Skip to content

Commit bba1585

Browse files
authored
Merge pull request #284 from valory-xyz/audit_internal15
doc: audit internal15
2 parents 180356f + 19cdb66 commit bba1585

8 files changed

Lines changed: 1789 additions & 43 deletions

File tree

README.md

Lines changed: 42 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -16,74 +16,74 @@ a group of agent instances.
1616

1717
In order to generalize `components` / `agents` / `services`, they are referred sometimes as `units`.
1818

19-
A graphical overview is available [here](https://github.com/valory-xyz/autonolas-registries/blob/main/docs/flowchart.md).
19+
A graphical overview is available [here](./docs/flowchart.md).
2020

21-
For reference purposes only, an older version of the general Autonolas architecture is available [here](https://github.com/valory-xyz/autonolas-registries/blob/main/docs/On-chain_architecture_v6.png).
21+
For reference purposes only, an older version of the general Autonolas architecture is available [here](./docs/On-chain_architecture_v6.png).
2222

2323
An overview of the design, details on how securing services with ETH or a custom ERC20 token, how service owners can opt for a set of authorized operators,
24-
as well as how DAOs can manage their autonomous services are provided [here](https://github.com/valory-xyz/autonolas-registries/blob/main/docs/AgentServicesFunctionality.pdf).
24+
as well as how DAOs can manage their autonomous services are provided [here](./docs/AgentServicesFunctionality.pdf).
2525

2626
We have a core periphery architecture for both the components/agents and services. The core contracts are ERC721s primarily accessed via the peripheral manager contracts.
2727

28-
An overview of the state machine governing service management and usage is provided [here](https://github.com/valory-xyz/autonolas-registries/blob/main/docs/FSM.md).
28+
An overview of the state machine governing service management and usage is provided [here](./docs/FSM.md).
2929

30-
A more detailed set of registries definitions are provided [here](https://github.com/valory-xyz/autonolas-registries/blob/main/docs/definitions.md).
30+
A more detailed set of registries definitions are provided [here](./docs/definitions.md).
3131

32-
An overview of the registries contracts related to staking can be found [here](https://github.com/valory-xyz/autonolas-registries/blob/main/docs/StakingSmartContracts.pdf). Details on Olas staking are provided [here](https://staking.olas.network/poaa-whitepaper.pdf).
32+
An overview of the registries contracts related to staking can be found [here](./docs/StakingSmartContracts.pdf). Details on Olas staking are provided [here](https://staking.olas.network/poaa-whitepaper.pdf).
3333

3434
Note that by default the contracts do not work with:
3535
- Fee on transfer tokens;
3636
- Balance changes outside token transfers.
3737

