chanlink 0.0.1-security → 0.8.2

package/contracts/tests/EmptyOracle.sol

@@ -0,0 +1,19 @@
+pragma solidity 0.4.24;
+
+import "../interfaces/ChainlinkRequestInterface.sol";
+import "../interfaces/OracleInterface.sol";
+
+/* solhint-disable no-empty-blocks */
+
+contract EmptyOracle is ChainlinkRequestInterface, OracleInterface {
+
+  function cancelOracleRequest(bytes32, uint256, bytes4, uint256) external {}
+  function fulfillOracleRequest(bytes32, uint256, address, bytes4, uint256, bytes32) external returns (bool) {}
+  function getAuthorizationStatus(address) external view returns (bool) { return false; }
+  function onTokenTransfer(address, uint256, bytes) external pure {}
+  function oracleRequest(address, uint256, bytes32, address, bytes4, uint256, uint256, bytes) external {}
+  function setFulfillmentPermission(address, bool) external {}
+  function withdraw(address, uint256) external {}
+  function withdrawable() external view returns (uint256) {}
+
+}

package/contracts/tests/GetterSetter.sol

@@ -0,0 +1,45 @@
+pragma solidity 0.4.24;
+
+// GetterSetter is a contract to aid debugging and testing during development.
+contract GetterSetter {
+  bytes32 public getBytes32;
+  uint256 public getUint256;
+  bytes32 public requestId;
+  bytes public getBytes;
+
+  event SetBytes32(address indexed from, bytes32 indexed value);
+  event SetUint256(address indexed from, uint256 indexed value);
+  event SetBytes(address indexed from, bytes value);
+
+  event Output(bytes32 b32, uint256 u256, bytes32 b322);
+
+  function setBytes32(bytes32 _value) public {
+    getBytes32 = _value;
+    emit SetBytes32(msg.sender, _value);
+  }
+
+  function requestedBytes32(bytes32 _requestId, bytes32 _value) public {
+    requestId = _requestId;
+    setBytes32(_value);
+  }
+
+  function setBytes(bytes _value) public {
+    getBytes = _value;
+    emit SetBytes(msg.sender, _value);
+  }
+
+  function requestedBytes(bytes32 _requestId, bytes _value) public {
+    requestId = _requestId;
+    setBytes(_value);
+  }
+
+  function setUint256(uint256 _value) public {
+    getUint256 = _value;
+    emit SetUint256(msg.sender, _value);
+  }
+
+  function requestedUint256(bytes32 _requestId, uint256 _value) public {
+    requestId = _requestId;
+    setUint256(_value);
+  }
+}

package/contracts/tests/MaliciousChainlink.sol

@@ -0,0 +1,76 @@
+pragma solidity 0.4.24;
+
+import "../vendor/CBOR.sol";
+
+
+library MaliciousChainlink {
+  using CBOR for Buffer.buffer;
+
+  struct Request {
+    bytes32 specId;
+    address callbackAddress;
+    bytes4 callbackFunctionId;
+    uint256 nonce;
+    Buffer.buffer buf;
+  }
+
+  struct WithdrawRequest {
+    bytes32 specId;
+    address callbackAddress;
+    bytes4 callbackFunctionId;
+    uint256 nonce;
+    Buffer.buffer buf;
+  }
+
+  function initializeWithdraw(
+    WithdrawRequest memory self,
+    bytes32 _specId,
+    address _callbackAddress,
+    bytes4 _callbackFunction
+  ) internal pure returns (MaliciousChainlink.WithdrawRequest memory) {
+    Buffer.init(self.buf, 128);
+    self.specId = _specId;
+    self.callbackAddress = _callbackAddress;
+    self.callbackFunctionId = _callbackFunction;
+    return self;
+  }
+
+  function add(Request memory self, string _key, string _value)
+    internal pure
+  {
+    self.buf.encodeString(_key);
+    self.buf.encodeString(_value);
+  }
+
+  function addBytes(Request memory self, string _key, bytes _value)
+    internal pure
+  {
+    self.buf.encodeString(_key);
+    self.buf.encodeBytes(_value);
+  }
+
+  function addInt(Request memory self, string _key, int256 _value)
+    internal pure
+  {
+    self.buf.encodeString(_key);
+    self.buf.encodeInt(_value);
+  }
+
+  function addUint(Request memory self, string _key, uint256 _value)
+    internal pure
+  {
+    self.buf.encodeString(_key);
+    self.buf.encodeUInt(_value);
+  }
+
+  function addStringArray(Request memory self, string _key, string[] memory _values)
+    internal pure
+  {
+    self.buf.encodeString(_key);
+    self.buf.startArray();
+    for (uint256 i = 0; i < _values.length; i++) {
+      self.buf.encodeString(_values[i]);
+    }
+    self.buf.endSequence();
+  }
+}

