Snowbridge v2 - Inbound Queue #6697

claravanstaden · 2024-11-28T17:15:48Z

Description

Implements the Inbound Queue for Snowbridge v2.

Integration

This PR adds:

A new pallet called EthereumInboundQueueV2 with a submit extrinsic.
A new runtime API called InboundQueueApiV2 with a method dry_run, that takes an Ethereum command and converts it to Xcm and provides the execution fee on BH and static fee part of the AH execution.

Since this is a new pallet, no breaking changes are made to the EthereumInboundQueue pallet.

Review Notes

The Inbound Queue v2 pallet expects an abi-encoded envelope from Ethereum. Once decoded, the payload parameter is SCALE decoded into a v2::Message. The message contains:

origin: The origin address of the user on Ethereum
assets: A vector of assets that will be placed in the holding on AH. Can be a native ERC-20 or a foreign ERC-20 (Polkadot native assets). The XCM instructions that are used differ per asset type (ReserveAssetDeposited for native ERC-20 tokens and WithdrawAsset for Polkadot native assets). The user on Ethereum specifies additional xcm deposit the asset into a beneficiary account.
xcm: User provided xcms, to deposit the asset to a beneficiary, provide further fees or other instructions such as Transact (for example, to register a token)
claimer: The claimer on AH, in case funds are trapped so it can be claimed.

The relayer pays a DOT fee that covers:

The execution fees on BH
The static xcm part of the message on AH

The DOT fee is burnt from the relayer account and teleported to AH.

Messages may be processed out of order. Nonces are stored in a sparse bitmap for space-efficient storage.

Co-authored-by: Vincent Geddes <[email protected]>

Fix register token

alistair-singh · 2024-12-04T00:05:23Z

bridges/snowbridge/primitives/router/src/inbound/v2.rs

+
+		let mut origin_location = Location::new(2, [GlobalConsensus(network)]);
+		if message.origin == GatewayProxyAddress::get() {
+			// If the message origin is the gateway proxy contract, set the origin to


You do not need this branch. The origin is already set here:

UniversalOrigin(GlobalConsensus(network)),

https://github.com/paritytech/polkadot-sdk/pull/6697/files#diff-011a2c280539a541db601aa2fd4e5f30960525c4bb35588c3de78effb01720fcR147

So you can only add AliasOrigin if its not the gateway proxy.

Changed in 02750d6.

alistair-singh · 2024-12-04T00:20:50Z

cumulus/parachains/runtimes/bridge-hubs/bridge-hub-westend/src/bridge_to_ethereum_config.rs

+	type Balance = Balance;
+	type MessageConverter = snowbridge_router_primitives::inbound::v2::MessageToXcm<
+		EthereumNetwork,
+		ConstU8<INBOUND_QUEUE_PALLET_INDEX>,


This pallet index is for the inbound queue v1 pallet. We are essentially re-using it for the v2 pallet and I am not sure if this is the right thing to do. We may need to add the v2 pallet index separately.

This is used to allow the use of the UniversalOrigin instruction, which only the v1 pallet is configured to use now.

Its set in xcm config here:

polkadot-sdk/cumulus/parachains/runtimes/assets/asset-hub-westend/src/xcm_config.rs

Lines 464 to 465 in 41a5d8e

type UniversalAliases =

(bridging::to_rococo::UniversalAliases, bridging::to_ethereum::UniversalAliases);

And bridge config here:

polkadot-sdk/cumulus/parachains/runtimes/assets/asset-hub-westend/src/xcm_config.rs

Line 687 in 41a5d8e

(SiblingBridgeHubWithEthereumInboundQueueInstance::get(), GlobalConsensus(EthereumNetwork::get().into())),

Basically it means only the bridge hub inbound queue v1 pallet can be the Universal origin { parents: 2, interior: X1([GlobalConsensus(Ethereum { chain_id: 11155111 }) } (Snowbridge Sovereign)

Addressed in 40e85ea.

alistair-singh · 2024-12-04T00:47:33Z

cumulus/parachains/integration-tests/emulated/tests/bridges/bridge-hub-westend/Cargo.toml

@@ -12,6 +12,7 @@ workspace = true

 [dependencies]
 hex-literal = { workspace = true, default-features = true }
+hex = { workspace = true, default-features = true }


This looks like a dev dependency only?

This whole crate is tests only and then all dependencies should be under dev-dependencies, I think.

AH ok, ignore then.

alistair-singh · 2024-12-04T01:08:04Z

bridges/snowbridge/pallets/inbound-queue-v2/src/lib.rs

+			Self::deposit_event(Event::MessageReceived { nonce: envelope.nonce, message_id });
+
+			// Set nonce flag to true
+			Nonce::<T>::set(envelope.nonce.into());


Not sure if re-entrancy is a potential security issue for substrate pallets like it is for smart contracts, but generally you want to increment (Or in this case set) the nonce first and then dispatch.

