feat: [POST AUDIT] OFT changes

.github/workflows/pr.yml

@@ -124,7 +124,7 @@ jobs:
           name: evm-artifacts-${{ runner.os }}-node-${{ env.NODE_VERSION }}
       - name: Test evm-hardhat
         shell: bash
-        run: yarn test-evm
+        run: yarn test-evm-hardhat
   test-svm-verified:
     name: Test verified SVM build
     needs: upload-svm-artifacts
@@ -212,4 +212,4 @@ jobs:
       - name: Inspect storage layouts
         run: ./scripts/checkStorageLayout.sh
       - name: Test evm-foundry
-        run: forge test --match-path test/evm/foundry/local/**/*.t.sol
+        run: yarn test-evm-foundry

contracts/AdapterStore.sol

@@ -0,0 +1,120 @@
+// SPDX-License-Identifier: BUSL-1.1
+pragma solidity ^0.8.18;
+
+import { Ownable } from "@openzeppelin/contracts/access/Ownable.sol";
+import { IOFT } from "./interfaces/IOFT.sol";
+
+/**
+ * @title MessengerTypes
+ * @notice Library containing messenger type constants
+ * @custom:security-contact bugs@across.to
+ */
+library MessengerTypes {
+    /** @notice Identifier for OFT (Omni-chain Fungible Token by LayerZero) messenger type */
+    bytes32 public constant OFT_MESSENGER = bytes32("OFT_MESSENGER");
+}
+
+/**
+ * @dev A helper contract for chain adapters on the hub chain that support OFT messaging. Handles
+ * @dev token => messenger mapping storage. Adapters can't store this themselves as they're called
+ * @dev via `delegateCall` and their storage is not part of available context.
+ * @custom:security-contact bugs@across.to
+ */
+contract AdapterStore is Ownable {
+    /** @notice Maps messenger type and destination domain to token-messenger pairs */
+    mapping(bytes32 messengerType => mapping(uint256 dstDomainId => mapping(address srcChainToken => address messengerAddress)))
+        public crossChainMessengers;
+
+    /**
+     * @notice Emitted when a messenger is set for a specific token and destination
+     * @param messengerType Type of messenger being set
+     * @param dstDomainId Destination domain ID
+     * @param srcChainToken Source chain token address
+     * @param srcChainMessenger Source chain messenger address
+     */
+    event MessengerSet(
+        bytes32 indexed messengerType,
+        uint256 indexed dstDomainId,
+        address indexed srcChainToken,
+        address srcChainMessenger
+    );
+
+    /** @notice Thrown when array lengths don't match in batch operations */
+    error ArrayLengthMismatch();
+
+    /** @notice Thrown when IOFT messenger's token doesn't match expected token */
+    error IOFTTokenMismatch();
+
+    /** @notice Thrown when messenger type is not supported */
+    error NonExistentMessengerType();
+
+    /**
+     * @notice Sets a messenger for a specific token and destination domain
+     * @param messengerType Type of messenger to set
+     * @param dstDomainId Destination domain ID
+     * @param srcChainToken Source chain token address
+     * @param srcChainMessenger Source chain messenger address
+     */
+    function setMessenger(
+        bytes32 messengerType,
+        uint256 dstDomainId,
+        address srcChainToken,
+        address srcChainMessenger
+    ) external onlyOwner {
+        _setMessenger(messengerType, dstDomainId, srcChainToken, srcChainMessenger);
+    }
+
+    /**
+     * @notice Sets multiple messengers in a single transaction
+     * @param messengerTypes Array of messenger types
+     * @param dstDomainIds Array of destination domain IDs
+     * @param srcChainTokens Array of source chain token addresses
+     * @param srcChainMessengers Array of source chain messenger addresses
+     */
+    function batchSetMessengers(
+        bytes32[] calldata messengerTypes,
+        uint256[] calldata dstDomainIds,
+        address[] calldata srcChainTokens,
+        address[] calldata srcChainMessengers
+    ) external onlyOwner {
+        if (
+            messengerTypes.length != dstDomainIds.length ||
+            messengerTypes.length != srcChainTokens.length ||
+            messengerTypes.length != srcChainMessengers.length
+        ) {
+            revert ArrayLengthMismatch();
+        }
+
+        for (uint256 i = 0; i < dstDomainIds.length; i++) {
+            _setMessenger(messengerTypes[i], dstDomainIds[i], srcChainTokens[i], srcChainMessengers[i]);
+        }
+    }
+
+    /**
+     * @notice Internal function to set a messenger with validation
+     * @param _messengerType Type of messenger to set
+     * @param _dstDomainId Destination domain ID
+     * @param _srcChainToken Source chain token address
+     * @param _srcChainMessenger Source chain messenger address
+     */
+    function _setMessenger(
+        bytes32 _messengerType,
+        uint256 _dstDomainId,
+        address _srcChainToken,
+        address _srcChainMessenger
+    ) internal {
+        // @dev Always allow zero-messenger to be set: this can be used to 'remove' a stored token <> messenger relationship
+        if (_srcChainMessenger != address(0)) {
+            if (_messengerType == MessengerTypes.OFT_MESSENGER) {
+                // @dev Protect against human error: check that IOFT messenger's token matches the expected one
+                if (IOFT(_srcChainMessenger).token() != _srcChainToken) {
+                    revert IOFTTokenMismatch();
+                }
+            } else {
+                revert NonExistentMessengerType();
+            }
+        }
+        crossChainMessengers[_messengerType][_dstDomainId][_srcChainToken] = _srcChainMessenger;
+        emit MessengerSet(_messengerType, _dstDomainId, _srcChainToken, _srcChainMessenger);
+    }
+}

