Merge pull request #42 from argentlabs/feat/action-safeguards

Execute action fallback safeguard
argentlabs · Jun 26, 2024 · aaed507 · aaed507
2 parents 2af66b8 + 11ce476
commit aaed507
Show file tree

Hide file tree

Showing 3 changed files with 24 additions and 8 deletions.
diff --git a/lib/claim.ts b/lib/claim.ts
@@ -139,8 +139,8 @@ export async function claimExternal(args: {
 function executeActionOnAccount(functionName: string, accountAddress: string, args: Calldata): Call {
   return {
     contractAddress: accountAddress,
-    calldata: { selector: hash.getSelectorFromName(functionName), calldata: args },
     entrypoint: "execute_action",
+    calldata: { selector: hash.getSelectorFromName(functionName), calldata: args },
   };
 }
 

diff --git a/src/contracts/claim_account.cairo b/src/contracts/claim_account.cairo
@@ -118,8 +118,8 @@ mod ClaimAccount {
             let mut calldata_span = calldata.span();
             let claim: ClaimData = Serde::deserialize(ref calldata_span).expect('gift-acc/invalid-claim');
             let implementation_class_hash = get_validated_impl(claim);
-            // TODO consider delegating to a fixed selector to we can have a whitelist of selectors in the implementation
-            library_call_syscall(implementation_class_hash, selector, calldata.span()).unwrap()
+            IClaimAccountImplLibraryDispatcher { class_hash: implementation_class_hash }
+                .execute_action(implementation_class_hash, selector, calldata.span())
         }
     }
 

diff --git a/src/contracts/claim_account_impl.cairo b/src/contracts/claim_account_impl.cairo
@@ -1,10 +1,15 @@
-use starknet::{ContractAddress};
+use starknet::{ContractAddress, ClassHash};
 use starknet_gifting::contracts::interface::{ClaimData, OutsideExecution, StarknetSignature};
 
 
 #[starknet::interface]
 pub trait IClaimAccountImpl<TContractState> {
+    fn execute_action(
+        ref self: TContractState, this_class_hash: ClassHash, selector: felt252, args: Span<felt252>
+    ) -> Span<felt252>;
+
     fn claim_internal(ref self: TContractState, claim: ClaimData, receiver: ContractAddress) -> Array<Span<felt252>>;
+
     fn claim_external(
         ref self: TContractState,
         claim: ClaimData,
@@ -40,11 +45,12 @@ mod ClaimAccountImpl {
     use core::panic_with_felt252;
     use openzeppelin::access::ownable::interface::{IOwnable, IOwnableDispatcherTrait, IOwnableDispatcher};
     use openzeppelin::token::erc20::interface::{IERC20, IERC20DispatcherTrait, IERC20Dispatcher};
-    use starknet::{ClassHash, ContractAddress, get_caller_address, get_contract_address,};
-
-
+    use starknet::{
+        ClassHash, ContractAddress, get_caller_address, get_contract_address, syscalls::library_call_syscall
+    };
     use starknet_gifting::contracts::claim_hash::{ClaimExternal, IOffChainMessageHashRev1};
     use starknet_gifting::contracts::interface::{ClaimData, OutsideExecution, StarknetSignature};
+    use starknet_gifting::contracts::utils::full_deserialize;
 
     #[storage]
     struct Storage {}
@@ -74,14 +80,24 @@ mod ClaimAccountImpl {
     }
 
     #[abi(embed_v0)]
-    impl Impl of super::IClaimAccountImpl<ContractState> {
+    impl ClaimAccountImpl of super::IClaimAccountImpl<ContractState> {
         fn claim_internal(
             ref self: ContractState, claim: ClaimData, receiver: ContractAddress
         ) -> Array<Span<felt252>> {
             self.proceed_with_claim(claim, receiver, Zero::zero());
             array![]
         }
 
+        fn execute_action(
+            ref self: ContractState, this_class_hash: ClassHash, selector: felt252, args: Span<felt252>
+        ) -> Span<felt252> {
+            let is_whitelisted = selector == selector!("claim_external")
+                || selector == selector!("get_dust")
+                || selector == selector!("cancel");
+            assert(is_whitelisted, 'gift/invalid-selector');
+            library_call_syscall(this_class_hash, selector, args).unwrap()
+        }
+
         fn claim_external(
             ref self: ContractState,
             claim: ClaimData,