From 2da5b3a9c11eb1a345356cad87cd083501db9cdc Mon Sep 17 00:00:00 2001
From: Milap Sheth <milap@interoplabs.io>
Date: Mon, 18 Nov 2024 12:29:05 -0500
Subject: [PATCH] fix(its)!: restrict token deployments on ITS for Amplifier
 chains (#304)

---
 .changeset/hungry-bats-study.md      |  5 +++++
 contracts/InterchainTokenService.sol |  7 ++++++-
 test/InterchainTokenService.js       | 15 +++++++++++++++
 3 files changed, 26 insertions(+), 1 deletion(-)
 create mode 100644 .changeset/hungry-bats-study.md

diff --git a/.changeset/hungry-bats-study.md b/.changeset/hungry-bats-study.md
new file mode 100644
index 00000000..698c3fed
--- /dev/null
+++ b/.changeset/hungry-bats-study.md
@@ -0,0 +1,5 @@
+---
+'@axelar-network/interchain-token-service': patch
+---
+
+ITS deployInterchainToken is restricted from being on ITS on Amplifier chains. The ITS Factory should be used instead
diff --git a/contracts/InterchainTokenService.sol b/contracts/InterchainTokenService.sol
index 7b12842b..7c83b429 100644
--- a/contracts/InterchainTokenService.sol
+++ b/contracts/InterchainTokenService.sol
@@ -356,7 +356,12 @@ contract InterchainTokenService is
     ) external payable whenNotPaused returns (bytes32 tokenId) {
         address deployer = msg.sender;
 
-        if (deployer == interchainTokenFactory) deployer = TOKEN_FACTORY_DEPLOYER;
+        if (deployer == interchainTokenFactory) {
+            deployer = TOKEN_FACTORY_DEPLOYER;
+        } else if (trustedAddressHash(chainName()) == ITS_HUB_ROUTING_IDENTIFIER_HASH) {
+            // Currently, deployments directly on ITS contract (instead of ITS Factory) are restricted for ITS contracts deployed on Amplifier, i.e registered with the Hub
+            revert NotSupported();
+        }
 
         tokenId = interchainTokenId(deployer, salt);
 
diff --git a/test/InterchainTokenService.js b/test/InterchainTokenService.js
index 19e44262..2cb75946 100644
--- a/test/InterchainTokenService.js
+++ b/test/InterchainTokenService.js
@@ -695,6 +695,21 @@ describe('Interchain Token Service', () => {
                 'EmptyTokenSymbol',
             );
         });
+
+        it('Should revert when deploying an interchain token on chain native to ITS hub', async () => {
+            await expect(service.setTrustedAddress(chainName, ITS_HUB_ROUTING_IDENTIFIER))
+                .to.emit(service, 'TrustedAddressSet')
+                .withArgs(chainName, ITS_HUB_ROUTING_IDENTIFIER);
+
+            await expectRevert(
+                (gasOptions) =>
+                    service.deployInterchainToken(salt, '', tokenName, tokenSymbol, tokenDecimals, wallet.address, 0, gasOptions),
+                service,
+                'NotSupported',
+            );
+
+            await expect(service.removeTrustedAddress(chainName)).to.emit(service, 'TrustedAddressRemoved').withArgs(chainName);
+        });
     });
 
     describe('Deploy and Register remote Interchain Token', () => {