handler.fc

;;; ===============================================================
;; The controller is only used for deployment and configuration.
;; Controller handlers are not necessarily gas efficient, as they
;; are expected to be called infrequently.
;; No dictionaries exist in the controller, so there is no risk of
;; gas usage increasing over time and resulting in DoS due to the 1m gas
;; limit.
;;; ===============================================================

#include "../core/abstract/protocolHandler.fc";

#include "../../classes/lz/Path.fc";

#include "../../classes/msgdata/Deploy.fc";
#include "../../classes/msgdata/ExtendedMd.fc";
#include "../../classes/msgdata/CoinsAmount.fc";
#include "../../classes/msgdata/AddMsglib.fc";
#include "../../classes/msgdata/InitEndpoint.fc";
#include "../../classes/msgdata/MdEid.fc";
#include "../../classes/msgdata/MdObj.fc";
#include "../../classes/msgdata/SetAddress.fc";

#include "../core/baseStorage.fc";

#include "../channel/storage.fc";
#include "../endpoint/storage.fc";
#include "../interfaces.fc";

#include "interface.fc";
#include "storage.fc";
#include "../../classes/msgdata/SetEpConfig.fc";

;;; ================INTERFACE FUNCTIONS=====================

(cell, tuple) _initialize(cell $md) impure inline {
    return preamble();
}

;; should be the protocol owner's zro wallet
int _getZroWalletAddress() inline method_id {
    return getContractStorage().cl::get<address>(Controller::zroWallet);
}

() assertTentativeOwner() impure inline {
    throw_unless(
        Controller::ERROR::onlyTentativeOwner,
        getCaller() == getContractStorage().cl::get<address>(Controller::tentativeOwner)
    );
}

int _getEventSink() inline {
    return getContractAddress();
}

;;; ================PERMISSION FUNCTIONS=====================

() _checkPermissions(int op, cell $md) impure inline {
    if (op == Controller::OP::DEPLOY_CHANNEL) {
        ;; Controller::OP::DEPLOY_CHANNEL determines the initial storage of
        ;; the deployed channel by the caller address, making this opcode
        ;; safe for open and public calls
        return ();
    } elseif (op == Controller::OP::SET_EP_CONFIG_OAPP) {
        cell $path = $md.cl::get<objRef>(md::ExtendedMd::obj).lz::Path::sanitize();
        throw_unless(
            Controller::ERROR::onlyOApp,
            getCaller() == $path.cl::get<address>(lz::Path::srcOApp)
        );
    } elseif (
        (op == Controller::OP::DEPLOY_ENDPOINT)
        | (op == Controller::OP::ADD_MSGLIB)
        | (op == Controller::OP::SET_EP_CONFIG_DEFAULTS)
        | (op == Controller::OP::SET_ZRO_WALLET)
        | (op == Controller::OP::TRANSFER_OWNERSHIP)
    ) {
        return assertOwner();
    } elseif (op == Controller::OP::CLAIM_OWNERSHIP) {
        return assertTentativeOwner();
    } elseif (op == Controller::OP::EXCESSES) {
        throw_unless(Controller::ERROR::onlyZroWallet, getCaller() == _getZroWalletAddress());
    } else {
        ;; Any other opcodes will throw, to limit possibility of unexpected behaviors
        throw(BaseInterface::ERROR::invalidOpcode);
    }
}

;;; ==========================HELPER FUNCTIONS=====================================

int _calculateEndpointAddress(int dstEid) impure inline method_id {
    throw_if(Controller::ERROR::invalidEid, dstEid == 0);

    return computeContractAddress(
        Endpoint::New(
            getContractStorage().cl::get<uint32>(Controller::eid),
            dstEid,
            getContractAddress()
        ),
        getContractStorage().cl::get<cellRef>(Controller::endpointCode)
    );
}

;;; ==========================VIEW FUNCTIONS=====================================

;; _verifyEventSender is used by offchain entities to verify that an event emitted
;; by the controller was sent by a protocol contract (endpoint or channel).
;; Each event transaction includes the storage init of the event emitting contract,
;; which is used to verify the sender is the contract they claim to be.

