Deploy permit2 to various chains check #1161
Conversation
…mit2-to-various-chains
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
…mit2-to-various-chains
WalkthroughThis update introduces a new GitHub Actions workflow to automate verification of Permit2 contract bytecode for specific networks when their proxy addresses change. It also standardizes and expands the Permit2 proxy address configuration, updates deployment logs and targets, and adds new scripts and Solidity contracts for Permit2 bytecode extraction and verification. Changes
Warning Review ran into problems🔥 ProblemsErrors were encountered while retrieving linked issues. Errors (1)
✨ Finishing Touches
🧪 Generate Unit Tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🔭 Outside diff range comments (1)
script/utils/permit2/verifyPermit2Bytecode.sh (1)
40-44: 🛠️ Refactor suggestionQuote the runtime byte-code to avoid word-splitting
If
$CODEever contains a newline (Foundry wraps long hex strings) or leading0x, word-splitting can turn it into multiple arguments and break the call.-CODE=$(forge script Permit2Code --sig "getCode(uint256,address)" $CHAIN_ID $ADDRESS --json | jq -r '.returns["0"].value') +CODE="$(forge script Permit2Code --sig "getCode(uint256,address)" "$CHAIN_ID" "$ADDRESS" --json | jq -r '.returns[0].value')" ... -forge script Permit2Check --sig "checkCode(address,bytes)" $ADDRESS $CODE --rpc-url "$RPC_URL" -vvvv +forge script Permit2Check --sig "checkCode(address,bytes)" "$ADDRESS" "$CODE" --rpc-url "$RPC_URL" -vvvvTwo extra quotes now, plus the JSON path fixed to
.returns[0].value(array, not object).
♻️ Duplicate comments (1)
script/deploy/_targetState.json (1)
119-122: Duplicate: New facet additions across multiple networks
These entries mirror the mainnet changes (addingDeBridgeDlnFacet,GlacisFacet, etc.) in other chain blocks. Please refer to the guidance above for validating each.Also applies to: 192-192, 388-388, 421-422, 455-455, 638-639, 703-704, 757-757, 819-820, 883-883, 937-937, 971-971, 1063-1064, 1132-1133, 1170-1170, 1199-1199, 1235-1235, 1325-1325, 1354-1355
🧹 Nitpick comments (9)
script/helperFunctions.sh (1)
3030-3054: EnhancereadJsonValueFromConfigFileerror handling and reuse helpers
Consider the following refinements:
- Use the existing
checkIfFileExistshelper for file existence checks to maintain consistency.- Switch to
jq -erso that missing keys cause a non-zero exit automatically (jq -er '.key // empty' file).- Replace inline
echo "[ERROR]"with the sharederrorfunction to standardize error formatting and exit codes.config/permit2Proxy.json (1)
5-43: Verify network names & keep configuration deterministicThe file now contains many new keys. A few look suspicious (
"soneium","gravity", maybe"blast"instead of"blast-mainnet"etc.) or appear twice across other configs.
Please double-check that each key exactly matches the identifier used everywhere else (networks.json, helper scripts, CI matrix). A typo here silently breaks the verification script becausereadJsonValueFromConfigFilewill succeed (value exists) yet the downstream RPC helpers won’t find a matching entry.As a follow-up, consider sorting the keys alphabetically – future diffs become much smaller and merge conflicts rarer.
script/utils/permit2/Permit2Check.s.sol (2)
8-20: Mark the functions asviewto communicate intent and save gasBoth
checkCodeoverloads only read state (target.code,expected) and never modify storage.
Adding theviewspecifier removes an unnecessarySSTOREpossibility from the generated byte-code and makes static-analysis happier.- function checkCode(address target, bytes memory expected) public virtual { + function checkCode(address target, bytes memory expected) public view virtual { ... - function checkCode(bytes memory expected) public virtual { + function checkCode(bytes memory expected) public view virtual {
11-16: Provide more context in the custom errorRight now the revert gives no hint why the hashes differ.
