add check if token is created in launchpad (#500)

AFK-AlignedFamKernel · Feb 17, 2025 · e5b77ad · e5b77ad
1 parent fff68c1
commit e5b77ad
Show file tree

Hide file tree

Showing 4 changed files with 48 additions and 0 deletions.
diff --git a/onchain/cairo/launchpad/src/errors.cairo b/onchain/cairo/launchpad/src/errors.cairo
@@ -17,3 +17,4 @@ pub const TICK_SPACING_TOO_HIGH: felt252 = 'Tick spacing high';
 pub const FEE_TOO_HIGH: felt252 = 'Fee too high';
 pub const BOUND_TOO_LOW: felt252 = 'Upper bound too low';
 pub const POOL_COIN_ALREADY_LAUNCHED: felt252 = 'Pool already launched';
+pub const TOKEN_NOT_CREATED_BY_LAUNCHPAD: felt252 = 'Token not created by launchpad';
diff --git a/onchain/cairo/launchpad/src/launchpad/errors.cairo b/onchain/cairo/launchpad/src/launchpad/errors.cairo
@@ -47,3 +47,4 @@ pub const SUPPLY_ABOVE_TOTAL_OWNED: felt252 = 'Supply above total';
 pub const EXTERNAL_CONTRACT_NOT_SETUP: felt252 = 'External address Zero';
 pub const NOT_CLAIMABLE: felt252 = 'Not claimable';
 pub const POOL_COIN_ALREADY_LAUNCHED: felt252 = 'Pool already launched';
+pub const TOKEN_NOT_CREATED_BY_LAUNCHPAD: felt252 = 'Token not created by launchpad';
diff --git a/onchain/cairo/launchpad/src/launchpad/launchpad.cairo b/onchain/cairo/launchpad/src/launchpad/launchpad.cairo
@@ -1145,6 +1145,9 @@ pub mod LaunchpadMarketplace {
             let caller = get_caller_address();
             let token = self.token_created.read(coin_address);
 
+            // check if token is created by the launchpad to prevent malicious erc20
+            assert(!token.creator.is_zero(), errors::TOKEN_NOT_CREATED_BY_LAUNCHPAD);
+            // assert(token.creator == get_contract_address(), errors::TOKEN_NOT_CREATED_BY_LAUNCHPAD);
 
             let is_coin_launched = self.is_coin_launched.read(coin_address);
             assert(!is_coin_launched, errors::POOL_COIN_ALREADY_LAUNCHED);

diff --git a/onchain/cairo/launchpad/src/tests/launchpad_tests.cairo b/onchain/cairo/launchpad/src/tests/launchpad_tests.cairo
@@ -183,6 +183,15 @@ mod launchpad_tests {
         symbol
     }
 
+
+    fn SYMBOL_FELT() -> felt252 {
+        'symbol'.try_into().unwrap()
+    }
+
+    fn NAME_FELT() -> felt252 {
+        'name'.try_into().unwrap()
+    }
+
     // Math
     fn pow_256(self: u256, mut exponent: u8) -> u256 {
         if self.is_zero() {
@@ -1089,6 +1098,40 @@ mod launchpad_tests {
     }
 
 
+    #[test]
+    #[should_panic]
+    fn launch_token_not_from_launchpad_panic() {
+        println!("launch_token_not_from_launchpad_panic");
+        let (sender_address, erc20, launchpad) = request_fixture();
+
+        let erc20_class = declare_erc20();
+        let token_new = deploy_erc20(
+            *erc20_class,
+            name: NAME_FELT(),
+            symbol: SYMBOL_FELT(),
+            initial_supply: DEFAULT_INITIAL_SUPPLY(),
+            recipient: sender_address,
+        );
+
+        // start_cheat_caller_address_global(sender_address);
+        start_cheat_caller_address(erc20.contract_address, sender_address);
+        let default_token = launchpad.get_default_token();
+        assert(default_token.token_address == erc20.contract_address, 'no default token');
+        assert(default_token.starting_price == INITIAL_KEY_PRICE, 'no init price');
+        start_cheat_caller_address(launchpad.contract_address, sender_address);
+
+        let memecoin = IERC20Dispatcher { contract_address: token_new.contract_address };
+        start_cheat_caller_address(memecoin.contract_address, OWNER());
+
+        let total_supply = memecoin.total_supply();
+        memecoin.approve(launchpad.contract_address, total_supply);
+        stop_cheat_caller_address(memecoin.contract_address);
+        start_cheat_caller_address(launchpad.contract_address, sender_address);
+
+        launchpad.launch_token(token_new.contract_address, bonding_type: BondingType::Linear);
+    }
+
+
     #[test]
     #[fork("Mainnet")]
     fn launchpad_integration_linear() {