3838
The following list represents registries contracts:
3939
- Abstract contracts:
40-
- [GenericRegistry](https://github.com/valory-xyz/autonolas-registries/blob/main/contracts/GenericRegistry.sol)
41-
- [UnitRegistry](https://github.com/valory-xyz/autonolas-registries/blob/main/contracts/UnitRegistry.sol)
42-
- [GenericManager](https://github.com/valory-xyz/autonolas-registries/blob/main/contracts/GenericManager.sol)
43-
- [StakingBase.sol](https://github.com/valory-xyz/autonolas-registries/blob/main/contracts/staking/StakingBase.sol)
40+
- [GenericRegistry](./contracts/GenericRegistry.sol)
41+
- [UnitRegistry](./contracts/UnitRegistry.sol)
42+
- [GenericManager](./contracts/GenericManager.sol)
43+
- [StakingBase.sol](./contracts/staking/StakingBase.sol)
4444
- Core contracts:
45-
- [AgentRegistry](https://github.com/valory-xyz/autonolas-registries/blob/main/contracts/AgentRegistry.sol)
46-
- [ComponentRegistry](https://github.com/valory-xyz/autonolas-registries/blob/main/contracts/ComponentRegistry.sol)
47-
- ServiceRegistry [L1](https://github.com/valory-xyz/autonolas-registries/blob/main/contracts/ServiceRegistry.sol)
48-
[L2](https://github.com/valory-xyz/autonolas-registries/blob/main/contracts/ServiceRegistryL2.sol)
49-
- [ServiceRegistryTokenUtility](https://github.com/valory-xyz/autonolas-registries/blob/main/contracts/ServiceRegistryTokenUtility.sol)
45+
- [AgentRegistry](./contracts/AgentRegistry.sol)
46+
- [ComponentRegistry](./contracts/ComponentRegistry.sol)
47+
- ServiceRegistry [L1](./contracts/ServiceRegistry.sol)
48+
[L2](./contracts/ServiceRegistryL2.sol)
49+
- [ServiceRegistryTokenUtility](./contracts/ServiceRegistryTokenUtility.sol)
5050
- Periphery contracts:
51-
- [RegistriesManager](https://github.com/valory-xyz/autonolas-registries/blob/main/contracts/RegistriesManager.sol)
52-
- [ServiceManager](https://github.com/valory-xyz/autonolas-registries/blob/main/contracts/ServiceManager.sol)
51+
- [RegistriesManager](./contracts/RegistriesManager.sol)
52+
- [ServiceManager](./contracts/ServiceManager.sol)
5353
- Utility contracts:
54-
- [OperatorSignedHashes](https://github.com/valory-xyz/autonolas-registries/blob/main/contracts/utils/OperatorSignedHashes.sol)
55-
- [OperatorWhitelist](https://github.com/valory-xyz/autonolas-registries/blob/main/contracts/utils/OperatorWhitelist.sol)
54+
- [OperatorSignedHashes](./contracts/utils/OperatorSignedHashes.sol)
55+
- [OperatorWhitelist](./contracts/utils/OperatorWhitelist.sol)
5656

5757
- Staking related contracts:
58-
- [StakingBase.sol](https://github.com/valory-xyz/autonolas-registries/blob/main/contracts/staking/StakingBase.sol)
59-
- [StakingNativeToken.sol](https://github.com/valory-xyz/autonolas-registries/blob/main/contracts/staking/StakingNativeToken.sol)
60-
- [StakingToken.sol](https://github.com/valory-xyz/autonolas-registries/blob/main/contracts/staking/StakingToken.sol)
61-
- [StakingFactory.sol](https://github.com/valory-xyz/autonolas-registries/blob/main/contracts/staking/StakingFactory.sol)
62-
- [StakingProxy.sol](https://github.com/valory-xyz/autonolas-registries/blob/main/contracts/staking/StakingProxy.sol)
63-
- [StakingVerifier.sol](https://github.com/valory-xyz/autonolas-registries/blob/main/contracts/staking/StakingVerifier.sol)
64-
- [StakingActivityChecker.sol](https://github.com/valory-xyz/autonolas-registries/blob/main/contracts/staking/StakingActivityChecker.sol)
58+
- [StakingBase.sol](./contracts/staking/StakingBase.sol)
59+
- [StakingNativeToken.sol](./contracts/staking/StakingNativeToken.sol)
60+
- [StakingToken.sol](./contracts/staking/StakingToken.sol)
61+
- [StakingFactory.sol](./contracts/staking/StakingFactory.sol)
62+
- [StakingProxy.sol](./contracts/staking/StakingProxy.sol)
63+
- [StakingVerifier.sol](./contracts/staking/StakingVerifier.sol)
64+
- [StakingActivityChecker.sol](./contracts/staking/StakingActivityChecker.sol)
6565

6666

6767
In order to deploy a service, its registered agent instances form a consensus mechanism via the means of multisigs using the generic multisig interface.
6868
One of the most well-known multisigs is [Safe](https://safe.global/). The Safe interface implementation of a generic multisig interface is provided here:
69-
- [GnosisSafeMultisig](https://github.com/valory-xyz/autonolas-registries/blob/main/contracts/multisigs/GnosisSafeMultisig.sol)
69+
- [GnosisSafeMultisig](./contracts/multisigs/GnosisSafeMultisig.sol)
7070

