Medusa swap tests

.gitignore

@@ -50,3 +50,7 @@ slither/
 # Misc
 .vscode/
 .idea/
+
+# Fuzz tests
+crytic-export/
+medusa-corpus/

README.md

@@ -98,6 +98,21 @@ $ yarn test:hardhat
 
 Hardhat tests will also update snapshots for bytecode size and gas usage if applicable for a given package.
 
+### Medusa tests
+
+Medusa is a tool, developed by Trail of Bits, that allow us to execute stateful fuzz tests in contracts, in a way
+smarter than Forge. That's because Medusa has an optimizer to create a path of transactions which is not completely
+random.
+
+To run Medusa tests, we first need to install Echidna. To do so, install `echidna` using the 
+[release page](https://github.com/crytic/echidna/releases) or `brew install echidna` in Mac. Notice that the Mac
+installation will also install Crytic-compiller, so this step can be skipped when installing Medusa.
+
+Then, install Medusa using this [installation guide](https://github.com/crytic/medusa/blob/master/docs/src/getting_started/installation.md#building-from-source).
+
+Finally, run `yarn fuzz:medusa`. This command is available inside the packages `vault`, `pool-weighted` and 
+`pool-stable`.
+
 ## Static analysis
 
 To run [Slither](https://github.com/crytic/slither) static analyzer, Python 3.8+ is a requirement.

pkg/interfaces/contracts/test/IStdMedusaCheats.sol

@@ -0,0 +1,89 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+pragma solidity ^0.8.24;
+
+interface IStdMedusaCheats {
+    // Set block.timestamp
+    function warp(uint256) external;
+
+    // Set block.number
+    function roll(uint256) external;
+
+    // Set block.basefee
+    function fee(uint256) external;
+
+    // Set block.difficulty and block.prevrandao
+    function difficulty(uint256) external;
+
+    // Set block.chainid
+    function chainId(uint256) external;
+
+    // Sets the block.coinbase
+    function coinbase(address) external;
+
+    // Loads a storage slot from an address
+    function load(address account, bytes32 slot) external returns (bytes32);
+
+    // Stores a value to an address' storage slot
+    function store(address account, bytes32 slot, bytes32 value) external;
+
+    // Sets the *next* call's msg.sender to be the input address
+    function prank(address) external;
+
+    // Set msg.sender to the input address until the current call exits
+    function prankHere(address) external;
+
+    // Sets an address' balance
+    function deal(address who, uint256 newBalance) external;
+
+    // Sets an address' code
+    function etch(address who, bytes calldata code) external;
+
+    // Signs data
+    function sign(uint256 privateKey, bytes32 digest) external returns (uint8 v, bytes32 r, bytes32 s);
+
+    // Computes address for a given private key
+    function addr(uint256 privateKey) external returns (address);
+
+    // Gets the nonce of an account
+    function getNonce(address account) external returns (uint64);
+
+    // Sets the nonce of an account
+    // The new nonce must be higher than the current nonce of the account
+    function setNonce(address account, uint64 nonce) external;
+
+    // Performs a foreign function call via terminal
+    function ffi(string[] calldata) external returns (bytes memory);
+
+    // Take a snapshot of the current state of the EVM
+    function snapshot() external returns (uint256);
+
+    // Revert state back to a snapshot
+    function revertTo(uint256) external returns (bool);
+
+    // Convert Solidity types to strings
+    function toString(address) external returns (string memory);
+
+    function toString(bytes calldata) external returns (string memory);
+
+    function toString(bytes32) external returns (string memory);
+
+    function toString(bool) external returns (string memory);
+
+    function toString(uint256) external returns (string memory);
+
+    function toString(int256) external returns (string memory);
+
+    // Convert strings into Solidity types
+    function parseBytes(string memory) external returns (bytes memory);
+
+    function parseBytes32(string memory) external returns (bytes32);
+
+    function parseAddress(string memory) external returns (address);
+
+    function parseUint(string memory) external returns (uint256);
+
+    function parseInt(string memory) external returns (int256);
+
+    function parseBool(string memory) external returns (bool);
+}

