Merge pull request #7121 from ethereum-optimism/jm/basic-delay

Add the DelayedVetoable contract

op-bindings/artifacts.json

@@ -38,5 +38,6 @@
   "SchemaRegistry",
   "ProtocolVersions",
   "Safe",
-  "SafeProxyFactory"
+  "SafeProxyFactory",
+  "DelayedVetoable"
 ]

op-bindings/bindings/delayedvetoable_more.go

+// Code generated - DO NOT EDIT.
+// This file is a generated binding and any manual changes will be lost.
+
+package bindings
+
+import (
+	"encoding/json"
+
+	"github.com/ethereum-optimism/optimism/op-bindings/solc"
+)
+
+const DelayedVetoableStorageLayoutJSON = "{\"storage\":[{\"astId\":1000,\"contract\":\"src/L1/DelayedVetoable.sol:DelayedVetoable\",\"label\":\"_delay\",\"offset\":0,\"slot\":\"0\",\"type\":\"t_uint256\"},{\"astId\":1001,\"contract\":\"src/L1/DelayedVetoable.sol:DelayedVetoable\",\"label\":\"_queuedAt\",\"offset\":0,\"slot\":\"1\",\"type\":\"t_mapping(t_bytes32,t_uint256)\"}],\"types\":{\"t_bytes32\":{\"encoding\":\"inplace\",\"label\":\"bytes32\",\"numberOfBytes\":\"32\"},\"t_mapping(t_bytes32,t_uint256)\":{\"encoding\":\"mapping\",\"label\":\"mapping(bytes32 =\u003e uint256)\",\"numberOfBytes\":\"32\",\"key\":\"t_bytes32\",\"value\":\"t_uint256\"},\"t_uint256\":{\"encoding\":\"inplace\",\"label\":\"uint256\",\"numberOfBytes\":\"32\"}}}"
+
+var DelayedVetoableStorageLayout = new(solc.StorageLayout)
+
+var DelayedVetoableDeployedBin = "0x608060405234801561001057600080fd5b50600436106100725760003560e01c8063b912de5d11610050578063b912de5d14610111578063d4b8399214610124578063d8bff4401461012c57610072565b806354fd4d501461007c5780635c39fcc1146100ce5780636a42b8f8146100fb575b61007a610134565b005b6100b86040518060400160405280600581526020017f312e302e3000000000000000000000000000000000000000000000000000000081525081565b6040516100c591906106a7565b60405180910390f35b6100d66104fb565b60405173ffffffffffffffffffffffffffffffffffffffff90911681526020016100c5565b610103610532565b6040519081526020016100c5565b61010361011f36600461071a565b610540565b6100d6610567565b6100d6610593565b361580156101425750600054155b15610298573373ffffffffffffffffffffffffffffffffffffffff7f000000000000000000000000000000000000000000000000000000000000000016148015906101c357503373ffffffffffffffffffffffffffffffffffffffff7f00000000000000000000000000000000000000000000000000000000000000001614155b1561023d576040517f295a81c100000000000000000000000000000000000000000000000000000000815273ffffffffffffffffffffffffffffffffffffffff7f00000000000000000000000000000000000000000000000000000000000000001660048201523360248201526044015b60405180910390fd5b7f000000000000000000000000000000000000000000000000000000000000000060008190556040519081527febf28bfb587e28dfffd9173cf71c32ba5d3f0544a0117b5539c9b274a5bba2a89060200160405180910390a1565b600080366040516102aa929190610733565b60405190819003902090503373ffffffffffffffffffffffffffffffffffffffff7f0000000000000000000000000000000000000000000000000000000000000000161480156103065750600081815260016020526040902054155b1561036c5760005460000361031e5761031e816105bf565b6000818152600160205260408082204290555182917f87a332a414acbc7da074543639ce7ae02ff1ea72e88379da9f261b080beb5a139161036191903690610743565b60405180910390a250565b3373ffffffffffffffffffffffffffffffffffffffff7f0000000000000000000000000000000000000000000000000000000000000000161480156103be575060008181526001602052604090205415155b15610406576000818152600160205260408082208290555182917fbede6852c1d97d93ff557f676de76670cd0dec861e7fe8beb13aa0ba2b0ab0409161036191903690610743565b600081815260016020526040812054900361048b576040517f295a81c100000000000000000000000000000000000000000000000000000000815273ffffffffffffffffffffffffffffffffffffffff7f0000000000000000000000000000000000000000000000000000000000000000166004820152336024820152604401610234565b60008054828252600160205260409091205442916104a891610790565b10156104e0576040517f43dc986d00000000000000000000000000000000000000000000000000000000815260040160405180910390fd5b6000818152600160205260408120556104f8816105bf565b50565b60003361052757507f000000000000000000000000000000000000000000000000000000000000000090565b61052f610134565b90565b600033610527575060005490565b60003361055a575060009081526001602052604090205490565b610562610134565b919050565b60003361052757507f000000000000000000000000000000000000000000000000000000000000000090565b60003361052757507f000000000000000000000000000000000000000000000000000000000000000090565b807f4c109d85bcd0bb5c735b4be850953d652afe4cd9aa2e0b1426a65a4dcb2e12296000366040516105f2929190610743565b60405180910390a26000807f000000000000000000000000000000000000000000000000000000000000000073ffffffffffffffffffffffffffffffffffffffff16600036604051610645929190610733565b6000604051808303816000865af19150503d8060008114610682576040519150601f19603f3d011682016040523d82523d6000602084013e610687565b606091505b50909250905081151560010361069f57805160208201f35b805160208201fd5b600060208083528351808285015260005b818110156106d4578581018301518582016040015282016106b8565b818111156106e6576000604083870101525b50601f017fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffe016929092016040019392505050565b60006020828403121561072c57600080fd5b5035919050565b8183823760009101908152919050565b60208152816020820152818360408301376000818301604090810191909152601f9092017fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffe0160101919050565b600082198211156107ca577f4e487b7100000000000000000000000000000000000000000000000000000000600052601160045260246000fd5b50019056fea164736f6c634300080f000a"
+
+func init() {
+	if err := json.Unmarshal([]byte(DelayedVetoableStorageLayoutJSON), DelayedVetoableStorageLayout); err != nil {
+		panic(err)
+	}
+
+	layouts["DelayedVetoable"] = DelayedVetoableStorageLayout
+	deployedBytecodes["DelayedVetoable"] = DelayedVetoableDeployedBin
+}

