chanlink 0.0.1-security → 0.8.2

package/v0.5/contracts/tests/ChainlinkTestHelper.sol

@@ -0,0 +1,75 @@
+pragma solidity ^0.5.0;
+
+import "../Chainlink.sol";
+
+contract ChainlinkTestHelper {
+  using Chainlink for Chainlink.Request;
+  using CBOR_Chainlink for Buffer_Chainlink.buffer;
+
+  Chainlink.Request private req;
+
+  event RequestData(bytes payload);
+
+  function closeEvent() public {
+    emit RequestData(req.buf.buf);
+  }
+
+  function setBuffer(bytes memory data) public {
+    Chainlink.Request memory r2 = req;
+    r2.setBuffer(data);
+    req = r2;
+  }
+
+  function add(string memory _key, string memory _value) public {
+    Chainlink.Request memory r2 = req;
+    r2.add(_key, _value);
+    req = r2;
+  }
+
+  function addBytes(string memory _key, bytes memory _value) public {
+    Chainlink.Request memory r2 = req;
+    r2.addBytes(_key, _value);
+    req = r2;
+  }
+
+  function addInt(string memory _key, int256 _value) public {
+    Chainlink.Request memory r2 = req;
+    r2.addInt(_key, _value);
+    req = r2;
+  }
+
+  function addUint(string memory _key, uint256 _value) public {
+    Chainlink.Request memory r2 = req;
+    r2.addUint(_key, _value);
+    req = r2;
+  }
+
+  // Temporarily have method receive bytes32[] memory until experimental
+  // string[] memory can be invoked from truffle tests.
+  function addStringArray(string memory _key, bytes32[] memory _values) public {
+    string[] memory strings = new string[](_values.length);
+    for (uint256 i = 0; i < _values.length; i++) {
+      strings[i] = bytes32ToString(_values[i]);
+    }
+    Chainlink.Request memory r2 = req;
+    r2.addStringArray(_key, strings);
+    req = r2;
+  }
+
+  function bytes32ToString(bytes32 x) private pure returns (string memory) {
+    bytes memory bytesString = new bytes(32);
+    uint charCount = 0;
+    for (uint j = 0; j < 32; j++) {
+      byte char = byte(bytes32(uint(x) * 2 ** (8 * j)));
+      if (char != 0) {
+        bytesString[charCount] = char;
+        charCount++;
+      }
+    }
+    bytes memory bytesStringTrimmed = new bytes(charCount);
+    for (uint j = 0; j < charCount; j++) {
+      bytesStringTrimmed[j] = bytesString[j];
+    }
+    return string(bytesStringTrimmed);
+  }
+}

package/v0.5/contracts/tests/Consumer.sol

@@ -0,0 +1,55 @@
+pragma solidity ^0.5.0;
+
+import "../ChainlinkClient.sol";
+
+contract Consumer is ChainlinkClient {
+  bytes32 internal specId;
+  bytes32 public currentPrice;
+
+  event RequestFulfilled(
+    bytes32 indexed requestId,  // User-defined ID
+    bytes32 indexed price
+  );
+
+  function requestEthereumPrice(string memory _currency, uint256 _payment) public {
+    requestEthereumPriceByCallback(_currency, _payment, address(this));
+  }
+
+  function requestEthereumPriceByCallback(string memory _currency, uint256 _payment, address _callback) public {
+    Chainlink.Request memory req = buildChainlinkRequest(specId, _callback, this.fulfill.selector);
+    req.add("get", "https://min-api.cryptocompare.com/data/price?fsym=ETH&tsyms=USD,EUR,JPY");
+    string[] memory path = new string[](1);
+    path[0] = _currency;
+    req.addStringArray("path", path);
+    sendChainlinkRequest(req, _payment);
+  }
+
+  function cancelRequest(
+    address _oracle,
+    bytes32 _requestId,
+    uint256 _payment,
+    bytes4 _callbackFunctionId,
+    uint256 _expiration
+  ) public {
+    ChainlinkRequestInterface requested = ChainlinkRequestInterface(_oracle);
+    requested.cancelOracleRequest(_requestId, _payment, _callbackFunctionId, _expiration);
+  }
+
+  function withdrawLink() public {
+    LinkTokenInterface _link = LinkTokenInterface(chainlinkTokenAddress());
+    require(_link.transfer(msg.sender, _link.balanceOf(address(this))), "Unable to transfer");
+  }
+
+  function addExternalRequest(address _oracle, bytes32 _requestId) external {
+    addChainlinkExternalRequest(_oracle, _requestId);
+  }
+
+  function fulfill(bytes32 _requestId, bytes32 _price)
+    public
+    recordChainlinkFulfillment(_requestId)
+  {
+    emit RequestFulfilled(_requestId, _price);
+    currentPrice = _price;
+  }
+
+}

