fix: gate nested V4_SWAP behind an explicit opt-in entrypoint

#491 ran V4 actions inside a foreign PoolManager unlock whenever
poolManager.isUnlocked() was true, inferring consent from chain state. All V4
deltas accrue under the router's address for the lifetime of that unlock while
the router's own locker clears between external calls, so one call could leave
unpaid debt that a later call's SETTLE_ALL or OPEN_DELTA settlement paid from a
different caller's funds (audit finding M-01).

Consent now lives on the entrypoint. executeNested sets a transient flag for the
duration of the call and the nested branch requires it, so only a caller that
opened the surrounding unlock can reach the path. It cannot live in the payload:
EXECUTE_SIGNED_TYPEHASH commits to keccak256(commands), and a command byte would
let the route author, rather than the composer whose capital is at risk, make the
decision. Plain execute now reverts NestedExecutionNotPermitted instead.

Signed routes cannot nest in this version. executeSignedNested would restore
that, but costs 252 bytes against 473 remaining, and the RESOLVE proposal needs
the same headroom. Documented on executeNested as a deliberate omission.

Also carries the calldata re-encode (BP-1/2/3): the v4 parameter decoders follow
struct offsets without bounding them against the enclosing input, so forwarding
a slice of transaction calldata let them read bytes the signature never covered.
executeV4SwapWithinUnlock re-enters through the ABI encoder so calldata ends
where the input ends. This stays load-bearing under the opt-in, since an attacker
can opt themselves in.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: dianakocsis

contracts/UniversalRouter.sol

@@ -9,6 +9,7 @@ import {PaymentsImmutables, PaymentsParameters} from './modules/PaymentsImmutabl
 import {UniswapImmutables, UniswapParameters} from './modules/uniswap/UniswapImmutables.sol';
 import {V4SwapRouter} from './modules/uniswap/v4/V4SwapRouter.sol';
 import {Commands} from './libraries/Commands.sol';
+import {NestedUnlock} from './libraries/NestedUnlock.sol';
 import {IUniversalRouter} from './interfaces/IUniversalRouter.sol';
 import {MigratorImmutables, MigratorParameters} from './modules/MigratorImmutables.sol';
 import {EIP712} from '@openzeppelin/contracts/utils/cryptography/EIP712.sol';
@@ -66,6 +67,17 @@ contract UniversalRouter is IUniversalRouter, ChainedActions, RouteSigner, Dispa
         _resetSignatureContext();
     }
 
+    /// @inheritdoc IUniversalRouter
+    function executeNested(bytes calldata commands, bytes[] calldata inputs, uint256 deadline)
+        external
+        payable
+        checkDeadline(deadline)
+    {
+        NestedUnlock.set(true);
+        execute(commands, inputs);
+        NestedUnlock.set(false);
+    }
+
     /// @inheritdoc Dispatcher
     function execute(bytes calldata commands, bytes[] calldata inputs) public payable override isNotLocked {
         bool success;

contracts/base/Dispatcher.sol

@@ -7,6 +7,7 @@ import {V4SwapRouter} from '../modules/uniswap/v4/V4SwapRouter.sol';
 import {BytesLib} from '../modules/uniswap/v3/BytesLib.sol';
 import {Payments} from '../modules/Payments.sol';
 import {Constants} from '../libraries/Constants.sol';
+import {NestedUnlock} from '../libraries/NestedUnlock.sol';
 import {PaymentsImmutables} from '../modules/PaymentsImmutables.sol';
 import {V3ToV4Migrator} from '../modules/V3ToV4Migrator.sol';
 import {Commands} from '../libraries/Commands.sol';
@@ -37,12 +38,29 @@ abstract contract Dispatcher is
 
     error InvalidCommandType(uint256 commandType);
     error BalanceTooLow();
+    error NotSelf();
+    /// @notice Thrown when a route reaches V4_SWAP inside a foreign PoolManager unlock without opting in
+    error NestedExecutionNotPermitted();
 
     /// @notice Executes encoded commands along with provided inputs.
     /// @param commands A set of concatenated commands, each 1 byte in length
     /// @param inputs An array of byte strings containing abi encoded inputs for each command
     function execute(bytes calldata commands, bytes[] calldata inputs) external payable virtual;
 
