fix(ZkSync_SpokePool): Add missing bridged USDC approval (#967)

An approval is required to initiate a withdrawal of Circle bridged
(upgradable) USDC on Lens.

Author: pxrl

.github/workflows/pr.yml

@@ -28,11 +28,11 @@ jobs:
       - name: Install Cargo toolchain
         uses: actions-rs/toolchain@v1
         with:
-          toolchain: nightly
+          toolchain: nightly-2025-04-01
           profile: minimal
           components: rustc
       - name: Install packages
-        run: yarn install --frozen-lockfile && rustup component add --toolchain nightly-x86_64-unknown-linux-gnu rustfmt
+        run: yarn install --frozen-lockfile && rustup component add --toolchain nightly-2025-04-01-x86_64-unknown-linux-gnu rustfmt
       - name: Lint js
         shell: bash
         run: yarn lint-js
@@ -69,7 +69,7 @@ jobs:
       - name: Install Cargo toolchain
         uses: actions-rs/toolchain@v1
         with:
-          toolchain: stable
+          toolchain: nightly-2025-04-01
           profile: minimal
           components: rustc
       - name: Cache Cargo dependencies

contracts/ZkSync_SpokePool.sol

@@ -1,9 +1,10 @@
 // SPDX-License-Identifier: BUSL-1.1
 pragma solidity ^0.8.0;
 
-import "./SpokePool.sol";
+import "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";
 import { CircleCCTPAdapter, CircleDomainIds, ITokenMessenger } from "./libraries/CircleCCTPAdapter.sol";
 import { CrossDomainAddressUtils } from "./libraries/CrossDomainAddressUtils.sol";
+import "./SpokePool.sol";
 
 // https://github.com/matter-labs/era-contracts/blob/6391c0d7bf6184d7f6718060e3991ba6f0efe4a7/zksync/contracts/bridge/L2ERC20Bridge.sol#L104
 interface ZkBridgeLike {
@@ -24,6 +25,8 @@ interface IL2ETH {
  * @custom:security-contact [email protected]
  */
 contract ZkSync_SpokePool is SpokePool, CircleCCTPAdapter {
+    using SafeERC20 for IERC20;
+
     // On Ethereum, avoiding constructor parameters and putting them into constants reduces some of the gas cost
     // upon contract deployment. On zkSync the opposite is true: deploying the same bytecode for contracts,
     // while changing only constructor parameters can lead to substantial fee savings. So, the following params
@@ -151,6 +154,7 @@ contract ZkSync_SpokePool is SpokePool, CircleCCTPAdapter {
                 _transferUsdc(withdrawalRecipient, amountToReturn);
             } else {
                 // Matter Labs custom USDC bridge for Circle Bridged (upgradable) USDC.
+                IERC20(l2TokenAddress).forceApprove(address(zkUSDCBridge), amountToReturn);
                 zkUSDCBridge.withdraw(withdrawalRecipient, l2TokenAddress, amountToReturn);
             }
         } else {

package.json

@@ -22,24 +22,25 @@
     "lint": "yarn lint-solidity && yarn lint-js && yarn lint-rust",
     "lint-solidity": "yarn solhint ./contracts/**/*.sol",
     "lint-js": "yarn prettier --list-different **/*.js **/*.ts",
-    "lint-rust": "cargo +nightly fmt --all -- --check && cargo clippy",
-    "lint-fix": "yarn prettier --write **/*.js **/*.ts ./programs/**/*.rs ./contracts**/*.sol && cargo +nightly fmt  --all && cargo clippy",
+    "lint-rust": "cargo +nightly-2025-04-01 fmt --all -- --check && cargo clippy",
+    "lint-fix": "yarn prettier --write **/*.js **/*.ts ./programs/**/*.rs ./contracts**/*.sol && cargo +nightly-2025-04-01 fmt  --all && cargo clippy",
     "clean-fast": "for dir in node_modules cache cache-zk artifacts artifacts-zk dist typechain; do mv \"${dir}\" \"_${dir}\"; rm -rf \"_${dir}\" &; done",
     "clean": "rm -rf node_modules cache cache-zk artifacts artifacts-zk dist typechain",
     "generate-svm-assets": "sh ./scripts/generate-svm-assets.sh && yarn generate-svm-clients",
     "generate-svm-clients": "yarn ts-node ./scripts/svm/utils/generate-svm-clients.ts && yarn ts-node ./scripts/svm/utils/rename-clients-imports.ts",
     "build-evm": "hardhat compile",
-    "build-svm": "echo 'Generating IDLs...' && anchor build > /dev/null 2>&1 || true && anchor run generateExternalTypes && anchor build",
+    "build-svm": "echo 'Generating IDLs...' && yarn anchor-build > /dev/null 2>&1 || true && anchor run generateExternalTypes && yarn anchor-build",
     "build-ts": "rm -rf ./dist && tsc && rsync -a --include '*/' --include '*.d.ts' --exclude '*' ./typechain ./dist/",
     "copy-idl": "mkdir -p dist/src/svm/assets/idl && cp src/svm/assets/idl/*.json dist/src/svm/assets/idl/",
     "build": "yarn build-evm && yarn build-svm && yarn generate-svm-assets && yarn build-ts && yarn copy-idl",
     "test-evm": "IS_TEST=true hardhat test",
-    "test-svm": "anchor test -- --features test",
+    "test-svm": "sh ./scripts/anchor-test.sh",
     "test": "yarn test-evm && yarn test-svm",
     "test:report-gas": "IS_TEST=true REPORT_GAS=true hardhat test",
     "generate-evm-assets": "rm -rf typechain && TYPECHAIN=ethers yarn hardhat typechain",
     "prepublish": "yarn build && hardhat export --export-all ./cache/massExport.json && ts-node ./scripts/processHardhatExport.ts && prettier --write ./deployments/deployments.json && yarn generate-evm-assets",
-    "pre-commit-hook": "sh scripts/preCommitHook.sh"
+    "pre-commit-hook": "sh scripts/preCommitHook.sh",
+    "anchor-build": "sh ./scripts/anchor-build.sh"
   },
   "dependencies": {
     "@across-protocol/constants": "^3.1.46",