package/contracts/tests/MaliciousChainlinked.sol

@@ -0,0 +1,109 @@
+pragma solidity 0.4.24;
+
+import "./MaliciousChainlink.sol";
+import "../Chainlinked.sol";
+import "../vendor/SafeMath.sol";
+
+contract MaliciousChainlinked is Chainlinked {
+  using MaliciousChainlink for MaliciousChainlink.Request;
+  using MaliciousChainlink for MaliciousChainlink.WithdrawRequest;
+  using Chainlink for Chainlink.Request;
+  using SafeMath for uint256;
+
+  uint256 private maliciousRequests = 1;
+  mapping(bytes32 => address) private maliciousPendingRequests;
+
+  function newWithdrawRequest(
+    bytes32 _specId,
+    address _callbackAddress,
+    bytes4 _callbackFunction
+  ) internal pure returns (MaliciousChainlink.WithdrawRequest memory) {
+    MaliciousChainlink.WithdrawRequest memory req;
+    return req.initializeWithdraw(_specId, _callbackAddress, _callbackFunction);
+  }
+
+  function chainlinkTargetRequest(address _target, Chainlink.Request memory _req, uint256 _amount)
+    internal
+    returns(bytes32 requestId)
+  {
+    requestId = keccak256(abi.encodePacked(_target, maliciousRequests));
+    _req.nonce = maliciousRequests;
+    maliciousPendingRequests[requestId] = oracleAddress();
+    emit ChainlinkRequested(requestId);
+    LinkTokenInterface link = LinkTokenInterface(chainlinkToken());
+    require(link.transferAndCall(oracleAddress(), _amount, encodeTargetRequest(_req)), "Unable to transferAndCall to oracle");
+    maliciousRequests += 1;
+
+    return requestId;
+  }
+
+  function chainlinkPriceRequest(Chainlink.Request memory _req, uint256 _amount)
+    internal
+    returns(bytes32 requestId)
+  {
+    requestId = keccak256(abi.encodePacked(this, maliciousRequests));
+    _req.nonce = maliciousRequests;
+    maliciousPendingRequests[requestId] = oracleAddress();
+    emit ChainlinkRequested(requestId);
+    LinkTokenInterface link = LinkTokenInterface(chainlinkToken());
+    require(link.transferAndCall(oracleAddress(), _amount, encodePriceRequest(_req)), "Unable to transferAndCall to oracle");
+    maliciousRequests += 1;
+
+    return requestId;
+  }
+
+  function chainlinkWithdrawRequest(MaliciousChainlink.WithdrawRequest memory _req, uint256 _wei)
+    internal
+    returns(bytes32 requestId)
+  {
+    requestId = keccak256(abi.encodePacked(this, maliciousRequests));
+    _req.nonce = maliciousRequests;
+    maliciousPendingRequests[requestId] = oracleAddress();
+    emit ChainlinkRequested(requestId);
+    LinkTokenInterface link = LinkTokenInterface(chainlinkToken());
+    require(link.transferAndCall(oracleAddress(), _wei, encodeWithdrawRequest(_req)), "Unable to transferAndCall to oracle");
+    maliciousRequests += 1;
+    return requestId;
+  }
+
+  function encodeWithdrawRequest(MaliciousChainlink.WithdrawRequest memory _req)
+    internal pure returns (bytes memory)
+  {
+    return abi.encodeWithSelector(
+      bytes4(keccak256("withdraw(address,uint256)")),
+      _req.callbackAddress,
+      _req.callbackFunctionId,
+      _req.nonce,
+      _req.buf.buf);
+  }
+
+  function encodeTargetRequest(Chainlink.Request memory _req)
+    internal pure returns (bytes memory)
+  {
+    return abi.encodeWithSelector(
+      bytes4(keccak256("oracleRequest(address,uint256,bytes32,address,bytes4,uint256,uint256,bytes)")),
+      0, // overridden by onTokenTransfer
+      0, // overridden by onTokenTransfer
+      _req.id,
+      _req.callbackAddress,
+      _req.callbackFunctionId,
+      _req.nonce,
+      1,
+      _req.buf.buf);
+  }
+
+  function encodePriceRequest(Chainlink.Request memory _req)
+    internal pure returns (bytes memory)
+  {
+    return abi.encodeWithSelector(
+      bytes4(keccak256("oracleRequest(address,uint256,bytes32,address,bytes4,uint256,uint256,bytes)")),
+      0, // overridden by onTokenTransfer
+      2000000000000000000, // overridden by onTokenTransfer
+      _req.id,
+      _req.callbackAddress,
+      _req.callbackFunctionId,
+      _req.nonce,
+      1,
+      _req.buf.buf);
+  }
+}