packages/contracts-bedrock/.gas-snapshot

@@ -46,6 +46,9 @@ CrossDomainOwnable3_Test:test_transferOwnership_zeroAddress_reverts() (gas: 1208
 CrossDomainOwnableThroughPortal_Test:test_depositTransaction_crossDomainOwner_succeeds() (gas: 81417)
 CrossDomainOwnable_Test:test_onlyOwner_notOwner_reverts() (gas: 10597)
 CrossDomainOwnable_Test:test_onlyOwner_succeeds() (gas: 34883)
+DelayedVetoable_Getters_Test:test_getters() (gas: 21342)
+DelayedVetoable_Getters_TestFail:test_getters_notZeroAddress_reverts() (gas: 26649)
+DelayedVetoable_HandleCall_TestFail:test_handleCall_unauthorizedInitiation_reverts() (gas: 20234)
 DeleteOutput:test_script_succeeds() (gas: 3100)
 DeployerWhitelist_Test:test_owner_succeeds() (gas: 7582)
 DeployerWhitelist_Test:test_storageSlots_succeeds() (gas: 33395)

packages/contracts-bedrock/semver-lock.json

 {
   "src/EAS/EAS.sol": "0x1acb25751a1206eb859cc5fcf934da2f84cfb907b8e8951d86fc4e43c53a7303",
   "src/EAS/SchemaRegistry.sol": "0x305f3afed2e337cd70aac70fc202e6503b947b0a31e0d4e18c49486eeb635bb5",
+  "src/L1/DelayedVetoable.sol": "0x276c6276292095e6aa37a70008cf4e0d1cbcc020dbc9107459bbc72ab5ed744f",
   "src/L1/L1CrossDomainMessenger.sol": "0x14f5991022705b8bd3bf931e138a528cc9c9e90d0f1ec398efd5079224d61b3b",
   "src/L1/L1ERC721Bridge.sol": "0x3e0e3d2f4c151e41585850f06e6452cdda86348debfe6ff16e364a839266450b",
   "src/L1/L1StandardBridge.sol": "0x12e227c6054660a83b92d823a7447db96a7d476b7a94e0f1807772d400329880",

