@hyperlane-xyz/core 0.5.4-3 → 1.0.0-beta0

package/contracts/HyperlaneConnectionClient.sol

@@ -18,7 +18,7 @@ abstract contract HyperlaneConnectionClient is
 
     IMailbox public mailbox;
     // Interchain Gas Paymaster contract. The relayer associated with this contract
-    // must be willing to relay messages dispatched from the current Outbox contract,
+    // must be willing to relay messages dispatched from the current Mailbox contract,
     // otherwise payments made to the paymaster will not result in relayed messages.
     IInterchainGasPaymaster public interchainGasPaymaster;
 
@@ -55,8 +55,7 @@ abstract contract HyperlaneConnectionClient is
      * @notice Only accept addresses that at least have contract code
      */
     modifier onlyContract(address _contract) {
-        // TODO: fix tests that provide zero address
-        // require(Address.isContract(_contract), "!contract");
+        require(Address.isContract(_contract), "!contract");
         _;
     }
 
@@ -137,7 +136,7 @@ abstract contract HyperlaneConnectionClient is
     }
 
     /**
-     * @notice Modify the contract the Application uses to validate Inbox contracts
+     * @notice Modify the contract the Application uses to validate Mailbox contracts
      * @param _mailbox The address of the mailbox contract
      */
     function _setMailbox(address _mailbox) internal onlyContract(_mailbox) {

package/contracts/InterchainGasPaymaster.sol

@@ -17,9 +17,14 @@ contract InterchainGasPaymaster is IInterchainGasPaymaster, OwnableUpgradeable {
     /**
      * @notice Emitted when a payment is made for a message's gas costs.
      * @param messageId The ID of the message to pay for.
-     * @param amount The amount of native tokens paid.
+     * @param gasAmount The amount of destination gas paid for.
+     * @param payment The amount of native tokens paid.
      */
-    event GasPayment(bytes32 indexed messageId, uint256 amount);
+    event GasPayment(
+        bytes32 indexed messageId,
+        uint256 gasAmount,
+        uint256 payment
+    );
 
     // ============ Constructor ============
 
@@ -39,18 +44,22 @@ contract InterchainGasPaymaster is IInterchainGasPaymaster, OwnableUpgradeable {
      * to its destination chain.
      * @param _messageId The ID of the message to pay for.
      * @param _destinationDomain The domain of the message's destination chain.
+     * @param _gasAmount The amount of destination gas to pay for. Currently unused.
+     * @param _refundAddress The address to refund any overpayment to. Currently unused.
      */
-    function payGasFor(bytes32 _messageId, uint32 _destinationDomain)
-        external
-        payable
-        override
-    {
+    function payForGas(
+        bytes32 _messageId,
+        uint32 _destinationDomain,
+        uint256 _gasAmount,
+        address _refundAddress
+    ) external payable override {
         // Silence compiler warning. The NatSpec @param requires the parameter to be named.
-        // While not used at the moment, future versions of the paymaster may conditionally
-        // forward payments depending on the destination domain.
+        // While not used at the moment, future versions of the paymaster have behavior specific
+        // to the destination domain and refund overpayments to the _refundAddress.
         _destinationDomain;
+        _refundAddress;
 
-        emit GasPayment(_messageId, msg.value);
+        emit GasPayment(_messageId, _gasAmount, msg.value);
     }
 
     /**

package/contracts/Mailbox.sol

@@ -9,16 +9,16 @@ import {TypeCasts} from "./libs/TypeCasts.sol";
 import {IMessageRecipient} from "../interfaces/IMessageRecipient.sol";
 import {IInterchainSecurityModule, ISpecifiesInterchainSecurityModule} from "../interfaces/IInterchainSecurityModule.sol";
 import {IMailbox} from "../interfaces/IMailbox.sol";
+import {PausableReentrancyGuardUpgradeable} from "./PausableReentrancyGuard.sol";
 
