIN_ROLE(), address(upgradeProxy));
-        nativeTokens.revokeRole(nativeTokens.ADMIN_ROLE(), address(this));
+        nativeTokens.revokeRole(nativeTokens.ADMIN_ROLE(), deployer);
 
         vault.grantRole(vault.ADMIN_ROLE(), address(upgradeProxy));
-        vault.revokeRole(vault.ADMIN_ROLE(), address(this));
+        vault.revokeRole(vault.ADMIN_ROLE(), deployer);
 
         tokenVault.grantRole(tokenVault.ADMIN_ROLE(), address(upgradeProxy));
-        tokenVault.revokeRole(tokenVault.ADMIN_ROLE(), address(this));
+        tokenVault.revokeRole(tokenVault.ADMIN_ROLE(), deployer);
 
         inboundQueue.grantRole(inboundQueue.ADMIN_ROLE(), address(upgradeProxy));
-        inboundQueue.revokeRole(inboundQueue.ADMIN_ROLE(), address(this));
+        inboundQueue.revokeRole(inboundQueue.ADMIN_ROLE(), deployer);
 
         outboundQueue.grantRole(outboundQueue.ADMIN_ROLE(), address(upgradeProxy));
-        outboundQueue.revokeRole(outboundQueue.ADMIN_ROLE(), address(this));
+        outboundQueue.revokeRole(outboundQueue.ADMIN_ROLE(), deployer);
+
+        registry.grantRole(outboundQueue.ADMIN_ROLE(), address(upgradeProxy));
+        registry.revokeRole(outboundQueue.ADMIN_ROLE(), deployer);
 
-        upgradeProxy.revokeRole(upgradeProxy.ADMIN_ROLE(), address(this));
+        upgradeProxy.revokeRole(upgradeProxy.ADMIN_ROLE(), deployer);
 
         vm.stopBroadcast();
     }

core/packages/contracts/src/Gateway.sol

@@ -0,0 +1,35 @@
+// SPDX-License-Identifier: Apache-2.0
+pragma solidity ^0.8.19;
+
+import {AccessControl} from "openzeppelin/access/AccessControl.sol";
+import {Registry} from "./Registry.sol";
+import {IOutboundQueue} from "./IOutboundQueue.sol";
+import {IRecipient} from "./IRecipient.sol";
+import {ParaID} from "./Types.sol";
+import {Auth} from "./Auth.sol";
+import {RegistryLookup} from "./RegistryLookup.sol";
+
+abstract contract Gateway is Auth, RegistryLookup, IRecipient {
+    bytes32 public constant SENDER_ROLE = keccak256("SENDER_ROLE");
+    bytes32 public constant OUTBOUND_QUEUE = keccak256("OutboundQueue");
+
+    /* Errors */
+
+    error Unauthorized();
+
+    constructor(Registry registry) RegistryLookup(registry) {
+        _setRoleAdmin(SENDER_ROLE, ADMIN_ROLE);
+    }
+
+    function handle(ParaID origin, bytes calldata message) external virtual;
+
+    function outboundQueue() internal view returns (IOutboundQueue) {
+        return IOutboundQueue(resolve(OUTBOUND_QUEUE));
+    }
+
+    function ensureOrigin(ParaID a, ParaID b) internal pure {
+        if (a != b) {
+            revert Unauthorized();
+        }
+    }
+}

core/packages/contracts/src/InboundQueue.sol

@@ -4,29 +4,27 @@ pragma solidity ^0.8.19;
 import {MerkleProof} from "openzeppelin/utils/cryptography/MerkleProof.sol";
 import {AccessControl} from "openzeppelin/access/AccessControl.sol";
 import {IParachainClient} from "./ParachainClient.sol";
+import {Registry} from "./Registry.sol";
+import {RegistryLookup} from "./RegistryLookup.sol";
+import {Auth} from "./Auth.sol";
+import {Vault} from "./Vault.sol";
+
 import {IRecipient} from "./IRecipient.sol";
-import {IVault} from "./IVault.sol";
 import {ParaID} from "./Types.sol";
 
