#pragma version =0.4.4; #include "imports/stdlib.fc"; const int size::stored_seqno = 33; const int size::stored_subwallet = 80; const int size::public_key = 256; const int size::subwallet_id = 80; const int size::valid_until = 32; const int size::msg_seqno = 32; const int size::flags = 4; () return_if(int cond) impure asm "IFRET"; () return_unless(int cond) impure asm "IFNOTRET"; (slice) udict_get_or_return(cell dict, int key_len, int index) impure asm(index dict key_len) "DICTUGET" "IFNOTRET"; (slice) enforce_and_remove_sign_prefix(slice body) impure asm "x{7369676E} SDBEGINS"; (slice, int) check_and_remove_extn_prefix(slice body) impure asm "x{6578746E} SDBEGINSQ"; (slice, int) check_and_remove_sint_prefix(slice body) impure asm "x{73696E74} SDBEGINSQ"; ;; (slice, int) check_and_remove_set_data_prefix(slice body) impure asm "x{1ff8ea0b} SDBEGINSQ"; (slice, int) check_and_remove_add_extension_prefix(slice body) impure asm "x{1c40db9f} SDBEGINSQ"; (slice, int) check_and_remove_remove_extension_prefix(slice body) impure asm "x{5eaef4a4} SDBEGINSQ"; (slice, int) check_and_remove_set_signature_auth_allowed_prefix(slice body) impure asm "x{20cbb95a} SDBEGINSQ"; (slice) enforce_and_remove_action_send_msg_prefix(slice body) impure asm "x{0ec3c86d} SDBEGINS"; ;; Extensible wallet contract v5 ;; Compresses 8+256-bit address into 256-bit uint by cutting off one bit from sha256. ;; This allows us to save on wrapping the address in a cell and make plugin requests cheaper. ;; This method also unpacks address hash if you pass packed hash with the original wc. int pack_address((int, int) address) impure asm "SWAP" "INC" "XOR"; ;; hash ^ (wc+1) ;; Stores pre-computed list of actions (mostly `action_send_msg`) in the actions register. () set_actions(cell action_list) impure asm "c5 POP"; int count_leading_zeroes(slice cs) asm "SDCNTLEAD0"; int count_trailing_zeroes(slice cs) asm "SDCNTTRAIL0"; int count_trailing_ones(slice cs) asm "SDCNTTRAIL1"; ;; (slice, slice) split(slice s, int bits, int refs) asm "SPLIT"; ;; (slice, slice, int) split?(slice s, int bits, int refs) asm "SPLIT" "NULLSWAPIFNOT"; slice get_last_bits(slice s, int n) asm "SDCUTLAST"; slice remove_last_bits(slice s, int n) asm "SDSKIPLAST"; cell verify_actions(cell c5) inline { ;; Comment out code starting from here to disable checks (unsafe version) ;; {- slice c5s = c5.begin_parse(); return_if(c5s.slice_empty?()); do { ;; only send_msg is allowed, set_code or reserve_currency are not c5s = c5s.enforce_and_remove_action_send_msg_prefix(); ;; enforce that send_mode has 2 bit set ;; for that load 7 bits and make sure that they end with 1 throw_if(37, count_trailing_zeroes(c5s.preload_bits(7))); c5s = c5s.preload_ref().begin_parse(); } until (c5s.slice_empty?()); ;; -} return c5; } ;; Dispatches already authenticated request. ;; this function is explicitly included as an inline reference - not completely inlined ;; completely inlining it causes undesirable code split and noticeable gas increase in some paths () dispatch_complex_request(slice cs) impure inline_ref { ;; Recurse into extended actions until we reach standard actions while (cs~load_int(1)) { var is_add_ext? = cs~check_and_remove_add_extension_prefix(); var is_del_ext? = is_add_ext? ? 0 : cs~check_and_remove_remove_extension_prefix(); ;; Add/remove extensions if (is_add_ext? | is_del_ext?) { (int wc, int hash) = parse_std_addr(cs~load_msg_addr()); int packed_addr = pack_address((wc, hash) ); var ds = get_data().begin_parse(); var data_bits = ds~load_bits(size::stored_seqno + size::stored_subwallet + size::public_key); var stored_seqno = data_bits.preload_int(size::stored_seqno); var extensions = ds.preload_dict(); ;; Add extension if (is_add_ext?) { (extensions, int success?) = extensions.udict_add_builder?(256, packed_addr, begin_cell().store_int(wc,8)); throw_unless(39, success?); } else ;; Remove extension if (op == 0x5eaef4a4) ;; It can be ONLY 0x1c40db9f OR 0x5eaef4a4 here. No need for second check. { (extensions, int success?) = extensions.udict_delete?(256, packed_addr); throw_unless(40, success?); throw_if(44, null?(extensions) & (stored_seqno < 0)); } set_data(begin_cell() .store_slice(data_bits) .store_dict(extensions) .end_cell()); } elseif (cs~check_and_remove_set_signature_auth_allowed_prefix()) { var allow? = cs~load_int(1); var ds = get_data().begin_parse(); var stored_seqno = ds~load_int(size::stored_seqno); var immutable_tail = ds; ;; stored_subwallet ~ public_key ~ extensions if (allow?) { ;; allow throw_unless(43, stored_seqno < 0); ;; Can't be disallowed with 0 because disallowing increments seqno ;; -123 -> 123 -> 124 stored_seqno = - stored_seqno; stored_seqno = stored_seqno + 1; } else { ;; disallow throw_unless(43, stored_seqno >= 0); ds = ds.skip_bits(size::stored_subwallet + size::public_key); var extensions_is_not_null = ds.preload_uint(1); throw_unless(42, extensions_is_not_null); ;; Corner case: 0 -> 1 -> -1 ;; 123 -> 124 -> -124 stored_seqno = stored_seqno + 1; stored_seqno = - stored_seqno; } set_data(begin_cell() .store_int(stored_seqno, size::stored_seqno) .store_slice(immutable_tail) ;; stored_subwallet ~ public_key ~ extensions .end_cell()); } ;; Uncomment to allow set_data (for unsafe version) {- elseif (cs~check_and_remove_set_data_prefix()) { set_data(cs~load_ref()); } -} else { ;; need to throw on unsupported actions for correct flow and for testability throw(41); ;; unsupported action } cs = cs.preload_ref().begin_parse(); } ;; At this point we are at `action_list_basic$0 {n:#} actions:^(OutList n) = ActionList n 0;` ;; Simply set the C5 register with all pre-computed actions after verification: set_actions(cs.preload_ref().verify_actions()); return (); } ;; ------------------------------------------------------------------------------------------------ ;; Verifies signed request, prevents replays and proceeds with `dispatch_request`. () process_signed_request_from_external_message(slice full_body) impure inline { ;; The precise order of operations here is VERY important. Any other order results in unneccessary stack shuffles. slice signature = full_body.get_last_bits(512); slice signed = full_body.remove_last_bits(512); var cs = signed.skip_bits(32); var (subwallet_id, valid_until, msg_seqno) = (cs~load_uint(size::subwallet_id), cs~load_uint(size::valid_until), cs~load_uint(size::msg_seqno)); var ds = get_data().begin_parse(); var stored_seqno = ds~load_int(size::stored_seqno); var immutable_tail = ds; ;; stored_subwallet ~ public_key ~ extensions var stored_subwallet = ds~load_uint(size::stored_subwallet); var public_key = ds.preload_uint(size::public_key); ;; TODO: Consider moving signed into separate ref, slice_hash consumes 500 gas just like cell creation! ;; Only such checking order results in least amount of gas throw_unless(35, check_signature(slice_hash(signed), signature, public_key)); ;; If public key is disabled, stored_seqno is strictly less than zero: stored_seqno < 0 ;; However, msg_seqno is uint, therefore it can be only greater or equal to zero: msg_seqno >= 0 ;; Thus, if public key is disabled, these two domains NEVER intersect, and additional check is not needed throw_unless(33, msg_seqno == stored_seqno); throw_unless(34, subwallet_id == stored_subwallet); throw_if(36, valid_until <= now()); accept_message(); ;; Store and commit the seqno increment to prevent replays even if the subsequent requests fail. stored_seqno = stored_seqno + 1; set_data(begin_cell() .store_int(stored_seqno, size::stored_seqno) .store_slice(immutable_tail) ;; stored_subwallet ~ public_key ~ extensions .end_cell()); commit(); if (count_leading_zeroes(cs)) { ;; starts with bit 0 return set_actions(cs.preload_ref().verify_actions()); } ;; <<<<<<<<<<---------- Simple primary cases gas evaluation ends here ---------->>>>>>>>>> ;; inline_ref required because otherwise it will produce undesirable JMPREF dispatch_complex_request(cs); } () recv_external(slice body) impure inline { slice full_body = body; ;; 0x7369676E ("sign") external message authenticated by signature body = enforce_and_remove_sign_prefix(body); process_signed_request_from_external_message(full_body); return(); } ;; ------------------------------------------------------------------------------------------------ () dispatch_extension_request(slice cs, var dummy1) impure inline { if (count_leading_zeroes(cs)) { ;; starts with bit 0 return set_actions(cs.preload_ref().verify_actions()); } ;; <<<<<<<<<<---------- Simple primary cases gas evaluation ends here ---------->>>>>>>>>> ;; dummy1~impure_touch(); ;; DROP merged to 2DROP! dispatch_complex_request(cs); } ;; Same logic as above function but with return_* instead of throw_* and additional checks to prevent bounces () process_signed_request_from_internal_message(slice full_body) impure inline { ;; Additional check to make sure that there are enough bits for reading (+1 for actual actions flag) return_if(full_body.slice_bits() < 32 + size::subwallet_id + size::valid_until + size::msg_seqno + 1 + 512); ;; The precise order of operations here is VERY important. Any other order results in unneccessary stack shuffles. slice signature = full_body.get_last_bits(512); slice signed = full_body.remove_last_bits(512); var cs = signed.skip_bits(32); var (subwallet_id, valid_until, msg_seqno) = (cs~load_uint(size::subwallet_id), cs~load_uint(size::valid_until), cs~load_uint(size::msg_seqno)); var ds = get_data().begin_parse(); var stored_seqno = ds~load_int(size::stored_seqno); var immutable_tail = ds; ;; stored_subwallet ~ public_key ~ extensions var stored_subwallet = ds~load_uint(size::stored_subwallet); var public_key = ds.preload_uint(size::public_key); ;; Note on bouncing/nonbouncing behaviour: ;; In principle, the wallet should not bounce incoming messages as to avoid ;; returning deposits back to the sender due to opcode misinterpretation. ;; However, specifically for "gasless" transactions (signed messages relayed by a 3rd party), ;; there is a risk for the relaying party to be abused: their coins should be bounced back in case of a race condition or delays. ;; We resolve this dilemma by silently failing at the signature check (therefore ordinary deposits with arbitrary opcodes never bounce), ;; but failing with exception (therefore bouncing) after the signature check. ;; TODO: Consider moving signed into separate ref, slice_hash consumes 500 gas just like cell creation! ;; Only such checking order results in least amount of gas return_unless(check_signature(slice_hash(signed), signature, public_key)); ;; If public key is disabled, stored_seqno is strictly less than zero: stored_seqno < 0 ;; However, msg_seqno is uint, therefore it can be only greater or equal to zero: msg_seqno >= 0 ;; Thus, if public key is disabled, these two domains NEVER intersect, and additional check is not needed throw_unless(33, msg_seqno == stored_seqno); throw_unless(34, subwallet_id == stored_subwallet); throw_if(36, valid_until <= now()); ;; Store and commit the seqno increment to prevent replays even if the subsequent requests fail. stored_seqno = stored_seqno + 1; set_data(begin_cell() .store_int(stored_seqno, size::stored_seqno) .store_slice(immutable_tail) ;; stored_subwallet ~ public_key ~ extensions .end_cell()); commit(); if (count_leading_zeroes(cs)) { ;; starts with bit 0 return set_actions(cs.preload_ref().verify_actions()); } ;; <<<<<<<<<<---------- Simple primary cases gas evaluation ends here ---------->>>>>>>>>> ;; inline_ref required because otherwise it will produce undesirable JMPREF dispatch_complex_request(cs); } () recv_internal(cell full_msg, slice body) impure inline { ;; return right away if there are no references ;; correct messages always have a ref, because any code paths ends with preload_ref return_if(body.slice_refs_empty?