@ensuro/core 2.8.0-beta2 → 2.8.1

package/README.md

@@ -131,6 +131,10 @@ Also the docker container is prepared to run [hardhat](https://hardhat.org/). Th
 
 - Audit by [Quantstamp](https://quantstamp.com/) - 2022-09-26 through 2022-10-20: [AuditReport](audits/Quantstamp-Ensuro-Final-Report-2022-11-09.pdf)
 - Audit by [SlowMist](https://www.slowmist.com) - 2021-09-29: [AuditReport](audits/SlowMistAuditReport-Ensuro-2021-09-29.pdf)
+- Process Quality Review by [DefiSafety](https://www.defisafety.com/) - 2024-03-18: [Process Quality Review](audits/DefiSafety.Process_Quality_Review.Ensuro.pdf)
+
+[![DeFiSafety Badge](audits/DefiSafety-93-badge.png)](https://www.defisafety.com/app/pqrs/594)
+
 
 ## Contributing
 

package/contracts/Policy.sol

@@ -34,6 +34,51 @@ library Policy {
     uint40 expiration;
   }
 
+  struct PremiumComposition {
+    uint256 purePremium;
+    uint256 jrScr;
+    uint256 srScr;
+    uint256 jrCoc;
+    uint256 srCoc;
+    uint256 ensuroCommission;
+    uint256 partnerCommission;
+    uint256 totalPremium;
+  }
+
+  function getMinimumPremium(
+    IRiskModule.Params memory rmParams,
+    uint256 payout,
+    uint256 lossProb,
+    uint40 expiration,
+    uint40 start
+  ) internal pure returns (PremiumComposition memory minPremium) {
+    minPremium.purePremium = payout.wadMul(lossProb.wadMul(rmParams.moc));
+    minPremium.jrScr = payout.wadMul(rmParams.jrCollRatio);
+    if (minPremium.jrScr > minPremium.purePremium) {
+      minPremium.jrScr -= minPremium.purePremium;
+    } else {
+      minPremium.jrScr = 0;
+    }
+
+    minPremium.srScr = payout.wadMul(rmParams.collRatio);
+    if (minPremium.srScr > (minPremium.purePremium + minPremium.jrScr)) {
+      minPremium.srScr -= minPremium.purePremium + minPremium.jrScr;
+    } else {
+      minPremium.srScr = 0;
+    }
+
+    // Calculate CoCs
+    minPremium.jrCoc = minPremium.jrScr.wadMul((rmParams.jrRoc * (expiration - start)) / SECONDS_PER_YEAR);
+    minPremium.srCoc = minPremium.srScr.wadMul((rmParams.srRoc * (expiration - start)) / SECONDS_PER_YEAR);
+    uint256 totalCoc = minPremium.jrCoc + minPremium.srCoc;
+
+    minPremium.ensuroCommission =
+      minPremium.purePremium.wadMul(rmParams.ensuroPpFee) +
+      totalCoc.wadMul(rmParams.ensuroCocFee);
+
+    minPremium.totalPremium = minPremium.purePremium + minPremium.ensuroCommission + totalCoc;
+  }
+
   function initialize(
     IRiskModule riskModule,
     IRiskModule.Params memory rmParams,
@@ -52,27 +97,19 @@ library Policy {
     policy.lossProb = lossProb;
     policy.start = start;
     policy.expiration = expiration;
-    policy.purePremium = payout.wadMul(lossProb.wadMul(rmParams.moc));
-    // Calculate Junior and Senior SCR
-    policy.jrScr = payout.wadMul(rmParams.jrCollRatio);
-    if (policy.jrScr > policy.purePremium) {
-      policy.jrScr -= policy.purePremium;
-    } else {
-      policy.jrScr = 0;
-    }
-    policy.srScr = payout.wadMul(rmParams.collRatio);
-    if (policy.srScr > (policy.purePremium + policy.jrScr)) {
-      policy.srScr -= policy.purePremium + policy.jrScr;
-    } else {
-      policy.srScr = 0;
-    }
-    // Calculate CoCs
-    policy.jrCoc = policy.jrScr.wadMul((rmParams.jrRoc * (policy.expiration - policy.start)) / SECONDS_PER_YEAR);
-    policy.srCoc = policy.srScr.wadMul((rmParams.srRoc * (policy.expiration - policy.start)) / SECONDS_PER_YEAR);
-    uint256 coc = policy.jrCoc + policy.srCoc;
-    policy.ensuroCommission = policy.purePremium.wadMul(rmParams.ensuroPpFee) + coc.wadMul(rmParams.ensuroCocFee);
-    require((policy.purePremium + policy.ensuroCommission + coc) <= premium, "Premium less than minimum");
-    policy.partnerCommission = premium - policy.purePremium - coc - policy.ensuroCommission;
+
+    PremiumComposition memory minPremium = getMinimumPremium(rmParams, payout, lossProb, expiration, start);
+
+    policy.purePremium = minPremium.purePremium;
+    policy.jrScr = minPremium.jrScr;
+    policy.srScr = minPremium.srScr;
+    policy.jrCoc = minPremium.jrCoc;
+    policy.srCoc = minPremium.srCoc;
+    policy.ensuroCommission = minPremium.ensuroCommission;
+
+    require(minPremium.totalPremium <= premium, "Premium less than minimum");
+
+    policy.partnerCommission = premium - minPremium.totalPremium;
     return policy;
   }
 

package/contracts/PolicyPool.sol

@@ -11,6 +11,7 @@ import {UUPSUpgradeable} from "@openzeppelin/contracts-upgradeable/proxy/utils/U
 
 import {IAccessManager} from "./interfaces/IAccessManager.sol";
 import {IEToken} from "./interfaces/IEToken.sol";
+import {IPolicyHolderV2} from "./interfaces/IPolicyHolderV2.sol";
 import {IPolicyHolder} from "./interfaces/IPolicyHolder.sol";
 import {IPolicyPool} from "./interfaces/IPolicyPool.sol";
 import {IPolicyPoolComponent} from "./interfaces/IPolicyPoolComponent.sol";
@@ -43,6 +44,8 @@ contract PolicyPool is IPolicyPool, PausableUpgradeable, UUPSUpgradeable, ERC721
   bytes32 public constant LEVEL2_ROLE = keccak256("LEVEL2_ROLE");
   bytes32 public constant LEVEL3_ROLE = keccak256("LEVEL3_ROLE");
 
+  uint256 internal constant HOLDER_GAS_LIMIT = 150000;
+
   /**
    * @dev {AccessManager} that handles the access permissions for the PolicyPool and its components.
    */
@@ -125,6 +128,98 @@ contract PolicyPool is IPolicyPool, PausableUpgradeable, UUPSUpgradeable, ERC721
    */
   string internal _nftBaseURI;
 
+  /**
+   * @dev Constructor error when address(0) is sent as `access()`
+   */
+  error NoZeroAccess();
+
+  /**
+   * @dev Constructor error when address(0) is sent as `currency()`
+   */
+  error NoZeroCurrency();
+
+  /**
+   * @dev Constructor error (or setTreasury) when address(0) is sent as `treasury()`
+   */
+  error NoZeroTreasury();
+
+  /**
+   * @dev Initialization error when empty name for the ERC721 is sent
+   */
+  error NoEmptyName();
+
+  /**
+   * @dev Initialization error when empty symbol for the ERC721 is sent
+   */
+  error NoEmptySymbol();
+
+  /**
+   * @dev Upgrade error when the new implementation contract tries to change the `access()`
+   */
+  error UpgradeCannotChangeAccess();
+
+  /**
+   * @dev Upgrade error when the new implementation contract tries to change the `currency()`
+   */
+  error UpgradeCannotChangeCurrency();
+
+  /**
+   * @dev Error when trying to add a component that was already added to the PolicyPool
+   */
+  error ComponentAlreadyInThePool();
+
+  /**
+   * @dev Error when trying to add a component that isn't linked to this pool (`.policyPool() != this`)
+   */
+  error ComponentNotLinkedToThisPool();
+
+  /**
+   * @dev Error when a component is not of the right kind, it might happen if a component declared as
+   *      ComponentKind.eToken doesn't support the IEToken interface (or similar) or when in a given operation
+   *      we expect a component to be a risk module and the stored kind is different.
+   */
+  error ComponentNotTheRightKind(IPolicyPoolComponent component, ComponentKind expectedKind);
+
+  /**
+   * @dev Error when a component is expected to be deprecated for the operation (see `removeComponent`) and it isn't.
+   */
+  error ComponentNotDeprecated();
+
+  /**
+   * @dev Error when trying to remove a component that is still in use. The "in use" definition can change from one
+   *      component to the other. For eToken in use means `totalSupply() != 0`. For PremiumsAccount means
+   *      `purePremiums() != 0`. For RiskModule means `activeExposure() != 0`.
+   */
+  error ComponentInUseCannotRemove(ComponentKind kind, uint256 amount);
+
+  /**
+   * @dev Error when a component is not found in the pool (status = 0 = inactive)
+   */
+  error ComponentNotFound();
+
+  /**
+   * @dev Error when a component is not found in the pool or is not active (status != active)
+   */
+  error ComponentNotFoundOrNotActive();
+
+  /**
+   * @dev Error when a component is not active or deprecated. Happens on some operations like eToken withdrawals or
+   *      policy resolutions that accept the component might be active or deprecated and isn't on any of those states.
+   */
+  error ComponentMustBeActiveOrDeprecated();
+
+  /**
+   * @dev Error when a method intented to be called by riskModule (and by policy's risk module) is called by someone
+   *      else.
+   */
+  error OnlyRiskModuleAllowed();
+
+  /**
+   * @dev Error raised when IPolicyHolder doesn't return the expected selector answer when notified of policy payout,
+   *      reception or replacement.
+   */
+  error InvalidNotificationResponse(bytes4 response);
+
   /**
    * @dev Event emitted when the treasury changes
    *
@@ -142,6 +237,13 @@ contract PolicyPool is IPolicyPool, PausableUpgradeable, UUPSUpgradeable, ERC721
    */
   event ComponentStatusChanged(IPolicyPoolComponent indexed component, ComponentKind kind, ComponentStatus newStatus);
 
+  /**
+   * @dev Event emitted when a IPolicyHolder reverts on the expiration notification. The operation doesn't reverts
+   *
+   * @param policyId The id of the policy being expired
+   * @param holder The address of the contract that owns the policy
+   */
+  event ExpirationNotificationFailed(uint256 indexed policyId, IPolicyHolder holder);
   /**
    * @dev Modifier that checks the caller has a given role
    */
@@ -167,8 +269,8 @@ contract PolicyPool is IPolicyPool, PausableUpgradeable, UUPSUpgradeable, ERC721
    */
   /// @custom:oz-upgrades-unsafe-allow constructor
   constructor(IAccessManager access_, IERC20Metadata currency_) {
-    require(address(access_) != address(0), "PolicyPool: access cannot be zero address");
-    require(address(currency_) != address(0), "PolicyPool: currency cannot be zero address");
+    if (address(access_) == address(0)) revert NoZeroAccess();
+    if (address(currency_) == address(0)) revert NoZeroCurrency();
     _disableInitializers();
     _access = access_;
     _currency = currency_;
@@ -182,8 +284,8 @@ contract PolicyPool is IPolicyPool, PausableUpgradeable, UUPSUpgradeable, ERC721
    * @param treasury_ The address of the treasury that will receive the protocol fees.
    */
   function initialize(string memory name_, string memory symbol_, address treasury_) public initializer {
-    require(bytes(name_).length > 0, "PolicyPool: name cannot be empty");
-    require(bytes(symbol_).length > 0, "PolicyPool: symbol cannot be empty");
+    if (bytes(name_).length == 0) revert NoEmptyName();
+    if (bytes(symbol_).length == 0) revert NoEmptySymbol();
     __UUPSUpgradeable_init();
     __ERC721_init(name_, symbol_);
     __Pausable_init();
@@ -204,8 +306,8 @@ contract PolicyPool is IPolicyPool, PausableUpgradeable, UUPSUpgradeable, ERC721
 
   function _authorizeUpgrade(address newImpl) internal view override onlyRole2(GUARDIAN_ROLE, LEVEL1_ROLE) {
     IPolicyPool newPool = IPolicyPool(newImpl);
-    require(newPool.access() == _access, "Can't upgrade changing the access manager");
-    require(newPool.currency() == _currency, "Can't upgrade changing the currency");
+    if (newPool.access() != _access) revert UpgradeCannotChangeAccess();
+    if (newPool.currency() != _currency) revert UpgradeCannotChangeCurrency();
   }
 
   /**
@@ -238,7 +340,7 @@ contract PolicyPool is IPolicyPool, PausableUpgradeable, UUPSUpgradeable, ERC721
   }
 
   function _setTreasury(address treasury_) internal {
-    require(treasury_ != address(0), "PolicyPool: treasury cannot be the zero address");
+    if (treasury_ == address(0)) revert NoZeroTreasury();
     _treasury = treasury_;
     emit ComponentChanged(IAccessManager.GovernanceActions.setTreasury, _treasury);
   }
@@ -280,15 +382,14 @@ contract PolicyPool is IPolicyPool, PausableUpgradeable, UUPSUpgradeable, ERC721
    */
   function addComponent(IPolicyPoolComponent component, ComponentKind kind) external onlyRole(LEVEL1_ROLE) {
     Component storage comp = _components[component];
-    require(comp.status == ComponentStatus.inactive, "Component already in the pool");
-    require(component.policyPool() == this, "Component not linked to this pool");
+    if (comp.status != ComponentStatus.inactive) revert ComponentAlreadyInThePool();
+    if (component.policyPool() != this) revert ComponentNotLinkedToThisPool();
 
-    require(
-      (kind == ComponentKind.eToken && component.supportsInterface(type(IEToken).interfaceId)) ||
-        (kind == ComponentKind.premiumsAccount && component.supportsInterface(type(IPremiumsAccount).interfaceId)) ||
-        (kind == ComponentKind.riskModule && component.supportsInterface(type(IRiskModule).interfaceId)),
-      "PolicyPool: Not the right kind"
-    );
+    if (
+      (kind == ComponentKind.eToken && !component.supportsInterface(type(IEToken).interfaceId)) ||
+      (kind == ComponentKind.premiumsAccount && !component.supportsInterface(type(IPremiumsAccount).interfaceId)) ||
+      (kind == ComponentKind.riskModule && !component.supportsInterface(type(IRiskModule).interfaceId))
+    ) revert ComponentNotTheRightKind(component, kind);
 
