@etherisc/gif-next 0.0.2-e26c262-698 → 0.0.2-e2a1510-528

package/contracts/registry/ServiceAuthorizationV3.sol

@@ -0,0 +1,200 @@
+// SPDX-License-Identifier: Apache-2.0
+pragma solidity ^0.8.20;
+
+import {
+     ALL, REGISTRY, SERVICE, PRODUCT, ORACLE, POOL, INSTANCE, COMPONENT, DISTRIBUTION, DISTRIBUTOR, APPLICATION, POLICY, CLAIM, BUNDLE, STAKE, STAKING, PRICE
+} from "../../contracts/type/ObjectType.sol";
+
+import {ComponentService} from "../shared/ComponentService.sol";
+import {IAccess} from "../authorization/IAccess.sol";
+import {IBundleService} from "../pool/IBundleService.sol";
+import {IDistributionService} from "../distribution/IDistributionService.sol";
+import {InstanceService} from "../instance/InstanceService.sol";
+import {IInstanceService} from "../instance/IInstanceService.sol";
+import {IPoolService} from "../pool/IPoolService.sol";
+import {IStakingService} from "../staking/IStakingService.sol";
+import {IRegistryService} from "./IRegistryService.sol";
+import {ServiceAuthorization} from "../authorization/ServiceAuthorization.sol";
+
+
+contract ServiceAuthorizationV3
+     is ServiceAuthorization
+{
+
+     constructor(string memory commitHash)
+          ServiceAuthorization(commitHash)
+     {}
+
+     function _setupDomains()
+          internal
+          override
+     {
+          _authorizeDomain(REGISTRY(), address(1));
+          _authorizeDomain(STAKING(), address(2));
+          _authorizeDomain(INSTANCE(), address(3));
+          _authorizeDomain(COMPONENT(), address(4));
+          _authorizeDomain(DISTRIBUTION(), address(5));
+          _authorizeDomain(PRICE(), address(6));
+          _authorizeDomain(BUNDLE(), address(7));
+          _authorizeDomain(POOL(), address(8));
+          _authorizeDomain(ORACLE(), address(9));
+          _authorizeDomain(PRODUCT(), address(10));
+          _authorizeDomain(CLAIM(), address(11));
+          _authorizeDomain(APPLICATION(), address(12));
+          _authorizeDomain(POLICY(), address(13));
+     }
+
+
+     function _setupDomainAuthorizations()
+          internal
+          override
+     {
+          _setupIRegistryServiceAuthorization();
+          _setupStakingServiceAuthorization();
+          _setupInstanceServiceAuthorization();
+          _setupComponentServiceAuthorization();
+          _setupDistributionServiceAuthorization();
+          _setupPoolServiceAuthorization();
+          _setupBundleServiceAuthorization();
+     }
+
+
+     /// @dev registry service authorization.
+     /// authorized functions MUST be implemented with a restricted modifier
+     function _setupIRegistryServiceAuthorization()
+          internal
+     {
+          IAccess.FunctionInfo[] storage functions;
+
+          functions = _authorizeForService(REGISTRY(), APPLICATION());
+          _authorize(functions, IRegistryService.registerPolicy.selector, "registerPolicy");
+
+          // functions = _authorizeForService(REGISTRY(), POOL());
+          // _authorize(functions, IRegistryService.registerPool.selector, "registerPool");
+
+          functions = _authorizeForService(REGISTRY(), BUNDLE());
+          _authorize(functions, IRegistryService.registerBundle.selector, "registerBundle");
+
+          functions = _authorizeForService(REGISTRY(), DISTRIBUTION());
+          // _authorize(functions, IRegistryService.registerDistribution.selector, "registerDistribution");
+          _authorize(functions, IRegistryService.registerDistributor.selector, "registerDistributor");
+
+          functions = _authorizeForService(REGISTRY(), COMPONENT());
+          _authorize(functions, IRegistryService.registerComponent.selector, "registerComponent");
+
+          functions = _authorizeForService(REGISTRY(), INSTANCE());
+          _authorize(functions, IRegistryService.registerInstance.selector, "registerInstance");
+
+          functions = _authorizeForService(REGISTRY(), STAKING());
+          _authorize(functions, IRegistryService.registerStake.selector, "registerStake");
+
+          // functions = _authorizeForService(REGISTRY(), PRODUCT());
+          // _authorize(functions, IRegistryService.registerProduct.selector, "registerProduct");
+     }
+
+
+     /// @dev staking service authorization.
+     /// authorized functions MUST be implemented with a restricted modifier
+     function _setupStakingServiceAuthorization()
+          internal
+     {
+          IAccess.FunctionInfo[] storage functions;
+
+          functions = _authorizeForService(STAKING(), INSTANCE());
+          _authorize(functions, IStakingService.createInstanceTarget.selector, "createInstanceTarget");
