@inco/lightning 0.3.2 → 0.5.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +2 -8
- package/manifest.yaml +24 -11
- package/package.json +2 -5
- package/src/DeployUtils.sol +113 -77
- package/src/IIncoLightning.sol +16 -9
- package/src/IncoLightning.sol +18 -9
- package/src/IncoVerifier.sol +47 -0
- package/src/Lib.alphanet.sol +14 -15
- package/src/Lib.demonet.sol +14 -15
- package/src/Lib.devnet.sol +14 -15
- package/src/Lib.sol +14 -15
- package/src/Lib.template.sol +15 -44
- package/src/Lib.testnet.sol +14 -15
- package/src/Types.sol +7 -0
- package/src/interfaces/IIncoLightning.sol +20 -0
- package/src/interfaces/IIncoVerifier.sol +24 -0
- package/src/interfaces/automata-interfaces/BELE.sol +20 -0
- package/src/interfaces/automata-interfaces/IAutomataEnclaveIdentityDao.sol +28 -0
- package/src/interfaces/automata-interfaces/IFmspcTcbDao.sol +10 -0
- package/src/interfaces/automata-interfaces/IPCCSRouter.sol +94 -0
- package/src/interfaces/automata-interfaces/IPCCSRouterExtended.sol +10 -0
- package/src/interfaces/automata-interfaces/IPcsDao.sol +18 -0
- package/src/interfaces/automata-interfaces/IQuoteVerifier.sol +34 -0
- package/src/interfaces/automata-interfaces/Types.sol +193 -0
- package/src/libs/incoLightning_alphanet_v0_297966649.sol +14 -15
- package/src/libs/incoLightning_demonet_v0_863421733.sol +14 -15
- package/src/libs/incoLightning_devnet_v0_340846814.sol +14 -15
- package/src/libs/incoLightning_testnet_v0_183408998.sol +14 -15
- package/src/libs/incoLightning_testnet_v1_938327937.sol +451 -0
- package/src/lightning-parts/AccessControl/AdvancedAccessControl.sol +133 -0
- package/src/lightning-parts/AccessControl/AdvancedAccessControl.types.sol +18 -0
- package/src/lightning-parts/AccessControl/BaseAccessControlList.sol +42 -3
- package/src/lightning-parts/AccessControl/interfaces/IAdvancedAccessControl.sol +25 -0
- package/src/lightning-parts/AccessControl/interfaces/IBaseAccessControlList.sol +24 -0
- package/src/lightning-parts/AccessControl/test/TestAdvancedAccessControl.t.sol +234 -0
- package/src/lightning-parts/AccessControl/test/TestBaseAccessControl.t.sol +16 -2
- package/src/lightning-parts/DecryptionAttester.sol +45 -0
- package/src/lightning-parts/DecryptionAttester.types.sol +7 -0
- package/src/lightning-parts/EncryptedInput.sol +10 -13
- package/src/lightning-parts/EncryptedOperations.sol +78 -28
- package/src/lightning-parts/TEELifecycle.sol +180 -88
- package/src/lightning-parts/TrivialEncryption.sol +9 -9
- package/src/lightning-parts/interfaces/IDecryptionAttester.sol +9 -0
- package/src/lightning-parts/interfaces/IEncryptedInput.sol +19 -0
- package/src/lightning-parts/interfaces/IEncryptedOperations.sol +31 -0
- package/src/lightning-parts/interfaces/ITEELifecycle.sol +26 -0
- package/src/lightning-parts/interfaces/ITrivialEncryption.sol +10 -0
- package/src/lightning-parts/primitives/EventCounter.sol +15 -3
- package/src/lightning-parts/primitives/HandleGeneration.sol +8 -3
- package/src/lightning-parts/primitives/HandleMetadata.sol +1 -1
- package/src/lightning-parts/primitives/LightningAddressGetter.sol +10 -0
- package/src/lightning-parts/primitives/SignatureVerifier.sol +2 -9
- package/src/lightning-parts/primitives/VerifierAddressGetter.sol +13 -0
- package/src/lightning-parts/primitives/{EventCounter.gen.sol → interfaces/IEventCounter.sol} +4 -2
- package/src/lightning-parts/primitives/interfaces/IHandleGeneration.sol +41 -0
- package/src/lightning-parts/primitives/interfaces/ISignatureVerifier.sol +9 -0
- package/src/lightning-parts/primitives/interfaces/IVerifierAddressGetter.sol +8 -0
- package/src/lightning-parts/test/HandleMetadata.t.sol +25 -6
- package/src/lightning-parts/test/TestDecryptionAttestationInSynchronousFlow.t.sol +78 -0
- package/src/periphery/SessionVerifier.sol +63 -0
- package/src/test/AddTwo.sol +20 -24
- package/src/test/FakeIncoInfra/FakeDecryptionAttester.sol +198 -0
- package/src/test/FakeIncoInfra/FakeIncoInfraBase.sol +0 -15
- package/src/test/FakeIncoInfra/FakeQuoteVerifier.sol +10 -6
- package/src/test/FakeIncoInfra/MockOpHandler.sol +0 -7
- package/src/test/FakeIncoInfra/MockRemoteAttestation.sol +19 -7
