@ensuro/core 2.0.0-beta8 → 2.0.0-beta9

package/contracts/PremiumsAccount.sol

@@ -4,10 +4,12 @@ pragma solidity ^0.8.0;
 import {Math} from "@openzeppelin/contracts/utils/math/Math.sol";
 import {IERC20Metadata} from "@openzeppelin/contracts/token/ERC20/extensions/IERC20Metadata.sol";
 import {SafeERC20} from "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";
-import {WadRayMath} from "./WadRayMath.sol";
+import {SafeCast} from "@openzeppelin/contracts/utils/math/SafeCast.sol";
+import {WadRayMath} from "./dependencies/WadRayMath.sol";
 import {IPolicyPool} from "./interfaces/IPolicyPool.sol";
 import {IEToken} from "./interfaces/IEToken.sol";
 import {Reserve} from "./Reserve.sol";
+import {IAccessManager} from "./interfaces/IAccessManager.sol";
 import {IPremiumsAccount} from "./interfaces/IPremiumsAccount.sol";
 import {Policy} from "./Policy.sol";
 import {IEToken} from "./interfaces/IEToken.sol";
@@ -15,7 +17,14 @@ import {IAssetManager} from "./interfaces/IAssetManager.sol";
 
 /**
  * @title Ensuro Premiums Account
- * @dev This contract holds the premiums of a set of risk modules
+ * @dev This contract holds the pure premiums of a set of risk modules. The pure premiums is the part of the premium
+ * that is expected to cover the losses. The contract keeps track of the pure premiums of the active policies
+ * (_activePurePremiums) and the surplus or deficit generated by the finalized policies (pure premiums collected -
+ * losses).
+ *
+ * Collaborates with a junior {EToken} and a senior {EToken} that act as lenders when the premiums aren't enought to
+ * cover the losses.
+ *
  * @custom:security-contact security@ensuro.co
  * @author Ensuro
  */
@@ -23,15 +32,35 @@ contract PremiumsAccount is IPremiumsAccount, Reserve {
   using Policy for Policy.PolicyData;
   using WadRayMath for uint256;
   using SafeERC20 for IERC20Metadata;
+  using SafeCast for uint256;
 
   bytes32 public constant WITHDRAW_WON_PREMIUMS_ROLE = keccak256("WITHDRAW_WON_PREMIUMS_ROLE");
 
+  /**
+   * @dev The Junior eToken is the first {EToken} to which the PremiumsAccount will go for credit when it runs out of
+   * money. Optional (address(0)).
+   */
   /// @custom:oz-upgrades-unsafe-allow state-variable-immutable
   IEToken internal immutable _juniorEtk;
+
+  /**
+   * @dev The Senior eToken is the second {EToken} to which the PremiumsAccount will go for credit, after trying before
+   * with the junior eToken, when it runs out of money. Optional (address(0)).
+   */
   /// @custom:oz-upgrades-unsafe-allow state-variable-immutable
   IEToken internal immutable _seniorEtk;
 
+  /**
+   * @dev The active pure premiums field keeps track of the pure premiums collected by the active policies of risk
+   * modules linked with this PremiumsAccount.
+   */
   uint256 internal _activePurePremiums; // sum of pure-premiums of active policies - In Wad
+
+  /**
+   * @dev The surplus field keeps track of the surplus or deficit (when negative) of the actual payouts made by the
+   * PremiumsAccount versus the collected pure premiums. On the negative side, it has a limit defined by `_maxDeficit()`,
+   * after that limit, internal loans are taken from the eTokens.
+   */
   int256 internal _surplus;
 
   struct PackedParams {
@@ -41,14 +70,22 @@ contract PremiumsAccount is IPremiumsAccount, Reserve {
 
   PackedParams internal _params;
 
-  /*
-   * Premiums can come in (for free, without liability) with receiveGrant.
+  /**
+   * Premiums can come in (for "free", without liability) with receiveGrant.
    * And can come out (withdrawed to treasury) with withdrawWonPremiums
+   *
+   * @param moneyIn Indicates if money came in or out (false).
+   * @param value The amount of money received or given
    */
   event WonPremiumsInOut(bool moneyIn, uint256 value);
 
