@ensuro/core 2.0.0-beta8 → 2.0.0

package/contracts/Reserve.sol

@@ -11,7 +11,13 @@ import {PolicyPoolComponent} from "./PolicyPoolComponent.sol";
 
 /**
  * @title Base contract for Ensuro cash reserves
- * @dev This contract implements the methods related with management of the reserves and payments
+ * @dev This contract implements the methods related with management of the reserves and payments. {EToken} and
+ * {PremiumsAccount} inherit from this contract.
+ *
+ * These contracts have an asset manager {IAssetManager} that's a strategy contract that runs in the same context
+ * (called with delegatecall) that apply some strategy to reinvest the assets managed by the contract to generate
+ * additional returns.
+ *
  * @custom:security-contact security@ensuro.co
  * @author Ensuro
  */
@@ -21,42 +27,116 @@ abstract contract Reserve is PolicyPoolComponent {
 
   /// @custom:oz-upgrades-unsafe-allow state-variable-immutable
   // solhint-disable-next-line var-name-mixedcase
-  uint256 public immutable NEGLIGIBLE_AMOUNT; // init as 10**(decimals/2) == 0.001 USD
+  uint256 internal immutable NEGLIGIBLE_AMOUNT; // init as 10**(decimals/2) == 0.001 USD
 
+  /**
+   * @dev Reserve constructor. Calculates NEGLIGIBLE_AMOUNT to avoid rounding errors.
+   *
+   * @param policyPool_ The {PolicyPool} where this reserve will be plugged
+   */
   /// @custom:oz-upgrades-unsafe-allow constructor
   constructor(IPolicyPool policyPool_) PolicyPoolComponent(policyPool_) {
     NEGLIGIBLE_AMOUNT = 10**(policyPool_.currency().decimals() / 2);
   }
 
+  /**
+   * @dev Initializes the Reserve (to be called by subclasses)
+   */
+  // solhint-disable-next-line func-name-mixedcase
+  function __Reserve_init() internal onlyInitializing {
+    __PolicyPoolComponent_init();
+  }
+
+  /**
+   * @dev Refills the reserve's balance, deinvesting from the asset manager to be able to make a payment
+   *
+   * @param amount The amount of the payment that needs to be made
+   * @return Returns the actual amount deinvested (how much the `currency().balanceof(this)` was increased). It might be
+   * more than `amount` because the asset manager might want to give more liquidity to the reserve to avoid further
+   * deinvestments. After the call, the `currency().balanceof(this)` should be greater than `amount` (unless unsolvency
+   * problem).
+   */
+  function _refillWallet(uint256 amount) internal returns (uint256) {
+    address am = address(assetManager());
+    if (am != address(0)) {
+      bytes memory result = am.functionDelegateCall(
+        abi.encodeWithSelector(IAssetManager.refillWallet.selector, amount),
+        "Error refilling wallet"
+      );
+      return abi.decode(result, (uint256));
+    }
+    return 0;
+  }
+
+  /**
+   * @dev Internal function that transfers money to a destination. It might need to call `_refillWallet` to deinvest
+   * some money to have enough liquidity for the payment.
+   *
+   * @param destination The destination of the transfer.
+   * @param amount The amount to be transferred.
+   */
   function _transferTo(address destination, uint256 amount) internal {
+    require(destination != address(0), "Reserve: transfer to the zero address");
     if (amount == 0) return;
     uint256 balance = currency().balanceOf(address(this));
     if (balance < amount) {
-      address am = address(assetManager());
-      if (am != address(0)) {
-        am.functionDelegateCall(
-          abi.encodeWithSelector(IAssetManager.refillWallet.selector, amount),
-          "Error refilling wallet"
-        );
+      balance += _refillWallet(amount);
+      if (amount > balance) {
+        if ((amount - balance) < NEGLIGIBLE_AMOUNT) {
+          amount = balance;
+        } // else - No need to do anything since safeTransfer will fail anyway
       }
-      if ((amount - balance) < NEGLIGIBLE_AMOUNT) amount = balance;
     }
     currency().safeTransfer(destination, amount);
   }
 
+  /**
+   * @dev Returns the address of the asset manager for this reserve. The asset manager is the contract that manages the
+   * funds to generate additional yields. Can be `address(0)` if no asset manager has been set.
+   */
   function assetManager() public view virtual returns (IAssetManager);
 
