@bananapus/address-registry-v6 0.0.19 → 0.0.21

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bananapus/address-registry-v6",
-  "version": "0.0.19",
+  "version": "0.0.21",
   "license": "MIT",
   "repository": {
     "type": "git",

package/script/helpers/AddressRegistryDeploymentLib.sol

@@ -72,6 +72,8 @@ library AddressRegistryDeploymentLib {
         string memory deploymentJson =
         // forge-lint: disable-next-line(unsafe-cheatcode)
         vm.readFile(string.concat(path, projectName, "/", networkName, "/", contractName, ".json"));
-        return stdJson.readAddress({json: deploymentJson, key: ".address"});
+        address deployed = stdJson.readAddress({json: deploymentJson, key: ".address"});
+        require(deployed.code.length != 0, "AddressRegistryDeploymentLib: registry has no code");
+        return deployed;
     }
 }

package/test/audit/CodexUnauthorizedRegistrar.t.sol

@@ -0,0 +1,59 @@
+// SPDX-License-Identifier: MIT
+pragma solidity 0.8.28;
+
+import {Test} from "forge-std/Test.sol";
+
+import {JBAddressRegistry} from "src/JBAddressRegistry.sol";
+
+contract CodexUnauthorizedRegistrarTest is Test {
+    JBAddressRegistry internal registry;
+    address internal deployer = makeAddr("deployer");
+    address internal attacker = makeAddr("attacker");
+
+    function setUp() public {
+        registry = new JBAddressRegistry();
+    }
+
+    function test_attackerCanFinalizeCreateRegistrationForAnotherDeployersContract() external {
+        uint64 nonce = 7;
+        vm.setNonce(deployer, nonce);
+
+        vm.prank(deployer);
+        address deployed = address(new MockDeployment());
+
+        vm.prank(attacker);
+        registry.registerAddress(deployer, nonce);
+
+        assertEq(registry.deployerOf(deployed), deployer, "attacker should be able to write the record");
+
+        vm.prank(deployer);
+        vm.expectRevert(
+            abi.encodeWithSelector(JBAddressRegistry.JBAddressRegistry_AlreadyRegistered.selector, deployed)
+        );
+        registry.registerAddress(deployer, nonce);
+    }
+
+    function test_attackerCanFinalizeCreate2RegistrationForAnotherDeployersContract() external {
+        Create2Factory factory = new Create2Factory();
+        bytes32 salt = keccak256("salt");
+        address deployed = factory.deploy(salt);
+
+        vm.prank(attacker);
+        registry.registerAddress(address(factory), salt, type(MockDeployment).creationCode);
+
+        assertEq(registry.deployerOf(deployed), address(factory), "attacker should be able to write the record");
+
+        vm.expectRevert(
+            abi.encodeWithSelector(JBAddressRegistry.JBAddressRegistry_AlreadyRegistered.selector, deployed)
+        );
+        registry.registerAddress(address(factory), salt, type(MockDeployment).creationCode);
+    }
+}
+
+contract Create2Factory {
+    function deploy(bytes32 salt) external returns (address deployed) {
+        deployed = address(new MockDeployment{salt: salt}());
+    }
+}
+
+contract MockDeployment {}