Returning both hashes (or even the first few bytes of each) greatly speeds up debugging on CI.- error RuntimeCodesAreNotTheSame(); + error RuntimeCodesAreNotTheSame(bytes32 expectedHash, bytes32 onChainHash); ... - if (keccak256(expected) != keccak256(target.code)) - revert RuntimeCodesAreNotTheSame(); + bytes32 expHash = keccak256(expected); + bytes32 onChain = keccak256(target.code); + if (expHash != onChain) revert RuntimeCodesAreNotTheSame(expHash, onChain);script/utils/permit2/Permit2Code.s.sol (2)
11-28: Safety note aboutvm.etch& creation code
vm.etch(where, permit2CreationCalldata)writes creation byte-code directly.
If someone mistakenly runs this script with--broadcast, the injected address becomes bricked (no runtime code) on a public network.The comment “Don’t run in fork! Run isolated!” helps, but you can enforce it:
require(!vm.isFork(), "Permit2Code: must not run in fork/broadcast mode");or wrap the script with
--fork-urldetection in CI.
24-26: Remove dead comment or wire the secondvm.etchLine 24 leaves a commented-out
vm.etch(where, runtimeBytecode);.
If you really want the helper to write the runtime code for local debugging, keep it and gate behind a boolean flag; otherwise delete to avoid confusion..github/workflows/verifyPermit2Bytecode.yml (3)
26-27: Use two-dot diff for PR branch changes
Usingorigin/main...HEADwith three dots can include changes from both branches; to limit the check to commits on the PR branch only, switch to a two-dot range:- if git diff --name-only origin/main...HEAD | grep -q "config/permit2Proxy.json"; then + if git diff --name-only origin/main..HEAD | grep -q "config/permit2Proxy.json"; then
27-31: Quote$GITHUB_ENVto avoid word splitting
ShellCheck (SC2086) flags unquoted variable expansions. Wrap$GITHUB_ENVin quotes in both echo statements:- echo "CONTINUE=true" >> $GITHUB_ENV + echo "CONTINUE=true" >> "$GITHUB_ENV" - echo "CONTINUE=false" >> $GITHUB_ENV + echo "CONTINUE=false" >> "$GITHUB_ENV"
58-59: Quote$GITHUB_ENVwhen exportingCHANGED_NETWORKS
Similarly, quote the environment file path to prevent globbing:- echo "CHANGED_NETWORKS=$(cat changed_networks.json)" >> $GITHUB_ENV + echo "CHANGED_NETWORKS=$(cat changed_networks.json)" >> "$GITHUB_ENV"
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
Cache: Disabled due to data retention organization setting
Knowledge Base: Disabled due to data retention organization setting
📒 Files selected for processing (12)
.github/workflows/verifyPermit2Bytecode.yml(1 hunks)config/permit2Proxy.json(1 hunks)deployments/_deployments_log_file.json(3 hunks)deployments/corn.json(1 hunks)deployments/swellchain.json(1 hunks)deployments/worldchain.diamond.json(1 hunks)deployments/worldchain.json(1 hunks)script/deploy/_targetState.json(30 hunks)script/helperFunctions.sh(2 hunks)script/utils/permit2/Permit2Check.s.sol(1 hunks)script/utils/permit2/Permit2Code.s.sol(1 hunks)script/utils/permit2/verifyPermit2Bytecode.sh(1 hunks)
🧰 Additional context used
🧬 Code Graph Analysis (1)
script/utils/permit2/verifyPermit2Bytecode.sh (1)
script/helperFunctions.sh (3)
getRPCUrl(2786-2795)getChainId(2946-2963)readJsonValueFromConfigFile(3030-3053)
🪛 actionlint (1.7.7)
.github/workflows/verifyPermit2Bytecode.yml
25-25: shellcheck reported issue in this script: SC2086:info:2:27: Double quote to prevent globbing and word splitting
(shellcheck)
25-25: shellcheck reported issue in this script: SC2086:info:5:28: Double quote to prevent globbing and word splitting
(shellcheck)
36-36: shellcheck reported issue in this script: SC2086:info:16:29: Double quote to prevent globbing and word splitting
(shellcheck)
36-36: shellcheck reported issue in this script: SC2086:info:22:59: Double quote to prevent globbing and word splitting
(shellcheck)
🔇 Additional comments (6)
deployments/_deployments_log_file.json (3)
30340-30349: Deployment log entry for version1.0.3looks correct
The added block under the existing environment is properly formatted, with matching metadata fields (ADDRESS,OPTIMIZER_RUNS,TIMESTAMP,CONSTRUCTOR_ARGS,SALT,VERIFIED) and correct comma placement.
