@artblocks/contracts 1.0.3 → 1.1.0

package/contracts/mock/ReentrancyMerkleMockShared.sol

@@ -0,0 +1,58 @@
+// SPDX-License-Identifier: LGPL-3.0-only
+// Created By: Art Blocks Inc.
+
+import "../interfaces/v0.8.x/ISharedMinterMerkleV0.sol";
+
+pragma solidity ^0.8.0;
+
+contract ReentrancyMerkleMockShared {
+    uint256 public currentQtyToPurchase;
+    uint256 public currentProjectId;
+    address public currentCoreContract;
+    uint256 public currentPriceToPay;
+    bytes32[3] currentProof;
+
+    /**
+        @notice This function can be called to induce controlled reentrency attacks
+        on the shared AB minter filter suite. 
+        Note that _priceToPay should be > project price per token to induce refund, 
+        making reentrency possible via fallback function.
+     */
+    function attack(
+        uint256 _qtyToPurchase,
+        address _minterContractAddress,
+        uint256 _projectId,
+        address _coreContract,
+        uint256 _priceToPay,
+        bytes32[] memory _proof
+    ) external payable {
+        // update state variables so that receive() knows what to do
+        currentQtyToPurchase = _qtyToPurchase;
+        currentProjectId = _projectId;
+        currentCoreContract = _coreContract;
+        currentPriceToPay = _priceToPay;
+        currentProof[0] = _proof[0];
+        currentProof[1] = _proof[1];
+        currentProof[2] = _proof[2];
+        ISharedMinterMerkleV0(_minterContractAddress).purchase{
+            value: _priceToPay
+        }(_projectId, _coreContract, _proof);
+    }
+
+    // receiver is called when minter sends refunded Ether to this contract.
+    receive() external payable {
+        // decrement num to be purchased
+        currentQtyToPurchase--;
+        if (currentQtyToPurchase > 0) {
+            // rebuild _proof
+            bytes32[] memory _proof = new bytes32[](3);
+            _proof[0] = currentProof[0];
+            _proof[1] = currentProof[1];
+            _proof[2] = currentProof[2];
+            // purchase again!
+            ISharedMinterMerkleV0(msg.sender).purchase{
+                value: currentPriceToPay
+            }(currentProjectId, currentCoreContract, _proof);
+        }
+    }
+}

package/contracts/mock/ReentrancyMock.sol

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: LGPL-3.0-only
 // Created By: Art Blocks Inc.
 
-import "../interfaces/0.8.x/IFilteredMinterV0.sol";
+import "../interfaces/v0.8.x/IFilteredMinterV0.sol";
 
 pragma solidity ^0.8.0;
 

package/contracts/mock/ReentrancyMockShared.sol

@@ -0,0 +1,48 @@
+// SPDX-License-Identifier: LGPL-3.0-only
+// Created By: Art Blocks Inc.
+
+import "../interfaces/v0.8.x/ISharedMinterSimplePurchaseV0.sol";
+
+pragma solidity ^0.8.0;
+
+contract ReentrancyMockShared {
+    uint256 public currentQtyToPurchase;
+    uint256 public currentProjectId;
+    address public currentCoreContract;
+    uint256 public currentPriceToPay;
+
+    /**
+        @notice This function can be called to induce controlled reentrency attacks
+        on the shared AB minter filter suite. 
+        Note that _priceToPay should be > project price per token to induce refund, 
+        making reentrency possible via fallback function.
+     */
+    function attack(
+        uint256 _qtyToPurchase,
+        address _minterContractAddress,
+        uint256 _projectId,
+        address _coreContract,
+        uint256 _priceToPay
+    ) external payable {
+        // update state variables so that receive() knows what to do
+        currentQtyToPurchase = _qtyToPurchase;
+        currentProjectId = _projectId;
+        currentCoreContract = _coreContract;
+        currentPriceToPay = _priceToPay;
+        ISharedMinterSimplePurchaseV0(_minterContractAddress).purchase{
+            value: _priceToPay
+        }(_projectId, _coreContract);
+    }
+
+    // receiver is called when minter sends refunded Ether to this contract.
+    receive() external payable {
+        // decrement num to be purchased
+        currentQtyToPurchase--;
+        if (currentQtyToPurchase > 0) {
+            // purchase again!
+            ISharedMinterSimplePurchaseV0(msg.sender).purchase{
+                value: currentPriceToPay
+            }(currentProjectId, currentCoreContract);
+        }
+    }
+}

package/contracts/mock/ReentrancySEAMock.sol

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: LGPL-3.0-only
 // Created By: Art Blocks Inc.
 
