@ensuro/core 1.2.7 → 2.0.0-beta10

package/contracts/PolicyPool.sol

@@ -4,231 +4,410 @@ pragma solidity ^0.8.0;
 import {IERC20Metadata} from "@openzeppelin/contracts/token/ERC20/extensions/IERC20Metadata.sol";
 import {AddressUpgradeable} from "@openzeppelin/contracts-upgradeable/utils/AddressUpgradeable.sol";
 import {UUPSUpgradeable} from "@openzeppelin/contracts-upgradeable/proxy/utils/UUPSUpgradeable.sol";
+import {ERC721Upgradeable} from "@openzeppelin/contracts-upgradeable/token/ERC721/ERC721Upgradeable.sol";
 import {SafeERC20} from "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";
-import {IPolicyPoolConfig} from "../interfaces/IPolicyPoolConfig.sol";
+import {IAccessManager} from "./interfaces/IAccessManager.sol";
 import {PausableUpgradeable} from "@openzeppelin/contracts-upgradeable/security/PausableUpgradeable.sol";
-import {EnumerableSet} from "@openzeppelin/contracts/utils/structs/EnumerableSet.sol";
-import {IPolicyPool} from "../interfaces/IPolicyPool.sol";
-import {IRiskModule} from "../interfaces/IRiskModule.sol";
-import {IInsolvencyHook} from "../interfaces/IInsolvencyHook.sol";
-import {IPolicyPoolComponent} from "../interfaces/IPolicyPoolComponent.sol";
-import {IEToken} from "../interfaces/IEToken.sol";
-import {IPolicyNFT} from "../interfaces/IPolicyNFT.sol";
-import {IPolicyHolder} from "../interfaces/IPolicyHolder.sol";
-import {IAssetManager} from "../interfaces/IAssetManager.sol";
+import {IPremiumsAccount} from "./interfaces/IPremiumsAccount.sol";
+import {IPolicyPool} from "./interfaces/IPolicyPool.sol";
+import {IRiskModule} from "./interfaces/IRiskModule.sol";
+import {IPolicyPoolComponent} from "./interfaces/IPolicyPoolComponent.sol";
+import {IEToken} from "./interfaces/IEToken.sol";
+import {IPolicyHolder} from "./interfaces/IPolicyHolder.sol";
 import {Policy} from "./Policy.sol";
-import {WadRayMath} from "./WadRayMath.sol";
-import {Math} from "@openzeppelin/contracts/utils/math/Math.sol";
-import {DataTypes} from "./DataTypes.sol";
+import {WadRayMath} from "./dependencies/WadRayMath.sol";
 
 /**
  * @title Ensuro PolicyPool contract
  * @dev This is the main contract of the protocol, it stores the eTokens (liquidity pools) and has the operations
- *      to interact with them. This is also the contract that receives and sends the underlying asset.
+ *      to interact with them. This is also the contract that receives and sends the underlying asset (currency).
  *      Also this contract keeps track of accumulated premiums in different stages:
  *      - activePurePremiums
  *      - wonPurePremiums (surplus)
  *      - borrowedActivePP (deficit borrowed from activePurePremiums)
+ *      This contract also implements the ERC721 standard, because it mints and NFT for each policy created. The
+ *      property of the NFT represents the one that will receive the payout.
  * @custom:security-contact security@ensuro.co
  * @author Ensuro
  */
-// #invariant_disabled {:msg "Borrow up to activePurePremiums"} _borrowedActivePP <= _activePurePremiums;
-// #invariant_disabled {:msg "Can't borrow if not exhausted before won"} (_borrowedActivePP > 0) ==> _wonPurePremiums == 0;
-contract PolicyPool is IPolicyPool, PausableUpgradeable, UUPSUpgradeable {
-  using EnumerableSet for EnumerableSet.AddressSet;
+contract PolicyPool is IPolicyPool, PausableUpgradeable, UUPSUpgradeable, ERC721Upgradeable {
   using WadRayMath for uint256;
   using Policy for Policy.PolicyData;
-  using DataTypes for DataTypes.ETokenToWadMap;
-  using DataTypes for DataTypes.ETokenStatusMap;
   using SafeERC20 for IERC20Metadata;
 
-  /// @custom:oz-upgrades-unsafe-allow state-variable-immutable
-  // solhint-disable-next-line var-name-mixedcase
-  uint256 public immutable NEGLIGIBLE_AMOUNT; // init as 10**(decimals-3) == 0.001 USD
-
-  bytes32 public constant WITHDRAW_WON_PREMIUMS_ROLE = keccak256("WITHDRAW_WON_PREMIUMS_ROLE");
-
   bytes32 public constant GUARDIAN_ROLE = keccak256("GUARDIAN_ROLE");
   bytes32 public constant LEVEL1_ROLE = keccak256("LEVEL1_ROLE");
   bytes32 public constant LEVEL2_ROLE = keccak256("LEVEL2_ROLE");
   bytes32 public constant LEVEL3_ROLE = keccak256("LEVEL3_ROLE");
 
-  uint256 public constant MAX_ETOKENS = 10;
-
+  /**
+   * @dev {AccessManager} that handles the access permissions for the PolicyPool and its components.
+   */
   /// @custom:oz-upgrades-unsafe-allow state-variable-immutable
-  IPolicyPoolConfig internal immutable _config;
+  IAccessManager internal immutable _access;
+
+  /**
+   * @dev {ERC20} token used in PolicyPool as currency. Usually it will be a stablecoin such as USDC.
+   */
   /// @custom:oz-upgrades-unsafe-allow state-variable-immutable
   IERC20Metadata internal immutable _currency;
-  /// @custom:oz-upgrades-unsafe-allow state-variable-immutable
-  IPolicyNFT internal immutable _policyNFT;
 
-  DataTypes.ETokenStatusMap internal _eTokens;
+  /**
+   * @dev Address of Ensuro's treasury that receives the protocol fees.
+   */
+  address internal _treasury; // address of Ensuro treasury
 
