353 lines
11 KiB
Solidity
353 lines
11 KiB
Solidity
// SPDX-License-Identifier: MIT
|
|
pragma solidity ^0.8.20;
|
|
|
|
import "@openzeppelin/contracts-upgradeable/access/AccessControlUpgradeable.sol";
|
|
import "@openzeppelin/contracts-upgradeable/utils/ReentrancyGuardUpgradeable.sol";
|
|
import "@openzeppelin/contracts-upgradeable/proxy/utils/UUPSUpgradeable.sol";
|
|
import "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol";
|
|
import "@openzeppelin/contracts/token/ERC20/IERC20.sol";
|
|
import "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";
|
|
import "../registry/UniversalAssetRegistry.sol";
|
|
import "../ccip/IRouterClient.sol";
|
|
|
|
/**
|
|
* @title UniversalCCIPBridge
|
|
* @notice Main bridge contract supporting all asset types via CCIP
|
|
* @dev Extends CCIP infrastructure with dynamic asset routing and PMM integration
|
|
*/
|
|
contract UniversalCCIPBridge is
|
|
Initializable,
|
|
AccessControlUpgradeable,
|
|
ReentrancyGuardUpgradeable,
|
|
UUPSUpgradeable
|
|
{
|
|
using SafeERC20 for IERC20;
|
|
|
|
bytes32 public constant BRIDGE_OPERATOR_ROLE = keccak256("BRIDGE_OPERATOR_ROLE");
|
|
bytes32 public constant UPGRADER_ROLE = keccak256("UPGRADER_ROLE");
|
|
|
|
struct BridgeOperation {
|
|
address token;
|
|
uint256 amount;
|
|
uint64 destinationChain;
|
|
address recipient;
|
|
bytes32 assetType;
|
|
bool usePMM;
|
|
bool useVault;
|
|
bytes complianceProof;
|
|
bytes vaultInstructions;
|
|
}
|
|
|
|
struct Destination {
|
|
address receiverBridge;
|
|
bool enabled;
|
|
uint256 addedAt;
|
|
}
|
|
|
|
// Core dependencies
|
|
UniversalAssetRegistry public assetRegistry;
|
|
IRouterClient public ccipRouter;
|
|
address public liquidityManager;
|
|
address public vaultFactory;
|
|
|
|
// State
|
|
mapping(address => mapping(uint64 => Destination)) public destinations;
|
|
mapping(address => address) public userVaults;
|
|
mapping(bytes32 => bool) public processedMessages;
|
|
mapping(address => uint256) public nonces;
|
|
|
|
// Events
|
|
event BridgeExecuted(
|
|
bytes32 indexed messageId,
|
|
address indexed token,
|
|
address indexed sender,
|
|
uint256 amount,
|
|
uint64 destinationChain,
|
|
address recipient,
|
|
bool usedPMM
|
|
);
|
|
|
|
event DestinationAdded(
|
|
address indexed token,
|
|
uint64 indexed chainSelector,
|
|
address receiverBridge
|
|
);
|
|
|
|
event DestinationRemoved(
|
|
address indexed token,
|
|
uint64 indexed chainSelector
|
|
);
|
|
|
|
event MessageReceived(
|
|
bytes32 indexed messageId,
|
|
uint64 indexed sourceChainSelector,
|
|
address sender,
|
|
address token,
|
|
uint256 amount
|
|
);
|
|
|
|
/// @custom:oz-upgrades-unsafe-allow constructor
|
|
constructor() {
|
|
_disableInitializers();
|
|
}
|
|
|
|
function initialize(
|
|
address _assetRegistry,
|
|
address _ccipRouter,
|
|
address admin
|
|
) external initializer {
|
|
__AccessControl_init();
|
|
__ReentrancyGuard_init();
|
|
__UUPSUpgradeable_init();
|
|
|
|
require(_assetRegistry != address(0), "Zero registry");
|
|
|
|
assetRegistry = UniversalAssetRegistry(_assetRegistry);
|
|
if (_ccipRouter != address(0)) {
|
|
ccipRouter = IRouterClient(_ccipRouter);
|
|
}
|
|
// If _ccipRouter is zero, set via setCCIPRouter() after deployment (enables same initData for deterministic proxy address)
|
|
|
|
_grantRole(DEFAULT_ADMIN_ROLE, admin);
|
|
