Skip to content

Commit

Permalink
address comment
Browse files Browse the repository at this point in the history
  • Loading branch information
aroralanuk committed Dec 3, 2024
1 parent 6016f50 commit 3999b1c
Show file tree
Hide file tree
Showing 5 changed files with 48 additions and 27 deletions.
27 changes: 23 additions & 4 deletions solidity/contracts/libs/FraudMessage.sol
Original file line number Diff line number Diff line change
Expand Up @@ -27,25 +27,44 @@ struct Attribution {
}

library FraudMessage {
uint8 public constant SIGNER_OFFSET = 0;
uint8 public constant MERKLE_TREE_OFFSET = 32;
uint8 public constant DIGEST_OFFSET = 64;
uint8 public constant FRAUD_TYPE_OFFSET = 96;
uint8 public constant TIMESTAMP_OFFSET = 97;
uint8 public constant MESSAGE_LENGTH = 103;

function encode(
bytes32 signer,
bytes32 merkleTree,
bytes32 digest,
Attribution memory attribution
) internal pure returns (bytes memory) {
return
abi.encode(
abi.encodePacked(
signer,
merkleTree,
digest,
attribution.fraudType,
uint8(attribution.fraudType),
attribution.timestamp
);
}

function decode(
bytes memory _message
bytes calldata _message
) internal pure returns (bytes32, bytes32, bytes32, Attribution memory) {
return abi.decode(_message, (bytes32, bytes32, bytes32, Attribution));
require(_message.length == MESSAGE_LENGTH, "Invalid message length");

bytes32 signer = bytes32(_message[SIGNER_OFFSET:MERKLE_TREE_OFFSET]);

Check notice

Code scanning / Olympix Integrated Security

Local variables in test functions are not properly fuzzed, potentially reducing the effectiveness of property-based testing. For more information, visit: http://detectors.olympixdevsectools.com/article/web3-vulnerability/unfuzzed-local-variables Low

Local variables in test functions are not properly fuzzed, potentially reducing the effectiveness of property-based testing. For more information, visit: http://detectors.olympixdevsectools.com/article/web3-vulnerability/unfuzzed-local-variables

Check notice

Code scanning / Olympix Integrated Security

Performing a narrowing downcast may result in silent overflow due to bit truncation. For more information, visit: http://detectors.olympixdevsectools.com/article/web3-vulnerability/unsafe-downcast Low

Performing a narrowing downcast may result in silent overflow due to bit truncation. For more information, visit: http://detectors.olympixdevsectools.com/article/web3-vulnerability/unsafe-downcast
bytes32 merkleTree = bytes32(

Check notice

Code scanning / Olympix Integrated Security

Local variables in test functions are not properly fuzzed, potentially reducing the effectiveness of property-based testing. For more information, visit: http://detectors.olympixdevsectools.com/article/web3-vulnerability/unfuzzed-local-variables Low

Local variables in test functions are not properly fuzzed, potentially reducing the effectiveness of property-based testing. For more information, visit: http://detectors.olympixdevsectools.com/article/web3-vulnerability/unfuzzed-local-variables

Check notice

Code scanning / Olympix Integrated Security

Performing a narrowing downcast may result in silent overflow due to bit truncation. For more information, visit: http://detectors.olympixdevsectools.com/article/web3-vulnerability/unsafe-downcast Low

Performing a narrowing downcast may result in silent overflow due to bit truncation. For more information, visit: http://detectors.olympixdevsectools.com/article/web3-vulnerability/unsafe-downcast
_message[MERKLE_TREE_OFFSET:DIGEST_OFFSET]
);
bytes32 digest = bytes32(_message[DIGEST_OFFSET:FRAUD_TYPE_OFFSET]);

Check notice

Code scanning / Olympix Integrated Security

Local variables in test functions are not properly fuzzed, potentially reducing the effectiveness of property-based testing. For more information, visit: http://detectors.olympixdevsectools.com/article/web3-vulnerability/unfuzzed-local-variables Low

Local variables in test functions are not properly fuzzed, potentially reducing the effectiveness of property-based testing. For more information, visit: http://detectors.olympixdevsectools.com/article/web3-vulnerability/unfuzzed-local-variables

Check notice

Code scanning / Olympix Integrated Security

Performing a narrowing downcast may result in silent overflow due to bit truncation. For more information, visit: http://detectors.olympixdevsectools.com/article/web3-vulnerability/unsafe-downcast Low

Performing a narrowing downcast may result in silent overflow due to bit truncation. For more information, visit: http://detectors.olympixdevsectools.com/article/web3-vulnerability/unsafe-downcast
FraudType fraudType = FraudType(uint8(_message[FRAUD_TYPE_OFFSET]));

Check notice

Code scanning / Olympix Integrated Security

Local variables in test functions are not properly fuzzed, potentially reducing the effectiveness of property-based testing. For more information, visit: http://detectors.olympixdevsectools.com/article/web3-vulnerability/unfuzzed-local-variables Low

Local variables in test functions are not properly fuzzed, potentially reducing the effectiveness of property-based testing. For more information, visit: http://detectors.olympixdevsectools.com/article/web3-vulnerability/unfuzzed-local-variables

Check notice

Code scanning / Olympix Integrated Security

Performing a narrowing downcast may result in silent overflow due to bit truncation. For more information, visit: http://detectors.olympixdevsectools.com/article/web3-vulnerability/unsafe-downcast Low

Performing a narrowing downcast may result in silent overflow due to bit truncation. For more information, visit: http://detectors.olympixdevsectools.com/article/web3-vulnerability/unsafe-downcast
uint48 timestamp = uint48(

