Upgrade Snowbridge Gateway Contract

This proposal upgrades the Snowbridge Gateway Proxy contract on Ethereum.

Changes

BeefyClient

• Security hardening from bug bounty program.
• Updated parameters (#1823):
  • minimumSignatures: 17 → 20
  • randaoCommitExpiration: 24 → 12
  • fiatShamirRequiredSignatures: 111 → 103
  • randaoCommitDelay: unchanged at 128

Technical Details

This proposal updates the Gateway proxy with:

• a new implementation contract at 0x4aD0577C76AfaEf8AaC23C661974340bB131426F (code hash 0x7082f0a78744653164d1a8cf7525634ea7fc009e27e0a81b5146e399415af5a8)
• a new BeefyClient at 0xbCBEbc20a0FDF9EfD53B5852a71869b0cF25283f

No storage migration is performed (initializer_params is empty).

These contracts were built and deployed using:

• Repository: https://github.com/Snowfork/snowbridge
• Commit: 4f3f41db1c0bcb38da03141edade46014a7bdb9f
• Commands: cd contracts; scripts/deploy-beefy.sh and scripts/deploy-gateway.sh

The preimage that will be executed on Bridge Hub for this referendum was created using the Snowbridge Control tool.

➜  control git:(main) cargo run --release --features polkadot --bin snowbridge-preimage -- --format hex upgrade-202610

Preimage Hash: 0x2bac5e67e6d3fb23cad13270df2aaf703b0d070648c622a44c63bd210520c64b
Preimage Size: 90
0x1f0005010100a90f050c2f0000060201c27927d08970010153004ad0577c76afaef8aac23c661974340bb131426f7082f0a78744653164d1a8cf7525634ea7fc009e27e0a81b5146e399415af5a80100a0860100000000002000

Testing

The upgrade was tested with simulations on forked Polkadot and Ethereum mainnet, using Chopsticks and Foundry respectively.

• The referendum and whitelist calls were generated with opengov-cli:

./target/release/opengov-cli submit-referendum --proposal 0x1f0005010100a90f050c2f0000060201c27927d08970010153004ad0577c76afaef8aac23c661974340bb131426f7082f0a78744653164d1a8cf7525634ea7fc009e27e0a81b5146e399415af5a80100a0860100000000002000 --network polkadot --track whitelisted-caller --after 100 --output calldata

• polkadot-referenda-tester confirmed that the EthereumSystem.Upgrade event is emitted as expected:

npx github:karolk91/polkadot-referenda-tester test \
  --governance-chain-url wss://asset-hub-polkadot-rpc.n.dwellir.com \
  --fellowship-chain-url wss://polkadot-collectives-rpc.polkadot.io \
  --call-to-create-governance-referendum 0x2804080500710140031f0005010100a90f050c2f0000060201c27927d08970010153004ad0577c76afaef8aac23c661974340bb131426f7082f0a78744653164d1a8cf7525634ea7fc009e27e0a81b5146e399415af5a80100a08601000000000020003e003f0d02f67ceb253dd7c2acaeb3716349588b3c643080191aaed9da5b2a02b73bd82f0c5c0000000164000000 \
  --call-to-create-fellowship-referendum 0x2804043d003e0201cc1f0005010100a10f05082f00000603008840002bac5e67e6d3fb23cad13270df2aaf703b0d070648c622a44c63bd210520c64b010a000000 \
  --additional-chains wss://bridge-hub-polkadot-rpc.n.dwellir.com \
  --verbose
...
ℹ   • EthereumSystem.Upgrade
▸     Data: {
  "impl_address": "0x4ad0577c76afaef8aac23c661974340bb131426f",
  "impl_code_hash": "0x7082f0a78744653164d1a8cf7525634ea7fc009e27e0a81b5146e399415af5a8",
  ...
}

• Forked Ethereum upgrade verification

The fork tests in ForkUpgrade202610.t.sol run the deployed 202610 implementation against the production Gateway proxy. They verify that the upgrade is applied through the governance channel, that inbound V1 and V2 messages from Asset Hub (unlocking native Ether) are still accepted, that outbound messaging still works, and that DOT can still be minted and sent back.

Auditing

The contract changes in this upgrade form part of the HackenProof bug bounty program. The code has "baked" for some time under the bug bounty with no further reports related to the current release.