30364-30373: Deployment log entry for version1.0.3looks correct
This second environment’s new1.0.3entry follows the same structure and conventions as other entries; formatting and separators are consistent.
30405-30418: Verify newworldchainenvironment entry
A newworldchainnetwork has been added with itsproduction→1.0.3deployment details. Please confirm that this entry matches:
- The Permit2Proxy address configured for
worldchaininconfig/permit2Proxy.json.- The deployment record in
deployments/worldchain.json(if present).script/helperFunctions.sh (1)
2030-2038: Approved explicit function declaration for checkNetworksJsonFilePath
The addition of thefunctionkeyword forcheckNetworksJsonFilePathaligns it with the style used by other helper functions and introduces no regressions.script/deploy/_targetState.json (2)
36-39: Verify new facets on mainnet
You’ve addedChainflipFacet,ReceiverChainflip,DeBridgeDlnFacet, andGlacisFacetfor mainnet:
- Ensure each facet contract is implemented and published at version
1.0.0.- Update any deployment or initialization scripts and tests to include these facets.
- Confirm the mainnet Permit2Proxy address in
config/permit2Proxy.jsonis aligned.
339-365: Review the newbobnetwork target
A brand-new"bob"deployment is introduced:
- Add
bobtoconfig/permit2Proxy.jsonwith a valid Permit2Proxy address.- Verify your deployment tooling, scripts, and tests include
bob.- Confirm facet versions and that the
LiFiDiamondcontract is correctly configured forbob.
| @@ -80,7 +80,7 @@ | |||
| "FeeCollector": "0x50D5a8aCFAe13Dceb217E9a071F6c6Bd5bDB4155", | |||
| "GasZipPeriphery": "0x76aE215b11797b32397d878e6f3E65081ff58b13", | |||
| "LiFiDEXAggregator": "0x2321F1a63A683a1F3634Dbe1CbA0d657D5F56d54", | |||
| "Permit2Proxy": "", | |||
| "Permit2Proxy": "0xfD7c2Ad2fd5c5392904e6d64226c28b0F42da9ed", | |||
There was a problem hiding this comment.
💡 Verification agent
🧩 Analysis chain
Ensure Permit2Proxy config coherence
The new Permit2Proxy address for the worldchain network should match the entry in config/permit2Proxy.json. Please verify with:
and confirm it equals 0xfD7c2Ad2fd5c5392904e6d64226c28b0F42da9ed.
🏁 Script executed:
jq -r '.worldchain' config/permit2Proxy.jsonLength of output: 87
Sync Permit2Proxy Address
The Permit2Proxy address in deployments/worldchain.diamond.json (line 83) (0xfD7c2Ad2fd5c5392904e6d64226c28b0F42da9ed) does not match the .worldchain entry in config/permit2Proxy.json (0x000000000022D473030F116dDEE9F6B43aC78BA3). Please align these values:
• deployments/worldchain.diamond.json (line 83)
• config/permit2Proxy.json (.worldchain)
Recommended change:
--- deployments/worldchain.diamond.json
@@ line 83
- "Permit2Proxy": "0xfD7c2Ad2fd5c5392904e6d64226c28b0F42da9ed",
+ "Permit2Proxy": "0x000000000022D473030F116dDEE9F6B43aC78BA3",📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| "Permit2Proxy": "0xfD7c2Ad2fd5c5392904e6d64226c28b0F42da9ed", | |
| "Permit2Proxy": "0x000000000022D473030F116dDEE9F6B43aC78BA3", |
🤖 Prompt for AI Agents
In deployments/worldchain.diamond.json at line 83, the Permit2Proxy address does
not match the corresponding .worldchain entry in config/permit2Proxy.json.