-  mapping(uint256 => bytes32) internal _policies;
-  mapping(uint256 => DataTypes.ETokenToWadMap) internal _policiesFunds;
+  /**
+   * @dev This enum tracks the different status that a component ({PremiumsAccount}, {EToken} or {RiskModule} can have.
+   */
+  enum ComponentStatus {
+    /**
+     * @dev inactive status = 0 means the component doesn't exists - All operations rejected
+     */
+    inactive,
+    /**
+     * @dev active means the component is fully functional, all the component operations are allowed.
+     *      deposit / withdraw for eTokens
+     *      newPolicy / resolvePolicy for riskModules
+     *      policyCreated / policyExpired / policyResolvedWithPayout for premiumsAccount
+     */
+    active,
+    /**
+     * @dev deprecated means the component is in process of being deactivated. Only some operations are allowed:
+     *      withdraw for eTokens
+     *      resolvePolicy / expirePolicy for riskModules
+     *      policyExpired / policyResolvedWithPayout for premiumsAccount
+     */
+    deprecated,
+    /**
+     * @dev suspended means the component is temporarily deactivated. All the operations are rejected. Only GUARDIAN
+     *      can suspend.
+     */
+    suspended
+  }
 
-  uint256 internal _activePurePremiums; // sum of pure-premiums of active policies - In Wad
-  uint256 internal _borrowedActivePP; // amount borrowed from active pure premiums to pay defaulted policies
-  uint256 internal _wonPurePremiums; // amount of pure premiums won from non-defaulted policies
+  /**
+   * @dev Enum of the different kind of top level components that can be plugged into the pool. Each one corresponds
+   * with the {EToken}, {RiskModule} and {PremiumsAccount} respectively.
+   */
+  enum ComponentKind {
+    unknown,
+    eToken,
+    riskModule,
+    premiumsAccount
+  }
+
+  /**
+   * @dev Struct to keep the state and type of the components installed. The `kind` never changes. The `status`
+   * initially is `active` and can be changes with {PolicyPool-changeComponentStatus} and {PolicyPool-removeComponent}.
+   */
+  struct Component {
+    ComponentStatus status;
+    ComponentKind kind;
+  }
+
+  /**
+   * @dev Mapping of installed components (see {EToken}, {RiskModule}, {PremiumsAccount}) in the PolicyPool.
+   */
+  mapping(IPolicyPoolComponent => Component) private _components;
+
+  /**
+   * @dev Mapping that stores the active policies (the policyId is the key). It just saves the hash of the policies,
+   * the full {Policy-PolicyData} struct has to be sent for each operation (hash is used to verify).
+   */
+  mapping(uint256 => bytes32) internal _policies;
 
+  /**
+   * @dev Event emitted every time a new policy is added to the pool. Contains all the data about the policy that is
+   * later required for doing operations with the policy like resolution or expiration.
+   *
+   * @param riskModule The risk module that created the policy
+   * @param policy The {Policy-PolicyData} struct with all the immutable fields of the policy.
+   */
   event NewPolicy(IRiskModule indexed riskModule, Policy.PolicyData policy);
-  event PolicyRebalanced(IRiskModule indexed riskModule, uint256 indexed policyId);
-  event PolicyResolved(IRiskModule indexed riskModule, uint256 indexed policyId, uint256 payout);
 
-  event ETokenStatusChanged(IEToken indexed eToken, DataTypes.ETokenStatus newStatus);
+  /**
+   * @dev Event emitted every time a policy is removed from the pool. If the policy expired, the `payout` is 0,
+   * otherwise is the amount transferred to the policyholder.
+   *
+   * @param riskModule The risk module where that created the policy initially.
+   * @param policyId The unique id of the policy
+   * @param payout The payout that has been paid to the policy holder. 0 when the policy expired.
+   */
+  event PolicyResolved(IRiskModule indexed riskModule, uint256 indexed policyId, uint256 payout);
 
-  /*
-   * Premiums can come in (for free, without liability) with receiveGrant.
-   * And can come out (withdrawed to treasury) with withdrawWonPremiums
+  /**
+   * @dev Event emitted when the treasury changes
+   *
+   * @param action The type of governance action (just setTreasury in this contract for now)
+   * @param value  The address of the new treasury
    */
-  event WonPremiumsInOut(bool moneyIn, uint256 value);
+  event ComponentChanged(IAccessManager.GovernanceActions indexed action, address value);
 
-  modifier onlyAssetManager() {
-    require(
-      msg.sender == address(_config.assetManager()),
-      "Only assetManager can call this function"
-    );
-    _;
-  }
+  /**
+   * @dev Event emitted when a new component added/removed to the pool or the status changes.
+   *
+   * @param component The address of the component, it can be an {EToken}, {RiskModule} or {PremiumsAccount}
+   * @param kind Value indicating the kind of component. See {ComponentKind}
+   * @param newStatus The status of the component after the operation. See {ComponentStatus}
+   */
+  event ComponentStatusChanged(
+    IPolicyPoolComponent indexed component,
+    ComponentKind kind,
+    ComponentStatus newStatus
+  );
 
+  /**
+   * @dev Modifier that checks the caller has a given role
+   */
   modifier onlyRole(bytes32 role) {
-    _config.checkRole(role, msg.sender);
+    _access.checkRole(role, _msgSender());
     _;
   }
 
+  /**
+   * @dev Modifier that checks the caller has any of the given rolea
+   */
   modifier onlyRole2(bytes32 role1, bytes32 role2) {
-    _config.checkRole2(role1, role2, msg.sender);
+    _access.checkRole2(role1, role2, _msgSender());
     _;
   }
 