rust-toolchain.toml

@@ -0,0 +1,2 @@
+[toolchain]
+channel = "nightly-2025-04-01"

scripts/anchor-build.sh

@@ -0,0 +1,16 @@
+#!/bin/sh
+
+echo "🔨 Building anchor programs (no IDL)..."
+anchor build --no-idl
+
+echo "📦 Generating IDLs (using nightly)..."
+
+for program in programs/*; do
+  [ -d "$program" ] || continue
+
+  dir_name=$(basename "$program")
+  program_name=$(echo "$dir_name" | tr '-' '_')
+
+  echo "→ IDL for $program_name"
+  RUSTUP_TOOLCHAIN="nightly-2025-04-01" anchor idl build -p "$dir_name" -o "target/idl/$program_name.json" -t "target/types/$program_name.ts"
+done

scripts/anchor-test.sh

@@ -0,0 +1,19 @@
+#!/bin/sh
+
+echo "🔨 Building anchor programs (with test feature, no IDL)..."
+anchor build --no-idl -- --features test
+
+echo "📦 Generating IDLs (using nightly)..."
+
+for program in programs/*; do
+  [ -d "$program" ] || continue
+
+  dir_name=$(basename "$program")
+  program_name=$(echo "$dir_name" | tr '-' '_')
+
+  echo "→ IDL for $program_name"
+  RUSTUP_TOOLCHAIN="nightly-2025-04-01" anchor idl build -p "$dir_name" -o "target/idl/$program_name.json" -t "target/types/$program_name.ts"
+done
+
+echo "🧪 Running anchor tests..."
+anchor test --skip-build

test/evm/hardhat/chain-specific-spokepools/ZkSync_SpokePool.ts

@@ -202,9 +202,16 @@ describe("ZkSync Spoke Pool", function () {
       await zkSyncSpokePool.callStatic.chainId()
     );
     await zkSyncSpokePool.connect(crossDomainAlias).relayRootBundle(tree.getHexRoot(), mockTreeRoot);
+    let allowance = await usdc.allowance(zkSyncSpokePool.address, zkUSDCBridge.address);
+    expect(allowance.isZero()).to.be.true;
+
     await zkSyncSpokePool.connect(relayer).executeRelayerRefundLeaf(0, leaves[0], tree.getHexProof(leaves[0]));
 
-    // This should have sent tokens back to L1. Check the correct methods on the gateway are correctly called.
+    // This should have called withdraw() to pull tokens back to L1. Check the correct methods on the gateway are correctly called.
+    // zkUSDCBridge is a mocked contract, so the tokens are not actually moved and the approval is intact.
+    allowance = await usdc.allowance(zkSyncSpokePool.address, zkUSDCBridge.address);
+    expect(allowance.eq(amountToReturn)).to.be.true;
+
     expect(zkUSDCBridge.withdraw).to.have.been.calledOnce;
     expect(zkUSDCBridge.withdraw).to.have.been.calledWith(hubPool.address, usdc.address, amountToReturn);
   });