+  /**
+   * @dev Internal function that needs to be implemented by child contracts because they might store the asset manager
+   * address in a different way. This function just stores the value, doesn't do any validation (validations are done on
+   * `setAssetManager`.
+   *
+   * @param newAM The address of the new asset manager for the reserve.
+   */
   function _setAssetManager(IAssetManager newAM) internal virtual;
 
+  /**
+   * @dev Internal function that needs to be implemented by child contracts to record the earnings (or losses if
+   * negative) generated by the asset management.
+   *
+   * @param earnings The amount of earnings (or losses if negative) generated since last time the earnings were
+   * recorded.
+   */
   function _assetEarnings(int256 earnings) internal virtual;
 
+  /**
+   * @dev Sets the asset manager for this reserve. If the reserve had previously an asset manager, it will deinvest all
+   * the funds, making all of the liquid in the reserve balance.
+   *
+   * Requirements:
+   * - The caller must have been granted of global or component roles GUARDIAN_ROLE or LEVEL1_ROLE.
+   *
+   * Events:
+   * - Emits ComponentChanged with action setAssetManager or setAssetManagerForced
+   *
+   * @param newAM The address of the new asset manager to assign to the reserve. If is `address(0)` it means the reserve
+   * will not have an asset manager. If not `address(0)` it MUST be a contract following the IAssetManager interface.
+   * @param force When a previous asset manager exists, before setting the new one, the funds are deinvested. When
+   * `force` is true, an error in the deinvestAll() operation is ignored. When `force` is false, if `deinvestAll()`
+   * fails, it reverts.
+   */
   function setAssetManager(IAssetManager newAM, bool force)
     external
     onlyGlobalOrComponentRole2(GUARDIAN_ROLE, LEVEL1_ROLE)
   {
     require(
-      address(newAM) == address(0) || address(newAM).isContract(),
-      "The assetManager is not a contract!"
+      address(newAM) == address(0) || newAM.supportsInterface(type(IAssetManager).interfaceId),
+      "Reserve: asset manager doesn't implements the required interface"
     );
     address am = address(assetManager());
     IAccessManager.GovernanceActions action = IAccessManager.GovernanceActions.setAssetManager;
@@ -87,32 +167,63 @@ abstract contract Reserve is PolicyPoolComponent {
     _componentChanged(action, address(newAM));
   }
 
+  /**
+   * @dev Calls {IAssetManager-rebalance} of the assigned asset manager (fails if no asset manager). This operation is
+   * intended to give the opportunity to rebalance the liquid and invested for better returns and/or gas optimization.
+   *
+   * - Emits {IAssetManager-MoneyInvested} or {IAssetManager-MoneyDeinvested}
+   */
   function rebalance() public whenNotPaused {
-    address am = address(assetManager());
-    require(am != address(0), "No asset manager");
-    am.functionDelegateCall(abi.encodeWithSelector(IAssetManager.rebalance.selector));
+    address(assetManager()).functionDelegateCall(
+      abi.encodeWithSelector(IAssetManager.rebalance.selector)
+    );
   }
 
+  /**
+   * @dev Calls {IAssetManager-recordEarnings} of the assigned asset manager (fails if no asset manager). The asset
+   * manager will return the earnings since last time the earnings where recorded. It then calls `_assetEarnings` to
+   * reflect the earnings in the way defined for each reserve.
+   *
+   * - Emits {IAssetManager-EarningsRecorded}
+   */
   function recordEarnings() public whenNotPaused {
-    address am = address(assetManager());
-    require(am != address(0), "No asset manager");
-    bytes memory result = am.functionDelegateCall(
+    bytes memory result = address(assetManager()).functionDelegateCall(
       abi.encodeWithSelector(IAssetManager.recordEarnings.selector)
     );
     _assetEarnings(abi.decode(result, (int256)));
   }
 
+  /**
+   * @dev Function that calls both `recordEarnings()` and `rebalance()` (in that order). Usually scheduled to run once a
+   * day by a keeper or crontask.
+   */
   function checkpoint() external whenNotPaused {
     recordEarnings();
     rebalance();
   }
 
