@ensuro/core 2.0.0-beta9 → 2.0.1

package/contracts/PolicyPoolComponent.sol

@@ -3,6 +3,7 @@ pragma solidity ^0.8.0;
 
 import {UUPSUpgradeable} from "@openzeppelin/contracts-upgradeable/proxy/utils/UUPSUpgradeable.sol";
 import {IERC20Metadata} from "@openzeppelin/contracts/token/ERC20/extensions/IERC20Metadata.sol";
+import {IERC165} from "@openzeppelin/contracts/utils/introspection/IERC165.sol";
 import {IPolicyPool} from "./interfaces/IPolicyPool.sol";
 import {IPolicyPoolComponent} from "./interfaces/IPolicyPoolComponent.sol";
 import {IAccessManager} from "./interfaces/IAccessManager.sol";
@@ -14,8 +15,8 @@ import {WadRayMath} from "./dependencies/WadRayMath.sol";
  * @dev This is the base class of all the components of the protocol that are linked to the PolicyPool and created
  *      after it.
  *      Holds the reference to _policyPool as immutable, also provides access to common admin roles:
- *      - LEVEL1_ROLE: High impact changes like upgrades or other critical operations
- *      - LEVEL2_ROLE: Mid-impact changes like adding new risk modules or changing some parameters
+ *      - LEVEL1_ROLE: High impact changes like upgrades, adding or removing components or other critical operations
+ *      - LEVEL2_ROLE: Mid-impact changes like changing some parameters
  *      - LEVEL3_ROLE: Low-impact changes like changing some parameters up to given percentage (tweaks)
  *      - GUARDIAN_ROLE: For emergency operations oriented to protect the protocol in case of attacks or hacking.
  *
@@ -79,11 +80,16 @@ abstract contract PolicyPoolComponent is
 
   /// @custom:oz-upgrades-unsafe-allow constructor
   constructor(IPolicyPool policyPool_) {
+    require(
+      address(policyPool_) != address(0),
+      "PolicyPoolComponent: policyPool cannot be zero address"
+    );
+    _disableInitializers();
     _policyPool = policyPool_;
   }
 
   // solhint-disable-next-line func-name-mixedcase
-  function __PolicyPoolComponent_init() internal initializer {
+  function __PolicyPoolComponent_init() internal onlyInitializing {
     __UUPSUpgradeable_init();
     __Pausable_init();
   }
@@ -94,12 +100,25 @@ abstract contract PolicyPoolComponent is
     override
     onlyGlobalOrComponentRole2(GUARDIAN_ROLE, LEVEL1_ROLE)
   {
+    _upgradeValidations(newImpl);
+  }
+
+  function _upgradeValidations(address newImpl) internal view virtual {
     require(
       IPolicyPoolComponent(newImpl).policyPool() == _policyPool,
       "Can't upgrade changing the PolicyPool!"
     );
   }
 
+  /**
+   * @dev See {IERC165-supportsInterface}.
+   */
+  function supportsInterface(bytes4 interfaceId) public view virtual override returns (bool) {
+    return
+      interfaceId == type(IERC165).interfaceId ||
+      interfaceId == type(IPolicyPoolComponent).interfaceId;
+  }
+
   function pause() public onlyGlobalOrComponentRole(GUARDIAN_ROLE) {
     _pause();
   }
@@ -171,4 +190,11 @@ abstract contract PolicyPoolComponent is
       }
     }
   }
+
+  /**
+   * @dev This empty reserved space is put in place to allow future versions to add new
+   * variables without shifting down storage in the inheritance chain.
+   * See https://docs.openzeppelin.com/contracts/4.x/upgradeable#storage_gaps
+   */
+  uint256[49] private __gap;
 }

package/contracts/PremiumsAccount.sol

@@ -22,7 +22,7 @@ import {IAssetManager} from "./interfaces/IAssetManager.sol";
  * (_activePurePremiums) and the surplus or deficit generated by the finalized policies (pure premiums collected -
  * losses).
  *
- * Collaborates with a junior {EToken} and a senior {EToken} that act as lenders when the premiums aren't enought to
+ * Collaborates with a junior {EToken} and a senior {EToken} that act as lenders when the premiums aren't enough to
  * cover the losses.
  *
  * @custom:security-contact security@ensuro.co
@@ -35,6 +35,8 @@ contract PremiumsAccount is IPremiumsAccount, Reserve {
   using SafeCast for uint256;
 
   bytes32 public constant WITHDRAW_WON_PREMIUMS_ROLE = keccak256("WITHDRAW_WON_PREMIUMS_ROLE");
+  uint256 internal constant FOUR_DECIMAL_TO_WAD = 1e14;
+  uint16 internal constant HUNDRED_PERCENT = 1e4;
 
   /**
    * @dev The Junior eToken is the first {EToken} to which the PremiumsAccount will go for credit when it runs out of
@@ -106,29 +108,44 @@ contract PremiumsAccount is IPremiumsAccount, Reserve {
    * @dev Initializes the PremiumsAccount (to be called by subclasses)
    */
   // solhint-disable-next-line func-name-mixedcase
-  function __PremiumsAccount_init() internal initializer {
-    __PolicyPoolComponent_init();
+  function __PremiumsAccount_init() internal onlyInitializing {
+    __Reserve_init();
     __PremiumsAccount_init_unchained();
   }
 
-  /**
-   * @dev In the initialization, besides settings the parameters, we approve the spending of funds by the eTokens
-   * so we don't need to do it on every repayment operation
-   */
   // solhint-disable-next-line func-name-mixedcase
-  function __PremiumsAccount_init_unchained() internal initializer {
+  function __PremiumsAccount_init_unchained() internal onlyInitializing {
     /*
     _activePurePremiums = 0;
     */
-    if (address(_juniorEtk) != address(0))
-      currency().approve(address(_juniorEtk), type(uint256).max);
-    if (address(_seniorEtk) != address(0))
-      currency().approve(address(_seniorEtk), type(uint256).max);
-
-    _params = PackedParams({deficitRatio: 1e4, assetManager: IAssetManager(address(0))});
+    _params = PackedParams({
+      deficitRatio: HUNDRED_PERCENT,
+      assetManager: IAssetManager(address(0))
+    });
     _validateParameters();
   }
 
+  function _upgradeValidations(address newImpl) internal view virtual override {
+    super._upgradeValidations(newImpl);
+    IPremiumsAccount newPA = IPremiumsAccount(newImpl);
+    require(
+      newPA.juniorEtk() == _juniorEtk || address(_juniorEtk) == address(0),
+      "Can't upgrade changing the Junior ETK unless to non-zero"
+    );
+    require(
+      newPA.seniorEtk() == _seniorEtk || address(_seniorEtk) == address(0),
+      "Can't upgrade changing the Senior ETK unless to non-zero"
+    );
+  }
+
+  /**
+   * @dev See {IERC165-supportsInterface}.
+   */
+  function supportsInterface(bytes4 interfaceId) public view virtual override returns (bool) {
+    return
+      super.supportsInterface(interfaceId) || interfaceId == type(IPremiumsAccount).interfaceId;
+  }
+
   function assetManager() public view override returns (IAssetManager) {
     return _params.assetManager;
   }
@@ -141,7 +158,7 @@ contract PremiumsAccount is IPremiumsAccount, Reserve {
    * @dev This is called by the {Reserve} base class to record the earnings generated by the asset management.
    *
    * @param earningsOrLosses Indicates the amount earned since last time earnings where recorded.
-   * - If positive, repays the lons and accumulates the rest in the surplus.
+   * - If positive, repays the loans and accumulates the rest in the surplus.
    * - If negative (losses) substracts it from surplus. It never can exceed _maxDeficit and doesn't takes
    *   loans to cover asset losses.
    */
@@ -158,7 +175,7 @@ contract PremiumsAccount is IPremiumsAccount, Reserve {
 
   function _validateParameters() internal view override {
     require(
-      _params.deficitRatio <= 1e4 && _params.deficitRatio >= 0,
+      _params.deficitRatio <= HUNDRED_PERCENT && _params.deficitRatio >= 0,
       "Validation: deficitRatio must be <= 1"
     );
   }
@@ -227,16 +244,19 @@ contract PremiumsAccount is IPremiumsAccount, Reserve {
    * @dev Returns the percentage of the active pure premiums that can be used to cover losses of finalized policies.
    */
   function deficitRatio() public view returns (uint256) {
-    return uint256(_params.deficitRatio) * 1e14; // 4 -> 18 decimals
+    return uint256(_params.deficitRatio) * FOUR_DECIMAL_TO_WAD; // 4 -> 18 decimals
   }
 
   /**
    * @dev Changes the `deficitRatio` parameter.
    *
+   * Requirements:
+   * - onlyGlobalOrComponentRole(LEVEL2_ROLE)
+   *
    * Events:
    * - Emits GovernanceAction with action = setDeficitRatio or setDeficitRatioWithAdjustment if an adjustment was made.
    *
-   * @param adjustment If true and the new ratio leaves `_surplus < -_maxDeficit()`, if adjusts the _surplus to the new
+   * @param adjustment If true and the new ratio leaves `_surplus < -_maxDeficit()`, it adjusts the _surplus to the new
    *                   `_maxDeficit()` and borrows the difference from the eTokens.
    *                   If false and the new ratio leaves `_surplus < -_maxDeficit()`, the operation is reverted.
    */
@@ -244,9 +264,17 @@ contract PremiumsAccount is IPremiumsAccount, Reserve {
     external
     onlyComponentRole(LEVEL2_ROLE)
   {
-    require(newRatio <= 1e18 && newRatio >= 0, "Validation: deficitRatio must be <= 1");
+    require(newRatio <= 1e18, "Validation: deficitRatio must be <= 1");
+
+    uint16 truncatedRatio = (newRatio / FOUR_DECIMAL_TO_WAD).toUint16();
+    require(
+      uint256(truncatedRatio) * FOUR_DECIMAL_TO_WAD == newRatio,
+      "Validation: only up to 4 decimals allowed"
+    );
+
     int256 maxDeficit = _maxDeficit(newRatio);
     require(adjustment || _surplus >= maxDeficit, "Validation: surplus must be >= maxDeficit");
+
     IAccessManager.GovernanceActions action = IAccessManager.GovernanceActions.setDeficitRatio;
     if (_surplus < maxDeficit) {
       // Do the adjustment
@@ -255,12 +283,12 @@ contract PremiumsAccount is IPremiumsAccount, Reserve {
       _borrowFromEtk(borrow, address(this), address(_juniorEtk) != address(0));
       action = IAccessManager.GovernanceActions.setDeficitRatioWithAdjustment;
     }
-    _params.deficitRatio = (newRatio / 1e14).toUint16();
+    _params.deficitRatio = truncatedRatio;
     _parameterChanged(action, newRatio, false);
   }
 
   /**
-   * @dev Internal function called when money in the PremiumsAccount is not enought and we need to borrow from the
+   * @dev Internal function called when money in the PremiumsAccount is not enough and we need to borrow from the
    * eTokens.
    *
    * @param borrow The amount to borrow.
@@ -273,6 +301,7 @@ contract PremiumsAccount is IPremiumsAccount, Reserve {
     address receiver,
     bool jrEtk
   ) internal {
+    require(receiver != address(0), "PremiumsAccount: receiver cannot be the zero address");
     uint256 left;
     if (jrEtk) {
       // Consume Junior Pool until exhausted
@@ -331,9 +360,9 @@ contract PremiumsAccount is IPremiumsAccount, Reserve {
    * @param amount The amount to be transferred.
    */
   function receiveGrant(uint256 amount) external {
-    currency().safeTransferFrom(_msgSender(), address(this), amount);
     _storePurePremiumWon(amount);
     emit WonPremiumsInOut(true, amount);
+    currency().safeTransferFrom(_msgSender(), address(this), amount);
   }
 
   /**
@@ -345,7 +374,7 @@ contract PremiumsAccount is IPremiumsAccount, Reserve {
    *
    * Requirements:
    * - onlyGlobalOrComponentRole(WITHDRAW_WON_PREMIUMS_ROLE)
-   * - _wonPurePremiums > 0
+   * - _surplus > 0
    *
    * Events:
    * - Emits {WonPremiumsInOut} with moneyIn = false
@@ -359,6 +388,7 @@ contract PremiumsAccount is IPremiumsAccount, Reserve {
     onlyGlobalOrComponentRole(WITHDRAW_WON_PREMIUMS_ROLE)
     returns (uint256)
   {
+    require(destination != address(0), "PremiumsAccount: destination cannot be the zero address");
     if (_surplus <= 0) {
       amount = 0;
     } else {
@@ -442,10 +472,21 @@ contract PremiumsAccount is IPremiumsAccount, Reserve {
     if (borrowedFromEtk == 0) return purePremiumWon;
     uint256 repayAmount = Math.min(purePremiumWon, borrowedFromEtk);
 
-    // If not enought liquidity, it deinvests from the asset manager
+    // If not enough liquidity, it deinvests from the asset manager
     if (currency().balanceOf(address(this)) < repayAmount) {
+      /**
+       * I send `repayAmount` because the IAssetManager expects the full amount that's needed, not the missing one.
+       * It uses the value of the full amount to optimize the deinvestment leaving more liquidity if possible to avoid
+       * future deinvestment. It will only fail if it can't refill `repayAmount - currency().balanceOf(address(this))`
+       */
       _refillWallet(repayAmount);
     }
+    // Checks the allowance before repayment
+    if (currency().allowance(address(this), address(etk)) < repayAmount) {
+      // If I have to approve, I approve for all the pending debt (not just repayAmount), this way I avoid some
+      // future approvals.
+      currency().approve(address(etk), borrowedFromEtk);
+    }
     etk.repayLoan(repayAmount, address(this));
     return purePremiumWon - repayAmount;
   }
@@ -474,4 +515,11 @@ contract PremiumsAccount is IPremiumsAccount, Reserve {
     _storePurePremiumWon(purePremiumWon);
     _unlockScr(policy);
   }
+
+  /**
+   * @dev This empty reserved space is put in place to allow future versions to add new
+   * variables without shifting down storage in the inheritance chain.
+   * See https://docs.openzeppelin.com/contracts/4.x/upgradeable#storage_gaps
+   */
+  uint256[47] private __gap;
 }

package/contracts/Reserve.sol

@@ -39,6 +39,14 @@ abstract contract Reserve is PolicyPoolComponent {
     NEGLIGIBLE_AMOUNT = 10**(policyPool_.currency().decimals() / 2);
   }
 
+  /**
+   * @dev Initializes the Reserve (to be called by subclasses)
+   */
+  // solhint-disable-next-line func-name-mixedcase
+  function __Reserve_init() internal onlyInitializing {
+    __PolicyPoolComponent_init();
+  }
+
   /**
    * @dev Refills the reserve's balance, deinvesting from the asset manager to be able to make a payment
    *
@@ -62,12 +70,13 @@ abstract contract Reserve is PolicyPoolComponent {
 
   /**
    * @dev Internal function that transfers money to a destination. It might need to call `_refillWallet` to deinvest
-   * some money to have enought liquidity for the payment.
+   * some money to have enough liquidity for the payment.
    *
    * @param destination The destination of the transfer.
    * @param amount The amount to be transferred.
    */
   function _transferTo(address destination, uint256 amount) internal {
+    require(destination != address(0), "Reserve: transfer to the zero address");
     if (amount == 0) return;
     uint256 balance = currency().balanceOf(address(this));
     if (balance < amount) {
@@ -126,8 +135,8 @@ abstract contract Reserve is PolicyPoolComponent {
     onlyGlobalOrComponentRole2(GUARDIAN_ROLE, LEVEL1_ROLE)
   {
     require(
-      address(newAM) == address(0) || address(newAM).isContract(),
-      "The assetManager is not a contract!"
+      address(newAM) == address(0) || newAM.supportsInterface(type(IAssetManager).interfaceId),
+      "Reserve: asset manager doesn't implements the required interface"
     );
     address am = address(assetManager());
     IAccessManager.GovernanceActions action = IAccessManager.GovernanceActions.setAssetManager;
@@ -210,4 +219,11 @@ abstract contract Reserve is PolicyPoolComponent {
   {
     return address(assetManager()).functionDelegateCall(functionCall);
   }
+
+  /**
+   * @dev This empty reserved space is put in place to allow future versions to add new
+   * variables without shifting down storage in the inheritance chain.
+   * See https://docs.openzeppelin.com/contracts/4.x/upgradeable#storage_gaps
+   */
+  uint256[50] private __gap;
 }

package/contracts/RiskModule.sol

@@ -22,6 +22,12 @@ abstract contract RiskModule is IRiskModule, PolicyPoolComponent {
   using SafeCast for uint256;
 
   uint256 internal constant SECONDS_IN_YEAR_WAD = 31536000e18; /* 365 * 24 * 3600 * 10e18 */
+  uint16 internal constant HOURS_PER_YEAR = 8760; /* 24 * 365 */
+
+  uint256 internal constant FOUR_DECIMAL_TO_WAD = 1e14;
+  uint16 internal constant HUNDRED_PERCENT = 1e4;
+  uint16 internal constant MIN_MOC = 5e3;
+  uint16 internal constant MAX_MOC = 4e4;
 
   // For parameters that can be changed by the risk module provider
   bytes32 public constant RM_PROVIDER_ROLE = keccak256("RM_PROVIDER_ROLE");
@@ -80,7 +86,7 @@ abstract contract RiskModule is IRiskModule, PolicyPoolComponent {
     uint256 maxPayoutPerPolicy_,
     uint256 exposureLimit_,
     address wallet_
-  ) internal initializer {
+  ) internal onlyInitializing {
     __PolicyPoolComponent_init();
     __RiskModule_init_unchained(
       name_,
@@ -102,10 +108,10 @@ abstract contract RiskModule is IRiskModule, PolicyPoolComponent {
     uint256 maxPayoutPerPolicy_,
     uint256 exposureLimit_,
     address wallet_
-  ) internal initializer {
+  ) internal onlyInitializing {
     _name = name_;
     _params = PackedParams({
-      moc: 1e4,
+      moc: HUNDRED_PERCENT,
       jrCollRatio: 0,
       collRatio: _wadTo4(collRatio_),
       ensuroPpFee: _wadTo4(ensuroPpFee_),
@@ -114,23 +120,42 @@ abstract contract RiskModule is IRiskModule, PolicyPoolComponent {
       srRoc: _wadTo4(srRoc_),
       maxPayoutPerPolicy: _amountToX(2, maxPayoutPerPolicy_),
       exposureLimit: _amountToX(0, exposureLimit_),
-      maxDuration: 24 * 365 // default = 1 year
+      maxDuration: HOURS_PER_YEAR
     });
     _activeExposure = 0;
     _wallet = wallet_;
     _validateParameters();
   }
 
+  function _upgradeValidations(address newImpl) internal view virtual override {
+    super._upgradeValidations(newImpl);
+    IRiskModule newRM = IRiskModule(newImpl);
+    require(
+      newRM.premiumsAccount() == _premiumsAccount,
+      "Can't upgrade changing the PremiumsAccount"
+    );
+  }
+
+  /**
+   * @dev See {IERC165-supportsInterface}.
+   */
+  function supportsInterface(bytes4 interfaceId) public view virtual override returns (bool) {
+    return super.supportsInterface(interfaceId) || interfaceId == type(IRiskModule).interfaceId;
+  }
+
   // runs validation on RiskModule parameters
   function _validateParameters() internal view override {
-    require(_params.jrCollRatio <= 1e4, "Validation: jrCollRatio must be <=1");
-    require(_params.collRatio <= 1e4 && _params.collRatio > 0, "Validation: collRatio must be <=1");
+    require(_params.jrCollRatio <= HUNDRED_PERCENT, "Validation: jrCollRatio must be <=1");
+    require(
+      _params.collRatio <= HUNDRED_PERCENT && _params.collRatio > 0,
+      "Validation: collRatio must be <=1"
+    );
     require(_params.collRatio >= _params.jrCollRatio, "Validation: collRatio >= jrCollRatio");
-    require(_params.moc <= 4e4 && _params.moc >= 5e3, "Validation: moc must be [0.5, 4]");
-    require(_params.ensuroPpFee <= 1e4, "Validation: ensuroPpFee must be <= 1");
-    require(_params.ensuroCocFee <= 1e4, "Validation: ensuroCocFee must be <= 1");
-    require(_params.srRoc <= 1e4, "Validation: srRoc must be <= 1 (100%)");
-    require(_params.jrRoc <= 1e4, "Validation: jrRoc must be <= 1 (100%)");
+    require(_params.moc <= MAX_MOC && _params.moc >= MIN_MOC, "Validation: moc must be [0.5, 4]");
+    require(_params.ensuroPpFee <= HUNDRED_PERCENT, "Validation: ensuroPpFee must be <= 1");
+    require(_params.ensuroCocFee <= HUNDRED_PERCENT, "Validation: ensuroCocFee must be <= 1");
+    require(_params.srRoc <= HUNDRED_PERCENT, "Validation: srRoc must be <= 1 (100%)");
+    require(_params.jrRoc <= HUNDRED_PERCENT, "Validation: jrRoc must be <= 1 (100%)");
     // _maxPayoutPerPolicy no limits
     require(
       exposureLimit() >= _activeExposure,
@@ -150,12 +175,12 @@ abstract contract RiskModule is IRiskModule, PolicyPoolComponent {
   // solhint-disable-next-line func-name-mixedcase
   function _4toWad(uint16 value) internal pure returns (uint256) {
     // 4 decimals to Wad (18 decimals)
-    return uint256(value) * 1e14;
+    return uint256(value) * FOUR_DECIMAL_TO_WAD;
   }
 
   function _wadTo4(uint256 value) internal pure returns (uint16) {
     // Wad to 4 decimals
-    return (value / 1e14).toUint16();
+    return (value / FOUR_DECIMAL_TO_WAD).toUint16();
   }
 
   // solhint-disable-next-line func-name-mixedcase
@@ -262,6 +287,7 @@ abstract contract RiskModule is IRiskModule, PolicyPoolComponent {
   }
 
   function setWallet(address wallet_) external onlyComponentRole(RM_PROVIDER_ROLE) {
+    require(wallet_ != address(0), "RiskModule: wallet cannot be the zero address");
     _wallet = wallet_;
     _parameterChanged(IAccessManager.GovernanceActions.setWallet, uint256(uint160(wallet_)), false);
   }
@@ -358,4 +384,11 @@ abstract contract RiskModule is IRiskModule, PolicyPoolComponent {
   function premiumsAccount() external view override returns (IPremiumsAccount) {
     return _premiumsAccount;
   }
+
+  /**
+   * @dev This empty reserved space is put in place to allow future versions to add new
+   * variables without shifting down storage in the inheritance chain.
+   * See https://docs.openzeppelin.com/contracts/4.x/upgradeable#storage_gaps
+   */
+  uint256[46] private __gap;
 }