solidity: C10lUUPSUpgradeable -> UUPSProposeableUpgradeable

Author: matevz

solidity/contracts/lib/C10lUUPSUpgradeable.sol

@@ -0,0 +1,153 @@
+// SPDX-License-Identifier: Apache-2.0
+pragma solidity ^0.8.0;
+
+import {UUPSUpgradeable} from "@openzeppelin/contracts-upgradeable/proxy/utils/UUPSUpgradeable.sol";
+
+/**
+ * @title Extended UUPSUpgradeable base contract that prevents simulation
+ * attacks by the upgrader on confidential Oasis Sapphire contract state.
+ * @notice This contract adds a proposeUpgrade step before executing the upgrade
+ * that enforces the upgrade being done in two separate blocks. This prevents
+ * the simulation attack by the upgrader without user's knowledge.
+ *
+ * #### Example
+ *
+ * ```solidity
+ * contract MyContract is UUPSProposeableUpgradeable, OwnableUpgradeable {
+ *   function initialize(address _owner) public initializer {
+ *     __Ownable_init(_owner);
+ *   }
+ *
+ *   // Gate proposeUpgrade with appropriate modifier.
+ *   function _authorizeProposeUpgrade() internal onlyOwner { }
+ *
+ *   // Gate UUPSUpgradeable.authorizeUpgrade with appropriate modifier.
+ *   function _authorizeUpgrade(address newImpl) internal onlyOwner onlyProposeUpgrade(newImpl) { }
+ * }
+ * ```
+ */
+abstract contract UUPSProposeableUpgradeable is UUPSUpgradeable {
+    /// @custom:storage-location erc7201:oasisprotocol.storage.UUPSProposeableUpgradeable
+    struct UUPSProposeableUpgradeableStorage {
+        address _newImplementation;
+        uint256 _minBlockNumber;
+    }
+
+    // keccak256(abi.encode(uint256(keccak256("oasisprotocol.storage.UUPSProposeableUpgradeable")) - 1)) & ~bytes32(uint256(0xff))
+    bytes32 private constant UUPSProposeableUpgradeableStorageLocation =
+        0xa97571fb9a74c4c520fcdddf68345a7b192979c0085272968c2570875f6f0000;
+
+    function _getUUPSProposeableUpgradeableStorage()
+        private
+        pure
+        returns (UUPSProposeableUpgradeableStorage storage $)
+    {
+        assembly {
+            $.slot := UUPSProposeableUpgradeableStorageLocation
+        }
+    }
+
+    error ImplementationDoesNotMatch();
+    error MinBlockNumberNotReached();
+    error MinBlockNumberInPast();
+
+    event UpgradeProposed(
+        address indexed newImplementation,
+        uint256 indexed minBlockNumber
+    );
+
+    event UpgradeAccepted(
+        address indexed newImplementation,
+        uint256 indexed minBlockNumber
+    );
+
+    /**
+     * @notice Initializes the contract.
+     */
+    function __UUPSProposeableUpgradeable_init()
+        internal
+        onlyInitializing
+    {
+    }
+
+    /**
+     * @notice Reverts unless the transaction is signed by an authorized
+     * instance of the configured ROFL app.
+     */
+    modifier acceptProposedUpgrade(address newImpl) {
+        _acceptProposeUpgrade(newImpl);
+
+        _;
+    }
+
+    /**
+     * @notice  Function that should revert when `msg.sender` is not authorized
+     * to propose the upgrade. Use {proposedUpgradeImplementation} and
+     * {proposeedMinBlockNumber} to fetch proposal details. Called by
+     * {proposeUpgrade}.
+     *
+     * Normally, this function will use an xref:access.adoc[access control]
+     * modifier such as {Ownable-onlyOwner}.
+     *
+     * ```solidity
+     * function _authorizeUpgradeProposal() internal onlyOwner {}
+     * ```
+     */
+    function _authorizeProposeUpgrade() internal virtual;
+
+    /**
+     * @notice Returns the new implementation address of the proposed upgrade.
+     */
+    function proposedUpgradeImplementation() public view virtual returns (address) {
+        UUPSProposeableUpgradeableStorage storage $ = _getUUPSProposeableUpgradeableStorage();
+        return $._newImplementation;
+    }
+
+    /**
+     * @notice Returns the proposed upgrade minimum block number.
+     */
+    function proposedUpgradeMinBlockNumber() public view virtual returns (uint256) {
+        UUPSProposeableUpgradeableStorage storage $ = _getUUPSProposeableUpgradeableStorage();
+        return $._minBlockNumber;
+    }
+
+    /**
+     * @notice Reverts unless the implementation matches and the current block
+     * number is at least one block ahead of the minBlockNumber.
+     */
+    function _acceptProposeUpgrade(address newImplementation) internal view virtual {
+        if (newImplementation != proposedUpgradeImplementation()) {
+            revert ImplementationDoesNotMatch();
+        }
+        if (block.number <= proposedUpgradeMinBlockNumber()) {
+            revert MinBlockNumberNotReached();
+        }
+        emit UpgradeAccepted(newImplementation, proposedUpgradeMinBlockNumber());
+
+        UUPSProposeableUpgradeableStorage storage $ = _getUUPSProposeableUpgradeableStorage();
+        $._newImplementation = address(0);
+        $._minBlockNumber = 0;
+    }
+
+    /**
+     * @notice Propose the upgrade to the new implementation address after the
+     * given block number. If minBlockNumber is zero, take the current block
+     * number.
+     */
+    function proposeUpgrade(address newImplementation, uint256 minBlockNumber) public virtual {
+        if (minBlockNumber == 0) {
+            minBlockNumber = block.number;
+        }
+        if (minBlockNumber < block.number) {
+            revert MinBlockNumberInPast();
+        }
+
+        UUPSProposeableUpgradeableStorage storage $ = _getUUPSProposeableUpgradeableStorage();
+        $._newImplementation = newImplementation;
+        $._minBlockNumber = minBlockNumber;
+
+        _authorizeProposeUpgrade();
+
+        emit UpgradeProposed(newImplementation, minBlockNumber);
+    }
+}