@artblocks/contracts 1.0.1 → 1.0.2

package/contracts/minter-suite/Minters/MinterSetPriceERC20V4.sol

@@ -76,13 +76,12 @@ contract MinterSetPriceERC20V4 is
     // /// projectId => currency address - supersedes any defined core value
     // mapping(uint256 => address) private projectIdToCurrencyAddress;
 
-    modifier onlyArtist(uint256 _projectId) {
+    function _onlyArtist(uint256 _projectId) internal view {
         require(
             msg.sender ==
                 genArtCoreContract_Base.projectIdToArtistAddress(_projectId),
             "Only Artist"
         );
-        _;
     }
 
     /**
@@ -151,9 +150,8 @@ contract MinterSetPriceERC20V4 is
      * @dev this enables gas reduction after maxInvocations have been reached -
      * core contracts shall still enforce a maxInvocation check during mint.
      */
-    function setProjectMaxInvocations(
-        uint256 _projectId
-    ) public onlyArtist(_projectId) {
+    function setProjectMaxInvocations(uint256 _projectId) public {
+        _onlyArtist(_projectId);
         uint256 maxInvocations;
         uint256 invocations;
         (invocations, maxInvocations, , , , ) = genArtCoreContract_Base
@@ -185,7 +183,8 @@ contract MinterSetPriceERC20V4 is
     function manuallyLimitProjectMaxInvocations(
         uint256 _projectId,
         uint256 _maxInvocations
-    ) external onlyArtist(_projectId) {
+    ) external {
+        _onlyArtist(_projectId);
         // CHECKS
         // ensure that the manually set maxInvocations is not greater than what is set on the core contract
         uint256 maxInvocations;
@@ -216,9 +215,8 @@ contract MinterSetPriceERC20V4 is
      * @notice Warning: Disabling purchaseTo is not supported on this minter.
      * This method exists purely for interface-conformance purposes.
      */
-    function togglePurchaseToDisabled(
-        uint256 _projectId
-    ) external view onlyArtist(_projectId) {
+    function togglePurchaseToDisabled(uint256 _projectId) external view {
+        _onlyArtist(_projectId);
         revert("Action not supported");
     }
 
@@ -273,7 +271,8 @@ contract MinterSetPriceERC20V4 is
     function updatePricePerTokenInWei(
         uint256 _projectId,
         uint256 _pricePerTokenInWei
-    ) external onlyArtist(_projectId) {
+    ) external {
+        _onlyArtist(_projectId);
         require(_pricePerTokenInWei > 0, "Price may not be 0");
         ProjectConfig storage _projectConfig = projectConfig[_projectId];
         _projectConfig.pricePerTokenInWei = _pricePerTokenInWei;
@@ -302,7 +301,8 @@ contract MinterSetPriceERC20V4 is
         uint256 _projectId,
         string memory _currencySymbol,
         address _currencyAddress
-    ) external onlyArtist(_projectId) {
+    ) external {
+        _onlyArtist(_projectId);
         // require null address if symbol is "ETH"
         require(
             (keccak256(abi.encodePacked(_currencySymbol)) ==

package/contracts/minter-suite/Minters/MinterSetPriceV4.sol

@@ -61,13 +61,12 @@ contract MinterSetPriceV4 is ReentrancyGuard, MinterBase, IFilteredMinterV2 {
 
     mapping(uint256 => ProjectConfig) public projectConfig;
 
-    modifier onlyArtist(uint256 _projectId) {
+    function _onlyArtist(uint256 _projectId) internal view {
         require(
             msg.sender ==
                 genArtCoreContract_Base.projectIdToArtistAddress(_projectId),
             "Only Artist"
         );
-        _;
     }
 
     /**
@@ -104,9 +103,8 @@ contract MinterSetPriceV4 is ReentrancyGuard, MinterBase, IFilteredMinterV2 {
      * @dev this enables gas reduction after maxInvocations have been reached -
      * core contracts shall still enforce a maxInvocation check during mint.
      */
-    function setProjectMaxInvocations(
-        uint256 _projectId
-    ) public onlyArtist(_projectId) {
+    function setProjectMaxInvocations(uint256 _projectId) public {
+        _onlyArtist(_projectId);
         uint256 maxInvocations;
         uint256 invocations;
         (invocations, maxInvocations, , , , ) = genArtCoreContract_Base
@@ -138,7 +136,8 @@ contract MinterSetPriceV4 is ReentrancyGuard, MinterBase, IFilteredMinterV2 {
     function manuallyLimitProjectMaxInvocations(
         uint256 _projectId,
         uint256 _maxInvocations
-    ) external onlyArtist(_projectId) {
+    ) external {
+        _onlyArtist(_projectId);
         // CHECKS
         // ensure that the manually set maxInvocations is not greater than what is set on the core contract
         uint256 maxInvocations;
@@ -169,9 +168,8 @@ contract MinterSetPriceV4 is ReentrancyGuard, MinterBase, IFilteredMinterV2 {
      * @notice Warning: Disabling purchaseTo is not supported on this minter.
      * This method exists purely for interface-conformance purposes.
      */
-    function togglePurchaseToDisabled(
-        uint256 _projectId
-    ) external view onlyArtist(_projectId) {
+    function togglePurchaseToDisabled(uint256 _projectId) external view {
+        _onlyArtist(_projectId);
         revert("Action not supported");
     }
 
@@ -228,7 +226,8 @@ contract MinterSetPriceV4 is ReentrancyGuard, MinterBase, IFilteredMinterV2 {
     function updatePricePerTokenInWei(
         uint256 _projectId,
         uint256 _pricePerTokenInWei
-    ) external onlyArtist(_projectId) {
+    ) external {
+        _onlyArtist(_projectId);
         ProjectConfig storage _projectConfig = projectConfig[_projectId];
         _projectConfig.pricePerTokenInWei = _pricePerTokenInWei;
         _projectConfig.priceIsConfigured = true;

package/contracts/mock/DeadReceiverBidderMock.sol

@@ -0,0 +1,23 @@
+// SPDX-License-Identifier: LGPL-3.0-only
+
+pragma solidity 0.8.17;
+
+import {DeadReceiverMock} from "./DeadReceiverMock.sol";
+
+/**
+ * @notice This reverts when receiving Ether.
+ * Also exposes a createBidOnAuction function to create a bid on an auction
+ * of a serial English auction minter.
+ * @dev Mock contract for testing purposes.
+ */
+contract DeadReceiverBidderMock is DeadReceiverMock {
+    function createBidOnAuction(
+        address minter,
+        uint256 tokenId
+    ) external payable {
+        (bool success, ) = minter.call{value: msg.value}(
+            abi.encodeWithSignature("createBid(uint256)", tokenId)
+        );
+        require(success, "DeadReceiverBidderMock: call failed");
+    }
+}

package/contracts/mock/GasLimitReceiverBidderMock.sol

@@ -0,0 +1,23 @@
+// SPDX-License-Identifier: LGPL-3.0-only
+
+pragma solidity 0.8.17;
+
+import {GasLimitReceiverMock} from "./GasLimitReceiverMock.sol";
+
+/**
+ * @notice This reverts when receiving Ether.
+ * Also exposes a createBidOnAuction function to create a bid on an auction
+ * of a serial English auction minter.
+ * @dev Mock contract for testing purposes.
+ */
+contract GasLimitReceiverBidderMock is GasLimitReceiverMock {
+    function createBidOnAuction(
+        address minter,
+        uint256 tokenId
+    ) external payable {
+        (bool success, ) = minter.call{value: msg.value}(
+            abi.encodeWithSignature("createBid(uint256)", tokenId)
+        );
+        require(success, "GasLimitReceiverBidderMock: call failed");
+    }
+}

package/contracts/mock/GasLimitReceiverMock.sol

@@ -0,0 +1,19 @@
+// SPDX-License-Identifier: LGPL-3.0-only
+
+pragma solidity 0.8.17;
+
+/**
+ * @notice This uses all gas when receiving Ether, useful when testing denial
+ * of service attacks.
+ * @dev Mock contract for testing purposes.
+ */
+contract GasLimitReceiverMock {
+    string public a = "a string in storage.";
+
+    receive() external payable {
+        // infinite loop to burn all available gas
+        while (true) {
+            a = string.concat(a, " A longer string in storage to burn gas.");
+        }
+    }
+}

package/contracts/mock/RandomizerV2_NoAssignMock.sol

@@ -3,7 +3,7 @@
 
 pragma solidity 0.8.17;
 
