Merge pull request #2489 from AmbireTech/feature/safe-delegation-warnings-improvements

Add: display a warning when a delegate call is detected during execute as well

Author: Oxbobby

src/libs/humanizer/erc7730/humanize.ts

@@ -378,6 +378,17 @@ const getCalldataFormatMatch = (
   return null
 }
 
+const getSafeExecTransactionWarnings = (match: DescriptorFormatMatch): HumanizerWarning[] => {
+  const fragment = getFunctionFragment(match.formatKey)
+  if (fragment?.name !== 'execTransaction') return []
+
+  const operation = toBigIntOrNull(match.values.operation)
+  const to = match.values.to
+  if (operation === null || typeof to !== 'string') return []
+
+  return getDelegateCallWarning(operation, to)
+}
+
 const getTypedMessageFormatMatch = (
   message: Message,
   descriptor: Erc7730Descriptor
@@ -1557,6 +1568,7 @@ export const humanizeCallWithErc7730 = (
         fullVisualization: visualizationWithNativeValue,
         warnings: dedupeWarnings([
           ...getSafeCallWarnings(call, accountAddr),
+          ...getSafeExecTransactionWarnings(match),
           ...getNativeValueWarnings(visualizationWithNativeValue, nativeAssetSymbol)
         ])
       }

src/libs/humanizer/index.test.ts

@@ -2251,6 +2251,60 @@ describe('ERC-7730 descriptors', () => {
     })
   })
 
+  test('keeps the Safe delegatecall warning after ERC-7730 execTransaction humanization', () => {
+    const safeProxy = '0x043faB48aCC3DD066fcf33cA3e3f2E2Ba5be9018'
+    const recipeExecutor = '0xc91305DdE651c899EF8eE1D0C33E7dab1B5ABF0D'
+    const execTransactionData = new ethers.Interface(execTransactionAbi).encodeFunctionData(
+      'execTransaction',
+      [recipeExecutor, 0, '0x0c2c8750', 1, 0, 0, 0, ZeroAddress, ZeroAddress, '0x']
+    )
+    const safeExecAccountOp: AccountOp = {
+      ...accountOp,
+      chainId: 8453n,
+      calls: [
+        {
+          to: safeProxy,
+          value: 0n,
+          data: execTransactionData
+        }
+      ]
+    }
+    const irCalls = humanizeAccountOp(safeExecAccountOp, {
+      erc7730Descriptors: {
+        0: {
+          descriptor: {
+            display: {
+              formats: {
+                'execTransaction(address to,uint256 value,bytes data,uint8 operation,uint256 safeTxGas,uint256 baseGas,uint256 gasPrice,address gasToken,address refundReceiver,bytes signatures)':
+                  {
+                    intent: 'sign multisig operation',
+                    fields: [
+                      { path: 'operation', label: 'Operation type' },
+                      {
+                        path: 'data',
+                        label: 'Transaction',
+                        format: 'calldata',
+                        params: { calleePath: 'to' }
+                      }
+                    ]
+                  }
+              }
+            }
+          }
+        }
+      }
+    })
+
+    expect(irCalls[0]?.warnings).toEqual([
+      getWarning(
+        'You are about to delegate permissions to a contract not whitelisted by Safe. Proceed with caution',
+        'SAFE{WALLET}_DELEGATE_CALL',
+        undefined,
+        recipeExecutor
+      )
+    ])
+  })
+
   test('humanizes Safe setup calldata nested in a factory initializer with ERC-7730', () => {
     const safeProxyFactory = '0x4e1DCf7AD4e460CfD30791CCC4F9c8a4f820ec67'
     const safeSingleton = '0x41675c099f32341bf84bfc5382af534df5c7461a'

src/libs/humanizer/modules/Safe/safe.test.ts

@@ -3,7 +3,7 @@ import { AccountOp } from '../../../accountOp/accountOp'
 import { HumanizerMeta } from '../../interfaces'
 import { compareHumanizerVisualizations } from '../../testHelpers'
 import { getAction, getAddressVisualization, getLabel } from '../../utils'
-import SafeModule from '.'
+import SafeModule from './'
 
 const transactions = [
   {
@@ -12,6 +12,11 @@ const transactions = [
     data: '0x6a7612020000000000000000000000000bbbead62f7647ae8323d2cb243a0db74b7c2b800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000014000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00000000000000000000000000000000000000000000000000000000000000044a9059cbb0000000000000000000000006969174fd72466430a46e18234d0b530c9fd5f49000000000000000000000000000000000000000000000000016345785d8a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000820000000000000000000000004206d534CD8aCF86ba0eeC5ABb3c0B98EF7728dC000000000000000000000000000000000000000000000000000000000000000001a2df9e98285798df2bc8ba5368202ed950e153dee458fa9264dabf03722203d60a6ec8fc34f6dd0c745ef498795bf6bb00f32aec006af6fc94df3ac4b8284f1c1b000000000000000000000000000000000000000000000000000000000000'
   }
 ]
+const delegateCallTransaction = {
+  to: '0x043faB48aCC3DD066fcf33cA3e3f2E2Ba5be9018',
+  value: 0n,
+  data: '0x6a761202000000000000000000000000c91305dde651c899ef8ee1d0c33e7dab1b5abf0d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001400000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000025aa0f9a42ee4ea2dc7f3c9ff02f558dcb0445a3000000000000000000000000000000000000000000000000000000000000088000000000000000000000000000000000000000000000000000000000000007040c2c8750000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000a000000000000000000000000000000000000000000000000000000000000000e0000000000000000000000000000000000000000000000000000000000000038000000000000000000000000000000000000000000000000000000000000003e0000000000000000000000000000000000000000000000000000000000000044000000000000000000000000000000000000000000000000000000000000000104161766556334f70656e5265636970650000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000016000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000572000000000000000000000000d8293ad21678c6f09da139b4b62d38e514a03b780000000000000000000000000000000000000000000000000000000000000006000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e20fcbdbffc4dd138ce8b2e6fbb6cb49777ad64d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000002710000000000000000000000000d8293ad21678c6f09da139b4b62d38e514a03b780000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e20fcbdbffc4dd138ce8b2e6fbb6cb49777ad64d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002fc33bf00000000000000000000000000000000000000000000000000000000009e9290b100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000160000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000041000000000000000000000000d8293ad21678c6f09da139b4b62d38e514a03b7800000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000'
+}
 const accountOp: AccountOp = {
   accountAddr: '0x6969174FD72466430a46e18234D0b530c9FD5f49',
   chainId: 42161n,
@@ -23,7 +28,8 @@ const accountOp: AccountOp = {
   calls: [],
   gasLimit: null,
   signature: null,
-  gasFeePayment: null
+  gasFeePayment: null,
+  id: 'testSafe'
   // This is fed into the humanizer to help visualize the accountOp
   // This can contain info like the value of specific share tokens at the time of signing,
   // or any other data that needs to otherwise be retrieved in an async manner and/or needs to be