@etherisc/gif-next 0.0.2-c00cf5d-513 → 0.0.2-c0457ac-280

package/contracts/instance/IInstance.sol

@@ -3,6 +3,7 @@ pragma solidity ^0.8.20;
 
 import {IAccessManaged} from "@openzeppelin/contracts/access/manager/IAccessManaged.sol";
 
+import {Amount} from "../type/Amount.sol";
 import {ClaimId} from "../type/ClaimId.sol";
 import {DistributorType} from "../type/DistributorType.sol";
 import {PayoutId} from "../type/PayoutId.sol";
@@ -13,6 +14,8 @@ import {RiskId} from "../type/RiskId.sol";
 import {VersionPart} from "../type/Version.sol";
 import {Key32} from "../type/Key32.sol";
 import {RoleId} from "../type/RoleId.sol";
+import {Seconds} from "../type/Seconds.sol";
+import {UFixed} from "../type/UFixed.sol";
 
 import {AccessManagerExtendedInitializeable} from "../shared/AccessManagerExtendedInitializeable.sol";
 import {IRegisterable} from "../shared/IRegisterable.sol";
@@ -24,7 +27,7 @@ import {BundleManager} from "./BundleManager.sol";
 import {InstanceReader} from "./InstanceReader.sol";
 import {InstanceStore} from "./InstanceStore.sol";
 
-import {IKeyValueStore} from "./base/IKeyValueStore.sol";
+import {IKeyValueStore} from "../shared/IKeyValueStore.sol";
 
 import {IAccess} from "./module/IAccess.sol";
 
@@ -37,7 +40,6 @@ import {IPolicyService} from "../product/IPolicyService.sol";
 import {IBundleService} from "../pool/IBundleService.sol";
 
 
-
 interface IInstance is 
     IRegisterable, 
     ITransferInterceptor, 
@@ -56,6 +58,10 @@ interface IInstance is
     error ErrorInstanceInstanceStoreAlreadySet(address instanceStore);
     error ErrorInstanceInstanceStoreAuthorityMismatch(address instanceAuthority);
 
+    struct InstanceInfo {
+        uint64 requestsCount;
+    }
+
     function createRole(string memory roleName, string memory adminName) external returns (RoleId roleId, RoleId admin);
     function grantRole(RoleId roleId, address account) external;
     function revokeRole(RoleId roleId, address account) external;
@@ -64,11 +70,13 @@ interface IInstance is
     function setTargetFunctionRole(string memory targetName, bytes4[] calldata selectors, RoleId roleId) external;
     function setTargetLocked(address target, bool locked) external;
 
-    function getDistributionService() external view returns (IDistributionService);
-    function getProductService() external view returns (IProductService);
-    function getPoolService() external view returns (IPoolService);
-    function getPolicyService() external view returns (IPolicyService);
-    function getBundleService() external view returns (IBundleService);
+    function setStakingLockingPeriod(Seconds stakeLockingPeriod) external;
+    function setStakingRewardRate(UFixed rewardRate) external;
+    function refillStakingRewardReserves(Amount dipAmount) external;
+
+    /// @dev defunds the staking reward reserves for the specified target
+    /// permissioned: only the target owner may call this function
+    function withdrawStakingRewardReserves(Amount dipAmount) external returns (Amount newBalance);
 
     function getMajorVersion() external pure returns (VersionPart majorVersion);
     function getInstanceReader() external view returns (InstanceReader);

package/contracts/instance/IInstanceService.sol

@@ -1,21 +1,28 @@
 // SPDX-License-Identifier: Apache-2.0
 pragma solidity ^0.8.20;
 
