@ensuro/core 2.8.0-beta1 → 2.8.0

package/README.md

@@ -68,7 +68,7 @@ This contract also follows the ERC721 standard, minting an NFT for each policy c
 
 The protocol uses three levels of access control, plus a guardian role. These roles can be assigned at protocol level or specifically for a component. The roles are managed by the AccessManager smart contract.
 
-More info about governance in https://docs.google.com/spreadsheets/d/1LqlogRn8AlnLq1rPTd5UT7CJI3uc31PdBaxj4pX3mtE/edit?usp=sharing
+More info about governance in [our docs](https://docs.ensuro.co/ensuro-docs/smart-contracts/governance)
 
 ## Upgradability
 
@@ -81,7 +81,7 @@ We will never deploy upgrades to live contracts without prior notice to the user
 - LEVEL1_ROLE: this will be delegated to a Timelock contract that will give enough time to the users to be notified of the imminent upgrade.
 - GUARDIAN_ROLE: this will used only for emergency situations to prevent hacks or fix vulnerabilities. It will be delegated to multisigs where one of the signers is a trusted third party.
 
-Have in mind the new versions of the contracts might or might not be covered by the same audit processes as the initial ones. Always check the details of the audit reports.
+Have in mind the new versions of the contracts might or might not be covered by the same audit processes as the initial ones. See our [audit applicability matrix](https://docs.ensuro.co/ensuro-docs/deployments/audits) to check which audit applies to the currently deployed contracts.
 
 ## Development
 
@@ -131,6 +131,10 @@ Also the docker container is prepared to run [hardhat](https://hardhat.org/). Th
 
 - Audit by [Quantstamp](https://quantstamp.com/) - 2022-09-26 through 2022-10-20: [AuditReport](audits/Quantstamp-Ensuro-Final-Report-2022-11-09.pdf)
 - Audit by [SlowMist](https://www.slowmist.com) - 2021-09-29: [AuditReport](audits/SlowMistAuditReport-Ensuro-2021-09-29.pdf)
+- Process Quality Review by [DefiSafety](https://www.defisafety.com/) - 2024-03-18: [Process Quality Review](audits/DefiSafety.Process_Quality_Review.Ensuro.pdf)
+
+[![DeFiSafety Badge](audits/DefiSafety-93-badge.png)](https://www.defisafety.com/app/pqrs/594)
+
 
 ## Contributing
 

package/contracts/Policy.sol

@@ -40,8 +40,9 @@ library Policy {
     uint256 premium,
     uint256 payout,
     uint256 lossProb,
-    uint40 expiration
-  ) internal view returns (PolicyData memory newPolicy) {
+    uint40 expiration,
+    uint40 start
+  ) internal pure returns (PolicyData memory newPolicy) {
     require(premium <= payout, "Premium cannot be more than payout");
     PolicyData memory policy;
 
@@ -49,7 +50,7 @@ library Policy {
     policy.premium = premium;
     policy.payout = payout;
     policy.lossProb = lossProb;
-    policy.start = uint40(block.timestamp);
+    policy.start = start;
     policy.expiration = expiration;
     policy.purePremium = payout.wadMul(lossProb.wadMul(rmParams.moc));
     // Calculate Junior and Senior SCR

package/contracts/PolicyPool.sol

@@ -125,25 +125,6 @@ contract PolicyPool is IPolicyPool, PausableUpgradeable, UUPSUpgradeable, ERC721
    */
   string internal _nftBaseURI;
 
-  /**
-   * @dev Event emitted every time a new policy is added to the pool. Contains all the data about the policy that is
-   * later required for doing operations with the policy like resolution or expiration.
-   *
-   * @param riskModule The risk module that created the policy
-   * @param policy The {Policy-PolicyData} struct with all the immutable fields of the policy.
-   */
-  event NewPolicy(IRiskModule indexed riskModule, Policy.PolicyData policy);
-
-  /**
-   * @dev Event emitted every time a policy is removed from the pool. If the policy expired, the `payout` is 0,
-   * otherwise is the amount transferred to the policyholder.
-   *
-   * @param riskModule The risk module where that created the policy initially.
-   * @param policyId The unique id of the policy
-   * @param payout The payout that has been paid to the policy holder. 0 when the policy expired.
-   */
-  event PolicyResolved(IRiskModule indexed riskModule, uint256 indexed policyId, uint256 payout);
-
   /**
    * @dev Event emitted when the treasury changes
    *
@@ -400,39 +381,34 @@ contract PolicyPool is IPolicyPool, PausableUpgradeable, UUPSUpgradeable, ERC721
     return _components[component].status;
   }
 
-  function _etkStatus(IEToken eToken) internal view returns (ComponentStatus) {
-    Component storage comp = _components[IPolicyPoolComponent(address(eToken))];
-    require(comp.kind == ComponentKind.eToken, "Component is not an eToken");
+  function _componentStatus(address component, ComponentKind kind) internal view returns (ComponentStatus) {
+    Component storage comp = _components[IPolicyPoolComponent(component)];
+    require(comp.kind == kind, "Component is not of the right kind");
     return comp.status;
   }
 
-  function _rmStatus(IRiskModule riskModule) internal view returns (ComponentStatus) {
-    Component storage comp = _components[IPolicyPoolComponent(address(riskModule))];
-    require(comp.kind == ComponentKind.riskModule, "Component is not a RiskModule");
-    return comp.status;
+  function _requireCompActive(address component, ComponentKind kind) internal view {
+    require(_componentStatus(component, kind) == ComponentStatus.active, "Component not found or not active");
   }
 
-  function _paStatus(IPremiumsAccount premiumsAccount) internal view returns (ComponentStatus) {
-    Component storage comp = _components[IPolicyPoolComponent(address(premiumsAccount))];
-    require(comp.kind == ComponentKind.premiumsAccount, "Component is not a PremiumsAccount");
-    return comp.status;
+  function _requireCompActiveOrDeprecated(address component, ComponentKind kind) internal view {
+    ComponentStatus status = _componentStatus(component, kind);
+    require(
+      status == ComponentStatus.active || status == ComponentStatus.deprecated,
+      "Component must be active or deprecated"
+    );
   }
 
   function deposit(IEToken eToken, uint256 amount) external override whenNotPaused {
-    require(_etkStatus(eToken) == ComponentStatus.active, "eToken is not active");
+    _requireCompActive(address(eToken), ComponentKind.eToken);
     uint256 balanceBefore = _currency.balanceOf(address(eToken));
     _currency.safeTransferFrom(_msgSender(), address(eToken), amount);
     eToken.deposit(_msgSender(), _currency.balanceOf(address(eToken)) - balanceBefore);
   }
 
   function withdraw(IEToken eToken, uint256 amount) external override whenNotPaused returns (uint256) {
-    ComponentStatus etkStatus = _etkStatus(eToken);
-    require(
-      etkStatus == ComponentStatus.active || etkStatus == ComponentStatus.deprecated,
-      "eToken not found or withdraws not allowed"
-    );
-    address provider = _msgSender();
-    return eToken.withdraw(provider, amount);
+    _requireCompActiveOrDeprecated(address(eToken), ComponentKind.eToken);
+    return eToken.withdraw(_msgSender(), amount);
   }
 
   function newPolicy(
@@ -444,14 +420,15 @@ contract PolicyPool is IPolicyPool, PausableUpgradeable, UUPSUpgradeable, ERC721
     // Checks
     IRiskModule rm = policy.riskModule;
     require(address(rm) == _msgSender(), "Only the RM can create new policies");
-    require(_rmStatus(rm) == ComponentStatus.active, "RM module not found or not active");
+    _requireCompActive(address(rm), ComponentKind.riskModule);
     IPremiumsAccount pa = rm.premiumsAccount();
-    require(_paStatus(pa) == ComponentStatus.active, "PremiumsAccount not found or not active");
+    _requireCompActive(address(pa), ComponentKind.premiumsAccount);
 
     // Effects
-    policy.id = (uint256(uint160(address(rm))) << 96) + internalId;
+    policy.id = makePolicyId(rm, internalId);
     require(_policies[policy.id] == bytes32(0), "Policy already exists");
     _policies[policy.id] = policy.hash();
+    _safeMint(policyHolder, policy.id, "");
 