+  /**
+   * @dev Constructor of the contract, sets the immutable fields.
+   *
+   * @param juniorEtk_ Address of the Junior EToken (first loss lender). `address(0)` if not present.
+   * @param seniorEtk_ Address of the Senior EToken (2nd loss lender). `address(0)` if not present.
+   */
   /// @custom:oz-upgrades-unsafe-allow constructor
-  // solhint-disable-next-line no-empty-blocks
   constructor(
     IPolicyPool policyPool_,
     IEToken juniorEtk_,
@@ -59,14 +96,14 @@ contract PremiumsAccount is IPremiumsAccount, Reserve {
   }
 
   /**
-   * @dev Public initialize Initializes the PremiumsAccount
+   * @dev Initializes the PremiumsAccount
    */
   function initialize() public initializer {
     __PremiumsAccount_init();
   }
 
   /**
-   * @dev Initializes the PremiumsAccount
+   * @dev Initializes the PremiumsAccount (to be called by subclasses)
    */
   // solhint-disable-next-line func-name-mixedcase
   function __PremiumsAccount_init() internal initializer {
@@ -74,6 +111,10 @@ contract PremiumsAccount is IPremiumsAccount, Reserve {
     __PremiumsAccount_init_unchained();
   }
 
+  /**
+   * @dev In the initialization, besides settings the parameters, we approve the spending of funds by the eTokens
+   * so we don't need to do it on every repayment operation
+   */
   // solhint-disable-next-line func-name-mixedcase
   function __PremiumsAccount_init_unchained() internal initializer {
     /*
@@ -96,6 +137,14 @@ contract PremiumsAccount is IPremiumsAccount, Reserve {
     _params.assetManager = newAM;
   }
 
+  /**
+   * @dev This is called by the {Reserve} base class to record the earnings generated by the asset management.
+   *
+   * @param earningsOrLosses Indicates the amount earned since last time earnings where recorded.
+   * - If positive, repays the lons and accumulates the rest in the surplus.
+   * - If negative (losses) substracts it from surplus. It never can exceed _maxDeficit and doesn't takes
+   *   loans to cover asset losses.
+   */
   function _assetEarnings(int256 earningsOrLosses) internal override {
     if (earningsOrLosses > 0) {
       uint256 earnings = uint256(earningsOrLosses);
@@ -103,11 +152,10 @@ contract PremiumsAccount is IPremiumsAccount, Reserve {
       if (address(_juniorEtk) != address(0)) earnings = _repayLoan(earnings, _juniorEtk);
       _storePurePremiumWon(earnings);
     } else {
-      _payFromPremiums(uint256(-earningsOrLosses));
+      require(_payFromPremiums(uint256(-earningsOrLosses)) == 0, "Losses can't exceed maxDeficit");
     }
   }
 
-  // solhint-disable-next-line no-empty-blocks
   function _validateParameters() internal view override {
     require(
       _params.deficitRatio <= 1e4 && _params.deficitRatio >= 0,
@@ -119,18 +167,35 @@ contract PremiumsAccount is IPremiumsAccount, Reserve {
     return uint256(int256(_activePurePremiums) + _surplus);
   }
 
+  /**
+   * @dev Returns the total amount of pure premiums that were collected by the active policies of the risk modules
+   * linked to this PremiumsAccount.
+   */
   function activePurePremiums() external view returns (uint256) {
     return _activePurePremiums;
   }
 
+  /**
+   * @dev Returns the surplus between pure premiums collected and payouts of finalized policies. Returns 0 if no surplus
+   * or deficit.
+   */
   function wonPurePremiums() external view returns (uint256) {
     return _surplus >= 0 ? uint256(_surplus) : 0;
   }
 
+  /**
+   * @dev Returns the amount of active pure premiums that was used to cover payouts of finalized policies (in excess of
+   * collected pure premiums). This is limited by `_maxDeficit()`
+   */
   function borrowedActivePP() external view returns (uint256) {
     return _surplus >= 0 ? 0 : uint256(-_surplus);
   }
 
