Implement proxy contract

README.md

@@ -138,6 +138,12 @@ After that call: <br />
 As a result of the function call you will get the address of the freshly deployed `EthCustodian` that you can put in
 your `ethereum-config.json` file in the `ethConnectorAddress` field.
 
+After `ethConnectorAddress` is set, you can run
+
+`$ make eth-deploy-proxy`
+
+to deploy the proxy contract and make it the admin of `EthCustodian`.
+
 ### Other scripts
 
 For more advanced usage, please examine the `hardhat.config.js` file which contains a lot of scripts that are performed

eth-custodian/Makefile

@@ -1,6 +1,6 @@
 .PHONY: compile test
 
-NETWORK=ropsten
+NETWORK=sepolia
 NEAR_NETWORK=testnet
 NEAR_EVM_ACCOUNT=aurora
 NEAR_ACCOUNT=
@@ -38,6 +38,9 @@ eth-get-prover-address:
 eth-deploy-contracts:
 	yarn hardhat run --network ${NETWORK} scripts/eth_deploy_contracts.js
 
+eth-deploy-proxy:
+	yarn hardhat run --network ${NETWORK} scripts/eth_deploy_proxy.js
+
 eth-deposit-to-near:
 	yarn hardhat --network ${NETWORK} eth-deposit-to-near --near-recipient ${NEAR_RECIPIENT} --amount ${AMOUNT} --fee ${FEE}
 

eth-custodian/contracts/EthCustodian.sol

@@ -67,7 +67,7 @@ contract EthCustodian is ProofKeeper, AdminControlled {
 
         string memory protocolMessage = string(
             abi.encodePacked(
-                string(nearProofProducerAccount),
+                string(nearProofProducerAccount_),
                 MESSAGE_SEPARATOR, ethRecipientOnNear
             )
         );

