@hyperlane-xyz/core 1.2.3 → 1.3.1

package/contracts/HyperlaneConnectionClient.sol

@@ -2,9 +2,10 @@
 pragma solidity >=0.6.11;
 
 // ============ Internal Imports ============
-import {IInterchainGasPaymaster} from "../interfaces/IInterchainGasPaymaster.sol";
-import {ISpecifiesInterchainSecurityModule, IInterchainSecurityModule} from "../interfaces/IInterchainSecurityModule.sol";
-import {IMailbox} from "../interfaces/IMailbox.sol";
+import {IInterchainGasPaymaster} from "./interfaces/IInterchainGasPaymaster.sol";
+import {IInterchainSecurityModule} from "./interfaces/IInterchainSecurityModule.sol";
+import {IHyperlaneConnectionClient} from "./interfaces/IHyperlaneConnectionClient.sol";
+import {IMailbox} from "./interfaces/IMailbox.sol";
 
 // ============ External Imports ============
 import {OwnableUpgradeable} from "@openzeppelin/contracts-upgradeable/access/OwnableUpgradeable.sol";
@@ -12,7 +13,7 @@ import {Address} from "@openzeppelin/contracts/utils/Address.sol";
 
 abstract contract HyperlaneConnectionClient is
     OwnableUpgradeable,
-    ISpecifiesInterchainSecurityModule
+    IHyperlaneConnectionClient
 {
     // ============ Mutable Storage ============
 

package/contracts/Mailbox.sol

@@ -6,9 +6,9 @@ import {Versioned} from "./upgrade/Versioned.sol";
 import {MerkleLib} from "./libs/Merkle.sol";
 import {Message} from "./libs/Message.sol";
 import {TypeCasts} from "./libs/TypeCasts.sol";
-import {IMessageRecipient} from "../interfaces/IMessageRecipient.sol";
-import {IInterchainSecurityModule, ISpecifiesInterchainSecurityModule} from "../interfaces/IInterchainSecurityModule.sol";
-import {IMailbox} from "../interfaces/IMailbox.sol";
+import {IMessageRecipient} from "./interfaces/IMessageRecipient.sol";
+import {IInterchainSecurityModule, ISpecifiesInterchainSecurityModule} from "./interfaces/IInterchainSecurityModule.sol";
+import {IMailbox} from "./interfaces/IMailbox.sol";
 import {PausableReentrancyGuardUpgradeable} from "./PausableReentrancyGuard.sol";
 
 // ============ External Imports ============
@@ -57,44 +57,6 @@ contract Mailbox is
      */
     event DefaultIsmSet(address indexed module);
 
-    /**
-     * @notice Emitted when a new message is dispatched via Hyperlane
-     * @param sender The address that dispatched the message
-     * @param destination The destination domain of the message
-     * @param recipient The message recipient address on `destination`
-     * @param message Raw bytes of message
-     */
-    event Dispatch(
-        address indexed sender,
-        uint32 indexed destination,
-        bytes32 indexed recipient,
-        bytes message
-    );
-
-    /**
-     * @notice Emitted when a new message is dispatched via Hyperlane
-     * @param messageId The unique message identifier
-     */
-    event DispatchId(bytes32 indexed messageId);
-
-    /**
-     * @notice Emitted when a Hyperlane message is processed
-     * @param messageId The unique message identifier
-     */
-    event ProcessId(bytes32 indexed messageId);
-
-    /**
-     * @notice Emitted when a Hyperlane message is delivered
-     * @param origin The origin domain of the message
-     * @param sender The message sender address on `origin`
-     * @param recipient The address that handled the message
-     */
-    event Process(
-        uint32 indexed origin,
-        bytes32 indexed sender,
-        address indexed recipient
-    );
-
     /**
      * @notice Emitted when Mailbox is paused
      */

package/contracts/OwnableMulticall.sol

@@ -1,26 +1,26 @@
 // SPDX-License-Identifier: Apache-2.0
 pragma solidity ^0.8.13;
 
-// ============ External Imports ============
-
-import {OwnableUpgradeable} from "@openzeppelin/contracts-upgradeable/access/OwnableUpgradeable.sol";
-import {Address} from "@openzeppelin/contracts/utils/Address.sol";
+// ============ Internal Imports ============
 import {CallLib} from "./libs/Call.sol";
 
