Contract Source Code:

pragma solidity 0.8.25;

import {OwnableUpgradeable} from "@openzeppelin/contracts-upgradeable/access/OwnableUpgradeable.sol";
import {IForeignBridge} from "../../interfaces/IForeignBridge.sol";
import {IXDaiForeignBridge} from "../../interfaces/IXDaiForeignBridge.sol";
import {IXDaiBridgePeripheral} from "../../interfaces/IXDaiBridgePeripheral.sol";
import {IERC20} from "../../interfaces/IERC20.sol";
import {IWETHOmnibridgeRouter} from "../../interfaces/IWETHOmnibridgeRouter.sol";

/// @title BridgeRouter
/// @author Gnosis Chain Bridge team
/// @notice A router contract that facilitates the correct routing for specific token that bridges to Gnosis Chain
/// @dev this intended to be an upgradeable contract
contract BridgeRouter is OwnableUpgradeable {
    address public constant FOREIGN_OMNIBRIDGE = 0x88ad09518695c6c3712AC10a214bE5109a655671;
    address public constant FOREIGN_AMB = 0x4C36d2919e407f0Cc2Ee3c993ccF8ac26d9CE64e;
    address public constant FOREIGN_XDAIBRIDGE = 0x4aa42145Aa6Ebf72e164C9bBC74fbD3788045016;
    address public constant DAI = 0x6B175474E89094C44Da98b954EedeAC495271d0F;
    address public constant USDS = 0xdC035D45d973E3EC169d2276DDab16f1e407384F;
    address public constant WETH_OMNIBRIDGE_ROUTER = 0xa6439Ca0FCbA1d0F80df0bE6A17220feD9c9038a;

    error ClaimUsdsNotSupported();

    mapping(address => address) public tokenRoutes;

    constructor() {
        _disableInitializers();
    }

    function initialize(address owner) public initializer {
        __Ownable_init(owner);
    }

    /// @notice An entry point contract for user to bridge any token from source chain
    /// @dev Directs route to relevant contract to perform token relaying
    /// @param _token token to bridge
    /// @param _receiver receiver of token on Gnosis Chain
    /// @param _amount amount to receive on Gnosis Chain
    function relayTokens(address _token, address _receiver, uint256 _amount) external payable {
        address route = tokenRoutes[_token];

        if (_token == DAI) {
            IERC20(_token).transferFrom(msg.sender, route, _amount);
            IXDaiBridgePeripheral(route).relayTokens(_receiver, _amount);
        } else if (_token == USDS) {
            // token need to be transferred to router contract first, because the bridge will call transferFrom(msg.sender, bridge, amount);
            IERC20(_token).transferFrom(msg.sender, address(this), _amount);
            IERC20(_token).approve(route, _amount);
            IXDaiForeignBridge(route).relayTokens(_receiver, _amount);
        } else if (_token == address(0)) {
            // call wrapAndRelayTokens
            require(msg.value == _amount, "msg.value mismatch");
            IWETHOmnibridgeRouter(WETH_OMNIBRIDGE_ROUTER).wrapAndRelayTokens{value: msg.value}(_receiver);
        } else {
            IERC20(_token).transferFrom(msg.sender, address(this), _amount);
            IERC20(_token).approve(FOREIGN_OMNIBRIDGE, _amount);
            IForeignBridge(FOREIGN_OMNIBRIDGE).relayTokens(_token, _receiver, _amount);
        }
    }

    /// @notice Set route for specific token. Be aware of pending cross chain transactions before updating the route.
    /// @param _token token address
    /// @param _route router contract address
    function setRoute(address _token, address _route) public onlyOwner {
        require(_route != address(0) && _route != address(this), "invalid route address");
        require(_token == DAI || _token == USDS, "invalid token address");
        uint256 size;
        assembly {
            size := extcodesize(_route)
        }
        require(size > 0, "route should be a contract");
        tokenRoutes[_token] = _route;
    }