 // ============ External Imports ============
 import {Address} from "@openzeppelin/contracts/utils/Address.sol";
 import {OwnableUpgradeable} from "@openzeppelin/contracts-upgradeable/access/OwnableUpgradeable.sol";
-import {ReentrancyGuardUpgradeable} from "@openzeppelin/contracts-upgradeable/security/ReentrancyGuardUpgradeable.sol";
 
 contract Mailbox is
     IMailbox,
     OwnableUpgradeable,
-    ReentrancyGuardUpgradeable,
+    PausableReentrancyGuardUpgradeable,
     Versioned
 {
     // ============ Libraries ============
@@ -59,16 +59,51 @@ contract Mailbox is
 
     /**
      * @notice Emitted when a new message is dispatched via Hyperlane
-     * @param messageId The unique message identifier
+     * @param sender The address that dispatched the message
+     * @param destination The destination domain of the message
+     * @param recipient The message recipient address on `destination`
      * @param message Raw bytes of message
      */
-    event Dispatch(bytes32 indexed messageId, bytes message);
+    event Dispatch(
+        address indexed sender,
+        uint32 indexed destination,
+        bytes32 indexed recipient,
+        bytes message
+    );
 
     /**
-     * @notice Emitted when a Hyperlane message is delivered
+     * @notice Emitted when a new message is dispatched via Hyperlane
      * @param messageId The unique message identifier
      */
-    event Process(bytes32 indexed messageId);
+    event DispatchId(bytes32 indexed messageId);
+
+    /**
+     * @notice Emitted when a Hyperlane message is processed
+     * @param messageId The unique message identifier
+     */
+    event ProcessId(bytes32 indexed messageId);
+
+    /**
+     * @notice Emitted when a Hyperlane message is delivered
+     * @param origin The origin domain of the message
+     * @param sender The message sender address on `origin`
+     * @param recipient The address that handled the message
+     */
+    event Process(
+        uint32 indexed origin,
+        bytes32 indexed sender,
+        address indexed recipient
+    );
+
+    /**
+     * @notice Emitted when Mailbox is paused
+     */
+    event Paused();
+
+    /**
+     * @notice Emitted when Mailbox is unpaused
+     */
+    event Unpaused();
 
     // ============ Constructor ============
 
@@ -80,7 +115,7 @@ contract Mailbox is
     // ============ Initializer ============
 
     function initialize(address _defaultIsm) external initializer {
-        __ReentrancyGuard_init();
+        __PausableReentrancyGuard_init();
         __Ownable_init();
         _setDefaultIsm(_defaultIsm);
     }
@@ -106,7 +141,7 @@ contract Mailbox is
         uint32 _destinationDomain,
         bytes32 _recipientAddress,
         bytes calldata _messageBody
-    ) external override returns (bytes32) {
+    ) external override notPaused returns (bytes32) {
         require(_messageBody.length <= MAX_MESSAGE_BODY_BYTES, "msg too long");
         // Format the message into packed bytes.
         bytes memory _message = Message.formatMessage(
@@ -122,7 +157,13 @@ contract Mailbox is
         // Insert the message ID into the merkle tree.
         bytes32 _id = _message.id();
         tree.insert(_id);
-        emit Dispatch(_id, _message);
+        emit Dispatch(
+            msg.sender,
+            _destinationDomain,
+            _recipientAddress,
+            _message
+        );
+        emit DispatchId(_id);
         return _id;
     }
 
@@ -135,7 +176,7 @@ contract Mailbox is
     function process(bytes calldata _metadata, bytes calldata _message)
         external
         override
-        nonReentrant
+        nonReentrantAndNotPaused
     {
         // Check that the message was intended for this mailbox.
         require(_message.version() == VERSION, "!version");
@@ -153,13 +194,12 @@ contract Mailbox is
         require(_ism.verify(_metadata, _message), "!module");
 
         // Deliver the message to the recipient.
-        uint32 _origin = _message.origin();
-        IMessageRecipient(_message.recipientAddress()).handle(
-            _origin,
-            _message.sender(),
-            _message.body()
-        );
-        emit Process(_id);
+        uint32 origin = _message.origin();
+        bytes32 sender = _message.sender();
+        address recipient = _message.recipientAddress();
+        IMessageRecipient(recipient).handle(origin, sender, _message.body());
+        emit Process(origin, sender, recipient);
+        emit ProcessId(_id);
     }
 
     // ============ Public Functions ============
@@ -181,13 +221,38 @@ contract Mailbox is
 
