@layerzerolabs/oapp-upgradeable-evm-contracts 0.2.74

package/package.json

@@ -0,0 +1,42 @@
+{
+  "name": "@layerzerolabs/oapp-upgradeable-evm-contracts",
+  "version": "0.2.74",
+  "private": false,
+  "description": "LayerZero Labs reference EVM upgradeable OApp implementation",
+  "license": "MIT",
+  "devDependencies": {
+    "@layerzerolabs/lz-evm-messagelib-v2": "3.0.167",
+    "@layerzerolabs/lz-evm-protocol-v2": "3.0.167",
+    "@layerzerolabs/lz-evm-v1-0.7": "3.0.167",
+    "@layerzerolabs/test-devtools-evm-foundry": "8.0.1",
+    "@layerzerolabs/toolbox-foundry": "^0.1.13",
+    "@openzeppelin/contracts": "^5.0.2",
+    "@openzeppelin/contracts-upgradeable": "^5.0.2",
+    "ethers": "^5.8.0",
+    "solhint": "^6.0.1",
+    "solidity-bytes-utils": "^0.8.4",
+    "@layerzerolabs/oapp-evm-contracts": "0.2.74",
+    "@layerzerolabs/typescript-configuration": "0.2.74",
+    "@layerzerolabs/tsup-configuration": "0.2.74",
+    "@layerzerolabs/solhint-configuration": "0.2.74",
+    "@layerzerolabs/test-utils-evm-contracts": "0.2.74",
+    "@layerzerolabs/utils-evm-contracts": "0.2.74",
+    "@layerzerolabs/utils-upgradeable-evm-contracts": "0.2.74",
+    "@layerzerolabs/vm-tooling-evm": "0.2.74"
+  },
+  "publishConfig": {
+    "access": "restricted",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "externalRepoConfig": {
+    "targets": [
+      "audit-external",
+      "monorepo-external"
+    ]
+  },
+  "scripts": {
+    "clean-artifacts": "rm -rf artifacts* cache hh-cache*",
+    "lint": "solhint --config solhint.config.js 'contracts/**/*.sol' 'test/**/*.sol' --fix --noPrompt",
+    "test": "pnpm lz-tool forge test"
+  }
+}

package/solhint.config.js

@@ -0,0 +1,3 @@
+const baseConfig = require('@layerzerolabs/solhint-configuration');
+
+module.exports = baseConfig;

package/test/OAppAltUpgradeable.t.sol

@@ -0,0 +1,130 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.22;
+
+import { IOAppAlt } from "@layerzerolabs/oapp-evm-contracts/contracts/interfaces/IOAppAlt.sol";
+import { EndpointV2AltMock } from "@layerzerolabs/test-devtools-evm-foundry/contracts/mocks/EndpointV2AltMock.sol";
+import { TestHelperOz5 } from "@layerzerolabs/test-devtools-evm-foundry/contracts/TestHelperOz5.sol";
+import { MockERC20 } from "@layerzerolabs/test-utils-evm-contracts/contracts/mocks/MockERC20.sol";
+import { TransparentUpgradeableProxy } from "@openzeppelin/contracts/proxy/transparent/TransparentUpgradeableProxy.sol";
+import { IERC20 } from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
+import { OAppAltUpgradeable } from "./../contracts/oapp/alt/OAppAltUpgradeable.sol";
+import { OAppCoreBaseUpgradeable } from "./../contracts/oapp/OAppCoreBaseUpgradeable.sol";
+
+contract OAppAltUpgradeableHarness is OAppCoreBaseUpgradeable, OAppAltUpgradeable {
+    constructor(address _endpoint) OAppCoreBaseUpgradeable(_endpoint) {}
+
+    function initialize(address _delegate) public initializer {
+        __OAppCoreBase_init(_delegate);
+    }
+
+    function oAppVersion() public pure returns (uint64 senderVersion, uint64 receiverVersion) {
+        return (1, 1);
+    }
+
+    function payNative(uint256 _nativeFee) public payable returns (uint256 nativeFee) {
+        return _payNative(_nativeFee);
+    }
+
+    function _payNative(uint256 _nativeFee) internal virtual override(OAppAltUpgradeable) returns (uint256 nativeFee) {
+        return OAppAltUpgradeable._payNative(_nativeFee);
+    }
+
+    function setPeer(uint32 _eid, bytes32 _peer) external {
+        _setPeer(_eid, _peer);
+    }
+
+    function setDelegate(address _delegate) external {
