feat: euler working poc #1

kaze-cow · 2025-09-11T13:01:46Z

implements the bulk code expected to be required for an Ethereum Vault Connector integration with CoWSwap through a GPv2Wrapper integration. The code here is based on an original PoC developed by @anxolin https://github.com/anxolin/evk-periphery . Compared to the PoC, it has these major changes:

bring it into our own repo and trim the dependencies as much as possible
modify the overall flow so that it is easier for backend changes:
- (in pre-hook): call setEvcCalls, which sets transient data for use in the next call
- (as main op): solver calls settle() function (same as GPv2Settlement signature) on the EVC wraper contract
- (within settle): call pre-hooks with EVC (ex borrow)
- (within settle): EVC calls internalSettle() which calls the actual GPv2Settlement settle()
- (within settle): call post-hooks with EVC (ex. return)
tighten the security (ex. only the EVC can call internalSettle)

To be done in separate PRs:

analyze gas usage and make sure its in line with our expectations

* check solver on internalSettle function * check only callable through EVC * prevent reentrancy

make settlement the gatekeeper why did I not do this before

anxolin

Generally looks great!

Some general feedback:

The PR is way too big. It adds too many things at once. We should seek smaller PRs to make sure reviews happen earlier
I didn't get yet how this thing will be secure. If the transient storage is done in hook, how we make sure this is secure?
In the description you reference the PoC. It would be good to give some pointer so readers have the right context.
Added a few other nits and comments in the review

cannonfile.test.toml

script/CannonDeploy.sol

script/Transient.s.sol

src/CowEvcWrapper.sol

test/CowEvcWrapperTest.internal.t.sol

test/helpers/CowBaseTest.sol

anxolin · 2025-09-24T10:05:12Z

test/CowEvcWrapperTest.t.sol

+import {CowEvcWrapper, GPv2Trade, GPv2Interaction} from "../src/CowEvcWrapper.sol";
+import {GPv2AllowListAuthentication} from "cow/GPv2AllowListAuthentication.sol";
+//import {GPv2Settlement} from "cow/GPv2Settlement.sol";
+//import {GPv2Interaction, GPv2Trade} from "../../src/vendor/interfaces/IGPv2Settlement.sol";


anxolin · 2025-09-24T10:06:31Z

test/CowEvcWrapperTest.t.sol

+    }
+
+    function test_batchWithSettle_Empty() external {
+        vm.skip(bytes(FORK_RPC_URL).length == 0);


Because so many dependencies, I guess its hard to not depend on forking right?

couple things I have found WRT fork tests:

If you lock a block number, fork tests can be just as performant and insightful as unit tests for many needs. And oftentimes easier to set up. That is the case here and its indeed been convenient

As you say, setting up mocks for large, many dependency projects like this can be a challenge (though foundry has been finding ways to make this easier, so with the help of AI (cough cough) can probably crank these out)

in a PR following the security PR my priority will be to use Unit tests to cover any uncovered code as a next step.

anxolin · 2025-09-24T10:17:07Z

test/CowEvcWrapperTest.t.sol

+        );
+    }
+
+    function test_leverage_WithCoWOrder() external {


Probably this test should get a bit more of explanatation. Its a quite complex use case, so probably we should find a way to simplify it (so it has less lines of code) and also explain exactly what is doing (explain the use case, and why those EVC calls are needed).

Also, ideally nice to connect it more to how this could be used. The update of the transient data will be done in a hook (according to the comments). In general, would be great to see how this connects to how this will be used in reality.

yea this should probably go in its own file actually. its the core of the whole PoC.