package/contracts/tests/MaliciousConsumer.sol

@@ -0,0 +1,54 @@
+pragma solidity 0.4.24;
+
+
+import "../Chainlinked.sol";
+
+
+contract MaliciousConsumer is Chainlinked {
+  uint256 constant private ORACLE_PAYMENT = 1 * LINK;
+  uint256 private expiration;
+
+  constructor(address _link, address _oracle) public payable {
+    setLinkToken(_link);
+    setOracle(_oracle);
+  }
+
+  function () public payable {} // solhint-disable-line no-empty-blocks
+
+  function requestData(bytes32 _id, bytes _callbackFunc) public {
+    Chainlink.Request memory req = newRequest(_id, this, bytes4(keccak256(_callbackFunc)));
+    expiration = now.add(5 minutes); // solhint-disable-line not-rely-on-time
+    chainlinkRequest(req, ORACLE_PAYMENT);
+  }
+
+  function assertFail(bytes32, bytes32) public pure {
+    assert(1 == 2);
+  }
+
+  function cancelRequestOnFulfill(bytes32 _requestId, bytes32) public {
+    cancelChainlinkRequest(
+      _requestId,
+      ORACLE_PAYMENT,
+      this.cancelRequestOnFulfill.selector,
+      expiration);
+  }
+
+  function remove() public {
+    selfdestruct(address(0));
+  }
+
+  function stealEthCall(bytes32 _requestId, bytes32) public recordChainlinkFulfillment(_requestId) {
+    require(address(this).call.value(100)(), "Call failed"); // solhint-disable-line avoid-call-value
+  }
+
+  function stealEthSend(bytes32 _requestId, bytes32) public recordChainlinkFulfillment(_requestId) {
+    // solhint-disable-next-line check-send-result
+    require(address(this).send(100), "Send failed"); // solhint-disable-line multiple-sends
+  }
+
+  function stealEthTransfer(bytes32 _requestId, bytes32) public recordChainlinkFulfillment(_requestId) {
+    address(this).transfer(100);
+  }
+
+  function doesNothing(bytes32, bytes32) public pure {} // solhint-disable-line no-empty-blocks
+}

