feat(scroll): adapter and spokepool

[james-a-morris]

This PR creates the Chain Adapter for Scroll.

Sepolia Deployments for L1 -> L2 communication:

Deployments:

Network	Contract Name	Address
Sepolia	Scroll Adapter	0x99EC530a761E68a377593888D9504002Bd191717
Sepolia	Mock Hubpool (for l1->l2 token transfers)	0xa9F2Ba6333B78375b967d39CFdB38feE28288F2c
Sepolia	Hubpool (for SetDepositRoute)	0x14224e63716afAcE30C9a417E0542281869f7d9e
Sepolia Scroll	Spoke Pool	0x76f3fe966F91602129cb278043239afBB7B7646A

Type	L1 Transaction	L2 Txn Confirmation
ERC-20	0xc2a...8d8	0xddd...125
WETH	0xb42...5c1	0xb1c...532
Set Deposit Route	0x4a9...546	0xbba...af0

---

Closes ACX-1753, ACX-1757, ACX-1765, ACX-1780

[linear]

ACX-1757 Create Scroll Adapter

[socket-security]

New dependencies detected. Learn more about Socket for GitHub ↗︎

Packages	Version	New capabilities	Transitives	Size	Publisher
@scroll-tech/contracts	0.1.0	None	+0	198 kB	turupawn
axios	1.6.2	None	+0	1.8 MB	jasonsaayman

[nicholaspai]

This looks great, how did it perform with integration tests?

[pxrl]

Some quick initial comments.

[mrice32]

Looks great! A few questions

[mrice32]

Looks great! Just a few minor comments

[mrice32]

If our gas limit is too high and gas is left unused on the destination, does that money get lost or is it refunded somehow?

[james-a-morris]

Per the TG group chat with the Scroll team, our ETH may get burned if we overestimate our gas limit. However, we were told in a previous message that 250,000 is an acceptable amount.

[james-a-morris]

@nicholaspai @mrice32 @pxrl updated the test txns in this PR's description to the latest txn tests as of 300735d

[nicholaspai]

Can xDomainMessageSender be set to whatever a malicious contract wants it to or is it always the contract that is the target of the L1 to L2 message?

[james-a-morris]

(I'm going to go through each call in the stack so this might be longform, but tl;dr I believe we should be fine as long as we trust the chain)

---

Per master on scroll's official github ( link ), the xDomainMessenger is set to be the _from sender (sender of the L1 txn) here. The transaction stack is l2TokenMessenger calls relayMessage -> _executeMessage.

_executeMessage

function _executeMessage(
        address _from,
        address _to,
        uint256 _value,
        bytes memory _message,
        bytes32 _xDomainCalldataHash
    ) internal {
        // @note check more `_to` address to avoid attack in the future when we add more gateways.
        require(_to != messageQueue, "Forbid to call message queue");
        _validateTargetAddress(_to);

        // @note This usually will never happen, just in case.
        require(_from != xDomainMessageSender, "Invalid message sender"); 

the last line of this snippet always set to be the DEFAULT_XDOMAIN_MESSAGE_SENDER outside of this specific case. This is a call to ensure that doesn't happen

        xDomainMessageSender = _from;
        // solhint-disable-next-line avoid-low-level-calls
        (bool success, ) = _to.call{value: _value}(_message);
        // reset value to refund gas.
        xDomainMessageSender = ScrollConstants.DEFAULT_XDOMAIN_MESSAGE_SENDER; <--- Immediately resets
        ...
    }

In the above ^ it's only set to be read within the context of _to.call(...) and then is immediately reset

relayMessage

    function relayMessage(
        address _from,
        address _to,
        uint256 _value,
        uint256 _nonce,
        bytes memory _message
    ) external override whenNotPaused {
        // It is impossible to deploy a contract with the same address, reentrance is prevented in nature.
        require(AddressAliasHelper.undoL1ToL2Alias(_msgSender()) == counterpart, "Caller is not L1ScrollMessenger");

        bytes32 _xDomainCalldataHash = keccak256(_encodeXDomainCalldata(_from, _to, _value, _nonce, _message));

        require(!isL1MessageExecuted[_xDomainCalldataHash], "Message was already successfully executed");

        _executeMessage(_from, _to, _value, _message, _xDomainCalldataHash);
    }

From the above, what we're really looking for is that _msgSender() which is the msg.sender is the counterpart domain of the L1ScrollMessenger. Ergo if we pass that require, it must be the case that the calling contract is the trusted L2ScrollMessenger.

L2ScrollMessenger

We have an implicit trust that the L2ScrollMessenger is going to set things right.

[nicholaspai]

This looks great. LGTM after we get an answer about excess xchain message fees and I also left two additional comments

[linear]

ACX-1765 Create Scroll SpokePool

ACX-1753 Setup test framework on Sepolia

ACX-1780 Confirm two or more independent RPC node providers

[james-a-morris]

@nicholaspai @mrice32 @dohaki I've added a second gas limit so that we can differentiate between arbitrary messages & token relays

[dohaki]

🔥 LGTM

[nicholaspai]

would have implemented this with a single internal function where you pass in uint256 l2GasLimit.

Then, within relayTokens and relayMessage you pass in a different constant

[james-a-morris]

Done: e9b4443

[nicholaspai]

Looks good to go, I left two comments on making code better

[mrice32]

LGTM!