-import "../interfaces/0.8.x/IFilteredMinterSEAV0.sol";
+import "../interfaces/v0.8.x/IFilteredMinterSEAV0.sol";
 
 pragma solidity ^0.8.0;
 

package/contracts/mock/ReentrancySEAMockShared.sol

@@ -0,0 +1,40 @@
+// SPDX-License-Identifier: LGPL-3.0-only
+// Created By: Art Blocks Inc.
+
+import "../interfaces/v0.8.x/ISharedMinterSEAV0.sol";
+
+pragma solidity ^0.8.0;
+
+contract ReentrancySEAAutoBidderMockShared {
+    uint256 public targetTokenId;
+    address public targetCoreContract;
+
+    /**
+        @notice This function can be called to induce controlled reentrency attacks
+        on AB minter filter suite. 
+        Note that _priceToPay should be > project price per token to induce refund, 
+        making reentrency possible via fallback function.
+     */
+    function attack(
+        uint256 _targetTokenId,
+        address _targetCoreContract,
+        address _minterContractAddress,
+        uint256 _initialBidValue
+    ) external payable {
+        targetTokenId = _targetTokenId;
+        targetCoreContract = _targetCoreContract;
+        ISharedMinterSEAV0(_minterContractAddress).createBid{
+            value: _initialBidValue
+        }(_targetTokenId, _targetCoreContract);
+    }
+
+    // receiver is called when minter sends refunded Ether to this contract, when outbid
+    receive() external payable {
+        // auto-rebid
+        uint256 newBidValue = (msg.value * 110) / 100;
+        ISharedMinterSEAV0(msg.sender).createBid{value: newBidValue}(
+            targetTokenId,
+            targetCoreContract
+        );
+    }
+}

package/contracts/mock/SSTORE2Mock.sol

@@ -3,7 +3,7 @@ pragma solidity 0.8.19;
 
 // Created By: Art Blocks Inc.
 
-import "../libs/0.8.x/SSTORE2.sol";
+import "../libs/v0.8.x/SSTORE2.sol";
 
 /**
  * @title Art Blocks SSTORE2Mock.

package/contracts/randomizer/deprecated/BasicRandomizer.sol

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: LGPL-3.0-only
 // Creatd By: Art Blocks Inc.
 
-import "../../interfaces/0.8.x/IRandomizer.sol";
+import "../../interfaces/v0.8.x/IRandomizer.sol";
 
 pragma solidity 0.8.9;
 

package/contracts/randomizer/deprecated/PolyptychRandomizerV0.sol

@@ -3,8 +3,8 @@
 
 pragma solidity 0.8.19;
 
-import "../../interfaces/0.8.x/IGenArt721CoreContractV3_Base.sol";
-import "../../interfaces/0.8.x/IRandomizerPolyptychV0.sol";
+import "../../interfaces/v0.8.x/IGenArt721CoreContractV3_Base.sol";
+import "../../interfaces/v0.8.x/IRandomizerPolyptychV0.sol";
 import "./BasicRandomizerBase_v0_0_0.sol";
 
 import "@openzeppelin-4.7/contracts/access/Ownable.sol";

package/contracts/randomizer/deprecated/RandomizerV2.sol

@@ -3,8 +3,8 @@
 
 pragma solidity 0.8.19;
 
-import "../../interfaces/0.8.x/IRandomizerV2.sol";
-import "../../interfaces/0.8.x/IGenArt721CoreContractV3_Base.sol";
+import "../../interfaces/v0.8.x/IRandomizerV2.sol";
+import "../../interfaces/v0.8.x/IGenArt721CoreContractV3_Base.sol";
 import "./BasicRandomizerBase_v0_0_0.sol";
 
 import "@openzeppelin-4.7/contracts/access/Ownable.sol";

package/contracts/randomizer/primitive/PseudorandomAtomicBasic.sol

@@ -3,7 +3,7 @@
 
 pragma solidity 0.8.19;
 
-import "../../interfaces/0.8.x/IPseudorandomAtomic.sol";
+import "../../interfaces/v0.8.x/IPseudorandomAtomic.sol";
 
 /**
  * @title PseudorandomAtomic

package/contracts/randomizer/shared/SharedRandomizerV0.sol

@@ -1,11 +1,13 @@
 // SPDX-License-Identifier: LGPL-3.0-only
 // Creatd By: Art Blocks Inc.
 
