restrict increase, decrease, and burn and v4 initialize pool call (#416)

* restrict increase, decrease, and burn

* prettier

* initialize v4 pool call

* prettier

* refactor logic into function, plus optimise decode

* merge latest periphery

* move v3 logic outside of dispatcher

* initialize pool tests

* sbapshot

* larger refactor

* pull v4 periphery and revert payments

* make checkV4InitializeCall like the others

* Call initialize directly

* undo v3 refactor

* imports

* remove unused typescript type

* remove unnecessary extra immutable

* Bump beta version

* Improve coments

* Add pool intiialization to some tests

---------

Co-authored-by: Alice Henshaw <[email protected]>

contracts/base/Dispatcher.sol

@@ -15,6 +15,8 @@ import {IAllowanceTransfer} from 'permit2/src/interfaces/IAllowanceTransfer.sol'
 import {IERC721Permit} from '@uniswap/v3-periphery/contracts/interfaces/IERC721Permit.sol';
 import {ActionConstants} from '@uniswap/v4-periphery/src/libraries/ActionConstants.sol';
 import {CalldataDecoder} from '@uniswap/v4-periphery/src/libraries/CalldataDecoder.sol';
+import {PoolKey} from '@uniswap/v4-core/src/types/PoolKey.sol';
+import {IPoolManager} from '@uniswap/v4-core/src/interfaces/IPoolManager.sol';
 
 /// @title Decodes and Executes Commands
 /// @notice Called by the UniversalRouter contract to efficiently decode and execute a singular command
@@ -24,8 +26,6 @@ abstract contract Dispatcher is Payments, V2SwapRouter, V3SwapRouter, V4SwapRout
 
     error InvalidCommandType(uint256 commandType);
     error BalanceTooLow();
-    error InvalidAction(bytes4 action);
-    error NotAuthorizedForToken(uint256 tokenId);
 
     /// @notice Executes encoded commands along with provided inputs.
     /// @param commands A set of concatenated commands, each 1 byte in length
@@ -269,12 +269,21 @@ abstract contract Dispatcher is Payments, V2SwapRouter, V3SwapRouter, V4SwapRout
                     }
 
                     (success, output) = address(V3_POSITION_MANAGER).call(inputs);
-                } else if (command == Commands.V4_POSITION_CALL) {
+                } else if (command == Commands.V4_INITIALIZE_POOL) {
+                    PoolKey calldata poolKey;
+                    uint160 sqrtPriceX96;
+                    assembly {
+                        poolKey := inputs.offset
+                        sqrtPriceX96 := calldataload(add(inputs.offset, 0xa0))
+                    }
+                    (success, output) =
+                        address(poolManager).call(abi.encodeCall(IPoolManager.initialize, (poolKey, sqrtPriceX96)));
+                } else if (command == Commands.V4_POSITION_MANAGER_CALL) {
                     // should only call modifyLiquidities() to mint
-                    // do not permit or approve this contract over a v4 position or someone could use this command to decrease, burn, or transfer your position
+                    _checkV4PositionManagerCall(inputs);
                     (success, output) = address(V4_POSITION_MANAGER).call{value: address(this).balance}(inputs);
                 } else {
-                    // placeholder area for commands 0x13-0x20
+                    // placeholder area for commands 0x15-0x20
                     revert InvalidCommandType(command);
                 }
             }

contracts/libraries/Commands.sol

@@ -35,8 +35,9 @@ library Commands {
     uint256 constant V4_SWAP = 0x10;
     uint256 constant V3_POSITION_MANAGER_PERMIT = 0x11;
     uint256 constant V3_POSITION_MANAGER_CALL = 0x12;
-    uint256 constant V4_POSITION_CALL = 0x13;
-    // COMMAND_PLACEHOLDER = 0x14 -> 0x20
+    uint256 constant V4_INITIALIZE_POOL = 0x13;
+    uint256 constant V4_POSITION_MANAGER_CALL = 0x14;
+    // COMMAND_PLACEHOLDER = 0x15 -> 0x20
 
     // Command Types where 0x21<=value<=0x3f
     uint256 constant EXECUTE_SUB_PLAN = 0x21;

contracts/modules/MigratorImmutables.sol

@@ -3,6 +3,7 @@ pragma solidity ^0.8.24;
 
 import {INonfungiblePositionManager} from '@uniswap/v3-periphery/contracts/interfaces/INonfungiblePositionManager.sol';
 import {IPositionManager} from '@uniswap/v4-periphery/src/interfaces/IPositionManager.sol';
+import {IPoolManager} from '@uniswap/v4-core/src/interfaces/IPoolManager.sol';
 
