feat(protect): add onlyInitiated modifier

[Rubilmax]

• Fixes https://github.com/cantinasec/review-morpho-blue-1/issues/23
• Fixes Quantify _checkInitiated in actions that require initialization #270
• Fixes Potentially misleading warning comments #278

[MerlinEgalite]

@QGarchery @MathisGD can one of you review this PR?

[MerlinEgalite]

@Rubilmax can you update this branche please?

[Rubilmax]

Ideally this one is merged among the last ones, but I reviewed still

[QGarchery]

Many conflicts, sorry :/

[openzeppelin-code]

feat(protect): add onlyInitiated modifier

Generated at commit: 0a052d8e36b46d8abb6ccaec7b660a2bcba1af13

🚨 Vulnerabilities Summary

Process	Issues	Results
Contract Inspector	note low critical Total	20 10 1 31
Dependency Checker	Total	0

---

For more details view the full report in OpenZeppelin Code

[Rubilmax]

LGTM

[MerlinEgalite]

Conflicts to fix cc @Rubilmax

[QGarchery]

LGTM except one point on native transfers that I think we should discuss.
The goal of the onlyInitiated modifier is to:

1. explicit the error in case of an accidental usage of the bundler. In most cases it is not a safety measure, because the UNSET_INITIATOR address would be used instead, which would lead to a revert anyway.

2. The onlyInitiated modifier is also used in the WNativeBundler. Here I assume that the reasoning is that native tokens could be used without having been sent by a previous transfer in the same multicall. Indeed, without the modifier, one could make a direct call to wrapNative with a positive msg.value and it would result to lost funds most likely (wrapped tokens could be skimmed by anyone). In this case it is a safety measure against accidentally sending native tokens.

I think that the goal 2 is not consistent in the current state, because of the following functions:

• wrapNative is gated by onlyInitiated, which is useful against accidental native transfers
• unwrapNative is unnecessarily gated, because it already assumes that funds are on the bundler. It is similar to the wrap/unwrap stETH functions (which are not gated)
• stakeEth is not gated, but it would be useful against accidental native transfer, similarly to wrapNative

I think we can either:
a. remove goal 2 entirely, by removing the onlyInitiated modifier to the functions mentioned above
b. implement goal 2 everywhere. Notice that we could also gate the receive function if we go that route

[Rubilmax]

Thanks @QGarchery for pointing out that the change wasn't consistent. I removed onlyInitiated from wrapNative & unwrapNative. We'll move to (b) in #354 , in addition to protect from reentrancies

[Rubilmax]

I still remove this comment because in this case we're not using initiator(). The goal of this comment wasn't to avoid losing funds, otherwise this comment should be duplicated on all functions. In any case, #354 will protect the user from everything