Release

.github/workflows/indexer.yml

@@ -0,0 +1,39 @@
+name: Bridge Indexer
+
+on:
+  push:
+    paths: "apps/indexer/**"
+  workflow_dispatch:
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+      - uses: actions-rs/toolchain@v1
+        with:
+          toolchain: stable
+      - name: Run test
+        run: cargo test
+        working-directory: apps/indexer
+      - name: Lowercase repository
+        run: |
+          echo "LOWERCASE_REPOSITORY=${GITHUB_REPOSITORY@L}" >> ${GITHUB_ENV}
+
+      - name: Setup docker buildx
+        uses: docker/setup-buildx-action@v2
+      - name: Login to Github Container registry
+        uses: docker/login-action@v2
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v4
+        with:
+          push: true
+          context: apps/indexer
+          tags: ghcr.io/${{ env.LOWERCASE_REPOSITORY }}:latest
+          build-args: |
+            "GIT_HASH=$GITHUB_SHA"

apps/blockchain/ethereum/src/Bridge.sol

@@ -58,8 +58,8 @@ contract Starklane is IStarklaneEvent, UUPSOwnableProxied, StarklaneState, Stark
 
         _transferOwnership(owner);
 
-        setStarklaneL2Address(Cairo.snaddressWrap(starklaneL2Address));
-        setStarklaneL2Selector(Cairo.felt252Wrap(starklaneL2Selector));
+        setStarklaneL2Address(starklaneL2Address);
+        setStarklaneL2Selector(starklaneL2Selector);
     }
 
     /**
@@ -82,6 +82,9 @@ contract Starklane is IStarklaneEvent, UUPSOwnableProxied, StarklaneState, Stark
         external
         payable
     {
+        if (!Cairo.isFelt252(snaddress.unwrap(ownerL2))) {
+            revert CairoWrapError();
+        }
         if (!_enabled) {
             revert BridgeNotEnabledError();
         }
@@ -159,7 +162,9 @@ contract Starklane is IStarklaneEvent, UUPSOwnableProxied, StarklaneState, Stark
         // Any error or permission fail in the message consumption will cause a revert.
         // After message being consumed, it is considered legit and tokens can be withdrawn.
         if (Protocol.canUseWithdrawAuto(header)) {
-            _consumeMessageAutoWithdraw(_starklaneL2Address, request);
+            // 2024-03-19: disabled autoWithdraw after audit report
+            // _consumeMessageAutoWithdraw(_starklaneL2Address, request);
+            revert NotSupportedYetError();
         } else {
             _consumeMessageStarknet(_starknetCoreAddress, _starklaneL2Address, request);
         }
@@ -179,7 +184,7 @@ contract Starklane is IStarklaneEvent, UUPSOwnableProxied, StarklaneState, Stark
                     req.hash
                 );
             } else {
-                // TODO ERC1155.
+                revert NotSupportedYetError();
             }
         }
 
@@ -348,4 +353,14 @@ contract Starklane is IStarklaneEvent, UUPSOwnableProxied, StarklaneState, Stark
     function isEnabled() external view returns(bool) {
         return _enabled;
     }
+
+    function setL1L2CollectionMapping(
+        address collectionL1,
+        snaddress collectionL2,
+        bool force
+    ) external onlyOwner {
+        _setL1L2AddressMapping(collectionL1, collectionL2, force);
+        emit L1L2CollectionMappingUpdated(collectionL1, snaddress.unwrap(collectionL2));
+    }
+
 }

apps/blockchain/ethereum/src/IStarklane.sol

@@ -128,4 +128,17 @@ interface IStarklane {
      * @return true if bridge is enabled
      */
     function isEnabled() external view returns (bool);
+
+    /**
+     * 
+     * @param collectionL1 Collection address on L1
+     * @param collectionL2 Collection address on L2
+     * @param force Force flag
+     */
+    function setL1L2CollectionMapping(
+        address collectionL1,
+        snaddress collectionL2,
+        bool force
+    ) external;
+
 }