     comp.status = ComponentStatus.active;
     comp.kind = kind;
@@ -321,14 +422,16 @@ contract PolicyPool is IPolicyPool, PausableUpgradeable, UUPSUpgradeable, ERC721
    */
   function removeComponent(IPolicyPoolComponent component) external onlyRole(LEVEL1_ROLE) {
     Component storage comp = _components[component];
-    require(comp.status == ComponentStatus.deprecated, "Component not deprecated");
+    if (comp.status != ComponentStatus.deprecated) revert ComponentNotDeprecated();
     if (comp.kind == ComponentKind.eToken) {
-      require(IEToken(address(component)).totalSupply() == 0, "EToken has liquidity, can't be removed");
+      if (IEToken(address(component)).totalSupply() != 0)
+        revert ComponentInUseCannotRemove(comp.kind, IEToken(address(component)).totalSupply());
     } else if (comp.kind == ComponentKind.riskModule) {
-      require(IRiskModule(address(component)).activeExposure() == 0, "Can't remove a module with active policies");
+      if (IRiskModule(address(component)).activeExposure() != 0)
+        revert ComponentInUseCannotRemove(comp.kind, IRiskModule(address(component)).activeExposure());
     } else if (comp.kind == ComponentKind.premiumsAccount) {
       IPremiumsAccount pa = IPremiumsAccount(address(component));
-      require(pa.purePremiums() == 0, "Can't remove a PremiumsAccount with premiums");
+      if (pa.purePremiums() != 0) revert ComponentInUseCannotRemove(comp.kind, pa.purePremiums());
       IEToken etk = pa.juniorEtk();
       if (address(etk) != address(0)) {
         etk.removeBorrower(address(pa));
@@ -360,13 +463,13 @@ contract PolicyPool is IPolicyPool, PausableUpgradeable, UUPSUpgradeable, ERC721
     ComponentStatus newStatus
   ) external onlyRole2(GUARDIAN_ROLE, LEVEL1_ROLE) {
     Component storage comp = _components[component];
-    require(comp.status != ComponentStatus.inactive, "Component not found");
-    require(
-      (newStatus == ComponentStatus.active && _access.hasRole(LEVEL1_ROLE, _msgSender())) ||
-        (newStatus == ComponentStatus.suspended && _access.hasRole(GUARDIAN_ROLE, _msgSender())) ||
-        (newStatus == ComponentStatus.deprecated && _access.hasRole(LEVEL1_ROLE, _msgSender())),
-      "Only GUARDIAN can suspend / Only LEVEL1 can activate/deprecate"
-    );
+    if (comp.status == ComponentStatus.inactive) revert ComponentNotFound();
+    if (newStatus == ComponentStatus.active || newStatus == ComponentStatus.deprecated) {
+      _access.checkRole(LEVEL1_ROLE, _msgSender());
+    } else {
+      // ComponentStatus.suspended requires GUARDIAN_ROLE
+      _access.checkRole(GUARDIAN_ROLE, _msgSender());
+    }
     comp.status = newStatus;
     emit ComponentStatusChanged(component, comp.kind, newStatus);
   }
@@ -383,20 +486,18 @@ contract PolicyPool is IPolicyPool, PausableUpgradeable, UUPSUpgradeable, ERC721
 
   function _componentStatus(address component, ComponentKind kind) internal view returns (ComponentStatus) {
     Component storage comp = _components[IPolicyPoolComponent(component)];
-    require(comp.kind == kind, "Component is not of the right kind");
+    if (comp.kind != kind) revert ComponentNotTheRightKind(IPolicyPoolComponent(component), kind);
     return comp.status;
   }
 
   function _requireCompActive(address component, ComponentKind kind) internal view {
-    require(_componentStatus(component, kind) == ComponentStatus.active, "Component not found or not active");
+    if (_componentStatus(component, kind) != ComponentStatus.active) revert ComponentNotFoundOrNotActive();
   }
 
   function _requireCompActiveOrDeprecated(address component, ComponentKind kind) internal view {
     ComponentStatus status = _componentStatus(component, kind);
-    require(
-      status == ComponentStatus.active || status == ComponentStatus.deprecated,
-      "Component must be active or deprecated"
-    );
+    if (status != ComponentStatus.active && status != ComponentStatus.deprecated)
+      revert ComponentMustBeActiveOrDeprecated();
   }
 
   function deposit(IEToken eToken, uint256 amount) external override whenNotPaused {
@@ -419,7 +520,7 @@ contract PolicyPool is IPolicyPool, PausableUpgradeable, UUPSUpgradeable, ERC721
   ) external override whenNotPaused returns (uint256) {
     // Checks
     IRiskModule rm = policy.riskModule;
-    require(address(rm) == _msgSender(), "Only the RM can create new policies");
+    if (address(rm) != _msgSender()) revert OnlyRiskModuleAllowed();
     _requireCompActive(address(rm), ComponentKind.riskModule);
     IPremiumsAccount pa = rm.premiumsAccount();
     _requireCompActive(address(pa), ComponentKind.premiumsAccount);
@@ -459,7 +560,7 @@ contract PolicyPool is IPolicyPool, PausableUpgradeable, UUPSUpgradeable, ERC721
     // Checks
     _validatePolicy(oldPolicy);
     IRiskModule rm = oldPolicy.riskModule;
-    require(address(rm) == _msgSender(), "Only the RM can create new policies");
+    if (address(rm) != _msgSender()) revert OnlyRiskModuleAllowed();
     _requireCompActive(address(rm), ComponentKind.riskModule);
     IPremiumsAccount pa = rm.premiumsAccount();
     _requireCompActive(address(pa), ComponentKind.premiumsAccount);
@@ -509,6 +610,7 @@ contract PolicyPool is IPolicyPool, PausableUpgradeable, UUPSUpgradeable, ERC721
 
     emit NewPolicy(rm, newPolicy_);
     emit PolicyReplaced(rm, oldPolicy.id, newPolicy_.id);
+    _notifyReplacement(oldPolicy.id, newPolicy_.id);
     return newPolicy_.id;
   }
 
@@ -566,7 +668,7 @@ contract PolicyPool is IPolicyPool, PausableUpgradeable, UUPSUpgradeable, ERC721
     // Checks
     _validatePolicy(policy);
     IRiskModule rm = policy.riskModule;
-    require(expired || address(rm) == _msgSender(), "Only the RM can resolve policies");
+    if (!expired && address(rm) != _msgSender()) revert OnlyRiskModuleAllowed();
     require(payout == 0 || policy.expiration > block.timestamp, "Can't pay expired policy");
     _requireCompActiveOrDeprecated(address(rm), ComponentKind.riskModule);
 
@@ -606,7 +708,7 @@ contract PolicyPool is IPolicyPool, PausableUpgradeable, UUPSUpgradeable, ERC721
     if (!ERC165Checker.supportsInterface(customer, type(IPolicyHolder).interfaceId)) return;
 
     bytes4 retval = IPolicyHolder(customer).onPayoutReceived(_msgSender(), address(this), policyId, payout);
-    require(retval == IPolicyHolder.onPayoutReceived.selector, "PolicyPool: Invalid return value from IPolicyHolder");
+    if (retval != IPolicyHolder.onPayoutReceived.selector) revert InvalidNotificationResponse(retval);
   }
 
   /**
@@ -617,13 +719,29 @@ contract PolicyPool is IPolicyPool, PausableUpgradeable, UUPSUpgradeable, ERC721
     if (!AddressUpgradeable.isContract(customer)) return;
     if (!ERC165Checker.supportsInterface(customer, type(IPolicyHolder).interfaceId)) return;
 
-    try IPolicyHolder(customer).onPolicyExpired(_msgSender(), address(this), policyId) returns (bytes4) {
+    try IPolicyHolder(customer).onPolicyExpired{gas: HOLDER_GAS_LIMIT}(_msgSender(), address(this), policyId) returns (
+      bytes4
+    ) {
       return;
     } catch {
+      emit ExpirationNotificationFailed(policyId, IPolicyHolder(customer));
       return;
     }
   }
 
+  /**
+   * @dev Notifies the replacement with a callback if the policyholder is a contract. Never reverts.
+   */
+  function _notifyReplacement(uint256 oldPolicyId, uint256 newPolicyId) internal {
+    address customer = ownerOf(oldPolicyId);
+    if (!AddressUpgradeable.isContract(customer)) return;
+    if (!ERC165Checker.supportsInterface(customer, type(IPolicyHolderV2).interfaceId)) return;
+
+    bytes4 retval = IPolicyHolderV2(customer).onPolicyReplaced(_msgSender(), address(this), oldPolicyId, newPolicyId);
+    // PolicyHolder can revert and cancel the policy replacement
+    if (retval != IPolicyHolderV2.onPolicyReplaced.selector) revert InvalidNotificationResponse(retval);
+  }
+
   /**
    * @dev Base URI for computing {tokenURI}. If set, the resulting URI for each
    * token will be the concatenation of the `baseURI` and the `tokenId`. Empty

package/contracts/PolicyPoolComponent.sol

@@ -42,6 +42,9 @@ abstract contract PolicyPoolComponent is UUPSUpgradeable, PausableUpgradeable, I
   event GovernanceAction(IAccessManager.GovernanceActions indexed action, uint256 value);
   event ComponentChanged(IAccessManager.GovernanceActions indexed action, address value);
 
+  error NoZeroPolicyPool();
+  error UpgradeCannotChangePolicyPool();
+
   modifier onlyPolicyPool() {
     require(_msgSender() == address(_policyPool), "The caller must be the PolicyPool");
     _;
@@ -76,7 +79,7 @@ abstract contract PolicyPoolComponent is UUPSUpgradeable, PausableUpgradeable, I
 
   /// @custom:oz-upgrades-unsafe-allow constructor
   constructor(IPolicyPool policyPool_) {
-    require(address(policyPool_) != address(0), "PolicyPoolComponent: policyPool cannot be zero address");
+    if (address(policyPool_) == address(0)) revert NoZeroPolicyPool();
     _disableInitializers();
     _policyPool = policyPool_;
   }
@@ -94,7 +97,7 @@ abstract contract PolicyPoolComponent is UUPSUpgradeable, PausableUpgradeable, I
   }
 
   function _upgradeValidations(address newImpl) internal view virtual {
-    require(IPolicyPoolComponent(newImpl).policyPool() == _policyPool, "Can't upgrade changing the PolicyPool!");
+    if (IPolicyPoolComponent(newImpl).policyPool() != _policyPool) revert UpgradeCannotChangePolicyPool();
   }
 
   /**

package/contracts/RiskModule.sol

@@ -56,12 +56,16 @@ abstract contract RiskModule is IRiskModule, PolicyPoolComponent {
 
   address internal _wallet; // Address of the RiskModule provider
 
+  error NoZeroWallet();
+  error ExposureLimitCannotBeLessThanActiveExposure();
+  error PremiumsAccountMustBePartOfThePool();
+  error UpgradeCannotChangePremiumsAccount();
+
   /// @custom:oz-upgrades-unsafe-allow constructor
   constructor(IPolicyPool policyPool_, IPremiumsAccount premiumsAccount_) PolicyPoolComponent(policyPool_) {
-    require(
-      PolicyPoolComponent(address(premiumsAccount_)).policyPool() == policyPool_,
-      "The PremiumsAccount must be part of the Pool"
-    );
+    if (PolicyPoolComponent(address(premiumsAccount_)).policyPool() != policyPool_) {
+      revert PremiumsAccountMustBePartOfThePool();
+    }
     _premiumsAccount = premiumsAccount_;
   }
 
@@ -120,7 +124,9 @@ abstract contract RiskModule is IRiskModule, PolicyPoolComponent {
   function _upgradeValidations(address newImpl) internal view virtual override {
     super._upgradeValidations(newImpl);
     IRiskModule newRM = IRiskModule(newImpl);
-    require(newRM.premiumsAccount() == _premiumsAccount, "Can't upgrade changing the PremiumsAccount");
+    if (newRM.premiumsAccount() != _premiumsAccount) {
+      revert UpgradeCannotChangePremiumsAccount();
+    }
   }
 
   /**
@@ -133,8 +139,12 @@ abstract contract RiskModule is IRiskModule, PolicyPoolComponent {
   // runs validation on RiskModule parameters
   function _validateParameters() internal view virtual override {
     // _maxPayoutPerPolicy no limits
-    require(exposureLimit() >= _activeExposure, "Validation: exposureLimit can't be less than actual activeExposure");
-    require(_wallet != address(0), "Validation: Wallet can't be zero address");
+    if (exposureLimit() < _activeExposure) {
+      revert ExposureLimitCannotBeLessThanActiveExposure();
+    }
+    if (_wallet == address(0)) {
+      revert NoZeroWallet();
+    }
     _validatePackedParams(_params);
   }
 
@@ -259,7 +269,9 @@ abstract contract RiskModule is IRiskModule, PolicyPoolComponent {
   }
 
   function setWallet(address wallet_) external onlyComponentRole(RM_PROVIDER_ROLE) {
-    require(wallet_ != address(0), "RiskModule: wallet cannot be the zero address");
+    if (wallet_ == address(0)) {
+      revert NoZeroWallet();
+    }
     _wallet = wallet_;
     _parameterChanged(IAccessManager.GovernanceActions.setWallet, uint256(uint160(wallet_)), false);
   }
@@ -269,32 +281,17 @@ abstract contract RiskModule is IRiskModule, PolicyPoolComponent {
     uint256 lossProb,
     uint40 expiration
   ) public view virtual returns (uint256) {
-    return _getMinimumPremium(payout, lossProb, expiration, params());
+    return _getMinimumPremium(payout, lossProb, expiration, uint40(block.timestamp), params());
   }
 
   function _getMinimumPremium(
     uint256 payout,
     uint256 lossProb,
     uint40 expiration,
+    uint40 start,
     Params memory p
-  ) internal view returns (uint256) {
-    uint256 purePremium = payout.wadMul(lossProb.wadMul(p.moc));
-    uint256 jrScr = payout.wadMul(p.jrCollRatio);
-    if (jrScr > purePremium) {
-      jrScr -= purePremium;
-    } else {
-      jrScr = 0;
-    }
-    uint256 srScr = payout.wadMul(p.collRatio);
-    if (srScr > (purePremium + jrScr)) {
-      srScr -= purePremium + jrScr;
-    } else {
-      srScr = 0;
-    }
-    uint256 jrCoc = jrScr.wadMul((p.jrRoc * (expiration - block.timestamp)).wadDiv(SECONDS_IN_YEAR_WAD));
-    uint256 srCoc = srScr.wadMul((p.srRoc * (expiration - block.timestamp)).wadDiv(SECONDS_IN_YEAR_WAD));
-    uint256 ensuroCommission = purePremium.wadMul(p.ensuroPpFee) + (jrCoc + srCoc).wadMul(p.ensuroCocFee);
-    return purePremium + ensuroCommission + (jrCoc + srCoc);
+  ) internal pure returns (uint256) {
+    return Policy.getMinimumPremium(p, payout, lossProb, expiration, start).totalPremium;
   }
 
