@etherisc/gif-next 0.0.2-de9ede4-391 → 0.0.2-deb924b-641

package/contracts/instance/InstanceService.sol

@@ -3,6 +3,7 @@ pragma solidity ^0.8.20;
 
 import {Clones} from "@openzeppelin/contracts/proxy/Clones.sol";
 
+import {IAuthorization} from "../authorization/IAuthorization.sol";
 import {AccessManagerCloneable} from "../authorization/AccessManagerCloneable.sol";
 import {Amount} from "../type/Amount.sol";
 import {BundleSet} from "./BundleSet.sol";
@@ -80,6 +81,7 @@ contract InstanceService is
         _;
     }
 
+
     // TODO check component - service - instance version match
     modifier onlyComponent() {
         if (! getRegistry().isRegisteredComponent(msg.sender)) {
@@ -90,6 +92,7 @@ contract InstanceService is
 
     function createInstance()
         external 
+        restricted()
         returns (
             IInstance instance,
             NftId instanceNftId
@@ -113,7 +116,11 @@ contract InstanceService is
             TargetManagerLib.getDefaultRewardRate());
 
         // MUST be set after instance is set up and registered
-        instanceAdmin.initializeInstanceAuthorization(address(instance));
+        IAuthorization instanceAuthorization = InstanceAdmin(_masterInstanceAdmin).getInstanceAuthorization();
+        VersionPart release = AccessManagerCloneable(authority()).getRelease();
+        instanceAdmin.completeSetup(
+            address(instance),
+            address(instanceAuthorization));
 
         emit LogInstanceCloned(
             instanceNftId,
@@ -124,6 +131,7 @@ contract InstanceService is
     function setStakingLockingPeriod(Seconds stakeLockingPeriod)
         external
         virtual
+        restricted()
         onlyInstance()
     {
         NftId instanceNftId = getRegistry().getNftIdForAddress(msg.sender);
@@ -136,6 +144,7 @@ contract InstanceService is
     function setStakingRewardRate(UFixed rewardRate)
         external
         virtual
+        restricted()
         onlyInstance()
     {
         NftId instanceNftId = getRegistry().getNftIdForAddress(msg.sender);
@@ -148,6 +157,7 @@ contract InstanceService is
     function refillStakingRewardReserves(address rewardProvider, Amount dipAmount)
         external
         virtual
+        restricted()
         onlyInstance()
     {
         NftId instanceNftId = getRegistry().getNftIdForAddress(msg.sender);
@@ -161,6 +171,7 @@ contract InstanceService is
     function withdrawStakingRewardReserves(Amount dipAmount)
         external
         virtual
+        restricted()
         onlyInstance()
         returns (Amount newBalance)
     {
@@ -170,14 +181,26 @@ contract InstanceService is
             dipAmount);
     }
 
-    function getMasterInstanceReader() external view returns (address) {
-        return _masterInstanceReader;
+    function upgradeInstanceReader(NftId instanceNftId) 
+        external 
+        nonReentrant()
+        restricted()
+        onlyInstanceOwner(instanceNftId) 
+        onlyNftOfType(instanceNftId, INSTANCE())
+    {
+        IRegistry registry = getRegistry();
+        IRegistry.ObjectInfo memory instanceInfo = registry.getObjectInfo(instanceNftId);
+        Instance instance = Instance(instanceInfo.objectAddress);
+        
+        InstanceReader upgradedInstanceReaderClone = InstanceReader(Clones.clone(address(_masterInstanceReader)));
+        upgradedInstanceReaderClone.initializeWithInstance(address(instance));
+        instance.setInstanceReader(upgradedInstanceReaderClone);
     }
 