package/test/audit/DeploymentHelperNonceSideEffect.t.sol

@@ -0,0 +1,47 @@
+// SPDX-License-Identifier: MIT
+pragma solidity 0.8.28;
+
+import {Test} from "forge-std/Test.sol";
+
+import {
+    AddressRegistryDeploymentLib,
+    AddressRegistryDeployment
+} from "../../script/helpers/AddressRegistryDeploymentLib.sol";
+
+/// @notice Wrapper that exposes the library's chain-aware overload.
+contract DeploymentLibAutoCaller {
+    function getDeployment(string memory path) external returns (AddressRegistryDeployment memory) {
+        return AddressRegistryDeploymentLib.getDeployment(path);
+    }
+}
+
+/// @notice Verifies that auto-discovering the network name has an on-chain side effect.
+contract DeploymentHelperNonceSideEffectTest is Test {
+    DeploymentLibAutoCaller internal caller;
+
+    function setUp() public {
+        caller = new DeploymentLibAutoCaller();
+    }
+
+    function test_getDeployment_pathOverloadConsumesCallersCreateNonce() external {
+        address registry = makeAddr("registryContract");
+        vm.etch(registry, hex"6080604052");
+
+        string memory json = string.concat('{"address":"', vm.toString(registry), '"}');
+        string memory dir = "test/audit/tmp-nonce/nana-address-registry-v6/anvil/";
+        string memory file = string.concat(dir, "JBAddressRegistry.json");
+
+        vm.createDir(dir, true);
+        vm.writeFile(file, json);
+
+        uint64 nonceBefore = vm.getNonce(address(caller));
+
+        caller.getDeployment("test/audit/tmp-nonce/");
+
+        uint64 nonceAfter = vm.getNonce(address(caller));
+
+        assertEq(nonceAfter, nonceBefore + 1, "library should deploy SphinxConstants and consume one CREATE nonce");
+
+        vm.removeFile(file);
+    }
+}

package/test/audit/DeploymentHelperValidation.t.sol

@@ -0,0 +1,62 @@
+// SPDX-License-Identifier: MIT
+pragma solidity 0.8.28;
+
+import {Test} from "forge-std/Test.sol";
+import {stdJson} from "forge-std/Script.sol";
+
+import {
+    AddressRegistryDeploymentLib,
+    AddressRegistryDeployment
+} from "../../script/helpers/AddressRegistryDeploymentLib.sol";
+
+/// @notice Wrapper that makes the library's internal functions callable externally so vm.expectRevert works.
+contract DeploymentLibCaller {
+    function getDeployment(
+        string memory path,
+        string memory networkName
+    )
+        external
+        returns (AddressRegistryDeployment memory)
+    {
+        return AddressRegistryDeploymentLib.getDeployment({path: path, networkName: networkName});
+    }
+}
+
+/// @notice Tests M-40: Deployment helper rejects stale artifacts pointing to non-contract addresses.
+contract DeploymentHelperValidationTest is Test {
+    DeploymentLibCaller internal caller;
+
+    function setUp() public {
+        caller = new DeploymentLibCaller();
+    }
+
+    /// @notice Stale deployment artifact pointing to an EOA reverts.
+    function test_deploymentHelper_revertsForEOARegistry() external {
+        address eoa = makeAddr("staleEOA");
+        string memory json = string.concat('{"address":"', vm.toString(eoa), '"}');
+
+        string memory dir = "test/audit/tmp-eoa/nana-address-registry-v6/testnet/";
+        vm.createDir(dir, true);
+        vm.writeFile(string.concat(dir, "JBAddressRegistry.json"), json);
+
+        vm.expectRevert("AddressRegistryDeploymentLib: registry has no code");
+        caller.getDeployment({path: "test/audit/tmp-eoa/", networkName: "testnet"});
+
+        vm.removeFile(string.concat(dir, "JBAddressRegistry.json"));
+    }
+
+    /// @notice Valid deployment artifact with a contract address is accepted.
+    function test_deploymentHelper_acceptsContractRegistry() external {
+        address registry = makeAddr("registryContract");
+        vm.etch(registry, hex"6080604052");
+        string memory json = string.concat('{"address":"', vm.toString(registry), '"}');
+
+        string memory dir = "test/audit/tmp-contract/nana-address-registry-v6/testnet/";
+        vm.createDir(dir, true);
+        vm.writeFile(string.concat(dir, "JBAddressRegistry.json"), json);
+
+        caller.getDeployment({path: "test/audit/tmp-contract/", networkName: "testnet"});
+
+        vm.removeFile(string.concat(dir, "JBAddressRegistry.json"));
+    }
+}