- package/src/test/FakeIncoInfra/getOpForSelector.sol +0 -3
- package/src/test/IncoTest.sol +12 -11
- package/src/test/TEELifecycle/TEELifecycleMockTest.t.sol +98 -77
- package/src/test/TestAddTwo.t.sol +16 -9
- package/src/test/TestFakeInfra.t.sol +10 -27
- package/src/test/TestUpgrade.t.sol +11 -4
- package/src/test/TestVersion.t.sol +0 -7
- package/src/version/IncoLightningConfig.sol +4 -3
- package/src/version/SessionVerifierConfig.sol +8 -0
- package/src/version/Version.sol +7 -9
- package/src/version/interfaces/IVersion.sol +8 -0
- package/src/DeployTEE.sol +0 -153
- package/src/IncoLightning.gen.sol +0 -15
- package/src/lightning-parts/AccessControl/BaseAccessControlList.gen.sol +0 -19
- package/src/lightning-parts/DecryptionHandler.gen.sol +0 -54
- package/src/lightning-parts/DecryptionHandler.sol +0 -307
- package/src/lightning-parts/DecryptionHandler.types.sol +0 -34
- package/src/lightning-parts/EncryptedInput.gen.sol +0 -16
- package/src/lightning-parts/EncryptedOperations.gen.sol +0 -59
- package/src/lightning-parts/TEELifecycle.gen.sol +0 -58
- package/src/lightning-parts/TrivialEncryption.gen.sol +0 -15
- package/src/lightning-parts/primitives/HandleGeneration.gen.sol +0 -19
- package/src/lightning-parts/primitives/HandleMetadata.gen.sol +0 -4
- package/src/lightning-parts/primitives/SignatureVerifier.gen.sol +0 -16
- package/src/test/FibonacciDecrypt.sol +0 -49
- package/src/test/TEELifecycle/TEELifecycleHWTest.t.sol +0 -119
- package/src/test/TEELifecycle/addnode_data/eoa.txt +0 -1
- package/src/test/TEELifecycle/addnode_data/quote.bin +0 -0
- package/src/test/TEELifecycle/bootstrap_data/ecies_pubkey.bin +0 -1
- package/src/test/TEELifecycle/bootstrap_data/eip712_signature.bin +0 -1
- package/src/test/TEELifecycle/bootstrap_data/eoa.txt +0 -1
- package/src/test/TEELifecycle/bootstrap_data/qe_identity +0 -1
- package/src/test/TEELifecycle/bootstrap_data/qe_identity_signature.bin +0 -1
- package/src/test/TEELifecycle/bootstrap_data/quote.bin +0 -0
- package/src/test/TEELifecycle/bootstrap_data/tcb_info +0 -1
- package/src/test/TEELifecycle/bootstrap_data/tcb_info_signature.bin +0 -1
- package/src/test/TEELifecycle/test_cert/AttestationReportSigningCA.crl +0 -0
- package/src/test/TEELifecycle/test_cert/Intel_SGX_Attestation_RootCA.cer +0 -0
- package/src/test/TEELifecycle/test_cert/Intel_SGX_PCK_CRL.crl +0 -0
- package/src/test/TEELifecycle/test_cert/Intel_SGX_PCK_PlatformCA.cer +0 -0
- package/src/test/TEELifecycle/test_cert/Intel_SGX_TCB_Signing.cer +0 -0
- package/src/version/Version.gen.sol +0 -14
|
@@ -2,13 +2,14 @@
|
|
|
2
2
|
pragma solidity ^0.8;
|
|
3
3
|
|
|
4
4
|
import {IncoTest} from "./IncoTest.sol";
|
|
5
|
-
import {e, euint256, ebool, eaddress} from "../Lib.sol";
|
|
5
|
+
import {e, euint256, ebool, eaddress, inco} from "../Lib.sol";
|
|
6
6
|
import {SenderNotAllowedForHandle} from "../Types.sol";
|
|
7
7
|
import {TEELifecycle} from "../lightning-parts/TEELifecycle.sol";
|
|
8
8
|
import {MockRemoteAttestation} from "./FakeIncoInfra/MockRemoteAttestation.sol";
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
9
|
+
import {
|
|
10
|
+
TD10ReportBody,
|
|
11
|
+
MINIMUM_QUOTE_LENGTH
|
|
12
|
+
} from "../interfaces/automata-interfaces/Types.sol";
|
|
12
13
|
|
|
13
14
|
contract TakesEInput {
|
|
14
15
|
using e for bytes;
|
|
@@ -26,18 +27,6 @@ contract TakesEInput {
|
|
|
26
27
|
function setB(bytes memory boolEInput) external {
|
|
27
28
|
b = boolEInput.newEbool(msg.sender);
|
|
28
29
|
}
|
|
29
|
-
|
|
30
|
-
function decryptA() external {
|
|
31
|
-
a.requestDecryption(this.aDecryptionCallback.selector, "");
|
|
32
|
-
}
|
|
33
|
-
|
|
34
|
-
function aDecryptionCallback(
|
|
35
|
-
uint256,
|
|
36
|
-
uint256 _decryptedA,
|
|
37
|
-
bytes memory
|
|
38
|
-
) external {
|
|
39
|
-
decryptedA = _decryptedA;
|
|
40
|
-
}
|
|
41
30
|
}
|
|
42
31
|
|
|
43
32
|
// its meta: this is testing correct behavior of our testing infrastructure
|
|
@@ -288,14 +277,6 @@ contract TestFakeInfra is IncoTest, MockRemoteAttestation {
|
|
|
288
277
|
assertEq(getBoolValue(inputContract.b()), true);
|
|
289
278
|
}
|
|
290
279
|
|
|
291
|
-
function testDecryption() public {
|
|
292
|
-