+  /**
+   * @dev Returns the surplus between pure premiums collected and payouts of finalized policies. Losses where more than
+   * premiums collected, returns a negative number that indicates the amount of the active pure premiums that was used
+   * to cover finalized premiums.
+   */
   function surplus() external view returns (int256) {
     return _surplus;
   }
@@ -143,14 +208,38 @@ contract PremiumsAccount is IPremiumsAccount, Reserve {
     return _juniorEtk;
   }
 
+  /**
+   * @dev Returns the maximum deficit that's supported by the PremiumsAccount. If more money is needed, it must take
+   * loans from the eTokens. The value is calculated as a fraction of the active pure premiums. The fraction is
+   * regulated by the `deficitRatio` parameter that indicates the percentage of the active pure premiums that can be
+   * used to cover payouts of finalized policies. In many cases is fine to use the active pure premiums to cover the
+   * losses because in most cases the policies with payout are triggered long time before the policies without payout.
+   * But this also can be dangerous because it can be postponing the losses that should impact on liquidity providers.
+   *
+   * @param ratio The ratio used in the calculation of the deficit. It's the deficitRatio parameter (whether the current
+   * one or the new one when it's being modified).
+   */
   function _maxDeficit(uint256 ratio) internal view returns (int256) {
     return -int256(_activePurePremiums.wadMul(ratio));
   }
 
+  /**
+   * @dev Returns the percentage of the active pure premiums that can be used to cover losses of finalized policies.
+   */
   function deficitRatio() public view returns (uint256) {
     return uint256(_params.deficitRatio) * 1e14; // 4 -> 18 decimals
   }
 
+  /**
+   * @dev Changes the `deficitRatio` parameter.
+   *
+   * Events:
+   * - Emits GovernanceAction with action = setDeficitRatio or setDeficitRatioWithAdjustment if an adjustment was made.
+   *
+   * @param adjustment If true and the new ratio leaves `_surplus < -_maxDeficit()`, if adjusts the _surplus to the new
+   *                   `_maxDeficit()` and borrows the difference from the eTokens.
+   *                   If false and the new ratio leaves `_surplus < -_maxDeficit()`, the operation is reverted.
+   */
   function setDeficitRatio(uint256 newRatio, bool adjustment)
     external
     onlyComponentRole(LEVEL2_ROLE)
@@ -158,15 +247,27 @@ contract PremiumsAccount is IPremiumsAccount, Reserve {
     require(newRatio <= 1e18 && newRatio >= 0, "Validation: deficitRatio must be <= 1");
     int256 maxDeficit = _maxDeficit(newRatio);
     require(adjustment || _surplus >= maxDeficit, "Validation: surplus must be >= maxDeficit");
+    IAccessManager.GovernanceActions action = IAccessManager.GovernanceActions.setDeficitRatio;
     if (_surplus < maxDeficit) {
       // Do the adjustment
       uint256 borrow = uint256(-_surplus + maxDeficit);
       _surplus = maxDeficit;
       _borrowFromEtk(borrow, address(this), address(_juniorEtk) != address(0));
+      action = IAccessManager.GovernanceActions.setDeficitRatioWithAdjustment;
     }
-    _params.deficitRatio = uint16(newRatio / 1e14);
+    _params.deficitRatio = (newRatio / 1e14).toUint16();
+    _parameterChanged(action, newRatio, false);
   }
 
+  /**
+   * @dev Internal function called when money in the PremiumsAccount is not enought and we need to borrow from the
+   * eTokens.
+   *
+   * @param borrow The amount to borrow.
+   * @param receiver The address that will receive the money of the loan. Usually is the policy holder if this is called
+   *                 in the context of a policy payout.
+   * @param jrEtk If true it indicates that the loan is asked first from the junior eToken.
+   */
   function _borrowFromEtk(
     uint256 borrow,
     address receiver,
@@ -186,6 +287,13 @@ contract PremiumsAccount is IPremiumsAccount, Reserve {
     }
   }
 
