feat(zkevm-integration): implement `draft-impl` by github-actions[bot] · Pull Request #140 · ronin-chain/dpos-contract

github-actions · 2024-10-25T07:49:48Z

Description

PR to merge from implement-feature/zkevm-integration/draft-impl to feature/zkevm-integration.

…integration

github-actions · 2024-10-25T08:07:19Z

Slither report

THIS CHECKLIST IS NOT COMPLETE. Use --show-ignored-findings to show all the results.
Summary

reentrancy-eth (6 results) (High)
shadowing-state (4 results) (High)
uninitialized-state (13 results) (High)

reentrancy-eth

Impact: High
Confidence: Medium

ID-0
Reentrancy in CoinbaseExecution._distributeRewardToTreasuriesAndCalculateTotalDelegatorsReward(uint256,address[]):
External calls:
- _distributeL2MiningReward(vId,treasury)
  - (success,None) = recipient.call{gas: gas,value: amount}()
- _distributeMiningReward(vId,treasury)
  - (success,None) = recipient.call{gas: gas,value: amount}()
- _distributeFastFinalityReward(vId,treasury,validatorFFReward)
  - (success,None) = recipient.call{gas: gas,value: amount}()
    State variables written after the call(s):
- delete _delegatorL2MiningReward[vId]
  CommonStorage._delegatorL2MiningReward can be used in cross function reentrancies:
- CoinbaseExecution._distributeRewardToTreasuriesAndCalculateTotalDelegatorsReward(uint256,address[])
- CoinbaseExecution.onL2BlockRewardSubmitted(address)
- delete _delegatorMiningReward[vId]
  CommonStorage._delegatorMiningReward can be used in cross function reentrancies:
- CoinbaseExecution._distributeRewardToTreasuriesAndCalculateTotalDelegatorsReward(uint256,address[])
- CoinbaseExecution.submitBlockReward()
- delete _fastFinalityReward[vId]
  CommonStorage._fastFinalityReward can be used in cross function reentrancies:
- CoinbaseExecution._distributeRewardToTreasuriesAndCalculateTotalDelegatorsReward(uint256,address[])
- CoinbaseExecution._syncFastFinalityReward(uint256,address[])
- _totalDeprecatedReward += _validatorMiningReward[vId] + _delegatorMiningReward[vId] + _fastFinalityReward[vId]
  CommonStorage._totalDeprecatedReward can be used in cross function reentrancies:
- CoinbaseExecution._distributeRewardToTreasuriesAndCalculateTotalDelegatorsReward(uint256,address[])
- CoinbaseExecution._recycleDeprecatedRewards()
- CoinbaseExecution._syncFastFinalityReward(uint256,address[])
- EmergencyExit._tryRecycleLockedFundsFromEmergencyExits()
- CoinbaseExecution.submitBlockReward()
- CommonStorage.totalDeprecatedReward()
- delete _validatorL2MiningReward[vId]
  CommonStorage._validatorL2MiningReward can be used in cross function reentrancies:
- CoinbaseExecution._distributeL2MiningReward(address,address)
- CoinbaseExecution._distributeRewardToTreasuriesAndCalculateTotalDelegatorsReward(uint256,address[])
- CoinbaseExecution.onL2BlockRewardSubmitted(address)
- delete _validatorMiningReward[vId]
  CommonStorage._validatorMiningReward can be used in cross function reentrancies:
- CoinbaseExecution._distributeMiningReward(address,address)
- CoinbaseExecution._distributeRewardToTreasuriesAndCalculateTotalDelegatorsReward(uint256,address[])
- CoinbaseExecution.submitBlockReward()

dpos-contract/src/ronin/validator/CoinbaseExecution.sol

Lines 219 to 271 in 232d73a

    
           function _distributeRewardToTreasuriesAndCalculateTotalDelegatorsReward( 
        
             uint256 lastPeriod, 
        
             address[] memory cids 
        
           ) 
        
             private 
        
             returns ( 
        
               uint256[] memory delegatorBlockMiningRewards, 
        
               uint256[] memory delegatorL2BlockMiningRewards, 
        
               uint256[] memory delegatorFastFinalityRewards 
        
             ) 
        
           { 
        
             address vId; // validator id 
        
             address payable treasury; 
        
             uint256 length = cids.length; 
        
             delegatorBlockMiningRewards = new uint256[](length); 
        
             delegatorL2BlockMiningRewards = new uint256[](length); 
        
             delegatorFastFinalityRewards = new uint256[](length); 
        
             (uint256 minRate, uint256 maxRate) = IStaking(getContract(ContractType.STAKING)).getCommissionRateRange(); 
        
             for (uint256 i; i < length; ++i) { 
        
               vId = cids[i]; 
        
               treasury = _candidateInfo[vId].__shadowedTreasury; 
        
               // Distribute the L2 mining reward to the treasury address of the validator regardless of the jail status. 
        
               delegatorL2BlockMiningRewards[i] = _delegatorL2MiningReward[vId]; 
        
               _distributeL2MiningReward(vId, treasury); 
        
               if (!_isJailedById(vId) && !_miningRewardDeprecatedById(vId, lastPeriod)) { 
        
                 (uint256 validatorFFReward, uint256 delegatorFFReward) = _calcCommissionReward({ 
        
                   vId: vId, 
        
                   totalReward: _fastFinalityReward[vId], 
        
                   maxCommissionRate: maxRate, 
        
                   minCommissionRate: minRate 
        
                 }); 
        
                 delegatorBlockMiningRewards[i] = _delegatorMiningReward[vId]; 
        
                 delegatorFastFinalityRewards[i] = delegatorFFReward; 
        