+import {Amount} from "../type/Amount.sol";
+import {BundleManager} from "./BundleManager.sol";
+import {Instance} from "./Instance.sol";
+import {IService} from "../shared/IService.sol";
 import {NftId} from "../type/NftId.sol";
 import {ObjectType} from "../type/ObjectType.sol";
 import {RoleId} from "../type/RoleId.sol";
-import {IService} from "../shared/IService.sol";
-
-import {InstanceAdmin} from "./InstanceAdmin.sol";
-import {Instance} from "./Instance.sol";
-import {InstanceReader} from "./InstanceReader.sol";
-import {BundleManager} from "./BundleManager.sol";
-import {InstanceStore} from "./InstanceStore.sol";
+import {Seconds} from "../type/Seconds.sol";
+import {UFixed} from "../type/UFixed.sol";
+import {VersionPart} from "../type/Version.sol";
 
 interface IInstanceService is IService {
 
+    // onlyInstance
+    error ErrorInstanceServiceNotRegistered(address instance);
+    error ErrorInstanceServiceNotInstance(address instance, ObjectType objectType);
+    error ErrorInstanceServiceInstanceVersionMismatch(address instance, VersionPart instanceVersion);
+
+    error ErrorInstanceServiceComponentNotInstanceLinked(address component);
+
     error ErrorInstanceServiceMasterInstanceAlreadySet();
-    error ErrorInstanceServiceMasterOzAccessManagerAlreadySet();
+    error ErrorInstanceServiceMasterInstanceAccessManagerAlreadySet();
     error ErrorInstanceServiceMasterInstanceAdminAlreadySet();
     error ErrorInstanceServiceMasterBundleManagerAlreadySet();
     error ErrorInstanceServiceInstanceAddressZero();
@@ -37,8 +44,7 @@ interface IInstanceService is IService {
     error ErrorInstanceServiceInstanceStoreAuthorityMismatch();
 
     error ErrorInstanceServiceRequestUnauhorized(address caller);
-    error ErrorInstanceServiceNotInstanceOwner(address caller, NftId instanceNftId);
-    error ErrorInstanceServiceNotInstance(NftId nftId);
+    error ErrorInstanceServiceNotInstanceNftId(NftId nftId);
     error ErrorInstanceServiceComponentNotRegistered(address componentAddress);
     error ErrorInstanceServiceInstanceComponentMismatch(NftId instanceNftId, NftId componentNftId);
     error ErrorInstanceServiceInvalidComponentType(address componentAddress, ObjectType expectedType, ObjectType componentType);
@@ -56,10 +62,29 @@ interface IInstanceService is IService {
     function createInstanceClone()
         external 
         returns (
+            // TODO check if Instance can be changed to IInstance
             Instance clonedInstance,
             NftId instanceNftId
         );
 
+
+    function setStakingLockingPeriod(Seconds stakeLockingPeriod) external;
+    function setStakingRewardRate(UFixed rewardRate) external;
+    function refillStakingRewardReserves(address rewardProvider, Amount dipAmount) external;
+
+    /// @dev defunds the staking reward reserves for the specified target
+    /// permissioned: only the target owner may call this function
+    function withdrawStakingRewardReserves(Amount dipAmount) external returns (Amount newBalance);
+
+
+    function createComponentTarget(
+        NftId instanceNftId,
+        address targetAddress,
+        string memory targetName,
+        bytes4[][] memory selectors,
+        RoleId[] memory roles
+    ) external;
+
     function createGifTarget(
         NftId instanceNftId,
         address targetAddress,

package/contracts/instance/Instance.sol

@@ -3,16 +3,19 @@ pragma solidity ^0.8.20;
 
 import {AccessManagedUpgradeable} from "@openzeppelin/contracts-upgradeable/access/manager/AccessManagedUpgradeable.sol";
 
