@inco/lightning 0.3.2 → 0.5.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (108) hide show
  1. package/README.md +2 -8
  2. package/manifest.yaml +24 -11
  3. package/package.json +2 -5
  4. package/src/DeployUtils.sol +113 -77
  5. package/src/IIncoLightning.sol +16 -9
  6. package/src/IncoLightning.sol +18 -9
  7. package/src/IncoVerifier.sol +47 -0
  8. package/src/Lib.alphanet.sol +14 -15
  9. package/src/Lib.demonet.sol +14 -15
  10. package/src/Lib.devnet.sol +14 -15
  11. package/src/Lib.sol +14 -15
  12. package/src/Lib.template.sol +15 -44
  13. package/src/Lib.testnet.sol +14 -15
  14. package/src/Types.sol +7 -0
  15. package/src/interfaces/IIncoLightning.sol +20 -0
  16. package/src/interfaces/IIncoVerifier.sol +24 -0
  17. package/src/interfaces/automata-interfaces/BELE.sol +20 -0
  18. package/src/interfaces/automata-interfaces/IAutomataEnclaveIdentityDao.sol +28 -0
  19. package/src/interfaces/automata-interfaces/IFmspcTcbDao.sol +10 -0
  20. package/src/interfaces/automata-interfaces/IPCCSRouter.sol +94 -0
  21. package/src/interfaces/automata-interfaces/IPCCSRouterExtended.sol +10 -0
  22. package/src/interfaces/automata-interfaces/IPcsDao.sol +18 -0
  23. package/src/interfaces/automata-interfaces/IQuoteVerifier.sol +34 -0
  24. package/src/interfaces/automata-interfaces/Types.sol +193 -0
  25. package/src/libs/incoLightning_alphanet_v0_297966649.sol +14 -15
  26. package/src/libs/incoLightning_demonet_v0_863421733.sol +14 -15
  27. package/src/libs/incoLightning_devnet_v0_340846814.sol +14 -15
  28. package/src/libs/incoLightning_testnet_v0_183408998.sol +14 -15
  29. package/src/libs/incoLightning_testnet_v1_938327937.sol +451 -0
  30. package/src/lightning-parts/AccessControl/AdvancedAccessControl.sol +133 -0
  31. package/src/lightning-parts/AccessControl/AdvancedAccessControl.types.sol +18 -0
  32. package/src/lightning-parts/AccessControl/BaseAccessControlList.sol +42 -3
  33. package/src/lightning-parts/AccessControl/interfaces/IAdvancedAccessControl.sol +25 -0
  34. package/src/lightning-parts/AccessControl/interfaces/IBaseAccessControlList.sol +24 -0
  35. package/src/lightning-parts/AccessControl/test/TestAdvancedAccessControl.t.sol +234 -0
  36. package/src/lightning-parts/AccessControl/test/TestBaseAccessControl.t.sol +16 -2
  37. package/src/lightning-parts/DecryptionAttester.sol +45 -0
  38. package/src/lightning-parts/DecryptionAttester.types.sol +7 -0
  39. package/src/lightning-parts/EncryptedInput.sol +10 -13
  40. package/src/lightning-parts/EncryptedOperations.sol +78 -28
  41. package/src/lightning-parts/TEELifecycle.sol +180 -88
  42. package/src/lightning-parts/TrivialEncryption.sol +9 -9
  43. package/src/lightning-parts/interfaces/IDecryptionAttester.sol +9 -0
  44. package/src/lightning-parts/interfaces/IEncryptedInput.sol +19 -0
  45. package/src/lightning-parts/interfaces/IEncryptedOperations.sol +31 -0
  46. package/src/lightning-parts/interfaces/ITEELifecycle.sol +26 -0
  47. package/src/lightning-parts/interfaces/ITrivialEncryption.sol +10 -0
  48. package/src/lightning-parts/primitives/EventCounter.sol +15 -3
  49. package/src/lightning-parts/primitives/HandleGeneration.sol +8 -3
  50. package/src/lightning-parts/primitives/HandleMetadata.sol +1 -1
  51. package/src/lightning-parts/primitives/LightningAddressGetter.sol +10 -0
  52. package/src/lightning-parts/primitives/SignatureVerifier.sol +2 -9
  53. package/src/lightning-parts/primitives/VerifierAddressGetter.sol +13 -0
  54. package/src/lightning-parts/primitives/{EventCounter.gen.sol → interfaces/IEventCounter.sol} +4 -2
