Skip to content

Commit 310cc2e

Browse files
nkrishangnkrishang
authored
Contractkit upgradeable smart contracts (#269)
* Add extension: Upgradeable * docs update * pkg release * Add oz proxy presets * Upgradeable is OZ UUPSUpgradeable * Fix Address -> TWAddress import * docs update * pkg release * git status * pkg release * Add extension: Initializable * pkg release
1 parent c2daa78 commit 310cc2e

19 files changed

+1301
-1
lines changed

‎contracts/extension/Initializable.sol

+138
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,138 @@
1+
// SPDX-License-Identifier: Apache 2.0
2+
// Cerdits: OpenZeppelin Contracts (last updated v4.7.0) (proxy/utils/Initializable.sol)
3+
4+
pragma solidity ^0.8.2;
5+
6+
import "../lib/TWAddress.sol";
7+
8+
/**
9+
* @dev This is a base contract to aid in writing upgradeable contracts, or any kind of contract that will be deployed
10+
* behind a proxy. Since proxied contracts do not make use of a constructor, it's common to move constructor logic to an
11+
* external initializer function, usually called `initialize`. It then becomes necessary to protect this initializer
12+
* function so it can only be called once. The {initializer} modifier provided by this contract will have this effect.
13+
*
14+
* The initialization functions use a version number. Once a version number is used, it is consumed and cannot be
15+
* reused. This mechanism prevents re-execution of each "step" but allows the creation of new initialization steps in
16+
* case an upgrade adds a module that needs to be initialized.
17+
*
18+
* For example:
19+
*
20+
* [.hljs-theme-light.nopadding]
21+
* ```
22+
* contract MyToken is ERC20Upgradeable {
23+
* function initialize() initializer public {
24+
* __ERC20_init("MyToken", "MTK");
25+
* }
26+
* }
27+
* contract MyTokenV2 is MyToken, ERC20PermitUpgradeable {
28+
* function initializeV2() reinitializer(2) public {
29+
* __ERC20Permit_init("MyToken");
30+
* }
31+
* }
32+
* ```
33+
*
34+
* TIP: To avoid leaving the proxy in an uninitialized state, the initializer function should be called as early as
35+
* possible by providing the encoded function call as the `_data` argument to {ERC1967Proxy-constructor}.
36+
*
37+
* CAUTION: When used with inheritance, manual care must be taken to not invoke a parent initializer twice, or to ensure
38+
* that all initializers are idempotent. This is not verified automatically as constructors are by Solidity.
39+
*
40+
* [CAUTION]
41+
* ====
42+
* Avoid leaving a contract uninitialized.
43+
*
44+
* An uninitialized contract can be taken over by an attacker. This applies to both a proxy and its implementation
45+
* contract, which may impact the proxy. To prevent the implementation contract from being used, you should invoke
46+
* the {_disableInitializers} function in the constructor to automatically lock it when it is deployed:
47+
*
48+
* [.hljs-theme-light.nopadding]
49+
* ```
50+
* /// @custom:oz-upgrades-unsafe-allow constructor
51+
* constructor() {
52+
* _disableInitializers();
53+
* }
54+
* ```
55+
* ====
56+
*/
57+
abstract contract Initializable {
58+
/**
59+
* @dev Indicates that the contract has been initialized.
60+
* @custom:oz-retyped-from bool
61+
*/
62+
uint8 private _initialized;
63+
64+
/**
65+
* @dev Indicates that the contract is in the process of being initialized.
66+
*/
67+
bool private _initializing;
68+
69+
/**
70+
* @dev Triggered when the contract has been initialized or reinitialized.
71+
*/
72+
event Initialized(uint8 version);
73+
74+
/**
75+
* @dev A modifier that defines a protected initializer function that can be invoked at most once. In its scope,
76+
* `onlyInitializing` functions can be used to initialize parent contracts. Equivalent to `reinitializer(1)`.
77+
*/
78+
modifier initializer() {
79+
bool isTopLevelCall = !_initializing;
80+
require(
81+
(isTopLevelCall && _initialized < 1) || (!TWAddress.isContract(address(this)) && _initialized == 1),
82+
"Initializable: contract is already initialized"
83+
);
84+
_initialized = 1;
85+
if (isTopLevelCall) {
86+
_initializing = true;
87+
}
88+
_;
89+
if (isTopLevelCall) {
90+
_initializing = false;
91+
emit Initialized(1);
92+
}
93+
}
94+
95+
/**
96+
* @dev A modifier that defines a protected reinitializer function that can be invoked at most once, and only if the
97+
* contract hasn't been initialized to a greater version before. In its scope, `onlyInitializing` functions can be
98+
* used to initialize parent contracts.
99+
*
100+
* `initializer` is equivalent to `reinitializer(1)`, so a reinitializer may be used after the original
101+
* initialization step. This is essential to configure modules that are added through upgrades and that require
102+
* initialization.
103+
*
104+
* Note that versions can jump in increments greater than 1; this implies that if multiple reinitializers coexist in
105+
* a contract, executing them in the right order is up to the developer or operator.
106+
*/
107+
modifier reinitializer(uint8 version) {
108+
require(!_initializing && _initialized < version, "Initializable: contract is already initialized");
109+
_initialized = version;
110+
_initializing = true;
111+
_;
112+
_initializing = false;
113+
emit Initialized(version);
114+
}
115+
116+
/**
117+
* @dev Modifier to protect an initialization function so that it can only be invoked by functions with the
118+
* {initializer} and {reinitializer} modifiers, directly or indirectly.
119+
*/
120+
modifier onlyInitializing() {
121+
require(_initializing, "Initializable: contract is not initializing");
122+
_;
123+
}
124+
125+
/**
126+
* @dev Locks the contract, preventing any future reinitialization. This cannot be part of an initializer call.
127+
* Calling this in the constructor of a contract will prevent that contract from being initialized or reinitialized
128+
* to any version. It is recommended to use this to lock implementation contracts that are designed to be called
129+
* through proxies.
130+
*/
131+
function _disableInitializers() internal virtual {
132+
require(!_initializing, "Initializable: contract is initializing");
133+
if (_initialized < type(uint8).max) {
134+
_initialized = type(uint8).max;
135+
emit Initialized(type(uint8).max);
136+
}
137+
}
138+
}

‎contracts/extension/Proxy.sol

+86
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
// SPDX-License-Identifier: Apache 2.0
2+
// Credits: OpenZeppelin Contracts (last updated v4.6.0) (proxy/Proxy.sol)
3+
4+
pragma solidity ^0.8.0;
5+
6+
/**
7+
* @dev This abstract contract provides a fallback function that delegates all calls to another contract using the EVM
8+
* instruction `delegatecall`. We refer to the second contract as the _implementation_ behind the proxy, and it has to
9+
* be specified by overriding the virtual {_implementation} function.
10+
*
11+
* Additionally, delegation to the implementation can be triggered manually through the {_fallback} function, or to a
12+
* different contract through the {_delegate} function.
13+
*
14+
* The success and return data of the delegated call will be returned back to the caller of the proxy.
15+
*/
16+
abstract contract Proxy {
17+
/**
18+
* @dev Delegates the current call to `implementation`.
19+
*
20+
* This function does not return to its internal call site, it will return directly to the external caller.
21+
*/
22+
function _delegate(address implementation) internal virtual {
23+
assembly {
24+
// Copy msg.data. We take full control of memory in this inline assembly
25+
// block because it will not return to Solidity code. We overwrite the
26+
// Solidity scratch pad at memory position 0.
27+
calldatacopy(0, 0, calldatasize())
28+
29+
// Call the implementation.
30+
// out and outsize are 0 because we don't know the size yet.
31+
let result := delegatecall(gas(), implementation, 0, calldatasize(), 0, 0)
32+
33+
// Copy the returned data.
34+
returndatacopy(0, 0, returndatasize())
35+
36+
switch result
37+
// delegatecall returns 0 on error.
38+
case 0 {
39+
revert(0, returndatasize())
40+
}
41+
default {
42+
return(0, returndatasize())
43+
}
44+
}
45+
}
46+
47+
/**
48+
* @dev This is a virtual function that should be overridden so it returns the address to which the fallback function
49+
* and {_fallback} should delegate.
50+
*/
51+
function _implementation() internal view virtual returns (address);
52+
53+
/**
54+
* @dev Delegates the current call to the address returned by `_implementation()`.
55+
*
56+
* This function does not return to its internal call site, it will return directly to the external caller.
57+
*/
58+
function _fallback() internal virtual {
59+
_beforeFallback();
60+
_delegate(_implementation());
61+
}
62+
63+
/**
64+
* @dev Fallback function that delegates calls to the address returned by `_implementation()`. Will run if no other
65+
* function in the contract matches the call data.
66+
*/
67+
fallback() external payable virtual {
68+
_fallback();
69+
}
70+
71+
/**
72+
* @dev Fallback function that delegates calls to the address returned by `_implementation()`. Will run if call data
73+
* is empty.
74+
*/
75+
receive() external payable virtual {
76+
_fallback();
77+
}
78+
79+
/**
80+
* @dev Hook that is called before falling back to the implementation. Can happen as part of a manual `_fallback`
81+
* call, or as part of the Solidity `fallback` or `receive` functions.
82+
*
83+
* If overridden should call `super._beforeFallback()`.
84+
*/
85+
function _beforeFallback() internal virtual {}
86+
}

‎contracts/extension/ProxyForUpgradeable.sol

+32
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
// SPDX-License-Identifier: Apache 2.0
2+
// Credits: OpenZeppelin Contracts (last updated v4.7.0) (proxy/ERC1967/ERC1967Proxy.sol)
3+
4+
pragma solidity ^0.8.0;
5+
6+
import "./Proxy.sol";
7+
import "../openzeppelin-presets/proxy/ERC1967/ERC1967Upgrade.sol";
8+
9+
/**
10+
* @dev This contract implements an upgradeable proxy. It is upgradeable because calls are delegated to an
11+
* implementation address that can be changed. This address is stored in storage in the location specified by
12+
* https://eips.ethereum.org/EIPS/eip-1967[EIP1967], so that it doesn't conflict with the storage layout of the
13+
* implementation behind the proxy.
14+
*/
15+
contract ProxyForUpgradeable is Proxy, ERC1967Upgrade {
16+
/**
17+
* @dev Initializes the upgradeable proxy with an initial implementation specified by `_logic`.
18+
*
19+
* If `_data` is nonempty, it's used as data in a delegate call to `_logic`. This will typically be an encoded
20+
* function call, and allows initializing the storage of the proxy like a Solidity constructor.
21+
*/
22+
constructor(address _logic, bytes memory _data) payable {
23+
_upgradeToAndCall(_logic, _data, false);
24+
}
25+
26+
/**
27+
* @dev Returns the current implementation address.
28+
*/
29+
function _implementation() internal view virtual override returns (address impl) {
30+
return ERC1967Upgrade._getImplementation();
31+
}
32+
}

