Skip to content

Audit changes #8

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
sunbreak1211 merged 8 commits into from
Feb 19, 2026
Merged

Audit changes #8

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
207ef97
Wrappers: use abi.encodeCall
sunbreak1211 Feb 13, 2026
bd5505f
Allow to decrease from unlimited if the state is updated
sunbreak1211 Feb 13, 2026
610ba4e
Comments about checking in general if no specific setting
oldchili Feb 15, 2026
26f0645
Add comment about enforcing maximal rate limits
oldchili Feb 15, 2026
2af76dd
Fix in test
sunbreak1211 Feb 16, 2026
8ea679a
Add also overflow protection for slope
sunbreak1211 Feb 16, 2026
94be5f0
Minor changes
sunbreak1211 Feb 16, 2026
027ea6d
Minor changes
sunbreak1211 Feb 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions deploy/PASInit.sol
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -141,6 +141,8 @@ library PASInit {
address[] memory rateLimits,
address[] memory controllers
) internal {
require(hop > 0, "PASInit/hop-is-zero");

BeamStateLike beamState = BeamStateLike(pasInstance.beamState);

beamState.setHop(address(0), hop);
Expand Down
4 changes: 3 additions & 1 deletion src/BeamState.sol
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -106,10 +106,12 @@ contract BeamState {
}

function getHop(address rateLimits_) external view returns (uint256 hop_) {
// If not set for specific rateLimits, check in general
hop_ = hop[rateLimits_]; hop_ = hop_ != 0 ? hop_ : hop[address(0)];
}

function getMaxChange(address rateLimits_) external view returns (uint256 maxChange_) {
// If not set for specific rateLimits, check in general
maxChange_ = maxChange[rateLimits_]; maxChange_ = maxChange_ != 0 ? maxChange_ : maxChange[address(0)];
}

Expand Down Expand Up @@ -176,7 +178,7 @@ contract BeamState {
}

function setMaxChange(address rateLimits_, uint256 value) external roleAuth {
require(value >= WAD, "BeamState/maxChange-below-1x");
require(value == 0 || value >= WAD, "BeamState/invalid-maxChange");
maxChange[rateLimits_] = value;
emit SetMaxChange(rateLimits_, value);
}
Expand Down
21 changes: 15 additions & 6 deletions src/Configurator.sol
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -84,10 +84,6 @@ contract Configurator {

// --- Internal functions ---

function _max(uint256 x, uint256 y) internal pure returns (uint256 z) {
z = x > y ? x : y;
}

function _min(uint256 x, uint256 y) internal pure returns (uint256 z) {
z = x < y ? x : y;
}
Expand All @@ -97,6 +93,7 @@ contract Configurator {
function setRateLimit(address rateLimits, bytes32 key, uint256 maxAmount, uint256 slope) external notStopped authRateLimits(rateLimits) {
(uint256 defMaxAmount, uint256 defSlope) = beamState.getInitRateLimits(key, rateLimits);
if (defMaxAmount == type(uint256).max && defSlope == 0) {
// If maximal rate limits are defined in beamState the cBEAM has to use those
require(maxAmount == type(uint256).max && slope == 0, "Configurator/unlimited-incorrect-params");
RateLimitsLike(rateLimits).setUnlimitedRateLimitData(key);
emit SetRateLimit(rateLimits, key, type(uint256).max, 0);
Expand All @@ -105,8 +102,20 @@ contract Configurator {
uint256 maxChange = beamState.getMaxChange(rateLimits);

// Ceiling is the max of (current * maxChange) and default
require(maxAmount <= _max(current.maxAmount * maxChange / WAD, defMaxAmount), "Configurator/exceeds-max-amount");
require(slope <= _max(current.slope * maxChange / WAD, defSlope), "Configurator/exceeds-max-slope");
// Avoids overflow when current maxAmount is type(uint256).max and guarantees decreases are always possible even when maxChange is 0
require(
maxAmount <= defMaxAmount ||
maxAmount <= current.maxAmount ||
maxAmount <= current.maxAmount * maxChange / WAD,
"Configurator/exceeds-max-amount"
);
// Avoids overflow for a hypothetical case where current slope is type(uint256).max
require(
slope <= defSlope ||
slope <= current.slope ||
slope <= current.slope * maxChange / WAD,
Comment thread
oldchili marked this conversation as resolved.
"Configurator/exceeds-max-slope"
);

// Any increase requires hop
if (maxAmount > current.maxAmount || slope > current.slope) {
Expand Down
138 changes: 60 additions & 78 deletions src/timelock/TimelockWrapperForeign.sol
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -146,37 +146,37 @@ contract TimelockWrapperForeign {
}

function start(bytes32 predecessor, bytes32 salt, uint256 delay) external toll returns (bytes32 operationId) {
bytes memory payload = abi.encodeWithSelector(BeamStateLike.start.selector);
bytes memory payload = abi.encodeCall(BeamStateLike.start, ());
operationId = _submitProposal(payload, predecessor, salt, delay);
emit ProposalSubmitted(operationId, "start");
}

function setHop(address rateLimits, uint256 hop, bytes32 predecessor, bytes32 salt, uint256 delay) external toll returns (bytes32 operationId) {
bytes memory payload = abi.encodeWithSelector(BeamStateLike.setHop.selector, rateLimits, hop);
bytes memory payload = abi.encodeCall(BeamStateLike.setHop, (rateLimits, hop));
operationId = _submitProposal(payload, predecessor, salt, delay);
emit ProposalSubmitted(operationId, "setHop");
}

function setMaxChange(address rateLimits, uint256 maxChange, bytes32 predecessor, bytes32 salt, uint256 delay) external toll returns (bytes32 operationId) {
bytes memory payload = abi.encodeWithSelector(BeamStateLike.setMaxChange.selector, rateLimits, maxChange);
bytes memory payload = abi.encodeCall(BeamStateLike.setMaxChange, (rateLimits, maxChange));
operationId = _submitProposal(payload, predecessor, salt, delay);
emit ProposalSubmitted(operationId, "setMaxChange");
}

function addRateLimits(address rateLimits, bytes32 predecessor, bytes32 salt, uint256 delay) external toll returns (bytes32 operationId) {
bytes memory payload = abi.encodeWithSelector(BeamStateLike.addRateLimits.selector, rateLimits);
bytes memory payload = abi.encodeCall(BeamStateLike.addRateLimits, (rateLimits));
operationId = _submitProposal(payload, predecessor, salt, delay);
emit ProposalSubmitted(operationId, "addRateLimits");
}

function addController(address controller, bytes32 predecessor, bytes32 salt, uint256 delay) external toll returns (bytes32 operationId) {
bytes memory payload = abi.encodeWithSelector(BeamStateLike.addController.selector, controller);
bytes memory payload = abi.encodeCall(BeamStateLike.addController, (controller));
operationId = _submitProposal(payload, predecessor, salt, delay);
emit ProposalSubmitted(operationId, "addController");
}

function addCBeam(address cBeam, bytes32 predecessor, bytes32 salt, uint256 delay) external toll returns (bytes32 operationId) {
bytes memory payload = abi.encodeWithSelector(BeamStateLike.addCBeam.selector, cBeam);
bytes memory payload = abi.encodeCall(BeamStateLike.addCBeam, (cBeam));
operationId = _submitProposal(payload, predecessor, salt, delay);
emit ProposalSubmitted(operationId, "addCBeam");
}
Expand All @@ -187,12 +187,9 @@ contract TimelockWrapperForeign {
bytes32 salt,
uint256 delay
) external toll returns (bytes32 operationId) {
bytes memory payload = abi.encodeWithSelector(
BeamStateLike.addInitRateLimits.selector,
config.key,
config.rateLimits,
config.maxAmount,
config.slope
bytes memory payload = abi.encodeCall(
BeamStateLike.addInitRateLimits,
(config.key, config.rateLimits, config.maxAmount, config.slope)
);

operationId = _submitProposal(payload, predecessor, salt, delay);
Expand All @@ -213,12 +210,9 @@ contract TimelockWrapperForeign {

for (uint256 i = 0; i < len; ++i) {
targets[i] = address(beamState);
payloads[i] = abi.encodeWithSelector(
BeamStateLike.addInitRateLimits.selector,
configs[i].key,
configs[i].rateLimits,
configs[i].maxAmount,
configs[i].slope
payloads[i] = abi.encodeCall(
BeamStateLike.addInitRateLimits,
(configs[i].key, configs[i].rateLimits, configs[i].maxAmount, configs[i].slope)
);
}

Expand All @@ -241,12 +235,11 @@ contract TimelockWrapperForeign {
bytes32 salt,
uint256 delay
) external toll returns (bytes32 operationId) {
bytes memory controllerData = abi.encodeWithSelector(
ControllerLike.grantRole.selector,
role,
account
bytes memory controllerData = abi.encodeCall(
ControllerLike.grantRole,
(role, account)
);
bytes memory payload = abi.encodeWithSelector(BeamStateLike.addInitControllerActions.selector, controllerData, controller);
bytes memory payload = abi.encodeCall(BeamStateLike.addInitControllerActions, (controllerData, controller));

