Skip to content

Commit ed565f4

Browse files
ericglauericglau
authored
Add check to ensure initialOwner is not a ProxyAdmin contract when deploying a transparent proxy (#1083)
1 parent 43ceae1 commit ed565f4

File tree

13 files changed

+163
-4
lines changed

13 files changed

+163
-4
lines changed

‎docs/modules/ROOT/pages/api-hardhat-upgrades.adoc‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,8 @@ The following options are common to some functions.
2222
* `constructorArgs`: (`unknown[]`) Provide arguments for the constructor of the implementation contract. Note that these are different from initializer arguments, and will be used in the deployment of the implementation contract itself. Can be used to initialize immutable variables.
2323
* `initialOwner`: (`string`) the address to set as the initial owner of a transparent proxy's admin or initial owner of a beacon. Defaults to the externally owned account that is deploying the transparent proxy or beacon. Not supported for UUPS proxies.
2424
** *Since:* `@openzeppelin/[email protected]`
25+
* `unsafeSkipProxyAdminCheck`: (`boolean`) Skips checking the `initialOwner` option when deploying a transparent proxy. When deploying a transparent proxy, the `initialOwner` must be the address of an EOA or a contract that can call functions on a ProxyAdmin. It must not be a ProxyAdmin contract itself. Use this if you encounter an error due to this check and are sure that the `initialOwner` is not a ProxyAdmin contract.
26+
** *Since:* `@openzeppelin/[email protected]`
2527
* `timeout`: (`number`) Timeout in milliseconds to wait for the transaction confirmation when deploying an implementation contract. Defaults to `60000`. Use `0` to wait indefinitely.
2628
* `pollingInterval`: (`number`) Polling interval in milliseconds between checks for the transaction confirmation when deploying an implementation contract. Defaults to `5000`.
2729
* `redeployImplementation`: (`"always" | "never" | "onchange"`) Determines whether the implementation contract will be redeployed. Defaults to `"onchange"`.
@@ -56,6 +58,7 @@ async function deployProxy(
5658
unsafeAllow?: ValidationError[],
5759
constructorArgs?: unknown[],
5860
initialOwner?: string,
61+
unsafeSkipProxyAdminCheck?: boolean,
5962
timeout?: number,
6063
pollingInterval?: number,
6164
redeployImplementation?: 'always' | 'never' | 'onchange',

‎packages/core/CHANGELOG.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,9 @@
11
# Changelog
22

3+
## 1.38.0 (2024-09-23)
4+
5+
- Supports checking to ensure `initialOwner` is not a ProxyAdmin contract when deploying a transparent proxy from Hardhat. ([#1083](https://github.com/OpenZeppelin/openzeppelin-upgrades/pull/1083))
6+
37
## 1.37.1 (2024-09-09)
48

59
- Fix Hardhat compile error when using solc version `0.8.27`. ([#1075](https://github.com/OpenZeppelin/openzeppelin-upgrades/pull/1075))

‎packages/core/package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "@openzeppelin/upgrades-core",
3-
"version": "1.37.1",
3+
"version": "1.38.0",
44
"description": "",
55
"repository": "https://github.com/OpenZeppelin/openzeppelin-upgrades/tree/master/packages/core",
66
"license": "MIT",

‎packages/core/src/index.ts‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -62,3 +62,4 @@ export { ValidateUpgradeSafetyOptions, validateUpgradeSafety, ProjectReport, Ref
6262
export { getUpgradeInterfaceVersion } from './upgrade-interface-version';
6363
export { makeNamespacedInput } from './utils/make-namespaced';
6464
export { isNamespaceSupported } from './storage/namespace';
65+
export { inferProxyAdmin } from './infer-proxy-admin';

‎packages/core/src/infer-proxy-admin.test.ts‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
import test from 'ava';
2+
import { EthereumProvider } from './provider';
3+
import { inferProxyAdmin } from './infer-proxy-admin';
4+
5+
const addr = '0x123';
6+
7+
function makeProviderReturning(result: unknown): EthereumProvider {
8+
return { send: (_method: string, _params: unknown[]) => Promise.resolve(result) } as EthereumProvider;
9+
}
10+
11+
function makeProviderError(msg: string): EthereumProvider {
12+
return {
13+
send: (_method: string, _params: unknown[]) => {
14+
throw new Error(msg);
15+
},
16+
} as EthereumProvider;
17+
}
18+
19+
test('inferProxyAdmin returns true when owner looks like an address', async t => {
20+
// abi encoding of address 0x1000000000000000000000000000000000000123
21+
const provider = makeProviderReturning('0x0000000000000000000000001000000000000000000000000000000000000123');
22+
t.true(await inferProxyAdmin(provider, addr));
23+
});
24+
25+
test('inferProxyAdmin returns false when returned value is 32 bytes but clearly not an address', async t => {
26+
// dirty upper bits beyond 20 bytes (the 'abc' in the below)
27+
const provider = makeProviderReturning('0x000000000000000000000abc1000000000000000000000000000000000000123');
28+
t.false(await inferProxyAdmin(provider, addr));
29+
});
30+
31+
test('inferProxyAdmin returns false when returned value is a string', async t => {
32+
// abi encoding of string 'foo'
33+
const provider = makeProviderReturning(
34+
'0x00000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000003666f6f0000000000000000000000000000000000000000000000000000000000',
35+
);
36+
t.false(await inferProxyAdmin(provider, addr));
37+
});
38+
39+
test('inferProxyAdmin throws unrelated error', async t => {
40+
const provider = makeProviderError('unrelated error');
41+
await t.throwsAsync(() => inferProxyAdmin(provider, addr), { message: 'unrelated error' });
42+
});
43+
44+
test('inferProxyAdmin returns false for invalid selector', async t => {
45+
const provider = makeProviderError(
46+
`Transaction reverted: function selector was not recognized and there's no fallback function`,
47+
);
48+
t.false(await inferProxyAdmin(provider, addr));
49+
});