     // Interactions
     pa.policyCreated(policy);
@@ -468,16 +445,81 @@ contract PolicyPool is IPolicyPool, PausableUpgradeable, UUPSUpgradeable, ERC721
      * transfers. This might be considered in the future, but to avoid increasing the complexity and since so far we
      * operate on low gas-cost blockchains, we keep it as it is.
      */
-    _safeMint(policyHolder, policy.id, "");
 
     emit NewPolicy(rm, policy);
     return policy.id;
   }
 
+  function replacePolicy(
+    Policy.PolicyData memory oldPolicy,
+    Policy.PolicyData memory newPolicy_,
+    address payer,
+    uint96 internalId
+  ) external override whenNotPaused returns (uint256) {
+    // Checks
+    _validatePolicy(oldPolicy);
+    IRiskModule rm = oldPolicy.riskModule;
+    require(address(rm) == _msgSender(), "Only the RM can create new policies");
+    _requireCompActive(address(rm), ComponentKind.riskModule);
+    IPremiumsAccount pa = rm.premiumsAccount();
+    _requireCompActive(address(pa), ComponentKind.premiumsAccount);
+    require(oldPolicy.expiration > uint40(block.timestamp), "Old policy is expired");
+    require(oldPolicy.start == newPolicy_.start, "Both policies must have the same starting date");
+    require(
+      oldPolicy.payout <= newPolicy_.payout &&
+        oldPolicy.purePremium <= newPolicy_.purePremium &&
+        oldPolicy.ensuroCommission <= newPolicy_.ensuroCommission &&
+        oldPolicy.jrCoc <= newPolicy_.jrCoc &&
+        oldPolicy.srCoc <= newPolicy_.srCoc &&
+        oldPolicy.jrScr <= newPolicy_.jrScr &&
+        oldPolicy.srScr <= newPolicy_.srScr &&
+        oldPolicy.partnerCommission <= newPolicy_.partnerCommission &&
+        oldPolicy.expiration <= newPolicy_.expiration &&
+        rm == newPolicy_.riskModule,
+      "New policy must be greater or equal than old policy"
+    );
+
+    // Effects
+    newPolicy_.id = makePolicyId(rm, internalId);
+    require(_policies[newPolicy_.id] == bytes32(0), "Policy already exists");
+    _policies[newPolicy_.id] = newPolicy_.hash();
+    address policyHolder = ownerOf(oldPolicy.id);
+    _safeMint(policyHolder, newPolicy_.id, "");
+    delete _policies[oldPolicy.id];
+
+    // Interactions
+    pa.policyReplaced(oldPolicy, newPolicy_);
+
+    // Distribute the premium
+    uint256 aux = newPolicy_.purePremium - oldPolicy.purePremium;
+    if (aux > 0) _currency.safeTransferFrom(payer, address(pa), aux);
+    aux = newPolicy_.srCoc - oldPolicy.srCoc;
+    if (aux > 0) _currency.safeTransferFrom(payer, address(pa.seniorEtk()), aux);
+    aux = newPolicy_.jrCoc - oldPolicy.jrCoc;
+    if (aux > 0) _currency.safeTransferFrom(payer, address(pa.juniorEtk()), aux);
+    aux = newPolicy_.ensuroCommission - oldPolicy.ensuroCommission;
+    if (aux > 0) _currency.safeTransferFrom(payer, _treasury, aux);
+    aux = newPolicy_.partnerCommission - oldPolicy.partnerCommission;
+    if (aux > 0 && payer != rm.wallet()) _currency.safeTransferFrom(payer, rm.wallet(), aux);
+    /**
+     * This code does up to 5 ERC20 transfers. This can be avoided to reduce the gas cost, by implementing delayed
+     * transfers. This might be considered in the future, but to avoid increasing the complexity and since so far we
+     * operate on low gas-cost blockchains, we keep it as it is.
+     */
+
+    emit NewPolicy(rm, newPolicy_);
+    emit PolicyReplaced(rm, oldPolicy.id, newPolicy_.id);
+    return newPolicy_.id;
+  }
+
   function _validatePolicy(Policy.PolicyData memory policy) internal view {
     require(policy.id != 0 && policy.hash() == _policies[policy.id], "Policy not found");
   }
 
+  function makePolicyId(IRiskModule rm, uint96 internalId) public pure returns (uint256) {
+    return (uint256(uint160(address(rm))) << 96) + internalId;
+  }
+
   function expirePolicy(Policy.PolicyData calldata policy) external override whenNotPaused {
     require(policy.expiration <= block.timestamp, "Policy not expired yet");
     return _resolvePolicy(policy, 0, true);
@@ -526,21 +568,14 @@ contract PolicyPool is IPolicyPool, PausableUpgradeable, UUPSUpgradeable, ERC721
     IRiskModule rm = policy.riskModule;
     require(expired || address(rm) == _msgSender(), "Only the RM can resolve policies");
     require(payout == 0 || policy.expiration > block.timestamp, "Can't pay expired policy");
-    ComponentStatus compStatus = _rmStatus(rm);
-    require(
-      compStatus == ComponentStatus.active || compStatus == ComponentStatus.deprecated,
-      "Module must be active or deprecated to process resolutions"
-    );
+    _requireCompActiveOrDeprecated(address(rm), ComponentKind.riskModule);
+
     require(payout <= policy.payout, "payout > policy.payout");
 
     bool customerWon = payout > 0;
 
     IPremiumsAccount pa = rm.premiumsAccount();
-    compStatus = _paStatus(pa);
-    require(
-      compStatus == ComponentStatus.active || compStatus == ComponentStatus.deprecated,
-      "PremiumsAccount must be active or deprecated to process resolutions"
-    );
+    _requireCompActiveOrDeprecated(address(pa), ComponentKind.premiumsAccount);
     // Effects
     delete _policies[policy.id];
     // Interactions

package/contracts/PremiumsAccount.sol

@@ -2,6 +2,7 @@
 pragma solidity ^0.8.0;
 
 import {Math} from "@openzeppelin/contracts/utils/math/Math.sol";
+import {SignedMath} from "@openzeppelin/contracts/utils/math/SignedMath.sol";
 import {IERC20Metadata} from "@openzeppelin/contracts/token/ERC20/extensions/IERC20Metadata.sol";
 import {SafeERC20} from "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";
 import {SafeCast} from "@openzeppelin/contracts/utils/math/SafeCast.sol";
@@ -476,6 +477,30 @@ contract PremiumsAccount is IPremiumsAccount, Reserve {
     if (policy.srScr > 0) _seniorEtk.lockScr(policy.srScr, policy.srInterestRate());
   }
 
+  function policyReplaced(
+    Policy.PolicyData memory oldPolicy,
+    Policy.PolicyData memory newPolicy
+  ) external override onlyPolicyPool whenNotPaused {
+    if (oldPolicy.srScr > 0 && newPolicy.srScr > 0) {
+      int256 diff = int256(oldPolicy.srInterestRate()) - int256(newPolicy.srInterestRate());
+      require(SignedMath.abs(diff) < 1e14, "Interest rate can't change");
+    }
+    if (oldPolicy.jrScr > 0 && newPolicy.jrScr > 0) {
+      int256 diff = int256(oldPolicy.jrInterestRate()) - int256(newPolicy.jrInterestRate());
+      require(SignedMath.abs(diff) < 1e14, "Interest rate can't change");
+    }
+    /*
+     * Supporting interest rate change is possible, but it would require complex computations.
+     * If new IR > old IR, then we must adjust positivelly to accrue the interests not accrued
+     * If new IR < old IR, then we must adjust negativelly to substract the interests accrued in excess
+     */
+    _activePurePremiums += newPolicy.purePremium - oldPolicy.purePremium;
+    if (oldPolicy.jrScr > 0) _juniorEtk.unlockScr(oldPolicy.jrScr, oldPolicy.jrInterestRate(), 0);
+    if (oldPolicy.srScr > 0) _seniorEtk.unlockScr(oldPolicy.srScr, oldPolicy.srInterestRate(), 0);
+    if (newPolicy.jrScr > 0) _juniorEtk.lockScr(newPolicy.jrScr, newPolicy.jrInterestRate());
+    if (newPolicy.srScr > 0) _seniorEtk.lockScr(newPolicy.srScr, newPolicy.srInterestRate());
+  }
+
   function policyResolvedWithPayout(
     address policyHolder,
     Policy.PolicyData memory policy,