+  /**
+   * @dev Updates the `_surplus` field with the payment made. Since the _surplus can never exceed `_maxDeficit()`,
+   * returns the remaining amount in case something can't be paid from the PremiumsAccount.
+   *
+   * @param toPay The amount to pay.
+   * @return The amount that couldn't be paid from the premiums account.
+   */
   function _payFromPremiums(uint256 toPay) internal returns (uint256) {
     int256 newSurplus = _surplus - int256(toPay);
     int256 maxDeficit = _maxDeficit(deficitRatio());
@@ -197,38 +305,54 @@ contract PremiumsAccount is IPremiumsAccount, Reserve {
     return uint256(-newSurplus + maxDeficit);
   }
 
+  /**
+   * @dev Stores an earned pure premium. Adds to the surplus, increasing the surplus if it was positive or reducing the
+   * deficit if it was negative.
+   *
+   * @param purePremiumWon The amount earned
+   */
   function _storePurePremiumWon(uint256 purePremiumWon) internal {
     if (purePremiumWon == 0) return;
     _surplus += int256(purePremiumWon);
   }
 
-  // TODO: restore repayETokenLoan?
-
   /**
    *
    * Endpoint to receive "free money" and inject that money into the premium pool.
    *
    * Can be used for example if the PolicyPool subscribes an excess loss policy with other company.
    *
+   * Requirements:
+   * - The sender needs to approve the spending of `currency()` by this contract.
+   *
+   * Events:
+   * - Emits {WonPremiumsInOut} with moneyIn = true
+   *
+   * @param amount The amount to be transferred.
    */
   function receiveGrant(uint256 amount) external {
-    currency().safeTransferFrom(msg.sender, address(this), amount);
+    currency().safeTransferFrom(_msgSender(), address(this), amount);
     _storePurePremiumWon(amount);
     emit WonPremiumsInOut(true, amount);
   }
 
   /**
    *
-   * Withdraws excess premiums to PolicyPool's treasury.
+   * Withdraws excess premiums (surplus) to the destination.
+   *
    * This might be needed in some cases for example if we are deprecating the protocol or the excess premiums
    * are needed to compensate something. Shouldn't be used. Can be disabled revoking role WITHDRAW_WON_PREMIUMS_ROLE
    *
-   * returns The amount withdrawed
-   *
    * Requirements:
-   *
    * - onlyGlobalOrComponentRole(WITHDRAW_WON_PREMIUMS_ROLE)
    * - _wonPurePremiums > 0
+   *
+   * Events:
+   * - Emits {WonPremiumsInOut} with moneyIn = false
+   *
+   * @param amount The amount to withdraw
+   * @param destination The address that will receive the transferred funds.
+   * @return Returns the actual amount withdrawn.
    */
   function withdrawWonPremiums(uint256 amount, address destination)
     external
@@ -283,6 +407,11 @@ contract PremiumsAccount is IPremiumsAccount, Reserve {
     }
   }
 
+  /**
+   * @dev Internal function that calls the eTokens to lock the solvency capital when the policy is created.
+   *
+   * @param policy The policy created
+   */
   function _unlockScr(Policy.PolicyData memory policy) internal {
     if (policy.jrScr > 0) {
       _juniorEtk.unlockScr(
@@ -300,12 +429,23 @@ contract PremiumsAccount is IPremiumsAccount, Reserve {
     }
   }
 
+  /**
+   * @dev Internal function that repays a loan taken (if any outstanding) from the an eToken
+   *
+   * @param purePremiumWon The amount earned and available for loan repayment.
+   * @param etk The eToken with the potential debt
+   * @return The excess amount of the purePremiumWon that wasn't used for the loan repayment.
+   */
   function _repayLoan(uint256 purePremiumWon, IEToken etk) internal returns (uint256) {
     if (purePremiumWon < NEGLIGIBLE_AMOUNT) return purePremiumWon;
     uint256 borrowedFromEtk = etk.getLoan(address(this));
     if (borrowedFromEtk == 0) return purePremiumWon;
-    uint256 repayAmount = borrowedFromEtk > purePremiumWon ? purePremiumWon : borrowedFromEtk;
-    // TODO: make sure the balance is available or deinvest
+    uint256 repayAmount = Math.min(purePremiumWon, borrowedFromEtk);
+
+    // If not enought liquidity, it deinvests from the asset manager
+    if (currency().balanceOf(address(this)) < repayAmount) {
+      _refillWallet(repayAmount);
+    }
     etk.repayLoan(repayAmount, address(this));
     return purePremiumWon - repayAmount;
   }

package/contracts/Reserve.sol

@@ -11,7 +11,13 @@ import {PolicyPoolComponent} from "./PolicyPoolComponent.sol";
 