    /// @notice Claim token function
    /// @dev This function check if the data belongs of xDAI bridge or AMB/Omnibridge
    /// @param message bytes to be relayed
    /// @param signatures signatures to be validated
    function executeSignatures(bytes memory message, bytes memory signatures) external {
        if (message.length == 104) {
            // xdai bridge
            // should always receive DAI
            IXDaiForeignBridge(FOREIGN_XDAIBRIDGE).executeSignatures(message, signatures);
        } else {
            // amb & omnibridge
            IForeignBridge(FOREIGN_AMB).safeExecuteSignaturesWithAutoGasLimit(message, signatures);
        }
    }

    /// @notice Validates provided signatures and relays a given AMB message.
    /// @dev  This function is introduced to allow third party applications to switch from calling AMB bridge to Bridge Router contract(this) without changing the function signature
    /// @param message bytes to be relayed
    /// @param signatures signatures to be validated
    function safeExecuteSignaturesWithAutoGasLimit(bytes memory message, bytes memory signatures) external {
        IForeignBridge(FOREIGN_AMB).safeExecuteSignaturesWithAutoGasLimit(message, signatures);
    }

    /// @notice Claim USDS function
    /// @dev This function should revert before the xDAI bridge USDS upgrade
    /// @param message bytes to be relayed
    /// @param signatures signatures to be validated
    function executeSignaturesUSDS(bytes memory message, bytes memory signatures) external {
        if (IXDaiForeignBridge(FOREIGN_XDAIBRIDGE).erc20token() == DAI) {
            // should revert if the bridge is not upgraded to USDS
            revert ClaimUsdsNotSupported();
        } else {
            IXDaiForeignBridge(FOREIGN_XDAIBRIDGE).executeSignaturesUSDS(message, signatures);
        }
    }

    /// @notice Allows to transfer any locked token from this contract.
    /// @param token token to recover
    /// @param recipient recipient of token
    /// @param amount token amount
    function recoverLockedFund(address token, address recipient, uint256 amount) external onlyOwner {
        if (token == address(0)) {
            uint256 balance = address(this).balance;
            require(amount <= balance, "no enough ETH to withdraw");
            require(payable(recipient).send(amount), "unsuccesssful sent");
        } else {
            require(amount <= IERC20(token).balanceOf(address(this)), "no enough balance to withdraw");
            IERC20(token).transfer(recipient, amount);
        }
    }
}

// SPDX-License-Identifier: MIT
// OpenZeppelin Contracts (last updated v5.0.0) (access/Ownable.sol)

pragma solidity ^0.8.20;

import {ContextUpgradeable} from "../utils/ContextUpgradeable.sol";
import {Initializable} from "../proxy/utils/Initializable.sol";

/**
 * @dev Contract module which provides a basic access control mechanism, where
 * there is an account (an owner) that can be granted exclusive access to
 * specific functions.
 *
 * The initial owner is set to the address provided by the deployer. This can
 * later be changed with {transferOwnership}.
 *
 * This module is used through inheritance. It will make available the modifier
 * `onlyOwner`, which can be applied to your functions to restrict their use to
 * the owner.
 */
abstract contract OwnableUpgradeable is Initializable, ContextUpgradeable {
    /// @custom:storage-location erc7201:openzeppelin.storage.Ownable
    struct OwnableStorage {
        address _owner;
    }

    // keccak256(abi.encode(uint256(keccak256("openzeppelin.storage.Ownable")) - 1)) & ~bytes32(uint256(0xff))
    bytes32 private constant OwnableStorageLocation = 0x9016d09d72d40fdae2fd8ceac6b6234c7706214fd39c1cd1e609a0528c199300;

    function _getOwnableStorage() private pure returns (OwnableStorage storage $) {
        assembly {
            $.slot := OwnableStorageLocation
        }
    }

    /**
     * @dev The caller account is not authorized to perform an operation.
     */
    error OwnableUnauthorizedAccount(address account);

    /**
     * @dev The owner is not a valid owner account. (eg. `address(0)`)
     */
    error OwnableInvalidOwner(address owner);

    event OwnershipTransferred(address indexed previousOwner, address indexed newOwner);

    /**
     * @dev Initializes the contract setting the address provided by the deployer as the initial owner.
     */
    function __Ownable_init(address initialOwner) internal onlyInitializing {
        __Ownable_init_unchained(initialOwner);
    }

    function __Ownable_init_unchained(address initialOwner) internal onlyInitializing {
        if (initialOwner == address(0)) {
            revert OwnableInvalidOwner(address(0));
        }
        _transferOwnership(initialOwner);
    }