operationId = _submitProposal(payload, predecessor, salt, delay);
emit ProposalSubmitted(operationId, "grantRole");
Expand All @@ -260,12 +253,11 @@ contract TimelockWrapperForeign {
bytes32 salt,
uint256 delay
) external toll returns (bytes32 operationId) {
bytes memory controllerData = abi.encodeWithSelector(
ControllerLike.revokeRole.selector,
role,
account
bytes memory controllerData = abi.encodeCall(
ControllerLike.revokeRole,
(role, account)
);
bytes memory payload = abi.encodeWithSelector(BeamStateLike.addInitControllerActions.selector, controllerData, controller);
bytes memory payload = abi.encodeCall(BeamStateLike.addInitControllerActions, (controllerData, controller));

operationId = _submitProposal(payload, predecessor, salt, delay);
emit ProposalSubmitted(operationId, "revokeRole");
Expand All @@ -279,12 +271,11 @@ contract TimelockWrapperForeign {
bytes32 salt,
uint256 delay
) external toll returns (bytes32 operationId) {
bytes memory controllerData = abi.encodeWithSelector(
ControllerLike.setMintRecipient.selector,
destinationDomain,
mintRecipient
bytes memory controllerData = abi.encodeCall(
ControllerLike.setMintRecipient,
(destinationDomain, mintRecipient)
);
bytes memory payload = abi.encodeWithSelector(BeamStateLike.addInitControllerActions.selector, controllerData, controller);
bytes memory payload = abi.encodeCall(BeamStateLike.addInitControllerActions, (controllerData, controller));

operationId = _submitProposal(payload, predecessor, salt, delay);
emit ProposalSubmitted(operationId, "setMintRecipient");
Expand All @@ -298,12 +289,11 @@ contract TimelockWrapperForeign {
bytes32 salt,
uint256 delay
) external toll returns (bytes32 operationId) {
bytes memory controllerData = abi.encodeWithSelector(
ControllerLike.setLayerZeroRecipient.selector,
destinationEndpointId,
layerZeroRecipient
bytes memory controllerData = abi.encodeCall(
ControllerLike.setLayerZeroRecipient,
(destinationEndpointId, layerZeroRecipient)
);
bytes memory payload = abi.encodeWithSelector(BeamStateLike.addInitControllerActions.selector, controllerData, controller);
bytes memory payload = abi.encodeCall(BeamStateLike.addInitControllerActions, (controllerData, controller));

operationId = _submitProposal(payload, predecessor, salt, delay);
emit ProposalSubmitted(operationId, "setLayerZeroRecipient");
Expand All @@ -317,12 +307,11 @@ contract TimelockWrapperForeign {
bytes32 salt,
uint256 delay
) external toll returns (bytes32 operationId) {
bytes memory controllerData = abi.encodeWithSelector(
ControllerLike.setMaxSlippage.selector,
pool,
maxSlippage
bytes memory controllerData = abi.encodeCall(
ControllerLike.setMaxSlippage,
(pool, maxSlippage)
);
bytes memory payload = abi.encodeWithSelector(BeamStateLike.addInitControllerActions.selector, controllerData, controller);
bytes memory payload = abi.encodeCall(BeamStateLike.addInitControllerActions, (controllerData, controller));

operationId = _submitProposal(payload, predecessor, salt, delay);
emit ProposalSubmitted(operationId, "setMaxSlippage");
Expand All @@ -337,13 +326,11 @@ contract TimelockWrapperForeign {
bytes32 salt,
uint256 delay
) external toll returns (bytes32 operationId) {
bytes memory controllerData = abi.encodeWithSelector(
ControllerLike.setMaxExchangeRate.selector,
token,
shares,
maxExpectedAssets
bytes memory controllerData = abi.encodeCall(
ControllerLike.setMaxExchangeRate,
(token, shares, maxExpectedAssets)
);
bytes memory payload = abi.encodeWithSelector(BeamStateLike.addInitControllerActions.selector, controllerData, controller);
bytes memory payload = abi.encodeCall(BeamStateLike.addInitControllerActions, (controllerData, controller));

operationId = _submitProposal(payload, predecessor, salt, delay);
emit ProposalSubmitted(operationId, "setMaxExchangeRate");
Expand All @@ -359,12 +346,11 @@ contract TimelockWrapperForeign {
bytes32 salt,
uint256 delay
) external toll returns (bytes32 operationId) {
bytes memory controllerData = abi.encodeWithSelector(
ControllerLike.setUniswapV3PoolMaxTickDelta.selector,
pool,
maxTickDelta
bytes memory controllerData = abi.encodeCall(
ControllerLike.setUniswapV3PoolMaxTickDelta,
(pool, maxTickDelta)
);
bytes memory payload = abi.encodeWithSelector(BeamStateLike.addInitControllerActions.selector, controllerData, controller);
bytes memory payload = abi.encodeCall(BeamStateLike.addInitControllerActions, (controllerData, controller));

