Skip to content

Conversation

@simonDos
Copy link
Member

@simonDos simonDos commented May 27, 2025

This PR prepares VaultBridge to be deploy on Katana.

An important fix has been added in src/CustomToken.sol to allow bridging to address(0).
Other than that, the contracts itself are untouched.

Version is still 0.5.0 as this is only the 2nd part of the deployment, now on Katana.

Deployment scripts are:

  • script/DeployLayerY.s.sol
  • script/DeployLayerY_WETH.s.sol

The script/input.json at 747474 contains all important deployment configurations, settings and addresses.
It needs to be thoroughly reviewed.

The scripts print payloads for upgrading the custom tokens (bridge-wrapped vbTokens).
These will need to be executed (in bulk) by the Polygon Engineering Multisig on Katana:
0x4e981bAe8E3cd06Ca911ffFE5504B2653ac1C38a

@ZeroEkkusu ZeroEkkusu self-requested a review May 27, 2025 18:42
Copy link
Member

@ZeroEkkusu ZeroEkkusu left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  1. Some things need to be changed. Please see the suggestions.
  2. Native Converters are not configured in Migration Manager on Layer X.
  3. v0.5.0 is already released. We will need to make a new release after the deployment. Please merge #25 for proper versioning.


string memory vbETHSlug = string(abi.encodePacked('["', vm.toString(block.chainid), '"]', '.["vbETH"]'));

address vbWETH = input.readAddress(string.concat(vbETHSlug, ".customToken"));

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Recommended to Use CustomToken and underlying token. Using vbETH for W-vbETH and WETH for W-WETH is misleading.


for (uint256 i = 0; i < vbTokens.length; i++) {
address nativeConverter =
input.readAddress(string.concat(migrationManagerSlug, ".", vbTokens[i], "NativeConverter"));

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Beware that all input.json "vbTokens[i].NativeConverters" are still fake (all of them are using address 0x000059dE96F9C28e3a343b831cbDC2B93c8C4855) , so we MUST update them once we have each of the NativeConverters deployed. Count with us to review before executing.

Comment on lines +9 to +13
"vbUSDSNativeConverter": "0x000059dE96F9C28e3a343b831cbDC2B93c8C4855",
"vbUSDTNativeConverter": "0x000059dE96F9C28e3a343b831cbDC2B93c8C4855",
"vbUSDCNativeConverter": "0x000059dE96F9C28e3a343b831cbDC2B93c8C4855",
"vbWBTCNativeConverter": "0x000059dE96F9C28e3a343b831cbDC2B93c8C4855",
"vbETHNativeConverter": "0x000059dE96F9C28e3a343b831cbDC2B93c8C4855",

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please update them before executing the RegisterNativeConverters.s.sol script

"customToken": "0xEE7D8BCFb72bC1880D0Cf19822eB0A2e6577aB62",
"underlyingToken": "0x815955d051C6262C16c720b19D735426254Bec5B",
"owner": "0x2De242e27386e224E5fbF110EA8406d5B70740ec",
"name": "Wrapped Ether",
Copy link

@web3security web3security May 28, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Dangerous breaking change, be careful.

Metadata changes are usually discouraged for every sovereign token. This is due to the fact that if it is sent to a non-upgradeable bridge version in a different network this getTokenMetadata(token) call at https://github.com/agglayer/agglayer-contracts/blob/v10.1.0-rc.5/contracts/v2/PolygonZkEVMBridgeV2.sol#L397 will produce a different token address in destination network as unexpected.

This seems safe for an already deployed "upgradeable token" deployed on Katana coming from a bridge from L1 (mainnet) as it will take tokenInfoHash.originToken but beware that if sent to a 3rd network (with non upgradeable tokens - 99% of them) then it will have side effects.

To avoid address change it is encouraged to use the same metadata.

Here the issue documented https://github.com/0xPolygonHermez/internal-audit/issues/160

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Checking with the Product Team if the naming is crucial. If yes, we can override name, symbol, and decimals functions to report different values to LxLy Bridge.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let me put an example:

  • User sends L1 vbTOK to L2 Katana (gets an upgradeable token 0xA)
  • Katana W-vbTOK token 0xA's owner changes its metadata to a different name / symbol (i.WETH).
  • User sends Katana 0xA W-vbTOK (renamed as WETH) to network LY with a non-uogradeable version (gets a different address 0xB
  • the problem is not 0xA != 0xB because those networks use different bridge type (upgradeable wrapped tokens vs non upgradeable)
  • the problem is that non-upgradeable networks will have different addresses for the same asset depending on whether or not the first deposit came from Katana (with a renamed metadata) or for example L1 with the original naming.
  • so the problem is that if a user sends vbTOK from L1 to LY+1, that W-vbTOK will get an address of 0xC which is different from != 0xB

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The solution I proposed fixes the issue because LxLy Bridge will see the original metadata, while everyone else will see the new metadata. So, the same bridge-wrapped token will be used no matter if you bridge from Ethereum or Katana.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@simonDos Per the internal discussions, revert the naming to Vault Bridge ETH / vbETH.

@simonDos simonDos merged commit 0b005f2 into staging May 29, 2025
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants