@ensuro/core 2.0.0-beta8 → 2.0.0

package/contracts/LiquidityThresholdAssetManager.sol

@@ -1,8 +1,9 @@
 // SPDX-License-Identifier: Apache-2.0
 pragma solidity ^0.8.0;
 
-import {WadRayMath} from "./WadRayMath.sol";
+import {SafeCast} from "@openzeppelin/contracts/utils/math/SafeCast.sol";
 import {IERC20Metadata} from "@openzeppelin/contracts/token/ERC20/extensions/IERC20Metadata.sol";
+import {IERC165} from "@openzeppelin/contracts/utils/introspection/IERC165.sol";
 import {IPolicyPoolComponent} from "./interfaces/IPolicyPoolComponent.sol";
 import {IAssetManager} from "./interfaces/IAssetManager.sol";
 import {IAccessManager} from "./interfaces/IAccessManager.sol";
@@ -17,9 +18,11 @@ import {Math} from "@openzeppelin/contracts/utils/math/Math.sol";
  *      cash at liquidityMiddle.
  * @custom:security-contact security@ensuro.co
  * @author Ensuro
+ *
+ * @notice This contracts uses Diamond Storage and should not define state variables outside of that. See the diamondStorage method for more details.
  */
 abstract contract LiquidityThresholdAssetManager is IAssetManager {
-  using WadRayMath for uint256;
+  using SafeCast for uint256;
 
   IERC20Metadata internal immutable _asset;
   event GovernanceAction(IAccessManager.GovernanceActions indexed action, uint256 value);
@@ -37,6 +40,10 @@ abstract contract LiquidityThresholdAssetManager is IAssetManager {
   }
 
   constructor(IERC20Metadata asset_) {
+    require(
+      address(asset_) != address(0),
+      "LiquidityThresholdAssetManager: asset cannot be zero address"
+    );
     _asset = asset_;
   }
 
@@ -70,7 +77,7 @@ abstract contract LiquidityThresholdAssetManager is IAssetManager {
     uint256 investmentValue = getInvestmentValue();
     DiamondStorage storage ds = diamondStorage();
     int256 earnings = int256(investmentValue) - int256(uint256(ds.lastInvestmentValue));
-    ds.lastInvestmentValue = uint128(investmentValue);
+    ds.lastInvestmentValue = investmentValue.toUint128();
     emit EarningsRecorded(earnings);
     return earnings;
   }
@@ -96,31 +103,32 @@ abstract contract LiquidityThresholdAssetManager is IAssetManager {
   }
 
   /**
-   * @dev This is called from PolicyPool when doesn't have enought money for payment.
-   *      After the call, there should be enought money in PolicyPool.currency().balanceOf(this) to
+   * @dev This is called from PolicyPool when doesn't have enough money for payment.
+   *      After the call, there should be enough money in PolicyPool.currency().balanceOf(this) to
    *      do the payment
    * @param paymentAmount The amount of the payment
    */
-  function refillWallet(uint256 paymentAmount) external override {
+  function refillWallet(uint256 paymentAmount) external override returns (uint256 deinvest) {
     uint256 cash = _asset.balanceOf(address(this));
     require(cash < paymentAmount, "No need to refill the wallet for this payment");
     uint256 investmentValue = getInvestmentValue();
     // try to leave the pool balance at liquidity_middle after the payment
-    uint256 deinvest = paymentAmount + liquidityMiddle() - cash;
+    deinvest = paymentAmount + liquidityMiddle() - cash;
     if (deinvest > investmentValue) deinvest = investmentValue;
     _deinvest(deinvest);
+    return deinvest;
   }
 
   function _invest(uint256 amount) internal virtual {
     DiamondStorage storage ds = diamondStorage();
-    ds.lastInvestmentValue += uint128(amount);
+    ds.lastInvestmentValue += amount.toUint128();
     emit MoneyInvested(amount);
     // must be reimplemented do the actual cash movement
   }
 
