Skip to content

Commit 43516c6

Browse files
drewstonedrewstone
committed
Remediate vulnerable JavaScript dependencies
1 parent 23f9d72 commit 43516c6

14 files changed

Lines changed: 3509 additions & 9546 deletions

File tree

‎package.json‎

Lines changed: 16 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -41,23 +41,19 @@
4141
"@nomicfoundation/hardhat-chai-matchers": "^1.0.6",
4242
"@nomicfoundation/hardhat-network-helpers": "^1.0.8",
4343
"@nomiclabs/hardhat-ethers": "^2.2.3",
44-
"@nomiclabs/hardhat-truffle5": "^2.0.7",
45-
"@nomiclabs/hardhat-web3": "^2.0.0",
4644
"@openzeppelin/contracts": "^4.8.3",
4745
"@typechain/ethers-v5": "^10.2.0",
4846
"@typechain/hardhat": "^6.1.5",
4947
"@types/chai": "^4.3.4",
5048
"@types/mocha": "^10.0.1",
51-
"@webb-tools/test-utils": "0.1.4-126",
5249
"chai": "^4.3.7",
5350
"circomlibjs": "^0.0.8",
5451
"copyfiles": "^2.4.1",
5552
"dotenv": "^16.0.3",
56-
"elliptic": "^6.5.4",
57-
"ethers": "^5.7.0",
53+
"ethers": "^5.8.0",
5854
"hardhat": "^2.14.0",
5955
"hardhat-artifactor": "^0.2.0",
60-
"hardhat-gas-reporter": "^1.0.9",
56+
"hardhat-gas-reporter": "^2.3.0",
6157
"hardhat-preprocessor": "^0.1.5",
6258
"itertools": "^2.1.1",
6359
"lerna": "^6.6.1",
@@ -75,5 +71,19 @@
7571
"dependencies": {
7672
"circomlib": "^2.0.5",
7773
"typescript": "^5.0.4"
74+
},
75+
"resolutions": {
76+
"@ethersproject/signing-key": "5.8.0",
77+
"@tootallnate/once": "3.0.1",
78+
"cookie": "1.1.1",
79+
"es5-ext": "0.10.64",
80+
"handlebars": "4.7.9",
81+
"ip": "2.0.1",
82+
"on-headers": "1.1.0",
83+
"qs": "6.15.1",
84+
"secp256k1": "4.0.4",
85+
"tmp": "0.2.5",
86+
"undici": "5.29.0",
87+
"webpack": "5.106.2"
7888
}
7989
}

‎packages/anchors/package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@
1717
"@webb-tools/tokens": "^1.1.1",
1818
"@webb-tools/utils": "^1.1.1",
1919
"circomlibjs": "^0.0.8",
20-
"ethers": "5.7.0",
20+
"ethers": "5.8.0",
2121
"jssha": "^3.2.0",
2222
"snarkjs": "^0.7.2"
2323
},

‎packages/contracts/hardhat.config.ts‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,6 @@ import 'hardhat-gas-reporter';
55
import '@typechain/hardhat';
66

77
import '@nomiclabs/hardhat-ethers';
8-
import '@nomiclabs/hardhat-truffle5';
98
// import '@primitivefi/hardhat-dodoc';
109
import { subtask } from 'hardhat/config';
1110

‎packages/contracts/package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@
2929
"dependencies": {
3030
"@ethersproject/abi": "^5.7.0",
3131
"@ethersproject/providers": "^5.7.2",
32-
"ethers": "^5.7.0",
32+
"ethers": "^5.8.0",
3333
"typescript": "^5.0.4"
3434
}
3535
}

‎packages/contracts/test/governance/governable.test.ts‎

Lines changed: 12 additions & 57 deletions
Original file line numberDiff line numberDiff line change
@@ -5,22 +5,19 @@
55
// @ts-nocheck
66
const assert = require('assert');
77
import { ethers, network } from 'hardhat';
8-
import BN from 'bn.js';
98
import { toFixedHex, toHex } from '@webb-tools/utils';
10-
import EC from 'elliptic';
11-
const ec = new EC.ec('secp256k1');
129
const TruffleAssert = require('truffle-assertions');
1310

1411
import { Governable, Governable__factory } from '@webb-tools/contracts';
15-
import { ethers } from 'ethers';
12+
import type { Signer } from 'ethers';
1613
import { ZERO_BYTES32 } from '@webb-tools/utils';
1714
import { keccak256, recoverAddress, solidityPack } from 'ethers/lib/utils';
1815

1916
describe('Governable Contract', () => {
2017
let governableInstance: Governable;
21-
let sender: ethers.Signer;
22-
let nextGovernor: ethers.Signer;
23-
let arbSigner: ethers.Signer;
18+
let sender: Signer;
19+
let nextGovernor: Signer;
20+
let arbSigner: Signer;
2421

