Merge pull request #75 from helix-bridge/xiaoch05-audit-repair

audit repair

helix-contract/contracts/ln/lnv3/HelixLnBridgeV3.sol

@@ -15,8 +15,6 @@ contract HelixLnBridgeV3 is Initializable, LnBridgeSourceV3, LnBridgeTargetV3 {
     // remoteChainId => messager
     mapping(uint256=>MessagerService) public messagers;
 
-    receive() external payable {}
-
     function initialize(address _dao, bytes calldata) public virtual initializer {
         _initialize(_dao);
     }

helix-contract/contracts/ln/lnv3/HelixLnBridgeV3ForBlast.sol

@@ -9,13 +9,13 @@ import "../../interfaces/IBlastPoints.sol";
 contract HelixLnBridgeV3ForBlast is HelixLnBridgeV3 {
     function initialize(address _dao, bytes calldata _data) public override initializer {
         _initialize(_dao);
-        (address _blast, address _blastPoints) = abi.decode(_data, (address, address));
+        (address _blast, address _blastPoints, address _pointReceiver) = abi.decode(_data, (address, address, address));
         IBlast blast = IBlast(_blast);
         blast.configureClaimableGas();
         blast.configureClaimableYield();
         blast.configureGovernor(_dao);
         IBlastPoints blastPoints = IBlastPoints(_blastPoints);
-        blastPoints.configurePointsOperator(_dao);
+        blastPoints.configurePointsOperator(_pointReceiver);
     }
 }
 

helix-contract/contracts/ln/lnv3/base/LnBridgeSourceV3.sol

@@ -96,7 +96,7 @@ contract LnBridgeSourceV3 is Pausable, AccessController {
         uint112 penalty,
         uint32 index
     );
-    event TokenInfoUpdated(bytes32 tokenInfoKey, uint112 protocolFee, uint112 penalty, uint112 sourceDecimals, uint112 targetDecimals);
+    event TokenInfoUpdated(bytes32 tokenInfoKey, uint112 protocolFee, uint112 penalty, uint8 sourceDecimals, uint8 targetDecimals);
     event FeeIncomeClaimed(bytes32 tokenInfoKey, uint256 amount, address receiver);
     event TokenLocked(
         TransferParams params,
@@ -113,7 +113,7 @@ contract LnBridgeSourceV3 is Pausable, AccessController {
         uint16 liquidityfeeRate,
         uint112 transferLimit
     );
-    event PenaltyReserveUpdated(address provider, address sourceToken, uint256 updatedPanaltyReserve);
+    event PenaltyReserveUpdated(address provider, address sourceToken, uint256 updatedPenaltyReserve);
     event LiquidityWithdrawn(bytes32[] transferIds, address provider, uint256 amount);
     event TransferSlashed(bytes32 transferId, address provider, address slasher, uint112 slashAmount);
     event LnProviderPaused(address provider, uint256 remoteChainId, address sourceToken, address targetToken, bool paused);
@@ -147,6 +147,7 @@ contract LnBridgeSourceV3 is Pausable, AccessController {
         uint32 _index
     ) onlyDao external {
         require(_index > 0, "invalid index");
+        require(_penalty > 0, "penalty can't be zero");
         bytes32 key = getTokenKey(_remoteChainId, _sourceToken, _targetToken);
         TokenInfo memory oldInfo = tokenInfos[key];
         require(oldInfo.index == 0, "token info exist");
@@ -180,6 +181,7 @@ contract LnBridgeSourceV3 is Pausable, AccessController {
         uint8 _sourceDecimals,
         uint8 _targetDecimals
     ) onlyDao external {
+        require(_penalty > 0, "penalty can't be zero");
         bytes32 key = getTokenKey(_remoteChainId, _sourceToken, _targetToken);
         TokenInfo memory tokenInfo = tokenInfos[key];
         require(tokenInfo.index > 0, "token not registered");
@@ -192,25 +194,15 @@ contract LnBridgeSourceV3 is Pausable, AccessController {
         emit TokenInfoUpdated(key, _protocolFee, _penalty, _sourceDecimals, _targetDecimals);
     }
 