  55. package/src/lightning-parts/primitives/interfaces/IHandleGeneration.sol +41 -0
  56. package/src/lightning-parts/primitives/interfaces/ISignatureVerifier.sol +9 -0
  57. package/src/lightning-parts/primitives/interfaces/IVerifierAddressGetter.sol +8 -0
  58. package/src/lightning-parts/test/HandleMetadata.t.sol +25 -6
  59. package/src/lightning-parts/test/TestDecryptionAttestationInSynchronousFlow.t.sol +78 -0
  60. package/src/periphery/SessionVerifier.sol +63 -0
  61. package/src/test/AddTwo.sol +20 -24
  62. package/src/test/FakeIncoInfra/FakeDecryptionAttester.sol +198 -0
  63. package/src/test/FakeIncoInfra/FakeIncoInfraBase.sol +0 -15
  64. package/src/test/FakeIncoInfra/FakeQuoteVerifier.sol +10 -6
  65. package/src/test/FakeIncoInfra/MockOpHandler.sol +0 -7
  66. package/src/test/FakeIncoInfra/MockRemoteAttestation.sol +19 -7
  67. package/src/test/FakeIncoInfra/getOpForSelector.sol +0 -3
  68. package/src/test/IncoTest.sol +12 -11
  69. package/src/test/TEELifecycle/TEELifecycleMockTest.t.sol +98 -77
  70. package/src/test/TestAddTwo.t.sol +16 -9
  71. package/src/test/TestFakeInfra.t.sol +10 -27
  72. package/src/test/TestUpgrade.t.sol +11 -4
  73. package/src/test/TestVersion.t.sol +0 -7
  74. package/src/version/IncoLightningConfig.sol +4 -3
  75. package/src/version/SessionVerifierConfig.sol +8 -0
  76. package/src/version/Version.sol +7 -9
  77. package/src/version/interfaces/IVersion.sol +8 -0
  78. package/src/DeployTEE.sol +0 -153
  79. package/src/IncoLightning.gen.sol +0 -15
  80. package/src/lightning-parts/AccessControl/BaseAccessControlList.gen.sol +0 -19
  81. package/src/lightning-parts/DecryptionHandler.gen.sol +0 -54
  82. package/src/lightning-parts/DecryptionHandler.sol +0 -307
  83. package/src/lightning-parts/DecryptionHandler.types.sol +0 -34
  84. package/src/lightning-parts/EncryptedInput.gen.sol +0 -16
  85. package/src/lightning-parts/EncryptedOperations.gen.sol +0 -59
  86. package/src/lightning-parts/TEELifecycle.gen.sol +0 -58
  87. package/src/lightning-parts/TrivialEncryption.gen.sol +0 -15
  88. package/src/lightning-parts/primitives/HandleGeneration.gen.sol +0 -19
  89. package/src/lightning-parts/primitives/HandleMetadata.gen.sol +0 -4
  90. package/src/lightning-parts/primitives/SignatureVerifier.gen.sol +0 -16
  91. package/src/test/FibonacciDecrypt.sol +0 -49
  92. package/src/test/TEELifecycle/TEELifecycleHWTest.t.sol +0 -119
  93. package/src/test/TEELifecycle/addnode_data/eoa.txt +0 -1
  94. package/src/test/TEELifecycle/addnode_data/quote.bin +0 -0
  95. package/src/test/TEELifecycle/bootstrap_data/ecies_pubkey.bin +0 -1
  96. package/src/test/TEELifecycle/bootstrap_data/eip712_signature.bin +0 -1
  97. package/src/test/TEELifecycle/bootstrap_data/eoa.txt +0 -1
  98. package/src/test/TEELifecycle/bootstrap_data/qe_identity +0 -1
  99. package/src/test/TEELifecycle/bootstrap_data/qe_identity_signature.bin +0 -1
  100. package/src/test/TEELifecycle/bootstrap_data/quote.bin +0 -0
  101. package/src/test/TEELifecycle/bootstrap_data/tcb_info +0 -1
  102. package/src/test/TEELifecycle/bootstrap_data/tcb_info_signature.bin +0 -1
  103. package/src/test/TEELifecycle/test_cert/AttestationReportSigningCA.crl +0 -0
  104. package/src/test/TEELifecycle/test_cert/Intel_SGX_Attestation_RootCA.cer +0 -0
  105. package/src/test/TEELifecycle/test_cert/Intel_SGX_PCK_CRL.crl +0 -0
  106. package/src/test/TEELifecycle/test_cert/Intel_SGX_PCK_PlatformCA.cer +0 -0
  107. package/src/test/TEELifecycle/test_cert/Intel_SGX_TCB_Signing.cer +0 -0
  108. package/src/version/Version.gen.sol +0 -14
package/README.md CHANGED
@@ -1,5 +1,7 @@
1
1
  # Inco lite
2
2
 