apps/blockchain/ethereum/src/IStarklaneEvent.sol

@@ -52,4 +52,12 @@ interface IStarklaneEvent {
         address indexed collection,
         bool enable
     );
+
+    /**
+        @notice L1 L2 collection mapping updated
+     */
+    event L1L2CollectionMappingUpdated(
+        address indexed colllectionL1,
+        uint256 indexed collectionL2
+    );
 }

apps/blockchain/ethereum/src/State.sol

@@ -40,12 +40,12 @@ contract StarklaneState is Ownable {
        @param l2Address Starklane L2 address.
     */
     function setStarklaneL2Address(
-        snaddress l2Address
+        uint256 l2Address
     )
         public
         onlyOwner
     {
-        _starklaneL2Address = l2Address;
+        _starklaneL2Address = Cairo.snaddressWrap(l2Address);
     }
 
     /**
@@ -55,12 +55,12 @@ contract StarklaneState is Ownable {
        @param l2Selector Starklane L2 selector.
     */
     function setStarklaneL2Selector(
-        felt252 l2Selector
+        uint256 l2Selector
     )
         public
         onlyOwner
     {
-        _starklaneL2Selector = l2Selector;
+        _starklaneL2Selector = Cairo.felt252Wrap(l2Selector);
     }
 
 

apps/blockchain/ethereum/src/token/CollectionManager.sol

@@ -10,6 +10,7 @@ import "../sn/Cairo.sol";
 error InvalidCollectionL1Address();
 error InvalidCollectionL2Address();
 error ErrorVerifyingAddressMapping();
+error CollectionMappingAlreadySet();
 
 /**
    @title Collection manager to verify collection address matching and deploy them.
@@ -56,6 +57,7 @@ contract CollectionManager {
     {
         address proxy = Deployer.deployERC721Bridgeable(name, symbol);
         _l1ToL2Addresses[proxy] = collectionL2;
+        _l2ToL1Addresses[collectionL2] = proxy;
 
         emit CollectionDeployedFromL2(
             reqHash,
@@ -86,6 +88,7 @@ contract CollectionManager {
     {
         address proxy = Deployer.deployERC1155Bridgeable(uri);
         _l1ToL2Addresses[proxy] = collectionL2;
+        _l2ToL1Addresses[collectionL2] = proxy;
 
         emit CollectionDeployedFromL2(
             reqHash,
@@ -145,5 +148,21 @@ contract CollectionManager {
         revert ErrorVerifyingAddressMapping();
     }
 
+    function _setL1L2AddressMapping(
+        address collectionL1,
+        snaddress collectionL2,
+        bool force
+    )
+        internal
+    {
+        if (((snaddress.unwrap(_l1ToL2Addresses[collectionL1]) == 0) && (_l2ToL1Addresses[collectionL2] == address(0)))
+            || (force == true)) {
+            _l1ToL2Addresses[collectionL1] = collectionL2;
+            _l2ToL1Addresses[collectionL2] = collectionL1;
+        } else {
+            revert CollectionMappingAlreadySet();
+        }
+    }
+
 }
 

apps/blockchain/ethereum/test/Bridge.t.sol

@@ -110,6 +110,22 @@ contract BridgeTest is Test, IStarklaneEvent {
         );
     }
 
+    function test_L2OwnerOverflow() public {
+        uint256[] memory ids = new uint256[](0);
+
+        uint256 salt = 0x0;
+        snaddress to = snaddress.wrap(SN_MODULUS);
+
+        vm.expectRevert(CairoWrapError.selector);
+        IStarklane(bridge).depositTokens{value: 30000}(
+            salt,
+            address(erc721C1),
+            to,
+            ids,
+            false
+        );
+    }
+
     //
     function test_depositTokenERC721() public {
         IERC721MintRangeFree(erc721C1).mintRangeFree(alice, 0, 10);
@@ -261,7 +277,8 @@ contract BridgeTest is Test, IStarklaneEvent {
         assertEq(whiteListed.length, 1);
     }
 
-    // Test a withdraw auto that will trigger the deploy of a new collection on L1.
+    // Audit:
+    // [C-01] Anyone can withdraw any token held by the L1 bridge
     function test_withdrawTokensERC721AutoWithdrawDeploy() public {
         // Build the request and compute it's "would be" message hash.
         felt252 header = Protocol.requestHeaderV1(CollectionType.ERC721, false, true);
@@ -273,24 +290,112 @@ contract BridgeTest is Test, IStarklaneEvent {
         // as QUICK message.
 
