Merge pull request #559 from PolymathNetwork/gtm-signed-transfer

GTM KYC during transfer

Author: maxsam4

contracts/modules/Experimental/TransferManager/SignedTransferManager.sol

@@ -43,10 +43,11 @@ contract SignedTransferManager is TransferManager {
     function checkSignatureValidity(bytes calldata _data) external view returns(bool) {
         address targetAddress;
         uint256 nonce;
+        uint256 validFrom;
         uint256 expiry;
         bytes memory signature;
-        (targetAddress, nonce, expiry, signature) = abi.decode(_data, (address, uint256, uint256, bytes));
-        if (targetAddress != address(this) || expiry < now || signature.length == 0 || _checkSignatureIsInvalid(signature))
+        (targetAddress, nonce, validFrom, expiry, signature) = abi.decode(_data, (address, uint256, uint256, uint256, bytes));
+        if (targetAddress != address(this) || expiry < now || validFrom > now || signature.length == 0 || _checkSignatureIsInvalid(signature))
             return false;
         return true;
     }
@@ -66,9 +67,9 @@ contract SignedTransferManager is TransferManager {
     */
     function executeTransfer(address _from, address _to, uint256 _amount, bytes calldata _data) external onlySecurityToken returns(Result) {
         (Result success, ) = verifyTransfer(_from, _to, _amount, _data);
-        if (success == Result.VALID) {
+        if (success == Result.VALID && _data.length > 32) {
             bytes memory signature;
-            (,,,signature) = abi.decode(_data, (address, uint256, uint256, bytes));
+            (,,,,signature) = abi.decode(_data, (address, uint256, uint256, uint256, bytes));
             _invalidateSignature(signature);
         }
         return success;
@@ -86,19 +87,20 @@ contract SignedTransferManager is TransferManager {
     function verifyTransfer(address _from, address _to, uint256 _amount, bytes memory _data) public view returns(Result, bytes32) {
         if (!paused) {
 
-            if (_data.length == 0)
+            if (_data.length <= 32)
                 return (Result.NA, bytes32(0));
 
             address targetAddress;
             uint256 nonce;
+            uint256 validFrom;
             uint256 expiry;
             bytes memory signature;
-            (targetAddress, nonce, expiry, signature) = abi.decode(_data, (address, uint256, uint256, bytes));
+            (targetAddress, nonce, validFrom, expiry, signature) = abi.decode(_data, (address, uint256, uint256, uint256, bytes));
 
-            if (address(this) != targetAddress || signature.length == 0 || _checkSignatureIsInvalid(signature) || expiry < now)
+            if (address(this) != targetAddress || signature.length == 0 || _checkSignatureIsInvalid(signature) || expiry < now || validFrom > now)
                 return (Result.NA, bytes32(0));
 
-            bytes32 hash = keccak256(abi.encodePacked(targetAddress, nonce, expiry, _from, _to, _amount));
+            bytes32 hash = keccak256(abi.encodePacked(targetAddress, nonce, validFrom, expiry, _from, _to, _amount));
             address signer = hash.toEthSignedMessageHash().recover(signature);
 
             if (!_checkSigner(signer))
@@ -122,14 +124,15 @@ contract SignedTransferManager is TransferManager {
 
         address targetAddress;
         uint256 nonce;
+        uint256 validFrom;
         uint256 expiry;
         bytes memory signature;
-        (targetAddress, nonce, expiry, signature) = abi.decode(_data, (address, uint256, uint256, bytes));
+        (targetAddress, nonce, validFrom, expiry, signature) = abi.decode(_data, (address, uint256, uint256, uint256, bytes));
 
         require(!_checkSignatureIsInvalid(signature), "Signature already invalid");
         require(targetAddress == address(this), "Signature not for this module");
 
-        bytes32 hash = keccak256(abi.encodePacked(targetAddress, nonce, expiry, _from, _to, _amount));
+        bytes32 hash = keccak256(abi.encodePacked(targetAddress, nonce, validFrom, expiry, _from, _to, _amount));
         require(hash.toEthSignedMessageHash().recover(signature) == msg.sender, "Incorrect Signer");
 
         _invalidateSignature(signature);

contracts/modules/TransferManager/GTM/GeneralTransferManager.sol

@@ -101,8 +101,29 @@ contract GeneralTransferManager is GeneralTransferManagerStorage, TransferManage
         uint256 _amount,
         bytes calldata _data
     ) external returns(Result) {
-       (Result success,) = verifyTransfer(_from, _to, _amount, _data);
-       return success;
+        if (_data.length > 32) {
+            address target;
+            uint256 nonce;
+            uint256 validFrom;
+            uint256 validTo;
+            bytes memory data;
+            (target, nonce, validFrom, validTo, data) = abi.decode(_data, (address, uint256, uint256, uint256, bytes));
+            if (target == address(this))
+                _processTransferSignature(nonce, validFrom, validTo, data);
+        }
+        (Result success,) = verifyTransfer(_from, _to, _amount, _data);
+        return success;
+    }
+
+    function _processTransferSignature(uint256 _nonce, uint256 _validFrom, uint256 _validTo, bytes memory _data) internal {
+        address[] memory investor;
+        uint256[] memory fromTime;
+        uint256[] memory toTime;
+        uint256[] memory expiryTime;
+        bytes memory signature;
+        (investor, fromTime, toTime, expiryTime, signature) =
+            abi.decode(_data, (address[], uint256[], uint256[], uint256[], bytes));
+        _modifyKYCDataSignedMulti(investor, fromTime, toTime, expiryTime, _validFrom, _validTo, _nonce, signature);
     }
 
