@ensuro/core 1.2.7 → 2.0.0-beta1

package/contracts/PolicyPoolComponent.sol

@@ -3,9 +3,9 @@ pragma solidity ^0.8.0;
 
 import {UUPSUpgradeable} from "@openzeppelin/contracts-upgradeable/proxy/utils/UUPSUpgradeable.sol";
 import {IERC20Metadata} from "@openzeppelin/contracts/token/ERC20/extensions/IERC20Metadata.sol";
-import {IPolicyPool} from "../interfaces/IPolicyPool.sol";
-import {IPolicyPoolComponent} from "../interfaces/IPolicyPoolComponent.sol";
-import {IPolicyPoolConfig} from "../interfaces/IPolicyPoolConfig.sol";
+import {IPolicyPool} from "./interfaces/IPolicyPool.sol";
+import {IPolicyPoolComponent} from "./interfaces/IPolicyPoolComponent.sol";
+import {IPolicyPoolConfig} from "./interfaces/IPolicyPoolConfig.sol";
 import {PausableUpgradeable} from "@openzeppelin/contracts-upgradeable/security/PausableUpgradeable.sol";
 import {WadRayMath} from "./WadRayMath.sol";
 
@@ -71,6 +71,11 @@ abstract contract PolicyPoolComponent is
     _;
   }
 
+  modifier onlyComponentRole(bytes32 role) {
+    _policyPool.config().checkComponentRole(address(this), role, msg.sender);
+    _;
+  }
+
   /// @custom:oz-upgrades-unsafe-allow constructor
   constructor(IPolicyPool policyPool_) {
     _policyPool = policyPool_;

package/contracts/PolicyPoolConfig.sol

@@ -4,14 +4,11 @@ pragma solidity ^0.8.0;
 import {AccessControlUpgradeable} from "@openzeppelin/contracts-upgradeable/access/AccessControlUpgradeable.sol";
 import {Initializable} from "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol";
 import {UUPSUpgradeable} from "@openzeppelin/contracts-upgradeable/proxy/utils/UUPSUpgradeable.sol";
-import {IAssetManager} from "../interfaces/IAssetManager.sol";
-import {IInsolvencyHook} from "../interfaces/IInsolvencyHook.sol";
-import {IPolicyPoolConfig} from "../interfaces/IPolicyPoolConfig.sol";
-import {IPolicyPool} from "../interfaces/IPolicyPool.sol";
-import {IRiskModule} from "../interfaces/IRiskModule.sol";
-import {ILPWhitelist} from "../interfaces/ILPWhitelist.sol";
-import {IExchange} from "../interfaces/IExchange.sol";
-import {IPolicyPoolComponent} from "../interfaces/IPolicyPoolComponent.sol";
+import {IPolicyPoolConfig} from "./interfaces/IPolicyPoolConfig.sol";
+import {IPolicyPool} from "./interfaces/IPolicyPool.sol";
+import {IRiskModule} from "./interfaces/IRiskModule.sol";
+import {ILPWhitelist} from "./interfaces/ILPWhitelist.sol";
+import {IPolicyPoolComponent} from "./interfaces/IPolicyPoolComponent.sol";
 import {WadRayMath} from "./WadRayMath.sol";
 
 /**
@@ -37,11 +34,8 @@ contract PolicyPoolConfig is
   uint256 public constant L2_RM_LIMIT = 5e16; // 5% in WAD
 
   address internal _treasury; // address of Ensuro treasury
-  IAssetManager internal _assetManager; // asset manager
-  IInsolvencyHook internal _insolvencyHook; // Contract that handles insolvency situations
   IPolicyPool internal _policyPool;
   ILPWhitelist internal _lpWhitelist; // Contract that handles whitelisting of Liquidity Providers
-  IExchange internal _exchange; // Contract that handles exchange operations between assets
 
   mapping(IRiskModule => RiskModuleStatus) private _riskModules;
 
