fix(its)!: restrict token deployments on ITS for Amplifier chains (#304)

.changeset/hungry-bats-study.md

@@ -0,0 +1,5 @@
+---
+'@axelar-network/interchain-token-service': patch
+---
+
+ITS deployInterchainToken is restricted from being on ITS on Amplifier chains. The ITS Factory should be used instead

contracts/InterchainTokenService.sol

@@ -356,7 +356,12 @@ contract InterchainTokenService is
     ) external payable whenNotPaused returns (bytes32 tokenId) {
         address deployer = msg.sender;
 
-        if (deployer == interchainTokenFactory) deployer = TOKEN_FACTORY_DEPLOYER;
+        if (deployer == interchainTokenFactory) {
+            deployer = TOKEN_FACTORY_DEPLOYER;
+        } else if (trustedAddressHash(chainName()) == ITS_HUB_ROUTING_IDENTIFIER_HASH) {
+            // Currently, deployments directly on ITS contract (instead of ITS Factory) are restricted for ITS contracts deployed on Amplifier, i.e registered with the Hub
+            revert NotSupported();
+        }
 
         tokenId = interchainTokenId(deployer, salt);
 

test/InterchainTokenService.js

@@ -695,6 +695,21 @@ describe('Interchain Token Service', () => {
                 'EmptyTokenSymbol',
             );
         });
+
+        it('Should revert when deploying an interchain token on chain native to ITS hub', async () => {
+            await expect(service.setTrustedAddress(chainName, ITS_HUB_ROUTING_IDENTIFIER))
+                .to.emit(service, 'TrustedAddressSet')
+                .withArgs(chainName, ITS_HUB_ROUTING_IDENTIFIER);
+
+            await expectRevert(
+                (gasOptions) =>
+                    service.deployInterchainToken(salt, '', tokenName, tokenSymbol, tokenDecimals, wallet.address, 0, gasOptions),
+                service,
+                'NotSupported',
+            );
+
+            await expect(service.removeTrustedAddress(chainName)).to.emit(service, 'TrustedAddressRemoved').withArgs(chainName);
+        });
     });
 
     describe('Deploy and Register remote Interchain Token', () => {