()); ;; Any attempt to postpone msg_value deletion will result in s2 POP -> SWAP change. No use at all. var full_msg_slice = full_msg.begin_parse(); var s_flags = full_msg_slice~load_bits(size::flags); ;; int_msg_info$0 ihr_disabled:Bool bounce:Bool bounced:Bool src:MsgAddressInt ... ;; If bounced flag (last bit) is set amount of trailing ones will be non-zero, else it will be zero. return_if(count_trailing_ones(s_flags)); ;; slicy_return_if_bounce(begin_cell().store_uint(3, 4).end_cell().begin_parse()); ;; TEST!!! ;; We accept two kinds of authenticated messages: ;; - 0x6578746E "extn" authenticated by extension ;; - 0x73696E74 "sint" internal message authenticated by signature (body, int is_extn?) = check_and_remove_extn_prefix(body); ;; 0x6578746E ("extn") ;; IFJMPREF because unconditionally returns inside if (is_extn?) { ;; "extn" authenticated by extension ;; Authenticate extension by its address. int packed_sender_addr = pack_address(parse_std_addr(full_msg_slice~load_msg_addr())); ;; no PLDMSGADDR exists var ds = get_data().begin_parse(); ;; It is not required to read this data here, maybe ext is doing simple transfer where those are not needed var extensions = ds.skip_bits(size::stored_seqno + size::stored_subwallet + size::public_key).preload_dict(); ;; Note that some random contract may have deposited funds with this prefix, ;; so we accept the funds silently instead of throwing an error (wallet v4 does the same). var wc = extensions.udict_get_or_return(256, packed_sender_addr); ;; kindof ifnot (success?) { return(); } ;; auth_kind and wc are passed into dispatch_extension_request and later are dropped in batch with 3 BLKDROP dispatch_extension_request(body, wc); ;; Special route for external address authenticated request return (); } slice full_body = body; (_, int is_sint?) = check_and_remove_sint_prefix(body); ;; 0x73696E74 ("sint") - sign internal return_unless(is_sint?); ;; Process the rest of the slice just like the signed request. process_signed_request_from_internal_message(full_body); return (); ;; Explicit returns escape function faster and const less gas (suddenly!) } ;; ------------------------------------------------------------------------------------------------ ;; Get methods int seqno() method_id { ;; Use absolute value to do not confuse apps with negative seqno if key is disabled return abs(get_data().begin_parse().preload_int(size::stored_seqno)); } int get_wallet_id() method_id { return get_data().begin_parse().skip_bits(size::stored_seqno).preload_uint(size::stored_subwallet); } int get_public_key() method_id { var cs = get_data().begin_parse().skip_bits(size::stored_seqno + size::stored_subwallet); return cs.preload_uint(size::public_key); } ;; Returns raw dictionary (or null if empty) where keys are packed addresses and the `wc` is stored in leafs. ;; User should unpack the address using the same packing function using `wc` to restore the original address. cell get_extensions() method_id { var ds = get_data().begin_parse().skip_bits(size::stored_seqno + size::stored_subwallet + size::public_key); return ds~load_dict(); } int get_is_signature_auth_allowed() method_id { return get_data().begin_parse().preload_int(size::stored_seqno) >= 0; }

Contracts/89fKU0k97trCizgZhqhJQDy6w9LFhHea8IEGWvCsS5M=

Verified Sources