feat: prevent on revert spoofing backport

.github/workflows/generated-files_v2.yaml

@@ -8,7 +8,7 @@ on:
       - "v2/**"
   pull_request:
     branches:
-      - "*"
+      - "**"
     paths:
       - "v2/**"
     types:

.github/workflows/lint_v2.yaml

@@ -8,7 +8,7 @@ on:
       - 'v2/**'
   pull_request:
     branches:
-      - "*"
+      - "**"
     paths:
       - 'v2/**'
     types:

.github/workflows/slither_v2.yaml

@@ -8,7 +8,7 @@ on:
       - 'v2/**'
   pull_request:
     branches:
-      - "*"
+      - "**"
     paths:
       - 'v2/**'
     types:

.github/workflows/test_v2.yaml

@@ -8,7 +8,7 @@ on:
       - 'v2/**'
   pull_request:
     branches:
-      - "*"
+      - "**"
     paths:
       - 'v2/**'
     types:

v2/contracts/evm/GatewayEVM.sol

@@ -76,6 +76,7 @@ contract GatewayEVM is
     /// @param data Calldata to pass to the call.
     /// @return The result of the call.
     function _execute(address destination, bytes calldata data) internal returns (bytes memory) {
+        revertIfCallingOnRevert(data);
         (bool success, bytes memory result) = destination.call{ value: msg.value }(data);
         if (!success) revert ExecutionFailed();
 
@@ -385,4 +386,18 @@ contract GatewayEVM is
             IERC20(token).safeTransfer(custody, amount);
         }
     }
+
+    // @dev prevent spoofing onRevert functions
+    function revertIfCallingOnRevert(bytes calldata data) private pure {
+        if (data.length >= 4) {
+            bytes4 functionSelector;
+            assembly {
+                functionSelector := calldataload(data.offset)
+            }
+
+            if (functionSelector == Revertable.onRevert.selector) {
+                revert NotAllowedToCallOnRevert();
+            }
+        }
+    }
 }

v2/contracts/evm/interfaces/IGatewayEVM.sol

@@ -80,6 +80,9 @@ interface IGatewayEVMErrors {
 
     /// @notice Error when trying to transfer not whitelisted token to custody.
     error NotWhitelistedInCustody();
+
+    /// @notice Error when trying to call onRevert method using arbitrary call.
+    error NotAllowedToCallOnRevert();
 }
 
 /// @title IGatewayEVM

v2/test/GatewayEVM.t.sol

@@ -182,6 +182,14 @@ contract GatewayEVMTest is Test, IGatewayEVMErrors, IGatewayEVMEvents, IReceiver
         gateway.execute(address(receiver), data);
     }
 
+    function testForwardCallToReceiveOnRevertFails() public {
+        bytes memory data = abi.encodeWithSignature("onRevert((address,uint64,bytes))");
+
+        vm.prank(tssAddress);
+        vm.expectRevert(NotAllowedToCallOnRevert.selector);
+        gateway.execute(address(receiver), data);
+    }
+
     function testExecuteFailsIfDestinationIsZeroAddress() public {
         bytes memory data = abi.encodeWithSignature("receiveNoParams()");
 

v2/types/factories/IGatewayEVM.sol/IGatewayEVMErrors__factory.ts

@@ -44,6 +44,11 @@ const _abi = [
     name: "InsufficientETHAmount",
     inputs: [],
   },
+  {
+    type: "error",
+    name: "NotAllowedToCallOnRevert",
+    inputs: [],
+  },
   {
     type: "error",
     name: "NotWhitelistedInCustody",

v2/types/factories/IGatewayEVM.sol/IGatewayEVM__factory.ts

@@ -684,6 +684,11 @@ const _abi = [
     name: "InsufficientETHAmount",
     inputs: [],
   },
+  {
+    type: "error",
+    name: "NotAllowedToCallOnRevert",
+    inputs: [],
+  },
   {
     type: "error",
     name: "NotWhitelistedInCustody",