 struct MigratorParameters {
     address v3PositionManager;
@@ -12,9 +13,9 @@ struct MigratorParameters {
 /// @title Migrator Immutables
 /// @notice Immutable state for liquidity-migration contracts
 contract MigratorImmutables {
-    /// @notice v3PositionManager address
+    /// @notice v3 PositionManager address
     INonfungiblePositionManager public immutable V3_POSITION_MANAGER;
-    /// @notice v4PositionManager address
+    /// @notice v4 PositionManager address
     IPositionManager public immutable V4_POSITION_MANAGER;
 
     constructor(MigratorParameters memory params) {

contracts/modules/Payments.sol

@@ -3,7 +3,7 @@ pragma solidity ^0.8.24;
 
 import {Constants} from '../libraries/Constants.sol';
 import {ActionConstants} from '@uniswap/v4-periphery/src/libraries/ActionConstants.sol';
-import {BipsLibrary} from '@uniswap/v4-core/src/libraries/BipsLibrary.sol';
+import {BipsLibrary} from '@uniswap/v4-periphery/src/libraries/BipsLibrary.sol';
 import {PaymentsImmutables} from '../modules/PaymentsImmutables.sol';
 import {SafeTransferLib} from 'solmate/src/utils/SafeTransferLib.sol';
 import {ERC20} from 'solmate/src/tokens/ERC20.sol';

contracts/modules/V3ToV4Migrator.sol

@@ -3,10 +3,18 @@ pragma solidity ^0.8.24;
 
 import {MigratorImmutables} from '../modules/MigratorImmutables.sol';
 import {INonfungiblePositionManager} from '@uniswap/v3-periphery/contracts/interfaces/INonfungiblePositionManager.sol';
+import {Actions} from '@uniswap/v4-periphery/src/libraries/Actions.sol';
+import {CalldataDecoder} from '@uniswap/v4-periphery/src/libraries/CalldataDecoder.sol';
 
 /// @title V3 to V4 Migrator
 /// @notice A contract that migrates liquidity from Uniswap V3 to V4
 abstract contract V3ToV4Migrator is MigratorImmutables {
+    using CalldataDecoder for bytes;
+
+    error InvalidAction(bytes4 action);
+    error OnlyMintAllowed();
+    error NotAuthorizedForToken(uint256 tokenId);
+
     /// @dev validate if an action is decreaseLiquidity, collect, or burn
     function isValidAction(bytes4 selector) internal pure returns (bool) {
         return selector == INonfungiblePositionManager.decreaseLiquidity.selector
@@ -20,4 +28,38 @@ abstract contract V3ToV4Migrator is MigratorImmutables {
         return caller == owner || V3_POSITION_MANAGER.getApproved(tokenId) == caller
             || V3_POSITION_MANAGER.isApprovedForAll(owner, caller);
     }
+
+    /// @dev check that the v4 position manager call is a safe call
+    /// of the position-altering Actions, we only allow Actions.MINT
+    /// this is because, if a user could be tricked into approving the UniversalRouter for
+    /// their position, an attacker could take their fees, or drain their entire position
+    function _checkV4PositionManagerCall(bytes calldata inputs) internal view {
+        bytes4 selector;
+        assembly {
+            selector := calldataload(inputs.offset)
+        }
+        if (selector != V4_POSITION_MANAGER.modifyLiquidities.selector) {
+            revert InvalidAction(selector);
+        }
+
+        // slice is `abi.encode(bytes unlockData, uint256 deadline)`
+        bytes calldata slice = inputs[4:];
+        // the first bytes(0) extracts the unlockData parameter from modifyLiquidities
+        // unlockData = `abi.encode(bytes actions, bytes[] params)`
+        // the second bytes(0) extracts the actions parameter from unlockData
+        bytes calldata actions = slice.toBytes(0).toBytes(0);
+
+        uint256 numActions = actions.length;
+
+        for (uint256 actionIndex = 0; actionIndex < numActions; actionIndex++) {
+            uint256 action = uint8(actions[actionIndex]);
+
+            if (
+                action == Actions.INCREASE_LIQUIDITY || action == Actions.DECREASE_LIQUIDITY
+                    || action == Actions.BURN_POSITION
+            ) {
+                revert OnlyMintAllowed();
+            }
+        }
+    }
 }

package.json

@@ -6,7 +6,7 @@
     "access": "public",
     "provenance": true
   },
-  "version": "2.0.0-beta.1",
+  "version": "2.0.0-beta.2",
   "keywords": [
     "uniswap",
     "router",

test/integration-tests/UniswapV2.test.ts

@@ -74,7 +74,7 @@ describe('Uniswap V2 Tests:', () => {
 
     beforeEach(async () => {
       // cancel the permit on DAI
-      await permit2.approve(DAI.address, ADDRESS_ZERO, 0, 0)
+      await permit2.approve(DAI.address, router.address, 0, 0)
     })
 
     it('V2 exactIn, permiting the exact amount', async () => {