 /*
  * @title OwnableMulticall
- * @dev Permits owner address to execute state mutating calls with value to other contracts
+ * @dev Permits immutable owner address to execute calls with value to other contracts.
  */
-contract OwnableMulticall is OwnableUpgradeable {
-    constructor() {
-        _transferOwnership(msg.sender);
+contract OwnableMulticall {
+    address public immutable owner;
+
+    constructor(address _owner) {
+        owner = _owner;
     }
 
-    function initialize() external initializer {
-        __Ownable_init();
+    modifier onlyOwner() {
+        require(msg.sender == owner, "!owner");
+        _;
     }
 
-    function proxyCalls(CallLib.Call[] calldata calls) external onlyOwner {
+    function multicall(CallLib.Call[] calldata calls) external onlyOwner {
         return CallLib.multicall(calls);
     }
 

package/contracts/Router.sol

@@ -3,9 +3,9 @@ pragma solidity >=0.6.11;
 
 // ============ Internal Imports ============
 import {HyperlaneConnectionClient} from "./HyperlaneConnectionClient.sol";
-import {IInterchainGasPaymaster} from "../interfaces/IInterchainGasPaymaster.sol";
-import {IMessageRecipient} from "../interfaces/IMessageRecipient.sol";
-import {IMailbox} from "../interfaces/IMailbox.sol";
+import {IInterchainGasPaymaster} from "./interfaces/IInterchainGasPaymaster.sol";
+import {IMessageRecipient} from "./interfaces/IMessageRecipient.sol";
+import {IMailbox} from "./interfaces/IMailbox.sol";
 import {EnumerableMapExtended} from "./libs/EnumerableMapExtended.sol";
 
 abstract contract Router is HyperlaneConnectionClient, IMessageRecipient {
@@ -25,7 +25,7 @@ abstract contract Router is HyperlaneConnectionClient, IMessageRecipient {
      * @param domain The domain of the new router
      * @param router The address of the new router
      */
-    event RemoteRouterEnrolled(uint32 indexed domain, bytes32 indexed router);
+    event RemoteRouterEnrolled(uint32 indexed domain, bytes32 router);
 
     // ============ Modifiers ============
     /**

package/contracts/ValidatorAnnounce.sol

@@ -2,8 +2,8 @@
 pragma solidity >=0.8.0;
 
 // ============ Internal Imports ============
-import {IValidatorAnnounce} from "../interfaces/IValidatorAnnounce.sol";
-import {IMailbox} from "../interfaces/IMailbox.sol";
+import {IValidatorAnnounce} from "./interfaces/IValidatorAnnounce.sol";
+import {IMailbox} from "./interfaces/IMailbox.sol";
 import {TypeCasts} from "./libs/TypeCasts.sol";
 import {ValidatorAnnouncements} from "./libs/ValidatorAnnouncements.sol";
 // ============ External Imports ============

package/contracts/igps/InterchainGasPaymaster.sol

@@ -2,8 +2,8 @@
 pragma solidity >=0.8.0;
 
 // ============ Internal Imports ============
-import {IGasOracle} from "../../interfaces/IGasOracle.sol";
-import {IInterchainGasPaymaster} from "../../interfaces/IInterchainGasPaymaster.sol";
+import {IGasOracle} from "../interfaces/IGasOracle.sol";
+import {IInterchainGasPaymaster} from "../interfaces/IInterchainGasPaymaster.sol";
 // ============ External Imports ============
 import {OwnableUpgradeable} from "@openzeppelin/contracts-upgradeable/access/OwnableUpgradeable.sol";
 
@@ -50,12 +50,6 @@ contract InterchainGasPaymaster is
         address gasOracle;
     }
 
-    // ============ Constructor ============
-
-    constructor(address _beneficiary) {
-        initialize(msg.sender, _beneficiary); // allows contract to be used without proxying
-    }
-
     // ============ External Functions ============
 
     /**

package/contracts/igps/OverheadIgp.sol

@@ -2,7 +2,7 @@
 pragma solidity >=0.8.0;
 
 // ============ Internal Imports ============
-import {IInterchainGasPaymaster} from "../../interfaces/IInterchainGasPaymaster.sol";
+import {IInterchainGasPaymaster} from "../interfaces/IInterchainGasPaymaster.sol";
 // ============ External Imports ============
 import {Ownable} from "@openzeppelin/contracts/access/Ownable.sol";
 

package/contracts/igps/gas-oracles/StorageGasOracle.sol

@@ -2,7 +2,7 @@
 pragma solidity >=0.8.0;
 
