Skip to content

Commit e1d15bb

Browse files
AndriianChestnykhAndriian Chestnykhvmidyllic
authored
Security and CI settings (#97)
* Create SECURITY.md * IDEN-725 Add Github workflow security actions * fix security issues. run prettier. increase solc version * move Pairing.sol to separate file * rename interface: slither Name reused * Upgrade tests for convenient check tx reverts * Add more SMT tests with big numbers and edge cases * Fix wrong comment * Remove abicoder v2 and change var type * Fix import path in the Smt contract * Rename the _getNodeHash function * Remove redundant input arguments in the function _pushLeaf() * Add checking verifier != address(0x0) in the setVerifier() method * Add check newState != 0 in the transitState() method * Simplify StateV2 unit tests * Init memory vars with zero values, refactor some methods * Fix getStateInfoHistoryById() and getRootHistory() not to throw when startIndex+length>historyLength * Update public visibility modifier to external whenever possible * Allow verifier zero address to block any state transition * Inherit StateV2 from Ownable2StepUpgradeable * Upgrade OpenZeppelin version * Fix solhint errors * Fix solhint errors * Change visibility of __gap variable in StateV2.sol * Upgrade GitHub action to [email protected] * Fix Slither errors * Upgrade outdated npm packages * Upgrade Solidity version, add Slither config * Resolve Slither medium findings * Fix tests --------- Co-authored-by: Andriian Chestnykh <[email protected]> Co-authored-by: vmidyllic <[email protected]> Co-authored-by: Andriian Chestnykh <>
1 parent 24867f3 commit e1d15bb

40 files changed

+15173
-33189
lines changed

‎.github/workflows/security-ci.yml

+44
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
name: Security Scan
2+
on: # yamllint disable-line rule:truthy
3+
push:
4+
workflow_call:
5+
workflow_dispatch: {}
6+
7+
jobs:
8+
slither:
9+
name: Slither
10+
runs-on: ubuntu-latest
11+
steps:
12+
- uses: actions/checkout@v3
13+
- uses: crytic/[email protected]
14+
with:
15+
fail-on: medium
16+
17+
solhint:
18+
runs-on: ubuntu-latest
19+
steps:
20+
- uses: actions/checkout@v2
21+
- name: Get node.js
22+
uses: actions/setup-node@v1
23+
with:
24+
node-version: "16.x"
25+
- run: npm ci
26+
- run: npx solhint "contracts/**/*.sol"
27+
28+
coverage:
29+
runs-on: ubuntu-latest
30+
steps:
31+
- uses: actions/checkout@v3
32+
- name: Get node.js
33+
uses: actions/setup-node@v2
34+
with:
35+
node-version: "16.x"
36+
cache: "npm"
37+
- run: npm ci
38+
- run: npx hardhat compile
39+
- name: solidity-coverage
40+
run: npx hardhat coverage
41+
- name: coveralls
42+
uses: coverallsapp/[email protected]
43+
with:
44+
github-token: ${{ secrets.GITHUB_TOKEN }}

‎.solcover.js

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
module.exports = {
2+
configureYulOptimizer: true,
3+
skipFiles: ["mocks", "test"],
4+
};

‎.solhint.json

+15-11
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,18 @@
11
{
2-
"extends": [
3-
"solhint:recommended"
2+
"extends": "solhint:recommended",
3+
"plugins": ["prettier"],
4+
"rules": {
5+
"code-complexity": ["error", 8],
6+
"compiler-version": ["error", ">=0.8.4"],
7+
"func-visibility": ["error", { "ignoreConstructors": true }],
8+
"max-line-length": ["error", 120],
9+
"not-rely-on-time": "off",
10+
"prettier/prettier": [
11+
"error",
12+
{
13+
"endOfLine": "auto"
14+
}
415
],
5-
"rules": {
6-
"prettier/prettier": "error",
7-
"avoid-throw": false,
8-
"avoid-suicide": "error",
9-
"avoid-sha3": "warn"
10-
},
11-
"plugins": [
12-
"prettier"
13-
]
16+
"reason-string": ["warn", { "maxLength": 64 }]
17+
}
1418
}

‎.solhintignore

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
# directories
2+
**/lib
3+
**/node_modules

‎SECURITY.md

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
# Polygon Technology Security Information
2+
3+
## Link to vulnerability disclosure details (Bug Bounty).
4+
- Websites and Applications: https://hackerone.com/polygon-technology
5+
- Smart Contracts: https://immunefi.com/bounty/polygon
6+
7+
## Languages that our team speaks and understands.
8+
Preferred-Languages: en
9+
10+
## Security-related job openings at Polygon.
11+
https://polygon.technology/careers
12+
13+
## Polygon security contact details.
14+
[email protected]
15+
16+
## The URL for accessing the security.txt file.
17+
Canonical: https://polygon.technology/security.txt

‎contracts/Schema.sol

+5-13
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
// SPDX-License-Identifier: GPL-3.0
2-
pragma solidity ^0.8.0;
2+
pragma solidity 0.8.16;
33

44
/**
55
* @title Schema
@@ -14,14 +14,10 @@ contract SchemaRegistry {
1414
uint256 timestamp;
1515
}
1616

17-
mapping(string => bytes32) nameHash;
18-
mapping(bytes32 => Schema) hashSchema;
17+
mapping(string => bytes32) public nameHash;
18+
mapping(bytes32 => Schema) public hashSchema;
1919

20-
function getHashFromBytes(bytes memory schemaBody)
21-
private
22-
pure
23-
returns (bytes32)
24-
{
20+
function getHashFromBytes(bytes memory schemaBody) private pure returns (bytes32) {
2521
return keccak256(schemaBody);
2622
}
2723

@@ -54,11 +50,7 @@ contract SchemaRegistry {
5450
return nameHash[name];
5551
}
5652

57-
function getBytesByName(string memory name)
58-
public
59-
view
60-
returns (bytes memory)
61-
{
53+
function getBytesByName(string memory name) public view returns (bytes memory) {
6254
bytes32 hash = nameHash[name];
6355
return hashSchema[hash].body;
6456
}

‎contracts/SchemaUrlRegistry.sol

+18-14
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
// SPDX-License-Identifier: GPL-3.0
2-
pragma solidity ^0.8.0;
2+
pragma solidity 0.8.16;
33

44
/**
55
* @title Schema
@@ -25,12 +25,12 @@ contract SchemaUrlRegistry {
2525
function save(bytes32 id, string memory credentialType, string memory url) public {
2626
require(schemaMap[id].creator != address(0), "Schema already exists");
2727

28-
Schema memory s = Schema({// creating new schema
29-
creator : msg.sender,
30-
id : id,
31-
credentialType : credentialType,
32-
timestamp : block.timestamp,
33-
url : url
28+
Schema memory s = Schema({ // creating new schema
29+
creator: msg.sender,
30+
id: id,
31+
credentialType: credentialType,
32+
timestamp: block.timestamp,
33+
url: url
3434
});
3535

3636
schemaMap[id] = s;
@@ -39,12 +39,16 @@ contract SchemaUrlRegistry {
3939
/**
4040
* @dev getSchemaById is function to retrieve ipfs utl by name
4141
* @param id - hash of the schema
42-
*/
43-
function getSchemaById(bytes32 id)
44-
public
45-
view
46-
returns (bytes32, string memory, string memory, address, uint256)
47-
{
48-
return (schemaMap[id].id, schemaMap[id].credentialType, schemaMap[id].url, schemaMap[id].creator, schemaMap[id].timestamp);
42+
*/
43+
function getSchemaById(
44+
bytes32 id
45+
) public view returns (bytes32, string memory, string memory, address, uint256) {
46+
return (
47+
schemaMap[id].id,
48+
schemaMap[id].credentialType,
49+
schemaMap[id].url,
50+
schemaMap[id].creator,
51+
schemaMap[id].timestamp
52+
);
4953
}
5054
}

‎contracts/ZKPVerifier.sol

+1-2
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
// SPDX-License-Identifier: MIT
2-
pragma solidity ^0.8.0;
2+
pragma solidity 0.8.16;
33

44
import "@openzeppelin/contracts/token/ERC20/ERC20.sol";
55
import "@openzeppelin/contracts/access/Ownable.sol";
@@ -63,7 +63,6 @@ contract ZKPVerifier is IZKPVerifier, Ownable {
6363
uint256 operator,
6464
uint256[] calldata value
6565
) public override onlyOwner returns (bool) {
66-
6766
uint256 valueHash = PoseidonFacade.poseidonSponge(value);
6867
// only merklized claims are supported (claimPathNotExists is false, slot index is set to 0 )
6968
uint256 queryHash = PoseidonFacade.poseidon6(

‎contracts/examples/ERC20Verifier.sol

+7-15
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
// SPDX-License-Identifier: MIT
2-
pragma solidity ^0.8.0;
2+
pragma solidity 0.8.16;
33

44
import "@openzeppelin/contracts/token/ERC20/ERC20.sol";
55
import "../lib/GenesisUtils.sol";
@@ -13,27 +13,19 @@ contract ERC20Verifier is ERC20, ZKPVerifier {
1313
mapping(uint256 => address) public idToAddress;
1414
mapping(address => uint256) public addressToId;
1515