@@ -100,6 +94,26 @@ contract PolicyPoolConfig is
   // solhint-disable-next-line no-empty-blocks
   function _authorizeUpgrade(address) internal override onlyRole2(GUARDIAN_ROLE, LEVEL1_ROLE) {}
 
+  function getComponentRole(address component, bytes32 role) public pure returns (bytes32) {
+    return bytes32(bytes20(component)) ^ role;
+  }
+
+  function checkComponentRole(
+    address component,
+    bytes32 role,
+    address account
+  ) external view override {
+    _checkRole(getComponentRole(component, role), account);
+  }
+
+  function grantComponentRole(
+    address component,
+    bytes32 role,
+    address account
+  ) external onlyRole(getRoleAdmin(getComponentRole(component, role))) {
+    _grantRole(getComponentRole(component, role), account);
+  }
+
   function checkRole(bytes32 role, address account) external view override {
     _checkRole(role, account);
   }
@@ -112,21 +126,6 @@ contract PolicyPoolConfig is
     if (!hasRole(role1, account)) _checkRole(role2, account);
   }
 
-  function setAssetManager(IAssetManager assetManager_) external onlyRole(LEVEL1_ROLE) {
-    require(
-      address(assetManager_) == address(0) ||
-        IPolicyPoolComponent(address(assetManager_)).policyPool() == _policyPool,
-      "Component not linked to this PolicyPool"
-    );
-    _policyPool.setAssetManager(assetManager_);
-    _assetManager = assetManager_;
-    emit ComponentChanged(GovernanceActions.setAssetManager, address(_assetManager));
-  }
-
-  function assetManager() external view virtual override returns (IAssetManager) {
-    return _assetManager;
-  }
-
   function setTreasury(address treasury_) external onlyRole(LEVEL1_ROLE) {
     _treasury = treasury_;
     emit ComponentChanged(GovernanceActions.setTreasury, _treasury);
@@ -136,23 +135,6 @@ contract PolicyPoolConfig is
     return _treasury;
   }
 
-  function setInsolvencyHook(IInsolvencyHook insolvencyHook_)
-    external
-    onlyRole2(GUARDIAN_ROLE, LEVEL1_ROLE)
-  {
-    require(
-      address(insolvencyHook_) == address(0) ||
-        IPolicyPoolComponent(address(insolvencyHook_)).policyPool() == _policyPool,
-      "Component not linked to this PolicyPool"
-    );
-    _insolvencyHook = insolvencyHook_;
-    emit ComponentChanged(GovernanceActions.setInsolvencyHook, address(_insolvencyHook));
-  }
-
-  function insolvencyHook() external view override returns (IInsolvencyHook) {
-    return _insolvencyHook;
-  }
-
   function setLPWhitelist(ILPWhitelist lpWhitelist_)
     external
     onlyRole2(GUARDIAN_ROLE, LEVEL1_ROLE)
@@ -170,21 +152,7 @@ contract PolicyPoolConfig is
     return _lpWhitelist;
   }
 
-  function setExchange(IExchange exchange_) external onlyRole2(GUARDIAN_ROLE, LEVEL1_ROLE) {
-    require(
-      address(exchange_) == address(0) ||
-        IPolicyPoolComponent(address(exchange_)).policyPool() == _policyPool,
-      "Component not linked to this PolicyPool"
-    );
-    _exchange = exchange_;
-    emit ComponentChanged(GovernanceActions.setExchange, address(_exchange));
-  }
-
-  function exchange() external view override returns (IExchange) {
-    return _exchange;
-  }
-
-  function addRiskModule(IRiskModule riskModule) external onlyRole2(LEVEL1_ROLE, LEVEL2_ROLE) {
+  function addRiskModule(IRiskModule riskModule) external onlyRole(LEVEL1_ROLE) {
     require(
       _riskModules[riskModule] == RiskModuleStatus.inactive,
       "Risk Module already in the pool"
@@ -194,26 +162,20 @@ contract PolicyPoolConfig is
       IPolicyPoolComponent(address(riskModule)).policyPool() == _policyPool,
       "RiskModule not linked to this pool"
     );
-    require(
-      hasRole(LEVEL1_ROLE, msg.sender) ||
-        _policyPool.totalETokenSupply() > (riskModule.scrLimit().wadMul(L2_RM_LIMIT)),
-      "RiskModule SCR Limit exceeds the limit for LEVEL2 user"
-    );
     _riskModules[riskModule] = RiskModuleStatus.active;
     emit RiskModuleStatusChanged(riskModule, RiskModuleStatus.active);
   }
 
   function removeRiskModule(IRiskModule riskModule) external onlyRole(LEVEL2_ROLE) {
     require(_riskModules[riskModule] != RiskModuleStatus.inactive, "Risk Module not found");
-    require(riskModule.totalScr() == 0, "Can't remove a module with active policies");
+    require(riskModule.activeExposure() == 0, "Can't remove a module with active policies");
     delete _riskModules[riskModule];
     emit RiskModuleStatusChanged(riskModule, RiskModuleStatus.inactive);
   }
 
-  // #if_succeeds_disabled _riskModules.get(riskModule) == newStatus;
   function changeRiskModuleStatus(IRiskModule riskModule, RiskModuleStatus newStatus)
     external
-    onlyRole3(GUARDIAN_ROLE, LEVEL1_ROLE, LEVEL2_ROLE)
+    onlyRole2(GUARDIAN_ROLE, LEVEL1_ROLE)
   {
     require(_riskModules[riskModule] != RiskModuleStatus.inactive, "Risk Module not found");
     require(
@@ -221,13 +183,8 @@ contract PolicyPoolConfig is
       "Only GUARDIAN can suspend modules"
     );
     // To activate LEVEL1 required or LEVEL2 if <5% of total liquidity
-    require(
-      newStatus != RiskModuleStatus.active ||
-        hasRole(LEVEL1_ROLE, msg.sender) ||
-        _policyPool.totalETokenSupply() > (riskModule.scrLimit().wadMul(L2_RM_LIMIT)),
-      "RiskModule SCR Limit exceeds the limit for LEVEL2 user"
-    );
-    // Anyone (LEVEL1, LEVEL2, GUARDIAN) can deprecate
+    require(hasRole(LEVEL1_ROLE, msg.sender), "Only LEVEL1 can activate modules");
+    // Anyone (LEVEL1, GUARDIAN) can deprecate
     _riskModules[riskModule] = newStatus;
     emit RiskModuleStatusChanged(riskModule, newStatus);
   }

