@crossecute/protocol 0.0.0-stage → 0.1.0

package/contracts/messaging/inbound/ReceiverBase.sol

@@ -0,0 +1,359 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.0;
+
+import {Initializable} from "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol";
+import {ReentrancyGuardUpgradeable} from "@openzeppelin/contracts-upgradeable/utils/ReentrancyGuardUpgradeable.sol";
+import {EnumerableMap} from "@openzeppelin/contracts/utils/structs/EnumerableMap.sol";
+import {Call} from "../Call.sol";
+import {Commitment} from "../Commitment.sol";
+import {Erc7930} from "../../addressing/Erc7930.sol";
+import {Executor} from "../Executor.sol";
+import {Payload} from "../Payload.sol";
+import {RolesEnumerable} from "../Roles.sol";
+import {IERC7786Recipient} from "../IErc7786.sol";
+
+/// @notice Two-step execution: approve a hash now, supply the matching array later.
+/// @dev `commit` is gated and `finalize` is not: only an array matching an approved hash does
+///      anything, so whoever relays it is irrelevant.
+interface ICommitFinalize {
+    function commit(bytes32 commitment) external returns (uint256 approvals);
+    function finalize(Call[] calldata calls) external;
+    function finalize(Call[][] calldata batches) external;
+}
+
+/// @notice Withdrawing an approval.
+/// @dev Gated on a receiver by its transmitter, or a payload it is already executing.
+interface ICancel {
+    function cancel(bytes32 commitment) external;
+}
+
+/// @notice One-step execution: run this array, no hash comparison.
+/// @dev `finalize` is permissionless because it checks the array against an approved hash;
+///      `execute` skips the hash, so it is gated on the caller instead. `Call[]` only: an EVM
+///      receiver runs EVM calls, and `Commitment` hashes both element forms to one value.
+interface IExecute {
+    function execute(Call[] calldata calls) external payable;
+}
+
+/// @notice What a transceiver needs from the receiver it creates and reuses.
+interface IReceiverInit is ICommitFinalize, ICancel, IExecute {
+    function initialize(address sourceTransmitter, bytes32 homeOrigin, Call[] calldata calls) external;
+}
+
+/// @title ReceiverBase
+/// @notice The destination-side half. One receiver per transmitter per destination, created
+///         by the transceiver and reused for every payload that transmitter sends.
+///
+/// @dev Approvals are an unordered map of hash to count. A map, so a pending approval never
+///      blocks recording the next; a count, since two identical payloads are two approvals;
+///      unordered, so an unrelayed payload stalls nothing, and a relayer holding two arrays
+///      chooses their order. `cancel` takes the hash, so it cannot go stale like an index.
+///
+/// @dev All state is storage, set in the single-shot `initialize`: immutables would live in
+///      the implementation and be shared by every conduit.
+///
+/// @dev `Commitment.hashCalls` seeds with `ChainKey.local()`, so an array approved for one
+///      chain cannot be finalized on another where the same conduit address exists.
+///
+/// @dev Uses OZ 5.4's `ReentrancyGuardUpgradeable`, whose state is ERC-7201 namespaced; 5.4's
+///      plain `ReentrancyGuard` would take a sequential slot. `__ReceiverBase_init` starts it
+///      before any payload runs. The guard covers `_onMessage`, both `finalize` overloads, and
+///      `execute` under one lock.
+abstract contract ReceiverBase is
+    Initializable,
+    Executor,
+    RolesEnumerable,
+    ReentrancyGuardUpgradeable,
+    IReceiverInit,
+    IERC7786Recipient
+{
+    using EnumerableMap for EnumerableMap.Bytes32ToUintMap;
+
+    /// @notice The outstanding approvals: commitment => how many times it may still be
+    ///         finalized.
+    /// @dev Enumerable, so what is outstanding can be read on-chain. Each `finalize`
+    ///      decrements, and the entry leaves the map at zero.
+    EnumerableMap.Bytes32ToUintMap private _commitments;
+
+    /// The transmitter this receiver answers to. Set once, at initialization.
+    address public sourceTransmitter;
+    /// The transceiver that created this receiver. Not `transceiver`, which on
+    /// `TransmitterBase` means the other direction.