2522
beforeEach(async () => {
2623
const signers = await ethers.getSigners();
@@ -60,8 +57,7 @@ describe('Governable Contract', () => {
6057

6158
it('should check ownership is transferred to new governor via signed public key', async () => {
6259
const wallet = ethers.Wallet.createRandom();
63-
const key = ec.keyFromPrivate(wallet.privateKey.slice(2), 'hex');
64-
const pubkey = key.getPublic().encode('hex').slice(2);
60+
const pubkey = ethers.utils.computePublicKey(wallet.privateKey, false).slice(4);
6561

6662
const publicKey = '0x' + pubkey;
6763
let nextGovernorAddress = ethers.utils.getAddress(
@@ -71,11 +67,7 @@ describe('Governable Contract', () => {
7167
await governableInstance.transferOwnership(nextGovernorAddress, 1);
7268

7369
const dummy = ethers.Wallet.createRandom();
74-
const dummyPubkey = ec
75-
.keyFromPrivate(dummy.privateKey, 'hex')
76-
.getPublic()
77-
.encode('hex')
78-
.slice(2);
70+
const dummyPubkey = ethers.utils.computePublicKey(dummy.privateKey, false).slice(4);
7971

8072
nextGovernorAddress = ethers.utils.getAddress(
8173
'0x' + ethers.utils.keccak256('0x' + dummyPubkey).slice(-40)
@@ -100,24 +92,8 @@ describe('Governable Contract', () => {
10092
]
10193
);
10294

103-
let msg = ethers.utils.arrayify(ethers.utils.keccak256(prehashed));
104-
let signature = key.sign(msg);
105-
let expandedSig = {
106-
r: '0x' + signature.r.toString('hex'),
107-
s: '0x' + signature.s.toString('hex'),
108-
v: signature.recoveryParam + 27,
109-
};
110-
111-
// Transaction malleability fix if s is too large (Bitcoin allows it, Ethereum rejects it)
112-
// https://ethereum.stackexchange.com/questions/55245/why-is-s-in-transaction-signature-limited-to-n-21
113-
let sig;
114-
try {
115-
sig = ethers.utils.joinSignature(expandedSig);
116-
} catch (e) {
117-
expandedSig.s = '0x' + new BN(ec.curve.n).sub(signature.s).toString('hex');
118-
expandedSig.v = expandedSig.v === 27 ? 28 : 27;
119-
sig = ethers.utils.joinSignature(expandedSig);
120-
}
95+
const digest = ethers.utils.keccak256(prehashed);
96+
const sig = ethers.utils.joinSignature(wallet._signingKey().signDigest(digest));
12197

12298
const tx = await governableInstance.transferOwnershipWithSignature(
12399
refreshProposal.voterMerkleRoot,
@@ -158,8 +134,7 @@ describe('Governable Contract', () => {
158134

159135
assert.strictEqual((await governableInstance.refreshNonce()).toString(), '0');
160136
const wallet = ethers.Wallet.createRandom();
161-
const key = ec.keyFromPrivate(wallet.privateKey.slice(2), 'hex');
162-
const pubkey = key.getPublic().encode('hex').slice(2);
137+
const pubkey = ethers.utils.computePublicKey(wallet.privateKey, false).slice(4);
163138
const publicKey = '0x' + pubkey;
164139
let nextGovernorAddress = ethers.utils.getAddress(
165140
'0x' + ethers.utils.keccak256(publicKey).slice(-40)
@@ -168,11 +143,7 @@ describe('Governable Contract', () => {
168143
await governableInstance.transferOwnership(nextGovernorAddress, 1);
169144

170145
const dummy = ethers.Wallet.createRandom();
171-
const dummyPubkey = ec
172-
.keyFromPrivate(dummy.privateKey, 'hex')
173-
.getPublic()
174-
.encode('hex')
175-
.slice(2);
146+
const dummyPubkey = ethers.utils.computePublicKey(dummy.privateKey, false).slice(4);
176147

177148
const nonce = 2;
178149

@@ -222,24 +193,8 @@ describe('Governable Contract', () => {
222193
]
223194
);
224195

