@crossecute/protocol 0.0.0 → 0.1.0

package/contracts/protocols/ProviderAttribute.sol

@@ -0,0 +1,65 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.0;
+
+/// @notice Parsing for the single selector-prefixed attribute each native binding accepts.
+///         ERC-7786 requires a gateway to refuse any attribute it does not support.
+/// @dev `attributes[0]` is validated in full (selector, length, and for `uintValue` the bound)
+///      before a second attribute is refused, so a malformed first attribute is the one
+///      reported rather than a well-formed extra.
+library ProviderAttribute {
+    error UnsupportedAttribute(bytes attribute);
+
+    /// @notice The bytes after `selector` in the single attribute, or `present == false` when
+    ///         none was given.
+    /// @param bodyLength The exact body length required; zero accepts any length.
+    function body(bytes[] memory attributes, bytes4 selector, uint256 bodyLength)
+        internal
+        pure
+        returns (bool present, bytes memory out)
+    {
+        // forge-lint: disable-next-line(boolean-cst) the `present` flag
+        if (attributes.length == 0) return (false, "");
+        bytes memory attribute = attributes[0];
+        if (
+            attribute.length < 4 || _selectorOf(attribute) != selector
+                || (bodyLength != 0 && attribute.length - 4 != bodyLength)
+        ) revert UnsupportedAttribute(attribute);
+        if (attributes.length > 1) revert UnsupportedAttribute(attributes[1]);
+
+        out = new bytes(attribute.length - 4);
+        for (uint256 i; i < out.length; ++i) {
+            out[i] = attribute[i + 4];
+        }
+        // forge-lint: disable-next-line(boolean-cst) the `present` flag
+        return (true, out);
+    }
+
+    /// @notice The `uint256` in a single `abi.encodePacked(selector, abi.encode(value))`
+    ///         attribute, at most `max`, or `defaultValue` when none was given.
+    function uintValue(bytes[] memory attributes, bytes4 selector, uint256 max, uint256 defaultValue)
+        internal
+        pure
+        returns (uint256 value)
+    {
+        if (attributes.length == 0) return defaultValue;
+        bytes memory attribute = attributes[0];
+        if (attribute.length != 36 || _selectorOf(attribute) != selector) revert UnsupportedAttribute(attribute);
+        assembly {
+            value := mload(add(attribute, 36))
+        }
+        if (value > max) revert UnsupportedAttribute(attribute);
+        if (attributes.length > 1) revert UnsupportedAttribute(attributes[1]);
+    }
+
+    /// @notice For a binding that supports no attribute: the first given is refused.
+    function none(bytes[] memory attributes) internal pure {
+        if (attributes.length != 0) revert UnsupportedAttribute(attributes[0]);
+    }
+
+    /// @dev Callers check `attribute.length >= 4` first.
+    function _selectorOf(bytes memory attribute) private pure returns (bytes4 selector) {
+        assembly {
+            selector := mload(add(attribute, 32))
+        }
+    }
+}