+// @dev fixed to specific solidity version for clarity and for more clear
+// source code verification purposes.
 pragma solidity 0.8.19;
 
-import "../../interfaces/0.8.x/IGenArt721CoreContractV3_Base.sol";
-import "../../interfaces/0.8.x/ISharedRandomizerV0.sol";
-import "../../interfaces/0.8.x/IPseudorandomAtomic.sol";
+import "../../interfaces/v0.8.x/IGenArt721CoreContractV3_Base.sol";
+import "../../interfaces/v0.8.x/ISharedRandomizerV0.sol";
+import "../../interfaces/v0.8.x/IPseudorandomAtomic.sol";
 
 /**
  * @title A shared randomizer contract that enables support of many Art Blocks
@@ -16,36 +18,35 @@ import "../../interfaces/0.8.x/IPseudorandomAtomic.sol";
  * `assignTokenHash` function, as long as the call does not revert.
  *
  * The randomizer generates a token's hash seed in one of two ways:
- * 1. If the project of the token is specified as a polyptych, the randomizer
- * will assign the token the hash seed as previously set by the project's hash
- * seed setter contract. If no hash seed has been set, the randomizer will
- * revert.
- * 2. If the project of the token is not specified as a polyptych, the
- * randomizer will generate a new hash seed using the `IPseudorandomAtomic`
- * contract, which is immutable and set during deployment.
+ * 1. If the project of the token is specified as using a hash seed setter
+ * contract, the randomizer will assign the token the hash seed as previously
+ * pre-set by the project's hash seed setter contract. If no hash seed has
+ * been set, the randomizer will revert (will not assign null token hash).
+ * 2. If the project of the token is not specified as using a hash seed setter
+ * contract, the randomizer will generate a new hash seed using the
+ * `IPseudorandomAtomic` contract, which is immutable and set during
+ * deployment.
  *
- * When using this randomizer for ployptych minting, several requirements may
- * be required by the hash seed setter contract, including the possibility
+ * @dev When using this randomizer for ployptych minting, several requirements
+ * may be required by the hash seed setter contract, including the possibility
  * that a token's hash seed must be available in a public getter function on
  * the core contract. Please inspect the hash seed setter contract to ensure
  * that all requirements are met.
  *
  * @notice Privileged Roles and Ownership:
- * Privileged roles and abilities are controlled by each core contract's admin
- * ACL contract and artists. Both of these roles hold extensive power and can
- * influence the behavior of this randomizer.
- * Care must be taken to ensure that the admin ACL contract and artist
- * addresses are secure behind a multi-sig or other access control mechanism.
- * ----------------------------------------------------------------------------
- * The following function is restricted to each core's Admin ACL contract:
- * - setHashSeedSetterContract
+ * Privileged roles and abilities are controlled by each core contract's
+ * artists.
+ * These roles hold extensive power and can influence the behavior of this
+ * randomizer.
+ * Care must be taken to ensure that the artist addresses are secure.
  * ----------------------------------------------------------------------------
  * The following functions are restricted to only the Artist address:
- * - toggleProjectIsPolyptych
+ * - setHashSeedSetterContract
+ * - toggleProjectUseAssignedHashSeed
  * ----------------------------------------------------------------------------
  * The following function is restricted to only the hash seed setter contract
  * of a given core contract:
- * - setPolyptychHashSeed
+ * - preSetHashSeed
  * ----------------------------------------------------------------------------
  * Additional admin and artist privileged roles may be described on minters,
  * registries, and other contracts that may interact with this randomizer.
@@ -56,66 +57,63 @@ contract SharedRandomizerV0 is ISharedRandomizerV0 {
     // constant used to obtain the project ID from the token ID
     uint256 internal constant ONE_MILLION = 1_000_000;
 
