@ensuro/core 2.0.0-beta9 → 2.0.0

package/contracts/AccessManager.sol

@@ -9,6 +9,16 @@ import {IAccessManager} from "./interfaces/IAccessManager.sol";
 /**
  * @title AccessManager - Protocol access roles
  * @dev Contract that holds the access roles for PolicyPool and other components of the protocol.
+ *
+ * [CAUTION]
+ * ====
+ * Avoid leaving a this contract without DEFAULT_ADMIN_ROLE.
+ *
+ * This contract includes the methods `revokeRole()` and `renounceRole()` that allow to revoke or renounce to
+ * specific roles. Even when there are valid reasons to leave these methods (for example revoking the initial
+ * DEFAULT_ADMIN_ROLE of the deployer account to leave just the governance account), it's good to mention these
+ * methods have to be used with care, avoiding leaving the contract without any default admin.
+ *
  * @custom:security-contact security@ensuro.co
  * @author Ensuro
  */
@@ -24,6 +34,11 @@ contract AccessManager is Initializable, AccessControlUpgradeable, UUPSUpgradeab
     _;
   }
 
+  /// @custom:oz-upgrades-unsafe-allow constructor
+  constructor() {
+    _disableInitializers();
+  }
+
   function initialize() public initializer {
     __AccessControl_init();
     __UUPSUpgradeable_init();
@@ -31,13 +46,20 @@ contract AccessManager is Initializable, AccessControlUpgradeable, UUPSUpgradeab
   }
 
   // solhint-disable-next-line func-name-mixedcase
-  function __AccessManager_init_unchained() internal initializer {
+  function __AccessManager_init_unchained() internal onlyInitializing {
     _setupRole(DEFAULT_ADMIN_ROLE, _msgSender());
   }
 
   // solhint-disable-next-line no-empty-blocks
   function _authorizeUpgrade(address) internal override onlyRole2(GUARDIAN_ROLE, LEVEL1_ROLE) {}
 
+  /**
+   * @dev See {IERC165-supportsInterface}.
+   */
+  function supportsInterface(bytes4 interfaceId) public view virtual override returns (bool) {
+    return super.supportsInterface(interfaceId) || interfaceId == type(IAccessManager).interfaceId;
+  }
+
   function getComponentRole(address component, bytes32 role)
     public
     pure
@@ -100,4 +122,11 @@ contract AccessManager is Initializable, AccessControlUpgradeable, UUPSUpgradeab
   ) external onlyRole(getRoleAdmin(getComponentRole(component, role))) {
     _grantRole(getComponentRole(component, role), account);
   }
+
+  /**
+   * @dev This empty reserved space is put in place to allow future versions to add new
+   * variables without shifting down storage in the inheritance chain.
+   * See https://docs.openzeppelin.com/contracts/4.x/upgradeable#storage_gaps
+   */
+  uint256[50] private __gap;
 }

package/contracts/ERC4626AssetManager.sol

@@ -11,6 +11,8 @@ import {LiquidityThresholdAssetManager} from "./LiquidityThresholdAssetManager.s
  * @dev Using liquidity thresholds defined in {LiquidityThresholdAssetManager}, deploys the funds into an ERC4626 vault.
  * @custom:security-contact security@ensuro.co
  * @author Ensuro
+ *
+ * @notice This contracts uses Diamond Storage and should not define state variables outside of that. See the diamondStorage method for more details.
  */
 contract ERC4626AssetManager is LiquidityThresholdAssetManager {
   using SafeCast for uint256;
@@ -18,6 +20,7 @@ contract ERC4626AssetManager is LiquidityThresholdAssetManager {
   IERC4626 internal immutable _vault;
 
   constructor(IERC20Metadata asset_, IERC4626 vault_) LiquidityThresholdAssetManager(asset_) {
+    require(address(vault_) != address(0), "ERC4626AssetManager: vault cannot be zero address");
     _vault = vault_;
   }
 

package/contracts/EToken.sol

@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: Apache-2.0
 pragma solidity ^0.8.0;
 
+import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
 import {IERC20Metadata} from "@openzeppelin/contracts/token/ERC20/extensions/IERC20Metadata.sol";
 import {SafeERC20} from "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";
 import {SafeCast} from "@openzeppelin/contracts/utils/math/SafeCast.sol";
@@ -31,6 +32,13 @@ contract EToken is Reserve, IERC20Metadata, IEToken {
   using SafeERC20 for IERC20Metadata;
   using SafeCast for uint256;
 
+  uint256 internal constant FOUR_DECIMAL_TO_WAD = 1e14;
+  uint16 internal constant HUNDRED_PERCENT = 1e4;
+  uint16 internal constant MAX_UR_MIN = 5e3; // 50% - Minimum value for Max Utilization Rate
+  uint16 internal constant LIQ_REQ_MIN = 8e3; // 80%
+  uint16 internal constant LIQ_REQ_MAX = 13e3; // 130%
+  uint16 internal constant INT_LOAN_IR_MAX = 5e3; // 50% - Maximum value for InternalLoan interest rate
+
   // Attributes taken from ERC20
   mapping(address => uint256) private _balances;
   mapping(address => mapping(address => uint256)) private _allowances;
@@ -90,7 +98,7 @@ contract EToken is Reserve, IERC20Metadata, IEToken {
     uint256 maxUtilizationRate_,
     uint256 internalLoanInterestRate_
   ) public initializer {
-    __PolicyPoolComponent_init();
+    __Reserve_init();
     __EToken_init_unchained(name_, symbol_, maxUtilizationRate_, internalLoanInterestRate_);
   }
 
@@ -100,7 +108,9 @@ contract EToken is Reserve, IERC20Metadata, IEToken {
     string memory symbol_,
     uint256 maxUtilizationRate_,
     uint256 internalLoanInterestRate_
-  ) internal initializer {
+  ) internal onlyInitializing {
+    require(bytes(name_).length > 0, "EToken: name cannot be empty");
+    require(bytes(symbol_).length > 0, "EToken: symbol cannot be empty");
     _name = name_;
     _symbol = symbol_;
     _tsScaled.init();
@@ -111,7 +121,7 @@ contract EToken is Reserve, IERC20Metadata, IEToken {
     }); */
     _params = PackedParams({
       maxUtilizationRate: _wadTo4(maxUtilizationRate_),
-      liquidityRequirement: 1e4,
+      liquidityRequirement: HUNDRED_PERCENT,
       minUtilizationRate: 0,
       internalLoanInterestRate: _wadTo4(internalLoanInterestRate_),
       whitelist: ILPWhitelist(address(0))
@@ -120,19 +130,42 @@ contract EToken is Reserve, IERC20Metadata, IEToken {
     _validateParameters();
   }
 
+  /**
+   * @dev See {IERC165-supportsInterface}.
+   */
+  function supportsInterface(bytes4 interfaceId) public view virtual override returns (bool) {
+    return
+      super.supportsInterface(interfaceId) ||
+      interfaceId == type(IERC20).interfaceId ||
+      interfaceId == type(IERC20Metadata).interfaceId ||
+      interfaceId == type(IEToken).interfaceId;
+  }
+
   // runs validation on EToken parameters
   function _validateParameters() internal view override {
     require(
-      _params.liquidityRequirement >= 8e3 && _params.liquidityRequirement <= 13e3,
+      _params.liquidityRequirement >= LIQ_REQ_MIN && _params.liquidityRequirement <= LIQ_REQ_MAX,
       "Validation: liquidityRequirement must be [0.8, 1.3]"
     );
     require(
-      _params.maxUtilizationRate >= 5e3 && _params.maxUtilizationRate <= 1e4,
+      _params.maxUtilizationRate >= MAX_UR_MIN && _params.maxUtilizationRate <= HUNDRED_PERCENT,
       "Validation: maxUtilizationRate must be [0.5, 1]"
     );
-    require(_params.minUtilizationRate <= 1e4, "Validation: minUtilizationRate must be [0, 1]");
     require(
-      _params.internalLoanInterestRate <= 5e3,
+      _params.minUtilizationRate <= HUNDRED_PERCENT,
+      "Validation: minUtilizationRate must be [0, 1]"
+    );
+    /*
+     * We don't validate minUtilizationRate < maxUtilizationRate because the opposite is valid too.
+     * These limits aren't strong limits on the values the utilization rate can take, but instead they are
+     * limits on specific operations.
+     * `minUtilizationRate` is used to avoid new deposits to dilute the yields of existing LPs, but it doesn't
+     * prevent the UR from going down in other operations (`unlockScr` for example).
+     * `maxUtilizationRate` is used to prevent selling more coverage when UR is too high, only checked on `lockScr`
+     * operations, but not in withdrawals or other operations.
+     */
+    require(
+      _params.internalLoanInterestRate <= INT_LOAN_IR_MAX,
       "Validation: internalLoanInterestRate must be <= 50%"
     );
   }
@@ -243,15 +276,34 @@ contract EToken is Reserve, IERC20Metadata, IEToken {
     address recipient,
     uint256 amount
   ) public virtual override returns (bool) {
+    address spender = _msgSender();
+    _spendAllowance(sender, spender, amount);
     _transfer(sender, recipient, amount);
-
-    uint256 currentAllowance = _allowances[sender][_msgSender()];
-    require(currentAllowance >= amount, "EToken: transfer amount exceeds allowance");
-    _approve(sender, _msgSender(), currentAllowance - amount);
-
     return true;
   }
 
+  /**
+   * @dev Updates `owner` s allowance for `spender` based on spent `amount`.
+   *
+   * Does not update the allowance amount in case of infinite allowance.
+   * Revert if not enough allowance is available.
+   *
+   * Might emit an {Approval} event.
+   */
+  function _spendAllowance(
+    address owner,
+    address spender,
+    uint256 amount
+  ) internal virtual {
+    uint256 currentAllowance = allowance(owner, spender);
+    if (currentAllowance != type(uint256).max) {
+      require(currentAllowance >= amount, "EToken: insufficient allowance");
+      unchecked {
+        _approve(owner, spender, currentAllowance - amount);
+      }
+    }
+  }
+
   /**
    * @dev Atomically increases the allowance granted to `spender` by the caller.
    *
@@ -265,7 +317,7 @@ contract EToken is Reserve, IERC20Metadata, IEToken {
    * - `spender` cannot be the zero address.
    */
   function increaseAllowance(address spender, uint256 addedValue) public virtual returns (bool) {
-    _approve(_msgSender(), spender, _allowances[_msgSender()][spender] + addedValue);
+    _approve(_msgSender(), spender, allowance(_msgSender(), spender) + addedValue);
     return true;
   }
 
@@ -339,6 +391,7 @@ contract EToken is Reserve, IERC20Metadata, IEToken {
    */
   function _mint(address account, uint256 amount) internal virtual {
     require(account != address(0), "EToken: mint to the zero address");
+    require(amount > 0, "EToken: amount to mint should be greater than zero");
 
     _beforeTokenTransfer(address(0), account, amount);
     uint256 scaledAmount = _tsScaled.add(amount, tokenInterestRate());
@@ -464,12 +517,12 @@ contract EToken is Reserve, IERC20Metadata, IEToken {
   // solhint-disable-next-line func-name-mixedcase
   function _4toWad(uint16 value) internal pure returns (uint256) {
     // 4 decimals to Wad (18 decimals)
-    return uint256(value) * 1e14;
+    return uint256(value) * FOUR_DECIMAL_TO_WAD;
   }
 
   function _wadTo4(uint256 value) internal pure returns (uint16) {
     // Wad to 4 decimals
-    return (value / 1e14).toUint16();
+    return (value / FOUR_DECIMAL_TO_WAD).toUint16();
   }
 
   function scr() public view virtual override returns (uint256) {
@@ -508,7 +561,7 @@ contract EToken is Reserve, IERC20Metadata, IEToken {
   {
     require(
       scrAmount <= this.fundsAvailableToLock(),
-      "Not enought funds available to cover the SCR"
+      "Not enough funds available to cover the SCR"
     );
     _tsScaled.updateScale(tokenInterestRate());
     if (_scr.scr == 0) {
@@ -529,7 +582,7 @@ contract EToken is Reserve, IERC20Metadata, IEToken {
     uint256 scrAmount,
     uint256 policyInterestRate,
     int256 adjustment
-  ) external override onlyBorrower {
+  ) external override onlyBorrower whenNotPaused {
     require(scrAmount <= uint256(_scr.scr), "Current SCR less than the amount you want to unlock");
     _tsScaled.updateScale(tokenInterestRate());
 
@@ -586,6 +639,12 @@ contract EToken is Reserve, IERC20Metadata, IEToken {
     onlyPolicyPool
     returns (uint256)
   {
+    /**
+     * Here we don't check for maxUtilizationRate because that limit only affects locking more capital (`lockScr`), but
+     * doesn't affects the right of liquidity providers to withdraw their funds.
+     * The only limit for withdraws is the `totalWithdrawable()` function, that's affected by the relation between the
+     * scr and the totalSupply.
+     */
     amount = Math.min(amount, Math.min(balanceOf(provider), totalWithdrawable()));
     if (amount == 0) return 0;
     _burn(provider, amount);
@@ -595,6 +654,7 @@ contract EToken is Reserve, IERC20Metadata, IEToken {
   }
 
   function addBorrower(address borrower) external override onlyPolicyPool {
+    require(borrower != address(0), "EToken: Borrower cannot be the zero address");
     TimeScaled.ScaledAmount storage loan = _loans[borrower];
     if (loan.scale == 0) {
       loan.init();
@@ -603,6 +663,7 @@ contract EToken is Reserve, IERC20Metadata, IEToken {
   }
 
   function removeBorrower(address borrower) external override onlyPolicyPool {
+    require(borrower != address(0), "EToken: Borrower cannot be the zero address");
     uint256 defaultedDebt = getLoan(borrower);
     delete _loans[borrower];
     emit InternalBorrowerRemoved(borrower, defaultedDebt);
@@ -627,14 +688,16 @@ contract EToken is Reserve, IERC20Metadata, IEToken {
     return amountAsked - amount;
   }
 
-  function repayLoan(uint256 amount, address onBehalfOf) external override {
+  function repayLoan(uint256 amount, address onBehalfOf) external override whenNotPaused {
+    require(amount > 0, "EToken: amount should be greater than zero.");
     // Anyone can call this method, since it has to pay
-    currency().safeTransferFrom(_msgSender(), address(this), amount);
     TimeScaled.ScaledAmount storage loan = _loans[onBehalfOf];
     require(loan.scale != 0, "Not a registered borrower");
     loan.sub(amount, internalLoanInterestRate());
     _discreteChange(int256(amount));
     emit InternalLoanRepaid(onBehalfOf, amount);
+    // Interaction at the end for security reasons
+    currency().safeTransferFrom(_msgSender(), address(this), amount);
   }
 
   function getLoan(address borrower) public view virtual override returns (uint256) {
@@ -705,4 +768,11 @@ contract EToken is Reserve, IERC20Metadata, IEToken {
   function whitelist() external view returns (ILPWhitelist) {
     return _params.whitelist;
   }
+
+  /**
+   * @dev This empty reserved space is put in place to allow future versions to add new
+   * variables without shifting down storage in the inheritance chain.
+   * See https://docs.openzeppelin.com/contracts/4.x/upgradeable#storage_gaps
+   */
+  uint256[41] private __gap;
 }

package/contracts/LPManualWhitelist.sol

@@ -34,8 +34,17 @@ contract LPManualWhitelist is ILPWhitelist, PolicyPoolComponent {
     external
     onlyComponentRole(LP_WHITELIST_ROLE)
   {
-    _whitelisted[provider] = whitelisted;
-    emit LPWhitelisted(provider, whitelisted);
+    if (_whitelisted[provider] != whitelisted) {
+      _whitelisted[provider] = whitelisted;
+      emit LPWhitelisted(provider, whitelisted);
+    }
+  }
+
+  /**
+   * @dev See {IERC165-supportsInterface}.
+   */
+  function supportsInterface(bytes4 interfaceId) public view virtual override returns (bool) {
+    return super.supportsInterface(interfaceId) || interfaceId == type(ILPWhitelist).interfaceId;
   }
 
   function acceptsDeposit(
@@ -54,4 +63,11 @@ contract LPManualWhitelist is ILPWhitelist, PolicyPoolComponent {
   ) external view override returns (bool) {
     return _whitelisted[providerTo];
   }
+
+  /**
+   * @dev This empty reserved space is put in place to allow future versions to add new
+   * variables without shifting down storage in the inheritance chain.
+   * See https://docs.openzeppelin.com/contracts/4.x/upgradeable#storage_gaps
+   */
+  uint256[49] private __gap;
 }

package/contracts/LiquidityThresholdAssetManager.sol

@@ -3,6 +3,7 @@ pragma solidity ^0.8.0;
 
 import {SafeCast} from "@openzeppelin/contracts/utils/math/SafeCast.sol";
 import {IERC20Metadata} from "@openzeppelin/contracts/token/ERC20/extensions/IERC20Metadata.sol";
+import {IERC165} from "@openzeppelin/contracts/utils/introspection/IERC165.sol";
 import {IPolicyPoolComponent} from "./interfaces/IPolicyPoolComponent.sol";
 import {IAssetManager} from "./interfaces/IAssetManager.sol";
 import {IAccessManager} from "./interfaces/IAccessManager.sol";
@@ -17,6 +18,8 @@ import {Math} from "@openzeppelin/contracts/utils/math/Math.sol";
  *      cash at liquidityMiddle.
  * @custom:security-contact security@ensuro.co
  * @author Ensuro
+ *
+ * @notice This contracts uses Diamond Storage and should not define state variables outside of that. See the diamondStorage method for more details.
  */
 abstract contract LiquidityThresholdAssetManager is IAssetManager {
   using SafeCast for uint256;
@@ -37,6 +40,10 @@ abstract contract LiquidityThresholdAssetManager is IAssetManager {
   }
 
   constructor(IERC20Metadata asset_) {
+    require(
+      address(asset_) != address(0),
+      "LiquidityThresholdAssetManager: asset cannot be zero address"
+    );
     _asset = asset_;
   }
 
@@ -96,8 +103,8 @@ abstract contract LiquidityThresholdAssetManager is IAssetManager {
   }
 
   /**
-   * @dev This is called from PolicyPool when doesn't have enought money for payment.
-   *      After the call, there should be enought money in PolicyPool.currency().balanceOf(this) to
+   * @dev This is called from PolicyPool when doesn't have enough money for payment.
+   *      After the call, there should be enough money in PolicyPool.currency().balanceOf(this) to
    *      do the payment
    * @param paymentAmount The amount of the payment
    */
@@ -157,4 +164,12 @@ abstract contract LiquidityThresholdAssetManager is IAssetManager {
       emit GovernanceAction(IAccessManager.GovernanceActions.setLiquidityMax, max);
     }
   }
+
+  /**
+   * @dev See {IERC165-supportsInterface}.
+   */
+  function supportsInterface(bytes4 interfaceId) public view virtual override returns (bool) {
+    return
+      interfaceId == type(IERC165).interfaceId || interfaceId == type(IAssetManager).interfaceId;
+  }
 }

package/contracts/Policy.sol

@@ -102,7 +102,9 @@ library Policy {
     return (policy.srCoc * (block.timestamp - policy.start)) / (policy.expiration - policy.start);
   }
 
-  function hash(PolicyData memory policy) internal pure returns (bytes32) {
-    return keccak256(abi.encode(policy));
+  function hash(PolicyData memory policy) internal pure returns (bytes32 retHash) {
+    retHash = keccak256(abi.encode(policy));
+    require(retHash != bytes32(0), "Policy: hash cannot be 0");
+    return retHash;
   }
 }

package/contracts/PolicyPool.sol

@@ -166,7 +166,7 @@ contract PolicyPool is IPolicyPool, PausableUpgradeable, UUPSUpgradeable, ERC721
   }
 
   /**
-   * @dev Modifier that checks the caller has any of the given rolea
+   * @dev Modifier that checks the caller has any of the given roles
    */
   modifier onlyRole2(bytes32 role1, bytes32 role2) {
     _access.checkRole2(role1, role2, _msgSender());
@@ -182,6 +182,9 @@ contract PolicyPool is IPolicyPool, PausableUpgradeable, UUPSUpgradeable, ERC721
    */
   /// @custom:oz-upgrades-unsafe-allow constructor
   constructor(IAccessManager access_, IERC20Metadata currency_) {
+    require(address(access_) != address(0), "PolicyPool: access cannot be zero address");
+    require(address(currency_) != address(0), "PolicyPool: currency cannot be zero address");
+    _disableInitializers();
     _access = access_;
     _currency = currency_;
   }
@@ -198,19 +201,36 @@ contract PolicyPool is IPolicyPool, PausableUpgradeable, UUPSUpgradeable, ERC721
     string memory symbol_,
     address treasury_
   ) public initializer {
+    require(bytes(name_).length > 0, "PolicyPool: name cannot be empty");
+    require(bytes(symbol_).length > 0, "PolicyPool: symbol cannot be empty");
     __UUPSUpgradeable_init();
     __ERC721_init(name_, symbol_);
     __Pausable_init();
     __PolicyPool_init_unchained(treasury_);
   }
 
