Skip to content

solidity: Simulated upgrade attack fix - #228

Merged
matevz merged 3 commits into
masterfrom
matevz/feature/simulation-attack-fix
Aug 3, 2026
Merged

solidity: Simulated upgrade attack fix#228
matevz merged 3 commits into
masterfrom
matevz/feature/simulation-attack-fix

Conversation

@matevz

@matevz matevz commented Jul 30, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Implements #198 (Option 4):

  • adds UPUPSUpgradeable contract that enforces a two-step upgrade
  • updates hardhat deployment tasks
  • updates tests

Tested on Sapphire Testnet with Safe:

$ npx hardhat show 0x91075489Df10f3Ee42ed497aaA4C6c9E94924Ac0 --network sapphire-testnet
=== Accounting Contract Info ===
Proxy address:        0x91075489Df10f3Ee42ed497aaA4C6c9E94924Ac0
Implementation:       0x822414e02851c8fcEE0E39F30EE225F568979514
VERSION:              3
Owner:                0xf1B7dF2E13E01928BAac26b6d4f315008EEE5E25
SiweAuth address:     0x402fF7d748CfD37BEF9b2cCfB208e595FBb39B8c
Withdrawal count:     0
Proposed upgrade:     yes
  New implementation:      0xf01f1B746e50ccee741333eE667B6C34ad473CBa
  New implementation hash: 0x36f5d259f2de622c4bc8224738f293595b61def913257167799f6b1bc3fd7e8e
  Min block number:        18217961

=== Registered Tokens (0) ===

=== AccountingSiweAuth Info ===
Address:              0x402fF7d748CfD37BEF9b2cCfB208e595FBb39B8c
ROFL app ID:          rofl1qqn9xndja7e2pnxhttktmecvwzz0yqwxsquqyxdf
Auth key hash:        0x290decd9548b62a8d60345a988386fc84ba6bc95484008f6362f93160ef3e563

=== EVMSignerAndVerifier Info ===
EVM signing address:  0xcbf2A507A676164b87A93497477cD4dBD1a3393e
Gas tank address:     0xEceC81a8510A1FA8209434564f7ec6faB9E6780a
ROFL app ID:          rofl1qqn9xndja7e2pnxhttktmecvwzz0yqwxsquqyxdf
ROFL signer address:  0x0000000000000000000000000000000000000000

$ npx hardhat show 0x91075489Df10f3Ee42ed497aaA4C6c9E94924Ac0 --network sapphire-testnet
=== Accounting Contract Info ===
Proxy address:        0x91075489Df10f3Ee42ed497aaA4C6c9E94924Ac0
Implementation:       0xf01f1B746e50ccee741333eE667B6C34ad473CBa
VERSION:              4
Owner:                0xf1B7dF2E13E01928BAac26b6d4f315008EEE5E25
SiweAuth address:     0x402fF7d748CfD37BEF9b2cCfB208e595FBb39B8c
Withdrawal count:     0
Proposed upgrade:     none

=== Registered Tokens (0) ===

=== AccountingSiweAuth Info ===
Address:              0x402fF7d748CfD37BEF9b2cCfB208e595FBb39B8c
ROFL app ID:          rofl1qqn9xndja7e2pnxhttktmecvwzz0yqwxsquqyxdf
Auth key hash:        0x290decd9548b62a8d60345a988386fc84ba6bc95484008f6362f93160ef3e563

=== EVMSignerAndVerifier Info ===
EVM signing address:  0xcbf2A507A676164b87A93497477cD4dBD1a3393e
Gas tank address:     0xEceC81a8510A1FA8209434564f7ec6faB9E6780a
ROFL app ID:          rofl1qqn9xndja7e2pnxhttktmecvwzz0yqwxsquqyxdf
ROFL signer address:  0x0000000000000000000000000000000000000000

@matevz matevz linked an issue Jul 30, 2026 that may be closed by this pull request
Simulated upgrade attack on Privana contracts #198
Closed
@matevz
matevz force-pushed the matevz/feature/simulation-attack-fix branch from 1c3354c to baa0487 Compare July 30, 2026 14:18
uniyalabhishek
uniyalabhishek reviewed Jul 31, 2026
View reviewed changes
Comment thread solidity/contracts/lib/UPUPSUpgradeable.sol
Comment thread solidity/contracts/Accounting.sol
@matevz
matevz force-pushed the matevz/feature/simulation-attack-fix branch 3 times, most recently from 02e1ad7 to 6d69f84 Compare July 31, 2026 09:28
@matevz matevz changed the title solidity: Simulation attack fix solidity: Simulated upgrade attack fix Jul 31, 2026
@matevz
matevz marked this pull request as ready for review July 31, 2026 11:33
@matevz
matevz requested a review from uniyalabhishek July 31, 2026 11:33
uniyalabhishek
uniyalabhishek reviewed Jul 31, 2026
View reviewed changes
Comment thread solidity/tasks/deploy.ts
uniyalabhishek
uniyalabhishek reviewed Jul 31, 2026
View reviewed changes
Comment thread solidity/tasks/deploy.ts
rube-de
rube-de reviewed Aug 3, 2026
View reviewed changes
Comment thread solidity/tasks/deploy.ts Outdated
Comment thread solidity/contracts/lib/UPUPSUpgradeable.sol Outdated
Comment thread solidity/tasks/deploy.ts
@matevz matevz mentioned this pull request Aug 3, 2026
Open
@matevz
matevz force-pushed the matevz/feature/simulation-attack-fix branch 2 times, most recently from bd274f4 to d11675b Compare August 3, 2026 11:35
@matevz
matevz requested a review from rube-de August 3, 2026 11:45
@matevz
matevz force-pushed the matevz/feature/simulation-attack-fix branch from d11675b to a732002 Compare August 3, 2026 12:26
@matevz
matevz force-pushed the matevz/feature/simulation-attack-fix branch from a732002 to 0f42547 Compare August 3, 2026 12:35
@matevz
matevz merged commit c3079b9 into master Aug 3, 2026
3 checks passed
@matevz
matevz deleted the matevz/feature/simulation-attack-fix branch August 3, 2026 12:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@uniyalabhishek uniyalabhishek uniyalabhishek approved these changes
@ahmedhamedaly ahmedhamedaly Awaiting requested review from ahmedhamedaly ahmedhamedaly is a code owner
@rube-de rube-de Awaiting requested review from rube-de rube-de is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Simulated upgrade attack on Privana contracts

3 participants

@matevz @rube-de @uniyalabhishek