569 lines
22 KiB
Solidity
569 lines
22 KiB
Solidity
pragma solidity ^0.4.19;
|
|
|
|
/// general helpers.
|
|
/// `internal` so they get compiled into contracts using them.
|
|
library Helpers {
|
|
/// returns whether `array` contains `value`.
|
|
function addressArrayContains(address[] array, address value) internal pure returns (bool) {
|
|
for (uint256 i = 0; i < array.length; i++) {
|
|
if (array[i] == value) {
|
|
return true;
|
|
}
|
|
}
|
|
return false;
|
|
}
|
|
|
|
// returns the digits of `inputValue` as a string.
|
|
// example: `uintToString(12345678)` returns `"12345678"`
|
|
function uintToString(uint256 inputValue) internal pure returns (string) {
|
|
// figure out the length of the resulting string
|
|
uint256 length = 0;
|
|
uint256 currentValue = inputValue;
|
|
do {
|
|
length++;
|
|
currentValue /= 10;
|
|
} while (currentValue != 0);
|
|
// allocate enough memory
|
|
bytes memory result = new bytes(length);
|
|
// construct the string backwards
|
|
uint256 i = length - 1;
|
|
currentValue = inputValue;
|
|
do {
|
|
result[i--] = byte(48 + currentValue % 10);
|
|
currentValue /= 10;
|
|
} while (currentValue != 0);
|
|
return string(result);
|
|
}
|
|
|
|
/// returns whether signatures (whose components are in `vs`, `rs`, `ss`)
|
|
/// contain `requiredSignatures` distinct correct signatures
|
|
/// where signer is in `allowed_signers`
|
|
/// that signed `message`
|
|
function hasEnoughValidSignatures(bytes message, uint8[] vs, bytes32[] rs, bytes32[] ss, address[] allowed_signers, uint256 requiredSignatures) internal pure returns (bool) {
|
|
// not enough signatures
|
|
if (vs.length < requiredSignatures) {
|
|
return false;
|
|
}
|
|
|
|
var hash = MessageSigning.hashMessage(message);
|
|
var encountered_addresses = new address[](allowed_signers.length);
|
|
|
|
for (uint256 i = 0; i < requiredSignatures; i++) {
|
|
var recovered_address = ecrecover(hash, vs[i], rs[i], ss[i]);
|
|
// only signatures by addresses in `addresses` are allowed
|
|
if (!addressArrayContains(allowed_signers, recovered_address)) {
|
|
return false;
|
|
}
|
|
// duplicate signatures are not allowed
|
|
if (addressArrayContains(encountered_addresses, recovered_address)) {
|
|
return false;
|
|
}
|
|
encountered_addresses[i] = recovered_address;
|
|
}
|
|
return true;
|
|
}
|
|
|
|
}
|
|
|
|
|
|
/// Library used only to test Helpers library via rpc calls
|
|
library HelpersTest {
|
|
function addressArrayContains(address[] array, address value) public pure returns (bool) {
|
|
return Helpers.addressArrayContains(array, value);
|
|
}
|
|
|
|
function uintToString(uint256 inputValue) public pure returns (string str) {
|
|
return Helpers.uintToString(inputValue);
|
|
}
|
|
|
|
function hasEnoughValidSignatures(bytes message, uint8[] vs, bytes32[] rs, bytes32[] ss, address[] addresses, uint256 requiredSignatures) public pure returns (bool) {
|
|
return Helpers.hasEnoughValidSignatures(message, vs, rs, ss, addresses, requiredSignatures);
|
|
}
|
|
}
|
|
|
|
|
|
// helpers for message signing.
|
|
// `internal` so they get compiled into contracts using them.