package/contracts/RiskModule.sol

@@ -333,7 +333,7 @@ abstract contract RiskModule is IRiskModule, PolicyPoolComponent {
     address onBehalfOf,
     uint96 internalId,
     Params memory params_
-  ) internal returns (Policy.PolicyData memory) {
+  ) internal returns (Policy.PolicyData memory policy) {
     if (premium == type(uint256).max) {
       premium = _getMinimumPremium(payout, lossProb, expiration, params_);
     }
@@ -351,11 +351,60 @@ abstract contract RiskModule is IRiskModule, PolicyPoolComponent {
       "Payer must allow caller to transfer the premium"
     );
     require(payout <= maxPayoutPerPolicy(), "RiskModule: Payout is more than maximum per policy");
-    Policy.PolicyData memory policy = Policy.initialize(this, params_, premium, payout, lossProb, expiration);
+    policy = Policy.initialize(this, params_, premium, payout, lossProb, expiration, now_);
     _activeExposure += policy.payout;
     require(_activeExposure <= exposureLimit(), "RiskModule: Exposure limit exceeded");
-    uint256 policyId = _policyPool.newPolicy(policy, payer, onBehalfOf, internalId);
-    policy.id = policyId;
+    policy.id = _policyPool.newPolicy(policy, payer, onBehalfOf, internalId);
+    return policy;
+  }
+
+  /**
+   * @dev Called from child contracts to replace policies (after they validated the pricing).
+   *      whenNotPaused validation must be done in the external method.
+   *
+   * @param payout The exposure (maximum payout) of the policy
+   * @param premium The premium that will be paid by the policyHolder
+   * @param lossProb The probability of having to pay the maximum payout (wad)
+   * @param payer The account that pays for the premium
+   * @param expiration The expiration of the policy (timestamp)
+   * @param internalId An id that's unique within this module and it will be used to identify the policy
+   * @param params_ Params to use to create the new policy
+   */
+  function _replacePolicy(
+    Policy.PolicyData calldata oldPolicy,
+    uint256 payout,
+    uint256 premium,
+    uint256 lossProb,
+    uint40 expiration,
+    address payer,
+    uint96 internalId,
+    Params memory params_
+  ) internal virtual returns (Policy.PolicyData memory policy) {
+    if (premium == type(uint256).max) {
+      premium = _getMinimumPremium(payout, lossProb, expiration, params_);
+    }
+    require(premium < payout, "Premium must be less than payout");
+    require(oldPolicy.expiration > uint40(block.timestamp), "Old policy is expired");
+    require(
+      expiration >= oldPolicy.expiration && payout >= oldPolicy.payout && premium >= oldPolicy.premium,
+      "Policy replacement must be greater or equal than old policy"
+    );
+    require(((expiration - oldPolicy.start) / 3600) < _params.maxDuration, "Policy exceeds max duration");
+    require(
+      _policyPool.currency().allowance(payer, address(_policyPool)) >= (premium - oldPolicy.premium),
+      "You must allow ENSURO to transfer the premium"
+    );
+    require(
+      payer == _msgSender() || _policyPool.currency().allowance(payer, _msgSender()) >= (premium - oldPolicy.premium),
+      "Payer must allow caller to transfer the premium"
+    );
+    require(payout <= maxPayoutPerPolicy(), "RiskModule: Payout is more than maximum per policy");
+    policy = Policy.initialize(this, params_, premium, payout, lossProb, expiration, oldPolicy.start);
+
+    _activeExposure += policy.payout - oldPolicy.payout;
+    require(_activeExposure <= exposureLimit(), "RiskModule: Exposure limit exceeded");
+
+    policy.id = _policyPool.replacePolicy(oldPolicy, policy, payer, internalId);
     return policy;
   }
 

package/contracts/TrustfulRiskModule.sol

@@ -5,6 +5,7 @@ import {IPolicyPool} from "./interfaces/IPolicyPool.sol";
 import {IPremiumsAccount} from "./interfaces/IPremiumsAccount.sol";
 import {RiskModule} from "./RiskModule.sol";
 import {Policy} from "./Policy.sol";
+import {IERC721} from "@openzeppelin/contracts/interfaces/IERC721.sol";
 
 /**
  * @title Trustful Risk Module
@@ -17,6 +18,7 @@ import {Policy} from "./Policy.sol";
 contract TrustfulRiskModule is RiskModule {
   bytes32 public constant PRICER_ROLE = keccak256("PRICER_ROLE");
   bytes32 public constant RESOLVER_ROLE = keccak256("RESOLVER_ROLE");
+  bytes32 public constant REPLACER_ROLE = keccak256("REPLACER_ROLE");
 
   /// @custom:oz-upgrades-unsafe-allow constructor
   // solhint-disable-next-line no-empty-blocks
@@ -100,6 +102,44 @@ contract TrustfulRiskModule is RiskModule {
     return _newPolicy(payout, premium, lossProb, expiration, _getPayer(onBehalfOf, premium), onBehalfOf, internalId);
   }
 
