V3.1 audit fixes

bridge-proxy/src/bridge-proxy.rs

@@ -67,8 +67,8 @@ pub trait BridgeProxyContract:
         } else {
             CallData::default()
         };
-
-        if call_data.endpoint.is_empty()
+        let non_empty_args = call_data.args.is_some();
+        if (call_data.endpoint.is_empty() && non_empty_args)
             || call_data.gas_limit < MIN_GAS_LIMIT_FOR_SC_CALL
             || call_data.gas_limit > MAX_GAS_LIMIT_FOR_SC_CALL
         {
@@ -118,24 +118,27 @@ pub trait BridgeProxyContract:
         self.tx().to(tx.to).payment(payment).transfer();
         self.cleanup_transaction(tx_id);
     }
+
     #[promises_callback]
     fn execution_callback(&self, #[call_result] result: ManagedAsyncCallResult<()>, tx_id: usize) {
         if result.is_err() {
-            self.refund_transaction(tx_id);
+            let tx = self.get_pending_transaction_by_id(tx_id);
+            self.refund_transactions(tx_id).set(&tx);
         }
         self.cleanup_transaction(tx_id);
     }
 
+    #[endpoint(refundTransaction)]
     fn refund_transaction(&self, tx_id: usize) {
-        let tx = self.get_pending_transaction_by_id(tx_id);
+        let tx = self.refund_transactions(tx_id).get();
         let esdt_safe_contract_address = self.get_esdt_safe_address();
 
         let unwrapped_token = self.unwrap_token(&tx.token_id, tx_id);
         let batch_id = self.batch_id(tx_id).get();
         self.tx()
             .to(esdt_safe_contract_address)
             .typed(esdt_safe_proxy::EsdtSafeProxy)
-            .create_transaction(
+            .create_refund_transaction(
                 tx.from,
                 OptionalValue::Some(esdt_safe_proxy::RefundInfo {
                     address: tx.to,
@@ -184,7 +187,8 @@ pub trait BridgeProxyContract:
     }
 
     fn finish_execute_gracefully(&self, tx_id: usize) {
-        self.refund_transaction(tx_id);
+        let tx = self.get_pending_transaction_by_id(tx_id);
+        self.refund_transactions(tx_id).set(&tx);
         self.cleanup_transaction(tx_id);
     }
 

bridge-proxy/src/config.rs

@@ -4,17 +4,21 @@ use transaction::EthTransaction;
 
 #[multiversx_sc::module]
 pub trait ConfigModule {
-    #[storage_mapper("pending_transactions")]
+    #[storage_mapper("pendingTransactions")]
     fn pending_transactions(&self) -> MapMapper<usize, EthTransaction<Self::Api>>;
 
+    #[view(refundTransactions)]
+    #[storage_mapper("refundTransactions")]
+    fn refund_transactions(&self, tx_id: usize) -> SingleValueMapper<EthTransaction<Self::Api>>;
+
     #[storage_mapper("payments")]
     fn payments(&self, tx_id: usize) -> SingleValueMapper<EsdtTokenPayment<Self::Api>>;
 
-    #[storage_mapper("batch_id")]
+    #[storage_mapper("batchId")]
     fn batch_id(&self, tx_id: usize) -> SingleValueMapper<u64>;
 
     #[view(highestTxId)]
-    #[storage_mapper("highest_tx_id")]
+    #[storage_mapper("highestTxId")]
     fn highest_tx_id(&self) -> SingleValueMapper<usize>;
 
     #[storage_mapper("ongoingExecution")]

bridge-proxy/tests/bridge_proxy_blackbox_test.rs

@@ -740,6 +740,77 @@ fn bridge_proxy_too_small_gas_sc_call_test() {
         call_data: ManagedOption::some(call_data),
     };
 