|
|
library MessageSigning {
|
|
function recoverAddressFromSignedMessage(bytes signature, bytes message) internal pure returns (address) {
|
|
require(signature.length == 65);
|
|
bytes32 r;
|
|
bytes32 s;
|
|
bytes1 v;
|
|
// solium-disable-next-line security/no-inline-assembly
|
|
assembly {
|
|
r := mload(add(signature, 0x20))
|
|
s := mload(add(signature, 0x40))
|
|
v := mload(add(signature, 0x60))
|
|
}
|
|
return ecrecover(hashMessage(message), uint8(v), r, s);
|
|
}
|
|
|
|
function hashMessage(bytes message) internal pure returns (bytes32) {
|
|
bytes memory prefix = "\x19Ethereum Signed Message:\n";
|
|
return keccak256(prefix, Helpers.uintToString(message.length), message);
|
|
}
|
|
}
|
|
|
|
|
|
/// Library used only to test MessageSigning library via rpc calls
|
|
library MessageSigningTest {
|
|
function recoverAddressFromSignedMessage(bytes signature, bytes message) public pure returns (address) {
|
|
return MessageSigning.recoverAddressFromSignedMessage(signature, message);
|
|
}
|
|
}
|
|
|
|
|
|
library Message {
|
|
// layout of message :: bytes:
|
|
// offset 0: 32 bytes :: uint256 - message length
|
|
// offset 32: 20 bytes :: address - recipient address
|
|
// offset 52: 32 bytes :: uint256 - value
|
|
// offset 84: 32 bytes :: bytes32 - transaction hash
|
|
// offset 116: 32 bytes :: uint256 - home gas price
|
|
|
|
// bytes 1 to 32 are 0 because message length is stored as little endian.
|
|
// mload always reads 32 bytes.
|
|
// so we can and have to start reading recipient at offset 20 instead of 32.
|
|
// if we were to read at 32 the address would contain part of value and be corrupted.
|
|
// when reading from offset 20 mload will read 12 zero bytes followed
|
|
// by the 20 recipient address bytes and correctly convert it into an address.
|
|
// this saves some storage/gas over the alternative solution
|
|
// which is padding address to 32 bytes and reading recipient at offset 32.
|
|
// for more details see discussion in:
|
|
// https://github.com/paritytech/parity-bridge/issues/61
|
|
|
|
function getRecipient(bytes message) internal pure returns (address) {
|
|
address recipient;
|
|
// solium-disable-next-line security/no-inline-assembly
|
|
assembly {
|
|
recipient := mload(add(message, 20))
|
|
}
|
|
return recipient;
|
|
}
|
|
|
|
function getValue(bytes message) internal pure returns (uint256) {
|
|
uint256 value;
|
|
// solium-disable-next-line security/no-inline-assembly
|
|
assembly {
|
|
value := mload(add(message, 52))
|
|
}
|
|
return value;
|
|
}
|
|
|
|
function getTransactionHash(bytes message) internal pure returns (bytes32) {
|
|
bytes32 hash;
|
|
// solium-disable-next-line security/no-inline-assembly
|
|
assembly {
|
|
hash := mload(add(message, 84))
|
|
}
|
|
return hash;
|
|
}
|
|
|
|
function getHomeGasPrice(bytes message) internal pure returns (uint256) {
|
|
uint256 gasPrice;
|
|
// solium-disable-next-line security/no-inline-assembly
|
|
assembly {
|
|
gasPrice := mload(add(message, 116))
|
|
}
|
|
return gasPrice;
|
|
}
|
|
}
|
|
|
|
|
|
/// Library used only to test Message library via rpc calls
|
|
library MessageTest {
|
|
function getRecipient(bytes message) public pure returns (address) {
|
|
return Message.getRecipient(message);
|
|
}
|
|
|
|
function getValue(bytes message) public pure returns (uint256) {
|
|
return Message.getValue(message);
|
|
}
|
|
|
|
function getTransactionHash(bytes message) public pure returns (bytes32) {
|
|
return Message.getTransactionHash(message);
|
|
}
|
|
|
|
function getHomeGasPrice(bytes message) public pure returns (uint256) {
|
|
return Message.getHomeGasPrice(message);
|
|
}
|
|
}
|
|
|
|
/// This contract introduces a new field which can be used by new bridge
|
|
/// instances to get information when the bridge contract was deployed.
|
|
/// This will avoid necessity to distribute this information as part of the
|
|
/// database file to new validators if they want to join to existing
|
|
/// bridge validators group.
|
|
/// So, now bridge deployment script or webapp could pickup HomeBridge
|
|
/// and ForeignBridge addresses and request block deployed from the contracts
|
|
/// in order to generate correct database file.