+  /**
+   * @dev Instantiates a Policy Pool. Sets immutable fields.
+   *
+   * @param access_ The address of the {AccessManager} that manages the access permissions for the pool governance
+   * operations.
+   * @param currency_ The {ERC20} token that's used as a currency in the protocol. Usually a stablecoin such as USDC.
+   */
   /// @custom:oz-upgrades-unsafe-allow constructor
-  constructor(
-    IPolicyPoolConfig config_,
-    IPolicyNFT policyNFT_,
-    IERC20Metadata currency_
-  ) {
-    _config = config_;
-    _policyNFT = policyNFT_;
+  constructor(IAccessManager access_, IERC20Metadata currency_) {
+    _access = access_;
     _currency = currency_;
-    NEGLIGIBLE_AMOUNT = 10**(currency_.decimals() - 3);
   }
 
-  function initialize() public initializer {
+  /**
+   * @dev Initializes a Policy Pool
+   *
+   * @param name_ The name of the ERC721 token.
+   * @param symbol_ The symbol of the ERC721 token.
+   * @param treasury_ The address of the treasury that will receive the protocol fees.
+   */
+  function initialize(
+    string memory name_,
+    string memory symbol_,
+    address treasury_
+  ) public initializer {
     __UUPSUpgradeable_init();
+    __ERC721_init(name_, symbol_);
     __Pausable_init();
-    __PolicyPool_init_unchained();
+    __PolicyPool_init_unchained(treasury_);
   }
 
   // solhint-disable-next-line func-name-mixedcase
-  function __PolicyPool_init_unchained() internal initializer {
-    _config.connect();
-    require(
-      _config.assetManager() == IAssetManager(address(0)),
-      "AssetManager can't be set before PolicyPool initialization"
-    );
-    _policyNFT.connect();
-    /*
-    _activePurePremiums = 0;
-    _borrowedActivePP = 0;
-    _wonPurePremiums = 0;
-    */
+  function __PolicyPool_init_unchained(address treasury_) internal initializer {
+    _treasury = treasury_;
   }
 
   // solhint-disable-next-line no-empty-blocks
   function _authorizeUpgrade(address) internal override onlyRole2(GUARDIAN_ROLE, LEVEL1_ROLE) {}
 
+  /**
+   * @dev Pauses the contract. When the contract is paused, several operations are rejected: deposits, withdrawals, new
+   * policies, policy resolution and expiration, nft transfers.
+   *
+   * Requirements:
+   * - Must be executed by a user with the {GUARDIAN_ROLE}.
+   */
   function pause() public onlyRole(GUARDIAN_ROLE) {
     _pause();
   }
 
+  /**
+   * @dev Unpauses the contract. All the operations disabled when the contract was paused are re-enabled.
+   *
+   * Requirements:
+   * - Must be called by a user with either the {GUARDIAN_ROLE} or a {LEVEL1_ROLE}.
+   */
   function unpause() public onlyRole2(GUARDIAN_ROLE, LEVEL1_ROLE) {
     _unpause();
   }
 
-  function config() external view virtual override returns (IPolicyPoolConfig) {
-    return _config;
+  function access() external view virtual override returns (IAccessManager) {
+    return _access;
   }
 
   function currency() external view virtual override returns (IERC20Metadata) {
     return _currency;
   }
 
-  function policyNFT() external view virtual override returns (address) {
-    return address(_policyNFT);
-  }
-
-  function purePremiums() public view returns (uint256) {
-    return _activePurePremiums + _wonPurePremiums - _borrowedActivePP;
+  /**
+   * @dev Changes the address of the treasury, the one that receives the protocol fees.
+   *
+   * Requirements:
+   * - Must be called by a user with the {LEVEL1_ROLE}.
+   *
+   * Events:
+   * - Emits {ComponentChanged} with action = setTreasury and the address of the new treasury.
+   */
+  function setTreasury(address treasury_) external onlyRole(LEVEL1_ROLE) {
+    _treasury = treasury_;
+    emit ComponentChanged(IAccessManager.GovernanceActions.setTreasury, _treasury);
   }
 
-  function activePurePremiums() external view returns (uint256) {
-    return _activePurePremiums;
+  /**
+   * @dev Returns the address of the treasury, the one that receives the protocol fees.
+   */
+  function treasury() external view override returns (address) {
+    return _treasury;
   }
 
-  function wonPurePremiums() external view returns (uint256) {
-    return _wonPurePremiums;
+  /**
+   * @dev Adds a new component (either an {EToken}, {RiskModule} or {PremiumsAccount}) to the protocol. The component
+   * status will be `active`.
+   *
+   * Requirements:
+   * - Must be called by a user with the {LEVEL1_ROLE}
+   * - The component wasn't added before.
+   *
+   * Events:
+   * - Emits {ComponentStatusChanged} with status active.
+   *
+   * @param component The address of component contract. Must be an {EToken}, {RiskModule} or {PremiumsAccount} linked
+   * to this specific {PolicyPool} and matching the `kind` specified in the next paramter.
+   * @param kind The type of component to be added.
+   */
+  function addComponent(IPolicyPoolComponent component, ComponentKind kind)
+    external
+    onlyRole(LEVEL1_ROLE)
+  {
+    Component storage comp = _components[component];
+    require(comp.status == ComponentStatus.inactive, "Component already in the pool");
+    require(component.policyPool() == this, "Component not linked to this pool");
+
+    comp.status = ComponentStatus.active;
+    comp.kind = kind;
+    if (kind == ComponentKind.premiumsAccount) {
+      IPremiumsAccount pa = IPremiumsAccount(address(component));
+      IEToken etk = pa.juniorEtk();
+      if (address(etk) != address(0)) {
+        etk.addBorrower(address(pa));
+      }
+      etk = pa.seniorEtk();
+      if (address(etk) != address(0)) {
+        etk.addBorrower(address(pa));
+      }
+    }
+    emit ComponentStatusChanged(component, kind, ComponentStatus.active);
   }
 