package/contracts/PremiumsAccount.sol

@@ -0,0 +1,274 @@
+// SPDX-License-Identifier: Apache-2.0
+pragma solidity ^0.8.0;
+
+import {Math} from "@openzeppelin/contracts/utils/math/Math.sol";
+import {IERC20Metadata} from "@openzeppelin/contracts/token/ERC20/extensions/IERC20Metadata.sol";
+import {SafeERC20} from "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";
+import {WadRayMath} from "./WadRayMath.sol";
+import {IPolicyPool} from "./interfaces/IPolicyPool.sol";
+import {IEToken} from "./interfaces/IEToken.sol";
+import {Reserve} from "./Reserve.sol";
+import {IPremiumsAccount} from "./interfaces/IPremiumsAccount.sol";
+import {Policy} from "./Policy.sol";
+import {IEToken} from "./interfaces/IEToken.sol";
+
+/**
+ * @title Ensuro Premiums Account
+ * @dev This contract holds the premiums of a set of risk modules
+ * @custom:security-contact security@ensuro.co
+ * @author Ensuro
+ */
+contract PremiumsAccount is IPremiumsAccount, Reserve {
+  using Policy for Policy.PolicyData;
+  using WadRayMath for uint256;
+  using SafeERC20 for IERC20Metadata;
+
+  bytes32 public constant WITHDRAW_WON_PREMIUMS_ROLE = keccak256("WITHDRAW_WON_PREMIUMS_ROLE");
+
+  /// @custom:oz-upgrades-unsafe-allow state-variable-immutable
+  IEToken internal immutable _juniorEtk;
+  /// @custom:oz-upgrades-unsafe-allow state-variable-immutable
+  IEToken internal immutable _seniorEtk;
+
+  uint256 internal _activePurePremiums; // sum of pure-premiums of active policies - In Wad
+  uint256 internal _borrowedActivePP; // amount borrowed from active pure premiums to pay defaulted policies
+  uint256 internal _wonPurePremiums; // amount of pure premiums won from non-defaulted policies
+
+  /*
+   * Premiums can come in (for free, without liability) with receiveGrant.
+   * And can come out (withdrawed to treasury) with withdrawWonPremiums
+   */
+  event WonPremiumsInOut(bool moneyIn, uint256 value);
+
+  /// @custom:oz-upgrades-unsafe-allow constructor
+  // solhint-disable-next-line no-empty-blocks
+  constructor(
+    IPolicyPool policyPool_,
+    IEToken juniorEtk_,
+    IEToken seniorEtk_
+  ) Reserve(policyPool_) {
+    _juniorEtk = juniorEtk_;
+    _seniorEtk = seniorEtk_;
+  }
+
+  /**
+   * @dev Public initialize Initializes the PremiumsAccount
+   */
+  function initialize() public initializer {
+    __PremiumsAccount_init();
+  }
+
+  /**
+   * @dev Initializes the PremiumsAccount
+   */
+  // solhint-disable-next-line func-name-mixedcase
+  function __PremiumsAccount_init() internal initializer {
+    __PolicyPoolComponent_init();
+    __PremiumsAccount_init_unchained();
+  }
+
+  // solhint-disable-next-line func-name-mixedcase
+  function __PremiumsAccount_init_unchained() internal initializer {
+    /*
+    _activePurePremiums = 0;
+    _borrowedActivePP = 0;
+    _wonPurePremiums = 0;
+    */
+    if (address(_juniorEtk) != address(0))
+      currency().approve(address(_juniorEtk), type(uint256).max);
+    if (address(_seniorEtk) != address(0))
+      currency().approve(address(_seniorEtk), type(uint256).max);
+    _validateParameters();
+  }
+
+  // solhint-disable-next-line no-empty-blocks
+  function _validateParameters() internal view override {}
+
+  function purePremiums() public view returns (uint256) {
+    return _activePurePremiums + _wonPurePremiums - _borrowedActivePP;
+  }
+
+  function activePurePremiums() external view returns (uint256) {
+    return _activePurePremiums;
+  }
+
+  function wonPurePremiums() external view returns (uint256) {
+    return _wonPurePremiums;
+  }
+
+  function borrowedActivePP() external view returns (uint256) {
+    return _borrowedActivePP;
+  }
+
+  function seniorEtk() external view override returns (IEToken) {
+    return _seniorEtk;
+  }
+
+  function juniorEtk() external view override returns (IEToken) {
+    return _juniorEtk;
+  }
+
+  function _payFromPool(uint256 toPay) internal returns (uint256) {
+    // 1. take from won_pure_premiums
+    if (toPay <= _wonPurePremiums) {
+      _wonPurePremiums -= toPay;
+      return 0;
+    }
+    toPay -= _wonPurePremiums;
+    _wonPurePremiums = 0;
+    // 2. borrow from active pure premiums
+    if (_activePurePremiums > _borrowedActivePP) {
+      if (toPay <= (_activePurePremiums - _borrowedActivePP)) {
+        _borrowedActivePP += toPay;
+        return 0;
+      } else {
+        toPay -= _activePurePremiums - _borrowedActivePP;
+        _borrowedActivePP = _activePurePremiums;
+      }
+    }
+    return toPay;
+  }
+
+  function _storePurePremiumWon(uint256 purePremiumWon) internal {
+    // TODO: merge _wonPurePremiums and _borrowedActivePP into single int256 variable
+    // and this will be just `_wonPurePremiums += purePremiumWon;`
+    if (purePremiumWon == 0) return;
+    if (_borrowedActivePP >= purePremiumWon) {
+      _borrowedActivePP -= purePremiumWon;
+    } else {
+      _wonPurePremiums += (purePremiumWon - _borrowedActivePP);
+      _borrowedActivePP = 0;
+    }
+  }
+
+  // TODO: restore repayETokenLoan?
+
+  /**
+   *
+   * Endpoint to receive "free money" and inject that money into the premium pool.
+   *
+   * Can be used for example if the PolicyPool subscribes an excess loss policy with other company.
+   *
+   */
+  function receiveGrant(uint256 amount) external {
+    currency().safeTransferFrom(msg.sender, address(this), amount);
+    _storePurePremiumWon(amount);
+    emit WonPremiumsInOut(true, amount);
+  }
+
+  /**
+   *
+   * Withdraws excess premiums to PolicyPool's treasury.
+   * This might be needed in some cases for example if we are deprecating the protocol or the excess premiums
+   * are needed to compensate something. Shouldn't be used. Can be disabled revoking role WITHDRAW_WON_PREMIUMS_ROLE
+   *
+   * returns The amount withdrawed
+   *
+   * Requirements:
+   *
+   * - onlyPoolRole(WITHDRAW_WON_PREMIUMS_ROLE)
+   * - _wonPurePremiums > 0
+   */
+  function withdrawWonPremiums(uint256 amount)
+    external
+    onlyPoolRole(WITHDRAW_WON_PREMIUMS_ROLE)
+    returns (uint256)
+  {
+    if (amount > _wonPurePremiums) amount = _wonPurePremiums;
+    require(amount > 0, "No premiums to withdraw");
+    _wonPurePremiums -= amount;
+    _transferTo(_policyPool.config().treasury(), amount); // TODO: discuss if destination shoud be msg.sender
+    // TODO: see if this will be a component role
+    emit WonPremiumsInOut(false, amount);
+    return amount;
+  }
+
+  function policyCreated(Policy.PolicyData memory policy) external override onlyPolicyPool {
+    _activePurePremiums += policy.purePremium;
+    if (policy.jrScr > 0) _juniorEtk.lockScr(policy.jrScr, policy.jrInterestRate());
+    if (policy.srScr > 0) _seniorEtk.lockScr(policy.srScr, policy.srInterestRate());
+  }
+
+  function policyResolvedWithPayout(
+    address policyHolder,
+    Policy.PolicyData memory policy,
+    uint256 payout
+  ) external override onlyPolicyPool {
+    _activePurePremiums -= policy.purePremium;
+    if (policy.purePremium >= payout) {
+      uint256 purePremiumWon = policy.purePremium - payout;
+      if (address(_seniorEtk) != address(0))
+        purePremiumWon = _repayLoan(purePremiumWon, _seniorEtk);
+      if (address(_juniorEtk) != address(0))
+        purePremiumWon = _repayLoan(purePremiumWon, _juniorEtk);
+      _storePurePremiumWon(purePremiumWon);
+      _unlockScr(policy);
+      _transferTo(policyHolder, payout);
+    } else {
+      uint256 borrowFromScr = _payFromPool(payout - policy.purePremium);
+      _unlockScr(policy);
+      if (borrowFromScr > 0) {
+        uint256 left;
+        if (policy.jrScr > 0) {
+          // Consume Junior Pool until exhausted
+          left = _juniorEtk.internalLoan(borrowFromScr, policyHolder, false);
+        } else {
+          left = borrowFromScr;
+        }
+        if (left > NEGLIGIBLE_AMOUNT) {
+          // Consume Senior Pool only up to SCR
+          left = _seniorEtk.internalLoan(left, policyHolder, true);
+          require(left <= NEGLIGIBLE_AMOUNT, "Don't know where to take the rest of the money");
+        }
+      }
+      _transferTo(policyHolder, payout - borrowFromScr);
+    }
+  }
+
+  function _unlockScr(Policy.PolicyData memory policy) internal {
+    if (policy.jrScr > 0) {
+      _juniorEtk.unlockScr(
+        policy.jrScr,
+        policy.jrInterestRate(),
+        int256(policy.jrCoc) - int256(policy.jrAccruedInterest())
+      );
+    }
+    if (policy.srScr > 0) {
+      _seniorEtk.unlockScr(
+        policy.srScr,
+        policy.srInterestRate(),
+        int256(policy.srCoc) - int256(policy.srAccruedInterest())
+      );
+    }
+  }
+
+  function _repayLoan(uint256 purePremiumWon, IEToken etk) internal returns (uint256) {
+    if (purePremiumWon < NEGLIGIBLE_AMOUNT) return purePremiumWon;
+    uint256 borrowedFromEtk = etk.getLoan(address(this));
+    if (borrowedFromEtk == 0) return purePremiumWon;
+    uint256 repayAmount = borrowedFromEtk > purePremiumWon ? purePremiumWon : borrowedFromEtk;
+    // TODO: make sure the balance is available or deinvest
+    etk.repayLoan(repayAmount, address(this));
+    return purePremiumWon - repayAmount;
+  }
+
+  function policyExpired(Policy.PolicyData memory policy) external override onlyPolicyPool {
+    uint256 aux;
+    uint256 purePremiumWon = policy.purePremium;
+    _activePurePremiums -= purePremiumWon;
+
+    // If negative _activePurePremiums, repay this first (shouldn't happen)
+    if (_borrowedActivePP > _activePurePremiums) {
+      aux = Math.min(_borrowedActivePP - _activePurePremiums, purePremiumWon);
+      _borrowedActivePP -= aux;
+      purePremiumWon -= aux;
+    }
+
+    if (address(_seniorEtk) != address(0)) purePremiumWon = _repayLoan(purePremiumWon, _seniorEtk);
+    if (address(_juniorEtk) != address(0)) purePremiumWon = _repayLoan(purePremiumWon, _juniorEtk);
+
+    // Finally store purePremiumWon
+    _storePurePremiumWon(purePremiumWon);
+    _unlockScr(policy);
+  }
+}

