Use obfuscated key in deployment

package.json

@@ -7,8 +7,8 @@
     "solhint-plugin-prettier": "^0.0.5"
   },
   "scripts": {
-    "fmt": "prettier 'src/**/*.sol' -w && prettier 'test/**/*.sol' -w",
-    "lint": "solhint 'src/**/*.sol' 'test/**/*.sol'"
+    "fmt": "prettier 'src/**/*.sol' -w && prettier 'test/**/*.sol' -w && prettier 'script/**/*.sol' -w",
+    "lint": "solhint 'src/**/*.sol' 'test/**/*.sol' 'script/**/*.sol'"
   },
   "version": "1.3.0"
 }

readme.md

@@ -55,20 +55,37 @@ forge build -o artifacts
 The ETH flow contract has a dedicated deployment script. To simulate a deployment, run:
 
 ```sh
-forge script script/Deploy.sol --rpc-url "$RPC_URL" -vvvv --private-key "$PK"
+forge script script/Deploy.sol --rpc-url "$RPC_URL" -vvvv "$ETHFLOW_OBFUSCATED_PK"
 ```
 
 You can find a list of supported RPC URLs in `foundry.toml` under `[rpc_endpoints]`.
 
-To broadcast the deployment onchain, append `--broadcast` to the command above.
+`ETHFLOW_OBFUSCATED_PK` is an obfuscated version of the private key used in the deployment, _not_ a raw private key.
+The purpose of obfuscating the key is making sure the same key isn't used by accident to deploy other contracts, thereby consuming the nonce of the deployer used for deterministic addresses.
+It's not a security mechanism: the key is trivially recovered from the obfuscated version.
 
 You can verify a contract you deployed with the deployment script on the block explorer of the current chain with:
 
 ```sh
 export ETHERSCAN_API_KEY=<your Etherscan API key> # Only needed for etherscan-based explorers
-forge script script/Deploy.sol --rpc-url "$RPC_URL" -vvvv --private-key "$PK" --verify
+forge script script/Deploy.sol --rpc-url "$RPC_URL" -vvvv --verify "$ETHFLOW_OBFUSCATED_PK"
 ```
 
+To broadcast the deployment onchain and verify it at the same time, append `--broadcast` to the command above.
+
+#### Obfuscate/deobfuscate a private key
+
+For standard deployments on a new chain, there's no need to do this because the standard deployer is already provided with an obfuscated key.
+
+If you need to generate a new obfuscated key from an actual secret key, you can run the following command:
+
+```sh
+PK=<your private key here>
+forge script script/ObfuscateKey.sol "$PK"
+```
+
+To recover the actual key from an obfuscated key, you can run the exact same command: obfuscating twice returns the original key.
+
 ### Code formatting
 
 ```sh

script/Deploy.sol

@@ -1,21 +1,36 @@
 // SPDX-License-Identifier: UNLICENSED
 pragma solidity ^0.8.13;
 
-import "forge-std/Script.sol";
-import "./ValidatedAddress.sol";
-import "../src/CoWSwapEthFlow.sol";
+import {Script, console} from "forge-std/Script.sol";
+import {Vm} from "forge-std/Vm.sol";
+
+import {CoWSwapEthFlow, ICoWSwapSettlement, IWrappedNativeToken} from "src/CoWSwapEthFlow.sol";
+
+import {ValidatedAddress} from "./ValidatedAddress.sol";
+import {Obfuscator} from "./ObfuscateKey.sol";
 
 /// @title Deployer Script for the ETH Flow Contract
 /// @author CoW Swap Developers.
 contract Deploy is Script {
-    function run() external {
-        vm.startBroadcast();
-
-        new CoWSwapEthFlow(
-            ICoWSwapSettlement(ValidatedAddress.cowSwapSettlement()),
-            IWrappedNativeToken(ValidatedAddress.wrappedNativeToken())
+    /// @param obfuscatedPk An obfuscated version of the private key used for
+    /// deploying the contract.
+    function run(bytes32 obfuscatedPk) external {
+        ICoWSwapSettlement settlement = ICoWSwapSettlement(
+            ValidatedAddress.cowSwapSettlement()
         );
+        IWrappedNativeToken wrappedNativeToken = IWrappedNativeToken(
+            ValidatedAddress.wrappedNativeToken()
+        );
+
+        uint256 pk = uint256(Obfuscator.deobfuscate(obfuscatedPk));
+        Vm.Wallet memory wallet = vm.createWallet(pk);
+        console.log("Deployer address:    ", wallet.addr);
 
-        vm.stopBroadcast();
+        vm.broadcast(wallet.privateKey);
+        CoWSwapEthFlow ethFlow = new CoWSwapEthFlow(
+            settlement,
+            wrappedNativeToken
+        );
+        console.log("Contract deployed at:", address(ethFlow));
     }
 }

script/ObfuscateKey.sol

@@ -0,0 +1,32 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.13;
+
+import {Script, console} from "forge-std/Script.sol";
+
+library Obfuscator {
+    bytes32 internal constant SHIFT =
+        0x31337def1beef31337def1beef31337def1beef31337def1beef1173def1beef;
+
+    function obfuscate(bytes32 input) internal pure returns (bytes32) {
+        return SHIFT ^ input;
+    }
+
+    function deobfuscate(bytes32 input) internal pure returns (bytes32) {
+        // This function is the inverse of itself.
+        return obfuscate(input);
+    }
+}
+
+/// @title Helper script to obfuscate a key for use in the deployment process.
+/// @dev This obfuscation isn't intended to be secure, it's just here to avoid
+/// reusing the private keys in other contexts by accident.
+/// @author CoW Swap Developers.
+contract ObfuscateKey is Script {
+    function run(bytes32 key) external pure {
+        console.log("Obfuscation parameter:", vm.toString(Obfuscator.SHIFT));
+        console.log(
+            "Obfuscated key:       ",
+            vm.toString(Obfuscator.obfuscate(key))
+        );
+    }
+}