+        _setDelegate(_delegate);
+    }
+}
+
+contract OAppAltUpgradeableTest is TestHelperOz5 {
+    OAppAltUpgradeableHarness impl;
+    OAppAltUpgradeableHarness oapp;
+    MockERC20 nativeToken;
+    address endpoint;
+
+    address delegate = makeAddr("delegate");
+    address alice = makeAddr("alice");
+    address bob = makeAddr("bob");
+
+    function setUp() public override {
+        nativeToken = new MockERC20(18);
+
+        address[] memory nativeTokenAddrs = new address[](2);
+        nativeTokenAddrs[0] = address(nativeToken);
+        createEndpoints(2, LibraryType.SimpleMessageLib, nativeTokenAddrs);
+        endpoint = address(endpointSetup.endpointList[0]);
+
+        impl = new OAppAltUpgradeableHarness(endpoint);
+
+        bytes memory initData = abi.encodeWithSelector(OAppAltUpgradeableHarness.initialize.selector, delegate);
+        TransparentUpgradeableProxy proxy = new TransparentUpgradeableProxy(address(impl), delegate, initData);
+
+        oapp = OAppAltUpgradeableHarness(address(proxy));
+    }
+
+    function test_constructor() public view {
+        assertEq(address(oapp.endpoint()), endpoint);
+    }
+
+    function test_constructor_Revert_InvalidNativeToken() public {
+        EndpointV2AltMock endpointZeroNative = new EndpointV2AltMock(1, address(this), address(0));
+
+        vm.expectRevert(IOAppAlt.InvalidNativeToken.selector);
+        new OAppAltUpgradeableHarness(address(endpointZeroNative));
+    }
+
+    function test_payNative() public {
+        uint256 fee = 0.1 ether;
+        nativeToken.mint(alice, fee);
+
+        vm.startPrank(alice);
+        nativeToken.approve(address(oapp), fee);
+
+        uint256 returnedFee = oapp.payNative(fee);
+        vm.stopPrank();
+
+        assertEq(returnedFee, 0, "Should return 0 as fee is paid via ERC20");
+        assertEq(nativeToken.balanceOf(alice), 0, "Alice should have 0 balance");
+        assertEq(nativeToken.balanceOf(endpoint), fee, "Endpoint should have the fee");
+    }
+
+    function test_payNative_ZeroFee() public {
+        /// @dev Expects `transferFrom` to never be called on the native token.
+        vm.expectCall(address(nativeToken), abi.encodeWithSelector(IERC20.transferFrom.selector), 0);
+
+        vm.prank(alice);
+        uint256 returnedFee = oapp.payNative(0);
+
+        assertEq(returnedFee, 0);
+    }
+
+    function test_payNative_Revert_OnlyAltToken() public {
+        uint256 fee = 0.1 ether;
+        nativeToken.mint(alice, fee);
+        vm.deal(alice, 1 wei);
+
+        vm.startPrank(alice);
+        nativeToken.approve(address(oapp), fee);
+
+        vm.expectRevert(IOAppAlt.OnlyAltToken.selector);
+        oapp.payNative{ value: 1 wei }(fee);
+        vm.stopPrank();
+    }
+
+    function test_payNative_Fuzz(uint96 _fee) public {
+        _fee = uint96(bound(_fee, 1, 1_000_000 ether));
+        nativeToken.mint(alice, _fee);
+
+        vm.startPrank(alice);
+        nativeToken.approve(address(oapp), _fee);
+
+        uint256 returnedFee = oapp.payNative(_fee);
+        vm.stopPrank();
+
+        assertEq(returnedFee, 0);
+        assertEq(nativeToken.balanceOf(alice), 0);
+        assertEq(nativeToken.balanceOf(endpoint), _fee);
+    }
+}

package/test/OAppCoreRBACUpgradeable.t.sol

@@ -0,0 +1,115 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.22;
+
+import { EndpointV2Mock } from "@layerzerolabs/test-devtools-evm-foundry/contracts/mocks/EndpointV2Mock.sol";
+import { TestHelperOz5 } from "@layerzerolabs/test-devtools-evm-foundry/contracts/TestHelperOz5.sol";