-    // delete a token pair by Helix Dao
-    // This interface should be called with exceptional caution, only when correcting registration errors, to conserve index resources.
-    // Attention! DON'T delete a used token pair
-    function deleteTokenInfo(bytes32 key) onlyDao external {
-        TokenInfo memory tokenInfo = tokenInfos[key];
-        require(tokenInfo.index > 0, "token not registered");
-        require(tokenIndexer[tokenInfo.index] == key, "indexer exception");
-        delete tokenInfos[key];
-        delete tokenIndexer[tokenInfo.index];
-    }
-
     // claim the protocol fee
     function claimProtocolFeeIncome(
         bytes32 _tokenInfoKey,
         uint256 _amount,
         address _receiver
     ) onlyDao external {
         TokenInfo memory tokenInfo = tokenInfos[_tokenInfoKey];
-        require(tokenInfo.protocolFeeIncome > _amount, "not enough income");
+        require(tokenInfo.protocolFeeIncome >= _amount, "not enough income");
+        require(_receiver != address(0), "invalid receiver address");
         tokenInfos[_tokenInfoKey].protocolFeeIncome = tokenInfo.protocolFeeIncome - _amount;
 
         if (tokenInfo.sourceToken == address(0)) {
@@ -252,9 +244,10 @@ contract LnBridgeSourceV3 is Pausable, AccessController {
         address _sourceToken,
         uint256 _amount
     ) external payable {
+        require(_amount > 0, "invalid amount");
         bytes32 key = getProviderStateKey(_sourceToken, msg.sender);
-        uint256 updatedPanaltyReserve = penaltyReserves[key] + _amount;
-        penaltyReserves[key] = updatedPanaltyReserve;
+        uint256 updatedPenaltyReserve = penaltyReserves[key] + _amount;
+        penaltyReserves[key] = updatedPenaltyReserve;
 
         if (_sourceToken == address(0)) {
             require(msg.value == _amount, "invalid penaltyReserve value");
@@ -267,23 +260,24 @@ contract LnBridgeSourceV3 is Pausable, AccessController {
                 _amount
             );
         }
-        emit PenaltyReserveUpdated(msg.sender, _sourceToken, updatedPanaltyReserve);
+        emit PenaltyReserveUpdated(msg.sender, _sourceToken, updatedPenaltyReserve);
     }
 
     function withdrawPenaltyReserve(
         address _sourceToken,
         uint256 _amount
     ) external {
+        require(_amount > 0, "invalid amount");
         bytes32 key = getProviderStateKey(_sourceToken, msg.sender);
-        uint256 updatedPanaltyReserve = penaltyReserves[key] - _amount;
-        penaltyReserves[key] = updatedPanaltyReserve;
+        uint256 updatedPenaltyReserve = penaltyReserves[key] - _amount;
+        penaltyReserves[key] = updatedPenaltyReserve;
 
         if (_sourceToken == address(0)) {
             TokenTransferHelper.safeTransferNative(msg.sender, _amount);
         } else {
             TokenTransferHelper.safeTransfer(_sourceToken, msg.sender, _amount);
         }
-        emit PenaltyReserveUpdated(msg.sender, _sourceToken, updatedPanaltyReserve);
+        emit PenaltyReserveUpdated(msg.sender, _sourceToken, updatedPenaltyReserve);
     }
 
     function providerPause(

helix-contract/contracts/ln/lnv3/base/LnBridgeTargetV3.sol

@@ -13,11 +13,6 @@ contract LnBridgeTargetV3 {
         address provider;
     }
 
-    // lockTimestamp: the time when the transfer start from source chain
-    // the lockTimestamp is verified on source chain
-    // 1. lockTimestamp verified successed: slasher get the transfer amount, fee and penalty on source chain
-    // 2. lockTimestamp verified failed:    slasher get the transfer amount, but the fee and penalty back to the provider
-    // sourceAmount: the send amount on source chain
     struct SlashInfo {
         uint256 remoteChainId;
         address slasher;