fix: OZ 2.3.0 audit part 2 (L-03, L-04, N-04, N-09, N-10, N-11)

[dianakocsis]

AI-Generated Description

What

Seven commits addressing the remaining findings from the OpenZeppelin 2.3.0 audit, continuing from #523 (L-01, N-02 through N-07):

Finding	Change	Commit
N-09	Fix stale "Maximum supported command at this moment is 0x3f" comment in Commands.sol — command types are 7 bits (COMMAND_TYPE_MASK), and 0x40–0x5f is the highest assigned range. Also fix duplicated-word typo ("the the" → "the") in MaxInputAmount.sol	5705424
N-11	Call protocolFeeController() on poolManager directly instead of casting through IProtocolFees, removing the now-unused import	91034da
N-10	Make TransientSlots the single source of truth for slot constants — convert library constants to file-level constants so consumers import them directly instead of duplicating the literal and asserting equality in tests	80d69fe
L-03	Map PERMIT2_TRANSFER_FROM and each PERMIT2_TRANSFER_FROM_BATCH detail amount through the resolved-amount register, so a route can pull exactly the amount a prior RESOLVE produced instead of an offchain upper bound. Also wire WRAP_ETH and UNWRAP_WETH_EXACT through ResolvedAmount.map	53ef266
L-04	Document that sub-plans share the resolved-amount register and that a reverted sub-plan undoes its writes	daf65a1
—	Accept the resolved amount in every exact amount the router moves: wire SETTLE, TAKE, and ACROSS_V4_DEPOSIT_V3 through ResolvedAmount.map; expand README and Constants.sol with the full sentinel-aware and sentinel-excluded field lists	131d396
N-04	Note that share-rounding tokens (e.g. stETH delivering 1-2 wei less) revert V2 exact-output swaps, directing integrators to V2_SWAP_EXACT_IN instead	543fcaa

Changes

• contracts/base/Dispatcher.sol: Drop the IProtocolFees import and call poolManager.protocolFeeController() directly (N-11); map PERMIT2_TRANSFER_FROM amount through ResolvedAmount.map and SafeCast160 (L-03); map WRAP_ETH and UNWRAP_WETH_EXACT amounts through ResolvedAmount.map; add sub-plan revert note to _resolve NatSpec (L-04)
• contracts/modules/Permit2Payments.sol: Rewrite permit2TransferFrom(batch) to transfer one detail at a time so each amount passes through ResolvedAmount.map, replacing the single PERMIT2.transferFrom(batchDetails) call (L-03)
• contracts/modules/uniswap/v4/V4SwapRouter.sol: Map SETTLE and TAKE amounts through ResolvedAmount.map by overriding _mapSettleAmount and _mapTakeAmount
• contracts/modules/ChainedActions.sol: Map ACROSS_V4_DEPOSIT_V3 inputAmount through ResolvedAmount.map
• contracts/libraries/TransientSlots.sol: Convert from a library with internal constant members to file-level constant declarations so inline assembly in consumer libraries can reference them directly without duplication (N-10)
• contracts/libraries/Locker.sol, NestedUnlock.sol, ResolvedAmount.sol, MaxInputAmount.sol: Remove duplicated slot constants, import from TransientSlots (N-10)
• contracts/base/RouteSigner.sol: Remove three duplicated slot constants, import from TransientSlots (N-10)
• contracts/libraries/Commands.sol: Update the command-type range comment to reflect the actual 7-bit layout (N-09)
• contracts/libraries/MaxInputAmount.sol: Remove duplicate "the" in the slot documentation comment (N-09)
• contracts/libraries/Constants.sol: Expand the USE_RESOLVED_AMOUNT doc comment to list which amount fields consume the sentinel and which do not (L-03)
• contracts/modules/uniswap/v2/V2SwapRouter.sol: Expand delivery-check comment to mention share-based rounding (N-04)
• README.md: Update RESOLVE section with the full list of sentinel-aware and sentinel-excluded amount fields; document sub-plan register sharing (L-04); add V2_SWAP_EXACT_OUT rounding-token note (N-04)
• test/foundry-tests/Resolve.t.sol: Add ResolvePermit2TransferTest — exercises resolved-amount mapping for PERMIT2_TRANSFER_FROM and PERMIT2_TRANSFER_FROM_BATCH, plus robustness tests (truncated details, overstated length, dirty fields, foreign owner)
• test/foundry-tests/ResolveV4.t.sol: Tests for resolved-amount mapping through SETTLE and TAKE v4 actions
• test/foundry-tests/TransientSlots.t.sol: Remove test_librariesUseTableSlots (redundant now that there is only one copy of each constant); update imports to file-level constants
• test/foundry-tests/Locker.t.sol, MaxInputAmount.t.sol, ResolvedAmount.t.sol: Remove slot-equality assertions that are no longer needed

Bytecode

	Runtime	Free under 24,576
dev-2.3.0 before	24,228	348
This PR	24,121	455
The batch-to-single-detail refactor in Permit2Payments and the IProtocolFees import removal together save bytes despite adding the ResolvedAmount.map and SafeCast160 calls.

Notes

• The PERMIT2_TRANSFER_FROM_BATCH refactor issues one permit2.transferFrom per detail instead of one batch call; Permit2's batch implementation performs the same per-detail transfers, so the onchain behaviour is identical
• The TransientSlots refactor eliminates the class of bug where a consumer's duplicated literal drifts from the table — there is now exactly one definition per slot
• Follows up on fix: OZ 2.3.0 audit fixes (L-01, N-02, N-03, N-04, N-05, N-06, N-07) #523 which addressed L-01, N-02 through N-07
• Includes the OpenZeppelin UR 2.3.0 and v4-periphery diff audit report PDF