feat: deploy AdapterStore + Arbitrum_Adapter after OFT audit (#1063)

grasphoper · web-flow · commit f2415a29af7a · 2025-08-14T15:25:03.000-07:00
* deploy adapterStore + arbitrumAdapter

Signed-off-by: Ihor Farion &lt;ihor@umaproject.org&gt;

* bump package

Signed-off-by: Ihor Farion &lt;ihor@umaproject.org&gt;

* undo tsconfig change

Signed-off-by: Ihor Farion &lt;ihor@umaproject.org&gt;

* add bytecode verification script

Signed-off-by: Ihor Farion &lt;ihor@umaproject.org&gt;

* move verifyBytecode script to a hardhat task

Signed-off-by: Ihor Farion &lt;ihor@umaproject.org&gt;

* deploy spokepool

Signed-off-by: Ihor Farion &lt;ihor@umaproject.org&gt;

* verify deployment tx inputs rather than runtime bytecode

Signed-off-by: Ihor Farion &lt;ihor@umaproject.org&gt;

* improve verifyBytecode script

Signed-off-by: Ihor Farion &lt;ihor@umaproject.org&gt;

* update adapter address

Signed-off-by: Ihor Farion &lt;ihor@umaproject.org&gt;

---------

Signed-off-by: Ihor Farion &lt;ihor@umaproject.org&gt;
diff --git a/.gitignore b/.gitignore
@@ -25,6 +25,7 @@ storage-layouts/proposed*
 
 # IDE
 .idea
+.vscode
 
 # Anchor files
 .anchor
diff --git a/deploy/004_deploy_arbitrum_adapter.ts b/deploy/004_deploy_arbitrum_adapter.ts
@@ -1,5 +1,5 @@
 import { CHAIN_IDs } from "@across-protocol/constants";
-import { getHyperlaneDomainId, getOftEid, toWei } from "../utils/utils";
+import { getOftEid, toWei } from "../utils/utils";
 import { L1_ADDRESS_MAP, USDC } from "./consts";
 import { DeployFunction } from "hardhat-deploy/types";
 import { HardhatRuntimeEnvironment } from "hardhat/types";
@@ -31,16 +31,8 @@ const func: DeployFunction = async function (hre: HardhatRuntimeEnvironment) {
     from: deployer,
     log: true,
     skipIfAlreadyDeployed: false,
-    args: [
-      L1_ADDRESS_MAP[chainId].l1ArbitrumInbox,
-      L1_ADDRESS_MAP[chainId].l1ERC20GatewayRouter,
-      l2RefundAddress,
-      USDC[chainId],
-      L1_ADDRESS_MAP[chainId].cctpTokenMessenger,
-      L1_ADDRESS_MAP[chainId].adapterStore,
-      oftDstEid,
-      oftFeeCap,
-    ],
+    gasLimit: 2000000,
+    args,
   });
   await hre.run("verify:verify", { address: instance.address, constructorArguments: args });
 };
diff --git a/deploy/005_deploy_arbitrum_spokepool.ts b/deploy/005_deploy_arbitrum_spokepool.ts
@@ -2,10 +2,10 @@ import { DeployFunction } from "hardhat-deploy/types";
 import { HardhatRuntimeEnvironment } from "hardhat/types";
 import { deployNewProxy, getSpokePoolDeploymentInfo } from "../utils/utils.hre";
 import { FILL_DEADLINE_BUFFER, L2_ADDRESS_MAP, QUOTE_TIME_BUFFER, USDC, WETH } from "./consts";
-import { getHyperlaneDomainId, getOftEid, toWei } from "../utils/utils";
+import { getOftEid, toWei } from "../utils/utils";
 
 const func: DeployFunction = async function (hre: HardhatRuntimeEnvironment) {
-  const { hubPool, spokeChainId } = await getSpokePoolDeploymentInfo(hre);
+  const { hubPool, hubChainId, spokeChainId } = await getSpokePoolDeploymentInfo(hre);
 
   const initArgs = [
     // Initialize deposit counter to very high number of deposits to avoid duplicate deposit ID's
diff --git a/deploy/063_deploy_adapter_store.ts b/deploy/063_deploy_adapter_store.ts
@@ -1,6 +1,5 @@
 import { DeployFunction } from "hardhat-deploy/types";
 import { HardhatRuntimeEnvironment } from "hardhat/types";
-import "hardhat-deploy";
 