package/v0.5/contracts/tests/EmptyAggregator.sol

@@ -0,0 +1,34 @@
+pragma solidity 0.5.0;
+
+import "../dev/CoordinatorInterface.sol";
+
+/// Used to check the basic aggregator/coordinator interactions. It does nothing
+/// but emit its messages as certain types of events.
+contract EmptyAggregator {
+
+  event InitiatedJob(bytes32 said);
+
+  function initiateJob(
+    bytes32 _saId, bytes memory _serviceAgreementData)
+    public returns (bool success, bytes memory _) {
+      emit InitiatedJob(_saId);
+      success = true;
+    }
+
+  event Fulfilled(
+    bytes32 requestId,
+    address oracle,
+    bool success,
+    bool complete,
+    bytes fulfillment);
+
+  function fulfill(bytes32 _requestId, bytes32 _saId, address _oracle,
+    bytes32 _fulfillment)
+    public returns (bool success, bool complete, bytes memory response,
+    int256[] memory paymentAmounts) {
+      success = true;
+      complete = true;
+      response = abi.encode(_fulfillment);
+      emit Fulfilled(_requestId, _oracle, success, complete, response);
+    }
+}

package/v0.5/contracts/tests/GetterSetter.sol

@@ -0,0 +1,45 @@
+pragma solidity 0.5.0;
+
+// GetterSetter is a contract to aid debugging and testing during development.
+contract GetterSetter {
+  bytes32 public getBytes32;
+  uint256 public getUint256;
+  bytes32 public requestId;
+  bytes public getBytes;
+
+  event SetBytes32(address indexed from, bytes32 indexed value);
+  event SetUint256(address indexed from, uint256 indexed value);
+  event SetBytes(address indexed from, bytes value);
+
+  event Output(bytes32 b32, uint256 u256, bytes32 b322);
+
+  function setBytes32(bytes32 _value) public {
+    getBytes32 = _value;
+    emit SetBytes32(msg.sender, _value);
+  }
+
+  function requestedBytes32(bytes32 _requestId, bytes32 _value) public {
+    requestId = _requestId;
+    setBytes32(_value);
+  }
+
+  function setBytes(bytes memory _value) public {
+    getBytes = _value;
+    emit SetBytes(msg.sender, _value);
+  }
+
+  function requestedBytes(bytes32 _requestId, bytes memory _value) public {
+    requestId = _requestId;
+    setBytes(_value);
+  }
+
+  function setUint256(uint256 _value) public {
+    getUint256 = _value;
+    emit SetUint256(msg.sender, _value);
+  }
+
+  function requestedUint256(bytes32 _requestId, uint256 _value) public {
+    requestId = _requestId;
+    setUint256(_value);
+  }
+}