                 _distributeMiningReward(vId, treasury); 
        
                 _distributeFastFinalityReward(vId, treasury, validatorFFReward); 
        
               } else { 
        
                 _totalDeprecatedReward += _validatorMiningReward[vId] + _delegatorMiningReward[vId] + _fastFinalityReward[vId]; 
        
               } 
        
               delete _delegatorMiningReward[vId]; 
        
               delete _validatorMiningReward[vId]; 
        
               delete _fastFinalityReward[vId]; 
        
               delete _delegatorL2MiningReward[vId]; 
        
               delete _validatorL2MiningReward[vId]; 
        
             } 
        
           }

ID-1
Reentrancy in CoinbaseExecution.wrapUpEpoch():
External calls:

dpos-contract/src/ronin/validator/CoinbaseExecution.sol

Lines 112 to 175 in 232d73a

    
           function wrapUpEpoch() external payable virtual override onlyCoinbase whenEpochEnding oncePerEpoch { 
        
             unchecked { 
        
               uint256 newPeriod = _computePeriod(block.timestamp); 
        
               bool periodEnding = _isPeriodEnding(newPeriod); 
        
               uint256 lastPeriod = currentPeriod(); 
        
               uint256 epoch = epochOf(block.number); 
        
               uint256 nextEpoch = epoch + 1; 
        
               IRandomBeacon randomBeacon = IRandomBeacon(getContract(ContractType.RANDOM_BEACON)); 
        
               // This request is actually only invoked at the first epoch of the period. 
        
               randomBeacon.execRequestRandomSeedForNextPeriod(lastPeriod, newPeriod); 
        
               // Get all candidate ids 
        
               address[] memory allCids = _candidateIds; 
        
               _syncFastFinalityReward({ epoch: epoch, validatorIds: allCids }); 
        
               if (periodEnding) { 
        
                 ISlashIndicator slashIndicatorContract = ISlashIndicator(getContract(ContractType.SLASH_INDICATOR)); 
        
                 // Slash submit random beacon proof unavailability first, then update credit scores. 
        
                 randomBeacon.execRecordAndSlashUnavailability(lastPeriod, newPeriod, address(slashIndicatorContract), allCids); 
        
                 slashIndicatorContract.execUpdateCreditScores(allCids, lastPeriod); 
        
                 ( 
        
                   uint256[] memory delegatorBlockMiningRewards, 
        
                   uint256[] memory delegatorL2BlockMiningRewards, 
        
                   uint256[] memory delegatorFastFinalityRewards 
        
                 ) = _distributeRewardToTreasuriesAndCalculateTotalDelegatorsReward(lastPeriod, allCids); 
        
                 _settleAndTransferDelegatingRewards( 
        
                   lastPeriod, allCids, delegatorBlockMiningRewards, delegatorL2BlockMiningRewards, delegatorFastFinalityRewards 
        
                 ); 
        
                 _tryRecycleLockedFundsFromEmergencyExits(); 
        
                 _recycleDeprecatedRewards(); 
        
                 address[] memory revokedCandidateIds = _syncCandidateSet(newPeriod); 
        
                 if (revokedCandidateIds.length > 0) { 
        
                   // Re-update `allCids` after unsatisfied candidates get removed. 
        
                   allCids = _candidateIds; 
        
                   slashIndicatorContract.execResetCreditScores(revokedCandidateIds); 
        
                 } 
        
                 // Wrap up the beacon period includes (1) finalizing the beacon proof, and (2) determining the validator list for the next period by new proof. 
        
                 // Should wrap up the beacon after unsatisfied candidates get removed. 
        
                 randomBeacon.execFinalizeBeaconAndPendingCids(lastPeriod, newPeriod, allCids); 
        
                 _periodEndBlock[lastPeriod] = block.number; 
        
                 _currentPeriodStartAtBlock = block.number + 1; 
        
               } 
        
               // Clear the previous validator set and block producer set before sync the new set from beacon. 
        
               _clearPreviousValidatorSetAndBlockProducerSet(); 
        
               // Query the new validator set for upcoming epoch from the random beacon contract. 
        
               // Save new set into the contract storage. 
        
               address[] memory newValidatorIds = _syncValidatorSet(randomBeacon, newPeriod, nextEpoch); 
        
               // Activate applicable validators into the block producer set. 
        
               _updateApplicableValidatorToBlockProducerSet(newPeriod, nextEpoch, newValidatorIds); 
        
               emit WrappedUpEpoch(lastPeriod, epoch, periodEnding); 
        
               _periodOf[nextEpoch] = newPeriod; 
        
               _lastUpdatedPeriod = newPeriod; 
        
             } 
        
           }

ID-2
Reentrancy in CoinbaseExecution.wrapUpEpoch():
External calls:

dpos-contract/src/ronin/validator/CoinbaseExecution.sol

Lines 112 to 175 in 232d73a

    
           function wrapUpEpoch() external payable virtual override onlyCoinbase whenEpochEnding oncePerEpoch { 
        
             unchecked { 
        
               uint256 newPeriod = _computePeriod(block.timestamp); 
        
               bool periodEnding = _isPeriodEnding(newPeriod); 
        
               uint256 lastPeriod = currentPeriod(); 
        
               uint256 epoch = epochOf(block.number); 
        
               uint256 nextEpoch = epoch + 1; 
        
               IRandomBeacon randomBeacon = IRandomBeacon(getContract(ContractType.RANDOM_BEACON)); 
        
               // This request is actually only invoked at the first epoch of the period. 
        
               randomBeacon.execRequestRandomSeedForNextPeriod(lastPeriod, newPeriod); 
        
               // Get all candidate ids 
        
               address[] memory allCids = _candidateIds; 
        
               _syncFastFinalityReward({ epoch: epoch, validatorIds: allCids }); 
        
               if (periodEnding) { 
        
                 ISlashIndicator slashIndicatorContract = ISlashIndicator(getContract(ContractType.SLASH_INDICATOR)); 
        
                 // Slash submit random beacon proof unavailability first, then update credit scores. 
        
                 randomBeacon.execRecordAndSlashUnavailability(lastPeriod, newPeriod, address(slashIndicatorContract), allCids); 
        
                 slashIndicatorContract.execUpdateCreditScores(allCids, lastPeriod); 
        
                 ( 
        
                   uint256[] memory delegatorBlockMiningRewards, 
        
                   uint256[] memory delegatorL2BlockMiningRewards, 
        
                   uint256[] memory delegatorFastFinalityRewards 
        
                 ) = _distributeRewardToTreasuriesAndCalculateTotalDelegatorsReward(lastPeriod, allCids); 
        
                 _settleAndTransferDelegatingRewards( 
        
                   lastPeriod, allCids, delegatorBlockMiningRewards, delegatorL2BlockMiningRewards, delegatorFastFinalityRewards 
        
                 ); 
        
                 _tryRecycleLockedFundsFromEmergencyExits(); 
        
                 _recycleDeprecatedRewards(); 
        
                 address[] memory revokedCandidateIds = _syncCandidateSet(newPeriod); 
        
                 if (revokedCandidateIds.length > 0) { 
        
                   // Re-update `allCids` after unsatisfied candidates get removed. 
        
                   allCids = _candidateIds; 
        
                   slashIndicatorContract.execResetCreditScores(revokedCandidateIds); 
        
                 } 
        
                 // Wrap up the beacon period includes (1) finalizing the beacon proof, and (2) determining the validator list for the next period by new proof. 
        
                 // Should wrap up the beacon after unsatisfied candidates get removed. 
        
                 randomBeacon.execFinalizeBeaconAndPendingCids(lastPeriod, newPeriod, allCids); 
        
                 _periodEndBlock[lastPeriod] = block.number; 
        
                 _currentPeriodStartAtBlock = block.number + 1; 
        
               } 
        
               // Clear the previous validator set and block producer set before sync the new set from beacon. 
        
               _clearPreviousValidatorSetAndBlockProducerSet(); 
        
               // Query the new validator set for upcoming epoch from the random beacon contract. 
        
               // Save new set into the contract storage. 
        
               address[] memory newValidatorIds = _syncValidatorSet(randomBeacon, newPeriod, nextEpoch); 
        
               // Activate applicable validators into the block producer set. 
        
               _updateApplicableValidatorToBlockProducerSet(newPeriod, nextEpoch, newValidatorIds); 
        
               emit WrappedUpEpoch(lastPeriod, epoch, periodEnding); 
        
               _periodOf[nextEpoch] = newPeriod; 
        
               _lastUpdatedPeriod = newPeriod; 
        
             } 
        
           }

ID-3
Reentrancy in CandidateStaking.execDeprecatePools(address[],uint256):
External calls:
- ! _unsafeSendRONLimitGas(address(_pool.__shadowedPoolAdmin),deductingAmount,DEFAULT_ADDITION_GAS)
  - (success,None) = recipient.call{gas: gas,value: amount}()
- _unsafeSendRONLimitGas(address(_pool.__shadowedPoolAdmin),lastRewardAmount,DEFAULT_ADDITION_GAS)
  - (success,None) = recipient.call{gas: gas,value: amount}()
    State variables written after the call(s):
- delete _adminOfActivePoolMapping[_pool.__shadowedPoolAdmin]
  BaseStaking._adminOfActivePoolMapping can be used in cross function reentrancies:
- CandidateStaking.execDeprecatePools(address[],uint256)
- BaseStaking.getPoolAddressOf(address)
- BaseStaking.isAdminOfActivePool(address)
- lastRewardAmount = _claimReward(poolId,_pool.__shadowedPoolAdmin,newPeriod)
  - _reward.debited = 0
  - _reward.lastPeriod = lastPeriod
  - _reward.aRps = _stakingPool[poolId].aRps
    RewardCalculation._userReward can be used in cross function reentrancies:
- RewardCalculation._claimReward(address,address,uint256)
- RewardCalculation._getReward(address,address,uint256,uint256)
- RewardCalculation._syncUserReward(address,address,uint256)

dpos-contract/src/ronin/staking/CandidateStaking.sol

Lines 120 to 155 in 232d73a

    
           function execDeprecatePools( 
        
             address[] calldata poolIds, 
        
             uint256 newPeriod 
        
           ) external override onlyContract(ContractType.VALIDATOR) { 
        
             if (poolIds.length == 0) { 
        
               return; 
        
             } 
        
             for (uint256 i = 0; i < poolIds.length;) { 
        
               address poolId = poolIds[i]; 
        
               PoolDetail storage _pool = _poolDetail[poolId]; 
        
               // Deactivate the pool admin in the active mapping. 
        
               delete _adminOfActivePoolMapping[_pool.__shadowedPoolAdmin]; 
        
               // Deduct and transfer the self staking amount to the pool admin. 
        
