1fb7266469
- Introduced Aggregator.sol for Chainlink-compatible oracle functionality, including round-based updates and access control. - Added OracleWithCCIP.sol to extend Aggregator with CCIP cross-chain messaging capabilities. - Created .gitmodules to include OpenZeppelin contracts as a submodule. - Developed a comprehensive deployment guide in NEXT_STEPS_COMPLETE_GUIDE.md for Phase 2 and smart contract deployment. - Implemented Vite configuration for the orchestration portal, supporting both Vue and React frameworks. - Added server-side logic for the Multi-Cloud Orchestration Portal, including API endpoints for environment management and monitoring. - Created scripts for resource import and usage validation across non-US regions. - Added tests for CCIP error handling and integration to ensure robust functionality. - Included various new files and directories for the orchestration portal and deployment scripts.
414 lines
14 KiB
Markdown
414 lines
14 KiB
Markdown
# OpenZeppelin Dependency Assessment Tasks
|
|
|
|
## Overview
|
|
|
|
This document outlines tasks to assess and resolve OpenZeppelin dependencies in the project. The new WETH contracts (WETH10, CCIPWETH9Bridge, CCIPWETH10Bridge) are independent and don't require OpenZeppelin, but several existing contracts do.
|
|
|
|
## Task List
|
|
|
|
### Phase 1: Discovery and Inventory
|
|
|
|
#### Task 1.1: Identify All OpenZeppelin Dependencies
|
|
**Status:** ⏳ Pending
|
|
**Priority:** High
|
|
**Description:** Catalog all contracts that import OpenZeppelin libraries
|
|
|
|
**Actions:**
|
|
- [ ] Search for all `@openzeppelin` imports in the codebase
|
|
- [ ] List contracts using OpenZeppelin:
|
|
- [ ] `contracts/ccip/CCIPSender.sol` - Uses `SafeERC20`, `IERC20`
|
|
- [ ] `contracts/ccip/CCIPRouter.sol` - Uses `SafeERC20`, `IERC20`
|
|
- [ ] `contracts/ccip/CCIPRouterOptimized.sol` - Uses `SafeERC20`, `IERC20`
|
|
- [ ] `contracts/governance/MultiSig.sol` - Uses `Ownable`
|
|
- [ ] `contracts/governance/Voting.sol` - Uses `Ownable`
|
|
- [ ] Document which OpenZeppelin contracts are used:
|
|
- [ ] `@openzeppelin/contracts/token/ERC20/IERC20.sol`
|
|
- [ ] `@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol`
|
|
- [ ] `@openzeppelin/contracts/access/Ownable.sol`
|
|
- [ ] Check for any test files using OpenZeppelin
|
|
- [ ] Check for any deployment scripts using OpenZeppelin
|
|
|
|
**Deliverable:** List of all files with OpenZeppelin dependencies
|
|
|
|
---
|
|
|
|
#### Task 1.2: Check OpenZeppelin Installation Status
|
|
**Status:** ⏳ Pending
|
|
**Priority:** High
|
|
**Description:** Determine if OpenZeppelin is installed in the project
|
|
|
|
**Actions:**
|
|
- [ ] Check if `lib/openzeppelin-contracts` directory exists
|
|
- [ ] Check if OpenZeppelin is listed in `.gitmodules` (if using git submodules)
|
|
- [ ] Check `foundry.toml` for lib directory configuration
|
|
- [ ] Verify `remappings.txt` for OpenZeppelin remappings
|
|
- [ ] Check if OpenZeppelin is installed via npm (check `package.json`)
|
|
- [ ] Check if OpenZeppelin is installed via yarn (check `yarn.lock`)
|
|
- [ ] Verify if OpenZeppelin is available in Foundry's default libs
|
|
|
|
**Deliverable:** Installation status report
|
|
|
|
---
|
|
|
|
#### Task 1.3: Verify Compilation Status
|
|
**Status:** ⏳ Pending
|
|