+  /**
+   * @dev See {IERC165-supportsInterface}.
+   */
+  function supportsInterface(bytes4 interfaceId) public view virtual override returns (bool) {
+    return super.supportsInterface(interfaceId) || interfaceId == type(IPolicyPool).interfaceId;
+  }
+
   // solhint-disable-next-line func-name-mixedcase
-  function __PolicyPool_init_unchained(address treasury_) internal initializer {
-    _treasury = treasury_;
+  function __PolicyPool_init_unchained(address treasury_) internal onlyInitializing {
+    _setTreasury(treasury_);
   }
 
-  // solhint-disable-next-line no-empty-blocks
-  function _authorizeUpgrade(address) internal override onlyRole2(GUARDIAN_ROLE, LEVEL1_ROLE) {}
+  function _authorizeUpgrade(address newImpl)
+    internal
+    view
+    override
+    onlyRole2(GUARDIAN_ROLE, LEVEL1_ROLE)
+  {
+    IPolicyPool newPool = IPolicyPool(newImpl);
+    require(newPool.access() == _access, "Can't upgrade changing the access manager");
+    require(newPool.currency() == _currency, "Can't upgrade changing the currency");
+  }
 
   /**
    * @dev Pauses the contract. When the contract is paused, several operations are rejected: deposits, withdrawals, new
@@ -241,6 +261,12 @@ contract PolicyPool is IPolicyPool, PausableUpgradeable, UUPSUpgradeable, ERC721
     return _currency;
   }
 
+  function _setTreasury(address treasury_) internal {
+    require(treasury_ != address(0), "PolicyPool: treasury cannot be the zero address");
+    _treasury = treasury_;
+    emit ComponentChanged(IAccessManager.GovernanceActions.setTreasury, _treasury);
+  }
+
   /**
    * @dev Changes the address of the treasury, the one that receives the protocol fees.
    *
@@ -251,8 +277,7 @@ contract PolicyPool is IPolicyPool, PausableUpgradeable, UUPSUpgradeable, ERC721
    * - Emits {ComponentChanged} with action = setTreasury and the address of the new treasury.
    */
   function setTreasury(address treasury_) external onlyRole(LEVEL1_ROLE) {
-    _treasury = treasury_;
-    emit ComponentChanged(IAccessManager.GovernanceActions.setTreasury, _treasury);
+    _setTreasury(treasury_);
   }
 
   /**
@@ -285,6 +310,15 @@ contract PolicyPool is IPolicyPool, PausableUpgradeable, UUPSUpgradeable, ERC721
     require(comp.status == ComponentStatus.inactive, "Component already in the pool");
     require(component.policyPool() == this, "Component not linked to this pool");
 
+    require(
+      (kind == ComponentKind.eToken && component.supportsInterface(type(IEToken).interfaceId)) ||
+        (kind == ComponentKind.premiumsAccount &&
+          component.supportsInterface(type(IPremiumsAccount).interfaceId)) ||
+        (kind == ComponentKind.riskModule &&
+          component.supportsInterface(type(IRiskModule).interfaceId)),
+      "PolicyPool: Not the right kind"
+    );
+
     comp.status = ComponentStatus.active;
     comp.kind = kind;
     if (kind == ComponentKind.premiumsAccount) {
@@ -406,8 +440,9 @@ contract PolicyPool is IPolicyPool, PausableUpgradeable, UUPSUpgradeable, ERC721
 
   function deposit(IEToken eToken, uint256 amount) external override whenNotPaused {
     require(_etkStatus(eToken) == ComponentStatus.active, "eToken is not active");
+    uint256 balanceBefore = _currency.balanceOf(address(eToken));
     _currency.safeTransferFrom(_msgSender(), address(eToken), amount);
-    eToken.deposit(_msgSender(), amount);
+    eToken.deposit(_msgSender(), _currency.balanceOf(address(eToken)) - balanceBefore);
   }
 