package/v0.5/contracts/tests/MaliciousChainlink.sol

@@ -0,0 +1,75 @@
+pragma solidity 0.5.0;
+
+import "../vendor/CBOR.sol";
+
+library MaliciousChainlink {
+  using CBOR for Buffer.buffer;
+
+  struct Request {
+    bytes32 specId;
+    address callbackAddress;
+    bytes4 callbackFunctionId;
+    uint256 nonce;
+    Buffer.buffer buf;
+  }
+
+  struct WithdrawRequest {
+    bytes32 specId;
+    address callbackAddress;
+    bytes4 callbackFunctionId;
+    uint256 nonce;
+    Buffer.buffer buf;
+  }
+
+  function initializeWithdraw(
+    WithdrawRequest memory self,
+    bytes32 _specId,
+    address _callbackAddress,
+    bytes4 _callbackFunction
+  ) internal pure returns (MaliciousChainlink.WithdrawRequest memory) {
+    Buffer.init(self.buf, 128);
+    self.specId = _specId;
+    self.callbackAddress = _callbackAddress;
+    self.callbackFunctionId = _callbackFunction;
+    return self;
+  }
+
+  function add(Request memory self, string memory _key, string memory _value)
+    internal pure
+  {
+    self.buf.encodeString(_key);
+    self.buf.encodeString(_value);
+  }
+
+  function addBytes(Request memory self, string memory _key, bytes memory _value)
+    internal pure
+  {
+    self.buf.encodeString(_key);
+    self.buf.encodeBytes(_value);
+  }
+
+  function addInt(Request memory self, string memory _key, int256 _value)
+    internal pure
+  {
+    self.buf.encodeString(_key);
+    self.buf.encodeInt(_value);
+  }
+
+  function addUint(Request memory self, string memory _key, uint256 _value)
+    internal pure
+  {
+    self.buf.encodeString(_key);
+    self.buf.encodeUInt(_value);
+  }
+
+  function addStringArray(Request memory self, string memory _key, string[] memory _values)
+    internal pure
+  {
+    self.buf.encodeString(_key);
+    self.buf.startArray();
+    for (uint256 i = 0; i < _values.length; i++) {
+      self.buf.encodeString(_values[i]);
+    }
+    self.buf.endSequence();
+  }
+}

package/v0.5/contracts/tests/MaliciousChainlinkClient.sol

@@ -0,0 +1,109 @@
+pragma solidity 0.5.0;
+
+import "./MaliciousChainlink.sol";
+import "../ChainlinkClient.sol";
+import "../vendor/SafeMath.sol";
+
+contract MaliciousChainlinkClient is ChainlinkClient {
+  using MaliciousChainlink for MaliciousChainlink.Request;
+  using MaliciousChainlink for MaliciousChainlink.WithdrawRequest;
+  using Chainlink for Chainlink.Request;
+  using SafeMath for uint256;
+
+  uint256 private maliciousRequests = 1;
+  mapping(bytes32 => address) private maliciousPendingRequests;
+
+  function newWithdrawRequest(
+    bytes32 _specId,
+    address _callbackAddress,
+    bytes4 _callbackFunction
+  ) internal pure returns (MaliciousChainlink.WithdrawRequest memory) {
+    MaliciousChainlink.WithdrawRequest memory req;
+    return req.initializeWithdraw(_specId, _callbackAddress, _callbackFunction);
+  }
+
+  function chainlinkTargetRequest(address _target, Chainlink.Request memory _req, uint256 _amount)
+    internal
+    returns(bytes32 requestId)
+  {
+    requestId = keccak256(abi.encodePacked(_target, maliciousRequests));
+    _req.nonce = maliciousRequests;
+    maliciousPendingRequests[requestId] = chainlinkOracleAddress();
+    emit ChainlinkRequested(requestId);
+    LinkTokenInterface _link = LinkTokenInterface(chainlinkTokenAddress());
+    require(_link.transferAndCall(chainlinkOracleAddress(), _amount, encodeTargetRequest(_req)), "Unable to transferAndCall to oracle");
+    maliciousRequests += 1;
+
+    return requestId;
+  }
+
+  function chainlinkPriceRequest(Chainlink.Request memory _req, uint256 _amount)
+    internal
+    returns(bytes32 requestId)
+  {
+    requestId = keccak256(abi.encodePacked(this, maliciousRequests));
+    _req.nonce = maliciousRequests;
+    maliciousPendingRequests[requestId] = chainlinkOracleAddress();
+    emit ChainlinkRequested(requestId);
+    LinkTokenInterface _link = LinkTokenInterface(chainlinkTokenAddress());
+    require(_link.transferAndCall(chainlinkOracleAddress(), _amount, encodePriceRequest(_req)), "Unable to transferAndCall to oracle");
+    maliciousRequests += 1;
+
+    return requestId;
+  }
+
+  function chainlinkWithdrawRequest(MaliciousChainlink.WithdrawRequest memory _req, uint256 _wei)
+    internal
+    returns(bytes32 requestId)
+  {
+    requestId = keccak256(abi.encodePacked(this, maliciousRequests));
+    _req.nonce = maliciousRequests;
+    maliciousPendingRequests[requestId] = chainlinkOracleAddress();
+    emit ChainlinkRequested(requestId);
+    LinkTokenInterface _link = LinkTokenInterface(chainlinkTokenAddress());
+    require(_link.transferAndCall(chainlinkOracleAddress(), _wei, encodeWithdrawRequest(_req)), "Unable to transferAndCall to oracle");
+    maliciousRequests += 1;
+    return requestId;
+  }
+
+  function encodeWithdrawRequest(MaliciousChainlink.WithdrawRequest memory _req)
+    internal pure returns (bytes memory)
+  {
+    return abi.encodeWithSelector(
+      bytes4(keccak256("withdraw(address,uint256)")),
+      _req.callbackAddress,
+      _req.callbackFunctionId,
+      _req.nonce,
+      _req.buf.buf);
+  }
+
+  function encodeTargetRequest(Chainlink.Request memory _req)
+    internal pure returns (bytes memory)
+  {
+    return abi.encodeWithSelector(
+      bytes4(keccak256("oracleRequest(address,uint256,bytes32,address,bytes4,uint256,uint256,bytes)")),
+      0, // overridden by onTokenTransfer
+      0, // overridden by onTokenTransfer
+      _req.id,
+      _req.callbackAddress,
+      _req.callbackFunctionId,
+      _req.nonce,
+      1,
+      _req.buf.buf);
+  }
+
+  function encodePriceRequest(Chainlink.Request memory _req)
+    internal pure returns (bytes memory)
+  {
+    return abi.encodeWithSelector(
+      bytes4(keccak256("oracleRequest(address,uint256,bytes32,address,bytes4,uint256,uint256,bytes)")),
+      0, // overridden by onTokenTransfer
+      2000000000000000000, // overridden by onTokenTransfer
+      _req.id,
+      _req.callbackAddress,
+      _req.callbackFunctionId,
+      _req.nonce,
+      1,
+      _req.buf.buf);
+  }
+}