|
|
contract BridgeDeploymentAddressStorage {
|
|
uint256 public deployedAtBlock;
|
|
|
|
function BridgeDeploymentAddressStorage() public {
|
|
deployedAtBlock = block.number;
|
|
}
|
|
}
|
|
|
|
/// Due to nature of bridge operations it makes sense to have the same value
|
|
/// of gas consumption limits which will distributed among all validators serving
|
|
/// particular bridge. This approach introduces few advantages:
|
|
/// --- new bridge instances will pickup limits from the contract instead of
|
|
/// looking at the configuration file (this configuration parameters could be
|
|
/// depricated)
|
|
/// --- as soon as upgradable bridge contract is implemented these limits needs
|
|
/// to be updated every time the contract is upgraded. Validators could get
|
|
/// an event that limits updated and use new values to send transactions.
|
|
contract HomeBridgeGasConsumptionLimitsStorage {
|
|
uint256 public gasLimitWithdrawRelay;
|
|
|
|
event GasConsumptionLimitsUpdated(uint256);
|
|
|
|
function setGasLimitWithdrawRelay(uint256 gas) {
|
|
gasLimitWithdrawRelay = gas;
|
|
|
|
GasConsumptionLimitsUpdated(gasLimitWithdrawRelay);
|
|
}
|
|
}
|
|
|
|
contract ForeignBridgeGasConsumptionLimitsStorage {
|
|
uint256 public gasLimitDepositRelay;
|
|
uint256 public gasLimitWithdrawConfirm;
|
|
|
|
event GasConsumptionLimitsUpdated(uint256, uint256);
|
|
|
|
function setGasLimitDepositRelay(uint256 gas) {
|
|
gasLimitDepositRelay = gas;
|
|
|
|
GasConsumptionLimitsUpdated(gasLimitDepositRelay, gasLimitWithdrawConfirm);
|
|
}
|
|
|
|
function setGasLimitWithdrawConfirm(uint256 gas) {
|
|
gasLimitWithdrawConfirm = gas;
|
|
|
|
GasConsumptionLimitsUpdated(gasLimitDepositRelay, gasLimitWithdrawConfirm);
|
|
}
|
|
}
|
|
|
|
contract HomeBridge is BridgeDeploymentAddressStorage,
|
|
HomeBridgeGasConsumptionLimitsStorage {
|
|
/// Number of authorities signatures required to withdraw the money.
|
|
///
|
|
/// Must be lesser than number of authorities.
|
|
uint256 public requiredSignatures;
|
|
|
|
/// The gas cost of calling `HomeBridge.withdraw`.
|
|
///
|
|
/// Is subtracted from `value` on withdraw.
|
|
/// recipient pays the relaying authority for withdraw.
|
|
/// this shuts down attacks that exhaust authorities funds on home chain.
|
|
uint256 public estimatedGasCostOfWithdraw;
|
|
|
|
/// Contract authorities.
|
|
address[] public authorities;
|
|
|
|
/// Used foreign transaction hashes.
|
|
mapping (bytes32 => bool) withdraws;
|
|
|
|
/// Event created on money deposit.
|
|
event Deposit (address recipient, uint256 value);
|
|
|
|
/// Event created on money withdraw.
|
|
event Withdraw (address recipient, uint256 value);
|
|
|
|
/// Constructor.
|
|
function HomeBridge(
|
|
uint256 requiredSignaturesParam,
|
|
address[] authoritiesParam,
|
|
uint256 estimatedGasCostOfWithdrawParam
|
|
) public
|
|
{
|
|
require(requiredSignaturesParam != 0);
|
|
require(requiredSignaturesParam <= authoritiesParam.length);
|
|
requiredSignatures = requiredSignaturesParam;
|
|
authorities = authoritiesParam;
|
|
estimatedGasCostOfWithdraw = estimatedGasCostOfWithdrawParam;
|
|
}
|
|
|
|
/// Should be used to deposit money.
|
|
function () public payable {
|
|
Deposit(msg.sender, msg.value);
|
|
}
|
|
|
|
/// final step of a withdraw.
|
|
/// checks that `requiredSignatures` `authorities` have signed of on the `message`.
|
|
/// then transfers `value` to `recipient` (both extracted from `message`).
|
|
/// see message library above for a breakdown of the `message` contents.
|
|
/// `vs`, `rs`, `ss` are the components of the signatures.