+    address public parentTransceiver;
+    /// The conduit's home as the transport names an origin: the provider's id for it, or its
+    /// chainKey over an ERC-7786 gateway. Set once, at initialization.
+    /// @dev The transmitter's address on another chain is not always this conduit's, and where
+    ///      the provider's transceiver is not yet deployed its deployer can place code there; no
+    ///      message is sent to such a chain until the registry marks the transceiver live.
+    bytes32 public homeOrigin;
+
+    event ReceiverInitialized(address indexed sourceTransmitter, address indexed transceiver);
+    event ReceiverExecuted(address indexed caller, uint256 callCount);
+    event Committed(bytes32 indexed commitment, uint256 outstanding);
+    event Finalized(bytes32 indexed commitment, uint256 remaining, uint256 callCount);
+    /// @dev A payload that ran on arrival, as distinct from one a commitment discharged or a
+    ///      gated entry point drove locally.
+    event Delivered(uint256 callCount);
+    /// @dev Carries what was dropped, since cancelling removes every outstanding copy.
+    event Cancelled(bytes32 indexed commitment, uint256 dropped);
+
+    error NotSourceTransmitter();
+    error ZeroTransmitter();
+    error ZeroHomeOrigin();
+    /// @dev The message came from a chain other than this conduit's home.
+    error NotHomeOrigin(bytes32 origin);
+    /// @dev No approval matches the array supplied.
+    error CommitmentMismatch();
+    /// @dev Nothing outstanding under that hash. Refused rather than a no-op, since success
+    ///      would suggest a payload was stopped that may already have run.
+    error NotCommitted(bytes32 commitment);
+    /// @dev Zero would make "committed" indistinguishable from "never committed".
+    error ZeroCommitment();
+    error EmptyBatch();
+    /// @dev The sender envelope's address half is not 20 bytes, so it cannot be an EVM
+    ///      transmitter.
+    error UnauthenticatedSender(bytes sender);
+
+    /// @notice Whether `conduit` is the transmitter this receiver was created for.
+    function isSourceTransmitter(address conduit) public view returns (bool) {
+        return conduit != address(0) && conduit == sourceTransmitter;
+    }
+
+    /// @notice Who may drive this receiver: its transmitter, and a payload it is executing.
+    ///
+    /// @dev Not the transceiver: after initialization it has no authority here, so one
+    ///      compromised transceiver cannot drive every conduit it created.
+    ///
+    /// @dev `address(this)` lets a deferred payload call this receiver's own `commit`. Only
+    ///      `_execute` can produce it, reachable from an authenticated inbound message or a
+    ///      gated entry point. Stated explicitly because receiver and transmitter addresses
+    ///      differ on zkSync and Tron.
+    function isAuthorizedCaller(address conduit) public view returns (bool) {
+        return conduit == address(this) || isSourceTransmitter(conduit);
+    }
+
+    modifier onlySourceTransmitter() {
+        if (!isAuthorizedCaller(msg.sender)) revert NotSourceTransmitter();
+        _;
+    }
+
+    /* ================================ initializing ============================== */
+
+    /// @notice Bind this conduit to its transmitter and run the payload it was created for.
+    /// @dev For a binding that needs no setup of its own; one that does declares its own
+    ///      `initialize` and calls `__ReceiverBase_init` last.
+    function initialize(address sourceTransmitter_, bytes32 homeOrigin_, Call[] calldata calls)
+        external
+        virtual
+        override
+        initializer
+    {
+        __ReceiverBase_init(sourceTransmitter_, homeOrigin_, calls);
+    }
+
+    /// @notice The work behind `initialize`: bind, then run the bootstrap calls.
+    ///
+    /// @dev Runs the calls rather than recording a commitment; a payload that should wait
+    ///      carries a self-call to `commit`. An empty array is allowed here, unlike in
+    ///      `execute`, since creating the receiver is the intent.
+    ///
+    /// @dev Separate so a binding can configure its provider before the payload runs, from
+    ///      inside its own `initializer` and ahead of this call; `super.initialize` would run the
+    ///      payload first. The transceiver's reach into a receiver ends here.