3
+ <!-- todo #1035 upgrade deployment and upgrade documentation now outdated @silasdavis -->
4
+
3
5
  ## Install dependencies
4
6
 
5
7
  `bun install`
@@ -60,14 +62,6 @@ With a nod to the future we provide the `make release` target which performs a s
60
62
  1. PR to main
61
63
  2. Manually grab hash from dockerhub which is also `git describe --tags --always --dirty`
62
64
 
63
- ## Update denver multi-chain testnet
64
-
65
- 1. Copy docker tag into [Pulumi.multichain.yaml](../../infraco/pkg/denver/Pulumi.multichain.yaml)
66
- 2. Consider whether to cobber `requestConter.txt` and `lastBlock.txt` depending on the type of update:
67
- - If updating a covalidator to an existing contract use `--no-clobber`
68
- - If updating a covalidator to a new contract omit `--no-clobber`
69
- 3. Run `pulumi up`
70
-
71
65
  ## Manifest file
72
66
 
73
67
  [`manifest.yaml`](./manifest.yaml) is a file that tracks Inco Lightning smart contract releases (versioned instances of the executor contract) and deployments (actual instances of the contract on particular chains). The release names correspond to the names of the [solidity libs](./src/libs) that are libraries that statically link to the correct executor for the corresponding release.
package/manifest.yaml CHANGED
@@ -140,8 +140,8 @@ incoLightning_devnet_v0_340846814:
140
140
  salt: "0x8202d2d747784cb7d48868e44c42c4bf162a70bc00b001d6742fded0dd599ede"
141
141
  deployments:
142
142
  - name: incoLightningPreview_0_2_1__340846814
143
- chainId: "4801"
144
- chainName: World Chain Sepolia
143
+ chainId: "9746"
144
+ chainName: Plasma Testnet
145
145
  version:
146
146
  major: 0
147
147
  minor: 2
@@ -149,11 +149,11 @@ incoLightning_devnet_v0_340846814:
149
149
  shortSalt: "340846814"
150
150
  decryptSigner: "0x138AcbDC1FA02b955949d8Da09E546Ea7748710f"
151
151
  eciesPublicKey: "0x038a582d29083c2f3fefe024bf4dd9ab913ab8973716977da5f01106e0b84095b1"
152
- blockNumber: "17365942"
153
- deployDate: 2025-08-15T17:35:15.208Z
154
- commit: v0.2.17-35-g8cca6b4e-dirty
152
+ blockNumber: "1718868"
153
+ deployDate: 2025-09-10T15:20:25.654Z
154
+ commit: v6-7-gf96f358e-dirty
155
155
  active: true
156
- - name: incoLightningPreview_0_2_1__340846814
156
+ - name: incoLightning_0_2_1__340846814
157
157
  chainId: "9746"
158
158
  chainName: Plasma Testnet
159
159
  version:
@@ -162,11 +162,24 @@ incoLightning_devnet_v0_340846814:
162
162
  patch: 1
163
163
  shortSalt: "340846814"
164
164
  decryptSigner: "0x138AcbDC1FA02b955949d8Da09E546Ea7748710f"
165
- eciesPublicKey: "0x048a582d29083c2f3fefe024bf4dd9ab913ab8973716977da5f01106e0b8\
166
- 4095b1e647a9e377175fcb66bda05087c93b05e1fd53a704d0914bb23a0b2a69e9f235"
167
- blockNumber: "3339121"
168
- deployDate: 2025-08-07T12:14:56.788Z
169
- commit: v0.2.17-28-gfd11c1aa-dirty
165
+ eciesPublicKey: "0x038a582d29083c2f3fefe024bf4dd9ab913ab8973716977da5f01106e0b84095b1"
166
+ blockNumber: "1717229"
167
+ deployDate: 2025-09-10T14:53:07.218Z
168
+ commit: v6-7-gf96f358e-dirty
169
+ active: true
170
+ - name: incoLightningPreview_0_2_1__340846814
171
+ chainId: "4801"
172
+ chainName: World Chain Sepolia
173
+ version:
174
+ major: 0
175
+ minor: 2
176
+ patch: 1
177
+ shortSalt: "340846814"
178
+ decryptSigner: "0x138AcbDC1FA02b955949d8Da09E546Ea7748710f"
179
+ eciesPublicKey: "0x038a582d29083c2f3fefe024bf4dd9ab913ab8973716977da5f01106e0b84095b1"
180
+ blockNumber: "17365942"
181
+ deployDate: 2025-08-15T17:35:15.208Z
182
+ commit: v0.2.17-35-g8cca6b4e-dirty
170
183
  active: true
171
184
  - name: incoLightning_0_2_0__340846814
172
185
  chainId: "84532"
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@inco/lightning",
3
- "version": "0.3.2",
3
+ "version": "0.5.0",
4
4
  "repository": "https://github.com/Inco-fhevm/inco-monorepo",
5
5
  "files": [
6
6
  "src/",
@@ -19,16 +19,13 @@
19
19
  "@openzeppelin/contracts": "^5.2.0",
20
20
  "@openzeppelin/contracts-upgradeable": "^5.2.0",
21
21
  "@safe-global/safe-smart-account": "https://github.com/safe-global/safe-smart-account.git#v1.5.0",
22
- "automata-dcap-attestation": "https://github.com/automata-network/automata-dcap-attestation.git#evm-v1.0.0",
23
- "automata-on-chain-pccs": "https://github.com/automata-network/automata-on-chain-pccs.git#v1.0.0",
24
22
  "ds-test": "https://github.com/dapphub/ds-test",
25
23
  "forge-std": "https://github.com/foundry-rs/forge-std",
26
24
  "solady": "https://github.com/Vectorized/solady.git#v0.1.24",
27
25
  "tsx": "^4.19.3"
28
26
  },
29
27
  "devDependencies": {
30
- "@types/bun": "latest",
31
- "prettier": "^3.5.3"
28
+ "@types/bun": "latest"
32
29
  },
33
30
  "publishConfig": {
34
31
  "registry": "https://npm.pkg.github.com"
@@ -1,15 +1,26 @@
1
1
  // SPDX-License-Identifier: No License
2
2
  pragma solidity ^0.8;
3
3
 
4
- import {IncoLightning} from "../src/IncoLightning.sol";
4
+ import {IncoLightning} from "./IncoLightning.sol";
5
5
  import {Script} from "forge-std/Script.sol";
6
+ import {IIncoLightning} from "./interfaces/IIncoLightning.sol";
6
7
  import {Vm} from "forge-std/Vm.sol";
7
- import {CreateX, createXAddress, createXDeployer} from "../src/pasted-dependencies/CreateX.sol";
8
+ import {
9
+ CreateX,
10
+ createXAddress,
11
+ createXDeployer
12
+ } from "./pasted-dependencies/CreateX.sol";
8
13
  import {ERC1967Proxy} from "@openzeppelin/contracts/proxy/ERC1967/ERC1967Proxy.sol";
9
- import {CONTRACT_NAME, MAJOR_VERSION, MINOR_VERSION, PATCH_VERSION} from "../src/version/IncoLightningConfig.sol";
14
+ import {
15
+ CONTRACT_NAME,
16
+ MAJOR_VERSION,
17
+ VERIFIER_NAME
18
+ } from "./version/IncoLightningConfig.sol";
19
+ import {IncoVerifier} from "./IncoVerifier.sol";
20
+ import {IIncoVerifier} from "./interfaces/IIncoVerifier.sol";
10
21
  import {console} from "forge-std/console.sol";
11
22
  import {CreateXHelper} from "./CreateXHelper.sol";
12
- import {IncoLightningPreview} from "@inco/lightning-preview/src/IncoLightningPreview.sol";
23
+ import {IQuoteVerifier} from "./interfaces/automata-interfaces/IQuoteVerifier.sol";
13
24
 