|
|
|
|
/// anyone can call this, provided they have the message and required signatures!
|
|
/// only the `authorities` can create these signatures.
|
|
/// `requiredSignatures` authorities can sign arbitrary `message`s
|
|
/// transfering any ether `value` out of this contract to `recipient`.
|
|
/// bridge users must trust a majority of `requiredSignatures` of the `authorities`.
|
|
function withdraw(uint8[] vs, bytes32[] rs, bytes32[] ss, bytes message) public {
|
|
require(message.length == 116);
|
|
|
|
// check that at least `requiredSignatures` `authorities` have signed `message`
|
|
require(Helpers.hasEnoughValidSignatures(message, vs, rs, ss, authorities, requiredSignatures));
|
|
|
|
address recipient = Message.getRecipient(message);
|
|
uint256 value = Message.getValue(message);
|
|
bytes32 hash = Message.getTransactionHash(message);
|
|
uint256 homeGasPrice = Message.getHomeGasPrice(message);
|
|
|
|
// if the recipient calls `withdraw` they can choose the gas price freely.
|
|
// if anyone else calls `withdraw` they have to use the gas price
|
|
// `homeGasPrice` specified by the user initiating the withdraw.
|
|
// this is a security mechanism designed to shut down
|
|
// malicious senders setting extremely high gas prices
|
|
// and effectively burning recipients withdrawn value.
|
|
// see https://github.com/paritytech/parity-bridge/issues/112
|
|
// for further explanation.
|
|
require((recipient == msg.sender) || (tx.gasprice == homeGasPrice));
|
|
|
|
// The following two statements guard against reentry into this function.
|
|
// Duplicated withdraw or reentry.
|
|
require(!withdraws[hash]);
|
|
// Order of operations below is critical to avoid TheDAO-like re-entry bug
|
|
withdraws[hash] = true;
|
|
|
|
uint256 estimatedWeiCostOfWithdraw = estimatedGasCostOfWithdraw * homeGasPrice;
|
|
|
|
// charge recipient for relay cost
|
|
uint256 valueRemainingAfterSubtractingCost = value - estimatedWeiCostOfWithdraw;
|
|
|
|
// pay out recipient
|
|
recipient.transfer(valueRemainingAfterSubtractingCost);
|
|
|
|
// refund relay cost to relaying authority
|
|
msg.sender.transfer(estimatedWeiCostOfWithdraw);
|
|
|
|
Withdraw(recipient, valueRemainingAfterSubtractingCost);
|
|
}
|
|
}
|
|
|
|
contract ERC20 {
|
|
function transfer(address to, uint256 value) public returns (bool);
|
|
function transferFrom(address from, address to, uint256 value) public returns (bool);
|
|
function allowance(address owner, address spender) public constant returns (uint256);
|
|
function balanceOf(address tokenOwner) public constant returns (uint balance);
|
|
}
|
|
|
|
contract ForeignBridge is BridgeDeploymentAddressStorage,
|
|
ForeignBridgeGasConsumptionLimitsStorage {
|
|
/// Number of authorities signatures required to withdraw the money.
|
|
///
|
|
/// Must be less than number of authorities.
|
|
uint256 public requiredSignatures;
|
|
|
|
uint256 public estimatedGasCostOfWithdraw;
|
|
|
|
// Original parity-bridge assumes that anyone could forward final
|
|
// withdraw confirmation to the HomeBridge contract. That's why
|
|
// they need to make sure that no one is trying to steal funds by
|
|
// setting a big gas price of withdraw transaction. So,
|
|
// funds sender is responsible to limit this by setting gasprice
|
|
// as part of withdraw request.
|
|
// Since it is not the case for POA CCT bridge, gasprice is set
|
|
// to 1 Gwei which is minimal gasprice for POA network.
|
|
uint256 homeGasPrice = 1000000000 wei;
|
|
|
|
/// Contract authorities.
|
|
mapping (address => bool) authorities;
|
|
|
|
/// Pending mesages
|
|
mapping (bytes32 => bytes) messages;
|
|
/// ???