-  function borrowedActivePP() external view returns (uint256) {
-    return _borrowedActivePP;
+  /**
+   * @dev Removes a component from the protocol. The component needs to be in `deprecated` status before doing this
+   * operation.
+   *
+   * Requirements:
+   * - Must be called by a user with the {LEVEL1_ROLE}
+   * - The component status is `deprecated`.
+   *
+   * Events:
+   * - Emits {ComponentStatusChanged} with status inactive.
+   *
+   * @param component The address of component contract. Must be a component added before.
+   */
+  function removeComponent(IPolicyPoolComponent component) external onlyRole(LEVEL1_ROLE) {
+    Component storage comp = _components[component];
+    require(comp.status == ComponentStatus.deprecated, "Component not deprecated");
+    if (comp.kind == ComponentKind.eToken) {
+      require(
+        IEToken(address(component)).totalSupply() == 0,
+        "EToken has liquidity, can't be removed"
+      );
+    } else if (comp.kind == ComponentKind.riskModule) {
+      require(
+        IRiskModule(address(component)).activeExposure() == 0,
+        "Can't remove a module with active policies"
+      );
+    } else if (comp.kind == ComponentKind.premiumsAccount) {
+      IPremiumsAccount pa = IPremiumsAccount(address(component));
+      require(pa.purePremiums() == 0, "Can't remove a PremiumsAccount with premiums");
+      IEToken etk = pa.juniorEtk();
+      if (address(etk) != address(0)) {
+        etk.removeBorrower(address(pa));
+      }
+      etk = pa.seniorEtk();
+      if (address(etk) != address(0)) {
+        etk.removeBorrower(address(pa));
+      }
+    }
+    emit ComponentStatusChanged(component, comp.kind, ComponentStatus.inactive);
+    delete _components[component];
   }
 
-  // #if_succeeds_disabled {:msg "eToken added as active"} _eTokens.get(eToken) == DataTypes.ETokenStatus.active;
-  function addEToken(IEToken eToken) external onlyRole(LEVEL1_ROLE) {
-    require(_eTokens.length() < MAX_ETOKENS, "Maximum number of ETokens reached");
-    require(!_eTokens.contains(eToken), "eToken already in the pool");
-    require(address(eToken) != address(0), "eToken can't be zero");
+  /**
+   * @dev Changes the status of a component.
+   *
+   * Requirements:
+   * - Must be called by a user with the {LEVEL1_ROLE} if the new status is `active` or `deprecated`.
+   * - Must be called by a user with the {GUARDIAN_ROLE} if the new status is `suspended`.
+   *
+   * Events:
+   * - Emits {ComponentStatusChanged} with the new status.
+   *
+   * @param component The address of component contract. Must be a component added before.
+   * @param newStatus The new status, must be either `active`, `deprecated` or `suspended`.
+   */
+  function changeComponentStatus(IPolicyPoolComponent component, ComponentStatus newStatus)
+    external
+    onlyRole2(GUARDIAN_ROLE, LEVEL1_ROLE)
+  {
+    Component storage comp = _components[component];
+    require(comp.status != ComponentStatus.inactive, "Component not found");
     require(
-      IPolicyPoolComponent(address(eToken)).policyPool() == this,
-      "EToken not linked to this pool"
+      (newStatus == ComponentStatus.active && _access.hasRole(LEVEL1_ROLE, _msgSender())) ||
+        (newStatus == ComponentStatus.suspended && _access.hasRole(GUARDIAN_ROLE, _msgSender())) ||
+        (newStatus == ComponentStatus.deprecated && _access.hasRole(LEVEL1_ROLE, _msgSender())),
+      "Only GUARDIAN can suspend / Only LEVEL1 can activate/deprecate"
     );
-
-    _eTokens.set(eToken, DataTypes.ETokenStatus.active);
-    emit ETokenStatusChanged(eToken, DataTypes.ETokenStatus.active);
+    comp.status = newStatus;
+    emit ComponentStatusChanged(component, comp.kind, newStatus);
   }
 
-  function removeEToken(IEToken eToken) external onlyRole(LEVEL3_ROLE) {
-    require(_eTokens.get(eToken) == DataTypes.ETokenStatus.deprecated, "EToken not deprecated");
-    require(eToken.totalSupply() == 0, "EToken has liquidity, can't be removed");
-    emit ETokenStatusChanged(eToken, DataTypes.ETokenStatus.inactive);
-  }
-
-  function changeETokenStatus(IEToken eToken, DataTypes.ETokenStatus newStatus)
+  /**
+   * @dev Returns the status of a component.
+   *
+   * @param component The address of the component
+   * @return The status of the component. See {ComponentStatus}
+   */
+  function getComponentStatus(IPolicyPoolComponent component)
     external
-    onlyRole2(GUARDIAN_ROLE, LEVEL1_ROLE)
+    view
+    returns (ComponentStatus)
   {
-    require(_eTokens.contains(eToken), "Risk Module not found");
-    require(
-      newStatus != DataTypes.ETokenStatus.suspended || _config.hasRole(GUARDIAN_ROLE, msg.sender),
-      "Only GUARDIAN can suspend eTokens"
-    );
-    _eTokens.set(eToken, newStatus);
-    emit ETokenStatusChanged(eToken, newStatus);
+    return _components[component].status;
   }
 
-  function getETokenStatus(IEToken eToken) external view returns (DataTypes.ETokenStatus) {
-    return _eTokens.get(eToken);
+  function _etkStatus(IEToken eToken) internal view returns (ComponentStatus) {
+    Component storage comp = _components[IPolicyPoolComponent(address(eToken))];
+    require(comp.kind == ComponentKind.eToken, "Component is not an eToken");
+    return comp.status;
   }
 
-  function setAssetManager(IAssetManager newAssetManager) external override {
-    require(msg.sender == address(_config), "Only the PolicyPoolConfig can change assetManager");
-    if (address(_config.assetManager()) != address(0)) {
-      _config.assetManager().deinvestAll(); // deInvest all assets
-      _currency.approve(address(_config.assetManager()), 0); // revoke currency management approval
-    }
-    if (address(newAssetManager) != address(0)) {
-      _currency.approve(address(newAssetManager), type(uint256).max);
-    }
+  function _rmStatus(IRiskModule riskModule) internal view returns (ComponentStatus) {
+    Component storage comp = _components[IPolicyPoolComponent(address(riskModule))];
+    require(comp.kind == ComponentKind.riskModule, "Component is not a RiskModule");
+    return comp.status;
+  }
+
+  function _paStatus(IPremiumsAccount premiumsAccount) internal view returns (ComponentStatus) {
+    Component storage comp = _components[IPolicyPoolComponent(address(premiumsAccount))];
+    require(comp.kind == ComponentKind.premiumsAccount, "Component is not a PremiumsAccount");
+    return comp.status;
   }
 