14
25
  // can be set to 0x01 so the inco address can exist on only one chain, we want the same contract at the same address
15
26
  // on all chains
@@ -36,122 +47,147 @@ contract DeployUtils is Script {
36
47
  function getSalt(
37
48
  string memory name,
38
49
  uint8 majorVersionNumber,
39
- uint8 minorVersionNumber,
40
- uint8 patchVersionNumber,
41
50
  address deployer,
42
51
  string memory pepper
43
52
  ) internal pure returns (bytes32) {
44
53
  return
45
54
  bytes32(
46
- abi.encodePacked(
47
- deployer,
48
- crossChainDeployAuthorizedFlag,
49
- bytes11(
50
- keccak256(
51
- abi.encodePacked(
52
- name,
53
- majorVersionNumber,
54
- minorVersionNumber,
55
- patchVersionNumber,
56
- pepper
55
+ abi.encodePacked(
56
+ deployer,
57
+ crossChainDeployAuthorizedFlag,
58
+ bytes11(
59
+ keccak256(
60
+ abi.encodePacked(
61
+ name,
62
+ majorVersionNumber,
63
+ // "ghost" minor and patch versions are passed in the salt for retro compatibility
64
+ // of the deployment address
65
+ // todo #1037 remove permanently fake minor and patch versions from the salt
66
+ uint8(1),
67
+ uint8(29),
68
+ pepper
69
+ )
57
70
  )
58
71
  )
59
72
  )
60
- )
61
- );
73
+ );
62
74
  }
63
75
 
64
- /// @dev Computes the address of the IncoLightning contract using CreateX based on the deployer and pepper
65
- /// @param deployer MUST be the signer of the transaction
66
- /// @param pepper a value used to avoid address collision on deploying the same contract twice with the same deployer
67
- /// @param majorVersion major version of the contract
68
- /// @param minorVersion minor version of the contract
69
- /// @param patchVersion patch version of the contract
70
- /// @return the address of the IncoLightning contract
71
- /// @dev this function is used to compute the address of the contract before deploying it, so that we can check
72
- /// @notice this must be called after vm.startBroadcast() to get the correct address
73
- function computeIncoLightningAddress(
74
- address deployer,
75
- string memory pepper,
76
- uint8 majorVersion,
77
- uint8 minorVersion,
78
- uint8 patchVersion
79
- ) public returns (address) {
76
+ /// @notice Computes the address of the contract using CreateX based on the deployer and pepper
77
+ /// @dev not sure what the msg.sender influence is over the result
78
+ /// @param salt The salt value that will be passed to CreateX
79
+ /// @return The address of the deployed contract by CreateX
80
+ function computeAddressFromSalt(bytes32 salt) public returns (address) {
80
81
  CreateXHelper createX = new CreateXHelper();
81
- bytes32 salt = getSalt(
82
- CONTRACT_NAME,
83
- majorVersion,
84
- minorVersion,
85
- patchVersion,
86
- deployer,
87
- pepper
88
- );
89
82
  return createX.computeCreate3DeployAddress({salt: salt});
90
83
  }
91
84
 