 /**
  * @title Base contract for Ensuro cash reserves
- * @dev This contract implements the methods related with management of the reserves and payments
+ * @dev This contract implements the methods related with management of the reserves and payments. {EToken} and
+ * {PremiumsAccount} inherit from this contract.
+ *
+ * These contracts have an asset manager {IAssetManager} that's a strategy contract that runs in the same context
+ * (called with delegatecall) that apply some strategy to reinvest the assets managed by the contract to generate
+ * additional returns.
+ *
  * @custom:security-contact security@ensuro.co
  * @author Ensuro
  */
@@ -21,35 +27,100 @@ abstract contract Reserve is PolicyPoolComponent {
 
   /// @custom:oz-upgrades-unsafe-allow state-variable-immutable
   // solhint-disable-next-line var-name-mixedcase
-  uint256 public immutable NEGLIGIBLE_AMOUNT; // init as 10**(decimals/2) == 0.001 USD
+  uint256 internal immutable NEGLIGIBLE_AMOUNT; // init as 10**(decimals/2) == 0.001 USD
 
+  /**
+   * @dev Reserve constructor. Calculates NEGLIGIBLE_AMOUNT to avoid rounding errors.
+   *
+   * @param policyPool_ The {PolicyPool} where this reserve will be plugged
+   */
   /// @custom:oz-upgrades-unsafe-allow constructor
   constructor(IPolicyPool policyPool_) PolicyPoolComponent(policyPool_) {
     NEGLIGIBLE_AMOUNT = 10**(policyPool_.currency().decimals() / 2);
   }
 
+  /**
+   * @dev Refills the reserve's balance, deinvesting from the asset manager to be able to make a payment
+   *
+   * @param amount The amount of the payment that needs to be made
+   * @return Returns the actual amount deinvested (how much the `currency().balanceof(this)` was increased). It might be
+   * more than `amount` because the asset manager might want to give more liquidity to the reserve to avoid further
+   * deinvestments. After the call, the `currency().balanceof(this)` should be greater than `amount` (unless unsolvency
+   * problem).
+   */
+  function _refillWallet(uint256 amount) internal returns (uint256) {
+    address am = address(assetManager());
+    if (am != address(0)) {
+      bytes memory result = am.functionDelegateCall(
+        abi.encodeWithSelector(IAssetManager.refillWallet.selector, amount),
+        "Error refilling wallet"
+      );
+      return abi.decode(result, (uint256));
+    }
+    return 0;
+  }
+
+  /**
+   * @dev Internal function that transfers money to a destination. It might need to call `_refillWallet` to deinvest
+   * some money to have enought liquidity for the payment.
+   *
+   * @param destination The destination of the transfer.
+   * @param amount The amount to be transferred.
+   */
   function _transferTo(address destination, uint256 amount) internal {
     if (amount == 0) return;
     uint256 balance = currency().balanceOf(address(this));
     if (balance < amount) {
-      address am = address(assetManager());
-      if (am != address(0)) {
-        am.functionDelegateCall(
-          abi.encodeWithSelector(IAssetManager.refillWallet.selector, amount),
-          "Error refilling wallet"
-        );
+      balance += _refillWallet(amount);
+      if (amount > balance) {
+        if ((amount - balance) < NEGLIGIBLE_AMOUNT) {
+          amount = balance;
+        } // else - No need to do anything since safeTransfer will fail anyway
       }
-      if ((amount - balance) < NEGLIGIBLE_AMOUNT) amount = balance;
     }
     currency().safeTransfer(destination, amount);
   }
 
+  /**
+   * @dev Returns the address of the asset manager for this reserve. The asset manager is the contract that manages the
+   * funds to generate additional yields. Can be `address(0)` if no asset manager has been set.
+   */
   function assetManager() public view virtual returns (IAssetManager);
 
+  /**
+   * @dev Internal function that needs to be implemented by child contracts because they might store the asset manager
+   * address in a different way. This function just stores the value, doesn't do any validation (validations are done on
+   * `setAssetManager`.
+   *
+   * @param newAM The address of the new asset manager for the reserve.
+   */
   function _setAssetManager(IAssetManager newAM) internal virtual;
 
+  /**
+   * @dev Internal function that needs to be implemented by child contracts to record the earnings (or losses if
+   * negative) generated by the asset management.
+   *
+   * @param earnings The amount of earnings (or losses if negative) generated since last time the earnings were
+   * recorded.
+   */
   function _assetEarnings(int256 earnings) internal virtual;
 
+  /**
+   * @dev Sets the asset manager for this reserve. If the reserve had previously an asset manager, it will deinvest all
+   * the funds, making all of the liquid in the reserve balance.
+   *
+   * Requirements:
+   * - The caller must have been granted of global or component roles GUARDIAN_ROLE or LEVEL1_ROLE.
+   *
+   * Events:
+   * - Emits ComponentChanged with action setAssetManager or setAssetManagerForced
+   *
+   * @param newAM The address of the new asset manager to assign to the reserve. If is `address(0)` it means the reserve
+   * will not have an asset manager. If not `address(0)` it MUST be a contract following the IAssetManager interface.
+   * @param force When a previous asset manager exists, before setting the new one, the funds are deinvested. When
+   * `force` is true, an error in the deinvestAll() operation is ignored. When `force` is false, if `deinvestAll()`
+   * fails, it reverts.
+   */
   function setAssetManager(IAssetManager newAM, bool force)
     external
     onlyGlobalOrComponentRole2(GUARDIAN_ROLE, LEVEL1_ROLE)
@@ -87,32 +158,56 @@ abstract contract Reserve is PolicyPoolComponent {
     _componentChanged(action, address(newAM));
   }
 
+  /**
+   * @dev Calls {IAssetManager-rebalance} of the assigned asset manager (fails if no asset manager). This operation is
+   * intended to give the opportunity to rebalance the liquid and invested for better returns and/or gas optimization.
+   *
+   * - Emits {IAssetManager-MoneyInvested} or {IAssetManager-MoneyDeinvested}
+   */
   function rebalance() public whenNotPaused {
-    address am = address(assetManager());
-    require(am != address(0), "No asset manager");
-    am.functionDelegateCall(abi.encodeWithSelector(IAssetManager.rebalance.selector));
+    address(assetManager()).functionDelegateCall(
+      abi.encodeWithSelector(IAssetManager.rebalance.selector)
+    );
   }
 
+  /**
+   * @dev Calls {IAssetManager-recordEarnings} of the assigned asset manager (fails if no asset manager). The asset
+   * manager will return the earnings since last time the earnings where recorded. It then calls `_assetEarnings` to
+   * reflect the earnings in the way defined for each reserve.
+   *
+   * - Emits {IAssetManager-EarningsRecorded}
+   */
   function recordEarnings() public whenNotPaused {
-    address am = address(assetManager());
-    require(am != address(0), "No asset manager");
-    bytes memory result = am.functionDelegateCall(
+    bytes memory result = address(assetManager()).functionDelegateCall(
       abi.encodeWithSelector(IAssetManager.recordEarnings.selector)
     );
     _assetEarnings(abi.decode(result, (int256)));
   }
 
+  /**
+   * @dev Function that calls both `recordEarnings()` and `rebalance()` (in that order). Usually scheduled to run once a
+   * day by a keeper or crontask.
+   */
   function checkpoint() external whenNotPaused {
     recordEarnings();
     rebalance();
   }
 