Will also link the diagram I sent yesterday for reference 👍

kaze-cow · 2025-09-25T04:08:36Z

re @anxolin

The PR is way too big. It adds too many things at once. We should seek smaller PRs to make sure reviews happen earlier

whoops! yea my focus for this PR was just to take the work you did from the original euler repo and apply it to a fresh slate and minimize

I didn't get yet how this thing will be secure. If the transient storage is done in hook, how we make sure this is secure?

thats because the security changes were put in a separate PR! #2

In the description you reference the PoC. It would be good to give some pointer so readers have the right context.

will do 👍

This reverts commit e56eac3.

best way to ensure the expected flow is followed exactly

src/CowEvcWrapper.sol

src/SwapVerifier.sol

fedgiac · 2025-09-29T17:56:56Z

src/CowEvcWrapper.sol

+
+/// @title CowEvcWrapper
+/// @notice A wrapper around the EVC that allows for settlement operations
+contract CowEvcWrapper {


I don't mind either way but considering it's the first contract one sees in the explorer I think it makes sense it mentions the settlement contract. Maybe CowEvcSettlement for simplicity? I'd vote against anything like *Proxy though because the word proxy is usually interpreted as "delegatecall shim" but it isn't the case here.

src/CowEvcWrapper.sol

src/vendor/interfaces/IGPv2Settlement.sol

test/CowEvcWrapperTest.t.sol

fedgiac · 2025-09-29T18:52:52Z

test/helpers/SignerECDSA.sol

+abstract contract EIP712 {
+
+    bytes32 internal constant _TYPE_HASH =
+        keccak256("EIP712Domain(string name,uint256 chainId,address verifyingContract)");
+
+    bytes32 internal immutable _hashedName;
+    string private _name;
+    string private _nameFallback;
+
+    /**
+     * @dev Initializes the domain separator.
+     *
+     * The meaning of `name` is specified in
+     * https://eips.ethereum.org/EIPS/eip-712#definition-of-domainseparator[EIP 712]:
+     *
+     * - `name`: the user readable name of the signing domain, i.e. the name of the DApp or the protocol.
+     *
+     * NOTE: These parameters cannot be changed except through a xref:learn::upgrading-smart-contracts.adoc[smart
+     * contract upgrade].
+     */
+    constructor(string memory name) {
+        _name = name;
+        _hashedName = keccak256(bytes(name));
+    }
+
+    /**
+     * @dev Returns the domain separator for the current chain.
+     */
+    function _domainSeparatorV4() internal view returns (bytes32) {
+        return _buildDomainSeparator();
+    }
+
+    function _buildDomainSeparator() internal view virtual returns (bytes32) {
+        return bytes32(0);
+    }
+
+    /**
+     * @dev Given an already https://eips.ethereum.org/EIPS/eip-712#definition-of-hashstruct[hashed struct], this
+     * function returns the hash of the fully encoded EIP712 message for this domain.
+     *
+     * This hash can be used together with {ECDSA-recover} to obtain the signer of a message. For example:
+     *
+     * ```solidity
+     * bytes32 digest = _hashTypedDataV4(keccak256(abi.encode(
+     *     keccak256("Mail(address to,string contents)"),
+     *     mailTo,
+     *     keccak256(bytes(mailContents))
+     * )));
+     * address signer = ECDSA.recover(digest, signature);
+     * ```
+     */
+    function _hashTypedDataV4(bytes32 structHash) internal view virtual returns (bytes32) {
+        return ECDSA.toTypedDataHash(_domainSeparatorV4(), structHash);
+    }
+}


Nit: to me, EIP712 just looks like an unneeded extra layer of indirection: it should just made part of SignerECDSA and all indirection involving the virtual _buildDomainSeparator and related function chain should be removed.

* check solver on internalSettle function * check only callable through EVC * prevent reentrancy

they shouldn't have been in the repository

feat: use new wrapper from upstream

feat: working security

we use the settlement contract, so it shouldn't be needed anymore also soljson.latest is still here

this PR is a division of previous PR #1 , focusing on just getting vendored dependencies isolated and added to the project

we dont need it because we have the actual cow repository

feat: pull in from PoC and minify and adjust for easy integratoin

ee6eb57

kaze-cow requested review from anxolin and fedgiac September 11, 2025 13:01

kaze-cow self-assigned this Sep 11, 2025

Kaze added 4 commits September 11, 2025 22:14

remove unnecessary console logs

0172171

fix: some security lockdowns

3e72e99

* check solver on internalSettle function * check only callable through EVC * prevent reentrancy

it builds

453c007

fix: new strategy

0f635c7

make settlement the gatekeeper why did I not do this before

anxolin requested a review from a team September 24, 2025 08:52

anxolin reviewed Sep 24, 2025

View reviewed changes

kaze-cow added 8 commits September 29, 2025 14:34

compiles

5ebd847

fix tests

b168d45

forge fmt

e56eac3

enable optimizer

2e7f051

setup secrets and fix build failure

de12e99

remove sizes for now

c3dc655

Revert "forge fmt"