operationId = _submitProposal(payload, predecessor, salt, delay);
emit ProposalSubmitted(operationId, "setUniswapV3PoolMaxTickDelta");
Expand All @@ -378,12 +364,11 @@ contract TimelockWrapperForeign {
bytes32 salt,
uint256 delay
) external toll returns (bytes32 operationId) {
bytes memory controllerData = abi.encodeWithSelector(
ControllerLike.setUniswapV3AddLiquidityLowerTickBound.selector,
pool,
lowerTickBound
bytes memory controllerData = abi.encodeCall(
ControllerLike.setUniswapV3AddLiquidityLowerTickBound,
(pool, lowerTickBound)
);
bytes memory payload = abi.encodeWithSelector(BeamStateLike.addInitControllerActions.selector, controllerData, controller);
bytes memory payload = abi.encodeCall(BeamStateLike.addInitControllerActions, (controllerData, controller));

operationId = _submitProposal(payload, predecessor, salt, delay);
emit ProposalSubmitted(operationId, "setUniswapV3AddLiquidityLowerTickBound");
Expand All @@ -397,12 +382,11 @@ contract TimelockWrapperForeign {
bytes32 salt,
uint256 delay
) external toll returns (bytes32 operationId) {
bytes memory controllerData = abi.encodeWithSelector(
ControllerLike.setUniswapV3AddLiquidityUpperTickBound.selector,
pool,
upperTickBound
bytes memory controllerData = abi.encodeCall(
ControllerLike.setUniswapV3AddLiquidityUpperTickBound,
(pool, upperTickBound)
);
bytes memory payload = abi.encodeWithSelector(BeamStateLike.addInitControllerActions.selector, controllerData, controller);
bytes memory payload = abi.encodeCall(BeamStateLike.addInitControllerActions, (controllerData, controller));

operationId = _submitProposal(payload, predecessor, salt, delay);
emit ProposalSubmitted(operationId, "setUniswapV3AddLiquidityUpperTickBound");
Expand All @@ -416,12 +400,11 @@ contract TimelockWrapperForeign {
bytes32 salt,
uint256 delay
) external toll returns (bytes32 operationId) {
bytes memory controllerData = abi.encodeWithSelector(
ControllerLike.setUniswapV3TwapSecondsAgo.selector,
pool,
twapSecondsAgo
bytes memory controllerData = abi.encodeCall(
ControllerLike.setUniswapV3TwapSecondsAgo,
(pool, twapSecondsAgo)
);
bytes memory payload = abi.encodeWithSelector(BeamStateLike.addInitControllerActions.selector, controllerData, controller);
bytes memory payload = abi.encodeCall(BeamStateLike.addInitControllerActions, (controllerData, controller));

operationId = _submitProposal(payload, predecessor, salt, delay);
emit ProposalSubmitted(operationId, "setUniswapV3TwapSecondsAgo");
Expand All @@ -435,12 +418,11 @@ contract TimelockWrapperForeign {
bytes32 salt,
uint256 delay
) external toll returns (bytes32 operationId) {
bytes memory controllerData = abi.encodeWithSelector(
ControllerLike.setCentrifugeRecipient.selector,
centrifugeId,
recipient
bytes memory controllerData = abi.encodeCall(
ControllerLike.setCentrifugeRecipient,
(centrifugeId, recipient)
);
bytes memory payload = abi.encodeWithSelector(BeamStateLike.addInitControllerActions.selector, controllerData, controller);
bytes memory payload = abi.encodeCall(BeamStateLike.addInitControllerActions, (controllerData, controller));

operationId = _submitProposal(payload, predecessor, salt, delay);
emit ProposalSubmitted(operationId, "setCentrifugeRecipient");
Expand All @@ -453,11 +435,11 @@ contract TimelockWrapperForeign {
bytes32 salt,
uint256 delay
) external toll returns (bytes32 operationId) {
bytes memory controllerData = abi.encodeWithSelector(
ControllerLike.setMerklDistributor.selector,
merklDistributor
bytes memory controllerData = abi.encodeCall(
ControllerLike.setMerklDistributor,
(merklDistributor)
);
bytes memory payload = abi.encodeWithSelector(BeamStateLike.addInitControllerActions.selector, controllerData, controller);
bytes memory payload = abi.encodeCall(BeamStateLike.addInitControllerActions, (controllerData, controller));

operationId = _submitProposal(payload, predecessor, salt, delay);
emit ProposalSubmitted(operationId, "setMerklDistributor");
Expand Down
Loading