+  /**
+   * @dev This function allows to call custom functions of the asset manager (for example for setting parameters).
+   *      This functions will be called with `delegatecall`, in the context of the reserve.
+   *
+   * Requirements:
+   * - The caller must have been granted of global or component roles LEVEL2_ROLE.
+   *
+   * @param functionCall Abi encoded function call to make.
+   * @return Returns the return value of the function called, to be decoded by the receiver.
+   */
   function forwardToAssetManager(bytes memory functionCall)
     external
     onlyGlobalOrComponentRole(LEVEL2_ROLE)
     returns (bytes memory)
   {
-    address am = address(assetManager());
-    return am.functionDelegateCall(functionCall);
+    return address(assetManager()).functionDelegateCall(functionCall);
   }
+
+  /**
+   * @dev This empty reserved space is put in place to allow future versions to add new
+   * variables without shifting down storage in the inheritance chain.
+   * See https://docs.openzeppelin.com/contracts/4.x/upgradeable#storage_gaps
+   */
+  uint256[50] private __gap;
 }

package/contracts/RiskModule.sol

@@ -1,7 +1,8 @@
 // SPDX-License-Identifier: Apache-2.0
 pragma solidity ^0.8.0;
 
-import {WadRayMath} from "./WadRayMath.sol";
+import {SafeCast} from "@openzeppelin/contracts/utils/math/SafeCast.sol";
+import {WadRayMath} from "./dependencies/WadRayMath.sol";
 import {IPolicyPool} from "./interfaces/IPolicyPool.sol";
 import {PolicyPoolComponent} from "./PolicyPoolComponent.sol";
 import {IRiskModule} from "./interfaces/IRiskModule.sol";
@@ -18,8 +19,15 @@ import {Policy} from "./Policy.sol";
 abstract contract RiskModule is IRiskModule, PolicyPoolComponent {
   using Policy for Policy.PolicyData;
   using WadRayMath for uint256;
+  using SafeCast for uint256;
 
   uint256 internal constant SECONDS_IN_YEAR_WAD = 31536000e18; /* 365 * 24 * 3600 * 10e18 */
+  uint16 internal constant HOURS_PER_YEAR = 8760; /* 24 * 365 */
+
+  uint256 internal constant FOUR_DECIMAL_TO_WAD = 1e14;
+  uint16 internal constant HUNDRED_PERCENT = 1e4;
+  uint16 internal constant MIN_MOC = 5e3;
+  uint16 internal constant MAX_MOC = 4e4;
 
   // For parameters that can be changed by the risk module provider
   bytes32 public constant RM_PROVIDER_ROLE = keccak256("RM_PROVIDER_ROLE");
@@ -78,7 +86,7 @@ abstract contract RiskModule is IRiskModule, PolicyPoolComponent {
     uint256 maxPayoutPerPolicy_,
     uint256 exposureLimit_,
     address wallet_
-  ) internal initializer {
+  ) internal onlyInitializing {
     __PolicyPoolComponent_init();
     __RiskModule_init_unchained(
       name_,
@@ -100,10 +108,10 @@ abstract contract RiskModule is IRiskModule, PolicyPoolComponent {
     uint256 maxPayoutPerPolicy_,
     uint256 exposureLimit_,
     address wallet_
-  ) internal initializer {
+  ) internal onlyInitializing {
     _name = name_;
     _params = PackedParams({
-      moc: 1e4,
+      moc: HUNDRED_PERCENT,
       jrCollRatio: 0,
       collRatio: _wadTo4(collRatio_),
       ensuroPpFee: _wadTo4(ensuroPpFee_),
@@ -112,23 +120,42 @@ abstract contract RiskModule is IRiskModule, PolicyPoolComponent {
       srRoc: _wadTo4(srRoc_),
       maxPayoutPerPolicy: _amountToX(2, maxPayoutPerPolicy_),
       exposureLimit: _amountToX(0, exposureLimit_),
-      maxDuration: 24 * 365 // default = 1 year
+      maxDuration: HOURS_PER_YEAR
     });
     _activeExposure = 0;
     _wallet = wallet_;
     _validateParameters();
   }
 