+          _authorize(functions, IStakingService.setInstanceLockingPeriod.selector, "setInstanceLockingPeriod");
+          _authorize(functions, IStakingService.setInstanceRewardRate.selector, "setInstanceRewardRate");
+          _authorize(functions, IStakingService.refillInstanceRewardReserves.selector, "refillInstanceRewardReserves");
+          _authorize(functions, IStakingService.withdrawInstanceRewardReserves.selector, "withdrawInstanceRewardReserves");
+
+          functions = _authorizeForService(STAKING(), ALL());
+          _authorize(functions, IStakingService.create.selector, "create");
+          _authorize(functions, IStakingService.stake.selector, "stake");
+          _authorize(functions, IStakingService.restakeToNewTarget.selector, "restakeToNewTarget");
+          _authorize(functions, IStakingService.updateRewards.selector, "updateRewards");
+          _authorize(functions, IStakingService.claimRewards.selector, "claimRewards");
+          _authorize(functions, IStakingService.unstake.selector, "unstake");
+     }
+
+
+     /// @dev Instance service function authorization.
+     function _setupInstanceServiceAuthorization()
+          internal
+     {
+          IAccess.FunctionInfo[] storage functions;
+
+          functions = _authorizeForService(INSTANCE(), COMPONENT());
+          _authorize(functions, IInstanceService.initializeAuthorization.selector, "initializeAuthorization");
+     }
+
+
+     /// @dev Component service function authorization.
+     function _setupComponentServiceAuthorization()
+          internal
+     {
+          // authz.authorizations = new DomainAuthorization[](4);
+
+          // authz.authorizations[0].domain = POLICY();
+          // _functions = new IAccessAdmin.Function[](1);
+          // __authorize(ComponentService.increaseProductFees.selector, "increaseProductFees"));
+          // authz.authorizations[0].functions = _functions;
+
+          // authz.authorizations[1].domain = DISTRIBUTION();
+          // _functions = new IAccessAdmin.Function[](1);
+          // __authorize(ComponentService.increaseDistributionBalance.selector, "increaseDistributionBalance"));
+          // authz.authorizations[1].functions = _functions;
+
+          // authz.authorizations[2].domain = POOL();
+          // _functions = new IAccessAdmin.Function[](1);
+          // __authorize(ComponentService.increasePoolBalance.selector, "increasePoolBalance"));
+          // authz.authorizations[2].functions = _functions;
+
+          // authz.authorizations[3].domain = BUNDLE();
+          // _functions = new IAccessAdmin.Function[](1);
+          // __authorize(ComponentService.increaseBundleBalance.selector, "increaseBundleBalance"));
+          // authz.authorizations[3].functions = _functions;
+     }
+
+     /// @dev Distribution service function authorization.
+     function _setupDistributionServiceAuthorization()
+          internal
+     {
+          IAccess.FunctionInfo[] storage functions;
+
+          functions = _authorizeForService(DISTRIBUTION(), POLICY());
+          _authorize(functions, IDistributionService.processSale.selector, "processSale");
+     }
+
+
+     /// @dev Pool service function authorization.
+     function _setupPoolServiceAuthorization()
+          internal
+     {
+          IAccess.FunctionInfo[] storage functions;
+
+          functions = _authorizeForService(POOL(), POLICY());
+          _authorize(functions, IPoolService.lockCollateral.selector, "lockCollateral");
+          _authorize(functions, IPoolService.releaseCollateral.selector, "releaseCollateral");
+          _authorize(functions, IPoolService.reduceCollateral.selector, "reduceCollateral");
+          _authorize(functions, IPoolService.processSale.selector, "processSale");
+
+          functions = _authorizeForService(POOL(), CLAIM());
+          _authorize(functions, IPoolService.reduceCollateral.selector, "reduceCollateral");
+     }
+
+
+     /// @dev Instance service function authorization.
+     function _setupBundleServiceAuthorization()
+          internal
+     {
+          IAccess.FunctionInfo[] storage functions;
+
+          functions = _authorizeForService(BUNDLE(), POOL());
+          _authorize(functions, IBundleService.create.selector, "create");
+          _authorize(functions, IBundleService.close.selector, "close");
+          _authorize(functions, IBundleService.lockCollateral.selector, "lockCollateral");
+          _authorize(functions, IBundleService.releaseCollateral.selector, "releaseCollateral");
+          _authorize(functions, IBundleService.unlinkPolicy.selector, "unlinkPolicy");
+     }
+}
+

package/contracts/registry/TokenRegistry.sol

@@ -1,116 +1,315 @@
 // SPDX-License-Identifier: Apache-2.0
 pragma solidity ^0.8.20;
 
+import {AccessManaged} from "@openzeppelin/contracts/access/manager/AccessManaged.sol";
 import {IERC20Metadata} from "@openzeppelin/contracts/token/ERC20/extensions/IERC20Metadata.sol";
 import {ERC165Checker} from "@openzeppelin/contracts/utils/introspection/ERC165Checker.sol";
 
+import {REGISTRY} from "../type/ObjectType.sol";
+import {VersionPart} from "../type/Version.sol";
+
 import {IRegisterable} from "../shared/IRegisterable.sol";
+
 import {IRegistry} from "./IRegistry.sol";
-import {VersionPart} from "../types/Version.sol";
-import {REGISTRY} from "../types/ObjectType.sol";
-import {NftOwnable} from "../shared/NftOwnable.sol";
+import {IRegistryLinked} from "../shared/IRegistryLinked.sol";
+import {ReleaseRegistry} from "./ReleaseRegistry.sol";
+import {RegistryAdmin} from "./RegistryAdmin.sol";
+
 
 /// @title contract to register token per GIF major release.
 contract TokenRegistry is
-    NftOwnable
+    AccessManaged,
+    IRegistryLinked
 {
-    event LogRegistered(address token, string symbol, uint256 decimals);
-    event LogTokenStateSet(address token, VersionPart majorVersion, bool active);
+    event LogTokenRegistryTokenRegistered(uint256 chainId, address token, uint256 decimals, string symbol);
+    event LogTokenRegistryTokenGlobalStateSet(uint256 chainId, address token, bool active);
+    event LogTokenRegistryTokenStateSet(uint256 chainId, address token, VersionPart majorVersion, bool active);
 
-    error NotContract(address account);
-    error NotToken(address account);
-    error TokenDecimalsZero();
-    error TokenMajorVersionInvalid(VersionPart majorVersion);
+    error ErrorTokenRegistryChainIdZero();
+    error ErrorTokenRegistryTokenAddressZero();
 
-    address [] internal _token;
-    mapping(address token => bool registered) internal _registered;
-    mapping(address token => mapping(VersionPart majorVersion => bool isActive)) internal _active;
+    error ErrorTokenRegistryNotRemoteToken(uint256 chainId, address token);
+    error ErrorTokenRegistryTokenAlreadyRegistered(uint256 chainId, address token);
+    error ErrorTokenRegistryTokenNotContract(uint256 chainId, address token);
+    error ErrorTokenRegistryTokenNotErc20(uint256 chainId, address token);
 
-    constructor(
-        address registry
-    )
-    { 
-        initialize(registry);
+    error ErrorTokenRegistryTokenNotRegistered(uint256 chainId, address token);
+    error ErrorTokenRegistryMajorVersionInvalid(VersionPart majorVersion);
+
+    struct TokenInfo {
+        uint256 chainId;
+        address token;
+        uint8 decimals;
+        string symbol;
+        bool active;
+    }
+
+    mapping(uint256 chainId => mapping(address token => TokenInfo info)) internal _tokenInfo;
+    mapping(uint256 chainId => mapping(address token => mapping(VersionPart majorVersion => bool isActive))) internal _active;
+    TokenInfo [] internal _token;
+
+    IRegistry internal _registry;
+    ReleaseRegistry internal _releaseRegistry;
+    IERC20Metadata internal _dipToken;
+
+    /// @dev enforces msg.sender is owner of nft (or initial owner of nft ownable)
+    modifier onlyRegisteredToken(uint256 chainId, address token) {
+        if (!isRegistered(chainId, token)) {
+            revert ErrorTokenRegistryTokenNotRegistered(chainId, token);
+        }
+        _;
     }
 
-    function initialize(address registry)
-        public
-        initializer()
+    constructor(IRegistry registry, IERC20Metadata dipToken)
+        AccessManaged(msg.sender)
     {
-        initializeNftOwnable(msg.sender, registry);
+        // set authority
+        address authority = RegistryAdmin(registry.getRegistryAdminAddress()).authority();
+        setAuthority(authority);
+        
+        _registry = registry;
+        _dipToken = dipToken;
+
+        // register dip token
+        uint256 chainId = block.chainid;
+        _registerToken(
+            chainId, 
+            address(_dipToken), 
+            _dipToken.decimals(), 
+            _dipToken.symbol());
     }
 
 
-    /// @dev link ownership of token registry to nft owner of registry service
-    // TODO latter registry service will get new release, new address, new nft, TokenRegistry will not catch that -> use AccessManaged only for services
-    function linkToNftOwnable(address registryAddress) 
+    /// @dev register an onchain token.
+    /// this function verifies that the provided token address is a contract that implements
+    /// the non optional erc20 view functions.
+    function registerToken(address tokenAddress)
         external
-        onlyOwner
+        restricted()
     {
-        IRegistry registry = IRegistry(registryAddress);
-        // TODO use _latest instead of _initial -> but _latest is 0 before first release activation
-        address registryServiceAddress = registry.getServiceAddress(REGISTRY(), registry.getNextVersion());
-
-        _linkToNftOwnable(registryServiceAddress);
+        IERC20Metadata token = _verifyOnchainToken(tokenAddress);
+        _registerToken(block.chainid, tokenAddress, token.decimals(), token.symbol());
     }
 
-    /// @dev token state is informative, registry have no clue about used tokens
-    // component owner is responsible for token selection and operations
-    // service MUST deny registration of component with inactive token 
-    function setActive(address token, VersionPart majorVersion, bool active)
+
+    /// @dev register the remote token with the provided attributes.
+    /// this function may not be used for tokens when chainId == block.chainid.
+    function registerRemoteToken(
+        uint256 chainId,
+        address token,
+        uint8 decimals,
+        string memory symbol
+    )
         external
-        onlyOwner
+        restricted()
     {
-        // verify that token is registered
-        if (!_registered[token]) {
-            _registerToken(token);
+        if (chainId == block.chainid) {
+            revert ErrorTokenRegistryNotRemoteToken(chainId, token);
         }
 