               uint256 deductingAmount = _pool.stakingAmount; 
        
               if (deductingAmount > 0) { 
        
                 _deductStakingAmount(_pool, deductingAmount); 
        
                 if (!_unsafeSendRONLimitGas(payable(_pool.__shadowedPoolAdmin), deductingAmount, DEFAULT_ADDITION_GAS)) { 
        
                   emit StakingAmountTransferFailed(_pool.pid, _pool.__shadowedPoolAdmin, deductingAmount, address(this).balance); 
        
                 } 
        
               } 
        
               // Settle the unclaimed reward and transfer to the pool admin. 
        
               uint256 lastRewardAmount = _claimReward(poolId, _pool.__shadowedPoolAdmin, newPeriod); 
        
               if (lastRewardAmount > 0) { 
        
                 _unsafeSendRONLimitGas(payable(_pool.__shadowedPoolAdmin), lastRewardAmount, DEFAULT_ADDITION_GAS); 
        
               } 
        
               unchecked { 
        
                 ++i; 
        
               } 
        
             } 
        
             emit PoolsDeprecated(poolIds); 
        
           }

ID-4
Reentrancy in CoinbaseExecution.wrapUpEpoch():
External calls:

dpos-contract/src/ronin/validator/CoinbaseExecution.sol

Lines 112 to 175 in 232d73a

    
           function wrapUpEpoch() external payable virtual override onlyCoinbase whenEpochEnding oncePerEpoch { 
        
             unchecked { 
        
               uint256 newPeriod = _computePeriod(block.timestamp); 
        
               bool periodEnding = _isPeriodEnding(newPeriod); 
        
               uint256 lastPeriod = currentPeriod(); 
        
               uint256 epoch = epochOf(block.number); 
        
               uint256 nextEpoch = epoch + 1; 
        
               IRandomBeacon randomBeacon = IRandomBeacon(getContract(ContractType.RANDOM_BEACON)); 
        
               // This request is actually only invoked at the first epoch of the period. 
        
               randomBeacon.execRequestRandomSeedForNextPeriod(lastPeriod, newPeriod); 
        
               // Get all candidate ids 
        
               address[] memory allCids = _candidateIds; 
        
               _syncFastFinalityReward({ epoch: epoch, validatorIds: allCids }); 
        
               if (periodEnding) { 
        
                 ISlashIndicator slashIndicatorContract = ISlashIndicator(getContract(ContractType.SLASH_INDICATOR)); 
        
                 // Slash submit random beacon proof unavailability first, then update credit scores. 
        
                 randomBeacon.execRecordAndSlashUnavailability(lastPeriod, newPeriod, address(slashIndicatorContract), allCids); 
        
                 slashIndicatorContract.execUpdateCreditScores(allCids, lastPeriod); 
        
                 ( 
        
                   uint256[] memory delegatorBlockMiningRewards, 
        
                   uint256[] memory delegatorL2BlockMiningRewards, 
        
                   uint256[] memory delegatorFastFinalityRewards 
        
                 ) = _distributeRewardToTreasuriesAndCalculateTotalDelegatorsReward(lastPeriod, allCids); 
        
                 _settleAndTransferDelegatingRewards( 
        
                   lastPeriod, allCids, delegatorBlockMiningRewards, delegatorL2BlockMiningRewards, delegatorFastFinalityRewards 
        
                 ); 
        
                 _tryRecycleLockedFundsFromEmergencyExits(); 
        
                 _recycleDeprecatedRewards(); 
        
                 address[] memory revokedCandidateIds = _syncCandidateSet(newPeriod); 
        
                 if (revokedCandidateIds.length > 0) { 
        
                   // Re-update `allCids` after unsatisfied candidates get removed. 
        
                   allCids = _candidateIds; 
        
                   slashIndicatorContract.execResetCreditScores(revokedCandidateIds); 
        
                 } 
        
                 // Wrap up the beacon period includes (1) finalizing the beacon proof, and (2) determining the validator list for the next period by new proof. 
        
                 // Should wrap up the beacon after unsatisfied candidates get removed. 
        
                 randomBeacon.execFinalizeBeaconAndPendingCids(lastPeriod, newPeriod, allCids); 
        
                 _periodEndBlock[lastPeriod] = block.number; 
        
                 _currentPeriodStartAtBlock = block.number + 1; 
        
               } 
        
               // Clear the previous validator set and block producer set before sync the new set from beacon. 
        
               _clearPreviousValidatorSetAndBlockProducerSet(); 
        
               // Query the new validator set for upcoming epoch from the random beacon contract. 
        
               // Save new set into the contract storage. 
        
               address[] memory newValidatorIds = _syncValidatorSet(randomBeacon, newPeriod, nextEpoch); 
        
               // Activate applicable validators into the block producer set. 
        
               _updateApplicableValidatorToBlockProducerSet(newPeriod, nextEpoch, newValidatorIds); 
        
               emit WrappedUpEpoch(lastPeriod, epoch, periodEnding); 
        
               _periodOf[nextEpoch] = newPeriod; 
        
               _lastUpdatedPeriod = newPeriod; 
        
             } 
        
           }

ID-5
Reentrancy in CoinbaseExecution.wrapUpEpoch():
External calls:

dpos-contract/src/ronin/validator/CoinbaseExecution.sol

Lines 112 to 175 in 232d73a

    
           function wrapUpEpoch() external payable virtual override onlyCoinbase whenEpochEnding oncePerEpoch { 
        
             unchecked { 
        
               uint256 newPeriod = _computePeriod(block.timestamp); 
        
               bool periodEnding = _isPeriodEnding(newPeriod); 
        
               uint256 lastPeriod = currentPeriod(); 
        
               uint256 epoch = epochOf(block.number); 
        
               uint256 nextEpoch = epoch + 1; 
        