package/contracts/protocols/ProviderChainId.sol

@@ -0,0 +1,115 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.0;
+
+import {Erc7930} from "../addressing/Erc7930.sol";
+
+/// @notice What a transmitter reads from its transceiver. It keeps no table of its own, being
+///         per-user and locked after creation, so every send reads the transceiver's live.
+interface IProviderIdTable {
+    function providerIdFor(bytes32 chainKey) external view returns (uint256);
+}
+
+/// @notice `recipient`'s provider id from `transceiver`'s table, for the caller to narrow to its
+///         width.
+function providerIdOf(address transceiver, bytes memory recipient) view returns (uint256) {
+    return IProviderIdTable(transceiver).providerIdFor(Erc7930.chainKey(recipient));
+}
+
+/// @title ProviderChainId
+/// @notice Maps this protocol's chainKey to a native provider's own id for the same chain
+///         (LayerZero's `uint32` eid, CCIP's `uint64` selector, Hyperlane's `uint32` domain).
+///
+/// @dev Distinct from `ChainRegistry`, which answers a provenance question and has no
+///      bearing here. A gateway binding (ERC-7786) never needs this file either: it's told
+///      the chain by the recipient (see `OutboundBase`'s note on the route slot). Only the
+///      native bindings under `protocols/` use it.
+///
+/// @dev On every binding transceiver whose provider names chains by its own id. For
+///      `op-stack-l1-l2` the id is the address of the messenger that reaches the chain.
+///
+/// @dev Storage is `uint256` so one mapping backs every provider's narrower id type; each
+///      binding's typed setter (`setEid`, `setSelector`, `setDomain`, `setWormholeChain`)
+///      bounds it on the way in, and readers narrow it back.
+///
+/// @dev Write-once-if-unset, same shape as `OutboundBase._setRoute`: re-declaring the same id
+///      is a no-op, a different one reverts, since repointing would silently redirect future
+///      sends to a different remote endpoint.
+///
+/// @dev The reverse index exists because a provider's inbound callback reports the source by
+///      its own id, not our chainKey. It is injective: two chainKeys sharing one provider id
+///      would let an inbound message from either be attributed to the other. Routes get the
+///      same property from `OutboundBase._setRoute`, which requires a route to hash to its key.
+///
+/// @dev Zero is the unset sentinel on both sides, so a provider id of 0 is refused here
+///      (`ZeroProviderId`) and in `deploy/` (`ChainConfig.providerId`).
+///
+/// @dev Internal and ungated, like every other setter on `OutboundBase`: the inheriting
+///      transceiver wraps `_setProviderId` in its own authority.
+abstract contract ProviderChainId is IProviderIdTable {
+    /// chainKey => the provider's own id for that chain. Zero means unset.
+    mapping(bytes32 => uint256) private _providerIds;
+
+    /// The inbound direction: a delivery names its origin by the provider's id, and this is
+    /// the only way back to a chainKey.
+    mapping(uint256 => bytes32) private _chainKeyOfProviderId;
+
+    event ProviderIdSet(bytes32 indexed chainKey, uint256 providerId);
+
+    /// @dev Named distinctly from `OutboundBase.NoDestination`: every binding transceiver
+    ///      inherits both and would otherwise collide on the name.
+    error NoProviderChainKey();
+    error ZeroProviderId();
+    error ProviderIdAlreadySet(bytes32 chainKey);
+    error ProviderIdInUse(uint256 providerId);
+    error NoProviderIdFor(bytes32 chainKey);
+    error UnknownProviderId(uint256 providerId);
+
+    /// @notice Write-once, ungated: the caller applies its own authority. See the
+    ///         contract-level note for why re-declaring the same id is a no-op while a
+    ///         different one reverts.
+    function _setProviderId(bytes32 chainKey, uint256 providerId) internal {
+        if (chainKey == bytes32(0)) revert NoProviderChainKey();
+        if (providerId == 0) revert ZeroProviderId();
+
+        uint256 existing = _providerIds[chainKey];
+        if (existing != 0) {
+            if (existing != providerId) revert ProviderIdAlreadySet(chainKey);
+            return;
+        }
+
+        bytes32 held = _chainKeyOfProviderId[providerId];
+        if (held != bytes32(0) && held != chainKey) revert ProviderIdInUse(providerId);
+
+        _providerIds[chainKey] = providerId;
+        _chainKeyOfProviderId[providerId] = chainKey;
+        emit ProviderIdSet(chainKey, providerId);
+    }
+
+    /// @notice The provider's id for `chainKey`. Reverts when unset.
+    function _providerIdFor(bytes32 chainKey) internal view returns (uint256 providerId) {
+        providerId = _providerIds[chainKey];
+        if (providerId == 0) revert NoProviderIdFor(chainKey);
+    }
+
+    /// @notice The chainKey a provider id refers to (inbound direction). Reverts when unset.
+    function _chainKeyOfProvider(uint256 providerId) internal view returns (bytes32 chainKey) {
+        chainKey = _chainKeyOfProviderId[providerId];
+        if (chainKey == bytes32(0)) revert UnknownProviderId(providerId);
+    }
+
+    /// @notice Whether a provider id is recorded for `chainKey`.
+    function hasProviderId(bytes32 chainKey) public view returns (bool) {
+        return _providerIds[chainKey] != 0;
+    }
+
+    /// @notice See `IProviderIdTable`. Reverts `NoProviderIdFor` when unset; the typed setters
+    ///         are per binding.
+    function providerIdFor(bytes32 chainKey) external view returns (uint256) {
+        return _providerIdFor(chainKey);
+    }
+
+    /// @notice The provider's id for the chain `recipient` is on.
+    function _providerIdOf(bytes memory recipient) internal view returns (uint256) {
+        return _providerIdFor(Erc7930.chainKey(recipient));
+    }
+}

package/contracts/protocols/ProviderReceiver.sol

@@ -0,0 +1,24 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.0;
+
+import {Call} from "../messaging/Call.sol";
+import {ReceiverBase} from "../messaging/inbound/ReceiverBase.sol";
+
+/// @notice A receiver whose only provider setup is naming the provider's delivery contract as
+///         its gateway.
+abstract contract ProviderReceiver is ReceiverBase {
+    /// @dev `_grantInitialRole` is `onlyInitializing`, so this initializer is the only window the
+    ///      gateway grant ever gets. It runs before `__ReceiverBase_init`, which executes the
+    ///      payload.
+    function initialize(address sourceTransmitter_, bytes32 homeOrigin_, Call[] calldata calls)
+        external
+        override
+        initializer
+    {
+        _grantInitialRole(GATEWAY_ROLE, _providerGateway());
+        __ReceiverBase_init(sourceTransmitter_, homeOrigin_, calls);
+    }
+
+    /// @notice The provider contract that delivers to this receiver.
+    function _providerGateway() internal view virtual returns (address);
+}

package/contracts/protocols/ProviderTransceiver.sol

@@ -0,0 +1,48 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.0;
+
+import {TransceiverBase} from "../messaging/transceiver/TransceiverBase.sol";
+import {IReceiverInit} from "../messaging/inbound/ReceiverBase.sol";
+import {ProviderChainId} from "./ProviderChainId.sol";
+import {Call} from "../messaging/Call.sol";
+
+/// @notice What every native binding with a provider chain id shares: the id table, and mapping
+///         a delivery's reported origin back to a route, which `_authenticateOrigin` then
+///         checks like any other.
+abstract contract ProviderTransceiver is TransceiverBase, ProviderChainId {
+    /// @notice Name the provider's own delivery contract as a gateway, for a binding whose
+    ///         entry point checks `GATEWAY_ROLE`.
+    function __ProviderTransceiver_init(address providerGateway) internal onlyInitializing {
+        _grantInitialRole(GATEWAY_ROLE, providerGateway);
+    }
+
+    /// @notice Name the provider's id for the governor's home, so the bootstrap that creates
+    ///         this transceiver's owner can be accepted. Zero leaves it to the owner, which only
+    ///         the governor's home can do.
+    function _initGovernorHomeId(bytes memory governorHome, uint256 providerId) internal onlyInitializing {
+        if (providerId != 0) _setProviderId(keccak256(governorHome), providerId);
+    }
+
+    /// @dev An unmapped `providerId` reverts in `_chainKeyOfProvider`, so a chain this
+    ///      transceiver was never configured for cannot deliver at all.
+    function _onProviderInbound(uint256 providerId, address sender, bytes calldata message) internal {
+        _onInbound(routeFor(_chainKeyOfProvider(providerId)), abi.encodePacked(sender), message);
+    }
+
+    /// @inheritdoc TransceiverBase
+    /// @dev A receiver names its home by the provider's id for it, from the table that admitted
+    ///      the bootstrap, since that is how its deliveries report their origin.
+    function _conduitInitializer(
+        address owner,
+        bytes32 salt,
+        bytes32 homeChainKey,
+        address sourceTransmitter,
+        Call[] memory calls
+    ) internal view virtual override returns (bytes memory) {
+        if (homeChainKey == localChainKey) {
+            return super._conduitInitializer(owner, salt, homeChainKey, sourceTransmitter, calls);
+        }
+        return
+            abi.encodeCall(IReceiverInit.initialize, (sourceTransmitter, bytes32(_providerIdFor(homeChainKey)), calls));
+    }
+}

package/contracts/protocols/layerzero/ILzOftConduitFactory.sol

@@ -0,0 +1,10 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.0;
+
+/// @notice What a `layerzero-oft` conduit reads from the factory that created it, beyond the
+///         views `TransmitterBase` reads from any transceiver.
+interface ILzOftConduitFactory {
+    /// @notice The eid and OFT `conduit` reaches `chainKey` through, as it was created with.
+    /// @dev Reverts for a chain the conduit was not created with.
+    function destinationOf(address conduit, bytes32 chainKey) external view returns (uint32 eid, address oft);
+}

package/contracts/protocols/op-stack/OpStackTransmitterBase.sol

@@ -0,0 +1,11 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.0;
+
+import {OwnableTransmitter} from "../../messaging/outbound/OwnableTransmitter.sol";
+
+/// @notice The fixed outbound fee shared by the two OP Stack bindings.
+abstract contract OpStackTransmitterBase is OwnableTransmitter {
+    function _crossecuteFee(uint256) internal pure override returns (uint256) {
+        return 0.0001 ether;
+    }
+}