+import {Amount} from "../type/Amount.sol";
 import {Key32} from "../type/Key32.sol";
 import {NftId} from "../type/NftId.sol";
 import {RiskId} from "../type/RiskId.sol";
 import {ObjectType, BUNDLE, DISTRIBUTION, INSTANCE, POLICY, POOL, ROLE, PRODUCT, TARGET, COMPONENT, DISTRIBUTOR, DISTRIBUTOR_TYPE} from "../type/ObjectType.sol";
 import {RoleId, RoleIdLib, eqRoleId, ADMIN_ROLE, INSTANCE_ROLE, INSTANCE_OWNER_ROLE} from "../type/RoleId.sol";
-import {VersionPart, VersionPartLib} from "../type/Version.sol";
 import {ClaimId} from "../type/ClaimId.sol";
 import {ReferralId} from "../type/Referral.sol";
 import {PayoutId} from "../type/PayoutId.sol";
 import {DistributorType} from "../type/DistributorType.sol";
+import {Seconds} from "../type/Seconds.sol";
+import {UFixed} from "../type/UFixed.sol";
+import {VersionPart, VersionPartLib} from "../type/Version.sol";
 
 import {Registerable} from "../shared/Registerable.sol";
 import {TokenHandler} from "../shared/TokenHandler.sol";
@@ -21,17 +24,19 @@ import {AccessManagerExtendedInitializeable} from "../shared/AccessManagerExtend
 import {IRegistry} from "../registry/IRegistry.sol";
 
 import {IInstance} from "./IInstance.sol";
+import {IInstanceService} from "./IInstanceService.sol";
 import {InstanceReader} from "./InstanceReader.sol";
 import {InstanceAdmin} from "./InstanceAdmin.sol";
 import {BundleManager} from "./BundleManager.sol";
 import {InstanceStore} from "./InstanceStore.sol";
 
+import {KeyValueStore} from "../shared/KeyValueStore.sol";
+
 import {IBundle} from "./module/IBundle.sol";
 import {IComponents} from "./module/IComponents.sol";
 import {IDistribution} from "./module/IDistribution.sol";
 import {IPolicy} from "./module/IPolicy.sol";
 import {IRisk} from "./module/IRisk.sol";
-import {ISetup} from "./module/ISetup.sol";
 
 import {IDistributionService} from "../distribution/IDistributionService.sol";
 import {IPoolService} from "../pool/IPoolService.sol";
@@ -48,6 +53,7 @@ contract Instance is
 
     bool private _initialized;
 
+    IInstanceService internal _instanceService;
     InstanceAdmin internal _instanceAdmin;
     InstanceReader internal _instanceReader;
     BundleManager internal _bundleManager;
@@ -73,13 +79,52 @@ contract Instance is
         IRegistry registry = IRegistry(registryAddress);
         initializeRegisterable(registryAddress, registry.getNftId(), INSTANCE(), true, initialOwner, "");
 
+        _instanceService = IInstanceService(
+            getRegistry().getServiceAddress(
+                INSTANCE(), 
+                getMajorVersion()));
+
         registerInterface(type(IInstance).interfaceId);    
     }
 
+    //--- Staking ----------------------------------------------------------//
+
+    function setStakingLockingPeriod(Seconds stakeLockingPeriod)
+        external
+        // TODO decide if onlyOwner or restricted to instance owner role is better
+        onlyOwner()
+    {
+        _instanceService.setStakingLockingPeriod(stakeLockingPeriod);
+    }
+
+    function setStakingRewardRate(UFixed rewardRate)
+        external
+        onlyOwner()
+    {
+        _instanceService.setStakingRewardRate(rewardRate);
+    }
+
+    function refillStakingRewardReserves(Amount dipAmount)
+        external
+        onlyOwner()
+    {
+        address instanceOwner = msg.sender;
+        _instanceService.refillStakingRewardReserves(instanceOwner, dipAmount);
+    }
+
+    function withdrawStakingRewardReserves(Amount dipAmount)
+        external
+        onlyOwner()
+        returns (Amount newBalance)
+    {
+        return _instanceService.withdrawStakingRewardReserves(dipAmount);
+    }
+
     //--- Roles ------------------------------------------------------------//
 