+import { TransparentUpgradeableProxy } from "@openzeppelin/contracts/proxy/transparent/TransparentUpgradeableProxy.sol";
+import { OAppCoreBaseUpgradeable } from "./../contracts/oapp/OAppCoreBaseUpgradeable.sol";
+import { OAppCoreRBACUpgradeable } from "./../contracts/oapp/OAppCoreRBACUpgradeable.sol";
+
+contract OAppCoreRBACHarness is OAppCoreRBACUpgradeable {
+    constructor(address _endpoint) OAppCoreBaseUpgradeable(_endpoint) {}
+
+    function initialize(address _initialAdmin) public initializer {
+        __OAppCoreBase_init(_initialAdmin);
+        __AccessControl2Step_init(_initialAdmin);
+    }
+
+    function oAppVersion() public pure returns (uint64 senderVersion, uint64 receiverVersion) {
+        return (1, 1);
+    }
+}
+
+contract OAppCoreRBACUpgradeableTest is TestHelperOz5 {
+    OAppCoreRBACHarness oapp;
+    EndpointV2Mock endpoint;
+
+    address owner;
+    address alice = makeAddr("alice");
+    address bob = makeAddr("bob");
+    address proxyAdmin;
+
+    function setUp() public override {
+        owner = address(this);
+        setUpEndpoints(2, LibraryType.SimpleMessageLib);
+        endpoint = endpointSetup.endpointList[0];
+        OAppCoreRBACHarness impl = new OAppCoreRBACHarness(address(endpoint));
+
+        uint256 currentNonce = vm.getNonce(address(this));
+        proxyAdmin = vm.computeCreateAddress(vm.computeCreateAddress(address(this), currentNonce), 1);
+
+        oapp = OAppCoreRBACHarness(
+            address(
+                new TransparentUpgradeableProxy(
+                    address(impl),
+                    address(this),
+                    abi.encodeWithSelector(OAppCoreRBACHarness.initialize.selector, owner)
+                )
+            )
+        );
+    }
+
+    // ============ initialize ============
+
+    function test_initialize_SetsDelegate() public view {
+        assertEq(endpoint.delegates(address(oapp)), owner);
+    }
+
+    // ============ setDelegate ============
+
+    function test_setDelegate_Revert_CannotDirectlySetDelegate_Admin() public {
+        vm.expectRevert(OAppCoreRBACUpgradeable.CannotDirectlySetDelegate.selector);
+        oapp.setDelegate(alice);
+    }
+
+    function test_setDelegate_Revert_CannotDirectlySetDelegate_NonAdmin() public {
+        vm.expectRevert(OAppCoreRBACUpgradeable.CannotDirectlySetDelegate.selector);
+        vm.prank(alice);
+        oapp.setDelegate(alice);
+    }
+
+    // ============ acceptDefaultAdminTransfer ============
+
+    function test_acceptDefaultAdminTransfer() public {
+        oapp.beginDefaultAdminTransfer(alice);
+
+        vm.prank(alice);
+        oapp.acceptDefaultAdminTransfer();
+
+        assertEq(endpoint.delegates(address(oapp)), alice);
+        assertTrue(oapp.hasRole(oapp.DEFAULT_ADMIN_ROLE(), alice));
+        assertFalse(oapp.hasRole(oapp.DEFAULT_ADMIN_ROLE(), owner));
+    }
+
+    function test_acceptDefaultAdminTransfer_ChainedTransfers() public {
+        oapp.beginDefaultAdminTransfer(alice);
+        vm.prank(alice);
+        oapp.acceptDefaultAdminTransfer();
+
+        assertEq(endpoint.delegates(address(oapp)), alice);
+
+        vm.prank(alice);
+        oapp.beginDefaultAdminTransfer(bob);
+        vm.prank(bob);
+        oapp.acceptDefaultAdminTransfer();
+
+        assertEq(endpoint.delegates(address(oapp)), bob);
+        assertTrue(oapp.hasRole(oapp.DEFAULT_ADMIN_ROLE(), bob));
+        assertFalse(oapp.hasRole(oapp.DEFAULT_ADMIN_ROLE(), alice));
+    }
+
+    function test_acceptDefaultAdminTransfer_Fuzz(address _newAdmin) public {
+        vm.assume(_newAdmin != address(0));
+        vm.assume(_newAdmin != proxyAdmin);
