@etherisc/gif-next 0.0.2-e8b06c8-540 → 0.0.2-e8ea5fe-337

package/artifacts/contracts/upgradeability/UpgradableProxyWithAdmin.sol/UpgradableProxyWithAdmin.dbg.json

@@ -0,0 +1,4 @@
+{
+  "_format": "hh-sol-dbg-1",
+  "buildInfo": "../../../build-info/e2e3b7f72e025759291be05737506c35.json"
+}

package/artifacts/contracts/upgradeability/UpgradableProxyWithAdmin.sol/UpgradableProxyWithAdmin.json

@@ -0,0 +1,129 @@
+{
+  "_format": "hh-sol-artifact-1",
+  "contractName": "UpgradableProxyWithAdmin",
+  "sourceName": "contracts/upgradeability/UpgradableProxyWithAdmin.sol",
+  "abi": [
+    {
+      "inputs": [
+        {
+          "internalType": "address",
+          "name": "implementation",
+          "type": "address"
+        },
+        {
+          "internalType": "address",
+          "name": "initialProxyAdminOwner",
+          "type": "address"
+        },
+        {
+          "internalType": "bytes",
+          "name": "data",
+          "type": "bytes"
+        }
+      ],
+      "stateMutability": "nonpayable",
+      "type": "constructor"
+    },
+    {
+      "inputs": [
+        {
+          "internalType": "address",
+          "name": "target",
+          "type": "address"
+        }
+      ],
+      "name": "AddressEmptyCode",
+      "type": "error"
+    },
+    {
+      "inputs": [
+        {
+          "internalType": "address",
+          "name": "admin",
+          "type": "address"
+        }
+      ],
+      "name": "ERC1967InvalidAdmin",
+      "type": "error"
+    },
+    {
+      "inputs": [
+        {
+          "internalType": "address",
+          "name": "implementation",
+          "type": "address"
+        }
+      ],
+      "name": "ERC1967InvalidImplementation",
+      "type": "error"
+    },
+    {
+      "inputs": [],
+      "name": "ERC1967NonPayable",
+      "type": "error"
+    },
+    {
+      "inputs": [],
+      "name": "FailedInnerCall",
+      "type": "error"
+    },
+    {
+      "inputs": [],
+      "name": "ProxyDeniedAdminAccess",
+      "type": "error"
+    },
+    {
+      "anonymous": false,
+      "inputs": [
+        {
+          "indexed": false,
+          "internalType": "address",
+          "name": "previousAdmin",
+          "type": "address"
+        },
+        {
+          "indexed": false,
+          "internalType": "address",
+          "name": "newAdmin",
+          "type": "address"
+        }
+      ],
+      "name": "AdminChanged",
+      "type": "event"
+    },
+    {
+      "anonymous": false,
+      "inputs": [
+        {
+          "indexed": true,
+          "internalType": "address",
+          "name": "implementation",
+          "type": "address"
+        }
+      ],
+      "name": "Upgraded",
+      "type": "event"
+    },
+    {
+      "stateMutability": "payable",
+      "type": "fallback"
+    },
+    {
+      "inputs": [],
+      "name": "getProxyAdmin",
+      "outputs": [
+        {
+          "internalType": "contract ProxyAdmin",
+          "name": "",
+          "type": "address"
+        }
+      ],
+      "stateMutability": "nonpayable",
+      "type": "function"
+    }
+  ],