-import "../BasicRandomizerV2.sol";
+import "../randomizer/RandomizerV2.sol";
 
 /// @title RandomizerV2_NoAssignMock
 /// @notice WARNING - This is a mock contract. Do not use it in production.
@@ -20,16 +20,7 @@ contract RandomizerV2_NoAssignMock is BasicRandomizerV2 {
     // on the core contract. Used for test purposes only.
     // @dev WARNING - THIS IS NOT SECURE AND SHOULD NOT BE USED IN PRODUCTION.
     function actuallyAssignTokenHash(uint256 _tokenId) external {
-        uint256 time = block.timestamp;
-        bytes32 hash = keccak256(
-            abi.encodePacked(
-                _tokenId,
-                block.number,
-                blockhash(block.number - 1),
-                time,
-                (time % 200) + 1
-            )
-        );
+        bytes32 hash = _getPseudorandom(_tokenId);
         genArt721Core.setTokenHash_8PT(_tokenId, hash);
     }
 

package/contracts/mock/ReentrancySEAMock.sol

@@ -0,0 +1,36 @@
+// SPDX-License-Identifier: LGPL-3.0-only
+// Created By: Art Blocks Inc.
+
+import "../interfaces/0.8.x/IFilteredMinterSEAV0.sol";
+
+pragma solidity ^0.8.0;
+
+contract ReentrancySEAAutoBidderMock {
+    uint256 public targetTokenId;
+
+    /**
+        @notice This function can be called to induce controlled reentrency attacks
+        on AB minter filter suite. 
+        Note that _priceToPay should be > project price per token to induce refund, 
+        making reentrency possible via fallback function.
+     */
+    function attack(
+        uint256 _targetTokenId,
+        address _minterContractAddress,
+        uint256 _initialBidValue
+    ) external payable {
+        targetTokenId = _targetTokenId;
+        IFilteredMinterSEAV0(_minterContractAddress).createBid{
+            value: _initialBidValue
+        }(_targetTokenId);
+    }
+
+    // receiver is called when minter sends refunded Ether to this contract, when outbid
+    receive() external payable {
+        // auto-rebid
+        uint256 newBidValue = (msg.value * 110) / 100;
+        IFilteredMinterSEAV0(msg.sender).createBid{value: newBidValue}(
+            targetTokenId
+        );
+    }
+}

package/contracts/{BasicRandomizer.sol → randomizer/BasicRandomizer.sol}

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: LGPL-3.0-only
 // Creatd By: Art Blocks Inc.
 
-import "./interfaces/0.8.x/IRandomizer.sol";
+import "../interfaces/0.8.x/IRandomizer.sol";
 
 pragma solidity 0.8.9;
 

package/contracts/randomizer/BasicRandomizerBase_v0_0_0.sol

@@ -0,0 +1,23 @@
+// SPDX-License-Identifier: LGPL-3.0-only
+// Creatd By: Art Blocks Inc.
+
+pragma solidity 0.8.17;
+
+abstract contract RandomizerBase {
+    // base class that returns
+    function _getPseudorandom(
+        uint256 _tokenId
+    ) internal virtual returns (bytes32) {
+        uint256 time = block.timestamp;
+        return
+            keccak256(
+                abi.encodePacked(
+                    _tokenId,
+                    block.number,
+                    blockhash(block.number - 1),
+                    time,
+                    (time % 200) + 1
+                )
+            );
+    }
+}

package/contracts/{BasicPolyptychRandomizerV0.sol → randomizer/PolyptychRandomizerV0.sol}

@@ -3,8 +3,9 @@
 
 pragma solidity 0.8.17;
 
