CCIP-4748 CCTP Upgradeability Fix (smartcontractkit#16140)

* CCTPMessageTransmitterProxy + test

* fix exiting test

* Add test for new version of USDCTokenPool.sol

* update wrappers

* add changeset

* fix integration tests

* update wrapper dependency

* [Bot] Update changeset file with jira issues

* fix imports in deployments

* update comments

* merge

* change version to dev

* remove extra geth wrapper

* configure mapping for allowed callers

* update comments for USDC pool burn

* replace allowedCallers mapping with EnumerableSet

* fixing comments

---------

Co-authored-by: app-token-issuer-infra-releng[bot] <120227048+app-token-issuer-infra-releng[bot]@users.noreply.github.com>

Author: 0xsuryansh

contracts/.changeset/brave-keys-enjoy.md

@@ -0,0 +1,9 @@
+---
+'@chainlink/contracts': patch
+---
+
+#internal Add Proxy contract for resolving problem with USDC upgradeability
+
+PR issue: CCIP-4748
+
+Solidity Review issue: CCIP-3966

contracts/gas-snapshots/ccip.gas-snapshot

@@ -23,6 +23,10 @@ CCIPHome_promoteCandidateAndRevokeActive:test_promoteCandidateAndRevokeActive_mu
 CCIPHome_revokeCandidate:test_revokeCandidate() (gas: 30647)
 CCIPHome_setCandidate:test_setCandidate() (gas: 1365392)
 CCIPHome_supportsInterface:test_supportsInterface() (gas: 9885)
+CCTPMessageTransmitterProxy_configureAllowedCallers:test_configureAllowedCallers() (gas: 65308)
+CCTPMessageTransmitterProxy_getAllowedCallers:test_configureAllowedCallers() (gas: 75076)
+CCTPMessageTransmitterProxy_getCCTPTransmitter:test_getCCTPTransmitter() (gas: 10536)
+CCTPMessageTransmitterProxy_receiveMesssage:test_receiveMesssage() (gas: 31304)
 DefensiveExampleTest:test_HappyPath() (gas: 200535)
 DefensiveExampleTest:test_Recovery() (gas: 424996)
 E2E:test_E2E_3MessagesMMultiOffRampSuccess_gas() (gas: 1519925)
@@ -136,11 +140,11 @@ FeeQuoter_updateTokenPriceFeeds:test_SingleFeedUpdate() (gas: 53171)
 FeeQuoter_updateTokenPriceFeeds:test_ZeroFeeds() (gas: 12471)
 FeeQuoter_validateDestFamilyAddress:test_ValidEVMAddress() (gas: 6840)
 FeeQuoter_validateDestFamilyAddress:test_ValidSVMAddress() (gas: 6701)
-HybridLockReleaseUSDCTokenPool_lockOrBurn:test_PrimaryMechanism() (gas: 130339)
-HybridLockReleaseUSDCTokenPool_lockOrBurn:test_onLockReleaseMechanism() (gas: 140169)
-HybridLockReleaseUSDCTokenPool_lockOrBurn:test_onLockReleaseMechanism_thenSwitchToPrimary() (gas: 202967)
-HybridLockReleaseUSDCTokenPool_releaseOrMint:test_OnLockReleaseMechanism() (gas: 206350)
-HybridLockReleaseUSDCTokenPool_releaseOrMint:test_incomingMessageWithPrimaryMechanism() (gas: 260423)
+HybridLockReleaseUSDCTokenPool_lockOrBurn:test_PrimaryMechanism() (gas: 130321)
+HybridLockReleaseUSDCTokenPool_lockOrBurn:test_onLockReleaseMechanism() (gas: 140191)
+HybridLockReleaseUSDCTokenPool_lockOrBurn:test_onLockReleaseMechanism_thenSwitchToPrimary() (gas: 202932)
+HybridLockReleaseUSDCTokenPool_releaseOrMint:test_OnLockReleaseMechanism() (gas: 206305)
+HybridLockReleaseUSDCTokenPool_releaseOrMint:test_incomingMessageWithPrimaryMechanism() (gas: 265499)
 LockReleaseTokenPool_canAcceptLiquidity:test_CanAcceptLiquidity() (gas: 3222607)
 LockReleaseTokenPool_lockOrBurn:test_LockOrBurnWithAllowList() (gas: 72828)
 LockReleaseTokenPool_releaseOrMint:test_ReleaseOrMint() (gas: 217898)
@@ -416,23 +420,24 @@ TokenPool_parseRemoteDecimals:test_parseRemoteDecimals() (gas: 14030)
 TokenPool_parseRemoteDecimals:test_parseRemoteDecimals_NoDecimalsDefaultsToLocalDecimals() (gas: 9705)
 TokenPool_removeRemotePool:test_removeRemotePool() (gas: 188402)