     /**
      * @notice Returns a checkpoint representing the current merkle tree.
-     * @return root The root of the Outbox's merkle tree.
+     * @return root The root of the Mailbox's merkle tree.
      * @return index The index of the last element in the tree.
      */
     function latestCheckpoint() public view returns (bytes32, uint32) {
         return (root(), count() - 1);
     }
 
+    /**
+     * @notice Pauses mailbox and prevents further dispatch/process calls
+     * @dev Only `owner` can pause the mailbox.
+     */
+    function pause() external onlyOwner {
+        _pause();
+        emit Paused();
+    }
+
+    /**
+     * @notice Unpauses mailbox and allows for message processing.
+     * @dev Only `owner` can unpause the mailbox.
+     */
+    function unpause() external onlyOwner {
+        _unpause();
+        emit Unpaused();
+    }
+
+    /**
+     * @notice Returns whether mailbox is paused.
+     */
+    function isPaused() external view returns (bool) {
+        return _isPaused();
+    }
+
     // ============ Internal Functions ============
 
     /**
@@ -218,7 +283,7 @@ contract Mailbox is
         try _recipient.interchainSecurityModule() returns (
             IInterchainSecurityModule _val
         ) {
-            // TODO: reconsider
+            // If the recipient specifies a zero address, use the default ISM.
             if (address(_val) != address(0)) {
                 return _val;
             }

package/contracts/PausableReentrancyGuard.sol

@@ -0,0 +1,69 @@
+// SPDX-License-Identifier: MIT OR Apache-2.0
+pragma solidity >=0.8.0;
+
+import "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol";
+
+// adapted from "@openzeppelin/contracts-upgradeable/security/ReentrancyGuardUpgradeable.sol";
+abstract contract PausableReentrancyGuardUpgradeable is Initializable {
+    uint256 private constant _NOT_ENTERED = 1;
+    uint256 private constant _ENTERED = 2;
+    uint256 private constant _PAUSED = 3;
+
+    uint256 private _status;
+
+    /**
+     * @dev MUST be called for `nonReentrant` to not always revert
+     */
+    function __PausableReentrancyGuard_init() internal onlyInitializing {
+        _status = _NOT_ENTERED;
+    }
+
+    function _isPaused() internal view returns (bool) {
+        return _status == _PAUSED;
+    }
+
+    function _pause() internal notPaused {
+        _status = _PAUSED;
+    }
+
+    function _unpause() internal {
+        require(_isPaused(), "!paused");
+        _status = _NOT_ENTERED;
+    }
+
+    /**
+     * @dev Prevents a contract from being entered when paused.
+     */
+    modifier notPaused() {
+        require(!_isPaused(), "paused");
+        _;
+    }
+
+    /**
+     * @dev Prevents a contract from calling itself, directly or indirectly.
+     * Calling a `nonReentrant` function from another `nonReentrant`
+     * function is not supported. It is possible to prevent this from happening
+     * by making the `nonReentrant` function external, and making it call a
+     * `private` function that does the actual work.
+     */
+    modifier nonReentrantAndNotPaused() {
+        // status must have been initialized
+        require(_status == _NOT_ENTERED, "reentrant call (or paused)");
+
+        // Any calls to nonReentrant after this point will fail
+        _status = _ENTERED;
+
+        _;
+
+        // By storing the original value once again, a refund is triggered (see
+        // https://eips.ethereum.org/EIPS/eip-2200)
+        _status = _NOT_ENTERED;
+    }
+
+    /**
+     * @dev This empty reserved space is put in place to allow future versions to add new
+     * variables without shifting down storage in the inheritance chain.
+     * See https://docs.openzeppelin.com/contracts/4.x/upgradeable#storage_gaps
+     */
+    uint256[49] private __gap;
+}