92
85
  /// @dev wrap in prank or broadcast depending on prod or testing environment
93
86
  /// @param deployer MUST be the signer of the transaction
94
87
  /// @param pepper a value used to avoid address collision on deploying the same contract twice with the same deployer
95
- /// @param minorVersionForSalt minor version of the contract to use in the salt
96
- /// @param patchVersionForSalt patch version of the contract to use in the salt
97
- /// @param includePreviewFeatures whether to include preview features in the contract
98
- /// @param teeLifecycleAddress the address of the TEELifecycle contract to use in the contract
88
+ /// @param quoteVerifier the address of the QuoteVerifier contract to use in the contract
99
89
  function deployIncoLightningUsingConfig(
100
90
  address deployer,
101
91
  string memory pepper,
102
- // FIXME: on the next major version (new contract address and state) we should remove these from the salt altogether
103
- uint8 minorVersionForSalt,
104
- uint8 patchVersionForSalt,
105
- bool includePreviewFeatures,
106
- address teeLifecycleAddress
107
- ) internal returns (IncoLightning proxy) {
108
- bytes32 salt = getSalt(
109
- CONTRACT_NAME,
110
- MAJOR_VERSION,
111
- minorVersionForSalt,
112
- patchVersionForSalt,
92
+ IQuoteVerifier quoteVerifier
93
+ )
94
+ internal
95
+ returns (IIncoLightning lightningProxy, IIncoVerifier verifierProxy)
96
+ {
97
+ (bytes32 lightningSalt, bytes32 verifierSalt) = getIncoSalts(
113
98
  deployer,
114
99
  pepper
115
100
  );
116
101
  console.log(
117
- "Deploying Inco with deployerAddress: %s, salt: %s",
102
+ "Deploying Inco with deployerAddress: %s, lightning salt: %s",
118
103
  vm.toString(deployer),
119
- vm.toString(salt)
104
+ vm.toString(lightningSalt)
105
+ );
106
+ lightningProxy = deployLightning(lightningSalt, verifierSalt, deployer);
107
+ verifierProxy = deployVerifier(
108
+ verifierSalt,
109
+ lightningProxy,
110
+ deployer,
111
+ quoteVerifier
112
+ );
113
+ }
114
+
115
+ function getIncoSalts(
116
+ address deployer,
117
+ string memory pepper
118
+ ) internal pure returns (bytes32 lightningSalt, bytes32 verifierSalt) {
119
+ lightningSalt = getSalt(CONTRACT_NAME, MAJOR_VERSION, deployer, pepper);
120
+ verifierSalt = getSalt(VERIFIER_NAME, MAJOR_VERSION, deployer, pepper);
121
+ }
122
+
123
+ /// @notice Deploys the IncoLightning contract
124
+ /// @param lightningSalt The salt value that will be passed to CreateX
125
+ /// @param verifierSalt The salt value that will be passed to CreateX
126
+ /// @param deployer The address of the deployer
127
+ function deployLightning(
128
+ bytes32 lightningSalt,
129
+ bytes32 verifierSalt,
130
+ address deployer
131
+ ) internal returns (IIncoLightning lightningProxy) {
132
+ address verifierAddress = computeAddressFromSalt(verifierSalt);
133
+ IncoLightning lightningImplem = new IncoLightning(
134
+ lightningSalt,
135
+ IIncoVerifier(verifierAddress)
120
136
  );
121
- IncoLightning implementation = new IncoLightning(salt);
122
- if (includePreviewFeatures) {
123
- IncoLightningPreview preview = new IncoLightningPreview(address(implementation));
124
- // FIXME: This is hack, we ought to define an interface IIncoLightning here and use that instead
125
- implementation = IncoLightning(address(preview));
126
- }
127
- proxy = IncoLightning(
137
+ lightningProxy = IIncoLightning(
128
138
  deployProxy({
129
- salt: salt,
130
- implem: address(implementation),
139
+ salt: lightningSalt,
140
+ implem: address(lightningImplem),
131
141
  initCall: abi.encodeWithSelector(
132
- IncoLightning.initialize.selector,
133
- deployer,
134
- teeLifecycleAddress
142
+ IIncoLightning.initialize.selector,
143
+ deployer // owner
135
144
  )
136
145
  })
137
146
  );
138
147
  }
139
148
 
149
+ /// @notice Deploys the IncoVerifier contract
150
+ /// @param verifierSalt The salt value that will be passed to CreateX
151
+ /// @param lightning The previously deployed lightning contract
152
+ /// @param deployer The address of the deployer
153
+ /// @param quoteVerifier The address of the TEE lifecycle contract
154
+ /// @dev lightning implem must already be deployed
155
+ function deployVerifier(
156
+ bytes32 verifierSalt,
157
+ IIncoLightning lightning,
158
+ address deployer,
159
+ IQuoteVerifier quoteVerifier
160
+ ) internal returns (IIncoVerifier verifierProxy) {
161
+ IncoVerifier verifierImplem = new IncoVerifier(address(lightning));
162
+ verifierProxy = IIncoVerifier(
163
+ deployProxy({
164
+ salt: verifierSalt,
165
+ implem: address(verifierImplem),
166
+ initCall: abi.encodeWithSelector(
167
+ IIncoVerifier.initialize.selector,
168
+ deployer, // owner
169
+ VERIFIER_NAME,
170
+ lightning.getVersion(),
171
+ quoteVerifier
172
+ )
173
+ })
174
+ );
175
+ }
140
176
 
141
- /// @notice deploys a ERC1967Proxy contract using CreateX (create3 pattern), gives the deployer the ownership of
142
- /// the proxy
143
- /// @dev deployer is made the owner of the contract
177
+ /// @notice deploys a ERC1967Proxy contract using CreateX (create3 pattern), gives the deployer the ownership of
178
+ /// the proxy
179
+ /// @dev deployer is made the owner of the contract
144
180
  function deployProxy(
145
181
  bytes32 salt,
146
182
  address implem,
147
183
  bytes memory initCall
148
184
  ) internal returns (address proxy) {
149
185
  CreateX createX = CreateX(createXAddress);
150
- CreateX.Values memory msgValues = CreateX.Values(0, 0);
151
186
  bytes memory bytecode = abi.encodePacked(
152
187
  type(ERC1967Proxy).creationCode,
153
188
  abi.encode(implem, initCall)
154
189
  );
155
- proxy = createX.deployCreate3AndInit(salt, bytecode, "", msgValues);
190
+ // todo: check if we don't have a double delegatecall cost issue
191
+ proxy = createX.deployCreate3(salt, bytecode);
156
192
  }
157
193
  }
@@ -1,13 +1,20 @@
1
1
  // SPDX-License-Identifier: No License
2
2
  pragma solidity ^0.8;
3
3
 