+    /// @notice Runs the v4 actions of a V4_SWAP command inside a PoolManager unlock opened elsewhere
+    /// @param inputs The V4_SWAP command input, re-encoded by the dispatcher
+    /// @dev Only callable by this contract. It exists so that `inputs` arrives as a freshly abi encoded
+    /// calldata copy rather than as a slice of the original transaction calldata. The v4 parameter decoders
+    /// follow offsets without bounding them against the enclosing input, so a slice would let them read
+    /// bytes past `inputs.length` -- bytes that executeSigned never commits to. Encoding the argument makes
+    /// calldata end where the input ends, which is the same guarantee poolManager.unlock() gives the
+    /// ordinary path when it re-encodes for unlockCallback.
+    function executeV4SwapWithinUnlock(bytes calldata inputs) external {
+        if (msg.sender != address(this)) revert NotSelf();
+        (bytes calldata actions, bytes[] calldata params) = inputs.decodeActionsRouterParams();
+        _executeActionsWithoutUnlock(actions, params);
+    }
+
     /// @notice Public view function to be used instead of msg.sender, as the contract performs self-reentrancy and at
     /// times msg.sender == address(this). Instead msgSender() returns the initiator of the lock
     /// @dev overrides BaseActionsRouter.msgSender in V4Router
@@ -299,8 +317,22 @@ abstract contract Dispatcher is
                     // contract's unlock callback. Opening a new lock via _executeActions would revert with
                     // AlreadyUnlocked, so instead run the v4 actions within the existing lock.
                     if (poolManager.isUnlocked()) {
-                        (bytes calldata actions, bytes[] calldata params) = inputs.decodeActionsRouterParams();
-                        _executeActionsWithoutUnlock(actions, params);
+                        // Nesting shares the router's delta account with every other call in this
+                        // unlock, so it runs only when the caller explicitly opted in via executeNested.
+                        if (!NestedUnlock.isPermitted()) revert NestedExecutionNotPermitted();
+                        // Re-enter externally so the abi encoder produces a canonical, self-contained copy of
+                        // `inputs`. Decoding it in place leaves it a slice of the original transaction calldata,
+                        // where the v4 parameter decoders can follow offsets past inputs.length into bytes the
+                        // signature never covered. See executeV4SwapWithinUnlock.
+                        (bool ok, bytes memory reason) =
+                            address(this).call(abi.encodeCall(Dispatcher.executeV4SwapWithinUnlock, (inputs)));
+                        // bubble unconditionally: the _executeActions path below propagates reverts regardless
+                        // of FLAG_ALLOW_REVERT, and routing through a call must not quietly change that
+                        if (!ok) {
+                            assembly ('memory-safe') {
+                                revert(add(reason, 0x20), mload(reason))
+                            }
+                        }
                     } else {
                         // pass the calldata provided to V4SwapRouter._executeActions (defined in BaseActionsRouter)
                         _executeActions(inputs);

contracts/interfaces/IUniversalRouter.sol

@@ -65,6 +65,24 @@ interface IUniversalRouter {
         uint256 deadline
     ) external payable;
 
+    /// @notice Executes encoded commands, opting in to running inside a PoolManager unlock opened by
+    /// another contract
+    /// @param commands A set of concatenated commands, each 1 byte in length
+    /// @param inputs An array of byte strings containing abi encoded inputs for each command
+    /// @param deadline The deadline by which the transaction must be executed
+    /// @dev Use this ONLY from a contract that itself opened the surrounding PoolManager unlock. V4 deltas
+    /// accrue under the router's address for the lifetime of that unlock, not per call, so an unsettled
+    /// delta left by one call can be paid by a later call's `SETTLE_ALL` or `OPEN_DELTA` settlement, out of
+    /// that later caller's funds. Opting in accepts responsibility for that: a contract exposing a
+    /// permissionless function that reaches this entrypoint can have its own capital drained. If a function
+    /// does not open its own unlock, call `execute` instead, which refuses to run nested.
+    /// @dev Signed routes cannot nest in this version. `executeSigned` does not set the opt-in, so a signed
+    /// route reaching V4_SWAP inside a foreign unlock reverts NestedExecutionNotPermitted. This is a
+    /// deliberate omission for bytecode headroom, not a security boundary: a composer that needs a hook to
+    /// authorize on the signer rather than on msgSender() has no way to express that here. Restoring it
+    /// requires an `executeSignedNested` entrypoint and therefore a new router deployment.
+    function executeNested(bytes calldata commands, bytes[] calldata inputs, uint256 deadline) external payable;
+
     /// @notice Returns all signed execution context (signer, intent, data) in a single call
     /// @return signer The address that signed the current execution, or address(0) if not in a signed execution
     /// @return intent The intent value from the signed execution, or bytes32(0) if not in a signed execution

contracts/libraries/NestedUnlock.sol

@@ -0,0 +1,25 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+pragma solidity ^0.8.24;
+
+/// @notice A library to record, in transient storage, that the caller has opted into executing a
+/// route inside a PoolManager unlock opened by another contract.
+/// @dev Set for the duration of an executeNested / executeSignedNested call only. Deltas accrue under
+/// the router's address for the whole of the surrounding unlock, so an opted-in caller is responsible
+/// for the delta hygiene the router can no longer guarantee on its behalf. See IUniversalRouter.
+/// TODO: This library can be deleted when we have the transient keyword support in solidity.
+library NestedUnlock {
+    // The slot holding the opt-in state, transiently. bytes32(uint256(keccak256("NestedUnlock")) - 1)
+    bytes32 constant NESTED_UNLOCK_SLOT = 0x904918ff601603e47e61e77f6dc30e7705c7e82b0e1bf84efb9b137e90ac8643;
+
+    function set(bool permitted) internal {
+        assembly ('memory-safe') {
+            tstore(NESTED_UNLOCK_SLOT, permitted)
+        }
+    }
+
+    function isPermitted() internal view returns (bool permitted) {
+        assembly ('memory-safe') {
+            permitted := tload(NESTED_UNLOCK_SLOT)
+        }
+    }
+}

snapshots/UniversalRouterTest.json

@@ -1,3 +1,3 @@
 {
-  "UniversalRouter bytecode size": "23705"
+  "UniversalRouter bytecode size": "24103"
 }