-    // mapping of core contract => token ID => hash seed
-    mapping(address => mapping(uint256 => bytes12)) private _polyptychHashSeed;
+    // mapping of core contract => token ID => pre-assigned hash seed
+    // @dev this mapping is only used when the project is configured as using
+    // a hash seed setter contract. It is not populated when the project is
+    // using pseudorandomAtomicContract.
+    mapping(address coreContract => mapping(uint256 tokenId => bytes12 preAssignedHashSeed))
+        private _preAssignedHashSeeds;
 
-    // mapping of core contract => project ID => is polyptych
-    mapping(address => mapping(uint256 => bool)) private _projectIsPolyptych;
+    // mapping of core contract => project ID => usesHashSeedSetter Contract
+    mapping(address coreContract => mapping(uint256 projectId => bool usesHashSeedSetter))
+        private _projectUsesHashSeedSetter;
 
-    // mapping of core contract => hash seed setter contract
-    mapping(address => address) private _hashSeedSetterContracts;
-
-    // modifier to restrict access to only AdminACL allowed calls
-    // @dev defers to ACL contract being used to the core contract
-    function _onlyCoreAdminACL(
-        address _coreContract,
-        bytes4 _selector
-    ) internal {
-        require(
-            IGenArt721CoreContractV3_Base(_coreContract).adminACLAllowed(
-                msg.sender,
-                address(this),
-                _selector
-            ),
-            "Only Core AdminACL allowed"
-        );
-    }
+    // mapping of core contract => projectId => hash seed setter contract
+    mapping(address coreContract => mapping(uint256 projectId => address hashSeedSetterContract))
+        private _hashSeedSetterContracts;
 
     // modifier to restrict access to only Artist allowed calls
     function _onlyArtist(
-        address _coreContract,
-        uint256 _projectId
+        address coreContract,
+        uint256 projectId
     ) internal view {
         require(
             msg.sender ==
-                IGenArt721CoreContractV3_Base(_coreContract)
-                    .projectIdToArtistAddress(_projectId),
+                IGenArt721CoreContractV3_Base(coreContract)
+                    .projectIdToArtistAddress(projectId),
             "Only Artist"
         );
     }
 
-    // modifier to restrict access to only calls by the hash seed setter
-    // contract of a given core contract
-    function _onlyHashSeedSetterContract(address _coreContract) internal view {
+    /**
+     * Modifier to restrict access to only calls by the hash seed setter
+     * contract of a given project.
+     * @param coreContract core contract address associated with the project
+     * @param projectId project ID being set
+     */
+    function _onlyHashSeedSetterContract(
+        address coreContract,
+        uint256 projectId
+    ) internal view {
         require(
-            msg.sender == _hashSeedSetterContracts[_coreContract],
+            msg.sender == _hashSeedSetterContracts[coreContract][projectId],
             "Only Hash Seed Setter Contract"
         );
     }
 
     /**
      *
-     * @param _pseudorandomAtomicContract Address of the pseudorandom atomic
+     * @param pseudorandomAtomicContract_ Address of the pseudorandom atomic
      * contract to use for atomically generating random values. This contract
      * does not have an owner, and therefore the pseudorandom atomic contract
      * address cannot be changed after deployment.
      */
-    constructor(address _pseudorandomAtomicContract) {
+    constructor(address pseudorandomAtomicContract_) {
         pseudorandomAtomicContract = IPseudorandomAtomic(
-            _pseudorandomAtomicContract
+            pseudorandomAtomicContract_
         );
         emit PseudorandomAtomicContractUpdated({
-            pseudorandomAtomicContract: _pseudorandomAtomicContract
+            pseudorandomAtomicContract: pseudorandomAtomicContract_
         });
     }
 
@@ -123,48 +121,55 @@ contract SharedRandomizerV0 is ISharedRandomizerV0 {
      * @inheritdoc ISharedRandomizerV0
      */
     function setHashSeedSetterContract(
-        address _coreContract,
-        address _hashSeedSetterContract
+        address coreContract,
+        uint256 projectId,
+        address hashSeedSetterContract
     ) external {
-        _onlyCoreAdminACL(
-            _coreContract,
-            this.setHashSeedSetterContract.selector
-        );
-        _hashSeedSetterContracts[_coreContract] = _hashSeedSetterContract;
-        emit HashSeedSetterForCoreUpdated({
-            coreContract: _coreContract,
-            hashSeedSetterContract: _hashSeedSetterContract
+        _onlyArtist({projectId: projectId, coreContract: coreContract});
+        _hashSeedSetterContracts[coreContract][
+            projectId
+        ] = hashSeedSetterContract;
+        emit HashSeedSetterForProjectUpdated({
+            coreContract: coreContract,
+            projectId: projectId,
+            hashSeedSetterContract: hashSeedSetterContract
         });
     }
 