contracts/AlephZero_SpokePool.sol

@@ -17,14 +17,18 @@ contract AlephZero_SpokePool is Arbitrum_SpokePool {
         uint32 _depositQuoteTimeBuffer,
         uint32 _fillDeadlineBuffer,
         IERC20 _l2Usdc,
-        ITokenMessenger _cctpTokenMessenger
+        ITokenMessenger _cctpTokenMessenger,
+        uint32 _oftDstEid,
+        uint256 _oftFeeCap
     )
         Arbitrum_SpokePool(
             _wrappedNativeTokenAddress,
             _depositQuoteTimeBuffer,
             _fillDeadlineBuffer,
             _l2Usdc,
-            _cctpTokenMessenger
+            _cctpTokenMessenger,
+            _oftDstEid,
+            _oftFeeCap
         )
     {} // solhint-disable-line no-empty-blocks
 }

contracts/Arbitrum_SpokePool.sol

@@ -27,9 +27,11 @@ contract Arbitrum_SpokePool is SpokePool, CircleCCTPAdapter {
         uint32 _depositQuoteTimeBuffer,
         uint32 _fillDeadlineBuffer,
         IERC20 _l2Usdc,
-        ITokenMessenger _cctpTokenMessenger
+        ITokenMessenger _cctpTokenMessenger,
+        uint32 _oftDstEid,
+        uint256 _oftFeeCap
     )
-        SpokePool(_wrappedNativeTokenAddress, _depositQuoteTimeBuffer, _fillDeadlineBuffer)
+        SpokePool(_wrappedNativeTokenAddress, _depositQuoteTimeBuffer, _fillDeadlineBuffer, _oftDstEid, _oftFeeCap)
         CircleCCTPAdapter(_l2Usdc, _cctpTokenMessenger, CircleDomainIds.Ethereum)
     {} // solhint-disable-line no-empty-blocks
 
