@hyperlane-xyz/core 0.5.0-beta0

package/contracts/upgrade/UpgradeBeaconProxy.sol

@@ -0,0 +1,176 @@
+// SPDX-License-Identifier: MIT
+pragma solidity >=0.8.0;
+
+// ============ External Imports ============
+import {Address} from "@openzeppelin/contracts/utils/Address.sol";
+
+/**
+ * @title UpgradeBeaconProxy
+ * @notice
+ * Proxy contract which delegates all logic, including initialization,
+ * to an implementation contract.
+ * The implementation contract is stored within an Upgrade Beacon contract;
+ * the implementation contract can be changed by performing an upgrade on the Upgrade Beacon contract.
+ * The Upgrade Beacon contract for this Proxy is immutably specified at deployment.
+ * @dev This implementation combines the gas savings of keeping the UpgradeBeacon address outside of contract storage
+ * found in 0age's implementation:
+ * https://github.com/dharma-eng/dharma-smart-wallet/blob/master/contracts/proxies/smart-wallet/UpgradeBeaconProxyV1.sol
+ * With the added safety checks that the UpgradeBeacon and implementation are contracts at time of deployment
+ * found in OpenZeppelin's implementation:
+ * https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/proxy/beacon/BeaconProxy.sol
+ */
+contract UpgradeBeaconProxy {
+    // ============ Immutables ============
+
+    // Upgrade Beacon address is immutable (therefore not kept in contract storage)
+    address private immutable upgradeBeacon;
+
+    // ============ Constructor ============
+
+    /**
+     * @notice Validate that the Upgrade Beacon is a contract, then set its
+     * address immutably within this contract.
+     * Validate that the implementation is also a contract,
+     * Then call the initialization function defined at the implementation.
+     * The deployment will revert and pass along the
+     * revert reason if the initialization function reverts.
+     * @param _upgradeBeacon Address of the Upgrade Beacon to be stored immutably in the contract
+     * @param _initializationCalldata Calldata supplied when calling the initialization function
+     */
+    constructor(address _upgradeBeacon, bytes memory _initializationCalldata)
+        payable
+    {
+        // Validate the Upgrade Beacon is a contract
+        require(Address.isContract(_upgradeBeacon), "beacon !contract");
+        // set the Upgrade Beacon
+        upgradeBeacon = _upgradeBeacon;
+        // Validate the implementation is a contract
+        address _implementation = _getImplementation(_upgradeBeacon);
+        require(
+            Address.isContract(_implementation),
+            "beacon implementation !contract"
+        );
+        // Call the initialization function on the implementation
+        if (_initializationCalldata.length > 0) {
+            _initialize(_implementation, _initializationCalldata);
+        }
+    }
+
+    // ============ External Functions ============
+
+    /**
+     * @notice Forwards all calls with data to _fallback()
+     * No public functions are declared on the contract, so all calls hit fallback
+     */
+    fallback() external payable {
+        _fallback();
+    }
+
+    /**
+     * @notice Forwards all calls with no data to _fallback()
+     */
+    receive() external payable {
+        _fallback();
+    }
+
+    // ============ Private Functions ============
+
+    /**
+     * @notice Call the initialization function on the implementation
+     * Used at deployment to initialize the proxy
+     * based on the logic for initialization defined at the implementation
+     * @param _implementation - Contract to which the initalization is delegated
+     * @param _initializationCalldata - Calldata supplied when calling the initialization function
+     */
+    function _initialize(
+        address _implementation,
+        bytes memory _initializationCalldata
+    ) private {
+        // Delegatecall into the implementation, supplying initialization calldata.
+        (bool _ok, ) = _implementation.delegatecall(_initializationCalldata);
+        // Revert and include revert data if delegatecall to implementation reverts.
+        if (!_ok) {
+            assembly {
+                returndatacopy(0, 0, returndatasize())
+                revert(0, returndatasize())
+            }
+        }
+    }
+
+    /**
+     * @notice Delegates function calls to the implementation contract returned by the Upgrade Beacon
+     */
+    function _fallback() private {
+        _delegate(_getImplementation());
+    }
+
+    /**
+     * @notice Delegate function execution to the implementation contract
+     * @dev This is a low level function that doesn't return to its internal
+     * call site. It will return whatever is returned by the implementation to the
+     * external caller, reverting and returning the revert data if implementation
+     * reverts.
+     * @param _implementation - Address to which the function execution is delegated
+     */
+    function _delegate(address _implementation) private {
+        assembly {
+            // Copy msg.data. We take full control of memory in this inline assembly
+            // block because it will not return to Solidity code. We overwrite the
+            // Solidity scratch pad at memory position 0.
+            calldatacopy(0, 0, calldatasize())
+            // Delegatecall to the implementation, supplying calldata and gas.
+            // Out and outsize are set to zero - instead, use the return buffer.
+            let result := delegatecall(
+                gas(),
+                _implementation,
+                0,
+                calldatasize(),
+                0,
+                0
+            )
+            // Copy the returned data from the return buffer.
+            returndatacopy(0, 0, returndatasize())
+            switch result
+            // Delegatecall returns 0 on error.
+            case 0 {
+                revert(0, returndatasize())
+            }
+            default {
+                return(0, returndatasize())
+            }
+        }
+    }
+
+    /**
+     * @notice Call the Upgrade Beacon to get the current implementation contract address
+     * @return _implementation Address of the current implementation.
+     */
+    function _getImplementation()
+        private
+        view
+        returns (address _implementation)
+    {
+        _implementation = _getImplementation(upgradeBeacon);
+    }
+
+    /**
+     * @notice Call the Upgrade Beacon to get the current implementation contract address
+     * @dev _upgradeBeacon is passed as a parameter so that
+     * we can also use this function in the constructor,
+     * where we can't access immutable variables.
+     * @param _upgradeBeacon Address of the UpgradeBeacon storing the current implementation
+     * @return _implementation Address of the current implementation.
+     */
+    function _getImplementation(address _upgradeBeacon)
+        private
+        view
+        returns (address _implementation)
+    {
+        // Get the current implementation address from the upgrade beacon.
+        (bool _ok, bytes memory _returnData) = _upgradeBeacon.staticcall("");
+        // Revert and pass along revert message if call to upgrade beacon reverts.
+        require(_ok, string(_returnData));
+        // Set the implementation to the address returned from the upgrade beacon.
+        _implementation = abi.decode(_returnData, (address));
+    }
+}