     function createRole(string memory roleName, string memory adminName)
         external
+        // TODO decide if onlyOwner or restricted to instance owner role is better
         restricted // INSTANCE_OWNER_ROLE
         returns (RoleId roleId, RoleId admin)
     {
@@ -88,6 +133,7 @@ contract Instance is
 
     function grantRole(RoleId roleId, address account) 
         external 
+        // TODO decide if onlyOwner or restricted to instance owner role is better
         restricted // INSTANCE_OWNER_ROLE
     {
         AccessManagerExtendedInitializeable(authority()).grantRole(roleId.toInt(), account, 0);
@@ -95,6 +141,7 @@ contract Instance is
 
     function revokeRole(RoleId roleId, address account) 
         external 
+        // TODO decide if onlyOwner or restricted to instance owner role is better
         restricted // INSTANCE_OWNER_ROLE
     {
         AccessManagerExtendedInitializeable(authority()).revokeRole(roleId.toInt(), account);
@@ -104,6 +151,7 @@ contract Instance is
 
     function createTarget(address target, string memory name) 
         external 
+        // TODO decide if onlyOwner or restricted to instance owner role is better
         restricted // INSTANCE_OWNER_ROLE
     {
         _instanceAdmin.createTarget(target, name);
@@ -127,7 +175,8 @@ contract Instance is
         _instanceAdmin.setTargetLockedByInstance(target, locked);
     }
 
-    //--- ITransferInterceptor ------------------------------------------------------------//
+    //--- ITransferInterceptor ----------------------------------------------//
+
     // TODO interception of child components nfts
     function nftMint(address to, uint256 tokenId) external onlyChainNft {
         _instanceAdmin.transferInstanceOwnerRole(address(0), to);
@@ -174,6 +223,16 @@ contract Instance is
         _instanceReader = instanceReader;
     }
 
+    function setInstanceStore(InstanceStore instanceStore) external restricted {
+        if(address(_instanceStore) != address(0)) {
+            revert ErrorInstanceInstanceStoreAlreadySet(address(_instanceStore));
+        }
+        if(instanceStore.authority() != authority()) {
+            revert ErrorInstanceInstanceStoreAuthorityMismatch(authority());
+        }
+        _instanceStore = instanceStore;
+    }
+
     //--- external view functions -------------------------------------------//
 
     function getInstanceReader() external view returns (InstanceReader) {
@@ -192,43 +251,13 @@ contract Instance is
         return AccessManagerExtendedInitializeable(authority());
     }
 
-    function setInstanceStore(InstanceStore instanceStore) external restricted {
-        if(address(_instanceStore) != address(0)) {
-            revert ErrorInstanceInstanceStoreAlreadySet(address(_instanceStore));
-        }
-        if(instanceStore.authority() != authority()) {
-            revert ErrorInstanceInstanceStoreAuthorityMismatch(authority());
-        }
-        _instanceStore = instanceStore;
-    }
-
     function getInstanceStore() external view returns (InstanceStore) {
         return _instanceStore;
     }
 
-    function getMajorVersion() external pure returns (VersionPart majorVersion) {
+    function getMajorVersion() public pure returns (VersionPart majorVersion) {
         return VersionPartLib.toVersionPart(GIF_MAJOR_VERSION);
     }
 
-    function getDistributionService() external view returns (IDistributionService) {
-        return IDistributionService(getRegistry().getServiceAddress(DISTRIBUTION(), VersionPart.wrap(3)));
-    }
-
-    function getProductService() external view returns (IProductService) {
-        return IProductService(getRegistry().getServiceAddress(PRODUCT(), VersionPart.wrap(3)));
-    }
-
-    function getPoolService() external view returns (IPoolService) {
-        return IPoolService(getRegistry().getServiceAddress(POOL(), VersionPart.wrap(3)));
-    }
-
-    function getPolicyService() external view returns (IPolicyService) {
-        return IPolicyService(getRegistry().getServiceAddress(POLICY(), VersionPart.wrap(3)));
-    }
-
-    function getBundleService() external view returns (IBundleService) {
-        return IBundleService(getRegistry().getServiceAddress(BUNDLE(), VersionPart.wrap(3)));
-    }
-
     //--- internal view/pure functions --------------------------------------//
 }

package/contracts/instance/InstanceAdmin.sol

@@ -242,7 +242,7 @@ contract InstanceAdmin is
         _accessManager.createRole(roleId.toInt(), name);
     }
 
-    function _validateRole(RoleId roleId, IAccess.Type rtype) internal view
+    function _validateRole(RoleId roleId, IAccess.Type rtype) internal pure
     {
         uint roleIdInt = roleId.toInt();
         if(rtype == IAccess.Type.Custom && roleIdInt < CUSTOM_ROLE_ID_MIN) {
@@ -312,7 +312,8 @@ contract InstanceAdmin is
         view 
     {}
 
-    // IMPORTANT: instance access manager MUST be of Core type -> otherwise can be locked forever
+    // IMPORTANT: instance admin MUST be of Core type -> otherwise can be locked forever
+    // TODO: consider locking gif targets in a separate function?
     function _setTargetLocked(address target, bool locked) internal
     {
         IAccess.Type targetType = _targetType[target];

package/contracts/instance/InstanceAuthorizationsLib.sol

@@ -1,8 +1,8 @@
 // SPDX-License-Identifier: Apache-2.0
 pragma solidity ^0.8.20;
 
-import {ADMIN_ROLE, INSTANCE_OWNER_ROLE, DISTRIBUTION_OWNER_ROLE, POOL_OWNER_ROLE, PRODUCT_OWNER_ROLE, INSTANCE_SERVICE_ROLE, DISTRIBUTION_SERVICE_ROLE, POOL_SERVICE_ROLE, PRODUCT_SERVICE_ROLE, APPLICATION_SERVICE_ROLE, POLICY_SERVICE_ROLE, CLAIM_SERVICE_ROLE, BUNDLE_SERVICE_ROLE, INSTANCE_ROLE} from "../type/RoleId.sol";
-import {INSTANCE, BUNDLE, APPLICATION, POLICY, CLAIM, PRODUCT, DISTRIBUTION, REGISTRY, POOL} from "../type/ObjectType.sol";
+import {ADMIN_ROLE, INSTANCE_OWNER_ROLE, ORACLE_SERVICE_ROLE, DISTRIBUTION_OWNER_ROLE, POOL_OWNER_ROLE, PRODUCT_OWNER_ROLE, ORACLE_OWNER_ROLE, INSTANCE_SERVICE_ROLE, COMPONENT_SERVICE_ROLE, DISTRIBUTION_SERVICE_ROLE, POOL_SERVICE_ROLE, PRODUCT_SERVICE_ROLE, APPLICATION_SERVICE_ROLE, POLICY_SERVICE_ROLE, CLAIM_SERVICE_ROLE, BUNDLE_SERVICE_ROLE, INSTANCE_ROLE} from "../type/RoleId.sol";
+import {APPLICATION, BUNDLE, CLAIM, COMPONENT, DISTRIBUTION, INSTANCE, ORACLE, POLICY, POOL, PRODUCT, REGISTRY} from "../type/ObjectType.sol";
 import {VersionPart} from "../type/Version.sol";
 