               IRandomBeacon randomBeacon = IRandomBeacon(getContract(ContractType.RANDOM_BEACON)); 
        
               // This request is actually only invoked at the first epoch of the period. 
        
               randomBeacon.execRequestRandomSeedForNextPeriod(lastPeriod, newPeriod); 
        
               // Get all candidate ids 
        
               address[] memory allCids = _candidateIds; 
        
               _syncFastFinalityReward({ epoch: epoch, validatorIds: allCids }); 
        
               if (periodEnding) { 
        
                 ISlashIndicator slashIndicatorContract = ISlashIndicator(getContract(ContractType.SLASH_INDICATOR)); 
        
                 // Slash submit random beacon proof unavailability first, then update credit scores. 
        
                 randomBeacon.execRecordAndSlashUnavailability(lastPeriod, newPeriod, address(slashIndicatorContract), allCids); 
        
                 slashIndicatorContract.execUpdateCreditScores(allCids, lastPeriod); 
        
                 ( 
        
                   uint256[] memory delegatorBlockMiningRewards, 
        
                   uint256[] memory delegatorL2BlockMiningRewards, 
        
                   uint256[] memory delegatorFastFinalityRewards 
        
                 ) = _distributeRewardToTreasuriesAndCalculateTotalDelegatorsReward(lastPeriod, allCids); 
        
                 _settleAndTransferDelegatingRewards( 
        
                   lastPeriod, allCids, delegatorBlockMiningRewards, delegatorL2BlockMiningRewards, delegatorFastFinalityRewards 
        
                 ); 
        
                 _tryRecycleLockedFundsFromEmergencyExits(); 
        
                 _recycleDeprecatedRewards(); 
        
                 address[] memory revokedCandidateIds = _syncCandidateSet(newPeriod); 
        
                 if (revokedCandidateIds.length > 0) { 
        
                   // Re-update `allCids` after unsatisfied candidates get removed. 
        
                   allCids = _candidateIds; 
        
                   slashIndicatorContract.execResetCreditScores(revokedCandidateIds); 
        
                 } 
        
                 // Wrap up the beacon period includes (1) finalizing the beacon proof, and (2) determining the validator list for the next period by new proof. 
        
                 // Should wrap up the beacon after unsatisfied candidates get removed. 
        
                 randomBeacon.execFinalizeBeaconAndPendingCids(lastPeriod, newPeriod, allCids); 
        
                 _periodEndBlock[lastPeriod] = block.number; 
        
                 _currentPeriodStartAtBlock = block.number + 1; 
        
               } 
        
               // Clear the previous validator set and block producer set before sync the new set from beacon. 
        
               _clearPreviousValidatorSetAndBlockProducerSet(); 
        
               // Query the new validator set for upcoming epoch from the random beacon contract. 
        
               // Save new set into the contract storage. 
        
               address[] memory newValidatorIds = _syncValidatorSet(randomBeacon, newPeriod, nextEpoch); 
        
               // Activate applicable validators into the block producer set. 
        
               _updateApplicableValidatorToBlockProducerSet(newPeriod, nextEpoch, newValidatorIds); 
        
               emit WrappedUpEpoch(lastPeriod, epoch, periodEnding); 
        
               _periodOf[nextEpoch] = newPeriod; 
        
               _lastUpdatedPeriod = newPeriod; 
        
             } 
        
           }

shadowing-state

Impact: High
Confidence: High

ID-6
CandidateStaking.______gap shadows:
- BaseStaking.______gap
- RewardCalculation.______gap

dpos-contract/src/ronin/staking/CandidateStaking.sol

Line 27 in 232d73a

uint256[48] ______gap;

ID-7
BaseStaking.______gap shadows:
- RewardCalculation.______gap

dpos-contract/src/ronin/staking/BaseStaking.sol

Line 40 in 232d73a

uint256[49] private ______gap;

ID-8
CommonStorage.______gap shadows:

dpos-contract/src/ronin/validator/storage-fragments/CommonStorage.sol

Line 44 in 232d73a

uint256[42] private ______gap;

ID-9
DelegatorStaking.______gap shadows:
- BaseStaking.______gap
- RewardCalculation.______gap

dpos-contract/src/ronin/staking/DelegatorStaking.sol

Line 13 in 232d73a

uint256[50] private ______gap;

uninitialized-state

Impact: High
Confidence: High

ID-10
TimingStorage._firstTrackedPeriodEnd is never initialized. It is used in:
- TimingStorage.getPeriodEndBlock(uint256)

dpos-contract/src/ronin/validator/storage-fragments/TimingStorage.sol

Line 23 in 232d73a

uint256 internal _firstTrackedPeriodEnd;

ID-11
TimingStorage._numberOfBlocksInEpoch is never initialized. It is used in:

dpos-contract/src/ronin/validator/storage-fragments/TimingStorage.sol

Line 10 in 232d73a

uint256 internal _numberOfBlocksInEpoch;

ID-12
ProfileStorage._rollupId2Id is never initialized. It is used in:
- Profile._tryGetRollupId2Id(uint32)

dpos-contract/src/ronin/profile/ProfileStorage.sol

Line 33 in 232d73a

mapping(uint32 rollupId => address cid) internal _rollupId2Id;

ID-13
TimingStorage._periodOf is never initialized. It is used in:
- TimingStorage.tryGetPeriodOfEpoch(uint256)

dpos-contract/src/ronin/validator/storage-fragments/TimingStorage.sol

Line 19 in 232d73a

mapping(uint256 epoch => uint256 period) internal _periodOf;

ID-14
JailingStorage._miningRewardDeprecatedAtPeriod is never initialized. It is used in:
- JailingStorage._miningRewardDeprecatedById(address,uint256)

dpos-contract/src/ronin/validator/storage-fragments/JailingStorage.sol

Line 9 in 232d73a

    
           mapping(address => mapping(uint256 => bool)) internal _miningRewardDeprecatedAtPeriod;

ID-15
TimingStorage._lastUpdatedBlock is never initialized. It is used in:
- TimingStorage.getLastUpdatedBlock()

dpos-contract/src/ronin/validator/storage-fragments/TimingStorage.sol

Line 12 in 232d73a

uint256 internal _lastUpdatedBlock;

ID-16
ValidatorInfoStorageV2._validatorCount is never initialized. It is used in:

dpos-contract/src/ronin/validator/storage-fragments/ValidatorInfoStorageV2.sol

Line 18 in 232d73a

uint256 internal _validatorCount;

ID-17
TimingStorage._lastUpdatedPeriod is never initialized. It is used in:

dpos-contract/src/ronin/validator/storage-fragments/TimingStorage.sol

Line 14 in 232d73a

uint256 internal _lastUpdatedPeriod;

ID-18
JailingStorage._blockProducerJailedBlock is never initialized. It is used in:
- JailingStorage._getJailedTimeLeftAtBlockById(address,uint256)
- JailingStorage._isJailedAtBlockById(address,uint256)

dpos-contract/src/ronin/validator/storage-fragments/JailingStorage.sol

Line 16 in 232d73a

mapping(address => uint256) internal _blockProducerJailedBlock;

ID-19
ValidatorInfoStorageV2._validatorMap is never initialized. It is used in:
- ValidatorInfoStorageV2._isBlockProducerById(address)

dpos-contract/src/ronin/validator/storage-fragments/ValidatorInfoStorageV2.sol

Line 22 in 232d73a

mapping(address cid => bool isBlockProducer) internal _validatorMap;

ID-20
TimingStorage._periodEndBlock is never initialized. It is used in:
- TimingStorage.getPeriodEndBlock(uint256)

dpos-contract/src/ronin/validator/storage-fragments/TimingStorage.sol

Line 21 in 232d73a

mapping(uint256 period => uint256 endedAtBlock) internal _periodEndBlock;

ID-21
ValidatorInfoStorageV2._validatorIds is never initialized. It is used in:

dpos-contract/src/ronin/validator/storage-fragments/ValidatorInfoStorageV2.sol

Line 20 in 232d73a

mapping(uint256 idx => address cid) internal _validatorIds;

ID-22
TimingStorage._currentPeriodStartAtBlock is never initialized. It is used in:
- TimingStorage.currentPeriodStartAtBlock()

dpos-contract/src/ronin/validator/storage-fragments/TimingStorage.sol

Line 16 in 232d73a

uint256 internal _currentPeriodStartAtBlock;

github-actions · 2024-10-25T08:17:12Z

Storage Layout Change Report

Layout Changes for ProfileHandler

--- https://github.com/ronin-chain/dpos-contract/blob/8f3de799bd122622d3f96abb01db226cd4a58b31/src/ronin/profile/ProfileHandler.sol	.464099646 +0000
+++ https://github.com/ronin-chain/dpos-contract/blob/03b1613b9f1f9d6e7a224b30800677c2ebf39d1d/src/ronin/profile/ProfileHandler.sol	.464099646 +0000
@@ -3,4 +3,5 @@
     2          _consensus2Id                mapping(TConsensus => address)
     3          _profileChangeCooldown       uint256
     4          _vrfKeyHash2Id               mapping(bytes32 => address)
-    5          __gap                        bytes32[46]
+🏴  5          _rollupId2Id                 mapping(uint32 => address)
+🏴  6          __gap                        bytes32[45]

Layout Changes for ProfileStorage

--- https://github.com/ronin-chain/dpos-contract/blob/8f3de799bd122622d3f96abb01db226cd4a58b31/src/ronin/profile/ProfileStorage.sol	.533100945 +0000
+++ https://github.com/ronin-chain/dpos-contract/blob/03b1613b9f1f9d6e7a224b30800677c2ebf39d1d/src/ronin/profile/ProfileStorage.sol	.533100945 +0000
@@ -3,4 +3,5 @@
     2          _consensus2Id                mapping(TConsensus => address)
     3          _profileChangeCooldown       uint256
     4          _vrfKeyHash2Id               mapping(bytes32 => address)
-    5          __gap                        bytes32[46]
+🏴  5          _rollupId2Id                 mapping(uint32 => address)
+🏴  6          __gap                        bytes32[45]

Layout Changes for SlashingExecution

--- https://github.com/ronin-chain/dpos-contract/blob/8f3de799bd122622d3f96abb01db226cd4a58b31/src/ronin/validator/SlashingExecution.sol	.100262167 +0000
+++ https://github.com/ronin-chain/dpos-contract/blob/03b1613b9f1f9d6e7a224b30800677c2ebf39d1d/src/ronin/validator/SlashingExecution.sol	.100262167 +0000
@@ -32,5 +32,6 @@
     173        _lockedConsensusList         address[]
     174        _exitInfo                    mapping(address => struct ICommonInfo.EmergencyExitInfo)
     175        _lockedFundReleased          mapping(address => bool)
-    176        ______gap                    uint256[44]
-
+🏴  176        _validatorL2MiningReward     mapping(address => uint256)
+🏴  177        _delegatorL2MiningReward     mapping(address => uint256)
+🏴  178        ______gap                    uint256[42]

Layout Changes for CoinbaseExecution

--- https://github.com/ronin-chain/dpos-contract/blob/8f3de799bd122622d3f96abb01db226cd4a58b31/src/ronin/validator/CoinbaseExecution.sol	.577271143 +0000
+++ https://github.com/ronin-chain/dpos-contract/blob/03b1613b9f1f9d6e7a224b30800677c2ebf39d1d/src/ronin/validator/CoinbaseExecution.sol	.577271143 +0000
@@ -42,5 +42,6 @@
     230        _lockedConsensusList         address[]
     231        _exitInfo                    mapping(address => struct ICommonInfo.EmergencyExitInfo)
     232        _lockedFundReleased          mapping(address => bool)
-    233        ______gap                    uint256[44]
-
+🏴  233        _validatorL2MiningReward     mapping(address => uint256)
+🏴  234        _delegatorL2MiningReward     mapping(address => uint256)
+🏴  235        ______gap                    uint256[42]

Layout Changes for EmergencyExit

--- https://github.com/ronin-chain/dpos-contract/blob/8f3de799bd122622d3f96abb01db226cd4a58b31/src/ronin/validator/EmergencyExit.sol	.214264312 +0000
+++ https://github.com/ronin-chain/dpos-contract/blob/03b1613b9f1f9d6e7a224b30800677c2ebf39d1d/src/ronin/validator/EmergencyExit.sol	.214264312 +0000
@@ -38,5 +38,6 @@
     226        _lockedConsensusList         address[]
     227        _exitInfo                    mapping(address => struct ICommonInfo.EmergencyExitInfo)
     228        _lockedFundReleased          mapping(address => bool)
-    229        ______gap                    uint256[44]
-
+🏴  229        _validatorL2MiningReward     mapping(address => uint256)
+🏴  230        _delegatorL2MiningReward     mapping(address => uint256)
+🏴  231        ______gap                    uint256[42]

Layout Changes for CoinbaseExecutionDependant

--- https://github.com/ronin-chain/dpos-contract/blob/8f3de799bd122622d3f96abb01db226cd4a58b31/src/ronin/validator/CoinbaseExecutionDependant.sol	.282265592 +0000
+++ https://github.com/ronin-chain/dpos-contract/blob/03b1613b9f1f9d6e7a224b30800677c2ebf39d1d/src/ronin/validator/CoinbaseExecutionDependant.sol	.282265592 +0000
@@ -42,5 +42,6 @@
     230        _lockedConsensusList         address[]
     231        _exitInfo                    mapping(address => struct ICommonInfo.EmergencyExitInfo)
     232        _lockedFundReleased          mapping(address => bool)
-    233        ______gap                    uint256[44]
-
+🏴  233        _validatorL2MiningReward     mapping(address => uint256)
+🏴  234        _delegatorL2MiningReward     mapping(address => uint256)
+🏴  235        ______gap                    uint256[42]

Layout Changes for RoninValidatorSetConstructor

--- https://github.com/ronin-chain/dpos-contract/blob/8f3de799bd122622d3f96abb01db226cd4a58b31/src/ronin/validator/RoninValidatorSetConstructor.sol	.897277165 +0000
+++ https://github.com/ronin-chain/dpos-contract/blob/03b1613b9f1f9d6e7a224b30800677c2ebf39d1d/src/ronin/validator/RoninValidatorSetConstructor.sol	.897277165 +0000
@@ -44,5 +44,6 @@
     231        _lockedConsensusList         address[]
     232        _exitInfo                    mapping(address => struct ICommonInfo.EmergencyExitInfo)
     233        _lockedFundReleased          mapping(address => bool)
-    234        ______gap                    uint256[44]
-
+🏴  234        _validatorL2MiningReward     mapping(address => uint256)
+🏴  235        _delegatorL2MiningReward     mapping(address => uint256)
+🏴  236        ______gap                    uint256[42]

Layout Changes for SlashingExecutionDependant

--- https://github.com/ronin-chain/dpos-contract/blob/8f3de799bd122622d3f96abb01db226cd4a58b31/src/ronin/validator/SlashingExecutionDependant.sol	.315266213 +0000
+++ https://github.com/ronin-chain/dpos-contract/blob/03b1613b9f1f9d6e7a224b30800677c2ebf39d1d/src/ronin/validator/SlashingExecutionDependant.sol	.315266213 +0000
@@ -32,5 +32,6 @@
     173        _lockedConsensusList         address[]
     174        _exitInfo                    mapping(address => struct ICommonInfo.EmergencyExitInfo)
     175        _lockedFundReleased          mapping(address => bool)
-    176        ______gap                    uint256[44]
-
+🏴  176        _validatorL2MiningReward     mapping(address => uint256)
+🏴  177        _delegatorL2MiningReward     mapping(address => uint256)
+🏴  178        ______gap                    uint256[42]