eth-custodian/contracts/EthCustodianProxy.sol

@@ -0,0 +1,133 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+pragma solidity ^0.8;
+import '@openzeppelin/contracts-upgradeable/access/AccessControlUpgradeable.sol';
+import '@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol';
+import '@openzeppelin/contracts-upgradeable/proxy/utils/UUPSUpgradeable.sol';
+import '@openzeppelin/contracts-upgradeable/utils/PausableUpgradeable.sol';
+import {EthCustodian} from './EthCustodian.sol';
+import {SelectivePausableUpgradable} from './SelectivePausableUpgradable.sol';
+
+contract EthCustodianProxy is
+    Initializable,
+    UUPSUpgradeable,
+    AccessControlUpgradeable,
+    SelectivePausableUpgradable
+{
+    bytes32 public constant PAUSABLE_ADMIN_ROLE = keccak256('PAUSABLE_ADMIN_ROLE');
+
+    uint constant UNPAUSED_ALL = 0;
+    uint constant PAUSED_DEPOSIT_TO_EVM = 1 << 0;
+    uint constant PAUSED_DEPOSIT_TO_NEAR = 1 << 1;
+    uint constant PAUSED_WITHDRAW_POST_MIGRATION = 1 << 2;
+    uint constant PAUSED_WITHDRAW_PRE_MIGRATION = 1 << 3;
+
+    error AlreadyMigrated();
+    error ProducerAccountIdTooLong(bytes newProducerAccount);
+    error ProofFromPostMergeBlock();
+
+    bytes public preMigrationProducerAccount;
+    uint64 public migrationBlockHeight;
+
+    EthCustodian public ethCustodianImpl;
+
+    /// @custom:oz-upgrades-unsafe-allow constructor
+    constructor() {
+        _disableInitializers();
+    }
+
+    function initialize(
+        EthCustodian _ethCustodianImpl
+    ) public initializer {
+        ethCustodianImpl = _ethCustodianImpl;
+        __Pausable_init();
+        __AccessControl_init();
+        __UUPSUpgradeable_init();
+        _grantRole(DEFAULT_ADMIN_ROLE, _msgSender());
+        _grantRole(PAUSABLE_ADMIN_ROLE, _msgSender());
+    }
+
+    function depositToNear(
+        string memory nearRecipientAccountId
+    ) external payable whenNotPaused(PAUSED_DEPOSIT_TO_NEAR) {
+        ethCustodianImpl.depositToNear{value: msg.value}(nearRecipientAccountId, 0);
+    }
+
+    function depositToEVM(
+        string memory ethRecipientOnNear
+    ) external payable whenNotPaused(PAUSED_DEPOSIT_TO_EVM) {
+        ethCustodianImpl.depositToEVM{value: msg.value}(ethRecipientOnNear, 0);
+    }
+
+    function withdraw(
+        bytes calldata proofData,
+        uint64 proofBlockHeight
+    ) external {
+        if (proofBlockHeight > migrationBlockHeight) {
+            _requireNotPaused(PAUSED_WITHDRAW_POST_MIGRATION);
+            ethCustodianImpl.withdraw(proofData, proofBlockHeight);
+        } else {
+            _requireNotPaused(PAUSED_WITHDRAW_PRE_MIGRATION);
+            bytes memory postMigrationProducer = ethCustodianImpl.nearProofProducerAccount_();
+            _writeProofProducerSlot(preMigrationProducerAccount);
+            ethCustodianImpl.withdraw(proofData, proofBlockHeight);
+            _writeProofProducerSlot(postMigrationProducer);
+        }
+    }
+
+    function migrateToNewProofProducer(
+        bytes calldata newProducerAccount,
+        uint64 migrationBlockNumber
+    ) external onlyRole(DEFAULT_ADMIN_ROLE) {
+        if (keccak256(preMigrationProducerAccount) != keccak256(hex"")) {
+            revert AlreadyMigrated();
+        }
+
+        // Needs to fit in one slot
+        if (newProducerAccount.length > 31) {
+            revert ProducerAccountIdTooLong(newProducerAccount);
+        }
+
+        migrationBlockHeight = migrationBlockNumber;
+        preMigrationProducerAccount = ethCustodianImpl.nearProofProducerAccount_();
+        _writeProofProducerSlot(newProducerAccount);
+    }
+
+    function callImpl(bytes calldata data) external payable onlyRole(DEFAULT_ADMIN_ROLE) {
+        (bool success, ) = address(ethCustodianImpl).call{value: msg.value}(data);
+        require(success, 'EthCustodian call failed');
+    }
+
+    function pauseAll() external onlyRole(PAUSABLE_ADMIN_ROLE) {
+        uint flags = PAUSED_DEPOSIT_TO_EVM |
+            PAUSED_DEPOSIT_TO_NEAR |
+            PAUSED_WITHDRAW_POST_MIGRATION |
+            PAUSED_WITHDRAW_PRE_MIGRATION;
+        ethCustodianImpl.adminPause(flags);
+        _pause(flags);
+    }
+
+    function pauseImpl(uint flags) external onlyRole(DEFAULT_ADMIN_ROLE) {
+        ethCustodianImpl.adminPause(flags);
+    }
+
+    function pauseProxy(uint flags) external onlyRole(DEFAULT_ADMIN_ROLE) {
+        _pause(flags);
+    }
+
+    /**
+     * @dev Internal function called by the proxy contract to authorize an upgrade to a new implementation address
+     * using the UUPS proxy upgrade pattern. Overrides the default `_authorizeUpgrade` function from the `UUPSUpgradeable` contract.
+     * This function does not need to perform any extra authorization checks other than restricting the execution of the function to the admin and reverting otherwise.
+     * @param newImplementation Address of the new implementation contract.
+     * Requirements:
+     * - The caller must have the `DEFAULT_ADMIN_ROLE`.
+     */
+    function _authorizeUpgrade(
+        address newImplementation
+    ) internal override onlyRole(DEFAULT_ADMIN_ROLE) {}
+
+    function _writeProofProducerSlot(bytes memory proofProducer) private {
+        uint dataLength = proofProducer.length * 2;
+        ethCustodianImpl.adminSstore(1, uint(bytes32(proofProducer)) + dataLength);
+    }
+}

eth-custodian/contracts/ProofKeeper.sol

@@ -9,15 +9,15 @@ contract ProofKeeper {
     using Borsh for Borsh.Data;
     using ProofDecoder for Borsh.Data;
 
-    INearProver public prover;
-    bytes public nearProofProducerAccount;
+    INearProver public prover_;
+    bytes public nearProofProducerAccount_;
 
     /// Proofs from blocks that are below the acceptance height will be rejected.
     // If `minBlockAcceptanceHeight` value is zero - proofs from block with any height are accepted.
-    uint64 public minBlockAcceptanceHeight;
+    uint64 public minBlockAcceptanceHeight_;
 
