@layerzerolabs/layerzero-v2-ton 3.0.31-ton.2 → 3.0.31

package/src/protocol/controller/handler.fc

@@ -116,31 +116,50 @@ int _verifyEventSender(int sender, cell $senderStorageInit) impure method_id {
     }
 
     int storageType = cl::typeof($senderStorageInit);
-    int senderOwner = $senderStorageInit
-        .cl::get<objRef>(BASE_STORAGE_INDEX)
-        .cl::get<address>(BaseStorage::owner);
-
-    ;; If senderOwner != controller address, then this event sender might be using the correct
-    ;; bytecode and storage but be part of a different LayerZero protocol deployment owned
-    ;; by a different signer.
-    throw_if(BaseInterface::ERROR::invalidEventSource, senderOwner != getContractAddress());
+    int senderOwner = NULLADDRESS;
 
     if (storageType == Endpoint::NAME) {
+        cell $endpointStorageInit = Endpoint::sanitize($senderStorageInit);
+        throw_if(
+            BaseInterface::ERROR::invalidEventSource,
+            $endpointStorageInit.cl::hash() != $senderStorageInit.cl::hash()
+        );
+
         cell endpointCode = $storage.cl::get<cellRef>(Controller::endpointCode);
         throw_unless(
             BaseInterface::ERROR::invalidEventSource,
             sender == computeContractAddress($senderStorageInit, endpointCode)
         );
+
+        senderOwner = $endpointStorageInit
+            .cl::get<objRef>(Endpoint::baseStorage)
+            .cl::get<address>(BaseStorage::owner);
+
     } elseif (storageType == Channel::NAME) {
+        cell $channelStorageInit = Channel::sanitize($senderStorageInit);
+        throw_if(
+            BaseInterface::ERROR::invalidEventSource,
+            $channelStorageInit.cl::hash() != $senderStorageInit.cl::hash()
+        );
+
         cell channelCode = $storage.cl::get<cellRef>(Controller::channelCode);
         throw_unless(
             BaseInterface::ERROR::invalidEventSource,
             sender == computeContractAddress($senderStorageInit, channelCode)
         );
+
+        senderOwner = $channelStorageInit
+            .cl::get<objRef>(Channel::baseStorage)
+            .cl::get<address>(BaseStorage::owner);
     } else {
         throw(BaseInterface::ERROR::invalidEventSource);
     }
 
+    ;; If senderOwner != controller address, then this event sender might be using the correct
+    ;; bytecode and storage but be part of a different LayerZero protocol deployment owned
+    ;; by a different signer.
+    throw_if(BaseInterface::ERROR::invalidEventSource, senderOwner != getContractAddress());
+
     return true;
 }
 

package/src/protocol/endpoint/storage.fc

@@ -98,4 +98,13 @@ cell Endpoint::getDefaultTimeoutReceiveLibInfo(cell $self) impure inline {
         selfSlice.preloadRefAt(2).cellPreloadRefAt(3),
         selfSlice.preloadRefAt(3).cellPreloadRefAt(0)
     );
+}
+
+cell Endpoint::sanitize(cell $self) impure inline {
+    cell $baseStorage = $self.cl::get<cellRef>(Endpoint::baseStorage);
+    return Endpoint::New(
+        $self.cl::get<uint32>(Endpoint::eid),
+        $self.cl::get<uint32>(Endpoint::dstEid),
+        $baseStorage.cl::get<address>(BaseStorage::owner)
+    );
 }

package/tests/baseSerdeTest.fc

@@ -82,7 +82,7 @@ cell baseTest::prepare(tuple args) impure {
     while (idx < expected.tlen()) {
         if (expected.at(idx).is_cell() & actual.at(idx).is_cell()) {
             if (expected.at(idx).cell_hash() != actual.at(idx).cell_hash()) {
-                return (TEST_FAILED, "expected cell != actual cell");
+                return (TEST_FAILED, "expected cell at idx ".str::concatInt(idx).str::concat(" != actual cell"));
             }
         } elseif (expected.at(idx).is_int() & actual.at(idx).is_int()) {
             if (expected.at(idx) != actual.at(idx)) {