   /**
@@ -334,11 +331,11 @@ abstract contract RiskModule is IRiskModule, PolicyPoolComponent {
     uint96 internalId,
     Params memory params_
   ) internal returns (Policy.PolicyData memory policy) {
+    uint40 now_ = uint40(block.timestamp);
     if (premium == type(uint256).max) {
-      premium = _getMinimumPremium(payout, lossProb, expiration, params_);
+      premium = _getMinimumPremium(payout, lossProb, expiration, now_, params_);
     }
     require(premium < payout, "Premium must be less than payout");
-    uint40 now_ = uint40(block.timestamp);
     require(expiration > now_, "Expiration must be in the future");
     require(((expiration - now_) / 3600) < _params.maxDuration, "Policy exceeds max duration");
     require(onBehalfOf != address(0), "Customer can't be zero address");
@@ -381,7 +378,7 @@ abstract contract RiskModule is IRiskModule, PolicyPoolComponent {
     Params memory params_
   ) internal virtual returns (Policy.PolicyData memory policy) {
     if (premium == type(uint256).max) {
-      premium = _getMinimumPremium(payout, lossProb, expiration, params_);
+      premium = _getMinimumPremium(payout, lossProb, expiration, oldPolicy.start, params_);
     }
     require(premium < payout, "Premium must be less than payout");
     require(oldPolicy.expiration > uint40(block.timestamp), "Old policy is expired");

package/contracts/SignedBucketRiskModule.sol

@@ -2,15 +2,16 @@
 pragma solidity ^0.8.0;
 
 import {ECDSA} from "@openzeppelin/contracts/utils/cryptography/ECDSA.sol";
+
 import {IPolicyPool} from "./interfaces/IPolicyPool.sol";
 import {IPremiumsAccount} from "./interfaces/IPremiumsAccount.sol";
-import {RiskModule} from "./RiskModule.sol";
 import {Policy} from "./Policy.sol";
+import {RiskModule} from "./RiskModule.sol";
 
 /**
- * @title SignedQuote Risk Module
+ * @title SignedBucket Risk Module
  * @dev Risk Module that for policy creation verifies the different components of the price have been signed by a
-        trusted account (PRICER_ROLE). One of the components of the price it's a bucket id that groups policies within
+        trusted account (PRICER_ROLE). One of the components of the price is a bucket id that groups policies within
         a risk module, with different parameters (such as collaterallization levels or fees).
         For the resolution (resolvePolicy), it has to be called by an authorized user
   * @custom:security-contact security@ensuro.co
@@ -18,12 +19,10 @@ import {Policy} from "./Policy.sol";
  */
 contract SignedBucketRiskModule is RiskModule {
   bytes32 public constant POLICY_CREATOR_ROLE = keccak256("POLICY_CREATOR_ROLE");
+  bytes32 public constant REPLACER_ROLE = keccak256("REPLACER_ROLE");
   bytes32 public constant PRICER_ROLE = keccak256("PRICER_ROLE");
   bytes32 public constant RESOLVER_ROLE = keccak256("RESOLVER_ROLE");
 
-  /// @custom:oz-upgrades-unsafe-allow state-variable-immutable
-  bool internal immutable _creationIsOpen;
-
   mapping(uint256 => PackedParams) internal _buckets;
 
   /**
@@ -47,14 +46,12 @@ contract SignedBucketRiskModule is RiskModule {
    */
   event NewSignedPolicy(uint256 indexed policyId, bytes32 policyData);
 
+  error QuoteExpired();
+  error BucketCannotBeZero();
+  error BucketNotFound();
+
   /// @custom:oz-upgrades-unsafe-allow constructor
-  constructor(
-    IPolicyPool policyPool_,
-    IPremiumsAccount premiumsAccount_,
-    bool creationIsOpen_
-  ) RiskModule(policyPool_, premiumsAccount_) {
-    _creationIsOpen = creationIsOpen_;
-  }
+  constructor(IPolicyPool policyPool_, IPremiumsAccount premiumsAccount_) RiskModule(policyPool_, premiumsAccount_) {}
 
   /**
    * @dev Initializes the RiskModule
@@ -89,9 +86,7 @@ contract SignedBucketRiskModule is RiskModule {
     bytes32 quoteSignatureVS,
     uint40 quoteValidUntil
   ) internal view {
-    if (!_creationIsOpen)
-      _policyPool.access().checkComponentRole(address(this), POLICY_CREATOR_ROLE, _msgSender(), false);
-    require(quoteValidUntil >= block.timestamp, "Quote expired");
+    if (quoteValidUntil < block.timestamp) revert QuoteExpired();
 
     /**
      * Checks the quote has been signed by an authorized user
@@ -134,55 +129,6 @@ contract SignedBucketRiskModule is RiskModule {
     return createdPolicy;
   }
 
-  /**
-   * @dev Creates a new Policy using a signed quote. The caller is the payer of the policy. Returns all the struct, not just the id.
-   *
-   * Requirements:
-   * - The caller approved the spending of the premium to the PolicyPool
-   * - The quote has been signed by an address with the component role PRICER_ROLE
-   *
-   *  Emits:
-   * - {PolicyPool.NewPolicy}
-   *  - {NewSignedPolicy}
-   *
-   * @param payout The exposure (maximum payout) of the policy
-   * @param premium The premium that will be paid by the payer
-   * @param lossProb The probability of having to pay the maximum payout (wad)
-   * @param expiration The expiration of the policy (timestamp)
-   * @param onBehalfOf The policy holder
-   * @param policyData A hash of the private details of the policy. The last 96 bits will be used as internalId
-   * @param bucketId Identifies the group to which the policy belongs (that defines the RM parameters applicable to it)
-   * @param quoteSignatureR The signature of the quote. R component (EIP-2098 signature)
-   * @param quoteSignatureVS The signature of the quote. VS component (EIP-2098 signature)
-   * @param quoteValidUntil The expiration of the quote
-   * @return createdPolicy Returns the created policy
-   */
-  function newPolicyFull(
-    uint256 payout,
-    uint256 premium,
-    uint256 lossProb,
-    uint40 expiration,
-    address onBehalfOf,
-    bytes32 policyData,
-    uint256 bucketId,
-    bytes32 quoteSignatureR,
-    bytes32 quoteSignatureVS,
-    uint40 quoteValidUntil
-  ) external whenNotPaused returns (Policy.PolicyData memory createdPolicy) {
-    _checkSignature(
-      payout,
-      premium,
-      lossProb,
-      expiration,
-      policyData,
-      bucketId,
-      quoteSignatureR,
-      quoteSignatureVS,
-      quoteValidUntil
-    );
-    return _newPolicySigned(payout, premium, lossProb, expiration, policyData, bucketId, _msgSender(), onBehalfOf);
-  }
-
   /**
    * @dev Creates a new Policy using a signed quote. The caller is the payer of the policy.
    *
@@ -217,7 +163,7 @@ contract SignedBucketRiskModule is RiskModule {
     bytes32 quoteSignatureR,
     bytes32 quoteSignatureVS,
     uint40 quoteValidUntil
-  ) external whenNotPaused returns (uint256) {
+  ) external whenNotPaused onlyComponentRole(POLICY_CREATOR_ROLE) returns (uint256) {
     _checkSignature(
       payout,
       premium,
@@ -233,21 +179,22 @@ contract SignedBucketRiskModule is RiskModule {
   }
 