     // OutcomeReciptId -> Used
-    mapping(bytes32 => bool) public usedEvents;
+    mapping(bytes32 => bool) public usedEvents_;
 
     constructor(
         bytes memory _nearProofProducerAccount,
@@ -34,9 +34,9 @@ contract ProofKeeper {
             'Invalid Near prover address'
         );
 
-        nearProofProducerAccount = _nearProofProducerAccount;
-        prover = _prover;
-        minBlockAcceptanceHeight = _minBlockAcceptanceHeight;
+        nearProofProducerAccount_ = _nearProofProducerAccount;
+        prover_ = _prover;
+        minBlockAcceptanceHeight_ = _minBlockAcceptanceHeight;
     }
 
     /// Parses the provided proof and consumes it if it's not already used.
@@ -49,11 +49,11 @@ contract ProofKeeper {
         returns(ProofDecoder.ExecutionStatus memory result)
     {
         require(
-            proofBlockHeight >= minBlockAcceptanceHeight,
+            proofBlockHeight >= minBlockAcceptanceHeight_,
             'Proof is from an ancient block'
         );
         require(
-            prover.proveOutcome(proofData,proofBlockHeight),
+            prover_.proveOutcome(proofData,proofBlockHeight),
             'Proof should be valid'
         );
 
@@ -66,14 +66,14 @@ contract ProofKeeper {
         bytes32 receiptId = fullOutcomeProof.outcome_proof.outcome_with_id.outcome.receipt_ids[0];
 
         require(
-            !usedEvents[receiptId],
+            !usedEvents_[receiptId],
             'The burn event cannot be reused'
         );
-        usedEvents[receiptId] = true;
+        usedEvents_[receiptId] = true;
 
         require(
             keccak256(fullOutcomeProof.outcome_proof.outcome_with_id.outcome.executor_id) == 
-            keccak256(nearProofProducerAccount),
+            keccak256(nearProofProducerAccount_),
             'Can only withdraw coins from the linked proof producer on Near blockchain'
         );
 

eth-custodian/contracts/SelectivePausableUpgradable.sol

@@ -0,0 +1,113 @@
+// SPDX-License-Identifier: MIT
+
+pragma solidity ^0.8;
+
+import "@openzeppelin/contracts-upgradeable/utils/ContextUpgradeable.sol";
+import "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol";
+
+/**
+ * @dev Contract module which allows children to implement an emergency stop
+ * mechanism that can be triggered by an authorized account.
+ *
+ * This module is used through inheritance. It will make available the
+ * modifiers `whenNotPaused` and `whenPaused`, which can be applied to
+ * the functions of your contract. Note that they will not be pausable by
+ * simply including this module, only once the modifiers are put in place.
+ */
+abstract contract SelectivePausableUpgradable is Initializable, ContextUpgradeable {
+
+    struct SelectivePausableStorage {
+        uint _pausedFlags;
+    }
+
+    // keccak256(abi.encode(uint256(keccak256("aurora.SelectivePausable")) - 1)) & ~bytes32(uint256(0xff))
+    bytes32 private constant SelectivePausableStorageLocation = 0x3385e98de875c27690676838324244576ee92c4384629b3b7dd9c0a7c978e200;
+
+    function _getSelectivePausableStorage() private pure returns (SelectivePausableStorage storage $) {
+        assembly {
+            $.slot := SelectivePausableStorageLocation
+        }
+    }
+
+    /**
+     * @dev Emitted when the pause is triggered by `account`.
+     */
+    event Paused(address account, uint flags);
+
+    uint private _pausedFlags;
+
+    /**
+     * @dev Initializes the contract in unpaused state.
+     */
+    function __Pausable_init() internal onlyInitializing {
+        __Pausable_init_unchained();
+    }
+
+    function __Pausable_init_unchained() internal onlyInitializing {
+        SelectivePausableStorage storage $ = _getSelectivePausableStorage();
+        $._pausedFlags = 0;
+    }
+
+    /**
+     * @dev Modifier to make a function callable only when the contract is not paused.
+     *
+     * Requirements:
+     *
+     * - The contract must not be paused.
+     */
+    modifier whenNotPaused(uint flag) {
+        _requireNotPaused(flag);
+        _;
+    }
+
+    /**
+     * @dev Modifier to make a function callable only when the contract is paused.
+     *
+     * Requirements:
+     *
+     * - The contract must be paused.
+     */
+    modifier whenPaused(uint flag) {
+        _requirePaused(flag);
+        _;
+    }
+
+    /**
+     * @dev Returns true if the contract is paused, and false otherwise.
+     */
+    function paused(uint flag) public view virtual returns (bool) {
+        SelectivePausableStorage storage $ = _getSelectivePausableStorage();
+        return ($._pausedFlags & flag) != 0;
+    }
+
+    /**
+     * @dev Returns paused flags.
+     */
+    function pausedFlags() public view virtual returns (uint) {
+        SelectivePausableStorage storage $ = _getSelectivePausableStorage();
+        return $._pausedFlags;
+    }
+
+    /**
+     * @dev Throws if the contract is paused.
+     */
+    function _requireNotPaused(uint flag) internal view virtual {
+        require(!paused(flag), "Pausable: paused");
+    }
+
+    /**
+     * @dev Throws if the contract is not paused.
+     */
+    function _requirePaused(uint flag) internal view virtual {
+        require(paused(flag), "Pausable: not paused");
+    }
+
+    /**
+     * @dev Triggers stopped state.
+     */
+    function _pause(uint flags) internal virtual {
+        SelectivePausableStorage storage $ = _getSelectivePausableStorage();
+        $._pausedFlags = flags;
+        emit Paused(_msgSender(), $._pausedFlags);
+    }
+}

