SGX to TDX

.github/workflows/l2-contracts.yml

@@ -19,6 +19,7 @@ jobs:
           uses: actions/checkout@v4
           with:
             fetch-depth: 0
+            submodules: recursive
 
         - name: Codespell
           uses: codespell-project/actions-codespell@v2.0
@@ -34,6 +35,8 @@ jobs:
         uses: styfle/cancel-workflow-action@0.12.1
 
       - uses: actions/checkout@v4
+        with:
+          submodules: recursive
       - uses: actions/setup-node@v4
         with:
           cache: 'yarn'
@@ -79,6 +82,8 @@ jobs:
         uses: styfle/cancel-workflow-action@0.12.1
 
       - uses: actions/checkout@v4
+        with:
+          submodules: recursive
       - uses: actions/setup-node@v4
         with:
           cache: 'yarn'

.github/workflows/mainnet-contracts.yml

@@ -11,33 +11,36 @@ on:
 
 jobs:
   codespell:
-      name: Check for spelling errors
-      runs-on: ubuntu-latest
-
-      steps:
-        - name: Checkout
-          uses: actions/checkout@v4
-          with:
-            fetch-depth: 0
-
-        - name: Codespell
-          uses: codespell-project/actions-codespell@v2.0
-          with:
-            path: mainnet-contracts
-            check_hidden: true
-            check_filenames: true
-            skip: "pnpm-lock.yaml"
+    name: Check for spelling errors
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          submodules: recursive
+
+      - name: Codespell
+        uses: codespell-project/actions-codespell@v2.0
+        with:
+          path: mainnet-contracts
+          check_hidden: true
+          check_filenames: true
+          skip: "pnpm-lock.yaml,*/lib/*"
 
   tests:
     runs-on: ubuntu-latest
     steps:
       - name: Cancel previous runs
         uses: styfle/cancel-workflow-action@0.12.1
-      
+
       - uses: actions/checkout@v4
+        with:
+          submodules: recursive
       - uses: actions/setup-node@v4
         with:
-          cache: 'yarn'
+          cache: "yarn"
           cache-dependency-path: yarn.lock
           node-version: 20
 
@@ -69,7 +72,7 @@ jobs:
         uses: stefanzweifel/git-auto-commit-action@v5
         with:
           commit_message: "forge fmt"
-          file_pattern: '*.sol'
+          file_pattern: "*.sol"
 
       - name: List selectors
         working-directory: mainnet-contracts
@@ -81,11 +84,13 @@ jobs:
     steps:
       - name: Cancel previous runs
         uses: styfle/cancel-workflow-action@0.12.1
-      
+
       - uses: actions/checkout@v4
+        with:
+          submodules: recursive
       - uses: actions/setup-node@v4
         with:
-          cache: 'yarn'
+          cache: "yarn"
           cache-dependency-path: yarn.lock
           node-version: 20
 
@@ -102,10 +107,11 @@ jobs:
 
       - name: "Generate the coverage report"
         working-directory: mainnet-contracts
-        run: 'forge coverage --no-match-coverage "(script|test|mock|node_modules|interface|integrations|echidna|L1RewardManagerUnsafe)"  --no-match-contract "CarrotVestingTest" --report lcov -vvv --ir-minimum'
+        run: 'forge coverage --no-match-coverage "(script|test|mock|node_modules|interface|integrations|echidna|L1RewardManagerUnsafe)" --no-match-contract "CarrotVestingTest" --report lcov -vvv --ir-minimum'
         env:
           ETH_RPC_URL: ${{ secrets.ETH_RPC_URL }}
           HOLESKY_RPC_URL: ${{ secrets.HOLESKY_RPC_URL }}
+          HOODI_RPC_URL: ${{ secrets.HOODI_RPC_URL }}
 
       - name: "Upload coverage report to Codecov"
         uses: "codecov/codecov-action@v4"

.gitmodules

@@ -4,3 +4,7 @@
 [submodule "partners/layerzero/lib/forge-std"]
 	path = partners/layerzero/lib/forge-std
 	url = https://github.com/foundry-rs/forge-std
+[submodule "mainnet-contracts/lib/automata-tee-workload-measurement"]
+	path = mainnet-contracts/lib/automata-tee-workload-measurement
+	url = https://github.com/automata-network/automata-tee-workload-measurement
+    branch = develop

l2-contracts/foundry.toml

@@ -30,6 +30,7 @@ bracket_spacing = true
 [rpc_endpoints]
 mainnet="${ETH_RPC_URL}"
 holesky="${HOLESKY_RPC_URL}"
+hoodi="${HOODI_RPC_URL}"
 
