2026 02 05 audit

.gas-snapshot

@@ -1,6 +1,8 @@
-CloneFactoryCloneTest:testCloneBytecode(bytes) (runs: 2048, μ: 371392, ~: 361967)
-CloneFactoryCloneTest:testCloneInitializeData(bytes) (runs: 2048, μ: 376530, ~: 366844)
-CloneFactoryCloneTest:testCloneInitializeEvent(bytes) (runs: 2048, μ: 377279, ~: 367854)
-CloneFactoryCloneTest:testCloneInitializeFailureFails(bytes32) (runs: 2048, μ: 173411, ~: 173411)
-CloneFactoryCloneTest:testCloneUninitializableFails(address,bytes) (runs: 2048, μ: 10029, ~: 9967)
-CloneFactoryCloneTest:testZeroImplementationCodeSizeError(address,bytes) (runs: 2046, μ: 10812, ~: 10790)
+CloneFactoryCloneTest:testCloneBytecode(bytes) (runs: 2048, μ: 350833, ~: 341941)
+CloneFactoryCloneTest:testCloneInitializeData(bytes) (runs: 2048, μ: 355388, ~: 346399)
+CloneFactoryCloneTest:testCloneInitializeEvent(bytes) (runs: 2048, μ: 356010, ~: 347118)
+CloneFactoryCloneTest:testCloneInitializeFailureFails(bytes32) (runs: 2048, μ: 159643, ~: 159643)
+CloneFactoryCloneTest:testCloneUninitializableFails(address,bytes) (runs: 2048, μ: 9882, ~: 9844)
+CloneFactoryCloneTest:testZeroImplementationCodeSizeError(address,bytes) (runs: 2048, μ: 10539, ~: 10557)
+LibCloneFactoryDeployTest:testDeployAddress() (gas: 242794)
+LibCloneFactoryDeployTest:testExpectedCodeHash() (gas: 235395)

.github/workflows/manual-sol-artifacts.yaml

@@ -2,42 +2,11 @@ name: Manual sol artifacts
 on:
   workflow_dispatch:
     inputs:
-      network:
-        description: 'Network to deploy to'
-        required: true
-        type: choice
-        options:
-          - arbitrum
-          - arbitrum_sepolia
-          - avalanche
-          - base
-          - base_sepolia
-          - bsc
-          - ethereum
-          - flare
-          - mumbai
-          - oasis_sapphire
-          - polygon
-          - sepolia
-          - songbird
-          - amoy
-          - epn
 
 jobs:
   deploy:
     runs-on: ubuntu-latest
-    env:
-      DEPLOYMENT_KEY: ${{ github.ref == 'refs/heads/main' && secrets.PRIVATE_KEY || secrets.PRIVATE_KEY_DEV }}
     steps:
-      - run: |
-          network=${{ inputs.network }}
-          echo "etherscan_api_key_secret_name=CI_DEPLOY_${network^^}_ETHERSCAN_API_KEY" >> $GITHUB_ENV
-          echo "rpc_secret_name=CI_DEPLOY_${network^^}_RPC_URL" >> $GITHUB_ENV
-          echo "verify_secret_name=CI_DEPLOY_${network^^}_VERIFY" >> $GITHUB_ENV
-          echo "verifier_secret_name=CI_DEPLOY_${network^^}_VERIFIER" >> $GITHUB_ENV
-          echo "verifier_url_secret_name=CI_DEPLOY_${network^^}_VERIFIER_URL" >> $GITHUB_ENV
-          echo "metaboard_address_secret_name=CI_DEPLOY_${network^^}_METABOARD_ADDRESS" >> $GITHUB_ENV
-
       - uses: actions/checkout@v4
         with:
           submodules: recursive
@@ -47,14 +16,17 @@ jobs:
       - uses: DeterminateSystems/magic-nix-cache-action@v2
 
