Multi-chain reputation rebooted

.circleci/config.yml

@@ -85,6 +85,37 @@ jobs:
       - run:
           name: "Running storage consistency smoke tests"
           command: npm run test:contracts:smoke
+  reputation-test-non-gnosis:
+    <<: *job_common
+    steps:
+      - checkout
+      - <<: *step_restore_cache
+      - setup_remote_docker:
+          version: docker23
+      - <<: *step_pull_solc_docker
+      - <<: *step_setup_global_packages
+      - run:
+          name: "Install lsof"
+          command: |
+            sudo apt-get update
+            sudo apt-get install lsof
+      - run:
+          name: "Running reputation system unit tests"
+          command: npm run test:reputation:1:anotherChain
+          environment:
+            NODE_OPTIONS: --max-old-space-size=6144
+      - run:
+          name: "Reset chains"
+          command: |
+            sudo apt-get update
+            sudo apt-get install lsof
+            npm run stop:blockchain:client && rm -rf ganache-chain-db*
+      - run:
+          name: "Running reputation system unit tests"
+          command: npm run test:reputation:2:anotherChain
+          environment:
+            NODE_OPTIONS: --max-old-space-size=6144
+
   lint-and-unit-test:
     <<: *job_common
     steps:
@@ -388,6 +419,8 @@ workflows:
           context: dockerhub-credentials
       - reputation-test:
           context: dockerhub-credentials
+      - reputation-test-non-gnosis:
+          context: dockerhub-credentials
       - test-contracts-coverage:
           context: dockerhub-credentials
       - test-contracts-extensions-coverage:

.gitmodules

@@ -10,3 +10,6 @@
 	path = lib/safe-contracts
 	url = https://github.com/safe-global/safe-contracts
 	ignore = dirty
+[submodule "lib/wormhole"]
+	path = lib/wormhole
+	url = https://github.com/wormhole-foundation/wormhole.git

.solcover.chainid.js

@@ -4,5 +4,4 @@ config.providerOptions.network_id = parseInt(process.env.CHAIN_ID, 10);
 config.providerOptions._chainId = parseInt(process.env.CHAIN_ID, 10);
 config.providerOptions._chainIdRpc = parseInt(process.env.CHAIN_ID, 10);
 config.istanbulFolder = `./coverage-chainid-${process.env.CHAIN_ID}`
-
 module.exports = config

.solcover.crosschain.js

@@ -1,11 +1,28 @@
 const config = require("./.solcover.js")
 const log = console.log;
 const { execSync } = require("child_process");
+const ethers  = require("ethers");
+
+const { FORKED_XDAI_CHAINID } = require("./helpers/constants");
 
 const existingCompileComplete = config.onCompileComplete;
 
-config.istanbulFolder = `./coverage-cross-chain-${process.env.TRUFFLE_HOME ? "home" : "foreign"}`
+let chainId;
+// We configure the truffle coverage chain to have the same chainid as one of the
+// nodes we've started up, but on a different port
+// TODO: Actually query nodes, don't hard-code here, or work out how to get environment
+// variables in package.json to work here as I want.
+if (JSON.parse(process.env.TRUFFLE_FOREIGN)){
+  chainId = FORKED_XDAI_CHAINID + 1;
+} else {
+  chainId = FORKED_XDAI_CHAINID;
+}
+
+config.providerOptions.network_id = chainId;
+config.providerOptions._chainId = chainId;
+config.providerOptions._chainIdRpc = chainId;
 
+config.istanbulFolder = `./coverage-cross-chain-${JSON.parse(process.env.TRUFFLE_FOREIGN) ? "foreign" : "home"}`
 
 function provisionSafeContracts(){
   let output;

.solcover.js

@@ -4,13 +4,13 @@ const log = console.log;
 // Copies pre-built token artifacts to .coverage_artifacts/contracts
 function provisionTokenContracts(config){
   let output;
-  const provisionColonyToken = `BUILD_DIR="build-coverage" bash ./scripts/provision-token-contracts.sh`;
+  const provisionColonyToken = `BUILD_DIR="build-coverage" npm run provision:token:contracts`;
 
   log('Provisioning ColonyToken contracts...')
   output = execSync(provisionColonyToken);
   log(output.toString())
 