+    function __ReceiverBase_init(address sourceTransmitter_, bytes32 homeOrigin_, Call[] calldata calls)
+        internal
+        onlyInitializing
+    {
+        if (sourceTransmitter_ == address(0)) revert ZeroTransmitter();
+        if (homeOrigin_ == bytes32(0)) revert ZeroHomeOrigin();
+
+        // First, so the guard is live before the payload at the end of this function runs.
+        __ReentrancyGuard_init();
+
+        sourceTransmitter = sourceTransmitter_;
+        homeOrigin = homeOrigin_;
+        parentTransceiver = msg.sender;
+        emit ReceiverInitialized(sourceTransmitter_, msg.sender);
+        if (calls.length != 0) _execute(calls);
+    }
+
+    /// @notice Stop trusting a transport this receiver was armed with.
+    ///
+    /// @dev The only membership change after initialization anywhere, and it only subtracts:
+    ///      `grantRole` is `onlyInitializing`, and `Proxy` arms once, so a dropped
+    ///      transport is never replaced. A gateway that can deliver can forge, so going deaf is
+    ///      the recoverable failure.
+    ///
+    /// @dev A transceiver has no equivalent: it is shared by every owner on its chain.
+    function revokeGateway(address gateway) external onlySourceTransmitter {
+        _revokeRole(GATEWAY_ROLE, gateway);
+    }
+
+    /* ================================== approving =============================== */
+
+    /// @notice Approve the hash of a call array, to be executed later by anyone.
+    /// @dev The same hash may be approved twice; each approval needs its own `finalize`.
+    /// @return approvals How many times this hash may now be finalized.
+    function commit(bytes32 commitment_) external override onlySourceTransmitter returns (uint256 approvals) {
+        if (commitment_ == bytes32(0)) revert ZeroCommitment();
+
+        (, uint256 held) = _commitments.tryGet(commitment_);
+        approvals = held + 1;
+        _commitments.set(commitment_, approvals);
+        emit Committed(commitment_, approvals);
+    }
+
+    /// @notice Withdraw an approval so it can never be finalized.
+    /// @dev Gated like `commit`, which already lets the caller approve any array. Drops every
+    ///      copy: a wrong payload is wrong in every copy, and re-approving is one `commit`
+    ///      away. An absent approval reverts, since success would suggest a payload was stopped
+    ///      that may have run.
+    function cancel(bytes32 commitment_) external virtual override onlySourceTransmitter {
+        (bool held, uint256 dropped) = _commitments.tryGet(commitment_);
+        if (!held) revert NotCommitted(commitment_);
+
+        _commitments.remove(commitment_);
+        emit Cancelled(commitment_, dropped);
+    }
+
+    /* ================================= finalizing =============================== */
+
+    /// @notice Supply an approved array, and run it.
+    ///
+    /// @dev Ungated: only an array matching an outstanding commitment does anything, which lets
+    ///      a third party pay the gas. It discharges the approval the array hashes to.
+    ///
+    /// @dev `Commitment` hashes `Call[]` and the equivalent opaque elements to one value, so an
+    ///      approval made over `bytes[]` is discharged by the typed array.
+    function finalize(Call[] calldata calls) external override nonReentrant {
+        _finalize(calls);
+    }
+
+    /// @notice Discharge several approvals in one transaction, in the order given.
+    /// @dev All or nothing, since each entry is decremented before its payload runs.
+    function finalize(Call[][] calldata batches) external override nonReentrant {
+        uint256 n = batches.length;
+        if (n == 0) revert EmptyBatch();
+        for (uint256 i; i < n; ++i) {
+            _finalize(batches[i]);
+        }
+    }
+
+    /// @dev `Commitment.hashCalls` seeds with `ChainKey.local()`, so an array approved for
+    ///      another chain hashes to a value this map does not hold. The decrement happens
+    ///      before `_execute`, so a re-entrant `finalize` of the same array finds it spent.
+    function _finalize(Call[] calldata calls) private {
+        bytes32 pending = Commitment.hashCalls(calls);
+
+        (bool held, uint256 approvals) = _commitments.tryGet(pending);
+        if (!held) revert CommitmentMismatch();
+
+        uint256 remaining = approvals - 1;
+        if (remaining == 0) {
+            _commitments.remove(pending);
+        } else {
+            _commitments.set(pending, remaining);
+        }
+
+        emit Finalized(pending, remaining, calls.length);
+        _execute(calls);
+    }
+
+    /// @notice Run these calls now, with no commitment and no hash comparison.
+    ///
+    /// @dev Grants nothing `commit` does not: the transmitter can already approve any array
+    ///      and let anyone finalize it. `commit`, `cancel`, and `execute` share one gate.
+    ///
+    /// @dev Leaves pending commitments alone; each still needs its own `finalize`.
+    function execute(Call[] calldata calls) external payable virtual onlySourceTransmitter nonReentrant {
+        if (calls.length == 0) revert EmptyExecution();
+        emit ReceiverExecuted(msg.sender, calls.length);
+        _execute(calls);
+    }
+
+    /* ============================== approval reads ============================== */
+
+    /// @notice How many times `commitment_` may still be finalized. Zero means never.
+    function outstanding(bytes32 commitment_) public view returns (uint256) {
+        (, uint256 held) = _commitments.tryGet(commitment_);
+        return held;
+    }
+
+    /// @notice Whether `commitment_` has an approval left.
+    function isCommitted(bytes32 commitment_) public view returns (bool) {
+        return _commitments.contains(commitment_);
+    }
+
+    /// @notice Every outstanding approval.
+    /// @dev The order is not stable: discharging one swaps the last entry into its place.
+    function commitments() external view returns (bytes32[] memory hashes) {
+        uint256 n = _commitments.length();
+        hashes = new bytes32[](n);
+        for (uint256 i; i < n; ++i) {
+            (hashes[i],) = _commitments.at(i);
+        }
+    }
+
+    /// @notice How many distinct approvals are outstanding: a hash approved twice counts once
+    ///         here and twice in `outstanding`.
+    function pendingCount() external view returns (uint256) {
+        return _commitments.length();
+    }
+
+    /* ================================== delivery ================================ */
+
+    /// @notice ERC-7786 delivery: the gateway hands over an authenticated message.
+    ///
+    /// @dev Both checks are required on an `external` entry point: the gateway role says the
+    ///      transport is trusted, and `_onMessageFrom` requires the sender to be this
+    ///      receiver's own transmitter on its home, so a shared gateway cannot land one
+    ///      conduit's payload in another's receiver. Compared against the stored
+    ///      `sourceTransmitter`, not `address(this)`, mirroring
+    ///      `TransmitterBase._requireOwnRecipient`.
+    ///
+    /// @dev `receiveId` is ignored: nothing here correlates messages, and replay is the
+    ///      transport's to prevent (`docs/provider-spec.md` R3.5).
+    function receiveMessage(bytes32, bytes calldata sender, bytes calldata payload)
+        external
+        payable
+        override
+        onlyRole(GATEWAY_ROLE)
+        returns (bytes4)
+    {
+        Erc7930.Interop memory io = Erc7930.parseStrict(sender);
+        if (io.addr.length != 20) revert UnauthenticatedSender(sender);
+        // forge-lint: disable-next-line(unsafe-typecast) length checked above
+        _onMessageFrom(Erc7930.chainKey(sender), address(bytes20(io.addr)), payload);
+        return IERC7786Recipient.receiveMessage.selector;
+    }
+
+    /// @notice Deliver `payload` if `origin` and `sender`, as the provider reported them, are
+    ///         this conduit's home and its transmitter there.
+    /// @param origin The source chain in `homeOrigin`'s naming.
+    function _onMessageFrom(bytes32 origin, address sender, bytes calldata payload) internal {
+        if (origin != homeOrigin) revert NotHomeOrigin(origin);
+        if (!isSourceTransmitter(sender)) revert NotSourceTransmitter();
+        _onMessage(payload);
+    }
+
+    /// @notice Run a payload that arrived over the wire.
+    ///
+    /// @dev Decoded here, not by the binding. It runs inside the delivery callback, so a
+    ///      reverting payload fails the message, which every provider lets anyone re-execute.
+    ///      A payload that should wait carries a self-call to `commit`; nothing on the wire
+    ///      distinguishes it.
+    ///
+    /// @dev `nonReentrant`, shared with `finalize`, since it calls arbitrary targets from a
+    ///      provider callback.
+    function _onMessage(bytes calldata payload) internal nonReentrant {
+        Call[] memory calls = Payload.decodeCalls(payload);
+        emit Delivered(calls.length);
+        _execute(calls);
+    }
+
+    /// @notice Accept ETH, so a receiver can be funded ahead of a `finalize` that spends it.
+    /// @dev `finalize` is permissionless and carries no value, so a payload with value
+    ///      finalized by a third party spends this balance. The address is known before the
+    ///      receiver exists, so a shortfall is fixed by topping up and retrying.
+    receive() external payable {}
+}

package/contracts/messaging/outbound/OutboundBase.sol

@@ -0,0 +1,221 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.0;
+
+import {Erc7930} from "../../addressing/Erc7930.sol";
+import {ChainKey} from "../../addressing/ChainKey.sol";
+
+/// @title OutboundBase
+/// @notice The sending half: who this contract's counterpart is on each chain, how to
+///         address it, and the two primitives that put a message on the wire.
+///
+/// @dev Split from `TransmitterBase` because a transceiver needs the mechanics but must not
+///      have a conduit's owner. The setters are `internal` and ungated; each side wraps them
+///      in its own authority (`onlyOwner` on a transceiver, `onlyConduitOwner` on a conduit).
+///
+/// @dev One table serves every sender: an ERC-7930 recipient is the route (chain) joined to
+///      the counterpart (address). A transceiver's counterpart is the provider's transceiver
+///      on that chain, and a conduit's is its own receiver, stored rather than assumed equal
+///      to this address, which is wrong wherever the CREATE2 formula differs from Ethereum's.
+///
+/// @dev Leads the inheritance list on `TransmitterBase` and `TransceiverBase`, so its fields
+///      take the first slots of both layouts (R8.2). `ReceiverBase` does not inherit it.
+///
+/// @dev Entry points validate their arguments and call `_sendMessage` directly. A gateway
+///      source emits `MessageSent`; path B is not one, so `TransceiverBase` emits
+///      `BootstrapSent` instead.
+abstract contract OutboundBase {
+    /// chainKey => that chain's canonical ERC-7930 chain identifier.
+    /// @dev Held by the sender, not the registry: on the execute-on-arrival path nothing else
+    ///      binds the destination, so a registry that could misroute could run a payload on
+    ///      the wrong chain.
+    mapping(bytes32 => bytes) private _routes;
+
+    /// chainKey => this contract's counterpart there, in that chain's own address format.
+    /// @dev Raw bytes: the counterpart is not at this address on zkSync or Tron, and a 32-byte
+    ///      Solana or Move key cannot be narrowed to 20.
+    mapping(bytes32 => bytes) private _counterparts;
+
+    event RouteSet(bytes32 indexed chainKey, bytes route);
+    event CounterpartSet(bytes32 indexed chainKey, bytes counterpart);
+
+    error NoDestination();
+    error EmptyPayload();
+    error ZeroRoute();
+    error ZeroCounterpart();
+    error NoRouteFor(bytes32 chainKey);
+    /// @dev The route is not the canonical chain identifier that `chainKey` hashes from.
+    error RouteKeyMismatch(bytes32 chainKey);
+    error UnknownRoute();
+    error NoCounterpartFor(bytes32 chainKey);
+    /// @dev For a binding whose provider cannot quote on-chain (P9). Zero would read as free.
+    error QuoteNotImplemented();
+
+    /* ================================== routing ================================ */
+
+    /// @notice Record how a destination chain is named. Write-once and ungated: the caller
+    ///         applies its own authority.
+    ///
+    /// @dev The route must be the chain's canonical ERC-7930 chain identifier, and
+    ///      `keccak256(route)` must be the chainKey: otherwise the reverse index would
+    ///      attribute one chain's messages to another, and a conduit homed there would be
+    ///      looked for under the wrong key (#25). A key therefore has exactly one valid route,
+    ///      which makes the table write-once and injective without further checks: re-writing
+    ///      it is a no-op, and any other route for the key is refused above.
+    function _setRoute(bytes32 chainKey, bytes memory route) internal {
+        if (chainKey == bytes32(0)) revert NoDestination();
+        if (route.length == 0) revert ZeroRoute();
+        _requireNames(route, chainKey);
+
+        if (_routes[chainKey].length != 0) return;
+
+        _routes[chainKey] = route;
+        emit RouteSet(chainKey, route);
+    }
+
+    /// @notice Refuse `route` unless it is the canonical bare chain identifier `chainKey` hashes
+    ///         from.
