feat: fix input decoding in usv3 executor and execution dispatcher

2025-02-14 00:53:43 +05:30
parent bd1971334e
commit 80500e615e
10 changed files with 237 additions and 321 deletions
--- a/foundry/src/executors/BalancerV2Executor.sol
+++ b/foundry/src/executors/BalancerV2Executor.sol
@@ -2,7 +2,10 @@
 pragma solidity ^0.8.26;

 import "@interfaces/IExecutor.sol";
-import {IERC20, SafeERC20} from "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";
+import {
+    IERC20,
+    SafeERC20
+} from "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";
 // slither-disable-next-line solc-version
 import {IAsset} from "@balancer-labs/v2-interfaces/contracts/vault/IAsset.sol";
 // slither-disable-next-line solc-version
@@ -16,10 +19,11 @@ contract BalancerV2Executor is IExecutor {
    address private constant VAULT = 0xBA12222222228d8Ba445958a75a0704d566BF2C8;

    // slither-disable-next-line locked-ether
-    function swap(
-        uint256 givenAmount,
-        bytes calldata data
-    ) external payable returns (uint256 calculatedAmount) {
+    function swap(uint256 givenAmount, bytes calldata data)
+        external
+        payable
+        returns (uint256 calculatedAmount)
+    {
        (
            IERC20 tokenIn,
            IERC20 tokenOut,
@@ -51,21 +55,16 @@ contract BalancerV2Executor is IExecutor {

        uint256 limit = 0;

-        calculatedAmount = IVault(VAULT).swap(
-            singleSwap,
-            funds,
-            limit,
-            block.timestamp
-        );
+        calculatedAmount =
+            IVault(VAULT).swap(singleSwap, funds, limit, block.timestamp);
    }

-    function handleCallback(
-        bytes calldata data
-    ) external returns (bytes memory result) {}
+    function handleCallback(bytes calldata data)
+        external
+        returns (bytes memory result)
+    {}

-    function _decodeData(
-        bytes calldata data
-    )
+    function _decodeData(bytes calldata data)
        internal
        pure
        returns (
--- a/foundry/src/executors/UniswapV2Executor.sol
+++ b/foundry/src/executors/UniswapV2Executor.sol
@@ -11,10 +11,11 @@ contract UniswapV2Executor is IExecutor {
    using SafeERC20 for IERC20;

    // slither-disable-next-line locked-ether
-    function swap(
-        uint256 givenAmount,
-        bytes calldata data
-    ) external payable returns (uint256 calculatedAmount) {
+    function swap(uint256 givenAmount, bytes calldata data)
+        external
+        payable
+        returns (uint256 calculatedAmount)
+    {
        address target;
        address receiver;
        bool zeroForOne;
@@ -32,13 +33,12 @@ contract UniswapV2Executor is IExecutor {
        }
    }

-    function handleCallback(
-        bytes calldata data
-    ) external returns (bytes memory result) {}
+    function handleCallback(bytes calldata data)
+        external
+        returns (bytes memory result)
+    {}

-    function _decodeData(
-        bytes calldata data
-    )
+    function _decodeData(bytes calldata data)
        internal
        pure
        returns (
@@ -57,20 +57,20 @@ contract UniswapV2Executor is IExecutor {
        zeroForOne = uint8(data[60]) > 0;
    }

-    function _getAmountOut(
-        address target,
-        uint256 amountIn,
-        bool zeroForOne
-    ) internal view returns (uint256 amount) {
+    function _getAmountOut(address target, uint256 amountIn, bool zeroForOne)
+        internal
+        view
+        returns (uint256 amount)
+    {
        IUniswapV2Pair pair = IUniswapV2Pair(target);
        uint112 reserveIn;
        uint112 reserveOut;
        if (zeroForOne) {
            // slither-disable-next-line unused-return
-            (reserveIn, reserveOut, ) = pair.getReserves();
+            (reserveIn, reserveOut,) = pair.getReserves();
        } else {
            // slither-disable-next-line unused-return
-            (reserveOut, reserveIn, ) = pair.getReserves();
+            (reserveOut, reserveIn,) = pair.getReserves();
        }

        require(reserveIn > 0 && reserveOut > 0, "L");
--- a/foundry/src/executors/UniswapV3Executor.sol
+++ b/foundry/src/executors/UniswapV3Executor.sol
@@ -7,6 +7,7 @@ import "@uniswap/v3-core/contracts/interfaces/IUniswapV3Pool.sol";
 import "@uniswap/v3-updated/CallbackValidationV2.sol";

 error UniswapV3Executor__InvalidDataLength();
+error UniswapV3Executor__InvalidFactory();

 contract UniswapV3Executor is IExecutor {
    using SafeERC20 for IERC20;
@@ -16,16 +17,22 @@ contract UniswapV3Executor is IExecutor {
        1461446703485210103287273052203988822378723970342;

    address public immutable factory;
+    address private immutable self;

    constructor(address _factory) {
+        if (_factory == address(0)) {
+            revert UniswapV3Executor__InvalidFactory();
+        }
        factory = _factory;
+        self = address(this);
    }