   function withdraw(IEToken eToken, uint256 amount)
@@ -431,15 +466,20 @@ contract PolicyPool is IPolicyPool, PausableUpgradeable, UUPSUpgradeable, ERC721
     address policyHolder,
     uint96 internalId
   ) external override whenNotPaused returns (uint256) {
+    // Checks
     IRiskModule rm = policy.riskModule;
     require(address(rm) == _msgSender(), "Only the RM can create new policies");
     require(_rmStatus(rm) == ComponentStatus.active, "RM module not found or not active");
-    policy.id = (uint256(uint160(address(rm))) << 96) + internalId;
-    _policies[policy.id] = policy.hash();
     IPremiumsAccount pa = rm.premiumsAccount();
     require(_paStatus(pa) == ComponentStatus.active, "PremiumsAccount not found or not active");
+
+    // Effects
+    policy.id = (uint256(uint160(address(rm))) << 96) + internalId;
+    require(_policies[policy.id] == bytes32(0), "Policy already exists");
+    _policies[policy.id] = policy.hash();
+
+    // Interactions
     pa.policyCreated(policy);
-    _safeMint(policyHolder, policy.id, "");
 
     // Distribute the premium
     _currency.safeTransferFrom(payer, address(pa), policy.purePremium);
@@ -448,7 +488,12 @@ contract PolicyPool is IPolicyPool, PausableUpgradeable, UUPSUpgradeable, ERC721
     _currency.safeTransferFrom(payer, _treasury, policy.ensuroCommission);
     if (policy.partnerCommission > 0 && payer != rm.wallet())
       _currency.safeTransferFrom(payer, rm.wallet(), policy.partnerCommission);
-    // TODO: this code does up to 5 ERC20 transfers. How we can avoid this? Delayed transfers?
+    /**
+     * This code does up to 5 ERC20 transfers. This can be avoided to reduce the gas cost, by implementing delayed
+     * transfers. This might be considered in the future, but to avoid increasing the complexity and since so far we
+     * operate on low gas-cost blockchains, we keep it as it is.
+     */
+    _safeMint(policyHolder, policy.id, "");
 
     emit NewPolicy(rm, policy);
     return policy.id;
@@ -483,6 +528,10 @@ contract PolicyPool is IPolicyPool, PausableUpgradeable, UUPSUpgradeable, ERC721
     return _policies[policyId] != bytes32(0);
   }
 
+  function getPolicyHash(uint256 policyId) external view override returns (bytes32) {
+    return _policies[policyId];
+  }
+
   /**
    * @dev Internal function that handles the different alternative resolutions for a policy, with or without payout and
    * expiration.
@@ -499,6 +548,7 @@ contract PolicyPool is IPolicyPool, PausableUpgradeable, UUPSUpgradeable, ERC721
     uint256 payout,
     bool expired
   ) internal {
+    // Checks
     _validatePolicy(policy);
     IRiskModule rm = policy.riskModule;
     require(expired || address(rm) == _msgSender(), "Only the RM can resolve policies");
@@ -518,6 +568,9 @@ contract PolicyPool is IPolicyPool, PausableUpgradeable, UUPSUpgradeable, ERC721
       compStatus == ComponentStatus.active || compStatus == ComponentStatus.deprecated,
       "PremiumsAccount must be active or deprecated to process resolutions"
     );
+    // Effects
+    delete _policies[policy.id];
+    // Interactions
     if (customerWon) {
       address policyOwner = ownerOf(policy.id);
       pa.policyResolvedWithPayout(policyOwner, policy, payout);
@@ -528,7 +581,6 @@ contract PolicyPool is IPolicyPool, PausableUpgradeable, UUPSUpgradeable, ERC721
     rm.releaseExposure(policy.payout);
 
     emit PolicyResolved(policy.riskModule, policy.id, payout);
-    delete _policies[policy.id];
     if (payout > 0) {
       _notifyPayout(policy.id, payout);
     } else {
@@ -584,4 +636,11 @@ contract PolicyPool is IPolicyPool, PausableUpgradeable, UUPSUpgradeable, ERC721
   ) internal override whenNotPaused {
     super._beforeTokenTransfer(from, to, tokenId);
   }
+
+  /**
+   * @dev This empty reserved space is put in place to allow future versions to add new
+   * variables without shifting down storage in the inheritance chain.
+   * See https://docs.openzeppelin.com/contracts/4.x/upgradeable#storage_gaps
+   */
+  uint256[47] private __gap;
 }