 TokenPool_setRateLimitAdmin:test_SetRateLimitAdmin() (gas: 37630)
-USDCBridgeMigrator_BurnLockedUSDC:test_PrimaryMechanism() (gas: 130502)
-USDCBridgeMigrator_BurnLockedUSDC:test_lockOrBurn_then_BurnInCCTPMigration() (gas: 303967)
-USDCBridgeMigrator_BurnLockedUSDC:test_onLockReleaseMechanism() (gas: 140236)
-USDCBridgeMigrator_BurnLockedUSDC:test_onLockReleaseMechanism_thenSwitchToPrimary() (gas: 203330)
-USDCBridgeMigrator_cancelMigrationProposal:test_cancelExistingCCTPMigrationProposal() (gas: 56100)
-USDCBridgeMigrator_provideLiquidity:test_PrimaryMechanism() (gas: 130520)
-USDCBridgeMigrator_provideLiquidity:test_lockOrBurn_then_BurnInCCTPMigration() (gas: 303967)
-USDCBridgeMigrator_provideLiquidity:test_onLockReleaseMechanism() (gas: 140325)
-USDCBridgeMigrator_provideLiquidity:test_onLockReleaseMechanism_thenSwitchToPrimary() (gas: 203331)
-USDCBridgeMigrator_releaseOrMint:test_OnLockReleaseMechanism() (gas: 206383)
-USDCBridgeMigrator_releaseOrMint:test_incomingMessageWithPrimaryMechanism() (gas: 260476)
-USDCBridgeMigrator_releaseOrMint:test_unstickManualTxAfterMigration_destChain() (gas: 142853)
-USDCBridgeMigrator_releaseOrMint:test_unstickManualTxAfterMigration_homeChain() (gas: 505540)
-USDCBridgeMigrator_updateChainSelectorMechanism:test_PrimaryMechanism() (gas: 130502)
-USDCBridgeMigrator_updateChainSelectorMechanism:test_lockOrBurn_then_BurnInCCTPMigration() (gas: 303949)
-USDCBridgeMigrator_updateChainSelectorMechanism:test_onLockReleaseMechanism() (gas: 140325)
-USDCBridgeMigrator_updateChainSelectorMechanism:test_onLockReleaseMechanism_thenSwitchToPrimary() (gas: 203312)
-USDCTokenPool_lockOrBurn:test_LockOrBurn() (gas: 128094)
-USDCTokenPool_releaseOrMint:test_ReleaseOrMintRealTx() (gas: 260189)
+USDCBridgeMigrator_BurnLockedUSDC:test_PrimaryMechanism() (gas: 130484)
+USDCBridgeMigrator_BurnLockedUSDC:test_lockOrBurn_then_BurnInCCTPMigration() (gas: 304002)
+USDCBridgeMigrator_BurnLockedUSDC:test_onLockReleaseMechanism() (gas: 140258)
+USDCBridgeMigrator_BurnLockedUSDC:test_onLockReleaseMechanism_thenSwitchToPrimary() (gas: 203295)
+USDCBridgeMigrator_cancelMigrationProposal:test_cancelExistingCCTPMigrationProposal() (gas: 56135)
+USDCBridgeMigrator_provideLiquidity:test_PrimaryMechanism() (gas: 130503)
+USDCBridgeMigrator_provideLiquidity:test_lockOrBurn_then_BurnInCCTPMigration() (gas: 304002)
+USDCBridgeMigrator_provideLiquidity:test_onLockReleaseMechanism() (gas: 140347)
+USDCBridgeMigrator_provideLiquidity:test_onLockReleaseMechanism_thenSwitchToPrimary() (gas: 203296)
+USDCBridgeMigrator_releaseOrMint:test_OnLockReleaseMechanism() (gas: 206338)
+USDCBridgeMigrator_releaseOrMint:test_incomingMessageWithPrimaryMechanism() (gas: 265552)
+USDCBridgeMigrator_releaseOrMint:test_unstickManualTxAfterMigration_destChain() (gas: 142808)
+USDCBridgeMigrator_releaseOrMint:test_unstickManualTxAfterMigration_homeChain() (gas: 510650)
+USDCBridgeMigrator_updateChainSelectorMechanism:test_PrimaryMechanism() (gas: 130484)
+USDCBridgeMigrator_updateChainSelectorMechanism:test_lockOrBurn_then_BurnInCCTPMigration() (gas: 303984)
+USDCBridgeMigrator_updateChainSelectorMechanism:test_onLockReleaseMechanism() (gas: 140347)
+USDCBridgeMigrator_updateChainSelectorMechanism:test_onLockReleaseMechanism_thenSwitchToPrimary() (gas: 203277)
+USDCTokenPool_constructor:test_constructor() (gas: 3192321)
+USDCTokenPool_lockOrBurn:test_LockOrBurn() (gas: 128129)
+USDCTokenPool_releaseOrMint:test_ReleaseOrMintRealTx() (gas: 265265)
 USDCTokenPool_supportsInterface:test_SupportsInterface() (gas: 10108)