4
- import {IIncoLightningGen} from "./IncoLightning.gen.sol";
5
- import {IEncryptedInputGen} from "./lightning-parts/EncryptedInput.gen.sol";
6
- import {IDecryptionHandlerGen} from "./lightning-parts/DecryptionHandler.gen.sol";
7
- import {IEncryptedOperationsGen} from "./lightning-parts/EncryptedOperations.gen.sol";
8
- import {ITrivialEncryptionGen} from "./lightning-parts/TrivialEncryption.gen.sol";
9
- import {IBaseAccessControlListGen} from "./lightning-parts/AccessControl/BaseAccessControlList.gen.sol";
10
- import {IHandleGenerationGen} from "./lightning-parts/primitives/HandleGeneration.gen.sol";
4
+ import {IEncryptedInput} from "./lightning-parts/interfaces/IEncryptedInput.sol";
5
+ import {IEncryptedOperations} from "./lightning-parts/interfaces/IEncryptedOperations.sol";
6
+ import {ITrivialEncryption} from "./lightning-parts/interfaces/ITrivialEncryption.sol";
7
+ import {IBaseAccessControlList} from "./lightning-parts/AccessControl/interfaces/IBaseAccessControlList.sol";
8
+ import {IHandleGeneration} from "./lightning-parts/primitives/interfaces/IHandleGeneration.sol";
9
+ import {IVersion} from "./version/interfaces/IVersion.sol";
11
10
 
12
-
13
- interface IIncoLightning is IIncoLightningGen, IEncryptedInputGen, IDecryptionHandlerGen, IEncryptedOperationsGen, ITrivialEncryptionGen, IBaseAccessControlListGen, IHandleGenerationGen {}
11
+ interface IIncoLightning is
12
+ IEncryptedInput,
13
+ IEncryptedOperations,
14
+ ITrivialEncryption,
15
+ IBaseAccessControlList,
16
+ IHandleGeneration,
17
+ IVersion
18
+ {
19
+ function initialize(address owner) external;
20
+ }
@@ -1,31 +1,40 @@
1
1
  // SPDX-License-Identifier: No License
2
2
  pragma solidity ^0.8;
3
3
 
4
- import {IIncoLightning} from "./IIncoLightning.sol";
5
- import {CONTRACT_NAME, MAJOR_VERSION, MINOR_VERSION, PATCH_VERSION} from "./version/IncoLightningConfig.sol";
6
- import {DecryptionHandler} from "./lightning-parts/DecryptionHandler.sol";
4
+ import {IIncoLightning} from "./interfaces/IIncoLightning.sol";
5
+ import {
6
+ CONTRACT_NAME,
7
+ MAJOR_VERSION,
8
+ MINOR_VERSION,
9
+ PATCH_VERSION
10
+ } from "./version/IncoLightningConfig.sol";
7
11
  import {EncryptedInput} from "./lightning-parts/EncryptedInput.sol";
8
12
  import {EncryptedOperations} from "./lightning-parts/EncryptedOperations.sol";
9
- import {IIncoLightningGen} from "./IncoLightning.gen.sol";
10
13
  import {TrivialEncryption} from "./lightning-parts/TrivialEncryption.sol";
11
14
  import {UUPSUpgradeable} from "@openzeppelin/contracts/proxy/utils/UUPSUpgradeable.sol";
15
+ import {OwnableUpgradeable} from "@openzeppelin/contracts-upgradeable/access/OwnableUpgradeable.sol";
12
16
  import {Version} from "./version/Version.sol";
17
+ import {IIncoVerifier} from "./interfaces/IIncoVerifier.sol";
18
+ import {VerifierAddressGetter} from "./lightning-parts/primitives/VerifierAddressGetter.sol";
19
+
20
+ // todo add initialization of tee lifecycle
13
21
 
14
22
  /// @title Inco Lightning
15
23
  /// @notice Onchain singleton for Inco Lightning, TEE-based encrypted data and operations over shared state service
16
- /// @dev implicitly extends BaseAccessControlList, SignatureVerifier, OwnableUpgradeable
24
+ /// @dev implicitly extends BaseAccessControlList, IncoVerifierGetter
17
25
  contract IncoLightning is
18
26
  IIncoLightning,
19
27
  EncryptedOperations,
20
- DecryptionHandler,
21
28
  TrivialEncryption,
22
29
  UUPSUpgradeable,
23
30
  EncryptedInput,
31
+ OwnableUpgradeable,
24
32
  Version
25
33
  {
26
34
  // salt embeds the deployer address, the contract name, the version and the pepper
27
35
  constructor(
28
- bytes32 salt
36
+ bytes32 salt,
37
+ IIncoVerifier _incoVerifier
29
38
  )
30
39
  Version(
31
40
  MAJOR_VERSION,
@@ -34,15 +43,15 @@ contract IncoLightning is
34
43
  salt,
35
44
  CONTRACT_NAME
36
45
  )
46
+ VerifierAddressGetter(address(_incoVerifier))
37
47
  {}
38
48
 
39
49
  function _authorizeUpgrade(address) internal view override {
40
50
  require(msg.sender == owner());
41
51
  }
42
52
 
43
- function initialize(address owner, address teeLifecycleAddress) public initializer {
53
+ function initialize(address owner) public initializer {
44
54
  __Ownable_init(owner);
45
- __SignatureVerifier_init(teeLifecycleAddress);
46
55
  }
47
56
 