+  /**
+   * @dev Replace a policy with a new one, reusing the premium and the capital locked
+   *
+   * Requirements:
+   * - The caller has been granted componentRole(PRICER_ROLE)
+   *
+   * Emits:
+   * - {PolicyPool.PolicyReplaced}
+   *
+   * @param payout The exposure (maximum payout) of the policy
+   * @param premium The premium that will be paid by the policyHolder
+   * @param lossProb The probability of having to pay the maximum payout (wad)
+   * @param expiration The expiration of the policy (timestamp)
+   * @param internalId An id that's unique within this module and it will be used to identify the policy
+   * @return Returns the id of the created policy
+   */
+  function replacePolicy(
+    Policy.PolicyData calldata oldPolicy,
+    uint256 payout,
+    uint256 premium,
+    uint256 lossProb,
+    uint40 expiration,
+    uint96 internalId
+  ) external whenNotPaused onlyComponentRole(REPLACER_ROLE) returns (uint256) {
+    address onBehalfOf = IERC721(address(_policyPool)).ownerOf(oldPolicy.id);
+    return
+      _replacePolicy(
+        oldPolicy,
+        payout,
+        premium,
+        lossProb,
+        expiration,
+        _getPayer(onBehalfOf, premium),
+        internalId,
+        params()
+      ).id;
+  }
+
   function _getPayer(address onBehalfOf, uint256 premium) internal view returns (address payer) {
     payer = onBehalfOf;
     if (payer != _msgSender() && _policyPool.currency().allowance(payer, _msgSender()) < premium)

package/contracts/interfaces/IPolicyPool.sol

@@ -4,9 +4,39 @@ pragma solidity ^0.8.0;
 import {IERC20Metadata} from "@openzeppelin/contracts/token/ERC20/extensions/IERC20Metadata.sol";
 import {Policy} from "../Policy.sol";
 import {IEToken} from "./IEToken.sol";
+import {IRiskModule} from "./IRiskModule.sol";
 import {IAccessManager} from "./IAccessManager.sol";
 
 interface IPolicyPool {
+  /**
+   * @dev Event emitted every time a new policy is added to the pool. Contains all the data about the policy that is
+   * later required for doing operations with the policy like resolution or expiration.
+   *
+   * @param riskModule The risk module that created the policy
+   * @param policy The {Policy-PolicyData} struct with all the immutable fields of the policy.
+   */
+  event NewPolicy(IRiskModule indexed riskModule, Policy.PolicyData policy);
+
+  /**
+   * @dev Event emitted every time a new policy replaces an old Policy Contains all the data about the policy that is
+   * later required for doing operations with the policy like resolution or expiration.
+   *
+   * @param riskModule The risk module that created the policy
+   * @param oldPolicyId The id of the replaced policy.
+   * @param newPolicyId The id of the new policy.
+   */
+  event PolicyReplaced(IRiskModule indexed riskModule, uint256 indexed oldPolicyId, uint256 indexed newPolicyId);
+
+  /**
+   * @dev Event emitted every time a policy is removed from the pool. If the policy expired, the `payout` is 0,
+   * otherwise is the amount transferred to the policyholder.
+   *
+   * @param riskModule The risk module where that created the policy initially.
+   * @param policyId The unique id of the policy
+   * @param payout The payout that has been paid to the policy holder. 0 when the policy expired.
+   */
+  event PolicyResolved(IRiskModule indexed riskModule, uint256 indexed policyId, uint256 payout);
+
   /**
    * @dev Reference to the main currency (ERC20) used in the protocol
    * @return The address of the currency (e.g. USDC) token used in the protocol
@@ -39,18 +69,44 @@ interface IPolicyPool {
    * (see Premium Split in the docs)
    *
    * @param policy A policy created with {Policy-initialize}
-   * @param caller The pricer that's creating the policy and will pay for the premium
-   * @param policyHolder The address of the policy holder and the payer of the premiums
+   * @param payer The address that will pay for the premium
+   * @param policyHolder The address of the policy holder
    * @param internalId A unique id within the RiskModule, that will be used to compute the policy id
    * @return The policy id, identifying the NFT and the policy
    */
   function newPolicy(
     Policy.PolicyData memory policy,
-    address caller,
+    address payer,
     address policyHolder,
     uint96 internalId
   ) external returns (uint256);
 