225-
let msg = ethers.utils.arrayify(ethers.utils.keccak256(prehashed));
226-
let signature = key.sign(msg);
227-
let expandedSig = {
228-
r: '0x' + signature.r.toString('hex'),
229-
s: '0x' + signature.s.toString('hex'),
230-
v: signature.recoveryParam + 27,
231-
};
232-
233-
// Transaction malleability fix if s is too large (Bitcoin allows it, Ethereum rejects it)
234-
// https://ethereum.stackexchange.com/questions/55245/why-is-s-in-transaction-signature-limited-to-n-21
235-
let sig: any;
236-
try {
237-
sig = ethers.utils.joinSignature(expandedSig);
238-
} catch (e) {
239-
expandedSig.s = '0x' + new BN(ec.curve.n).sub(signature.s).toString('hex');
240-
expandedSig.v = expandedSig.v === 27 ? 28 : 27;
241-
sig = ethers.utils.joinSignature(expandedSig);
242-
}
196+
const digest = ethers.utils.keccak256(prehashed);
197+
const sig = ethers.utils.joinSignature(wallet._signingKey().signDigest(digest));
243198

244199
const tx = await governableInstance.transferOwnershipWithSignature(
245200
refreshProposal.voterMerkleRoot,

‎packages/contracts/test/trees/MerkleTreePoseidon.test.ts‎

Lines changed: 28 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -5,30 +5,25 @@
55

66
import { MerkleTree, toFixedHex } from '@webb-tools/utils';
77
import { BigNumber } from 'ethers';
8-
import { artifacts, contract, ethers } from 'hardhat';
8+
import { ethers } from 'hardhat';
99
import { poseidon } from 'circomlibjs';
1010
import { PoseidonHasher } from '@webb-tools/anchors';
11-
const TruffleAssert = require('truffle-assertions');
1211
const assert = require('assert');
1312

14-
const MerkleTreeWithHistory = artifacts.require('MerkleTreeMock');
15-
16-
contract('MerkleTree w/ Poseidon hasher', (accounts) => {
13+
describe('MerkleTree w/ Poseidon hasher', () => {
1714
let merkleTreeWithHistory;
1815
let hasherInstance: PoseidonHasher;
1916
let levels = 30;
20-
const sender = accounts[0];
2117
let tree: MerkleTree;
2218

2319
beforeEach(async () => {
2420
const signers = await ethers.getSigners();
2521
const wallet = signers[0];
2622
hasherInstance = await PoseidonHasher.createPoseidonHasher(wallet);
2723
tree = new MerkleTree(levels);
28-
merkleTreeWithHistory = await MerkleTreeWithHistory.new(
29-
levels,
30-
hasherInstance.contract.address
31-
);
24+
const MerkleTreeWithHistory = await ethers.getContractFactory('MerkleTreeMock', wallet);
25+
merkleTreeWithHistory = await MerkleTreeWithHistory.deploy(levels, hasherInstance.contract.address);
26+
await merkleTreeWithHistory.deployed();
3227
});
3328

3429
describe('#constructor', () => {
@@ -67,7 +62,7 @@ contract('MerkleTree w/ Poseidon hasher', (accounts) => {
6762
let rootFromContract;
6863

6964
for (let i = 1; i < 11; i++) {
70-
await merkleTreeWithHistory.insert(toFixedHex(i), { from: sender });
65+
await merkleTreeWithHistory.insert(toFixedHex(i));
7166
await tree.insert(i);
7267
let { merkleRoot } = await tree.path(i - 1);
7368
rootFromContract = await merkleTreeWithHistory.getLastRoot();
@@ -77,21 +72,23 @@ contract('MerkleTree w/ Poseidon hasher', (accounts) => {
7772

7873
it('should reject if tree is full', async () => {
7974
const levels = 6;
80-
const merkleTreeWithHistory = await MerkleTreeWithHistory.new(
75+
const MerkleTreeWithHistory = await ethers.getContractFactory('MerkleTreeMock');
76+
const merkleTreeWithHistory = await MerkleTreeWithHistory.deploy(
8177
levels,
8278
hasherInstance.contract.address
8379
);
80+
await merkleTreeWithHistory.deployed();
8481

8582
for (let i = 0; i < 2 ** levels; i++) {
86-
TruffleAssert.passes(await merkleTreeWithHistory.insert(toFixedHex(i + 42)));
83+
await merkleTreeWithHistory.insert(toFixedHex(i + 42));
8784
}
8885

89-
await TruffleAssert.reverts(
86+
await assertRejects(
9087
merkleTreeWithHistory.insert(toFixedHex(1337)),
9188
'Merkle tree is full. No more leaves can be added'
9289
);
9390

94-
await TruffleAssert.reverts(
91+
await assertRejects(
9592
merkleTreeWithHistory.insert(toFixedHex(1)),
9693
'Merkle tree is full. No more leaves can be added'
9794
);
@@ -103,36 +100,38 @@ contract('MerkleTree w/ Poseidon hasher', (accounts) => {
103100
let path;
104101