 [invariant]
 fail_on_revert=false

l2-contracts/remappings.txt

@@ -22,4 +22,5 @@ l2-contracts/=node_modules/l2-contracts/
 @layerzerolabs/lz-evm-messagelib-v2/=node_modules/@layerzerolabs/lz-evm-messagelib-v2/
 @layerzerolabs/lz-evm-v1-0.7/=node_modules/@layerzerolabs/lz-evm-v1-0.7/
 solidity-bytes-utils/=node_modules/solidity-bytes-utils/
-partners-layerzero/=../partners/layerzero/
+partners-layerzero/=../partners/layerzero/
+@automata-network/automata-tee-workload-measurement=../mainnet-contracts/lib/automata-tee-workload-measurement/src/

mainnet-contracts/README.md

@@ -1,6 +1,7 @@
 # <h1 align="center"> Puffer Vault </h1>
+
 [![Website][Website-badge]][Website] [![Docs][docs-badge]][docs]
-  [![Discord][discord-badge]][discord] [![X][X-badge]][X] [![Foundry][foundry-badge]][foundry]
+[![Discord][discord-badge]][discord] [![X][X-badge]][X] [![Foundry][foundry-badge]][foundry]
 
 [Website-badge]: https://img.shields.io/badge/WEBSITE-8A2BE2
 [Website]: https://www.puffer.fi
@@ -15,8 +16,8 @@
 [foundry]: https://getfoundry.sh
 [foundry-badge]: https://img.shields.io/badge/Built%20with-Foundry-FFDB1C.svg
 
+## Overview
 
-## Overview 
 Stakers can deposit ETH and mint the [pufETH nLRT](https://docs.puffer.fi/protocol/nlrt#pufeth) via the PufferVault contract, which serves as a redeemable receipt for their restaked ETH. If sufficient exit liquidity is available, stakers can reclaim their ETH from the PufferVault. Over time, the redeemable amount is expected to increase from [validator tickets](https://docs.puffer.fi/protocol/validator-tickets) and restaking rewards.
 
 In [contrast with conventional liquid staking tokens (LSTs)](https://docs.puffer.fi/protocol/nlrt#what-is-an-lst), pufETH can provide strictly more rewards for its holders. Not only does pufETH encompass PoS rewards and restaking rewards, but its value can accelerate quickly due to validator ticket sales. Furthermore, the PoS rewards for stakers are decoupled from the protocol validators' performance.
@@ -27,17 +28,18 @@ pufETH is implemented as a reward-bearing ERC20 token, following [ERC4626](https
 
 Read more about pufETH and native Liquid Restaking Tokens (nLRTs) in the [Puffer Docs](https://docs.puffer.fi/protocol/nlrt#pufeth) website.
 
-
 ## How pufETH Works
+
 Stakers deposit ETH to the PufferVault contract to mint the pufETH nLRT. At the protocol's inception, pufETH's conversion rate is one-to-one, but is expected to increase over time. Assuming the protocol performs well, i.e., accrues more rewards than penalties, the amount of ETH reedamable for pufETH will increase.
 
 ### Calculating the Conversion Rate
+
 The conversion rate can be calculated simply as:
 
 ```
 conversion rate = (deposits + rewards - penalties) / pufETH supply
 ```
-  
+
 Where:
 
 - deposits and pufETH supply increase proportionally as stakers deposit ETH to mint pufETH, leaving the conversion rate unaffected.
@@ -46,18 +48,17 @@ Where:
 
 - penalties accrue if validators are slashed on PoS for more than their 1 ETH collateral, which is [disincentivized behavior](https://docs.puffer.fi/protocol/validator-tickets#why--noop-incentives) and mitigated through [anti-slashing technology](https://docs.puffer.fi/technology/secure-signer). Penalties can also accrue if the restaking operator is slashed running AVSs, which is why Puffer is [restricting restaking operator participation](https://docs.puffer.fi/protocol/puffer-modules#restricting-reops) during its nascent stages.
 
-
-
 ## Contract addresses
+
 - PufferVault (pufETH token): `0xD9A442856C234a39a81a089C06451EBAa4306a72`
 - PufferDepositor: `0x4aA799C5dfc01ee7d790e3bf1a7C2257CE1DcefF`
 - AccessManager: `0x8c1686069474410E6243425f4a10177a94EBEE11`
 - Timelock: `0x3C28B7c7Ba1A1f55c9Ce66b263B33B204f2126eA`
 
-For more detailed information on the contract deployments (Mainnet, Holesky, etc) and the ABIs, please check the [Deployments and ACL](https://github.com/PufferFinance/Deployments-and-ACL/blob/main/docs/deployments/) repository.
-
+For more detailed information on the contract deployments (Mainnet, Holesky, Hoodi, etc) and the ABIs, please check the [Deployments and ACL](https://github.com/PufferFinance/Deployments-and-ACL/blob/main/docs/deployments/) repository.
 