     /**
      * @inheritdoc ISharedRandomizerV0
      */
-    function toggleProjectIsPolyptych(
-        address _coreContract,
-        uint256 _projectId
+    function toggleProjectUseAssignedHashSeed(
+        address coreContract,
+        uint256 projectId
     ) external {
-        _onlyArtist(_coreContract, _projectId);
-        _projectIsPolyptych[_coreContract][_projectId] = !_projectIsPolyptych[
-            _coreContract
-        ][_projectId];
-        emit ProjectIsPolyptychUpdated({
-            coreContract: _coreContract,
-            projectId: _projectId,
-            isPolyptych: _projectIsPolyptych[_coreContract][_projectId]
+        _onlyArtist({projectId: projectId, coreContract: coreContract});
+        _projectUsesHashSeedSetter[coreContract][
+            projectId
+        ] = !_projectUsesHashSeedSetter[coreContract][projectId];
+        emit ProjectUsingHashSeedSetterUpdated({
+            coreContract: coreContract,
+            projectId: projectId,
+            usingHashSeedSetter: _projectUsesHashSeedSetter[coreContract][
+                projectId
+            ]
         });
     }
 
     /**
      * @inheritdoc ISharedRandomizerV0
      */
-    function setPolyptychHashSeed(
-        address _coreContract,
-        uint256 _tokenId,
-        bytes12 _hashSeed
+    function preSetHashSeed(
+        address coreContract,
+        uint256 tokenId,
+        bytes12 hashSeed
     ) external {
-        _onlyHashSeedSetterContract(_coreContract);
-        _polyptychHashSeed[_coreContract][_tokenId] = _hashSeed;
+        uint256 projectId = _tokenIdToProjectId(tokenId);
+        _onlyHashSeedSetterContract({
+            projectId: projectId,
+            coreContract: coreContract
+        });
+        _preAssignedHashSeeds[coreContract][tokenId] = hashSeed;
         // @dev event indicating token hash seed assigned is not required for
         // subgraph indexing because token hash seeds are still assigned
         // atomically in `assignTokenHash` function. If token hash seeds were
@@ -175,71 +180,89 @@ contract SharedRandomizerV0 is ISharedRandomizerV0 {
     /**
      * @inheritdoc IRandomizer_V3CoreBase
      */
-    function assignTokenHash(uint256 _tokenId) external {
-        // @dev this function is callable by any core contract, and does not
-        // does not require any gating.
-        // @dev naming variables for readability
+    function assignTokenHash(uint256 tokenId) external {
+        // @dev This function is not specifically gated to any specific caller,
+        // but will only call back to the calling contract, `msg.sender`, to
+        // set the specified token's hash seed.
+        // A third party contract calling this function will not be able to set
+        // the token hash seed on a different core contract.
+        // @dev variables are named to improve readability
         address coreContract = msg.sender;
-        uint256 projectId = _tokenId / ONE_MILLION;
+        uint256 projectId = _tokenIdToProjectId(tokenId);
         bytes32 hashSeed;
-        if (_projectIsPolyptych[coreContract][projectId]) {
-            hashSeed = _polyptychHashSeed[coreContract][_tokenId];
+        if (_projectUsesHashSeedSetter[coreContract][projectId]) {
+            hashSeed = _preAssignedHashSeeds[coreContract][tokenId];
         } else {
-            hashSeed = _getPseudorandomAtomic(coreContract, _tokenId);
+            hashSeed = _getPseudorandomAtomic({
+                coreContract: coreContract,
+                tokenId: tokenId
+            });
         }
         // verify that the hash seed is non-zero
         require(hashSeed != 0, "Only non-zero hash seed");
         // assign the token hash seed on the core contract
-        IGenArt721CoreContractV3_Base(coreContract).setTokenHash_8PT(
-            _tokenId,
-            hashSeed
-        );
+        IGenArt721CoreContractV3_Base(coreContract).setTokenHash_8PT({
+            _tokenId: tokenId,
+            _hash: hashSeed
+        });
     }
 