Check notice

Code scanning / Olympix Integrated Security

Local variables in test functions are not properly fuzzed, potentially reducing the effectiveness of property-based testing. For more information, visit: http://detectors.olympixdevsectools.com/article/web3-vulnerability/unfuzzed-local-variables Low

Local variables in test functions are not properly fuzzed, potentially reducing the effectiveness of property-based testing. For more information, visit: http://detectors.olympixdevsectools.com/article/web3-vulnerability/unfuzzed-local-variables
bytes6(_message[TIMESTAMP_OFFSET:MESSAGE_LENGTH])

Check notice

Code scanning / Olympix Integrated Security

Performing a narrowing downcast may result in silent overflow due to bit truncation. For more information, visit: http://detectors.olympixdevsectools.com/article/web3-vulnerability/unsafe-downcast Low

Performing a narrowing downcast may result in silent overflow due to bit truncation. For more information, visit: http://detectors.olympixdevsectools.com/article/web3-vulnerability/unsafe-downcast
);

return (signer, merkleTree, digest, Attribution(fraudType, timestamp));
}
}
2 changes: 1 addition & 1 deletion solidity/contracts/middleware/FraudProofRouter.sol
Original file line number Diff line number Diff line change
Expand Up @@ -113,7 +113,7 @@ contract FraudProofRouter is GasRouter {
bytes32,
/*_sender*/
bytes calldata _message
) internal override onlyMailbox {
) internal override {
(
bytes32 signer,

Check notice

Code scanning / Olympix Integrated Security

Local variables in test functions are not properly fuzzed, potentially reducing the effectiveness of property-based testing. For more information, visit: http://detectors.olympixdevsectools.com/article/web3-vulnerability/unfuzzed-local-variables Low

Local variables in test functions are not properly fuzzed, potentially reducing the effectiveness of property-based testing. For more information, visit: http://detectors.olympixdevsectools.com/article/web3-vulnerability/unfuzzed-local-variables
bytes32 merkleTree,

Check notice

Code scanning / Olympix Integrated Security

Local variables in test functions are not properly fuzzed, potentially reducing the effectiveness of property-based testing. For more information, visit: http://detectors.olympixdevsectools.com/article/web3-vulnerability/unfuzzed-local-variables Low

Local variables in test functions are not properly fuzzed, potentially reducing the effectiveness of property-based testing. For more information, visit: http://detectors.olympixdevsectools.com/article/web3-vulnerability/unfuzzed-local-variables
Expand Down
8 changes: 4 additions & 4 deletions solidity/remappings.txt
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
@arbitrum=./node_modules/@arbitrum
@eth-optimism=./node_modules/@eth-optimism
@layerzerolabs=./node_modules/@layerzerolabs
@openzeppelin=./node_modules/@openzeppelin
@arbitrum=../node_modules/@arbitrum
@eth-optimism=../node_modules/@eth-optimism
@layerzerolabs=../node_modules/@layerzerolabs
@openzeppelin=../node_modules/@openzeppelin
ds-test/=lib/forge-std/lib/ds-test/src/
forge-std/=lib/forge-std/src/
fx-portal/=lib/fx-portal/
31 changes: 20 additions & 11 deletions solidity/test/FraudProofRouter.t.sol
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ pragma solidity >=0.8.0;

import {Test} from "forge-std/Test.sol";

import {FraudType, Attribution} from "../contracts/libs/FraudMessage.sol";
import {FraudType} from "../contracts/libs/FraudMessage.sol";
import {TypeCasts} from "../contracts/libs/TypeCasts.sol";
import {TestAttributeCheckpointFraud} from "../contracts/test/TestAttributeCheckpointFraud.sol";
import {FraudProofRouter} from "../contracts/middleware/FraudProofRouter.sol";
Expand Down Expand Up @@ -63,29 +63,38 @@ contract FraudProofRouterTest is Test {
new FraudProofRouter(address(localMailbox), address(0));
}

function test_sendFraudProof() public {
FraudType fraudType = FraudType.Whitelist;
function test_sendFraudProof(
address _signer,
bytes32 _digest,
bytes32 _merkleTree,
uint8 _fraudType,
uint48 _timestamp
) public {
vm.assume(_fraudType <= uint8(FraudType.Root));
vm.assume(_timestamp > 0);
vm.warp(_timestamp);
FraudType fraudTypeEnum = FraudType(_fraudType);

testAcf.mockSetAttribution(SIGNER, DIGEST, fraudType);
testAcf.mockSetAttribution(_signer, _digest, fraudTypeEnum);

originFpr.sendFraudProof(
DESTINATION_DOMAIN,
SIGNER,
TypeCasts.addressToBytes32(address(testMerkleHook)),
DIGEST
_signer,
_merkleTree,
_digest
);

remoteMailbox.processNextInboundMessage();

(FraudType actualFraudType, uint48 actualTimestamp) = remoteFpr
.fraudAttributions(
LOCAL_DOMAIN,
SIGNER.addressToBytes32(),
address(testMerkleHook).addressToBytes32(),
DIGEST
_signer.addressToBytes32(),
_merkleTree,
_digest
);

assert(actualFraudType == fraudType);
assert(actualFraudType == fraudTypeEnum);
assertEq(actualTimestamp, block.timestamp);
}

Expand Down
7 changes: 0 additions & 7 deletions solidity/test/OlyTest.sol

This file was deleted.

0 comments on commit 3999b1c

Please sign in to comment.