@ensuro/core 2.2.0 → 2.3.0

package/contracts/RiskModule.sol

@@ -26,8 +26,8 @@ abstract contract RiskModule is IRiskModule, PolicyPoolComponent {
 
   uint256 internal constant FOUR_DECIMAL_TO_WAD = 1e14;
   uint16 internal constant HUNDRED_PERCENT = 1e4;
-  uint16 internal constant MIN_MOC = 5e3;
-  uint16 internal constant MAX_MOC = 4e4;
+  uint16 internal constant MIN_MOC = 5e3; // 50%
+  uint16 internal constant MAX_MOC = 4e4; // 400%
 
   // For parameters that can be changed by the risk module provider
   bytes32 public constant RM_PROVIDER_ROLE = keccak256("RM_PROVIDER_ROLE");
@@ -339,7 +339,8 @@ abstract contract RiskModule is IRiskModule, PolicyPoolComponent {
   }
 
   /**
-   * @dev Called from child contracts to create policies (after they validated the pricing)
+   * @dev Called from child contracts to create policies (after they validated the pricing).
+   *      whenNotPaused validation must be done in the external method.
    *
    * @param payout The exposure (maximum payout) of the policy
    * @param premium The premium that will be paid by the policyHolder
@@ -357,7 +358,7 @@ abstract contract RiskModule is IRiskModule, PolicyPoolComponent {
     address payer,
     address onBehalfOf,
     uint96 internalId
-  ) internal whenNotPaused returns (Policy.PolicyData memory) {
+  ) internal virtual returns (Policy.PolicyData memory) {
     return
       _newPolicyWithParams(
         payout,
@@ -371,40 +372,6 @@ abstract contract RiskModule is IRiskModule, PolicyPoolComponent {
       );
   }
 
-  /**
-   * @dev Called from child contracts to create policies (after they validated the pricing), receives custom params
-   *
-   * @param payout The exposure (maximum payout) of the policy
-   * @param premium The premium that will be paid by the policyHolder
-   * @param lossProb The probability of having to pay the maximum payout (wad)
-   * @param payer The account that pays for the premium
-   * @param expiration The expiration of the policy (timestamp)
-   * @param onBehalfOf The policy holder
-   * @param internalId An id that's unique within this module and it will be used to identify the policy
-   */
-  function _newPolicyCustomParams(
-    uint256 payout,
-    uint256 premium,
-    uint256 lossProb,
-    uint40 expiration,
-    address payer,
-    address onBehalfOf,
-    uint96 internalId,
-    Params memory params_
-  ) internal whenNotPaused returns (Policy.PolicyData memory) {
-    return
-      _newPolicyWithParams(
-        payout,
-        premium,
-        lossProb,
-        expiration,
-        payer,
-        onBehalfOf,
-        internalId,
-        params_
-      );
-  }
-
   /**
    * @dev Internal method without whenNotPaused, MUST be called from other function that has this modifier
    */

package/contracts/SignedQuoteRiskModule.sol

@@ -159,7 +159,7 @@ contract SignedQuoteRiskModule is RiskModule {
     bytes32 quoteSignatureR,
     bytes32 quoteSignatureVS,
     uint40 quoteValidUntil
-  ) external returns (Policy.PolicyData memory createdPolicy) {
+  ) external whenNotPaused returns (Policy.PolicyData memory createdPolicy) {
     return
       _newPolicySigned(
         payout,
@@ -207,7 +207,7 @@ contract SignedQuoteRiskModule is RiskModule {
     bytes32 quoteSignatureR,
     bytes32 quoteSignatureVS,
     uint40 quoteValidUntil
-  ) external returns (uint256) {
+  ) external whenNotPaused returns (uint256) {
     return
       _newPolicySigned(
         payout,
@@ -255,7 +255,7 @@ contract SignedQuoteRiskModule is RiskModule {
     bytes32 quoteSignatureR,
     bytes32 quoteSignatureVS,
     uint40 quoteValidUntil
-  ) external returns (uint256) {
+  ) external whenNotPaused returns (uint256) {
     require(
       onBehalfOf == _msgSender() || currency().allowance(onBehalfOf, _msgSender()) > 0,
       "Sender is not authorized to create policies onBehalfOf"