     function setAndRegisterMasterInstance(address instanceAddress)
-            external 
-            onlyOwner 
-            returns(NftId masterInstanceNftId)
+        external 
+        onlyOwner()
+        returns(NftId masterInstanceNftId)
     {
         if(_masterInstance != address(0)) { revert ErrorInstanceServiceMasterInstanceAlreadySet(); }
         if(_masterInstanceAdmin != address(0)) { revert ErrorInstanceServiceMasterInstanceAdminAlreadySet(); }
@@ -209,8 +232,8 @@ contract InstanceService is
         if(bundleSet.authority() != instanceAdmin.authority()) { revert ErrorInstanceServiceBundleSetAuthorityMismatch(); }
         if(riskSet.authority() != instanceAdmin.authority()) { revert ErrorInstanceServiceRiskSetAuthorityMismatch(); }
         if(instanceStore.authority() != instanceAdmin.authority()) { revert ErrorInstanceServiceInstanceStoreAuthorityMismatch(); }
-        if(bundleSet.getInstance() != instance) { revert ErrorInstanceServiceBundleSetInstanceMismatch(); }
-        if(riskSet.getInstance() != instance) { revert ErrorInstanceServiceRiskSetInstanceMismatch(); }
+        if(bundleSet.getInstanceAddress() != address(instance)) { revert ErrorInstanceServiceBundleSetInstanceMismatch(); }
+        if(riskSet.getInstanceAddress() != address(instance)) { revert ErrorInstanceServiceRiskSetInstanceMismatch(); }
         if(instanceReader.getInstance() != instance) { revert ErrorInstanceServiceInstanceReaderInstanceMismatch2(); }
 
         _masterAccessManager = accessManagerAddress;
@@ -226,7 +249,10 @@ contract InstanceService is
         masterInstanceNftId = info.nftId;
     }
 
-    function upgradeMasterInstanceReader(address instanceReaderAddress) external onlyOwner {
+    function upgradeMasterInstanceReader(address instanceReaderAddress)
+        external
+        onlyOwner
+    {
         if(_masterInstanceReader == address(0)) { revert ErrorInstanceServiceMasterInstanceReaderNotSet(); }
         if(instanceReaderAddress == address(0)) { revert ErrorInstanceServiceInstanceReaderAddressZero(); }
         if(instanceReaderAddress == _masterInstanceReader) { revert ErrorInstanceServiceInstanceReaderSameAsMasterInstanceReader(); }
@@ -237,19 +263,8 @@ contract InstanceService is
         _masterInstanceReader = instanceReaderAddress;
     }
 
-    function upgradeInstanceReader(NftId instanceNftId) 
-        external 
-        nonReentrant()
-        onlyInstanceOwner(instanceNftId) 
-        onlyNftOfType(instanceNftId, INSTANCE())
-    {
-        IRegistry registry = getRegistry();
-        IRegistry.ObjectInfo memory instanceInfo = registry.getObjectInfo(instanceNftId);
-        Instance instance = Instance(instanceInfo.objectAddress);
-        
-        InstanceReader upgradedInstanceReaderClone = InstanceReader(Clones.clone(address(_masterInstanceReader)));
-        upgradedInstanceReaderClone.initializeWithInstance(address(instance));
-        instance.setInstanceReader(upgradedInstanceReaderClone);
+    function getMasterInstanceReader() external view returns (address) {
+        return _masterInstanceReader;
     }
 
     /// @dev create new cloned instance admin
@@ -260,19 +275,16 @@ contract InstanceService is
         returns (InstanceAdmin clonedInstanceAdmin)
     {
         // start with setting up a new OZ access manager
+        // TODO consider _masterInstanceAdmin.authority() instead of _masterAccessManager
         AccessManagerCloneable clonedAccessManager = AccessManagerCloneable(
             Clones.clone(_masterAccessManager));
         
         // set up the instance admin
         clonedInstanceAdmin = InstanceAdmin(Clones.clone(_masterInstanceAdmin));
-        clonedAccessManager.initialize(
-            address(clonedInstanceAdmin)); // grant ADMIN_ROLE to instance admin
-
-        address authorization = address(
-            InstanceAdmin(_masterInstanceAdmin).getInstanceAuthorization());
         clonedInstanceAdmin.initialize(
             clonedAccessManager,
-            authorization);
+            getRegistry(),
+            getRelease());
     }
 
