Repository: lifinance/contracts
Pull request #1080: LF-12880 Added new error case [Permit2Proxy v1.0.3]
Author: login: mirooon
Labels: name: AuditCompleted
name: AuditRequired
Created: 2025-04-01T12:39:28Z | Merged: 2025-04-16T07:56:54Z

# Which Jira task belongs to this PR?
[LF-12880]

# Why did I implement it this way?

# Checklist before requesting a review

- [x] I have performed a self-review of my code
- [x] This pull request is as small as possible and only tackles one problem
- [ ] I have added tests that cover the functionality / test the bug
- [ ] For new facets: I have checked all points from this list: https://www.notion.so/lifi/New-Facet-Contract-Checklist-157f0ff14ac78095a2b8f999d655622e
- [ ] I have updated any required documentation

# Checklist for reviewer (DO NOT DEPLOY and contracts BEFORE CHECKING THIS!!!)

- [ ] I have checked that any arbitrary calls to external contracts are validated and or restricted
- [ ] I have checked that any privileged calls (i.e. storage modifications) are validated and or restricted
- [ ] I have ensured that any new contracts have had AT A MINIMUM 1 preliminary audit conducted on <date> by <company/auditor>


[LF-12880]: https://lifi.atlassian.net/browse/LF-12880?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ


Diff:
diff --git a/audit/auditLog.json b/audit/auditLog.json
index f2f43cabf..8c48f518e 100644
--- a/audit/auditLog.json
+++ b/audit/auditLog.json
@@ -202,6 +202,13 @@
       "auditorGitHandle": "sujithsomraaj",
       "auditReportPath": "./audit/reports/2025.04.13_DexManagerFacet(v1.0.2).pdf",
       "auditCommitHash": "299df50b5d44d4d59a7ccc34bbfe94584acb0c81"
+    },
+    "audit20250415": {
+      "auditCompletedOn": "15.04.2025",
+      "auditedBy": "Sujith Somraaj (individual security researcher)",
+      "auditorGitHandle": "sujithsomraaj",
+      "auditReportPath": "./audit/reports/2025.04.15_Permit2Proxy(v1.0.3).pdf",
+      "auditCommitHash": "5b212bd302a7ec0c027c51753d6d5a9937f6769e"
     }
   },
   "auditedContracts": {
@@ -289,7 +296,8 @@
     "Permit2Proxy": {
       "1.0.0": ["audit20241122"],
       "1.0.1": ["audit20250110_1"],
-      "1.0.2": ["audit20250109_3"]
+      "1.0.2": ["audit20250109_3"],
+      "1.0.3": ["audit20250415"]
     },
     "Receiver": {
       "2.0.3": ["audit20250109_3"],
diff --git a/audit/reports/2025.04.15_Permit2Proxy(v1.0.3).pdf b/audit/reports/2025.04.15_Permit2Proxy(v1.0.3).pdf
new file mode 100644
index 000000000..3e97bfa37
Binary files /dev/null and b/audit/reports/2025.04.15_Permit2Proxy(v1.0.3).pdf differ
diff --git a/src/Periphery/Permit2Proxy.sol b/src/Periphery/Permit2Proxy.sol
index ebb29eb0d..b00c44a3b 100644
--- a/src/Periphery/Permit2Proxy.sol
+++ b/src/Periphery/Permit2Proxy.sol
@@ -3,6 +3,7 @@ pragma solidity ^0.8.17;
 
 import { ISignatureTransfer } from "permit2/interfaces/ISignatureTransfer.sol";
 import { LibAsset, IERC20 } from "lifi/Libraries/LibAsset.sol";
+import { LibUtil } from "lifi/Libraries/LibUtil.sol";
 import { PermitHash } from "permit2/libraries/PermitHash.sol";
 import { ERC20Permit } from "@openzeppelin/contracts/token/ERC20/extensions/ERC20Permit.sol";
 import { WithdrawablePeriphery } from "lifi/Helpers/WithdrawablePeriphery.sol";
@@ -12,7 +13,7 @@ import { SafeTransferLib } from "solady/utils/SafeTransferLib.sol";
 /// @author LI.FI (https://li.fi)
 /// @notice Proxy contract allowing gasless calls via Permit2 as well as making
 ///         token approvals via ERC20 Permit (EIP-2612) to our diamond contract
-/// @custom:version 1.0.2
+/// @custom:version 1.0.3
 contract Permit2Proxy is WithdrawablePeriphery {
     /// Storage ///
 
@@ -100,6 +101,13 @@ contract Permit2Proxy is WithdrawablePeriphery {
             ) {
                 revert(reason);
             }
+        } catch (bytes memory reason) {
+            if (
+                IERC20(tokenAddress).allowance(msg.sender, address(this)) <
+                amount
+            ) {
+                LibUtil.revertWith(reason);
+            }
         }
 
         // deposit assets
diff --git a/test/solidity/Periphery/Permit2Proxy.t.sol b/test/solidity/Periphery/Permit2Proxy.t.sol
index e0f7c334e..e1e4968bb 100644
--- a/test/solidity/Periphery/Permit2Proxy.t.sol
+++ b/test/solidity/Periphery/Permit2Proxy.t.sol
@@ -1,12 +1,91 @@
 // SPDX-License-Identifier: MIT
 pragma solidity ^0.8.17;
 
