From 48189cbec9ba8eff936ea39f67c404f97cc1398d Mon Sep 17 00:00:00 2001 From: Pascal Marco Caversaccio Date: Tue, 25 Feb 2025 15:16:43 +0100 Subject: [PATCH 1/8] =?UTF-8?q?=F0=9F=94=92=20Add=20Warning=20for=20`deleg?= =?UTF-8?q?atecall`s?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Pascal Marco Caversaccio --- safe_hashes.sh | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/safe_hashes.sh b/safe_hashes.sh index 6e11809..7d0d37f 100755 --- a/safe_hashes.sh +++ b/safe_hashes.sh @@ -425,6 +425,21 @@ validate_nonce() { fi } +# Utility function to warn the user if the transaction includes a delegate call. +warn_if_delegate_call() { + local operation="$1" + # Warn the user if `operation` equals `1`, implying a `delegatecall`. + # See: https://github.com/safe-global/safe-smart-account/blob/34359e8305d618b7d74e39ed370a6b59ab14f827/contracts/libraries/Enum.sol. + if [[ "$operation" -eq 1 ]]; then + echo + cat < Date: Tue, 25 Feb 2025 19:18:52 +0100 Subject: [PATCH 3/8] =?UTF-8?q?=F0=9F=94=92=20Add=20`SafeToL2Setup`?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Pascal Marco Caversaccio --- safe_hashes.sh | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/safe_hashes.sh b/safe_hashes.sh index 640f6f4..b8f2830 100755 --- a/safe_hashes.sh +++ b/safe_hashes.sh @@ -115,6 +115,12 @@ declare -a -r SafeToL2Migration=( "0xfF83F6335d8930cBad1c0D439A841f01888D9f69" # SafeToL2Migration `v1.4.1` (canonical). ) +# Set the trusted (i.e. for delegate calls) `SafeToL2Setup` addresses: +# SafeToL2Setup `v1.4.1` (canonical): https://github.com/safe-global/safe-deployments/blob/4e25b09f62a4acec92b4ebe6b8ae496b3852d440/src/assets/v1.4.1/safe_to_l2_setup.json#L7. +declare -a -r SafeToL2Setup=( + "0xBD89A1CE4DDe368FFAB0eC35506eEcE0b1fFdc54" # SafeToL2Setup `v1.4.1` (canonical). +) + # Set the trusted (i.e. for delegate calls) `SignMessageLib` addresses: # SignMessageLib `v1.3.0` (canonical): https://github.com/safe-global/safe-deployments/blob/4e25b09f62a4acec92b4ebe6b8ae496b3852d440/src/assets/v1.3.0/sign_message_lib.json#L7, # SignMessageLib `v1.3.0` (eip155): https://github.com/safe-global/safe-deployments/blob/4e25b09f62a4acec92b4ebe6b8ae496b3852d440/src/assets/v1.3.0/sign_message_lib.json#L11, @@ -134,6 +140,7 @@ declare -A -r TRUSTED_FOR_DELEGATE_CALL=( ["MultiSendCallOnly"]="${MultiSendCallOnly[@]}" ["SafeMigration"]="${SafeMigration[@]}" ["SafeToL2Migration"]="${SafeToL2Migration[@]}" + ["SafeToL2Setup"]="${SafeToL2Setup[@]}" ["SignMessageLib"]="${SignMessageLib[@]}" ) From 3a6f434f2dad0c57d7fff57b3d362b7120de6364 Mon Sep 17 00:00:00 2001 From: Pascal Marco Caversaccio Date: Wed, 26 Feb 2025 20:42:40 +0100 Subject: [PATCH 4/8] =?UTF-8?q?=E2=99=BB=EF=B8=8F=20=20Fix=20X=20Layer=20C?= =?UTF-8?q?hain=20ID?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Pascal Marco Caversaccio --- README.md | 2 +- safe_hashes.sh | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 5ae85d8..f23f938 100644 --- a/README.md +++ b/README.md @@ -44,7 +44,7 @@ This Bash [script](./safe_hashes.sh) calculates the Safe transaction hashes by r - Scroll (identifier: `scroll`, chain ID: `534352`) - Sepolia (identifier: `sepolia`, chain ID: `11155111`) - World Chain (identifier: `worldchain`, chain ID: `480`) -- X Layer (identifier: `xlayer`, chain ID: `195`) +- X Layer (identifier: `xlayer`, chain ID: `196`) - ZKsync Era (identifier: `zksync`, chain ID: `324`) ## Usage diff --git a/safe_hashes.sh b/safe_hashes.sh index b8f2830..cd759c0 100755 --- a/safe_hashes.sh +++ b/safe_hashes.sh @@ -191,7 +191,7 @@ declare -A -r CHAIN_IDS=( ["scroll"]="534352" ["sepolia"]="11155111" ["worldchain"]="480" - ["xlayer"]="195" + ["xlayer"]="196" ["zksync"]="324" ) From edfa2aff4633ce593057a4c9567a5ef7be564607 Mon Sep 17 00:00:00 2001 From: Pascal Marco Caversaccio Date: Thu, 27 Feb 2025 08:30:25 +0100 Subject: [PATCH 5/8] =?UTF-8?q?