 
@@ -344,11 +356,11 @@ contract InstanceService is
         initializer()
     {
         (
-            address registryAddress,
-            address authority
+            address authority,
+            address registry
         ) = abi.decode(data, (address, address));
 
-        _initializeService(registryAddress, authority, owner);
+        __Service_init(authority, registry, owner);
 
         _registryService = IRegistryService(_getServiceAddress(REGISTRY()));
         _stakingService = IStakingService(_getServiceAddress(STAKING()));

package/contracts/instance/InstanceServiceManager.sol

@@ -17,7 +17,7 @@ contract InstanceServiceManager is ProxyManager {
     ) 
     {
         InstanceService svc = new InstanceService{salt: salt}();
-        bytes memory data = abi.encode(registry, authority);
+        bytes memory data = abi.encode(authority, registry);
         IVersionable versionable = initialize(
             registry,
             address(svc), 

package/contracts/instance/InstanceStore.sol

@@ -91,6 +91,7 @@ contract InstanceStore is
         _create(_toNftKey32(productNftId, FEE()), abi.encode(info));
     }
 
+    // Fee only has one state, so no change change possible
     function updateFee(NftId productNftId, IComponents.FeeInfo memory info) external restricted() {
         _update(_toNftKey32(productNftId, FEE()), abi.encode(info), KEEP_STATE());
     }

package/contracts/instance/RiskSet.sol

@@ -1,18 +1,17 @@
 // SPDX-License-Identifier: Apache-2.0
 pragma solidity ^0.8.20;
 
-import {IPolicy} from "../instance/module/IPolicy.sol";
 import {Key32} from "../type/Key32.sol";
 import {LibNftIdSet} from "../type/NftIdSet.sol";
 import {NftId} from "../type/NftId.sol";
-import {RiskIdLib, RiskId} from "../type/RiskId.sol";
-
 import {ObjectSet} from "./base/ObjectSet.sol";
+import {ObjectSetHelperLib} from "./base/ObjectSetHelperLib.sol";
+import {RiskIdLib, RiskId} from "../type/RiskId.sol";
 
-contract RiskSet is 
+/// @dev RiskSet manages the risks and its active policies per product.
+contract RiskSet is
     ObjectSet
 {
-    using LibNftIdSet for LibNftIdSet.Set;
 
     event LogRiskSetPolicyLinked(RiskId riskId, NftId policyNftId);
     event LogRiskSetPolicyUnlinked(RiskId riskId, NftId policyNftId);
@@ -36,7 +35,7 @@ contract RiskSet is
             revert ErrorRiskSetRiskLocked(riskId, policyNftId);
         }
 
-        _activePolicies[riskId].add(policyNftId);
+        LibNftIdSet.add(_activePolicies[riskId], policyNftId);
         emit LogRiskSetPolicyLinked(riskId, policyNftId);
     }
 
@@ -48,14 +47,14 @@ contract RiskSet is
             revert ErrorRiskSetRiskUnknown(riskId);
         }
 
-        _activePolicies[riskId].remove(policyNftId);
+        LibNftIdSet.remove(_activePolicies[riskId], policyNftId);
         emit LogRiskSetPolicyUnlinked(riskId, policyNftId);
     }
 
     /// @dev add a new risk to a product registered with this instance
     // the corresponding product is fetched via instance reader
     function add(RiskId riskId) external restricted() {
-        NftId productNftId = _instance.getInstanceReader().getRiskInfo(riskId).productNftId;
+        NftId productNftId = ObjectSetHelperLib.getProductNftId(_instanceAddress, riskId);
 
         // ensure product is registered with instance
         if(productNftId.eqz()) {
@@ -68,14 +67,14 @@ contract RiskSet is
 
     /// @dev Applications linked to active risks may be underwritten
     function activate(RiskId riskId) external restricted() {
-        NftId productNftId = _instance.getInstanceReader().getRiskInfo(riskId).productNftId;
+        NftId productNftId = ObjectSetHelperLib.getProductNftId(_instanceAddress, riskId);
         _activate(productNftId, riskId.toKey32());
         emit LogRiskSetRiskActive(productNftId, riskId);
     }
 