‎contracts/extension/Upgradeable.sol

+95
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
// SPDX-License-Identifier: Apache 2.0
2+
// Credits: OpenZeppelin Contracts
3+
4+
pragma solidity ^0.8.0;
5+
6+
import "../openzeppelin-presets/proxy/IERC1822Proxiable.sol";
7+
import "../openzeppelin-presets/proxy/ERC1967/ERC1967Upgrade.sol";
8+
9+
/**
10+
* @dev An upgradeability mechanism designed for UUPS proxies. The functions included here can perform an upgrade of an
11+
* {ERC1967Proxy}, when this contract is set as the implementation behind such a proxy.
12+
*
13+
* A security mechanism ensures that an upgrade does not turn off upgradeability accidentally, although this risk is
14+
* reinstated if the upgrade retains upgradeability but removes the security mechanism, e.g. by replacing
15+
* `UUPSUpgradeable` with a custom implementation of upgrades.
16+
*
17+
* The {_authorizeUpgrade} function must be overridden to include access restriction to the upgrade mechanism.
18+
*
19+
* _Available since v4.1._
20+
*/
21+
abstract contract Upgradeable is IERC1822Proxiable, ERC1967Upgrade {
22+
/// @custom:oz-upgrades-unsafe-allow state-variable-immutable state-variable-assignment
23+
address private immutable __self = address(this);
24+
25+
/**
26+
* @dev Check that the execution is being performed through a delegatecall call and that the execution context is
27+
* a proxy contract with an implementation (as defined in ERC1967) pointing to self. This should only be the case
28+
* for UUPS and transparent proxies that are using the current contract as their implementation. Execution of a
29+
* function through ERC1167 minimal proxies (clones) would not normally pass this test, but is not guaranteed to
30+
* fail.
31+
*/
32+
modifier onlyProxy() {
33+
require(address(this) != __self, "Function must be called through delegatecall");
34+
require(_getImplementation() == __self, "Function must be called through active proxy");
35+
_;
36+
}
37+
38+
/**
39+
* @dev Check that the execution is not being performed through a delegate call. This allows a function to be
40+
* callable on the implementing contract but not through proxies.
41+
*/
42+
modifier notDelegated() {
43+
require(address(this) == __self, "UUPSUpgradeable: must not be called through delegatecall");
44+
_;
45+
}
46+
47+
/**
48+
* @dev Implementation of the ERC1822 {proxiableUUID} function. This returns the storage slot used by the
49+
* implementation. It is used to validate that the this implementation remains valid after an upgrade.
50+
*
51+
* IMPORTANT: A proxy pointing at a proxiable contract should not be considered proxiable itself, because this risks
52+
* bricking a proxy that upgrades to it, by delegating to itself until out of gas. Thus it is critical that this
53+
* function revert if invoked through a proxy. This is guaranteed by the `notDelegated` modifier.
54+
*/
55+
function proxiableUUID() external view virtual override notDelegated returns (bytes32) {
56+
return _IMPLEMENTATION_SLOT;
57+
}
58+
59+
/**
60+
* @dev Upgrade the implementation of the proxy to `newImplementation`.
61+
*
62+
* Calls {_authorizeUpgrade}.
63+
*
64+
* Emits an {Upgraded} event.
65+
*/
66+
function upgradeTo(address newImplementation) external virtual onlyProxy {
67+
_authorizeUpgrade(newImplementation);
68+
_upgradeToAndCallUUPS(newImplementation, new bytes(0), false);
69+
}
70+
71+
/**
72+
* @dev Upgrade the implementation of the proxy to `newImplementation`, and subsequently execute the function call
73+
* encoded in `data`.
74+
*
75+
* Calls {_authorizeUpgrade}.
76+
*
77+
* Emits an {Upgraded} event.
78+
*/
79+
function upgradeToAndCall(address newImplementation, bytes memory data) external payable virtual onlyProxy {
80+
_authorizeUpgrade(newImplementation);
81+
_upgradeToAndCallUUPS(newImplementation, data, true);
82+
}
83+
84+
/**
85+
* @dev Function that should revert when `msg.sender` is not authorized to upgrade the contract. Called by
86+
* {upgradeTo} and {upgradeToAndCall}.
87+
*
88+
* Normally, this function will use an xref:access.adoc[access control] modifier such as {Ownable-onlyOwner}.
89+
*
90+
* ```solidity
91+
* function _authorizeUpgrade(address) internal override onlyOwner {}
92+
* ```
93+
*/
94+
function _authorizeUpgrade(address newImplementation) internal virtual;
95+
}

0 commit comments

Comments
 (0)