-import { TestBase, ERC20 } from "../utils/TestBase.sol";
+import { ERC20 } from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
+import { ERC20Permit } from "@openzeppelin/contracts/token/ERC20/extensions/ERC20Permit.sol";
+import { TestBase } from "../utils/TestBase.sol";
 import { Permit2Proxy } from "lifi/Periphery/Permit2Proxy.sol";
 import { ISignatureTransfer } from "permit2/interfaces/ISignatureTransfer.sol";
 import { PermitHash } from "permit2/libraries/PermitHash.sol";
 import { PolygonBridgeFacet } from "lifi/Facets/PolygonBridgeFacet.sol";
-import { ERC20Permit } from "@openzeppelin/contracts/token/ERC20/extensions/ERC20Permit.sol";
+import { stdError } from "forge-std/Test.sol";
+
+abstract contract BaseMockPermitToken is ERC20, ERC20Permit {
+    constructor() ERC20("Mock", "MCK") ERC20Permit("Mock") {}
+
+    function permit(
+        // solhint-disable-next-line no-unused-vars
+        address owner,
+        // solhint-disable-next-line no-unused-vars
+        address spender,
+        // solhint-disable-next-line no-unused-vars
+        uint256 value,
+        // solhint-disable-next-line no-unused-vars
+        uint256 deadline,
+        // solhint-disable-next-line no-unused-vars
+        uint8 v,
+        // solhint-disable-next-line no-unused-vars
+        bytes32 r,
+        // solhint-disable-next-line no-unused-vars
+        bytes32 s
+    ) public pure override {
+        _permit();
+    }
+
+    function _permit() internal pure virtual;
+}
+
+contract MockPermitToken is BaseMockPermitToken {
+    function _permit() internal pure override {
+        revert CustomPermitError();
+    }
+
+    error CustomPermitError();
+}
+
+contract MockPermitTokenPanic is BaseMockPermitToken {
+    // solhint-disable-next-line reason-string
+    function _permit() internal pure override {
+        assert(true == false);
+    }
+}
+
+contract MockPermitTokenEmptyRevert is BaseMockPermitToken {
+    function _permit() internal pure override {
+        // solhint-disable-next-line gas-custom-errors,reason-string
+        revert();
+    }
+}
+
+contract MockPermitTokenStringRevert is BaseMockPermitToken {
+    function _permit() internal pure override {
+        // solhint-disable-next-line gas-custom-errors
+        revert("Custom error message");
+    }
+}
+
+contract MockPermitTokenRequireRevert is BaseMockPermitToken {
+    function _permit() internal pure override {
+        // solhint-disable-next-line gas-custom-errors
+        require(true == false, "Test revert message");
+    }
+}
+
+contract MockPermitTokenAdditionOverflow is BaseMockPermitToken {
+    function _permit() internal pure override {
+        // solhint-disable-next-line no-unused-vars
+        uint256 test = type(uint256).max + 1;
+    }
+}
+
+contract MockPermitTokenDivisionByZero is BaseMockPermitToken {
+    function _permit() internal pure override {
+        // solhint-disable-next-line no-unused-vars
+        uint256 x = 0;
+        // solhint-disable-next-line no-unused-vars
+        uint256 y = 1 / x; // This will cause a division by zero at runtime
+    }
+}
 
 contract Permit2ProxyTest is TestBase {
     using PermitHash for ISignatureTransfer.PermitTransferFrom;
@@ -542,6 +621,169 @@ contract Permit2ProxyTest is TestBase {
         return testdata;
     }
 
+    function testRevert_FailsOnCustomErrorAndAllowance() public {
+        // deploy a mock ERC20Permit token that reverts with custom error on permit
+        MockPermitToken token = new MockPermitToken();
+        address tokenAddress = address(token);
+
+        vm.startPrank(permit2User);
+
+        bytes memory callData = _getCalldataForBridging();
+
+        // we don't care about the signature since permit will revert anyway
+        vm.expectRevert(MockPermitToken.CustomPermitError.selector);
+        permit2Proxy.callDiamondWithEIP2612Signature(
+            tokenAddress,
+            defaultUSDCAmount,
+            block.timestamp + 1000,
+            27, // dummy v
+            bytes32(0), // dummy r
+            bytes32(0), // dummy s
+            callData
+        );
+
+        vm.stopPrank();
+    }
+
+    function testRevert_FailsOnPanicDuringAllowance() public {
+        MockPermitTokenPanic token = new MockPermitTokenPanic();
+
+        address tokenAddress = address(token);
+
+        vm.startPrank(permit2User);
+
+        bytes memory callData = _getCalldataForBridging();
+
+        // expect panic error (0x01 for assertion failure)
+        vm.expectRevert(stdError.assertionError);
+        permit2Proxy.callDiamondWithEIP2612Signature(
+            tokenAddress,
+            defaultUSDCAmount,
+            block.timestamp + 1000,
+            27, // dummy v
+            bytes32(0), // dummy r
+            bytes32(0), // dummy s
+            callData
+        );
+
+        vm.stopPrank();
+    }
+
+    function testRevert_FailsOnEmptyRevert() public {
+        MockPermitTokenEmptyRevert token = new MockPermitTokenEmptyRevert();
+        address tokenAddress = address(token);
+
+        vm.startPrank(permit2User);
+        bytes memory callData = _getCalldataForBridging();
+
+        // Expect empty revert
+        vm.expectRevert();
+
+        permit2Proxy.callDiamondWithEIP2612Signature(
+            tokenAddress,
+            defaultUSDCAmount,
+            block.timestamp + 1000,
+            27, // dummy v
+            bytes32(0), // dummy r
+            bytes32(0), // dummy s
+            callData
+        );
+
+        vm.stopPrank();
+    }
+
+    function testRevert_FailsOnStringRevert() public {
+        MockPermitTokenStringRevert token = new MockPermitTokenStringRevert();
+        address tokenAddress = address(token);
+
+        vm.startPrank(permit2User);
+        bytes memory callData = _getCalldataForBridging();
+
+        // Expect string revert
+        vm.expectRevert("Custom error message");
+
+        permit2Proxy.callDiamondWithEIP2612Signature(
+            tokenAddress,
+            defaultUSDCAmount,
+            block.timestamp + 1000,
+            27, // dummy v
+            bytes32(0), // dummy r
+            bytes32(0), // dummy s
+            callData
+        );
+
+        vm.stopPrank();
+    }
+
+    function testRevert_FailsOnRequireRevert() public {
+        MockPermitTokenRequireRevert token = new MockPermitTokenRequireRevert();
+        address tokenAddress = address(token);
+
+        vm.startPrank(permit2User);
+        bytes memory callData = _getCalldataForBridging();
+
+        // Expect require revert
+        vm.expectRevert("Test revert message");
+
+        permit2Proxy.callDiamondWithEIP2612Signature(
+            tokenAddress,
+            500, // Amount less than 1000 to trigger require
+            block.timestamp + 1000,
+            27, // dummy v
+            bytes32(0), // dummy r
+            bytes32(0), // dummy s
+            callData
+        );
+
+        vm.stopPrank();
+    }
+
+    function testRevert_FailsOnAdditionOverflow() public {
+        MockPermitTokenAdditionOverflow token = new MockPermitTokenAdditionOverflow();
+        address tokenAddress = address(token);
+
+        vm.startPrank(permit2User);
+        bytes memory callData = _getCalldataForBridging();
+
+        // Expect arithmetic overflow panic
+        vm.expectRevert(stdError.arithmeticError);
+
+        permit2Proxy.callDiamondWithEIP2612Signature(
+            tokenAddress,
+            defaultUSDCAmount,
+            block.timestamp + 1000,
+            27, // dummy v
+            bytes32(0), // dummy r
+            bytes32(0), // dummy s
+            callData
+        );
+
+        vm.stopPrank();
+    }
+
+    function testRevert_FailsOnDivisionByZero() public {
+        MockPermitTokenDivisionByZero token = new MockPermitTokenDivisionByZero();
+        address tokenAddress = address(token);
+
+        vm.startPrank(permit2User);
+        bytes memory callData = _getCalldataForBridging();
+
+        // Expect arithmetic error (division by zero)
+        vm.expectRevert(stdError.divisionError);
+
+        permit2Proxy.callDiamondWithEIP2612Signature(
+            tokenAddress,
+            defaultUSDCAmount,
+            block.timestamp + 1000,
+            27, // dummy v
+            bytes32(0), // dummy r
+            bytes32(0), // dummy s
+            callData
+        );
+
+        vm.stopPrank();
+    }
+
     /// Helper Functions ///
 
     function _getPermit2TransferFromParamsSignedBypermit2User()