package/contracts/Reserve.sol

@@ -0,0 +1,34 @@
+// SPDX-License-Identifier: Apache-2.0
+pragma solidity ^0.8.0;
+
+import {SafeERC20} from "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";
+import {IERC20Metadata} from "@openzeppelin/contracts/token/ERC20/extensions/IERC20Metadata.sol";
+import {IPolicyPool} from "./interfaces/IPolicyPool.sol";
+import {PolicyPoolComponent} from "./PolicyPoolComponent.sol";
+
+/**
+ * @title Base contract for Ensuro cash reserves
+ * @dev This contract implements the methods related with management of the reserves and payments
+ * @custom:security-contact security@ensuro.co
+ * @author Ensuro
+ */
+abstract contract Reserve is PolicyPoolComponent {
+  using SafeERC20 for IERC20Metadata;
+
+  /// @custom:oz-upgrades-unsafe-allow state-variable-immutable
+  // solhint-disable-next-line var-name-mixedcase
+  uint256 public immutable NEGLIGIBLE_AMOUNT; // init as 10**(decimals/2) == 0.001 USD
+
+  /// @custom:oz-upgrades-unsafe-allow constructor
+  constructor(IPolicyPool policyPool_) PolicyPoolComponent(policyPool_) {
+    NEGLIGIBLE_AMOUNT = 10**(policyPool_.currency().decimals() / 2);
+  }
+
+  function _transferTo(address destination, uint256 amount) internal {
+    if (amount == 0) return;
+    uint256 balance = currency().balanceOf(address(this));
+    if (balance < amount && (amount - balance) < NEGLIGIBLE_AMOUNT) amount = balance;
+    // TODO: asset management
+    currency().safeTransfer(destination, amount);
+  }
+}