         IStarklane(bridge).addMessageHashForAutoWithdraw(uint256(msgHash));
+        vm.expectRevert(NotSupportedYetError.selector);
+        IStarklane(bridge).withdrawTokens(reqSerialized);
+    }
+
+    // Test a withdraw STARKNET that will trigger the deploy of a new collection on L1.'0x800000000000011000000000000000000000000000000000000000000000001'
+    function test_withdrawTokensERC721StarknetWithdrawDeploy() public {
+        // Build the request and compute it's "would be" message hash.
+        felt252 header = Protocol.requestHeaderV1(CollectionType.ERC721, false, false);
+        Request memory req = buildRequestDeploy(header, 888, bob);
+        uint256[] memory reqSerialized = Protocol.requestSerialize(req);
+        bytes32 msgHash = computeMessageHashFromL2(reqSerialized);
+
+        // The message must be simulated to come from starknet verifier contract
+        // on L1 and pushed to starknet core.
+        uint256[] memory hashes = new uint256[](1);
+        hashes[0] = uint256(msgHash);
+        IStarknetMessagingLocal(snCore).addMessageHashesFromL2(hashes);
         address collection = IStarklane(bridge).withdrawTokens(reqSerialized);
 
         // TODO: add verification of event emission.
 
         assertEq(IERC721(collection).ownerOf(888), bob);
 
-        vm.expectRevert();
+        // Error message from Starknet Core expected.
+        vm.expectRevert(bytes("INVALID_MESSAGE_TO_CONSUME"));
         IStarklane(bridge).withdrawTokens(reqSerialized);
     }
 
-    // Test a withdraw STARKNET that will trigger the deploy of a new collection on L1.
-    function test_withdrawTokensERC721StarknetWithdrawDeploy() public {
+    // Audit:
+    // [C-02] Impossible to withdraw L1 native tokens back on L1 after bridging to L2. Also, a different collection address will be generated for every native l2 token bridged to l1
+    function test_withdrawTokensERC721StarknetWithdrawDeploySameCollection() public {
         // Build the request and compute it's "would be" message hash.
         felt252 header = Protocol.requestHeaderV1(CollectionType.ERC721, false, false);
         Request memory req = buildRequestDeploy(header, 888, bob);
         uint256[] memory reqSerialized = Protocol.requestSerialize(req);
         bytes32 msgHash = computeMessageHashFromL2(reqSerialized);
 