Reviews:
user: login: 0xDEnYO
state: DISMISSED
author_association: CONTRIBUTOR
submitted_at: 2025-04-07T02:25:55Z
user: login: 0xDEnYO
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-07T02:27:26Z
user: login: 0xDEnYO
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-07T02:31:04Z
user: login: mirooon
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-07T07:41:02Z
user: login: 0xDEnYO
state: DISMISSED
author_association: CONTRIBUTOR
submitted_at: 2025-04-07T09:34:57Z
user: login: 0xDEnYO
state: DISMISSED
author_association: CONTRIBUTOR
submitted_at: 2025-04-07T10:13:58Z
user: login: coderabbitai[bot]
body: > [!CAUTION]
> Inline review comments failed to post. This is likely due to GitHub's limits when posting large numbers of comments.  If you are seeing this consistently it is likely a permissions issue. Please check "Moderation" -> "Code review limits" under your organization settings.

**Actionable comments posted: 1**

<details>
<summary>🧹 Nitpick comments (1)</summary><blockquote>

<details>
<summary>test/solidity/Periphery/Permit2Proxy.t.sol (1)</summary><blockquote>

`709-730`: **Comment mismatch regarding the amount triggering `require`.**
Although the comment says “Amount less than 1000 to trigger require,” the actual revert is `require(true == false)`, which ignores the input entirely. Consider aligning the commented explanation with the actual logic, or switching the require condition to use the supplied amount if that is the intended test scenario.  

```diff
-        500, // Amount less than 1000 to trigger require
+        500, // This value is not used in the require logic; consider removing or reusing it
```

</blockquote></details>

</blockquote></details>

<details>
<summary>🛑 Comments failed to post (1)</summary><blockquote>

<details>
<summary>test/solidity/Periphery/Permit2Proxy.t.sol (1)</summary><blockquote>

732-753: _🛠️ Refactor suggestion_

**Test name does not match the overflow scenario.**
The test is named `testRevert_FailsOnDivisionByZero`, but the contract triggers an addition overflow. Update the test name or the contract logic for consistency.  

```diff
-function testRevert_FailsOnDivisionByZero() public {
+function testRevert_FailsOnAdditionOverflow() public {
```


<!-- suggestion_start -->

<details>
<summary>📝 Committable suggestion</summary>

> ‼️ **IMPORTANT**
> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

`````suggestion
    function testRevert_FailsOnAdditionOverflow() public {
        MockPermitTokenAdditionOverflow token = new MockPermitTokenAdditionOverflow();
        address tokenAddress = address(token);

        vm.startPrank(permit2User);
        bytes memory callData = _getCalldataForBridging();

        // Expect arithmetic overflow panic
        vm.expectRevert(stdError.arithmeticError);

        permit2Proxy.callDiamondWithEIP2612Signature(
            tokenAddress,
            defaultUSDCAmount,
            block.timestamp + 1000,
            27, // dummy v
            bytes32(0), // dummy r
            bytes32(0), // dummy s
            callData
        );

        vm.stopPrank();
    }
`````

</details>

<!-- suggestion_end -->

</blockquote></details>

</blockquote></details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-14T13:09:49Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 0**

<details>
<summary>🧹 Nitpick comments (2)</summary><blockquote>

<details>
<summary>test/solidity/Periphery/Permit2Proxy.t.sol (2)</summary><blockquote>

`13-36`: **Abstract contract structure is well-defined.**

Clearly separating the core ERC20 + ERC20Permit functionality in an abstract base is commendable and makes mocking easier. Consider removing `solhint-disable-next-line no-unused-vars` if no longer needed.

---

`624-646`: **Custom error revert test is cohesive.**

The test effectively expects the correct custom error revert for `MockPermitToken`. If the reference to “Allowance” in the name is unneeded, consider a clearer function name.

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between a9b172980f323363456873bbdd15c9405090bb70 and 5b212bd302a7ec0c027c51753d6d5a9937f6769e.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* `test/solidity/Periphery/Permit2Proxy.t.sol` (2 hunks)

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (3)</summary>

* GitHub Check: run-unit-tests
* GitHub Check: enforce-min-test-coverage
* GitHub Check: generate-tag

</details>

<details>
<summary>🔇 Additional comments (15)</summary><blockquote>

<details>
<summary>test/solidity/Periphery/Permit2Proxy.t.sol (15)</summary>

`4-6`: **Imports look appropriate.**

These additional imports from OpenZeppelin and local TestBase are valid and align with the usage below.

---

`11-11`: **Use of `stdError` is a good approach.**

Referencing `stdError` from `forge-std/Test.sol` is helpful for verifying specific panic and arithmetic reverts.

---

`38-45`: **Custom error usage is clear.**

Throwing a custom error in `_permit()` effectively tests revert scenarios. Implementation is straightforward.

---

`46-52`: **Panic test token is correct.**

Forcing an assertion failure is the right way to simulate a panic revert in Foundry.

---

`53-58`: **Empty revert logic is sound.**

This contract properly simulates a revert with no reason.

---

`60-66`: **String revert test is well-structured.**

Including a custom message ensures coverage for string-based revert scenarios.

---

`67-73`: **Require-based revert is clearly demonstrated.**

The `require(true == false)` exemplifies a typical logical revert scenario.

---

`74-80`: **Overflow scenario is adequately modeled.**

Using `type(uint256).max + 1` checks arithmetic overflow handling.

---

`81-88`: **Division by zero scenario is valid.**

Explicitly dividing by zero is a suitable test for arithmetic revert conditions.

---

`648-670`: **Panic during allowance simulation is effective.**

Testing with `MockPermitTokenPanic` accurately captures assertion-based panics.

---

`672-693`: **Empty revert scenario is well-tested.**

Verifying an untyped revert ensures coverage of minimal revert contexts.

---

`695-716`: **String revert scenario is validated correctly.**

Matching revert messages with `vm.expectRevert("Custom error message")` is the recommended approach.

---

`718-739`: **Require revert is correct.**

Unconditional require statements confirm the revert reason is checked properly.

---

`741-762`: **Arithmetic overflow scenario test is comprehensive.**

Using `stdError.arithmeticError` ensures the test captures any overflows triggered by addition.

---

`764-785`: **Division by zero scenario test is appropriate.**

`stdError.divisionError` precisely validates a zero divisor revert.