-  /// #if_succeeds
-  ///    {:msg "must take balance from sender"}
-  ///    _currency.balanceOf(msg.sender) == old(_currency.balanceOf(msg.sender) - amount);
   function deposit(IEToken eToken, uint256 amount) external override whenNotPaused {
-    (bool found, DataTypes.ETokenStatus etkStatus) = _eTokens.tryGet(eToken);
-    require(found && etkStatus == DataTypes.ETokenStatus.active, "eToken is not active");
-    _currency.safeTransferFrom(msg.sender, address(this), amount);
-    eToken.deposit(msg.sender, amount);
+    require(_etkStatus(eToken) == ComponentStatus.active, "eToken is not active");
+    _currency.safeTransferFrom(_msgSender(), address(eToken), amount);
+    eToken.deposit(_msgSender(), amount);
   }
 
   function withdraw(IEToken eToken, uint256 amount)
@@ -237,173 +416,49 @@ contract PolicyPool is IPolicyPool, PausableUpgradeable, UUPSUpgradeable {
     whenNotPaused
     returns (uint256)
   {
-    (bool found, DataTypes.ETokenStatus etkStatus) = _eTokens.tryGet(eToken);
+    ComponentStatus etkStatus = _etkStatus(eToken);
     require(
-      found &&
-        (
-          (etkStatus == DataTypes.ETokenStatus.active ||
-            etkStatus == DataTypes.ETokenStatus.deprecated)
-        ),
+      etkStatus == ComponentStatus.active || etkStatus == ComponentStatus.deprecated,
       "eToken not found or withdraws not allowed"
     );
-    address provider = msg.sender;
-    uint256 withdrawed = eToken.withdraw(provider, amount);
-    if (withdrawed > 0) _transferTo(provider, withdrawed);
-    return withdrawed;
+    address provider = _msgSender();
+    return eToken.withdraw(provider, amount);
   }
 
   function newPolicy(
     Policy.PolicyData memory policy,
-    address customer,
+    address payer,
+    address policyHolder,
     uint96 internalId
   ) external override whenNotPaused returns (uint256) {
     IRiskModule rm = policy.riskModule;
-    require(address(rm) == msg.sender, "Only the RM can create new policies");
-    _config.checkAcceptsNewPolicy(rm);
+    require(address(rm) == _msgSender(), "Only the RM can create new policies");
+    require(_rmStatus(rm) == ComponentStatus.active, "RM module not found or not active");
     policy.id = (uint256(uint160(address(rm))) << 96) + internalId;
     _policies[policy.id] = policy.hash();
-    _activePurePremiums += policy.purePremium;
-    _lockScr(policy);
-    _policyNFT.safeMint(customer, policy.id);
-    _currency.safeTransferFrom(customer, address(this), policy.purePremium + policy.premiumForLps);
-    _currency.safeTransferFrom(customer, _config.treasury(), policy.premiumForEnsuro);
-    if (policy.premiumForRm > 0 && customer != rm.wallet())
-      _currency.safeTransferFrom(customer, rm.wallet(), policy.premiumForRm);
+    IPremiumsAccount pa = rm.premiumsAccount();
+    require(_paStatus(pa) == ComponentStatus.active, "PremiumsAccount not found or not active");
+    pa.policyCreated(policy);
+    _safeMint(policyHolder, policy.id, "");
+
+    // Distribute the premium
+    _currency.safeTransferFrom(payer, address(pa), policy.purePremium);
+    if (policy.srCoc > 0) _currency.safeTransferFrom(payer, address(pa.seniorEtk()), policy.srCoc);
+    if (policy.jrCoc > 0) _currency.safeTransferFrom(payer, address(pa.juniorEtk()), policy.jrCoc);
+    _currency.safeTransferFrom(payer, _treasury, policy.ensuroCommission);
+    if (policy.partnerCommission > 0 && payer != rm.wallet())
+      _currency.safeTransferFrom(payer, rm.wallet(), policy.partnerCommission);
+    // TODO: this code does up to 5 ERC20 transfers. How we can avoid this? Delayed transfers?
+
     emit NewPolicy(rm, policy);
     return policy.id;
   }
 