+  "bytecode": "0x60a060405234801561000f575f80fd5b50604051610e4c380380610e4c83398101604081905261002e9161037c565b828282828161003d828261009e565b50508160405161004c90610340565b6001600160a01b039091168152602001604051809103905ff080158015610075573d5f803e3d5ffd5b506001600160a01b031660805261009361008e60805190565b6100fc565b505050505050610463565b6100a782610169565b6040516001600160a01b038316907fbc7cd75a20ee27fd9adebab32041f755214dbc6bffa90cc0225b39da2e5c2d3b905f90a28051156100f0576100eb82826101e7565b505050565b6100f861025a565b5050565b7f7e644d79422f17c01e4894b5f4f588d331ebfa28653d42ae832dc59e38c9798f61013b5f80516020610e2c833981519152546001600160a01b031690565b604080516001600160a01b03928316815291841660208301520160405180910390a16101668161027b565b50565b806001600160a01b03163b5f036101a357604051634c9c8ce360e01b81526001600160a01b03821660048201526024015b60405180910390fd5b807f360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc5b80546001600160a01b0319166001600160a01b039290921691909117905550565b60605f80846001600160a01b031684604051610203919061044d565b5f60405180830381855af49150503d805f811461023b576040519150601f19603f3d011682016040523d82523d5f602084013e610240565b606091505b5090925090506102518583836102b8565b95945050505050565b34156102795760405163b398979f60e01b815260040160405180910390fd5b565b6001600160a01b0381166102a457604051633173bdd160e11b81525f600482015260240161019a565b805f80516020610e2c8339815191526101c6565b6060826102cd576102c882610317565b610310565b81511580156102e457506001600160a01b0384163b155b1561030d57604051639996b31560e01b81526001600160a01b038516600482015260240161019a565b50805b9392505050565b8051156103275780518082602001fd5b604051630a12f52160e11b815260040160405180910390fd5b6104ef8061093d83390190565b80516001600160a01b0381168114610363575f80fd5b919050565b634e487b7160e01b5f52604160045260245ffd5b5f805f6060848603121561038e575f80fd5b6103978461034d565b92506103a56020850161034d565b60408501519092506001600160401b038111156103c0575f80fd5b8401601f810186136103d0575f80fd5b80516001600160401b038111156103e9576103e9610368565b604051601f8201601f19908116603f011681016001600160401b038111828210171561041757610417610368565b60405281815282820160200188101561042e575f80fd5b8160208401602083015e5f602083830101528093505050509250925092565b5f82518060208501845e5f920191825250919050565b6080516104bd6104805f395f818160350152607201526104bd5ff3fe60806040526004361061001d575f3560e01c80638b3240a014610027575b610025610070565b005b348015610032575f80fd5b507f00000000000000000000000000000000000000000000000000000000000000006040516001600160a01b03909116815260200160405180910390f35b7f00000000000000000000000000000000000000000000000000000000000000006001600160a01b031633036100dc575f356001600160e01b03191663278f794360e11b146100d2576040516334ad5dbb60e21b815260040160405180910390fd5b6100da6100e9565b565b6100da610117565b905090565b5f806100f83660048184610365565b81019061010591906103a0565b915091506101138282610127565b5050565b6100da610122610181565b6101b3565b610130826101d1565b6040516001600160a01b038316907fbc7cd75a20ee27fd9adebab32041f755214dbc6bffa90cc0225b39da2e5c2d3b905f90a280511561017957610174828261024c565b505050565b6101136102be565b5f6100e47f360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc546001600160a01b031690565b365f80375f80365f845af43d5f803e8080156101cd573d5ff35b3d5ffd5b806001600160a01b03163b5f0361020b57604051634c9c8ce360e01b81526001600160a01b03821660048201526024015b60405180910390fd5b7f360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc80546001600160a01b0319166001600160a01b0392909216919091179055565b60605f80846001600160a01b0316846040516102689190610471565b5f60405180830381855af49150503d805f81146102a0576040519150601f19603f3d011682016040523d82523d5f602084013e6102a5565b606091505b50915091506102b58583836102dd565b95945050505050565b34156100da5760405163b398979f60e01b815260040160405180910390fd5b6060826102f2576102ed8261033c565b610335565b815115801561030957506001600160a01