   function _deinvest(uint256 amount) internal virtual {
     DiamondStorage storage ds = diamondStorage();
-    ds.lastInvestmentValue -= uint128(Math.min(uint256(ds.lastInvestmentValue), amount));
+    ds.lastInvestmentValue -= Math.min(uint256(ds.lastInvestmentValue), amount).toUint128();
     emit MoneyDeinvested(amount);
     // must be reimplemented do the actual cash movement
   }
@@ -144,16 +152,24 @@ abstract contract LiquidityThresholdAssetManager is IAssetManager {
   ) external validateParamsAfterChange {
     DiamondStorage storage ds = diamondStorage();
     if (min != type(uint256).max) {
-      ds.liquidityMin = uint32(min / 10**_asset.decimals());
+      ds.liquidityMin = (min / 10**_asset.decimals()).toUint32();
       emit GovernanceAction(IAccessManager.GovernanceActions.setLiquidityMin, min);
     }
     if (middle != type(uint256).max) {
-      ds.liquidityMiddle = uint32(middle / 10**_asset.decimals());
+      ds.liquidityMiddle = (middle / 10**_asset.decimals()).toUint32();
       emit GovernanceAction(IAccessManager.GovernanceActions.setLiquidityMiddle, middle);
     }
     if (max != type(uint256).max) {
-      ds.liquidityMax = uint32(max / 10**_asset.decimals());
+      ds.liquidityMax = (max / 10**_asset.decimals()).toUint32();
       emit GovernanceAction(IAccessManager.GovernanceActions.setLiquidityMax, max);
     }
   }
+
+  /**
+   * @dev See {IERC165-supportsInterface}.
+   */
+  function supportsInterface(bytes4 interfaceId) public view virtual override returns (bool) {
+    return
+      interfaceId == type(IERC165).interfaceId || interfaceId == type(IAssetManager).interfaceId;
+  }
 }

package/contracts/Policy.sol

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: Apache-2.0
 pragma solidity ^0.8.0;
-import {WadRayMath} from "./WadRayMath.sol";
+import {WadRayMath} from "./dependencies/WadRayMath.sol";
 import {IRiskModule} from "./interfaces/IRiskModule.sol";
 
 /**
@@ -102,7 +102,9 @@ library Policy {
     return (policy.srCoc * (block.timestamp - policy.start)) / (policy.expiration - policy.start);
   }
 
-  function hash(PolicyData memory policy) internal pure returns (bytes32) {
-    return keccak256(abi.encode(policy));
+  function hash(PolicyData memory policy) internal pure returns (bytes32 retHash) {
+    retHash = keccak256(abi.encode(policy));
+    require(retHash != bytes32(0), "Policy: hash cannot be 0");
+    return retHash;
   }
 }

package/contracts/PolicyPool.sol

@@ -8,7 +8,6 @@ import {ERC721Upgradeable} from "@openzeppelin/contracts-upgradeable/token/ERC72
 import {SafeERC20} from "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";
 import {IAccessManager} from "./interfaces/IAccessManager.sol";
 import {PausableUpgradeable} from "@openzeppelin/contracts-upgradeable/security/PausableUpgradeable.sol";
-import {EnumerableSet} from "@openzeppelin/contracts/utils/structs/EnumerableSet.sol";
 import {IPremiumsAccount} from "./interfaces/IPremiumsAccount.sol";
 import {IPolicyPool} from "./interfaces/IPolicyPool.sol";
 import {IRiskModule} from "./interfaces/IRiskModule.sol";
@@ -16,21 +15,22 @@ import {IPolicyPoolComponent} from "./interfaces/IPolicyPoolComponent.sol";
 import {IEToken} from "./interfaces/IEToken.sol";
 import {IPolicyHolder} from "./interfaces/IPolicyHolder.sol";
 import {Policy} from "./Policy.sol";
-import {WadRayMath} from "./WadRayMath.sol";
+import {WadRayMath} from "./dependencies/WadRayMath.sol";
 