 ## Audits
+
 - BlockSec: [v1](./audits/BlockSec-pufETH-v1.pdf), [v2](https://github.com/PufferFinance/PufferPool/blob/polish-docs/docs/audits/Blocksec_audit_April2024.pdf)
 - SlowMist: [v1](./audits/SlowMist-pufETH-v1.pdf), v2
 - Quantstamp: [v1](./audits/Quantstamp-pufETH-v1.pdf)
@@ -66,21 +67,23 @@ For more detailed information on the contract deployments (Mainnet, Holesky, etc
 - Nethermind: [v2](https://github.com/NethermindEth/PublicAuditReports/blob/main/NM0202-FINAL_PUFFER.pdf)
 - Creed: [v2](https://github.com/PufferFinance/PufferPool/blob/polish-docs/docs/audits/Creed_Puffer_Finance_Audit_April2024.pdf)
 
-
 # Tests
 
 <strong>Make sure you have access to a valid archive node RPC for ETH Mainnet (e.g. Infura)</strong>
 
 Installing dependencies and running tests can be executed running:
+
 ```
 ETH_RPC_URL=https://mainnet.infura.io/v3/YOUR_KEY forge test -vvvv
 ```
 
 # Echidna
+
 To install Echidna, see the instructions [here](https://github.com/crytic/echidna). To use Echidna, run the following command from the project's root:
+
 ```bash
 forge install crytic/properties --no-commit
 echidna . --contract EchidnaPufferVaultV2 --config src/echidna/config.yaml
 ```
-For more information see the properties [README](https://github.com/crytic/properties/tree/main).
 
+For more information see the properties [README](https://github.com/crytic/properties/tree/main).

mainnet-contracts/foundry.lock

@@ -0,0 +1,20 @@
+{
+  "../partners/chainlink/lib/forge-std": {
+    "rev": "3b20d60d14b343ee4f908cb8079495c07f5e8981"
+  },
+  "lib/automata-dcap-attestation": {
+    "tag": {
+      "name": "v1.1.0",
+      "rev": "9c96312657f2a905003f6ebf565d5742422f24a2"
+    }
+  },
+  "lib/automata-tee-workload-measurement": {
+    "rev": "c3bcd68f4b887f86374cc47b31041bf2d667e7d3"
+  },
+  "lib/automata-tpm-attestation": {
+    "rev": "1a3ab2bc4886ac5313365f94e3d60dcf01fd9c41"
+  },
+  "partners/chainlink/lib/forge-std": {
+    "rev": "3b20d60d14b343ee4f908cb8079495c07f5e8981"
+  }
+}

mainnet-contracts/foundry.toml

@@ -44,6 +44,7 @@ bracket_spacing = true
 [rpc_endpoints]
 mainnet="${ETH_RPC_URL}"
 holesky="${HOLESKY_RPC_URL}"
+hoodi="${HOODI_RPC_URL}"
 sepolia="${SEPOLIA_RPC_URL}"
 opsepolia ="${OP_SEPOLIA_RPC_URL}"
 