**Priority:** High
|
|
**Description:** Test compilation of all contracts with and without OpenZeppelin
|
|
|
|
**Actions:**
|
|
- [ ] Attempt to compile all contracts: `forge build`
|
|
- [ ] Document compilation errors related to OpenZeppelin
|
|
- [ ] Test compilation of new WETH contracts independently:
|
|
- [ ] `contracts/tokens/WETH10.sol`
|
|
- [ ] `contracts/ccip/CCIPWETH9Bridge.sol`
|
|
- [ ] `contracts/ccip/CCIPWETH10Bridge.sol`
|
|
- [ ] Test compilation of existing CCIP contracts:
|
|
- [ ] `contracts/ccip/CCIPSender.sol`
|
|
- [ ] `contracts/ccip/CCIPRouter.sol`
|
|
- [ ] `contracts/ccip/CCIPRouterOptimized.sol`
|
|
- [ ] Test compilation of governance contracts:
|
|
- [ ] `contracts/governance/MultiSig.sol`
|
|
- [ ] `contracts/governance/Voting.sol`
|
|
- [ ] Document which contracts compile successfully
|
|
- [ ] Document which contracts fail compilation
|
|
|
|
**Deliverable:** Compilation status report
|
|
|
|
---
|
|
|
|
### Phase 2: Dependency Analysis
|
|
|
|
#### Task 2.1: Analyze OpenZeppelin Usage Patterns
|
|
**Status:** ⏳ Pending
|
|
**Priority:** Medium
|
|
**Description:** Understand how OpenZeppelin is used in each contract
|
|
|
|
**Actions:**
|
|
- [ ] Analyze `CCIPSender.sol`:
|
|
- [ ] Document SafeERC20 usage patterns
|
|
- [ ] Identify if SafeERC20 can be replaced with standard ERC20 calls
|
|
- [ ] Check if IERC20 interface can be replaced with minimal interface
|
|
- [ ] Analyze `CCIPRouter.sol`:
|
|
- [ ] Document SafeERC20 usage patterns
|
|
- [ ] Identify if SafeERC20 can be replaced with standard ERC20 calls
|
|
- [ ] Check if IERC20 interface can be replaced with minimal interface
|
|
- [ ] Analyze `CCIPRouterOptimized.sol`:
|
|
- [ ] Document SafeERC20 usage patterns
|
|
- [ ] Identify if SafeERC20 can be replaced with standard ERC20 calls
|
|
- [ ] Check if IERC20 interface can be replaced with minimal interface
|
|
- [ ] Analyze `MultiSig.sol`:
|
|
- [ ] Document Ownable usage patterns
|
|
- [ ] Identify if Ownable can be replaced with custom admin pattern
|
|
- [ ] Check if Ownable functionality is critical
|
|
- [ ] Analyze `Voting.sol`:
|
|
- [ ] Document Ownable usage patterns
|
|
- [ ] Identify if Ownable can be replaced with custom admin pattern
|
|
- [ ] Check if Ownable functionality is critical
|
|
|
|
**Deliverable:** Usage pattern analysis document
|
|
|
|
---
|
|
|
|
#### Task 2.2: Assess Refactoring Feasibility
|
|
**Status:** ⏳ Pending
|
|
**Priority:** Medium
|
|
**Description:** Determine if contracts can be refactored to remove OpenZeppelin dependencies
|
|
|
|
**Actions:**
|
|
- [ ] Evaluate SafeERC20 replacement options:
|
|
- [ ] Can we use standard ERC20 `transferFrom` with require statements?
|
|
- [ ] Are there non-standard ERC20 tokens that require SafeERC20?
|
|
- [ ] What are the security implications of removing SafeERC20?
|
|
- [ ] Evaluate Ownable replacement options:
|
|
- [ ] Can we use simple admin pattern (like in CCIPWETH9Bridge)?
|
|
- [ ] Are there additional features in Ownable we need?
|
|
- [ ] What are the security implications of removing Ownable?
|
|
- [ ] Evaluate IERC20 interface replacement:
|
|
- [ ] Can we use minimal IERC20 interface (like in CCIPWETH9Bridge)?
|
|
- [ ] Are there additional functions in OpenZeppelin's IERC20 we need?
|
|
- [ ] What are the compatibility implications?