 // ============ Internal Imports ============
-import {IGasOracle} from "../../../interfaces/IGasOracle.sol";
+import {IGasOracle} from "../../interfaces/IGasOracle.sol";
 // ============ External Imports ============
 import {Ownable} from "@openzeppelin/contracts/access/Ownable.sol";
 

package/contracts/interfaces/IAggregationIsm.sol

@@ -0,0 +1,19 @@
+// SPDX-License-Identifier: MIT OR Apache-2.0
+pragma solidity >=0.6.0;
+
+import {IInterchainSecurityModule} from "./IInterchainSecurityModule.sol";
+
+interface IAggregationIsm is IInterchainSecurityModule {
+    /**
+     * @notice Returns the set of modules responsible for verifying _message
+     * and the number of modules that must verify
+     * @dev Can change based on the content of _message
+     * @param _message Hyperlane formatted interchain message
+     * @return modules The array of ISM addresses
+     * @return threshold The number of modules needed to verify
+     */
+    function modulesAndThreshold(bytes calldata _message)
+        external
+        view
+        returns (address[] memory modules, uint8 threshold);
+}

package/contracts/interfaces/IHyperlaneConnectionClient.sol

@@ -0,0 +1,20 @@
+// SPDX-License-Identifier: MIT OR Apache-2.0
+pragma solidity >=0.8.0;
+import {IInterchainGasPaymaster} from "./IInterchainGasPaymaster.sol";
+import {ISpecifiesInterchainSecurityModule} from "./IInterchainSecurityModule.sol";
+import {IMailbox} from "./IMailbox.sol";
+
+interface IHyperlaneConnectionClient is ISpecifiesInterchainSecurityModule {
+    function mailbox() external view returns (IMailbox);
+
+    function interchainGasPaymaster()
+        external
+        view
+        returns (IInterchainGasPaymaster);
+
+    function setMailbox(address) external;
+
+    function setInterchainGasPaymaster(address) external;
+
+    function setInterchainSecurityModule(address) external;
+}

package/{interfaces → contracts/interfaces}/IInterchainSecurityModule.sol

@@ -2,6 +2,14 @@
 pragma solidity >=0.6.11;
 
 interface IInterchainSecurityModule {
+    enum Types {
+        UNUSED_0,
+        ROUTING,
+        AGGREGATION,
+        LEGACY_MULTISIG,
+        MULTISIG
+    }
+
     /**
      * @notice Returns an enum that represents the type of security model
      * encoded by this ISM.

package/contracts/interfaces/IMailbox.sol

@@ -0,0 +1,71 @@
+// SPDX-License-Identifier: MIT OR Apache-2.0
+pragma solidity >=0.8.0;
+
+import {IInterchainSecurityModule} from "./IInterchainSecurityModule.sol";
+
+interface IMailbox {
+    // ============ Events ============
+    /**
+     * @notice Emitted when a new message is dispatched via Hyperlane
+     * @param sender The address that dispatched the message
+     * @param destination The destination domain of the message
+     * @param recipient The message recipient address on `destination`
+     * @param message Raw bytes of message
+     */
+    event Dispatch(
+        address indexed sender,
+        uint32 indexed destination,
+        bytes32 indexed recipient,
+        bytes message
+    );
+
+    /**
+     * @notice Emitted when a new message is dispatched via Hyperlane
+     * @param messageId The unique message identifier
+     */
+    event DispatchId(bytes32 indexed messageId);
+
+    /**
+     * @notice Emitted when a Hyperlane message is processed
+     * @param messageId The unique message identifier
+     */
+    event ProcessId(bytes32 indexed messageId);
+
+    /**
+     * @notice Emitted when a Hyperlane message is delivered
+     * @param origin The origin domain of the message
+     * @param sender The message sender address on `origin`
+     * @param recipient The address that handled the message
+     */
+    event Process(
+        uint32 indexed origin,
+        bytes32 indexed sender,
+        address indexed recipient
+    );
+
+    function localDomain() external view returns (uint32);
+
+    function delivered(bytes32 messageId) external view returns (bool);
+
+    function defaultIsm() external view returns (IInterchainSecurityModule);
+
+    function dispatch(
+        uint32 _destinationDomain,
+        bytes32 _recipientAddress,
+        bytes calldata _messageBody
+    ) external returns (bytes32);
+
+    function process(bytes calldata _metadata, bytes calldata _message)
+        external;
+
+    function count() external view returns (uint32);
+
+    function root() external view returns (bytes32);
+
+    function latestCheckpoint() external view returns (bytes32, uint32);
+
+    function recipientIsm(address _recipient)
+        external
+        view
+        returns (IInterchainSecurityModule);
+}

package/contracts/interfaces/IRouter.sol

@@ -0,0 +1,15 @@
+// SPDX-License-Identifier: MIT OR Apache-2.0
+pragma solidity >=0.8.0;
+
+interface IRouter {
+    function domains() external view returns (uint32[] memory);
+
+    function routers(uint32 _domain) external view returns (bytes32);
+
+    function enrollRemoteRouter(uint32 _domain, bytes32 _router) external;
+
+    function enrollRemoteRouters(
+        uint32[] calldata _domains,
+        bytes32[] calldata _routers
+    ) external;
+}

package/{interfaces → contracts/interfaces/isms}/IMultisigIsm.sol

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: MIT OR Apache-2.0
 pragma solidity >=0.6.0;
 
-import {IInterchainSecurityModule} from "./IInterchainSecurityModule.sol";
+import {IInterchainSecurityModule} from "../IInterchainSecurityModule.sol";
 
 interface IMultisigIsm is IInterchainSecurityModule {
     /**

package/contracts/interfaces/middleware/IInterchainAccountRouter.sol

@@ -0,0 +1,50 @@
+// SPDX-License-Identifier: MIT OR Apache-2.0
+pragma solidity >=0.6.11;
+
+import {OwnableMulticall} from "../../OwnableMulticall.sol";
+import {CallLib} from "../../libs/Call.sol";
+
+interface IInterchainAccountRouter {
+    function callRemote(
+        uint32 _destination,
+        address _to,
+        uint256 _value,
+        bytes calldata _data
+    ) external returns (bytes32);
+
+    function callRemote(uint32 _destination, CallLib.Call[] calldata calls)
+        external
+        returns (bytes32);
+
+    function callRemoteWithOverrides(
+        uint32 _destination,
+        bytes32 _router,
+        bytes32 _ism,
+        CallLib.Call[] calldata calls
+    ) external returns (bytes32);
+
+    function getLocalInterchainAccount(
+        uint32 _origin,
+        bytes32 _router,
+        bytes32 _owner,
+        address _ism
+    ) external view returns (OwnableMulticall);
+
+    function getLocalInterchainAccount(
+        uint32 _origin,
+        address _router,
+        address _owner,
+        address _ism
+    ) external view returns (OwnableMulticall);
+
+    function getRemoteInterchainAccount(
+        address _router,
+        address _owner,
+        address _ism
+    ) external view returns (address);
+
+    function getRemoteInterchainAccount(uint32 _destination, address _owner)
+        external
+        view
+        returns (address);
+}

package/contracts/interfaces/middleware/IInterchainQueryRouter.sol

@@ -0,0 +1,18 @@
+// SPDX-License-Identifier: MIT OR Apache-2.0
+pragma solidity >=0.6.11;
+
+import {CallLib} from "../../libs/Call.sol";
+
+interface IInterchainQueryRouter {
+    function query(
+        uint32 _destination,
+        address _to,
+        bytes memory _data,
+        bytes memory _callback
+    ) external returns (bytes32);
+
+    function query(
+        uint32 _destination,
+        CallLib.StaticCallWithCallback[] calldata calls
+    ) external returns (bytes32);
+}

package/contracts/isms/aggregation/AbstractAggregationIsm.sol

@@ -0,0 +1,72 @@
+// SPDX-License-Identifier: MIT OR Apache-2.0
+pragma solidity >=0.8.0;
+
+// ============ External Imports ============
+import {ECDSA} from "@openzeppelin/contracts/utils/cryptography/ECDSA.sol";
+
+// ============ Internal Imports ============
+import {IInterchainSecurityModule} from "../../interfaces/IInterchainSecurityModule.sol";
+import {IAggregationIsm} from "../../interfaces/IAggregationIsm.sol";
+import {AggregationIsmMetadata} from "../../libs/isms/AggregationIsmMetadata.sol";
+
+/**
+ * @title AggregationIsm
+ * @notice Manages per-domain m-of-n ISM sets that are used to verify
+ * interchain messages.
+ */
+abstract contract AbstractAggregationIsm is IAggregationIsm {
+    // ============ Constants ============
+
+    uint8 public constant moduleType =
+        uint8(IInterchainSecurityModule.Types.MULTISIG);
+
+    // ============ Virtual Functions ============
+    // ======= OVERRIDE THESE TO IMPLEMENT =======
+
+    /**
+     * @notice Returns the set of ISMs responsible for verifying _message
+     * and the number of ISMs that must verify
+     * @dev Can change based on the content of _message
+     * @param _message Hyperlane formatted interchain message
+     * @return modules The array of ISM addresses
+     * @return threshold The number of ISMs needed to verify
+     */
+    function modulesAndThreshold(bytes calldata _message)
+        public
+        view
+        virtual
+        returns (address[] memory, uint8);
+
+    // ============ Public Functions ============
+
+    /**
+     * @notice Requires that m-of-n ISMs verify the provided interchain message.
+     * @param _metadata ABI encoded module metadata (see AggregationIsmMetadata.sol)
+     * @param _message Formatted Hyperlane message (see Message.sol).
+     */
+    function verify(bytes calldata _metadata, bytes calldata _message)
+        public
+        returns (bool)
+    {
+        (address[] memory _isms, uint8 _threshold) = modulesAndThreshold(
+            _message
+        );
+        uint256 _count = _isms.length;
+        for (uint8 i = 0; i < _count; i++) {
+            if (!AggregationIsmMetadata.hasMetadata(_metadata, i)) continue;
+            IInterchainSecurityModule _ism = IInterchainSecurityModule(
+                _isms[i]
+            );
+            require(
+                _ism.verify(
+                    AggregationIsmMetadata.metadataAt(_metadata, i),
+                    _message
+                ),
+                "!verify"
+            );
+            _threshold -= 1;
+        }
+        require(_threshold == 0, "!threshold");
+        return true;
+    }
+}

package/contracts/isms/aggregation/StaticAggregationIsm.sol

@@ -0,0 +1,33 @@
+// SPDX-License-Identifier: MIT OR Apache-2.0
+pragma solidity >=0.8.0;
+
+// ============ Internal Imports ============
+import {AbstractAggregationIsm} from "./AbstractAggregationIsm.sol";
+import {AggregationIsmMetadata} from "../../libs/isms/AggregationIsmMetadata.sol";
+import {MetaProxy} from "../../libs/MetaProxy.sol";
+
+/**
+ * @title StaticAggregationIsm
+ * @notice Manages per-domain m-of-n ISM sets that are used to verify
+ * interchain messages.
+ */
+contract StaticAggregationIsm is AbstractAggregationIsm {
+    // ============ Public Functions ============
+
+    /**
+     * @notice Returns the set of ISMs responsible for verifying _message
+     * and the number of ISMs that must verify
+     * @dev Can change based on the content of _message
+     * @return modules The array of ISM addresses
+     * @return threshold The number of ISMs needed to verify
+     */
+    function modulesAndThreshold(bytes calldata)
+        public
+        view
+        virtual
+        override
+        returns (address[] memory, uint8)
+    {
+        return abi.decode(MetaProxy.metadata(), (address[], uint8));
+    }
+}

package/contracts/isms/aggregation/StaticAggregationIsmFactory.sol

@@ -0,0 +1,16 @@
+// SPDX-License-Identifier: MIT OR Apache-2.0
+pragma solidity >=0.8.0;
+// ============ Internal Imports ============
+import {StaticAggregationIsm} from "./StaticAggregationIsm.sol";
+import {StaticMOfNAddressSetFactory} from "../../libs/StaticMOfNAddressSetFactory.sol";
+
+contract StaticAggregationIsmFactory is StaticMOfNAddressSetFactory {
+    function _deployImplementation()
+        internal
+        virtual
+        override
+        returns (address)
+    {
+        return address(new StaticAggregationIsm());
+    }
+}