 /**
  * @title Ensuro PolicyPool contract
  * @dev This is the main contract of the protocol, it stores the eTokens (liquidity pools) and has the operations
- *      to interact with them. This is also the contract that receives and sends the underlying asset.
+ *      to interact with them. This is also the contract that receives and sends the underlying asset (currency).
  *      Also this contract keeps track of accumulated premiums in different stages:
  *      - activePurePremiums
  *      - wonPurePremiums (surplus)
  *      - borrowedActivePP (deficit borrowed from activePurePremiums)
+ *      This contract also implements the ERC721 standard, because it mints and NFT for each policy created. The
+ *      property of the NFT represents the one that will receive the payout.
  * @custom:security-contact security@ensuro.co
  * @author Ensuro
  */
 contract PolicyPool is IPolicyPool, PausableUpgradeable, UUPSUpgradeable, ERC721Upgradeable {
-  using EnumerableSet for EnumerableSet.AddressSet;
   using WadRayMath for uint256;
   using Policy for Policy.PolicyData;
   using SafeERC20 for IERC20Metadata;
@@ -40,13 +40,26 @@ contract PolicyPool is IPolicyPool, PausableUpgradeable, UUPSUpgradeable, ERC721
   bytes32 public constant LEVEL2_ROLE = keccak256("LEVEL2_ROLE");
   bytes32 public constant LEVEL3_ROLE = keccak256("LEVEL3_ROLE");
 
+  /**
+   * @dev {AccessManager} that handles the access permissions for the PolicyPool and its components.
+   */
   /// @custom:oz-upgrades-unsafe-allow state-variable-immutable
   IAccessManager internal immutable _access;
+
+  /**
+   * @dev {ERC20} token used in PolicyPool as currency. Usually it will be a stablecoin such as USDC.
+   */
   /// @custom:oz-upgrades-unsafe-allow state-variable-immutable
   IERC20Metadata internal immutable _currency;
 
+  /**
+   * @dev Address of Ensuro's treasury that receives the protocol fees.
+   */
   address internal _treasury; // address of Ensuro treasury
 
+  /**
+   * @dev This enum tracks the different status that a component ({PremiumsAccount}, {EToken} or {RiskModule} can have.
+   */
   enum ComponentStatus {
     /**
      * @dev inactive status = 0 means the component doesn't exists - All operations rejected
@@ -73,6 +86,10 @@ contract PolicyPool is IPolicyPool, PausableUpgradeable, UUPSUpgradeable, ERC721
     suspended
   }
 
+  /**
+   * @dev Enum of the different kind of top level components that can be plugged into the pool. Each one corresponds
+   * with the {EToken}, {RiskModule} and {PremiumsAccount} respectively.
+   */
   enum ComponentKind {
     unknown,
     eToken,
@@ -80,6 +97,10 @@ contract PolicyPool is IPolicyPool, PausableUpgradeable, UUPSUpgradeable, ERC721
     premiumsAccount
   }
 
+  /**
+   * @dev Struct to keep the state and type of the components installed. The `kind` never changes. The `status`
+   * initially is `active` and can be changes with {PolicyPool-changeComponentStatus} and {PolicyPool-removeComponent}.
+   */
   struct Component {
     ComponentStatus status;
     ComponentKind kind;
@@ -87,7 +108,6 @@ contract PolicyPool is IPolicyPool, PausableUpgradeable, UUPSUpgradeable, ERC721
 
   /**
    * @dev Mapping of installed components (see {EToken}, {RiskModule}, {PremiumsAccount}) in the PolicyPool.
-   * For each one it keep an state {ComponentStatus}.
    */
   mapping(IPolicyPoolComponent => Component) private _components;
 
@@ -100,17 +120,27 @@ contract PolicyPool is IPolicyPool, PausableUpgradeable, UUPSUpgradeable, ERC721
   /**
    * @dev Event emitted every time a new policy is added to the pool. Contains all the data about the policy that is
    * later required for doing operations with the policy like resolution or expiration.
+   *
+   * @param riskModule The risk module that created the policy
+   * @param policy The {Policy-PolicyData} struct with all the immutable fields of the policy.
    */
   event NewPolicy(IRiskModule indexed riskModule, Policy.PolicyData policy);
 
   /**
    * @dev Event emitted every time a policy is removed from the pool. If the policy expired, the `payout` is 0,
    * otherwise is the amount transferred to the policyholder.
+   *
+   * @param riskModule The risk module where that created the policy initially.
+   * @param policyId The unique id of the policy
+   * @param payout The payout that has been paid to the policy holder. 0 when the policy expired.
    */
   event PolicyResolved(IRiskModule indexed riskModule, uint256 indexed policyId, uint256 payout);
 
   /**
    * @dev Event emitted when the treasury changes
+   *
+   * @param action The type of governance action (just setTreasury in this contract for now)
+   * @param value  The address of the new treasury
    */
   event ComponentChanged(IAccessManager.GovernanceActions indexed action, address value);
 