package/contracts/Router.sol

@@ -151,20 +151,26 @@ abstract contract Router is HyperlaneConnectionClient, IMessageRecipient {
      * @dev Reverts if there is no enrolled router for _destinationDomain.
      * @param _destinationDomain The domain of the chain to which to send the message.
      * @param _messageBody Raw bytes content of message.
+     * @param _gasAmount The amount of destination gas for the message that is requested via the InterchainGasPaymaster.
      * @param _gasPayment The amount of native tokens to pay for the message to be relayed.
+     * @param _gasPaymentRefundAddress The address to refund any gas overpayment to.
      */
     function _dispatchWithGas(
         uint32 _destinationDomain,
         bytes memory _messageBody,
-        uint256 _gasPayment
-    ) internal {
-        bytes32 _messageId = _dispatch(_destinationDomain, _messageBody);
-        if (_gasPayment > 0) {
-            interchainGasPaymaster.payGasFor{value: _gasPayment}(
-                _messageId,
-                _destinationDomain
-            );
-        }
+        uint256 _gasAmount,
+        uint256 _gasPayment,
+        address _gasPaymentRefundAddress
+    ) internal returns (bytes32 _messageId) {
+        _messageId = _dispatch(_destinationDomain, _messageBody);
+        // Call the IGP even if the gas payment is zero. This is to support on-chain
+        // fee quoting in IGPs, which should always revert if gas payment is insufficient.
+        interchainGasPaymaster.payForGas{value: _gasPayment}(
+            _messageId,
+            _destinationDomain,
+            _gasAmount,
+            _gasPaymentRefundAddress
+        );
     }
 
     /**

package/contracts/isms/MultisigIsm.sol

@@ -28,7 +28,7 @@ contract MultisigIsm is IMultisigIsm, Ownable {
     // ============ Mutable Storage ============
 
     /// @notice The validator threshold for each remote domain.
-    mapping(uint32 => uint256) public threshold;
+    mapping(uint32 => uint8) public threshold;
 
     /// @notice The validator set for each remote domain.
     mapping(uint32 => EnumerableSet.AddressSet) private validatorSet;
@@ -44,13 +44,11 @@ contract MultisigIsm is IMultisigIsm, Ownable {
      * @param domain The remote domain of the validator set.
      * @param validator The address of the validator.
      * @param validatorCount The number of enrolled validators in the validator set.
-     * @param commitment A commitment to the validator set and threshold.
      */
     event ValidatorEnrolled(
         uint32 indexed domain,
         address indexed validator,
-        uint256 validatorCount,
-        bytes32 commitment
+        uint256 validatorCount
     );
 
     /**
@@ -58,26 +56,26 @@ contract MultisigIsm is IMultisigIsm, Ownable {
      * @param domain The remote domain of the validator set.
      * @param validator The address of the validator.
      * @param validatorCount The number of enrolled validators in the validator set.
-     * @param commitment A commitment to the validator set and threshold.
      */
     event ValidatorUnenrolled(
         uint32 indexed domain,
         address indexed validator,
-        uint256 validatorCount,
-        bytes32 commitment
+        uint256 validatorCount
     );
 
     /**
      * @notice Emitted when the quorum threshold is set.
      * @param domain The remote domain of the validator set.
      * @param threshold The new quorum threshold.
+     */
+    event ThresholdSet(uint32 indexed domain, uint8 threshold);
+
+    /**
+     * @notice Emitted when the validator set or threshold changes.
+     * @param domain The remote domain of the validator set.
      * @param commitment A commitment to the validator set and threshold.
      */
-    event ThresholdSet(
-        uint32 indexed domain,
-        uint256 threshold,
-        bytes32 commitment
-    );
+    event CommitmentUpdated(uint32 domain, bytes32 commitment);
 