   /**
-   * @dev Creates a new Policy using a signed quote. The payer is the policy holder
+   * @dev Replace a policy with a new one, reusing the premium and the capital locked
    *
    * Requirements:
-   * - currency().allowance(onBehalfOf, _msgSender()) > 0
+   * - The caller approved the spending of the premium to the PolicyPool
    * - The quote has been signed by an address with the component role PRICER_ROLE
+   * - The caller has been granted component role REPLACER_ROLE or creation is open
    *
    * Emits:
+   * - {PolicyPool.PolicyReplaced}
    * - {PolicyPool.NewPolicy}
-   * - {NewSignedPolicy}
    *
-   * @param payout The exposure (maximum payout) of the policy
-   * @param premium The premium that will be paid by the payer
+   * @param oldPolicy The policy to be replaced
+   * @param payout The exposure (maximum payout) of the new policy
+   * @param premium The premium that will be paid by the caller
    * @param lossProb The probability of having to pay the maximum payout (wad)
    * @param expiration The expiration of the policy (timestamp)
-   * @param onBehalfOf The policy holder
    * @param policyData A hash of the private details of the policy. The last 96 bits will be used as internalId
    * @param bucketId Identifies the group to which the policy belongs (that defines the RM parameters applicable to it)
    * @param quoteSignatureR The signature of the quote. R component (EIP-2098 signature)
@@ -255,32 +202,18 @@ contract SignedBucketRiskModule is RiskModule {
    * @param quoteValidUntil The expiration of the quote
    * @return Returns the id of the created policy
    */
-  function newPolicyPaidByHolder(
+  function replacePolicy(
+    Policy.PolicyData calldata oldPolicy,
     uint256 payout,
     uint256 premium,
     uint256 lossProb,
     uint40 expiration,
-    address onBehalfOf,
     bytes32 policyData,
     uint256 bucketId,
     bytes32 quoteSignatureR,
     bytes32 quoteSignatureVS,
     uint40 quoteValidUntil
-  ) external whenNotPaused returns (uint256) {
-    require(
-      onBehalfOf == _msgSender() || currency().allowance(onBehalfOf, _msgSender()) > 0,
-      "Sender is not authorized to create policies onBehalfOf"
-    );
-    /**
-     * The standard is the payer should be the _msgSender() but usually, in this type of module,
-     * the sender is an operative account managed by software, where the onBehalfOf is a more
-     * secure account (hardware wallet) that does the cash movements.
-     * This non standard behaviour allows for a more secure setup, where the sender never manages
-     * cash.
-     * We leverage the currency's allowance mechanism to allow the sender access to the payer's
-     * funds.
-     * Note that this allowance won't be spent, so anything above 0 is accepted.
-     */
+  ) external whenNotPaused onlyComponentRole(REPLACER_ROLE) returns (uint256) {
     _checkSignature(
       payout,
       premium,
@@ -292,7 +225,10 @@ contract SignedBucketRiskModule is RiskModule {
       quoteSignatureVS,
       quoteValidUntil
     );
-    return _newPolicySigned(payout, premium, lossProb, expiration, policyData, bucketId, onBehalfOf, onBehalfOf).id;
+    uint96 internalId = uint96(uint256(policyData) % 2 ** 96);
+    return
+      _replacePolicy(oldPolicy, payout, premium, lossProb, expiration, _msgSender(), internalId, bucketParams(bucketId))
+        .id;
   }
 
   function resolvePolicy(
@@ -316,7 +252,7 @@ contract SignedBucketRiskModule is RiskModule {
     uint256 bucketId,
     Params calldata params_
   ) external onlyGlobalOrComponentRole2(LEVEL1_ROLE, LEVEL2_ROLE) {
-    require(bucketId != 0, "SignedBucketRiskModule: bucketId can't be zero, set default RM parameters");
+    if (bucketId == 0) revert BucketCannotBeZero();
     _buckets[bucketId] = PackedParams({
       moc: _wadTo4(params_.moc),
       jrCollRatio: _wadTo4(params_.jrCollRatio),
@@ -343,7 +279,8 @@ contract SignedBucketRiskModule is RiskModule {
    * @param bucketId Group identifier for the policies that will have these parameters
    */
   function deleteBucket(uint256 bucketId) external onlyGlobalOrComponentRole2(LEVEL1_ROLE, LEVEL2_ROLE) {
-    require(bucketId != 0, "SignedBucketRiskModule: bucketId can't be zero, set default RM parameters");
+    if (bucketId == 0) revert BucketCannotBeZero();
+    if (_buckets[bucketId].moc == 0) revert BucketNotFound();
     delete _buckets[bucketId];
     emit BucketDeleted(bucketId);
   }
@@ -351,12 +288,12 @@ contract SignedBucketRiskModule is RiskModule {
   /**
    * @dev returns the risk bucket parameters for the given bucketId
    *
-   * @param bucketId Id of the bucket of 0 if you want the default params
+   * @param bucketId Id of the bucket or 0 if you want the default params
    */
   function bucketParams(uint256 bucketId) public view returns (Params memory params_) {
     if (bucketId != 0) {
       PackedParams storage bucketParams_ = _buckets[bucketId];
-      require(bucketParams_.moc != 0, "SignedBucketRiskModule: bucket not found!");
+      if (bucketParams_.moc == 0) revert BucketNotFound();
       params_ = _unpackParams(bucketParams_);
     } else {
       params_ = params();
@@ -377,7 +314,7 @@ contract SignedBucketRiskModule is RiskModule {
     uint40 expiration,
     uint256 bucketId
   ) public view virtual returns (uint256) {
-    return _getMinimumPremium(payout, lossProb, expiration, bucketParams(bucketId));
+    return _getMinimumPremium(payout, lossProb, expiration, uint40(block.timestamp), bucketParams(bucketId));
   }
 
   /**

package/contracts/SignedQuoteRiskModule.sol

@@ -30,6 +30,8 @@ contract SignedQuoteRiskModule is RiskModule {
    */
   event NewSignedPolicy(uint256 indexed policyId, bytes32 policyData);
 
+  error QuoteExpired();
+
   /// @custom:oz-upgrades-unsafe-allow constructor
   constructor(
     IPolicyPool policyPool_,
@@ -75,7 +77,7 @@ contract SignedQuoteRiskModule is RiskModule {
   ) internal returns (Policy.PolicyData memory createdPolicy) {
     if (!_creationIsOpen)
       _policyPool.access().checkComponentRole(address(this), POLICY_CREATOR_ROLE, _msgSender(), false);
-    require(quoteValidUntil >= block.timestamp, "Quote expired");
+    if (quoteValidUntil < block.timestamp) revert QuoteExpired();
 
     /**
      * Checks the quote has been signed by an authorized user

package/contracts/interfaces/IPolicyHolder.sol

@@ -16,7 +16,7 @@ interface IPolicyHolder is IERC721Receiver {
    * No mather what's the return value or even if this function reverts, this function will not revert the policy
    * expiration.
    *
-   * The selector can be obtained in Solidity with `IPolicyPool.onPolicyExpired.selector`.
+   * The selector can be obtained in Solidity with `IPolicyHolder.onPolicyExpired.selector`.
    */
   function onPolicyExpired(address operator, address from, uint256 policyId) external returns (bytes4);
 