105102
for (let i = 1; i < 5; i++) {
106-
TruffleAssert.passes(await merkleTreeWithHistory.insert(toFixedHex(i), { from: sender }));
103+
await merkleTreeWithHistory.insert(toFixedHex(i));
107104
await tree.insert(i);
108105
path = await tree.path(i - 1);
109106
let isKnown = await merkleTreeWithHistory.isKnownRoot(toFixedHex(path.merkleRoot));
110107
assert(isKnown);
111108
}
112109

113-
TruffleAssert.passes(await merkleTreeWithHistory.insert(toFixedHex(42), { from: sender }));
110+
await merkleTreeWithHistory.insert(toFixedHex(42));
114111
// check outdated root
115112
let isKnown = await merkleTreeWithHistory.isKnownRoot(toFixedHex(path.merkleRoot));
116113
assert(isKnown);
117114
});
118115

119116
it('should not return uninitialized roots', async () => {
120-
TruffleAssert.passes(await merkleTreeWithHistory.insert(toFixedHex(42), { from: sender }));
117+
await merkleTreeWithHistory.insert(toFixedHex(42));
121118
let isKnown = await merkleTreeWithHistory.isKnownRoot(toFixedHex(0));
122119
assert(!isKnown);
123120
});
124121
});
125122

126123
describe('#insertions using deposit commitments', async () => {
127124
it('should rebuild root correctly between native and contract', async () => {
128-
const merkleTreeWithHistory = await MerkleTreeWithHistory.new(
125+
const MerkleTreeWithHistory = await ethers.getContractFactory('MerkleTreeMock');
126+
const merkleTreeWithHistory = await MerkleTreeWithHistory.deploy(
129127
levels,
130128
hasherInstance.contract.address
131129
);
130+
await merkleTreeWithHistory.deployed();
132131
const commitment = '0x0101010101010101010101010101010101010101010101010101010101010101';
133132
await tree.insert(commitment);
134133
const { merkleRoot, pathElements, pathIndices } = await tree.path(0);
135-
await merkleTreeWithHistory.insert(toFixedHex(commitment), { from: sender });
134+
await merkleTreeWithHistory.insert(toFixedHex(commitment));
136135
const rootFromContract = await merkleTreeWithHistory.getLastRoot();
137136
assert.strictEqual(
138137
merkleRoot.toString(),
@@ -156,3 +155,12 @@ contract('MerkleTree w/ Poseidon hasher', (accounts) => {
156155
});
157156
});
158157
});
158+
159+
async function assertRejects(promise: Promise<unknown>, message: string) {
160+
try {
161+
await promise;
162+
assert.fail('Expected promise to reject');
163+
} catch (error: any) {
164+
assert(error.message.includes(message), `Expected "${error.message}" to include "${message}"`);
165+
}
166+
}

‎packages/create2-utils/package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
},
1212
"dependencies": {
1313
"@webb-tools/contracts": "^1.1.1",
14-
"ethers": "5.7.0"
14+
"ethers": "5.8.0"
1515
},
1616
"publishConfig": {
1717
"access": "public"

‎packages/evm-test-utils/package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@
1414
"@webb-tools/utils": "^1.1.1",
1515
"@webb-tools/vbridge": "^1.1.1",
1616
"ecpair": "^2.0.1",
17-
"ethers": "5.7.0",
17+
"ethers": "5.8.0",
1818
"ganache": "7.5.0",
1919
"tiny-secp256k1": "^2.2.1"
2020
},

‎packages/tokens/package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
"@webb-tools/contracts": "^1.1.1",
1313
"@webb-tools/create2-utils": "^1.1.1",
1414
"@webb-tools/utils": "^1.1.1",
15-
"ethers": "5.7.0"
15+
"ethers": "5.8.0"
1616
},
1717
"publishConfig": {
1818
"access": "public"

‎packages/utils/package.json‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,9 +12,9 @@
1212
},
1313
"dependencies": {
1414
"@metamask/eth-sig-util": "^6.0.0",
15+
"big-integer": "^1.6.52",
1516
"circomlibjs": "^0.0.8",
16-
"elliptic": "6.5.4",
17-
"ethers": "5.7.0",
17+
"ethers": "5.8.0",
1818
"snarkjs": "^0.7.2"
1919
},
2020
"publishConfig": {
@@ -28,7 +28,7 @@
2828
"version": "1.1.1",
2929
"gitHead": "e1f3b300b6e004ac5a346dc0458bb1d303969d97",
3030
"devDependencies": {
31-
"@webb-tools/sdk-core": "0.1.4-126",
31+
"@webb-tools/sdk-core": "0.1.8",
3232
"chai": "^4.3.7"
3333
},
3434
"exports": {

0 commit comments

Comments
 (0)