Work for v4.1.0 (#96)

tinchoabbate · web-flow · commit 64fddf9f96de · 2025-03-21T12:25:21.000+01:00
diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile
@@ -25,10 +25,10 @@ RUN curl -o- https://raw.githubusercontent.com/devcontainers/features/main/src/n
 # Install solc-select
 RUN pipx install solc-select
 
-# Foundry at specific version
+# Foundry
 RUN curl -L https://foundry.paradigm.xyz | zsh
 
-RUN foundryup --version nightly-2044faec64f99a21f0e5f0094458a973612d0712
+RUN foundryup
 
 # Clean up
 RUN sudo apt-get autoremove -y && sudo apt-get clean -y
diff --git a/.gitmodules b/.gitmodules
@@ -41,11 +41,12 @@
 [submodule "lib/v3-periphery"]
 	path = lib/v3-periphery
 	url = https://github.com/Uniswap/v3-periphery
+	ignore = dirty
 [submodule "lib/v3-core"]
 	path = lib/v3-core
 	url = https://github.com/Uniswap/v3-core
 	ignore = dirty
 [submodule "lib/permit2"]
 	path = lib/permit2
 	url = https://github.com/Uniswap/permit2
-	ignore = dirty
+	ignore = dirty 
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,18 @@
 # Changelog
 
+## v4.1.0
+
+- Updated Wallet Mining challenge to:
+    - Use a new `USER_DEPOSIT_ADDRESS`
+    - Use [CREATEX](https://github.com/pcaversaccio/createx) for deployment of `AuthorizerFactory` and `WalletDeployer`
+    - Set `chief` of `WalletDeployer` in constructor instead of `msg.sender`
+    - Use [Safe Singleton Factory](https://github.com/safe-global/safe-singleton-factory)'s signed transaction for this chain (instead of using `etch` to set the code)
+- Updated devcontainer to use Foundry stable
+- Updated libraries (OZ Contracts, forge-std)
+- Explicitly enabled optimizer in `foundry.toml`
+- Updated instances of `vm.expectRevert`
+- Fixed some comments
+
 ## v4.0.1
 
 - Updated README instructions to include `--isolate` mode (https://github.com/theredguild/damn-vulnerable-defi/pull/77)
diff --git a/README.md b/README.md
@@ -14,7 +14,7 @@ Use Damn Vulnerable DeFi to:
 ## Install
 
 1. Clone the repository.
-2. Checkout the latest release (for example, `git checkout v4.0.1`)
+2. Checkout the latest release (for example, `git checkout v4.1.0`)
 3. Rename the `.env.sample` file to `.env` and add a valid RPC URL. This is only needed for the challenges that fork mainnet state.
 4. Either install [Foundry](https://book.getfoundry.sh/getting-started/installation), or use the [provided devcontainer](./.devcontainer/) (In VSCode, open the repository as a devcontainer with the command "Devcontainer: Open Folder in Container...")
 5. Run `forge build` to initialize the project.
diff --git a/foundry.toml b/foundry.toml
@@ -14,3 +14,6 @@ ignored_warnings_from = [
     "src/curvy-puppet/ICryptoSwapPool.sol"
 ]
 bytecode_hash = "none"
+optimizer = true
+optimizer_runs = 200
+
diff --git a/lib/forge-std b/lib/forge-std
@@ -1 +1 @@
-Subproject commit 07263d193d621c4b2b0ce8b4d54af58f6957d97d
+Subproject commit 3b20d60d14b343ee4f908cb8079495c07f5e8981
diff --git a/lib/openzeppelin-contracts b/lib/openzeppelin-contracts
@@ -1 +1 @@
-Subproject commit dbb6104ce834628e473d2173bbc9d47f81a9eec3
+Subproject commit acd4ff74de833399287ed6b31b4debf6b2b35527
diff --git a/lib/openzeppelin-contracts-upgradeable b/lib/openzeppelin-contracts-upgradeable
@@ -1 +1 @@
-Subproject commit 723f8cab09cdae1aca9ec9cc1cfa040c2d4b06c1
+Subproject commit 3d5fa5c24c411112bab47bec25cfa9ad0af0e6e8
diff --git a/src/wallet-mining/README.md b/src/wallet-mining/README.md
@@ -4,7 +4,7 @@ There’s a contract that incentivizes users to deploy Safe wallets, rewarding t
 
 The deployer contract only works with a Safe factory and copy set during deployment. It looks like the [Safe singleton factory](https://github.com/safe-global/safe-singleton-factory) is already deployed.
 
-The team transferred 20 million DVT tokens to a user at `0x8be6a88D3871f793aD5D5e24eF39e1bf5be31d2b`, where her plain 1-of-1 Safe was supposed to land. But they lost the nonce they should use for deployment.
+The team transferred 20 million DVT tokens to a user at `0xCe07CF30B540Bb84ceC5dA5547e1cb4722F9E496`, where her plain 1-of-1 Safe was supposed to land. But they lost the nonce they should use for deployment.
 
 To make matters worse, there's been rumours of a vulnerability in the system. The team's freaked out. Nobody knows what to do, let alone the user. She granted you access to her private key.
 
diff --git a/src/wallet-mining/WalletDeployer.sol b/src/wallet-mining/WalletDeployer.sol
@@ -16,18 +16,19 @@ contract WalletDeployer {
     address public immutable cpy;
 
     uint256 public constant pay = 1 ether;
-    address public immutable chief = msg.sender;
+    address public immutable chief;
     address public immutable gem;
 
     address public mom;
     address public hat;
 
     error Boom();
 
-    constructor(address _gem, address _cook, address _cpy) {
+    constructor(address _gem, address _cook, address _cpy, address _chief) {
         gem = _gem;
         cook = SafeProxyFactory(_cook);
         cpy = _cpy;
+        chief = _chief;
     }
 
     /**
diff --git a/test/backdoor/Backdoor.t.sol b/test/backdoor/Backdoor.t.sol
@@ -60,7 +60,7 @@ contract BackdoorChallenge is Test {
             assertTrue(walletRegistry.beneficiaries(users[i]));
 
             // User cannot add beneficiaries
-            vm.expectRevert(0x82b42900); // `Unauthorized()`
+            vm.expectRevert(bytes4(hex"82b42900")); // `Unauthorized()`
             vm.prank(users[i]);
             walletRegistry.addBeneficiary(users[i]);
         }
diff --git a/test/compromised/Compromised.t.sol b/test/compromised/Compromised.t.sol
@@ -60,7 +60,7 @@ contract CompromisedChallenge is Test {
     }
 
     /**
-     * CODE YOUR SOLUTION HERE
+     * VALIDATES INITIAL CONDITIONS - DO NOT TOUCH
      */
     function test_assertInitialState() public view {
         for (uint256 i = 0; i < sources.length; i++) {
diff --git a/test/naive-receiver/NaiveReceiver.t.sol b/test/naive-receiver/NaiveReceiver.t.sol
@@ -63,7 +63,7 @@ contract NaiveReceiverChallenge is Test {
         assertEq(pool.feeReceiver(), deployer);
 
         // Cannot call receiver
-        vm.expectRevert(0x48f5c3ed);
+        vm.expectRevert(bytes4(hex"48f5c3ed"));
         receiver.onFlashLoan(
             deployer,
             address(weth), // token
diff --git a/test/wallet-mining/CreateX.sol b/test/wallet-mining/CreateX.sol
diff --git a/test/wallet-mining/SafeSingletonFactory.sol b/test/wallet-mining/SafeSingletonFactory.sol
@@ -0,0 +1,11 @@
+// SPDX-License-Identifier: MIT
+// Damn Vulnerable DeFi v4 (https://damnvulnerabledefi.xyz)
+pragma solidity =0.8.25;
+
+// Safe Singleton Factory deployment data
+address constant SAFE_SINGLETON_FACTORY_DEPLOYMENT_SIGNER = 0xE1CB04A0fA36DdD16a06ea828007E35e1a3cBC37;
+bytes constant SAFE_SINGLETON_FACTORY_DEPLOYMENT_TX =
+    hex"f8a78085174876e800830186a08080b853604580600e600039806000f350fe7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffe03601600081602082378035828234f58015156039578182fd5b8082525050506014600cf382f4f5a00dc4d1d21b308094a30f5f93da35e4d72e99115378f135f2295bea47301a3165a0636b822daad40aa8c52dd5132f378c0c0e6d83b4898228c7e21c84e631a0b891";
+address constant SAFE_SINGLETON_FACTORY_ADDRESS = 0x914d7Fec6aaC8cd542e72Bca78B30650d45643d7;
+bytes constant SAFE_SINGLETON_FACTORY_CODE =
+    hex"7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffe03601600081602082378035828234f58015156039578182fd5b8082525050506014600cf3";
diff --git a/test/wallet-mining/WalletMining.t.sol b/test/wallet-mining/WalletMining.t.sol
@@ -5,12 +5,25 @@ pragma solidity =0.8.25;
 import {Test, console} from "forge-std/Test.sol";
 import {SafeProxyFactory} from "@safe-global/safe-smart-account/contracts/proxies/SafeProxyFactory.sol";
 import {Safe, OwnerManager, Enum} from "@safe-global/safe-smart-account/contracts/Safe.sol";
-import {Create2} from "@openzeppelin/contracts/utils/Create2.sol";
+import {SafeProxy} from "@safe-global/safe-smart-account/contracts/proxies/SafeProxy.sol";
 import {DamnValuableToken} from "../../src/DamnValuableToken.sol";
 import {WalletDeployer} from "../../src/wallet-mining/WalletDeployer.sol";
 import {
     AuthorizerFactory, AuthorizerUpgradeable, TransparentProxy
 } from "../../src/wallet-mining/AuthorizerFactory.sol";
+import {
+    ICreateX,
+    CREATEX_DEPLOYMENT_SIGNER,
+    CREATEX_ADDRESS,
+    CREATEX_DEPLOYMENT_TX,
+    CREATEX_CODEHASH
+} from "./CreateX.sol";
+import {
+    SAFE_SINGLETON_FACTORY_DEPLOYMENT_SIGNER,
+    SAFE_SINGLETON_FACTORY_DEPLOYMENT_TX,
+    SAFE_SINGLETON_FACTORY_ADDRESS,
+    SAFE_SINGLETON_FACTORY_CODE
+} from "./SafeSingletonFactory.sol";
 
 contract WalletMiningChallenge is Test {
     address deployer = makeAddr("deployer");
@@ -20,13 +33,9 @@ contract WalletMiningChallenge is Test {
     address user;
     uint256 userPrivateKey;
 
-    address constant USER_DEPOSIT_ADDRESS = 0x8be6a88D3871f793aD5D5e24eF39e1bf5be31d2b;
+    address constant USER_DEPOSIT_ADDRESS = 0xCe07CF30B540Bb84ceC5dA5547e1cb4722F9E496;
     uint256 constant DEPOSIT_TOKEN_AMOUNT = 20_000_000e18;
 
-    address constant SAFE_SINGLETON_FACTORY_ADDRESS = 0x914d7Fec6aaC8cd542e72Bca78B30650d45643d7;
-    bytes constant SAFE_SINGLETON_FACTORY_CODE =
-        hex"7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffe03601600081602082378035828234f58015156039578182fd5b8082525050506014600cf3";
-
     DamnValuableToken token;
     AuthorizerUpgradeable authorizer;
     WalletDeployer walletDeployer;
@@ -49,6 +58,20 @@ contract WalletMiningChallenge is Test {
         // Player should be able to use the user's private key
         (user, userPrivateKey) = makeAddrAndKey("user");
 