+        vm.assume(_newAdmin != owner);
+
+        oapp.beginDefaultAdminTransfer(_newAdmin);
+
+        vm.prank(_newAdmin);
+        oapp.acceptDefaultAdminTransfer();
+
+        assertEq(endpoint.delegates(address(oapp)), _newAdmin);
+        assertTrue(oapp.hasRole(oapp.DEFAULT_ADMIN_ROLE(), _newAdmin));
+        assertFalse(oapp.hasRole(oapp.DEFAULT_ADMIN_ROLE(), owner));
+    }
+}

package/test/OAppOptionsType3BaseUpgradeable.t.sol

@@ -0,0 +1,239 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.22;
+
+import { IOAppOptionsType3 } from "@layerzerolabs/oapp-evm-contracts/contracts/interfaces/IOAppOptionsType3.sol";
+import { OptionsBuilder } from "@layerzerolabs/oapp-evm-contracts/contracts/oapp/libs/OptionsBuilder.sol";
+import { Initializable } from "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol";
+import { TransparentUpgradeableProxy } from "@openzeppelin/contracts/proxy/transparent/TransparentUpgradeableProxy.sol";
+import { Test } from "forge-std/Test.sol";
+import { OAppOptionsType3BaseUpgradeable } from "./../contracts/oapp/options-type-3/OAppOptionsType3BaseUpgradeable.sol";
+
+contract OAppOptionsType3BaseHarness is OAppOptionsType3BaseUpgradeable {
+    constructor() {
+        _disableInitializers();
+    }
+
+    function initialize() public initializer {
+        __OAppOptionsType3Base_init();
+    }
+
+    function setEnforcedOptions(IOAppOptionsType3.EnforcedOptionParam[] calldata _enforcedOptions) external {
+        _setEnforcedOptions(_enforcedOptions);
+    }
+}
+
+contract OAppOptionsType3BaseUpgradeableTest is Test {
+    using OptionsBuilder for bytes;
+
+    IOAppOptionsType3 oapp;
+
+    uint16 internal constant SEND = 1;
+    uint16 internal constant SEND_AND_CALL = 2;
+
+    function _createOApp() internal virtual returns (IOAppOptionsType3) {
+        OAppOptionsType3BaseHarness impl = new OAppOptionsType3BaseHarness();
+        TransparentUpgradeableProxy proxy = new TransparentUpgradeableProxy(
+            address(impl),
+            address(this),
+            abi.encodeWithSelector(OAppOptionsType3BaseHarness.initialize.selector)
+        );
+        return IOAppOptionsType3(address(proxy));
+    }
+
+    function setUp() public virtual {
+        oapp = _createOApp();
+    }
+
+    // ============ initialize ============
+
+    function test_initialize_Revert_AlreadyInitialized() public virtual {
+        vm.expectRevert(Initializable.InvalidInitialization.selector);
+        OAppOptionsType3BaseHarness(address(oapp)).initialize();
+    }
+
+    // ============ enforcedOptions ============
+
+    function test_enforcedOptions() public {
+        uint32 eid = 30101;
+        bytes memory options = OptionsBuilder.newOptions().addExecutorLzReceiveOption(200_000, 0);
+
+        IOAppOptionsType3.EnforcedOptionParam[] memory params = new IOAppOptionsType3.EnforcedOptionParam[](1);
+        params[0] = IOAppOptionsType3.EnforcedOptionParam(eid, SEND, options);
+        oapp.setEnforcedOptions(params);
+
+        assertEq(oapp.enforcedOptions(eid, SEND), options);
+    }
+
+    function test_enforcedOptions_Empty() public view {
+        assertEq(oapp.enforcedOptions(1, SEND), bytes(""));
+    }
+
+    // ============ setEnforcedOptions ============
+
+    function test_setEnforcedOptions() public {
+        uint32 eid = 30101;
+        bytes memory sendOptions = OptionsBuilder.newOptions().addExecutorLzReceiveOption(200_000, 0);
+        bytes memory sendAndCallOptions = OptionsBuilder
+            .newOptions()
+            .addExecutorLzReceiveOption(200_000, 0)
+            .addExecutorLzComposeOption(0, 500_000, 0);