@@ -27,7 +27,7 @@ interface IPolicyHolder is IERC721Receiver {
    * If interface is not implemented by the recipient, it will be ignored and the payout will be successful.
    * If any other value is returned or it reverts, the policy resolution / payout will be reverted.
    *
-   * The selector can be obtained in Solidity with `IPolicyPool.onPayoutReceived.selector`.
+   * The selector can be obtained in Solidity with `IPolicyHolder.onPayoutReceived.selector`.
    */
   function onPayoutReceived(address operator, address from, uint256 policyId, uint256 amount) external returns (bytes4);
 }

package/contracts/interfaces/IPolicyHolderV2.sol

@@ -0,0 +1,29 @@
+// SPDX-License-Identifier: Apache-2.0
+pragma solidity ^0.8.0;
+
+import {IPolicyHolder} from "./IPolicyHolder.sol";
+
+/**
+ * @title Policy holder interface - V2 of the interface that adds onPolicyReplaced endpoint
+ * @dev Interface for any contract that wants to be a holder of Ensuro Policies and receive notification of payouts and
+ *      replacements.
+ *
+ *      Implementors of this interface MUST return true on supportsInterface for both IPolicyHolder and IPolicyHolderV2.
+ */
+interface IPolicyHolderV2 is IPolicyHolder {
+  /**
+   * @dev Whenever a policy is replaced, this function is called
+   *
+   * It must return its Solidity selector to confirm the payout.
+   * If interface is not implemented by the recipient, it will be ignored and the replacement will be successful.
+   * If any other value is returned or it reverts, the policy replacement will be reverted.
+   *
+   * The selector can be obtained in Solidity with `IPolicyHolderV2.onPolicyReplaced.selector`.
+   */
+  function onPolicyReplaced(
+    address operator,
+    address from,
+    uint256 oldPolicyId,
+    uint256 newPolicyId
+  ) external returns (bytes4);
+}

package/contracts/mocks/PolicyHolderMock.sol

@@ -2,22 +2,29 @@
 pragma solidity ^0.8.0;
 
 import {IPolicyHolder} from "../interfaces/IPolicyHolder.sol";
+import {IPolicyHolderV2} from "../interfaces/IPolicyHolderV2.sol";
 import {IERC721Receiver} from "@openzeppelin/contracts/token/ERC721/IERC721Receiver.sol";
 import {IERC165} from "@openzeppelin/contracts/utils/introspection/IERC165.sol";
+import {StorageSlot} from "@openzeppelin/contracts/utils/StorageSlot.sol";
 
-contract PolicyHolderMock is IPolicyHolder {
+contract PolicyHolderMock is IPolicyHolderV2 {
   uint256 public policyId;
   uint256 public payout;
   bool public fail;
+  bool public failReplace;
   bool public emptyRevert;
   bool public notImplemented;
   bool public badlyImplemented;
+  bool public badlyImplementedReplace;
   bool public noERC165;
+  bool public noV2;
+  uint256 public spendGasCount;
 
   enum NotificationKind {
     PolicyReceived,
     PayoutReceived,
-    PolicyExpired
+    PolicyExpired,
+    PolicyReplaced
   }
 
   event NotificationReceived(NotificationKind kind, uint256 policyId, address operator, address from);
@@ -29,12 +36,21 @@ contract PolicyHolderMock is IPolicyHolder {
     emptyRevert = false;
     noERC165 = false;
     payout = type(uint256).max;
+    spendGasCount = 0;
   }
 
   function setFail(bool fail_) external {
     fail = fail_;
   }
 
+  function setFailReplace(bool failReplace_) external {
+    failReplace = failReplace_;
+  }
+
+  function setSpendGasCount(uint256 spendGasCount_) external {
+    spendGasCount = spendGasCount_;
+  }
+
   function setNotImplemented(bool notImplemented_) external {
     notImplemented = notImplemented_;
   }
@@ -43,6 +59,14 @@ contract PolicyHolderMock is IPolicyHolder {
     badlyImplemented = badlyImplemented_;
   }
 
+  function setBadlyImplementedReplace(bool badlyImplementedReplace_) external {
+    badlyImplementedReplace = badlyImplementedReplace_;
+  }
+
+  function setNoV2(bool noV2_) external {
+    noV2 = noV2_;
+  }
+
   function setNoERC165(bool noERC165_) external {
     noERC165 = noERC165_;
   }
@@ -51,6 +75,13 @@ contract PolicyHolderMock is IPolicyHolder {
     emptyRevert = emptyRevert_;
   }
 
+  function spendGas() internal {
+    // Spends gas doing storage writes
+    for (uint256 i = 0; i < spendGasCount; i++) {
+      StorageSlot.getUint256Slot(bytes32(100 + i)).value = i + 1;
+    }
+  }
+
   /**
    * @dev See {IERC165-supportsInterface}.
    */
@@ -60,7 +91,10 @@ contract PolicyHolderMock is IPolicyHolder {
         revert(0, 0)
       }
     if (notImplemented) return false;
-    return interfaceId == type(IPolicyHolder).interfaceId || interfaceId == type(IERC165).interfaceId;
+    return
+      interfaceId == type(IPolicyHolder).interfaceId ||
+      (!noV2 && interfaceId == type(IPolicyHolderV2).interfaceId) ||
+      interfaceId == type(IERC165).interfaceId;
   }
 
   function onERC721Received(
@@ -82,6 +116,8 @@ contract PolicyHolderMock is IPolicyHolder {
 
     if (badlyImplemented) return bytes4(0x0badf00d);
 
+    spendGas();
+
     return IERC721Receiver.onERC721Received.selector;
   }
 
@@ -98,17 +134,13 @@ contract PolicyHolderMock is IPolicyHolder {
 
     if (badlyImplemented) return bytes4(0x0badf00d);
 
+    spendGas();
+
     return IPolicyHolder.onPolicyExpired.selector;
   }
 
   /**
-   * @dev Whenever an Policy is resolved with payout > 0, this function is called
-   *
-   * It must return its Solidity selector to confirm the payout.
-   * If interface is not implemented by the recipient, it will be ignored and the payout will be successful.
-   * If any other value is returned or it reverts, the policy resolution / payout will be reverted.
-   *
-   * The selector can be obtained in Solidity with `IPolicyPool.onPayoutReceived.selector`.
+   * @dev See {IPolicyHolderV2-onPayoutReceived}.
    */
   function onPayoutReceived(
     address operator,
@@ -128,6 +160,35 @@ contract PolicyHolderMock is IPolicyHolder {
 
     if (badlyImplemented) return bytes4(0x0badf00d);
 
+    spendGas();
+
     return IPolicyHolder.onPayoutReceived.selector;
   }
+
+  /**
+   * @dev See {IPolicyHolderV2-onPolicyReplaced}.
+   */
+  function onPolicyReplaced(
+    address operator,
+    address from,
+    uint256 oldPolicyId,
+    uint256 newPolicyId
+  ) external override returns (bytes4) {
+    if (noV2) revert("Shouldn't call this method if V2 not enabled");
+    if (failReplace)
+      if (emptyRevert)
+        assembly {
+          revert(0, 0)
+        }
+      else revert("onPolicyReplaced: They told me I have to fail");
+    policyId = oldPolicyId;
+    payout = newPolicyId;
+    emit NotificationReceived(NotificationKind.PolicyReplaced, oldPolicyId, operator, from);
+
+    if (badlyImplementedReplace) return bytes4(0x0badf00d);
+
+    spendGas();
+
+    return IPolicyHolderV2.onPolicyReplaced.selector;
+  }
 }

package/js/utils.js

@@ -144,22 +144,27 @@ async function grantRole(hre, contract, role, user, txOverrides = {}, log = () =
  * @param {Interface} interface The interface of the contract that contains the requested event
  * @param {TransactionReceipt} receipt Transaction receipt containing the events in the logs
  * @param {String} eventName The name of the event we are interested in
+ * @param {Boolean} firstOnly If false, returns all the events matching the name
+ * @param {String} contractAddress If not null, if returns only those events generated by the specified contract
  * @returns {LogDescription}
  */
-function getTransactionEvent(interface, receipt, eventName) {
+function getTransactionEvent(interface, receipt, eventName, firstOnly = true, contractAddress = null) {
+  const ret = [];
   // for each log in the transaction receipt
   for (const log of receipt.logs) {
     let parsedLog;
+    if (contractAddress !== null && contractAddress !== log.address) continue;
     try {
       parsedLog = interface.parseLog(log);
     } catch (error) {
       continue;
     }
     if (parsedLog?.name == eventName) {
-      return parsedLog;
+      if (firstOnly) return parsedLog;
+      ret.push(parsedLog);
     }
   }
-  return null; // not found
+  return firstOnly ? null : ret;
 }
 