package/contracts/isms/multisig/AbstractMultisigIsm.sol

@@ -0,0 +1,124 @@
+// SPDX-License-Identifier: MIT OR Apache-2.0
+pragma solidity >=0.8.0;
+
+// ============ External Imports ============
+import {ECDSA} from "@openzeppelin/contracts/utils/cryptography/ECDSA.sol";
+
+// ============ Internal Imports ============
+import {IInterchainSecurityModule} from "../../interfaces/IInterchainSecurityModule.sol";
+import {IMultisigIsm} from "../../interfaces/isms/IMultisigIsm.sol";
+import {Message} from "../../libs/Message.sol";
+import {MultisigIsmMetadata} from "../../libs/isms/MultisigIsmMetadata.sol";
+import {CheckpointLib} from "../../libs/CheckpointLib.sol";
+import {MerkleLib} from "../../libs/Merkle.sol";
+
+/**
+ * @title MultisigIsm
+ * @notice Manages per-domain m-of-n Validator sets that are used to verify
+ * interchain messages.
+ */
+abstract contract AbstractMultisigIsm is IMultisigIsm {
+    // ============ Constants ============
+
+    uint8 public constant moduleType =
+        uint8(IInterchainSecurityModule.Types.MULTISIG);
+
+    // ============ Virtual Functions ============
+    // ======= OVERRIDE THESE TO IMPLEMENT =======
+
+    /**
+     * @notice Returns the set of validators responsible for verifying _message
+     * and the number of signatures required
+     * @dev Can change based on the content of _message
+     * @param _message Hyperlane formatted interchain message
+     * @return validators The array of validator addresses
+     * @return threshold The number of validator signatures needed
+     */
+    function validatorsAndThreshold(bytes calldata _message)
+        public
+        view
+        virtual
+        returns (address[] memory, uint8);
+
+    // ============ Public Functions ============
+
+    /**
+     * @notice Requires that m-of-n validators verify a merkle root,
+     * and verifies a merkle proof of `_message` against that root.
+     * @param _metadata ABI encoded module metadata (see MultisigIsmMetadata.sol)
+     * @param _message Formatted Hyperlane message (see Message.sol).
+     */
+    function verify(bytes calldata _metadata, bytes calldata _message)
+        public
+        view
+        returns (bool)
+    {
+        require(_verifyMerkleProof(_metadata, _message), "!merkle");
+        require(_verifyValidatorSignatures(_metadata, _message), "!sigs");
+        return true;
+    }
+
+    // ============ Internal Functions ============
+
+    /**
+     * @notice Verifies the merkle proof of `_message` against the provided
+     * checkpoint.
+     * @param _metadata ABI encoded module metadata (see MultisigIsmMetadata.sol)
+     * @param _message Formatted Hyperlane message (see Message.sol).
+     */
+    function _verifyMerkleProof(
+        bytes calldata _metadata,
+        bytes calldata _message
+    ) internal pure returns (bool) {
+        // calculate the expected root based on the proof
+        bytes32 _calculatedRoot = MerkleLib.branchRoot(
+            Message.id(_message),
+            MultisigIsmMetadata.proof(_metadata),
+            Message.nonce(_message)
+        );
+        return _calculatedRoot == MultisigIsmMetadata.root(_metadata);
+    }
+
+    /**
+     * @notice Verifies that a quorum of the origin domain's validators signed
+     * the provided checkpoint.
+     * @param _metadata ABI encoded module metadata (see MultisigIsmMetadata.sol)
+     * @param _message Formatted Hyperlane message (see Message.sol).
+     */
+    function _verifyValidatorSignatures(
+        bytes calldata _metadata,
+        bytes calldata _message
+    ) internal view returns (bool) {
+        (
+            address[] memory _validators,
+            uint8 _threshold
+        ) = validatorsAndThreshold(_message);
+        require(_threshold > 0, "No MultisigISM threshold present for message");
+        bytes32 _digest = CheckpointLib.digest(
+            Message.origin(_message),
+            MultisigIsmMetadata.originMailbox(_metadata),
+            MultisigIsmMetadata.root(_metadata),
+            MultisigIsmMetadata.index(_metadata)
+        );
+        uint256 _validatorCount = _validators.length;
+        uint256 _validatorIndex = 0;
+        // Assumes that signatures are ordered by validator
+        for (uint256 i = 0; i < _threshold; ++i) {
+            address _signer = ECDSA.recover(
+                _digest,
+                MultisigIsmMetadata.signatureAt(_metadata, i)
+            );
+            // Loop through remaining validators until we find a match
+            for (
+                ;
+                _validatorIndex < _validatorCount &&
+                    _signer != _validators[_validatorIndex];
+                ++_validatorIndex
+            ) {}
+            // Fail if we never found a match
+            require(_validatorIndex < _validatorCount, "!threshold");
+            ++_validatorIndex;
+        }
+        return true;
+    }
+}