packages/contracts-bedrock/src/L1/DelayedVetoable.sol

+// SPDX-License-Identifier: MIT
+pragma solidity 0.8.15;
+
+import { ISemver } from "src/universal/ISemver.sol";
+
+/// @title DelayedVetoable
+/// @notice This contract enables a delay before a call is forwarded to a target contract, and during the delay period
+///         the call can be vetoed by the authorized vetoer.
+///         This contract does not support value transfers, only data is forwarded.
+///         Additionally, this contract cannot be used to forward calls with data beginning with the function selector
+///         of the queuedAt(bytes32) function. This is because of input validation checks which solidity performs at
+///         runtime on functions which take an argument.
+contract DelayedVetoable is ISemver {
+    /// @notice Error for when the delay has already been set.
+    error AlreadyDelayed();
+
+    /// @notice Error for when attempting to forward too early.
+    error ForwardingEarly();
+
+    /// @notice Error for the target is not set.
+    error TargetUnitialized();
+
+    /// @notice Error for unauthorized calls.
+    error Unauthorized(address expected, address actual);
+
+    /// @notice An event that is emitted when the delay is activated.
+    /// @param delay The delay that was activated.
+    event DelayActivated(uint256 delay);
+
+    /// @notice An event that is emitted when a call is initiated.
+    /// @param callHash The hash of the call data.
+    /// @param data The data of the initiated call.
+    event Initiated(bytes32 indexed callHash, bytes data);
+
+    /// @notice An event that is emitted each time a call is forwarded.
+    /// @param callHash The hash of the call data.
+    /// @param data The data forwarded to the target.
+    event Forwarded(bytes32 indexed callHash, bytes data);
+
+    /// @notice An event that is emitted each time a call is vetoed.
+    /// @param callHash The hash of the call data.
+    /// @param data The data forwarded to the target.
+    event Vetoed(bytes32 indexed callHash, bytes data);
+
+    /// @notice The address that all calls are forwarded to after the delay.
+    address internal immutable TARGET;
+
+    /// @notice The address that can veto a call.
+    address internal immutable VETOER;
+
+    /// @notice The address that can initiate a call.
+    address internal immutable INITIATOR;
+
+    /// @notice The delay which will be set after the initial system deployment is completed.
+    uint256 internal immutable OPERATING_DELAY;
+
+    /// @notice The current amount of time to wait before forwarding a call.
+    uint256 internal _delay;
+
+    /// @notice The time that a call was initiated.
+    mapping(bytes32 => uint256) internal _queuedAt;
+
+    /// @notice A modifier that reverts if not called by the vetoer or by address(0) to allow
+    ///         eth_call to interact with this proxy without needing to use low-level storage
+    ///         inspection. We assume that nobody is able to trigger calls from address(0) during
+    ///         normal EVM execution.
+    modifier readOrHandle() {
+        if (msg.sender == address(0)) {
+            _;
+        } else {
+            // This WILL halt the call frame on completion.
+            _handleCall();
+        }
+    }
+
+    /// @notice Semantic version.
+    /// @custom:semver 1.0.0
+    string public constant version = "1.0.0";
+
+    /// @notice Sets the target admin during contract deployment.
+    /// @param vetoer_ Address of the vetoer.
+    /// @param initiator_ Address of the initiator.
+    /// @param target_ Address of the target.
+    /// @param operatingDelay_ Time to delay when the system is operational.
+    constructor(address vetoer_, address initiator_, address target_, uint256 operatingDelay_) {
+        // Note that the _delay value is not set here. Having an initial delay of 0 is helpful
+        // during the deployment of a new system.
+        VETOER = vetoer_;
+        INITIATOR = initiator_;
+        TARGET = target_;
+        OPERATING_DELAY = operatingDelay_;
+    }
+
