Decentralised governance of 0x protocol and treasury

.github/workflows/ci.yml

@@ -31,6 +31,11 @@ jobs:
             - name: Install dependencies
               run: yarn install --frozen-lockfile
 
+            - name: Add foundry
+              uses: foundry-rs/foundry-toolchain@v1
+              with:
+                  version: nightly
+
             - name: Build solution
               run: yarn build
 
@@ -78,11 +83,6 @@ jobs:
                     -p @0x/order-utils \
                     -m --serial -c test:ci
 
-            - name: Add foundry
-              uses: foundry-rs/foundry-toolchain@v1
-              with:
-                  version: nightly
-
             - name: Run Forge build for erc20
               working-directory: contracts/erc20
               run: |
@@ -135,3 +135,26 @@ jobs:
                   path: ./contracts/zero-ex/lcov.info
                   min_coverage: 6.98
                   exclude: '**/tests'
+
+            - name: Run Forge build on governance contracts
+              working-directory: ./contracts/governance
+              run: |
+                  forge --version
+                  forge build --sizes
+
+            - name: Run Forge tests on governance contracts
+              working-directory: ./contracts/governance
+              run: |
+                  forge test -vvv --gas-report
+
+            - name: Run Forge coverage on governance contracts
+              working-directory: ./contracts/governance
+              run: |
+                  forge coverage --report lcov
+
+            - name: Upload the coverage report to Coveralls
+              uses: coverallsapp/github-action@master
+              with:
+                  github-token: ${{ secrets.GITHUB_TOKEN }}
+                  base-path: ./contracts/governance/
+                  path-to-lcov: ./contracts/governance/lcov.info

.gitignore

@@ -63,7 +63,16 @@ typings/
 .env
 
 # built library using in commonjs module syntax
-lib/
+contracts/erc20/lib/
+contracts/test-utils/lib/
+contracts/treasury/lib/
+contracts/utils/lib/
+contracts/zero-ex/lib/
+packages/contract-addresses/lib/
+packages/contract-artifacts/lib/
+packages/contract-wrappers/lib/
+packages/protocol-utils/lib/
+
 # UMD bundles that export the global variable
 _bundles
 
@@ -97,10 +106,17 @@ out/
 # typechain wrappers
 contracts/zero-ex/typechain-wrappers/
 
+# foundry packages
+contracts/governance/cache
+contracts/governance/out
+
 # Doc README copy
 packages/*/docs/README.md
 
 .DS_Store
+*~
+\#*\#
+.\#*
 
 # the snapshot that gets built for migrations sure does have a ton of files
 packages/migrations/0x_ganache_snapshot*

.gitmodules

@@ -3,4 +3,15 @@
 	url = https://github.com/foundry-rs/forge-std
 [submodule "contracts/erc20/lib/forge-std"]
 	path = contracts/erc20/lib/forge-std
+    url = https://github.com/foundry-rs/forge-std
+[submodule "contracts/governance/lib/forge-std"]
+	path = contracts/governance/lib/forge-std
 	url = https://github.com/foundry-rs/forge-std
+[submodule "contracts/governance/lib/openzeppelin-contracts"]
+	path = contracts/governance/lib/openzeppelin-contracts
+	url = https://github.com/openzeppelin/openzeppelin-contracts
+[submodule "contracts/governance/lib/openzeppelin-contracts-upgradeable"]
+	path = contracts/governance/lib/openzeppelin-contracts-upgradeable
+	url = https://github.com/OpenZeppelin/openzeppelin-contracts-upgradeable
+[submodule "lib/openzeppelin-contracts-upgradeable"]
+	branch = v4.8.2

contracts/governance/foundry.toml

@@ -0,0 +1,25 @@
+[profile.default]
+src = 'src'
+out = 'out'
+libs = ['lib', "../utils/contracts/src/"]
+fs_permissions = [{ access = "read", path = "./" }]
+remappings = [
+    '@openzeppelin/=./lib/openzeppelin-contracts/contracts/',
+    '@openzeppelin-contracts-upgradeable/=./lib/openzeppelin-contracts-upgradeable/contracts/',
+    '@0x/contracts-utils/=../utils/',
+]
+solc = '0.8.19'
+optimizer_runs = 20_000
+via_ir = true
+
+[profile.smt.model_checker]
+engine = 'chc'
+timeout = 10_000
+targets = [
+    'assert',
+    'constantCondition',
+    'divByZero',
+    'outOfBounds',
+    'underflow'
+]
+contracts = { 'src/ZeroExProtocolGovernor.sol' = [ 'ZeroExProtocolGovernor' ] }

contracts/governance/package.json

@@ -0,0 +1,21 @@
+{
+  "name": "@0x/governance",
+  "version": "1.0.0",
+  "description": "Governance implementation for the 0x protocol and treasury",
+  "main": "index.js",
+  "directories": {
+    "lib": "lib",
+    "test": "test"
+  },
+  "scripts": {
+    "test": "forge test",
+    "build": "forge build",
+    "build:smt": "FOUNDRY_PROFILE=smt forge build"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/0xProject/protocol.git"
+  },
+  "license": "Apache-2.0",
+  "dependencies": {}
+}

contracts/governance/src/CallWithGas.sol

@@ -0,0 +1,169 @@
+// SPDX-License-Identifier: MIT
+pragma solidity 0.8.19;
+
+library CallWithGas {
+    /**
+     * @notice `staticcall` another contract forwarding a precomputed amount of
+     *         gas.
+     * @dev contains protections against EIP-150-induced insufficient gas
+     *      griefing
+     * @dev reverts iff the target is not a contract or we encounter an
+     *      out-of-gas
+     * @return success true iff the call succeded and returned no more than
+     *                 `maxReturnBytes` of return data
+     * @return returnData the return data or revert reason of the call
+     * @param target the contract (reverts if non-contract) on which to make the
+     *               `staticcall`
+     * @param data the calldata to pass
+     * @param callGas the gas to pass for the call. If the call requires more than
+     *                the specified amount of gas and the caller didn't provide at
+     *                least `callGas`, triggers an out-of-gas in the caller.
+     * @param maxReturnBytes Only this many bytes of return data are read back
+     *                       from the call. This prevents griefing the caller. If
+     *                       more bytes are returned or the revert reason is
+     *                       longer, success will be false and returnData will be
+     *                       `abi.encodeWithSignature("Error(string)", "CallWithGas: returnData too long")`
+     */
+    function functionStaticCallWithGas(
+        address target,
+        bytes memory data,
+        uint256 callGas,
+        uint256 maxReturnBytes
+    ) internal view returns (bool success, bytes memory returnData) {
+        assembly ("memory-safe") {
+            returnData := mload(0x40)
+            success := staticcall(callGas, target, add(data, 0x20), mload(data), add(returnData, 0x20), maxReturnBytes)
+
+            // As of the time this contract was written, `verbatim` doesn't work in
+            // inline assembly.  Assignment of a value to a variable costs gas
+            // (although how much is unpredictable because it depends on the Yul/IR
+            // optimizer), as does the `GAS` opcode itself. Also solc tends to reorder
+            // the call to `gas()` with preparing the arguments for `div`. Therefore,
+            // the `gas()` below returns less than the actual amount of gas available
+            // for computation at the end of the call. That makes this check slightly
+            // too conservative. However, we do not correct for this because the
+            // correction would become outdated (possibly too permissive) if the
+            // opcodes are repriced.
+
+            // https://eips.ethereum.org/EIPS/eip-150
+            // https://ronan.eth.link/blog/ethereum-gas-dangers/
+            if iszero(or(success, or(returndatasize(), lt(div(callGas, 63), gas())))) {
+                // The call failed due to not enough gas left. We deliberately consume
+                // all remaining gas with `invalid` (instead of `revert`) to make this
+                // failure distinguishable to our caller.
+                invalid()
+            }
+
+            switch gt(returndatasize(), maxReturnBytes)
+            case 0 {
+                switch returndatasize()
+                case 0 {
+                    returnData := 0x60
+                    success := and(success, iszero(iszero(extcodesize(target))))
+                }
+                default {
+                    mstore(returnData, returndatasize())
+                    mstore(0x40, add(returnData, add(0x20, returndatasize())))
+                }
+            }
+            default {
+                // returnData = abi.encodeWithSignature("Error(string)", "CallWithGas: returnData too long")
+                success := 0
+                mstore(returnData, 0) // clear potentially dirty bits
+                mstore(add(returnData, 0x04), 0x6408c379a0) // length and selector
+                mstore(add(returnData, 0x24), 0x20)
+                mstore(add(returnData, 0x44), 0x20)
+                mstore(add(returnData, 0x64), "CallWithGas: returnData too long")
+                mstore(0x40, add(returnData, 0x84))
+            }
+        }
+    }
+
+    /// See `functionCallWithGasAndValue`
+    function functionCallWithGas(
+        address target,
+        bytes memory data,
+        uint256 callGas,
+        uint256 maxReturnBytes
+    ) internal returns (bool success, bytes memory returnData) {