@@ -127,45 +157,98 @@ contract PolicyPool is IPolicyPool, PausableUpgradeable, UUPSUpgradeable, ERC721
     ComponentStatus newStatus
   );
 
+  /**
+   * @dev Modifier that checks the caller has a given role
+   */
   modifier onlyRole(bytes32 role) {
-    _access.checkRole(role, msg.sender);
+    _access.checkRole(role, _msgSender());
     _;
   }
 
+  /**
+   * @dev Modifier that checks the caller has any of the given roles
+   */
   modifier onlyRole2(bytes32 role1, bytes32 role2) {
-    _access.checkRole2(role1, role2, msg.sender);
+    _access.checkRole2(role1, role2, _msgSender());
     _;
   }
 
+  /**
+   * @dev Instantiates a Policy Pool. Sets immutable fields.
+   *
+   * @param access_ The address of the {AccessManager} that manages the access permissions for the pool governance
+   * operations.
+   * @param currency_ The {ERC20} token that's used as a currency in the protocol. Usually a stablecoin such as USDC.
+   */
   /// @custom:oz-upgrades-unsafe-allow constructor
   constructor(IAccessManager access_, IERC20Metadata currency_) {
+    require(address(access_) != address(0), "PolicyPool: access cannot be zero address");
+    require(address(currency_) != address(0), "PolicyPool: currency cannot be zero address");
+    _disableInitializers();
     _access = access_;
     _currency = currency_;
   }
 
+  /**
+   * @dev Initializes a Policy Pool
+   *
+   * @param name_ The name of the ERC721 token.
+   * @param symbol_ The symbol of the ERC721 token.
+   * @param treasury_ The address of the treasury that will receive the protocol fees.
+   */
   function initialize(
     string memory name_,
     string memory symbol_,
     address treasury_
   ) public initializer {
+    require(bytes(name_).length > 0, "PolicyPool: name cannot be empty");
+    require(bytes(symbol_).length > 0, "PolicyPool: symbol cannot be empty");
     __UUPSUpgradeable_init();
     __ERC721_init(name_, symbol_);
     __Pausable_init();
     __PolicyPool_init_unchained(treasury_);
   }
 
+  /**
+   * @dev See {IERC165-supportsInterface}.
+   */
+  function supportsInterface(bytes4 interfaceId) public view virtual override returns (bool) {
+    return super.supportsInterface(interfaceId) || interfaceId == type(IPolicyPool).interfaceId;
+  }
+
   // solhint-disable-next-line func-name-mixedcase
-  function __PolicyPool_init_unchained(address treasury_) internal initializer {
-    _treasury = treasury_;
+  function __PolicyPool_init_unchained(address treasury_) internal onlyInitializing {
+    _setTreasury(treasury_);
   }
 
-  // solhint-disable-next-line no-empty-blocks
-  function _authorizeUpgrade(address) internal override onlyRole2(GUARDIAN_ROLE, LEVEL1_ROLE) {}
+  function _authorizeUpgrade(address newImpl)
+    internal
+    view
+    override
+    onlyRole2(GUARDIAN_ROLE, LEVEL1_ROLE)
+  {
+    IPolicyPool newPool = IPolicyPool(newImpl);
+    require(newPool.access() == _access, "Can't upgrade changing the access manager");
+    require(newPool.currency() == _currency, "Can't upgrade changing the currency");
+  }
 
+  /**
+   * @dev Pauses the contract. When the contract is paused, several operations are rejected: deposits, withdrawals, new
+   * policies, policy resolution and expiration, nft transfers.
+   *
+   * Requirements:
+   * - Must be executed by a user with the {GUARDIAN_ROLE}.
+   */
   function pause() public onlyRole(GUARDIAN_ROLE) {
     _pause();
   }
 
+  /**
+   * @dev Unpauses the contract. All the operations disabled when the contract was paused are re-enabled.
+   *
+   * Requirements:
+   * - Must be called by a user with either the {GUARDIAN_ROLE} or a {LEVEL1_ROLE}.
+   */
   function unpause() public onlyRole2(GUARDIAN_ROLE, LEVEL1_ROLE) {
     _unpause();
   }
@@ -178,15 +261,47 @@ contract PolicyPool is IPolicyPool, PausableUpgradeable, UUPSUpgradeable, ERC721
     return _currency;
   }
 