-import "./interfaces/0.8.x/IGenArt721CoreContractV3_Base.sol";
-import "./interfaces/0.8.x/IRandomizerPolyptychV0.sol";
+import "../interfaces/0.8.x/IGenArt721CoreContractV3_Base.sol";
+import "../interfaces/0.8.x/IRandomizerPolyptychV0.sol";
+import "./BasicRandomizerBase_v0_0_0.sol";
 
 import "@openzeppelin-4.7/contracts/access/Ownable.sol";
 
@@ -23,7 +24,11 @@ import "@openzeppelin-4.7/contracts/access/Ownable.sol";
  * Once the contract is configured, it will enable newly-minted tokens to use a copy of the hash
  * seed from a previously-minted token.
  */
-contract BasicPolyptychRandomizerV0 is IRandomizerPolyptychV0, Ownable {
+contract BasicPolyptychRandomizerV0 is
+    IRandomizerPolyptychV0,
+    RandomizerBase,
+    Ownable
+{
     // The core contract that may interact with this randomizer contract.
     IGenArt721CoreContractV3_Base public genArt721Core;
 
@@ -46,26 +51,23 @@ contract BasicPolyptychRandomizerV0 is IRandomizerPolyptychV0, Ownable {
 
     // modifier to restrict access to only AdminACL allowed calls
     // @dev defers which ACL contract is used to the core contract
-    modifier onlyCoreAdminACL(bytes4 _selector) {
+    function _onlyCoreAdminACL(bytes4 _selector) internal {
         require(
             genArt721Core.adminACLAllowed(msg.sender, address(this), _selector),
             "Only Core AdminACL allowed"
         );
-        _;
     }
 
-    modifier onlyArtist(uint256 _projectId) {
+    function _onlyArtist(uint256 _projectId) internal view {
         require(
             msg.sender == genArt721Core.projectIdToArtistAddress(_projectId),
             "Only Artist"
         );
-        _;
     }
 
     // Allows the owner of the core contract to set the minter that is allowed to assign hash seeds
-    function setHashSeedSetterContract(
-        address _contractAddress
-    ) external onlyCoreAdminACL(this.setHashSeedSetterContract.selector) {
+    function setHashSeedSetterContract(address _contractAddress) external {
+        _onlyCoreAdminACL(this.setHashSeedSetterContract.selector);
         hashSeedSetterContract = _contractAddress;
         emit HashSeedSetterUpdated(_contractAddress);
     }
@@ -74,9 +76,8 @@ contract BasicPolyptychRandomizerV0 is IRandomizerPolyptychV0, Ownable {
      * @notice Allows the owner of the core contract to configure a project as a polyptych
      * @param _projectId - The ID of the project that has a polyptych panel (second, third, etc.)
      */
-    function toggleProjectIsPolyptych(
-        uint256 _projectId
-    ) external onlyArtist(_projectId) {
+    function toggleProjectIsPolyptych(uint256 _projectId) external {
+        _onlyArtist(_projectId);
         projectIsPolyptych[_projectId] = !projectIsPolyptych[_projectId];
         emit ProjectIsPolyptychUpdated(
             _projectId,
@@ -104,23 +105,13 @@ contract BasicPolyptychRandomizerV0 is IRandomizerPolyptychV0, Ownable {
     // will set a bytes32 hash for tokenId `_tokenId` on the core contract.
     function assignTokenHash(uint256 _tokenId) external virtual {
         require(msg.sender == address(genArt721Core), "Only core may call");
-
+        bytes32 hash;
         if (projectIsPolyptych[_tokenId / ONE_MILLION]) {
-            bytes12 seededHash = polyptychHashSeeds[_tokenId];
-            require(seededHash != 0, "Only non-zero hash seed");
-            genArt721Core.setTokenHash_8PT(_tokenId, seededHash);
+            hash = polyptychHashSeeds[_tokenId];
         } else {
-            uint256 time = block.timestamp;
-            bytes32 hash = keccak256(
-                abi.encodePacked(
-                    _tokenId,
-                    block.number,
-                    blockhash(block.number - 1),
-                    time,
-                    (time % 200) + 1
-                )
-            );
-            genArt721Core.setTokenHash_8PT(_tokenId, hash);
+            hash = _getPseudorandom(_tokenId);
         }
+        require(hash != 0, "Only non-zero hash seed");
+        genArt721Core.setTokenHash_8PT(_tokenId, hash);
     }
 }

package/contracts/{BasicRandomizerV2.sol → randomizer/RandomizerV2.sol}

@@ -3,12 +3,13 @@
 
 pragma solidity 0.8.17;
 
