Add StorageSlot::get_slot typed accessor and eip1967::IMPLEMENTATION_SLOT for fixed-key proxy storage slots

Author: filip-parity

crates/pvm-contract-macros/tests/native_proxy_slot.rs

@@ -0,0 +1,79 @@
+#![cfg(not(feature = "abi-gen"))]
+//! Worked example: a minimal EIP-1967 upgradeable proxy.
+//!
+//! The implementation address lives at the standard pseudo-random slot
+//! `keccak256("eip1967.proxy.implementation") - 1`, deliberately outside the
+//! compiler-assigned `#[slot(N)]` range so it never collides with regular
+//! fields. The contract reaches it through the typed `StorageSlot::get_slot`
+//! helper — `&self` reads, `&mut self` writes — instead of hand-rolling a raw
+//! `host.get_storage` call plus manual `Address` decoding.
+
+use pvm_contract_sdk::{Address, Host, MockHost, MockHostBuilder, eip1967};
+
+#[allow(dead_code)]
+#[pvm_contract_sdk::contract]
+mod upgradeable_proxy {
+    use super::*;
+    use pvm_contract_sdk::StorageSlot;
+
+    pub struct UpgradeableProxy;
+
+    impl UpgradeableProxy {
+        #[pvm_contract_sdk::constructor]
+        pub fn new(&mut self) {}
+
+        /// Current implementation address, read from the EIP-1967 slot.
+        #[pvm_contract_sdk::method]
+        pub fn implementation(&self) -> Address {
+            StorageSlot::get_slot::<Address>(self.host(), eip1967::IMPLEMENTATION_SLOT).get()
+        }
+
+        /// Point the proxy at a new implementation contract.
+        #[pvm_contract_sdk::method]
+        pub fn upgrade_to(&mut self, new_implementation: Address) {
+            StorageSlot::get_slot::<Address>(self.host(), eip1967::IMPLEMENTATION_SLOT)
+                .set(&new_implementation);
+        }
+    }
+}
+
+use upgradeable_proxy::UpgradeableProxy;
+
+fn proxy() -> (UpgradeableProxy, MockHost) {
+    let mock = MockHostBuilder::new().build();
+    let contract = UpgradeableProxy {
+        host: Host::from_dyn(::std::rc::Rc::new(mock.clone())),
+    };
+    (contract, mock)
+}
+
+#[test]
+fn implementation_defaults_to_zero() {
+    let (p, _) = proxy();
+    assert_eq!(p.implementation(), Address::from([0u8; 20]));
+}
+
+#[test]
+fn upgrade_to_then_implementation_roundtrips() {
+    let (mut p, _) = proxy();
+    let impl_addr = Address::from([0x42; 20]);
+    p.upgrade_to(impl_addr);
+    assert_eq!(p.implementation(), impl_addr);
+}
+
+#[test]
+fn upgrade_to_writes_the_eip1967_slot() {
+    let (mut p, mock) = proxy();
+    let impl_addr = Address::from([0xCD; 20]);
+    p.upgrade_to(impl_addr);
+
+    // Independently confirm the write landed at the EIP-1967 slot — not some
+    // compiler-assigned slot — by reading the raw 32 bytes back. `address`
+    // stores right-aligned in its 32-byte word, mirroring solc.
+    let raw = mock
+        .get_raw_storage(&eip1967::IMPLEMENTATION_SLOT)
+        .expect("implementation slot was written");
+    let mut expected = [0u8; 32];
+    expected[12..].copy_from_slice(impl_addr.as_ref() as &[u8; 20]);
+    assert_eq!(raw.as_slice(), &expected);
+}

crates/pvm-contract-sdk/src/lib.rs

@@ -131,7 +131,8 @@ pub use pvm_contract_core::call::{
 // `uint8[]`, a different on-chain layout). `StorageComponent` is the trait
 // typed storage helpers implement to participate in auto-numbered slot layout.
 pub use pvm_storage::{
-    AsStorageKey, LayoutStep, Lazy, Mapping, Ref, RefMut, StorageComponent, StorageKey, layout_step,
+    AsStorageKey, LayoutStep, Lazy, Mapping, Ref, RefMut, StorageComponent, StorageKey,
+    StorageSlot, eip1967, layout_step,
 };
 
 #[cfg(feature = "abi-gen")]