 import {IRegistry} from "../registry/IRegistry.sol";
@@ -30,6 +30,8 @@ library InstanceAuthorizationsLib
     {
         _createRoles(instanceAdmin);
         _createTargets(instanceAdmin, instance, bundleManager, instanceStore);
+        _grantComponentServiceAuthorizations(accessManager, instanceAdmin, instanceStore, registry, majorVersion);
+        _grantOracleServiceAuthorizations(accessManager, instanceAdmin, instanceStore, registry, majorVersion);
         _grantDistributionServiceAuthorizations(accessManager, instanceAdmin, instanceStore, registry, majorVersion);
         _grantPoolServiceAuthorizations(accessManager, instanceAdmin, instanceStore, registry, majorVersion);
         _grantProductServiceAuthorizations(accessManager, instanceAdmin, instanceStore, registry, majorVersion);
@@ -46,15 +48,19 @@ library InstanceAuthorizationsLib
         // default roles controlled by ADMIN_ROLE -> core roles
         // all set/granted only once during cloning (the only exception is INSTANCE_OWNER_ROLE, hooked to instance nft)
         instanceAdmin.createCoreRole(INSTANCE_SERVICE_ROLE(), "InstanceServiceRole");
+        instanceAdmin.createCoreRole(COMPONENT_SERVICE_ROLE(), "ComponentServiceRole");
         instanceAdmin.createCoreRole(DISTRIBUTION_SERVICE_ROLE(), "DistributionServiceRole");
+        instanceAdmin.createCoreRole(ORACLE_SERVICE_ROLE(), "OracleServiceRole");
         instanceAdmin.createCoreRole(POOL_SERVICE_ROLE(), "PoolServiceRole");
         instanceAdmin.createCoreRole(APPLICATION_SERVICE_ROLE(), "ApplicationServiceRole");
         instanceAdmin.createCoreRole(PRODUCT_SERVICE_ROLE(), "ProductServiceRole");
         instanceAdmin.createCoreRole(CLAIM_SERVICE_ROLE(), "ClaimServiceRole");
         instanceAdmin.createCoreRole(POLICY_SERVICE_ROLE(), "PolicyServiceRole");
         instanceAdmin.createCoreRole(BUNDLE_SERVICE_ROLE(), "BundleServiceRole");
+
         // default roles controlled by INSTANCE_OWNER_ROLE -> gif roles
         instanceAdmin.createGifRole(DISTRIBUTION_OWNER_ROLE(), "DistributionOwnerRole", INSTANCE_OWNER_ROLE());
+        instanceAdmin.createGifRole(ORACLE_OWNER_ROLE(), "OracleOwnerRole", INSTANCE_OWNER_ROLE());
         instanceAdmin.createGifRole(POOL_OWNER_ROLE(), "PoolOwnerRole", INSTANCE_OWNER_ROLE());
         instanceAdmin.createGifRole(PRODUCT_OWNER_ROLE(), "ProductOwnerRole", INSTANCE_OWNER_ROLE());
     }
@@ -72,29 +78,81 @@ library InstanceAuthorizationsLib
         instanceAdmin.createCoreTarget(address(instanceStore), "InstanceStore");
     }
 