-  function setTreasury(address treasury_) external onlyRole(LEVEL1_ROLE) {
+  function _setTreasury(address treasury_) internal {
+    require(treasury_ != address(0), "PolicyPool: treasury cannot be the zero address");
     _treasury = treasury_;
     emit ComponentChanged(IAccessManager.GovernanceActions.setTreasury, _treasury);
   }
 
+  /**
+   * @dev Changes the address of the treasury, the one that receives the protocol fees.
+   *
+   * Requirements:
+   * - Must be called by a user with the {LEVEL1_ROLE}.
+   *
+   * Events:
+   * - Emits {ComponentChanged} with action = setTreasury and the address of the new treasury.
+   */
+  function setTreasury(address treasury_) external onlyRole(LEVEL1_ROLE) {
+    _setTreasury(treasury_);
+  }
+
+  /**
+   * @dev Returns the address of the treasury, the one that receives the protocol fees.
+   */
   function treasury() external view override returns (address) {
     return _treasury;
   }
 
+  /**
+   * @dev Adds a new component (either an {EToken}, {RiskModule} or {PremiumsAccount}) to the protocol. The component
+   * status will be `active`.
+   *
+   * Requirements:
+   * - Must be called by a user with the {LEVEL1_ROLE}
+   * - The component wasn't added before.
+   *
+   * Events:
+   * - Emits {ComponentStatusChanged} with status active.
+   *
+   * @param component The address of component contract. Must be an {EToken}, {RiskModule} or {PremiumsAccount} linked
+   * to this specific {PolicyPool} and matching the `kind` specified in the next paramter.
+   * @param kind The type of component to be added.
+   */
   function addComponent(IPolicyPoolComponent component, ComponentKind kind)
     external
     onlyRole(LEVEL1_ROLE)
@@ -195,6 +310,15 @@ contract PolicyPool is IPolicyPool, PausableUpgradeable, UUPSUpgradeable, ERC721
     require(comp.status == ComponentStatus.inactive, "Component already in the pool");
     require(component.policyPool() == this, "Component not linked to this pool");
 
+    require(
+      (kind == ComponentKind.eToken && component.supportsInterface(type(IEToken).interfaceId)) ||
+        (kind == ComponentKind.premiumsAccount &&
+          component.supportsInterface(type(IPremiumsAccount).interfaceId)) ||
+        (kind == ComponentKind.riskModule &&
+          component.supportsInterface(type(IRiskModule).interfaceId)),
+      "PolicyPool: Not the right kind"
+    );
+
     comp.status = ComponentStatus.active;
     comp.kind = kind;
     if (kind == ComponentKind.premiumsAccount) {
@@ -211,6 +335,19 @@ contract PolicyPool is IPolicyPool, PausableUpgradeable, UUPSUpgradeable, ERC721
     emit ComponentStatusChanged(component, kind, ComponentStatus.active);
   }
 
+  /**
+   * @dev Removes a component from the protocol. The component needs to be in `deprecated` status before doing this
+   * operation.
+   *
+   * Requirements:
+   * - Must be called by a user with the {LEVEL1_ROLE}
+   * - The component status is `deprecated`.
+   *
+   * Events:
+   * - Emits {ComponentStatusChanged} with status inactive.
+   *
+   * @param component The address of component contract. Must be a component added before.
+   */
   function removeComponent(IPolicyPoolComponent component) external onlyRole(LEVEL1_ROLE) {
     Component storage comp = _components[component];
     require(comp.status == ComponentStatus.deprecated, "Component not deprecated");
@@ -240,6 +377,19 @@ contract PolicyPool is IPolicyPool, PausableUpgradeable, UUPSUpgradeable, ERC721
     delete _components[component];
   }
 
