Audit fixes #173

GWSzeto · 2024-09-20T17:59:57Z

Addresses the changes found in the audit prelim report for modular contracts

…tokenId when installed after initial minting - updated sequentialTokenIdERC1155 to now be able to initialize nextTokenId

…ens with decimals other than 18 - uses IERC20.decimals instead of 1e18

joaquim-verges · 2024-09-28T20:20:14Z

src/module/token/tokenId/SequentialTokenIdERC1155.sol

+    //////////////////////////////////////////////////////////////*/
+
+    /// @dev Returns bytes encoded install params, to be sent to `onInstall` function
+    function encodeBytesOnInstall(uint256 nextTokenId) external pure returns (bytes memory) {


Would call this startTokenId to be clear of what it is

joaquim-verges · 2024-09-28T20:22:25Z

src/module/token/metadata/BatchMetadataERC721.sol

        uint256 nextTokenIdRangeStart;
-        // tokenId range end => baseURI of range
-        mapping(uint256 => string) baseURIOfTokenIdRange;
+        // tokenId range end


Update comment?

joaquim-verges · 2024-09-28T20:24:58Z

src/module/token/metadata/BatchMetadataERC721.sol

-        (uint256 startTokenId,) = getBatchRange(_batchId);
-        emit BatchMetadataUpdate(startTokenId, _batchId);
+    /// @dev Sets the base URI for the batch based on the batchIndex.
+    function setBaseURI(uint256 _batchIndex, string memory _baseURI) external virtual {


Would help me to have a list of ABI changes, hard to see from this pr

* [L-4] Wrong function selector returned for the transfer validation function (#150) * [L-4] Wrong function selector returned for the transfer validation function * [Q-3] Move interface identifier for ERC165 to Core * [Q-5] Royalty modules should inherit ICreatorToken interface * [Q-6] Nitpicks * removes duplicate supportsInterface (#156) * Has roles (#158) * created hasRole function in the roylaty module * created tests * Merge dev to main (#163) * renamed to nextTokenIdToMint in BatchMetadata (#141) * fix: expectRevert on low-level call (#136) * update batchMetadata logic to make each batchUris independent (#144) * update batchMetadata logic to make each batchUris independent * format * Module Core Refactor (#145) * separated out metadata functionality from mintable module * built in signature mint into the core erc721 contract * implemented in Mintable * Implemented updateMetadata * simplified parameters and structs * all tests pass * updated ERC721 initializable to match ERC721Core * addressed the PR issues * updated 1155 versions to now match 721 implementations * completed all the tests * Implemented parity in the ERC1155Initializable contract * unified naming from quantity and value to amount * slapped on a keccak256 * move OwnableRoles check on the signature * removed double events being emitted * tests pass * updated ERC20 core * implemented Claimable and Mintable on the ERC20 side * tests pass * updated based on PR feedback * Fix getSupportedCallbackFunctions ub ERC721CoreInitializable (#149) * implmented delayed functionality into batchMetadata (#148) * implmented delayed functionality into batchMetadata * created tests for BatchMetadata * updated ERC1155 tests and updated from batchStartId to batchRange * Implement tokenIdERC1155 module to handle tokenId management (#147) * initial commit * created tests for tokenIdERC1155 * updated to be optional * updated naming and tests * Transfer validator has roles (#143) * created hasRole function in the roylaty module * created tests * Optimzed callback execution (#135) * gas benchmark * optimize execute callback function * fix typo * optimize execute callback view function * optimize callback mode loop * Implement Max per wallet (#151) * implemented maxMintPerWallet * tests pass * maxMintPerWalletExceeded tests pass * introduced base contracts for core and initilizable to inherit * rename commit * rename commit * renamed from core to coreInitializable for the ERC1155 (#152) * updated to now use 1e18 divided (#153) * Remove double initializer in ERC721CoreInitializable (#154) * rebase off of main (#157) * [L-4] Wrong function selector returned for the transfer validation function (#150) * [L-4] Wrong function selector returned for the transfer validation function * [Q-3] Move interface identifier for ERC165 to Core * [Q-5] Royalty modules should inherit ICreatorToken interface * [Q-6] Nitpicks * removes duplicate supportsInterface (#156) * renamed to nextTokenIdToMint in BatchMetadata (#141) * fix: expectRevert on low-level call (#136) * update batchMetadata logic to make each batchUris independent (#144) * update batchMetadata logic to make each batchUris independent * format * Module Core Refactor (#145) * separated out metadata functionality from mintable module * built in signature mint into the core erc721 contract * implemented in Mintable * Implemented updateMetadata * simplified parameters and structs * all tests pass * updated ERC721 initializable to match ERC721Core * addressed the PR issues * updated 1155 versions to now match 721 implementations * completed all the tests * Implemented parity in the ERC1155Initializable contract * unified naming from quantity and value to amount * slapped on a keccak256 * move OwnableRoles check on the signature * removed double events being emitted * tests pass * updated ERC20 core * implemented Claimable and Mintable on the ERC20 side * tests pass * updated based on PR feedback * Fix getSupportedCallbackFunctions ub ERC721CoreInitializable (#149) * implmented delayed functionality into batchMetadata (#148) * implmented delayed functionality into batchMetadata * created tests for BatchMetadata * updated ERC1155 tests and updated from batchStartId to batchRange * Implement tokenIdERC1155 module to handle tokenId management (#147) * initial commit * created tests for tokenIdERC1155 * updated to be optional * updated naming and tests * Transfer validator has roles (#143) * created hasRole function in the roylaty module * created tests * Optimzed callback execution (#135) * gas benchmark * optimize execute callback function * fix typo * optimize execute callback view function * optimize callback mode loop * Implement Max per wallet (#151) * implemented maxMintPerWallet * tests pass * maxMintPerWalletExceeded tests pass * introduced base contracts for core and initilizable to inherit * rename commit * rename commit * renamed from core to coreInitializable for the ERC1155 (#152) * updated to now use 1e18 divided (#153) * Remove double initializer in ERC721CoreInitializable (#154) --------- Co-authored-by: Pranav Garg <[email protected]> Co-authored-by: Joaquim Verges <[email protected]> * Duplicate constant (#161) * [L-4] Wrong function selector returned for the transfer validation function (#150) * [L-4] Wrong function selector returned for the transfer validation function * [Q-3] Move interface identifier for ERC165 to Core * [Q-5] Royalty modules should inherit ICreatorToken interface * [Q-6] Nitpicks * removes duplicate supportsInterface (#156) * Has roles (#158) * created hasRole function in the roylaty module * created tests * removed duplicate constant in royaltyERC721 * removed .vscode * case sensitivity issue --------- Co-authored-by: Pranav Garg <[email protected]> Co-authored-by: Joaquim Verges <[email protected]> * added hasRole to creatorTokenERC20 module (#167) * Audit fixes (#173) * [M-1] The SequentialTokenIdERC1155 module fails to apply the correct tokenId when installed after initial minting - updated sequentialTokenIdERC1155 to now be able to initialize nextTokenId * [H-1] ClaimableERC20 and MintableERC20 modules incorrectly handle tokens with decimals other than 18 - uses IERC20.decimals instead of 1e18 * [H-2] Claimable modules lead to storage collisions when being updgraded * [H-3] BatchMetadata modules may apply baseURI to incorrect token ids * [Q-1] FallbackFunction array of Claimable modules can be reduced * [Q-2] Nitpicks --------- Co-authored-by: Pranav Garg <[email protected]> Co-authored-by: Joaquim Verges <[email protected]>