package/contracts/upgrade/Versioned.sol

@@ -0,0 +1,10 @@
+// SPDX-License-Identifier: MIT OR Apache-2.0
+pragma solidity >=0.6.11;
+
+/**
+ * @title Versioned
+ * @notice Version getter for contracts
+ **/
+contract Versioned {
+    uint8 public constant VERSION = 0;
+}

package/contracts/validator-manager/InboxValidatorManager.sol

@@ -0,0 +1,58 @@
+// SPDX-License-Identifier: MIT OR Apache-2.0
+pragma solidity >=0.8.0;
+
+// ============ Internal Imports ============
+import {IInbox} from "../../interfaces/IInbox.sol";
+import {MultisigValidatorManager} from "./MultisigValidatorManager.sol";
+
+/**
+ * @title InboxValidatorManager
+ * @notice Verifies checkpoints are signed by a quorum of validators and submits
+ * them to an Inbox.
+ */
+contract InboxValidatorManager is MultisigValidatorManager {
+    // ============ Constructor ============
+
+    /**
+     * @dev Reverts if `_validators` has any duplicates.
+     * @param _remoteDomain The remote domain of the outbox chain.
+     * @param _validators The set of validator addresses.
+     * @param _threshold The quorum threshold. Must be greater than or equal
+     * to the length of `_validators`.
+     */
+    // solhint-disable-next-line no-empty-blocks
+    constructor(
+        uint32 _remoteDomain,
+        address[] memory _validators,
+        uint256 _threshold
+    ) MultisigValidatorManager(_remoteDomain, _validators, _threshold) {}
+
+    // ============ External Functions ============
+
+    /**
+     * @notice Verifies a signed checkpoint and submits a message for processing.
+     * @dev Reverts if `_signatures` is not a quorum of validator signatures.
+     * @dev Reverts if `_signatures` is not sorted in ascending order by the signer
+     * address, which is required for duplicate detection.
+     * @param _inbox The inbox to submit the message to.
+     * @param _root The merkle root of the signed checkpoint.
+     * @param _index The index of the signed checkpoint.
+     * @param _signatures Signatures over the checkpoint to be checked for a validator
+     * quorum. Must be sorted in ascending order by signer address.
+     * @param _message The message to process.
+     * @param _proof Merkle proof of inclusion for message's leaf
+     * @param _leafIndex Index of leaf in outbox's merkle tree
+     */
+    function process(
+        IInbox _inbox,
+        bytes32 _root,
+        uint256 _index,
+        bytes[] calldata _signatures,
+        bytes calldata _message,
+        bytes32[32] calldata _proof,
+        uint256 _leafIndex
+    ) external {
+        require(isQuorum(_root, _index, _signatures), "!quorum");
+        _inbox.process(_root, _index, _message, _proof, _leafIndex);
+    }
+}