+  function _upgradeValidations(address newImpl) internal view virtual override {
+    super._upgradeValidations(newImpl);
+    IRiskModule newRM = IRiskModule(newImpl);
+    require(
+      newRM.premiumsAccount() == _premiumsAccount,
+      "Can't upgrade changing the PremiumsAccount"
+    );
+  }
+
+  /**
+   * @dev See {IERC165-supportsInterface}.
+   */
+  function supportsInterface(bytes4 interfaceId) public view virtual override returns (bool) {
+    return super.supportsInterface(interfaceId) || interfaceId == type(IRiskModule).interfaceId;
+  }
+
   // runs validation on RiskModule parameters
   function _validateParameters() internal view override {
-    require(_params.jrCollRatio <= 1e4, "Validation: jrCollRatio must be <=1");
-    require(_params.collRatio <= 1e4 && _params.collRatio > 0, "Validation: collRatio must be <=1");
+    require(_params.jrCollRatio <= HUNDRED_PERCENT, "Validation: jrCollRatio must be <=1");
+    require(
+      _params.collRatio <= HUNDRED_PERCENT && _params.collRatio > 0,
+      "Validation: collRatio must be <=1"
+    );
     require(_params.collRatio >= _params.jrCollRatio, "Validation: collRatio >= jrCollRatio");
-    require(_params.moc <= 4e4 && _params.moc >= 5e3, "Validation: moc must be [0.5, 4]");
-    require(_params.ensuroPpFee <= 1e4, "Validation: ensuroPpFee must be <= 1");
-    require(_params.ensuroCocFee <= 1e4, "Validation: ensuroCocFee must be <= 1");
-    require(_params.srRoc <= 1e4, "Validation: srRoc must be <= 1 (100%)");
-    require(_params.jrRoc <= 1e4, "Validation: jrRoc must be <= 1 (100%)");
+    require(_params.moc <= MAX_MOC && _params.moc >= MIN_MOC, "Validation: moc must be [0.5, 4]");
+    require(_params.ensuroPpFee <= HUNDRED_PERCENT, "Validation: ensuroPpFee must be <= 1");
+    require(_params.ensuroCocFee <= HUNDRED_PERCENT, "Validation: ensuroCocFee must be <= 1");
+    require(_params.srRoc <= HUNDRED_PERCENT, "Validation: srRoc must be <= 1 (100%)");
+    require(_params.jrRoc <= HUNDRED_PERCENT, "Validation: jrRoc must be <= 1 (100%)");
     // _maxPayoutPerPolicy no limits
     require(
       exposureLimit() >= _activeExposure,
@@ -148,12 +175,12 @@ abstract contract RiskModule is IRiskModule, PolicyPoolComponent {
   // solhint-disable-next-line func-name-mixedcase
   function _4toWad(uint16 value) internal pure returns (uint256) {
     // 4 decimals to Wad (18 decimals)
-    return uint256(value) * 1e14;
+    return uint256(value) * FOUR_DECIMAL_TO_WAD;
   }
 
   function _wadTo4(uint256 value) internal pure returns (uint16) {
     // Wad to 4 decimals
-    return uint16(value / 1e14);
+    return (value / FOUR_DECIMAL_TO_WAD).toUint16();
   }
 
   // solhint-disable-next-line func-name-mixedcase
@@ -164,7 +191,7 @@ abstract contract RiskModule is IRiskModule, PolicyPoolComponent {
 
   function _amountToX(uint8 decimals, uint256 value) internal view returns (uint32) {
     // Wad to X decimals
-    return uint32(value / 10**(currency().decimals() - decimals));
+    return (value / 10**(currency().decimals() - decimals)).toUint32();
   }
 
   function maxPayoutPerPolicy() public view override returns (uint256) {
@@ -235,9 +262,7 @@ abstract contract RiskModule is IRiskModule, PolicyPoolComponent {
       _params.exposureLimit = _amountToX(0, newValue);
     } else if (param == Parameter.maxDuration) {
       require(!tweak, "Tweak exceeded");
-      _params.maxDuration = uint16(newValue);
-    } else {
-      revert("Invalid param!");
+      _params.maxDuration = newValue.toUint16();
     }
     _parameterChanged(
       IAccessManager.GovernanceActions(
@@ -262,6 +287,7 @@ abstract contract RiskModule is IRiskModule, PolicyPoolComponent {
   }
 