contracts/src/v0.8/ccip/pools/USDC/CCTPMessageTransmitterProxy.sol

@@ -0,0 +1,87 @@
+// SPDX-License-Identifier: BUSL-1.1
+pragma solidity ^0.8.24;
+
+import {IMessageTransmitter} from "./IMessageTransmitter.sol";
+import {ITokenMessenger} from "./ITokenMessenger.sol";
+
+import {Ownable2StepMsgSender} from "../../../shared/access/Ownable2StepMsgSender.sol";
+
+import {EnumerableSet} from "../../../vendor/openzeppelin-solidity/v4.8.3/contracts/utils/structs/EnumerableSet.sol";
+
+/// @title CCTP Message Transmitter Proxy
+/// @notice A proxy contract for handling messages transmitted via the Cross Chain Transfer Protocol (CCTP).
+/// @dev This contract is responsible for sending messages to the `IMessageTransmitter` and ensuring only allowed callers can invoke it.
+contract CCTPMessageTransmitterProxy is Ownable2StepMsgSender {
+  using EnumerableSet for EnumerableSet.AddressSet;
+
+  /// @notice Error thrown when a function is called by an unauthorized address.
+  error Unauthorized(address caller);
+
+  /// @notice Emitted when an allowed caller is added.
+  event AllowedCallerAdded(address indexed caller);
+  /// @notice Emitted when an allowed caller is removed.
+  event AllowedCallerRemoved(address indexed caller);
+
+  struct AllowedCallerConfigArgs {
+    address caller;
+    bool allowed;
+  }
+
+  /// @notice Immutable reference to the `IMessageTransmitter` contract.
+  IMessageTransmitter public immutable i_cctpTransmitter;
+
+  /// @notice Enumerable set of addresses allowed to call `receiveMessage`.
+  EnumerableSet.AddressSet private s_allowedCallers;
+
+  /// @notice One-time cyclic dependency between TokenPool and MessageTransmitter.
+  constructor(
+    ITokenMessenger tokenMessenger
+  ) {
+    i_cctpTransmitter = IMessageTransmitter(tokenMessenger.localMessageTransmitter());
+  }
+
+  /// @notice Receives a message from the `IMessageTransmitter` contract and validates it.
+  /// @dev Can only be called by an allowed caller to process incoming messages.
+  /// @param message The payload of the message being received.
+  /// @param attestation The cryptographic proof validating the message.
+  /// @return success A boolean indicating if the message was successfully processed.
+  function receiveMessage(bytes calldata message, bytes calldata attestation) external returns (bool success) {
+    if (!s_allowedCallers.contains(msg.sender)) {
+      revert Unauthorized(msg.sender);
+    }
+    return i_cctpTransmitter.receiveMessage(message, attestation);
+  }
+
+  /// @notice Configures the allowed callers for the `receiveMessage` function.
+  /// @param configArgs An array of `AllowedCallerConfigArgs` structs.
+  function configureAllowedCallers(
+    AllowedCallerConfigArgs[] calldata configArgs
+  ) external onlyOwner {
+    for (uint256 i = 0; i < configArgs.length; ++i) {
+      if (configArgs[i].allowed) {
+        if (s_allowedCallers.add(configArgs[i].caller)) {
+          emit AllowedCallerAdded(configArgs[i].caller);
+        }
+      } else {
+        if (s_allowedCallers.remove(configArgs[i].caller)) {
+          emit AllowedCallerRemoved(configArgs[i].caller);
+        }
+      }
+    }
+  }
+
+  /// @notice Checks if the caller is allowed to call the `receiveMessage` function.
+  /// @param caller The address to check.
+  /// @return allowed A boolean indicating if the caller is allowed.
+  function isAllowedCaller(
+    address caller
+  ) external view returns (bool allowed) {
+    return s_allowedCallers.contains(caller);
+  }
+
+  /// @notice Returns an array of all allowed callers.
+  /// @return allowedCallers An array of allowed caller addresses.
+  function getAllowedCallers() external view returns (address[] memory allowedCallers) {
+    return s_allowedCallers.values();
+  }
+}