Layout Changes for CommonStorage

--- https://github.com/ronin-chain/dpos-contract/blob/8f3de799bd122622d3f96abb01db226cd4a58b31/src/ronin/validator/storage-fragments/CommonStorage.sol	.351248071 +0000
+++ https://github.com/ronin-chain/dpos-contract/blob/03b1613b9f1f9d6e7a224b30800677c2ebf39d1d/src/ronin/validator/storage-fragments/CommonStorage.sol	.351248071 +0000
@@ -30,5 +30,6 @@
     171        _lockedConsensusList         address[]
     172        _exitInfo                    mapping(address => struct ICommonInfo.EmergencyExitInfo)
     173        _lockedFundReleased          mapping(address => bool)
-    174        ______gap                    uint256[44]
-
+🏴  174        _validatorL2MiningReward     mapping(address => uint256)
+🏴  175        _delegatorL2MiningReward     mapping(address => uint256)
+🏴  176        ______gap                    uint256[42]

huyhuynh3103 · 2024-10-25T08:25:53Z

src/ronin/profile/Profile.sol

+    uint32 rollupId
+  ) external view returns (address) {
+    (bool found, address id) = _tryGetRollupId2Id(rollupId);
+    if (!found) revert ErrLookUpIdFromRollupIdFailed(rollupId);


Why dont we just return address zero when not found? Reverting in external view function doesn't make sense

we have try function for that. This protects other contracts from querying null data

Which other contracts? And should we revert when not found in both methods getId2Aggregator and getId2Sequencer too?

src/ronin/profile/ProfileXComponents.sol

huyhuynh3103 · 2024-10-25T08:33:42Z

src/ronin/profile/Profile.sol

+  function changeSequencerAddr(address id, address sequencer) external onlyAdmin {
+    CandidateProfile storage _profile = _getId2ProfileHelper(id);
+
+    _requireNonZeroAndNonDuplicated(RoleAccess.SEQUENCER, sequencer);


As the logic, aggregator address must be differential from sequencer address. Is it as intended?

huyhuynh3103 · 2024-10-25T08:36:42Z

src/ronin/profile/ProfileXComponents.sol

+  function execCreateRollup(address id, uint32 rollupId) external onlyContract(ContractType.ZK_ROLLUP_MANAGER) {
+    CandidateProfile storage _profile = _getId2ProfileHelper(id);
+
+    _requireNotOnRenunciation(id);


Nice to have: bring it to modifier

will bring later

huyhuynh3103 · 2024-10-25T08:40:59Z

src/ronin/profile/ProfileXComponents.sol

+
+    _requireNotOnRenunciation(id);
+
+    if (_registry[rollupId]) revert ErrRollupIdAlreadyRegistered(rollupId);


If the rollup ID does not exist but accidentally matches any registered address, this tx will be reverted. Is this as intended?

rollupId in range 2**32 so it cannot match

I think this is a valid point, a candidate can register an address as 0x1 on purpose to block the rollup flow then change that address later.

huyhuynh3103 · 2024-10-25T08:42:02Z

src/ronin/validator/CandidateManager.sol

+  /**
+   * @dev Checks whether the candidate has created a rollup before.
+   */
+  function _isRollupOwner(


Suggested change

function _isRollupOwner(

function _isRollupOwned(

huyhuynh3103 · 2024-10-25T08:43:27Z

src/ronin/validator/CoinbaseExecution.sol

-    // TODO: remove this line in the next upgrade
-    if (_firstTrackedPeriodEnd == 0) {
-      _firstTrackedPeriodEnd = _lastUpdatedPeriod;
-    }


Explain the context for this change

huyhuynh3103 · 2024-10-25T08:45:30Z

src/ronin/validator/CoinbaseExecution.sol

+      delete _delegatorL2MiningReward[vId];
+      delete _validatorL2MiningReward[vId];


This change do not follow CEI pattern

github-actions bot added the automated PR label Oct 25, 2024

TuDo1403 force-pushed the feature/zkevm-integration branch from f0cdb07 to 8f3de79 Compare October 25, 2024 07:52

feat(Profile,RoninValidatorSet): add draft implementation for zk-evm …

78e39ac

…integration

TuDo1403 force-pushed the implement-feature/zkevm-integration/draft-impl branch from 9d49a13 to 218c373 Compare October 25, 2024 07:53

test(Profile): fix unit test for new struct

9acc56e

TuDo1403 force-pushed the implement-feature/zkevm-integration/draft-impl branch from 218c373 to 9acc56e Compare October 25, 2024 08:13

test(Profile): fix unit test

7846b69

huyhuynh3103 reviewed Oct 25, 2024

View reviewed changes

minh-bq approved these changes Oct 25, 2024

View reviewed changes

src/ronin/profile/ProfileXComponents.sol Show resolved Hide resolved

huyhuynh3103 reviewed Oct 25, 2024

View reviewed changes

fix(Profile): remove unused check

03b1613

huyhuynh3103 reviewed Oct 25, 2024

View reviewed changes


		_requireNotOnRenunciation(id);

		if (_registry[rollupId]) revert ErrRollupIdAlreadyRegistered(rollupId);

		delete _delegatorL2MiningReward[vId];
		delete _validatorL2MiningReward[vId];

Conversation

github-actions bot commented Oct 25, 2024

Description

Uh oh!

github-actions bot commented Oct 25, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Slither report

reentrancy-eth

shadowing-state

uninitialized-state

Uh oh!

github-actions bot commented Oct 25, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Storage Layout Change Report

Layout Changes for ProfileHandler

Layout Changes for ProfileStorage

Layout Changes for SlashingExecution

Layout Changes for CoinbaseExecution

Layout Changes for EmergencyExit

Layout Changes for CoinbaseExecutionDependant

Layout Changes for RoninValidatorSetConstructor

Layout Changes for SlashingExecutionDependant

Layout Changes for CommonStorage

Uh oh!

Choose a reason for hiding this comment

Uh oh!

TuDo1403 Oct 25, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

github-actions bot commented Oct 25, 2024 •

edited

Loading

github-actions bot commented Oct 25, 2024 •

edited

Loading

TuDo1403 Oct 25, 2024 •

edited

Loading