 /**
@@ -246,7 +251,7 @@ async function defaultPolicyParams(
   _A = amountFunction(6)
 ) {
   const now = await helpers.time.latest();
-  const rmAddress = rm ? await ethers.resolveAddress(rm) : rm;
+  const rmAddress = rm ? getAddress(rm) : null;
   return {
     rmAddress,
     payout: payout || _A(1000),
@@ -295,6 +300,7 @@ module.exports = {
   amountFunction,
   defaultPolicyParams,
   defaultBucketParams,
+  getAddress,
   getComponentRole,
   getDefaultSigner,
   getRole,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@ensuro/core",
   "description": "Ensuro - Decentralized insurance protocol",
-  "version": "2.8.0-beta2",
+  "version": "2.8.1",
   "files": [
     "**/*.sol",
     "/build/contracts/*.json",

package/contracts/TieredSignedQuoteRiskModule.sol

@@ -1,159 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-pragma solidity ^0.8.0;
-
-import {SafeCast} from "@openzeppelin/contracts/utils/math/SafeCast.sol";
-import {IPolicyPool} from "./interfaces/IPolicyPool.sol";
-import {IPremiumsAccount} from "./interfaces/IPremiumsAccount.sol";
-import {SignedQuoteRiskModule} from "./SignedQuoteRiskModule.sol";
-import {Policy} from "./Policy.sol";
-
-/**
- * @title Tiered SignedQuote Risk Module
- * @dev Risk Module that for policy creation verifies the different components of the price have been signed by a
- *      trusted account (PRICER_ROLE). For the resolution (resolvePolicy), it has to be called by an authorized user.
- *
- *      It allows different collaterallization levels for different policy types, by defining tiers or buckets of loss
- *      probability.
- *
- *      Each bucket's loss probability represents the upper bound of the bucket (inclusive). The global parameters of
- *      the contract represent the 100% bucket.
- *
- * @custom:security-contact security@ensuro.co
- * @author Ensuro
- */
-contract TieredSignedQuoteRiskModule is SignedQuoteRiskModule {
-  using SafeCast for uint256;
-
-  uint8 public constant MAX_BUCKETS = 4;
-
-  struct PackedBuckets {
-    uint64[MAX_BUCKETS] lossProbs;
-  }
-
-  PackedBuckets internal _buckets;
-  PackedParams[MAX_BUCKETS] internal _bucketParams;
-
-  /**
-   * @dev Emitted when a new risk bucket is created.
-   * @param lossProb The loss probability of the new bucket.
-   * @param params The packed parameters of the new bucket.
-   */
-  event NewBucket(uint256 lossProb, Params params);
-
-  /**
-   * @dev Emitted when the risks buckets are reset and only the default one remains
-   */
-  event BucketsReset();
-
-  /// @custom:oz-upgrades-unsafe-allow constructor
-  constructor(
-    IPolicyPool policyPool_,
-    IPremiumsAccount premiumsAccount_,
-    bool creationIsOpen_
-  ) SignedQuoteRiskModule(policyPool_, premiumsAccount_, creationIsOpen_) {} // solhint-disable-line no-empty-blocks
-
-  /**
-   * @dev Adds a new risk bucket with the given loss probability and parameters after the last one.
-   *
-   * Requirements:
-   *
-   * - The caller must have the LEVEL1_ROLE or LEVEL2_ROLE
-   *
-   * @param lossProb The loss probability of the new bucket.
-   * @param params_ The parameters of the new bucket.
-   */
-  function pushBucket(
-    uint256 lossProb,
-    Params calldata params_
-  ) external onlyGlobalOrComponentRole2(LEVEL1_ROLE, LEVEL2_ROLE) {
-    uint256 newBucket = 0;
-    if (_buckets.lossProbs[0] != 0) {
-      // solhint-disable-next-line no-empty-blocks
-      for (newBucket = 1; newBucket < MAX_BUCKETS && _buckets.lossProbs[newBucket] != 0; newBucket++) {}
-      require(newBucket < MAX_BUCKETS, "No more than 4 buckets accepted");
-      require(lossProb > uint256(_buckets.lossProbs[newBucket - 1]), "lossProb <= last lossProb - reset instead");
-    }
-    _buckets.lossProbs[newBucket] = lossProb.toUint64();
-    _bucketParams[newBucket] = PackedParams({
-      moc: _wadTo4(params_.moc),
-      jrCollRatio: _wadTo4(params_.jrCollRatio),
-      collRatio: _wadTo4(params_.collRatio),
-      ensuroPpFee: _wadTo4(params_.ensuroPpFee),
-      ensuroCocFee: _wadTo4(params_.ensuroCocFee),
-      jrRoc: _wadTo4(params_.jrRoc),
-      srRoc: _wadTo4(params_.srRoc),
-      maxPayoutPerPolicy: type(uint32).max, // unused, but needs to be > 0
-      exposureLimit: type(uint32).max, //unused, but needs to be > 0
-      maxDuration: type(uint16).max //unused
-    });
-    if (newBucket < MAX_BUCKETS - 1) {
-      _buckets.lossProbs[newBucket + 1] = 0;
-    }
-    _validatePackedParams(_bucketParams[newBucket]);
-    emit NewBucket(lossProb, params_);
-  }
-
-  function resetBuckets() external onlyGlobalOrComponentRole2(LEVEL1_ROLE, LEVEL2_ROLE) {
-    _buckets.lossProbs[0] = 0;
-    emit BucketsReset();
-  }
-
-  /**
-   * @dev returns the risk bucket parameters for the given loss probability
-   */
-  function bucketParams(uint256 lossProb) public view returns (Params memory) {
-    for (uint256 i = 0; i < MAX_BUCKETS && _buckets.lossProbs[i] != 0; i++) {
-      if (lossProb <= _buckets.lossProbs[i]) {
-        return _unpackParams(_bucketParams[i]);
-      }
-    }
-    return this.params();
-  }
-
-  function _newPolicy(
-    uint256 payout,
-    uint256 premium,
-    uint256 lossProb,
-    uint40 expiration,
-    address payer,
-    address onBehalfOf,
-    uint96 internalId
-  ) internal override whenNotPaused returns (Policy.PolicyData memory) {
-    return
-      _newPolicyWithParams(
-        payout,
-        premium,
-        lossProb,
-        expiration,
-        payer,
-        onBehalfOf,
-        internalId,
-        bucketParams(lossProb)
-      );
-  }
-
-  function getMinimumPremium(
-    uint256 payout,
-    uint256 lossProb,
-    uint40 expiration
-  ) public view virtual override returns (uint256) {
-    return _getMinimumPremium(payout, lossProb, expiration, bucketParams(lossProb));
-  }
-
-  /**
-   * @dev returns the current risk bucket limits
-   */
-  function buckets() external view returns (uint256[MAX_BUCKETS] memory result) {
-    for (uint256 i = 0; i < MAX_BUCKETS && _buckets.lossProbs[i] > 0; i++) {
-      result[i] = _buckets.lossProbs[i];
-    }
-    return result;
-  }
-
-  /**
-   * @dev This empty reserved space is put in place to allow future versions to add new
-   * variables without shifting down storage in the inheritance chain.
-   * See https://docs.openzeppelin.com/contracts/4.x/upgradeable#storage_gaps
-   */
-  uint256[45] private __gap;
-}