    /**
     * @dev Throws if called by any account other than the owner.
     */
    modifier onlyOwner() {
        _checkOwner();
        _;
    }

    /**
     * @dev Returns the address of the current owner.
     */
    function owner() public view virtual returns (address) {
        OwnableStorage storage $ = _getOwnableStorage();
        return $._owner;
    }

    /**
     * @dev Throws if the sender is not the owner.
     */
    function _checkOwner() internal view virtual {
        if (owner() != _msgSender()) {
            revert OwnableUnauthorizedAccount(_msgSender());
        }
    }

    /**
     * @dev Leaves the contract without owner. It will not be possible to call
     * `onlyOwner` functions. Can only be called by the current owner.
     *
     * NOTE: Renouncing ownership will leave the contract without an owner,
     * thereby disabling any functionality that is only available to the owner.
     */
    function renounceOwnership() public virtual onlyOwner {
        _transferOwnership(address(0));
    }

    /**
     * @dev Transfers ownership of the contract to a new account (`newOwner`).
     * Can only be called by the current owner.
     */
    function transferOwnership(address newOwner) public virtual onlyOwner {
        if (newOwner == address(0)) {
            revert OwnableInvalidOwner(address(0));
        }
        _transferOwnership(newOwner);
    }

    /**
     * @dev Transfers ownership of the contract to a new account (`newOwner`).
     * Internal function without access restriction.
     */
    function _transferOwnership(address newOwner) internal virtual {
        OwnableStorage storage $ = _getOwnableStorage();
        address oldOwner = $._owner;
        $._owner = newOwner;
        emit OwnershipTransferred(oldOwner, newOwner);
    }
}

pragma solidity ^0.8.0;

interface IForeignBridge {
    function relayTokens(address receiver, uint256 amount) external;
    function relayTokens(address token, address receiver, uint256 amount) external;
    function withinLimit(address token, uint256 amount) external returns (bool);
    function executeSignatures(bytes memory data, bytes memory signatures) external;
    function safeExecuteSignaturesWithAutoGasLimit(bytes memory data, bytes memory signatures) external;
}

pragma solidity 0.8.25;

interface IXDaiForeignBridge {
    event DailyLimitChanged(uint256 newLimit);
    event ExecutionDailyLimitChanged(uint256 newLimit);
    event GasPriceChanged(uint256 gasPrice);
    event OwnershipTransferred(address previousOwner, address newOwner);
    event PaidInterest(address indexed token, address to, uint256 value);
    event RelayedMessage(address recipient, uint256 value, bytes32 transactionHash);
    event RequiredBlockConfirmationChanged(uint256 requiredBlockConfirmations);
    event UserRequestForAffirmation(address recipient, uint256 value);

    function claimTokens(address _token, address _to) external;
    function daiToken() external pure returns (address);
    function dailyLimit() external view returns (uint256);
    function decimalShift() external view returns (int256);
    function deployedAtBlock() external view returns (uint256);
    function disableInterest(address _token) external;
    function erc20token() external view returns (address);
    function executeSignatures(bytes memory message, bytes memory signatures) external;
    function executeSignaturesUSDS(bytes memory message, bytes memory signatures) external;
    function executeSignaturesGSN(bytes memory message, bytes memory signatures, uint256 maxTokensFee) external;
    function executionDailyLimit() external view returns (uint256);
    function executionMaxPerTx() external view returns (uint256);
    function gasPrice() external view returns (uint256);
    function getBridgeInterfacesVersion() external pure returns (uint64 major, uint64 minor, uint64 patch);
    function getBridgeMode() external pure returns (bytes4 _data);
    function getCurrentDay() external view returns (uint256);
    function getTrustedForwarder() external view returns (address);
    function initialize(
        address _validatorContract,
        address _erc20token,
        uint256 _requiredBlockConfirmations,
        uint256 _gasPrice,
        uint256[3] memory _dailyLimitMaxPerTxMinPerTxArray,
        uint256[2] memory _homeDailyLimitHomeMaxPerTxArray,
        address _owner,
        int256 _decimalShift,
        address _bridgeOnOtherSide
    ) external returns (bool);
    function initializeInterest(
        address _token,
        uint256 _minCashThreshold,
        uint256 _minInterestPaid,
        address _interestReceiver
    ) external;
    function swapSDAIToUSDS() external;
    function interestAmount(address _token) external view returns (uint256);
    function interestReceiver(address _token) external view returns (address);
    function invest(address _token) external;
    function investDai() external;
    function investedAmount(address _token) external view returns (uint256);
    function isInitialized() external view returns (bool);
    function isInterestEnabled(address _token) external view returns (bool);
    function isTrustedForwarder(address forwarder) external view returns (bool);
    function maxAvailablePerTx() external view returns (uint256);
    function maxPerTx() external view returns (uint256);
    function minCashThreshold(address _token) external view returns (uint256);
    function minInterestPaid(address _token) external view returns (uint256);
    function minPerTx() external view returns (uint256);
    function owner() external view returns (address);
    function payInterest(address _token, uint256 _amount) external;
    function previewWithdraw(address _token, uint256 _amount) external view returns (uint256);
    function refillBridge() external;
    function relayTokens(address _receiver, uint256 _amount) external;
    function relayedMessages(bytes32 _nonce) external view returns (bool);
    function requiredBlockConfirmations() external view returns (uint256);
    function requiredSignatures() external view returns (uint256);
    function sDaiToken() external pure returns (address);
    function setDailyLimit(uint256 _dailyLimit) external;
    function setExecutionDailyLimit(uint256 _dailyLimit) external;
    function setExecutionMaxPerTx(uint256 _maxPerTx) external;
    function setGasPrice(uint256 _gasPrice) external;
    function setInterestReceiver(address _token, address _receiver) external;
    function setMaxPerTx(uint256 _maxPerTx) external;
    function setMinCashThreshold(address _token, uint256 _minCashThreshold) external;
    function setMinInterestPaid(address _token, uint256 _minInterestPaid) external;
    function setMinPerTx(uint256 _minPerTx) external;
    function setPayMaster(address _paymaster) external;
    function setRequiredBlockConfirmations(uint256 _blockConfirmations) external;
    function setTrustedForwarder(address _trustedForwarder) external;
    function totalExecutedPerDay(uint256 _day) external view returns (uint256);
    function totalSpentPerDay(uint256 _day) external view returns (uint256);
    function transferOwnership(address newOwner) external;
    function validatorContract() external view returns (address);
    function versionRecipient() external view returns (string memory);
    function withinExecutionLimit(uint256 _amount) external view returns (bool);
    function withinLimit(uint256 _amount) external view returns (bool);
    function setNewErc20Token(address newDAI) external;
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.25;

interface IXDaiBridgePeripheral {
    function DAI() external view returns (address);
    function DAIUSDS() external view returns (address);
    function FOREIGN_XDAIBRIDGE() external view returns (address);
    function USDS() external view returns (address);
    function relayTokens(address receiver, uint256 amount) external;
    function router() external view returns (address);
}

pragma solidity ^0.8.0;

interface IERC20 {
    function approve(address usr, uint256 wad) external;
    function allowance(address owner, address spender, uint256 amount) external returns (uint256);
    function permit(address owner, address spender, uint256 amount, uint256 deadline, bytes memory signatures) external;
    function transferFrom(address owner, address spender, uint256 amount) external;
    function transfer(address usr, uint256 wad) external;
    function balanceOf(address usr) external returns (uint256);
}

// SPDX-License-Identifier: MIT

pragma solidity 0.8.25;

interface IWETHOmnibridgeRouter {
    function wrapAndRelayTokens(address _receiver) external payable;
}

// SPDX-License-Identifier: MIT
// OpenZeppelin Contracts (last updated v5.0.1) (utils/Context.sol)

pragma solidity ^0.8.20;
import {Initializable} from "../proxy/utils/Initializable.sol";

/**
 * @dev Provides information about the current execution context, including the
 * sender of the transaction and its data. While these are generally available
 * via msg.sender and msg.data, they should not be accessed in such a direct
 * manner, since when dealing with meta-transactions the account sending and
 * paying for execution may not be the actual sender (as far as an application
 * is concerned).
 *
 * This contract is only required for intermediate, library-like contracts.
 */
abstract contract ContextUpgradeable is Initializable {
    function __Context_init() internal onlyInitializing {
    }

    function __Context_init_unchained() internal onlyInitializing {
    }
    function _msgSender() internal view virtual returns (address) {
        return msg.sender;
    }

    function _msgData() internal view virtual returns (bytes calldata) {
        return msg.data;
    }

    function _contextSuffixLength() internal view virtual returns (uint256) {
        return 0;
    }
}

// SPDX-License-Identifier: MIT
// OpenZeppelin Contracts (last updated v5.0.0) (proxy/utils/Initializable.sol)

pragma solidity ^0.8.20;

/**
 * @dev This is a base contract to aid in writing upgradeable contracts, or any kind of contract that will be deployed
 * behind a proxy. Since proxied contracts do not make use of a constructor, it's common to move constructor logic to an
 * external initializer function, usually called `initialize`. It then becomes necessary to protect this initializer
 * function so it can only be called once. The {initializer} modifier provided by this contract will have this effect.
 *
 * The initialization functions use a version number. Once a version number is used, it is consumed and cannot be
 * reused. This mechanism prevents re-execution of each "step" but allows the creation of new initialization steps in
 * case an upgrade adds a module that needs to be initialized.
 *
 * For example:
 *
 * [.hljs-theme-light.nopadding]
 * ```solidity
 * contract MyToken is ERC20Upgradeable {
 *     function initialize() initializer public {
 *         __ERC20_init("MyToken", "MTK");
 *     }
 * }
 *
 * contract MyTokenV2 is MyToken, ERC20PermitUpgradeable {
 *     function initializeV2() reinitializer(2) public {
 *         __ERC20Permit_init("MyToken");
 *     }
 * }
 * ```
 *
 * TIP: To avoid leaving the proxy in an uninitialized state, the initializer function should be called as early as
 * possible by providing the encoded function call as the `_data` argument to {ERC1967Proxy-constructor}.
 *
 * CAUTION: When used with inheritance, manual care must be taken to not invoke a parent initializer twice, or to ensure
 * that all initializers are idempotent. This is not verified automatically as constructors are by Solidity.
 *
 * [CAUTION]
 * ====
 * Avoid leaving a contract uninitialized.
 *
 * An uninitialized contract can be taken over by an attacker. This applies to both a proxy and its implementation
 * contract, which may impact the proxy. To prevent the implementation contract from being used, you should invoke
 * the {_disableInitializers} function in the constructor to automatically lock it when it is deployed:
 *
 * [.hljs-theme-light.nopadding]
 * ```
 * /// @custom:oz-upgrades-unsafe-allow constructor
 * constructor() {
 *     _disableInitializers();
 * }
 * ```
 * ====
 */
abstract contract Initializable {
    /**
     * @dev Storage of the initializable contract.
     *
     * It's implemented on a custom ERC-7201 namespace to reduce the risk of storage collisions
     * when using with upgradeable contracts.
     *
     * @custom:storage-location erc7201:openzeppelin.storage.Initializable
     */
    struct InitializableStorage {
        /**
         * @dev Indicates that the contract has been initialized.
         */
        uint64 _initialized;
        /**
         * @dev Indicates that the contract is in the process of being initialized.
         */
        bool _initializing;
    }

    // keccak256(abi.encode(uint256(keccak256("openzeppelin.storage.Initializable")) - 1)) & ~bytes32(uint256(0xff))
    bytes32 private constant INITIALIZABLE_STORAGE = 0xf0c57e16840df040f15088dc2f81fe391c3923bec73e23a9662efc9c229c6a00;

    /**
     * @dev The contract is already initialized.
     */
    error InvalidInitialization();

    /**
     * @dev The contract is not initializing.
     */
    error NotInitializing();

    /**
     * @dev Triggered when the contract has been initialized or reinitialized.
     */
    event Initialized(uint64 version);

