Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Certora I01 - Add recipient argument to settle... #786

Merged
merged 21 commits into from
Jul 15, 2024

Conversation

gretzke
Copy link
Contributor

@gretzke gretzke commented Jul 13, 2024

in order to pay on behalf of another address

@gretzke gretzke requested a review from hensha256 July 13, 2024 00:41
test/Sync.t.sol Outdated Show resolved Hide resolved
@gretzke gretzke requested review from hensha256 and snreynolds July 13, 2024 17:34
@gretzke gretzke force-pushed the feat/pay-on-behalf branch from ddd34b1 to 618cf35 Compare July 13, 2024 18:00
@hensha256 hensha256 changed the title Add recipient argument to settle in order to pay on behalf of another… Certora I01 - Add recipient argument to settle... Jul 14, 2024
test/Sync.t.sol Outdated
actions[4] = Actions.ASSERT_DELTA_EQUALS;
params[4] = abi.encode(currency2, address(router), 0);

actions[5] = Actions.PRANK_TAKE_FROM;
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm a little confused what this is testing..

We are encoding here (currency2, recipient, address(this), amount)

but then inside _prankTakeFrom we are decoding (currency, from, recipient, amount)

Can you add another assert after this call for what you expect to happen?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

with settleFor we are settling on behalf of a third party. In order to be able to close out the delta, I'm pranking from the address that is the recipient in the settleFor call in order to successfully close out the deltas. Thus, the functionality is also implicitly tested, because the deltas are closed

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yeah +1 to what sara said. The command decodes

(Currency currency, address from, address recipient, uint256 amount) =
            abi.decode(params, (Currency, address, address, uint256));

But this call has the recipient second not third. Please can you check it and add checks 🙏

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

no this is correct, the recipient is the settleFor recipient, the account that receives the positive delta during the settleFor call. So that's the account we need to prank (from). The recipient in take is the recipient of the funds

Copy link
Member

@snreynolds snreynolds Jul 15, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think I see whats happening and IMO its just confusing because the params are the same names for different contexts. I think what you are testing is.. apply a positive delta for recipient, then prank that recipient and send it to somewhere else.

I think what I would prefer to see tested is pranking another address such that there is a negative delta open on that address then someone else transfers their own funds, and calls settleFor on behalf of the original person with the open negative deltas ( to pay off on their behalf)

Base automatically changed from fix/c01 to audit/openzeppelin July 14, 2024 22:24
@gretzke gretzke merged commit ad4b3f0 into audit/openzeppelin Jul 15, 2024
5 checks passed
@gretzke gretzke deleted the feat/pay-on-behalf branch July 15, 2024 21:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants