Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Prevent governance proxy deploy with rogue strategy contract #33

Open
gabririgo opened this issue Dec 2, 2023 · 0 comments
Open

Prevent governance proxy deploy with rogue strategy contract #33

gabririgo opened this issue Dec 2, 2023 · 0 comments

Comments

@gabririgo
Copy link
Contributor

Summary

When a proxy is deployed, the input parameters are validated in a strategy contract (which is also an input). The proxy deployment should revert if the strategy contract does not implement the method assertValidInitParams, thus not validating the parameters.

Motivation

While this is an edge case where a user inputs a rogue strategy contract at governance deployment, the end result is that the user won't be able to re-deploy another governance proxy with the same name after realizing the mistake. This is relevant for multi-chain governance proxies. Also, if the user inputs a rogue strategy smart contract address (which must be a smart contract indeed), does not realize the mistake, and transfers ownership of another contract to said governance, no proposal can be made, voted on, and the implementation cannot be upgraded.

Specification

To revert pool initialization without error if IRigoblockGovernanceStrategy.assertValidInitParams(params) does not execute, i.e., also in the case it fails silently (as with a smart contract that does not implement the method). The result can be achieved without assembly or low-level calls by using a try/catch statement.

try IGovernanceStrategy(params.governanceStrategy).assertValidInitParams(params) {

} catch {
   revert StrategyParamsAssertion();
}

Notes

An implementation has been proposed here and includes updates to the ci test suite.

@gabririgo gabririgo added the bug Something isn't working label Dec 2, 2023
@gabririgo gabririgo changed the title fix[Governance]: prevent proxy deploy with rogue strategy contract fix(governance): prevent proxy deploy with rogue strategy contract Dec 2, 2023
@gabririgo gabririgo removed the bug Something isn't working label Dec 19, 2023
@gabririgo gabririgo changed the title fix(governance): prevent proxy deploy with rogue strategy contract Prevent governance proxy deploy with rogue strategy contract Mar 6, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant