diff --git a/packages/contracts-bedrock/snapshots/semver-lock.json b/packages/contracts-bedrock/snapshots/semver-lock.json index d482fb650fd27..cb5738f1f4ad8 100644 --- a/packages/contracts-bedrock/snapshots/semver-lock.json +++ b/packages/contracts-bedrock/snapshots/semver-lock.json @@ -224,8 +224,8 @@ "sourceCodeHash": "0x7fc4789b082bc8ecd29c4c75a06058f0ff0b72f1c1028a42db6f1c35269c8865" }, "src/safe/SaferSafes.sol:SaferSafes": { - "initCodeHash": "0x80f67f25659b54347cea5f8c250cdf66a32a647375b6703e790b05965fe9cf88", - "sourceCodeHash": "0x9edb7350f8c664964dc106a89e1a117ba9e9b2d2c52d57b3c1c976170a34aa3b" + "initCodeHash": "0x0ad1f0f33517132b06a225b51e6eac48904d4ad691e0045eb70244d811d0d99d", + "sourceCodeHash": "0xd6683fe9be4019d34249ada5a4de3e597f1bd9cd473a89f6eff8f749a0b0e978" }, "src/universal/OptimismMintableERC20.sol:OptimismMintableERC20": { "initCodeHash": "0x3c85eed0d017dca8eda6396aa842ddc12492587b061e8c756a8d32c4610a9658", diff --git a/packages/contracts-bedrock/src/safe/LivenessModule2.sol b/packages/contracts-bedrock/src/safe/LivenessModule2.sol index 28c399bdca677..0c422d2d85ce0 100644 --- a/packages/contracts-bedrock/src/safe/LivenessModule2.sol +++ b/packages/contracts-bedrock/src/safe/LivenessModule2.sol @@ -165,6 +165,8 @@ abstract contract LivenessModule2 { /// @notice Configures the module for a Safe that has already enabled it. /// @param _config The configuration parameters for the module containing the response /// period and fallback owner. + /// @dev It is strongly recommended that the fallback owner is also a Safe or at least a + /// contract that is capable of building and executing transaction batches. function configureLivenessModule(ModuleConfig memory _config) external { Safe callingSafe = Safe(payable(msg.sender)); @@ -357,6 +359,13 @@ abstract contract LivenessModule2 { // even if it is not the SaferSafes guard. This is intentional, as it is possible that the // guard was the cause of the liveness failure which resulted in the transfer of ownership to // the fallback owner. + // WARNING: Removing the TimelockGuard from a Safe will make all Scheduled and Cancelled + // transactions at or below the Safe nonce immediately executable by anyone. To avoid this, + // particularly in an adversarial environment, it is recommended that the fallback owner is + // also a Safe, and that the call to `changeOwnershipToFallback` is the first transaction + // in a batch that also includes as many nonce-bumping no-op transactions through the Safe + // with the TimelockGuard as needed to increase its nonce above that of all Scheduled and + // Cancelled transactions. _safe.execTransactionFromModule({ to: address(_safe), value: 0, diff --git a/packages/contracts-bedrock/src/safe/SaferSafes.sol b/packages/contracts-bedrock/src/safe/SaferSafes.sol index 7fb547b4b5a4b..87644777a1a32 100644 --- a/packages/contracts-bedrock/src/safe/SaferSafes.sol +++ b/packages/contracts-bedrock/src/safe/SaferSafes.sol @@ -26,8 +26,8 @@ import { ISemver } from "interfaces/universal/ISemver.sol"; /// compatibility restrictions in the LivenessModule2 and TimelockGuard contracts. contract SaferSafes is LivenessModule2, TimelockGuard, ISemver { /// @notice Semantic version. - /// @custom:semver 1.10.0 - string public constant version = "1.10.0"; + /// @custom:semver 1.10.1 + string public constant version = "1.10.1"; /// @notice Error for when the liveness response period is insufficient. error SaferSafes_InsufficientLivenessResponsePeriod();