package/contracts/TieredSignedQuoteRiskModule.sol

@@ -0,0 +1,165 @@
+// SPDX-License-Identifier: Apache-2.0
+pragma solidity ^0.8.0;
+
+import {SafeCast} from "@openzeppelin/contracts/utils/math/SafeCast.sol";
+import {IPolicyPool} from "./interfaces/IPolicyPool.sol";
+import {IPremiumsAccount} from "./interfaces/IPremiumsAccount.sol";
+import {SignedQuoteRiskModule} from "./SignedQuoteRiskModule.sol";
+import {Policy} from "./Policy.sol";
+
+/**
+ * @title Tiered SignedQuote Risk Module
+ * @dev Risk Module that for policy creation verifies the different components of the price have been signed by a
+ *      trusted account (PRICER_ROLE). For the resolution (resolvePolicy), it has to be called by an authorized user.
+ *
+ *      It allows different collaterallization levels for different policy types, by defining tiers or buckets of loss
+ *      probability.
+ *
+ *      Each bucket's loss probability represents the upper bound of the bucket (inclusive). The global parameters of
+ *      the contract represent the 100% bucket.
+ *
+ * @custom:security-contact security@ensuro.co
+ * @author Ensuro
+ */
+contract TieredSignedQuoteRiskModule is SignedQuoteRiskModule {
+  using SafeCast for uint256;
+
+  uint8 public constant MAX_BUCKETS = 4;
+
+  struct PackedBuckets {
+    uint64[MAX_BUCKETS] lossProbs;
+  }
+
+  PackedBuckets internal _buckets;
+  PackedParams[MAX_BUCKETS] internal _bucketParams;
+
+  /**
+   * @dev Emitted when a new risk bucket is created.
+   * @param lossProb The loss probability of the new bucket.
+   * @param params The packed parameters of the new bucket.
+   */
+  event NewBucket(uint256 lossProb, Params params);
+
+  /**
+   * @dev Emitted when the risks buckets are reset and only the default one remains
+   */
+  event BucketsReset();
+
+  /// @custom:oz-upgrades-unsafe-allow constructor
+  constructor(
+    IPolicyPool policyPool_,
+    IPremiumsAccount premiumsAccount_,
+    bool creationIsOpen_
+  ) SignedQuoteRiskModule(policyPool_, premiumsAccount_, creationIsOpen_) {} // solhint-disable-line no-empty-blocks
+
+  /**
+   * @dev Adds a new risk bucket with the given loss probability and parameters after the last one.
+   *
+   * Requirements:
+   *
+   * - The caller must have the LEVEL1_ROLE or LEVEL2_ROLE
+   *
+   * @param lossProb The loss probability of the new bucket.
+   * @param params_ The parameters of the new bucket.
+   */
+  function pushBucket(uint256 lossProb, Params calldata params_)
+    external
+    onlyGlobalOrComponentRole2(LEVEL1_ROLE, LEVEL2_ROLE)
+  {
+    uint256 newBucket = 0;
+    if (_buckets.lossProbs[0] != 0) {
+      for (
+        newBucket = 1;
+        newBucket < MAX_BUCKETS && _buckets.lossProbs[newBucket] != 0;
+        newBucket++
+      ) {} // solhint-disable-line no-empty-blocks
+      require(newBucket < MAX_BUCKETS, "No more than 4 buckets accepted");
+      require(
+        lossProb > uint256(_buckets.lossProbs[newBucket - 1]),
+        "lossProb <= last lossProb - reset instead"
+      );
+    }
+    _buckets.lossProbs[newBucket] = lossProb.toUint64();
+    _bucketParams[newBucket] = PackedParams({
+      moc: _wadTo4(params_.moc),
+      jrCollRatio: _wadTo4(params_.jrCollRatio),
+      collRatio: _wadTo4(params_.collRatio),
+      ensuroPpFee: _wadTo4(params_.ensuroPpFee),
+      ensuroCocFee: _wadTo4(params_.ensuroCocFee),
+      jrRoc: _wadTo4(params_.jrRoc),
+      srRoc: _wadTo4(params_.srRoc),
+      maxPayoutPerPolicy: type(uint32).max, // unused, but needs to be > 0
+      exposureLimit: type(uint32).max, //unused, but needs to be > 0
+      maxDuration: type(uint16).max //unused
+    });
+    if (newBucket < MAX_BUCKETS - 1) {
+      _buckets.lossProbs[newBucket + 1] = 0;
+    }
+    _validatePackedParams(_bucketParams[newBucket]);
+    emit NewBucket(lossProb, params_);
+  }
+
+  function resetBuckets() external onlyGlobalOrComponentRole2(LEVEL1_ROLE, LEVEL2_ROLE) {
+    _buckets.lossProbs[0] = 0;
+    emit BucketsReset();
+  }
+
+  /**
+   * @dev returns the risk bucket parameters for the given loss probability
+   */
+  function bucketParams(uint256 lossProb) public view returns (Params memory) {
+    for (uint256 i = 0; i < MAX_BUCKETS && _buckets.lossProbs[i] != 0; i++) {
+      if (lossProb <= _buckets.lossProbs[i]) {
+        return _unpackParams(_bucketParams[i]);
+      }
+    }
+    return this.params();
+  }
+
+  function _newPolicy(
+    uint256 payout,
+    uint256 premium,
+    uint256 lossProb,
+    uint40 expiration,
+    address payer,
+    address onBehalfOf,
+    uint96 internalId
+  ) internal override whenNotPaused returns (Policy.PolicyData memory) {
+    return
+      _newPolicyWithParams(
+        payout,
+        premium,
+        lossProb,
+        expiration,
+        payer,
+        onBehalfOf,
+        internalId,
+        bucketParams(lossProb)
+      );
+  }
+
+  function getMinimumPremium(
+    uint256 payout,
+    uint256 lossProb,
+    uint40 expiration
+  ) public view virtual override returns (uint256) {
+    return _getMinimumPremium(payout, lossProb, expiration, bucketParams(lossProb));
+  }
+
+  /**
+   * @dev returns the current risk bucket limits
+   */
+  function buckets() external view returns (uint256[MAX_BUCKETS] memory result) {
+    for (uint256 i = 0; i < MAX_BUCKETS && _buckets.lossProbs[i] > 0; i++) {
+      result[i] = _buckets.lossProbs[i];
+    }
+    return result;
+  }
+
+  /**
+   * @dev This empty reserved space is put in place to allow future versions to add new
+   * variables without shifting down storage in the inheritance chain.
+   * See https://docs.openzeppelin.com/contracts/4.x/upgradeable#storage_gaps
+   */
+  uint256[45] private __gap;
+}