-  function _lockScr(Policy.PolicyData memory policy) internal {
-    uint256 ocean = 0;
-    DataTypes.ETokenToWadMap storage policyFunds = _policiesFunds[policy.id];
-
-    // Initially I iterate over all eTokens and accumulate ocean of eligible ones
-    // saves the ocean in policyFunds, later will _distributeScr
-    for (uint256 i = 0; i < _eTokens.length(); i++) {
-      (IEToken etk, DataTypes.ETokenStatus etkStatus) = _eTokens.at(i);
-      if (etkStatus != DataTypes.ETokenStatus.active) continue;
-      if (!etk.accepts(address(policy.riskModule), policy.expiration)) continue;
-      uint256 etkOcean = etk.oceanForNewScr();
-      if (etkOcean == 0) continue;
-      ocean += etkOcean;
-      policyFunds.set(etk, etkOcean);
-    }
-    _distributeScr(policy.scr, policy.interestRate(), ocean, policyFunds);
-  }
-
-  /**
-   * @dev Distributes SCR amount in policyFunds according to ocean per token
-   * @param scr  SCR to distribute
-   * @param ocean  Total ocean available in the ETokens for this SCR
-   * @param policyFunds  Input: loaded with ocean available for this SCR (sum=ocean)
-                         Ouput: loaded with locked SRC (sum=scr)
-   */
-  function _distributeScr(
-    uint256 scr,
-    uint256 interestRate,
-    uint256 ocean,
-    DataTypes.ETokenToWadMap storage policyFunds
-  ) internal {
-    require(ocean >= scr, "Not enought ocean to cover the policy");
-    uint256 scrNotLocked = scr;
-
-    for (uint256 i = 0; i < policyFunds.length(); i++) {
-      uint256 etkScr;
-      (IEToken etk, uint256 etkOcean) = policyFunds.at(i);
-      if (i < policyFunds.length() - 1) etkScr = scr.wadMul(etkOcean).wadDiv(ocean);
-      else etkScr = scrNotLocked;
-      etk.lockScr(interestRate, etkScr);
-      policyFunds.set(etk, etkScr);
-      scrNotLocked -= etkScr;
-    }
-  }
-
-  function _balance() internal view returns (uint256) {
-    return _currency.balanceOf(address(this));
-  }
-
-  function _transferTo(address destination, uint256 amount) internal {
-    if (amount == 0) return;
-    if (_config.assetManager() != IAssetManager(address(0)) && _balance() < amount) {
-      _config.assetManager().refillWallet(amount);
-    }
-    // Calculate again the balance and check if enought, if not call unsolvency_hook
-    if (_config.insolvencyHook() != IInsolvencyHook(address(0)) && _balance() < amount) {
-      _config.insolvencyHook().outOfCash(amount - _balance());
-    }
-    _currency.safeTransfer(destination, amount);
-  }
-
-  function _payFromPool(uint256 toPay) internal returns (uint256) {
-    // 1. take from won_pure_premiums
-    if (toPay <= _wonPurePremiums) {
-      _wonPurePremiums -= toPay;
-      return 0;
-    }
-    if (_wonPurePremiums > 0) {
-      toPay -= _wonPurePremiums;
-      _wonPurePremiums = 0;
-    }
-    // 2. borrow from active pure premiums
-    if (_activePurePremiums > _borrowedActivePP) {
-      if (toPay <= (_activePurePremiums - _borrowedActivePP)) {
-        _borrowedActivePP += toPay;
-        return 0;
-      } else {
-        toPay -= _activePurePremiums - _borrowedActivePP;
-        _borrowedActivePP = _activePurePremiums;
-      }
-    }
-    return toPay;
-  }
-
-  function _storePurePremiumWon(uint256 purePremiumWon) internal {
-    if (purePremiumWon == 0) return;
-    if (_borrowedActivePP >= purePremiumWon) {
-      _borrowedActivePP -= purePremiumWon;
-    } else {
-      if (_borrowedActivePP > 0) {
-        purePremiumWon -= _borrowedActivePP;
-        _borrowedActivePP = 0;
-      }
-      _wonPurePremiums += purePremiumWon;
-    }
-  }
-
-  function _processResolution(
-    Policy.PolicyData memory policy,
-    bool customerWon,
-    uint256 payout
-  ) internal returns (uint256, uint256) {
-    uint256 borrowFromScr; // = 0
-    uint256 purePremiumWon; // = 0
-    uint256 aux;
-
-    if (customerWon) {
-      _transferTo(_policyNFT.ownerOf(policy.id), payout);
-      if (policy.purePremium > payout) {
-        purePremiumWon = policy.purePremium - payout;
-      } else {
-        borrowFromScr = _payFromPool(payout - policy.purePremium);
-      }
-    } else {
-      // Pay RM and Ensuro
-      purePremiumWon = policy.purePremium;
-      // cover first _borrowedActivePP
-      if (_borrowedActivePP > _activePurePremiums) {
-        aux = Math.min(_borrowedActivePP - _activePurePremiums, purePremiumWon);
-        _borrowedActivePP -= aux;
-        purePremiumWon -= aux;
-      }
-    }
-    return (borrowFromScr, purePremiumWon);
-  }
-
   function _validatePolicy(Policy.PolicyData memory policy) internal view {
     require(policy.id != 0 && policy.hash() == _policies[policy.id], "Policy not found");
   }
 
-  function expirePolicy(Policy.PolicyData calldata policy) external whenNotPaused {
+  function expirePolicy(Policy.PolicyData calldata policy) external override whenNotPaused {
     require(policy.expiration <= block.timestamp, "Policy not expired yet");
     return _resolvePolicy(policy, 0, true);
   }
@@ -424,6 +479,21 @@ contract PolicyPool is IPolicyPool, PausableUpgradeable, UUPSUpgradeable {
     return _resolvePolicy(policy, customerWon ? policy.payout : 0, false);
   }
 
+  function isActive(uint256 policyId) external view override returns (bool) {
+    return _policies[policyId] != bytes32(0);
+  }
+
+  /**
+   * @dev Internal function that handles the different alternative resolutions for a policy, with or without payout and
+   * expiration.
+   *
+   * Events:
+   * - Emits {PolicyResolved} with the payout
+   *
+   * @param policy A policy created with {Policy-initialize}
+   * @param payout The amount to paid to the policyholder
+   * @param expired True for expiration resolution (`payout` must be 0)
+   */
   function _resolvePolicy(
     Policy.PolicyData memory policy,
     uint256 payout,
@@ -431,40 +501,34 @@ contract PolicyPool is IPolicyPool, PausableUpgradeable, UUPSUpgradeable {
   ) internal {
     _validatePolicy(policy);
     IRiskModule rm = policy.riskModule;
-    require(expired || address(rm) == msg.sender, "Only the RM can resolve policies");
+    require(expired || address(rm) == _msgSender(), "Only the RM can resolve policies");
     require(payout == 0 || policy.expiration > block.timestamp, "Can't pay expired policy");
-    _config.checkAcceptsResolvePolicy(rm);
+    ComponentStatus compStatus = _rmStatus(rm);
+    require(
+      compStatus == ComponentStatus.active || compStatus == ComponentStatus.deprecated,
+      "Module must be active or deprecated to process resolutions"
+    );
     require(payout <= policy.payout, "payout > policy.payout");
 
     bool customerWon = payout > 0;
 