    /**
     * @dev A modifier that defines a protected initializer function that can be invoked at most once. In its scope,
     * `onlyInitializing` functions can be used to initialize parent contracts.
     *
     * Similar to `reinitializer(1)`, except that in the context of a constructor an `initializer` may be invoked any
     * number of times. This behavior in the constructor can be useful during testing and is not expected to be used in
     * production.
     *
     * Emits an {Initialized} event.
     */
    modifier initializer() {
        // solhint-disable-next-line var-name-mixedcase
        InitializableStorage storage $ = _getInitializableStorage();

        // Cache values to avoid duplicated sloads
        bool isTopLevelCall = !$._initializing;
        uint64 initialized = $._initialized;

        // Allowed calls:
        // - initialSetup: the contract is not in the initializing state and no previous version was
        //                 initialized
        // - construction: the contract is initialized at version 1 (no reininitialization) and the
        //                 current contract is just being deployed
        bool initialSetup = initialized == 0 && isTopLevelCall;
        bool construction = initialized == 1 && address(this).code.length == 0;

        if (!initialSetup && !construction) {
            revert InvalidInitialization();
        }
        $._initialized = 1;
        if (isTopLevelCall) {
            $._initializing = true;
        }
        _;
        if (isTopLevelCall) {
            $._initializing = false;
            emit Initialized(1);
        }
    }

    /**
     * @dev A modifier that defines a protected reinitializer function that can be invoked at most once, and only if the
     * contract hasn't been initialized to a greater version before. In its scope, `onlyInitializing` functions can be
     * used to initialize parent contracts.
     *
     * A reinitializer may be used after the original initialization step. This is essential to configure modules that
     * are added through upgrades and that require initialization.
     *
     * When `version` is 1, this modifier is similar to `initializer`, except that functions marked with `reinitializer`
     * cannot be nested. If one is invoked in the context of another, execution will revert.
     *
     * Note that versions can jump in increments greater than 1; this implies that if multiple reinitializers coexist in
     * a contract, executing them in the right order is up to the developer or operator.
     *
     * WARNING: Setting the version to 2**64 - 1 will prevent any future reinitialization.
     *
     * Emits an {Initialized} event.
     */
    modifier reinitializer(uint64 version) {
        // solhint-disable-next-line var-name-mixedcase
        InitializableStorage storage $ = _getInitializableStorage();

        if ($._initializing || $._initialized >= version) {
            revert InvalidInitialization();
        }
        $._initialized = version;
        $._initializing = true;
        _;
        $._initializing = false;
        emit Initialized(version);
    }

    /**
     * @dev Modifier to protect an initialization function so that it can only be invoked by functions with the
     * {initializer} and {reinitializer} modifiers, directly or indirectly.
     */
    modifier onlyInitializing() {
        _checkInitializing();
        _;
    }

    /**
     * @dev Reverts if the contract is not in an initializing state. See {onlyInitializing}.
     */
    function _checkInitializing() internal view virtual {
        if (!_isInitializing()) {
            revert NotInitializing();
        }
    }

    /**
     * @dev Locks the contract, preventing any future reinitialization. This cannot be part of an initializer call.
     * Calling this in the constructor of a contract will prevent that contract from being initialized or reinitialized
     * to any version. It is recommended to use this to lock implementation contracts that are designed to be called
     * through proxies.
     *
     * Emits an {Initialized} event the first time it is successfully executed.
     */
    function _disableInitializers() internal virtual {
        // solhint-disable-next-line var-name-mixedcase
        InitializableStorage storage $ = _getInitializableStorage();

        if ($._initializing) {
            revert InvalidInitialization();
        }
        if ($._initialized != type(uint64).max) {
            $._initialized = type(uint64).max;
            emit Initialized(type(uint64).max);
        }
    }

    /**
     * @dev Returns the highest version that has been initialized. See {reinitializer}.
     */
    function _getInitializedVersion() internal view returns (uint64) {
        return _getInitializableStorage()._initialized;
    }

    /**
     * @dev Returns `true` if the contract is currently initializing. See {onlyInitializing}.
     */
    function _isInitializing() internal view returns (bool) {
        return _getInitializableStorage()._initializing;
    }

    /**
     * @dev Returns a pointer to the storage namespace.
     */
    // solhint-disable-next-line var-name-mixedcase
    function _getInitializableStorage() private pure returns (InitializableStorage storage $) {
        assembly {
            $.slot := INITIALIZABLE_STORAGE
        }
    }
}