Renegade v2 by jparklev · Pull Request #575 · 0xProject/0x-settler

jparklev · 2026-06-01T17:28:51Z

Picked up from #567

Context from 567:
Renegade v2 is deployed to Base Mainnet and Arbitrum One. On both deployments, the function signature for settlement is the same: sponsorExternalMatch(uint256,address,(address,address,(uint256),uint256,uint256,uint256),(bool,uint8,bytes),(address,bool,uint256,uint256,bytes))

"The adapter contract exposes sellToRenegade() with the following signature. Unlike the v1 adapter contract, there is no bool baseForQuote parameter.

> function sellToRenegade(
    address target,
    IERC20 sellToken,
    bytes memory data,
    uint256 minBuyAmt
) internal returns (uint256 buyAmt)

duncancmt

General style in this repo is that constant arguments go on the left of commutative operations in assembly. E.g. add(0x40, data) ⭕ -- add(data, 0x40) ❌

If this isn't already in AGENTS.md, it should be

duncancmt · 2026-06-01T18:07:39Z

+        assembly ("memory-safe") {
+            recipient := mload(add(data, 0x40))
        }
+        require((recipient == address(0)) || (recipient == address(this)), "Renegade: bad recipient");


What does address(0) indicate?

duncancmt · 2026-06-01T18:09:47Z

+        // newBuyAmt = floor(newSellAmt / price), matching
+        // FixedPointLib.divIntegerByFixedPoint.
+        uint256 newBuyAmt = (newSellAmt << 63) / priceRepr;


If we need to handle overflow, left shift should be avoided. If we don't need to handle overflow / should become unsafeDiv

duncancmt · 2026-06-01T18:11:09Z

+        require(newBuyAmt >= minInternalPartyAmountIn, "Renegade: newBuyAmt < minInternalPartyAmountIn");
+        require(newBuyAmt <= maxInternalPartyAmountIn, "Renegade: newBuyAmt > maxInternalPartyAmountIn");


Presumably Renegade checks this internally? If it doesn't, please replace this with the pattern:

if (!condition) { revert MyCustomErrorSelector(...); }

or, even better, throw the error in assembly. This is for contract size. If this isn't already documented as a stylistic dictum in AGENTS.md, please add it.

duncancmt · 2026-06-01T18:12:29Z

+        // Snapshot the buyToken balance before the call so we can measure the
+        // actual amount transferred after.
+        uint256 buyTokenBalanceBefore = buyToken.fastBalanceOf(address(this));


This is an antipattern for slippage checking https://kebabsec.xyz/posts/critical_vulnerability_in_uniswapx/

duncancmt · 2026-06-01T18:13:09Z

+        // Check the balance delta.
+        buyAmt = buyToken.fastBalanceOf(address(this)) - buyTokenBalanceBefore;
+        if (buyAmt < minBuyAmt) revertTooMuchSlippage(buyToken, minBuyAmt, buyAmt);


Shouldn't this be handled by _checkSlippageAndTransfer? Also is custody optimization not possible with RenegadeV2?

duncancmt · 2026-06-01T18:48:04Z

+     *     0x140  uint256   <offset>  GasSponsorOptions: (address refundAddress, bool refundNativeEth, uint256 refundAmount, uint256 nonce, bytes signature)
+     *   )
+     */
+    uint32 internal constant RENEGADE_SELECTOR = uint32(


If you define this constant as a literal, then you'll be able to access it in assembly. Even though the current expression is compile-time constant, because it isn't literal, it can't be accessed from Yul. Also should probably be private

immunefi-magnus · 2026-06-17T22:07:14Z

🛡️ Immunefi PR Reviews

We noticed that your project isn't set up for automatic code reviews. If you'd like this PR reviewed by the Immunefi team, you can request it manually using the link below:

🔗 Send this PR in for review

Once submitted, we'll take care of assigning a reviewer and follow up here.