+
+        IOAppOptionsType3.EnforcedOptionParam[] memory params = new IOAppOptionsType3.EnforcedOptionParam[](2);
+        params[0] = IOAppOptionsType3.EnforcedOptionParam(eid, SEND, sendOptions);
+        params[1] = IOAppOptionsType3.EnforcedOptionParam(eid, SEND_AND_CALL, sendAndCallOptions);
+
+        vm.expectEmit(true, true, true, true, address(oapp));
+        emit IOAppOptionsType3.EnforcedOptionSet(params);
+
+        oapp.setEnforcedOptions(params);
+
+        assertEq(oapp.enforcedOptions(eid, SEND), sendOptions);
+        assertEq(oapp.enforcedOptions(eid, SEND_AND_CALL), sendAndCallOptions);
+    }
+
+    function test_setEnforcedOptions_EmptyOptionsResetsEnforced() public {
+        uint32 eid = 30101;
+        bytes memory sendOptions = OptionsBuilder.newOptions().addExecutorLzReceiveOption(200_000, 0);
+
+        IOAppOptionsType3.EnforcedOptionParam[] memory params = new IOAppOptionsType3.EnforcedOptionParam[](1);
+        params[0] = IOAppOptionsType3.EnforcedOptionParam(eid, SEND, sendOptions);
+        oapp.setEnforcedOptions(params);
+        assertEq(oapp.enforcedOptions(eid, SEND), sendOptions);
+
+        // Reset enforced options with empty bytes.
+        params[0] = IOAppOptionsType3.EnforcedOptionParam(eid, SEND, bytes(""));
+        oapp.setEnforcedOptions(params);
+        assertEq(oapp.enforcedOptions(eid, SEND), bytes(""));
+    }
+
+    function test_setEnforcedOptions_Fuzz(uint32 _eid, uint16 _msgType, uint128 _gas) public {
+        _gas = uint128(bound(_gas, 1, type(uint128).max));
+
+        bytes memory options = OptionsBuilder.newOptions().addExecutorLzReceiveOption(_gas, 0);
+
+        IOAppOptionsType3.EnforcedOptionParam[] memory params = new IOAppOptionsType3.EnforcedOptionParam[](1);
+        params[0] = IOAppOptionsType3.EnforcedOptionParam(_eid, _msgType, options);
+        oapp.setEnforcedOptions(params);
+
+        assertEq(oapp.enforcedOptions(_eid, _msgType), options);
+    }
+
+    function test_setEnforcedOptions_Fuzz_Revert_InvalidOptionsType(uint16 _optionsType) public {
+        vm.assume(_optionsType != 3);
+
+        bytes memory options = abi.encodePacked(_optionsType);
+
+        IOAppOptionsType3.EnforcedOptionParam[] memory params = new IOAppOptionsType3.EnforcedOptionParam[](1);
+        params[0] = IOAppOptionsType3.EnforcedOptionParam(1, SEND, options);
+        vm.expectRevert(abi.encodeWithSelector(IOAppOptionsType3.InvalidOptions.selector, options));
+        oapp.setEnforcedOptions(params);
+    }
+
+    // ============ combineOptions ============
+
+    function test_combineOptions_CombinesType3Options() public {
+        uint32 eid = 30101;
+        bytes memory enforced = OptionsBuilder.newOptions().addExecutorLzReceiveOption(200_000, 0);
+        bytes32 receiver = bytes32(uint256(uint160(makeAddr("receiver"))));
+
+        IOAppOptionsType3.EnforcedOptionParam[] memory params = new IOAppOptionsType3.EnforcedOptionParam[](1);
+        params[0] = IOAppOptionsType3.EnforcedOptionParam(eid, SEND, enforced);
+        oapp.setEnforcedOptions(params);
+
+        bytes memory extraOptions = OptionsBuilder.newOptions().addExecutorNativeDropOption(1.2345 ether, receiver);
+        bytes memory expected = OptionsBuilder
+            .newOptions()
+            .addExecutorLzReceiveOption(200_000, 0)
+            .addExecutorNativeDropOption(1.2345 ether, receiver);
+
+        assertEq(oapp.combineOptions(eid, SEND, extraOptions), expected);
+    }
+
+    function test_combineOptions_NoExtraOptions() public {
+        uint32 eid = 30101;
+        bytes memory enforced = OptionsBuilder