TakesEInput inputContract = new TakesEInput();
|
|
293
|
-
inputContract.setA(fakePrepareEuint256Ciphertext(37));
|
|
294
|
-
inputContract.decryptA();
|
|
295
|
-
processAllOperations();
|
|
296
|
-
assertEq(inputContract.decryptedA(), 37);
|
|
297
|
-
}
|
|
298
|
-
|
|
299
280
|
function testUninitializedHandleIsDisallowed() public {
|
|
300
281
|
bytes32 randomHandle = keccak256("random handle");
|
|
301
282
|
euint256 a = e.asEuint256(12);
|
|
@@ -310,12 +291,14 @@ contract TestFakeInfra is IncoTest, MockRemoteAttestation {
|
|
|
310
291
|
}
|
|
311
292
|
|
|
312
293
|
function testCreateQuote() public {
|
|
313
|
-
bytes
|
|
294
|
+
bytes
|
|
295
|
+
memory mrtd = hex"1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef";
|
|
314
296
|
address signer = address(0x1234567890123456789012345678901234567890);
|
|
315
297
|
bytes memory quote = createQuote(mrtd, signer);
|
|
316
|
-
TEELifecycle lifecycle =
|
|
298
|
+
TEELifecycle lifecycle = TEELifecycle(address(inco.incoVerifier()));
|
|
317
299
|
TD10ReportBody memory tdReport = lifecycle.parseTD10ReportBody(quote);
|
|
318
|
-
(address reportDataSigner, bytes memory reportMrtd) = lifecycle
|
|
300
|
+
(address reportDataSigner, bytes memory reportMrtd) = lifecycle
|
|
301
|
+
.parseReport(tdReport);
|
|
319
302
|
assertEq(reportDataSigner, signer);
|
|
320
303
|
assertEq(keccak256(reportMrtd), keccak256(mrtd));
|
|
321
304
|
assertEq(quote.length, MINIMUM_QUOTE_LENGTH);
|
|
@@ -9,6 +9,9 @@ import {IOwnerManager} from "safe-smart-account/interfaces/IOwnerManager.sol";
|
|
|
9
9
|
import {IncoTest} from "./IncoTest.sol";
|
|
10
10
|
import {inco} from "../Lib.sol";
|
|
11
11
|
import {IncoLightning} from "../IncoLightning.sol";
|
|
12
|
+
import {IVersion} from "../version/interfaces/IVersion.sol";
|
|
13
|
+
import {Version} from "../version/Version.sol";
|
|
14
|
+
import {IIncoVerifier} from "../interfaces/IIncoVerifier.sol";
|
|
12
15
|
import {
|
|
13
16
|
MAJOR_VERSION,
|
|
14
17
|
MINOR_VERSION,
|
|
@@ -27,9 +30,15 @@ contract IncoLightningV2 is IncoLightning {
|
|
|
27
30
|
uint8 constant MINOR_VERSION_MOCK = 255;
|
|
28
31
|
uint8 constant PATCH_VERSION_MOCK = 255;
|
|
29
32
|
|
|
30
|
-
constructor(bytes32 salt) IncoLightning(salt) {}
|
|
33
|
+
constructor(bytes32 salt) IncoLightning(salt, IIncoVerifier(address(0))) {}
|
|
31
34
|
|
|
32
|
-
function getVersion()
|
|
35
|
+
function getVersion()
|
|
36
|
+
public
|
|
37
|
+
view
|
|
38
|
+
virtual
|
|
39
|
+
override(IVersion, Version)
|
|
40
|
+
returns (string memory)
|
|
41
|
+
{
|
|
33
42
|
return
|
|
34
43
|
versionString(
|
|
35
44
|
MAJOR_VERSION_MOCK,
|
|
@@ -86,8 +95,6 @@ contract TestUpgrade is IncoTest {
|
|
|
86
95
|
bytes32 salt = getSalt(
|
|
87
96
|
"IncoLightningV2",
|
|
88
97
|
255,
|
|
89
|
-
255,
|
|
90
|
-
255,
|
|
91
98
|
testDeployer,
|
|
92
99
|
"testnet"
|
|
93
100
|
);
|
|
@@ -26,11 +26,4 @@ contract TestVersion is Test {
|
|
|
26
26
|
"SomeContract_1_2_3__12345678"
|
|
27
27
|
);
|
|
28
28
|
}
|
|
29
|
-
|
|
30
|
-
function testVersionEip712() public view {
|
|
31
|
-
(, string memory name, string memory version, , , , ) = someContract
|
|
32
|
-
.eip712Domain();
|
|
33
|
-
assertEq(name, "SomeContract");
|
|
34
|
-
assertEq(version, "1_2_3");
|
|
35
|
-
}
|
|
36
29
|
}
|
|
@@ -4,10 +4,11 @@ pragma solidity ^0.8;
|
|
|
4
4
|
// Change these constants for new contracts
|
|
5
5
|
// Since this file only contains these constants, it could be generated reacting to cli inputs
|
|
6
6
|
|
|
7
|
-
// IMPORTANT if you are changing this file, run `make update_config` afterwards for it to take effect
|
|
8
7
|
// UPDATE the CHANGELOG on new versions
|
|
9
8
|
|
|
10
9
|
string constant CONTRACT_NAME = "incoLightning";
|
|
11
10
|
uint8 constant MAJOR_VERSION = 0;
|
|
12
|
-
uint8 constant MINOR_VERSION =
|
|
13
|
-
uint8 constant PATCH_VERSION =
|
|
11
|
+
uint8 constant MINOR_VERSION = 3;
|
|
12
|
+
uint8 constant PATCH_VERSION = 0;
|
|
13
|
+
|
|
14
|
+
string constant VERIFIER_NAME = "incoVerifier";
|
|
@@ -0,0 +1,8 @@
|
|
|
1
|
+
// SPDX-License-Identifier: No License
|
|
2
|
+
pragma solidity ^0.8;
|
|
3
|
+
|
|
4
|
+
string constant SESSION_VERIFIER_NAME = "sessionVerifier";
|
|
