build!: upstream Safe v1.5.0, forge-std v1.11.0, and via_ir by default

.github/workflows/test.yml

@@ -57,3 +57,4 @@ jobs:
         # `fork` needs an archive-node RPC and is not run here. The fuzz seed is
         # pinned so a failure is reproducible from the log alone.
         run: forge test -vvv --no-match-test "fork" --fuzz-seed 672679878
+

.gitmodules

@@ -1,15 +1,15 @@
 [submodule "lib/forge-std"]
 	path = lib/forge-std
 	url = https://github.com/foundry-rs/forge-std
-	branch = v1.5.3
+	branch = v1.11.0
 [submodule "lib/cowprotocol"]
 	path = lib/cowprotocol
 	url = https://github.com/cowprotocol/contracts
 	branch = main
 [submodule "lib/safe"]
 	path = lib/safe
-	url = https://github.com/cowdao-grants/extensible-fallback-handler
-	branch = main
+	url = https://github.com/safe-global/safe-smart-account
+	branch = v1.5.0
 [submodule "lib/solady"]
 	path = lib/solady
 	url = https://github.com/vectorized/solady

docs/discovery.md

@@ -639,12 +639,17 @@ recomputing the root.
 - `leafEncoding: "v1"` pins the full tree construction, byte-exact against
   `_auth`: `leaf = keccak256(abi.encode(ConditionalOrderParams))`; the tree is
   built bottom-up over the ascending-sorted leaf array; each internal node is
-  `keccak256(sorted-pair(a, b))`; an
-  odd trailing node at any level is promoted unchanged to the next level.
-  Sorted-pair hashing alone does not determine tree shape — implementations
-  MUST follow this construction (note: OpenZeppelin's `StandardMerkleTree`
-  double-hashes leaves and yields different roots; it is NOT this encoding).
-  Reference test vectors are published alongside the contracts.
+  `keccak256(sorted-pair(a, b))`; an odd trailing node at any level is promoted
+  unchanged to the next level. Sorted-pair hashing alone does not determine
+  tree shape, so implementations MUST follow this construction. Neither
+  OpenZeppelin's `StandardMerkleTree` (it double-hashes leaves) nor Solady's
+  `MerkleTreeLib` (it builds a complete `2n-1` node tree, diverging wherever
+  the odd-promotion rule fires, such as at 5, 7 or 9 leaves) produces this
+  shape. The mismatch is silent under verification: `MerkleProofLib.verify` is
+  sorted-pair and therefore shape-agnostic, so a non-conforming tree still
+  verifies against its own root, and the divergence surfaces only when a
+  consumer recomputes `root` from `leaves`. Reference test vectors are
+  published alongside the contracts.
 - `leaves` MUST be sorted ascending by leaf hash and deduplicated; consumers
   MUST reject on the first out-of-order or duplicate leaf.
 - Producers MUST serialize with RFC 8785; content addresses and digests commit

foundry.lock

@@ -7,14 +7,14 @@
   },
   "lib/forge-std": {
     "branch": {
-      "name": "v1.5.3",
-      "rev": "73a504d2cf6f37b7ce285b479f4c681f76e95f1b"
+      "name": "v1.11.0",
+      "rev": "8e40513d678f392f398620b3ef2b418648b33e89"
     }
   },
   "lib/safe": {
     "branch": {
-      "name": "main",
-      "rev": "11273c1f08eda18ed8ff49ec1d4abec5e451ff21"
+      "name": "v1.5.0",
+      "rev": "dc437e8fba8b4805d76bcbd1c668c9fd3d1e83be"
     }
   },
   "lib/solady": {

foundry.toml

@@ -7,6 +7,7 @@ solc_version = "0.8.30"
 evm_version = "cancun"
 optimizer = true
 optimizer_runs = 20000
+via_ir = true
 
 # Descriptor documents are read by test/ComposableCow.descriptorDoc.t.sol
 fs_permissions = [{ access = "read", path = "./descriptors" }]

script/deploy_AnvilStack.s.sol

@@ -11,7 +11,7 @@ import {GPv2Authentication} from "cowprotocol/contracts/interfaces/GPv2Authentic
 
 // Safe contracts
 import {Safe} from "safe/Safe.sol";
-import {Enum} from "safe/common/Enum.sol";
+import {Enum} from "safe/libraries/Enum.sol";
 import {SafeProxyFactory, SafeProxy} from "safe/proxies/SafeProxyFactory.sol";
 import {CompatibilityFallbackHandler} from "safe/handler/CompatibilityFallbackHandler.sol";
 import {MultiSend} from "safe/libraries/MultiSend.sol";

script/deploy_ProdStack.s.sol

@@ -4,7 +4,7 @@ pragma solidity >=0.8.0 <0.9.0;
 import {Script} from "forge-std/Script.sol";
 
 // ExtensibleFallbackHandler
-import {ExtensibleFallbackHandler} from "../lib/safe/contracts/handler/ExtensibleFallbackHandler.sol";
+import {ExtensibleFallbackHandler} from "safe/handler/ExtensibleFallbackHandler.sol";
 
 // ComposableCow
 import {ComposableCow} from "../src/ComposableCow.sol";

script/submit_SingleOrder.s.sol

@@ -7,7 +7,7 @@ import {IERC20} from "cowprotocol/contracts/interfaces/IERC20.sol";
 
 // Safe contracts
 import {Safe} from "safe/Safe.sol";
-import {Enum} from "safe/common/Enum.sol";
+import {Enum} from "safe/libraries/Enum.sol";
 import {SafeProxyFactory} from "safe/proxies/SafeProxyFactory.sol";
 import {CompatibilityFallbackHandler} from "safe/handler/CompatibilityFallbackHandler.sol";
 import {MultiSend} from "safe/libraries/MultiSend.sol";

src/ComposableCow.sol

@@ -2,13 +2,8 @@
 pragma solidity >=0.8.0 <0.9.0;
 
 import {MerkleProofLib} from "solady/utils/MerkleProofLib.sol";
-import {
-    ExtensibleFallbackHandler,
-    ERC1271,
-    ISignatureVerifierMuxer,
-    ISafeSignatureVerifier,
-    Safe
-} from "safe/handler/ExtensibleFallbackHandler.sol";
+
+import {IERC165, ERC1271, ISignatureVerifierMuxer, ISafeSignatureVerifier, Safe} from "./vendor/Safe.sol";
 
 import {IConditionalOrder, IConditionalOrderGenerator, GPv2Order} from "./interfaces/IConditionalOrder.sol";
 import {ISwapGuard} from "./interfaces/ISwapGuard.sol";
@@ -557,9 +552,7 @@ contract ComposableCow is ISafeSignatureVerifier {
         GPv2Order.Data memory order
     ) internal view returns (bytes memory signature) {
         // Get the signature for the order
-        try ExtensibleFallbackHandler(owner).supportsInterface(type(ISignatureVerifierMuxer).interfaceId) returns (
-            bool supported
-        ) {
+        try IERC165(owner).supportsInterface(type(ISignatureVerifierMuxer).interfaceId) returns (bool supported) {
             if (!supported) {
                 revert InvalidFallbackHandler();
             }

src/ERC1271Forwarder.sol

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: GPL-3.0
 pragma solidity >=0.8.0 <0.9.0;
 
-import {ERC1271, Safe} from "safe/handler/extensible/SignatureVerifierMuxer.sol";
+import {ERC1271, Safe} from "./vendor/Safe.sol";
 import {GPv2Order} from "cowprotocol/contracts/libraries/GPv2Order.sol";
 
 import {ComposableCow} from "./ComposableCow.sol";

src/interfaces/IConditionalOrder.sol

@@ -2,7 +2,7 @@
 pragma solidity >=0.8.0 <0.9.0;
 
 import {GPv2Order} from "cowprotocol/contracts/libraries/GPv2Order.sol";
-import {IERC165} from "safe/interfaces/IERC165.sol";
+import {IERC165} from "../vendor/Safe.sol";
 
 /**
  * @dev Canonical reason for `PollNeedsOffchainInput`: the handler cannot

src/interfaces/ISwapGuard.sol

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: GPL-3.0
 pragma solidity >=0.8.0 <0.9.0;
 
-import {IERC165} from "safe/interfaces/IERC165.sol";
+import {IERC165} from "../vendor/Safe.sol";
 
 import {IConditionalOrder, GPv2Order} from "./IConditionalOrder.sol";
 

src/vendor/Safe.sol

@@ -0,0 +1,55 @@
+// SPDX-License-Identifier: LGPL-3.0-only
+pragma solidity >=0.8.0 <0.9.0;
+
+/**
+ * @dev The Safe surface this registry actually uses, vendored from
+ *      `safe-contracts` rather than depended upon.
+ *
+ *      The dependency was a compilation liability: `Safe.sol` uses inline
+ *      assembly that is not annotated memory-safe, so the IR pipeline cannot
+ *      allocate its stack and `via_ir` fails on the whole project. Nothing here
+ *      needs the implementation. `Safe` is only ever a typed address, and the
+ *      handler is only ever asked whether it supports an interface.
+ *
+ *      Declarations match `safe-contracts` exactly, so a contract written
+ *      against either compiles against this.
+ */
+
+/// @dev Standard ERC-165.
+interface IERC165 {
+    function supportsInterface(bytes4 interfaceId) external view returns (bool);
+}
+
+/// @dev ERC-1271, as `safe-contracts` declares it.
+interface ERC1271 {
+    function isValidSignature(bytes32 hash, bytes calldata signature) external view returns (bytes4 magicValue);
+}
+
+/**
+ * @dev A Safe, as far as this registry is concerned. Only its address is used:
+ *      `isValidSafeSignature` takes one as a typed address and `_auth` reads
+ *      the registry's own storage, so no Safe behaviour is invoked.
+ */
+interface Safe {}
+
+/**
+ * @title Safe Signature Verifier Interface
+ * @notice Standard for external contracts verifying signatures for a Safe.
+ */
+interface ISafeSignatureVerifier {
+    function isValidSafeSignature(
+        Safe safe,
+        address sender,
+        bytes32 _hash,
+        bytes32 domainSeparator,
+        bytes32 typeHash,
+        bytes calldata encodeData,
+        bytes calldata payload
+    ) external view returns (bytes4 magic);
+}
+
+interface ISignatureVerifierMuxer {
+    function domainVerifiers(Safe safe, bytes32 domainSeparator) external view returns (ISafeSignatureVerifier);
+
+    function setDomainVerifier(bytes32 domainSeparator, ISafeSignatureVerifier verifier) external;
+}

test/ComposableCow.base.t.sol

@@ -1,7 +1,9 @@
 // SPDX-License-Identifier: GPL-3.0
 pragma solidity >=0.8.0 <0.9.0;
 
-import {Safe, IERC165, Enum} from "safe/Safe.sol";
+import {Safe} from "safe/Safe.sol";
+import {Enum} from "safe/libraries/Enum.sol";
+import {IERC165} from "safe/interfaces/IERC165.sol";
 
 // Testing Libraries
 import {Base} from "./Base.t.sol";

test/ComposableCow.descriptorDoc.t.sol

@@ -6,15 +6,6 @@ import "./ComposableCow.base.t.sol";
 import "../src/types/TradeAboveThreshold.sol";
 import {TWAPOrder} from "../src/types/twap/libraries/TWAPOrder.sol";
 
-/**
- * @dev `parseJsonKeys` is supported by the `forge` binary but absent from the
- *      vendored `forge-std` interface, so it is declared here rather than
- *      bumping the submodule for one cheatcode.
- */
-interface VmJson {
-    function parseJsonKeys(string calldata json, string calldata key) external pure returns (string[] memory);
-}
-
 /**
  * @dev Checks the generated descriptor documents against the contracts they
  *      describe. Solidity rather than a JS toolchain: the facts worth
@@ -45,7 +36,7 @@ contract ComposableCowDescriptorDocTest is BaseComposableCowTest {
     }
 
     function _errorKeys(string memory doc) private pure returns (string[] memory) {
-        return VmJson(address(vm)).parseJsonKeys(doc, "$.errors");
+        return vm.parseJsonKeys(doc, "$.errors");
     }
 
     function _hex4(bytes4 sel) private pure returns (string memory) {

test/ComposableCow.t.sol

@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: GPL-3.0
 pragma solidity >=0.8.0 <0.9.0;
 
+import {Safe as CowSafe} from "../src/vendor/Safe.sol";
 import {ERC1271} from "safe/handler/extensible/SignatureVerifierMuxer.sol";
 import {ISafeSignaturePayload} from "../src/ComposableCow.sol";
 
@@ -262,7 +263,7 @@ contract ComposableCowTest is BaseComposableCowTest {
         // should revert as the order hash mismatches
         vm.expectRevert(abi.encodeWithSelector(IConditionalOrder.OrderNotValid.selector, InvalidHash.selector));
         composableCow.isValidSafeSignature(
-            Safe(payable(address(alice.addr))),
+            CowSafe(payable(address(alice.addr))),
             address(0),
             GPv2Order.hash(order1, domainSeparator),
             domainSeparator,
@@ -300,7 +301,7 @@ contract ComposableCowTest is BaseComposableCowTest {
         // should revert as the proof is invalid
         vm.expectRevert(ComposableCow.ProofNotAuthed.selector);
         composableCow.isValidSafeSignature(
-            Safe(payable(owner)),
+            CowSafe(payable(owner)),
             address(0), // sender isn't used
             keccak256("some GPv2Order hash"),
             keccak256("some domain separator"),
@@ -328,7 +329,7 @@ contract ComposableCowTest is BaseComposableCowTest {
         // should revert as the order has not been created
         vm.expectRevert(ComposableCow.SingleOrderNotAuthed.selector);
         composableCow.isValidSafeSignature(
-            Safe(payable(owner)),
+            CowSafe(payable(owner)),
             address(0), // sender isn't used
             keccak256("some gpv2order hash"),
             keccak256("some domain separator"),
@@ -359,7 +360,7 @@ contract ComposableCowTest is BaseComposableCowTest {
         bytes memory cd = abi.encodeCall(
             composableCow.isValidSafeSignature,
             (
-                Safe(payable(address(owner))),
+                CowSafe(payable(address(owner))),
                 address(0), // sender isn't used
                 keccak256(abi.encode(order)),
                 domainSeparator,

test/helpers/Safe.t.sol

@@ -2,12 +2,13 @@
 pragma solidity >=0.8.0 <0.9.0;
 
 import {Safe} from "safe/Safe.sol";
-import {Enum} from "safe/common/Enum.sol";
+import {Enum} from "safe/libraries/Enum.sol";
 import {SafeProxyFactory} from "safe/proxies/SafeProxyFactory.sol";
 import {CompatibilityFallbackHandler} from "safe/handler/CompatibilityFallbackHandler.sol";
 import {MultiSend} from "safe/libraries/MultiSend.sol";
 import {SignMessageLib} from "safe/libraries/SignMessageLib.sol";
-import {ExtensibleFallbackHandler, FallbackHandler, MarshalLib} from "safe/handler/ExtensibleFallbackHandler.sol";
+import {ExtensibleFallbackHandler, FallbackHandler} from "safe/handler/ExtensibleFallbackHandler.sol";
+import {MarshalLib} from "safe/handler/extensible/MarshalLib.sol";
 
 import {SafeLib} from "../libraries/SafeLib.t.sol";
 import {TestAccount, TestAccountLib} from "../libraries/TestAccountLib.t.sol";

test/libraries/SafeLib.t.sol

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: GPL-3.0
 pragma solidity >=0.8.0 <0.9.0;
 
-import {Enum} from "safe/common/Enum.sol";
+import {Enum} from "safe/libraries/Enum.sol";
 import {Safe} from "safe/Safe.sol";
 import {SafeProxy} from "safe/proxies/SafeProxy.sol";
 import {SafeProxyFactory} from "safe/proxies/SafeProxyFactory.sol";