     /**
@@ -376,28 +397,117 @@ contract GeneralTransferManager is GeneralTransferManagerStorage, TransferManage
         bytes memory _signature
     )
         public
+    {
+        require(
+            _modifyKYCDataSigned(_investor, _fromTime, _toTime, _expiryTime, _validFrom, _validTo, _nonce, _signature),
+            "Invalid signature or data"
+        );
+    }
+
+    function _modifyKYCDataSigned(
+        address _investor,
+        uint256 _fromTime,
+        uint256 _toTime,
+        uint256 _expiryTime,
+        uint256 _validFrom,
+        uint256 _validTo,
+        uint256 _nonce,
+        bytes memory _signature
+    )
+        internal
+        returns(bool)
     {
         /*solium-disable-next-line security/no-block-members*/
-        require(_validFrom <= now, "ValidFrom is too early");
-        /*solium-disable-next-line security/no-block-members*/
-        require(_validTo >= now, "ValidTo is too late");
-        require(!nonceMap[_investor][_nonce], "Already used signature");
-        nonceMap[_investor][_nonce] = true;
+        if(_validFrom > now || _validTo < now || _investor == address(0))
+            return false;
         bytes32 hash = keccak256(
             abi.encodePacked(this, _investor, _fromTime, _toTime, _expiryTime, _validFrom, _validTo, _nonce)
         );
-        _checkSig(hash, _signature);
-        _modifyKYCData(_investor, _fromTime, _toTime, _expiryTime);
+        if (_checkSig(hash, _signature, _nonce)) {
+            _modifyKYCData(_investor, _fromTime, _toTime, _expiryTime);
+            return true;
+        }
+        return false;
+    }
+
+    /**
+    * @notice Adds or removes addresses from the whitelist - can be called by anyone with a valid signature
+    * @param _investor is the address to whitelist
+    * @param _fromTime is the moment when the sale lockup period ends and the investor can freely sell his tokens
+    * @param _toTime is the moment when the purchase lockup period ends and the investor can freely purchase tokens from others
+    * @param _expiryTime is the moment till investors KYC will be validated. After that investor need to do re-KYC
+    * @param _validFrom is the time that this signature is valid from
+    * @param _validTo is the time that this signature is valid until
+    * @param _nonce nonce of signature (avoid replay attack)
+    * @param _signature issuer signature
+    */
+    function modifyKYCDataSignedMulti(
+        address[] memory _investor,
+        uint256[] memory _fromTime,
+        uint256[] memory _toTime,
+        uint256[] memory _expiryTime,
+        uint256 _validFrom,
+        uint256 _validTo,
+        uint256 _nonce,
+        bytes memory _signature
+    )
+        public
+    {
+        require(
+            _modifyKYCDataSignedMulti(_investor, _fromTime, _toTime, _expiryTime, _validFrom, _validTo, _nonce, _signature),
+            "Invalid signature or data"
+        );
+    }
+
+    function _modifyKYCDataSignedMulti(
+        address[] memory _investor,
+        uint256[] memory _fromTime,
+        uint256[] memory _toTime,
+        uint256[] memory _expiryTime,
+        uint256 _validFrom,
+        uint256 _validTo,
+        uint256 _nonce,
+        bytes memory _signature
+    )
+        internal
+        returns(bool)
+    {
+        if (_investor.length != _fromTime.length ||
+            _fromTime.length != _toTime.length ||
+            _toTime.length != _expiryTime.length
+        ) {
+            return false;
+        }
+
+        if (_validFrom > now || _validTo < now) {
+            return false;
+        }
+
+        bytes32 hash = keccak256(
+            abi.encodePacked(this, _investor, _fromTime, _toTime, _expiryTime, _validFrom, _validTo, _nonce)
+        );
+
+        if (_checkSig(hash, _signature, _nonce)) {
+            for (uint256 i = 0; i < _investor.length; i++) {
+                _modifyKYCData(_investor[i], _fromTime[i], _toTime[i], _expiryTime[i]);
+            }
+            return true;
+        }
+        return false;
     }
 
     /**
      * @notice Used to verify the signature
      */
-    function _checkSig(bytes32 _hash, bytes memory _signature) internal view {
+    function _checkSig(bytes32 _hash, bytes memory _signature, uint256 _nonce) internal returns(bool) {
         //Check that the signature is valid
         //sig should be signing - _investor, _fromTime, _toTime & _expiryTime and be signed by the issuer address
         address signer = _hash.toEthSignedMessageHash().recover(_signature);
-        require(_checkPerm(OPERATOR, signer), "Incorrect signer");
+        if (nonceMap[signer][_nonce] || !_checkPerm(OPERATOR, signer)) {
+            return false;
+        }
+        nonceMap[signer][_nonce] = true;
+        return true;
     }
 
     /**