|
|
- [ ] Create refactoring plan for each contract
|
|
- [ ] Estimate effort for refactoring each contract
|
|
|
|
**Deliverable:** Refactoring feasibility assessment
|
|
|
|
---
|
|
|
|
### Phase 3: Solution Design
|
|
|
|
#### Task 3.1: Option A - Install OpenZeppelin
|
|
**Status:** ⏳ Pending
|
|
**Priority:** Medium
|
|
**Description:** Install OpenZeppelin as a dependency if refactoring is not feasible
|
|
|
|
**Actions:**
|
|
- [ ] Determine installation method:
|
|
- [ ] Option 1: Install via Foundry (`forge install`)
|
|
- [ ] Option 2: Install via npm/yarn (if using Hardhat/Truffle)
|
|
- [ ] Option 3: Use git submodules
|
|
- [ ] If using Foundry:
|
|
- [ ] Initialize git repository if not already initialized
|
|
- [ ] Install OpenZeppelin: `forge install OpenZeppelin/openzeppelin-contracts`
|
|
- [ ] Verify installation in `lib/openzeppelin-contracts`
|
|
- [ ] Update `foundry.toml` if needed
|
|
- [ ] Create or update `remappings.txt`
|
|
- [ ] Verify compilation after installation
|
|
- [ ] Test all contracts compile successfully
|
|
- [ ] Document installation process
|
|
- [ ] Update deployment scripts if needed
|
|
- [ ] Update CI/CD pipelines if needed
|
|
|
|
**Deliverable:** Installation guide and verification
|
|
|
|
---
|
|
|
|
#### Task 3.2: Option B - Refactor Contracts
|
|
**Status:** ⏳ Pending
|
|
**Priority:** Medium
|
|
**Description:** Refactor contracts to remove OpenZeppelin dependencies
|
|
|
|
**Actions:**
|
|
- [ ] Refactor `CCIPSender.sol`:
|
|
- [ ] Replace SafeERC20 with standard ERC20 calls
|
|
- [ ] Replace IERC20 with minimal interface
|
|
- [ ] Add require statements for error handling
|
|
- [ ] Test refactored contract
|
|
- [ ] Refactor `CCIPRouter.sol`:
|
|
- [ ] Replace SafeERC20 with standard ERC20 calls
|
|
- [ ] Replace IERC20 with minimal interface
|
|
- [ ] Add require statements for error handling
|
|
- [ ] Test refactored contract
|
|
- [ ] Refactor `CCIPRouterOptimized.sol`:
|
|
- [ ] Replace SafeERC20 with standard ERC20 calls
|
|
- [ ] Replace IERC20 with minimal interface
|
|
- [ ] Add require statements for error handling
|
|
- [ ] Test refactored contract
|
|
- [ ] Refactor `MultiSig.sol`:
|
|
- [ ] Replace Ownable with custom admin pattern
|
|
- [ ] Implement admin functions manually
|
|
- [ ] Test refactored contract
|
|
- [ ] Refactor `Voting.sol`:
|
|
- [ ] Replace Ownable with custom admin pattern
|
|
- [ ] Implement admin functions manually
|
|
- [ ] Test refactored contract
|
|
- [ ] Update tests for refactored contracts
|
|
- [ ] Verify all tests pass
|
|
- [ ] Update documentation
|
|
|
|
**Deliverable:** Refactored contracts and test results
|
|
|
|
---
|
|
|
|
#### Task 3.3: Option C - Hybrid Approach
|
|
**Status:** ⏳ Pending
|
|
**Priority:** Low
|
|
**Description:** Install OpenZeppelin for existing contracts, keep new contracts independent
|
|
|
|
**Actions:**
|
|
- [ ] Install OpenZeppelin for existing contracts
|
|
- [ ] Keep new WETH contracts independent (already done)
|
|
- [ ] Document which contracts use OpenZeppelin
|
|
- [ ] Document which contracts are independent
|
|
- [ ] Create migration plan for future contracts
|
|
- [ ] Update project documentation
|
|
|
|
**Deliverable:** Hybrid solution documentation
|
|
|
|
---
|
|
|
|
### Phase 4: Implementation
|
|
|
|
#### Task 4.1: Implement Chosen Solution
|
|
**Status:** ⏳ Pending
|