mainnet-contracts/package.json

@@ -1,59 +1,58 @@
 {
-    "name": "mainnet-contracts",
-    "description": "",
-    "version": "1.0.0",
-    "author": {
-        "name": "Puffer Finance",
-        "url": "https://puffer.fi"
-    },
-    "dependencies": {
-        "@layerzerolabs/lz-evm-messagelib-v2": "^3.0.75",
-        "@layerzerolabs/lz-evm-protocol-v2": "^3.0.75",
-        "@layerzerolabs/lz-evm-v1-0.7": "^3.0.75",
-        "@layerzerolabs/oapp-evm": "^0.3.2",
-        "@layerzerolabs/oft-evm": "^3.1.3",
-        "@openzeppelin/contracts": "5.0.1",
-        "@openzeppelin/contracts-upgradeable": "5.0.1",
-        "l2-contracts": "*",
-        "murky": "https://github.com/dmfxyz/murky.git",
-        "rave": "https://github.com/PufferFinance/rave.git#57ce268",
-        "solidity-bytes-utils": "^0.8.4",
-        "solidity-stringutils": "https://github.com/Arachnid/solidity-stringutils"
-    },
-    "devDependencies": {
-        "@crytic/properties": "https://github.com/crytic/properties#f1ff61b",
-        "@layerzerolabs/test-devtools-evm-foundry": "^6.0.3",
-        "@prb/test": "0.6.4",
-        "erc4626-tests": "https://github.com/a16z/erc4626-tests#232ff9b",
-        "forge-std": "github:foundry-rs/forge-std#v1.9.6",
-        "partners-layerzero": "*",
-        "solarray": "github:evmcheb/solarray#a547630",
-        "solhint": "^5.0.3"
-    },
-    "homepage": "https://puffer.fi",
-    "keywords": [
-        "blockchain",
-        "foundry",
-        "smart-contracts",
-        "solidity",
-        "web3",
-        "ethereum",
-        "puffer",
-        "puffer-finance",
-        "solidity",
-        "LRT",
-        "eigenlayer",
-        "restaking",
-        "liquid-staking"
-    ],
-    "scripts": {
-        "fmt": "forge fmt",
-        "build": "forge build",
-        "gas": "forge test --gas-report --mp \"./test/unit/**/*.sol\"",
-        "lint": "yarn run lint:sol",
-        "test:unit": "forge test --mp \"./test/unit/**/*.sol\" -vvv",
-        "slither": "slither .",
-        "coverage": "forge coverage --force --no-match-coverage \"(script|test|mock|interface|node_modules|echidna)\"  --no-match-contract \"PufferModuleManagerHoleskyTestnetFFI\"",
-        "coverage-lcov": "forge coverage --force --no-match-coverage \"(script|test|mock|interface|node_modules|echidna)\"  --no-match-contract \"PufferModuleManagerHoleskyTestnetFFI\" --report lcov"
-    }
+  "name": "mainnet-contracts",
+  "description": "",
+  "version": "1.0.0",
+  "author": {
+    "name": "Puffer Finance",
+    "url": "https://puffer.fi"
+  },
+  "dependencies": {
+    "@layerzerolabs/lz-evm-messagelib-v2": "^3.0.75",
+    "@layerzerolabs/lz-evm-protocol-v2": "^3.0.75",
+    "@layerzerolabs/lz-evm-v1-0.7": "^3.0.75",
+    "@layerzerolabs/oapp-evm": "^0.3.2",
+    "@layerzerolabs/oft-evm": "^3.1.3",
+    "@openzeppelin/contracts": "5.0.1",
+    "@openzeppelin/contracts-upgradeable": "5.0.1",
+    "l2-contracts": "*",
+    "murky": "https://github.com/dmfxyz/murky.git",
+    "solidity-bytes-utils": "^0.8.4",
+    "solidity-stringutils": "https://github.com/Arachnid/solidity-stringutils"
+  },
+  "devDependencies": {
+    "@crytic/properties": "https://github.com/crytic/properties#f1ff61b",
+    "@layerzerolabs/test-devtools-evm-foundry": "^6.0.3",
+    "@prb/test": "0.6.4",
+    "erc4626-tests": "https://github.com/a16z/erc4626-tests#232ff9b",
+    "forge-std": "github:foundry-rs/forge-std#v1.9.6",
+    "partners-layerzero": "*",
+    "solarray": "github:evmcheb/solarray#a547630",
+    "solhint": "^5.0.3"
+  },
+  "homepage": "https://puffer.fi",
+  "keywords": [
+    "blockchain",
+    "foundry",
+    "smart-contracts",
+    "solidity",
+    "web3",
+    "ethereum",
+    "puffer",
+    "puffer-finance",
+    "solidity",
+    "LRT",
+    "eigenlayer",
+    "restaking",
+    "liquid-staking"
+  ],
+  "scripts": {
+    "fmt": "forge fmt",
+    "build": "forge build",
+    "gas": "forge test --gas-report --mp \"./test/unit/**/*.sol\"",
+    "lint": "yarn run lint:sol",
+    "test:unit": "forge test --mp \"./test/unit/**/*.sol\" -vvv",
+    "slither": "slither .",
+    "coverage": "forge coverage --ir-minimum --force --no-match-coverage \"(script|test|mock|interface|node_modules|echidna)\"  --no-match-contract \"CarrotVestingTest\"",
+    "coverage-lcov": "forge coverage --ir-minimum --force --no-match-coverage \"(script|test|mock|interface|node_modules|echidna)\"  --no-match-contract \"CarrotVestingTest\" --report lcov"
+  }
 }