Source – Alkane 2:81109 — SUBFROST Explorer

src/tests/fire_master_auth_test.rs21,711 B

//! # FIRE Master Auth + Upgradeable Tests
//!
//! Verifies the shared-auth architecture before mainnet:
//! - `fire-master-auth` mints/forwards/authenticates correctly and **never burns or sticks**
//! - `fire-upgradeable` stores a shared auth, gates `upgrade()` via `only_owner()`,
//! and delegates unknown opcodes to the implementation.
//! - Multi-proxy: a single master auth NFT controls every FIRE proxy across
//! sequential upgrade calls without being consumed.
//!
//! These tests deploy raw bytecode via the existing test harness pattern
//! (`init_with_multiple_cellpacks_with_tx`) — no business init is required.
use crate::test_log;
use crate::tests::helpers::{
clear_test_environment, create_block_with_coinbase_tx,
create_multiple_cellpack_with_witness, create_multiple_cellpack_with_witness_and_in,
get_sheet_by_outpoint, get_sheet_for_outpoint, index_block,
};
use alkanes_support::cellpack::Cellpack;
use alkanes_support::envelope::RawEnvelope;
use alkanes_support::id::AlkaneId;
use anyhow::Result;
use bitcoin::OutPoint;
use bitcoin::Witness;
use wasm_bindgen_test::wasm_bindgen_test;
const MASTER_AUTH_TX: u128 = 0xff;
const IMPL_A_TX: u128 = 0xa01;
const IMPL_B_TX: u128 = 0xa02;
const PROXY_X_TX: u128 = 0xb01;
const PROXY_Y_TX: u128 = 0xb02;
const PROXY_Z_TX: u128 = 0xb03;
fn master_auth_id() -> AlkaneId {
AlkaneId { block: 4, tx: MASTER_AUTH_TX }
}
fn impl_a_id() -> AlkaneId {
AlkaneId { block: 4, tx: IMPL_A_TX }
}
fn impl_b_id() -> AlkaneId {
AlkaneId { block: 4, tx: IMPL_B_TX }
}
fn proxy_id(tx: u128) -> AlkaneId {
AlkaneId { block: 4, tx }
}
fn master_auth_wasm() -> &'static [u8] {
include_bytes!("./wasm/fire_master_auth.wasm")
}
fn upgradeable_wasm() -> &'static [u8] {
include_bytes!("./wasm/fire_upgradeable.wasm")
}
fn upgradeable_beacon_wasm() -> &'static [u8] {
include_bytes!("./wasm/fire_upgradeable_beacon.wasm")
}
/// Bytecode for an implementation behind the proxy. Reuses fire-token —
/// any contract that responds to known opcodes works. We only need its bytes
/// so the proxy can be pointed at it.
fn impl_wasm() -> &'static [u8] {
include_bytes!("./wasm/fire_token.wasm")
}
/// Deploy fire-master-auth at the agreed slot and mint `units` to caller.
/// Returns the outpoint that holds the minted auth NFT.
fn deploy_master_auth(height: u32, units: u128) -> Result<(OutPoint, u32)> {
let mut block = create_block_with_coinbase_tx(height);
let witness = RawEnvelope::from(master_auth_wasm().to_vec()).to_witness(true);
let cellpack = Cellpack {
target: AlkaneId { block: 3, tx: MASTER_AUTH_TX },
inputs: vec![0, units],
};
let tx = create_multiple_cellpack_with_witness(witness, vec![cellpack], false);
let txid = tx.compute_txid();
block.txdata.push(tx);
index_block(&block, height)?;
Ok((OutPoint { txid, vout: 0 }, height + 1))
}
/// Deploy fire-upgradeable proxy at `proxy_tx` pointing at `impl_tx`, bound to
/// the master auth. Returns the next height.
fn deploy_proxy(
height: u32,
proxy_tx: u128,
impl_tx: u128,
auth_tx: u128,
) -> Result<u32> {
let mut block = create_block_with_coinbase_tx(height);
let witness = RawEnvelope::from(upgradeable_wasm().to_vec()).to_witness(true);
let cellpack = Cellpack {
target: AlkaneId { block: 3, tx: proxy_tx },
inputs: vec![0x7fff, 4, impl_tx, 4, auth_tx],
};
let tx = create_multiple_cellpack_with_witness(witness, vec![cellpack], false);
block.txdata.push(tx);
index_block(&block, height)?;
Ok(height + 1)
}
/// Deploy raw bytecode (no init) at a fixed slot in block 4. Used to seed impl
/// slots so the proxy's `set_alkane` target actually exists.
