From cdbcada49b06cd4a30d07f2b383f61fe73c42f69 Mon Sep 17 00:00:00 2001
From: Jacob Evans <jacob@dekz.net>
Date: Mon, 6 Apr 2020 19:58:42 +1000
Subject: [PATCH] Authorize sender adddress

---
 .../contracts/src/bridges/DexForwarderBridge.sol |  1 +
 .../contracts/test/TestDexForwarderBridge.sol    | 15 +++++++++++++++
 .../asset-proxy/test/dex_forwarder_bridge.ts     | 16 +++++++++++++++-
 3 files changed, 31 insertions(+), 1 deletion(-)

diff --git a/contracts/asset-proxy/contracts/src/bridges/DexForwarderBridge.sol b/contracts/asset-proxy/contracts/src/bridges/DexForwarderBridge.sol
index a6cd09fee4..9faf278041 100644
--- a/contracts/asset-proxy/contracts/src/bridges/DexForwarderBridge.sol
+++ b/contracts/asset-proxy/contracts/src/bridges/DexForwarderBridge.sol
@@ -75,6 +75,7 @@ contract DexForwarderBridge is
         freesGasTokensFromCollector
         returns (bytes4 success)
     {
+        require(msg.sender == _getERC20BridgeProxyAddress(), "DexForwarderBridge/SENDER_NOT_AUTHORIZED");
         TransferFromState memory state;
         (
             state.inputToken,
diff --git a/contracts/asset-proxy/contracts/test/TestDexForwarderBridge.sol b/contracts/asset-proxy/contracts/test/TestDexForwarderBridge.sol
index dcb72fe093..21755ac591 100644
--- a/contracts/asset-proxy/contracts/test/TestDexForwarderBridge.sol
+++ b/contracts/asset-proxy/contracts/test/TestDexForwarderBridge.sol
@@ -156,6 +156,13 @@ contract TestDexForwarderBridge is
     ITestDexForwarderBridge,
     DexForwarderBridge
 {
+    address private AUTHORIZED_ADDRESS; // solhint-disable-line var-name-mixedcase
+
+    function setAuthorized(address authorized)
+        public
+    {
+        AUTHORIZED_ADDRESS = authorized;
+    }
 
     function createBridge(
         bytes4 returnCode,
@@ -226,4 +233,12 @@ contract TestDexForwarderBridge is
     {
         return address(0);
     }
+
+    function _getERC20BridgeProxyAddress()
+        internal
+        view
+        returns (address erc20BridgeProxyAddress)
+    {
+        return AUTHORIZED_ADDRESS;
+    }
 }
diff --git a/contracts/asset-proxy/test/dex_forwarder_bridge.ts b/contracts/asset-proxy/test/dex_forwarder_bridge.ts
index e5032f558a..687dc02c1e 100644
--- a/contracts/asset-proxy/test/dex_forwarder_bridge.ts
+++ b/contracts/asset-proxy/test/dex_forwarder_bridge.ts
@@ -8,7 +8,7 @@ import {
     randomAddress,
     shortZip,
 } from '@0x/contracts-test-utils';
-import { BigNumber, hexUtils } from '@0x/utils';
+import { BigNumber, hexUtils, NULL_ADDRESS } from '@0x/utils';
 import { DecodedLogs } from 'ethereum-types';
 import * as _ from 'lodash';
 
@@ -31,6 +31,7 @@ blockchainTests.resets('DexForwarderBridge unit tests', env => {
     const BRIDGE_FAILURE = '0xffffffff';
     const BRIDGE_REVERT_ERROR = 'oopsie';
     const INCOMPLETE_FILL_REVERT = 'DexForwarderBridge/INCOMPLETE_FILL';
+    const NOT_AUTHORIZED_REVERT = 'DexForwarderBridge/SENDER_NOT_AUTHORIZED';
     const DEFAULTS = {
         toAddress: randomAddress(),
     };
@@ -47,6 +48,7 @@ blockchainTests.resets('DexForwarderBridge unit tests', env => {
             await callAndTransactAsync(testContract.createToken()),
             await callAndTransactAsync(testContract.createToken()),
         ];
+        await callAndTransactAsync(testContract.setAuthorized(env.txDefaults.from as string));
     });
 
     async function callAndTransactAsync<TResult>(fnCall: ContractTxFunctionObj<TResult>): Promise<TResult> {
@@ -186,6 +188,18 @@ blockchainTests.resets('DexForwarderBridge unit tests', env => {
             ).to.revertWith(INCOMPLETE_FILL_REVERT);
         });
 
+        it('fails if not authorized', async () => {
+            const calls = goodBridgeCalls.slice(0, 1);
+            const bridgeData = dexForwarderBridgeDataEncoder.encode({
+                inputToken,
+                calls,
+            });
+            await callAndTransactAsync(testContract.setAuthorized(NULL_ADDRESS));
+            return expect(callBridgeTransferFromAsync({ bridgeData, sellAmount: new BigNumber(1) })).to.revertWith(
+                NOT_AUTHORIZED_REVERT,
+            );
+        });
+
         it('succeeds with one bridge call', async () => {
             const calls = goodBridgeCalls.slice(0, 1);
             const bridgeData = dexForwarderBridgeDataEncoder.encode({