Make Multicall context-aware

test/metatx/ERC2771Context.test.js

@@ -9,7 +9,7 @@ const { MAX_UINT48 } = require('../helpers/constants');
 const { shouldBehaveLikeRegularContext } = require('../utils/Context.behavior');
 
 async function fixture() {
-  const [sender] = await ethers.getSigners();
+  const [sender, other] = await ethers.getSigners();
 
   const forwarder = await ethers.deployContract('ERC2771Forwarder', []);
   const forwarderAsSigner = await impersonate(forwarder.target);
@@ -27,7 +27,7 @@ async function fixture() {
     ],
   };
 
-  return { sender, forwarder, forwarderAsSigner, context, domain, types };
+  return { sender, other, forwarder, forwarderAsSigner, context, domain, types };
 }
 
 describe('ERC2771Context', function () {
@@ -114,4 +114,30 @@ describe('ERC2771Context', function () {
         .withArgs(data);
     });
   });
+
+  it('multicall poison attack', async function () {
+    const nonce = await this.forwarder.nonces(this.sender);
+    const data = this.context.interface.encodeFunctionData('multicall', [
+      [
+        // poisonned call to 'msgSender()'
+        ethers.concat([this.context.interface.encodeFunctionData('msgSender'), this.other.address]),
+      ],
+    ]);
+
+    const req = {
+      from: await this.sender.getAddress(),
+      to: await this.context.getAddress(),
+      value: 0n,
+      data,
+      gas: 100000n,
+      nonce,
+      deadline: MAX_UINT48,
+    };
+
+    req.signature = await this.sender.signTypedData(this.domain, this.types, req);
+
+    expect(await this.forwarder.verify(req)).to.equal(true);
+
+    await expect(this.forwarder.execute(req)).to.emit(this.context, 'Sender').withArgs(this.sender.address);
+  });
 });