;; Returns true if the event originates from a protocol contract.
;; returns false if the event does not originate from a protocol contract.
int _verifyEventSender(int sender, cell $senderStorageInit) impure method_id {
    cell $storage = getContractStorage();

    if (sender == getContractAddress()) {
        return true;
    }

    int storageType = cl::typeof($senderStorageInit);
    int senderOwner = NULLADDRESS;

    if (storageType == Endpoint::NAME) {
        cell $endpointStorageInit = Endpoint::sanitize($senderStorageInit);
        throw_if(
            BaseInterface::ERROR::invalidEventSource,
            $endpointStorageInit.cl::hash() != $senderStorageInit.cl::hash()
        );

        cell endpointCode = $storage.cl::get<cellRef>(Controller::endpointCode);
        throw_unless(
            BaseInterface::ERROR::invalidEventSource,
            sender == computeContractAddress($senderStorageInit, endpointCode)
        );

        senderOwner = $endpointStorageInit
            .cl::get<objRef>(Endpoint::baseStorage)
            .cl::get<address>(BaseStorage::owner);

    } elseif (storageType == Channel::NAME) {
        cell $channelStorageInit = Channel::sanitize($senderStorageInit);
        throw_if(
            BaseInterface::ERROR::invalidEventSource,
            $channelStorageInit.cl::hash() != $senderStorageInit.cl::hash()
        );

        cell channelCode = $storage.cl::get<cellRef>(Controller::channelCode);
        throw_unless(
            BaseInterface::ERROR::invalidEventSource,
            sender == computeContractAddress($senderStorageInit, channelCode)
        );

        senderOwner = $channelStorageInit
            .cl::get<objRef>(Channel::baseStorage)
            .cl::get<address>(BaseStorage::owner);
    } else {
        throw(BaseInterface::ERROR::invalidEventSource);
    }

    ;; If senderOwner != controller address, then this event sender might be using the correct
    ;; bytecode and storage but be part of a different LayerZero protocol deployment owned
    ;; by a different signer.
    throw_if(BaseInterface::ERROR::invalidEventSource, senderOwner != getContractAddress());

    return true;
}

;;; ==========================HANDLERS=====================================

;; @in owner EOA
;; @in_md deployEndpoint
;; @out endpoint/handler.fc
;; @out_md deployAndCall(endpointInitData, endpointCode, endpoint_initialize)
;; @permissions only owner
tuple deployEndpoint(cell $deploy) impure inline method_id {
    (cell $storage, tuple actions) = preamble();

    cell $sanitizedDeploy = $deploy.md::Deploy::sanitize();
    int dstEid = $sanitizedDeploy.cl::get<uint32>(md::Deploy::dstEid);
    throw_if(Controller::ERROR::invalidEid, dstEid == 0);

    int eid = $storage.cl::get<uint32>(Controller::eid);

    actions~pushAction<deployAndCall>(
        $storage.cl::get<cellRef>(Controller::endpointCode),
        Endpoint::New(eid, dstEid, getContractAddress()),
        $sanitizedDeploy.cl::get<coins>(md::Deploy::initialDeposit),
        BaseInterface::OP::INITIALIZE,
        md::InitEndpoint::New($storage.cl::get<cellRef>(Controller::channelCode)),
        0
    );

    return actions;
}

;; @in oApp
;; @in_md deployChannel
;; @out channel/handler.fc
;; @out_md deployAndCall(endpoint_state_init, endpointCode, channel_initialize)
;; @note: There's no need to check for permissions here because ctx.SENDER is derived from the oApp.
;; @permissionless
tuple deployChannel(cell $deploy) impure inline method_id {
    (cell $storage, tuple actions) = preamble();

    cell $sanitizedDeploy = $deploy.md::Deploy::sanitize();
    int dstEid = $sanitizedDeploy.cl::get<uint32>(md::Deploy::dstEid);

    ;; create the path object
    cell $path = lz::Path::New(
        $storage.cl::get<uint32>(Controller::eid), ;; srcEid
        getCaller(), ;; srcOApp
        dstEid, ;; dstEid
        $sanitizedDeploy.cl::get<uint256>(md::Deploy::dstOApp) ;; dstOApp
    );

    ;; get the endpoint address
    int endpointAddress = _calculateEndpointAddress(dstEid);

    actions~pushAction<deployAndCall>(
        $storage.cl::get<cellRef>(Controller::channelCode),
        Channel::New(getContractAddress(), $path, endpointAddress),
        $sanitizedDeploy.cl::get<coins>(md::Deploy::initialDeposit),
        BaseInterface::OP::INITIALIZE,
        cl::nullObject(),
        0
    );

    return actions;
}

;; @in owner EOA
;; @in_md setEpConfigDefaults
;; @out endpoint/handler.fc/setEpConfigDefaults
;; @out_md setEpConfig
;; @permissions only owner
tuple setEpConfigDefaults(cell $mdEid) impure inline method_id {
    (_, tuple actions) = preamble();

    $mdEid = $mdEid.md::MdEid::sanitize();

    int dstEid = $mdEid.cl::get<uint32>(md::MdEid::eid);
    cell $sanitizedSetEpConfig = $mdEid.cl::get<objRef>(md::MdEid::md).md::SetEpConfig::sanitize();

    actions~pushAction<call>(
        _calculateEndpointAddress(dstEid),
        Endpoint::OP::SET_EP_CONFIG_DEFAULTS,
        $sanitizedSetEpConfig
    );

    return actions;
}

;; @in OApp contract
;; @in_md ExtendedMd(path, setEpConfig)
;; @out endpoint/handler.fc/setEpConfig
;; @out_md ExtendedMd(channelAddress, setEpConfig)
;; @note: There's no need to check for permissions here because ctx.SENDER is derived from the oApp.
;; Any configuration changes made will only impact the `oApp` that invokes this function.
;; @permissionless
tuple setEpConfigOApp(cell $mdObj) impure inline method_id {
    (_, tuple actions) = preamble();