‎packages/core/src/infer-proxy-admin.ts‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
import { callOptionalSignature } from './call-optional-signature';
2+
import { EthereumProvider } from './provider';
3+
import { parseAddress } from './utils/address';
4+
5+
/**
6+
* Infers whether the address might be a ProxyAdmin contract, by checking if it has an owner() function that returns an address.
7+
* @param provider Ethereum provider
8+
* @param possibleContractAddress The address to check
9+
* @returns true if the address might be a ProxyAdmin contract, false otherwise
10+
*/
11+
export async function inferProxyAdmin(provider: EthereumProvider, possibleContractAddress: string): Promise<boolean> {
12+
const owner = await callOptionalSignature(provider, possibleContractAddress, 'owner()');
13+
return owner !== undefined && parseAddress(owner) !== undefined;
14+
}

‎packages/core/src/utils/address.ts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ import { toChecksumAddress } from 'ethereumjs-util';
88
*/
99
export function parseAddress(addressString: string): string | undefined {
1010
const buf = Buffer.from(addressString.replace(/^0x/, ''), 'hex');
11-
if (!buf.slice(0, 12).equals(Buffer.alloc(12, 0))) {
11+
if (!buf.slice(0, 12).equals(Buffer.alloc(12, 0)) || buf.length !== 32) {
1212
return undefined;
1313
}
1414
const address = '0x' + buf.toString('hex', 12, 32); // grab the last 20 bytes

‎packages/plugin-hardhat/CHANGELOG.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,10 @@
11
# Changelog
22

3+
## 3.4.0 (2024-09-23)
4+
5+
### Potentially breaking changes
6+
- Adds a check to ensure `initialOwner` is not a ProxyAdmin contract when deploying a transparent proxy. ([#1083](https://github.com/OpenZeppelin/openzeppelin-upgrades/pull/1083))
7+
38
## 3.3.0 (2024-09-16)
49

510
- Defender: Add `metadata` option. ([#1079](https://github.com/OpenZeppelin/openzeppelin-upgrades/pull/1079))

‎packages/plugin-hardhat/contracts/HasOwner.sol‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
// SPDX-License-Identifier: MIT
2+
pragma solidity ^0.8.20;
3+
4+
import {Ownable} from "@openzeppelin/contracts/access/Ownable.sol";
5+
import {ITransparentUpgradeableProxy} from "@openzeppelin/contracts/proxy/transparent/TransparentUpgradeableProxy.sol";
6+
import {ProxyAdmin} from "@openzeppelin/contracts/proxy/transparent/ProxyAdmin.sol";
7+
8+
/**
9+
* This contract is for testing only.
10+
* Basic but pointless contract that has its own owner and can call ProxyAdmin functions.
11+
*/
12+
contract HasOwner is Ownable {
13+
constructor(address initialOwner) Ownable(initialOwner) {}
14+
15+
function upgradeAndCall(
16+
ProxyAdmin admin,
17+
ITransparentUpgradeableProxy proxy,
18+
address implementation,
19+
bytes memory data
20+
) public payable virtual onlyOwner {
21+
admin.upgradeAndCall{value: msg.value}(proxy, implementation, data);
22+
}
23+
}

‎packages/plugin-hardhat/package.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "@openzeppelin/hardhat-upgrades",
3-
"version": "3.3.0",
3+
"version": "3.4.0",
44
"description": "",
55
"repository": "https://github.com/OpenZeppelin/openzeppelin-upgrades/tree/master/packages/plugin-hardhat",
66
"license": "MIT",
@@ -38,7 +38,7 @@
3838
"@openzeppelin/defender-sdk-base-client": "^1.14.4",
3939
"@openzeppelin/defender-sdk-deploy-client": "^1.14.4",
4040
"@openzeppelin/defender-sdk-network-client": "^1.14.4",
41-
"@openzeppelin/upgrades-core": "^1.35.0",
41+
"@openzeppelin/upgrades-core": "^1.38.0",
4242
"chalk": "^4.1.0",
4343
"debug": "^4.1.1",
4444
"ethereumjs-util": "^7.1.5",

0 commit comments

Comments
 (0)