5
|
+
uint8 constant SESSION_VERIFIER_MAJOR_VERSION = 0;
|
|
6
|
+
uint8 constant SESSION_VERIFIER_MINOR_VERSION = 1;
|
|
7
|
+
uint8 constant SESSION_VERIFIER_PATCH_VERSION = 2;
|
|
8
|
+
bytes32 constant SESSION_VERIFIER_PEPPER = keccak256("");
|
package/src/version/Version.sol
CHANGED
|
@@ -2,10 +2,13 @@
|
|
|
2
2
|
pragma solidity ^0.8;
|
|
3
3
|
|
|
4
4
|
import {Strings} from "@openzeppelin/contracts/utils/Strings.sol";
|
|
5
|
-
import {
|
|
6
|
-
|
|
5
|
+
import {
|
|
6
|
+
ShortStrings,
|
|
7
|
+
ShortString
|
|
8
|
+
} from "@openzeppelin/contracts/utils/ShortStrings.sol";
|
|
9
|
+
import {IVersion} from "./interfaces/IVersion.sol";
|
|
7
10
|
|
|
8
|
-
contract Version is
|
|
11
|
+
contract Version is IVersion {
|
|
9
12
|
using ShortStrings for ShortString;
|
|
10
13
|
using ShortStrings for string;
|
|
11
14
|
|
|
@@ -21,12 +24,7 @@ contract Version is EIP712 {
|
|
|
21
24
|
uint8 _patchVersion,
|
|
22
25
|
bytes32 _salt,
|
|
23
26
|
string memory _name
|
|
24
|
-
)
|
|
25
|
-
EIP712(
|
|
26
|
-
_name,
|
|
27
|
-
versionString(_majorVersion, _minorVersion, _patchVersion)
|
|
28
|
-
)
|
|
29
|
-
{
|
|
27
|
+
) {
|
|
30
28
|
majorVersion = _majorVersion;
|
|
31
29
|
minorVersion = _minorVersion;
|
|
32
30
|
patchVersion = _patchVersion;
|
|
@@ -0,0 +1,8 @@
|
|
|
1
|
+
/// SPDX-License-Identifier: No License
|
|
2
|
+
pragma solidity ^0.8;
|
|
3
|
+
|
|
4
|
+
interface IVersion {
|
|
5
|
+
function getVersionedName() external view returns (string memory);
|
|
6
|
+
function getVersion() external view returns (string memory);
|
|
7
|
+
function getName() external view returns (string memory);
|
|
8
|
+
}
|
package/src/DeployTEE.sol
DELETED
|
@@ -1,153 +0,0 @@
|
|
|
1
|
-
// SPDX-License-Identifier: No License
|
|
2
|
-
pragma solidity ^0.8;
|
|
3
|
-
|
|
4
|
-
import {Script} from "forge-std/Script.sol";
|
|
5
|
-
import {Vm} from "forge-std/Vm.sol";
|
|
6
|
-
import {console} from "forge-std/console.sol";
|
|
7
|
-
|
|
8
|
-
import {IQuoteVerifier} from "automata-dcap-attestation/interfaces/IQuoteVerifier.sol";
|
|
9
|
-
import {TEELifecycle} from "./lightning-parts/TEELifecycle.sol";
|
|
10
|
-
|
|
11
|
-
import {CA} from "@automata-network/on-chain-pccs/Common.sol";
|
|
12
|
-
import {EnclaveIdentityJsonObj, IdentityObj, EnclaveIdentityHelper} from "@automata-network/on-chain-pccs/helpers/EnclaveIdentityHelper.sol";
|
|
13
|
-
import {TcbInfoJsonObj, FmspcTcbHelper} from "@automata-network/on-chain-pccs/helpers/FmspcTcbHelper.sol";
|
|
14
|
-
import {PCKHelper} from "@automata-network/on-chain-pccs/helpers/PCKHelper.sol";
|
|
15
|
-
import {X509CRLHelper} from "@automata-network/on-chain-pccs/helpers/X509CRLHelper.sol";
|
|
16
|
-
import {AutomataFmspcTcbDao} from "@automata-network/on-chain-pccs/automata_pccs/AutomataFmspcTcbDao.sol";
|
|
17
|
-
import {AutomataEnclaveIdentityDao} from "@automata-network/on-chain-pccs/automata_pccs/AutomataEnclaveIdentityDao.sol";
|
|
18
|
-
import {AutomataPcsDao} from "@automata-network/on-chain-pccs/automata_pccs/AutomataPcsDao.sol";
|
|
19
|
-
import {AutomataPckDao} from "@automata-network/on-chain-pccs/automata_pccs/AutomataPckDao.sol";
|
|
20
|
-
import {AutomataDaoStorage} from "@automata-network/on-chain-pccs/automata_pccs/shared/AutomataDaoStorage.sol";
|
|
21
|
-
import {PCCSRouter} from "@automata-network/dcap-attestation/PCCSRouter.sol";
|
|
22
|
-
import {V4QuoteVerifier} from "@automata-network/dcap-attestation/verifiers/V4QuoteVerifier.sol";
|
|
23
|
-
|
|
24
|
-
// For now we don't use deployments for TEELifecycle, as we do for IncoLightning.
|
|
25
|
-
// @todo: Use deployments for TEELifecycle
|
|
26
|
-
// ref: https://github.com/Inco-fhevm/inco-monorepo/issues/875
|
|
27
|
-
string constant EIP712_NAME = "TEELifecycle";
|
|
28
|
-
string constant EIP712_VERSION = "1.0.0";
|
|
29
|
-
|
|
30
|
-
// DeployTEE is a script that deplots all TEE-related supporting contracts for IncoLightning.
|
|
31
|
-
contract DeployTEE is Script {
|
|
32
|
-
|
|
33
|
-
// The default address of the P256 Verifier contract that is used to verify the P256 signatures.
|
|
34
|
-
// It is deployed with this address on Ethereum L1, OP Mainnet, Base, Arbitrum.
|
|
35
|
-
// @dev From: https://github.com/daimo-eth/p256-verifier?tab=readme-ov-file#usage
|
|
36
|
-
address public P256_VERIFIER = 0xc2b78104907F722DABAc4C69f826a522B2754De4;
|
|
37
|
-
|
|
38
|
-
// The PCCSRouter contract is used as the entrypoint for the management of collateral used to verify quotes.
|
|
39
|
-
// It is used by the QuoteVerifier to fetch collateral.
|
|
40
|
-
PCCSRouter public pccsRouter;
|
|
41
|
-
|
|
42
|
-
// These helpers are used to parse the collateral files and upload them to the PCCSRouter.
|
|
43
|
-
AutomataFmspcTcbDao fmspcTcbDao;
|
|
44
|
-
AutomataEnclaveIdentityDao enclaveIdDao;
|
|
45
|
-
|
|
46
|
-
// This function deploys a TEELifecycle contract that is used to manage the TEE lifecycle for the IncoLightning contract.
|
|
47
|
-
// @dev The TEELifecycle contract is used to manage the TEE lifecycle for the IncoLightning contract.
|
|
48
|
-
// It is used to verify quotes, and to manage the TEE lifecycle.
|
|
49
|
-
// It is also used to manage the EOA signers for the IncoLightning contract.
|
|
50
|
-
// @param quoteVerifierAddress The address of the QuoteVerifier contract to be used by the TEELifecycle contract.
|
|
51
|
-
function deployTEELifecycle(address deployer, address quoteVerifierAddress) internal returns (TEELifecycle) {
|
|
52
|
-
// TODO: Currently TEELifecycle is not UUPS
|
|
53
|
-
// ref: https://github.com/Inco-fhevm/inco-monorepo/issues/875
|
|
54
|
-
TEELifecycle implementation = new TEELifecycle();
|
|
55
|
-
implementation.initialize(
|
|
56
|
-
deployer,
|
|
57
|
-
EIP712_NAME,
|
|
58
|
-
EIP712_VERSION,
|
|
59
|
-
quoteVerifierAddress
|
|
60
|
-
);
|
|
61
|
-
return implementation;
|
|
62
|
-
}
|
|
63
|
-
|
|
64
|
-
// This function deploys a QuoteVerifier contract that is used to verify quotes for the IncoLightning contract.
|
|
65
|
-
// @dev: TDX_HW environment variable is used to determine whether to use the FakeQuoteVerifier or the V4QuoteVerifier.
|
|
66
|
-
// @dev We deploy two flavors of the QuoteVerifier contract:
|
|
67
|
-
// - FakeQuoteVerifier: A fake implementation of the QuoteVerifier contract that is used to test the IncoLightning contract.
|
|
68
|
-
// This is used for testing purposes, and returns true for all quote verifications.
|
|
69
|
-
// - V4QuoteVerifier: The real implementation of the QuoteVerifier contract that is used to verify quotes for the IncoLightning contract.
|
|
70
|
-
// This is taken from the automata-dcap-attestation package.
|
|
71
|
-
function deployQuoteVerifier() internal returns (IQuoteVerifier quoteVerifier) {
|
|
72
|
-
// deploys the QuoteVerifier contract
|
|
73
|
-
quoteVerifier = new V4QuoteVerifier(
|
|
74
|
-
P256_VERIFIER,
|
|
75
|
-
address(pccsRouter)
|
|
76
|
-
);
|
|
77
|
-
|
|
78
|
-
pccsRouter.setAuthorized(address(quoteVerifier), true);
|
|
79
|
-
}
|
|
80
|
-
|
|
81
|
-
function deployPCCS(address owner, string memory collateralDir) internal {
|
|
82
|
-
|
|
83
|
-
EnclaveIdentityHelper enclaveIdHelper = new EnclaveIdentityHelper();
|
|
84
|
-
FmspcTcbHelper tcbHelper = new FmspcTcbHelper();
|
|
85
|
-
PCKHelper x509 = new PCKHelper();
|
|
86
|
-
X509CRLHelper x509Crl = new X509CRLHelper();
|
|
87
|
-
|
|
88
|
-
AutomataDaoStorage pccsStorage = new AutomataDaoStorage(owner);
|
|
89
|
-
AutomataPcsDao pcsDao = new AutomataPcsDao(address(pccsStorage), P256_VERIFIER, address(x509), address(x509Crl));
|
|
90
|
-
AutomataPckDao pckDao = new AutomataPckDao(address(pccsStorage), P256_VERIFIER, address(pcsDao), address(x509), address(x509Crl));
|
|
91
|
-
enclaveIdDao = new AutomataEnclaveIdentityDao(
|
|
92
|
-
address(pccsStorage), P256_VERIFIER, address(pcsDao), address(enclaveIdHelper), address(x509), address(x509Crl)
|
|
93
|
-
);
|
|
94
|
-
fmspcTcbDao = new AutomataFmspcTcbDao(address(pccsStorage), P256_VERIFIER, address(pcsDao), address(tcbHelper), address(x509), address(x509Crl));
|
|
95
|
-
// grants dao permissions to write to the storage
|
|
96
|
-
pccsStorage.grantDao(address(pcsDao));
|
|
97
|
-
pccsStorage.grantDao(address(pckDao));
|
|
98
|
-
pccsStorage.grantDao(address(fmspcTcbDao));
|
|
99
|
-
pccsStorage.grantDao(address(enclaveIdDao));
|
|
100
|
-
|
|
101
|
-
// grants admin address permission to read collaterals
|
|
102
|
-
pccsRouter = new PCCSRouter(
|
|
103
|
-
owner,
|
|
104
|
-
address(enclaveIdDao),
|
|
105
|
-
address(fmspcTcbDao),
|
|
106
|
-
address(pcsDao),
|
|
107
|
-
address(pckDao),
|
|
108
|
-
address(x509),
|
|
109
|
-
address(x509Crl),
|
|
110
|
-
address(tcbHelper)
|
|
111
|
-
);
|
|
112
|
-
// allow PCCS Router to read collaterals from the storage
|
|
113
|
-
pccsStorage.setCallerAuthorization(address(pccsRouter), true);
|
|
114
|
-
|
|
115
|
-
// Upload Root Certs/CRLs
|
|
116
|
-
bytes memory rootCaDer = vm.readFileBinary(string.concat(collateralDir, "Intel_SGX_Attestation_RootCA.cer"));
|
|
117
|
-
pcsDao.upsertPcsCertificates(CA.ROOT, rootCaDer);
|
|
118
|
-
bytes memory tcbDer = vm.readFileBinary(string.concat(collateralDir, "Intel_SGX_TCB_Signing.cer"));
|
|
119
|
-
pcsDao.upsertPcsCertificates(CA.SIGNING, tcbDer);