contracts/src/v0.8/ccip/pools/USDC/HybridLockReleaseUSDCTokenPool.sol

@@ -6,6 +6,7 @@ import {ITokenMessenger} from "../USDC/ITokenMessenger.sol";
 
 import {Pool} from "../../libraries/Pool.sol";
 import {TokenPool} from "../TokenPool.sol";
+import {CCTPMessageTransmitterProxy} from "../USDC/CCTPMessageTransmitterProxy.sol";
 import {USDCTokenPool} from "../USDC/USDCTokenPool.sol";
 import {USDCBridgeMigrator} from "./USDCBridgeMigrator.sol";
 
@@ -44,11 +45,15 @@ contract HybridLockReleaseUSDCTokenPool is USDCTokenPool, USDCBridgeMigrator {
 
   constructor(
     ITokenMessenger tokenMessenger,
+    CCTPMessageTransmitterProxy cctpMessageTransmitterProxy,
     IERC20 token,
     address[] memory allowlist,
     address rmnProxy,
     address router
-  ) USDCTokenPool(tokenMessenger, token, allowlist, rmnProxy, router) USDCBridgeMigrator(address(token)) {}
+  )
+    USDCTokenPool(tokenMessenger, cctpMessageTransmitterProxy, token, allowlist, rmnProxy, router)
+    USDCBridgeMigrator(address(token))
+  {}
 
   // ================================================================
   // │                   Incoming/Outgoing Mechanisms               |

contracts/src/v0.8/ccip/pools/USDC/USDCTokenPool.sol

@@ -7,6 +7,7 @@ import {ITokenMessenger} from "./ITokenMessenger.sol";
 
 import {Pool} from "../../libraries/Pool.sol";
 import {TokenPool} from "../TokenPool.sol";
+import {CCTPMessageTransmitterProxy} from "./CCTPMessageTransmitterProxy.sol";
 
 import {IERC20} from "../../../vendor/openzeppelin-solidity/v4.8.3/contracts/token/ERC20/IERC20.sol";
 import {SafeERC20} from "../../../vendor/openzeppelin-solidity/v4.8.3/contracts/token/ERC20/utils/SafeERC20.sol";
@@ -29,6 +30,7 @@ contract USDCTokenPool is TokenPool, ITypeAndVersion {
   error InvalidSourceDomain(uint32 expected, uint32 got);
   error InvalidDestinationDomain(uint32 expected, uint32 got);
   error InvalidReceiver(bytes receiver);
+  error InvalidTransmitterInProxy();
 
   // This data is supplied from offchain and contains everything needed
   // to receive the USDC tokens.
@@ -50,19 +52,22 @@ contract USDCTokenPool is TokenPool, ITypeAndVersion {
     uint32 sourceDomain;
   }
 
