From ad96dbaecba14d4d1fc31aa84c15c4e8fa27d47b Mon Sep 17 00:00:00 2001
From: Milap Sheth <milap@interoplabs.io>
Date: Mon, 18 Nov 2024 22:51:20 +0700
Subject: [PATCH 1/3] fix(its)!: restrict token deployments on ITS for
 Amplifier chains

---
 contracts/InterchainTokenService.sol |  7 ++++++-
 test/InterchainTokenService.js       | 14 ++++++++++++++
 2 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/contracts/InterchainTokenService.sol b/contracts/InterchainTokenService.sol
index 7b12842b..7c83b429 100644
--- a/contracts/InterchainTokenService.sol
+++ b/contracts/InterchainTokenService.sol
@@ -356,7 +356,12 @@ contract InterchainTokenService is
     ) external payable whenNotPaused returns (bytes32 tokenId) {
         address deployer = msg.sender;
 
-        if (deployer == interchainTokenFactory) deployer = TOKEN_FACTORY_DEPLOYER;
+        if (deployer == interchainTokenFactory) {
+            deployer = TOKEN_FACTORY_DEPLOYER;
+        } else if (trustedAddressHash(chainName()) == ITS_HUB_ROUTING_IDENTIFIER_HASH) {
+            // Currently, deployments directly on ITS contract (instead of ITS Factory) are restricted for ITS contracts deployed on Amplifier, i.e registered with the Hub
+            revert NotSupported();
+        }
 
         tokenId = interchainTokenId(deployer, salt);
 
diff --git a/test/InterchainTokenService.js b/test/InterchainTokenService.js
index 19e44262..ce1c978c 100644
--- a/test/InterchainTokenService.js
+++ b/test/InterchainTokenService.js
@@ -695,6 +695,20 @@ describe('Interchain Token Service', () => {
                 'EmptyTokenSymbol',
             );
         });
+
+        it('Should revert when deploying an interchain token on chain native to ITS hub', async () => {
+            await expect(service.setTrustedAddress(chainName, ITS_HUB_ROUTING_IDENTIFIER))
+                .to.emit(service, 'TrustedAddressSet')
+                .withArgs(chainName, ITS_HUB_ROUTING_IDENTIFIER);
+
+            await expectRevert(
+                (gasOptions) => service.deployInterchainToken(salt, '', tokenName, tokenSymbol, tokenDecimals, wallet.address, 0, gasOptions),
+                service,
+                'NotSupported',
+            );
+
+            await expect(service.removeTrustedAddress(chainName)).to.emit(service, 'TrustedAddressRemoved').withArgs(chainName);
+        });
     });
 
     describe('Deploy and Register remote Interchain Token', () => {

From abac13616aac01699d846f8621cba2b5e1223105 Mon Sep 17 00:00:00 2001
From: Milap Sheth <milap@interoplabs.io>
Date: Mon, 18 Nov 2024 22:58:08 +0700
Subject: [PATCH 2/3] changeset

---
 .changeset/hungry-bats-study.md | 5 +++++
 1 file changed, 5 insertions(+)
 create mode 100644 .changeset/hungry-bats-study.md

diff --git a/.changeset/hungry-bats-study.md b/.changeset/hungry-bats-study.md
new file mode 100644
index 00000000..698c3fed
--- /dev/null
+++ b/.changeset/hungry-bats-study.md
@@ -0,0 +1,5 @@
+---
+'@axelar-network/interchain-token-service': patch
+---
+
+ITS deployInterchainToken is restricted from being on ITS on Amplifier chains. The ITS Factory should be used instead

From 0f26a9de5a47c5baa5fb047665ad54fbdc8409fc Mon Sep 17 00:00:00 2001
From: Milap Sheth <milap@interoplabs.io>
Date: Mon, 18 Nov 2024 23:47:55 +0700
Subject: [PATCH 3/3] prettier

---
 test/InterchainTokenService.js | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/test/InterchainTokenService.js b/test/InterchainTokenService.js
index ce1c978c..2cb75946 100644
--- a/test/InterchainTokenService.js
+++ b/test/InterchainTokenService.js
@@ -702,7 +702,8 @@ describe('Interchain Token Service', () => {
                 .withArgs(chainName, ITS_HUB_ROUTING_IDENTIFIER);
 
             await expectRevert(
-                (gasOptions) => service.deployInterchainToken(salt, '', tokenName, tokenSymbol, tokenDecimals, wallet.address, 0, gasOptions),
+                (gasOptions) =>
+                    service.deployInterchainToken(salt, '', tokenName, tokenSymbol, tokenDecimals, wallet.address, 0, gasOptions),
                 service,
                 'NotSupported',
             );