     // ============ Constructor ============
 
@@ -86,6 +84,27 @@ contract MultisigIsm is IMultisigIsm, Ownable {
 
     // ============ External Functions ============
 
+    /**
+     * @notice Enrolls multiple validators into a validator set.
+     * @dev Reverts if `_validator` is already in the validator set.
+     * @param _domains The remote domains of the validator sets.
+     * @param _validators The validators to add to the validator sets.
+     * @dev _validators[i] are the validators to enroll for _domains[i].
+     */
+    function enrollValidators(
+        uint32[] calldata _domains,
+        address[][] calldata _validators
+    ) external onlyOwner {
+        require(_domains.length == _validators.length, "!length");
+        for (uint256 i = 0; i < _domains.length; i += 1) {
+            address[] calldata _domainValidators = _validators[i];
+            for (uint256 j = 0; j < _domainValidators.length; j += 1) {
+                _enrollValidator(_domains[i], _domainValidators[j]);
+            }
+            _updateCommitment(_domains[i]);
+        }
+    }
+
     /**
      * @notice Enrolls a validator into a validator set.
      * @dev Reverts if `_validator` is already in the validator set.
@@ -96,15 +115,8 @@ contract MultisigIsm is IMultisigIsm, Ownable {
         external
         onlyOwner
     {
-        require(_validator != address(0), "zero address");
-        require(validatorSet[_domain].add(_validator), "already enrolled");
-        bytes32 _commitment = _updateCommitment(_domain);
-        emit ValidatorEnrolled(
-            _domain,
-            _validator,
-            validatorCount(_domain),
-            _commitment
-        );
+        _enrollValidator(_domain, _validator);
+        _updateCommitment(_domain);
     }
 
     /**
@@ -123,31 +135,23 @@ contract MultisigIsm is IMultisigIsm, Ownable {
             _validatorCount >= threshold[_domain],
             "violates quorum threshold"
         );
-        bytes32 _commitment = _updateCommitment(_domain);
-        emit ValidatorUnenrolled(
-            _domain,
-            _validator,
-            _validatorCount,
-            _commitment
-        );
+        _updateCommitment(_domain);
+        emit ValidatorUnenrolled(_domain, _validator, _validatorCount);
     }
 
     /**
-     * @notice Sets the quorum threshold.
-     * @param _domain The remote domain of the validator set.
-     * @param _threshold The new quorum threshold.
+     * @notice Sets the quorum threshold for multiple domains.
+     * @param _domains The remote domains of the validator sets.
+     * @param _thresholds The new quorum thresholds.
      */
-    function setThreshold(uint32 _domain, uint256 _threshold)
-        external
-        onlyOwner
-    {
-        require(
-            _threshold > 0 && _threshold <= validatorCount(_domain),
-            "!range"
-        );
-        threshold[_domain] = _threshold;
-        bytes32 _commitment = _updateCommitment(_domain);
-        emit ThresholdSet(_domain, _threshold, _commitment);
+    function setThresholds(
+        uint32[] calldata _domains,
+        uint8[] calldata _thresholds
+    ) external onlyOwner {
+        require(_domains.length == _thresholds.length, "!length");
+        for (uint256 i = 0; i < _domains.length; i += 1) {
+            setThreshold(_domains[i], _thresholds[i]);
+        }
     }
 
     /**
@@ -167,6 +171,22 @@ contract MultisigIsm is IMultisigIsm, Ownable {
 
     // ============ Public Functions ============
 
+    /**
+     * @notice Sets the quorum threshold.
+     * @param _domain The remote domain of the validator set.
+     * @param _threshold The new quorum threshold.
+     */
+    function setThreshold(uint32 _domain, uint8 _threshold) public onlyOwner {
+        require(
+            _threshold > 0 && _threshold <= validatorCount(_domain),
+            "!range"
+        );
+        threshold[_domain] = _threshold;
+        emit ThresholdSet(_domain, _threshold);
+
+        _updateCommitment(_domain);
+    }
+
     /**
      * @notice Verifies that a quorum of the origin domain's validators signed
      * a checkpoint, and verifies the merkle proof of `_message` against that
@@ -210,6 +230,18 @@ contract MultisigIsm is IMultisigIsm, Ownable {
 
     // ============ Internal Functions ============
 
+    /**
+     * @notice Enrolls a validator into a validator set.
+     * @dev Reverts if `_validator` is already in the validator set.
+     * @param _domain The remote domain of the validator set.
+     * @param _validator The validator to add to the validator set.
+     */
+    function _enrollValidator(uint32 _domain, address _validator) internal {
+        require(_validator != address(0), "zero address");
+        require(validatorSet[_domain].add(_validator), "already enrolled");
+        emit ValidatorEnrolled(_domain, _validator, validatorCount(_domain));
+    }
+
     /**
      * @notice Updates the commitment to the validator set for `_domain`.
      * @param _domain The remote domain of the validator set.
@@ -217,11 +249,12 @@ contract MultisigIsm is IMultisigIsm, Ownable {
      */
     function _updateCommitment(uint32 _domain) internal returns (bytes32) {
         address[] memory _validators = validators(_domain);
-        uint256 _threshold = threshold[_domain];
+        uint8 _threshold = threshold[_domain];
         bytes32 _commitment = keccak256(
             abi.encodePacked(_threshold, _validators)
         );
         commitment[_domain] = _commitment;
+        emit CommitmentUpdated(_domain, _commitment);
         return _commitment;
     }
 