package/contracts/TrustfulRiskModule.sol

@@ -78,7 +78,7 @@ contract TrustfulRiskModule is RiskModule {
     uint40 expiration,
     address onBehalfOf,
     uint96 internalId
-  ) external onlyComponentRole(PRICER_ROLE) returns (uint256) {
+  ) external whenNotPaused onlyComponentRole(PRICER_ROLE) returns (uint256) {
     return
       _newPolicy(
         payout,
@@ -115,7 +115,12 @@ contract TrustfulRiskModule is RiskModule {
     uint40 expiration,
     address onBehalfOf,
     uint96 internalId
-  ) external onlyComponentRole(PRICER_ROLE) returns (Policy.PolicyData memory createdPolicy) {
+  )
+    external
+    whenNotPaused
+    onlyComponentRole(PRICER_ROLE)
+    returns (Policy.PolicyData memory createdPolicy)
+  {
     return
       _newPolicy(
         payout,

package/js/deploy.js

@@ -1,7 +1,7 @@
 const upgrades_core = require("@openzeppelin/upgrades-core");
 const helpers = require("@nomicfoundation/hardhat-network-helpers");
 const fs = require("fs");
-
+const { request } = require("undici");
 const ethers = require("ethers");
 
 const _BN = ethers.BigNumber.from;
@@ -14,6 +14,10 @@ const WhitelistStatus = {
   blacklisted: 2,
 };
 