-contract InboundQueue is AccessControl {
+contract InboundQueue is Auth, RegistryLookup {
     // Nonce for each origin
     mapping(ParaID origin => uint64) public nonce;
 
-    // Registered message handlers
-    mapping(uint16 handlerID => IRecipient) public handlers;
-
     // Light client message verifier
     IParachainClient public parachainClient;
 
     // Relayers are rewarded from this vault
-    IVault public vault;
+    Vault public immutable vault;
 
     // The relayer reward for submitting a message
     uint256 public reward;
 
-    // The governance contract which is a proxy for Polkadot governance, administers via this role
-    bytes32 public constant ADMIN_ROLE = keccak256("ADMIN_ROLE");
-
     // Relayers must provide enough gas to cover message dispatch plus a buffer
     uint256 public gasToForward = 500000;
     uint256 public constant GAS_BUFFER = 24000;
@@ -35,7 +33,7 @@ contract InboundQueue is AccessControl {
     struct Message {
         ParaID origin;
         uint64 nonce;
-        uint16 handler;
+        bytes32 recipient;
         bytes payload;
     }
 
@@ -51,15 +49,14 @@ contract InboundQueue is AccessControl {
     event RewardUpdated(uint256 reward);
     event GasToForwardUpdated(uint256 gasToForward);
 
-
     error InvalidProof();
     error InvalidNonce();
-    error InvalidHandler();
+    error InvalidRecipient();
     error NotEnoughGas();
 
-    constructor(IParachainClient _parachainClient, IVault _vault, uint256 _reward) {
-        _grantRole(ADMIN_ROLE, msg.sender);
-        _setRoleAdmin(ADMIN_ROLE, ADMIN_ROLE);
+    constructor(Registry registry, IParachainClient _parachainClient, Vault _vault, uint256 _reward)
+        RegistryLookup(registry)
+    {
         parachainClient = _parachainClient;
         vault = _vault;
         reward = _reward;
@@ -89,11 +86,6 @@ contract InboundQueue is AccessControl {
         // should top up the funds and have a relayer resend the message.
         vault.withdraw(message.origin, payable(msg.sender), reward);
 
-        IRecipient handler = handlers[message.handler];
-        if (address(handler) == address(0)) {
-            revert InvalidHandler();
-        }
-
         // Ensure relayers pass enough gas for message to execute.
         // Otherwise malicious relayers can break the bridge by allowing handlers to run out gas.
         // Resubmission of the message by honest relayers will fail as the tracked nonce
@@ -102,30 +94,16 @@ contract InboundQueue is AccessControl {
             revert NotEnoughGas();
         }
 
+        address recipient = resolve(message.recipient);
         DispatchResult result = DispatchResult.Success;
-        try handler.handle{gas: gasToForward}(message.origin, message.payload) {}
+        try IRecipient(recipient).handle{gas: gasToForward}(message.origin, message.payload) {}
         catch {
             result = DispatchResult.Failure;
         }
 
         emit MessageDispatched(message.origin, message.nonce, result);
     }
 
-    function updateHandler(uint16 id, IRecipient handler) external onlyRole(ADMIN_ROLE) {
-        handlers[id] = handler;
-        emit HandlerUpdated(id, handler);
-    }
-
-    function updateParachainClient(IParachainClient _parachainClient) external onlyRole(ADMIN_ROLE) {
-        parachainClient = _parachainClient;
-        emit ParachainClientUpdated(address(_parachainClient));
-    }
-
-    function updateVault(IVault _vault) external onlyRole(ADMIN_ROLE) {
-        vault = _vault;
-        emit VaultUpdated(address(_vault));
-    }
-
     function updateReward(uint256 _reward) external onlyRole(ADMIN_ROLE) {
         reward = _reward;
         emit RewardUpdated(_reward);