BLOCKCHAIN-234 + BLOCKCHAIN-235 + BLOCKCHAIN-236 - bridge - set limits on values controlled by admin

bin/node/runtime/src/lib.rs

@@ -1575,6 +1575,9 @@ parameter_types! {
 	);
 	pub const LLMMaxTotalLocked: Balance = 100_000 * GRAINS_IN_LLM;
 	pub const LLMMinimumTransfer: Balance = 10 * GRAINS_IN_LLM;
+	pub const BridgeMinimumFee: Balance = 10 * CENTS;
+	pub const BridgeMaximumFee: Balance = 10 * DOLLARS;
+	pub const BridgeMinimumVotesRequired: u32 = 3;
 }
 
 type EthLLDBridgeInstance = pallet_federated_bridge::Instance1;
@@ -1590,6 +1593,9 @@ impl pallet_federated_bridge::Config<EthLLDBridgeInstance> for Runtime {
 	type WithdrawalRateLimit = LLDRateLimit;
 	type MaxTotalLocked = LLDMaxTotalLocked;
 	type MinimumTransfer = LLDMinimumTransfer;
+	type MinimumFee = BridgeMinimumFee;
+	type MaximumFee = BridgeMaximumFee;
+	type MinimumVotesRequired = BridgeMinimumVotesRequired;
 	type WeightInfo = ();
 }
 
@@ -1606,6 +1612,9 @@ impl pallet_federated_bridge::Config<EthLLMBridgeInstance> for Runtime {
 	type WithdrawalRateLimit = LLMRateLimit;
 	type MaxTotalLocked = LLMMaxTotalLocked;
 	type MinimumTransfer = LLMMinimumTransfer;
+	type MinimumFee = BridgeMinimumFee;
+	type MaximumFee = BridgeMaximumFee;
+	type MinimumVotesRequired = BridgeMinimumVotesRequired;
 	type WeightInfo = ();
 }
 

eth-bridge/contracts/.solhint.json

@@ -7,7 +7,7 @@
     "modifier-name-mixedcase": "error",
     "named-parameters-mapping": "error",
     "private-vars-leading-underscore": ["error",{"strict":true}],
-    "ordering": "warn",
-    "func-visibility": ["warn",{"ignoreConstructors":true}]
+    "func-visibility": ["warn",{"ignoreConstructors":true}],
+    "max-states-count": "off"
   }
 }

eth-bridge/contracts/script/Deploy.s.sol

@@ -40,8 +40,12 @@ contract Deploy is Script {
                     fee,
                     30_000_000_000_000_000, // max burst mint
                     60_000_000_000_000, // rate limit counter decay
-                    300_000_000_000_000_000, // max total supply
-                    30_000_000_000_000 // min transfer
+                    300_000_000_000_000_000, // supply limit
+                    30_000_000_000_000, // min transfer
+                    3_000_000_000_000_000_000, // max supply limit
+                    1_000_000 gwei, // min fee
+                    100_000_000 gwei, // max fee
+                    3 // min votes required
                 )
             )
         );
@@ -67,8 +71,12 @@ contract Deploy is Script {
                     fee,
                     10_000_000_000_000_000, // max burst mint
                         20_000_000_000_000, // rate limit counter decay
-                    100_000_000_000_000_000, // max total supply
-                    10_000_000_000_000 // min transfer
+                    100_000_000_000_000_000, // supply limit
+                    10_000_000_000_000, // min transfer
+                    1_000_000_000_000_000_000, // max supply limit
+                    1_000_000 gwei, // min fee
+                    100_000_000 gwei, // max fee
+                    3 // min votes required
                 )
             )
         );

eth-bridge/contracts/script/UpgradeBridgesToV2.s.sol

@@ -0,0 +1,40 @@
+// SPDX-License-Identifier: UNLICENSED
+pragma solidity ^0.8.18;
+
+import "forge-std/Script.sol";
+import "../src/Bridge.sol";
+
+contract UpgradeBridgesToV2 is Script {
+    function run() external {
+        vm.startBroadcast();
+        Bridge lldProxy = Bridge(vm.envAddress("LLDBridgeProxy"));
+        Bridge llmProxy = Bridge(vm.envAddress("LLMBridgeProxy"));
+
+        Bridge newBridgeImpl = new Bridge();
+
+        lldProxy.upgradeToAndCall(
+            address(newBridgeImpl),
+            abi.encodeCall(
+                Bridge.initializeV2,
+                (
+                    3_000_000_000_000_000_000, // max supply limit of 3M LLD, admin can lower it
+                    1_000_000 gwei, // min fee
+                    100_000_000 gwei, // max fee
+                    3 // min votes required
+                )
+            )
+        );
+        llmProxy.upgradeToAndCall(
+            address(newBridgeImpl),
+            abi.encodeCall(
+                Bridge.initializeV2,
+                (
+                    1_000_000_000_000_000_000, // max supply limit of 3M LLD, admin can lower it
+                    1_000_000 gwei, // min fee
+                    100_000_000 gwei, // max fee
+                    3 // min votes required
+                )
+            )
+        );
+    }
+}