+        _registerToken(chainId, token, decimals, symbol);
+    }
+
+
+    /// @dev set active flag on token itself.
+    /// when setting a token to active=false isActive will return false
+    /// regardless of release specific active value.
+    function setActive(
+        uint256 chainId, 
+        address token, 
+        bool active
+    )
+        external
+        restricted()
+        onlyRegisteredToken(chainId, token)
+    {
+        _tokenInfo[chainId][token].active = active;
+        emit LogTokenRegistryTokenGlobalStateSet(chainId, token, active);
+    }
+
+
+    /// @dev sets active state for specified token and major version.
+    /// internally calls setActiveWithVersionCheck() with enforcing version check.
+    /// token state is informative, registry have no clue about used tokens
+    /// component owner is responsible for token selection and operations
+    /// service MUST deny registration of component with inactive token.
+    function setActiveForVersion(
+        uint256 chainId, 
+        address token, 
+        VersionPart majorVersion, 
+        bool active
+    )
+        external
+        restricted()
+        onlyRegisteredToken(chainId, token)
+    {
+        _setActiveWithVersionCheck(chainId, token, majorVersion, active, true);
+    }
+
+
+    /// @dev as setActiveForVersion() with the option to skip the version check.
+    /// enforcing the version check checks if the provided major version with the release manager. 
+    /// the function reverts if the provided majorVersion is unknown to the release manager.
+    function setActiveWithVersionCheck(
+        uint256 chainId, 
+        address token, 
+        VersionPart majorVersion, 
+        bool active,
+        bool enforceVersionCheck
+    )
+        external
+        restricted()
+        onlyRegisteredToken(chainId, token)
+    {
+        _setActiveWithVersionCheck(chainId, token, majorVersion, active, enforceVersionCheck);
+    }
+
+
+    function _setActiveWithVersionCheck(
+        uint256 chainId, 
+        address token, 
+        VersionPart majorVersion, 
+        bool active,
+        bool enforceVersionCheck
+    )
+        internal
+    {
         // verify valid major version
-        // ensure major version increments is one
-        uint256 version = majorVersion.toInt();
-        if (!getRegistry().isValidRelease(majorVersion)) {
-            revert TokenMajorVersionInvalid(majorVersion);
+        if(enforceVersionCheck) {
+            uint256 version = majorVersion.toInt();
+            if (!getRegistry().isActiveRelease(majorVersion)) {
+                revert ErrorTokenRegistryMajorVersionInvalid(majorVersion);
+            }
         }
 
-        _active[token][majorVersion] = active;
+        _active[chainId][token][majorVersion] = active;
 
-        emit LogTokenStateSet(token, majorVersion, active);
+        emit LogTokenRegistryTokenStateSet(chainId, token, majorVersion, active);
     }
 
+    /// @dev returns the dip token for this chain
+    function getDipToken() external view returns (IERC20Metadata dipToken) {
+        return _dipToken;
+    }
+
+    /// @dev returns the number of registered tokens
     function tokens() external view returns (uint256) {
         return _token.length;
     }
 
-    function getToken(uint256 idx) external view returns (IERC20Metadata token) {
-        return IERC20Metadata(_token[idx]);
+    /// @dev returns the token info for the specified index position [0 .. tokens() - 1].
+    function getTokenInfo(uint256 idx) external view returns (TokenInfo memory tokenInfo) {
+        return _token[idx];
     }
 
-    function isRegistered(address token) external view returns (bool) {
-        return _registered[token];
+    /// @dev returns the token info for the specified token coordinates.
+    function getTokenInfo(uint256 chainId, address token) external view returns (TokenInfo memory tokenInfo) {
+        return _tokenInfo[chainId][token];
     }
 