-    function _grantDistributionServiceAuthorizations(
+    function _grantComponentServiceAuthorizations(
         AccessManagerExtendedInitializeable accessManager,
         InstanceAdmin instanceAdmin,
         InstanceStore instanceStore,
         IRegistry registry,
         VersionPart majorVersion)
         private
+    {
+        // configure authorization for component service on instance store
+        address componentServiceAddress = registry.getServiceAddress(COMPONENT(), majorVersion);
+        accessManager.grantRole(COMPONENT_SERVICE_ROLE().toInt(), componentServiceAddress, 0);
+
+        bytes4[] memory serviceSelectors = new bytes4[](8);
+        serviceSelectors[0] = instanceStore.createComponent.selector;
+        serviceSelectors[1] = instanceStore.updateComponent.selector;
+        serviceSelectors[2] = instanceStore.createPool.selector;
+        serviceSelectors[3] = instanceStore.createProduct.selector;
+        serviceSelectors[5] = instanceStore.updateProduct.selector;
+        serviceSelectors[6] = instanceStore.increaseBalance.selector;
+        serviceSelectors[7] = instanceStore.increaseFees.selector;
+
+        instanceAdmin.setTargetFunctionRoleByService(
+            "InstanceStore",
+            serviceSelectors,
+            COMPONENT_SERVICE_ROLE());
+    }
+
+    function _grantOracleServiceAuthorizations(
+        AccessManagerExtendedInitializeable accessManager,
+        InstanceAdmin instanceAdmin,
+        InstanceStore instanceStore,
+        IRegistry registry,
+        VersionPart majorVersion
+    )
+        private
+    {
+        // configure authorization for distribution service on instance
+        address oracleServiceAddress = registry.getServiceAddress(ORACLE(), majorVersion);
+        accessManager.grantRole(ORACLE_SERVICE_ROLE().toInt(), oracleServiceAddress, 0);
+
+        bytes4[] memory instanceOracleServiceSelectors = new bytes4[](3);
+        instanceOracleServiceSelectors[0] = instanceStore.createRequest.selector;
+        instanceOracleServiceSelectors[1] = instanceStore.updateRequest.selector;
+        instanceOracleServiceSelectors[2] = instanceStore.updateRequestState.selector;
+
+        instanceAdmin.setTargetFunctionRoleByService(
+            "InstanceStore",
+            instanceOracleServiceSelectors,
+            ORACLE_SERVICE_ROLE());
+    }
+
+    function _grantDistributionServiceAuthorizations(
+        AccessManagerExtendedInitializeable accessManager,
+        InstanceAdmin instanceAdmin,
+        InstanceStore instanceStore,
+        IRegistry registry,
+        VersionPart majorVersion
+    )
+        private
     {
         // configure authorization for distribution service on instance
         address distributionServiceAddress = registry.getServiceAddress(DISTRIBUTION(), majorVersion);
         accessManager.grantRole(DISTRIBUTION_SERVICE_ROLE().toInt(), distributionServiceAddress, 0);
-        bytes4[] memory instanceDistributionServiceSelectors = new bytes4[](11);
-        instanceDistributionServiceSelectors[0] = instanceStore.createDistributionSetup.selector;
-        instanceDistributionServiceSelectors[1] = instanceStore.updateDistributionSetup.selector;
-        instanceDistributionServiceSelectors[2] = instanceStore.createDistributorType.selector;
-        instanceDistributionServiceSelectors[3] = instanceStore.updateDistributorType.selector;
-        instanceDistributionServiceSelectors[4] = instanceStore.updateDistributorTypeState.selector;
-        instanceDistributionServiceSelectors[5] = instanceStore.createDistributor.selector;
-        instanceDistributionServiceSelectors[6] = instanceStore.updateDistributor.selector;
-        instanceDistributionServiceSelectors[7] = instanceStore.updateDistributorState.selector;
-        instanceDistributionServiceSelectors[8] = instanceStore.createReferral.selector;
-        instanceDistributionServiceSelectors[9] = instanceStore.updateReferral.selector;
-        instanceDistributionServiceSelectors[10] = instanceStore.updateReferralState.selector;
+        bytes4[] memory instanceDistributionServiceSelectors = new bytes4[](9);
+        //instanceDistributionServiceSelectors[0] = instanceStore.createDistributionSetup.selector;
+        //instanceDistributionServiceSelectors[1] = instanceStore.updateDistributionSetup.selector;