 const func: DeployFunction = async function (hre: HardhatRuntimeEnvironment) {
   const { deployer } = await hre.getNamedAccounts();
diff --git a/deploy/consts.ts b/deploy/consts.ts
@@ -45,7 +45,7 @@ export const L1_ADDRESS_MAP: { [key: number]: { [contractName: string]: string }
     l1AlephZeroInbox: "0x56D8EC76a421063e1907503aDd3794c395256AEb",
     l1AlephZeroERC20GatewayRouter: "0xeBb17f398ed30d02F2e8733e7c1e5cf566e17812",
     donationBox: "0x0d57392895Db5aF3280e9223323e20F3951E81B1",
-    adapterStore: "", // to be deployed
+    adapterStore: "0x42df4D71f35ffBD28ae217d52E83C1DA0007D63b",
     hubPoolStore: "0x1Ace3BbD69b63063F859514Eca29C9BDd8310E61",
     zkBridgeHub: "0x303a465B659cBB0ab36eE643eA362c509EEb5213",
     zkUsdcSharedBridge_232: "0xf553E6D903AA43420ED7e3bc2313bE9286A8F987",
diff --git a/deployments/arbitrum/Arbitrum_SpokePool.json b/deployments/arbitrum/Arbitrum_SpokePool.json
diff --git a/deployments/arbitrum/solcInputs/7a57f2eb2810fd49e428417389237b12.json b/deployments/arbitrum/solcInputs/7a57f2eb2810fd49e428417389237b12.json
diff --git a/deployments/deployments.json b/deployments/deployments.json
@@ -2,7 +2,7 @@
   "1": {
     "AcrossConfigStore": { "address": "0x3B03509645713718B78951126E0A6de6f10043f5", "blockNumber": 14717196 },
     "AcrossMerkleDistributor": { "address": "0xE50b2cEAC4f60E840Ae513924033E753e2366487", "blockNumber": 15976846 },
-    "Arbitrum_Adapter": { "address": "0x5473CBD30bEd1Bf97C0c9d7c59d268CD620dA426", "blockNumber": 19915048 },
+    "Arbitrum_Adapter": { "address": "0x5eC9844936875E27eBF22172f4d92E107D35B57C", "blockNumber": 23086601 },
     "Arbitrum_RescueAdapter": { "address": "0xC6fA0a4EBd802c01157d6E7fB1bbd2ae196ae375", "blockNumber": 16233939 },
     "Arbitrum_SendTokensAdapter": { "address": "0xC06A68DF12376271817FcEBfb45Be996B0e1593E", "blockNumber": 16691987 },
     "Boba_Adapter": { "address": "0x33B0Ec794c15D6Cc705818E70d4CaCe7bCfB5Af3", "blockNumber": 14716798 },
diff --git a/deployments/mainnet/AdapterStore.json b/deployments/mainnet/AdapterStore.json
diff --git a/deployments/mainnet/Arbitrum_Adapter.json b/deployments/mainnet/Arbitrum_Adapter.json
diff --git a/deployments/mainnet/solcInputs/a4568173fdd07a4724f5e04f961d9865.json b/deployments/mainnet/solcInputs/a4568173fdd07a4724f5e04f961d9865.json
diff --git a/hardhat.config.ts b/hardhat.config.ts
@@ -21,6 +21,7 @@ const tasks = [
   "finalizeScrollClaims",
   "rescueStuckScrollTxn",
   "verifySpokePool",
+  "verifyBytecode",
   "evmRelayMessageWithdrawal",
   "testChainAdapter",
   "upgradeSpokePool",
diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@across-protocol/contracts",
-  "version": "4.1.1",
+  "version": "4.1.2",
   "author": "UMA Team",
   "license": "AGPL-3.0-only",
   "repository": {
diff --git a/tasks/verifyBytecode.ts b/tasks/verifyBytecode.ts
@@ -0,0 +1,100 @@
+import { task } from "hardhat/config";
+import type { HardhatRuntimeEnvironment } from "hardhat/types";
+import "hardhat-deploy";
+import "@nomiclabs/hardhat-ethers";
+
+/**
+ * Verify that the deployment init code (creation bytecode + encoded constructor args)
+ * matches the locally reconstructed init code from artifacts and recorded args.
+ *
+ * Compares keccak256(initCodeOnChain) vs keccak256(initCodeLocal).
+ *
+ * Sample usage:
+ *   yarn hardhat verify-bytecode --contract Arbitrum_Adapter --network mainnet
+ *   yarn hardhat verify-bytecode --contract Arbitrum_Adapter --tx-hash 0x... --network mainnet
+ *   yarn hardhat verify-bytecode --contract X --tx-hash 0x... --libraries "MyLib=0x...,OtherLib=0x..." --network mainnet
+ */
+task("verify-bytecode", "Verify deploy transaction input against local artifacts")
+  .addOptionalParam("contract", "Contract name; falls back to env CONTRACT")
+  // @dev For proxies, we don't save transactionHash in deployments/. You have to provide it manually via --tx-hash 0x... by checking e.g. block explorer first
+  .addOptionalParam("txHash", "Deployment transaction hash (defaults to deployments JSON)")
+  .addOptionalParam("libraries", "Libraries to link. JSON string or 'Name=0x..,Other=0x..'")
+  .setAction(
+    async (args: { contract?: string; txHash?: string; libraries?: string }, hre: HardhatRuntimeEnvironment) => {