-import "./interfaces/0.8.x/IRandomizerV2.sol";
-import "./interfaces/0.8.x/IGenArt721CoreContractV3_Base.sol";
+import "../interfaces/0.8.x/IRandomizerV2.sol";
+import "../interfaces/0.8.x/IGenArt721CoreContractV3_Base.sol";
+import "./BasicRandomizerBase_v0_0_0.sol";
 
 import "@openzeppelin-4.7/contracts/access/Ownable.sol";
 
-contract BasicRandomizerV2 is IRandomizerV2, Ownable {
+contract BasicRandomizerV2 is IRandomizerV2, RandomizerBase, Ownable {
     // The core contract that may interact with this randomizer contract.
     IGenArt721CoreContractV3_Base public genArt721Core;
 
@@ -21,16 +22,7 @@ contract BasicRandomizerV2 is IRandomizerV2, Ownable {
     // will set a bytes32 hash for tokenId `_tokenId` on the core contract.
     function assignTokenHash(uint256 _tokenId) external virtual {
         require(msg.sender == address(genArt721Core), "Only core may call");
-        uint256 time = block.timestamp;
-        bytes32 hash = keccak256(
-            abi.encodePacked(
-                _tokenId,
-                block.number,
-                blockhash(block.number - 1),
-                time,
-                (time % 200) + 1
-            )
-        );
+        bytes32 hash = _getPseudorandom(_tokenId);
         genArt721Core.setTokenHash_8PT(_tokenId, hash);
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@artblocks/contracts",
-  "version": "1.0.1",
+  "version": "1.0.2",
   "description": "Smart contracts used by Art Blocks",
   "files": [
     "/contracts/**/*.sol",
@@ -18,8 +18,12 @@
     "format": "prettier --write 'contracts/**/*.sol' && prettier --write 'scripts/**/*.ts' && prettier --write 'test/**/*.ts'",
     "lint": "prettier --check 'contracts/**/*.sol' && prettier --check 'scripts/**/*.ts' && prettier --check 'test/**/*.ts' && npx eslint 'test/**/*.ts'",
     "remix": "remixd -s ./ --remix-ide https://remix.ethereum.org",
-    "deploy:goerli:v3-engine": "yarn hardhat run --network goerli scripts/engine/V3/generic-engine-deployer.ts",
-    "deploy:mainnet:v3-engine": "yarn hardhat run --network mainnet scripts/engine/V3/generic-engine-deployer.ts",
+    "codegen:dev": "NODE_ENV=dev yarn graphql-codegen --require dotenv/config --config ./graphql.config.js dotenv_config_path=./.env",
+    "codegen:staging": "NODE_ENV=staging yarn graphql-codegen --require dotenv/config --config ./graphql.config.js dotenv_config_path=./.env",
+    "codegen:mainnet": "NODE_ENV=mainnet yarn graphql-codegen --require dotenv/config --config ./graphql.config.js dotenv_config_path=./.env",
+    "deploy:dev:v3-engine": "yarn codegen:dev && NODE_ENV=dev yarn hardhat run --network goerli scripts/engine/V3/generic-engine-deployer.ts",
+    "deploy:staging:v3-engine": "yarn codegen:staging && NODE_ENV=staging yarn hardhat run --network goerli scripts/engine/V3/generic-engine-deployer.ts",
+    "deploy:mainnet:v3-engine": "yarn codegen:mainnet && NODE_ENV=mainnet yarn hardhat run --network mainnet scripts/engine/V3/generic-engine-deployer.ts",
