LatticeRegistry

DELIBERATELY NOT A DIAMOND. This is a minimal, standalone, NON-upgradeable plain contract: plain storage (no ERC-7201 — there is no upgrade path by design), no facets, no proxy. It is the single thing every deployment depends on, so it carries the smallest possible trust surface and is meant to be deployed once per chain (via CreateX at a fixed salt → same address everywhere). Only the curated namespace is admin-governed; Tier A and all reads are trustless. Original Lattice work.

keccak256("") — the runtime codehash of an existing-but-codeless account (e.g. a funded EOA). Together with 0 (a non-existent account) these are the two "no code" states _requireCode rejects, so only real contract bytecode is ever attested / registered (invariant I4).

Gas forwarded to every exportSelectors() call (finding R-2). A compiled pure exporter returns a constant blob: every release facet's export runs in at most 2,233 gas (AccessManager; measured over the whole release inventory), so this leaves over 40x headroom while bounding what a looping or gas-burning exporter can take from the caller (a register transaction, a getCut read, or every factory deploy resolving it).

Largest exportSelectors() return the registry copies (finding R-2): 8,192 bytes, room for 2,032 selectors in the canonical encoding (64-byte head + data). The largest release export is 224 bytes (Governor, 36 selectors), and EIP-170 caps a facet at 24,576 bytes of code with every routed selector costing a dispatcher several bytes, so no real facet comes close. The cap stops a return-data bomb from taxing every live read: a larger return is never copied at all.

The ERC-8153 exportSelectors() self-selector (0x0ef22643). A conformant facet MUST exclude it from its own export (it is never cut into a diamond); register rejects any blob that self-includes it, matching BaseDeploy's cut-path strip and the parity gate.

Tier A: runtime codehash → first attested address (first-write-wins, immutable once set).

Tier B: keccak256(abi.encode(nameHash, version)) → immutable curated record.

Tier B: name → the version flagged as latest. 0 (0.0.0) is the reserved "unset" sentinel.

Restricts a call to the current curated-namespace owner.

Self-verifying: reads deployed.codehash on-chain; reverts LatticeRegistry__EmptyCode for an EOA / empty account. Re-attesting an already-mapped codehash is a documented silent no-op — the mapping is immutable once set, so the first attester wins and no event re-fires.

A code-identity lookup only: it never says which selectors an address exports, and two addresses with one codehash are interchangeable only under the Tier A assumptions in the interface NatSpec.

Reverts LatticeRegistry__RecordExists if the record already exists (I1), LatticeRegistry__InvalidVersion for version 0, LatticeRegistry__EmptyCode for a codeless facet, and LatticeRegistry__NotERC8153 if IERC8153(facet).exportSelectors() fails the ERC-8153 contract. Pins keccak256(selectors), mirrors the codehash into Tier A, and emits Registered.

The target record must exist (LatticeRegistry__RecordNotFound otherwise). Moving the pointer to an OLDER version is allowed — it is only a convenience pointer, never the pinned record (I3).

Reverts LatticeRegistry__RecordNotFound if unregistered.

Reverts LatticeRegistry__LatestUnset if setLatest was never called for nameHash.

Reverts on the first key that get (or latest, for version 0) would revert on. Records are read from storage only; use getSelectors / getCut for live-verified selectors.

Reverts LatticeRegistry__LatestUnset on the first name whose pointer was never set.

Reverts LatticeRegistry__RecordNotFound if unregistered, LatticeRegistry__CodeDrift if facet.codehash no longer equals the pinned codehash, and LatticeRegistry__SelectorDrift if keccak256(exportSelectors()) no longer equals the pinned selectorsHash. A facet that reverts, runs out of its gas budget, returns oversized or malformed data, or lost its code is caught by the code/selector pins with one of those two errors, so the call never returns a stale cut. Then unpacks the blob to bytes4[].

Same code + selector drift verification as getSelectors; the returned cut uses FacetCutAction.Add.

For callers interacting DIRECTLY with the contract (Etherscan, etc.) so they need not pre-hash a name off-chain. The registry hashes the RAW string and applies NO prefix, so the string overloads below and the bytes32 overloads are interchangeable when passed the same full canonical name. By CONVENTION Lattice facets are registered under "lattice.<FacetName>" (e.g. "lattice.ERC20").

Reverts LatticeRegistry__NotPendingOwner when no handover is pending (pendingOwner == 0, which is also the state a cancelled handover leaves), so the owner can never become address(0).

Shared body of both register overloads: append-only write of a curated (nameHash, version) record after pulling + validating + pinning the facet's ERC-8153 selectors and codehash.

Shared body of both setLatest overloads: point latest(nameHash) at an existing version.

The registry key for a canonical facet name — the RAW keccak256(bytes(name)), no prefix. The "lattice.<Name>" convention lives in tooling/docs, not here, so the registry stays name-agnostic.

Shared body of both get overloads.

Shared body of both latest overloads.

Shared body of both getCut overloads: live-verify then assemble an Add cut.

Require target to carry real contract code and return its codehash (invariant I4).

First-write-wins insert into the Tier-A resolver; a duplicate codehash is a silent no-op so that register auto-attest and any prior permissionless attest compose without reverting.

Read IERC8153(facet).exportSelectors() through _exportedBlob and enforce the ERC-8153 contract at registration: the blob must be non-empty, 4-aligned, duplicate-free, and must not self-include exportSelectors(). Reverts LatticeRegistry__NotERC8153 on any violation, including every call or decoding failure _exportedBlob reports as an empty blob. Returns the packed blob (to be pinned).

Load a record and re-verify BOTH pins against the facet's current on-chain state: its codehash (defends against a metamorphic address swap) and the live keccak256(exportSelectors()). Reverts LatticeRegistry__RecordNotFound if unregistered, LatticeRegistry__CodeDrift if the code changed, and LatticeRegistry__SelectorDrift if the live selector blob no longer matches the pin.

Bounded read of exportSelectors() (findings R-1 and R-2). Staticcalls facet with at most EXPORT_GAS gas, copies nothing until the return size is known, and refuses a return shorter than an ABI bytes encoding (64 bytes) or longer than MAX_EXPORT_SIZE. The encoding is then decoded by hand with exactly the acceptance rule of abi.decode(ret, (bytes)): the offset word must leave room for the length word, and the declared length must fit in the bytes that follow it (no padding is required, trailing bytes are ignored). Returns the decoded blob, or EMPTY bytes on any failure, so no hostile return can make the caller revert with empty data or a Panic.

Unpack a tightly packed selector blob (length % 4 == 0, validated by the caller) to bytes4[].

Deterministic record key for a (nameHash, version) pair.