+  /**
+   * @dev Replaces a policy with another. Must be called from an active RiskModule
+   *
+   * Requirements:
+   * - `msg.sender` must be an active RiskModule
+   * - `caller` approved the spending of `currency()` for at least `newPolicy_.premium - oldPolicy.premium`
+   * - `internalId` must be unique within `policy.riskModule` and not used before
+   *
+   * Events:
+   * - {PolicyPool-PolicyReplaced}: with all the details about the policy
+   * - {ERC20-Transfer}: does several transfers from caller address to the different receivers of the premium
+   * (see Premium Split in the docs)
+   *
+   * @param oldPolicy A policy created previously and not expired
+   * @param newPolicy_ A policy created with {Policy-initialize}
+   * @param payer The address that will pay for the premium
+   * @param internalId A unique id within the RiskModule, that will be used to compute the policy id
+   * @return The policy id, identifying the NFT and the policy
+   */
+  function replacePolicy(
+    Policy.PolicyData memory oldPolicy,
+    Policy.PolicyData memory newPolicy_,
+    address payer,
+    uint96 internalId
+  ) external returns (uint256);
+
   /**
    * @dev Resolves a policy with a payout. Must be called from an active RiskModule
    *

package/contracts/interfaces/IPremiumsAccount.sol

@@ -24,6 +24,22 @@ interface IPremiumsAccount {
    */
   function policyCreated(Policy.PolicyData memory policy) external;
 
+  /**
+   * @dev Replaces a policy with another in PremiumsAccount. Stores the pure premiums difference and
+   * re-locks the aditional funds from junior and senior eTokens.
+   *
+   * Requirements:
+   * - Must be called by `policyPool()`
+   *
+   * Events:
+   * - {EToken-SCRUnlocked}
+   * - {EToken-SCRLocked}
+   *
+   * @param oldPolicy The policy to replace (created in a previous transaction)
+   * @param newPolicy The policy that will replace the old one (created in this transaction)
+   */
+  function policyReplaced(Policy.PolicyData memory oldPolicy, Policy.PolicyData memory newPolicy) external;
+
   /**
    * @dev The PremiumsAccount is notified that the policy was resolved and issues the payout to the policyHolder.
    *

package/contracts/mocks/InterfaceIdCalculator.sol

@@ -10,6 +10,7 @@ import {IPolicyPool} from "../interfaces/IPolicyPool.sol";
 import {IPolicyPoolComponent} from "../interfaces/IPolicyPoolComponent.sol";
 import {IEToken} from "../interfaces/IEToken.sol";
 import {IRiskModule} from "../interfaces/IRiskModule.sol";
+import {IPolicyHolder} from "../interfaces/IPolicyHolder.sol";
 import {IPremiumsAccount} from "../interfaces/IPremiumsAccount.sol";
 import {ILPWhitelist} from "../interfaces/ILPWhitelist.sol";
 import {IAccessManager} from "../interfaces/IAccessManager.sol";
@@ -29,4 +30,5 @@ contract InterfaceIdCalculator {
   bytes4 public constant ILPWHITELIST_INTERFACEID = type(ILPWhitelist).interfaceId;
   bytes4 public constant IACCESSMANAGER_INTERFACEID = type(IAccessManager).interfaceId;
   bytes4 public constant IASSETMANAGER_INTERFACEID = type(IAssetManager).interfaceId;
+  bytes4 public constant IPOLICYHOLDER_INTERFACEID = type(IPolicyHolder).interfaceId;
 }

package/contracts/mocks/PolicyPoolMock.sol

@@ -20,9 +20,6 @@ contract PolicyPoolMock is IPolicyPool {
   mapping(uint256 => Policy.PolicyData) internal policies;
   mapping(uint256 => bytes32) internal policyHashes;
 
-  event NewPolicy(IRiskModule indexed riskModule, Policy.PolicyData policy);
-  event PolicyResolved(IRiskModule indexed riskModule, uint256 indexed policyId, uint256 payout);
-
   constructor(IERC20Metadata currency_, IAccessManager access_) {
     _currency = currency_;
     _access = access_;
@@ -42,7 +39,7 @@ contract PolicyPoolMock is IPolicyPool {
 
   function newPolicy(
     Policy.PolicyData memory policy,
-    address /* caller */,
+    address /* payer */,
     address /* policyHolder */,
     uint96 internalId
   ) external override returns (uint256) {
@@ -52,6 +49,20 @@ contract PolicyPoolMock is IPolicyPool {
     return policy.id;
   }
 