See this comment:
https://github.com/Snowfork/snowbridge/pull/1300/files#diff-74470ba8f35b42dbc8805739e92708c0696343e0b1819feb3e7a5ebb77cc623cR140-R143

That's a good point, d70ac6c.

alistair-singh · 2024-12-04T01:20:33Z

bridges/snowbridge/primitives/router/src/inbound/v2.rs

+				&mut message.xcm.as_ref(),
+			)
+			.map_err(|_| ConvertMessageError::InvalidVersionedXCM)?;
+			message_xcm = versioned_xcm.try_into().map_err(|_| ConvertMessageError::InvalidXCM)?;


A possible alternative to failing here could be let the message go through with a empty xcm payload, which will essentially trap the funds on assethub, allowing the user to claim them. Lets discuss this.

That would be more work for the user though. I think it's better to fail early and not move any tokens around than allowing it and the user needs to take corrective action. Unless you see a benefit to doing this?

The funds are already locked on the Ethereum side so tokens are moved by this point. If the xcm is malformed for any reason there is no corrective step that can be applied here. The message is immutable and nothing can make the xcm well formed once submitted on the etherum side.

So the options for malformed xcm are:

Return error and revert: Funds are trapped on ethereum, no way to push the message through. The message is undeliverable due to the revert.

Push message to Asset Hub with empty xcm: The funds get trapped on asset hub where there is a claim process. If the user does want to do the extra step of claiming, then the funds are essentially still trapped, but on asset hub where it is claimable in some form.

Maybe if the bug is in our code, we could apply a fix to the inbound-queue-v2 and go through the whole release process, and a message could be retried after the release is done.

I see what you mean, thanks for explaining. I have changed it to allow invalid xcm: 6af760b

I did the same for an invalid claimer payload: b368760 If the claimer bytes cannot be decoded into an Xcm junction, don't add the claimer to the Xcm. The relayer will then be set to the claimer, as you mentioned here: #6697 (comment)

What do you think about foreign ERC20 (FNB) tokens that cannot be converted into a asset ID? Should we error? Or not add to the assets vector?

alistair-singh · 2024-12-04T01:24:23Z

bridges/snowbridge/primitives/router/src/inbound/v2.rs

+							AccountKey20 { network: None, key: (*token_id).into() },
+						],
+					);
+					instructions.push(ReserveAssetDeposited((token_location, *value).into()));


ReserveAssetDeposited takes multiple Assets as an argument. Instead of using multiple ReserveAssetDeposited with a single asset in each, do one ReserveAssetDeposited with multiple assets.

alistair-singh · 2024-12-04T01:24:48Z

bridges/snowbridge/primitives/router/src/inbound/v2.rs

+					let asset_id = ConvertAssetId::convert(&token_id)
+						.ok_or(ConvertMessageError::InvalidAsset)?;
+					instructions.push(WithdrawAsset((asset_id, *value).into()));
+				},


Same here with WithdrawAssets. Pass in multiple assets.

alistair-singh · 2024-12-04T01:25:42Z

bridges/snowbridge/primitives/router/src/inbound/v2.rs

+			}
+		}
+
+		if let Some(claimer) = message.claimer {


Set the claimer before ReserveDepositing or Withdrawing assets so that in the case of a failure, the user can at least claim some of their funds.

alistair-singh · 2024-12-04T01:29:19Z

bridges/snowbridge/primitives/router/src/inbound/v2.rs

+			origin_location
+				.push_interior(AccountKey20 { key: message.origin.into(), network: None })
+				.map_err(|_| ConvertMessageError::InvalidOrigin)?;
+			instructions.push(AliasOrigin(origin_location.into()));


We could potentially use DescendOrigin here instead of AliasOrigin. This is because AliasOrigin in this case is essentially doing a descend origin i.e. appending the msg.sender to the existing origin.

Agreed, it is better. 9ffb3e1

alistair-singh · 2024-12-04T01:30:56Z

bridges/snowbridge/primitives/router/src/inbound/v2.rs

+			// Refund excess fees to the relayer
+			DepositAsset {
+				assets: Wild(AllOf { id: AssetId(fee_asset.into()), fun: WildFungible }),
+				beneficiary: origin_account_location,


We should maybe refund to the claimer if its present, and if its not than refund to the relayer. The relayer will get its reward separately.