package/v0.5/contracts/tests/MaliciousConsumer.sol

@@ -0,0 +1,54 @@
+pragma solidity 0.5.0;
+
+import "../ChainlinkClient.sol";
+
+contract MaliciousConsumer is ChainlinkClient {
+  uint256 constant private ORACLE_PAYMENT = 1 * LINK;
+  uint256 private expiration;
+
+  constructor(address _link, address _oracle) public payable {
+    setChainlinkToken(_link);
+    setChainlinkOracle(_oracle);
+  }
+
+  function () external payable {} // solhint-disable-line no-empty-blocks
+
+  function requestData(bytes32 _id, bytes memory _callbackFunc) public {
+    Chainlink.Request memory req = buildChainlinkRequest(_id, address(this), bytes4(keccak256(_callbackFunc)));
+    expiration = now.add(5 minutes); // solhint-disable-line not-rely-on-time
+    sendChainlinkRequest(req, ORACLE_PAYMENT);
+  }
+
+  function assertFail(bytes32, bytes32) public pure {
+    assert(1 == 2);
+  }
+
+  function cancelRequestOnFulfill(bytes32 _requestId, bytes32) public {
+    cancelChainlinkRequest(
+      _requestId,
+      ORACLE_PAYMENT,
+      this.cancelRequestOnFulfill.selector,
+      expiration);
+  }
+
+  function remove() public {
+    selfdestruct(address(0));
+  }
+
+  function stealEthCall(bytes32 _requestId, bytes32) public recordChainlinkFulfillment(_requestId) {
+    (bool success,) = address(this).call.value(100)(""); // solhint-disable-line avoid-call-value
+    require(success, "Call failed");
+  }
+
+  function stealEthSend(bytes32 _requestId, bytes32) public recordChainlinkFulfillment(_requestId) {
+    // solhint-disable-next-line check-send-result
+    bool success = address(this).send(100); // solhint-disable-line multiple-sends
+    require(success, "Send failed");
+  }
+
+  function stealEthTransfer(bytes32 _requestId, bytes32) public recordChainlinkFulfillment(_requestId) {
+    address(this).transfer(100);
+  }
+
+  function doesNothing(bytes32, bytes32) public pure {} // solhint-disable-line no-empty-blocks
+}