+            .newOptions()
+            .addExecutorLzReceiveOption(200_000, 0)
+            .addExecutorLzComposeOption(0, 500_000, 0);
+
+        IOAppOptionsType3.EnforcedOptionParam[] memory params = new IOAppOptionsType3.EnforcedOptionParam[](1);
+        params[0] = IOAppOptionsType3.EnforcedOptionParam(eid, SEND_AND_CALL, enforced);
+        oapp.setEnforcedOptions(params);
+
+        assertEq(oapp.combineOptions(eid, SEND_AND_CALL, bytes("")), enforced);
+    }
+
+    function test_combineOptions_NoEnforcedOptions() public view {
+        bytes memory callerOptions = OptionsBuilder.newOptions().addExecutorLzReceiveOption(100_000, 0);
+        assertEq(oapp.combineOptions(1, SEND, callerOptions), callerOptions);
+    }
+
+    function test_combineOptions_PassthroughAfterReset() public {
+        uint32 eid = 30101;
+        bytes memory enforced = OptionsBuilder
+            .newOptions()
+            .addExecutorLzReceiveOption(200_000, 0)
+            .addExecutorLzComposeOption(0, 500_000, 0);
+
+        // Set enforced options.
+        IOAppOptionsType3.EnforcedOptionParam[] memory params = new IOAppOptionsType3.EnforcedOptionParam[](1);
+        params[0] = IOAppOptionsType3.EnforcedOptionParam(eid, SEND_AND_CALL, enforced);
+        oapp.setEnforcedOptions(params);
+
+        // Reset enforced options with empty bytes.
+        params[0] = IOAppOptionsType3.EnforcedOptionParam(eid, SEND_AND_CALL, bytes(""));
+        oapp.setEnforcedOptions(params);
+
+        // After reset, `combineOptions` should pass through caller options as-is.
+        bytes memory callerOptions = OptionsBuilder
+            .newOptions()
+            .addExecutorLzReceiveOption(100_000, 0)
+            .addExecutorLzComposeOption(0, 300_000, 0);
+        assertEq(oapp.combineOptions(eid, SEND_AND_CALL, callerOptions), callerOptions);
+    }
+
+    function test_combineOptions_Revert_SingleByteExtraOptions() public {
+        uint32 eid = 30101;
+        bytes memory enforced = OptionsBuilder.newOptions().addExecutorLzReceiveOption(200_000, 0);
+
+        IOAppOptionsType3.EnforcedOptionParam[] memory params = new IOAppOptionsType3.EnforcedOptionParam[](1);
+        params[0] = IOAppOptionsType3.EnforcedOptionParam(eid, SEND, enforced);
+        oapp.setEnforcedOptions(params);
+
+        vm.expectRevert(abi.encodeWithSelector(IOAppOptionsType3.InvalidOptions.selector, hex"03"));
+        oapp.combineOptions(eid, SEND, hex"03");
+    }
+
+    function test_combineOptions_Fuzz(uint32 _eid, uint16 _msgType, uint128 _enforcedGas, uint128 _extraGas) public {
+        _enforcedGas = uint128(bound(_enforcedGas, 1, type(uint128).max));
+        _extraGas = uint128(bound(_extraGas, 1, type(uint128).max));
+
+        bytes memory enforced = OptionsBuilder.newOptions().addExecutorLzReceiveOption(_enforcedGas, 0);
+
+        IOAppOptionsType3.EnforcedOptionParam[] memory params = new IOAppOptionsType3.EnforcedOptionParam[](1);
+        params[0] = IOAppOptionsType3.EnforcedOptionParam(_eid, _msgType, enforced);
+        oapp.setEnforcedOptions(params);
+
+        bytes memory extra = OptionsBuilder.newOptions().addExecutorLzReceiveOption(_extraGas, 0);
+        bytes memory expected = OptionsBuilder
+            .newOptions()
+            .addExecutorLzReceiveOption(_enforcedGas, 0)
+            .addExecutorLzReceiveOption(_extraGas, 0);
+
+        assertEq(oapp.combineOptions(_eid, _msgType, extra), expected);
+    }
+
+    function test_combineOptions_Fuzz_Revert_InvalidExtraOptionsType(uint16 _optionsType) public {
+        vm.assume(_optionsType != 3);