</details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-14T13:45:18Z
user: login: 0xDEnYO
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-04-16T07:56:36Z

Review comments:
diff_hunk: @@ -542,6 +569,30 @@ contract Permit2ProxyTest is TestBase {
         return testdata;
     }
 
+    function test_RevertOnCustomErrorAndAllowance() public {
path: test/solidity/Periphery/Permit2Proxy.t.sol
user: login: 0xDEnYO
body: test naming is inconsistent with our guidelines.
Should be testRevert_....
created_at: 2025-04-07T02:27:26Z
author_association: CONTRIBUTOR
diff_hunk: @@ -100,6 +100,15 @@ contract Permit2Proxy is WithdrawablePeriphery {
             ) {
                 revert(reason);
             }
+        } catch (bytes memory reason) {
+            if (
+                IERC20(tokenAddress).allowance(msg.sender, address(this)) <
+                amount
+            ) {
+                assembly {
+                    revert(add(reason, 32), mload(reason))
path: src/Periphery/Permit2Proxy.sol
user: login: 0xDEnYO
body: please use LibUtil.revertWith(reason) 
created_at: 2025-04-07T02:31:04Z
author_association: CONTRIBUTOR
diff_hunk: @@ -542,6 +569,30 @@ contract Permit2ProxyTest is TestBase {
         return testdata;
     }
 
+    function test_RevertOnCustomErrorAndAllowance() public {
path: test/solidity/Periphery/Permit2Proxy.t.sol
user: login: mirooon
body: updated
created_at: 2025-04-07T07:40:07Z
author_association: CONTRIBUTOR
diff_hunk: @@ -100,6 +100,15 @@ contract Permit2Proxy is WithdrawablePeriphery {
             ) {
                 revert(reason);
             }
+        } catch (bytes memory reason) {
+            if (
+                IERC20(tokenAddress).allowance(msg.sender, address(this)) <
+                amount
+            ) {
+                assembly {
+                    revert(add(reason, 32), mload(reason))
path: src/Periphery/Permit2Proxy.sol
user: login: mirooon
body: ok! Good to know we have this functionality already
created_at: 2025-04-07T07:40:52Z
author_association: CONTRIBUTOR

PR comments:
user: login: coderabbitai[bot]
created_at: 2025-04-01T12:39:37Z
body: <!-- This is an auto-generated comment: summarize by coderabbit.ai -->
<!-- walkthrough_start -->

```markdown
## Walkthrough
The changes introduce an enhanced error handling mechanism in the `Permit2Proxy` contract's `callDiamondWithEIP2612Signature` function, specifically addressing byte-based errors. A new abstract contract `BaseMockPermitToken` and a concrete implementation `MockPermitToken` are added for testing, which simulate various error conditions related to the permit functionality. This includes a custom error type, `CustomPermitError`, and multiple test functions that validate the expected behavior when the permit call fails under different scenarios. Additionally, an audit entry for the `Permit2Proxy` contract version 1.0.3 was added, documenting a completed audit.

## Changes

| File(s)                                  | Change Summary                                                                                                                                                                                                                                           |
|------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `src/Periphery/Permit2Proxy.sol`         | Introduced a new catch block in `callDiamondWithEIP2612Signature` to handle `bytes` errors by checking token allowance and reverting with the original error message if the allowance is insufficient.                                               |
| `test/solidity/Periphery/Permit2Proxy.t.sol` | Added abstract contract `BaseMockPermitToken` and concrete contract `MockPermitToken`, which includes an overridden `permit` function. Introduced multiple mock contracts for testing various revert scenarios and added several test functions to validate error handling. |
| `audit/auditLog.json`                     | Added a new audit entry "audit20250415" for the `Permit2Proxy` contract version 1.0.3, including auditor details, report path, and commit hash.                                                                                                         |

## Possibly related PRs
- lifinance/contracts#910: The main PR extends the error handling in `callDiamondWithEIP2612Signature` by adding a catch block for bytes errors and introduces comprehensive tests for various revert scenarios, building directly upon the error handling improvements introduced in the retrieved PR #910 for the same function in `Permit2Proxy.sol`.
- lifinance/contracts#912: The main PR enhances error handling in the `callDiamondWithEIP2612Signature` function of `Permit2Proxy.sol` by adding a `try-catch` block for `permit` calls and introduces extensive tests for various revert scenarios, while the retrieved PR #912 also modifies `Permit2Proxy.sol` but focuses primarily on replacing low-level ETH transfers with `SafeTransferLib.safeTransferETH` and adding a `try-catch` for `permit` calls without the detailed revert scenario tests; thus, both PRs modify the same function and contract with overlapping error handling improvements, making them related.

## Suggested labels
`AuditCompleted`

## Suggested reviewers
- 0xDEnYO
```

<!-- walkthrough_end -->

<!-- This is an auto-generated comment: resource warnings by coderabbit.ai -->

> [!WARNING]
> ## Review ran into problems
> 
> <details>
> <summary>🔥 Problems</summary>
> 
> Errors were encountered while retrieving linked issues.
> 
> <details>
> <summary>Errors (1)</summary>
> 
> * JIRA integration encountered authorization issues. Please disconnect and reconnect the integration in the CodeRabbit UI.
> 
> </details>
> 
> </details>

<!-- end of auto-generated comment: resource warnings by coderabbit.ai -->

---

<details>
<summary>📜 Recent review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between 3943f8ec6f7faf377e38a5c93ade6700c75e2854 and 33b7cdca700fcffab1ed623ff31d64d08e7e8ead.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* `audit/auditLog.json` (2 hunks)

</details>

<details>
<summary>🚧 Files skipped from review as they are similar to previous changes (1)</summary>