+    /// @notice Gets the initiator
+    /// @return initiator_ Initiator address.
+    function initiator() external virtual readOrHandle returns (address initiator_) {
+        initiator_ = INITIATOR;
+    }
+
+    //// @notice Queries the vetoer address.
+    /// @return vetoer_ Vetoer address.
+    function vetoer() external virtual readOrHandle returns (address vetoer_) {
+        vetoer_ = VETOER;
+    }
+
+    //// @notice Queries the target address.
+    /// @return target_ Target address.
+    function target() external readOrHandle returns (address target_) {
+        target_ = TARGET;
+    }
+
+    /// @notice Gets the delay
+    /// @return delay_ Delay address.
+    function delay() external readOrHandle returns (uint256 delay_) {
+        delay_ = _delay;
+    }
+
+    /// @notice Gets entries in the _queuedAt mapping.
+    /// @param callHash The hash of the call data.
+    /// @return queuedAt_ The time the callHash was recorded.
+    function queuedAt(bytes32 callHash) external readOrHandle returns (uint256 queuedAt_) {
+        queuedAt_ = _queuedAt[callHash];
+    }
+
+    /// @notice Used for all calls that pass data to the contract.
+    fallback() external {
+        _handleCall();
+    }
+
+    /// @notice Receives all calls other than those made by the vetoer.
+    ///         This enables transparent initiation and forwarding of calls to the target and avoids
+    ///         the need for additional layers of abi encoding.
+    function _handleCall() internal {
+        // The initiator and vetoer activate the delay by passing in null data.
+        if (msg.data.length == 0 && _delay == 0) {
+            if (msg.sender != INITIATOR && msg.sender != VETOER) {
+                revert Unauthorized(INITIATOR, msg.sender);
+            }
+            _delay = OPERATING_DELAY;
+            emit DelayActivated(_delay);
+            return;
+        }
+
+        bytes32 callHash = keccak256(msg.data);
+
+        // Case 1: The initiator is calling the contract to initiate a call.
+        if (msg.sender == INITIATOR && _queuedAt[callHash] == 0) {
+            if (_delay == 0) {
+                // This forward function will halt the call frame on completion.
+                _forwardAndHalt(callHash);
+            }
+            _queuedAt[callHash] = block.timestamp;
+            emit Initiated(callHash, msg.data);
+            return;
+        }
+
+        // Case 2: The vetoer is calling the contract to veto a call.
+        // Note: The vetoer retains the ability to veto even after the delay has passed. This makes censoring the vetoer
+        //       more costly, as there is no time limit after which their transaction can be included.
+        if (msg.sender == VETOER && _queuedAt[callHash] != 0) {
+            delete _queuedAt[callHash];
+            emit Vetoed(callHash, msg.data);
+            return;
+        }
+
+        // Case 3: The call is from an unpermissioned actor. We'll forward the call if the delay has
+        // passed.
+        if (_queuedAt[callHash] == 0) {
+            // The call has not been initiated, so we'll treat this is an unauthorized initiation attempt.
+            revert Unauthorized(INITIATOR, msg.sender);
+        }
+
+        if (_queuedAt[callHash] + _delay < block.timestamp) {
+            // Not enough time has passed, so we'll revert.
+            revert ForwardingEarly();
+        }
+
+        // Delete the call to prevent replays
+        delete _queuedAt[callHash];
+        _forwardAndHalt(callHash);
+    }
+
+    /// @notice Forwards the call to the target and halts the call frame.
+    function _forwardAndHalt(bytes32 callHash) internal {
+        // Forward the call
+        emit Forwarded(callHash, msg.data);
+        (bool success, bytes memory returndata) = TARGET.call(msg.data);
+        if (success == true) {
+            assembly {
+                return(add(returndata, 0x20), mload(returndata))
+            }
+        } else {
+            assembly {
+                revert(add(returndata, 0x20), mload(returndata))
+            }
+        }
+    }
+}