+
+        bytes memory enforced = OptionsBuilder.newOptions().addExecutorLzReceiveOption(200_000, 0);
+
+        IOAppOptionsType3.EnforcedOptionParam[] memory params = new IOAppOptionsType3.EnforcedOptionParam[](1);
+        params[0] = IOAppOptionsType3.EnforcedOptionParam(1, SEND, enforced);
+        oapp.setEnforcedOptions(params);
+
+        bytes memory invalidOptions = abi.encodePacked(_optionsType);
+        vm.expectRevert(abi.encodeWithSelector(IOAppOptionsType3.InvalidOptions.selector, invalidOptions));
+        oapp.combineOptions(1, SEND, invalidOptions);
+    }
+}

package/test/OAppOptionsType3RBACUpgradeable.t.sol

@@ -0,0 +1,67 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.22;
+
+import { IOAppOptionsType3 } from "@layerzerolabs/oapp-evm-contracts/contracts/interfaces/IOAppOptionsType3.sol";
+import { OptionsBuilder } from "@layerzerolabs/oapp-evm-contracts/contracts/oapp/libs/OptionsBuilder.sol";
+import { Initializable } from "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol";
+import { IAccessControl } from "@openzeppelin/contracts/access/IAccessControl.sol";
+import { TransparentUpgradeableProxy } from "@openzeppelin/contracts/proxy/transparent/TransparentUpgradeableProxy.sol";
+import { OAppOptionsType3RBACUpgradeable } from "./../contracts/oapp/options-type-3/OAppOptionsType3RBACUpgradeable.sol";
+import { OAppOptionsType3BaseUpgradeableTest } from "./OAppOptionsType3BaseUpgradeable.t.sol";
+
+contract OAppOptionsType3RBACHarness is OAppOptionsType3RBACUpgradeable {
+    constructor() {
+        _disableInitializers();
+    }
+
+    function initialize(address _initialAdmin) public initializer {
+        __AccessControl2Step_init(_initialAdmin);
+    }
+}
+
+contract OAppOptionsType3RBACUpgradeableTest is OAppOptionsType3BaseUpgradeableTest {
+    using OptionsBuilder for bytes;
+
+    address alice = makeAddr("alice");
+
+    function _createOApp() internal virtual override returns (IOAppOptionsType3) {
+        OAppOptionsType3RBACHarness impl = new OAppOptionsType3RBACHarness();
+        TransparentUpgradeableProxy proxy = new TransparentUpgradeableProxy(
+            address(impl),
+            address(this),
+            abi.encodeWithSelector(OAppOptionsType3RBACHarness.initialize.selector, address(this))
+        );
+        return IOAppOptionsType3(address(proxy));
+    }
+
+    function setUp() public override {
+        oapp = _createOApp();
+    }
+
+    // ============ initialize ============
+
+    /// @dev Override since `OAppOptionsType3RBACHarness.initialize(address)` has a different signature.
+    function test_initialize_Revert_AlreadyInitialized() public override {
+        vm.expectRevert(Initializable.InvalidInitialization.selector);
+        OAppOptionsType3RBACHarness(address(oapp)).initialize(alice);
+    }
+
+    // ============ setEnforcedOptions ============
+
+    function test_setEnforcedOptions_Revert_Unauthorized() public {
+        bytes memory sendOptions = OptionsBuilder.newOptions().addExecutorLzReceiveOption(200_000, 0);
+
+        IOAppOptionsType3.EnforcedOptionParam[] memory params = new IOAppOptionsType3.EnforcedOptionParam[](1);
+        params[0] = IOAppOptionsType3.EnforcedOptionParam(1, SEND, sendOptions);
+
+        vm.expectRevert(
+            abi.encodeWithSelector(
+                IAccessControl.AccessControlUnauthorizedAccount.selector,
+                alice,
+                OAppOptionsType3RBACHarness(address(oapp)).DEFAULT_ADMIN_ROLE()
+            )
+        );
+        vm.prank(alice);
+        oapp.setEnforcedOptions(params);
+    }
+}