[copied from exact same reasoning with execution code-checking]
I was inspired to do this because, when disabling the slither check for the staticcall when calling the callback verifier, I realized it's not clear from the same contract that we have already checked for contract code existence when setting the verifier. This made me feel uneasy, as this contract can then not stand alone and must rely on the higher level contract to safely check for code existence, otherwise the staticcall is unsafe. Keeping this logic in a separate contract seems error-prone to me, as we may remove the check for code existence without immediately realizing the implications of doing so.
For this reason I have organized it as follows:
- Logic/tests relating to proper roles/access control in the main TychoRouter.
- Lower-level logic/tests that check contract validity before setting the callback verifier in the CallbackVerificationDispatcher
- This is not so relevant for security, but it would sabotage our performance if an executor was wrongly removed, so it's worth it to know every time this happens.
I was inspired to do this because, when disabling the slither check for the delegatecall when calling the swap executor, I realized it's not clear from the same contract that we have already checked for contract code existence when setting the executor. This made me feel uneasy, as this contract can then not stand alone and must rely on the higher level contract to safely check for code existence, otherwise the delegatecall is unsafe. Keeping this logic in a separate contract seems error-prone to me, as we may remove the check for code existence without immediately realizing the implications of doing so.
For this reason I have organized it as follows:
- Logic/tests relating to proper roles/access control in the main TychoRouter.
- Lower-level logic/tests that checks contract validity before setting the executor in the SwapExecutionDispatcher
- Moved the deployment method into a test template for organization
- Created skeletons of dispatcher contracts
- Added all possible test cases for thoroughness
- remappings.txt is used for more elegant imports
- decided not to include all helper methods in skeleton - just main swap method. They are properly documented in the jira tasks.
- add filter-paths to slither to exclude submodules, otherwise we will get slither warnings about permit2 and open-zeppelin using different solidity versions:
```
- Version constraint ^0.8.20 is used by:
-^0.8.20 (lib/openzeppelin-contracts/contracts/access/AccessControl.sol#4)
-^0.8.20 (lib/openzeppelin-contracts/contracts/access/IAccessControl.sol#4)
-^0.8.20 (lib/openzeppelin-contracts/contracts/utils/Context.sol#4)
-^0.8.20 (lib/openzeppelin-contracts/contracts/utils/introspection/ERC165.sol#4)
-^0.8.20 (lib/openzeppelin-contracts/contracts/utils/introspection/IERC165.sol#4)
- Version constraint ^0.8.0 is used by:
-^0.8.0 (lib/permit2/src/interfaces/IAllowanceTransfer.sol#2)
-^0.8.0 (lib/permit2/src/interfaces/IEIP712.sol#2)
- Version constraint ^0.8.28 is used by:
```
