Merge branch 'main' into add-upgradeexecutor-setters

Author: chrstph-dvx

audit-ci.jsonc

@@ -65,6 +65,21 @@
     // from: @arbitrum/token-bridge-contracts>@openzeppelin/contracts-upgradeable
     // from: @arbitrum/nitro-contracts>@openzeppelin/contracts
     // from: @arbitrum/token-bridge-contracts>@openzeppelin/contracts
-    "GHSA-9vx6-7xxf-x967"
+    "GHSA-9vx6-7xxf-x967",
+    // https://github.com/advisories/GHSA-64vr-g452-qvp3
+    // Vite DOM Clobbering gadget found in vite bundled scripts that leads to XSS
+    // vite is not used in production
+    // from: vitest > vite
+    "GHSA-64vr-g452-qvp3",
+    // https://github.com/advisories/GHSA-9cwx-2883-4wfx
+    // server.fs.deny bypassed when using ?import&raw
+    // vite is not used in production
+    // from: vitest > vite
+    "GHSA-9cwx-2883-4wfx",
+    // https://github.com/advisories/GHSA-gcx4-mw62-g8wm
+    // DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS
+    // vite is not used in production
+    // from: vitest > vite
+    "GHSA-gcx4-mw62-g8wm"
   ]
 }

src/createRollupPrepareTransactionRequest.ts

@@ -32,6 +32,7 @@ export type CreateRollupPrepareTransactionRequestParams<TChain extends Chain | u
     WithRollupCreatorAddressOverride<{
       params: CreateRollupParams;
       account: Address;
+      value?: bigint;
       publicClient: PublicClient<Transport, TChain>;
       gasOverrides?: TransactionRequestGasOverrides;
     }>
@@ -40,6 +41,7 @@ export type CreateRollupPrepareTransactionRequestParams<TChain extends Chain | u
 export async function createRollupPrepareTransactionRequest<TChain extends Chain | undefined>({
   params,
   account,
+  value,
   publicClient,
   gasOverrides,
   rollupCreatorAddressOverride,
@@ -81,7 +83,7 @@ export async function createRollupPrepareTransactionRequest<TChain extends Chain
     chain: publicClient.chain,
     to: rollupCreatorAddressOverride ?? getRollupCreatorAddress(publicClient),
     data: createRollupEncodeFunctionData([paramsWithDefaults]),
-    value: createRollupGetCallValue(paramsWithDefaults),
+    value: value ?? createRollupGetCallValue(paramsWithDefaults),
     account,
     // if the base gas limit override was provided, hardcode gas to 0 to skip estimation
     // we'll set the actual value in the code below

src/createTokenBridge.integration.test.ts

@@ -436,4 +436,52 @@ describe('createTokenBridge', () => {
     checkTokenBridgeContracts(tokenBridgeContracts);
     checkWethGateways(tokenBridgeContracts, { customFeeToken: true });
   });
+
+  it('should throw when createTokenBridge is called multiple times', async () => {
+    const testnodeInformation = getInformationFromTestnode();
+
+    const tokenBridgeCreator = await deployTokenBridgeCreator({
+      publicClient: nitroTestnodeL1Client,
+    });
+
+    const cfg = {
+      rollupOwner: l2RollupOwner.address,
+      rollupAddress: testnodeInformation.rollup,
+      account: l2RollupOwner,
+      parentChainPublicClient: nitroTestnodeL1Client,
+      orbitChainPublicClient: nitroTestnodeL2Client,
+      tokenBridgeCreatorAddressOverride: tokenBridgeCreator,
+      gasOverrides: {
+        gasLimit: {
+          base: 6_000_000n,
+        },
+      },
+      retryableGasOverrides: {
+        maxGasForFactory: {
+          base: 20_000_000n,
+        },
+        maxGasForContracts: {
+          base: 20_000_000n,
+        },
+        maxSubmissionCostForFactory: {
+          base: 4_000_000_000_000n,
+        },
+        maxSubmissionCostForContracts: {
+          base: 4_000_000_000_000n,
+        },
+      },
+      setWethGatewayGasOverrides: {
+        gasLimit: {
+          base: 100_000n,
+        },
+      },
+    };
+    const { tokenBridgeContracts } = await createTokenBridge(cfg);
+    await expect(createTokenBridge(cfg)).rejects.toThrowError(
+      `Token bridge contracts for Rollup ${testnodeInformation.rollup} are already deployed`,
+    );
+
+    checkTokenBridgeContracts(tokenBridgeContracts);
+    checkWethGateways(tokenBridgeContracts, { customFeeToken: false });
+  });
 });