|
|
120
|
-
bytes memory platformDer = vm.readFileBinary(string.concat(collateralDir, "Intel_SGX_PCK_PlatformCA.cer"));
|
|
121
|
-
pcsDao.upsertPcsCertificates(CA.PLATFORM, platformDer);
|
|
122
|
-
bytes memory platformCrlDer = vm.readFileBinary(string.concat(collateralDir, "Intel_SGX_PCK_CRL.crl"));
|
|
123
|
-
pcsDao.upsertPckCrl(CA.PLATFORM, platformCrlDer);
|
|
124
|
-
bytes memory rootCrlDer = vm.readFileBinary(string.concat(collateralDir, "AttestationReportSigningCA.crl"));
|
|
125
|
-
|
|
126
|
-
pcsDao.upsertRootCACrl(rootCrlDer);
|
|
127
|
-
}
|
|
128
|
-
|
|
129
|
-
// This function deploys the P256 Verifier contract that is used to verify P256 signatures.
|
|
130
|
-
// @dev The code is taken from https://github.com/automata-network/automata-on-chain-pccs/blob/v1.0.0/test/TestSetupBase.t.sol#L91
|
|
131
|
-
function deployP256() internal {
|
|
132
|
-
// Known chains that have the P256 Verifier deployed:
|
|
133
|
-
// Ethereum Mainnet, Optimism Mainnet, Base, Arbitrum
|
|
134
|
-
// https://github.com/daimo-eth/p256-verifier/tree/master/broadcast/Deploy.s.sol
|
|
135
|
-
if (block.chainid == 1 || block.chainid == 10 || block.chainid == 8453 || block.chainid == 84531 ) {
|
|
136
|
-
console.log("P256 Verifier contract is already deployed on this chain, skipping deployment.");
|
|
137
|
-
return;
|
|
138
|
-
}
|
|
139
|
-
require(block.chainid == 31337, "Deploying P256 Verifier is only supported on Anvil chain");
|
|
140
|
-
bytes memory txdata =
|
|
141
|
-
hex"00000000000000000000000000000000000000000000000000000000000000006080806040523461001657610dd1908161001c8239f35b600080fdfe60e06040523461001a57610012366100c7565b602081519101f35b600080fd5b6040810190811067ffffffffffffffff82111761003b57604052565b7f4e487b7100000000000000000000000000000000000000000000000000000000600052604160045260246000fd5b60e0810190811067ffffffffffffffff82111761003b57604052565b90601f7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffe0910116810190811067ffffffffffffffff82111761003b57604052565b60a08103610193578060201161001a57600060409180831161018f578060601161018f578060801161018f5760a01161018c57815182810181811067ffffffffffffffff82111761015f579061013291845260603581526080356020820152833560203584356101ab565b15610156575060ff6001915b5191166020820152602081526101538161001f565b90565b60ff909161013e565b6024837f4e487b710000000000000000000000000000000000000000000000000000000081526041600452fd5b80fd5b5080fd5b5060405160006020820152602081526101538161001f565b909283158015610393575b801561038b575b8015610361575b6103585780519060206101dc818301938451906103bd565b1561034d57604051948186019082825282604088015282606088015260808701527fffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc63254f60a08701527fffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551958660c082015260c081526102588161006a565b600080928192519060055afa903d15610345573d9167ffffffffffffffff831161031857604051926102b1857fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffe0601f8401160185610086565b83523d828585013e5b156102eb57828280518101031261018c5750015190516102e693929185908181890994099151906104eb565b061490565b807f4e487b7100000000000000000000000000000000000000000000000000000000602492526001600452fd5b6024827f4e487b710000000000000000000000000000000000000000000000000000000081526041600452fd5b6060916102ba565b505050505050600090565b50505050600090565b507fffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc6325518310156101c4565b5082156101bd565b507fffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc6325518410156101b6565b7fffffffff00000001000000000000000000000000ffffffffffffffffffffffff90818110801590610466575b8015610455575b61044d577f5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b8282818080957fffffffff00000001000000000000000000000000fffffffffffffffffffffffc0991818180090908089180091490565b505050600090565b50801580156103f1575082156103f1565b50818310156103ea565b7f800000000000000000000000000000000000000000000000000000000000000081146104bc577fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff0190565b7f4e487b7100000000000000000000000000000000000000000000000000000000600052601160045260246000fd5b909192608052600091600160a05260a05193600092811580610718575b61034d57610516838261073d565b95909460ff60c05260005b600060c05112156106ef575b60a05181036106a1575050507f4fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5957f6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c2969594939291965b600060c05112156105c7575050505050507fffffffff00000001000000000000000000000000ffffffffffffffffffffffff91506105c260a051610ca2565b900990565b956105d9929394959660a05191610a98565b9097929181928960a0528192819a6105f66080518960c051610722565b61060160c051610470565b60c0528061061b5750505050505b96959493929196610583565b969b5061067b96939550919350916001810361068857507f4fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5937f6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c29693610952565b979297919060a05261060f565b6002036106985786938a93610952565b88938893610952565b600281036106ba57505050829581959493929196610583565b9197917ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd0161060f575095508