b0384163b155b1561033257604051639996b31560e01b81526001600160a01b0385166004820152602401610202565b50805b9392505050565b80511561034c5780518082602001fd5b604051630a12f52160e11b815260040160405180910390fd5b5f8085851115610373575f80fd5b8386111561037f575f80fd5b5050820193919092039150565b634e487b7160e01b5f52604160045260245ffd5b5f80604083850312156103b1575f80fd5b82356001600160a01b03811681146103c7575f80fd5b9150602083013567ffffffffffffffff8111156103e2575f80fd5b8301601f810185136103f2575f80fd5b803567ffffffffffffffff81111561040c5761040c61038c565b604051601f8201601f19908116603f0116810167ffffffffffffffff8111828210171561043b5761043b61038c565b604052818152828201602001871015610452575f80fd5b816020840160208301375f602083830101528093505050509250929050565b5f82518060208501845e5f92019182525091905056fea26469706673582212205f12e4d638be8d591db7c67d942f3e9eeb14e9e44f78ba8cddaca37631bdc49764736f6c634300081a0033608060405234801561000f575f80fd5b506040516104ef3803806104ef83398101604081905261002e916100bb565b806001600160a01b03811661005c57604051631e4fbdf760e01b81525f600482015260240160405180910390fd5b6100658161006c565b50506100e8565b5f80546001600160a01b038381166001600160a01b0319831681178455604051919092169283917f8be0079c531659141344cd1fd0a4f28419497f9722a3daafe3b4186f6b6457e09190a35050565b5f602082840312156100cb575f80fd5b81516001600160a01b03811681146100e1575f80fd5b9392505050565b6103fa806100f55f395ff3fe608060405260043610610049575f3560e01c8063715018a61461004d5780638da5cb5b146100635780639623609d1461008e578063ad3cb1cc146100a1578063f2fde38b146100de575b5f80fd5b348015610058575f80fd5b506100616100fd565b005b34801561006e575f80fd5b505f546040516001600160a01b0390911681526020015b60405180910390f35b61006161009c366004610260565b610110565b3480156100ac575f80fd5b506100d1604051806040016040528060058152602001640352e302e360dc1b81525081565b6040516100859190610365565b3480156100e9575f80fd5b506100616100f836600461037e565b61017b565b6101056101bd565b61010e5f6101e9565b565b6101186101bd565b60405163278f794360e11b81526001600160a01b03841690634f1ef2869034906101489086908690600401610399565b5f604051808303818588803b15801561015f575f80fd5b505af1158015610171573d5f803e3d5ffd5b5050505050505050565b6101836101bd565b6001600160a01b0381166101b157604051631e4fbdf760e01b81525f60048201526024015b60405180910390fd5b6101ba816101e9565b50565b5f546001600160a01b0316331461010e5760405163118cdaa760e01b81523360048201526024016101a8565b5f80546001600160a01b038381166001600160a01b0319831681178455604051919092169283917f8be0079c531659141344cd1fd0a4f28419497f9722a3daafe3b4186f6b6457e09190a35050565b6001600160a01b03811681146101ba575f80fd5b634e487b7160e01b5f52604160045260245ffd5b5f805f60608486031215610272575f80fd5b833561027d81610238565b9250602084013561028d81610238565b9150604084013567ffffffffffffffff8111156102a8575f80fd5b8401601f810186136102b8575f80fd5b803567ffffffffffffffff8111156102d2576102d261024c565b604051601f8201601f19908116603f0116810167ffffffffffffffff811182821017156103015761030161024c565b604052818152828201602001881015610318575f80fd5b816020840160208301375f602083830101528093505050509250925092565b5f81518084528060208401602086015e5f602082860101526020601f19601f83011685010191505092915050565b602081525f6103776020830184610337565b9392505050565b5f6020828403121561038e575f80fd5b813561037781610238565b6001600160a01b03831681526040602082018190525f906103bc90830184610337565b94935050505056fea264697066735822122063012ab3c3421087c307802be7295f03bec95db9eea702a4c2db9595befa162464736f6c634300081a0033b53127684a568b3173ae13b9f8a6016e243e63b6e8ee1178d6a717850b5d6103",