7171
The updated version accounting for the Recovery Module installation is provided here:
72-
- [SafeMultisigWithRecoveryModule](https://github.com/valory-xyz/autonolas-registries/blob/main/contracts/multisigs/SafeMultisigWithRecoveryModule.sol)
72+
- [SafeMultisigWithRecoveryModule](./contracts/multisigs/SafeMultisigWithRecoveryModule.sol)
7373

7474
Another multisig implementation allows to upgrade / downgrade the number of agent instances that govern the same Safe multisig instance between different service re-deployments.
7575
Please note that the initial multisig instance must already exist from a previous service deployment.
7676
In order to use that option, registered agent instances forming a consensus are required to return the multisig instance ownership to the service owner.
7777
Then, the service owner must terminate the service, update the number of desired agent instances and move it into a new `active-registration` state.
7878
Once all agent instances are registered, the service owner re-deploys the service by giving up their ownership of the multisig with registered agent instances and by setting a new multisig instance threshold.
7979
The implementation of such multisig is provided here:
80-
- [GnosisSafeSameAddressMultisig](https://github.com/valory-xyz/autonolas-registries/blob/main/contracts/multisigs/GnosisSafeSameAddressMultisig.sol)
80+
- [GnosisSafeSameAddressMultisig](./contracts/multisigs/GnosisSafeSameAddressMultisig.sol)
8181

8282
The updated version with the access recovery feature is provided in the Recovery Module contract itself here:
83-
- [RecoveryModule](https://github.com/valory-xyz/autonolas-registries/blob/main/contracts/multisigs/RecoveryModule.sol)
83+
- [RecoveryModule](./contracts/multisigs/RecoveryModule.sol)
8484

8585
To verify the multisig data when redeploying the service using the GnosisSafeSameAddressMultisig contract while changing service multisig owners (with updated agent instance addresses),
86-
see the guidelines and corresponding scripts [here](https://github.com/valory-xyz/autonolas-registries/blob/main/scripts/multisig/)
86+
see the guidelines and corresponding scripts [here](./scripts/multisig/)
8787

8888
As more multisigs come into play, their underlying implementation of the generic multisig will be added.
8989

@@ -142,7 +142,7 @@ forge test -f $FORK_NODE_URL --match-contract StakePolySafe -vvv
142142
```
143143

144144
### Test with instrumented code
145-
[Scribble](https://docs.scribble.codes/) annotated contracts are located in https://github.com/valory-xyz/autonolas-registries/blob/main/contracts/scribble.
145+
[Scribble](https://docs.scribble.codes/) annotated contracts are located in ./contracts/scribble.
146146

147147
Install Scribble in order to instrument the code:
148148
```
@@ -183,18 +183,18 @@ several steps in order to be verified. Those include:
183183

184184
## Deployment
185185
The deployment of contracts to the test- and main-net is split into step-by-step series of scripts for more control and checkpoint convenience.
186-
The description of deployment procedure can be found here: [deployment](https://github.com/valory-xyz/autonolas-registries/blob/main/scripts/deployment).
186+
The description of deployment procedure can be found here: [deployment](./scripts/deployment).
187187

188-
The finalized contract ABIs for deployment and their number of optimization passes are located here: [ABIs](https://github.com/valory-xyz/autonolas-registries/blob/main/abis).
188+
The finalized contract ABIs for deployment and their number of optimization passes are located here: [ABIs](./abis).
189189
Each folder there contains contracts compiled with the solidity version before their deployment.
190190

191-
For testing purposes, the hardhat node deployment script is located [here](https://github.com/valory-xyz/autonolas-registries/blob/main/deploy).
191+
For testing purposes, the hardhat node deployment script is located [here](./deploy).
192192

193-
If you want to use custom contracts in the registry image, read [here](https://github.com/valory-xyz/autonolas-registries/blob/main/docs/running_with_custom_contracts.md).
193+
If you want to use custom contracts in the registry image, read [here](./docs/running_with_custom_contracts.md).
194194