|
**Priority:** High
|
|
**Description:** Implement the chosen solution (Install, Refactor, or Hybrid)
|
|
|
|
**Actions:**
|
|
- [ ] Review Phase 3 recommendations
|
|
- [ ] Choose solution based on:
|
|
- [ ] Project requirements
|
|
- [ ] Security considerations
|
|
- [ ] Maintenance burden
|
|
- [ ] Team preferences
|
|
- [ ] Implement chosen solution
|
|
- [ ] Verify all contracts compile
|
|
- [ ] Run all tests
|
|
- [ ] Update documentation
|
|
- [ ] Create deployment guide
|
|
|
|
**Deliverable:** Implemented solution with verification
|
|
|
|
---
|
|
|
|
#### Task 4.2: Update Project Documentation
|
|
**Status:** ⏳ Pending
|
|
**Priority:** Medium
|
|
**Description:** Update project documentation to reflect dependency status
|
|
|
|
**Actions:**
|
|
- [ ] Update `README.md` with dependency information
|
|
- [ ] Update `docs/DEPLOYMENT.md` with installation steps
|
|
- [ ] Create `docs/CONTRACTS.md` documenting contract dependencies
|
|
- [ ] Update `foundry.toml` comments if needed
|
|
- [ ] Create `docs/DEPENDENCIES.md` with dependency overview
|
|
- [ ] Update CI/CD documentation if needed
|
|
|
|
**Deliverable:** Updated documentation
|
|
|
|
---
|
|
|
|
#### Task 4.3: Update CI/CD Pipelines
|
|
**Status:** ⏳ Pending
|
|
**Priority:** Medium
|
|
**Description:** Ensure CI/CD pipelines work with chosen solution
|
|
|
|
**Actions:**
|
|
- [ ] Check `.github/workflows/ci.yml` for dependency installation
|
|
- [ ] Update CI workflow to install OpenZeppelin if needed
|
|
- [ ] Update CI workflow to handle refactored contracts if needed
|
|
- [ ] Test CI pipeline locally
|
|
- [ ] Verify CI pipeline passes
|
|
- [ ] Update deployment pipelines if needed
|
|
|
|
**Deliverable:** Updated CI/CD pipelines
|
|
|
|
---
|
|
|
|
### Phase 5: Verification and Testing
|
|
|
|
#### Task 5.1: Comprehensive Testing
|
|
**Status:** ⏳ Pending
|
|
**Priority:** High
|
|
**Description:** Test all contracts with chosen solution
|
|
|
|
**Actions:**
|
|
- [ ] Run all unit tests: `forge test`
|
|
- [ ] Run integration tests if available
|
|
- [ ] Test compilation of all contracts
|
|
- [ ] Test deployment of all contracts
|
|
- [ ] Verify cross-contract interactions work
|
|
- [ ] Test edge cases and error handling
|
|
- [ ] Document test results
|
|
|
|
**Deliverable:** Test results and verification report
|
|
|
|
---
|
|
|
|
#### Task 5.2: Security Review
|
|
**Status:** ⏳ Pending
|
|
**Priority:** High
|
|
**Description:** Review security implications of chosen solution
|
|
|
|
**Actions:**
|
|
- [ ] Review refactored contracts for security issues
|
|
- [ ] Compare SafeERC20 replacement with original
|
|
- [ ] Review Ownable replacement for access control issues
|
|
- [ ] Check for reentrancy vulnerabilities
|
|
- [ ] Verify error handling is correct
|
|
- [ ] Document security considerations
|
|
- [ ] Create security audit checklist
|
|
|
|
**Deliverable:** Security review report
|
|
|
|
---
|
|
|
|
### Phase 6: Documentation and Handoff
|
|
|
|
#### Task 6.1: Create Dependency Guide
|
|
**Status:** ⏳ Pending
|
|
**Priority:** Medium
|
|
**Description:** Create comprehensive guide for managing dependencies
|
|
|
|
**Actions:**
|
|
- [ ] Document which contracts require OpenZeppelin
|
|
- [ ] Document which contracts are independent
|
|
- [ ] Create installation guide if OpenZeppelin is needed
|
|