     /**
      * @inheritdoc ISharedRandomizerV0
      */
-    function projectIsPolyptych(
-        address _coreContract,
-        uint256 _projectId
-    ) external view returns (bool _isPolyptych) {
-        return _projectIsPolyptych[_coreContract][_projectId];
+    function projectUsesHashSeedSetter(
+        address coreContract,
+        uint256 projectId
+    ) external view returns (bool usingHashSeedSetter) {
+        return _projectUsesHashSeedSetter[coreContract][projectId];
     }
 
     /**
      * @inheritdoc ISharedRandomizerV0
      */
     function hashSeedSetterContracts(
-        address _coreContract
+        address coreContract,
+        uint256 projectId
     ) external view returns (address _hashSeedSetterContract) {
-        return _hashSeedSetterContracts[_coreContract];
+        return _hashSeedSetterContracts[coreContract][projectId];
     }
 
     /**
      * @inheritdoc ISharedRandomizerV0
      */
-    function polyptychHashSeed(
-        address _coreContract,
-        uint256 _tokenId
+    function preAssignedHashSeed(
+        address coreContract,
+        uint256 tokenId
     ) external view returns (bytes12 _hashSeed) {
-        return _polyptychHashSeed[_coreContract][_tokenId];
+        return _preAssignedHashSeeds[coreContract][tokenId];
     }
 
     /**
      * @notice Internal function to atomically obtain a pseudorandom number
      * from the configured pseudorandom contract.
-     * @param _coreContract - The core contract that is requesting an atomic
+     * @param coreContract - The core contract that is requesting an atomic
      * pseudorandom number.
-     * @param _tokenId - The token ID on `_coreContract` that is associated
+     * @param tokenId - The token ID on `coreContract` that is associated
      * with the pseudorandom number request.
      */
     function _getPseudorandomAtomic(
-        address _coreContract,
-        uint256 _tokenId
+        address coreContract,
+        uint256 tokenId
     ) internal view returns (bytes32) {
         return
             pseudorandomAtomicContract.getPseudorandomAtomic(
-                keccak256(abi.encodePacked(_coreContract, _tokenId))
+                keccak256(abi.encodePacked(coreContract, tokenId))
             );
     }
+
+    /**
+     * @notice Gets the project ID for a given `tokenId`.
+     * @param tokenId Token ID to be queried.
+     * @return projectId Project ID for given `tokenId`.
+     */
+    function _tokenIdToProjectId(
+        uint256 tokenId
+    ) internal pure returns (uint256 projectId) {
+        return tokenId / ONE_MILLION;
+    }
 }

package/contracts/royalty-registry/GenArt721RoyaltyOverride.sol

@@ -1,8 +1,8 @@
 // SPDX-License-Identifier: LGPL-3.0-only
 // Created By: Art Blocks Inc.
 
-import "../interfaces/0.8.x/IArtblocksRoyaltyOverride.sol";
-import "../interfaces/0.8.x/IGenArt721CoreContractV3.sol";
+import "../interfaces/v0.8.x/IArtblocksRoyaltyOverride.sol";
+import "../interfaces/v0.8.x/IGenArt721CoreContractV3.sol";
 
 import "@openzeppelin-4.5/contracts/utils/introspection/ERC165.sol";
 

package/contracts/royalty-registry/GenArt721RoyaltyOverride_PBAB.sol

@@ -1,8 +1,8 @@
 // SPDX-License-Identifier: LGPL-3.0-only
 // Created By: Art Blocks Inc.
 
-import "../interfaces/0.8.x/IArtblocksRoyaltyOverride.sol";
-import "../interfaces/0.8.x/IGenArt721CoreV2_PBAB.sol";
+import "../interfaces/v0.8.x/IArtblocksRoyaltyOverride.sol";
+import "../interfaces/v0.8.x/IGenArt721CoreV2_PBAB.sol";
 
 import "@openzeppelin-4.5/contracts/utils/introspection/ERC165.sol";