    ;; get the path and setEpConfigMd from the md
    cell $sanitizedPath = $mdObj.cl::get<objRef>(md::MdObj::obj).lz::Path::sanitize();

    ;; create a sanitized mdObj with the sanitized setEpConfig
    $mdObj = md::MdObj::New(
        $mdObj.cl::get<objRef>(md::MdObj::md).md::SetEpConfig::sanitize(),
        $sanitizedPath
    );

    actions~pushAction<call>(
        _calculateEndpointAddress($sanitizedPath.cl::get<uint32>(lz::Path::dstEid)),
        Endpoint::OP::SET_EP_CONFIG_OAPP,
        $mdObj
    );

    return actions;
}

tuple addMsglib(cell $addMsglibMd) impure inline method_id {
    (_, tuple actions) = preamble();

    cell $sanitizedAddMsglibMd = $addMsglibMd.md::AddMsglib::sanitize();

    actions~pushAction<call>(
        _calculateEndpointAddress(
            $sanitizedAddMsglibMd.cl::get<uint32>(md::AddMsglib::dstEid)
        ),
        Endpoint::OP::ADD_MSGLIB,
        $sanitizedAddMsglibMd
    );

    return actions;
}

;; only controller zro wallet
tuple depositZro(cell $path) impure inline method_id {
    (cell $storage, tuple actions) = preamble();

    cell $sanitizedPath = $path.lz::Path::sanitize();

    ;; The message format of jetton happens to align with funC++
    ;; but the jetton token amount is aliased as donationNanos
    int tokenAmount = getDonationNanos();
    setDonationNanos(0);

    ;; get the endpoint address
    int endpointAddress = _calculateEndpointAddress($sanitizedPath.cl::get<uint32>(lz::Path::dstEid));

    int channelAddress = computeContractAddress(
        Channel::New(getContractAddress(), $sanitizedPath, endpointAddress),
        $storage.cl::get<cellRef>(Controller::channelCode)
    );

    actions~pushAction<call>(
        channelAddress,
        Channel::OP::DEPOSIT_ZRO,
        md::CoinsAmount::New(tokenAmount)
    );

    return actions;
}

tuple setZroWallet(cell $setAddress) impure inline method_id {
    (cell $storage, tuple actions) = preamble();

    cell $sanitizedSetAddress = $setAddress.md::SetAddress::sanitize();

    setContractStorage(
        $storage.cl::set(
            Controller::zroWallet,
            $sanitizedSetAddress.cl::get<address>(md::SetAddress::address)
        )
    );

    actions~pushAction<event>(Controller::event::ZRO_WALLET_SET, $sanitizedSetAddress);
    return actions;
}

;; This will override an existing tentative owner
;; Because we assert that the 'claimOwnership' can't be done by the 'null' address, it means
;; if we want to burn the ownership, we will need to set it to a contract which only has ability to
;; claim, but nothing else. This effectively burns it.
tuple transferOwnership(cell $setAddress) impure inline {
    (cell $storage, tuple actions) = preamble();

    cell $sanitizedSetAddress = $setAddress.md::SetAddress::sanitize();

    setContractStorage(
        $storage.cl::set(
            Controller::tentativeOwner,
            $sanitizedSetAddress.cl::get<address>(md::SetAddress::address)
        )
    );

    actions~pushAction<event>(
        Controller::event::OWNER_SET_TENTATIVE,
        $sanitizedSetAddress
    );

    return actions;
}

tuple claimOwnership(cell $emptyMd) impure inline {
    (cell $storage, tuple actions) = preamble();

    ;; permissions check guarantees newOwner == $storage.tentativeOwner
    int newOwner = $storage.cl::get<address>(Controller::tentativeOwner);

    ;; this should be caught by the permission check, BUT let's be super safe about this
    throw_if(Controller::ERROR::nullTentativeOwner, newOwner == NULLADDRESS);

    ;; erase the tentative owner AND set that tentative owner to the actual owner
    setContractStorage(
        $storage
            .cl::set(Controller::tentativeOwner, NULLADDRESS)
            .cl::set(
                Controller::baseStorage,
                $storage
                    .cl::get<objRef>(Controller::baseStorage)
                    .cl::set(BaseStorage::owner, newOwner)
            )
    );

    actions~pushAction<event>(
        Controller::event::OWNER_SET,
        md::SetAddress::New(newOwner)
    );

    return actions;
}