@@ -254,7 +287,7 @@ contract MultisigIsm is IMultisigIsm, Ownable {
         bytes calldata _metadata,
         bytes calldata _message
     ) internal view returns (bool) {
-        uint256 _threshold = _metadata.threshold();
+        uint8 _threshold = _metadata.threshold();
         bytes32 _digest;
         {
             uint32 _origin = _message.origin();

package/contracts/libs/MultisigIsmMetadata.sol

@@ -4,20 +4,20 @@ pragma solidity >=0.8.0;
 /**
  * Format of metadata:
  * [   0:  32] Merkle root
- * [  32:  64] Root index
- * [  64:  96] Origin mailbox address
- * [  96:1120] Merkle proof
- * [1120:1152] Threshold
- * [1152:????] Validator signatures, 65 bytes each, length == Threshold
+ * [  32:  36] Root index
+ * [  36:  68] Origin mailbox address
+ * [  68:1092] Merkle proof
+ * [1092:1093] Threshold
+ * [1093:????] Validator signatures, 65 bytes each, length == Threshold
  * [????:????] Addresses of the entire validator set, left padded to bytes32
  */
 library MultisigIsmMetadata {
     uint256 private constant MERKLE_ROOT_OFFSET = 0;
     uint256 private constant MERKLE_INDEX_OFFSET = 32;
-    uint256 private constant ORIGIN_MAILBOX_OFFSET = 64;
-    uint256 private constant MERKLE_PROOF_OFFSET = 96;
-    uint256 private constant THRESHOLD_OFFSET = 1120;
-    uint256 private constant SIGNATURES_OFFSET = 1152;
+    uint256 private constant ORIGIN_MAILBOX_OFFSET = 36;
+    uint256 private constant MERKLE_PROOF_OFFSET = 68;
+    uint256 private constant THRESHOLD_OFFSET = 1092;
+    uint256 private constant SIGNATURES_OFFSET = 1093;
     uint256 private constant SIGNATURE_LENGTH = 65;
 
     /**
@@ -34,10 +34,10 @@ library MultisigIsmMetadata {
      * @param _metadata ABI encoded Multisig ISM metadata.
      * @return Index of the signed checkpoint
      */
-    function index(bytes calldata _metadata) internal pure returns (uint256) {
+    function index(bytes calldata _metadata) internal pure returns (uint32) {
         return
-            uint256(
-                bytes32(_metadata[MERKLE_INDEX_OFFSET:ORIGIN_MAILBOX_OFFSET])
+            uint32(
+                bytes4(_metadata[MERKLE_INDEX_OFFSET:ORIGIN_MAILBOX_OFFSET])
             );
     }
 
@@ -79,12 +79,8 @@ library MultisigIsmMetadata {
      * @param _metadata ABI encoded Multisig ISM metadata.
      * @return The number of required signatures.
      */
-    function threshold(bytes calldata _metadata)
-        internal
-        pure
-        returns (uint256)
-    {
-        return uint256(bytes32(_metadata[THRESHOLD_OFFSET:SIGNATURES_OFFSET]));
+    function threshold(bytes calldata _metadata) internal pure returns (uint8) {
+        return uint8(bytes1(_metadata[THRESHOLD_OFFSET:SIGNATURES_OFFSET]));
     }
 
     /**
@@ -182,6 +178,8 @@ library MultisigIsmMetadata {
         pure
         returns (uint256)
     {
-        return SIGNATURES_OFFSET + (threshold(_metadata) * SIGNATURE_LENGTH);
+        return
+            SIGNATURES_OFFSET +
+            (uint256(threshold(_metadata)) * SIGNATURE_LENGTH);
     }
 }