+    let amount = BigUint::from(500u64);
+    // Destination is not an initialized contract
+    test.world
+        .tx()
+        .from(MULTI_TRANSFER_ADDRESS)
+        .to(BRIDGE_PROXY_ADDRESS)
+        .typed(bridge_proxy_contract_proxy::BridgeProxyContractProxy)
+        .deposit(&eth_tx, 1u64)
+        .egld_or_single_esdt(
+            &EgldOrEsdtTokenIdentifier::esdt(BRIDGE_TOKEN_ID),
+            0,
+            &amount,
+        )
+        .run();
+
+    test.world
+        .query()
+        .to(BRIDGE_PROXY_ADDRESS)
+        .typed(bridge_proxy_contract_proxy::BridgeProxyContractProxy)
+        .get_pending_transaction_by_id(1u32)
+        .returns(ExpectValue(eth_tx.clone()))
+        .run();
+
+    test.world
+        .tx()
+        .from(OWNER_ADDRESS)
+        .to(BRIDGE_PROXY_ADDRESS)
+        .typed(bridge_proxy_contract_proxy::BridgeProxyContractProxy)
+        .execute(1u32)
+        .run();
+
+    test.world
+        .check_account(BRIDGE_PROXY_ADDRESS)
+        .check_storage("str:refundTransactions|u32:1", "0x30313032303330343035303630373038303931300000000000000000050063726f7766756e64696e675f5f5f5f5f5f5f5f5f5f5f0000000d4252494447452d3132333435360000000201f4000000000000000101000000150000000466756e6400000000000f42400100000000")
+        .check_storage("str:batchId|u32:1", "1")
+        .check_storage("str:highestTxId", "1")
+        .check_storage("str:payments|u32:1", "nested:str:BRIDGE-123456|u64:0|biguint:500");
+}
+
+#[test]
+fn bridge_proxy_empty_endpoint_with_args_test() {
+    let mut test = BridgeProxyTestState::new();
+
+    test.world.start_trace();
+
+    test.multisig_deploy();
+    test.deploy_bridge_proxy();
+    test.deploy_crowdfunding();
+    test.config_bridge();
+
+    let mut args = ManagedVec::new();
+    let call_data: CallData<StaticApi> = CallData {
+        endpoint: ManagedBuffer::new(),
+        gas_limit: GAS_LIMIT,
+        args: ManagedOption::some(args),
+    };
+
+    let call_data: ManagedBuffer<StaticApi> =
+        ManagedSerializer::new().top_encode_to_managed_buffer(&call_data);
+
+    let eth_tx = EthTransaction {
+        from: EthAddress {
+            raw_addr: ManagedByteArray::new_from_bytes(b"01020304050607080910"),
+        },
+        to: ManagedAddress::from(CROWDFUNDING_ADDRESS.eval_to_array()),
+        token_id: BRIDGE_TOKEN_ID.into(),
+        amount: BigUint::from(500u64),
+        tx_nonce: 1u64,
+        call_data: ManagedOption::some(call_data),
+    };
+
     let amount = BigUint::from(500u64);
     // Destination is not an initialized contract
     test.world
@@ -771,8 +842,10 @@ fn bridge_proxy_too_small_gas_sc_call_test() {
         .execute(1u32)
         .run();
 
-    // Refund: Funds are transfered to EsdtSafe
     test.world
-        .check_account(ESDT_SAFE_ADDRESS)
-        .esdt_balance(BRIDGE_TOKEN_ID, amount.clone());
+    .check_account(BRIDGE_PROXY_ADDRESS)
+    .check_storage("str:refundTransactions|u32:1", "0x30313032303330343035303630373038303931300000000000000000050063726f7766756e64696e675f5f5f5f5f5f5f5f5f5f5f0000000d4252494447452d3132333435360000000201f4000000000000000101000000110000000000000000009896800100000000")
+    .check_storage("str:batchId|u32:1", "1")
+    .check_storage("str:highestTxId", "1")
+    .check_storage("str:payments|u32:1", "nested:str:BRIDGE-123456|u64:0|biguint:500");
 }

bridge-proxy/wasm/src/lib.rs

@@ -6,10 +6,10 @@
 
 // Init:                                 1
 // Upgrade:                              1
-// Endpoints:                            9
+// Endpoints:                           10
 // Async Callback (empty):               1
 // Promise callbacks:                    1
-// Total number of exported functions:  13
+// Total number of exported functions:  14
 
 #![no_std]
 