-  string public constant override typeAndVersion = "USDCTokenPool 1.5.1";
+  string public constant override typeAndVersion = "USDCTokenPool 1.6.1-dev";
 
   // We restrict to the first version. New pool may be required for subsequent versions.
   uint32 public constant SUPPORTED_USDC_VERSION = 0;
 
   // The local USDC config
   ITokenMessenger public immutable i_tokenMessenger;
-  IMessageTransmitter public immutable i_messageTransmitter;
+  CCTPMessageTransmitterProxy public immutable i_messageTransmitterProxy;
   uint32 public immutable i_localDomainIdentifier;
 
   /// A domain is a USDC representation of a destination chain.
   /// @dev Zero is a valid domain identifier.
   /// @dev The address to mint on the destination chain is the corresponding USDC pool.
+  /// @dev The allowedCaller represents the contract authorized to call receiveMessage on the destination CCTP message transmitter.
+  /// For dest pool version 1.6.1, this is the MessageTransmitterProxy of the destination chain.
+  /// For dest pool version 1.5.1, this is the destination chain's token pool.
   struct Domain {
     bytes32 allowedCaller; //      Address allowed to mint on the domain
     uint32 domainIdentifier; // ─╮ Unique domain ID
@@ -74,6 +79,7 @@ contract USDCTokenPool is TokenPool, ITypeAndVersion {
 
   constructor(
     ITokenMessenger tokenMessenger,
+    CCTPMessageTransmitterProxy cctpMessageTransmitterProxy,
     IERC20 token,
     address[] memory allowlist,
     address rmnProxy,
@@ -85,17 +91,20 @@ contract USDCTokenPool is TokenPool, ITypeAndVersion {
     if (transmitterVersion != SUPPORTED_USDC_VERSION) revert InvalidMessageVersion(transmitterVersion);
     uint32 tokenMessengerVersion = tokenMessenger.messageBodyVersion();
     if (tokenMessengerVersion != SUPPORTED_USDC_VERSION) revert InvalidTokenMessengerVersion(tokenMessengerVersion);
+    if (cctpMessageTransmitterProxy.i_cctpTransmitter() != transmitter) revert InvalidTransmitterInProxy();
 
     i_tokenMessenger = tokenMessenger;
-    i_messageTransmitter = transmitter;
+    i_messageTransmitterProxy = cctpMessageTransmitterProxy;
     i_localDomainIdentifier = transmitter.localDomain();
     i_token.safeIncreaseAllowance(address(i_tokenMessenger), type(uint256).max);
     emit ConfigSet(address(tokenMessenger));
   }
 
-  /// @notice Burn the token in the pool
-  /// @dev emits ITokenMessenger.DepositForBurn
-  /// @dev Assumes caller has validated destinationReceiver
+  /// @notice Burn tokens from the pool to initiate cross-chain transfer.
+  /// @notice Outgoing messages (burn operations) are routed via `i_tokenMessenger.depositForBurnWithCaller`.
+  /// The allowedCaller is preconfigured per destination domain and token pool version refer Domain struct.
+  /// @dev Emits ITokenMessenger.DepositForBurn event.
+  /// @dev Assumes caller has validated the destinationReceiver.
   function lockOrBurn(
     Pool.LockOrBurnInV1 calldata lockOrBurnIn
   ) public virtual override returns (Pool.LockOrBurnOutV1 memory) {
@@ -146,7 +155,7 @@ contract USDCTokenPool is TokenPool, ITypeAndVersion {
 
     _validateMessage(msgAndAttestation.message, sourceTokenDataPayload);
 