=E2=99=BB=EF=B8=8F=20=20Update=20UI=20Link?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Pascal Marco Caversaccio --- README.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index f23f938..6864296 100644 --- a/README.md +++ b/README.md @@ -269,10 +269,10 @@ Safe message hash: 0x1866b559f56261ada63528391b93a1fe8e2e33baf7cace94fc6b42202d1 ## Community-Maintained User Interface Implementations > [!IMPORTANT] -> Please be aware that user interface implementations may introduce additional trust assumptions, such as relying on `npm` dependencies that have not undergone thorough review. Always verify and cross-reference with the main [script](./safe_hashes.sh). +> Please be aware that user interface implementations may introduce additional trust assumptions, such as relying on `npm` dependencies that have not undergone thorough review or a deployment process that could be compromised by an attacker. Always verify and cross-reference with the main [script](./safe_hashes.sh). -- [`safehashpreview.com`](https://www.safehashpreview.com): - - Code: [`josepchetrit12/safe-tx-hashes-util`](https://github.com/josepchetrit12/safe-tx-hashes-util) +- [`safeutils.openzeppelin.com`](https://safeutils.openzeppelin.com): + - Code: [`OpenZeppelin/safe-utils`](https://github.com/OpenZeppelin/safe-utils) - Authors: [`josepchetrit12`](https://github.com/josepchetrit12), [`xaler5`](https://github.com/xaler5) [^1]: It is theoretically possible to query transactions prior to the first signature; however, this functionality is not incorporated into the main [script](https://github.com/pcaversaccio/safe-tx-hashes-util/blob/main/safe_hashes.sh). To do so, you would proceed through the [Safe UI](https://app.safe.global) as usual, stopping at the page where the transaction is signed or executed. At this point, the action is recorded in the [Safe Transaction Service API](https://docs.safe.global/core-api/transaction-service-overview), allowing you to retrieve the unsigned transaction by setting `trusted=false` in the [API](https://docs.safe.global/core-api/transaction-service-reference/mainnet#List-a-Safe's-Multisig-Transactions) query within your Bash script. For example, you might use a query such as: `https://safe-transaction-arbitrum.safe.global/api/v1/safes/0xB24A3AA250E209bC95A4a9afFDF10c6D099B3d34/multisig-transactions/?trusted=false&nonce=4`. This decision to not implement this feature avoids potential confusion caused by unsigned transactions in the queue, especially when multiple transactions share the same nonce, making it unclear which one to act upon. If this feature aligns with your needs, feel free to fork the [script](https://github.com/pcaversaccio/safe-tx-hashes-util/blob/main/safe_hashes.sh) and modify it as necessary. From 31b6ac25e3f7187f4351ba2a74d146601eb25f7e Mon Sep 17 00:00:00 2001 From: Pascal Marco Caversaccio Date: Wed, 5 Mar 2025 11:43:54 +0100 Subject: [PATCH 6/8] =?UTF-8?q?=F0=9F=93=96=20Update=20Branding=20Name=20f?= =?UTF-8?q?or=20BSC=20and=20OP?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Pascal Marco Caversaccio --- README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 6864296..b4865e4 100644 --- a/README.md +++ b/README.md @@ -31,14 +31,14 @@ This Bash [script](./safe_hashes.sh) calculates the Safe transaction hashes by r - Base (identifier: `base`, chain ID: `8453`) - Base Sepolia (identifier: `base-sepolia`, chain ID: `84532`) - Blast (identifier: `blast`, chain ID: `81457`) -- BSC (Binance Smart Chain) (identifier: `bsc`, chain ID: `56`) +- BSC (BNB Smart Chain) (identifier: `bsc`, chain ID: `56`) - Celo (identifier: `celo`, chain ID: `42220`) - Ethereum (identifier: `ethereum`, chain ID: `1`) - Gnosis (identifier: `gnosis`, chain ID: `100`) - Gnosis Chiado (identifier: `gnosis-chiado`, chain ID: `10200`) - Linea (identifier: `linea`, chain ID: `59144`) - Mantle (identifier: `mantle`, chain ID: `5000`) -- Optimism (identifier: `optimism`, chain ID: `10`) +- OP (Optimism) (identifier: `optimism`, chain ID: `10`) - Polygon (identifier: `polygon`, chain ID: `137`) - Polygon zkEVM (identifier: `polygon-zkevm`, chain ID: `1101`) - Scroll (identifier: `scroll`, chain ID: `534352`) From e639f9ddf1b280ee0a189ced8e8db852360d0eaf Mon Sep 17 00:00:00 2001 From: Pascal Marco Caversaccio Date: Wed, 5 Mar 2025 18:50:00 +0100 Subject: [PATCH 7/8] =?UTF-8?q?=E2=99=BB=EF=B8=8F=20Remove=20`SafeToL2Setu?= =?UTF-8?q?p`=20From=20List?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Pascal Marco Caversaccio --- README.md | 3 +++ safe_hashes.sh | 7 ------- 2 files changed, 3 insertions(+), 7 deletions(-) diff --git a/README.md b/README.md index b4865e4..60f5c7f 100644 --- a/README.md +++ b/README.md @@ -2,6 +2,9 @@ [![License: AGPL-3.0-only](https://img.shields.io/badge/License-AGPL--3.0--only-blue)](https://www.gnu.org/licenses/agpl-3.0) +> [!IMPORTANT] +> This [PR](https://github.com/pcaversaccio/safe-tx-hashes-util/pull/20) introduces a _temporary_ patch to use the [Safe Client Gateway API](https://safe-client.safe.global/api) since the [Safe Transaction Service API](https://docs.safe.global/core-api/transaction-service-overview) is currently unavailable. Please checkout the `feat/use-safe-client-gateway` branch until further notice. + ```console |)0/\/'T TR|\_|5T, \/3R1FY! 🫡 ``` diff --git a/safe_hashes.sh b/safe_hashes.sh index cd759c0..46b5e5a 100755 --- a/safe_hashes.sh +++ b/safe_hashes.sh @@ -115,12 +115,6 @@ declare -a -r SafeToL2Migration=( "0xfF83F6335d8930cBad1c0D439A841f01888D9f69" # SafeToL2Migration `v1.4.1` (canonical). ) -# Set the trusted (i.e. for delegate calls) `SafeToL2Setup` addresses: -# SafeToL2Setup `v1.4.1` (canonical): https://github.com/safe-global/safe-deployments/blob/4e25b09f62a4acec92b4ebe6b8ae496b3852d440/src/assets/v1.4.1/safe_to_l2_setup.json#L7. -declare -a -r SafeToL2Setup=( - "0xBD89A1CE4DDe368FFAB0eC35506eEcE0b1fFdc54" # SafeToL2Setup `v1.4.1` (canonical). -) - # Set the trusted (i.e. for delegate calls) `SignMessageLib` addresses: # SignMessageLib `v1.3.0` (canonical): https://github.com/safe-global/safe-deployments/blob/4e25b09f62a4acec92b4ebe6b8ae496b3852d440/src/assets/v1.3.0/sign_message_lib.json#L7, # SignMessageLib `v1.3.0` (eip155): https://github.com/safe-global/safe-deployments/blob/4e25b09f62a4acec92b4ebe6b8ae496b3852d440/src/assets/v1.3.0/sign_message_lib.json#L11, @@ -140,7 +134,6 @@ declare -A -r TRUSTED_FOR_DELEGATE_CALL=( ["MultiSendCallOnly"]="${MultiSendCallOnly[@]}" ["SafeMigration"]="${SafeMigration[@]}" ["SafeToL2Migration"]="${SafeToL2Migration[@]}" - ["SafeToL2Setup"]="${SafeToL2Setup[@]}" ["SignMessageLib"]="${SignMessageLib[@]}" ) From b7f17b974c81b27bf6a24c5f13d9da9ee591a1c9 Mon Sep 17 00:00:00 2001 From: Pascal Marco Caversaccio Date: Wed, 5 Mar 2025 18:59:53 +0100 Subject: [PATCH 8/8] =?UTF-8?q?=E2=99=BB=EF=B8=8F=20=20Add=20Missing=20Par?= =?UTF-8?q?ameter?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Pascal Marco Caversaccio --- safe_hashes.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/safe_hashes.sh b/safe_hashes.sh index 46b5e5a..ffb31cf 100755 --- a/safe_hashes.sh +++ b/safe_hashes.sh @@ -684,7 +684,7 @@ EOF local data_decoded=$(echo "$response" | jq -r ".results[$idx].dataDecoded // \"0x\"") # Warn the user if the transaction includes an untrusted delegate call. - warn_if_delegate_call "$operation" + warn_if_delegate_call "$operation" "$to" # Calculate and display the hashes. echo "==================================="