@@ -83,9 +85,13 @@ contract Arbitrum_SpokePool is SpokePool, CircleCCTPAdapter {
      **************************************/
 
     function _bridgeTokensToHubPool(uint256 amountToReturn, address l2TokenAddress) internal override {
+        address oftMessenger = _getOftMessenger(l2TokenAddress);
+
         // If the l2TokenAddress is UDSC, we need to use the CCTP bridge.
         if (_isCCTPEnabled() && l2TokenAddress == address(usdcToken)) {
             _transferUsdc(withdrawalRecipient, amountToReturn);
+        } else if (oftMessenger != address(0)) {
+            _transferViaOFT(IERC20(l2TokenAddress), IOFT(oftMessenger), withdrawalRecipient, amountToReturn);
         } else {
             // Check that the Ethereum counterpart of the L2 token is stored on this contract.
             address ethereumTokenToBridge = whitelistedTokens[l2TokenAddress];
@@ -112,4 +118,11 @@ contract Arbitrum_SpokePool is SpokePool, CircleCCTPAdapter {
 
     // Apply AVM-specific transformation to cross domain admin address on L1.
     function _requireAdminSender() internal override onlyFromCrossDomainAdmin {}
+
+    // Reserve storage slots for future versions of this base contract to add state variables without
+    // affecting the storage layout of child contracts. Decrement the size of __gap whenever state variables
+    // are added, so that the total number of slots taken by this contract remains constant. Per-contract
+    // storage layout information  can be found in storage-layouts/
+    // This is at bottom of contract to make sure it's always at the end of storage.
+    uint256[1000] private __gap;
 }

contracts/Ethereum_SpokePool.sol

@@ -16,7 +16,16 @@ contract Ethereum_SpokePool is SpokePool, OwnableUpgradeable {
         address _wrappedNativeTokenAddress,
         uint32 _depositQuoteTimeBuffer,
         uint32 _fillDeadlineBuffer
-    ) SpokePool(_wrappedNativeTokenAddress, _depositQuoteTimeBuffer, _fillDeadlineBuffer) {} // solhint-disable-line no-empty-blocks
+    )
+        SpokePool(
+            _wrappedNativeTokenAddress,
+            _depositQuoteTimeBuffer,
+            _fillDeadlineBuffer,
+            // Ethereum_SpokePool does not use OFT messaging; setting destination eid and fee cap to 0
+            0,
+            0
+        )
+    {} // solhint-disable-line no-empty-blocks
 
     /**
      * @notice Construct the Ethereum SpokePool.

contracts/Linea_SpokePool.sol

@@ -54,7 +54,14 @@ contract Linea_SpokePool is SpokePool, CircleCCTPAdapter {
         IERC20 _l2Usdc,
         ITokenMessenger _cctpTokenMessenger
     )
-        SpokePool(_wrappedNativeTokenAddress, _depositQuoteTimeBuffer, _fillDeadlineBuffer)
+        SpokePool(
+            _wrappedNativeTokenAddress,
+            _depositQuoteTimeBuffer,
+            _fillDeadlineBuffer,
+            // Linea_SpokePool does not use OFT messaging; setting destination eid and fee cap to 0
+            0,
+            0
+        )
         CircleCCTPAdapter(_l2Usdc, _cctpTokenMessenger, CircleDomainIds.Ethereum)
     {} // solhint-disable-line no-empty-blocks
 

contracts/Ovm_SpokePool.sol

@@ -34,6 +34,7 @@ interface IL2ERC20Bridge {
  */
 contract Ovm_SpokePool is SpokePool, CircleCCTPAdapter {
     using SafeERC20 for IERC20;
+
     // "l1Gas" parameter used in call to bridge tokens from this contract back to L1 via IL2ERC20Bridge. Currently
     // unused by bridge but included for future compatibility.
     uint32 public l1Gas;
@@ -71,7 +72,14 @@ contract Ovm_SpokePool is SpokePool, CircleCCTPAdapter {
         IERC20 _l2Usdc,
         ITokenMessenger _cctpTokenMessenger
     )
-        SpokePool(_wrappedNativeTokenAddress, _depositQuoteTimeBuffer, _fillDeadlineBuffer)
+        SpokePool(
+            _wrappedNativeTokenAddress,
+            _depositQuoteTimeBuffer,
+            _fillDeadlineBuffer,
+            // Ovm_SpokePool does not use OFT messaging; setting destination eid and fee cap to 0
+            0,
+            0
+        )
         CircleCCTPAdapter(_l2Usdc, _cctpTokenMessenger, CircleDomainIds.Ethereum)
     {} // solhint-disable-line no-empty-blocks
 