duncancmt · 2026-06-18T13:46:36Z

-            } else { // if (action == uint32(ISettlerActions.PANCAKE_INFINITY.selector))
+            } else {
+                // if (action == uint32(ISettlerActions.PANCAKE_INFINITY.selector))
                sellToPancakeInfinity(recipient, sellToken, bps, feeOnTransfer, hashMul, hashMod, fills, amountOutMin);
            }
-        /*
-        } else if (action == uint32(ISettlerActions.EULERSWAP.selector)) {
-            (address recipient, IERC20 sellToken, uint256 bps, IEulerSwap pool, bool zeroForOne, uint256 amountOutMin) =
-                abi.decode(data, (address, IERC20, uint256, IEulerSwap, bool, uint256));
+            /*
+            } else if (action == uint32(ISettlerActions.EULERSWAP.selector)) {
+                (address recipient, IERC20 sellToken, uint256 bps, IEulerSwap pool, bool zeroForOne, uint256 amountOutMin) =
+                    abi.decode(data, (address, IERC20, uint256, IEulerSwap, bool, uint256));

-            sellToEulerSwap(recipient, sellToken, bps, pool, zeroForOne, amountOutMin);
-        */
+                sellToEulerSwap(recipient, sellToken, bps, pool, zeroForOne, amountOutMin);
+            */


please fix bad formatting

duncancmt · 2026-06-18T13:47:40Z

+        if ((recipient != address(0)) && (recipient != address(this))) revertInvalidRenegadeData();
+        if (sellToken != internalPartyOutputToken) revertInvalidRenegadeData();
+        if (priceRepr == 0) revertInvalidRenegadeData();


Join these together with FastLogic.or into a single branch to save bytecode size.

duncancmt · 2026-06-18T13:48:54Z

+        if (newBuyAmt < minInternalPartyAmountIn) revertInvalidRenegadeData();
+        if (newBuyAmt > maxInternalPartyAmountIn) revertInvalidRenegadeData();


combine these with the above checks as well, presuming that these checks are meaningful and not redundant, which I suspect they are

duncancmt · 2026-06-18T13:49:24Z

-            revertTooMuchSlippage(_extractBuyToken(data, baseForQuote), minBuyAmount, buyAmount);
-        }
+        address target = _renegadeGasSponsorV2();
+        uint256 buyTokenBalanceBefore = buyToken.fastBalanceOf(address(this));


This is still the forbidden way of checking slippage. Please fix.

duncancmt · 2026-06-18T13:50:04Z

            let len := mload(data)
-            // temporarily clobber `data` size memory area
-            mstore(data, selector)
-            // Allowed selectors don't clash with any relevant function of restricted targets so we can skip checking `target`


Please restore this comment

duncancmt · 2026-06-18T13:51:12Z

        }
+
+        buyAmt = buyToken.fastBalanceOf(address(this)) - buyTokenBalanceBefore;
+        if (buyAmt < minBuyAmt) revertTooMuchSlippage(buyToken, minBuyAmt, buyAmt);


duncancmt · 2026-06-18T13:51:25Z

    /// VIP actions should always start with `recipient` address and the `permit` from the taker
    /// followed by all the other parameters to ensure compatibility with `executeWithPermit` entrypoint.
    /// `minBuyAmount`/`amountOutMin` should always be the last parameter.
-


Please fix bad formatting

duncancmt

This is looking pretty good. I think I still don't all the way understand how we're expecting Renegade to interact with slippage checking and custody optimization. The previous iteration seemed like it was amenable to custody optimization (and consequently slippage checking), but the current iteration removes that functionality entirely. Is this because we don't know whether we'll be applying that optimization at the time we request the firm quote from Renegade and the recipient is cryptographically bound to the price?

Even if custody optimization isn't possible, it's still desirable to be able to slippage-check the Renegade leg. Per-leg slippage checking is an infrequent, but still-used idiom.