195195
### Audits
196-
- The audit is provided as development matures. The latest audit report can be found here: [audits](https://github.com/valory-xyz/autonolas-registries/blob/main/audits).
197-
- A list of known vulnerabilities can be found here: [Vulnerabilities list](https://github.com/valory-xyz/autonolas-registries/blob/main/docs/Vulnerabilities_list_registries.pdf)
196+
- The audit is provided as development matures. The latest audit report can be found here: [audits](./audits).
197+
- A list of known vulnerabilities can be found here: [Vulnerabilities list](./docs/Vulnerabilities_list_registries.md)
198198

199199
#### Static audit
200200
The static audit checks all the deployed contracts on-chain info correctness and can be run using the following script:
@@ -203,7 +203,7 @@ node scripts/audit_chains/audit_contracts_setup.js
203203
```
204204

205205
## Deployed Protocol
206-
The list of contract addresses for different chains and their full contract configuration can be found [here](https://github.com/valory-xyz/autonolas-registries/blob/main/docs/configuration.json).
206+
The list of contract addresses for different chains and their full contract configuration can be found [here](./docs/configuration.json).
207207

208208
In order to test the protocol setup on all the deployed chains, the audit script is implemented. Make sure to export
209209
required API keys for corresponding chains (see the script for more information). The audit script can be run as follows:
@@ -212,7 +212,7 @@ node scripts/audit_chains/audit_contracts_setup.js
212212
```
213213

214214
### Mainnet snapshot of registries
215-
In order to get the current snapshot of all the registries, the following script is provided [here](https://github.com/valory-xyz/autonolas-registries/blob/main/scripts/mainnet_snapshot.js).
215+
In order to get the current snapshot of all the registries, the following script is provided [here](./scripts/mainnet_snapshot.js).
216216
The script can be run with the following command:
217217
```
218218
npx hardhat run scripts/mainnet_snapshot.js --network mainnet
@@ -223,12 +223,12 @@ NOTE: whilst the snapshot does maintain the exact dependency structure between c
223223

224224
## Protocol-owned-services
225225
A specific service can be owned by a DAO-governed protocol. In order to construct a DAO proposal for the service (re-)deployment,
226-
the following step-by-step guide is advised to be observed [here](https://github.com/valory-xyz/autonolas-registries/blob/main/docs/DAO_service_deloyment_FSM.pdf).
226+
the following step-by-step guide is advised to be observed [here](./docs/DAO_service_deloyment_FSM.pdf).
227227

228228
## Integrations on non-EVM blockchains
229229
### Solana
230230
The light protocol with a similar functionality to ServiceRegistryL2 is implemented as part of the Solana integration network.
231-
The ServiceRegistrySolana program is developed [here](https://github.com/valory-xyz/autonolas-registries/blob/main/integrations/solana).
231+
The ServiceRegistrySolana program is developed [here](./integrations/solana).
232232

233233

234234
## Acknowledgements

audits/README.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,8 @@ contracts is located in this folder: [internal audit 13](https://github.com/valo
4343
An internal audit with a focus on next update of ERC-8004 bridge (IdentityRegistryBridger)
4444
contracts is located in this folder: [internal audit 14](https://github.com/valory-xyz/autonolas-registries/blob/main/audits/internal14).
4545

46+
Full internal audit. Verify all C4A findings fixed. Identify new vulnerabilities: [internal audit 15](https://github.com/valory-xyz/autonolas-registries/blob/main/audits/internal15).
47+
4648
### External audit
4749

4850
Following the initial contracts [audit report](https://github.com/valory-xyz/autonolas-registries/blob/main/audits/Valory%20Review%20Final.pdf),

audits/internal14/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ N/A
1313
```
1414
sol2uml storage contracts/ -f png -c ServiceManager -o audits/internal14/ServiceManager.png
1515
```
16-
[ServiceManager](https://github.com/valory-xyz/autonolas-registries/blob/main/audits/internal14/ServiceManager.png)
16+
[ServiceManager](./ServiceManager.png)
1717

1818
### Coverage
1919
```

0 commit comments

Comments
 (0)