    // slither-disable-next-line locked-ether
-    function swap(
-        uint256 amountIn,
-        bytes calldata data
-    ) external payable returns (uint256 amountOut) {
+    function swap(uint256 amountIn, bytes calldata data)
+        external
+        payable
+        returns (uint256 amountOut)
+    {
        (
            address tokenIn,
            address tokenOut,
@@ -58,23 +65,19 @@ contract UniswapV3Executor is IExecutor {
        }
    }

-    function handleCallback(
-        bytes calldata msgData
-    ) external returns (bytes memory result) {
-        int256 amount0Delta;
-        int256 amount1Delta;
+    function handleCallback(bytes calldata msgData)
+        external
+        returns (bytes memory result)
+    {
+        // Skip first 4 bytes of function selector and decode the two int256 values
+        (int256 amount0Delta, int256 amount1Delta) =
+            abi.decode(msgData[4:68], (int256, int256));

-        (amount0Delta, amount1Delta) = abi.decode(
-            msgData[:64],
-            (int256, int256)
-        );
+        bytes calldata remainingData = msgData[68:];
+
+        (uint256 amountOwed, address tokenOwed) =
+            _verifyUSV3Callback(amount0Delta, amount1Delta, remainingData);

-        bytes calldata remainingData = msgData[64:];
-        (uint256 amountOwed, address tokenOwed) = _verifyUSV3Callback(
-            amount0Delta,
-            amount1Delta,
-            remainingData
-        );
        IERC20(tokenOwed).safeTransfer(msg.sender, amountOwed);
        return abi.encode(amountOwed, tokenOwed);
    }
@@ -84,28 +87,23 @@ contract UniswapV3Executor is IExecutor {
        int256 amount1Delta,
        bytes calldata data
    ) internal view returns (uint256 amountIn, address tokenIn) {
+        // Skip the first 64 bytes (32 bytes offset + 32 bytes length)
+        data = data[64:];
+
        tokenIn = address(bytes20(data[0:20]));
        address tokenOut = address(bytes20(data[20:40]));
        uint24 poolFee = uint24(bytes3(data[40:43]));

        // slither-disable-next-line unused-return
-        CallbackValidationV2.verifyCallback(
-            factory,
-            tokenIn,
-            tokenOut,
-            poolFee
-        );
+        CallbackValidationV2.verifyCallback(factory, tokenIn, tokenOut, poolFee);

-        amountIn = amount0Delta > 0
-            ? uint256(amount0Delta)
-            : uint256(amount1Delta);
+        amountIn =
+            amount0Delta > 0 ? uint256(amount0Delta) : uint256(amount1Delta);

        return (amountIn, tokenIn);
    }

-    function _decodeData(
-        bytes calldata data
-    )
+    function _decodeData(bytes calldata data)
        internal
        pure
        returns (
@@ -128,11 +126,11 @@ contract UniswapV3Executor is IExecutor {
        zeroForOne = uint8(data[83]) > 0;
    }

-    function _makeV3CallbackData(
-        address tokenIn,
-        address tokenOut,
-        uint24 fee
-    ) internal pure returns (bytes memory) {
-        return abi.encodePacked(tokenIn, tokenOut, fee);
+    function _makeV3CallbackData(address tokenIn, address tokenOut, uint24 fee)
+        internal
+        view
+        returns (bytes memory)
+    {
+        return abi.encodePacked(tokenIn, tokenOut, fee, self);
    }
 }
--- a/foundry/src/executors/UniswapV4Executor.sol
+++ b/foundry/src/executors/UniswapV4Executor.sol
@@ -2,9 +2,14 @@
 pragma solidity ^0.8.26;

 import "@interfaces/IExecutor.sol";
-import {IERC20, SafeERC20} from "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";
+import {
+    IERC20,
+    SafeERC20
+} from "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";
 import {IPoolManager} from "@uniswap/v4-core/src/interfaces/IPoolManager.sol";
-import {Currency, CurrencyLibrary} from "@uniswap/v4-core/src/types/Currency.sol";
+import {
+    Currency, CurrencyLibrary
+} from "@uniswap/v4-core/src/types/Currency.sol";
 import {PoolKey} from "@uniswap/v4-core/src/types/PoolKey.sol";
 import {IHooks} from "@uniswap/v4-core/src/interfaces/IHooks.sol";
 import {V4Router} from "@uniswap/v4-periphery/src/V4Router.sol";
@@ -21,16 +26,13 @@ contract UniswapV4Executor is IExecutor, V4Router {