+      const { deployments, ethers, artifacts, network } = hre;
+
+      // make sure we're using latest local contract artifacts for verification
+      await hre.run("compile");
+
+      const contractName = args.contract || process.env.CONTRACT;
+      if (!contractName) throw new Error("Please provide --contract or set CONTRACT env var");
+
+      const deployment = await deployments.get(contractName);
+      const deployedAddress: string = deployment.address;
+      const constructorArgs: any[] = deployment.args || [];
+
+      const parseLibraries = (s?: string): Record<string, string> => {
+        if (!s) return {};
+        const out: Record<string, string> = {};
+        const trimmed = s.trim();
+        if (trimmed.startsWith("{") && trimmed.endsWith("}")) {
+          const parsed = JSON.parse(trimmed);
+          for (const [k, v] of Object.entries(parsed)) out[k] = String(v);
+          return out;
+        }
+        for (const part of trimmed.split(/[\,\n]/)) {
+          const [k, v] = part.split("=").map((x) => x.trim());
+          if (k && v) out[k] = v;
+        }
+        return out;
+      };
+
+      // Read local compilation artifact
+      const artifact = await artifacts.readArtifact(contractName);
+      console.log("Reading compilation artifact for", artifact.sourceName);
+
+      /**
+       * TODO
+       * the `libraries` bit is untested. Could be wrong. Could remove this part if we don't have contracts with dynamic libraries
+       * artifact.linkReferences might help solve this better. Also, deployments.libraries. Implement only if required later.
+       */
+      const libraries: Record<string, string> = parseLibraries(args.libraries);
+      const factory = await ethers.getContractFactoryFromArtifact(
+        artifact,
+        Object.keys(libraries).length ? { libraries } : {}
+      );
+
+      // Note: `factory.getDeployTransaction` populates the transaction with whatever data we WOULD put in it if we were deploying it right now
+      const populatedDeployTransaction = factory.getDeployTransaction(...constructorArgs);
+      const expectedInit: string = ethers.utils.hexlify(populatedDeployTransaction.data!).toLowerCase();
+      if (!expectedInit || expectedInit === "0x") {
+        throw new Error("Failed to reconstruct deployment init code from local artifacts");
+      }
+
+      // Get on-chain creation input
+      const txHash = args.txHash ?? deployment.transactionHash;
+      if (!txHash) {
+        throw new Error("Could not find deployment tx hash. Pass --tx-hash when running script.");
+      }
+      const tx = await ethers.provider.getTransaction(txHash);
+      if (!tx) throw new Error(`Transaction not found for hash ${txHash}`);
+      if (tx.to && tx.to != "") {
+        throw new Error(`Transaction ${txHash} is not a direct contract creation (tx.to=${tx.to})`);
+      }
+
+      const expectedHash = ethers.utils.keccak256(expectedInit);
+      const onchainHash = ethers.utils.keccak256(tx.data.toLowerCase());
+
+      console.log("\n=============== Deploy Tx Verification ===============");
+      console.log(`Contract            : ${contractName}`);
+      console.log(`Network             : ${network.name}`);
+      console.log(`Deployed address    : ${deployedAddress}`);
+      if (txHash) console.log(`Tx hash             : ${txHash}`);
+      console.log("-------------------------------------------------------");
+      console.log(`On-chain init hash  : ${onchainHash}`);
+      console.log(`Local init hash     : ${expectedHash}`);
+      console.log("-------------------------------------------------------");
+      console.log(onchainHash === expectedHash ? "✅  MATCH" : "❌  MISMATCH – init code differs");
+      console.log("=======================================================\n");
+    }
+  );
diff --git a/utils/utils.hre.ts b/utils/utils.hre.ts
@@ -82,6 +82,7 @@ export async function deployNewProxy(
   const artifact = await deployments.getExtendedArtifact(name);
   const deployment: DeploymentSubmission = {
     address: instance,
+    args: constructorArgs,
     ...artifact,
   };
   await deployments.save(name, deployment);

-Original file line number
+Diff line change
 # IDE
 .idea
 +.vscode
 # Anchor files
 .anchor