Merge pull request #2916 from rainlanguage/fix-2909-take-orders-length-word

Zero the length word of takeOrders4's orderIOCalculationsToHandle

Author: thedavidmeister

crates/test_fixtures/abis/RaindexV6.json

@@ -385,6 +385,7 @@ contract RaindexV6 is IRaindexV6, IMetaV1_2, ReentrancyGuard, Multicall, Raindex
             assembly ("memory-safe") {
                 let ptr := mload(0x40)
                 orderIOCalculationsToHandle := ptr
+                mstore(ptr, 0)
                 mstore(0x40, add(ptr, mul(add(length, 1), 0x20)))
             }
         }

src/concrete/raindex/RaindexV6.sol

@@ -0,0 +1,82 @@
+// SPDX-License-Identifier: LicenseRef-DCL-1.0
+// SPDX-FileCopyrightText: Copyright (c) 2020 Rain Open Source Software Ltd
+pragma solidity =0.8.25;
+
+import {RaindexV6ExternalRealTest} from "test/util/abstract/RaindexV6ExternalRealTest.sol";
+import {LibRaindexDeploy} from "src/lib/deploy/LibRaindexDeploy.sol";
+import {LibTestTakeOrder} from "test/util/lib/LibTestTakeOrder.sol";
+import {MockToken} from "test/util/concrete/MockToken.sol";
+import {
+    OrderV4,
+    TakeOrderConfigV4,
+    TakeOrdersConfigV5,
+    SignedContextV1,
+    TaskV2
+} from "raindex-interface-0.1.8/src/interface/IRaindexV6.sol";
+import {Float, LibDecimalFloat} from "rain-math-float-0.3.10/src/lib/LibDecimalFloat.sol";
+
+/// @title RaindexV6TakeOrderDirtyFreeMemoryTest
+/// @notice `takeOrders4` settles exactly the taken orders when the memory past
+/// the free memory pointer is nonzero on entry.
+contract RaindexV6TakeOrderDirtyFreeMemoryTest is RaindexV6ExternalRealTest {
+    using LibDecimalFloat for Float;
+
+    address internal owner = address(uint160(uint256(keccak256("owner.rain.test"))));
+    address internal bob = address(uint160(uint256(keccak256("bob.rain.test"))));
+
+    bytes32 internal constant OUTPUT_VAULT_ID = bytes32(uint256(0x01));
+
+    MockToken internal token0;
+    MockToken internal token1;
+
+    constructor() {
+        vm.etch(
+            LibRaindexDeploy.RAINDEX_DEPLOYED_ADDRESS,
+            vm.getDeployedCode("RaindexV6DirtyFreeMemoryHarness.sol:RaindexV6DirtyFreeMemoryHarness")
+        );
+    }
+
+    function setUp() public {
+        token0 = new MockToken("Token Zero", "TK0", 18);
+        token1 = new MockToken("Token One", "TK1", 18);
+    }
+
+    function _deposit(address who, MockToken token, bytes32 vaultId, uint256 amount) internal {
+        token.mint(who, amount * 1e18);
+        vm.startPrank(who);
+        token.approve(address(iRaindex), amount * 1e18);
+        // forge-lint: disable-next-line(unsafe-typecast)
+        iRaindex.deposit4(address(token), vaultId, LibDecimalFloat.packLossless(int256(amount), 0), new TaskV2[](0));
+        vm.stopPrank();
+    }
+
+    function testTakeOrdersDirtyFreeMemorySettlesOnlyTakenOrders() external {
+        _deposit(owner, token1, OUTPUT_VAULT_ID, 10);
+        OrderV4 memory taken = LibTestTakeOrder.addOrderWithExpression(
+            vm, owner, "_ _:3 1;:;", address(token0), bytes32(0), address(token1), OUTPUT_VAULT_ID
+        );
+        OrderV4 memory zeroAmount = LibTestTakeOrder.addOrderWithExpression(
+            vm, owner, "_ _:0 1;:;", address(token0), bytes32(0), address(token1), OUTPUT_VAULT_ID
+        );
+
+        token0.mint(bob, 3e18);
+        vm.prank(bob);
+        token0.approve(address(iRaindex), 3e18);
+
+        TakeOrderConfigV4[] memory orders = new TakeOrderConfigV4[](2);
+        orders[0] = TakeOrderConfigV4(taken, 0, 0, new SignedContextV1[](0));
+        orders[1] = TakeOrderConfigV4(zeroAmount, 0, 0, new SignedContextV1[](0));
+        TakeOrdersConfigV5 memory config = LibTestTakeOrder.defaultTakeConfig(orders);
+        config.maximumIO = LibDecimalFloat.packLossless(10, 0);
+
+        vm.prank(bob);
+        (Float totalTakerInput, Float totalTakerOutput) = iRaindex.takeOrders4(config);
+
+        assertTrue(totalTakerInput.eq(LibDecimalFloat.packLossless(3, 0)), "taker input");
+        assertTrue(totalTakerOutput.eq(LibDecimalFloat.packLossless(3, 0)), "taker output");
+        assertEq(token0.balanceOf(owner), 3e18, "owner wallet");
+        assertEq(token0.balanceOf(bob), 0, "taker token0");
+        assertEq(token1.balanceOf(bob), 3e18, "taker token1");
+        assertEq(token0.balanceOf(address(iRaindex)), 0, "orderbook token0");
+    }
+}

src/generated/candidate/GenericPoolRaindexV6ArbOrderTaker.sol

@@ -0,0 +1,22 @@
+// SPDX-License-Identifier: LicenseRef-DCL-1.0
+// SPDX-FileCopyrightText: Copyright (c) 2020 Rain Open Source Software Ltd
+pragma solidity =0.8.25;
+
+import {RaindexV6} from "src/concrete/raindex/RaindexV6.sol";
+
+/// @dev RaindexV6 whose `nonReentrant` entry fills the memory past the free
+/// memory pointer with nonzero words, so allocations inside guarded functions
+/// cannot rely on that memory being zero.
+contract RaindexV6DirtyFreeMemoryHarness is RaindexV6 {
+    uint256 internal constant DIRTY_WORDS = 0x100;
+    uint256 internal constant DIRTY_WORD = 1;
+
+    function _reentrancyGuardStorageSlot() internal pure override returns (bytes32) {
+        assembly ("memory-safe") {
+            let start := mload(0x40)
+            let end := add(start, mul(DIRTY_WORDS, 0x20))
+            for { let cursor := start } lt(cursor, end) { cursor := add(cursor, 0x20) } { mstore(cursor, DIRTY_WORD) }
+        }
+        return super._reentrancyGuardStorageSlot();
+    }
+}