_grantRole(BRIDGE_OPERATOR_ROLE, admin);
|
|
_grantRole(UPGRADER_ROLE, admin);
|
|
}
|
|
|
|
function _authorizeUpgrade(address newImplementation)
|
|
internal override onlyRole(UPGRADER_ROLE) {}
|
|
|
|
/**
|
|
* @notice Set CCIP router (for deterministic deployment: initialize with router=0, then set per chain)
|
|
*/
|
|
function setCCIPRouter(address _ccipRouter) external onlyRole(DEFAULT_ADMIN_ROLE) {
|
|
require(_ccipRouter != address(0), "Zero router");
|
|
ccipRouter = IRouterClient(_ccipRouter);
|
|
}
|
|
|
|
/**
|
|
* @notice Main bridge function with asset type routing
|
|
*/
|
|
function bridge(
|
|
BridgeOperation calldata op
|
|
) external payable nonReentrant returns (bytes32 messageId) {
|
|
// Validate asset is registered and active
|
|
UniversalAssetRegistry.UniversalAsset memory asset = assetRegistry.getAsset(op.token);
|
|
require(asset.isActive, "Asset not active");
|
|
require(asset.tokenAddress != address(0), "Asset not registered");
|
|
|
|
// Verify destination is enabled
|
|
Destination memory dest = destinations[op.token][op.destinationChain];
|
|
require(dest.enabled, "Destination not enabled");
|
|
require(dest.receiverBridge != address(0), "Invalid receiver");
|
|
|
|
// Validate amounts
|
|
require(op.amount > 0, "Invalid amount");
|
|
require(op.amount >= asset.minBridgeAmount, "Below minimum");
|
|
require(op.amount <= asset.maxBridgeAmount, "Above maximum");
|
|
|
|
// Transfer tokens from user
|
|
IERC20(op.token).safeTransferFrom(msg.sender, address(this), op.amount);
|
|
|
|
// Execute bridge with optional PMM
|
|
if (op.usePMM && liquidityManager != address(0)) {
|
|
_executeBridgeWithPMM(op);
|
|
}
|
|
|
|
// Execute bridge with optional vault
|
|
if (op.useVault && vaultFactory != address(0)) {
|
|
_executeBridgeWithVault(op);
|
|
}
|
|
|
|
// Send CCIP message
|
|
messageId = _sendCCIPMessage(op, dest);
|
|
|
|
// Increment nonce
|
|
nonces[msg.sender]++;
|
|
|
|
emit BridgeExecuted(
|
|
messageId,
|
|
op.token,
|
|
msg.sender,
|
|
op.amount,
|
|
op.destinationChain,
|
|
op.recipient,
|
|
op.usePMM
|
|
);
|
|
|
|
return messageId;
|
|
}
|
|
|
|
/**
|
|
* @notice Execute bridge with PMM liquidity
|
|
*/
|
|
function _executeBridgeWithPMM(BridgeOperation calldata op) internal {
|
|
if (liquidityManager == address(0)) return;
|
|
|
|
// Call liquidity manager to provide liquidity
|
|
(bool success, ) = liquidityManager.call(
|
|
abi.encodeWithSignature(
|
|
"provideLiquidity(address,uint256,bytes)",
|
|
op.token,
|
|
op.amount,
|
|
""
|
|
)
|
|
);
|
|
|
|
// PMM is optional, don't revert if it fails
|
|
if (!success) {
|
|
// Log or handle PMM failure gracefully
|
|
}
|
|
}
|
|
|
|
/**
|
|
* @notice Execute bridge with vault
|
|
*/
|
|
function _executeBridgeWithVault(BridgeOperation calldata op) internal {
|
|
if (vaultFactory == address(0)) return;
|
|
|
|
// Get or create vault for user
|
|
address vault = userVaults[msg.sender];
|
|
if (vault == address(0)) {
|
|
// Call vault factory to create vault
|
|
(bool success, bytes memory data) = vaultFactory.call(
|
|
abi.encodeWithSignature("createVault(address)", msg.sender)
|
|
);
|
|
if (success) {
|
|
vault = abi.decode(data, (address));
|
|
userVaults[msg.sender] = vault;
|
|
}
|
|
}
|
|
|
|
// If vault exists, record operation
|
|
if (vault != address(0)) {
|
|
// Call vault to record bridge operation
|
|
