From ce440fef9f2573cef9b5f8a43b29e4152903b9e8 Mon Sep 17 00:00:00 2001
From: Hamdi Allam <hamdi.allam97@gmail.com>
Date: Tue, 24 Sep 2024 09:34:40 -0700
Subject: [PATCH] check deposit on validateMessage

---
 packages/contracts-bedrock/semver-lock.json   |  4 +-
 .../contracts-bedrock/src/L2/CrossL2Inbox.sol |  7 ++-
 .../test/L2/CrossL2Inbox.t.sol                | 48 +++++++++++++++++++
 3 files changed, 55 insertions(+), 4 deletions(-)

diff --git a/packages/contracts-bedrock/semver-lock.json b/packages/contracts-bedrock/semver-lock.json
index 3a60a92d73e31..1256ae6902154 100644
--- a/packages/contracts-bedrock/semver-lock.json
+++ b/packages/contracts-bedrock/semver-lock.json
@@ -68,8 +68,8 @@
     "sourceCodeHash": "0x2dc2284cf7c68e743da50e4113e96ffeab435de2390aeba2eab2f1e8ca411ce9"
   },
   "src/L2/CrossL2Inbox.sol": {
-    "initCodeHash": "0x79c5deb404605b42ef917b5e7308a9015dacfb71225d957a634e6d0a3a5bc621",
-    "sourceCodeHash": "0xd219408d99f627770dfcdb3243a183dec7429372787f0aec3bdbff5b3c294f2a"
+    "initCodeHash": "0x0ee27866b4bf864a0b68ab25ea9559d7f2722b0396d02f2e8e089c6a1a5a6a93",
+    "sourceCodeHash": "0xe6f453049035e0d77e4d7a92904b448bc17e04dd3d99e738b9af20e20986ce64"
   },
   "src/L2/ETHLiquidity.sol": {
     "initCodeHash": "0x713c18f95a6a746d0703f475f3ae10c106c9b9ecb64d881a2e61b8969b581371",
diff --git a/packages/contracts-bedrock/src/L2/CrossL2Inbox.sol b/packages/contracts-bedrock/src/L2/CrossL2Inbox.sol
index 6f86717c4e4d1..437e0c62a2e35 100644
--- a/packages/contracts-bedrock/src/L2/CrossL2Inbox.sol
+++ b/packages/contracts-bedrock/src/L2/CrossL2Inbox.sol
@@ -65,8 +65,8 @@ contract CrossL2Inbox is ICrossL2Inbox, ISemver, TransientReentrancyAware {
     address internal constant DEPOSITOR_ACCOUNT = 0xDeaDDEaDDeAdDeAdDEAdDEaddeAddEAdDEAd0001;
 
     /// @notice Semantic version.
-    /// @custom:semver 1.0.0-beta.6
-    string public constant version = "1.0.0-beta.6";
+    /// @custom:semver 1.0.0-beta.7
+    string public constant version = "1.0.0-beta.7";
 
     /// @notice Emitted when a cross chain message is being executed.
     /// @param msgHash Hash of message payload being executed.
@@ -164,6 +164,9 @@ contract CrossL2Inbox is ICrossL2Inbox, ISemver, TransientReentrancyAware {
     /// @param _id      Identifier of the message.
     /// @param _msgHash Hash of the message payload to call target with.
     function validateMessage(Identifier calldata _id, bytes32 _msgHash) external {
+        // We need to know if this is being called on a depositTx
+        if (IL1BlockIsthmus(Predeploys.L1_BLOCK_ATTRIBUTES).isDeposit()) revert NoExecutingDeposits();
+
         // Check the Identifier.
         _checkIdentifier(_id);
 
diff --git a/packages/contracts-bedrock/test/L2/CrossL2Inbox.t.sol b/packages/contracts-bedrock/test/L2/CrossL2Inbox.t.sol
index 99704860c00d4..0d3175d41ed1f 100644
--- a/packages/contracts-bedrock/test/L2/CrossL2Inbox.t.sol
+++ b/packages/contracts-bedrock/test/L2/CrossL2Inbox.t.sol
@@ -461,6 +461,13 @@ contract CrossL2InboxTest is Test {
             returnData: abi.encode(true)
         });
 
+        // Ensure is not a deposit transaction
+        vm.mockCall({
+            callee: Predeploys.L1_BLOCK_ATTRIBUTES,
+            data: abi.encodeWithSelector(IL1BlockIsthmus.isDeposit.selector),
+            returnData: abi.encode(false)
+        });
+
         // Look for the emit ExecutingMessage event
         vm.expectEmit(Predeploys.CROSS_L2_INBOX);
         emit CrossL2Inbox.ExecutingMessage(_messageHash, _id);
@@ -469,6 +476,26 @@ contract CrossL2InboxTest is Test {
         crossL2Inbox.validateMessage(_id, _messageHash);
     }
 
+    function testFuzz_validateMessage_isDeposit_reverts(
+        ICrossL2Inbox.Identifier calldata _id,
+        bytes32 _messageHash
+    )
+        external
+    {
+        // Ensure it is a deposit transaction
+        vm.mockCall({
+            callee: Predeploys.L1_BLOCK_ATTRIBUTES,
+            data: abi.encodeWithSelector(IL1BlockIsthmus.isDeposit.selector),
+            returnData: abi.encode(true)
+        });
+
+        // Expect a revert with the NoExecutingDeposits selector
+        vm.expectRevert(NoExecutingDeposits.selector);
+
+        // Call the executeMessage function
+        crossL2Inbox.validateMessage(_id, _messageHash);
+    }
+
     /// @dev Tests that the `validateMessage` function reverts when called with an identifier with a timestamp later
     /// than current block.timestamp.
     function testFuzz_validateMessage_invalidTimestamp_reverts(
@@ -478,6 +505,13 @@ contract CrossL2InboxTest is Test {
         external
         setInteropStart
     {
+        // Ensure is not a deposit transaction
+        vm.mockCall({
+            callee: Predeploys.L1_BLOCK_ATTRIBUTES,
+            data: abi.encodeWithSelector(IL1BlockIsthmus.isDeposit.selector),
+            returnData: abi.encode(false)
+        });
+
         // Ensure that the id's timestamp is invalid (greater than the current block timestamp)
         vm.assume(_id.timestamp > block.timestamp);
 
@@ -500,6 +534,13 @@ contract CrossL2InboxTest is Test {
         // Ensure that the id's timestamp is invalid (less than or equal to interopStartTime)
         _id.timestamp = bound(_id.timestamp, 0, crossL2Inbox.interopStart());
 
+        // Ensure is not a deposit transaction
+        vm.mockCall({
+            callee: Predeploys.L1_BLOCK_ATTRIBUTES,
+            data: abi.encodeWithSelector(IL1BlockIsthmus.isDeposit.selector),
+            returnData: abi.encode(false)
+        });
+
         // Expect a revert with the InvalidTimestamp selector
         vm.expectRevert(InvalidTimestamp.selector);
 
@@ -527,6 +568,13 @@ contract CrossL2InboxTest is Test {
             returnData: abi.encode(false)
         });
 
+        // Ensure is not a deposit transaction
+        vm.mockCall({
+            callee: Predeploys.L1_BLOCK_ATTRIBUTES,
+            data: abi.encodeWithSelector(IL1BlockIsthmus.isDeposit.selector),
+            returnData: abi.encode(false)
+        });
+
         // Expect a revert with the InvalidChainId selector
         vm.expectRevert(InvalidChainId.selector);