48
57
  fallback() external {} // must be included for createX deploy
@@ -0,0 +1,47 @@
1
+ // SPDX-License-Identifier: No License
2
+ pragma solidity ^0.8;
3
+
4
+ import {AdvancedAccessControl} from "./lightning-parts/AccessControl/AdvancedAccessControl.sol";
5
+ import {DecryptionAttester} from "./lightning-parts/DecryptionAttester.sol";
6
+ import {UUPSUpgradeable} from "@openzeppelin/contracts/proxy/utils/UUPSUpgradeable.sol";
7
+ import {IQuoteVerifier} from "./interfaces/automata-interfaces/IQuoteVerifier.sol";
8
+ import {TEELifecycle} from "./lightning-parts/TEELifecycle.sol";
9
+ import {IIncoVerifier} from "./interfaces/IIncoVerifier.sol";
10
+ import {LightningAddressGetter} from "./lightning-parts/primitives/LightningAddressGetter.sol";
11
+
12
+ /// @dev implicitely extends OwnableUpgradeable, EIP712Upgradeable, SignatureVerifier, LightningAddressGetter
13
+ /// @dev NEVER deploy this contract on its own, always deploy as a joint process with IncoLightning
14
+ contract IncoVerifier is
15
+ IIncoVerifier,
16
+ AdvancedAccessControl,
17
+ DecryptionAttester,
18
+ TEELifecycle,
19
+ UUPSUpgradeable
20
+ {
21
+ constructor(
22
+ address _incoLightningAddress
23
+ ) LightningAddressGetter(_incoLightningAddress) {}
24
+
25
+ function _authorizeUpgrade(address) internal view override {
26
+ require(msg.sender == owner());
27
+ }
28
+
29
+ function initialize(
30
+ address owner,
31
+ string memory name,
32
+ string memory version,
33
+ IQuoteVerifier quoteVerifier
34
+ ) public initializer {
35
+ __Ownable_init(owner);
36
+ __EIP712_init(name, version);
37
+ __TEELifecycle_init(quoteVerifier);
38
+ }
39
+
40
+ function getEIP712Name() external view returns (string memory) {
41
+ return _EIP712Name();
42
+ }
43
+
44
+ function getEIP712Version() external view returns (string memory) {
45
+ return _EIP712Version();
46
+ }
47
+ }
@@ -5,12 +5,11 @@
5
5
  /// SPDX-License-Identifier: No License
6
6
  pragma solidity ^0.8;
7
7
 
8
- import "./IncoLightning.sol";
9
- import { ebool, euint256, eaddress, ETypes, isTypeSupported } from "./Types.sol";
8
+ import { IncoLightning } from "./IncoLightning.sol";
9
+ import { ebool, euint256, eaddress, ETypes } from "./Types.sol";
10
10
 
11
11
  IncoLightning constant inco = IncoLightning(0x4651DfD7729aE5568092E7351fAaD872266d4CBd);
12
12
  address constant deployedBy = 0x8202D2D747784Cb7D48868E44C42C4bf162a70BC;
13
- uint256 constant defaultDecryptionDelayLimit = 2 hours;
14
13
 
15
14
  function typeOf(bytes32 handle) pure returns (ETypes) {
16
15
  return ETypes(uint8(uint256(handle) >> 8));
@@ -410,6 +409,18 @@ library e {
410
409
  inco.allow(eaddress.unwrap(a), to);
411
410
  }
412
411
 
412
+ function reveal(euint256 a) internal {
413
+ inco.reveal(euint256.unwrap(a));
414
+ }
415
+
416
+ function reveal(ebool a) internal {
417
+ inco.reveal(ebool.unwrap(a));
418
+ }
419
+
420
+ function reveal(eaddress a) internal {
421
+ inco.reveal(eaddress.unwrap(a));
422
+ }
423
+
413
424
  function allowThis(euint256 a) internal {
414
425
  allow(a, address(this));
415
426
  }
@@ -437,16 +448,4 @@ library e {
437
448
  function select(ebool control, eaddress ifTrue, eaddress ifFalse) internal returns (eaddress) {
438
449
  return eaddress.wrap(inco.eIfThenElse(s(control), eaddress.unwrap(s(ifTrue)), eaddress.unwrap(s(ifFalse))));
439
450
  }
440
-
441
- function requestDecryption(euint256 a, bytes4 callbackSelector, bytes memory callbackData) internal returns (uint256 requestId) {
442
- requestId = inco.requestDecryption(callbackSelector, block.timestamp + defaultDecryptionDelayLimit, euint256.unwrap(s(a)), callbackData);
443
- }
444
-
445
- function requestDecryption(ebool a, bytes4 callbackSelector, bytes memory callbackData) internal returns (uint256 requestId) {
446
- requestId = inco.requestDecryption(callbackSelector, block.timestamp + defaultDecryptionDelayLimit, ebool.unwrap(s(a)), callbackData);
447
- }
448
-
449
- function requestDecryption(eaddress a, bytes4 callbackSelector, bytes memory callbackData) internal returns (uint256 requestId) {
450
- requestId = inco.requestDecryption(callbackSelector, block.timestamp + defaultDecryptionDelayLimit, eaddress.unwrap(s(a)), callbackData);
451
- }
452
451
  }
@@ -5,12 +5,11 @@
5
5
  /// SPDX-License-Identifier: No License
6
6
  pragma solidity ^0.8;
7
7
 
8
- import "./IncoLightning.sol";
9
- import { ebool, euint256, eaddress, ETypes, isTypeSupported } from "./Types.sol";
8
+ import { IncoLightning } from "./IncoLightning.sol";
9
+ import { ebool, euint256, eaddress, ETypes } from "./Types.sol";
10
10
 