- [ ] Create refactoring guide if contracts were refactored
|
|
- [ ] Document decision-making process
|
|
- [ ] Create troubleshooting guide
|
|
|
|
**Deliverable:** Dependency management guide
|
|
|
|
---
|
|
|
|
#### Task 6.2: Update Project Status
|
|
**Status:** ⏳ Pending
|
|
**Priority:** Low
|
|
**Description:** Update project status and next steps
|
|
|
|
**Actions:**
|
|
- [ ] Update project README with dependency status
|
|
- [ ] Update `docs/WETH_CCIP_DEPLOYMENT.md` if needed
|
|
- [ ] Create migration guide for future contracts
|
|
- [ ] Document lessons learned
|
|
- [ ] Update project roadmap if needed
|
|
|
|
**Deliverable:** Updated project status
|
|
|
|
---
|
|
|
|
## Current Status Summary
|
|
|
|
### Contracts with OpenZeppelin Dependencies
|
|
1. ✅ **CCIPSender.sol** - Uses `SafeERC20`, `IERC20`
|
|
2. ✅ **CCIPRouter.sol** - Uses `SafeERC20`, `IERC20`
|
|
3. ✅ **CCIPRouterOptimized.sol** - Uses `SafeERC20`, `IERC20`
|
|
4. ✅ **MultiSig.sol** - Uses `Ownable`
|
|
5. ✅ **Voting.sol** - Uses `Ownable`
|
|
|
|
### Contracts Independent of OpenZeppelin
|
|
1. ✅ **WETH10.sol** - No OpenZeppelin dependencies
|
|
2. ✅ **CCIPWETH9Bridge.sol** - Uses minimal IERC20 interface
|
|
3. ✅ **CCIPWETH10Bridge.sol** - Uses minimal IERC20 interface
|
|
4. ✅ **WETH.sol** - No OpenZeppelin dependencies
|
|
5. ✅ **All other contracts** - No OpenZeppelin dependencies
|
|
|
|
### Installation Status
|
|
- ❌ OpenZeppelin is **NOT** currently installed
|
|
- ❌ `lib/openzeppelin-contracts` directory does **NOT** exist
|
|
- ❌ Git repository may not be initialized
|
|
- ✅ Foundry is configured with `libs = ["lib"]` in `foundry.toml`
|
|
|
|
### Compilation Status
|
|
- ✅ New WETH contracts compile independently
|
|
- ❌ Existing CCIP contracts fail compilation (missing OpenZeppelin)
|
|
- ❌ Governance contracts fail compilation (missing OpenZeppelin)
|
|
|
|
## Recommended Approach
|
|
|
|
Based on the assessment, the recommended approach is:
|
|
|
|
1. **Option A - Install OpenZeppelin** (Recommended for quick resolution)
|
|
- Install OpenZeppelin via Foundry
|
|
- Maintains existing contract code
|
|
- Minimal risk of introducing bugs
|
|
- Quick to implement
|
|
|
|
2. **Option B - Refactor Contracts** (Recommended for long-term)
|
|
- Remove OpenZeppelin dependencies
|
|
- Reduce external dependencies
|
|
- Align with new WETH contracts
|
|
- More maintainable long-term
|
|
|
|
3. **Option C - Hybrid Approach** (Recommended for gradual migration)
|
|
- Install OpenZeppelin for existing contracts
|
|
- Keep new contracts independent
|
|
- Gradually refactor existing contracts over time
|
|
|
|
## Next Steps
|
|
|
|
1. Complete Phase 1 tasks (Discovery and Inventory)
|
|
2. Complete Phase 2 tasks (Dependency Analysis)
|
|
3. Choose solution based on analysis
|
|
4. Implement chosen solution (Phase 3-4)
|
|
5. Verify and test (Phase 5)
|
|
6. Document and handoff (Phase 6)
|
|
|
|
## Notes
|
|
|
|
- New WETH contracts (WETH10, CCIPWETH9Bridge, CCIPWETH10Bridge) are already independent and don't require OpenZeppelin
|
|
- Existing CCIP contracts can be refactored to remove OpenZeppelin dependencies (similar to new WETH bridges)
|
|
- Governance contracts (MultiSig, Voting) can be refactored to use custom admin pattern (similar to CCIPWETH9Bridge)
|
|
- The project uses Foundry, so OpenZeppelin should be installed via `forge install` if needed
|
|
|