GWSzeto force-pushed the audit-fixes branch 2 times, most recently from 70b53eb to a351d1a Compare September 20, 2024 18:11

GWSzeto added 2 commits September 27, 2024 14:16

[M-1] The SequentialTokenIdERC1155 module fails to apply the correct …

9954d2b

…tokenId when installed after initial minting - updated sequentialTokenIdERC1155 to now be able to initialize nextTokenId

[H-1] ClaimableERC20 and MintableERC20 modules incorrectly handle tok…

0e580cd

…ens with decimals other than 18 - uses IERC20.decimals instead of 1e18

GWSzeto force-pushed the audit-fixes branch from a351d1a to 0e580cd Compare September 27, 2024 18:17

[H-2] Claimable modules lead to storage collisions when being updgraded

a58c573

GWSzeto force-pushed the audit-fixes branch 2 times, most recently from c8030b9 to 2adab3b Compare September 28, 2024 18:59

joaquim-verges reviewed Sep 28, 2024

View reviewed changes

GWSzeto force-pushed the audit-fixes branch from 2adab3b to 5a4848c Compare September 30, 2024 19:04

GWSzeto added 3 commits October 4, 2024 12:13

[H-3] BatchMetadata modules may apply baseURI to incorrect token ids

5a90834

[Q-1] FallbackFunction array of Claimable modules can be reduced

5765962

[Q-2] Nitpicks

7437f5b

GWSzeto force-pushed the audit-fixes branch from 5a4848c to 7437f5b Compare October 4, 2024 16:16

kumaryash90 approved these changes Oct 9, 2024

View reviewed changes

GWSzeto merged commit be6f40a into main Oct 9, 2024
5 checks passed

GWSzeto deleted the audit-fixes branch October 9, 2024 15:59

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Audit fixes #173

Audit fixes #173

Uh oh!

GWSzeto commented Sep 20, 2024 •

edited

Loading

Uh oh!

joaquim-verges Sep 28, 2024

Uh oh!

GWSzeto Sep 30, 2024

Uh oh!

joaquim-verges Sep 28, 2024

Uh oh!

GWSzeto Sep 30, 2024

Uh oh!

joaquim-verges Sep 28, 2024

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Audit fixes #173

Audit fixes #173

Uh oh!

Conversation

GWSzeto commented Sep 20, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

joaquim-verges Sep 28, 2024

Choose a reason for hiding this comment

Uh oh!

GWSzeto Sep 30, 2024

Choose a reason for hiding this comment

Uh oh!

joaquim-verges Sep 28, 2024

Choose a reason for hiding this comment

Uh oh!

GWSzeto Sep 30, 2024

Choose a reason for hiding this comment

Uh oh!

joaquim-verges Sep 28, 2024

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

GWSzeto commented Sep 20, 2024 •

edited

Loading