package/contracts/validator-manager/MultisigValidatorManager.sol

@@ -0,0 +1,271 @@
+// SPDX-License-Identifier: MIT OR Apache-2.0
+pragma solidity >=0.8.0;
+
+import {Versioned} from "../upgrade/Versioned.sol";
+
+// ============ External Imports ============
+import {Ownable} from "@openzeppelin/contracts/access/Ownable.sol";
+import {ECDSA} from "@openzeppelin/contracts/utils/cryptography/ECDSA.sol";
+import {EnumerableSet} from "@openzeppelin/contracts/utils/structs/EnumerableSet.sol";
+
+// ============ Internal Imports ============
+import {IMultisigValidatorManager} from "../../interfaces/IMultisigValidatorManager.sol";
+
+/**
+ * @title MultisigValidatorManager
+ * @notice Manages an ownable set of validators that ECDSA sign checkpoints to
+ * reach a quorum.
+ */
+abstract contract MultisigValidatorManager is
+    IMultisigValidatorManager,
+    Ownable,
+    Versioned
+{
+    // ============ Libraries ============
+
+    using EnumerableSet for EnumerableSet.AddressSet;
+
+    // ============ Immutables ============
+
+    // The domain of the validator set's outbox chain.
+    uint32 public immutable domain;
+
+    // The domain hash of the validator set's outbox chain.
+    bytes32 public immutable domainHash;
+
+    // ============ Mutable Storage ============
+
+    // The minimum threshold of validator signatures to constitute a quorum.
+    uint256 public threshold;
+
+    // The set of validators.
+    EnumerableSet.AddressSet private validatorSet;
+
+    // ============ Events ============
+
+    /**
+     * @notice Emitted when a validator is enrolled in the validator set.
+     * @param validator The address of the validator.
+     * @param validatorCount The new number of enrolled validators in the validator set.
+     */
+    event ValidatorEnrolled(address indexed validator, uint256 validatorCount);
+
+    /**
+     * @notice Emitted when a validator is unenrolled from the validator set.
+     * @param validator The address of the validator.
+     * @param validatorCount The new number of enrolled validators in the validator set.
+     */
+    event ValidatorUnenrolled(
+        address indexed validator,
+        uint256 validatorCount
+    );
+
+    /**
+     * @notice Emitted when the quorum threshold is set.
+     * @param threshold The new quorum threshold.
+     */
+    event ThresholdSet(uint256 threshold);
+
+    // ============ Constructor ============
+
+    /**
+     * @dev Reverts if `_validators` has any duplicates.
+     * @param _domain The domain of the outbox the validator set is for.
+     * @param _validators The set of validator addresses.
+     * @param _threshold The quorum threshold. Must be greater than or equal
+     * to the length of `_validators`.
+     */
+    constructor(
+        uint32 _domain,
+        address[] memory _validators,
+        uint256 _threshold
+    ) Ownable() {
+        // Set immutables.
+        domain = _domain;
+        domainHash = _domainHash(_domain);
+
+        // Enroll validators. Reverts if there are any duplicates.
+        uint256 _numValidators = _validators.length;
+        for (uint256 i = 0; i < _numValidators; i++) {
+            _enrollValidator(_validators[i]);
+        }
+
+        _setThreshold(_threshold);
+    }
+
+    // ============ External Functions ============
+
+    /**
+     * @notice Enrolls a validator into the validator set.
+     * @dev Reverts if `_validator` is already in the validator set.
+     * @param _validator The validator to add to the validator set.
+     */
+    function enrollValidator(address _validator) external onlyOwner {
+        _enrollValidator(_validator);
+    }
+
+    /**
+     * @notice Unenrolls a validator from the validator set.
+     * @dev Reverts if `_validator` is not in the validator set.
+     * @param _validator The validator to remove from the validator set.
+     */
+    function unenrollValidator(address _validator) external onlyOwner {
+        _unenrollValidator(_validator);
+    }
+
+    /**
+     * @notice Sets the quorum threshold.
+     * @param _threshold The new quorum threshold.
+     */
+    function setThreshold(uint256 _threshold) external onlyOwner {
+        _setThreshold(_threshold);
+    }
+
+    /**
+     * @notice Gets the addresses of the current validator set.
+     * @dev There are no ordering guarantees due to the semantics of EnumerableSet.AddressSet.
+     * @return The addresses of the validator set.
+     */
+    function validators() external view returns (address[] memory) {
+        uint256 _numValidators = validatorSet.length();
+        address[] memory _validators = new address[](_numValidators);
+        for (uint256 i = 0; i < _numValidators; i++) {
+            _validators[i] = validatorSet.at(i);
+        }
+        return _validators;
+    }
+
+    // ============ Public Functions ============
+
+    /**
+     * @notice Returns whether provided signatures over a checkpoint constitute
+     * a quorum of validator signatures.
+     * @dev Reverts if `_signatures` is not sorted in ascending order by the signer
+     * address, which is required for duplicate detection.