     "deploy:goerli:minter": "yarn hardhat run --network goerli scripts/minter-deployments/generic-minter-deployer-v3core.ts",
     "deploy:mainnet:minter": "yarn hardhat run --network mainnet scripts/minter-deployments/generic-minter-deployer-v3core.ts"
   },
@@ -38,37 +42,43 @@
     "@gnosis.pm/safe-core-sdk-types": "^1.7.0",
     "@gnosis.pm/safe-ethers-lib": "1.1.0",
     "@gnosis.pm/safe-service-client": "^1.4.0",
+    "@graphql-codegen/cli": "^3.0.0",
+    "@graphql-codegen/typescript": "^3.0.0",
+    "@graphql-codegen/typescript-document-nodes": "^3.0.0",
+    "@graphql-codegen/typescript-operations": "^3.0.0",
+    "@graphql-codegen/typescript-urql": "^3.7.3",
+    "@nomicfoundation/hardhat-network-helpers": "^1.0.8",
     "@nomiclabs/hardhat-ethers": "^2.2.1",
     "@nomiclabs/hardhat-etherscan": "^3.1.4",
-    "@nomiclabs/hardhat-solhint": "^2.0.0",
+    "@nomiclabs/hardhat-solhint": "^3.0.0",
     "@nomiclabs/hardhat-truffle5": "^2.0.7",
     "@nomiclabs/hardhat-waffle": "^2.0.3",
     "@nomiclabs/hardhat-web3": "^2.0.0",
     "@openzeppelin/hardhat-upgrades": "^1.22.0",
     "@openzeppelin/test-helpers": "^0.5.16",
-    "@remix-project/remixd": "^0.5.6",
+    "@remix-project/remixd": "^0.6.12",
     "@typechain/ethers-v5": "^6.0.5",
-    "@types/jest": "^27.0.3",
-    "@types/mocha": "^9.1.1",
+    "@types/jest": "^29.4.0",
+    "@types/mocha": "^10.0.1",
     "@types/prompt": "^1.1.5",
     "@typescript-eslint/eslint-plugin": "^5.48.0",
     "@typescript-eslint/parser": "^5.48.0",
-    "aws-sdk-client-mock": "^0.6.2",
+    "aws-sdk-client-mock": "^2.1.1",
     "chai": "^4.3.7",
     "coveralls": "^3.1.1",
-    "dotenv": "^8.2.0",
+    "dotenv": "^16.0.3",
     "eslint": "^8.31.0",
     "eslint-plugin-mocha": "^10.1.0",
-    "ethereum-waffle": "^3.4.4",
+    "ethereum-waffle": "^4.0.10",
     "ethers": "^5.7.2",
     "hardhat": "^2.12.5",
     "hardhat-contract-sizer": "^2.6.1",
     "hardhat-docgen": "^1.3.0",
     "hardhat-gas-reporter": "^1.0.9",
-    "husky": "^7.0.4",
+    "husky": "^8.0.3",
     "istanbul-combine": "^0.3.0",
     "keccak256": "^1.0.6",
-    "merkletreejs": "^0.2.31",
+    "merkletreejs": "^0.3.9",
     "prettier": "^2.8.1",
     "prettier-plugin-solidity": "^1.1.1",
     "prompt": "^1.3.0",
@@ -76,7 +86,7 @@
     "solidity-coverage": "^0.8.0",
     "ts-node": "^9.1.1",
     "typechain": "^4.0.3",
-    "typescript": "^4.9.4"
+    "typescript": "^5.0.2"
   },
   "author": "Art Blocks, Inc",
   "license": "LGPL-3.0-only",
@@ -84,6 +94,9 @@
     "@openzeppelin-0.5/contracts": "npm:@openzeppelin/contracts@2.5.1",
     "@openzeppelin-4.5/contracts": "npm:@openzeppelin/contracts@4.5.0",
     "@openzeppelin-4.7/contracts": "npm:@openzeppelin/contracts@4.7.1",
-    "@openzeppelin-4.8/contracts-upgradeable": "npm:@openzeppelin/contracts-upgradeable@4.8.0"
+    "@openzeppelin-4.8/contracts-upgradeable": "npm:@openzeppelin/contracts-upgradeable@4.8.0",
+    "@urql/exchange-retry": "^1.0.0",
+    "graphql": "^16.6.0",
+    "urql": "^3.0.3"
   }
 }