       - run: nix develop -c rainix-sol-prelude
-      - name: deploy to ${{ inputs.network }}
-        run: nix develop -c rainix-sol-artifacts
+      - run: nix develop -c forge selectors up --all
+      - run: nix develop -c forge script script/Deploy.sol:Deploy -vvvvv --slow --broadcast --verify
         env:
-          DEPLOY_BROADCAST: '1'
           DEPLOYMENT_KEY: ${{ github.ref == 'refs/heads/main' && secrets.PRIVATE_KEY || secrets.PRIVATE_KEY_DEV }}
-          ETH_RPC_URL: ${{ secrets[env.rpc_secret_name] || vars[env.rpc_secret_name] || '' }}
-          ETHERSCAN_API_KEY: ${{ secrets[env.etherscan_api_key_secret_name] || vars[env.etherscan_api_key_secret_name] || ''}}
-          DEPLOY_VERIFY: ${{ secrets[env.verify_secret_name] || vars[env.verify_secret_name] || '' }}
-          DEPLOY_VERIFIER: ${{ secrets[env.verifier_secret_name] || vars[env.verifier_secret_name] || '' }}
-          DEPLOY_VERIFIER_URL: ${{ secrets[env.verifier_url_secret_name] || vars[env.verifier_url_secret_name] || '' }}
-          DEPLOY_METABOARD_ADDRESS: ${{ secrets[env.metaboard_address_secret_name] || vars[env.metaboard_address_secret_name] || '' }}
+
+          CI_DEPLOY_ARBITRUM_RPC_URL: ${{ secrets.CI_DEPLOY_ARBITRUM_RPC_URL || vars.CI_DEPLOY_ARBITRUM_RPC_URL || '' }}
+          CI_DEPLOY_BASE_RPC_URL: ${{ secrets.CI_DEPLOY_BASE_RPC_URL || vars.CI_DEPLOY_BASE_RPC_URL || '' }}
+          CI_DEPLOY_FLARE_RPC_URL: ${{ secrets.CI_DEPLOY_FLARE_RPC_URL || vars.CI_DEPLOY_FLARE_RPC_URL || '' }}
+          CI_DEPLOY_POLYGON_RPC_URL: ${{ secrets.CI_DEPLOY_POLYGON_RPC_URL || vars.CI_DEPLOY_POLYGON_RPC_URL || '' }}
+
+          CI_DEPLOY_ARBITRUM_ETHERSCAN_API_KEY: ${{ secrets.CI_DEPLOY_ARBITRUM_ETHERSCAN_API_KEY || vars.CI_DEPLOY_ARBITRUM_ETHERSCAN_API_KEY || '' }}
+          CI_DEPLOY_BASE_ETHERSCAN_API_KEY: ${{ secrets.CI_DEPLOY_BASE_ETHERSCAN_API_KEY || vars.CI_DEPLOY_BASE_ETHERSCAN_API_KEY || '' }}
+          CI_DEPLOY_FLARE_ETHERSCAN_API_KEY: ${{ secrets.CI_DEPLOY_FLARE_ETHERSCAN_API_KEY || vars.CI_DEPLOY_FLARE_ETHERSCAN_API_KEY || '' }}
+          CI_DEPLOY_POLYGON_ETHERSCAN_API_KEY: ${{ secrets.CI_DEPLOY_POLYGON_ETHERSCAN_API_KEY || vars.CI_DEPLOY_POLYGON_ETHERSCAN_API_KEY || '' }}

.github/workflows/rainix.yaml

@@ -26,6 +26,7 @@ jobs:
       - name: Run ${{ matrix.task }}
         env:
           ETH_RPC_URL: ${{ secrets.CI_DEPLOY_RPC_URL }}
+          CI_FORK_ETH_RPC_URL: ${{ secrets.RPC_URL_ETHEREUM_FORK || vars.RPC_URL_ETHEREUM_FORK || '' }}
           ETHERSCAN_API_KEY: ${{ secrets.EXPLORER_VERIFICATION_KEY }}
           DEPLOY_VERIFIER: 'etherscan'
         run: nix develop -c ${{ matrix.task }}