   function setWallet(address wallet_) external onlyComponentRole(RM_PROVIDER_ROLE) {
+    require(wallet_ != address(0), "RiskModule: wallet cannot be the zero address");
     _wallet = wallet_;
     _parameterChanged(IAccessManager.GovernanceActions.setWallet, uint256(uint160(wallet_)), false);
   }
@@ -329,7 +355,7 @@ abstract contract RiskModule is IRiskModule, PolicyPoolComponent {
       "You must allow ENSURO to transfer the premium"
     );
     require(
-      payer == msg.sender || _policyPool.currency().allowance(payer, msg.sender) >= premium,
+      payer == _msgSender() || _policyPool.currency().allowance(payer, _msgSender()) >= premium,
       "Payer must allow caller to transfer the premium"
     );
     require(payout <= maxPayoutPerPolicy(), "RiskModule: Payout is more than maximum per policy");
@@ -342,7 +368,7 @@ abstract contract RiskModule is IRiskModule, PolicyPoolComponent {
       expiration
     );
     _activeExposure += policy.payout;
-    require(_activeExposure <= exposureLimit(), "RiskModule: SCR limit exceeded");
+    require(_activeExposure <= exposureLimit(), "RiskModule: Exposure limit exceeded");
     uint256 policyId = _policyPool.newPolicy(policy, payer, onBehalfOf, internalId);
     policy.id = policyId;
     return policy;
@@ -358,4 +384,11 @@ abstract contract RiskModule is IRiskModule, PolicyPoolComponent {
   function premiumsAccount() external view override returns (IPremiumsAccount) {
     return _premiumsAccount;
   }
+
+  /**
+   * @dev This empty reserved space is put in place to allow future versions to add new
+   * variables without shifting down storage in the inheritance chain.
+   * See https://docs.openzeppelin.com/contracts/4.x/upgradeable#storage_gaps
+   */
+  uint256[46] private __gap;
 }