eth-bridge/contracts/src/Bridge.sol

@@ -94,6 +94,14 @@ contract Bridge is Initializable, AccessControlUpgradeable, UUPSUpgradeable, Bri
     RateLimitParameters public rateLimit; // 2x uint256
     /// Minimum transfer - only applied for burns
     uint256 public minTransfer;
+    /// Maximum supply limit - admin can't increase supply limit above this value
+    uint256 public maxSupplyLimit;
+    /// Minimum fee that admin can set
+    uint256 public minFee;
+    /// Maximum fee that admin can set
+    uint256 public maxFee;
+    /// Minimum votes required that admin can set
+    uint256 public minVotesRequired;
 
     constructor() {
         _disableInitializers();
@@ -108,7 +116,28 @@ contract Bridge is Initializable, AccessControlUpgradeable, UUPSUpgradeable, Bri
     /// @param decayRate initial `rateLimit.decayRate`
     /// @param supplyLimit_ initial `supplyLimit`
     /// @param minTransfer_ initial `minTransfer`
+    /// @param maxSupplyLimit_ maximum `supplyLimit` that can be set by admin
+    /// @param minFee_ minimum `fee` that can be set by admin
+    /// @param maxFee_ maximum `fee` that can be set by admin
     function initialize(
+        WrappedToken token_,
+        uint32 votesRequired_,
+        uint256 mintDelay_,
+        uint256 fee_,
+        uint256 counterLimit,
+        uint256 decayRate,
+        uint256 supplyLimit_,
+        uint256 minTransfer_,
+        uint256 maxSupplyLimit_,
+        uint256 minFee_,
+        uint256 maxFee_,
+        uint256 minVotesRequired_
+    ) external {
+        _initializeV1(token_, votesRequired_, mintDelay_, fee_, counterLimit, decayRate, supplyLimit_, minTransfer_);
+        initializeV2(maxSupplyLimit_, minFee_, maxFee_, minVotesRequired_);
+    }
+
+    function _initializeV1(
         WrappedToken token_,
         uint32 votesRequired_,
         uint256 mintDelay_,
@@ -117,7 +146,7 @@ contract Bridge is Initializable, AccessControlUpgradeable, UUPSUpgradeable, Bri
         uint256 decayRate,
         uint256 supplyLimit_,
         uint256 minTransfer_
-    ) public initializer {
+    ) internal initializer {
         __AccessControl_init();
         __UUPSUpgradeable_init();
 
@@ -134,6 +163,18 @@ contract Bridge is Initializable, AccessControlUpgradeable, UUPSUpgradeable, Bri
         _grantRole(SUPER_ADMIN_ROLE, msg.sender);
     }
 
+    /// Reinitializer from v1 to v2. Should be used in the same tx as upgrade
+    /// @param maxSupplyLimit_ maximum `supplyLimit` that can be set by admin
+    function initializeV2(uint256 maxSupplyLimit_, uint256 minFee_, uint256 maxFee_, uint256 minVotesRequired_)
+        public
+        reinitializer(2)
+    {
+        maxSupplyLimit = maxSupplyLimit_;
+        minFee = minFee_;
+        maxFee = maxFee_;
+        minVotesRequired = minVotesRequired_;
+    }
+
     /// Adding special users. See role docs on info who can grant each role
     /// @param role Role to grant
     /// @param account Account to grant the role to
@@ -295,7 +336,11 @@ contract Bridge is Initializable, AccessControlUpgradeable, UUPSUpgradeable, Bri
     /// Set the minting fee
     /// @param fee_ New minting fee
     /// @dev Only addresses with ADMIN_ROLE can call this
+    /// @dev Will revert with InvalidArgument if outside [minFee,maxFee] range
     function setFee(uint256 fee_) public onlyRole(ADMIN_ROLE) {
+        if (fee_ > maxFee || fee_ < minFee) {
+            revert InvalidArgument();
+        }
         fee = fee_;
     }
 
@@ -304,7 +349,7 @@ contract Bridge is Initializable, AccessControlUpgradeable, UUPSUpgradeable, Bri
     /// @dev Only addresses with SUPER_ADMIN_ROLE can call this
     /// @dev Reverts with `InvalidArgument` if `votesRequired_` is 0
     function setVotesRequired(uint32 votesRequired_) public onlyRole(SUPER_ADMIN_ROLE) {
-        if (votesRequired_ == 0) revert InvalidArgument();
+        if (votesRequired_ < minVotesRequired) revert InvalidArgument();
         votesRequired = votesRequired_;
     }
 
@@ -361,7 +406,11 @@ contract Bridge is Initializable, AccessControlUpgradeable, UUPSUpgradeable, Bri
     /// Set max circulating token supply
     /// @param supplyLimit_ new supply limit
     /// @dev Only addresses with SUPER_ADMIN_ROLE can call this
+    /// @dev Reverts with `InvalidArgument` if `supplyLimit_` is greater than original limit set in constructor
     function setSupplyLimit(uint256 supplyLimit_) public onlyRole(SUPER_ADMIN_ROLE) {
+        if (supplyLimit_ > maxSupplyLimit) {
+            revert InvalidArgument();
+        }
         supplyLimit = supplyLimit_;
     }