     /// @dev Applications linked to paused/archived risks may not be underwritten
     function pause(RiskId riskId) external restricted() {
-        NftId productNftId = _instance.getInstanceReader().getRiskInfo(riskId).productNftId;
+        NftId productNftId = ObjectSetHelperLib.getProductNftId(_instanceAddress, riskId);
         _deactivate(productNftId, riskId.toKey32());
         emit LogRiskSetRiskPaused(productNftId, riskId);
     }
@@ -110,10 +109,10 @@ contract RiskSet is
     }
 
     function linkedPolicies(RiskId riskId) external view returns(uint256) {
-        return _activePolicies[riskId].size();
+        return LibNftIdSet.size(_activePolicies[riskId]);
     }
 
     function getLinkedPolicyNftId(RiskId riskId, uint256 idx) external view returns(NftId policyNftId) {
-        return _activePolicies[riskId].getElementAt(idx);
+        return LibNftIdSet.getElementAt(_activePolicies[riskId], idx);
     }
 }

package/contracts/instance/base/ObjectLifecycle.sol

@@ -65,6 +65,7 @@ contract ObjectLifecycle is
 
     function _setupClaimLifecycle() private {
         setInitialState(CLAIM(), SUBMITTED());
+        setStateTransition(CLAIM(), SUBMITTED(), REVOKED());
         setStateTransition(CLAIM(), SUBMITTED(), CONFIRMED());
         setStateTransition(CLAIM(), SUBMITTED(), DECLINED());
         setStateTransition(CLAIM(), CONFIRMED(), CLOSED());
@@ -72,8 +73,8 @@ contract ObjectLifecycle is
 
     function _setupPayoutLifecycle() private {
         setInitialState(PAYOUT(), EXPECTED());
-        // TODO: add state cancelled
         setStateTransition(PAYOUT(), EXPECTED(), PAID());
+        setStateTransition(PAYOUT(), EXPECTED(), CANCELLED());
     }
 
     function _setupRiskLifecycle() private {

package/contracts/instance/base/ObjectSet.sol

@@ -3,7 +3,6 @@ pragma solidity ^0.8.20;
 
 import {Cloneable} from "./Cloneable.sol";
 
-import {IInstance} from "../IInstance.sol";
 import {LibKey32Set} from "../../type/Key32Set.sol";
 import {NftId} from "../../type/NftId.sol";
 import {Key32} from "../../type/Key32.sol";
@@ -19,21 +18,21 @@ contract ObjectSet is
 
     mapping(NftId compnentNftId => LibKey32Set.Set objects) internal _activeObjects;
     mapping(NftId compnentNftId => LibKey32Set.Set objects) internal _allObjects;
-    IInstance internal _instance; // store instance address -> more flexible, instance may not be registered during ObjectSet initialization
+    address internal _instanceAddress;
 
     /// @dev This initializer needs to be called from the instance itself.
-    function initialize() 
+    function initialize(address authority, address registry) 
         external
         initializer()
     {
-        _instance = IInstance(msg.sender);
-        __Cloneable_init(_instance.authority(), address(_instance.getRegistry()));
+        _instanceAddress = msg.sender;
+        __Cloneable_init(authority, registry);
         
-        emit LogObjectSetInitialized(address(_instance));
+        emit LogObjectSetInitialized(address(_instanceAddress));
     }
 
-    function getInstance() external view returns (IInstance) {
-        return _instance;
+    function getInstanceAddress() external view returns (address) {
+        return _instanceAddress;
     }
 
