From 1e24f9acf632407108f07f715d031add3c7d4d30 Mon Sep 17 00:00:00 2001 From: byshape Date: Tue, 30 Jul 2024 17:29:29 +0100 Subject: [PATCH 1/2] Add comments on secret generation in tests --- test/integration/MerkleStorageInvalidator.t.sol | 1 + test/unit/EscrowFactory.t.sol | 1 + test/unit/MerkleStorageInvalidator.t.sol | 2 ++ 3 files changed, 4 insertions(+) diff --git a/test/integration/MerkleStorageInvalidator.t.sol b/test/integration/MerkleStorageInvalidator.t.sol index 53b354a..2a10cae 100644 --- a/test/integration/MerkleStorageInvalidator.t.sol +++ b/test/integration/MerkleStorageInvalidator.t.sol @@ -27,6 +27,7 @@ contract MerkleStorageInvalidatorIntTest is BaseSetup { dstWithParts = Address.wrap(uint256(uint160(address(dai))) | (PARTS_AMOUNT << 240)); for (uint256 i = 0; i < SECRETS_AMOUNT; i++) { + // Note: This is not production-ready code. Use cryptographically secure random to generate secrets. hashedSecrets[i] = keccak256(abi.encodePacked(i)); hashedPairs[i] = keccak256(abi.encodePacked(i, hashedSecrets[i])); } diff --git a/test/unit/EscrowFactory.t.sol b/test/unit/EscrowFactory.t.sol index 7d660d6..6fc4ff0 100644 --- a/test/unit/EscrowFactory.t.sol +++ b/test/unit/EscrowFactory.t.sol @@ -24,6 +24,7 @@ contract EscrowFactoryTest is BaseSetup { function setUp() public virtual override { BaseSetup.setUp(); + // Note: This is not production-ready code. Use cryptographically secure random to generate secrets. for (uint256 i = 0; i < SECRETS_AMOUNT; i++) { hashedSecrets[i] = keccak256(abi.encodePacked(i)); hashedPairs[i] = keccak256(abi.encodePacked(i, hashedSecrets[i])); diff --git a/test/unit/MerkleStorageInvalidator.t.sol b/test/unit/MerkleStorageInvalidator.t.sol index e6a4f02..44676c7 100644 --- a/test/unit/MerkleStorageInvalidator.t.sol +++ b/test/unit/MerkleStorageInvalidator.t.sol @@ -30,6 +30,7 @@ contract MerkleStorageInvalidatorTest is BaseSetup { bytes32[] memory hashedSecrets = new bytes32[](secretsAmount); bytes32[] memory hashedPairs = new bytes32[](secretsAmount); + // Note: This is not production-ready code. Use cryptographically secure random to generate secrets. for (uint256 i = 0; i < secretsAmount; i++) { hashedSecrets[i] = keccak256(abi.encodePacked(i)); hashedPairs[i] = keccak256(abi.encodePacked(i, hashedSecrets[i])); @@ -74,6 +75,7 @@ contract MerkleStorageInvalidatorTest is BaseSetup { bytes32[] memory hashedSecrets = new bytes32[](secretsAmount); bytes32[] memory hashedPairs = new bytes32[](secretsAmount); + // Note: This is not production-ready code. Use cryptographically secure random to generate secrets. for (uint256 i = 0; i < secretsAmount; i++) { hashedSecrets[i] = keccak256(abi.encodePacked(i)); hashedPairs[i] = keccak256(abi.encodePacked(i, hashedSecrets[i])); From 04cddd4522de65219824fbff6152bd884fb81ba0 Mon Sep 17 00:00:00 2001 From: Xenia <94478708+byshape@users.noreply.github.com> Date: Wed, 31 Jul 2024 16:06:43 +0100 Subject: [PATCH 2/2] Revert "Apply Consensys audit suggestions" --- test/integration/MerkleStorageInvalidator.t.sol | 1 - test/unit/EscrowFactory.t.sol | 1 - test/unit/MerkleStorageInvalidator.t.sol | 2 -- 3 files changed, 4 deletions(-) diff --git a/test/integration/MerkleStorageInvalidator.t.sol b/test/integration/MerkleStorageInvalidator.t.sol index 32ad61d..3f22eeb 100644 --- a/test/integration/MerkleStorageInvalidator.t.sol +++ b/test/integration/MerkleStorageInvalidator.t.sol @@ -24,7 +24,6 @@ contract MerkleStorageInvalidatorIntTest is BaseSetup { BaseSetup.setUp(); for (uint256 i = 0; i < SECRETS_AMOUNT; i++) { - // Note: This is not production-ready code. Use cryptographically secure random to generate secrets. hashedSecrets[i] = keccak256(abi.encodePacked(i)); hashedPairs[i] = keccak256(abi.encodePacked(i, hashedSecrets[i])); } diff --git a/test/unit/EscrowFactory.t.sol b/test/unit/EscrowFactory.t.sol index 29e7af8..5028e2b 100644 --- a/test/unit/EscrowFactory.t.sol +++ b/test/unit/EscrowFactory.t.sol @@ -25,7 +25,6 @@ contract EscrowFactoryTest is BaseSetup { function setUp() public virtual override { BaseSetup.setUp(); - // Note: This is not production-ready code. Use cryptographically secure random to generate secrets. for (uint256 i = 0; i < SECRETS_AMOUNT; i++) { hashedSecrets[i] = keccak256(abi.encodePacked(i)); hashedPairs[i] = keccak256(abi.encodePacked(i, hashedSecrets[i])); diff --git a/test/unit/MerkleStorageInvalidator.t.sol b/test/unit/MerkleStorageInvalidator.t.sol index 03373ec..93293ca 100644 --- a/test/unit/MerkleStorageInvalidator.t.sol +++ b/test/unit/MerkleStorageInvalidator.t.sol @@ -27,7 +27,6 @@ contract MerkleStorageInvalidatorTest is BaseSetup { bytes32[] memory hashedSecrets = new bytes32[](secretsAmount); bytes32[] memory hashedPairs = new bytes32[](secretsAmount); - // Note: This is not production-ready code. Use cryptographically secure random to generate secrets. for (uint256 i = 0; i < secretsAmount; i++) { hashedSecrets[i] = keccak256(abi.encodePacked(i)); hashedPairs[i] = keccak256(abi.encodePacked(i, hashedSecrets[i])); @@ -63,7 +62,6 @@ contract MerkleStorageInvalidatorTest is BaseSetup { bytes32[] memory hashedSecrets = new bytes32[](secretsAmount); bytes32[] memory hashedPairs = new bytes32[](secretsAmount); - // Note: This is not production-ready code. Use cryptographically secure random to generate secrets. for (uint256 i = 0; i < secretsAmount; i++) { hashedSecrets[i] = keccak256(abi.encodePacked(i)); hashedPairs[i] = keccak256(abi.encodePacked(i, hashedSecrets[i]));