package/contracts/SignedQuoteRiskModule.sol

@@ -0,0 +1,310 @@
+// SPDX-License-Identifier: Apache-2.0
+pragma solidity ^0.8.0;
+
+import {ECDSA} from "@openzeppelin/contracts/utils/cryptography/ECDSA.sol";
+import {IPolicyPool} from "./interfaces/IPolicyPool.sol";
+import {IPremiumsAccount} from "./interfaces/IPremiumsAccount.sol";
+import {RiskModule} from "./RiskModule.sol";
+import {Policy} from "./Policy.sol";
+
+/**
+ * @title SignedQuote Risk Module
+ * @dev Risk Module that for policy creation verifies the different components of the price have been signed by a
+        trusted account (PRICER_ROLE). For the resolution (resolvePolicy), it has to be called by an authorized user
+ * @custom:security-contact security@ensuro.co
+ * @author Ensuro
+ */
+contract SignedQuoteRiskModule is RiskModule {
+  bytes32 public constant POLICY_CREATOR_ROLE = keccak256("POLICY_CREATOR_ROLE");
+  bytes32 public constant PRICER_ROLE = keccak256("PRICER_ROLE");
+  bytes32 public constant RESOLVER_ROLE = keccak256("RESOLVER_ROLE");
+
+  /// @custom:oz-upgrades-unsafe-allow state-variable-immutable
+  bool internal immutable _creationIsOpen;
+
+  /**
+   * @dev Event emitted every time a new policy is created. It allows to link the policyData with a particular policy
+   *
+   * @param policyId The id of the policy
+   * @param policyData The value sent in `policyData` parameter that's the hash of the off-chain stored data.
+   */
+  event NewSignedPolicy(uint256 indexed policyId, bytes32 policyData);
+
+  /// @custom:oz-upgrades-unsafe-allow constructor
+  constructor(
+    IPolicyPool policyPool_,
+    IPremiumsAccount premiumsAccount_,
+    bool creationIsOpen_
+  ) RiskModule(policyPool_, premiumsAccount_) {
+    _creationIsOpen = creationIsOpen_;
+  }
+
+  /**
+   * @dev Initializes the RiskModule
+   * @param name_ Name of the Risk Module
+   * @param collRatio_ Collateralization ratio to compute solvency requirement as % of payout (in ray)
+   * @param ensuroPpFee_ % of pure premium that will go for Ensuro treasury (in ray)
+   * @param srRoc_ return on capital paid to Senior LPs (annualized percentage - in ray)
+   * @param maxPayoutPerPolicy_ Maximum payout per policy (in wad)
+   * @param exposureLimit_ Max exposure (sum of payouts) to be allocated to this module (in wad)
+   * @param wallet_ Address of the RiskModule provider
+   */
+  function initialize(
+    string memory name_,
+    uint256 collRatio_,
+    uint256 ensuroPpFee_,
+    uint256 srRoc_,
+    uint256 maxPayoutPerPolicy_,
+    uint256 exposureLimit_,
+    address wallet_
+  ) public initializer {
+    __RiskModule_init(
+      name_,
+      collRatio_,
+      ensuroPpFee_,
+      srRoc_,
+      maxPayoutPerPolicy_,
+      exposureLimit_,
+      wallet_
+    );
+  }
+
+  function _newPolicySigned(
+    uint256 payout,
+    uint256 premium,
+    uint256 lossProb,
+    uint40 expiration,
+    bytes32 policyData,
+    bytes32 quoteSignatureR,
+    bytes32 quoteSignatureVS,
+    uint40 quoteValidUntil,
+    address payer,
+    address onBehalfOf
+  ) internal returns (Policy.PolicyData memory createdPolicy) {
+    if (!_creationIsOpen)
+      _policyPool.access().checkComponentRole(
+        address(this),
+        POLICY_CREATOR_ROLE,
+        _msgSender(),
+        false
+      );
+    require(quoteValidUntil >= block.timestamp, "Quote expired");
+
+    /**
+     * Checks the quote has been signed by an authorized user
+     * The "quote" is computed as hash of the following fields (encodePacked):
+     * - address(this): the address of this RiskModule
+     * - payout, premium, lossProb, expiration: the base parameters of the policy
+     * - policyData: a hash of the private details of the policy. The calculation should include some
+     *   unique id (quoteId), so each policyData identifies a policy.
+     * - quoteValidUntil: the maximum validity of the quote
+     */
+    bytes32 quoteHash = ECDSA.toEthSignedMessageHash(
+      abi.encodePacked(
+        address(this),
+        payout,
+        premium,
+        lossProb,
+        expiration,
+        policyData,
+        quoteValidUntil
+      )
+    );
+    address signer = ECDSA.recover(quoteHash, quoteSignatureR, quoteSignatureVS);
+    _policyPool.access().checkComponentRole(address(this), PRICER_ROLE, signer, false);
+    uint96 internalId = uint96(uint256(policyData) % 2**96);
+
+    createdPolicy = _newPolicy(
+      payout,
+      premium,
+      lossProb,
+      expiration,
+      payer,
+      onBehalfOf,
+      internalId
+    );
+    emit NewSignedPolicy(createdPolicy.id, policyData);
+    return createdPolicy;
+  }
+
+  /**
+   * @dev Creates a new Policy using a signed quote. The caller is the payer of the policy. Returns all the struct, not just the id.
+   *
+   * Requirements:
+   * - The caller approved the spending of the premium to the PolicyPool
+   * - The quote has been signed by an address with the component role PRICER_ROLE
+   *
+   *  Emits:
+   * - {PolicyPool.NewPolicy}
+   *  - {NewSignedPolicy}
+   *
+   * @param payout The exposure (maximum payout) of the policy
+   * @param premium The premium that will be paid by the payer
+   * @param lossProb The probability of having to pay the maximum payout (wad)
+   * @param expiration The expiration of the policy (timestamp)
+   * @param onBehalfOf The policy holder
+   * @param policyData A hash of the private details of the policy. The last 96 bits will be used as internalId
+   * @param quoteSignatureR The signature of the quote. R component (EIP-2098 signature)