package/contracts/tests/MaliciousRequester.sol

@@ -0,0 +1,52 @@
+pragma solidity 0.4.24;
+
+
+import "./MaliciousChainlinked.sol";
+
+
+contract MaliciousRequester is MaliciousChainlinked {
+
+  uint256 constant private ORACLE_PAYMENT = 1 * LINK;
+  uint256 private expiration;
+
+  constructor(address _link, address _oracle) public {
+    setLinkToken(_link);
+    setOracle(_oracle);
+  }
+
+  function maliciousWithdraw()
+    public
+  {
+    MaliciousChainlink.WithdrawRequest memory req = newWithdrawRequest(
+      "specId", this, this.doesNothing.selector);
+    chainlinkWithdrawRequest(req, ORACLE_PAYMENT);
+  }
+
+  function request(bytes32 _id, address _target, bytes _callbackFunc) public returns (bytes32 requestId) {
+    Chainlink.Request memory req = newRequest(_id, _target, bytes4(keccak256(_callbackFunc)));
+    expiration = now.add(5 minutes); // solhint-disable-line not-rely-on-time
+    requestId = chainlinkRequest(req, ORACLE_PAYMENT);
+  }
+
+  function maliciousPrice(bytes32 _id) public returns (bytes32 requestId) {
+    Chainlink.Request memory req = newRequest(_id, this, this.doesNothing.selector);
+    requestId = chainlinkPriceRequest(req, ORACLE_PAYMENT);
+  }
+
+  function maliciousTargetConsumer(address _target) public returns (bytes32 requestId) {
+    Chainlink.Request memory req = newRequest("specId", _target, bytes4(keccak256("fulfill(bytes32,bytes32)")));
+    requestId = chainlinkTargetRequest(_target, req, ORACLE_PAYMENT);
+  }
+
+  function maliciousRequestCancel(bytes32 _id, bytes _callbackFunc) public {
+    ChainlinkRequestInterface oracle = ChainlinkRequestInterface(oracleAddress());
+    oracle.cancelOracleRequest(
+      request(_id, this, _callbackFunc),
+      ORACLE_PAYMENT,
+      this.maliciousRequestCancel.selector,
+      expiration
+    );
+  }
+
+  function doesNothing(bytes32, bytes32) public pure {} // solhint-disable-line no-empty-blocks
+}

package/contracts/tests/UpdatableConsumer.sol

@@ -0,0 +1,24 @@
+pragma solidity 0.4.24;
+
+import "./Consumer.sol";
+
+contract UpdatableConsumer is Consumer {
+
+  constructor(bytes32 _specId, address _ens, bytes32 _node) public {
+    specId = _specId;
+    useChainlinkWithENS(_ens, _node);
+  }
+
+  function updateOracle() public {
+    updateChainlinkOracleWithENS();
+  }
+
+  function getChainlinkToken() public view returns (address) {
+    return chainlinkTokenAddress();
+  }
+
+  function getOracle() public view returns (address) {
+    return chainlinkOracleAddress();
+  }
+
+}

