remove tx.origin checks (#269)

Co-authored-by: Quazia <alf40k@gmail.com>
rabbitholegg · Mar 21, 2024 · ad14258 · ad14258
1 parent 4752eb9
commit ad14258
Show file tree

Hide file tree

Showing 26 changed files with 1,950 additions and 204 deletions.
diff --git a/QuestFactory.json b/QuestFactory.json
diff --git a/broadcast/QuestFactory.s.sol/10/run-1710947288.json b/broadcast/QuestFactory.s.sol/10/run-1710947288.json
diff --git a/broadcast/QuestFactory.s.sol/10/run-1710947294.json b/broadcast/QuestFactory.s.sol/10/run-1710947294.json
diff --git a/broadcast/QuestFactory.s.sol/10/run-1710947301.json b/broadcast/QuestFactory.s.sol/10/run-1710947301.json
diff --git a/broadcast/QuestFactory.s.sol/10/run-latest.json b/broadcast/QuestFactory.s.sol/10/run-latest.json
diff --git a/broadcast/QuestFactory.s.sol/11155111/run-1710885308.json b/broadcast/QuestFactory.s.sol/11155111/run-1710885308.json
diff --git a/broadcast/QuestFactory.s.sol/11155111/run-1710885327.json b/broadcast/QuestFactory.s.sol/11155111/run-1710885327.json
diff --git a/broadcast/QuestFactory.s.sol/11155111/run-1710885333.json b/broadcast/QuestFactory.s.sol/11155111/run-1710885333.json
diff --git a/broadcast/QuestFactory.s.sol/11155111/run-1710894539.json b/broadcast/QuestFactory.s.sol/11155111/run-1710894539.json
diff --git a/broadcast/QuestFactory.s.sol/11155111/run-1710894558.json b/broadcast/QuestFactory.s.sol/11155111/run-1710894558.json
diff --git a/broadcast/QuestFactory.s.sol/11155111/run-1710894582.json b/broadcast/QuestFactory.s.sol/11155111/run-1710894582.json
diff --git a/broadcast/QuestFactory.s.sol/11155111/run-latest.json b/broadcast/QuestFactory.s.sol/11155111/run-latest.json
diff --git a/broadcast/QuestFactory.s.sol/137/run-1710947457.json b/broadcast/QuestFactory.s.sol/137/run-1710947457.json
diff --git a/broadcast/QuestFactory.s.sol/137/run-1710947500.json b/broadcast/QuestFactory.s.sol/137/run-1710947500.json
diff --git a/broadcast/QuestFactory.s.sol/137/run-1710947506.json b/broadcast/QuestFactory.s.sol/137/run-1710947506.json
diff --git a/broadcast/QuestFactory.s.sol/137/run-latest.json b/broadcast/QuestFactory.s.sol/137/run-latest.json
diff --git a/broadcast/QuestFactory.s.sol/42161/run-1710947385.json b/broadcast/QuestFactory.s.sol/42161/run-1710947385.json
diff --git a/broadcast/QuestFactory.s.sol/42161/run-1710947391.json b/broadcast/QuestFactory.s.sol/42161/run-1710947391.json
diff --git a/broadcast/QuestFactory.s.sol/42161/run-latest.json b/broadcast/QuestFactory.s.sol/42161/run-latest.json
diff --git a/broadcast/QuestFactory.s.sol/8453/run-1710947673.json b/broadcast/QuestFactory.s.sol/8453/run-1710947673.json
diff --git a/broadcast/QuestFactory.s.sol/8453/run-1710947762.json b/broadcast/QuestFactory.s.sol/8453/run-1710947762.json
diff --git a/broadcast/QuestFactory.s.sol/8453/run-1710947768.json b/broadcast/QuestFactory.s.sol/8453/run-1710947768.json
diff --git a/broadcast/QuestFactory.s.sol/8453/run-latest.json b/broadcast/QuestFactory.s.sol/8453/run-latest.json
diff --git a/contracts/QuestFactory.sol b/contracts/QuestFactory.sol
@@ -328,6 +328,17 @@ contract QuestFactory is Initializable, LegacyStorage, OwnableRoles, IQuestFacto
     /// @dev Claim rewards for a quest
     /// @param compressedData_ The claim data in abi encoded bytes, compressed with cdCompress from solady LibZip
     function claimCompressed(bytes calldata compressedData_) external payable {
+        _claimCompressed(compressedData_, msg.sender);
+    }
+
+    function claimCompressedRef(bytes calldata compressedData_, address claimer) external payable {
+        _claimCompressed(compressedData_, claimer);
+    }
+
+    /// @dev Claim rewards for a quest
+    /// @param compressedData_ The claim data in abi encoded bytes, compressed with cdCompress from solady LibZip
+    /// @param claimer The address of the claimer - where rewards are sent
+    function _claimCompressed(bytes calldata compressedData_, address claimer) internal {
         bytes memory data_ = LibZip.cdDecompress(compressedData_);
 