-  const provisionSafeContracts = `BUILD_DIR="build-coverage" bash ./scripts/provision-safe-contracts.sh`;
+  const provisionSafeContracts = `BUILD_DIR="build-coverage" npm run provision:safe:contracts`;
 
   log('Provisioning Safe contracts...')
   output = execSync(provisionSafeContracts);
@@ -33,6 +33,9 @@ module.exports = {
       account_keys_path: "./ganache-accounts.json",
       vmErrorsOnRPCResponse: false,
       total_accounts: 18,
+      _chainId: 265669100,
+      _chainIdRpc: 265669100,
+      network_id: 265669100,
       accounts: [
         {secretKey:"0x0355596cdb5e5242ad082c4fe3f8bbe48c9dba843fe1f99dd8272f487e70efae","balance":"100000000000000000000"},
         {secretKey:"0xe9aebe8791ad1ebd33211687e9c53f13fe8cca53b271a6529c7d7ba05eda5ce2","balance":"100000000000000000000"},
@@ -56,5 +59,5 @@ module.exports = {
     },
     onCompileComplete: provisionTokenContracts,
     istanbulFolder: "./coverage-contracts",
-    modifierWhitelist: ["always"],
+    modifierWhitelist: ["always", "onlyMiningChain", "onlyNotMiningChain"],
 }

contracts/bridging/IColonyBridge.sol

@@ -0,0 +1,52 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+/*
+  This file is part of The Colony Network.
+
+  The Colony Network is free software: you can redistribute it and/or modify
+  it under the terms of the GNU General Public License as published by
+  the Free Software Foundation, either version 3 of the License, or
+  (at your option) any later version.
+
+  The Colony Network is distributed in the hope that it will be useful,
+  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  GNU General Public License for more details.
+
+  You should have received a copy of the GNU General Public License
+  along with The Colony Network. If not, see <http://www.gnu.org/licenses/>.
+*/
+
+pragma solidity 0.8.25;
+pragma experimental "ABIEncoderV2";
+
+interface IColonyBridge {
+  /// @notice Function that checks whether a chain with the supplied evmChainId is supported
+  /// @param _evmChainId The chain id to check
+  /// @return bool Whether the chain is supported
+  function supportedEvmChainId(uint256 _evmChainId) external view returns (bool);
+
+  /// @notice Function to set the colony network address that the bridge will interact with
+  /// @param _colonyNetwork The address of the colony network
+  function setColonyNetworkAddress(address _colonyNetwork) external;
+
+  /// @notice Function to get the colony network address that the bridge is interacting with
+  /// @return address The address of the colony network
+  function getColonyNetworkAddress() external view returns (address);
+
+  /// @notice Function to set the address of the instance of this contract on other chains, that
+  /// this contract will expect to receive messages from
+  /// @param _evmChainId The chain id to set the address for
+  /// @param _colonyBridge The address of the colony bridge contract on the other chain
+  function setColonyBridgeAddress(uint256 _evmChainId, address _colonyBridge) external;
+
+  /// @notice Function to get the address of the instance of this contract on other chains
+  /// @param evmChainId The chain id to get the address for
+  function getColonyBridgeAddress(uint256 evmChainId) external view returns (address);
+
+  /// @notice Function to send a message to the colony bridge on another chain
+  /// @param evmChainId The chain id to send the message to
+  /// @param payload The message payload
+  /// @return bool Whether the message was sent successfully (to the best of the contract's knowledge,
+  /// in terms of the underlying bridge implementation)
+  function sendMessage(uint256 evmChainId, bytes memory payload) external returns (bool);
+}