+        // Deploy Safe Singleton Factory contract using signed transaction
+        vm.deal(SAFE_SINGLETON_FACTORY_DEPLOYMENT_SIGNER, 10 ether);
+        vm.broadcastRawTransaction(SAFE_SINGLETON_FACTORY_DEPLOYMENT_TX);
+        assertEq(
+            SAFE_SINGLETON_FACTORY_ADDRESS.codehash,
+            keccak256(SAFE_SINGLETON_FACTORY_CODE),
+            "Unexpected Safe Singleton Factory code"
+        );
+
+        // Deploy CreateX contract using signed transaction
+        vm.deal(CREATEX_DEPLOYMENT_SIGNER, 10 ether);
+        vm.broadcastRawTransaction(CREATEX_DEPLOYMENT_TX);
+        assertEq(CREATEX_ADDRESS.codehash, CREATEX_CODEHASH, "Unexpected CreateX code");
+
         startHoax(deployer);
 
         // Deploy token
@@ -59,15 +82,18 @@ contract WalletMiningChallenge is Test {
         wards[0] = ward;
         address[] memory aims = new address[](1);
         aims[0] = USER_DEPOSIT_ADDRESS;
-        AuthorizerFactory authorizerFactory = new AuthorizerFactory();
+
+        AuthorizerFactory authorizerFactory = AuthorizerFactory(
+            ICreateX(CREATEX_ADDRESS).deployCreate2({
+                salt: bytes32(keccak256("dvd.walletmining.authorizerfactory")),
+                initCode: type(AuthorizerFactory).creationCode
+            })
+        );
         authorizer = AuthorizerUpgradeable(authorizerFactory.deployWithProxy(wards, aims, upgrader));
 
         // Send big bag full of DVT tokens to the deposit address
         token.transfer(USER_DEPOSIT_ADDRESS, DEPOSIT_TOKEN_AMOUNT);
 
-        // Include Safe singleton factory in this chain
-        vm.etch(SAFE_SINGLETON_FACTORY_ADDRESS, SAFE_SINGLETON_FACTORY_CODE);
-
         // Call singleton factory to deploy copy and factory contracts
         (bool success, bytes memory returndata) =
             address(SAFE_SINGLETON_FACTORY_ADDRESS).call(bytes.concat(bytes32(""), type(Safe).creationCode));
@@ -78,12 +104,20 @@ contract WalletMiningChallenge is Test {
         proxyFactory = SafeProxyFactory(address(uint160(bytes20(returndata))));
 
         // Deploy wallet deployer
-        walletDeployer = new WalletDeployer(address(token), address(proxyFactory), address(singletonCopy));
+        walletDeployer = WalletDeployer(
+            ICreateX(CREATEX_ADDRESS).deployCreate2({
+                salt: bytes32(keccak256("dvd.walletmining.walletdeployer")),
+                initCode: bytes.concat(
+                    type(WalletDeployer).creationCode,
+                    abi.encode(address(token), address(proxyFactory), address(singletonCopy), deployer) // constructor args are appended at the end of creation code
+                )
+            })
+        );
 
         // Set authorizer in wallet deployer
         walletDeployer.rule(address(authorizer));
 
-        // Fund wallet deployer with tokens
+        // Fund wallet deployer with initial tokens
         initialWalletDeployerTokenBalance = walletDeployer.pay();
         token.transfer(address(walletDeployer), initialWalletDeployerTokenBalance);
 

Original file line number	Diff line number	Diff line change
`@@ -14,3 +14,6 @@ ignored_warnings_from = [`
`14`	`14`	`"src/curvy-puppet/ICryptoSwapPool.sol"`
`15`	`15`	`]`
`16`	`16`	`bytecode_hash = "none"`
	`17`	`+optimizer = true`
	`18`	`+optimizer_runs = 200`
	`19`	`+`