+    /// @dev `fromIdentifier` parses strictly and reduces to the bare identifier, so both together
+    ///      admit only the canonical bare form, which is how an inbound route arrives.
+    function _requireNames(bytes memory route, bytes32 chainKey) internal pure {
+        if (keccak256(route) != chainKey || ChainKey.fromIdentifier(route) != chainKey) {
+            revert RouteKeyMismatch(chainKey);
+        }
+    }
+
+    /// @notice Record this contract's counterpart on a chain. Ungated: the caller applies its
+    ///         own authority and decides whether a second write is allowed.
+    /// @dev Rebindable here, unlike a route: a counterpart names one address on an
+    ///      already-fixed chain, and on a chain this one cannot recompute it is learned after
+    ///      the fact.
+    function _setCounterpart(bytes32 chainKey, bytes memory counterpart) internal {
+        if (chainKey == bytes32(0)) revert NoDestination();
+        if (counterpart.length == 0) revert ZeroCounterpart();
+
+        _counterparts[chainKey] = counterpart;
+        emit CounterpartSet(chainKey, counterpart);
+    }
+
+    /// @notice The chain a route refers to: its hash, provided that route is configured here.
+    function chainKeyOfRoute(bytes memory route) public view returns (bytes32 chainKey) {
+        chainKey = keccak256(route);
+        if (_routes[chainKey].length == 0) revert UnknownRoute();
+    }
+
+    /// @notice How a chain is named here. Reverts when unset.
+    function routeFor(bytes32 chainKey) public view returns (bytes memory route) {
+        route = _routes[chainKey];
+        if (route.length == 0) revert NoRouteFor(chainKey);
+    }
+
+    function hasRoute(bytes32 chainKey) public view returns (bool) {
+        return _routes[chainKey].length != 0;
+    }
+
+    function hasCounterpart(bytes32 chainKey) public view returns (bool) {
+        return _counterparts[chainKey].length != 0;
+    }
+
+    /// @notice How the chain itself is named.
+    function _routeTo(bytes32 chainKey) internal view virtual returns (bytes memory) {
+        return routeFor(chainKey);
+    }
+
+    /// @notice Where the counterpart lives.
+    /// @dev A transceiver overrides it to apply the registry's provenance bar, and to answer its
+    ///      own address on a `Predetermined` chain with no counterpart recorded; see
+    ///      `TransceiverBase`.
+    function _counterpartOn(bytes32 chainKey) internal view virtual returns (bytes memory counterpart) {
+        counterpart = _counterparts[chainKey];
+        if (counterpart.length == 0) revert NoCounterpartFor(chainKey);
+    }
+
+    /// @notice Where this contract's counterpart lives on `chainKey`.
+    function counterpartOn(bytes32 chainKey) public view returns (bytes memory) {
+        return _counterpartOn(chainKey);
+    }
+
+    /// @notice The chain identifier `chainKey` is configured under.
+    function routeTo(bytes32 chainKey) public view returns (bytes memory) {
+        return _routeTo(chainKey);
+    }
+
+    /// @notice Revert unless this contract has both a counterpart it trusts and a route on
+    ///         `chainKey`.
+    /// @dev Called for its reverts; both lookups' values are discarded.
+    function _requireRoutable(bytes32 chainKey) internal view {
+        _counterpartOn(chainKey);
+        _routeTo(chainKey);
+    }
+
+    /// @notice The counterpart on `chainKey`, as the ERC-7930 address an ERC-7786 gateway
+    ///         takes as a recipient.
+    /// @dev Runs both lookups, so building a recipient enforces whatever bar each applies.
+    function _recipientOn(bytes32 chainKey) internal view returns (bytes memory) {
+        Erc7930.Interop memory io = Erc7930.parseStrict(_routeTo(chainKey));
+        return Erc7930.encode(io.chainType, io.chainRef, _counterpartOn(chainKey));
+    }
+
+    /* ================================== sending ================================ */
+
+    /// @notice Where a provider's excess fee goes back to: whoever paid it.
+    /// @dev On a transceiver's `bootstrap` that is `msg.sender`, the only conduit it accepts.
+    ///      Never the transceiver's `address(this)`, which would pool every user's excess.