package/v0.5/contracts/tests/MaliciousRequester.sol

@@ -0,0 +1,52 @@
+pragma solidity 0.5.0;
+
+
+import "./MaliciousChainlinkClient.sol";
+
+
+contract MaliciousRequester is MaliciousChainlinkClient {
+
+  uint256 constant private ORACLE_PAYMENT = 1 * LINK;
+  uint256 private expiration;
+
+  constructor(address _link, address _oracle) public {
+    setChainlinkToken(_link);
+    setChainlinkOracle(_oracle);
+  }
+
+  function maliciousWithdraw()
+    public
+  {
+    MaliciousChainlink.WithdrawRequest memory req = newWithdrawRequest(
+      "specId", address(this), this.doesNothing.selector);
+    chainlinkWithdrawRequest(req, ORACLE_PAYMENT);
+  }
+
+  function request(bytes32 _id, address _target, bytes memory _callbackFunc) public returns (bytes32 requestId) {
+    Chainlink.Request memory req = buildChainlinkRequest(_id, _target, bytes4(keccak256(_callbackFunc)));
+    expiration = now.add(5 minutes); // solhint-disable-line not-rely-on-time
+    requestId = sendChainlinkRequest(req, ORACLE_PAYMENT);
+  }
+
+  function maliciousPrice(bytes32 _id) public returns (bytes32 requestId) {
+    Chainlink.Request memory req = buildChainlinkRequest(_id, address(this), this.doesNothing.selector);
+    requestId = chainlinkPriceRequest(req, ORACLE_PAYMENT);
+  }
+
+  function maliciousTargetConsumer(address _target) public returns (bytes32 requestId) {
+    Chainlink.Request memory req = buildChainlinkRequest("specId", _target, bytes4(keccak256("fulfill(bytes32,bytes32)")));
+    requestId = chainlinkTargetRequest(_target, req, ORACLE_PAYMENT);
+  }
+
+  function maliciousRequestCancel(bytes32 _id, bytes memory _callbackFunc) public {
+    ChainlinkRequestInterface _oracle = ChainlinkRequestInterface(chainlinkOracleAddress());
+    _oracle.cancelOracleRequest(
+      request(_id, address(this), _callbackFunc),
+      ORACLE_PAYMENT,
+      this.maliciousRequestCancel.selector,
+      expiration
+    );
+  }
+
+  function doesNothing(bytes32, bytes32) public pure {} // solhint-disable-line no-empty-blocks
+}