* audit/auditLog.json

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (2)</summary>

* GitHub Check: run-unit-tests
* GitHub Check: enforce-min-test-coverage

</details>

</details>
<!-- internal state start -->


<!-- DwQgtGAEAqAWCWBnSTIEMB26CuAXA9mAOYCmGJATmriQCaQDG+Ats2bgFyQAOFk+AIwBWJBrngA3EsgEBPRvlqU0AgfFwA6NPEgQAfACgjoCEYDEZyAAUASpETZWaCrKNwSPbABsvkCiQBHbGlcSHFcLzpIACIAGQAxMABGACYADjSABkgAQVolenIAd0hKCnw+BjREEmjIIur7bAFmdRp6OTDYD2wavlby/HwsTHpUeCUMcQAzeCjO3G7IDEcBSkgkzKyNSABJUNQveAwAayiCLo8AKXgqMOqTyATk9O2YJdt0eGZkC+Pccq0bAMDxoZYkEplCqMaoeY6XBRKASwvwkLzUc74BFWSitXApKzlAAe8iYUyoYkgAAopBREPBhhsNJkNABmACUGjcSyUiAYFHg3HEjOODC82F56EY3QYJyOiFC02hi1BeFgyqxZAc/kgQTQR1w8lGCmY3EiNHIiBkJCVOv8QRCxyIUv8EjmRR27mlojlSFCZNmFB+XWoCLQauhsEa3EotrY9DBNS80zArvd6Aw9DOQuxdiVDF6UUZiadkR45QEkWYOwAEvgiiRaQAaMIhZBMWlOhHFSDTbAYMQMjD69TyaECbDOhs6jD4UJofJ0FvG2j4AtsKbUIeQbDcWgY5DTjyz0LMBckHbxaE96ZoEG4RAtlU4RaRxonyCd2ZRfW+Bgy30FR4fB/kQHY8lodQh1/WQn26HVUDBNMIXWf8fXlUISFNKN6QALy7CQR33YURkzVEFQFQdGXwaZ0AoNQAWceQSCJGgKGHP9f0fctJHgSJSHoKofG440tWwAUMGdXg0W+Y4mJwSCH17a8IQUck7wfLkDC9T4qiwNZ0AYEErR/ThIFgXBcG4RAOAAelsoh1FgZoNCYZhbKOWZhwHEhbLJRixEQWzuG8LxbM2bZzEsABhFgNyUhwnBcbkPDc+LkEZZ8Qp8VEHSA5wPF4b5nD4o08BYDF6BqAsBUNdBIgoUJkKKZAYwoON5nkZ9PPgMANKHMABDnT0liGprG3dKJmG8cQzQ8arxNHerKCU/x0XaMIsWfAADRAKAYWycQFbh4NkQ7cXUAliVkDREHwLxtt7PjQTIyDEFaEyExy/UVsPJzICUXBtEieghF6GZ4CqEibKMJIdgAKnh2KMAo4ECD4aBHUkxGuByBqlJPKJjgcaZZgYOYplbBUuxotSAv9YZUbECowPeDw3o+xB9VRapGQaZBogAdWGAByRV4CJJs6iKf7nxYs1MC3TKo3nLxX0nWBlixApIcqtSmfRqmlJYv04Pm4FjIy2i53go322GQNgyYCh/EpMkDehbhnDQNg2LU2YiHEpWMC0lIEfh3YMBC0IrG9331gANSI4OccgABlRtlF8H7GuQaZ0SIASUGHJQ9RoT9k5I/haOOaOeDjkg2O4ooEH/BRvHoSIF02z9vHIKg1ANOZWfcGp6kodmkE5+ZRHDMesou+cyJl3BLWQekiGHXBxNSgDkH1fwF2YlGd5hHxiLBcNXwFXDg4zQSKld1fpFZiCoOGbnCKOYjtyKfAO+LvyEgKIiCNCYAqP66sDimnKG6SS9hRCLUNDsNOLAPCCD6IRaG48dR3hOLOIoIMi6NC/hMSAE5QhKGmGUKItpex4FPruYi0gtKsnDrEesYBYiZ18NFLiqccgjHxugIaeBIBeE4ZEKQnFhLiLwV2L2VB458C/LrKu/MAZTyQDUBMAthYYDFk9SWdQwbU2/B0LqSwATgz/o1BAa9q4Ikgj7YYD91KUjWF2ISIMtIABZw5p3gJvagp8bAkAVvIHIlk8GIAEfjdek5SDU3gRIPuyhB5LQuBvLep9/ARPQNE2Uh4J6aPeton8ed9Rj24Pgek4gpCszCfk3gc5RBV3GBgeC7AvDyBaW6Ao5D5Czh8pANg/5MBT2QPCAAorsKwYAUgADZUj32sIvFIKBTRVnYMHMCRgACs4dY6yBUGWeIv5kSykgPEfsVEUZxN+mpEE7EFFoBOZWDwt4fCXMeH2Ac2CV7qjEXeS2dNyi+CPKU6eujexVMKrUqCDSRqpWGPTYu8F1B53KMwSA21BZOVoFQBoHyjqClOttZcPh6xdkBYStADRfC01diQSQtD+y0D2QYRZ4dkYez4LHJRjdE6VyHKnAAsjNQUZYc5KRUP/U82iCIiuorRd21jmZ8EUT7IVdIcGTzKZ9dAejRbiyJBoOoXotXKP3jqfy4KQaDKceEiRsh1jGmsQqKIdqNLcRqfSeBs5NnxngBiPwSATg7F2DA/AUh0qjLeeQlFKMJgT07hiCgWkADs4cAByzhygy3gQAEXrAOaouAHm5xEfK4CFpxDc3pJESmMbYwSJKECDwFxhwu2pfA1cRQy0QL1VC8pMKvnVIRfUlhbMYRDoKsXOt0Fs5kS5tQ+oTl4TPmGSCUoA5FBdj5N0NgWk0jhwAOKNAAEISlIIqaE0zWKUA4pAPhwkBFCJWqiUBFBILwJYmxZ93jIFAtCKA5ARw8SHkaBzUdyKwgUHBlEZxzBXFgo0vG+Q9psC3E+aFSAYHlJ8ExfwNquzlxkXgDXE+pNIYU1A40RChE+KnJIGbeDmAuZ3PXTlV0n6clUB8DdIwABOcO0zTR1WOSx65Fy8HvuWo1atwKsBYSFL0t50mvleB+fQ/5v9oNaMNY0ME474V1NZcuKZBwplTDIAMi4zLWXLC3FITaZwUYhn9JgORfsDK0qJSHFK5C5z+1uPGTzlxcEzixP2fwd0vBSCqog2qRp4lwZoEBDsyhSCohqYpxA6oWriOOCi2kaAcuhkzaJxZiyACkLY/lcay1QCroQ0j+OE5kerqyBBUAHJrZr5XQShF8dmtIKRuu/lKESEEdAuzPlaBgb4jguhxfVF4DlCC718CyuUEQYgtL6GMOAKAdnHFX0IKQfues0rsC4Lwfgwg2mspkKSRQ6SGJaB0EdkwUA4DjH3iMcqxAyDKA2rdqYXAiVNCSvIToTAlAD0+9oXQYBDDHdMAYPaB1SUnUoGdI6eIrr4BJLde6HADDRCpwYCwuRdgg+uxtRKZ4XCOPGZJaQQX2dJIXYCYEL10D5Hfs+qEfAoyZiOPAsZ4up7FwRNtbxRaQ0oczPixYsyrBLNSIE4J29/CPUa1XWmO1CeXUJCT2Qj1vUHdyOCEoCvqD/kepWNcjxEKLnoBccXtAyxVBqIeLp8u2p4it1N28fFgNSm2nIDLj1DQxlKD2jNkA1f2K6KgF3soWzqG9EUlAtFny/nrJgHdxurH4Hc4RhE1vrPiJfiGLAz5EAxnJuY3FLj+y4G2pGgvCB7aZmFygZAvts9edkTtXjjVU8G9uVXaY2LcWxHgAIAAquIB6LYvZWnm0sCoQS5K+FF6Ml+Q2RqoBQ5BMmd8yDi+MgiI/3vJfOk6M30QlHdaCcF4Sl+XYi8NBGdosEL8CrBhnREgB4C3GQEHovKHjlOHl4NxGJBJM6IsKGM+DXqiLSEpICmGNwC0kVKGkfv5P+lpJammP/MgA/qME/vwBgD0oZEwJ3rQtCBRE6INLCPQKLs3AgGWFuqpAuIpNuL1vgOeB5k3kwAnn8AOOKEoIMjQOwToonuUHSGbP4J0N8H0jvh4BWODA4mXrhnpqLJQUnvGsOKQPFFpLTnjGxLsj3M+EoGKN7NgrTPLBUBtJ7M0EcAwLuuEMPEYFAGKo3OqAmB7lwNtJPrgKnlSIfHdBgOyI9PCNtEvqvuvgkVgNtD1LZMkVQAKNIFkcvmvnxGTg9JTtTgYBAGAEYBlrgLZPFhMKOOdMdKdI0UTubqTpoPFhTlTtEDTpYDkPTldmDlEMzvJLTNzpztpEsOMTZgCIoPzlKD2CoBROhhgdtJerCGKq7qbrgNABXmQHHiAf+nZjIDbLitMjYNFCkJkI9MaNtOcZcZkNsd3u8KgBgaKDIdIFKGqghhqlXscFBCOPhPAs+AQJXjgWCMOGwKsogLIMwENF4ORgmFgC2i7BMJMLisHuoDPoYY3iAUBhmAuk+tzNtAAPqYld66Z3JwaknknYlcaoBUIlYwpghuiNTYDcyG5DiUptpdiI6spuL0y/BYgaHbKUyv6t6QyJpRhugVBaQ5B25oaUjbSbGyjbG7HuYJHtiHztAtgtyQyawilYTsDAEeA0kwGUlVwOaZyKbgmMDgwsBKHQjbTRT2nMDbHTJJ7PFvwkTcw142pwjkhzEgj0B0LVFKoCgUGYGfp8hkAlS1LZ7SEShdjKlbGLzqlkCxxLYMAUq4oqknBql7EYDiZqZhJYE5kpmqlpmFlpwAhOilkrTll5kFnuZhJBA4b1mNSNmplBjqDpkYDelDgADytI+c9YOZtxTZVZ7mSubo9Iwwl6sgAAWpQPgDmcAm3EoCrsseIH2pRtQv4JTPHp8UytaZpEYDcnYriBUKxggmVr4D2NURaUOP6V/piPLtscTiSJjAqFbqihSJoGzPPG2BXN/KGs+GsNKQyHwPoRieaZyYyOyusJfvuewGpIIYzC2A4G3I0PLM9vAhEZHgWAqA6VwZvhMt4aRaUBJphqedxKwfhbRS2FhjhlGbnMuLVLAL7JKSiaOSUF7FmSJK9LxHOfpPILhCuY6XSKQUsBoW4fYEDDQHGtKR4GsFAUwnrFaRUIjqsv4Chq5v4ECJmCXrBPYC3u/t4nDjRXpVoQDLuF4aGrJYprTHcRcVcU8ZYX0WrGDs+XYTyKIOiFQM4bRK4Y1EWJqp4ZKewFBBMVADmvwQIMsW7H+ehgIXQGEesTUJOT2TsYWWkbitUbUfdPUYaI0WSvji0WbtdBoB0fdNtOUZAHFSUBgalbQGEVlXiH2XldtAVXUYpATpQGVS4BVfiG0TdDVSUbFapPBSMKEbitNZAGSYvFSOyISexNzCFDqCiQKEoHlase1b2blXLt1SEIVd/A0bjs0R+aNdVcUXVZNZCCYS1WEUfi6cRW6YvB6coctbtclUqftTlRqUdT1UVX1aVXjkNVdVVeNXdQ1apM1bNRWfmVORmeRV1cDWdSVRdeVZDRbjdfFjDY1YqfOAjf9X2cWYaB2RSYkejcVf1U0djestddDfVYTfDQUG1d2R1dWbWZJJTWjSdb1edQNeDXTa0VDbdSzXDb9cTezbmZzQdS2YENhv4HzUDQLSDULfTRDYzeLfjZLU1dLa+a1XLZWdlX2QOcMMOa2mOWrQqKdbTWDZdTrbjczfdUTUbRzabVzdOcJUOAucueUPzXbYLZjcLU7dlZ+WNRLW7fNU9XNbPtuNUZTSSechHoORgK9QQMwJ9RUIIrQHjG2iXiQMtZ4JWJDD9e4qENtDjV+SEEHTUSHXTYNaLZVS7dHbDSULHQjfNUnaeSncDIgOnZmZDEWotJJAXcXj5CXSFGXdmXLqsTXbIN+VTekTTaDVjdrRHUze3YTV3bLdtD3SEMnanQgeneTbIJTdPRFXPfCAvc7bXT+bbQ3RraHVrS3SNbrbVfrU+cWN3QnZlEfX3SfYPRgDWcgZfStTPV4RXWitXffUvXXU/fbevWHQzVvZ/RNR3T/TNfvYfQqMfQPena2crSQBA6XdA/PYbXA+gxbsvfXcg5rc3cNZHXjV/THf/Tg2lfHTiUbAQ2nf2ULiRFbe1G2lfbPTA/+biovXQ0g43Y7Wg2LW3Xrewzw3HQfRw7w0A4QxgDOUgH7UuSuWIxQ7fVQ9I4g9TerRjU3SLcw9vXrd0f4ZjuGIpLZM4+oBwkQBoEILEV0dTlYQMaDoFcMY4CzmOKquLkkkYPKYsUmZhOSPINEG4/iJkCkPspkL4kkPstLMZh7r5R4Ik7E4gHUNVCRC2KuOuFFfAt5kkyaHNO4VgDkEVL4Jky2Fcaky2J0GnNgEIP9KgswFQGgEIOuosEandOTHrL7AuNQGCO8UmcCUsEkxUCLMgGejno/jeXknJV7IsIiSaHiOZNULADsLFC7NIDUgPpJD0mxgU4pHQMjIKcU89nzI0OpRtFIWKBKB4LSCJTEHDCyKyHUDBdEIvXUDXi2JLicF2DnhcHwYQkaLkzc5dCk2kxk1kwpOoDsDmliDbKhBE58RcCbMks6EkxlJUIbd8z5ZCmeEoFpFFLkF5YFT5TC35Y4Yy4zI4iFe4eFbPT4dFYgP4Q1cMB4FSOgXiy+RBuoG+VcGnIOTmgDNMz4bkYDvQKuFrKrH7Jy2FeQ5KQjh4FFeINIJyKUT0eUWjhjqdmRLTBdgzkMQ/KwHdn4PSjDqE46rq0jhiyjj9idns+oCSRMIgCSc1HQCSQqM4KEEdgYL9owPstML4gwIspmqyEkMJr4pkEkJmiQJkHQCQEkLQGkEkGkCQL4r4mgEkAwKyJkAIEkKyGgL4gIKyGkKjoYFG/skkMiIskW6IHQJmrW0kIsr4ikGgK22kKyIskZA29WwICkAwAIJkIm+W7RF6xAJAKO1kKyMiPsksiQIskssJkkGgKyPkBW5mgm7QPshk5kNMJW5mrOxkLO025G967QP2+u0kNW4spkDW6k/smkCeykDaLQNO/smgCkIO/u5kMJrQOWwwEoEkA+1G/W5mmkGe1W8AtMLQJmlBwIMJqoJmikLQBk+hyWykG2wwOmwwCkLO0svB962gDh+mykMJlkNMKyCkKyKO6yL4vsosr++uwIPkJkwwCm5kGk51rh9kEu1APslO6kPxxW4OxmwwJkEpykJmgwK25mvsoe4sme3R8JqyJmtMAm4ssJh4JJyuym6yNMIW/G9MIZ2gCx5mhmw20O0JzW0oAm5kMp5pyQOkOezR8u+xwIGp1B2gJml59MAwKTCoEkHQDu1Zyx7m/27QFsCQBm4W93BG1G2lL6/64GxNChLQCSWdvoEAA== -->