|
|
mapping (bytes32 => bytes) signatures;
|
|
|
|
/// Pending deposits and authorities who confirmed them
|
|
mapping (bytes32 => bool) messages_signed;
|
|
mapping (bytes32 => uint) num_messages_signed;
|
|
|
|
/// Pending deposits and authorities who confirmed them
|
|
mapping (bytes32 => bool) deposits_signed;
|
|
mapping (bytes32 => uint) num_deposits_signed;
|
|
|
|
/// Token to work with
|
|
ERC20 public erc20token;
|
|
|
|
/// List of authorities confirmed to set up ERC-20 token address
|
|
mapping (bytes32 => bool) tokenAddressAprroval_signs;
|
|
mapping (address => uint256) num_tokenAddressAprroval_signs;
|
|
|
|
/// triggered when relay of deposit from HomeBridge is complete
|
|
event Deposit(address recipient, uint256 value);
|
|
|
|
/// Event created on money withdraw.
|
|
event Withdraw(address recipient, uint256 value, uint256 homeGasPrice);
|
|
|
|
/// Collected signatures which should be relayed to home chain.
|
|
event CollectedSignatures(address authorityResponsibleForRelay, bytes32 messageHash, uint256 NumberOfCollectedSignatures);
|
|
|
|
/// Event created when new token address is set up.
|
|
event TokenAddress(address token);
|
|
|
|
/// Constructor.
|
|
function ForeignBridge(
|
|
uint256 _requiredSignatures,
|
|
address[] _authorities,
|
|
uint256 _estimatedGasCostOfWithdraw
|
|
) public
|
|
{
|
|
require(_requiredSignatures != 0);
|
|
require(_requiredSignatures <= _authorities.length);
|
|
requiredSignatures = _requiredSignatures;
|
|
|
|
for (uint i = 0; i < _authorities.length; i++) {
|
|
authorities[_authorities[i]] = true;
|
|
}
|
|
|
|
estimatedGasCostOfWithdraw = _estimatedGasCostOfWithdraw;
|
|
}
|
|
|
|
/// require that sender is an authority
|
|
modifier onlyAuthority() {
|
|
require(authorities[msg.sender]);
|
|
_;
|
|
}
|
|
|
|
/// Set up the token address. It allows to set up or change
|
|
/// the ERC20 token address only if authorities confirmed this.
|
|
///
|
|
/// Usage maps instead of arrey allows to reduce gas consumption
|
|
///
|
|
/// token address (address)
|
|
function setTokenAddress (ERC20 token) public onlyAuthority() {
|
|
// Duplicated deposits
|
|
bytes32 token_sender = keccak256(msg.sender, token);
|
|
require(!tokenAddressAprroval_signs[token_sender]);
|
|
tokenAddressAprroval_signs[token_sender]= true;
|
|
|
|
uint signed = num_tokenAddressAprroval_signs[address(token)] + 1;
|
|
num_tokenAddressAprroval_signs[address(token)] = signed;
|
|
|
|
// TODO: this may cause troubles if requriedSignatures len is changed
|
|
if (signed == requiredSignatures) {
|
|
erc20token = ERC20(token);
|
|
TokenAddress(token);
|
|
}
|
|
}
|
|
|
|
/// Used to transfer tokens to the `recipient`.
|
|
/// The bridge contract must own enough tokens to release them for
|
|
/// recipients. Tokens must be transfered to the bridge contract BEFORE
|
|
/// the first deposit will be performed.
|
|
///
|
|
/// Usage maps instead of array allows to reduce gas consumption
|
|
/// from 91169 to 89348 (solc 0.4.19).
|
|
///
|
|
/// deposit recipient (bytes20)
|
|
/// deposit value (uint256)
|
|
/// mainnet transaction hash (bytes32) // to avoid transaction duplication
|
|
function deposit(address recipient, uint value, bytes32 transactionHash) public onlyAuthority() {
|
|
require(erc20token != address(0x0));
|
|
|
|
// Protection from misbehaing authority
|
|
bytes32 hash_msg = keccak256(recipient, value, transactionHash);
|
|
bytes32 hash_sender = keccak256(msg.sender, hash_msg);
|
|
|
|
// Duplicated deposits
|
|
require(!deposits_signed[hash_sender]);
|
|
deposits_signed[hash_sender]= true;
|
|
|
|
uint signed = num_deposits_signed[hash_msg] + 1;
|
|
num_deposits_signed[hash_msg] = signed;
|
|
|
|
// TODO: this may cause troubles if requriedSignatures len is changed
|
|
if (signed == requiredSignatures) {
|
|
// If the bridge contract does not own enough tokens to transfer
|
|
// it will couse funds lock on the home side of the bridge
|
|
erc20token.transfer(recipient, value);
|
|
Deposit(recipient, value);
|
|
}
|
|
}
|
|
|
|
/// Used to transfer `value` of tokens from `_from`s balance on local
|
|
/// (`foreign`) chain to the same address (`_from`) on `home` chain.