    constructor(IPoolManager _poolManager) V4Router(_poolManager) {}

-    function swap(
-        uint256,
-        bytes calldata data
-    ) external payable returns (uint256 calculatedAmount) {
-        (
-            address tokenIn,
-            address tokenOut,
-            bool isExactInput,
-            uint256 amount
-        ) = _decodeData(data);
+    function swap(uint256, bytes calldata data)
+        external
+        payable
+        returns (uint256 calculatedAmount)
+    {
+        (address tokenIn, address tokenOut, bool isExactInput, uint256 amount) =
+            _decodeData(data);

        uint256 tokenOutBalanceBefore;
        uint256 tokenInBalanceBefore;
@@ -65,9 +67,7 @@ contract UniswapV4Executor is IExecutor, V4Router {
        return calculatedAmount;
    }

-    function _decodeData(
-        bytes calldata data
-    )
+    function _decodeData(bytes calldata data)
        internal
        pure
        returns (
@@ -77,19 +77,15 @@ contract UniswapV4Executor is IExecutor, V4Router {
            uint256 amount
        )
    {
-        (bytes memory actions, bytes[] memory params) = abi.decode(
-            data,
-            (bytes, bytes[])
-        );
+        (bytes memory actions, bytes[] memory params) =
+            abi.decode(data, (bytes, bytes[]));

        // First byte of actions determines the swap type
        uint8 action = uint8(bytes1(actions[0]));

        if (action == uint8(Actions.SWAP_EXACT_IN_SINGLE)) {
-            IV4Router.ExactInputSingleParams memory swapParams = abi.decode(
-                params[0],
-                (IV4Router.ExactInputSingleParams)
-            );
+            IV4Router.ExactInputSingleParams memory swapParams =
+                abi.decode(params[0], (IV4Router.ExactInputSingleParams));

            tokenIn = swapParams.zeroForOne
                ? address(uint160(swapParams.poolKey.currency0.toId()))
@@ -100,10 +96,8 @@ contract UniswapV4Executor is IExecutor, V4Router {
            isExactInput = true;
            amount = swapParams.amountIn;
        } else if (action == uint8(Actions.SWAP_EXACT_OUT_SINGLE)) {
-            IV4Router.ExactOutputSingleParams memory swapParams = abi.decode(
-                params[0],
-                (IV4Router.ExactOutputSingleParams)
-            );
+            IV4Router.ExactOutputSingleParams memory swapParams =
+                abi.decode(params[0], (IV4Router.ExactOutputSingleParams));

            tokenIn = swapParams.zeroForOne
                ? address(uint160(swapParams.poolKey.currency0.toId()))
@@ -114,23 +108,18 @@ contract UniswapV4Executor is IExecutor, V4Router {
            isExactInput = false;
            amount = swapParams.amountOut;
        } else if (action == uint8(Actions.SWAP_EXACT_IN)) {
-            IV4Router.ExactInputParams memory swapParams = abi.decode(
-                params[0],
-                (IV4Router.ExactInputParams)
-            );
+            IV4Router.ExactInputParams memory swapParams =
+                abi.decode(params[0], (IV4Router.ExactInputParams));

            tokenIn = address(uint160(swapParams.currencyIn.toId()));
-            PathKey memory lastPath = swapParams.path[
-                swapParams.path.length - 1
-            ];
+            PathKey memory lastPath =
+                swapParams.path[swapParams.path.length - 1];
            tokenOut = address(uint160(lastPath.intermediateCurrency.toId()));
            isExactInput = true;
            amount = swapParams.amountIn;
        } else if (action == uint8(Actions.SWAP_EXACT_OUT)) {
-            IV4Router.ExactOutputParams memory swapParams = abi.decode(
-                params[0],
-                (IV4Router.ExactOutputParams)
-            );
+            IV4Router.ExactOutputParams memory swapParams =
+                abi.decode(params[0], (IV4Router.ExactOutputParams));

            PathKey memory firstPath = swapParams.path[0];
            tokenIn = address(uint160(firstPath.intermediateCurrency.toId()));
@@ -140,14 +129,12 @@ contract UniswapV4Executor is IExecutor, V4Router {
        }
    }

-    function _pay(
-        Currency token,
-        address payer,
-        uint256 amount
-    ) internal override {
+    function _pay(Currency token, address payer, uint256 amount)
+        internal
+        override
+    {
        IERC20(Currency.unwrap(token)).safeTransfer(
-            address(poolManager),
-            amount
+            address(poolManager), amount
        );
    }

@@ -155,7 +142,8 @@ contract UniswapV4Executor is IExecutor, V4Router {
        return address(this);
    }

-    function handleCallback(
-        bytes calldata data
-    ) external returns (bytes memory result) {}
+    function handleCallback(bytes calldata data)
+        external
+        returns (bytes memory result)
+    {}
 }