         (
@@ -345,10 +356,8 @@ contract QuestFactory is Initializable, LegacyStorage, OwnableRoles, IQuestFacto
         string memory questIdString_ = bytes16ToUUID(questid_);
         Quest storage quest_ = quests[questIdString_];
 
-        if(tx.origin != msg.sender) revert txOriginMismatch();
-
         string memory jsonData_ = _buildJsonString(txHash_, txHashChainId_, quest_.actionType);
-        bytes memory claimData_ = abi.encode(msg.sender, ref_, questIdString_, jsonData_);
+        bytes memory claimData_ = abi.encode(claimer, ref_, questIdString_, jsonData_);
 
         // Since `vs_` includes `s` and the bit for `v`, we can extract `s` by masking out the `v` bit.
         bytes32 s = vs_ & bytes32(0x7FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF);
@@ -389,8 +398,6 @@ contract QuestFactory is Initializable, LegacyStorage, OwnableRoles, IQuestFacto
         );
         Quest storage quest = quests[questId_];
 
-        if(tx.origin != msg.sender && msg.sender != quest.questAddress && msg.sender != address(this)) revert txOriginMismatch();
-
         uint256 numberMintedPlusOne_ = quest.numberMinted + 1;
         address rewardToken_ = IQuestOwnable(quest.questAddress).rewardToken();
         uint256 rewardAmountOrTokenId;

diff --git a/contracts/libraries/QuestClaimable.sol b/contracts/libraries/QuestClaimable.sol
@@ -11,8 +11,6 @@ abstract contract QuestClaimable {
     function getQuestId() public view virtual returns (string memory);
 
     function claim() external payable {
-        if(tx.origin != msg.sender) revert txOriginMismatch();
-
         address ref_;
         IQuestFactory questFactoryContract = getQuestFactoryContract();
         string memory questId = getQuestId();

diff --git a/test/QuestFactory.t.sol b/test/QuestFactory.t.sol
@@ -268,7 +268,6 @@ contract TestQuestFactory is Test, Errors, Events, TestUtils {
     }
 
     function test_claimCompressed_erc20_mocked_data() public{
-
         bytes memory signData = abi.encode(participant, referrer, QUEST.QUEST_ID_STRING, QUEST.JSON_MSG);
         bytes32 msgHash = keccak256(signData);
         bytes32 digest = ECDSA.toEthSignedMessageHash(msgHash);
@@ -305,9 +304,9 @@ contract TestQuestFactory is Test, Errors, Events, TestUtils {
         assertEq(sampleERC20.balanceOf(participant), QUEST.REWARD_AMOUNT, "particpiant erc20 balance");
     }
 
-    function test_claimCompressed_revert_txOriginMismatch() public{
-
-        bytes memory signData = abi.encode(participant, referrer, "88e08cb1-95e6-4832-845f-a92ec8f2034a", QUEST.JSON_MSG);
+    function test_claimCompressedRef_erc20_mocked_data() public{
+        bytes memory signData = abi.encode(participant, referrer, QUEST.QUEST_ID_STRING, QUEST.JSON_MSG);
+
         bytes32 msgHash = keccak256(signData);
         bytes32 digest = ECDSA.toEthSignedMessageHash(msgHash);
         (, bytes32 r, bytes32 vs) = TestUtils.getSplitSignature(claimSignerPrivateKey, digest);
@@ -325,8 +324,8 @@ contract TestQuestFactory is Test, Errors, Events, TestUtils {
             QUEST.START_TIME,
             QUEST.TOTAL_PARTICIPANTS,
             QUEST.REWARD_AMOUNT,
-            QUEST.QUEST_ID_STRING,
-            QUEST.ACTION_TYPE,
+            QUEST.QUEST_ID_STRING, 
+            QUEST.ACTION_TYPE, 
             QUEST.QUEST_NAME,
             QUEST.PROJECT_NAME
         );
@@ -336,9 +335,11 @@ contract TestQuestFactory is Test, Errors, Events, TestUtils {
         bytes memory data = abi.encode(QUEST.TX_HASH, r, vs, referrer, QUEST.QUEST_ID, QUEST.CHAIN_ID);
         bytes memory dataCompressed = LibZip.cdCompress(data);
 
-        vm.expectRevert(abi.encodeWithSelector(txOriginMismatch.selector));
-        vm.startPrank(participant);
-        questFactory.claimCompressed{value: MINT_FEE}(dataCompressed);
+        vm.startPrank(anyone, anyone);
+        questFactory.claimCompressedRef{value: MINT_FEE}(dataCompressed, participant);
+
+        // erc20 reward
+        assertEq(sampleERC20.balanceOf(participant), QUEST.REWARD_AMOUNT, "particpiant erc20 balance");
     }
 
 
@@ -362,8 +363,6 @@ contract TestQuestFactory is Test, Errors, Events, TestUtils {
         );
 
         vm.warp(QUEST.START_TIME + 1);
-
-
 
         bytes memory signData = abi.encode(participant, referrer, QUEST.QUEST_ID_STRING, QUEST.JSON_MSG);
         bytes32 msgHash = keccak256(signData);