contracts/bridging/WormholeBridgeForColony.sol

@@ -0,0 +1,135 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+/*
+  This file is part of The Colony Network.
+
+  The Colony Network is free software: you can redistribute it and/or modify
+  it under the terms of the GNU General Public License as published by
+  the Free Software Foundation, either version 3 of the License, or
+  (at your option) any later version.
+
+  The Colony Network is distributed in the hope that it will be useful,
+  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  GNU General Public License for more details.
+
+  You should have received a copy of the GNU General Public License
+  along with The Colony Network. If not, see <http://www.gnu.org/licenses/>.
+*/
+
+pragma solidity 0.8.25;
+
+import { IWormhole } from "../../lib/wormhole/ethereum/contracts/interfaces/IWormhole.sol";
+import { IColonyNetwork } from "../colonyNetwork/IColonyNetwork.sol";
+import { IColonyBridge } from "./IColonyBridge.sol";
+import { CallWithGuards } from "../common/CallWithGuards.sol";
+import { DSAuth } from "../../lib/dappsys/auth.sol";
+
+contract WormholeBridgeForColony is DSAuth, IColonyBridge, CallWithGuards {
+  address colonyNetwork;
+  IWormhole public wormhole;
+
+  // ChainId => colonyBridge
+  mapping(uint256 => address) colonyBridges;
+
+  // Maps evm chain id to wormhole chain id
+  mapping(uint256 => uint16) public evmChainIdToWormholeChainId;
+
+  modifier onlyColonyNetwork() {
+    require(msg.sender == colonyNetwork, "wormhole-bridge-only-colony-network");
+    _;
+  }
+
+  function setChainIdMapping(
+    uint256[] calldata evmChainIds,
+    uint16[] calldata wormholeChainIds
+  ) public auth {
+    require(
+      evmChainIds.length == wormholeChainIds.length,
+      "colony-bridge-chainid-mapping-length-mismatch"
+    );
+    for (uint256 i = 0; i < evmChainIds.length; i++) {
+      evmChainIdToWormholeChainId[evmChainIds[i]] = wormholeChainIds[i];
+    }
+  }
+
+  function supportedEvmChainId(uint256 _evmChainId) public view returns (bool) {
+    return evmChainIdToWormholeChainId[_evmChainId] != 0;
+  }
+
+  function setWormholeAddress(address _wormhole) public auth {
+    wormhole = IWormhole(_wormhole);
+  }
+
+  function setColonyNetworkAddress(address _colonyNetwork) public auth {
+    colonyNetwork = _colonyNetwork;
+  }
+
+  function getColonyNetworkAddress() public view returns (address) {
+    return colonyNetwork;
+  }
+
+  function setColonyBridgeAddress(uint256 _evmChainId, address _bridgeAddress) public auth {
+    require(_evmChainId <= type(uint128).max, "colony-bridge-chainid-too-large");
+    uint16 requestedWormholeChainId = evmChainIdToWormholeChainId[_evmChainId];
+    colonyBridges[requestedWormholeChainId] = _bridgeAddress;
+  }
+
+  function getColonyBridgeAddress(uint256 evmChainId) public view returns (address) {
+    uint16 requestedWormholeChainId = evmChainIdToWormholeChainId[evmChainId];
+    return colonyBridges[requestedWormholeChainId];
+  }
+
+  function wormholeAddressToEVMAddress(
+    bytes32 _wormholeFormatAddress
+  ) public pure returns (address) {
+    return address(uint160(uint256(_wormholeFormatAddress)));
+  }
+
+  function receiveMessage(bytes memory _vaa) public {
+    // VAAs are the primitives used on wormhole (Verified Action Approvals)
+    // See https://docs.wormhole.com/wormhole/explore-wormhole/vaa for more details
+    // Note that the documentation sometimes also calls them VMs (as does IWormhole)
+    // I believe VM stands for 'Verified Message'
+    (IWormhole.VM memory wormholeMessage, bool valid, string memory reason) = wormhole
+      .parseAndVerifyVM(_vaa);
+
+    // Check the vaa was valid
+    require(valid, reason);
+
+    // Check came from a known colony bridge
+    require(
+      wormholeAddressToEVMAddress(wormholeMessage.emitterAddress) ==
+        colonyBridges[wormholeMessage.emitterChainId],
+      "colony-bridge-bridged-tx-only-from-colony-bridge"
+    );
+
+    // We ignore sequence numbers - bridging out of order is okay, because we have our own way of handling that
+
+    // Make the call requested to the colony network
+    (bool success, bytes memory returndata) = callWithGuards(
+      colonyNetwork,
+      wormholeMessage.payload
+    );
+
+    // Note that this is not a require because returndata might not be a string, and if we try
+    // to decode it we'll get a revert.
+    if (!success) {
+      revert(abi.decode(returndata, (string)));
+    }
+  }
+
+  function sendMessage(
+    uint256 _evmChainId,
+    bytes memory _payload
+  ) public onlyColonyNetwork returns (bool) {
+    require(supportedEvmChainId(_evmChainId), "colony-bridge-not-known-chain");
+    // This returns a sequence, but we don't care about it
+    // The first sequence ID is, I believe 0, so all return values are potentially valid
+    // slither-disable-next-line unused-return
+    try wormhole.publishMessage(0, _payload, 0) {
+      return true;
+    } catch {
+      return false;
+    }
+  }
+}