Update the Permit2Proxy address in deployments/worldchain.diamond.json to
exactly match the value found in config/permit2Proxy.json under the .worldchain
key, which is 0x000000000022D473030F116dDEE9F6B43aC78BA3, ensuring both files
are consistent.
| @@ -15,7 +15,7 @@ | |||
| "Executor": "0x852C8422e0d4968c5B32787432ce3eB908AfFBDB", | |||
| "FeeCollector": "0xC1eFd4D0284e45F23F1cA461e7B45b7Ed8b8713D", | |||
| "LiFiDEXAggregator": "0xEe2083f7f08df8492898307617f84477E4598BAb", | |||
| "Permit2Proxy": "0x8f4912C55177042CD948823F4aC23995496AA58a", | |||
| "Permit2Proxy": "0xad28ab7AE918f4Be8C6C5290500cB94373249F28", | |||
There was a problem hiding this comment.
💡 Verification agent
🧩 Analysis chain
Validate updated Permit2Proxy address for corn network
Ensure the new Permit2Proxy address is correct and aligns with config/permit2Proxy.json:
🏁 Script executed:
jq -r '.corn' config/permit2Proxy.jsonLength of output: 81
Fix mismatched Permit2Proxy address for corn network
The address in deployments/corn.json does not match the value in config/permit2Proxy.json (.corn). Please update it as follows:
deployments/corn.json (line 18)
- "Permit2Proxy": "0xad28ab7AE918f4Be8C6C5290500cB94373249F28",
+ "Permit2Proxy": "0x000000000022D473030F116dDEE9F6B43aC78BA3",📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| "Permit2Proxy": "0xad28ab7AE918f4Be8C6C5290500cB94373249F28", | |
| "Permit2Proxy": "0x000000000022D473030F116dDEE9F6B43aC78BA3", |
🤖 Prompt for AI Agents
In deployments/corn.json at line 18, the Permit2Proxy address does not match the
value specified in config/permit2Proxy.json under the .corn key. Update the
Permit2Proxy address in deployments/corn.json to exactly match the address found
in config/permit2Proxy.json for the corn network to ensure consistency.
| @@ -15,7 +15,7 @@ | |||
| "Executor": "0x3E72E2D59E1b87644291e026b04B0A7D6bEd7E20", | |||
| "FeeCollector": "0x5d9C68B76809B33317d869FF6034929F4458913c", | |||
| "LiFiDEXAggregator": "0xeDA29b03Be07709064ba36233C0a0430450b5941", | |||
| "Permit2Proxy": "0xc53366aD74aaFB58F12Cc83D38B77A11A097b118", | |||
| "Permit2Proxy": "0x0713eDe663E5251A722fdDcde7FbD7d6c23e3006", | |||
There was a problem hiding this comment.
💡 Verification agent
🧩 Analysis chain
Validate updated Permit2Proxy address for swellchain network
Please confirm that config/permit2Proxy.json reflects the updated address for swellchain:
🏁 Script executed:
jq -r '.swellchain' config/permit2Proxy.jsonLength of output: 87
Mismatch in Permit2Proxy address for swellchain
The Permit2Proxy address in deployments/swellchain.json (0x0713eDe663E5251A722fdDcde7FbD7d6c23e3006) does not match the current value in config/permit2Proxy.json (0x000000000022D473030F116dDEE9F6B43aC78BA3). Please update the config entry:
• File: config/permit2Proxy.json
- "swellchain": "0x000000000022D473030F116dDEE9F6B43aC78BA3",
+ "swellchain": "0x0713eDe663E5251A722fdDcde7FbD7d6c23e3006",🤖 Prompt for AI Agents
In config/permit2Proxy.json around the swellchain entry, update the Permit2Proxy
address to match the one in deployments/swellchain.json at line 18, which is
0x0713eDe663E5251A722fdDcde7FbD7d6c23e3006. This ensures consistency between the
deployment file and the configuration file.