crates/pvm-storage/src/lib.rs

@@ -272,6 +272,70 @@ impl StorageKey {
     }
 }
 
+// ---------------------------------------------------------------------------
+// StorageSlot — typed access at a fixed, externally-known 32-byte key
+// ---------------------------------------------------------------------------
+
+/// Well-known EIP-1967 proxy storage slots.
+///
+/// EIP-1967 places proxy bookkeeping at pseudo-random 32-byte slots, chosen so
+/// they never collide with compiler-assigned (sequential) storage slots. Every
+/// EVM proxy on Ethereum uses these exact values, so a contract reading them
+/// here sees the same data a Solidity proxy would.
+pub mod eip1967 {
+    /// `bytes32(uint256(keccak256("eip1967.proxy.implementation")) - 1)`.
+    ///
+    /// The slot holding a transparent/UUPS proxy's implementation address.
+    pub const IMPLEMENTATION_SLOT: [u8; 32] = [
+        0x36, 0x08, 0x94, 0xa1, 0x3b, 0xa1, 0xa3, 0x21, 0x06, 0x67, 0xc8, 0x28, 0x49, 0x2d, 0xb9,
+        0x8d, 0xca, 0x3e, 0x20, 0x76, 0xcc, 0x37, 0x35, 0xa9, 0x20, 0xa3, 0xca, 0x50, 0x5d, 0x38,
+        0x2b, 0xbc,
+    ];
+}
+
+/// Typed accessor for storage at a caller-supplied, externally-known 32-byte
+/// key — e.g. EIP-1967 proxy slots ([`eip1967::IMPLEMENTATION_SLOT`]).
+///
+/// Such slots live at fixed pseudo-random positions outside the
+/// compiler-assigned `#[slot(N)]` range, so they can't be reached through the
+/// normal contract-struct storage fields. [`get_slot`](StorageSlot::get_slot)
+/// gives them the same typed ergonomics as a regular field, returning a
+/// [`Lazy<T>`] handle with `get`/`set`/`try_get`, instead of forcing a raw
+/// `host.get_storage` call plus manual decoding.
+///
+/// ```ignore
+/// use pvm_storage::{StorageSlot, eip1967};
+/// use pvm_contract_types::Address;
+///
+/// let impl_addr: Address =
+///     StorageSlot::get_slot::<Address>(self.host(), eip1967::IMPLEMENTATION_SLOT).get();
+/// ```
+pub struct StorageSlot;
+
+impl StorageSlot {
+    /// Bind a [`Lazy<T>`] handle to the raw 32-byte storage `key`.
+    ///
+    /// This is the blessed safe wrapper for arbitrary-key access: it owns the
+    /// `unsafe` that [`Lazy::new`] requires (the key is supplied verbatim, not
+    /// derived from the macro layout). As with any raw-slot access, the
+    /// type-level view-vs-mutating gate does not apply — a `&self` method can
+    /// obtain a writable handle. The runtime STATICCALL backstop still rejects
+    /// an out-of-context `SSTORE`, so this is an SDK-level safety contract, not
+    /// a soundness hole. Multi-slot `T` is striped across consecutive slots
+    /// starting at `key`, matching [`Lazy`]'s layout.
+    pub fn get_slot<T: StorageEncode + StorageDecode>(host: &Host, key: [u8; 32]) -> Lazy<T> {
+        // A value occupying its own slot is right-aligned, matching solc's
+        // storage layout: a sub-word `T` (e.g. `Address`, `PACKED_BYTES == 20`)
+        // sits in the low-order bytes at offset `32 - PACKED_BYTES`, so a slot
+        // written by a Solidity proxy decodes identically here. Full-slot `T`
+        // (`PACKED_BYTES == 32`) yields offset 0.
+        let offset = (32 - T::PACKED_BYTES) as u8;
+        // SAFETY: `get_slot` exists precisely to expose arbitrary-key storage
+        // access; the caller-supplied key is the intended `StorageKey`.
+        unsafe { Lazy::new(StorageKey::from_raw(key), offset, host.clone()) }
+    }
+}
+
 // ---------------------------------------------------------------------------
 // AsStorageKey
 // ---------------------------------------------------------------------------

crates/pvm-storage/src/tests.rs

@@ -1899,3 +1899,63 @@ fn lazy_string_native_layout_matches_solc_short() {
     assert!(header[5..31].iter().all(|&b| b == 0));
     assert_eq!(header[31], 5 * 2);
 }
+
+// --- StorageSlot (fixed-key proxy slots, EIP-1967) ---
+
+#[test]
+fn eip1967_implementation_slot_matches_derivation() {
+    // The const must equal keccak256("eip1967.proxy.implementation") - 1,
+    // the canonical EVM-wide value every Solidity proxy uses. Computing it
+    // here (rather than trusting the literal) proves the derivation, not a copy.
+    let host = h();
+    let mut hash = [0u8; 32];
+    host.hash_keccak_256(b"eip1967.proxy.implementation", &mut hash);
+    let expected = U256::from_be_bytes(hash) - U256::from(1u64);
+    assert_eq!(eip1967::IMPLEMENTATION_SLOT, expected.to_be_bytes::<32>());
+}
+
+#[test]
+fn storage_slot_roundtrips_address() {
+    let host = h();
+    let addr = Address([0xAB; 20]);
+    let mut slot = StorageSlot::get_slot::<Address>(&host, eip1967::IMPLEMENTATION_SLOT);
+    slot.set(&addr);
+    assert_eq!(
+        StorageSlot::get_slot::<Address>(&host, eip1967::IMPLEMENTATION_SLOT).get(),
+        addr
+    );
+}
+
+#[test]
+fn storage_slot_stores_address_right_aligned_like_solc() {
+    // EIP-1967 interop hinges on matching solc's storage layout: a standalone
+    // `address` lives in the low-order 20 bytes of its slot. A slot written by
+    // a Solidity proxy must decode here, so the raw bytes must be right-aligned.
+    let host = h();
+    let addr = Address([0xCD; 20]);
+    StorageSlot::get_slot::<Address>(&host, eip1967::IMPLEMENTATION_SLOT).set(&addr);
+
+    let mut raw = [0u8; 32];
+    host.get_storage_or_zero(
+        StorageFlags::empty(),
+        &eip1967::IMPLEMENTATION_SLOT,
+        &mut raw,
+    );
+    let mut expected = [0u8; 32];
+    expected[12..].copy_from_slice(&addr.0);
+    assert_eq!(raw, expected);
+}
+
+#[test]
+fn storage_slot_targets_exact_key_not_slot_zero() {
+    let host = h();
+    let mut slot = StorageSlot::get_slot::<U256>(&host, eip1967::IMPLEMENTATION_SLOT);
+    slot.set(&U256::from(99u64));
+    // A compiler-assigned #[slot(0)] field must be untouched by the proxy slot.
+    let field = unsafe { Lazy::<U256>::new(StorageKey::from_slot(0), 0, host.clone()) };
+    assert_eq!(field.get(), U256::ZERO);
+    assert_eq!(
+        StorageSlot::get_slot::<U256>(&host, eip1967::IMPLEMENTATION_SLOT).get(),
+        U256::from(99u64)
+    );
+}