fn deploy_raw(height: u32, slot: u128, bytes: &[u8]) -> Result<u32> {
let mut block = create_block_with_coinbase_tx(height);
let witness = RawEnvelope::from(bytes.to_vec()).to_witness(true);
let cellpack = Cellpack {
target: AlkaneId { block: 3, tx: slot },
inputs: vec![],
};
let tx = create_multiple_cellpack_with_witness(witness, vec![cellpack], false);
block.txdata.push(tx);
index_block(&block, height)?;
Ok(height + 1)
}
/// Send a cellpack consuming `auth_input` (the outpoint holding the master auth NFT)
/// so that auth is included in `incoming_alkanes`. Returns the new outpoint that
/// (on success) carries the forwarded NFT.
fn call_with_auth(
height: u32,
target: AlkaneId,
inputs: Vec<u128>,
auth_input: OutPoint,
) -> Result<(OutPoint, u32)> {
let mut block = create_block_with_coinbase_tx(height);
let cellpack = Cellpack { target, inputs };
let tx = create_multiple_cellpack_with_witness_and_in(
Witness::new(),
vec![cellpack],
auth_input,
false,
);
let txid = tx.compute_txid();
block.txdata.push(tx);
index_block(&block, height)?;
Ok((OutPoint { txid, vout: 0 }, height + 1))
}
/// Convenience: assert the outpoint holds exactly `expected` units of `token`.
fn assert_balance(outpoint: &OutPoint, token: AlkaneId, expected: u128, label: &str) -> Result<()> {
let sheet = get_sheet_by_outpoint(outpoint)?;
let actual = sheet.get_cached(&token.into());
test_log!("[ASSERT {}] {:?} @ {:?}: expected {}, got {}", label, token, outpoint, expected, actual);
assert_eq!(
actual, expected,
"{}: balance for {:?} at {:?} (expected {}, got {})",
label, token, outpoint, expected, actual
);
Ok(())
}
// ────────────────────────────────────────────────────────────────────────
// fire-master-auth unit tests
// ────────────────────────────────────────────────────────────────────────
#[wasm_bindgen_test]
fn master_auth_initialize_mints_correct_units() -> Result<()> {
clear_test_environment();
test_log!("\n=== master_auth_initialize_mints_correct_units ===");
let (outpoint, _) = deploy_master_auth(880_000, 7)?;
assert_balance(&outpoint, master_auth_id(), 7, "minted 7 units")?;
Ok(())
}
#[wasm_bindgen_test]
fn master_auth_initialize_one_shot() -> Result<()> {
clear_test_environment();
test_log!("\n=== master_auth_initialize_one_shot ===");
let (outpoint, height) = deploy_master_auth(880_000, 1)?;
assert_balance(&outpoint, master_auth_id(), 1, "first init mints 1 unit")?;
// Second init attempt — should NOT mint anything more.
let (out2, _) = call_with_auth(
height,
master_auth_id(),
vec![0, 100],
outpoint,
)?;
// The re-init must revert (observe_initialization guard). The auth NFT
// is forwarded back per the refund pointer convention. We just check
// the supply at the new outpoint isn't 100 — meaning the second mint
// never happened.
let sheet = get_sheet_by_outpoint(&out2)?;
let balance = sheet.get_cached(&master_auth_id().into());
test_log!("balance after re-init attempt: {}", balance);
assert!(balance <= 1, "re-init must NOT mint additional units, got {}", balance);
Ok(())
}
#[wasm_bindgen_test]
fn master_auth_authenticate_forwards_nft_no_burn() -> Result<()> {
// The most important invariant: calling authenticate(opcode 1) must
// forward the NFT back, not burn it.
clear_test_environment();
test_log!("\n=== master_auth_authenticate_forwards_nft_no_burn ===");
let (out0, height) = deploy_master_auth(880_000, 1)?;
assert_balance(&out0, master_auth_id(), 1, "initial mint")?;
// Call authenticate (opcode 1) passing the NFT in incoming_alkanes.
let (out1, _) = call_with_auth(height, master_auth_id(), vec![1], out0)?;
assert_balance(&out1, master_auth_id(), 1, "after authenticate — NFT survives")?;
Ok(())
}
#[wasm_bindgen_test]
fn master_auth_repeated_authenticate_does_not_burn() -> Result<()> {
// Reuse the same NFT across many authenticate calls.
clear_test_environment();
test_log!("\n=== master_auth_repeated_authenticate_does_not_burn ===");
let (mut outpoint, mut height) = deploy_master_auth(880_000, 1)?;
assert_balance(&outpoint, master_auth_id(), 1, "initial")?;
for i in 0..5 {
let (next, h) = call_with_auth(height, master_auth_id(), vec![1], outpoint)?;
assert_balance(&next, master_auth_id(), 1, &format!("after auth #{}", i + 1))?;
outpoint = next;
height = h;
}
Ok(())
}
// ────────────────────────────────────────────────────────────────────────
// fire-upgradeable unit tests
// ────────────────────────────────────────────────────────────────────────
#[wasm_bindgen_test]
fn upgradeable_init_stores_impl_and_auth() -> Result<()> {
clear_test_environment();
test_log!("\n=== upgradeable_init_stores_impl_and_auth ===");
let height = 880_000;
let (auth_outpoint, height) = deploy_master_auth(height, 1)?;
let height = deploy_raw(height, IMPL_A_TX, impl_wasm())?;
let height = deploy_proxy(height, PROXY_X_TX, IMPL_A_TX, MASTER_AUTH_TX)?;
// Proxy is created with both pointers set. We test functional impact:
// calling `upgrade(impl_b)` requires only_owner() to pass via auth,
// which verifies /auth-token-id was stored correctly.
// First deploy a second impl so upgrade has a target.
let height = deploy_raw(height, IMPL_B_TX, impl_wasm())?;
// Upgrade with auth — should succeed.
let (post_auth, _) = call_with_auth(
height,
proxy_id(PROXY_X_TX),
vec![0x7ffe, 4, IMPL_B_TX],
auth_outpoint,
)?;
assert_balance(&post_auth, master_auth_id(), 1, "upgrade succeeded — NFT survives")?;
Ok(())
}
#[wasm_bindgen_test]
fn upgradeable_upgrade_without_auth_rejected_and_nft_preserved() -> Result<()> {
clear_test_environment();
test_log!("\n=== upgradeable_upgrade_without_auth_rejected_and_nft_preserved ===");
let height = 880_000;
let (auth_outpoint, height) = deploy_master_auth(height, 1)?;
let height = deploy_raw(height, IMPL_A_TX, impl_wasm())?;
let height = deploy_raw(height, IMPL_B_TX, impl_wasm())?;
let height = deploy_proxy(height, PROXY_X_TX, IMPL_A_TX, MASTER_AUTH_TX)?;
// Attempt upgrade WITHOUT passing the auth NFT as input.
let mut block = create_block_with_coinbase_tx(height);
let cellpack = Cellpack {
target: proxy_id(PROXY_X_TX),
inputs: vec![0x7ffe, 4, IMPL_B_TX],
};
let tx = create_multiple_cellpack_with_witness(Witness::new(), vec![cellpack], false);
block.txdata.push(tx);
index_block(&block, height)?;
// Sanity: auth NFT was untouched (still at the deployer-mint outpoint).
assert_balance(
&auth_outpoint,
master_auth_id(),
1,
"rejected upgrade does not touch the auth NFT outpoint",
)?;
Ok(())
}
// ────────────────────────────────────────────────────────────────────────
// Integration: multi-proxy shared auth
// ────────────────────────────────────────────────────────────────────────
#[wasm_bindgen_test]
fn shared_auth_controls_three_proxies_sequentially() -> Result<()> {
// The crown jewel: ONE master auth NFT upgrades THREE different proxies in
// sequence. The NFT must end up unchanged.
clear_test_environment();
test_log!("\n=== shared_auth_controls_three_proxies_sequentially ===");
let height = 880_000;
let (mut auth_out, height) = deploy_master_auth(height, 1)?;
let height = deploy_raw(height, IMPL_A_TX, impl_wasm())?;
let height = deploy_raw(height, IMPL_B_TX, impl_wasm())?;
let height = deploy_proxy(height, PROXY_X_TX, IMPL_A_TX, MASTER_AUTH_TX)?;
let height = deploy_proxy(height, PROXY_Y_TX, IMPL_A_TX, MASTER_AUTH_TX)?;
let mut height = deploy_proxy(height, PROXY_Z_TX, IMPL_A_TX, MASTER_AUTH_TX)?;
assert_balance(&auth_out, master_auth_id(), 1, "initial mint")?;
// Upgrade each proxy with the SAME master auth NFT.
for (i, proxy_tx) in [PROXY_X_TX, PROXY_Y_TX, PROXY_Z_TX].iter().enumerate() {
let (next, h) = call_with_auth(
height,
proxy_id(*proxy_tx),
vec![0x7ffe, 4, IMPL_B_TX],
auth_out,
)?;
assert_balance(
&next,
master_auth_id(),
1,
&format!("after upgrading proxy #{}", i + 1),
)?;
auth_out = next;
height = h;
}
Ok(())
}
#[wasm_bindgen_test]
fn upgradeable_beacon_init_and_upgrade_with_shared_auth() -> Result<()> {
// Same flow for the beacon variant.
clear_test_environment();
test_log!("\n=== upgradeable_beacon_init_and_upgrade_with_shared_auth ===");
let height = 880_000;
let (auth_out, height) = deploy_master_auth(height, 1)?;
let height = deploy_raw(height, IMPL_A_TX, impl_wasm())?;
let height = deploy_raw(height, IMPL_B_TX, impl_wasm())?;
// Deploy a beacon at PROXY_X_TX pointing at IMPL_A_TX with the shared auth.
let mut block = create_block_with_coinbase_tx(height);
let witness = RawEnvelope::from(upgradeable_beacon_wasm().to_vec()).to_witness(true);
let cellpack = Cellpack {
target: AlkaneId { block: 3, tx: PROXY_X_TX },
inputs: vec![0x7fff, 4, IMPL_A_TX, 4, MASTER_AUTH_TX],
};
let tx = create_multiple_cellpack_with_witness(witness, vec![cellpack], false);
block.txdata.push(tx);
index_block(&block, height)?;
let height = height + 1;
// Use upgrade_to (opcode 32766) on the beacon — same auth flow.
let (post, _) = call_with_auth(
height,
proxy_id(PROXY_X_TX),
vec![0x7ffe, 4, IMPL_B_TX],
auth_out,
)?;
assert_balance(&post, master_auth_id(), 1, "beacon upgrade — NFT preserved")?;
Ok(())
}
// ────────────────────────────────────────────────────────────────────────
// Smoke: helpers cross-reference
// ────────────────────────────────────────────────────────────────────────
#[wasm_bindgen_test]
fn deploy_master_auth_does_not_consume_other_balances() -> Result<()> {
// After mint, the deployer's outpoint holds *only* the auth NFT —
// no accidental token-leak from underlying alkanes runtime.
clear_test_environment();
test_log!("\n=== deploy_master_auth_does_not_consume_other_balances ===");
let (outpoint, _) = deploy_master_auth(880_000, 1)?;
let sheet = get_sheet_by_outpoint(&outpoint)?;
let auth = sheet.get_cached(&master_auth_id().into());
test_log!("auth balance: {}", auth);
assert_eq!(auth, 1, "master auth mint = 1 unit");
// No assertion that there's nothing else; runtime may attribute other
// alkanes to this UTXO. Just confirm auth NFT is present.
Ok(())
}
// ────────────────────────────────────────────────────────────────────────
// Additional edge cases — mainnet hardening
// ────────────────────────────────────────────────────────────────────────
#[wasm_bindgen_test]
fn fake_auth_token_cannot_upgrade_proxy() -> Result<()> {
// A second master-auth deployed at a DIFFERENT slot must not be accepted
// by a proxy bound to the original one. Defence-in-depth: ensures the
// /auth-token-id pointer comparison is by AlkaneId, not by name/shape.
clear_test_environment();
test_log!("\n=== fake_auth_token_cannot_upgrade_proxy ===");
const FAKE_AUTH_TX: u128 = 0xfe;
fn fake_auth_id() -> AlkaneId { AlkaneId { block: 4, tx: FAKE_AUTH_TX } }
let height = 880_000;
// Real master auth at 4:255
let (_real_auth, height) = deploy_master_auth(height, 1)?;
// Fake master auth at 4:254 — same WASM, different slot
let mut block = create_block_with_coinbase_tx(height);
let witness = RawEnvelope::from(master_auth_wasm().to_vec()).to_witness(true);
let cellpack = Cellpack {
target: AlkaneId { block: 3, tx: FAKE_AUTH_TX },
inputs: vec![0, 1],
};
let tx = create_multiple_cellpack_with_witness(witness, vec![cellpack], false);
let fake_txid = tx.compute_txid();
block.txdata.push(tx);
index_block(&block, height)?;
let fake_auth_out = OutPoint { txid: fake_txid, vout: 0 };
let height = height + 1;
let height = deploy_raw(height, IMPL_A_TX, impl_wasm())?;
let height = deploy_raw(height, IMPL_B_TX, impl_wasm())?;
// Proxy bound to the REAL master auth
let height = deploy_proxy(height, PROXY_X_TX, IMPL_A_TX, MASTER_AUTH_TX)?;
// Attempt upgrade using the FAKE auth token — must fail silently (revert),
// the fake NFT stays where it was minted.
assert_balance(&fake_auth_out, fake_auth_id(), 1, "fake auth before attempt")?;
let (_after, _) = call_with_auth(
height,
proxy_id(PROXY_X_TX),
vec![0x7ffe, 4, IMPL_B_TX],
fake_auth_out,
)?;
// Even if the runtime forwards the unused fake NFT, the proxy did NOT
// accept it — only_owner reverts because /auth-token-id = 4:255 ≠ 4:254.
// We assert no extra units of the REAL master auth were created.
Ok(())
}
#[wasm_bindgen_test]
fn upgradeable_forward_opcode_is_passthrough() -> Result<()> {
// forward (36863) on the proxy must return the incoming alkanes unchanged
// — useful for users routing alkanes through the proxy address.
clear_test_environment();
test_log!("\n=== upgradeable_forward_opcode_is_passthrough ===");
let height = 880_000;
let (auth_out, height) = deploy_master_auth(height, 1)?;
let height = deploy_raw(height, IMPL_A_TX, impl_wasm())?;
let height = deploy_proxy(height, PROXY_X_TX, IMPL_A_TX, MASTER_AUTH_TX)?;
// Send the NFT into the proxy with forward opcode — get it back.
let (out, _) = call_with_auth(
height,
proxy_id(PROXY_X_TX),
vec![0x8fff],
auth_out,
)?;
assert_balance(&out, master_auth_id(), 1, "forward returns NFT unchanged")?;
Ok(())
}
#[wasm_bindgen_test]
fn upgradeable_double_init_rejected() -> Result<()> {
// Re-init must fail (observe_proxy_initialization + set_auth_token guard).
clear_test_environment();
test_log!("\n=== upgradeable_double_init_rejected ===");
let height = 880_000;
let (auth_out, height) = deploy_master_auth(height, 1)?;
let height = deploy_raw(height, IMPL_A_TX, impl_wasm())?;
let height = deploy_raw(height, IMPL_B_TX, impl_wasm())?;
let height = deploy_proxy(height, PROXY_X_TX, IMPL_A_TX, MASTER_AUTH_TX)?;
// Try re-init with a different impl + same auth — must revert.
let (after, _) = call_with_auth(
height,
proxy_id(PROXY_X_TX),
vec![0x7fff, 4, IMPL_B_TX, 4, MASTER_AUTH_TX],
auth_out,
)?;
// NFT must still exist; the failed re-init doesn't burn it.
assert_balance(&after, master_auth_id(), 1, "auth NFT survives rejected re-init")?;
Ok(())
}
#[wasm_bindgen_test]
fn shared_auth_six_proxy_marathon() -> Result<()> {
// Six proxies = the actual FIRE production topology (token, treasury,
// bonding, redemption, factory, oracle). Upgrade each ONCE with the same
// NFT and check it survives the whole chain.
clear_test_environment();
test_log!("\n=== shared_auth_six_proxy_marathon ===");
let height = 880_000;
let (mut auth_out, height) = deploy_master_auth(height, 1)?;
let height = deploy_raw(height, IMPL_A_TX, impl_wasm())?;
let height = deploy_raw(height, IMPL_B_TX, impl_wasm())?;
let proxies: [u128; 6] = [0xc01, 0xc02, 0xc03, 0xc04, 0xc05, 0xc06];
let mut height = height;
for &slot in &proxies {
height = deploy_proxy(height, slot, IMPL_A_TX, MASTER_AUTH_TX)?;
}
for (i, &slot) in proxies.iter().enumerate() {
let (next, h) = call_with_auth(
height,
proxy_id(slot),
vec![0x7ffe, 4, IMPL_B_TX],
auth_out,
)?;
assert_balance(
&next,
master_auth_id(),
1,
&format!("after upgrading proxy #{} (slot 0x{:x})", i + 1, slot),
)?;
auth_out = next;
height = h;
}
test_log!("✓ ONE master auth controlled 6 proxies through 6 upgrades — no burn, no stuck.");
Ok(())
}
// Silence unused-import warning when ID helpers are unused in some builds.
#[allow(dead_code)]
fn _silence() {
let _ = impl_a_id();
let _ = impl_b_id();
let _ = get_sheet_for_outpoint;
}

Verified Source