| @@ -25,5 +25,6 @@ | |||
| "ReceiverAcrossV3": "0xca6e6B692F568055adA0bF72A06D1EBbC938Fb23", | |||
| "GasZipFacet": "0xb40044Bf27c2448e05e1f34ED83Ca4A3DfA54D19", | |||
| "GasZipPeriphery": "0x76aE215b11797b32397d878e6f3E65081ff58b13", | |||
| "RelayFacet": "0xeBCC663275cec5F53eebcDb16C0bCFacbAe74128" | |||
| "RelayFacet": "0xeBCC663275cec5F53eebcDb16C0bCFacbAe74128", | |||
| "Permit2Proxy": "0xfD7c2Ad2fd5c5392904e6d64226c28b0F42da9ed" | |||
There was a problem hiding this comment.
💡 Verification agent
🧩 Analysis chain
Confirm Permit2Proxy addition for worldchain network
Please verify that the Permit2Proxy entry in deployments/worldchain.json matches the configuration entry:
and confirm the address 0xfD7c2Ad2fd5c5392904e6d64226c28b0F42da9ed is correct.
🏁 Script executed:
jq -r '.worldchain' config/permit2Proxy.jsonLength of output: 87
Mismatch in Permit2Proxy for worldchain network
The address in deployments/worldchain.json (0xfD7c2Ad2fd5c5392904e6d64226c28b0F42da9ed) does not match the config value (0x000000000022D473030F116dDEE9F6B43aC78BA3). Please update line 29 accordingly:
- "Permit2Proxy": "0xfD7c2Ad2fd5c5392904e6d64226c28b0F42da9ed"
+ "Permit2Proxy": "0x000000000022D473030F116dDEE9F6B43aC78BA3"📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| "Permit2Proxy": "0xfD7c2Ad2fd5c5392904e6d64226c28b0F42da9ed" | |
| "Permit2Proxy": "0x000000000022D473030F116dDEE9F6B43aC78BA3" |
🤖 Prompt for AI Agents
In deployments/worldchain.json at line 29, the Permit2Proxy address is
incorrect. Replace the current address
"0xfD7c2Ad2fd5c5392904e6d64226c28b0F42da9ed" with the correct address
"0x000000000022D473030F116dDEE9F6B43aC78BA3" as specified in the
config/permit2Proxy.json file.
| #!/bin/bash | ||
|
|
||
| # load script | ||
| source script/helperFunctions.sh | ||
|
|
||
| # Require argument: <network> | ||
| if [ $# -lt 1 ]; then | ||
| echo "Usage: $0 <network>" | ||
| exit 1 | ||
| fi | ||
|
|
There was a problem hiding this comment.
🛠️ Refactor suggestion
Harden the script with strict bash options
Early exit on unset vars or failed pipes prevents false-green CI runs.
-#!/bin/bash
+#!/usr/bin/env bash
+set -euo pipefailAlso add IFS=$'\n\t' if you expect to ever read arrays.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| #!/bin/bash | |
| # load script | |
| source script/helperFunctions.sh | |
| # Require argument: <network> | |
| if [ $# -lt 1 ]; then | |
| echo "Usage: $0 <network>" | |
| exit 1 | |
| fi | |
| #!/usr/bin/env bash | |
| set -euo pipefail | |
| # load script | |
| source script/helperFunctions.sh | |
| # Require argument: <network> | |
| if [ $# -lt 1 ]; then | |
| echo "Usage: $0 <network>" | |
| exit 1 | |
| fi |
🤖 Prompt for AI Agents
In script/utils/permit2/verifyPermit2Bytecode.sh at lines 1 to 11, the script
lacks strict bash options that improve robustness. Add 'set -euo pipefail' at
the start to enable early exit on errors, unset variables, or failed pipes.
Also, set 'IFS=$'\n\t'' to properly handle array reading and prevent word
splitting issues.
Which Jira task belongs to this PR?
Why did I implement it this way?
Checklist before requesting a review
Checklist for reviewer (DO NOT DEPLOY and contracts BEFORE CHECKING THIS!!!)