pkg/pool-stable/medusa.json

@@ -0,0 +1,84 @@
+{
+  "fuzzing": {
+    "workers": 10,
+    "workerResetLimit": 50,
+    "timeout": 0,
+    "testLimit": 100000,
+    "shrinkLimit": 5000,
+    "callSequenceLength": 10,
+    "corpusDirectory": "medusa-corpus",
+    "coverageEnabled": true,
+    "targetContracts": ["AddAndRemoveLiquidityStableMedusaTest", "SwapMedusaTest"],
+    "predeployedContracts": {},
+    "targetContractsBalances": [],
+    "constructorArgs": {},
+    "deployerAddress": "0x30000",
+    "senderAddresses": [
+      "0x10000",
+      "0x20000",
+      "0x30000"
+    ],
+    "blockNumberDelayMax": 60480,
+    "blockTimestampDelayMax": 604800,
+    "blockGasLimit": 1250000000,
+    "transactionGasLimit": 125000000,
+    "testing": {
+      "stopOnFailedTest": false,
+      "stopOnFailedContractMatching": false,
+      "stopOnNoTests": true,
+      "testAllContracts": false,
+      "traceAll": false,
+      "assertionTesting": {
+        "enabled": true,
+        "testViewMethods": false,
+        "panicCodeConfig": {
+          "failOnCompilerInsertedPanic": false,
+          "failOnAssertion": true,
+          "failOnArithmeticUnderflow": false,
+          "failOnDivideByZero": false,
+          "failOnEnumTypeConversionOutOfBounds": false,
+          "failOnIncorrectStorageAccess": false,
+          "failOnPopEmptyArray": false,
+          "failOnOutOfBoundsArrayAccess": false,
+          "failOnAllocateTooMuchMemory": false,
+          "failOnCallUninitializedVariable": false
+        }
+      },
+      "propertyTesting": {
+        "enabled": true,
+        "testPrefixes": [
+          "property_"
+        ]
+      },
+      "optimizationTesting": {
+        "enabled": true,
+        "testPrefixes": [
+          "optimize_"
+        ]
+      },
+      "targetFunctionSignatures": [],
+      "excludeFunctionSignatures": []
+    },
+    "chainConfig": {
+      "codeSizeCheckDisabled": true,
+      "cheatCodes": {
+        "cheatCodesEnabled": true,
+        "enableFFI": true
+      }
+    }
+  },
+  "compilation": {
+    "platform": "crytic-compile",
+    "platformConfig": {
+      "target": ".",
+      "solcVersion": "",
+      "exportDirectory": "",
+      "args": ["--foundry-out-directory=forge-artifacts", "--foundry-compile-all"]
+    }
+  },
+  "logging": {
+    "level": "info",
+    "logDirectory": "",
+    "noColor": false
+  }
+}

pkg/pool-stable/package.json

@@ -28,6 +28,7 @@
     "test:hardhat": "hardhat test",
     "test:forge": "yarn build && REUSING_HARDHAT_ARTIFACTS=true forge test --ffi -vvv",
     "test:stress": "FOUNDRY_PROFILE=intense forge test --ffi -vvv",
+    "fuzz:medusa": "medusa fuzz --config medusa.json",
     "coverage": "./coverage.sh forge",
     "coverage:hardhat": "./coverage.sh hardhat",
     "coverage:all": "./coverage.sh all",

pkg/pool-stable/test/foundry/fuzz/AddAndRemoveLiquidityStable.medusa.sol

@@ -0,0 +1,58 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+pragma solidity ^0.8.24;
+
+import "forge-std/Test.sol";
+
+import { IERC20 } from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
+
+import { IVault } from "@balancer-labs/v3-interfaces/contracts/vault/IVault.sol";
+import "@balancer-labs/v3-interfaces/contracts/vault/VaultTypes.sol";
+
+import { InputHelpers } from "@balancer-labs/v3-solidity-utils/contracts/helpers/InputHelpers.sol";
+
+import {
+    AddAndRemoveLiquidityMedusaTest
+} from "@balancer-labs/v3-vault/test/foundry/fuzz/AddAndRemoveLiquidity.medusa.sol";
+
+import { StablePoolFactory } from "../../../contracts/StablePoolFactory.sol";
+import { StablePool } from "../../../contracts/StablePool.sol";
+
+contract AddAndRemoveLiquidityStableMedusaTest is AddAndRemoveLiquidityMedusaTest {
+    uint256 private constant DEFAULT_SWAP_FEE = 1e16;
+    uint256 internal constant _AMPLIFICATION_PARAMETER = 1000;
+
+    constructor() AddAndRemoveLiquidityMedusaTest() {
+        maxRateTolerance = 0;
+    }
+
+    function createPool(
+        IERC20[] memory tokens,
+        uint256[] memory initialBalances
+    ) internal override returns (address newPool) {
+        StablePoolFactory factory = new StablePoolFactory(IVault(address(vault)), 365 days, "Factory v1", "Pool v1");
+        PoolRoleAccounts memory roleAccounts;
+
+        StablePool newPool = StablePool(
+            factory.create(
+                "Stable Pool",
+                "STABLE",
+                vault.buildTokenConfig(tokens),
+                _AMPLIFICATION_PARAMETER,
+                roleAccounts,
+                DEFAULT_SWAP_FEE, // Swap fee is set to 0 in the test constructor
+                address(0), // No hooks
+                false, // Do not enable donations
+                false, // Do not disable unbalanced add/remove liquidity
+                // NOTE: sends a unique salt.
+                bytes32(poolCreationNonce++)
+            )
+        );
+
+        // Initialize liquidity of stable pool.
+        medusa.prank(lp);
+        router.initialize(address(newPool), tokens, initialBalances, 0, false, bytes(""));
+
+        return address(newPool);
+    }
+}

pkg/pool-stable/test/foundry/fuzz/SwapStable.medusa.sol

@@ -0,0 +1,50 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+pragma solidity ^0.8.24;
+
+import { IERC20 } from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
+
+import { IVault } from "@balancer-labs/v3-interfaces/contracts/vault/IVault.sol";
+import "@balancer-labs/v3-interfaces/contracts/vault/VaultTypes.sol";
+
+import { SwapMedusaTest } from "@balancer-labs/v3-vault/test/foundry/fuzz/Swap.medusa.sol";
+
+import { StablePoolFactory } from "../../../contracts/StablePoolFactory.sol";
+import { StablePool } from "../../../contracts/StablePool.sol";
+
+contract SwapStableMedusaTest is SwapMedusaTest {
+    uint256 private constant DEFAULT_SWAP_FEE = 1e16;
+    uint256 internal constant _AMPLIFICATION_PARAMETER = 1000;
+
+    constructor() SwapMedusaTest() {}
+
+    function createPool(
+        IERC20[] memory tokens,
+        uint256[] memory initialBalances
+    ) internal override returns (address newPool) {
+        StablePoolFactory factory = new StablePoolFactory(IVault(address(vault)), 365 days, "Factory v1", "Pool v1");
+        PoolRoleAccounts memory roleAccounts;
+
+        StablePool newPool = StablePool(
+            factory.create(
+                "Stable Pool",
+                "STABLE",
+                vault.buildTokenConfig(tokens),
+                _AMPLIFICATION_PARAMETER,
+                roleAccounts,
+                DEFAULT_SWAP_FEE, // Swap fee is set to 0 in the test constructor
+                address(0), // No hooks
+                false, // Do not enable donations
+                false, // Do not disable unbalanced add/remove liquidity
+                // NOTE: sends a unique salt.
+                bytes32(poolCreationNonce++)
+            )
+        );
+
+        // Initialize liquidity of stable pool.
+        medusa.prank(lp);
+        router.initialize(address(newPool), tokens, initialBalances, 0, false, bytes(""));
+
+        return address(newPool);
+    }
+}

pkg/pool-weighted/medusa.json

@@ -0,0 +1,76 @@
+{
+  "fuzzing": {
+    "workers": 10,
+    "workerResetLimit": 50,
+    "timeout": 0,
+    "testLimit": 100000,
+    "shrinkLimit": 5000,
+    "callSequenceLength": 10,
+    "corpusDirectory": "medusa-corpus",
+    "coverageEnabled": true,
+    "targetContracts": ["AddAndRemoveLiquidityWeightedMedusaTest", "SwapMedusaTest"],
+    "predeployedContracts": {},
+    "targetContractsBalances": [],
+    "constructorArgs": {},
+    "deployerAddress": "0x30000",
+    "senderAddresses": ["0x10000", "0x20000", "0x30000"],
+    "blockNumberDelayMax": 60480,
+    "blockTimestampDelayMax": 604800,
+    "blockGasLimit": 1250000000,
+    "transactionGasLimit": 125000000,
+    "testing": {
+      "stopOnFailedTest": false,
+      "stopOnFailedContractMatching": false,
+      "stopOnNoTests": true,
+      "testAllContracts": false,
+      "traceAll": false,
+      "assertionTesting": {
+        "enabled": true,
+        "testViewMethods": false,
+        "panicCodeConfig": {
+          "failOnCompilerInsertedPanic": false,
+          "failOnAssertion": true,
+          "failOnArithmeticUnderflow": false,
+          "failOnDivideByZero": false,
+          "failOnEnumTypeConversionOutOfBounds": false,
+          "failOnIncorrectStorageAccess": false,
+          "failOnPopEmptyArray": false,
+          "failOnOutOfBoundsArrayAccess": false,
+          "failOnAllocateTooMuchMemory": false,
+          "failOnCallUninitializedVariable": false
+        }
+      },
+      "propertyTesting": {
+        "enabled": true,
+        "testPrefixes": ["property_"]
+      },
+      "optimizationTesting": {
+        "enabled": true,
+        "testPrefixes": ["optimize_"]
+      },
+      "targetFunctionSignatures": [],
+      "excludeFunctionSignatures": []
+    },
+    "chainConfig": {
+      "codeSizeCheckDisabled": true,
+      "cheatCodes": {
+        "cheatCodesEnabled": true,
+        "enableFFI": true
+      }
+    }
+  },
+  "compilation": {
+    "platform": "crytic-compile",
+    "platformConfig": {
+      "target": ".",
+      "solcVersion": "",
+      "exportDirectory": "",
+      "args": ["--foundry-out-directory=forge-artifacts", "--foundry-compile-all"]
+    }
+  },
+  "logging": {
+    "level": "info",
+    "logDirectory": "",
+    "noColor": false
+  }
+}