(bool ok, ) = vault.call(
|
|
abi.encodeWithSignature(
|
|
"recordBridgeOperation(bytes32,address,uint256,uint64)",
|
|
bytes32(0), // messageId will be set after CCIP send
|
|
op.token,
|
|
op.amount,
|
|
op.destinationChain
|
|
)
|
|
);
|
|
if (!ok) {
|
|
// Vault recording is optional; ignore failure
|
|
}
|
|
}
|
|
}
|
|
|
|
/**
|
|
* @notice Send CCIP message
|
|
*/
|
|
function _sendCCIPMessage(
|
|
BridgeOperation calldata op,
|
|
Destination memory dest
|
|
) internal returns (bytes32 messageId) {
|
|
// Encode message data
|
|
bytes memory data = abi.encode(
|
|
op.recipient,
|
|
op.amount,
|
|
msg.sender,
|
|
nonces[msg.sender]
|
|
);
|
|
|
|
// Prepare CCIP message
|
|
IRouterClient.EVM2AnyMessage memory message = IRouterClient.EVM2AnyMessage({
|
|
receiver: abi.encode(dest.receiverBridge),
|
|
data: data,
|
|
tokenAmounts: new IRouterClient.TokenAmount[](1),
|
|
feeToken: address(0), // Pay in native
|
|
extraArgs: ""
|
|
});
|
|
|
|
// Set token amount
|
|
message.tokenAmounts[0] = IRouterClient.TokenAmount({
|
|
token: op.token,
|
|
amount: op.amount,
|
|
amountType: IRouterClient.TokenAmountType.Fiat
|
|
});
|
|
|
|
// Calculate fee
|
|
uint256 fee = ccipRouter.getFee(op.destinationChain, message);
|
|
require(address(this).balance >= fee, "Insufficient fee");
|
|
|
|
// Send via CCIP
|
|
(messageId, ) = ccipRouter.ccipSend{value: fee}(op.destinationChain, message);
|
|
|
|
return messageId;
|
|
}
|
|
|
|
/**
|
|
* @notice Add destination for token
|
|
*/
|
|
function addDestination(
|
|
address token,
|
|
uint64 chainSelector,
|
|
address receiverBridge
|
|
) external onlyRole(BRIDGE_OPERATOR_ROLE) {
|
|
require(token != address(0), "Zero token");
|
|
require(receiverBridge != address(0), "Zero receiver");
|
|
|
|
destinations[token][chainSelector] = Destination({
|
|
receiverBridge: receiverBridge,
|
|
enabled: true,
|
|
addedAt: block.timestamp
|
|
});
|
|
|
|
emit DestinationAdded(token, chainSelector, receiverBridge);
|
|
}
|
|
|
|
/**
|
|
* @notice Remove destination
|
|
*/
|
|
function removeDestination(
|
|
address token,
|
|
uint64 chainSelector
|
|
) external onlyRole(BRIDGE_OPERATOR_ROLE) {
|
|
destinations[token][chainSelector].enabled = false;
|
|
|
|
emit DestinationRemoved(token, chainSelector);
|
|
}
|
|
|
|
/**
|
|
* @notice Set liquidity manager
|
|
*/
|
|
function setLiquidityManager(address _liquidityManager) external onlyRole(DEFAULT_ADMIN_ROLE) {
|
|
liquidityManager = _liquidityManager;
|
|
}
|
|
|
|
/**
|
|
* @notice Set vault factory
|
|
*/
|
|
function setVaultFactory(address _vaultFactory) external onlyRole(DEFAULT_ADMIN_ROLE) {
|
|
vaultFactory = _vaultFactory;
|
|
}
|
|
|
|
/**
|
|
* @notice Receive native tokens
|
|
*/
|
|
receive() external payable {}
|
|
|
|
/**
|
|
* @notice Withdraw native tokens
|
|
*/
|
|
function withdraw() external onlyRole(DEFAULT_ADMIN_ROLE) {
|
|
payable(msg.sender).transfer(address(this).balance);
|
|
}
|
|
|
|
// View functions
|
|
|
|
function getDestination(address token, uint64 chainSelector)
|
|
external view returns (Destination memory) {
|
|
return destinations[token][chainSelector];
|
|
}
|
|
|
|
function getUserVault(address user) external view returns (address) {
|
|
return userVaults[user];
|
|
}
|
|
|
|
function getUserNonce(address user) external view returns (uint256) {
|
|
return nonces[user];
|
|
}
|
|
}
|