495849661060f565b506106ff6080518560c051610722565b8061070b60c051610470565b60c052156105215761052d565b5060805115610508565b91906002600192841c831b16921c1681018091116104bc5790565b8015806107ab575b6107635761075f91610756916107b3565b92919091610c42565b9091565b50507f6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296907f4fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f590565b508115610745565b919082158061094a575b1561080f57507f6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c29691507f4fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5906001908190565b7fb01cbd1c01e58065711814b583f061e9d431cca994cea1313449bf97c840ae0a917fffffffff00000001000000000000000000000000ffffffffffffffffffffffff808481600186090894817f94e82e0c1ed3bdb90743191a9c5bbf0d88fc827fd214cc5f0b5ec6ba27673d6981600184090893841561091b575050808084800993840994818460010994828088600109957f6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c29609918784038481116104bc5784908180867fffffffff00000001000000000000000000000000fffffffffffffffffffffffd0991818580090808978885038581116104bc578580949281930994080908935b93929190565b9350935050921560001461093b5761093291610b6d565b91939092610915565b50506000806000926000610915565b5080156107bd565b91949592939095811580610a90575b15610991575050831580610989575b61097a5793929190565b50600093508392508291508190565b508215610970565b85919294951580610a88575b610a78577fffffffff00000001000000000000000000000000ffffffffffffffffffffffff968703918783116104bc5787838189850908938689038981116104bc5789908184840908928315610a5d575050818880959493928180848196099b8c9485099b8c920999099609918784038481116104bc5784908180867fffffffff00000001000000000000000000000000fffffffffffffffffffffffd0991818580090808978885038581116104bc578580949281930994080908929190565b965096505050509093501560001461093b5761093291610b6d565b9550509150915091906001908190565b50851561099d565b508015610961565b939092821580610b65575b61097a577fffffffff00000001000000000000000000000000ffffffffffffffffffffffff908185600209948280878009809709948380888a0998818080808680097fffffffff00000001000000000000000000000000fffffffffffffffffffffffc099280096003090884808a7fffffffff00000001000000000000000000000000fffffffffffffffffffffffd09818380090898898603918683116104bc57888703908782116104bc578780969481809681950994089009089609930990565b508015610aa3565b919091801580610c3a575b610c2d577fffffffff00000001000000000000000000000000ffffffffffffffffffffffff90818460020991808084800980940991817fffffffff00000001000000000000000000000000fffffffffffffffffffffffc81808088860994800960030908958280837fffffffff00000001000000000000000000000000fffffffffffffffffffffffd09818980090896878403918483116104bc57858503928584116104bc5785809492819309940890090892565b5060009150819081908190565b508215610b78565b909392821580610c9a575b610c8d57610c5a90610ca2565b9182917fffffffff00000001000000000000000000000000ffffffffffffffffffffffff80809581940980099009930990565b5050509050600090600090565b508015610c4d565b604051906020918281019183835283604083015283606083015260808201527fffffffff00000001000000000000000000000000fffffffffffffffffffffffd60a08201527fffffffff00000001000000000000000000000000ffffffffffffffffffffffff60c082015260c08152610d1a8161006a565b600080928192519060055afa903d15610d93573d9167ffffffffffffffff83116103185760405192610d73857fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffe0601f8401160185610086565b83523d828585013e5b156102eb57828280518101031261018c5750015190565b606091610d7c56fea2646970667358221220fa55558b04ced380e93d0a46be01bb895ff30f015c50c516e898c341cd0a230264736f6c63430008150033";
|
|
142
|
-
|
|
143
|
-
// deploys the P256 Verifier contract using the default CREATE2 deterministic deployment contract available of EVM chains including on Anvil
|
|
144
|
-
// https://github.com/Arachnid/deterministic-deployment-proxy?tab=readme-ov-file#latest-outputs
|
|
145
|
-
// https://getfoundry.sh/guides/deterministic-deployments-using-create2
|
|
146
|
-
(bool succ,) = address(0x4e59b44847b379578588920cA78FbF26c0B4956C).call(txdata);
|
|
147
|
-
require(succ, "Failed to deploy P256");
|
|
148
|
-
|
|
149
|
-
// check code
|
|
150
|
-
uint256 codesize = P256_VERIFIER.code.length;
|
|
151
|
-
require(codesize > 0, "P256 deployed to the wrong address");
|
|
152
|
-
}
|
|
153
|
-
}
|
|
@@ -1,15 +0,0 @@
|
|
|
1
|
-
/// SPDX-License-Identifier: No License
|
|
2
|
-
pragma solidity ^0.8;
|
|
3
|
-
|
|
4
|
-
import { IIncoLightning } from "./IIncoLightning.sol";
|
|
5
|
-
import { CONTRACT_NAME, MAJOR_VERSION, MINOR_VERSION, PATCH_VERSION } from "./version/IncoLightningConfig.sol";
|
|
6
|
-
import { DecryptionHandler } from "./lightning-parts/DecryptionHandler.sol";
|
|
7
|
-
import { EncryptedInput } from "./lightning-parts/EncryptedInput.sol";
|
|
8
|
-
import { EncryptedOperations } from "./lightning-parts/EncryptedOperations.sol";
|
|
9
|
-
import { TrivialEncryption } from "./lightning-parts/TrivialEncryption.sol";
|
|
10
|
-
import { UUPSUpgradeable } from "@openzeppelin/contracts/proxy/utils/UUPSUpgradeable.sol";
|
|
11
|
-
import { Version } from "./version/Version.sol";
|
|
12
|
-
|
|
13
|
-
interface IIncoLightningGen {
|
|
14