-    function isActive(address token, VersionPart majorVersion) external view returns (bool) {
-        return _active[token][majorVersion];
+    /// @dev returns true iff the specified token has been registered for this TokenRegistry contract.
+    function isRegistered(uint256 chainId, address token) public view returns (bool) {
+        return _tokenInfo[chainId][token].chainId > 0;
     }
 
-    /// @dev some sanity checks to prevent unintended registration
-    function _registerToken(address token) internal {
+    /// @dev returns true iff both the token is active for the specfied version and the global token state is active
+    function isActive(uint256 chainId, address token, VersionPart majorVersion) external view returns (bool) {
+        if(!_tokenInfo[chainId][token].active) {
+            return false;
+        }
+
+        return _active[chainId][token][majorVersion];
+    }
+
+    function getDipTokenAddress() external view returns (address) {
+        return address(_dipToken);
+    }
+
+    //--- IRegistryLinked --------------------------------------------------//
+
+    /// @dev returns the dip token for this chain
+    function getRegistry() public view returns (IRegistry) {
+        return _registry;
+    }
+
+    //--- internal functions ------------------------------------------------//
+
+
+    /// @dev checks if provided token address refers to a smart contract that implements 
+    /// erc20 functionality (via its non-optional functions)
+    function _verifyOnchainToken(address tokenAddress)
+        internal
+        virtual
+        view
+        returns (IERC20Metadata token)
+    {
+        token = IERC20Metadata(tokenAddress);
+        uint256 chainId = block.chainid;
 
         // MUST be contract
-        if(token.code.length == 0) {
-            revert NotContract(token);
+        if(tokenAddress.code.length == 0) {
+            revert ErrorTokenRegistryTokenNotContract(chainId, tokenAddress);
+        }
+
+        // MUST implement required erc20 view functions
+        if(!_implementsErc20Functions(token)) {
+            revert ErrorTokenRegistryTokenNotErc20(chainId, tokenAddress);
+        }
+    }
+
+
+    /// @dev checks availability of non-optional view functions
+    /// https://eips.ethereum.org/EIPS/eip-20#methods
+    function _implementsErc20Functions(IERC20Metadata token) internal view returns (bool implementsErc20Functions) {
+        try token.totalSupply() returns (uint256) {
+            // so far so goood
+        } catch {
+            return false;
         }
 
-        // MUST have decimals > 0 (indicator that this is in fact an erc20 token)
-        IERC20Metadata erc20 = IERC20Metadata(token);
-        if(erc20.decimals() == 0) {
-            revert TokenDecimalsZero();
+        try token.balanceOf(address(1)) returns (uint256) {
+            // so far so goood
+        } catch {
+            return false;
         }
 
-        _registered[token] = true;
-        _token.push(token);
+        try token.allowance(address(1), address(2)) returns (uint256) {
+            // so far so goood
+        } catch {
+            return false;
+        }
+
+        return true;
+    }
+
+    /// @dev some sanity checks to prevent unintended registration:
+    /// - token not yet registered
+    /// - chainId not zero
+    /// - token address not zero
+    function _registerToken(uint256 chainId, address token, uint8 decimals, string memory symbol) internal {
+
+        if (isRegistered(chainId, token)) {
+            revert ErrorTokenRegistryTokenAlreadyRegistered(chainId, token);
+        }
+
+        if(chainId == 0) {
+            revert ErrorTokenRegistryChainIdZero();
+        }
+
+        if(token == address(0)) {
+            revert ErrorTokenRegistryTokenAddressZero();
+        }
+
+        TokenInfo memory tokenInfo = TokenInfo({
+            chainId: chainId,
+            token: token,
+            decimals: decimals,
+            symbol: symbol,
+            active: true});
+
+        _tokenInfo[chainId][token] = tokenInfo;
+        _token.push(tokenInfo);
 
-        emit LogRegistered(token, erc20.symbol(), erc20.decimals());
+        emit LogTokenRegistryTokenRegistered(chainId, token, decimals, symbol);
     }
 }