.gitignore

@@ -1,3 +1,4 @@
 out
 cache
-result
+result
+.env

.gitmodules

@@ -7,3 +7,6 @@
 [submodule "lib/forge-std"]
 	path = lib/forge-std
 	url = https://github.com/foundry-rs/forge-std
+[submodule "lib/rain.deploy"]
+	path = lib/rain.deploy
+	url = https://github.com/rainlanguage/rain.deploy

foundry.lock

@@ -1,11 +1,14 @@
 {
   "lib/forge-std": {
-    "rev": "b8f065fda83b8cd94a6b2fec8fcd911dc3b444fd"
+    "rev": "1801b0541f4fda118a10798fd3486bb7051c5dd6"
   },
   "lib/openzeppelin-contracts": {
     "rev": "fcbae5394ae8ad52d8e580a3477db99814b9d565"
   },
+  "lib/rain.deploy": {
+    "rev": "e419a46e2a1317a63639ac13fc5a22d7e967fbef"
+  },
   "lib/rain.extrospection": {
-    "rev": "57b600f44084b6c678d680b813463f2197087921"
+    "rev": "ab33ddb8b64d7566edfb15a775d86c536c977181"
   }
 }

foundry.toml

@@ -11,10 +11,28 @@ optimizer_runs = 100000
 
 evm_version = "cancun"
 
+bytecode_hash = "none"
+cbor_metadata = false
+
 # Build metadata used for testing rain meta aware contracts in this folder rather
 # than expose ffi to forge.
 fs_permissions = [{ access = "read", path = "./meta"}]
 
+remappings = [
+    "rain.deploy/=lib/rain.deploy/src/"
+]
+
 [fuzz]
 runs = 2048
 
+[rpc_endpoints]
+arbitrum = "${CI_DEPLOY_ARBITRUM_RPC_URL}"
+base = "${CI_DEPLOY_BASE_RPC_URL}"
+flare = "${CI_DEPLOY_FLARE_RPC_URL}"
+polygon = "${CI_DEPLOY_POLYGON_RPC_URL}"
+
+[etherscan]
+arbitrum = { key = "${CI_DEPLOY_ARBITRUM_ETHERSCAN_API_KEY}" }
+base = { key = "${CI_DEPLOY_BASE_ETHERSCAN_API_KEY}" }
+flare = { key = "${CI_DEPLOY_FLARE_ETHERSCAN_API_KEY}" }
+polygon = { key = "${CI_DEPLOY_POLYGON_ETHERSCAN_API_KEY}" }

script/Deploy.sol

@@ -4,16 +4,24 @@ pragma solidity =0.8.25;
 
 import {Script} from "forge-std/Script.sol";
 import {CloneFactory} from "src/concrete/CloneFactory.sol";
+import {LibRainDeploy} from "rain.deploy/lib/LibRainDeploy.sol";
+import {LibCloneFactoryDeploy} from "src/lib/LibCloneFactoryDeploy.sol";
 
 /// @title Deploy
 /// @notice A script that deploys a CloneFactory.
 contract Deploy is Script {
     function run() external {
         uint256 deployerPrivateKey = vm.envUint("DEPLOYMENT_KEY");
 
-        vm.startBroadcast(deployerPrivateKey);
-        CloneFactory cloneFactory = new CloneFactory();
-        (cloneFactory);
-        vm.stopBroadcast();
+        LibRainDeploy.deployAndBroadcastToSupportedNetworks(
+            vm,
+            LibRainDeploy.supportedNetworks(),
+            deployerPrivateKey,
+            type(CloneFactory).creationCode,
+            "",
+            LibCloneFactoryDeploy.CLONE_FACTORY_DEPLOYED_ADDRESS,
+            LibCloneFactoryDeploy.CLONE_FACTORY_DEPLOYED_CODEHASH,
+            new address[](0)
+        );
     }
 }