-    _activePurePremiums -= policy.purePremium;
-
-    (uint256 borrowFromScr, uint256 purePremiumWon) = _processResolution(
-      policy,
-      customerWon,
-      payout
+    IPremiumsAccount pa = rm.premiumsAccount();
+    compStatus = _paStatus(pa);
+    require(
+      compStatus == ComponentStatus.active || compStatus == ComponentStatus.deprecated,
+      "PremiumsAccount must be active or deprecated to process resolutions"
     );
-
     if (customerWon) {
-      uint256 borrowFromScrLeft;
-      borrowFromScrLeft = _updatePolicyFundsCustWon(policy, borrowFromScr);
-      if (borrowFromScrLeft > NEGLIGIBLE_AMOUNT)
-        borrowFromScrLeft = _takeLoanFromAnyEtk(borrowFromScrLeft);
-      require(
-        borrowFromScrLeft <= NEGLIGIBLE_AMOUNT,
-        "Don't know where to take the rest of the money"
-      );
+      address policyOwner = ownerOf(policy.id);
+      pa.policyResolvedWithPayout(policyOwner, policy, payout);
     } else {
-      purePremiumWon = _updatePolicyFundsCustLost(policy, purePremiumWon);
+      pa.policyExpired(policy);
     }
 
-    _storePurePremiumWon(purePremiumWon); // it's possible in some cases purePremiumWon > 0 && customerWon
-    rm.releaseScr(policy.scr);
+    rm.releaseExposure(policy.payout);
 
     emit PolicyResolved(policy.riskModule, policy.id, payout);
     delete _policies[policy.id];
-    delete _policiesFunds[policy.id];
     if (payout > 0) {
       _notifyPayout(policy.id, payout);
     } else {
@@ -472,8 +536,12 @@ contract PolicyPool is IPolicyPool, PausableUpgradeable, UUPSUpgradeable {
     }
   }
 
+  /**
+   * @dev Notifies the payout with a callback if the policyholder is a contract. Only reverts if the policyholder
+   * contract explicitly reverts. Doesn't reverts is the callback is not implemented.
+   */
   function _notifyPayout(uint256 policyId, uint256 payout) internal {
-    address customer = _policyNFT.ownerOf(policyId);
+    address customer = ownerOf(policyId);
     if (!AddressUpgradeable.isContract(customer)) return;
     try
       IPolicyHolder(customer).onPayoutReceived(_msgSender(), address(this), policyId, payout)
@@ -494,8 +562,11 @@ contract PolicyPool is IPolicyPool, PausableUpgradeable, UUPSUpgradeable {
     }
   }
 
+  /**
+   * @dev Notifies the expiration with a callback if the policyholder is a contract. Never reverts.
+   */
   function _notifyExpiration(uint256 policyId) internal {
-    address customer = _policyNFT.ownerOf(policyId);
+    address customer = ownerOf(policyId);
     if (!AddressUpgradeable.isContract(customer)) return;
     try IPolicyHolder(customer).onPolicyExpired(_msgSender(), address(this), policyId) returns (
       bytes4
@@ -506,217 +577,11 @@ contract PolicyPool is IPolicyPool, PausableUpgradeable, UUPSUpgradeable {
     }
   }
 