+        // The message must be simulated to come from starknet verifier contract
+        // on L1 and pushed to starknet core.
+        uint256[] memory msgHashes = new uint256[](1);
+        msgHashes[0] = uint256(msgHash);
+        IStarknetMessagingLocal(snCore).addMessageHashesFromL2(msgHashes);
+        address collection1 = IStarklane(bridge).withdrawTokens(reqSerialized);
+
+        assertEq(IERC721(collection1).ownerOf(888), bob);
+        // Error message from Starknet Core expected.
+        vm.expectRevert(bytes("INVALID_MESSAGE_TO_CONSUME"));
+        IStarklane(bridge).withdrawTokens(reqSerialized);
+
+        req.tokenIds[0] = 777;
+        reqSerialized = Protocol.requestSerialize(req);
+        msgHash = computeMessageHashFromL2(reqSerialized);
+
+        msgHashes[0] = uint256(msgHash);
+        IStarknetMessagingLocal(snCore).addMessageHashesFromL2(msgHashes);
+        address collection2 = IStarklane(bridge).withdrawTokens(reqSerialized);
+
+        assertEq(IERC721(collection2).ownerOf(777), bob);
+        assertEq(collection1, collection2);
+    }
+
+    function test_withdrawTokensERC721StarknetWithdrawDeployDifferentCollection() public {
+        felt252 header = Protocol.requestHeaderV1(CollectionType.ERC721, false, false);
+        Request memory req = buildRequestDeploy(header, 888, bob);
+        uint256[] memory reqSerialized = Protocol.requestSerialize(req);
+        bytes32 msgHash = computeMessageHashFromL2(reqSerialized);
+
+        // The message must be simulated to come from starknet verifier contract
+        // on L1 and pushed to starknet core.
+        uint256[] memory msgHashes = new uint256[](1);
+        msgHashes[0] = uint256(msgHash);
+        IStarknetMessagingLocal(snCore).addMessageHashesFromL2(msgHashes);
+        address collection1 = IStarklane(bridge).withdrawTokens(reqSerialized);
+
+        assertEq(IERC721(collection1).ownerOf(888), bob);
+        // Error message from Starknet Core expected.
+        vm.expectRevert(bytes("INVALID_MESSAGE_TO_CONSUME"));
+        IStarklane(bridge).withdrawTokens(reqSerialized);
+
+        req.tokenIds[0] = 777;
+        req.collectionL2 = Cairo.snaddressWrap(0x456);
+        reqSerialized = Protocol.requestSerialize(req);
+        msgHash = computeMessageHashFromL2(reqSerialized);
+
+        msgHashes[0] = uint256(msgHash);
+        IStarknetMessagingLocal(snCore).addMessageHashesFromL2(msgHashes);
+        address collection2 = IStarklane(bridge).withdrawTokens(reqSerialized);
+
+        assertEq(IERC721(collection2).ownerOf(777), bob);
+        assertFalse(collection1 == collection2);
+    }
+
+    function test_depositWithdrawTokens_withMapping() public {
+        // add mapping L1 <-> L2: erc721C1 <-> 0x123
+        IStarklane(bridge).setL1L2CollectionMapping(address(erc721C1), Cairo.snaddressWrap(0x123), true);
+
+        // alice deposit token 0 and 9 of collection erc721C1 to bridge
+        test_depositTokenERC721();
+
+        // Build the request and compute it's "would be" message hash.
+        felt252 header = Protocol.requestHeaderV1(CollectionType.ERC721, false, false);
+        Request memory req = buildRequestDeploy(header, 9, bob);
+        req.collectionL1 = address(erc721C1);
+        uint256[] memory reqSerialized = Protocol.requestSerialize(req);
+        bytes32 msgHash = computeMessageHashFromL2(reqSerialized);
+
         // The message must be simulated to come from starknet verifier contract
         // on L1 and pushed to starknet core.
         uint256[] memory hashes = new uint256[](1);
@@ -299,8 +404,8 @@ contract BridgeTest is Test, IStarklaneEvent {
         address collection = IStarklane(bridge).withdrawTokens(reqSerialized);
 
         // TODO: add verification of event emission.
-
-        assertEq(IERC721(collection).ownerOf(888), bob);
+        assertEq(collection, erc721C1);
+        assertEq(IERC721(erc721C1).ownerOf(9), bob);
 
         // Error message from Starknet Core expected.
         vm.expectRevert(bytes("INVALID_MESSAGE_TO_CONSUME"));
@@ -387,6 +492,7 @@ contract BridgeTest is Test, IStarklaneEvent {
         assert(IERC721(erc721C1).ownerOf(ids[1]) == alice);
     }
 
+
     // Build a request that should trigger a deploy of a new collection on L1.
     function buildRequestDeploy(
         felt252 header,

apps/blockchain/starknet/.tool-versions

@@ -1,2 +1,2 @@
-scarb 2.4.4
-starknet-foundry 0.15.0
+scarb 2.6.4
+starknet-foundry 0.19.0

apps/blockchain/starknet/Scarb.lock

@@ -0,0 +1,14 @@
+# Code generated by scarb DO NOT EDIT.
+version = 1
+
+[[package]]
+name = "snforge_std"
+version = "0.15.0"
+source = "git+https://github.com/foundry-rs/starknet-foundry.git?tag=v0.15.0#7747a2d27b9ebfccf7de8e757d9c6a3ed31e81fc"
+
+[[package]]
+name = "starklane"
+version = "0.1.0"
+dependencies = [
+ "snforge_std",
+]