Add check for length of callback data

# Conflicts: # script/salts/salts.json
Axis-Fi · Jun 21, 2024 · b579f25 · b579f25
1 parent 16d7c1c
commit b579f25
Show file tree

Hide file tree

Showing 6 changed files with 49 additions and 4 deletions.
diff --git a/script/salts/salts.json b/script/salts/salts.json
@@ -42,8 +42,8 @@
     "0x7cca57da19a5847b2b87641c1b721a32d4778e3e58641d6771cd14ed112b3bc3": "0xe0631d27a3d241774729d8c3ee1d9efae407f1073f89fa0956b2d308bd3adec4"
   },
   "Test_CappedMerkleAllowlist": {
-    "0x240bdd876f7c0070009c234b8cde981c3865d49db15097f59cd4ffb15d818d1e": "0xe68b5bbeed8a53eb7e97b7bc84ec08e1e6a5b360cae16f0653c60eff312dec3f",
-    "0xb8a17b3ee693ebdcfc6913bb2f65d0fadbe8812d9ef4d927595a7dc75db68727": "0x956b71c3545015d12e8bbefbad72019b673860f32a5b4313eeb866425d97be17"
+    "0x2e55fe4d6c3005f7bf152a42653bd234155cdac7f621582ba16b664c115ba76b": "0xcebb750afb8a132bc3cb37d32494b7ff18eddfb4b5359d69324660cb723e32e3",
+    "0xbd19b648b51fb3fe1bd9e42ad4018b839966abea0f4e25a9149dffdc7cc86a4e": "0x40034a34b97aef1a7635ee0f34b06951512b57d37bc0baa1be879a5144895d08"
   },
   "Test_GUniFactory": {
     "0x3bf0e882023640f31bf861e1f13d306fd4fbb7afb7860e21a489062cbefcf885": "0x397acf3db4cc9c81f8c1975a5505e392e6b5f8eb3b22efcc094b3e0f39f6739b"

diff --git a/src/callbacks/allowlists/CappedMerkleAllowlist.sol b/src/callbacks/allowlists/CappedMerkleAllowlist.sol
@@ -54,6 +54,11 @@ contract CappedMerkleAllowlist is MerkleAllowlist {
         bool,
         bytes calldata callbackData_
     ) internal override {
+        // Check that the parameters are of the correct length
+        if (callbackData_.length != 64) {
+            revert Callback_InvalidParams();
+        }
+
         // Decode the merkle root from the callback data
         (bytes32 merkleRoot, uint256 buyerLimit) = abi.decode(callbackData_, (bytes32, uint256));
 

diff --git a/test/callbacks/AllocatedMerkleAllowlistAtomic.t.sol b/test/callbacks/AllocatedMerkleAllowlistAtomic.t.sol
@@ -135,7 +135,8 @@ contract AllocatedMerkleAllowlistAtomicTest is Test, Permit2User, WithSalts {
 
     function test_onCreate_allowlistParametersIncorrectFormat_reverts() public {
         // Expect revert
-        vm.expectRevert();
+        bytes memory err = abi.encodeWithSelector(BaseCallback.Callback_InvalidParams.selector);
+        vm.expectRevert(err);
 
         vm.prank(address(_auctionHouse));
         _allowlist.onCreate(

diff --git a/test/callbacks/AllocatedMerkleAllowlistBatch.t.sol b/test/callbacks/AllocatedMerkleAllowlistBatch.t.sol
@@ -133,7 +133,8 @@ contract AllocatedMerkleAllowlistBatchTest is Test, Permit2User, WithSalts {
 
     function test_onCreate_allowlistParametersIncorrectFormat_reverts() public {
         // Expect revert
-        vm.expectRevert();
+        bytes memory err = abi.encodeWithSelector(BaseCallback.Callback_InvalidParams.selector);
+        vm.expectRevert(err);
 
         vm.prank(address(_auctionHouse));
         _allowlist.onCreate(

diff --git a/test/callbacks/CappedMerkleAllowlistAtomic.t.sol b/test/callbacks/CappedMerkleAllowlistAtomic.t.sol
@@ -91,6 +91,8 @@ contract CappedMerkleAllowlistAtomicTest is Test, Permit2User, WithSalts {
     }
 
     // onCreate
+    // [X] when the allowlist parameters are in an incorrect format
+    //  [X] it reverts
     // [X] if the caller is not the auction house
     //  [X] it reverts
     // [X] if the seller is not the seller for the allowlist
@@ -99,6 +101,23 @@ contract CappedMerkleAllowlistAtomicTest is Test, Permit2User, WithSalts {
     //  [X] it reverts
     // [X] it sets the merkle root and buyer limit
 
+    function test_onCreate_allowlistParametersIncorrectFormat_reverts() public {
+        // Expect revert
+        bytes memory err = abi.encodeWithSelector(BaseCallback.Callback_InvalidParams.selector);
+        vm.expectRevert(err);
+
+        vm.prank(address(_auctionHouse));
+        _allowlist.onCreate(
+            _lotId,
+            _SELLER,
+            _BASE_TOKEN,
+            _QUOTE_TOKEN,
+            _LOT_CAPACITY,
+            false,
+            abi.encode(_MERKLE_ROOT, _BUYER_LIMIT, uint256(20))
+        );
+    }
+
     function test_onCreate_callerNotAuctionHouse_reverts() public {
         // Expect revert
         bytes memory err = abi.encodeWithSelector(BaseCallback.Callback_NotAuthorized.selector);

diff --git a/test/callbacks/CappedMerkleAllowlistBatch.t.sol b/test/callbacks/CappedMerkleAllowlistBatch.t.sol
@@ -91,6 +91,8 @@ contract CappedMerkleAllowlistBatchTest is Test, Permit2User, WithSalts {
     }
 
     // onCreate
+    // [X] when the allowlist parameters are in an incorrect format
+    //  [X] it reverts
     // [X] if the caller is not the auction house
     //  [X] it reverts
     // [X] if the seller is not the seller for the allowlist
@@ -99,6 +101,23 @@ contract CappedMerkleAllowlistBatchTest is Test, Permit2User, WithSalts {
     //  [X] it reverts
     // [X] it sets the merkle root and buyer limit
 
+    function test_onCreate_allowlistParametersIncorrectFormat_reverts() public {
+        // Expect revert
+        bytes memory err = abi.encodeWithSelector(BaseCallback.Callback_InvalidParams.selector);
+        vm.expectRevert(err);
+
+        vm.prank(address(_auctionHouse));
+        _allowlist.onCreate(
+            _lotId,
+            _SELLER,
+            _BASE_TOKEN,
+            _QUOTE_TOKEN,
+            _LOT_CAPACITY,
+            false,
+            abi.encode(_MERKLE_ROOT, _BUYER_LIMIT, uint256(20))
+        );
+    }
+
     function test_onCreate_callerNotAuctionHouse_reverts() public {
         // Expect revert
         bytes memory err = abi.encodeWithSelector(BaseCallback.Callback_NotAuthorized.selector);