package/contracts/vendor/Buffer.sol

@@ -0,0 +1,301 @@
+pragma solidity >0.4.18;
+
+/**
+* @dev A library for working with mutable byte buffers in Solidity.
+*
+* Byte buffers are mutable and expandable, and provide a variety of primitives
+* for writing to them. At any time you can fetch a bytes object containing the
+* current contents of the buffer. The bytes object should not be stored between
+* operations, as it may change due to resizing of the buffer.
+*/
+library Buffer {
+  /**
+  * @dev Represents a mutable buffer. Buffers have a current value (buf) and
+  *      a capacity. The capacity may be longer than the current value, in
+  *      which case it can be extended without the need to allocate more memory.
+  */
+  struct buffer {
+    bytes buf;
+    uint capacity;
+  }
+
+  /**
+  * @dev Initializes a buffer with an initial capacity.
+  * @param buf The buffer to initialize.
+  * @param capacity The number of bytes of space to allocate the buffer.
+  * @return The buffer, for chaining.
+  */
+  function init(buffer memory buf, uint capacity) internal pure returns(buffer memory) {
+    if (capacity % 32 != 0) {
+      capacity += 32 - (capacity % 32);
+    }
+    // Allocate space for the buffer data
+    buf.capacity = capacity;
+    assembly {
+      let ptr := mload(0x40)
+      mstore(buf, ptr)
+      mstore(ptr, 0)
+      mstore(0x40, add(32, add(ptr, capacity)))
+    }
+    return buf;
+  }
+
+  /**
+  * @dev Initializes a new buffer from an existing bytes object.
+  *      Changes to the buffer may mutate the original value.
+  * @param b The bytes object to initialize the buffer with.
+  * @return A new buffer.
+  */
+  function fromBytes(bytes memory b) internal pure returns(buffer memory) {
+    buffer memory buf;
+    buf.buf = b;
+    buf.capacity = b.length;
+    return buf;
+  }
+
+  function resize(buffer memory buf, uint capacity) private pure {
+    bytes memory oldbuf = buf.buf;
+    init(buf, capacity);
+    append(buf, oldbuf);
+  }
+
+  function max(uint a, uint b) private pure returns(uint) {
+    if (a > b) {
+      return a;
+    }
+    return b;
+  }
+
+  /**
+  * @dev Sets buffer length to 0.
+  * @param buf The buffer to truncate.
+  * @return The original buffer, for chaining..
+  */
+  function truncate(buffer memory buf) internal pure returns (buffer memory) {
+    assembly {
+      let bufptr := mload(buf)
+      mstore(bufptr, 0)
+    }
+    return buf;
+  }
+
+  /**
+  * @dev Writes a byte string to a buffer. Resizes if doing so would exceed
+  *      the capacity of the buffer.
+  * @param buf The buffer to append to.
+  * @param off The start offset to write to.
+  * @param data The data to append.
+  * @param len The number of bytes to copy.
+  * @return The original buffer, for chaining.
+  */
+  function write(buffer memory buf, uint off, bytes memory data, uint len) internal pure returns(buffer memory) {
+    require(len <= data.length);
+
+    if (off + len > buf.capacity) {
+      resize(buf, max(buf.capacity, len + off) * 2);
+    }
+
+    uint dest;
+    uint src;
+    assembly {
+      // Memory address of the buffer data
+      let bufptr := mload(buf)
+      // Length of existing buffer data
+      let buflen := mload(bufptr)
+      // Start address = buffer address + offset + sizeof(buffer length)
+      dest := add(add(bufptr, 32), off)
+      // Update buffer length if we're extending it
+      if gt(add(len, off), buflen) {
+        mstore(bufptr, add(len, off))
+      }
+      src := add(data, 32)
+    }
+
+    // Copy word-length chunks while possible
+    for (; len >= 32; len -= 32) {
+      assembly {
+        mstore(dest, mload(src))
+      }
+      dest += 32;
+      src += 32;
+    }
+
+    // Copy remaining bytes
+    uint mask = 256 ** (32 - len) - 1;
+    assembly {
+      let srcpart := and(mload(src), not(mask))
+      let destpart := and(mload(dest), mask)
+      mstore(dest, or(destpart, srcpart))
+    }
+
+    return buf;
+  }
+
+  /**
+  * @dev Appends a byte string to a buffer. Resizes if doing so would exceed
+  *      the capacity of the buffer.
+  * @param buf The buffer to append to.
+  * @param data The data to append.
+  * @param len The number of bytes to copy.
+  * @return The original buffer, for chaining.
+  */
+  function append(buffer memory buf, bytes memory data, uint len) internal pure returns (buffer memory) {
+    return write(buf, buf.buf.length, data, len);
+  }
+
+  /**
+  * @dev Appends a byte string to a buffer. Resizes if doing so would exceed
+  *      the capacity of the buffer.
+  * @param buf The buffer to append to.
+  * @param data The data to append.
+  * @return The original buffer, for chaining.
+  */
+  function append(buffer memory buf, bytes memory data) internal pure returns (buffer memory) {
+    return write(buf, buf.buf.length, data, data.length);
+  }
+
+  /**
+  * @dev Writes a byte to the buffer. Resizes if doing so would exceed the
+  *      capacity of the buffer.
+  * @param buf The buffer to append to.