+const reservesOpts = {
+  unsafeAllow: ["delegatecall"],
+};
+
 /**
  * Creates a fixed-point conversion function for the desired number of decimals
  * @param decimals The number of decimals. Must be >= 6.
@@ -115,10 +119,28 @@ async function verifyContract(hre, contract, isProxy, constructorArguments) {
       constructorArguments: constructorArguments,
     });
     if (isProxy) {
-      console.log(
-        "Contract successfully verified, you should verify the proxy at " +
-          `${etherscanUrl()}/proxyContractChecker?a=${contract.address}`
-      );
+      // the following should work but it fails with the current @openzeppelin/hardhat-upgrades version (1.20.0)
+      // await hre.run("verify:verify", {
+      //   address: contract.address,
+      // });
+
+      // so we use the following workaround
+      const endpoints = await hre.run("verify:get-etherscan-endpoint");
+      const params = new URLSearchParams({
+        module: "contract",
+        action: "verifyproxycontract",
+        apiKey: hre.config.etherscan.apiKey,
+        address: contract.address,
+      });
+      const response = await request(endpoints.urls.apiURL, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: params.toString(),
+      });
+      if (response.statusCode != 200)
+        throw new Error(`Etherscan replied with ${response.statusCode}: ${await response.body.text()}`);
+      const body = await response.body.json();
+      if (body.status != 1) throw new Error(`Etherscan replied with ${body}`);
     }
   } catch (error) {
     console.log("Error verifying contract", error);
@@ -141,7 +163,7 @@ async function deployContract({ saveAddr, verify, contractClass, constructorArgs
 }
 
 async function deployProxyContract(
-  { saveAddr, verify, contractClass, constructorArgs, initializeArgs, initializer },
+  { saveAddr, verify, contractClass, constructorArgs, initializeArgs, initializer, deployProxyArgs },
   hre
 ) {
   const ContractFactory = await hre.ethers.getContractFactory(contractClass);
@@ -149,7 +171,7 @@ async function deployProxyContract(
     constructorArgs: constructorArgs,
     kind: "uups",
     initializer: initializer,
-    unsafeAllow: ["delegatecall"],
+    ...deployProxyArgs,
   });
   if (verify) {
     // From https://ethereum.stackexchange.com/a/119622/79726
@@ -266,6 +288,7 @@ async function deployEToken(
       contractClass: "EToken",
       constructorArgs: [poolAddress],
       initializeArgs: [etkName, etkSymbol, _W(maxUtilizationRate), _W(poolLoanInterestRate)],
+      deployProxyArgs: reservesOpts,
       ...opts,
     },
     hre
@@ -284,6 +307,7 @@ async function deployPremiumsAccount({ poolAddress, juniorEtk, seniorEtk, runAs,
       contractClass: "PremiumsAccount",
       constructorArgs: [poolAddress, juniorEtk, seniorEtk],
       initializeArgs: [],
+      deployProxyArgs: reservesOpts,
       ...opts,
     },
     hre
@@ -342,26 +366,26 @@ async function deployRiskModule(
   );
   const rm = runAs === undefined ? contract : contract.connect(runAs);
 
-  if (moc != 1.0) {
-    moc = _W(moc);
-    await rm.setParam(0, moc);
-  }
-  if (jrCollRatio != 0.0) {
-    jrCollRatio = _W(jrCollRatio);
-    await rm.setParam(1, jrCollRatio);
-  }
-  if (jrRoc != 0.0) {
-    jrRoc = _W(jrRoc);
-    await rm.setParam(5, jrRoc);
-  }
-  if (ensuroCocFee != 0) {
-    ensuroCocFee = _W(ensuroCocFee);
-    await rm.setParam(4, ensuroCocFee);
-  }
-  if (maxDuration != 24 * 365) {
-    await rm.setParam(9, maxDuration);
-  }
   if (opts.addComponent) {
+    if (moc != 1.0) {
+      moc = _W(moc);
+      await rm.setParam(0, moc);
+    }
+    if (jrCollRatio != 0.0) {
+      jrCollRatio = _W(jrCollRatio);
+      await rm.setParam(1, jrCollRatio);
+    }
+    if (jrRoc != 0.0) {
+      jrRoc = _W(jrRoc);
+      await rm.setParam(5, jrRoc);
+    }
+    if (ensuroCocFee != 0) {
+      ensuroCocFee = _W(ensuroCocFee);
+      await rm.setParam(4, ensuroCocFee);
+    }
+    if (maxDuration != 24 * 365) {
+      await rm.setParam(9, maxDuration);
+    }
     let policyPool = await hre.ethers.getContractAt("PolicyPool", poolAddress);
     if (runAs) policyPool = policyPool.connect(runAs);
     await policyPool.addComponent(contract.address, 2);
@@ -369,21 +393,6 @@ async function deployRiskModule(
   return contract.address;
 }
 
-async function deployFlightDelayRM(opts, hre) {
-  opts.extraArgs = [opts.linkToken, [opts.oracle, opts.delayTime, _W(opts.oracleFee), opts.dataJobId, opts.sleepJobId]];
-  return deployRiskModule(opts, hre);
-}
-
-async function deployPriceRM(opts, hre) {
-  opts.extraConstructorArgs = [opts.assetOracle, opts.referenceOracle, _W(opts.slotSize)];
-  opts.extraArgs = [opts.oracleTolerance];
-  const rm = await deployRiskModule(opts, hre);
-  if (opts.minDuration != 3600) {
-    // TODO: we will need ORACLE_ADMIN_ROLE
-    await rm.setMinDuration(opts.minDuration);
-  }
-}
-
 async function deploySignedQuoteRM(opts, hre) {
   opts.extraConstructorArgs = [opts.creationIsOpen];
   return deployRiskModule(opts, hre);
@@ -679,32 +688,6 @@ function add_task() {
     .addParam("wallet", "RM address", types.address)
     .setAction(deploySignedQuoteRM);
 
-  task("deploy:priceRiskModule", "Deploys and injects a Price RiskModule")
-    .addOptionalParam("verify", "Verify contract in Etherscan", false, types.boolean)
-    .addOptionalParam("saveAddr", "Save created contract address", "RM", types.str)
-    .addOptionalParam("addComponent", "Adds the new component to the pool", true, types.boolean)
-    .addParam("poolAddress", "PolicyPool Address", types.address)
-    .addParam("paAddress", "PremiumsAccount Address", types.address)
-    .addOptionalParam("rmClass", "RiskModule contract", "PriceRiskModule", types.str)
-    .addOptionalParam("rmName", "Name of the RM", "Price Risk Module", types.str)
-    .addOptionalParam("collRatio", "Collateralization ratio", 1.0, types.float)
-    .addOptionalParam("jrCollRatio", "Junior Collateralization ratio", 0.0, types.float)
-    .addOptionalParam("ensuroPpFee", "Ensuro Pure Premium Fee", 0.02, types.float)
-    .addOptionalParam("ensuroCocFee", "Ensuro Coc Fee", 0.1, types.float)
-    .addOptionalParam("roc", "Interest rate paid to Senior LPs for solvency capital", 0.05, types.float)
-    .addOptionalParam("jrRoc", "Interest rate paid to Junior LPs for solvency capital", 0.0, types.float)
-    .addOptionalParam("maxPayoutPerPolicy", "Max Payout Per policy", 10000, types.float)
-    .addOptionalParam("exposureLimit", "Exposure (sum of payouts) limit for the RM", 1e6, types.float)
-    .addOptionalParam("maxDuration", "Maximum policy duration in hours", 24 * 365, types.int)
-    .addOptionalParam("moc", "Margin of Conservativism", 1.0, types.float)
-    .addParam("wallet", "RM address", types.address)
-    .addParam("assetOracle", "Insured asset oracle address", types.address)
-    .addOptionalParam("referenceOracle", "Reference currency address", ethers.constants.AddressZero, types.address)
-    .addOptionalParam("slotSize", "Slot size", 0.01, types.float)
-    .addOptionalParam("oracleTolerance", "Oracle age tolerance", 1800, types.int)
-    .addOptionalParam("minDuration", "Minimum time that must elapse before a policy can be triggered", 3600, types.int)
-    .setAction(deployPriceRM);
-
   task("ens:setAssetManager", "Sets an asset manager to a reserve")
     .addParam("reserve", "Reserve Address", types.address)
     .addParam("amAddress", "Address of Asset Manager (reuse one already deployed)", types.address)
@@ -813,5 +796,7 @@ module.exports = {
   deployWhitelist,
   WhitelistStatus,
   txOverrides,
+  amountFunction,
+  _W,
   _A,
 };

package/js/test-utils.js

@@ -41,6 +41,19 @@ async function check_balances(currency, users, amounts) {
   );
 }
 
+const RiskModuleParameter = {
+  moc: 0,
+  jrCollRatio: 1,
+  collRatio: 2,
+  ensuroPpFee: 3,
+  ensuroCocFee: 4,
+  jrRoc: 5,
+  srRoc: 6,
+  maxPayoutPerPolicy: 7,
+  exposureLimit: 8,
+  maxDuration: 9,
+};
+
 const createRiskModule = async function (
   pool,
   premiumsAccount,
@@ -75,7 +88,6 @@ const createRiskModule = async function (
     ],
     {
       kind: "uups",
-      unsafeAllow: ["delegatecall"],
       constructorArgs: [pool.address, premiumsAccount.address, ...extraConstructorArgs],
     }
   );
@@ -84,7 +96,7 @@ const createRiskModule = async function (
 
   if (moc !== undefined && moc != 1.0) {
     moc = _W(moc);
-    await rm.setParam(0, moc);
+    await rm.setParam(RiskModuleParameter.moc, moc);
   }
   return rm;
 };
@@ -141,7 +153,7 @@ const createEToken = async function (
     ],
     {
       kind: "uups",
-      unsafeAllow: ["delegatecall"],
+      unsafeAllow: ["delegatecall"], // This holds, because EToken is a reserve and uses delegatecall
       constructorArgs: [pool.address, ...extraConstructorArgs],
     }
   );
@@ -236,7 +248,6 @@ async function deployPool(hre, options) {
     {
       constructorArgs: [accessManager.address, options.currency],
       kind: "uups",
-      unsafeAllow: ["delegatecall"],
     }
   );
 
@@ -264,7 +275,7 @@ async function deployPremiumsAccount(hre, pool, options, addToPool = true) {
       options.srEtkAddr || hre.ethers.constants.AddressZero,
     ],
     kind: "uups",
-    unsafeAllow: ["delegatecall"],
+    unsafeAllow: ["delegatecall"], // This holds, because EToken is a reserve and uses delegatecall
   });
 
   await premiumsAccount.deployed();
@@ -424,34 +435,35 @@ async function makeSignedQuote(signer, policyParams) {
 if (process.env.ENABLE_HH_WARNINGS !== "yes") hre.upgrades.silenceWarnings();
 
 module.exports = {
-  getStorageLayout,
-  makeQuoteMessage,
-  makeSignedQuote,
-  getRole,
-  WEEK,
-  DAY,
-  createRiskModule,
-  createEToken,
-  grantRole,
-  grantComponentRole,
-  initCurrency,
+  _BN,
+  _E,
+  _R,
+  _W,
+  accessControlMessage,
+  addEToken,
+  addRiskModule,
+  amountFunction,
   approve_multiple,
   check_balances,
-  addRiskModule,
-  addEToken,
-  expected_change,
-  getTransactionEvent,
+  createEToken,
+  createRiskModule,
+  DAY,
   deployPool,
   deployPremiumsAccount,
-  _E,
-  _BN,
-  WAD,
-  RAY,
-  amountFunction,
-  _W,
-  _R,
+  expected_change,
   getComponentRole,
-  accessControlMessage,
-  makePolicyId,
+  getRole,
+  getStorageLayout,
+  getTransactionEvent,
+  grantComponentRole,
+  grantRole,
+  initCurrency,
   makePolicy,
+  makePolicyId,
+  makeQuoteMessage,
+  makeSignedQuote,
+  RAY,
+  RiskModuleParameter,
+  WAD,
+  WEEK,
 };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@ensuro/core",
   "description": "Ensuro - Decentralized insurance protocol",
-  "version": "2.2.0",
+  "version": "2.3.0",
   "files": [
     "**/*.sol",
     "/build/contracts/*.json",