packages/contracts-bedrock/test/DelayedVetoable.t.sol

+// SPDX-License-Identifier: MIT
+pragma solidity 0.8.15;
+
+import { CommonTest } from "./CommonTest.t.sol";
+import { DelayedVetoable } from "src/L1/DelayedVetoable.sol";
+
+contract DelayedVetoable_Init is CommonTest {
+    error Unauthorized(address expected, address actual);
+    error ForwardingEarly();
+
+    event Initiated(bytes32 indexed callHash, bytes data);
+    event Forwarded(bytes32 indexed callHash, bytes data);
+    event Vetoed(bytes32 indexed callHash, bytes data);
+
+    address target = address(0xabba);
+    address initiator = alice;
+    address vetoer = bob;
+    uint256 operatingDelay = 14 days;
+    DelayedVetoable delayedVetoable;
+
+    function setUp() public override {
+        super.setUp();
+        delayedVetoable = new DelayedVetoable({
+            initiator_: alice,
+            vetoer_: bob,
+            target_: address(target),
+            operatingDelay_: operatingDelay
+        });
+
+        // Most tests will use the operating delay, so we call as the initiator with null data
+        // to set the delay. For tests that need to use the initial zero delay, we'll modify the
+        // value in storage.
+        vm.prank(initiator);
+        (bool success,) = address(delayedVetoable).call(hex"");
+    }
+
+    /// @dev This function is used to prevent initiating the delay unintentionally..
+    /// @param data The data to be used in the call.
+    function assumeNonzeroData(bytes memory data) internal pure {
+        vm.assume(data.length > 0);
+    }
+}
+
+contract DelayedVetoable_Getters_Test is DelayedVetoable_Init {
+    /// @dev The getters return the expected values when called by the zero address.
+    function test_getters() external {
+        vm.startPrank(address(0));
+        assertEq(delayedVetoable.initiator(), initiator);
+        assertEq(delayedVetoable.vetoer(), vetoer);
+        assertEq(delayedVetoable.target(), target);
+        assertEq(delayedVetoable.delay(), operatingDelay);
+    }
+}
+
+contract DelayedVetoable_Getters_TestFail is DelayedVetoable_Init {
+    /// @dev Check that getter calls from unauthorized entities will revert.
+    function test_getters_notZeroAddress_reverts() external {
+        vm.expectRevert(abi.encodeWithSelector(Unauthorized.selector, initiator, address(this)));
+        delayedVetoable.initiator();
+        vm.expectRevert(abi.encodeWithSelector(Unauthorized.selector, initiator, address(this)));
+        delayedVetoable.vetoer();
+        vm.expectRevert(abi.encodeWithSelector(Unauthorized.selector, initiator, address(this)));
+        delayedVetoable.target();
+        vm.expectRevert(abi.encodeWithSelector(Unauthorized.selector, initiator, address(this)));
+        delayedVetoable.delay();
+    }
+}
+
+contract DelayedVetoable_HandleCall_Test is DelayedVetoable_Init {
+    /// @dev A call can be initiated by the initiator.
+    function testFuzz_handleCall_initiation_succeeds(bytes memory data) external {
+        assumeNonzeroData(data);
+
+        vm.expectEmit(true, false, false, true, address(delayedVetoable));
+        emit Initiated(keccak256(data), data);
+
+        vm.prank(initiator);
+        (bool success,) = address(delayedVetoable).call(data);
+        assertTrue(success);
+    }
+
+    /// @dev The delay is inititially set to zero and the call is immediately forwarded.
+    function testFuzz_handleCall_initialForwardingImmediately_succeeds(
+        bytes calldata inData,
+        bytes calldata outData
+    )
+        external
+    {
+        assumeNonzeroData(inData);
+        if (inData.length >= 4) {
+            vm.assume(bytes4(inData[0:4]) != bytes4(keccak256("queuedAt(bytes32)")));
+        }
+
+        // Reset the delay to zero
+        vm.store(address(delayedVetoable), bytes32(uint256(0)), bytes32(uint256(0)));
+
+        vm.mockCall(target, inData, outData);
+        vm.expectEmit(true, false, false, true, address(delayedVetoable));
+        vm.expectCall({ callee: target, data: inData });
+        emit Forwarded(keccak256(inData), inData);
+        vm.prank(initiator);
+        (bool success, bytes memory returnData) = address(delayedVetoable).call(inData);
