Add contract creation allow lists to EVM domains #3350

teor2345 · 2025-01-15T03:07:28Z

How to review this PR

This PR is the second in a series of PRs which add "private EVM" functionality to subspace. The accompanying spec PR is subspace/protocol-specs#55 and user documentation is TODO.

The first PR in the series is #3359, it moves some test code around, and makes minor fixes.

The third PR in the series is #3360, it applies these changes and a storage migration to the Taurus runtime. (This storage isn't currently deployed on mainnet, so a migration isn't needed there.)

What it does

This PR adds a pallet which filters ethereum contract creation using an allow list. The allow list can be updated by the domain sudo account.

By default, all accounts can create contracts, to maintain compatibility with existing EVM domains. But the chainspec can be configured with an initial allow list of accounts. For our "private" EVM, that will be the domain sudo.

Close #3344.

This PR doesn't do a dynamic check for the domain sudo inside the pallet or runtime. We decided that isn't needed, because we can add the sudo account in the chainspec, or they can add themselves to the list using the (sudo) call provided by the pallet.

Part of #3353.

Other Changes

This PR makes it easier to add further code which:

has domain runtime type specific configurations (for example: EVM or Auto ID)
does recursion through utility pallet batches or call wrappers
extracts pallet calls from the RuntimeCall type (using MaybeInto*Call traits)
tests using ethereum transactions or EVM runtimes, via the EvmOnchainStateApi runtime API, and contract address calculation function

It also simplifies some existing code which was doing those things.

Bug Fixes

Fixes some transfer prevention extension code, which recursed through pallet-utility calls to use an iterator loop instead. The calls are checked in the same order, but references to the "Call stack" are stored on the heap instead. This avoids stack overflow for deeply nested calls.

Fixes some bugs in test-only code which made it harder to use.

TODOs

Add contract creation tests (see test matrix in comments)
Split the PR into:
- Test refactors & minor bug fixes
- Private EVM production, test code (Add contract creation allow lists to EVM domains #3350), and documentation (Document how to use Private EVM in the specs repo #3358)
- Taurus version bump and migration

Code contributor checklist:

I have read, understood and followed contributing guide

NingLin-P · 2025-01-17T13:39:15Z

domains/pallets/evm_nonce_tracker/src/lib.rs

+    #[pallet::storage]
+    pub(super) type ContractCreationAllowedBy<T: Config> =
+        StorageValue<_, PermissionedActionAllowedBy<T::AccountId>, OptionQuery>;
+


An alternative would be change the default return value of is_allowed_to_create_contracts to true

domains/runtime/evm/src/lib.rs

crates/pallet-domains/src/runtime_registry.rs

crates/pallet-domains/src/domain_registry.rs

domains/runtime/evm/src/lib.rs

crates/pallet-domains/src/lib.rs

crates/subspace-runtime/src/lib.rs

vedhavyas

Left some questions.

there are a lot of changes between the commits that is very confusing. Not a blocker for this PR

vedhavyas · 2025-01-31T08:16:07Z

domains/pallets/evm_nonce_tracker/src/lib.rs

+            origin: OriginFor<T>,
+            contract_creation_allowed_by: PermissionedActionAllowedBy<T::AccountId>,
+        ) -> DispatchResult {
+            ensure_root(origin)?;


This is fine to expect as sudo but ideally a domain owner should be able to update this allowlist instead of sudo so that Consensus sudo is not always required and is also a longer process.

Currently domain owner can update the XDM allow list that is initiated from the Consensus chain so I see no reason why the same domain owner should not be able to update this list as to who can create contracts as well.
Thoughts @dariolina

Apologies for not bringing this earlier.

I don’t know how to implement that, can you show me an example?

Edit: an example is in pallet-messenger. We'll add this in the next PR.

domains/runtime/evm/src/lib.rs

domains/pallets/evm_nonce_tracker/src/lib.rs

domains/client/domain-operator/src/tests.rs

crates/pallet-domains/src/lib.rs

crates/subspace-runtime/src/lib.rs

teor2345

there are a lot of changes between the commits that is very confusing. Not a blocker for this PR

I'm happy to squash the commits if that would help, but I've just got feedback in another PR that I squashed too much. So can you be more specific?
(Or we can leave it as it is if it's not a blocker.)

crates/pallet-domains/src/lib.rs

crates/subspace-runtime/src/lib.rs

teor2345 · 2025-02-02T21:46:07Z

domains/pallets/evm_nonce_tracker/src/lib.rs

+            origin: OriginFor<T>,
+            contract_creation_allowed_by: PermissionedActionAllowedBy<T::AccountId>,
+        ) -> DispatchResult {
+            ensure_root(origin)?;


I don’t know how to implement that, can you show me an example?