16-
uint256 public TOKEN_AMOUNT_FOR_AIRDROP_PER_ID =
17-
5 * 10**uint256(decimals());
16+
uint256 public TOKEN_AMOUNT_FOR_AIRDROP_PER_ID = 5 * 10 ** uint256(decimals());
1817

19-
constructor(string memory name_, string memory symbol_)
20-
ERC20(name_, symbol_)
21-
{}
18+
constructor(string memory name_, string memory symbol_) ERC20(name_, symbol_) {}
2219

2320
function _beforeProofSubmit(
24-
uint64, /* requestId */
21+
uint64 /* requestId */,
2522
uint256[] memory inputs,
2623
ICircuitValidator validator
2724
) internal view override {
2825
// check that challenge input is address of sender
29-
address addr = GenesisUtils.int256ToAddress(
30-
inputs[validator.getChallengeInputIndex()]
31-
);
26+
address addr = GenesisUtils.int256ToAddress(inputs[validator.getChallengeInputIndex()]);
3227
// this is linking between msg.sender and
33-
require(
34-
_msgSender() == addr,
35-
"address in proof is not a sender address"
36-
);
28+
require(_msgSender() == addr, "address in proof is not a sender address");
3729
}
3830

3931
function _afterProofSubmit(
@@ -57,7 +49,7 @@ contract ERC20Verifier is ERC20, ZKPVerifier {
5749
}
5850

5951
function _beforeTokenTransfer(
60-
address, /* from */
52+
address /* from */,
6153
address to,
6254
uint256 /* amount */
6355
) internal view override {

‎contracts/interfaces/ICircuitValidator.sol

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
// SPDX-License-Identifier: GPL-3.0
2-
pragma solidity ^0.8.0;
2+
pragma solidity 0.8.16;
33

44
interface ICircuitValidator {
55
struct CircuitQuery {

‎contracts/interfaces/IERC20zkp.sol

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
// SPDX-License-Identifier: GPL-3.0
22

3-
pragma solidity ^0.8.0;
3+
pragma solidity 0.8.16;
44

55
interface IERC20ZKP {
66
function transferWithProof(

‎contracts/interfaces/IState.sol

+5-10
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
1-
pragma solidity ^0.8.0;
1+
// SPDX-License-Identifier: GPL-3.0
2+
pragma solidity 0.8.16;
23

34
interface IState {
45
/**
@@ -37,25 +38,19 @@ interface IState {
3738
uint256 replacedAtBlock;
3839
}
3940

40-
function getStateInfoById(
41-
uint256 id
42-
) external view returns (StateInfo memory);
41+
function getStateInfoById(uint256 id) external view returns (StateInfo memory);
4342

4443
/**
4544
* @dev Retrieve the specific GIST root information.
4645
* @param root GIST root
4746
* @return The GIST root info
4847
*/
49-
function getGISTRootInfo(
50-
uint256 root
51-
) external view returns (RootInfo memory);
48+
function getGISTRootInfo(uint256 root) external view returns (RootInfo memory);
5249

5350
/**
5451
* @dev Retrieve state information by state.
5552
* @param state A state
5653
* @return The state info
5754
*/
58-
function getStateInfoByState(
59-
uint256 state
60-
) external view returns (StateInfo memory);
55+
function getStateInfoByState(uint256 state) external view returns (StateInfo memory);
6156
}

‎contracts/interfaces/IStateTransitionVerifier.sol

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
// SPDX-License-Identifier: GPL-3.0
2+
pragma solidity 0.8.16;
3+
4+
interface IStateTransitionVerifier {
5+
function verifyProof(
6+
uint256[2] memory a,
7+
uint256[2][2] memory b,
8+
uint256[2] memory c,
9+
uint256[4] memory input
10+
) external view returns (bool r);
11+
}

‎contracts/interfaces/IVerifier.sol

+2-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
1-
pragma solidity ^0.8.0;
1+
// SPDX-License-Identifier: GPL-3.0
2+
pragma solidity 0.8.16;
23

34
interface IVerifier {
45
function verifyProof(

‎contracts/interfaces/IZKPAirdrop.sol

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
// SPDX-License-Identifier: GPL-3.0
22

3-
pragma solidity ^0.8.0;
3+
pragma solidity 0.8.16;
44

55
interface IZKPAirdrop {
66
function mintWithProof(

‎contracts/interfaces/IZKPVerifier.sol

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
// SPDX-License-Identifier: GPL-3.0
22

3-
pragma solidity ^0.8.0;
3+
pragma solidity 0.8.16;
44

55
import "./ICircuitValidator.sol";
66

0 commit comments

Comments
 (0)