+        assertTrue(success);
+        assertEq(returnData, outData);
+    }
+
+    /// @dev The delay can be activated by the vetoer or initiator, and are not forwarded until the delay has passed
+    ///      once activated.
+    function testFuzz_handleCall_forwardingWithDelay_succeeds(bytes memory data) external {
+        assumeNonzeroData(data);
+
+        vm.prank(initiator);
+        (bool success,) = address(delayedVetoable).call(data);
+
+        // Check that the call is in the _queuedAt mapping
+        bytes32 callHash = keccak256(data);
+        vm.prank(address(0));
+        assertEq(delayedVetoable.queuedAt(callHash), block.timestamp);
+
+        vm.warp(block.timestamp + operatingDelay);
+        vm.expectEmit(true, false, false, true, address(delayedVetoable));
+        emit Forwarded(keccak256(data), data);
+
+        vm.expectCall({ callee: target, data: data });
+        (success,) = address(delayedVetoable).call(data);
+        assertTrue(success);
+    }
+}
+
+contract DelayedVetoable_HandleCall_TestFail is DelayedVetoable_Init {
+    /// @dev The delay is inititially set to zero and the call is immediately forwarded.
+    function test_handleCall_unauthorizedInitiation_reverts() external {
+        vm.expectRevert(abi.encodeWithSelector(Unauthorized.selector, initiator, address(this)));
+        (bool success,) = address(delayedVetoable).call(NON_ZERO_DATA);
+    }
+
+    /// @dev The call cannot be forewarded until the delay has passed.
+    function testFuzz_handleCall_forwardingTooSoon_reverts(bytes memory data) external {
+        vm.prank(initiator);
+        (bool success,) = address(delayedVetoable).call(data);
+
+        vm.expectRevert(abi.encodeWithSelector(ForwardingEarly.selector));
+        (success,) = address(delayedVetoable).call(data);
+    }
+
+    /// @dev The call cannot be forwarded a second time.
+    function testFuzz_handleCall_forwardingTwice_reverts(bytes memory data) external {
+        assumeNonzeroData(data);
+
+        // Initiate the call
+        vm.prank(initiator);
+        (bool success,) = address(delayedVetoable).call(data);
+
+        vm.warp(block.timestamp + operatingDelay);
+        vm.expectEmit(true, false, false, true, address(delayedVetoable));
+        emit Forwarded(keccak256(data), data);
+
+        // Forward the call
+        vm.expectCall({ callee: target, data: data });
+        (success,) = address(delayedVetoable).call(data);
+        assertTrue(success);
+
+        // Attempt to foward the same call again.
+        vm.expectRevert(abi.encodeWithSelector(Unauthorized.selector, initiator, address(this)));
+        (success,) = address(delayedVetoable).call(data);
+        assertTrue(success);
+    }
+
+    /// @dev If the target reverts, it is bubbled up.
+    function testFuzz_handleCall_forwardingTargetReverts_reverts(bytes memory inData, bytes memory outData) external {
+        assumeNonzeroData(inData);
+
+        // Initiate the call
+        vm.prank(initiator);
+        (bool success,) = address(delayedVetoable).call(inData);
+
+        vm.warp(block.timestamp + operatingDelay);
+        vm.expectEmit(true, false, false, true, address(delayedVetoable));
+        emit Forwarded(keccak256(inData), inData);
+
+        vm.mockCallRevert(target, inData, outData);
+
+        // Forward the call
+        vm.expectRevert(outData);
+        (bool success2,) = address(delayedVetoable).call(inData);
+    }
+
+    /// @dev A test documenting the single instance in which the contract is not 'transparent' to the initiator.
+    function testFuzz_handleCall_queuedAtClash_reverts(bytes memory outData) external {
+        // This will get us calldata with the same function selector as the queuedAt function, but
+        // with the incorrect input data length.
+        bytes memory inData = abi.encodePacked(keccak256("queuedAt(bytes32)"));
+
+        // Reset the delay to zero
+        vm.store(address(delayedVetoable), bytes32(uint256(0)), bytes32(uint256(0)));
+
+        vm.prank(initiator);
+        vm.expectRevert(outData);
+        (bool success,) = address(delayedVetoable).call(inData);
+    }
+}