Lastly, if we're going to be destructuring/interpreting many of the fields of the arguments to sponsorExternalMatch, it would make sense for those fields to be arguments of the action rather than taking it as opaque bytes and implicitly extracting them. It's less error-prone and (sometimes) more gas efficient. If we're not reading any of the BoundedMatchResult fields, then that can still be opaque.

Feel free to DM me if you want to iterate faster.

duncancmt · 2026-06-23T20:37:41Z

-        // FixedPointLib.divIntegerByFixedPoint.
-        uint256 newBuyAmt = (newSellAmt << 63).unsafeDiv(priceRepr);
-
-        if (newBuyAmt < minBuyAmt) revertTooMuchSlippage(buyToken, minBuyAmt, newBuyAmt);


Why was this removed? Does Renegade not support custody optimization?

duncancmt · 2026-06-23T20:39:57Z

-        if (newBuyAmt < minInternalPartyAmountIn) revertInvalidRenegadeData();
-        if (newBuyAmt > maxInternalPartyAmountIn) revertInvalidRenegadeData();


just an idle thought here: should we clamp? if there's a maximum notional, if the swap encounters slippage, we should clamp to avoid a revert, no?

duncancmt · 2026-06-23T20:41:54Z

+    // `data` is the args to `sponsorExternalMatch` minus the 4-byte selector; its payload begins at
+    // `data + 0x20`. The head is static (`BoundedMatchResult` is inlined), so we index fixed offsets:
+    // 0x20 externalPartyAmountIn, 0x40 recipient, 0x80 internalPartyOutputToken.
    uint32 private constant RENEGADE_SELECTOR = 0x54ea46d4;


it doesn't necessarily need to be here, but somewhere there should be a more readable signature from which this selector was computed

duncancmt · 2026-06-23T20:49:18Z

        }
-
-        buyAmt = buyToken.fastBalanceOf(address(this)) - buyTokenBalanceBefore;
-        if (buyAmt < minBuyAmt) revertTooMuchSlippage(buyToken, minBuyAmt, buyAmt);


upgraded Renegade.sol to v2 - sponsorExternalMatch()

c8a8e1d

jparklev changed the title ~~Renegade v2~~ [WIP] Renegade v2 Jun 1, 2026

jparklev mentioned this pull request Jun 1, 2026

Renegade v2 integration #567

Closed

Fix Renegade v2 integration

816ac9e

duncancmt reviewed Jun 1, 2026

View reviewed changes

jparklev added 3 commits June 1, 2026 13:22

Hide Renegade selector

807291a

Simplify Renegade integration

db7d6f7

Address Renegade review comments

452f8f9

duncancmt reviewed Jun 1, 2026

View reviewed changes

Inline Renegade selector

bb5b557

jparklev changed the title ~~[WIP] Renegade v2~~ Renegade v2 Jun 17, 2026

jparklev marked this pull request as ready for review June 17, 2026 22:07

Add Renegade guard tests

f347ea4

jparklev added 2 commits June 17, 2026 18:27

Simplify Renegade tests

30a296c

Merge branch 'master' into jparklev/renegade-v2

bc7e40e

duncancmt reviewed Jun 18, 2026

View reviewed changes

Address Renegade review comments

00f46e9

duncancmt reviewed Jun 23, 2026

View reviewed changes

		require(newBuyAmt >= minInternalPartyAmountIn, "Renegade: newBuyAmt < minInternalPartyAmountIn");
		require(newBuyAmt <= maxInternalPartyAmountIn, "Renegade: newBuyAmt > maxInternalPartyAmountIn");

		if (newBuyAmt < minInternalPartyAmountIn) revertInvalidRenegadeData();
		if (newBuyAmt > maxInternalPartyAmountIn) revertInvalidRenegadeData();

Uh oh!

Conversation

jparklev commented Jun 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

duncancmt left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

immunefi-magnus Bot commented Jun 17, 2026

🛡️ Immunefi PR Reviews

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

duncancmt left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

jparklev commented Jun 1, 2026 •

edited

Loading