feat(SpokePoolPeriphery): Support multiple exchanges

[nicholaspai]

Currently we can only initialize the periphery contract with a single exchange to swap with. This PR allows us to initialize it with multiple exchanges to swap with. Like before, these initial set of exchanges and function selectors cannot be changed post-initialization, which gives the user assurances.

This also adds a method whitelistExchanges which can update the whitelisted exchange list. This means that the contract is now Ownable and both initialize and whitelistExchanges are marked onlyOwner. This means that users need to trust the owner of the contract now, and the worst thing that the owner can do is whitelist a malicious exchange. The caller of the swapX functions would still need to knowingly sign off on routerCalldata that would target this malicious exchange, so the user still retains control

I don't think we're going to make the contract Ownable and let the owner update the whitelisted exchange list post-deployment, but if we want to we can revert this commit. The reasoning is to give better assurances to the user about the contract's expected behavior.

This PR removes the whitelist of exchanges that can be called by the SpokePoolPeriphery, which was useful for protecting the caller from approve-ing the SpokePoolPeriphery contract and leaving an approval that could be stolen by another user who could direct the SpokePoolPeriphery to transferFrom the user who left their approval hanging. The reasoning for removing the whitelist is so that multiple exchanges can be used by the caller. In order to keep protecting the user from this "approval abuse", we add a new "Proxy" contract that should be used by the caller to call functions like SpokePoolPeriphery.swapAndBridge that require approvals. Now the user only approves the proxy contract which can only be used to call SpokePoolPeriphery.swapAndBridge rather than execute any arbitrary calldata.

[nicholaspai]

I just added some forge unit tests for:

• swapAndBridge
• initialize
• deposit

[mrice32]

Just one comment

[bmzig]

This is a really good improvement. Another thing I was wondering was if we could not pass in a struct to _swapAndDeposit but IIRC that causes a stack too deep error.

[nicholaspai]

_swapAndDeposit

Does this function exist anymore?

[dohaki]

Not directly related to this specific diff, but is there a reason why you can not specify an explicit outputToken here?

[bmzig]

This is a copy/paste of the spoke pool verifier deposit function, so we just assume that this is only being used with the native token,

[dohaki]

In SpokePoolV3Periphery this is payable. Should this one be as well?

[bmzig]

This is not payable since the proxy is only used for ERC20 approval based flows. If we swap and bridge with ETH, it is more gas-efficient to call the periphery directly, so we force that the user does that.