Add upgradeable LCP Client

.github/workflows/test.yml

@@ -9,27 +9,30 @@ jobs:
     name: Test
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
       with:
         submodules: recursive
 
-    - uses: actions/setup-node@v3
+    - uses: actions/setup-node@v4
       with:
-        node-version: '16'
+        node-version: '20'
 
     - name: Install Foundry
       uses: foundry-rs/foundry-toolchain@v1
       with:
         version: nightly
 
+    - name: Show forge version
+      run: forge --version
+
     - name: npm install
       run: npm install
 
     - name: Build and Check sizes
-      run: forge build --sizes --skip test --use solc:${{ env.SOLC_VERSION }}
+      run: make SOLC_VERSION=${{ env.SOLC_VERSION }} build
 
     - name: Run tests
-      run: make SOLC_VERSION=${{ env.SOLC_VERSION }} test
+      run: make SOLC_VERSION=${{ env.SOLC_VERSION }} TEST_UPGRADEABLE=true test
 
     - name: Lint
       run: make lint

.gitmodules

@@ -1,3 +1,6 @@
 [submodule "lib/forge-std"]
 	path = lib/forge-std
 	url = https://github.com/foundry-rs/forge-std
+[submodule "lib/openzeppelin-foundry-upgrades"]
+	path = lib/openzeppelin-foundry-upgrades
+	url = https://github.com/OpenZeppelin/openzeppelin-foundry-upgrades

Makefile

@@ -1,17 +1,22 @@
-SOLC_VERSION ?= 0.8.20
-FORGE ?= forge
+SOLC_VERSION=0.8.20
+FORGE=forge
+TEST_UPGRADEABLE=false
 
-.PHONY: proto-sol
-proto-sol:
-ifndef SOLPB_DIR
-	$(error SOLPB_DIR is not specified)
-else
-	./solpb.sh
-endif
+.PHONY: build
+build:
+	@FOUNDRY_PROFILE=ir $(FORGE) build --sizes --skip test --use solc:$(SOLC_VERSION)
+
+.PHONY: clean
+clean:
+	@$(FORGE) clean
 
 .PHONY: test
 test:
-	@$(FORGE) test -vvvv --gas-report --ffi --use solc:$(SOLC_VERSION)
+	@TEST_UPGRADEABLE=$(TEST_UPGRADEABLE) $(FORGE) test -vvvv --gas-report --ffi --use solc:$(SOLC_VERSION)
+
+.PHONY: coverage
+coverage:
+	@$(FORGE) coverage --ffi --use solc:$(SOLC_VERSION)
 
 .PHONY: fmt
 fmt:
@@ -27,3 +32,11 @@ check-fmt:
 lint:
 	@npx solhint 'contracts/*.sol'
 	@$(MAKE) FORGE_FMT_OPTS=--check fmt
+
+.PHONY: proto-sol
+proto-sol:
+ifndef SOLPB_DIR
+	$(error SOLPB_DIR is not specified)
+else
+	./solpb.sh
+endif

contracts/LCPClientBase.sol

@@ -48,21 +48,27 @@ abstract contract LCPClientBase is ILightClient, ILCPClientErrors {
 
     // --------------------- Immutable fields ---------------------
 
+    /// @dev ibcHandler is the address of the IBC handler contract.
+    /// @custom:oz-upgrades-unsafe-allow state-variable-immutable
     address internal immutable ibcHandler;
-    // if developmentMode is true, the client allows the remote attestation of IAS in development.
+    /// @dev if developmentMode is true, the client allows the remote attestation of IAS in development.
+    /// @custom:oz-upgrades-unsafe-allow state-variable-immutable
     bool internal immutable developmentMode;
 
     // --------------------- Storage fields ---------------------
 
     mapping(string => ClientStorage) internal clientStorages;
 
     // rootCA's public key parameters
-    AVRValidator.RSAParams public verifiedRootCAParams;
+    AVRValidator.RSAParams internal verifiedRootCAParams;
     // keccak256(signingCert) => RSAParams of signing public key
-    mapping(bytes32 => AVRValidator.RSAParams) public verifiedSigningRSAParams;
+    mapping(bytes32 => AVRValidator.RSAParams) internal verifiedSigningRSAParams;
 
     // --------------------- Constructor ---------------------
 
+    /// @custom:oz-upgrades-unsafe-allow constructor
+    /// @param ibcHandler_ the address of the IBC handler contract
+    /// @param developmentMode_ if true, the client allows the enclave debug mode
     constructor(address ibcHandler_, bool developmentMode_) {
         ibcHandler = ibcHandler_;
         developmentMode = developmentMode_;
@@ -77,7 +83,7 @@ abstract contract LCPClientBase is ILightClient, ILCPClientErrors {
 
     // --------------------- Public methods ---------------------
 
-    /// @dev isDevelopmentMode returns true if the client allows the remote attestation of IAS in development.
+    /// @dev isDevelopmentMode returns true if the client allows the enclave debug mode.
     function isDevelopmentMode() public view returns (bool) {
         return developmentMode;
     }

contracts/LCPClientOwnableUpgradeable.sol

@@ -0,0 +1,20 @@
+// SPDX-License-Identifier: Apache-2.0
+pragma solidity ^0.8.12;
+
+import {LCPClientBase} from "./LCPClientBase.sol";
+import {UUPSUpgradeable} from "@openzeppelin/contracts-upgradeable/proxy/utils/UUPSUpgradeable.sol";
+import {OwnableUpgradeable} from "@openzeppelin/contracts-upgradeable/access/OwnableUpgradeable.sol";
+
+/// @custom:oz-upgrades-unsafe-allow external-library-linking
+contract LCPClientOwnableUpgradeable is LCPClientBase, UUPSUpgradeable, OwnableUpgradeable {
+    /// @custom:oz-upgrades-unsafe-allow constructor
+    constructor(address ibcHandler, bool developmentMode) LCPClientBase(ibcHandler, developmentMode) {}
+
+    function initialize(bytes memory rootCACert) public initializer {
+        initializeRootCACert(rootCACert);
+        __UUPSUpgradeable_init();
+        __Ownable_init(msg.sender);
+    }
+
+    function _authorizeUpgrade(address newImplementation) internal virtual override onlyOwner {}
+}

foundry.toml

@@ -4,4 +4,12 @@ out = 'out'
 libs = ['lib', 'node_modules']
 optimizer = true
 optimizer_runs = 9_999_999
+via-ir = false
+ffi = true
+ast = true
+build_info = true
+extra_output = ["storageLayout"]
 fs_permissions = [{ access = "read", path = "./"}]
+
+[profile.ir]
+via-ir = true