+  /**
+   * @dev Changes the status of a component.
+   *
+   * Requirements:
+   * - Must be called by a user with the {LEVEL1_ROLE} if the new status is `active` or `deprecated`.
+   * - Must be called by a user with the {GUARDIAN_ROLE} if the new status is `suspended`.
+   *
+   * Events:
+   * - Emits {ComponentStatusChanged} with the new status.
+   *
+   * @param component The address of component contract. Must be a component added before.
+   * @param newStatus The new status, must be either `active`, `deprecated` or `suspended`.
+   */
   function changeComponentStatus(IPolicyPoolComponent component, ComponentStatus newStatus)
     external
     onlyRole2(GUARDIAN_ROLE, LEVEL1_ROLE)
@@ -247,15 +397,21 @@ contract PolicyPool is IPolicyPool, PausableUpgradeable, UUPSUpgradeable, ERC721
     Component storage comp = _components[component];
     require(comp.status != ComponentStatus.inactive, "Component not found");
     require(
-      (newStatus == ComponentStatus.active && _access.hasRole(LEVEL1_ROLE, msg.sender)) ||
-        (newStatus == ComponentStatus.suspended && _access.hasRole(GUARDIAN_ROLE, msg.sender)) ||
-        (newStatus == ComponentStatus.deprecated && _access.hasRole(LEVEL1_ROLE, msg.sender)),
+      (newStatus == ComponentStatus.active && _access.hasRole(LEVEL1_ROLE, _msgSender())) ||
+        (newStatus == ComponentStatus.suspended && _access.hasRole(GUARDIAN_ROLE, _msgSender())) ||
+        (newStatus == ComponentStatus.deprecated && _access.hasRole(LEVEL1_ROLE, _msgSender())),
       "Only GUARDIAN can suspend / Only LEVEL1 can activate/deprecate"
     );
     comp.status = newStatus;
     emit ComponentStatusChanged(component, comp.kind, newStatus);
   }
 
+  /**
+   * @dev Returns the status of a component.
+   *
+   * @param component The address of the component
+   * @return The status of the component. See {ComponentStatus}
+   */
   function getComponentStatus(IPolicyPoolComponent component)
     external
     view
@@ -284,8 +440,9 @@ contract PolicyPool is IPolicyPool, PausableUpgradeable, UUPSUpgradeable, ERC721
 
   function deposit(IEToken eToken, uint256 amount) external override whenNotPaused {
     require(_etkStatus(eToken) == ComponentStatus.active, "eToken is not active");
-    _currency.safeTransferFrom(msg.sender, address(eToken), amount);
-    eToken.deposit(msg.sender, amount);
+    uint256 balanceBefore = _currency.balanceOf(address(eToken));
+    _currency.safeTransferFrom(_msgSender(), address(eToken), amount);
+    eToken.deposit(_msgSender(), _currency.balanceOf(address(eToken)) - balanceBefore);
   }
 
   function withdraw(IEToken eToken, uint256 amount)
@@ -299,7 +456,7 @@ contract PolicyPool is IPolicyPool, PausableUpgradeable, UUPSUpgradeable, ERC721
       etkStatus == ComponentStatus.active || etkStatus == ComponentStatus.deprecated,
       "eToken not found or withdraws not allowed"
     );
-    address provider = msg.sender;
+    address provider = _msgSender();
     return eToken.withdraw(provider, amount);
   }
 
@@ -309,15 +466,20 @@ contract PolicyPool is IPolicyPool, PausableUpgradeable, UUPSUpgradeable, ERC721
     address policyHolder,
     uint96 internalId
   ) external override whenNotPaused returns (uint256) {
+    // Checks
     IRiskModule rm = policy.riskModule;
-    require(address(rm) == msg.sender, "Only the RM can create new policies");
+    require(address(rm) == _msgSender(), "Only the RM can create new policies");
     require(_rmStatus(rm) == ComponentStatus.active, "RM module not found or not active");
-    policy.id = (uint256(uint160(address(rm))) << 96) + internalId;
-    _policies[policy.id] = policy.hash();
     IPremiumsAccount pa = rm.premiumsAccount();
     require(_paStatus(pa) == ComponentStatus.active, "PremiumsAccount not found or not active");
+
+    // Effects
+    policy.id = (uint256(uint160(address(rm))) << 96) + internalId;
+    require(_policies[policy.id] == bytes32(0), "Policy already exists");
+    _policies[policy.id] = policy.hash();
+
+    // Interactions
     pa.policyCreated(policy);
-    _safeMint(policyHolder, policy.id, "");
 
     // Distribute the premium
     _currency.safeTransferFrom(payer, address(pa), policy.purePremium);
@@ -326,16 +488,17 @@ contract PolicyPool is IPolicyPool, PausableUpgradeable, UUPSUpgradeable, ERC721
     _currency.safeTransferFrom(payer, _treasury, policy.ensuroCommission);
     if (policy.partnerCommission > 0 && payer != rm.wallet())
       _currency.safeTransferFrom(payer, rm.wallet(), policy.partnerCommission);
-    // TODO: this code does up to 5 ERC20 transfers. How we can avoid this? Delayed transfers?
+    /**
+     * This code does up to 5 ERC20 transfers. This can be avoided to reduce the gas cost, by implementing delayed
+     * transfers. This might be considered in the future, but to avoid increasing the complexity and since so far we
+     * operate on low gas-cost blockchains, we keep it as it is.
+     */
+    _safeMint(policyHolder, policy.id, "");
 
     emit NewPolicy(rm, policy);
     return policy.id;
   }
 
-  function _balance() internal view returns (uint256) {
-    return _currency.balanceOf(address(this));
-  }
-
   function _validatePolicy(Policy.PolicyData memory policy) internal view {
     require(policy.id != 0 && policy.hash() == _policies[policy.id], "Policy not found");
   }
@@ -361,10 +524,21 @@ contract PolicyPool is IPolicyPool, PausableUpgradeable, UUPSUpgradeable, ERC721
     return _resolvePolicy(policy, customerWon ? policy.payout : 0, false);
   }
 
+  function isActive(uint256 policyId) external view override returns (bool) {
+    return _policies[policyId] != bytes32(0);
+  }
+
+  function getPolicyHash(uint256 policyId) external view override returns (bytes32) {
+    return _policies[policyId];
+  }
+
   /**
    * @dev Internal function that handles the different alternative resolutions for a policy, with or without payout and
    * expiration.
    *
+   * Events:
+   * - Emits {PolicyResolved} with the payout
+   *
    * @param policy A policy created with {Policy-initialize}
    * @param payout The amount to paid to the policyholder
    * @param expired True for expiration resolution (`payout` must be 0)
@@ -374,9 +548,10 @@ contract PolicyPool is IPolicyPool, PausableUpgradeable, UUPSUpgradeable, ERC721
     uint256 payout,
     bool expired
   ) internal {
+    // Checks
     _validatePolicy(policy);
     IRiskModule rm = policy.riskModule;
-    require(expired || address(rm) == msg.sender, "Only the RM can resolve policies");
+    require(expired || address(rm) == _msgSender(), "Only the RM can resolve policies");
     require(payout == 0 || policy.expiration > block.timestamp, "Can't pay expired policy");
     ComponentStatus compStatus = _rmStatus(rm);
     require(
@@ -393,6 +568,9 @@ contract PolicyPool is IPolicyPool, PausableUpgradeable, UUPSUpgradeable, ERC721
       compStatus == ComponentStatus.active || compStatus == ComponentStatus.deprecated,
       "PremiumsAccount must be active or deprecated to process resolutions"
     );
+    // Effects
+    delete _policies[policy.id];
+    // Interactions
     if (customerWon) {
       address policyOwner = ownerOf(policy.id);
       pa.policyResolvedWithPayout(policyOwner, policy, payout);
@@ -403,7 +581,6 @@ contract PolicyPool is IPolicyPool, PausableUpgradeable, UUPSUpgradeable, ERC721
     rm.releaseExposure(policy.payout);
 
     emit PolicyResolved(policy.riskModule, policy.id, payout);
-    delete _policies[policy.id];
     if (payout > 0) {
       _notifyPayout(policy.id, payout);
     } else {
@@ -451,4 +628,19 @@ contract PolicyPool is IPolicyPool, PausableUpgradeable, UUPSUpgradeable, ERC721
       return;
     }
   }
+
+  function _beforeTokenTransfer(
+    address from,
+    address to,
+    uint256 tokenId
+  ) internal override whenNotPaused {
+    super._beforeTokenTransfer(from, to, tokenId);
+  }
+
+  /**
+   * @dev This empty reserved space is put in place to allow future versions to add new
+   * variables without shifting down storage in the inheritance chain.
+   * See https://docs.openzeppelin.com/contracts/4.x/upgradeable#storage_gaps
+   */
+  uint256[47] private __gap;
 }