11
11
  IncoLightning constant inco = IncoLightning(0xeBAFF6D578733E4603b99CBdbb221482F29a78E1);
12
12
  address constant deployedBy = 0x8202D2D747784Cb7D48868E44C42C4bf162a70BC;
13
- uint256 constant defaultDecryptionDelayLimit = 2 hours;
14
13
 
15
14
  function typeOf(bytes32 handle) pure returns (ETypes) {
16
15
  return ETypes(uint8(uint256(handle) >> 8));
@@ -410,6 +409,18 @@ library e {
410
409
  inco.allow(eaddress.unwrap(a), to);
411
410
  }
412
411
 
412
+ function reveal(euint256 a) internal {
413
+ inco.reveal(euint256.unwrap(a));
414
+ }
415
+
416
+ function reveal(ebool a) internal {
417
+ inco.reveal(ebool.unwrap(a));
418
+ }
419
+
420
+ function reveal(eaddress a) internal {
421
+ inco.reveal(eaddress.unwrap(a));
422
+ }
423
+
413
424
  function allowThis(euint256 a) internal {
414
425
  allow(a, address(this));
415
426
  }
@@ -437,16 +448,4 @@ library e {
437
448
  function select(ebool control, eaddress ifTrue, eaddress ifFalse) internal returns (eaddress) {
438
449
  return eaddress.wrap(inco.eIfThenElse(s(control), eaddress.unwrap(s(ifTrue)), eaddress.unwrap(s(ifFalse))));
439
450
  }
440
-
441
- function requestDecryption(euint256 a, bytes4 callbackSelector, bytes memory callbackData) internal returns (uint256 requestId) {
442
- requestId = inco.requestDecryption(callbackSelector, block.timestamp + defaultDecryptionDelayLimit, euint256.unwrap(s(a)), callbackData);
443
- }
444
-
445
- function requestDecryption(ebool a, bytes4 callbackSelector, bytes memory callbackData) internal returns (uint256 requestId) {
446
- requestId = inco.requestDecryption(callbackSelector, block.timestamp + defaultDecryptionDelayLimit, ebool.unwrap(s(a)), callbackData);
447
- }
448
-
449
- function requestDecryption(eaddress a, bytes4 callbackSelector, bytes memory callbackData) internal returns (uint256 requestId) {
450
- requestId = inco.requestDecryption(callbackSelector, block.timestamp + defaultDecryptionDelayLimit, eaddress.unwrap(s(a)), callbackData);
451
- }
452
451
  }
@@ -5,12 +5,11 @@
5
5
  /// SPDX-License-Identifier: No License
6
6
  pragma solidity ^0.8;
7
7
 
8
- import "./IncoLightning.sol";
9
- import { ebool, euint256, eaddress, ETypes, isTypeSupported } from "./Types.sol";
8
+ import { IncoLightning } from "./IncoLightning.sol";
9
+ import { ebool, euint256, eaddress, ETypes } from "./Types.sol";
10
10
 
11
11
  IncoLightning constant inco = IncoLightning(0x3B22be60Ae699933959CA3cE147C96caa88Ccd3D);
12
12
  address constant deployedBy = 0x8202D2D747784Cb7D48868E44C42C4bf162a70BC;
13
- uint256 constant defaultDecryptionDelayLimit = 2 hours;
14
13
 
15
14
  function typeOf(bytes32 handle) pure returns (ETypes) {
16
15
  return ETypes(uint8(uint256(handle) >> 8));
@@ -410,6 +409,18 @@ library e {
410
409
  inco.allow(eaddress.unwrap(a), to);
411
410
  }
412
411
 
412
+ function reveal(euint256 a) internal {
413
+ inco.reveal(euint256.unwrap(a));
414
+ }
415
+
416
+ function reveal(ebool a) internal {
417
+ inco.reveal(ebool.unwrap(a));
418
+ }
419
+
420
+ function reveal(eaddress a) internal {
421
+ inco.reveal(eaddress.unwrap(a));
422
+ }
423
+
413
424
  function allowThis(euint256 a) internal {
414
425
  allow(a, address(this));
415
426
  }
@@ -437,16 +448,4 @@ library e {
437
448
  function select(ebool control, eaddress ifTrue, eaddress ifFalse) internal returns (eaddress) {
438
449
  return eaddress.wrap(inco.eIfThenElse(s(control), eaddress.unwrap(s(ifTrue)), eaddress.unwrap(s(ifFalse))));
439
450
  }
440
-
441
- function requestDecryption(euint256 a, bytes4 callbackSelector, bytes memory callbackData) internal returns (uint256 requestId) {
442
- requestId = inco.requestDecryption(callbackSelector, block.timestamp + defaultDecryptionDelayLimit, euint256.unwrap(s(a)), callbackData);
443
- }
444
-
445
- function requestDecryption(ebool a, bytes4 callbackSelector, bytes memory callbackData) internal returns (uint256 requestId) {
446
- requestId = inco.requestDecryption(callbackSelector, block.timestamp + defaultDecryptionDelayLimit, ebool.unwrap(s(a)), callbackData);
447
- }
448
-
449
- function requestDecryption(eaddress a, bytes4 callbackSelector, bytes memory callbackData) internal returns (uint256 requestId) {
450
- requestId = inco.requestDecryption(callbackSelector, block.timestamp + defaultDecryptionDelayLimit, eaddress.unwrap(s(a)), callbackData);
451
- }
452
451
  }