+     * @dev Does not revert if a signature's signer is not in the validator set.
+     * @param _root The merkle root of the checkpoint.
+     * @param _index The index of the checkpoint.
+     * @param _signatures Signatures over the checkpoint to be checked for a validator
+     * quorum. Must be sorted in ascending order by signer address.
+     * @return TRUE iff `_signatures` constitute a quorum of validator signatures over
+     * the checkpoint.
+     */
+    function isQuorum(
+        bytes32 _root,
+        uint256 _index,
+        bytes[] calldata _signatures
+    ) public view returns (bool) {
+        uint256 _numSignatures = _signatures.length;
+        // If there are fewer signatures provided than the required quorum threshold,
+        // this is not a quorum.
+        if (_numSignatures < threshold) {
+            return false;
+        }
+        // To identify duplicates, the signers recovered from _signatures
+        // must be sorted in ascending order. previousSigner is used to
+        // enforce ordering.
+        address _previousSigner = address(0);
+        uint256 _validatorSignatureCount = 0;
+        for (uint256 i = 0; i < _numSignatures; i++) {
+            address _signer = _recoverCheckpointSigner(
+                _root,
+                _index,
+                _signatures[i]
+            );
+            // Revert if the signer violates the required sort order.
+            require(_previousSigner < _signer, "!sorted signers");
+            // If the signer is a validator, increment _validatorSignatureCount.
+            if (isValidator(_signer)) {
+                _validatorSignatureCount++;
+            }
+            _previousSigner = _signer;
+        }
+        return _validatorSignatureCount >= threshold;
+    }
+
+    /**
+     * @notice Returns if `_validator` is enrolled in the validator set.
+     * @param _validator The address of the validator.
+     * @return TRUE iff `_validator` is enrolled in the validator set.
+     */
+    function isValidator(address _validator) public view returns (bool) {
+        return validatorSet.contains(_validator);
+    }
+
+    /**
+     * @notice Returns the number of validators enrolled in the validator set.
+     * @return The number of validators enrolled in the validator set.
+     */
+    function validatorCount() public view returns (uint256) {
+        return validatorSet.length();
+    }
+
+    // ============ Internal Functions ============
+
+    /**
+     * @notice Recovers the signer from a signature of a checkpoint.
+     * @param _root The checkpoint's merkle root.
+     * @param _index The checkpoint's index.
+     * @param _signature Signature on the the checkpoint.
+     * @return The signer of the checkpoint signature.
+     **/
+    function _recoverCheckpointSigner(
+        bytes32 _root,
+        uint256 _index,
+        bytes calldata _signature
+    ) internal view returns (address) {
+        bytes32 _digest = keccak256(
+            abi.encodePacked(domainHash, _root, _index)
+        );
+        return ECDSA.recover(ECDSA.toEthSignedMessageHash(_digest), _signature);
+    }
+
+    /**
+     * @notice Enrolls a validator into the validator set.
+     * @dev Reverts if `_validator` is already in the validator set.
+     * @param _validator The validator to add to the validator set.
+     */
+    function _enrollValidator(address _validator) internal {
+        require(_validator != address(0), "zero address");
+        require(validatorSet.add(_validator), "already enrolled");
+        emit ValidatorEnrolled(_validator, validatorCount());
+    }
+
+    /**
+     * @notice Unenrolls a validator from the validator set.
+     * @dev Reverts if the resulting validator set length is less than
+     * the quorum threshold.
+     * @dev Reverts if `_validator` is not in the validator set.
+     * @param _validator The validator to remove from the validator set.
+     */
+    function _unenrollValidator(address _validator) internal {
+        require(validatorSet.remove(_validator), "!enrolled");
+        uint256 _numValidators = validatorCount();
+        require(_numValidators >= threshold, "violates quorum threshold");
+        emit ValidatorUnenrolled(_validator, _numValidators);
+    }
+
+    /**
+     * @notice Sets the quorum threshold.
+     * @param _threshold The new quorum threshold.
+     */
+    function _setThreshold(uint256 _threshold) internal {
+        require(_threshold > 0 && _threshold <= validatorCount(), "!range");
+        threshold = _threshold;
+        emit ThresholdSet(_threshold);
+    }
+
+    /**
+     * @notice Hash of `_domain` concatenated with "ABACUS" and deployment version.
+     * @dev Domain hash is salted with deployment version to prevent validator signature replay.
+     * @param _domain The domain to hash.
+     */
+    function _domainHash(uint32 _domain) internal pure returns (bytes32) {
+        if (VERSION > 0) {
+            return keccak256(abi.encodePacked(_domain, "ABACUS", VERSION));
+        } else {
+            // for backwards compatibility with initial deployment (VERSION == 0)
+            return keccak256(abi.encodePacked(_domain, "ABACUS"));
+        }
+    }
+}