|
-
function initialize(address owner, address teeLifecycleAddress) external;
|
|
15
|
-
}
|
|
@@ -1,19 +0,0 @@
|
|
|
1
|
-
/// SPDX-License-Identifier: No License
|
|
2
|
-
pragma solidity ^0.8;
|
|
3
|
-
|
|
4
|
-
import { SenderNotAllowedForHandle } from "../../Types.sol";
|
|
5
|
-
|
|
6
|
-
interface IBaseAccessControlListGen {
|
|
7
|
-
/// @dev persistent
|
|
8
|
-
function allow(bytes32 handle, address account) external;
|
|
9
|
-
|
|
10
|
-
function allowTransient(bytes32 handle, address account) external;
|
|
11
|
-
|
|
12
|
-
function allowedTransient(bytes32 handle, address account) external view returns (bool);
|
|
13
|
-
|
|
14
|
-
function cleanTransientStorage() external;
|
|
15
|
-
|
|
16
|
-
function persistAllowed(bytes32 handle, address account) external view returns (bool);
|
|
17
|
-
|
|
18
|
-
function isAllowed(bytes32 handle, address account) external view returns (bool);
|
|
19
|
-
}
|
|
@@ -1,54 +0,0 @@
|
|
|
1
|
-
/// SPDX-License-Identifier: No License
|
|
2
|
-
pragma solidity ^0.8;
|
|
3
|
-
|
|
4
|
-
import "./DecryptionHandler.types.sol";
|
|
5
|
-
import { BaseAccessControlList } from "./AccessControl/BaseAccessControlList.sol";
|
|
6
|
-
import { EIP712 } from "@openzeppelin/contracts/utils/cryptography/EIP712.sol";
|
|
7
|
-
import { EventCounter } from "./primitives/EventCounter.sol";
|
|
8
|
-
import { IDecryptionHandlerEip712CheckerGen } from "./DecryptionHandler.gen.sol";
|
|
9
|
-
import { SenderNotAllowedForHandle } from "../Types.sol";
|
|
10
|
-
import { SignatureVerifier } from "./primitives/SignatureVerifier.sol";
|
|
11
|
-
|
|
12
|
-
interface IDecryptionHandlerEip712CheckerGen {
|
|
13
|
-
function decryptionResultDigest(DecryptionResult memory result) external view returns (bytes32);
|
|
14
|
-
}
|
|
15
|
-
|
|
16
|
-
interface IDecryptionHandlerGen {
|
|
17
|
-
/// @dev callback function MUST be of form `function name(bytes32 requestId, bytes32 result, bytes memory data)`
|
|
18
|
-
function requestDecryption(bytes4 callbackSelector, uint256 maxTimestamp, bytes32 handle, bytes memory data) external returns (uint256 requestId);
|
|
19
|
-
|
|
20
|
-
function fulfillRequest(DecryptionResult memory result, bytes memory signature) external;
|
|
21
|
-
|
|
22
|
-
function fulfillRequestsBatch(SignedDecryptionResult[] memory results) external;
|
|
23
|
-
|
|
24
|
-
/// @dev Get some pending requests.
|
|
25
|
-
/// @param offset A parameter for paginating through the whole set of pending requests.
|
|
26
|
-
/// Use zero for an initial query, then use the previous query's nextOffset to continue traversal.
|
|
27
|
-
/// @param maxRequests The maximum number of pending to return.
|
|
28
|
-
/// @param iterationBound The maximum number of non-pending requests to iterate over before returning.
|
|
29
|
-
/// @return nextOffset The next offset to use to continue to scan through the pending request set.
|
|
30
|
-
/// Returns the input offset if the whole set has been scanned. Can re-query with this offset
|
|
31
|
-
/// to see any new pending requests, or re-query with a zero offset to return the whole set again.
|
|
32
|
-
/// @return requests Some pending requests. May be fewer than requested, possibly zero. There may be
|
|
33
|
-
/// more requests available if the returned nextOffset is greater than the input offset.
|
|
34
|
-
function getPendingRequests(uint256 offset, uint256 maxRequests, uint256 iterationBound) external view returns (uint256 nextOffset, Request[] memory requests);
|
|
35
|
-
|
|
36
|
-
/// @param offset A parameter for paginating through the whole set of pending requests.
|
|
37
|
-
/// Use zero for an initial query, then use the previous query's nextOffset to continue traversal.
|
|
38
|
-
/// @param maxRequests The maximum number of pending to return.
|
|
39
|
-
/// @return nextOffset The next offset to use to continue to scan through the pending request set.
|
|
40
|
-
/// Returns the input offset if the whole set has been scanned. Can re-query with this offset
|
|
41
|
-
/// to see any new pending requests, or re-query with a zero offset to return the whole set again.
|
|
42
|
-
/// @return requests Some pending requests. May be fewer than requested, possibly zero. There may be
|
|
43
|
-
/// more requests available if the returned nextOffset is greater than the input offset.
|
|
44
|
-
function getPendingRequests(uint256 offset, uint256 maxRequests) external view returns (uint256 nextOffset, Request[] memory requests);
|
|
45
|
-
|
|
46
|
-
function getNextRequestId() external view returns (uint256);
|
|
47
|
-
|
|
48
|
-
function getLowWatermarkRequestId() external view returns (uint256);
|
|
49
|
-
|
|
50
|
-
/// @dev Advance the low watermark until we hit a pending request, the requestId counter, or iterationBound steps.
|
|
51
|
-
/// @param iterationBound The maximum number of requests to iterate over.
|
|
52
|
-
/// @notice This function is public so that we can externally drive the low watermark in extreme cases.
|
|
53
|
-
function advanceLowWatermark(uint256 iterationBound) external;
|
|
54
|
-
}
|