<!-- internal state end -->
<!-- tips_start -->

---



<details>
<summary>🪧 Tips</summary>

### Chat

There are 3 ways to chat with [CodeRabbit](https://coderabbit.ai?utm_source=oss&utm_medium=github&utm_campaign=lifinance/contracts&utm_content=1080):

- Review comments: Directly reply to a review comment made by CodeRabbit. Example:
  - `I pushed a fix in commit <commit_id>, please review it.`
  - `Generate unit testing code for this file.`
  - `Open a follow-up GitHub issue for this discussion.`
- Files and specific lines of code (under the "Files changed" tab): Tag `@coderabbitai` in a new review comment at the desired location with your query. Examples:
  - `@coderabbitai generate unit testing code for this file.`
  -	`@coderabbitai modularize this function.`
- PR comments: Tag `@coderabbitai` in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
  - `@coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.`
  - `@coderabbitai read src/utils.ts and generate unit testing code.`
  - `@coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.`
  - `@coderabbitai help me debug CodeRabbit configuration file.`

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

### CodeRabbit Commands (Invoked using PR comments)

- `@coderabbitai pause` to pause the reviews on a PR.
- `@coderabbitai resume` to resume the paused reviews.
- `@coderabbitai review` to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
- `@coderabbitai full review` to do a full review from scratch and review all the files again.
- `@coderabbitai summary` to regenerate the summary of the PR.
- `@coderabbitai generate docstrings` to [generate docstrings](https://docs.coderabbit.ai/finishing-touches/docstrings) for this PR.
- `@coderabbitai resolve` resolve all the CodeRabbit review comments.
- `@coderabbitai configuration` to show the current CodeRabbit configuration for the repository.
- `@coderabbitai help` to get help.

### Other keywords and placeholders

- Add `@coderabbitai ignore` anywhere in the PR description to prevent this PR from being reviewed.
- Add `@coderabbitai summary` to generate the high-level summary at a specific location in the PR description.
- Add `@coderabbitai` anywhere in the PR title to generate the title automatically.

### CodeRabbit Configuration File (`.coderabbit.yaml`)

- You can programmatically configure CodeRabbit by adding a `.coderabbit.yaml` file to the root of your repository.
- Please see the [configuration documentation](https://docs.coderabbit.ai/guides/configure-coderabbit) for more information.
- If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: `# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json`

### Documentation and Community

- Visit our [Documentation](https://docs.coderabbit.ai) for detailed information on how to use CodeRabbit.
- Join our [Discord Community](http://discord.gg/coderabbit) to get help, request features, and share feedback.
- Follow us on [X/Twitter](https://twitter.com/coderabbitai) for updates and announcements.

</details>

<!-- tips_end -->
author_association: CONTRIBUTOR
user: login: lifi-action-bot
created_at: 2025-04-01T12:42:05Z
body: ### 🤖 GitHub Action: Security Alerts Review 🔍

🟢 **Dismissed Security Alerts with Comments**
The following alerts were dismissed with proper comments:

🟢 [View Alert](https://github.com/lifinance/contracts/security/code-scanning/722) - **File:** `src/Periphery/Permit2Proxy.sol`
   🔹 Test functions fail to thoroughly test all aspects of contract constructors, potentially missing critical initialization issues. For more information, visit: http://detectors.olympixdevsectools.com/article/web3-vulnerability/incomplete-constructor-tests
   🔹 Dismiss Reason: **Won't fix**
   🔹 Dismiss Comment: Although there isn’t a dedicated test for the constructor, the success of all other tests confirms that the constructor parameters are configured correctly 

🟢 [View Alert](https://github.com/lifinance/contracts/security/code-scanning/721) - **File:** `src/Periphery/Permit2Proxy.sol`
   🔹 The contract contains functions with inadequate validation of input parameters, potentially leading to unexpected behavior or vulnerabilities. For more information, visit: http://detectors.olympixdevsectools.com/article/web3-vulnerability/insufficient-parameter-assertion
   🔹 Dismiss Reason: **Won't fix**
   🔹 Dismiss Comment: Additional validation on the calldata is intentionally omitted because the permit and witness signature checks already verify that the calldata is both authorized and correctly constructed. Extra checks would only add gas overhead without improving security 

🟢 [View Alert](https://github.com/lifinance/contracts/security/code-scanning/720) - **File:** `src/Periphery/Permit2Proxy.sol`
   🔹 The contract contains functions with inadequate validation of input parameters, potentially leading to unexpected behavior or vulnerabilities. For more information, visit: http://detectors.olympixdevsectools.com/article/web3-vulnerability/insufficient-parameter-assertion
   🔹 Dismiss Reason: **Won't fix**
   🔹 Dismiss Comment: observation is valid, but it’s not a priority right now. Although we could add a check to ensure the values are not zero, they are already authenticated by their signature. This enhancement can be addressed in a future update 

🟢 [View Alert](https://github.com/lifinance/contracts/security/code-scanning/719) - **File:** `src/Periphery/Permit2Proxy.sol`
   🔹 The contract contains functions with inadequate validation of input parameters, potentially leading to unexpected behavior or vulnerabilities. For more information, visit: http://detectors.olympixdevsectools.com/article/web3-vulnerability/insufficient-parameter-assertion
   🔹 Dismiss Reason: **Won't fix**
   🔹 Dismiss Comment: observation is valid, but it’s not a priority right now. Although we could add a check to ensure the values are not zero, they are already authenticated by their signature. This enhancement can be addressed in a future update 