Edit: an example is in pallet-messenger. We'll add this in the next PR.

domains/runtime/evm/src/lib.rs

domains/pallets/evm_nonce_tracker/src/lib.rs

domains/client/domain-operator/src/tests.rs

NingLin-P

The changes make sense to me overall just one nit, and thanks for the refactoring and testing infra!

crates/pallet-domains/src/domain_registry.rs

teor2345

This is ready for another review.

I wasn't able to squash some commits, because they were different kinds of changes.

I still haven't set auto-merge, because I'm not sure where we're up to with the other Taurus deployments or migrations.

Edit: here is the diff since the last review:
https://github.com/autonomys/subspace/compare/c013f78b0fd9c328373ee23284b1fffb4768c45c..ee8c6466edb8c79fc659e7b7f29cee896be2126a

crates/pallet-domains/src/domain_registry.rs

domains/pallets/evm_nonce_tracker/src/lib.rs

domains/client/domain-operator/src/tests.rs

vedhavyas

Make sense!
Thank you for being patient

I believe we are missing migrations for the structures

domains/client/domain-operator/src/lib.rs

crates/pallet-domains/src/domain_registry.rs

crates/pallet-domains/src/runtime_registry.rs

vedhavyas

left one minor suggestion

domains/pallets/evm_nonce_tracker/src/lib.rs

vedhavyas

ignore the previous migrations suggestions.

I see a new PR for that to taurus specifically.

teor2345 added enhancement New feature or request execution Subspace execution labels Jan 15, 2025

teor2345 self-assigned this Jan 15, 2025

teor2345 requested review from NingLin-P, vedhavyas and nazar-pc as code owners January 15, 2025 03:07

This comment was marked as resolved.

Sign in to view

teor2345 force-pushed the private-evm branch from 377d0da to 6a47075 Compare January 17, 2025 02:28

This comment was marked as resolved.

Sign in to view

teor2345 requested a review from NingLin-P January 17, 2025 02:32

teor2345 force-pushed the private-evm branch from 6a47075 to eabc2ac Compare January 17, 2025 05:17

This comment was marked as resolved.

Sign in to view

teor2345 mentioned this pull request Jan 17, 2025

Unify copies of GenesisDomainParams across different crates #3352

Open

This comment was marked as resolved.

Sign in to view

NingLin-P reviewed Jan 17, 2025

View reviewed changes

This comment was marked as resolved.

Sign in to view

teor2345 force-pushed the private-evm branch from eabc2ac to 7497b5c Compare January 20, 2025 07:18

vedhavyas reviewed Jan 20, 2025

View reviewed changes

crates/pallet-domains/src/lib.rs Outdated Show resolved Hide resolved

crates/subspace-runtime/src/lib.rs Outdated Show resolved Hide resolved

teor2345 force-pushed the private-evm branch from 7497b5c to b29c6f3 Compare January 21, 2025 02:51

This comment was marked as resolved.

Sign in to view

teor2345 force-pushed the private-evm branch from b29c6f3 to 4a7f2bf Compare January 21, 2025 03:03

This comment was marked as resolved.

Sign in to view

teor2345 force-pushed the private-evm branch from a94e6b3 to c5c1880 Compare January 23, 2025 02:31

teor2345 added the bug Something isn't working label Jan 24, 2025

teor2345 force-pushed the private-evm branch from 7cee104 to 0a796cc Compare January 27, 2025 05:51

teor2345 marked this pull request as ready for review January 30, 2025 20:11

teor2345 enabled auto-merge January 30, 2025 20:12

teor2345 requested review from NingLin-P, vedhavyas and dariolina January 30, 2025 20:12

teor2345 disabled auto-merge January 30, 2025 20:14

vedhavyas reviewed Jan 31, 2025

View reviewed changes

teor2345 commented Feb 3, 2025

View reviewed changes

This comment was marked as resolved.

Sign in to view

NingLin-P reviewed Feb 3, 2025

View reviewed changes

crates/pallet-domains/src/domain_registry.rs Show resolved Hide resolved

teor2345 force-pushed the private-evm branch from c013f78 to ee8c646 Compare February 4, 2025 02:32

teor2345 requested review from NingLin-P and vedhavyas February 4, 2025 02:32

teor2345 added 6 commits February 4, 2025 12:36

Add a contract creation filter to EVM domains

79aa1e7

Add a pallet-utility Call iterator and use it in existing code

e3ca237

Rename pallet_evm_nonce_tracker to pallet-evm-tracker

8edc4d4

Move contract create hooks to pallet-evm-tracker

a188487

Add tests for contract creation allow lists

be46277

Set the empty contract create value to Anyone

eb4e295

teor2345 force-pushed the private-evm branch from ee8c646 to eb4e295 Compare February 4, 2025 02:38

teor2345 commented Feb 4, 2025

View reviewed changes

crates/pallet-domains/src/domain_registry.rs Show resolved Hide resolved

domains/pallets/evm_nonce_tracker/src/lib.rs Outdated Show resolved Hide resolved

domains/client/domain-operator/src/tests.rs Outdated Show resolved Hide resolved

vedhavyas reviewed Feb 4, 2025

View reviewed changes

domains/client/domain-operator/src/lib.rs Show resolved Hide resolved

crates/pallet-domains/src/domain_registry.rs Show resolved Hide resolved

crates/pallet-domains/src/runtime_registry.rs Show resolved Hide resolved

vedhavyas reviewed Feb 4, 2025

View reviewed changes

domains/pallets/evm_nonce_tracker/src/lib.rs Outdated Show resolved Hide resolved

vedhavyas approved these changes Feb 4, 2025

View reviewed changes

NingLin-P approved these changes Feb 4, 2025

View reviewed changes

teor2345 added this pull request to the merge queue Feb 4, 2025

Merged via the queue into main with commit f5e8b43 Feb 4, 2025
10 checks passed

teor2345 deleted the private-evm branch February 4, 2025 21:53

teor2345 mentioned this pull request Feb 4, 2025

Fix second segment offset in object retrieval, other minor cleanups #3367

Open

1 task

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add contract creation allow lists to EVM domains #3350

Add contract creation allow lists to EVM domains #3350

teor2345 commented Jan 15, 2025 •

edited

Loading

This comment was marked as resolved.

This comment was marked as resolved.

This comment was marked as resolved.

This comment was marked as resolved.

This comment was marked as resolved.

This comment was marked as resolved.

This comment was marked as resolved.

NingLin-P Jan 17, 2025

This comment was marked as resolved.

This comment was marked as resolved.

This comment was marked as resolved.

This comment was marked as resolved.

This comment was marked as resolved.

vedhavyas left a comment

vedhavyas Jan 31, 2025

teor2345 Feb 2, 2025 •

edited

Loading

teor2345 left a comment

teor2345 Feb 2, 2025 •

edited

Loading

This comment was marked as resolved.

NingLin-P left a comment

teor2345 left a comment •

edited

Loading

vedhavyas left a comment

vedhavyas left a comment

vedhavyas left a comment

Add contract creation allow lists to EVM domains #3350

Add contract creation allow lists to EVM domains #3350

Conversation

teor2345 commented Jan 15, 2025 • edited Loading

How to review this PR

What it does

Other Changes

Bug Fixes

TODOs

Code contributor checklist:

This comment was marked as resolved.

This comment was marked as resolved.

This comment was marked as resolved.

This comment was marked as resolved.

This comment was marked as resolved.

This comment was marked as resolved.

This comment was marked as resolved.

NingLin-P Jan 17, 2025

Choose a reason for hiding this comment

This comment was marked as resolved.

This comment was marked as resolved.

This comment was marked as resolved.

This comment was marked as resolved.

This comment was marked as resolved.

vedhavyas left a comment

Choose a reason for hiding this comment

vedhavyas Jan 31, 2025

Choose a reason for hiding this comment

teor2345 Feb 2, 2025 • edited Loading

Choose a reason for hiding this comment

teor2345 left a comment

Choose a reason for hiding this comment

teor2345 Feb 2, 2025 • edited Loading

Choose a reason for hiding this comment

This comment was marked as resolved.

NingLin-P left a comment

Choose a reason for hiding this comment

teor2345 left a comment • edited Loading

Choose a reason for hiding this comment

vedhavyas left a comment

Choose a reason for hiding this comment

vedhavyas left a comment

Choose a reason for hiding this comment

vedhavyas left a comment

Choose a reason for hiding this comment

teor2345 commented Jan 15, 2025 •

edited

Loading

teor2345 Feb 2, 2025 •

edited

Loading

teor2345 Feb 2, 2025 •

edited

Loading

teor2345 left a comment •

edited

Loading