217af04

This reverts commit e56eac3.

use a settle state instead of original sender

4f6c81e

best way to ensure the expected flow is followed exactly

fedgiac reviewed Sep 29, 2025

View reviewed changes

feat: pull in required vendor dependencies

2c9704a

kaze-cow mentioned this pull request Sep 30, 2025

feat: pull in required vendor dependencies #4

Merged

kaze-cow and others added 6 commits September 30, 2025 16:54

feat: pull in from PoC and minify and adjust for easy integratoin

8982db0

remove unnecessary console logs

e9afd40

fix: some security lockdowns

35cf23b

* check solver on internalSettle function * check only callable through EVC * prevent reentrancy

remove cannon things

938b8e9

they shouldn't have been in the repository

remove unnecessary file

5ca3ae5

update all pragmas

ec9d67d

kaze-cow force-pushed the feat/initial branch from 3319241 to ec9d67d Compare September 30, 2025 07:55

kaze-cow changed the base branch from master to feat/vendor September 30, 2025 07:55

kaze-cow added 5 commits September 30, 2025 16:56

undo undos

9b7a904

fix license

164efff

Merge pull request #3 from cowprotocol/feat/new-wrapper

2d7989b

feat: use new wrapper from upstream

Merge branch 'feat/initial' into feat/security

413d162

Merge pull request #2 from cowprotocol/feat/security

3ff8dc0

feat: working security

kaze-cow requested a review from a team September 30, 2025 08:30

kaze-cow changed the title ~~feat: pull in from PoC and minify and adjust for easy integration~~ feat: euler working poc Sep 30, 2025

cleanup SwapVerifier

ca207e7

we use the settlement contract, so it shouldn't be needed anymore also soljson.latest is still here

kaze-cow added a commit that referenced this pull request Oct 7, 2025

feat: pull in required vendor dependencies (#4)

ec200a4

this PR is a division of previous PR #1 , focusing on just getting vendored dependencies isolated and added to the project

Base automatically changed from feat/vendor to master October 7, 2025 07:38

kaze-cow added 4 commits October 7, 2025 18:10

remove unneeded IGPv2Settlement interface

c3823ba

we dont need it because we have the actual cow repository

remove unneeded commented code lines

30fd178

Merge remote-tracking branch 'origin/master' into feat/initial

b6e2318

add foundry lock

e2151f3

kaze-cow merged commit fa7d2b7 into master Oct 7, 2025
2 of 4 checks passed

kaze-cow deleted the feat/initial branch October 7, 2025 09:19

This was referenced Oct 23, 2025

feat: specialized wrappers #8

Closed

feat(wrapper): helpers contract #7

Open

This was referenced Oct 31, 2025

feat: collateral swap wrapper #13

Open

feat: add wrapper #6

Open

feat: close position wrapper #15

Draft

claude bot mentioned this pull request Nov 8, 2025

feat: open position wrapper #14

Draft

kaze-cow restored the feat/initial branch November 9, 2025 18:27

feat: euler working poc #1

feat: euler working poc #1

Uh oh!

Conversation

kaze-cow commented Sep 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

anxolin left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

anxolin Sep 24, 2025

Choose a reason for hiding this comment

Uh oh!

anxolin Sep 24, 2025

Choose a reason for hiding this comment

Uh oh!

kaze-cow Sep 25, 2025

Choose a reason for hiding this comment

Uh oh!

anxolin Sep 24, 2025

Choose a reason for hiding this comment

Uh oh!

kaze-cow Sep 25, 2025

Choose a reason for hiding this comment

Uh oh!

kaze-cow commented Sep 25, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

fedgiac Sep 29, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

fedgiac Sep 29, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

kaze-cow commented Sep 11, 2025 •

edited

Loading