Release aragonOS 4.2.0 #505
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
* fix: Use double quotes in contract imports * fix: add source location of ENS contracts
Updates the tests to use `EMPTY_BYTES` and `ZERO_ADDR` constants (should move these out to a shared lib sometime). Also fixes a few instances where we sent an invalid number of hex bytes (usually 1-length bytes like `0x1`; see trufflesuite/ganache#283 (comment)).
Consolidates all the bytes<>uint256[] conversions into a library. It's not _too_ costly to add, and hopefully makes us all feel a bit better about this bit 😄. Also fixes the solidity test runner, which must've broke at some point along the way (due to the assert logs not being decoded properly) 😅.
…nd forward error data (#496)
There are publicly exposed interfaces that expect `bytes` and immediately turn them into `uint256[]` (e.g. `hasPermission()` in the ACL and Kernel. There might be some cases where the truncation could lead to Bad Things<sup>TM</sup>, like the ACL being tricked into thinking a contract had permission to do something when it actually didn't. We never use the `bytes` form of `hasPermission()` directly ourselves, so this isn't exploitable, but could be if an external contract decided to.
`EVMScriptRunner` was previously assuming its executor would always return correctly ABI-encoded data of type `bytes`, which are at least 64 bytes in length (32 bytes for position and 32 bytes for actual data). Although an underflow here would've simply caused an out-of-gas error on trying to copy too much memory, reverting with an error message is much more friendly.
…ory (#511) Needed for the Aragon 0.7 re-deployment of kits, which will have an upgraded `DAOFactory` but keeping the bases for `ACL` and `Kernel` of the current deployment.
|
This has now completed security review by @wadealexc. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Bytecode diff:
Had to fight git a little bit with this PR since I didn't properly remake the
devbranch on the last publish 🤦♂️. I should also write a bit of documentation in the CONTRIBUTING.md to formalize the steps (never use the rebase merge sincedevis the default branch).