+  * @param off The offset to write the byte at.
+  * @param data The data to append.
+  * @return The original buffer, for chaining.
+  */
+  function writeUint8(buffer memory buf, uint off, uint8 data) internal pure returns(buffer memory) {
+    if (off >= buf.capacity) {
+      resize(buf, buf.capacity * 2);
+    }
+
+    assembly {
+      // Memory address of the buffer data
+      let bufptr := mload(buf)
+      // Length of existing buffer data
+      let buflen := mload(bufptr)
+      // Address = buffer address + sizeof(buffer length) + off
+      let dest := add(add(bufptr, off), 32)
+      mstore8(dest, data)
+      // Update buffer length if we extended it
+      if eq(off, buflen) {
+        mstore(bufptr, add(buflen, 1))
+      }
+    }
+    return buf;
+  }
+
+  /**
+  * @dev Appends a byte to the buffer. Resizes if doing so would exceed the
+  *      capacity of the buffer.
+  * @param buf The buffer to append to.
+  * @param data The data to append.
+  * @return The original buffer, for chaining.
+  */
+  function appendUint8(buffer memory buf, uint8 data) internal pure returns(buffer memory) {
+    return writeUint8(buf, buf.buf.length, data);
+  }
+
+  /**
+  * @dev Writes up to 32 bytes to the buffer. Resizes if doing so would
+  *      exceed the capacity of the buffer.
+  * @param buf The buffer to append to.
+  * @param off The offset to write at.
+  * @param data The data to append.
+  * @param len The number of bytes to write (left-aligned).
+  * @return The original buffer, for chaining.
+  */
+  function write(buffer memory buf, uint off, bytes32 data, uint len) private pure returns(buffer memory) {
+    if (len + off > buf.capacity) {
+      resize(buf, (len + off) * 2);
+    }
+
+    uint mask = 256 ** len - 1;
+    // Right-align data
+    data = data >> (8 * (32 - len));
+    assembly {
+      // Memory address of the buffer data
+      let bufptr := mload(buf)
+      // Address = buffer address + sizeof(buffer length) + off + len
+      let dest := add(add(bufptr, off), len)
+      mstore(dest, or(and(mload(dest), not(mask)), data))
+      // Update buffer length if we extended it
+      if gt(add(off, len), mload(bufptr)) {
+        mstore(bufptr, add(off, len))
+      }
+    }
+    return buf;
+  }
+
+  /**
+  * @dev Writes a bytes20 to the buffer. Resizes if doing so would exceed the
+  *      capacity of the buffer.
+  * @param buf The buffer to append to.
+  * @param off The offset to write at.
+  * @param data The data to append.
+  * @return The original buffer, for chaining.
+  */
+  function writeBytes20(buffer memory buf, uint off, bytes20 data) internal pure returns (buffer memory) {
+    return write(buf, off, bytes32(data), 20);
+  }
+
+  /**
+  * @dev Appends a bytes20 to the buffer. Resizes if doing so would exceed
+  *      the capacity of the buffer.
+  * @param buf The buffer to append to.
+  * @param data The data to append.
+  * @return The original buffer, for chhaining.
+  */
+  function appendBytes20(buffer memory buf, bytes20 data) internal pure returns (buffer memory) {
+    return write(buf, buf.buf.length, bytes32(data), 20);
+  }
+
+  /**
+  * @dev Appends a bytes32 to the buffer. Resizes if doing so would exceed
+  *      the capacity of the buffer.
+  * @param buf The buffer to append to.
+  * @param data The data to append.
+  * @return The original buffer, for chaining.
+  */
+  function appendBytes32(buffer memory buf, bytes32 data) internal pure returns (buffer memory) {
+    return write(buf, buf.buf.length, data, 32);
+  }
+
+  /**
+  * @dev Writes an integer to the buffer. Resizes if doing so would exceed
+  *      the capacity of the buffer.
+  * @param buf The buffer to append to.
+  * @param off The offset to write at.
+  * @param data The data to append.
+  * @param len The number of bytes to write (right-aligned).
+  * @return The original buffer, for chaining.
+  */
+  function writeInt(buffer memory buf, uint off, uint data, uint len) private pure returns(buffer memory) {
+    if (len + off > buf.capacity) {
+      resize(buf, (len + off) * 2);
+    }
+
+    uint mask = 256 ** len - 1;
+    assembly {
+      // Memory address of the buffer data
+      let bufptr := mload(buf)
+      // Address = buffer address + off + sizeof(buffer length) + len
+      let dest := add(add(bufptr, off), len)
+      mstore(dest, or(and(mload(dest), not(mask)), data))
+      // Update buffer length if we extended it
+      if gt(add(off, len), mload(bufptr)) {
+        mstore(bufptr, add(off, len))
+      }
+    }
+    return buf;
+  }
+
+  /**
+   * @dev Appends a byte to the end of the buffer. Resizes if doing so would
+   * exceed the capacity of the buffer.
+   * @param buf The buffer to append to.
+   * @param data The data to append.
+   * @return The original buffer.
+   */
+  function appendInt(buffer memory buf, uint data, uint len) internal pure returns(buffer memory) {
+    return writeInt(buf, buf.buf.length, data, len);
+  }
+}