package/v0.5/contracts/tests/MeanAggregator.sol

@@ -0,0 +1,75 @@
+pragma solidity 0.5.0;
+
+import "../dev/CoordinatorInterface.sol";
+import "../dev/ServiceAgreementDecoder.sol";
+
+/// Computes the mean of the values the oracles pass it via fulfill method
+contract MeanAggregator is ServiceAgreementDecoder {
+
+  // Relies on Coordinator's authorization of the oracles (no need to track
+  // oracle authorization in this contract.)
+
+  mapping(bytes32 /* service agreement ID */ => uint256) payment;
+  mapping(bytes32 /* service agreement ID */ => address[]) oracles;
+  mapping(bytes32 /* request ID */ => uint256) numberReported;
+  mapping(bytes32 /* request ID */ => mapping(address => uint256)) reportingOrder;
+
+  // Current total for given request, divided by number of oracles reporting
+  mapping(bytes32 /* request ID */ => uint256) average;
+  // Remainder of total for given request from division by number of oracles.
+  mapping(bytes32 /* request ID */ => uint256) remainder;
+
+  function initiateJob(
+    bytes32 _sAId, bytes memory _serviceAgreementData)
+    public returns (bool success, bytes memory message) {
+      ServiceAgreement memory serviceAgreement = decodeServiceAgreement(_serviceAgreementData);
+
+      if (oracles[_sAId].length != 0) {
+        return (false, bytes("job already initiated"));
+      }
+      if (serviceAgreement.oracles.length == 0) {
+        return (false, bytes("must depend on at least one oracle"));
+      }
+      oracles[_sAId] = serviceAgreement.oracles;
+      payment[_sAId] = serviceAgreement.payment;
+      success = true;
+    }
+
+  function fulfill(bytes32 _requestId, bytes32 _sAId, address _oracle,
+    bytes32 _value) public
+    returns (bool success, bool complete, bytes memory response,
+    int256[] memory paymentAmounts) {
+      if (reportingOrder[_requestId][_oracle] != 0 ||
+        numberReported[_requestId] == oracles[_sAId].length) {
+        return (false, false, "oracle already reported", paymentAmounts);
+      }
+      uint256 oDividend = uint256(_value) / oracles[_sAId].length;
+      uint256 oRemainder = uint256(_value) % oracles[_sAId].length;
+      uint256 newRemainder = remainder[_requestId] + oRemainder;
+      uint256 newAverage = average[_requestId] + oDividend + (newRemainder / oracles[_sAId].length);
+      assert(newAverage >= average[_requestId]); // No overflow
+      average[_requestId] = newAverage;
+      remainder[_requestId] = newRemainder % oracles[_sAId].length;
+      numberReported[_requestId] += 1;
+      reportingOrder[_requestId][_oracle] = numberReported[_requestId];
+      success = true;
+      complete = (numberReported[_requestId] == oracles[_sAId].length);
+      if (complete) {
+        response = abi.encode(average[_requestId]);
+        paymentAmounts = calculatePayments(_sAId, _requestId);
+      }
+    }
+
+  function calculatePayments(bytes32 _sAId, bytes32 _requestId) private returns (int256[] memory paymentAmounts) {
+    paymentAmounts = new int256[](oracles[_sAId].length);
+    uint256 numOracles = oracles[_sAId].length;
+    uint256 totalPayment = payment[_sAId];
+    for (uint256 oIdx = 0; oIdx < oracles[_sAId].length; oIdx++) {
+      // Linearly-decaying payout determined by each oracle's reportingIdx
+      uint256 reportingIdx = reportingOrder[_requestId][oracles[_sAId][oIdx]] - 1;
+      paymentAmounts[oIdx] = int256(2*(totalPayment/numOracles) - (
+        (totalPayment * ((2*reportingIdx) + 1)) / (numOracles**2)));
+      delete reportingOrder[_requestId][oracles[_sAId][oIdx]];
+    }
+  }
+}

package/v0.5/contracts/tests/MedianTestHelper.sol

@@ -0,0 +1,15 @@
+pragma solidity ^0.5.0;
+
+import "../Median.sol";
+
+contract MedianTestHelper {
+
+  function publicGet(int256[] memory _list)
+    public
+    pure
+    returns (int256)
+  {
+    return Median.calculate(_list);
+  }
+
+}

package/v0.5/contracts/tests/OwnedTestHelper.sol

@@ -0,0 +1,16 @@
+pragma solidity 0.5.0;
+
+import "../dev/Owned.sol";
+
+contract OwnedTestHelper is Owned {
+
+  event Here();
+
+  function modifierOnlyOwner()
+    public
+    onlyOwner()
+  {
+    emit Here();
+  }
+
+}

package/v0.5/contracts/tests/ServiceAgreementConsumer.sol

@@ -0,0 +1,30 @@
+pragma solidity 0.5.0;
+
+import "../ChainlinkClient.sol";
+
+contract ServiceAgreementConsumer is ChainlinkClient {
+  uint256 constant private ORACLE_PAYMENT = 1 * LINK;
+
+  bytes32 internal sAId;
+  bytes32 public currentPrice;
+
+  constructor(address _link, address _coordinator, bytes32 _sAId) public {
+    setChainlinkToken(_link);
+    setChainlinkOracle(_coordinator);
+    sAId = _sAId;
+  }
+
+  function requestEthereumPrice(string memory _currency) public {
+    Chainlink.Request memory req = buildChainlinkRequest(sAId, address(this), this.fulfill.selector);
+    req.add("get", "https://min-api.cryptocompare.com/data/price?fsym=ETH&tsyms=USD,EUR,JPY");
+    req.add("path", _currency);
+    sendChainlinkRequest(req, ORACLE_PAYMENT);
+  }
+
+  function fulfill(bytes32 _requestId, bytes32 _price)
+    public
+    recordChainlinkFulfillment(_requestId)
+  {
+    currentPrice = _price;
+  }
+}