src/createTokenBridge.ts

@@ -34,6 +34,58 @@ import { isCustomFeeTokenAddress } from './utils/isCustomFeeTokenAddress';
 import { WithTokenBridgeCreatorAddressOverride } from './types/createTokenBridgeTypes';
 import { TransactionRequestGasOverrides } from './utils/gasOverrides';
 import { getBlockExplorerUrl } from './utils/getBlockExplorerUrl';
+import { tokenBridgeCreatorABI } from './contracts/TokenBridgeCreator';
+import { getTokenBridgeCreatorAddress } from './utils';
+import { rollupABI } from './contracts/Rollup';
+
+/**
+ * If token bridge was already deployed, `createTokenBridge` will fail when waiting for retryables.
+ * This function returns true if token bridge was deployed previously.
+ *
+ * @param {String} assertTokenBridgeDoesntExistParams.parentChainPublicClient - The parent chain Viem Public Client
+ * @param {String} assertTokenBridgeDoesntExistParams.orbitChainPublicClient - The orbit chain Viem Public Client
+ * @param {String=} assertTokenBridgeDoesntExistParams.tokenBridgeCreatorAddress - The TokenBridgeCreator address.
+ * Default to getTokenBridgeCreatorAddress(parentChainPublicClient) if not provided
+ * @param {String} assertTokenBridgeDoesntExistParams.rollupAddress - The address of the rollup on the parent chain
+ *
+ * @returns true if token bridge was already deployed
+ */
+export async function isTokenBridgeDeployed<
+  TParentChain extends Chain | undefined,
+  TOrbitChain extends Chain | undefined,
+>({
+  parentChainPublicClient,
+  orbitChainPublicClient,
+  tokenBridgeCreatorAddress,
+  rollupAddress,
+}: {
+  parentChainPublicClient: PublicClient<Transport, TParentChain>;
+  orbitChainPublicClient: PublicClient<Transport, TOrbitChain>;
+  tokenBridgeCreatorAddress?: Address;
+  rollupAddress: Address;
+}) {
+  const inbox = await parentChainPublicClient.readContract({
+    address: rollupAddress,
+    abi: rollupABI,
+    functionName: 'inbox',
+  });
+
+  const [router] = await parentChainPublicClient.readContract({
+    address: tokenBridgeCreatorAddress ?? getTokenBridgeCreatorAddress(parentChainPublicClient),
+    abi: tokenBridgeCreatorABI,
+    functionName: 'inboxToL2Deployment',
+    args: [inbox],
+  });
+
+  if (router) {
+    const code = await orbitChainPublicClient.getBytecode({ address: router });
+    if (code) {
+      return true;
+    }
+  }
+
+  return false;
+}
 
 export type CreateTokenBridgeParams<
   TParentChain extends Chain | undefined,
@@ -171,6 +223,17 @@ export async function createTokenBridge<
 }: CreateTokenBridgeParams<TParentChain, TOrbitChain>): Promise<
   CreateTokenBridgeResults<TParentChain, TOrbitChain>
 > {
+  const isTokenBridgeAlreadyDeployed = await isTokenBridgeDeployed({
+    parentChainPublicClient,
+    orbitChainPublicClient,
+    tokenBridgeCreatorAddress: tokenBridgeCreatorAddressOverride,
+    rollupAddress,
+  });
+
+  if (isTokenBridgeAlreadyDeployed) {
+    throw new Error(`Token bridge contracts for Rollup ${rollupAddress} are already deployed`);
+  }
+
   const isCustomFeeTokenBridge = isCustomFeeTokenAddress(nativeTokenAddress);
   if (isCustomFeeTokenBridge) {
     // set the custom fee token

src/index.ts

@@ -80,6 +80,7 @@ import {
   CreateTokenBridgeParams,
   CreateTokenBridgeResults,
   createTokenBridge,
+  isTokenBridgeDeployed,
 } from './createTokenBridge';
 import {
   createTokenBridgeEnoughCustomFeeTokenAllowance,
@@ -210,6 +211,7 @@ export {
   prepareKeyset,
   utils,
   //
+  isTokenBridgeDeployed,
   CreateTokenBridgeParams,
   CreateTokenBridgeResults,
   createTokenBridge,

src/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@arbitrum/orbit-sdk",
   "description": "TypeScript SDK for building Arbitrum Orbit chains",
-  "version": "0.19.0",
+  "version": "0.20.0-beta.1",
   "main": "./dist/index.js",
   "files": [
     "./dist"

src/utils/getArbOSVersion.unit.test.ts

@@ -10,7 +10,7 @@ it('returns the ArbOS version of Arbitrum One', async () => {
     transport: http(),
   });
 
-  expect(await getArbOSVersion(arbitrumOneClient)).toBe(31);
+  expect(await getArbOSVersion(arbitrumOneClient)).toBe(32);
 });
 
 it('throws if the chain is not an Arbitrum chain', async () => {