+        instanceDistributionServiceSelectors[0] = instanceStore.createDistributorType.selector;
+        instanceDistributionServiceSelectors[1] = instanceStore.updateDistributorType.selector;
+        instanceDistributionServiceSelectors[2] = instanceStore.updateDistributorTypeState.selector;
+        instanceDistributionServiceSelectors[3] = instanceStore.createDistributor.selector;
+        instanceDistributionServiceSelectors[4] = instanceStore.updateDistributor.selector;
+        instanceDistributionServiceSelectors[5] = instanceStore.updateDistributorState.selector;
+        instanceDistributionServiceSelectors[6] = instanceStore.createReferral.selector;
+        instanceDistributionServiceSelectors[7] = instanceStore.updateReferral.selector;
+        instanceDistributionServiceSelectors[8] = instanceStore.updateReferralState.selector;
         instanceAdmin.setTargetFunctionRoleByService(
             "InstanceStore",
             instanceDistributionServiceSelectors,
@@ -112,9 +170,8 @@ library InstanceAuthorizationsLib
         // configure authorization for pool service on instance
         address poolServiceAddress = registry.getServiceAddress(POOL(), majorVersion);
         accessManager.grantRole(POOL_SERVICE_ROLE().toInt(), address(poolServiceAddress), 0);
-        bytes4[] memory instancePoolServiceSelectors = new bytes4[](4);
-        instancePoolServiceSelectors[0] = instanceStore.createPoolSetup.selector;
-        instancePoolServiceSelectors[1] = instanceStore.updatePoolSetup.selector;
+        bytes4[] memory instancePoolServiceSelectors = new bytes4[](1); // TODO works with (4)
+        instancePoolServiceSelectors[0] = instanceStore.updatePool.selector;
         instanceAdmin.setTargetFunctionRoleByService(
             "InstanceStore",
             instancePoolServiceSelectors,
@@ -131,13 +188,11 @@ library InstanceAuthorizationsLib
     {
         // configure authorization for product service on instance
         address productServiceAddress = registry.getServiceAddress(PRODUCT(), majorVersion);
-        accessManager.grantRole(PRODUCT_SERVICE_ROLE().toInt(), address(productServiceAddress), 0);
-        bytes4[] memory instanceProductServiceSelectors = new bytes4[](5);
-        instanceProductServiceSelectors[0] = instanceStore.createProductSetup.selector;
-        instanceProductServiceSelectors[1] = instanceStore.updateProductSetup.selector;
-        instanceProductServiceSelectors[2] = instanceStore.createRisk.selector;
-        instanceProductServiceSelectors[3] = instanceStore.updateRisk.selector;
-        instanceProductServiceSelectors[4] = instanceStore.updateRiskState.selector;
+        accessManager.grantRole(PRODUCT_SERVICE_ROLE().toInt(), productServiceAddress, 0);
+        bytes4[] memory instanceProductServiceSelectors = new bytes4[](3);
+        instanceProductServiceSelectors[0] = instanceStore.createRisk.selector;
+        instanceProductServiceSelectors[1] = instanceStore.updateRisk.selector;
+        instanceProductServiceSelectors[2] = instanceStore.updateRiskState.selector;
         instanceAdmin.setTargetFunctionRoleByService(
             "InstanceStore",
             instanceProductServiceSelectors,
@@ -226,11 +281,13 @@ library InstanceAuthorizationsLib
     {
         // configure authorization for bundle service on instance
         address bundleServiceAddress = registry.getServiceAddress(BUNDLE(), majorVersion);
-        accessManager.grantRole(BUNDLE_SERVICE_ROLE().toInt(), address(bundleServiceAddress), 0);
-        bytes4[] memory instanceBundleServiceSelectors = new bytes4[](3);
+        accessManager.grantRole(BUNDLE_SERVICE_ROLE().toInt(), bundleServiceAddress, 0);
+        bytes4[] memory instanceBundleServiceSelectors = new bytes4[](5);
         instanceBundleServiceSelectors[0] = instanceStore.createBundle.selector;
         instanceBundleServiceSelectors[1] = instanceStore.updateBundle.selector;
         instanceBundleServiceSelectors[2] = instanceStore.updateBundleState.selector;
+        instanceBundleServiceSelectors[3] = instanceStore.increaseLocked.selector;
+        instanceBundleServiceSelectors[4] = instanceStore.decreaseLocked.selector;
         instanceAdmin.setTargetFunctionRoleByService(
             "InstanceStore",
             instanceBundleServiceSelectors,