|
| 1 | +// SPDX-License-Identifier: GPL-3.0-or-later |
| 2 | +pragma solidity 0.8.19; |
| 3 | + |
| 4 | +import {xWELLRouter} from "@protocol/xWELL/xWELLRouter.sol"; |
| 5 | +import {ProposalAction} from "@proposals/proposalTypes/IProposal.sol"; |
| 6 | + |
| 7 | +/// @title BridgeValidationHook |
| 8 | +/// @notice Hook to validate bridgeToRecipient calls in proposals |
| 9 | +/// @dev Ensures that the native value sent with bridge calls is between 5x and 10x |
| 10 | +/// the actual bridge cost returned by router.bridgeCost(destinationChain) |
| 11 | +abstract contract BridgeValidationHook { |
| 12 | + /// @notice Function selector for bridgeToRecipient(address,uint256,uint16) |
| 13 | + bytes4 private constant BRIDGE_TO_RECIPIENT_SELECTOR = |
| 14 | + xWELLRouter.bridgeToRecipient.selector; |
| 15 | + |
| 16 | + /// @notice Minimum multiplier for bridge cost (5x) |
| 17 | + uint256 private constant MIN_BRIDGE_COST_MULTIPLIER = 5; |
| 18 | + |
| 19 | + /// @notice Maximum multiplier for bridge cost (10x) |
| 20 | + uint256 private constant MAX_BRIDGE_COST_MULTIPLIER = 10; |
| 21 | + |
| 22 | + /// @notice Verify bridge-related proposal actions before execution |
| 23 | + /// @dev Called by inheriting contracts to validate bridge cost parameters |
| 24 | + /// @param proposal Array of proposal actions to validate |
| 25 | + function _verifyBridgeActions( |
| 26 | + ProposalAction[] memory proposal |
| 27 | + ) internal view { |
| 28 | + uint256 proposalLength = proposal.length; |
| 29 | + |
| 30 | + for (uint256 i = 0; i < proposalLength; i++) { |
| 31 | + bytes4 selector = bytesToBytes4(proposal[i].data); |
| 32 | + |
| 33 | + // Check if this action is a bridgeToRecipient call |
| 34 | + if (selector == BRIDGE_TO_RECIPIENT_SELECTOR) { |
| 35 | + address router = proposal[i].target; |
| 36 | + uint256 actionValue = proposal[i].value; |
| 37 | + |
| 38 | + // Validate router is a contract |
| 39 | + _validateRouterIsContract(router); |
| 40 | + |
| 41 | + // Extract wormholeChainId from calldata |
| 42 | + // Calldata structure: |
| 43 | + // 0-3: function selector |
| 44 | + // 4-35: address to (32 bytes) |
| 45 | + // 36-67: uint256 amount (32 bytes) |
| 46 | + // 68-99: uint16 wormholeChainId (32 bytes, right-padded) |
| 47 | + uint16 wormholeChainId = extractUint16FromCalldata( |
| 48 | + proposal[i].data |
| 49 | + ); |
| 50 | + |
| 51 | + // Get the actual bridge cost from the router with validation |
| 52 | + uint256 bridgeCost = _getBridgeCost(router, wormholeChainId); |
| 53 | + |
| 54 | + // Validate that action value is between 5x and 10x the bridge cost |
| 55 | + uint256 minValue = bridgeCost * MIN_BRIDGE_COST_MULTIPLIER; |
| 56 | + uint256 maxValue = bridgeCost * MAX_BRIDGE_COST_MULTIPLIER; |
| 57 | + |
| 58 | + require( |
| 59 | + actionValue >= minValue, |
| 60 | + string.concat( |
| 61 | + "BridgeValidationHook: bridge value too low. Expected >= ", |
| 62 | + _toString(minValue), |
| 63 | + ", got ", |
| 64 | + _toString(actionValue) |
| 65 | + ) |
| 66 | + ); |
| 67 | + |
| 68 | + require( |
| 69 | + actionValue <= maxValue, |
| 70 | + string.concat( |
| 71 | + "BridgeValidationHook: bridge value too high. Expected <= ", |
| 72 | + _toString(maxValue), |
| 73 | + ", got ", |
| 74 | + _toString(actionValue) |
| 75 | + ) |
| 76 | + ); |
| 77 | + } |
| 78 | + } |
| 79 | + } |
| 80 | + |
| 81 | + /// @notice Validates that the router address is a contract |
| 82 | + /// @param router The router address to validate |
| 83 | + function _validateRouterIsContract(address router) private view { |
| 84 | + require( |
| 85 | + router.code.length > 0, |
| 86 | + "BridgeValidationHook: router must be a contract" |
| 87 | + ); |
| 88 | + } |
| 89 | + |
| 90 | + /// @notice Gets bridge cost from router and validates it's non-zero |
| 91 | + /// @param router The router contract address |
| 92 | + /// @param wormholeChainId The destination chain ID |
| 93 | + /// @return bridgeCost The validated bridge cost |
| 94 | + function _getBridgeCost( |
| 95 | + address router, |
| 96 | + uint16 wormholeChainId |
| 97 | + ) private view returns (uint256 bridgeCost) { |
| 98 | + bridgeCost = xWELLRouter(router).bridgeCost(wormholeChainId); |
| 99 | + |
| 100 | + require( |
| 101 | + bridgeCost > 0, |
| 102 | + "BridgeValidationHook: bridge cost must be greater than zero" |
| 103 | + ); |
| 104 | + } |
| 105 | + |
| 106 | + /// @notice Extract uint16 value from calldata at the third parameter position |
| 107 | + /// @param input The calldata to extract from |
| 108 | + /// @return result The extracted uint16 value |
| 109 | + function extractUint16FromCalldata( |
| 110 | + bytes memory input |
| 111 | + ) public pure returns (uint16 result) { |
| 112 | + require( |
| 113 | + input.length >= 100, |
| 114 | + "BridgeValidationHook: invalid calldata length" |
| 115 | + ); |
| 116 | + |
| 117 | + // The uint16 wormholeChainId is the third parameter, starting at byte 68 |
| 118 | + // It's stored in the last 2 bytes of a 32-byte word |
| 119 | + bytes32 rawBytes; |
| 120 | + assembly { |
| 121 | + // Skip 32 bytes (array length) + 4 bytes (selector) + 64 bytes (first two params) |
| 122 | + // = 100 bytes total, so we load from position 68 after the length prefix |
| 123 | + let dataPointer := add(add(input, 0x20), 0x44) // 0x20 (32) + 0x44 (68) = 100 |
| 124 | + rawBytes := mload(dataPointer) // Load 32 bytes |
| 125 | + } |
| 126 | + |
| 127 | + // Extract the uint16 from the rightmost 2 bytes |
| 128 | + result = uint16(uint256(rawBytes)); |
| 129 | + } |
| 130 | + |
| 131 | + /// @notice Extract the first 4 bytes (function selector) from calldata |
| 132 | + /// @dev This function must be implemented by inheriting contracts |
| 133 | + /// @param toSlice The bytes to extract from |
| 134 | + /// @return functionSignature The extracted function selector |
| 135 | + function bytesToBytes4( |
| 136 | + bytes memory toSlice |
| 137 | + ) public pure virtual returns (bytes4 functionSignature); |
| 138 | + |
| 139 | + /// @notice Convert uint256 to string |
| 140 | + /// @param value The uint256 value to convert |
| 141 | + /// @return str The string representation |
| 142 | + function _toString( |
| 143 | + uint256 value |
| 144 | + ) internal pure returns (string memory str) { |
| 145 | + if (value == 0) { |
| 146 | + return "0"; |
| 147 | + } |
| 148 | + |
| 149 | + uint256 temp = value; |
| 150 | + uint256 digits; |
| 151 | + |
| 152 | + while (temp != 0) { |
| 153 | + digits++; |
| 154 | + temp /= 10; |
| 155 | + } |
| 156 | + |
| 157 | + bytes memory buffer = new bytes(digits); |
| 158 | + |
| 159 | + while (value != 0) { |
| 160 | + digits -= 1; |
| 161 | + buffer[digits] = bytes1(uint8(48 + uint256(value % 10))); |
| 162 | + value /= 10; |
| 163 | + } |
| 164 | + |
| 165 | + return string(buffer); |
| 166 | + } |
| 167 | +} |
0 commit comments