+  /**
+   * @dev This function allows to call custom functions of the asset manager (for example for setting parameters).
+   *      This functions will be called with `delegatecall`, in the context of the reserve.
+   *
+   * Requirements:
+   * - The caller must have been granted of global or component roles LEVEL2_ROLE.
+   *
+   * @param functionCall Abi encoded function call to make.
+   * @return Returns the return value of the function called, to be decoded by the receiver.
+   */
   function forwardToAssetManager(bytes memory functionCall)
     external
     onlyGlobalOrComponentRole(LEVEL2_ROLE)
     returns (bytes memory)
   {
-    address am = address(assetManager());
-    return am.functionDelegateCall(functionCall);
+    return address(assetManager()).functionDelegateCall(functionCall);
   }
 }

package/contracts/RiskModule.sol

@@ -1,7 +1,8 @@
 // SPDX-License-Identifier: Apache-2.0
 pragma solidity ^0.8.0;
 
-import {WadRayMath} from "./WadRayMath.sol";
+import {SafeCast} from "@openzeppelin/contracts/utils/math/SafeCast.sol";
+import {WadRayMath} from "./dependencies/WadRayMath.sol";
 import {IPolicyPool} from "./interfaces/IPolicyPool.sol";
 import {PolicyPoolComponent} from "./PolicyPoolComponent.sol";
 import {IRiskModule} from "./interfaces/IRiskModule.sol";
@@ -18,6 +19,7 @@ import {Policy} from "./Policy.sol";
 abstract contract RiskModule is IRiskModule, PolicyPoolComponent {
   using Policy for Policy.PolicyData;
   using WadRayMath for uint256;
+  using SafeCast for uint256;
 
   uint256 internal constant SECONDS_IN_YEAR_WAD = 31536000e18; /* 365 * 24 * 3600 * 10e18 */
 
@@ -153,7 +155,7 @@ abstract contract RiskModule is IRiskModule, PolicyPoolComponent {
 
   function _wadTo4(uint256 value) internal pure returns (uint16) {
     // Wad to 4 decimals
-    return uint16(value / 1e14);
+    return (value / 1e14).toUint16();
   }
 
   // solhint-disable-next-line func-name-mixedcase
@@ -164,7 +166,7 @@ abstract contract RiskModule is IRiskModule, PolicyPoolComponent {
 
   function _amountToX(uint8 decimals, uint256 value) internal view returns (uint32) {
     // Wad to X decimals
-    return uint32(value / 10**(currency().decimals() - decimals));
+    return (value / 10**(currency().decimals() - decimals)).toUint32();
   }
 
   function maxPayoutPerPolicy() public view override returns (uint256) {
@@ -235,9 +237,7 @@ abstract contract RiskModule is IRiskModule, PolicyPoolComponent {
       _params.exposureLimit = _amountToX(0, newValue);
     } else if (param == Parameter.maxDuration) {
       require(!tweak, "Tweak exceeded");
-      _params.maxDuration = uint16(newValue);
-    } else {
-      revert("Invalid param!");
+      _params.maxDuration = newValue.toUint16();
     }
     _parameterChanged(
       IAccessManager.GovernanceActions(
@@ -329,7 +329,7 @@ abstract contract RiskModule is IRiskModule, PolicyPoolComponent {
       "You must allow ENSURO to transfer the premium"
     );
     require(
-      payer == msg.sender || _policyPool.currency().allowance(payer, msg.sender) >= premium,
+      payer == _msgSender() || _policyPool.currency().allowance(payer, _msgSender()) >= premium,
       "Payer must allow caller to transfer the premium"
     );
     require(payout <= maxPayoutPerPolicy(), "RiskModule: Payout is more than maximum per policy");
@@ -342,7 +342,7 @@ abstract contract RiskModule is IRiskModule, PolicyPoolComponent {
       expiration
     );
     _activeExposure += policy.payout;
-    require(_activeExposure <= exposureLimit(), "RiskModule: SCR limit exceeded");
+    require(_activeExposure <= exposureLimit(), "RiskModule: Exposure limit exceeded");
     uint256 policyId = _policyPool.newPolicy(policy, payer, onBehalfOf, internalId);
     policy.id = policyId;
     return policy;