src/lib/LibCloneFactoryDeploy.sol

@@ -0,0 +1,22 @@
+// SPDX-License-Identifier: LicenseRef-DCL-1.0
+// SPDX-FileCopyrightText: Copyright (c) 2020 Rain Open Source Software Ltd
+pragma solidity ^0.8.25;
+
+/// @title LibCloneFactoryDeploy
+/// A library containing the deployed address and code hash of the CloneFactory
+/// contract when deployed with the rain standard zoltu deployer. This allows
+/// idempotent deployments against precommitted addresses and hashes that can be
+/// easily verified automatically in tests and scripts rather than relying on
+/// registries or manual verification.
+library LibCloneFactoryDeploy {
+    /// The address of the `CloneFactory` contract when deployed with the rain
+    /// standard zoltu deployer.
+    address constant CLONE_FACTORY_DEPLOYED_ADDRESS = address(0x444acC29d63fa643E8adCC35FD9aa6DE111dCb39);
+
+    /// The code hash of the `CloneFactory` contract when deployed with the rain
+    /// standard zoltu deployer. This can be used to verify that the deployed
+    /// contract has the expected bytecode, which provides stronger guarantees
+    /// than just checking the address.
+    bytes32 constant CLONE_FACTORY_DEPLOYED_CODEHASH =
+        bytes32(0xf21b813c7075a1621285df3a8369d0652c31ea80cb807be1aaadafeecd134475);
+}

test/concrete/CloneFactory.t.sol → test/src/concrete/CloneFactory.t.sol

@@ -4,7 +4,7 @@ pragma solidity =0.8.25;
 
 import {Test, Vm} from "forge-std/Test.sol";
 
-import {LibExtrospectERC1167Proxy} from "rain.extrospection/src/lib/LibExtrospectERC1167Proxy.sol";
+import {LibExtrospectERC1167Proxy} from "rain.extrospection/lib/LibExtrospectERC1167Proxy.sol";
 import {ICloneableV2, ICLONEABLE_V2_SUCCESS} from "src/interface/ICloneableV2.sol";
 import {CloneFactory, ZeroImplementationCodeSize, InitializationFailed} from "src/concrete/CloneFactory.sol";
 

test/src/lib/LibCloneFactoryDeploy.t.sol

@@ -0,0 +1,27 @@
+// SPDX-License-Identifier: LicenseRef-DCL-1.0
+// SPDX-FileCopyrightText: Copyright (c) 2020 Rain Open Source Software Ltd
+pragma solidity =0.8.25;
+
+import {Test} from "forge-std/Test.sol";
+import {LibRainDeploy} from "rain.deploy/lib/LibRainDeploy.sol";
+import {LibCloneFactoryDeploy} from "src/lib/LibCloneFactoryDeploy.sol";
+import {CloneFactory} from "src/concrete/CloneFactory.sol";
+
+contract LibCloneFactoryDeployTest is Test {
+    function testDeployAddress() external {
+        vm.createSelectFork(vm.envString("CI_FORK_ETH_RPC_URL"));
+
+        address deployedAddress = LibRainDeploy.deployZoltu(type(CloneFactory).creationCode);
+
+        assertEq(deployedAddress, LibCloneFactoryDeploy.CLONE_FACTORY_DEPLOYED_ADDRESS);
+        assertTrue(address(deployedAddress).code.length > 0, "Deployed address has no code");
+
+        assertEq(address(deployedAddress).codehash, LibCloneFactoryDeploy.CLONE_FACTORY_DEPLOYED_CODEHASH);
+    }
+
+    function testExpectedCodeHash() external {
+        CloneFactory cloneFactory = new CloneFactory();
+
+        assertEq(address(cloneFactory).codehash, LibCloneFactoryDeploy.CLONE_FACTORY_DEPLOYED_CODEHASH);
+    }
+}