+  function replacePolicy(
+    Policy.PolicyData memory oldPolicy,
+    Policy.PolicyData memory newPolicy_,
+    address /* payer */,
+    uint96 internalId
+  ) external override returns (uint256) {
+    newPolicy_.id = (uint256(uint160(address(newPolicy_.riskModule))) << 96) + internalId;
+    policyHashes[newPolicy_.id] = newPolicy_.hash();
+    IRiskModule rm = oldPolicy.riskModule;
+    emit NewPolicy(rm, newPolicy_);
+    emit PolicyReplaced(IRiskModule(msg.sender), oldPolicy.id, newPolicy_.id);
+    return newPolicy_.id;
+  }
+
   function _resolvePolicy(Policy.PolicyData memory policy, uint256 payout) internal {
     require(policy.id != 0, "Policy not found");
     require(policy.hash() == policyHashes[policy.id], "Hash doesn't match");
@@ -98,9 +109,18 @@ contract PolicyPoolMock is IPolicyPool {
     uint256 premium,
     uint256 payout,
     uint256 lossProb,
-    uint40 expiration
+    uint40 expiration,
+    uint40 start
   ) external {
-    Policy.PolicyData memory policy = Policy.initialize(riskModule, rmParams, premium, payout, lossProb, expiration);
+    Policy.PolicyData memory policy = Policy.initialize(
+      riskModule,
+      rmParams,
+      premium,
+      payout,
+      lossProb,
+      expiration,
+      start == 0 ? uint40(block.timestamp) : start
+    );
 
     emit NewPolicy(riskModule, policy);
   }

package/contracts/mocks/RiskModuleMock.sol

@@ -5,6 +5,7 @@ import {IPolicyPool} from "../interfaces/IPolicyPool.sol";
 import {IPremiumsAccount} from "../interfaces/IPremiumsAccount.sol";
 import {RiskModule} from "../RiskModule.sol";
 import {Policy} from "../Policy.sol";
+import {IERC721} from "@openzeppelin/contracts/interfaces/IERC721.sol";
 
 /**
  * @title Trustful Risk Module
@@ -17,6 +18,7 @@ import {Policy} from "../Policy.sol";
 contract RiskModuleMock is RiskModule {
   bytes32 public constant PRICER_ROLE = keccak256("PRICER_ROLE");
   bytes32 public constant RESOLVER_ROLE = keccak256("RESOLVER_ROLE");
+  bytes32 public constant REPLACER_ROLE = keccak256("REPLACER_ROLE");
 
   /// @custom:oz-upgrades-unsafe-allow constructor
   // solhint-disable-next-line no-empty-blocks
@@ -56,7 +58,41 @@ contract RiskModuleMock is RiskModule {
     return _newPolicy(payout, premium, lossProb, expiration, payer, onBehalfOf, internalId).id;
   }
 
+  function newPolicyRaw(
+    Policy.PolicyData memory policy,
+    address payer,
+    address policyHolder,
+    uint96 internalId
+  ) external returns (uint256) {
+    return _policyPool.newPolicy(policy, payer, policyHolder, internalId);
+  }
+
   function resolvePolicy(Policy.PolicyData calldata policy, uint256 payout) external onlyComponentRole(RESOLVER_ROLE) {
     _policyPool.resolvePolicy(policy, payout);
   }
+
+  function resolvePolicyRaw(Policy.PolicyData calldata policy, uint256 payout) external {
+    return _policyPool.resolvePolicy(policy, payout);
+  }
+
+  function replacePolicy(
+    Policy.PolicyData calldata oldPolicy,
+    uint256 payout,
+    uint256 premium,
+    uint256 lossProb,
+    uint40 expiration,
+    uint96 internalId
+  ) external whenNotPaused onlyComponentRole(REPLACER_ROLE) returns (uint256) {
+    address onBehalfOf = IERC721(address(_policyPool)).ownerOf(oldPolicy.id);
+    return _replacePolicy(oldPolicy, payout, premium, lossProb, expiration, onBehalfOf, internalId, params()).id;
+  }
+
+  function replacePolicyRaw(
+    Policy.PolicyData memory oldPolicy,
+    Policy.PolicyData memory newPolicy_,
+    address payer,
+    uint96 internalId
+  ) external returns (uint256) {
+    return _policyPool.replacePolicy(oldPolicy, newPolicy_, payer, internalId);
+  }
 }

package/js/utils.js

@@ -295,6 +295,7 @@ module.exports = {
   amountFunction,
   defaultPolicyParams,
   defaultBucketParams,
+  getAddress,
   getComponentRole,
   getDefaultSigner,
   getRole,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@ensuro/core",
   "description": "Ensuro - Decentralized insurance protocol",
-  "version": "2.8.0-beta1",
+  "version": "2.8.0",
   "files": [
     "**/*.sol",
     "/build/contracts/*.json",