@@ -23,8 +23,10 @@ multiversx_sc_wasm_adapter::endpoints! {
         upgrade => upgrade
         deposit => deposit
         execute => execute
+        refundTransaction => refund_transaction
         getPendingTransactionById => get_pending_transaction_by_id
         getPendingTransactions => get_pending_transactions
+        refundTransactions => refund_transactions
         highestTxId => highest_tx_id
         pause => pause_endpoint
         unpause => unpause_endpoint

bridged-tokens-wrapper/scenarios/add_wrapped_token.scen.json

@@ -120,12 +120,12 @@
                         "str:universalBridgedTokenIds.len": "1",
                         "str:universalBridgedTokenIds.index|nested:str:WUSDC-abcdef": "1",
                         "str:universalBridgedTokenIds.item|u32:1": "str:WUSDC-abcdef",
-                        "str:token_decimals_num|nested:str:WUSDC-abcdef": "6"
+                        "str:tokenDecimalsNum|nested:str:WUSDC-abcdef": "6"
                     },
                     "code": "file:../output/bridged-tokens-wrapper.wasm",
                     "owner": "address:owner"
                 }
             }
         }
     ]
-}
+}

bridged-tokens-wrapper/scenarios/blacklist_token.scen.json

@@ -19,105 +19,12 @@
                 "gasLimit": "5,000,000",
                 "gasPrice": "0"
             },
-            "expect": {
-                "status": "0",
-                "message": "",
-                "gas": "*",
-                "refund": "*"
-            }
-        },
-        {
-            "step": "scCall",
-            "txId": "unwrap-token",
-            "tx": {
-                "from": "address:user",
-                "to": "sc:bridged_tokens_wrapper",
-                "value": "0",
-                "esdt": {
-                    "tokenIdentifier": "str:WUSDC-abcdef",
-                    "value": "100"
-                },
-                "function": "unwrapToken",
-                "arguments": [
-                    "str:USDC-aaaaaa"
-                ],
-                "gasLimit": "5,000,000",
-                "gasPrice": "0"
-            },
             "expect": {
                 "status": "4",
-                "message": "str:Esdt token unavailable",
+                "message": "str:Cannot blacklist token due to remaining liquidity",
                 "gas": "*",
                 "refund": "*"
             }
-        },
-        {
-            "step": "checkState",
-            "accounts": {
-                "address:owner": {
-                    "nonce": "4",
-                    "balance": "0",
-                    "storage": {}
-                },
-                "address:user": {
-                    "nonce": "5",
-                    "esdt": {
-                        "str:USDC-aaaaaa": {
-                            "balance": "200000000000000"
-                        },
-                        "str:USDC-bbbbbb": {
-                            "balance": "500000000000000"
-                        },
-                        "str:USDC-cccccc": {
-                            "balance": "400000000000000"
-                        },
-                        "str:WUSDC-abcdef": {
-                            "balance": "900"
-                        }
-                    },
-                    "storage": {}
-                },
-                "sc:bridged_tokens_wrapper": {
-                    "nonce": "0",
-                    "esdt": {
-                        "str:WUSDC-abcdef": {
-                            "balance": "1",
-                            "roles": [
-                                "ESDTRoleLocalMint",
-                                "ESDTRoleLocalBurn"
-                            ]
-                        },
-                        "str:WUSDC-uvwxyz": {
-                            "balance": "1",
-                            "roles": [
-                                "ESDTRoleLocalMint",
-                                "ESDTRoleLocalBurn"
-                            ]
-                        },
-                        "str:USDC-aaaaaa": {
-                            "balance": "300000000000000"
-                        },
-                        "str:USDC-cccccc": {
-                            "balance": "100000000000000"
-                        }
-                    },
-                    "storage": {
-                        "str:chainSpecificTokenIds|nested:str:WUSDC-abcdef|str:.len": "1",
-                        "str:chainSpecificTokenIds|nested:str:WUSDC-abcdef|str:.index|nested:str:USDC-cccccc": "1",
-                        "str:chainSpecificTokenIds|nested:str:WUSDC-abcdef|str:.item|u32:1": "str:USDC-cccccc",
-                        "str:chainSpecificToUniversalMapping|nested:str:USDC-cccccc": "str:WUSDC-abcdef",
-                        "str:universalBridgedTokenIds.len": "1",
-                        "str:universalBridgedTokenIds.index|nested:str:WUSDC-abcdef": "1",
-                        "str:universalBridgedTokenIds.item|u32:1": "str:WUSDC-abcdef",
-                        "str:tokenLiquidity|nested:str:USDC-aaaaaa": "300000000000000",
-                        "str:tokenLiquidity|nested:str:USDC-cccccc": "100000000000000",
-                        "str:token_decimals_num|nested:str:WUSDC-abcdef": "6",
-                        "str:token_decimals_num|nested:str:USDC-cccccc": "18"
-                    },
-                    "code": "file:../output/bridged-tokens-wrapper.wasm",
-                    "owner": "address:owner"
-                }
-            }
         }
     ]
-}
+}