…ound-queue-v2-clean

# Conflicts: # bridges/snowbridge/primitives/router/src/inbound/mod.rs

claravanstaden and others added 30 commits November 20, 2024 16:31

inbound queue v2

07808bd

adds sparse bitmap

6f238eb

use sparse bitmap

b0115cd

use payfees

c27def2

Update bridges/snowbridge/pallets/inbound-queue-v2/src/lib.rs

93b4516

Co-authored-by: Vincent Geddes <[email protected]>

Update bridges/snowbridge/pallets/inbound-queue-v2/src/lib.rs

3a13134

Co-authored-by: Vincent Geddes <[email protected]>

rename NonceBitmap

7e23462

config T::XcmPrologueFee: Balance

68f5a8e

burn fees

02e8081

fix westend config

ee0bc27

use sendcontroller

4309272

runtime config for sendcontroller

de00eb6

wip

3653b7f

tests

990bf47

xcm fee

9f7829c

adds comments

11839dc

revert sendcontroller

8974696

adds test for xcm register command

75d3c06

update test

c666d23

runtime api

42d688a

adds comment

92e3419

update test

37ecd53

update tests

69a660b

Merge branch 'master' into inbound-queue-v2-clean

43f0d8d

prdoc

71929f6

adds register token test

5735960

enable exchange asset on AH

a935ff2

fix transact

373d63a

Fix for register token

a61ceef

Merge pull request #6 from yrong/ron/inbound-queue-v2-clean

fae2947

Fix register token

claravanstaden changed the title ~~Snowbridge Unordered Message Delivery - Inbound Queue~~ Snowbridge v2 - Inbound Queue Nov 29, 2024

claravanstaden added 5 commits December 2, 2024 13:46

add pool

7e64403

fix pool owner

d77a1ee

use weth for execution fees on AH

f40cfd4

cleanup test

9b8117b

fix aliasorigin

c2804dc

alistair-singh reviewed Dec 4, 2024

View reviewed changes

claravanstaden added 12 commits December 4, 2024 10:31

remove unnecessary alias origin

02750d6

separate inbound pallet index IDs for v1 and v2

40e85ea

fix reentrancy bug

d70ac6c

send all assets in a single instruction

bc45bbd

use descend origin instead of alias origin

9ffb3e1

use claimer for refund surplus, otherwise relayer

85d355e

Merge branch 'master' into inbound-queue-v2-clean

1168a16

more tests

f1263e4

Merge remote-tracking branch 'origin/inbound-queue-v2-clean' into inb…

2d3a834

…ound-queue-v2-clean

allow invalid xcm

6af760b

allow invalid claimer

b368760

move claimer before assets

9939927

claravanstaden mentioned this pull request Dec 6, 2024

Inbound Queue v2 claravanstaden/polkadot-sdk#4

Open

11 tasks

claravanstaden added 10 commits December 6, 2024 11:33

Merge branch 'master' into inbound-queue-v2-clean

028e0e8

# Conflicts: # bridges/snowbridge/primitives/router/src/inbound/mod.rs

apply weight at most change

8f11a76

penpal test

2484821

pna progress

373c878

finish integration tests

30d0cf4

adds tests, changes message format

a35eee1

fmt

6208dfd

fmt

d0624e2

change fee asset from weth to eth

c66fcb1

adds abi decoding

ddece3c

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Snowbridge v2 - Inbound Queue #6697

Snowbridge v2 - Inbound Queue #6697

claravanstaden commented Nov 28, 2024 •

edited

Loading

alistair-singh Dec 4, 2024

claravanstaden Dec 4, 2024

alistair-singh Dec 4, 2024

claravanstaden Dec 5, 2024

alistair-singh Dec 4, 2024

claravanstaden Dec 5, 2024

alistair-singh Dec 5, 2024

alistair-singh Dec 4, 2024

claravanstaden Dec 5, 2024

alistair-singh Dec 4, 2024

claravanstaden Dec 5, 2024

alistair-singh Dec 5, 2024

claravanstaden Dec 5, 2024

claravanstaden Dec 6, 2024

alistair-singh Dec 4, 2024

claravanstaden Dec 6, 2024

alistair-singh Dec 4, 2024

claravanstaden Dec 5, 2024

alistair-singh Dec 4, 2024

claravanstaden Dec 5, 2024 •

edited

Loading

alistair-singh Dec 4, 2024

claravanstaden Dec 5, 2024

alistair-singh Dec 4, 2024

claravanstaden Dec 5, 2024

	type UniversalAliases =
	(bridging::to_rococo::UniversalAliases, bridging::to_ethereum::UniversalAliases);

Snowbridge v2 - Inbound Queue #6697

Are you sure you want to change the base?

Snowbridge v2 - Inbound Queue #6697

Conversation

claravanstaden commented Nov 28, 2024 • edited Loading

Description

Integration

Review Notes

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

claravanstaden Dec 5, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

claravanstaden commented Nov 28, 2024 •

edited

Loading

claravanstaden Dec 5, 2024 •

edited

Loading