+    ///      `TransmitterBase` pays from its own balance and overrides this to itself, as
+    ///      `TransceiverBase` does while a report pays from its float.
+    function _refundTo() internal view virtual returns (address) {
+        return msg.sender;
+    }
+
+    /// @notice Put the payload on the wire. No default, so a binding that omits it does not
+    ///         compile.
+    ///
+    /// @dev One primitive for every channel: a payload to a conduit, a bootstrap to a transceiver,
+    ///      and a receiver report home are all `bytes` to an ERC-7930 address.
+    ///
+    /// @dev Spend `value`, never `msg.value`. On a transmitter `value` is the quote and
+    ///      `msg.value` only tops up the balance; a transceiver takes a bootstrap fee off the top; on
+    ///      a nested send `msg.value` is zero.
+    ///
+    /// @param attributes Selector-prefixed values the gateway understands; it must refuse one
+    ///        it does not (see `supportsAttribute`).
+    /// @return sendId Zero once the provider has the message, ERC-7786's "sent"; never the
+    ///         provider's own message id. Over an ERC-7786 gateway it is that gateway's, and a
+    ///         non-zero one is a further step the binding either performs or refuses.
+    function _sendMessage(bytes memory recipient, bytes memory payload, bytes[] memory attributes, uint256 value)
+        internal
+        virtual
+        returns (bytes32 sendId);
+
+    /// @notice The destination gas `payload` is sent with when its attributes name none.
+    /// @dev A function of the payload alone, so a quote and its send always agree.
+    function _defaultGas(bytes memory payload) internal pure virtual returns (uint256);
+
+    /// @notice What `_sendMessage` would cost, in this chain's native currency.
+    ///
+    /// @dev ERC-7786 defines no quote. It is `view` so it can be `eth_call`ed before the send,
+    ///      and takes the built `payload` and the send's arguments, since providers price the
+    ///      exact bytes. A provider that also takes its own token is quoted on the native path.
+    ///
+    /// @dev `_sendMessage` never consults it. A transmitter's entry points call it in the same
+    ///      transaction as the send and pay exactly the answer, so it has no time to go stale.
+    ///      A transceiver's receiver report does the same.
+    function _quoteMessage(bytes memory recipient, bytes memory payload, bytes[] memory attributes)
+        internal
+        view
+        virtual
+        returns (uint256 nativeFee);
+
+    /// @notice What sending `payload` to `recipient` would cost, in this chain's native
+    ///         currency.
+    /// @dev On every sender, not only conduits: a transceiver's receiver report is paid from
+    ///      its float, which someone has to price in order to fund. Ungated, since it spends
+    ///      and writes nothing; `TransmitterBase` overrides it to apply its send's checks.
+    function quoteMessage(bytes calldata recipient, bytes calldata payload, bytes[] calldata attributes)
+        external
+        view
+        virtual
+        returns (uint256 nativeFee)
+    {
+        return _quoteMessage(recipient, payload, attributes);
+    }
+}

package/contracts/messaging/outbound/OwnableTransmitter.sol

@@ -0,0 +1,23 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.20;
+
+import {TransmitterBase} from "./TransmitterBase.sol";
+import {OwnableUpgradeable} from "@openzeppelin/contracts-upgradeable/access/OwnableUpgradeable.sol";
+
+/// @notice `TransmitterBase` with OpenZeppelin's `Ownable` as its authority, which every
+///         binding uses. `TransmitterBase` itself stays ownership-agnostic (see its note).
+abstract contract OwnableTransmitter is TransmitterBase, OwnableUpgradeable {
+    /// @dev The `ITransmitterInit` shape `TransceiverBase` encodes.
+    function initialize(address owner_, address transceiver_, bytes32 salt_) external virtual initializer {
+        __OwnableTransmitter_init(owner_, transceiver_, salt_);
+    }
+
+    function __OwnableTransmitter_init(address owner_, address transceiver_, bytes32 salt_) internal onlyInitializing {
+        __Ownable_init(owner_);
+        __TransmitterBase_init(owner_, transceiver_, salt_);
+    }
+
+    function _checkOwner() internal view virtual override(TransmitterBase, OwnableUpgradeable) {
+        OwnableUpgradeable._checkOwner();
+    }
+}