@@ -210,6 +218,8 @@ contract Ovm_SpokePool is SpokePool, CircleCCTPAdapter {
 
     // Reserve storage slots for future versions of this base contract to add state variables without
     // affecting the storage layout of child contracts. Decrement the size of __gap whenever state variables
-    // are added. This is at bottom of contract to make sure its always at the end of storage.
+    // are added, so that the total number of slots taken by this contract remains constant. Per-contract
+    // storage layout information  can be found in storage-layouts/
+    // This is at bottom of contract to make sure it's always at the end of storage.
     uint256[999] private __gap;
 }

contracts/PolygonZkEVM_SpokePool.sol

@@ -93,7 +93,16 @@ contract PolygonZkEVM_SpokePool is SpokePool, IBridgeMessageReceiver {
         address _wrappedNativeTokenAddress,
         uint32 _depositQuoteTimeBuffer,
         uint32 _fillDeadlineBuffer
-    ) SpokePool(_wrappedNativeTokenAddress, _depositQuoteTimeBuffer, _fillDeadlineBuffer) {} // solhint-disable-line no-empty-blocks
+    )
+        SpokePool(
+            _wrappedNativeTokenAddress,
+            _depositQuoteTimeBuffer,
+            _fillDeadlineBuffer,
+            // PolygonZkEVM_SpokePool does not use OFT messaging; setting destination eid and fee cap to 0
+            0,
+            0
+        )
+    {} // solhint-disable-line no-empty-blocks
 
     /**
      * @notice Construct the Polygon zkEVM SpokePool.

contracts/Polygon_SpokePool.sol

@@ -87,7 +87,14 @@ contract Polygon_SpokePool is IFxMessageProcessor, SpokePool, CircleCCTPAdapter
         IERC20 _l2Usdc,
         ITokenMessenger _cctpTokenMessenger
     )
-        SpokePool(_wrappedNativeTokenAddress, _depositQuoteTimeBuffer, _fillDeadlineBuffer)
+        SpokePool(
+            _wrappedNativeTokenAddress,
+            _depositQuoteTimeBuffer,
+            _fillDeadlineBuffer,
+            // Polygon_SpokePool does not use OFT messaging; setting destination eid and fee cap to 0
+            0,
+            0
+        )
         CircleCCTPAdapter(_l2Usdc, _cctpTokenMessenger, CircleDomainIds.Ethereum)
     {} // solhint-disable-line no-empty-blocks
 

contracts/Scroll_SpokePool.sol

@@ -48,7 +48,16 @@ contract Scroll_SpokePool is SpokePool {
         address _wrappedNativeTokenAddress,
         uint32 _depositQuoteTimeBuffer,
         uint32 _fillDeadlineBuffer
-    ) SpokePool(_wrappedNativeTokenAddress, _depositQuoteTimeBuffer, _fillDeadlineBuffer) {} // solhint-disable-line no-empty-blocks
+    )
+        SpokePool(
+            _wrappedNativeTokenAddress,
+            _depositQuoteTimeBuffer,
+            _fillDeadlineBuffer,
+            // Scroll_SpokePool does not use OFT messaging, setting destination id and fee cap to 0
+            0,
+            0
+        )
+    {} // solhint-disable-line no-empty-blocks
 
     /**
      * @notice Construct the Scroll SpokePool.