+   * @param quoteSignatureVS The signature of the quote. VS component (EIP-2098 signature)
+   * @param quoteValidUntil The expiration of the quote
+   * @return createdPolicy Returns the created policy
+   */
+  function newPolicyFull(
+    uint256 payout,
+    uint256 premium,
+    uint256 lossProb,
+    uint40 expiration,
+    address onBehalfOf,
+    bytes32 policyData,
+    bytes32 quoteSignatureR,
+    bytes32 quoteSignatureVS,
+    uint40 quoteValidUntil
+  ) external returns (Policy.PolicyData memory createdPolicy) {
+    return
+      _newPolicySigned(
+        payout,
+        premium,
+        lossProb,
+        expiration,
+        policyData,
+        quoteSignatureR,
+        quoteSignatureVS,
+        quoteValidUntil,
+        _msgSender(),
+        onBehalfOf
+      );
+  }
+
+  /**
+   * @dev Creates a new Policy using a signed quote. The caller is the payer of the policy.
+   *
+   * Requirements:
+   * - The caller approved the spending of the premium to the PolicyPool
+   * - The quote has been signed by an address with the component role PRICER_ROLE
+   *
+   * Emits:
+   * - {PolicyPool.NewPolicy}
+   * - {NewSignedPolicy}
+   *
+   * @param payout The exposure (maximum payout) of the policy
+   * @param premium The premium that will be paid by the payer
+   * @param lossProb The probability of having to pay the maximum payout (wad)
+   * @param expiration The expiration of the policy (timestamp)
+   * @param onBehalfOf The policy holder
+   * @param policyData A hash of the private details of the policy. The last 96 bits will be used as internalId
+   * @param quoteSignatureR The signature of the quote. R component (EIP-2098 signature)
+   * @param quoteSignatureVS The signature of the quote. VS component (EIP-2098 signature)
+   * @param quoteValidUntil The expiration of the quote
+   * @return Returns the id of the created policy
+   */
+  function newPolicy(
+    uint256 payout,
+    uint256 premium,
+    uint256 lossProb,
+    uint40 expiration,
+    address onBehalfOf,
+    bytes32 policyData,
+    bytes32 quoteSignatureR,
+    bytes32 quoteSignatureVS,
+    uint40 quoteValidUntil
+  ) external returns (uint256) {
+    return
+      _newPolicySigned(
+        payout,
+        premium,
+        lossProb,
+        expiration,
+        policyData,
+        quoteSignatureR,
+        quoteSignatureVS,
+        quoteValidUntil,
+        _msgSender(),
+        onBehalfOf
+      ).id;
+  }
+
+  /**
+   * @dev Creates a new Policy using a signed quote. The payer is the policy holder
+   *
+   * Requirements:
+   * - currency().allowance(onBehalfOf, _msgSender()) > 0
+   * - The quote has been signed by an address with the component role PRICER_ROLE
+   *
+   * Emits:
+   * - {PolicyPool.NewPolicy}
+   * - {NewSignedPolicy}
+   *
+   * @param payout The exposure (maximum payout) of the policy
+   * @param premium The premium that will be paid by the payer
+   * @param lossProb The probability of having to pay the maximum payout (wad)
+   * @param expiration The expiration of the policy (timestamp)
+   * @param onBehalfOf The policy holder
+   * @param policyData A hash of the private details of the policy. The last 96 bits will be used as internalId
+   * @param quoteSignatureR The signature of the quote. R component (EIP-2098 signature)
+   * @param quoteSignatureVS The signature of the quote. VS component (EIP-2098 signature)
+   * @param quoteValidUntil The expiration of the quote
+   * @return Returns the id of the created policy
+   */
+  function newPolicyPaidByHolder(
+    uint256 payout,
+    uint256 premium,
+    uint256 lossProb,
+    uint40 expiration,
+    address onBehalfOf,
+    bytes32 policyData,
+    bytes32 quoteSignatureR,
+    bytes32 quoteSignatureVS,
+    uint40 quoteValidUntil
+  ) external returns (uint256) {
+    require(
+      onBehalfOf == _msgSender() || currency().allowance(onBehalfOf, _msgSender()) > 0,
+      "Sender is not authorized to create policies onBehalfOf"
+    );
+    /**
+     * The standard is the payer should be the _msgSender() but usually, in this type of module,
+     * the sender is an operative account managed by software, where the onBehalfOf is a more
+     * secure account (hardware wallet) that does the cash movements.
+     * This non standard behaviour allows for a more secure setup, where the sender never manages
+     * cash.
+     * We leverage the currency's allowance mechanism to allow the sender access to the payer's
+     * funds.
+     * Note that this allowance won't be spent, so anything above 0 is accepted.
+     */
+    return
+      _newPolicySigned(
+        payout,
+        premium,
+        lossProb,
+        expiration,
+        policyData,
+        quoteSignatureR,
+        quoteSignatureVS,
+        quoteValidUntil,
+        onBehalfOf,
+        onBehalfOf
+      ).id;
+  }
+
+  function resolvePolicy(Policy.PolicyData calldata policy, uint256 payout)
+    external
+    onlyComponentRole(RESOLVER_ROLE)
+    whenNotPaused
+  {
+    _policyPool.resolvePolicy(policy, payout);
+  }
+
+  function resolvePolicyFullPayout(Policy.PolicyData calldata policy, bool customerWon)
+    external
+    onlyComponentRole(RESOLVER_ROLE)
+    whenNotPaused
+  {
+    _policyPool.resolvePolicyFullPayout(policy, customerWon);
+  }
+
+  /**
+   * @dev This empty reserved space is put in place to allow future versions to add new
+   * variables without shifting down storage in the inheritance chain.
+   * See https://docs.openzeppelin.com/contracts/4.x/upgradeable#storage_gaps
+   */
+  uint256[50] private __gap;
+}