     function _add(NftId componentNftId, Key32 key) internal {

package/contracts/instance/base/ObjectSetHelperLib.sol

@@ -0,0 +1,30 @@
+// SPDX-License-Identifier: Apache-2.0
+pragma solidity ^0.8.20;
+
+import {IBundle} from "../module/IBundle.sol";
+import {IInstance} from "../IInstance.sol";
+import {IRisk} from "../module/IRisk.sol";
+import {NftId} from "../../type/NftId.sol";
+import {RiskId} from "../../type/RiskId.sol";
+
+
+library ObjectSetHelperLib {
+
+    function getRiskInfo(address instanceAddress, RiskId riskId) public view returns (IRisk.RiskInfo memory) {
+
+        return IInstance(instanceAddress).getInstanceReader().getRiskInfo(riskId);
+    }
+
+    function getProductNftId(address instanceAddress, RiskId riskId) public view returns (NftId) {
+        return getRiskInfo(instanceAddress, riskId).productNftId;
+    }
+
+    function getBundleInfo(address instanceAddress, NftId bundleNftId) public view returns (IBundle.BundleInfo memory) {
+        return IInstance(instanceAddress).getInstanceReader().getBundleInfo(bundleNftId);
+    }
+
+    function getPoolNftId(address instanceAddress, NftId bundleNftId) public view returns (NftId) {
+        return getBundleInfo(instanceAddress, bundleNftId).poolNftId;
+    }
+
+}

package/contracts/instance/module/IComponents.sol

@@ -27,14 +27,6 @@ interface IComponents {
         NftId poolNftId; // mandatory
         NftId distributionNftId; // 0..1 (optional)
         NftId [] oracleNftId; // 0..n (optional)
-        // TODO: remove those fields
-        Fee productFee; // product fee on net premium
-        Fee processingFee; // product fee on payout amounts        
-        Fee distributionFee; // distribution fee for sales that do not include commissions
-        Fee minDistributionOwnerFee; // min fee required by distribution owner (not including commissions for distributors)
-        Fee poolFee; // pool fee on net premium
-        Fee stakingFee; // pool fee on staked capital from investor
-        Fee performanceFee; // pool fee on profits from capital investors
     }
 
     struct FeeInfo {

package/contracts/instance/module/IDistribution.sol

@@ -4,6 +4,7 @@ pragma solidity ^0.8.20;
 import {Amount} from "../../type/Amount.sol";
 import {DistributorType} from "../../type/DistributorType.sol";
 import {NftId} from "../../type/NftId.sol";
+import {Seconds} from "../../type/Seconds.sol";
 import {Timestamp} from "../../type/Timestamp.sol";
 import {UFixed} from "../../type/UFixed.sol";
 
@@ -15,7 +16,7 @@ interface IDistribution {
         UFixed maxDiscountPercentage;
         UFixed commissionPercentage;
         uint32 maxReferralCount;
-        uint32 maxReferralLifetime;
+        Seconds maxReferralLifetime;
         bool allowSelfReferrals;
         bool allowRenewals;
         bytes data;

package/contracts/instance/module/IRisk.sol

@@ -2,11 +2,13 @@
 pragma solidity ^0.8.20;
 
 import {NftId} from "../../type/NftId.sol";
+import {Timestamp} from "../../type/Timestamp.sol";
 
 interface IRisk {
 
     struct RiskInfo {
         NftId productNftId;
+        Timestamp createdAt;
         bytes data;
     }
 }

package/contracts/oracle/BasicOracleAuthorization.sol

@@ -15,18 +15,9 @@ contract BasicOracleAuthorization
 {
 
      constructor(string memory componentName)
-          Authorization(componentName)
+          Authorization(componentName, ORACLE())
      {}
 
-     function _setupTargets()
-          internal
-          virtual override
-     {
-          // basic component target
-          _addComponentTargetWithRole(ORACLE()); 
-     }
-
-
      function _setupTargetAuthorizations()
           internal
           virtual override
@@ -34,12 +25,12 @@ contract BasicOracleAuthorization
           IAccess.FunctionInfo[] storage functions;
 
           // authorize public role (open access to any account, only allows to lock target)
-          functions = _authorizeForTarget(getTargetName(), getServiceRole(ORACLE()));
+          functions = _authorizeForTarget(getMainTargetName(), getServiceRole(ORACLE()));
           _authorize(functions, IOracle.request.selector, "request");
           _authorize(functions, IOracle.cancel.selector, "cancel");
 
