@bananapus/address-registry-v6 0.0.20 → 0.0.21

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bananapus/address-registry-v6",
-  "version": "0.0.20",
+  "version": "0.0.21",
   "license": "MIT",
   "repository": {
     "type": "git",

package/test/audit/CodexUnauthorizedRegistrar.t.sol

@@ -0,0 +1,59 @@
+// SPDX-License-Identifier: MIT
+pragma solidity 0.8.28;
+
+import {Test} from "forge-std/Test.sol";
+
+import {JBAddressRegistry} from "src/JBAddressRegistry.sol";
+
+contract CodexUnauthorizedRegistrarTest is Test {
+    JBAddressRegistry internal registry;
+    address internal deployer = makeAddr("deployer");
+    address internal attacker = makeAddr("attacker");
+
+    function setUp() public {
+        registry = new JBAddressRegistry();
+    }
+
+    function test_attackerCanFinalizeCreateRegistrationForAnotherDeployersContract() external {
+        uint64 nonce = 7;
+        vm.setNonce(deployer, nonce);
+
+        vm.prank(deployer);
+        address deployed = address(new MockDeployment());
+
+        vm.prank(attacker);
+        registry.registerAddress(deployer, nonce);
+
+        assertEq(registry.deployerOf(deployed), deployer, "attacker should be able to write the record");
+
+        vm.prank(deployer);
+        vm.expectRevert(
+            abi.encodeWithSelector(JBAddressRegistry.JBAddressRegistry_AlreadyRegistered.selector, deployed)
+        );
+        registry.registerAddress(deployer, nonce);
+    }
+
+    function test_attackerCanFinalizeCreate2RegistrationForAnotherDeployersContract() external {
+        Create2Factory factory = new Create2Factory();
+        bytes32 salt = keccak256("salt");
+        address deployed = factory.deploy(salt);
+
+        vm.prank(attacker);
+        registry.registerAddress(address(factory), salt, type(MockDeployment).creationCode);
+
+        assertEq(registry.deployerOf(deployed), address(factory), "attacker should be able to write the record");
+
+        vm.expectRevert(
+            abi.encodeWithSelector(JBAddressRegistry.JBAddressRegistry_AlreadyRegistered.selector, deployed)
+        );
+        registry.registerAddress(address(factory), salt, type(MockDeployment).creationCode);
+    }
+}
+
+contract Create2Factory {
+    function deploy(bytes32 salt) external returns (address deployed) {
+        deployed = address(new MockDeployment{salt: salt}());
+    }
+}
+
+contract MockDeployment {}

package/test/audit/DeploymentHelperNonceSideEffect.t.sol

@@ -0,0 +1,47 @@
+// SPDX-License-Identifier: MIT
+pragma solidity 0.8.28;
+
+import {Test} from "forge-std/Test.sol";
+
+import {
+    AddressRegistryDeploymentLib,
+    AddressRegistryDeployment
+} from "../../script/helpers/AddressRegistryDeploymentLib.sol";
+
+/// @notice Wrapper that exposes the library's chain-aware overload.
+contract DeploymentLibAutoCaller {
+    function getDeployment(string memory path) external returns (AddressRegistryDeployment memory) {
+        return AddressRegistryDeploymentLib.getDeployment(path);
+    }
+}
+
+/// @notice Verifies that auto-discovering the network name has an on-chain side effect.
+contract DeploymentHelperNonceSideEffectTest is Test {
+    DeploymentLibAutoCaller internal caller;
+
+    function setUp() public {
+        caller = new DeploymentLibAutoCaller();
+    }
+
+    function test_getDeployment_pathOverloadConsumesCallersCreateNonce() external {
+        address registry = makeAddr("registryContract");
+        vm.etch(registry, hex"6080604052");
+
+        string memory json = string.concat('{"address":"', vm.toString(registry), '"}');
+        string memory dir = "test/audit/tmp-nonce/nana-address-registry-v6/anvil/";
+        string memory file = string.concat(dir, "JBAddressRegistry.json");
+
+        vm.createDir(dir, true);
+        vm.writeFile(file, json);
+
+        uint64 nonceBefore = vm.getNonce(address(caller));
+
+        caller.getDeployment("test/audit/tmp-nonce/");
+
+        uint64 nonceAfter = vm.getNonce(address(caller));
+
+        assertEq(nonceAfter, nonceBefore + 1, "library should deploy SphinxConstants and consume one CREATE nonce");
+
+        vm.removeFile(file);
+    }
+}