TokenPaymaster (0.7, Adjusted) #660
Conversation
Uniswap + Oracle based single ERC20 Paymaster for runtime sponsorship, compatible with sdks
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| abstract contract BasePaymaster is IPaymaster, Ownable { | ||
| IEntryPoint public immutable entryPoint; | ||
|
|
||
| uint256 internal constant PAYMASTER_VALIDATION_GAS_OFFSET = UserOperationLib.PAYMASTER_VALIDATION_GAS_OFFSET; |
Check warning
Code scanning / Slither
Unused state variable Warning
| IEntryPoint public immutable entryPoint; | ||
|
|
||
| uint256 internal constant PAYMASTER_VALIDATION_GAS_OFFSET = UserOperationLib.PAYMASTER_VALIDATION_GAS_OFFSET; | ||
| uint256 internal constant PAYMASTER_POSTOP_GAS_OFFSET = UserOperationLib.PAYMASTER_POSTOP_GAS_OFFSET; |
Check warning
Code scanning / Slither
Unused state variable Warning
contracts/prebuilts/account/token-paymaster/TokenPaymaster.sol
Dismissed
Show dismissed
Hide dismissed
| TokenPaymasterConfig memory _tokenPaymasterConfig, | ||
| OracleHelperConfig memory _oracleHelperConfig, | ||
| UniswapHelperConfig memory _uniswapHelperConfig, | ||
| address _owner |
Check notice
Code scanning / Slither
Local variable shadowing Low
| function calculatePrice( | ||
| uint256 tokenPrice, | ||
| uint256 nativeAssetPrice, | ||
| bool tokenOracleReverse, | ||
| bool nativeOracleReverse | ||
| ) private view returns (uint256){ | ||
| // tokenPrice is normalized as bridging-asset-per-token | ||
| if (tokenOracleReverse) { | ||
| // inverting tokenPrice that was tokens-per-bridging-asset (or tokens-per-native-asset) | ||
| tokenPrice = PRICE_DENOMINATOR * tokenOracleDecimalPower / tokenPrice; | ||
| } else { | ||
| // tokenPrice already bridging-asset-per-token (or native-asset-per-token) | ||
| tokenPrice = PRICE_DENOMINATOR * tokenPrice / tokenOracleDecimalPower; | ||
| } | ||
|
|
||
| if (nativeOracleReverse) { | ||
| // multiplying by nativeAssetPrice that is native-asset-per-bridging-asset | ||
| // => result = (bridging-asset / token) * (native-asset / bridging-asset) = native-asset / token | ||
| return nativeAssetPrice * tokenPrice / nativeOracleDecimalPower; | ||
| } else { | ||
| // dividing by nativeAssetPrice that is bridging-asset-per-native-asset | ||
| // => result = (bridging-asset / token) / (bridging-asset / native-asset) = native-asset / token | ||
| return tokenPrice * nativeOracleDecimalPower / nativeAssetPrice; | ||
| } | ||
| } |
Check warning
Code scanning / Slither
Divide before multiply Medium
| function calculatePrice( | ||
| uint256 tokenPrice, | ||
| uint256 nativeAssetPrice, | ||
| bool tokenOracleReverse, | ||
| bool nativeOracleReverse | ||
| ) private view returns (uint256){ | ||
| // tokenPrice is normalized as bridging-asset-per-token | ||
| if (tokenOracleReverse) { | ||
| // inverting tokenPrice that was tokens-per-bridging-asset (or tokens-per-native-asset) | ||
| tokenPrice = PRICE_DENOMINATOR * tokenOracleDecimalPower / tokenPrice; | ||
| } else { | ||
| // tokenPrice already bridging-asset-per-token (or native-asset-per-token) | ||
| tokenPrice = PRICE_DENOMINATOR * tokenPrice / tokenOracleDecimalPower; | ||
| } | ||
|
|
||
| if (nativeOracleReverse) { | ||
| // multiplying by nativeAssetPrice that is native-asset-per-bridging-asset | ||
| // => result = (bridging-asset / token) * (native-asset / bridging-asset) = native-asset / token | ||
| return nativeAssetPrice * tokenPrice / nativeOracleDecimalPower; | ||
| } else { | ||
| // dividing by nativeAssetPrice that is bridging-asset-per-native-asset | ||
| // => result = (bridging-asset / token) / (bridging-asset / native-asset) = native-asset / token | ||
| return tokenPrice * nativeOracleDecimalPower / nativeAssetPrice; | ||
| } | ||
| } |
Check warning
Code scanning / Slither
Divide before multiply Medium
| function fetchPrice(IOracle _oracle) internal view returns (uint256 price) { | ||
| (uint80 roundId, int256 answer,, uint256 updatedAt, uint80 answeredInRound) = _oracle.latestRoundData(); | ||
| require(answer > 0, "TPM: Chainlink price <= 0"); | ||
| require(updatedAt >= block.timestamp - oracleHelperConfig.maxOracleRoundAge, "TPM: Incomplete round"); | ||
| require(answeredInRound >= roundId, "TPM: Stale price"); | ||
| price = uint256(answer); | ||
| } |
Check warning
Code scanning / Slither
Unused return Medium
| function swapToToken( | ||
| address tokenIn, | ||
| address tokenOut, | ||
| uint256 amountIn, | ||
| uint256 amountOutMin, | ||
| uint24 fee | ||
| ) internal returns (uint256 amountOut) { | ||
| ISwapRouter.ExactInputSingleParams memory params = ISwapRouter.ExactInputSingleParams( | ||
| tokenIn, //tokenIn | ||
| tokenOut, //tokenOut | ||
| fee, | ||
| address(uniswap), | ||
| block.timestamp, //deadline | ||
| amountIn, | ||
| amountOutMin, | ||
| 0 | ||
| ); | ||
| try uniswap.exactInputSingle(params) returns (uint256 _amountOut) { | ||
| amountOut = _amountOut; | ||
| } catch { | ||
| emit UniswapReverted(tokenIn, tokenOut, amountIn, amountOutMin); | ||
| amountOut = 0; | ||
| } | ||
| } |
Check notice
Code scanning / Slither
Reentrancy vulnerabilities Low
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #660 +/- ##
==========================================
- Coverage 66.21% 65.50% -0.72%
==========================================
Files 220 225 +5
Lines 6900 7528 +628
==========================================
+ Hits 4569 4931 +362
- Misses 2331 2597 +266 ☔ View full report in Codecov by Sentry. |
contracts/prebuilts/account/token-paymaster/TokenPaymaster.sol
Dismissed
Show dismissed
Hide dismissed
contracts/prebuilts/account/token-paymaster/TokenPaymaster.sol
Dismissed
Show dismissed
Hide dismissed
contracts/prebuilts/account/token-paymaster/TokenPaymaster.sol
Dismissed
Show dismissed
Hide dismissed
contracts/prebuilts/account/token-paymaster/TokenPaymaster.sol
Dismissed
Show dismissed
Hide dismissed
Uniswap + Oracle based single ERC20 Paymaster for runtime sponsorship, compatible with sdks