-    if (!i_messageTransmitter.receiveMessage(msgAndAttestation.message, msgAndAttestation.attestation)) {
+    if (!i_messageTransmitterProxy.receiveMessage(msgAndAttestation.message, msgAndAttestation.attestation)) {
       revert UnlockingUSDCFailed();
     }
 

contracts/src/v0.8/ccip/test/helpers/USDCTokenPoolHelper.sol

@@ -2,18 +2,20 @@
 pragma solidity ^0.8.24;
 
 import {IBurnMintERC20} from "../../../shared/token/ERC20/IBurnMintERC20.sol";
-
 import {ITokenMessenger} from "../../pools/USDC/ITokenMessenger.sol";
+
+import {CCTPMessageTransmitterProxy} from "../../pools/USDC/CCTPMessageTransmitterProxy.sol";
 import {USDCTokenPool} from "../../pools/USDC/USDCTokenPool.sol";
 
 contract USDCTokenPoolHelper is USDCTokenPool {
   constructor(
     ITokenMessenger tokenMessenger,
+    CCTPMessageTransmitterProxy messageTransmitterProxy,
     IBurnMintERC20 token,
     address[] memory allowlist,
     address rmnProxy,
     address router
-  ) USDCTokenPool(tokenMessenger, token, allowlist, rmnProxy, router) {}
+  ) USDCTokenPool(tokenMessenger, messageTransmitterProxy, token, allowlist, rmnProxy, router) {}
 
   function validateMessage(bytes memory usdcMessage, SourceTokenDataPayload memory sourceTokenData) external view {
     return _validateMessage(usdcMessage, sourceTokenData);

contracts/src/v0.8/ccip/test/pools/USDC/CCTPMessageTransmitterProxy/CCTPMessageTransmitterProxy.configureAllowedCallers.t.sol

@@ -0,0 +1,40 @@
+// SPDX-License-Identifier: BUSL-1.1
+pragma solidity ^0.8.24;
+
+import {Ownable2Step} from "../../../../../shared/access/Ownable2Step.sol";
+import {CCTPMessageTransmitterProxy} from "../../../../pools/USDC/CCTPMessageTransmitterProxy.sol";
+import {CCTPMessageTransmitterProxySetup} from "./CCTPMessageTransmitterProxySetup.t.sol";
+
+contract CCTPMessageTransmitterProxy_configureAllowedCallers is CCTPMessageTransmitterProxySetup {
+  function test_configureAllowedCallers() public {
+    CCTPMessageTransmitterProxy.AllowedCallerConfigArgs[] memory allowedCallerParams =
+      new CCTPMessageTransmitterProxy.AllowedCallerConfigArgs[](2);
+    allowedCallerParams[0] =
+      CCTPMessageTransmitterProxy.AllowedCallerConfigArgs({caller: s_usdcTokenPool, allowed: true});
+    allowedCallerParams[1] = CCTPMessageTransmitterProxy.AllowedCallerConfigArgs({caller: msg.sender, allowed: true});
+    s_cctpMessageTransmitterProxy.configureAllowedCallers(allowedCallerParams);
+    assertTrue(s_cctpMessageTransmitterProxy.isAllowedCaller(s_usdcTokenPool));
+
+    // Remove the allowed caller
+    allowedCallerParams = new CCTPMessageTransmitterProxy.AllowedCallerConfigArgs[](1);
+    allowedCallerParams[0] =
+      CCTPMessageTransmitterProxy.AllowedCallerConfigArgs({caller: s_usdcTokenPool, allowed: false});
+    s_cctpMessageTransmitterProxy.configureAllowedCallers(allowedCallerParams);
+    assertFalse(s_cctpMessageTransmitterProxy.isAllowedCaller(s_usdcTokenPool));
+
+    address[] memory allowedCallers = s_cctpMessageTransmitterProxy.getAllowedCallers();
+    assertEq(allowedCallers.length, 1);
+    assertEq(allowedCallers[0], msg.sender);
+  }
+
+  // Revert cases
+  function test_configureAllowedCallers_RevertWhen_NotOwner() public {
+    changePrank(makeAddr("RANDOM"));
+    CCTPMessageTransmitterProxy.AllowedCallerConfigArgs[] memory allowedCallerParams =
+      new CCTPMessageTransmitterProxy.AllowedCallerConfigArgs[](1);
+    allowedCallerParams[0] =
+      CCTPMessageTransmitterProxy.AllowedCallerConfigArgs({caller: s_usdcTokenPool, allowed: true});
+    vm.expectRevert(Ownable2Step.OnlyCallableByOwner.selector);
+    s_cctpMessageTransmitterProxy.configureAllowedCallers(allowedCallerParams);
+  }
+}