           // authorize public role (open access to any account, only allows to lock target)
-          functions = _authorizeForTarget(getTargetName(), PUBLIC_ROLE());
+          functions = _authorizeForTarget(getMainTargetName(), PUBLIC_ROLE());
           _authorize(functions, BasicOracle.respond.selector, "respond");
      }
 }

package/contracts/oracle/Oracle.sol

@@ -69,7 +69,7 @@ abstract contract Oracle is
         override(IInstanceLinkedComponent, InstanceLinkedComponent)
         onlyOwner()
         restricted()
-        returns (Amount withdrawnAmount)
+        returns (Amount)
     {
         revert ErrorOracleNotImplemented("withdrawFees");
     }

package/contracts/oracle/OracleService.sol

@@ -32,11 +32,11 @@ contract OracleService is
         initializer()
     {
         (
-            address registryAddress,
-            address authority
+            address authority,
+            address registry
         ) = abi.decode(data, (address, address));
 
-        _initializeService(registryAddress, authority, owner);
+        __Service_init(authority, registry, owner);
         _registerInterface(type(IOracleService).interfaceId);
     }
 
@@ -52,11 +52,10 @@ contract OracleService is
         onlyNftOfType(oracleNftId, ORACLE())
         returns (RequestId requestId) 
     {
-        // IRegistry registry = getRegistry();
-
+        // checks
         // get and check active caller
         (
-            IRegistry.ObjectInfo memory info, 
+            IRegistry.ObjectInfo memory requesterInfo, 
             address instance
         ) = ContractLib.getAndVerifyAnyComponent(
             getRegistry(), msg.sender, true);
@@ -65,8 +64,9 @@ contract OracleService is
             NftId requesterNftId,
             IOracleComponent oracle
         ) = _checkRequestParams(
-            getRegistry(), oracleNftId, info, expiryAt, callbackMethodName);
+            getRegistry(), oracleNftId, requesterInfo, expiryAt, callbackMethodName);
 
+        // effects
         {
             // create request info
             IOracle.RequestInfo memory request = IOracle.RequestInfo({
@@ -84,14 +84,15 @@ contract OracleService is
             requestId = IInstance(instance).getInstanceStore().createRequest(request);
         }
 
+        emit LogOracleServiceRequestCreated(requestId, requesterNftId, oracleNftId, expiryAt);
+
+        // interactions
         // callback to oracle component
         oracle.request(
             requestId, 
             requesterNftId, 
             requestData, 
             expiryAt);
-
-        emit LogOracleServiceRequestCreated(requestId, requesterNftId, oracleNftId, expiryAt);
     }
 
 
@@ -220,7 +221,7 @@ contract OracleService is
     function _checkRequestParams(
         IRegistry registry,
         NftId oracleNftId,
-        IRegistry.ObjectInfo memory info,
+        IRegistry.ObjectInfo memory requesterInfo,
         Timestamp expiryAt,
         string memory callbackMethodName
     )
@@ -237,17 +238,17 @@ contract OracleService is
             registry, oracleNftId, true);
 
         // obtain return values
-        requesterNftId = info.nftId;
+        requesterNftId = requesterInfo.nftId;
         oracle = IOracleComponent(oracleInfo.objectAddress);
 
         // check that requester and oracle share same product cluster
-        if (info.objectType == PRODUCT()) {
+        if (requesterInfo.objectType == PRODUCT()) {
             if (oracleInfo.parentNftId != requesterNftId) {
-                revert ErrorOracleServiceProductMismatch(info.objectType, requesterNftId, oracleInfo.parentNftId);
+                revert ErrorOracleServiceProductMismatch(requesterInfo.objectType, requesterNftId, oracleInfo.parentNftId);
             }
         } else {
-            if (oracleInfo.parentNftId != info.parentNftId) {
-                revert ErrorOracleServiceProductMismatch(info.objectType, info.parentNftId, oracleInfo.parentNftId);
+            if (oracleInfo.parentNftId != requesterInfo.parentNftId) {
+                revert ErrorOracleServiceProductMismatch(requesterInfo.objectType, requesterInfo.parentNftId, oracleInfo.parentNftId);
             }
         }
 

package/contracts/oracle/OracleServiceManager.sol

@@ -17,7 +17,7 @@ contract OracleServiceManager is ProxyManager {
     ) 
     {
         OracleService svc = new OracleService{salt: salt}();
-        bytes memory data = abi.encode(registry, authority);
+        bytes memory data = abi.encode(authority, registry);
         IVersionable versionable = initialize(
             registry,
             address(svc), 

package/contracts/pool/BasicPoolAuthorization.sol

@@ -1,14 +1,16 @@
 // SPDX-License-Identifier: Apache-2.0
 pragma solidity ^0.8.20;
 