contracts/colony/Colony.sol

@@ -166,23 +166,6 @@ contract Colony is BasicMetaTransaction, Multicall, ColonyStorage, PatriciaTreeP
     emit TokensMinted(msgSender(), _guy, _wad);
   }
 
-  function mintTokensForColonyNetwork(uint _wad) public stoppable {
-    // Only the colony Network can call this function
-    require(msgSender() == colonyNetworkAddress, "colony-access-denied-only-network-allowed");
-    // Function only valid on the Meta Colony
-    require(
-      address(this) == IColonyNetwork(colonyNetworkAddress).getMetaColony(),
-      "colony-access-denied-only-meta-colony-allowed"
-    );
-    // Not callable on Xdai
-    require(!isXdai(), "colony-network-forbidden-on-xdai");
-
-    ERC20Extended(token).mint(_wad);
-    assert(ERC20Extended(token).transfer(colonyNetworkAddress, _wad));
-
-    emit TokensMinted(msgSender(), colonyNetworkAddress, _wad);
-  }
-
   function registerColonyLabel(
     string memory colonyName,
     string memory orbitdb
@@ -210,6 +193,22 @@ contract Colony is BasicMetaTransaction, Multicall, ColonyStorage, PatriciaTreeP
     IColonyNetwork(colonyNetworkAddress).addColonyVersion(_version, _resolver);
   }
 
+  function setColonyBridgeAddress(address _bridgeAddress) public stoppable auth {
+    IColonyNetwork(colonyNetworkAddress).setColonyBridgeAddress(_bridgeAddress);
+  }
+
+  function initialiseReputationMining(
+    uint256 miningChainId,
+    bytes32 newHash,
+    uint256 newNLeaves
+  ) public stoppable auth {
+    IColonyNetwork(colonyNetworkAddress).initialiseReputationMining(
+      miningChainId,
+      newHash,
+      newNLeaves
+    );
+  }
+
   function addExtensionToNetwork(bytes32 _extensionId, address _resolver) public stoppable auth {
     IColonyNetwork(colonyNetworkAddress).addExtensionToNetwork(_extensionId, _resolver);
   }
@@ -312,6 +311,12 @@ contract Colony is BasicMetaTransaction, Multicall, ColonyStorage, PatriciaTreeP
 
     sig = bytes4(keccak256("finalizeExpenditureViaArbitration(uint256,uint256,uint256)"));
     colonyAuthority.setRoleCapability(uint8(ColonyRole.Arbitration), address(this), sig, true);
+
+    sig = bytes4(keccak256("setColonyBridgeAddress(address)"));
+    colonyAuthority.setRoleCapability(uint8(ColonyRole.Root), address(this), sig, true);
+
+    sig = bytes4(keccak256("initialiseReputationMining(uint256,bytes32,uint256)"));
+    colonyAuthority.setRoleCapability(uint8(ColonyRole.Root), address(this), sig, true);
   }
 
   function getMetatransactionNonce(address _user) public view override returns (uint256 nonce) {

contracts/colony/ColonyAuthority.sol

@@ -132,6 +132,8 @@ contract ColonyAuthority is CommonAuthority {
     // Added in colony v15 (hazel-lwss-2)
     addRoleCapability(ARBITRATION_ROLE, "cancelExpenditureViaArbitration(uint256,uint256,uint256)");
     addRoleCapability(ARBITRATION_ROLE, "finalizeExpenditureViaArbitration(uint256,uint256,uint256)");
+    addRoleCapability(ROOT_ROLE, "setColonyBridgeAddress(address)");
+    addRoleCapability(ROOT_ROLE, "initialiseReputationMining(uint256,bytes32,uint256)");
   }
 
   function addRoleCapability(uint8 role, bytes memory sig) private {