|
|
/// Transfer of tokens within local (`foreign`) chain performed by usual
|
|
/// way through transfer method of the token contract.
|
|
/// In order to swap tokens to coins the owner (`_from`) must allow this
|
|
/// explicitly in the token contract by calling approveAndCall with address
|
|
/// of the bridge account.
|
|
/// The method locks tokens and emits a `Withdraw` event which will be
|
|
/// picked up by the bridge authorities.
|
|
/// Bridge authorities will then sign off (by calling `submitSignature`) on
|
|
/// a message containing `value`, the recipient (`_from`) and the `hash` of
|
|
/// the transaction on `foreign` containing the `Withdraw` event.
|
|
/// Once `requiredSignatures` are collected a `CollectedSignatures` event
|
|
/// will be emitted.
|
|
/// An authority will pick up `CollectedSignatures` an call
|
|
/// `HomeBridge.withdraw` which transfers `value - relayCost` to the
|
|
/// recipient completing the transfer.
|
|
function receiveApproval(address _from, uint256 _value, ERC20 _tokenContract, bytes _msg) external returns(bool) {
|
|
require(erc20token != address(0x0));
|
|
require(msg.sender == address(erc20token));
|
|
require(erc20token.allowance(_from, this) >= _value);
|
|
erc20token.transferFrom(_from, this, _value);
|
|
Withdraw(_from, _value, homeGasPrice);
|
|
|
|
return true;
|
|
}
|
|
|
|
/// Should be used as sync tool
|
|
///
|
|
/// Message is a message that should be relayed to main chain once authorities sign it.
|
|
///
|
|
/// Usage several maps instead of structure allows to reduce gas consumption
|
|
/// from 265102 to 242334 (solc 0.4.19).
|
|
///
|
|
/// for withdraw message contains:
|
|
/// withdrawal recipient (bytes20)
|
|
/// withdrawal value (uint256)
|
|
/// foreign transaction hash (bytes32) // to avoid transaction duplication
|
|
function submitSignature(bytes signature, bytes message) public onlyAuthority() {
|
|
// ensure that `signature` is really `message` signed by `msg.sender`
|
|
require(msg.sender == MessageSigning.recoverAddressFromSignedMessage(signature, message));
|
|
|
|
require(message.length == 116);
|
|
bytes32 hash = keccak256(message);
|
|
bytes32 hash_sender = keccak256(msg.sender, hash);
|
|
|
|
uint signed = num_messages_signed[hash_sender] + 1;
|
|
|
|
if (signed > 1) {
|
|
// Duplicated signatures
|
|
require(!messages_signed[hash_sender]);
|
|
}
|
|
else {
|
|
// check if it will really reduce gas usage in case of the second transaction
|
|
// with the same hash
|
|
messages[hash] = message;
|
|
}
|
|
messages_signed[hash_sender] = true;
|
|
|
|
bytes32 sign_idx = keccak256(hash, (signed-1));
|
|
signatures[sign_idx]= signature;
|
|
|
|
num_messages_signed[hash_sender] = signed;
|
|
|
|
// TODO: this may cause troubles if requiredSignatures len is changed
|
|
if (signed == requiredSignatures) {
|
|
CollectedSignatures(msg.sender, hash, signed);
|
|
}
|
|
}
|
|
|
|
/// Get signature
|
|
function signature(bytes32 hash, uint index) public view returns (bytes) {
|
|
bytes32 sign_idx = keccak256(hash, index);
|
|
return signatures[sign_idx];
|
|
}
|
|
|
|
/// Get message
|
|
function message(bytes32 hash) public view returns (bytes) {
|
|
return messages[hash];
|
|
}
|
|
}
|