-import {Authorization} from "../authorization/Authorization.sol";
-import {BasicPool} from "./BasicPool.sol"; 
 import {IAccess} from "../authorization/IAccess.sol";
 import {IInstanceLinkedComponent} from "../shared/IInstanceLinkedComponent.sol";
 import {IPoolComponent} from "./IPoolComponent.sol";
-import {POOL} from "../type/ObjectType.sol";
+
+import {Authorization} from "../authorization/Authorization.sol";
+import {BasicPool} from "./BasicPool.sol"; 
+import {COMPONENT, POOL} from "../type/ObjectType.sol";
 import {PUBLIC_ROLE} from "../../contracts/type/RoleId.sol";
 import {RoleId} from "../type/RoleId.sol";
+import {TokenHandler} from "../shared/TokenHandler.sol";
 
 
 contract BasicPoolAuthorization
@@ -16,23 +18,30 @@ contract BasicPoolAuthorization
 {
 
      constructor(string memory poolName)
-          Authorization(poolName)
+          Authorization(poolName, POOL())
      {}
 
      function _setupServiceTargets()
           internal
           virtual override
      {
+          _addServiceTargetWithRole(COMPONENT());
           _addServiceTargetWithRole(POOL());
      }
 
-     function _setupTargets()
-          internal
-          virtual override
-     {
-          _addComponentTargetWithRole(POOL()); // basic pool target
-     }
+     function _setupTokenHandlerAuthorizations() internal virtual override {
+          // authorize token handler functions for component service role
+          IAccess.FunctionInfo[] storage functions;
+          functions = _authorizeForTarget(getTokenHandlerName(), getServiceRole(COMPONENT()));
+          _authorize(functions, TokenHandler.approve.selector, "approve");
+          _authorize(functions, TokenHandler.setWallet.selector, "setWallet");
+          _authorize(functions, TokenHandler.pushFeeToken.selector, "pushFeeToken");
 
+          // authorize token handler functions for pool service role
+          functions = _authorizeForTarget(getTokenHandlerName(), getServiceRole(POOL()));
+          _authorize(functions, TokenHandler.pullToken.selector, "pullToken");
+          _authorize(functions, TokenHandler.pushToken.selector, "pushToken");
+     }
 
      function _setupTargetAuthorizations()
           internal
@@ -41,7 +50,7 @@ contract BasicPoolAuthorization
           IAccess.FunctionInfo[] storage functions;
 
           // authorize public role (open access to any account, only allows to lock target)
-          functions = _authorizeForTarget(getTargetName(), PUBLIC_ROLE());
+          functions = _authorizeForTarget(getMainTargetName(), PUBLIC_ROLE());
           _authorize(functions, BasicPool.stake.selector, "stake");
           _authorize(functions, BasicPool.unstake.selector, "unstake");
           _authorize(functions, BasicPool.extend.selector, "extend");
@@ -57,11 +66,10 @@ contract BasicPoolAuthorization
           _authorize(functions, BasicPool.extend.selector, "extend");
 
           _authorize(functions, IInstanceLinkedComponent.withdrawFees.selector, "withdrawFees");
-
           _authorize(functions, BasicPool.withdrawBundleFees.selector, "withdrawBundleFees");
 
           // authorize pool service
-          functions = _authorizeForTarget(getTargetName(), getServiceRole(POOL()));
+          functions = _authorizeForTarget(getMainTargetName(), getServiceRole(POOL()));
           _authorize(functions, IPoolComponent.verifyApplication.selector, "verifyApplication");
      }
 }