-  function _interestAdjustment(Policy.PolicyData memory policy)
-    internal
-    view
-    returns (bool, uint256)
-  {
-    // Calculate interest accrual adjustment
-    uint256 aux = policy.accruedInterest();
-    if (policy.premiumForLps >= aux) return (true, policy.premiumForLps - aux);
-    else return (false, aux - policy.premiumForLps);
-  }
-
-  function _updatePolicyFundsCustWon(Policy.PolicyData memory policy, uint256 borrowFromScr)
-    internal
-    returns (uint256)
-  {
-    uint256 borrowFromScrLeft = 0;
-    uint256 interestRate = policy.interestRate();
-    (bool positive, uint256 adjustment) = _interestAdjustment(policy);
-
-    // Iterate policyFunds - unlockScr / adjust / take loan
-    DataTypes.ETokenToWadMap storage policyFunds = _policiesFunds[policy.id];
-    for (uint256 i = 0; i < policyFunds.length(); i++) {
-      (IEToken etk, uint256 etkScr) = policyFunds.at(i);
-      etk.unlockScr(interestRate, etkScr);
-      etkScr = etkScr.wadDiv(policy.scr);
-      // etkScr now represents the share of SCR that's covered by this etk (variable reuse)
-      etk.discreteEarning(adjustment.wadMul(etkScr), positive);
-      if (borrowFromScr > 0) {
-        uint256 aux;
-        aux = borrowFromScr.wadMul(etkScr);
-        borrowFromScrLeft += aux - etk.lendToPool(aux, true);
-      }
-    }
-    return borrowFromScrLeft;
-  }
-
-  // Almost duplicated code from _updatePolicyFundsCustWon but separated to avoid stack depth error
-  function _updatePolicyFundsCustLost(Policy.PolicyData memory policy, uint256 purePremiumWon)
-    internal
-    returns (uint256)
-  {
-    uint256 interestRate = policy.interestRate();
-    (bool positive, uint256 adjustment) = _interestAdjustment(policy);
-
-    // Iterate policyFunds - unlockScr / adjust / repay loan
-    DataTypes.ETokenToWadMap storage policyFunds = _policiesFunds[policy.id];
-    for (uint256 i = 0; i < policyFunds.length(); i++) {
-      (IEToken etk, uint256 etkScr) = policyFunds.at(i);
-      etk.unlockScr(interestRate, etkScr);
-      etkScr = etkScr.wadDiv(policy.scr);
-      // etkScr now represents the share of SCR that's covered by this etk (variable reuse)
-      etk.discreteEarning(adjustment.wadMul(etkScr), positive);
-      if (purePremiumWon > 0 && etk.getPoolLoan() > 0) {
-        uint256 aux;
-        // if debt with token, repay from purePremium
-        aux = policy.purePremium.wadMul(etkScr);
-        aux = Math.min(purePremiumWon, Math.min(etk.getPoolLoan(), aux));
-        etk.repayPoolLoan(aux);
-        purePremiumWon -= aux;
-      }
-    }
-    return purePremiumWon;
-  }
-
-  /*
-   * Called when the payout to be taken from policyFunds wasn't enought.
-   * Then I take loan from the others tokens
-   */
-  function _takeLoanFromAnyEtk(uint256 loanLeft) internal returns (uint256) {
-    for (uint256 i = 0; i < _eTokens.length(); i++) {
-      (IEToken etk, DataTypes.ETokenStatus etkStatus) = _eTokens.at(i);
-      if (etkStatus != DataTypes.ETokenStatus.active) continue;
-      loanLeft -= etk.lendToPool(loanLeft, false);
-      if (loanLeft <= NEGLIGIBLE_AMOUNT) break;
-    }
-    return loanLeft;
-  }
-
-  /**
-   *
-   * Repays a loan taken with the eToken with the money in the premium pool.
-   * The repayment should happen without calling this method when customer losses and eToken is one of the
-   * policyFunds. But sometimes we need to take loans from tokens not linked to the policy.
-   *
-   * returns The amount repaid
-   *
-   * Requirements:
-   *
-   * - `eToken` must be `active` or `deprecated`
-   */
-  function repayETokenLoan(IEToken eToken) external whenNotPaused returns (uint256) {
-    (bool found, DataTypes.ETokenStatus etkStatus) = _eTokens.tryGet(eToken);
-    require(
-      found &&
-        (etkStatus == DataTypes.ETokenStatus.active ||
-          etkStatus == DataTypes.ETokenStatus.deprecated),
-      "eToken is not active"
-    );
-    uint256 poolLoan = eToken.getPoolLoan();
-    uint256 toPayLater = _payFromPool(poolLoan);
-    eToken.repayPoolLoan(poolLoan - toPayLater);
-    return poolLoan - toPayLater;
-  }
-
-  /**
-   *
-   * Endpoint to receive "free money" and inject that money into the premium pool.
-   *
-   * Can be used for example if the PolicyPool subscribes an excess loss policy with other company.
-   *
-   */
-  function receiveGrant(uint256 amount) external override {
-    _currency.safeTransferFrom(msg.sender, address(this), amount);
-    _storePurePremiumWon(amount);
-    emit WonPremiumsInOut(true, amount);
-  }
-
-  /**
-   *
-   * Withdraws excess premiums to PolicyPool's treasury.
-   * This might be needed in some cases for example if we are deprecating the protocol or the excess premiums
-   * are needed to compensate something. Shouldn't be used. Can be disabled revoking role WITHDRAW_WON_PREMIUMS_ROLE
-   *
-   * returns The amount withdrawed
-   *
-   * Requirements:
-   *
-   * - onlyRole(WITHDRAW_WON_PREMIUMS_ROLE)
-   * - _wonPurePremiums > 0
-   */
-  function withdrawWonPremiums(uint256 amount)
-    external
-    onlyRole(WITHDRAW_WON_PREMIUMS_ROLE)
-    returns (uint256)
-  {
-    if (amount > _wonPurePremiums) amount = _wonPurePremiums;
-    require(amount > 0, "No premiums to withdraw");
-    _wonPurePremiums -= amount;
-    _transferTo(_config.treasury(), amount);
-    emit WonPremiumsInOut(false, amount);
-    return amount;
-  }
-
-  function getInvestable() external view override returns (uint256) {
-    uint256 borrowedFromEtk = 0;
-    for (uint256 i = 0; i < _eTokens.length(); i++) {
-      (
-        IEToken etk, /* DataTypes.ETokenStatus etkStatus */
-
-      ) = _eTokens.at(i);
-      // TODO: define if not active are investable or not
-      borrowedFromEtk += etk.getPoolLoan();
-    }
-    uint256 premiums = purePremiums();
-    if (premiums > borrowedFromEtk) return premiums - borrowedFromEtk;
-    else return 0;
-  }
-
-  function totalETokenSupply() public view override returns (uint256) {
-    uint256 ret = 0;
-    for (uint256 i = 0; i < _eTokens.length(); i++) {
-      (
-        IEToken etk, /* DataTypes.ETokenStatus etkStatus */
-
-      ) = _eTokens.at(i);
-      // TODO: define if not active are investable or not
-      ret += etk.totalSupply();
-    }
-    return ret;
-  }
-
-  function assetEarnings(uint256 amount, bool positive)
-    external
-    override
-    onlyAssetManager
-    whenNotPaused
-  {
-    if (positive) {
-      // earnings
-      _storePurePremiumWon(amount);
-    } else {
-      // losses
-      _payFromPool(amount); // return value should be 0 if not, losses are more than capital available
-    }
-  }
-
-  function getPolicyFundCount(uint256 policyId) external view returns (uint256) {
-    return _policiesFunds[policyId].length();
-  }
-
-  function getPolicyFundAt(uint256 policyId, uint256 index)
-    external
-    view
-    returns (IEToken, uint256)
-  {
-    return _policiesFunds[policyId].at(index);
-  }
-
-  function getPolicyFund(uint256 policyId, IEToken etoken) external view returns (uint256) {
-    (bool success, uint256 amount) = _policiesFunds[policyId].tryGet(etoken);
-    if (success) return amount;
-    else return 0;
-  }
-
-  function getETokenCount() external view override returns (uint256) {
-    return _eTokens.length();
-  }
-
-  function getETokenAt(uint256 index) external view override returns (IEToken) {
-    (IEToken etk, DataTypes.ETokenStatus etkStatus) = _eTokens.at(index);
-    if (etkStatus != DataTypes.ETokenStatus.inactive) return etk;
-    else return IEToken(address(0));
+  function _beforeTokenTransfer(
+    address from,
+    address to,
+    uint256 tokenId
+  ) internal override whenNotPaused {
+    super._beforeTokenTransfer(from, to, tokenId);
   }
 }