+        return functionCallWithGasAndValue(payable(target), data, callGas, 0, maxReturnBytes);
+    }
+
+    /**
+     * @notice `call` another contract forwarding a precomputed amount of gas.
+     * @notice Unlike `functionStaticCallWithGas`, a failure is not signaled if
+     *         there is too much return data. Instead, it is simply truncated.
+     * @dev contains protections against EIP-150-induced insufficient gas griefing
+     * @dev reverts iff caller doesn't have enough native asset balance, the
+     *      target is not a contract, or due to out-of-gas
+     * @return success true iff the call succeded
+     * @return returnData the return data or revert reason of the call
+     * @param target the contract (reverts if non-contract) on which to make the
+     *               `call`
+     * @param data the calldata to pass
+     * @param callGas the gas to pass for the call. If the call requires more than
+     *                the specified amount of gas and the caller didn't provide at
+     *                least `callGas`, triggers an out-of-gas in the caller.
+     * @param value the amount of the native asset in wei to pass to the callee
+     *              with the call
+     * @param maxReturnBytes Only this many bytes of return data/revert reason are
+     *                       read back from the call. This prevents griefing the
+     *                       caller. If more bytes are returned or the revert
+     *                       reason is longer, returnData will be truncated
+     */
+    function functionCallWithGasAndValue(
+        address payable target,
+        bytes memory data,
+        uint256 callGas,
+        uint256 value,
+        uint256 maxReturnBytes
+    ) internal returns (bool success, bytes memory returnData) {
+        if (value > 0 && (address(this).balance < value || target.code.length == 0)) {
+            return (success, returnData);
+        }
+
+        assembly ("memory-safe") {
+            returnData := mload(0x40)
+            success := call(callGas, target, value, add(data, 0x20), mload(data), add(returnData, 0x20), maxReturnBytes)
+
+            // As of the time this contract was written, `verbatim` doesn't work in
+            // inline assembly.  Assignment of a value to a variable costs gas
+            // (although how much is unpredictable because it depends on the Yul/IR
+            // optimizer), as does the `GAS` opcode itself. Also solc tends to reorder
+            // the call to `gas()` with preparing the arguments for `div`. Therefore,
+            // the `gas()` below returns less than the actual amount of gas available
+            // for computation at the end of the call. That makes this check slightly
+            // too conservative. However, we do not correct for this because the
+            // correction would become outdated (possibly too permissive) if the
+            // opcodes are repriced.
+
+            // https://eips.ethereum.org/EIPS/eip-150
+            // https://ronan.eth.link/blog/ethereum-gas-dangers/
+            if iszero(or(success, or(returndatasize(), lt(div(callGas, 63), gas())))) {
+                // The call failed due to not enough gas left. We deliberately consume
+                // all remaining gas with `invalid` (instead of `revert`) to make this
+                // failure distinguishable to our caller.
+                invalid()
+            }
+
+            switch gt(returndatasize(), maxReturnBytes)
+            case 0 {
+                switch returndatasize()
+                case 0 {
+                    returnData := 0x60
+                    if iszero(value) {
+                        success := and(success, iszero(iszero(extcodesize(target))))
+                    }
+                }
+                default {
+                    mstore(returnData, returndatasize())
+                    mstore(0x40, add(returnData, add(0x20, returndatasize())))
+                }
+            }
+            default {
+                mstore(returnData, maxReturnBytes)
+                mstore(0x40, add(returnData, add(0x20, maxReturnBytes)))
+            }
+        }
+    }
+}

contracts/governance/src/IZeroExGovernor.sol

@@ -0,0 +1,39 @@
+// SPDX-License-Identifier: Apache-2.0
+/*
+
+  Copyright 2023 ZeroEx Intl.
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+
+*/
+pragma solidity ^0.8.19;
+
+import "./SecurityCouncil.sol";
+import "@openzeppelin/governance/IGovernor.sol";
+import "@openzeppelin/governance/extensions/IGovernorTimelock.sol";
+
+abstract contract IZeroExGovernor is SecurityCouncil, IGovernor, IGovernorTimelock {
+    function token() public virtual returns (address);
+
+    function proposalThreshold() public view virtual returns (uint256);
+
+    function setVotingDelay(uint256 newVotingDelay) public virtual;
+
+    function setVotingPeriod(uint256 newVotingPeriod) public virtual;
+
+    function setProposalThreshold(uint256 newProposalThreshold) public virtual;
+
+    function proposalVotes(
+        uint256 proposalId
+    ) public view virtual returns (uint256 againstVotes, uint256 forVotes, uint256 abstainVotes);
+}