eth-custodian/hardhat.config.js

@@ -4,14 +4,15 @@
 require('dotenv').config();
 require('@nomiclabs/hardhat-waffle');
 require('hardhat-gas-reporter');
+require('@openzeppelin/hardhat-upgrades');
 
 const ROPSTEN_WEB3_RPC_ENDPOINT = process.env.ROPSTEN_WEB3_RPC_ENDPOINT;
-const GOERLI_WEB3_RPC_ENDPOINT = process.env.GOERLI_WEB3_RPC_ENDPOINT;
+const SEPOLIA_WEB3_RPC_ENDPOINT = process.env.SEPOLIA_WEB3_RPC_ENDPOINT;
 const MAINNET_WEB3_RPC_ENDPOINT = process.env.MAINNET_WEB3_RPC_ENDPOINT;
 const AURORA_WEB3_RPC_ENDPOINT = process.env.AURORA_WEB3_RPC_ENDPOINT;
 // Hardhat workaround to specify some random private key so this won't fail in CI
 const ROPSTEN_PRIVATE_KEY = process.env.ROPSTEN_PRIVATE_KEY ? process.env.ROPSTEN_PRIVATE_KEY : "00".repeat(32);
-const GOERLI_PRIVATE_KEY = process.env.GOERLI_PRIVATE_KEY ? process.env.GOERLI_PRIVATE_KEY : "00".repeat(32);
+const SEPOLIA_PRIVATE_KEY = process.env.SEPOLIA_PRIVATE_KEY ? process.env.SEPOLIA_PRIVATE_KEY : "00".repeat(32);
 const MAINNET_PRIVATE_KEY = process.env.MAINNET_PRIVATE_KEY ? process.env.MAINNET_PRIVATE_KEY : "00".repeat(32);
 const AURORA_PRIVATE_KEY = process.env.AURORA_PRIVATE_KEY ? process.env.AURORA_PRIVATE_KEY : "00".repeat(32);
 
@@ -264,7 +265,7 @@ module.exports = {
   solidity: {
     compilers: [
       {
-        version: "0.8.11",
+        version: "0.8.20",
         settings: {
           optimizer: {
             enabled: true,
@@ -279,9 +280,9 @@ module.exports = {
       url: `${ROPSTEN_WEB3_RPC_ENDPOINT}`,
       accounts: [`0x${ROPSTEN_PRIVATE_KEY}`]
     },
-    goerli: {
-      url: `${GOERLI_WEB3_RPC_ENDPOINT}`,
-      accounts: [`0x${GOERLI_PRIVATE_KEY}`]
+    sepolia: {
+      url: `${SEPOLIA_WEB3_RPC_ENDPOINT}`,
+      accounts: [`0x${SEPOLIA_PRIVATE_KEY}`]
     },
     mainnet: {
       url: `${MAINNET_WEB3_RPC_ENDPOINT}`,