🟢 [View Alert](https://github.com/lifinance/contracts/security/code-scanning/718) - **File:** `src/Periphery/Permit2Proxy.sol`
   🔹 The contract uses low-level calls without properly verifying the input parameters, potentially leading to unexpected behavior or vulnerabilities. For more information, visit: http://detectors.olympixdevsectools.com/article/web3-vulnerability/low-level-call-params-verified
   🔹 Dismiss Reason: **Won't fix**
   🔹 Dismiss Comment: it is safe in this context because the diamond contract is trusted 

🟢 [View Alert](https://github.com/lifinance/contracts/security/code-scanning/717) - **File:** `src/Periphery/Permit2Proxy.sol`
   🔹 The contract is vulnerable to signature replay attacks, potentially allowing malicious actors to reuse valid signatures. For more information, visit: http://detectors.olympixdevsectools.com/article/web3-vulnerability/signature-replay-attacks
   🔹 Dismiss Reason: **False positive**
   🔹 Dismiss Comment: replay protection is inherently provided by the underlying nonce mechanisms in the EIP-2612 and Permit2 implementations 

🟢 [View Alert](https://github.com/lifinance/contracts/security/code-scanning/716) - **File:** `src/Periphery/Permit2Proxy.sol`
   🔹 The contract is vulnerable to signature replay attacks, potentially allowing malicious actors to reuse valid signatures. For more information, visit: http://detectors.olympixdevsectools.com/article/web3-vulnerability/signature-replay-attacks
   🔹 Dismiss Reason: **False positive**
   🔹 Dismiss Comment: replay protection is inherently provided by the underlying nonce mechanisms in the EIP-2612 and Permit2 implementations 

🟢 [View Alert](https://github.com/lifinance/contracts/security/code-scanning/715) - **File:** `src/Periphery/Permit2Proxy.sol`
   🔹 Using a payable fallback (including receive) with no access control may lead to inadvertently locked funds. For more information, visit: http://detectors.olympixdevsectools.com/article/web3-vulnerability/no-access-control-payable-fallback
   🔹 Dismiss Reason: **False positive**
   🔹 Dismiss Comment: Funds can be withdrawn. Permit2Proxy inherits from WithdrawablePeriphery 

🟢 [View Alert](https://github.com/lifinance/contracts/security/code-scanning/714) - **File:** `src/Periphery/Permit2Proxy.sol`
   🔹 Parameters passed to a constructor that are not validated for correct values may lead to contract creation in an undesired state. For more information, visit: http://detectors.olympixdevsectools.com/article/web3-vulnerability/no-parameter-validation-in-constructor
   🔹 Dismiss Reason: **Won't fix**
   🔹 Dismiss Comment: This is a valid observation but can be skipped for now. The parameters are set during deployment by us, so there’s no immediate risk. It’s not urgent but can be improved later if needed 

🟢 [View Alert](https://github.com/lifinance/contracts/security/code-scanning/713) - **File:** `src/Periphery/Permit2Proxy.sol`
   🔹 Parameters passed to a constructor that are not validated for correct values may lead to contract creation in an undesired state. For more information, visit: http://detectors.olympixdevsectools.com/article/web3-vulnerability/no-parameter-validation-in-constructor
   🔹 Dismiss Reason: **Won't fix**
   🔹 Dismiss Comment: This is a valid observation but can be skipped for now. The addresses (_lifiDiamond and _permit2) are known contracts controlled or trusted by the deployerm so there’s no immediate risk. It’s not urgent but can be improved later 

🟢 [View Alert](https://github.com/lifinance/contracts/security/code-scanning/712) - **File:** `src/Periphery/Permit2Proxy.sol`
   🔹 Parameters passed to a constructor that are not validated for correct values may lead to contract creation in an undesired state. For more information, visit: http://detectors.olympixdevsectools.com/article/web3-vulnerability/no-parameter-validation-in-constructor
   🔹 Dismiss Reason: **Won't fix**
   🔹 Dismiss Comment: This is a valid observation but can be skipped for now. The addresses (_lifiDiamond and _permit2) are known contracts controlled or trusted by the deployerm so there’s no immediate risk. It’s not urgent but can be improved later 

🟢 [View Alert](https://github.com/lifinance/contracts/security/code-scanning/711) - **File:** `src/Periphery/Permit2Proxy.sol`
   🔹 Performing a narrowing downcast may result in silent overflow due to bit truncation. For more information, visit: http://detectors.olympixdevsectools.com/article/web3-vulnerability/unsafe-downcast
   🔹 Dismiss Reason: **False positive**
   🔹 Dismiss Comment: the narrowing cast is intentional and fits our nonce encoding scheme. The lower 8 bits extracted with uint8(start) are guaranteed to be within the valid range (0–255) by design 

🟢 [View Alert](https://github.com/lifinance/contracts/security/code-scanning/710) - **File:** `src/Periphery/Permit2Proxy.sol`
   🔹 Performing a narrowing downcast may result in silent overflow due to bit truncation. For more information, visit: http://detectors.olympixdevsectools.com/article/web3-vulnerability/unsafe-downcast
   🔹 Dismiss Reason: **False positive**
   🔹 Dismiss Comment: the cast from uint256 to uint248 is intentionally safe because start >> 8 is guaranteed not to exceed 2^248 - 1. so narrowing is safe 

🟢 [View Alert](https://github.com/lifinance/contracts/security/code-scanning/709) - **File:** `src/Periphery/Permit2Proxy.sol`
   🔹 Making an external call without a gas budget may consume all of the transaction's gas, causing it to revert. For more information, visit: http://detectors.olympixdevsectools.com/article/web3-vulnerability/call-without-gas-budget
   🔹 Dismiss Reason: **Won't fix**
   🔹 Dismiss Comment: we are calling a trusted diamond contract that may need full gas to execute its bridging or swap logic. If the diamond call requires more gas than available, the transaction will naturally revert 

🟢 [View Alert](https://github.com/lifinance/contracts/security/code-scanning/708) - **File:** `src/Periphery/Permit2Proxy.sol`
   🔹 Using a payable fallback (including receive) with no explicit functionality may indicate incomplete contract logic. For more information, visit: http://detectors.olympixdevsectools.com/article/web3-vulnerability/empty-payable-fallback
   🔹 Dismiss Reason: **False positive**
   🔹 Dismiss Comment: it's for receiving native token which later on can be withdrawn with WithdrawablePeriphery parent contract 

✅ **No unresolved security alerts!** 🎉


author_association: COLLABORATOR
user: login: lifi-action-bot
created_at: 2025-04-01T12:46:10Z
body: <!-- add-pr-comment:add-pr-comment -->

## Test Coverage Report
Line Coverage:       79.67% (2113 / 2652 lines)
Function Coverage:   84.90% ( 360 /  424 functions)
Branch Coverage:     47.92% ( 254 /  530 branches)
Test coverage (79.67%) is above min threshold (76%). Check passed.
author_association: COLLABORATOR