+  "deployedBytecode": "0x60806040526004361061001d575f3560e01c80638b3240a014610027575b610025610070565b005b348015610032575f80fd5b507f00000000000000000000000000000000000000000000000000000000000000006040516001600160a01b03909116815260200160405180910390f35b7f00000000000000000000000000000000000000000000000000000000000000006001600160a01b031633036100dc575f356001600160e01b03191663278f794360e11b146100d2576040516334ad5dbb60e21b815260040160405180910390fd5b6100da6100e9565b565b6100da610117565b905090565b5f806100f83660048184610365565b81019061010591906103a0565b915091506101138282610127565b5050565b6100da610122610181565b6101b3565b610130826101d1565b6040516001600160a01b038316907fbc7cd75a20ee27fd9adebab32041f755214dbc6bffa90cc0225b39da2e5c2d3b905f90a280511561017957610174828261024c565b505050565b6101136102be565b5f6100e47f360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc546001600160a01b031690565b365f80375f80365f845af43d5f803e8080156101cd573d5ff35b3d5ffd5b806001600160a01b03163b5f0361020b57604051634c9c8ce360e01b81526001600160a01b03821660048201526024015b60405180910390fd5b7f360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc80546001600160a01b0319166001600160a01b0392909216919091179055565b60605f80846001600160a01b0316846040516102689190610471565b5f60405180830381855af49150503d805f81146102a0576040519150601f19603f3d011682016040523d82523d5f602084013e6102a5565b606091505b50915091506102b58583836102dd565b95945050505050565b34156100da5760405163b398979f60e01b815260040160405180910390fd5b6060826102f2576102ed8261033c565b610335565b815115801561030957506001600160a01b0384163b155b1561033257604051639996b31560e01b81526001600160a01b0385166004820152602401610202565b50805b9392505050565b80511561034c5780518082602001fd5b604051630a12f52160e11b815260040160405180910390fd5b5f8085851115610373575f80fd5b8386111561037f575f80fd5b5050820193919092039150565b634e487b7160e01b5f52604160045260245ffd5b5f80604083850312156103b1575f80fd5b82356001600160a01b03811681146103c7575f80fd5b9150602083013567ffffffffffffffff8111156103e2575f80fd5b8301601f810185136103f2575f80fd5b803567ffffffffffffffff81111561040c5761040c61038c565b604051601f8201601f19908116603f0116810167ffffffffffffffff8111828210171561043b5761043b61038c565b604052818152828201602001871015610452575f80fd5b816020840160208301375f602083830101528093505050509250929050565b5f82518060208501845e5f92019182525091905056fea26469706673582212205f12e4d638be8d591db7c67d942f3e9eeb14e9e44f78ba8cddaca37631bdc49764736f6c634300081a0033",
+  "linkReferences": {},
+  "deployedLinkReferences": {}
+}

package/artifacts/contracts/upgradeability/Versionable.sol/Versionable.dbg.json

@@ -0,0 +1,4 @@
+{
+  "_format": "hh-sol-dbg-1",
+  "buildInfo": "../../../build-info/e2e3b7f72e025759291be05737506c35.json"
+}

package/artifacts/contracts/{shared → upgradeability}/Versionable.sol/Versionable.json

@@ -1,7 +1,7 @@
 {
   "_format": "hh-sol-artifact-1",
   "contractName": "Versionable",
-  "sourceName": "contracts/shared/Versionable.sol",
+  "sourceName": "contracts/upgradeability/Versionable.sol",
   "abi": [
     {
       "inputs": [],

package/contracts/authorization/AccessAdmin.sol

@@ -1,10 +1,11 @@
 // SPDX-License-Identifier: UNLICENSED
 pragma solidity ^0.8.20;
 
-import {AccessManager} from "@openzeppelin/contracts/access/manager/AccessManager.sol";
 import {AccessManagedUpgradeable} from "@openzeppelin/contracts-upgradeable/access/manager/AccessManagedUpgradeable.sol";
 import {EnumerableSet} from "@openzeppelin/contracts/utils/structs/EnumerableSet.sol";
+import {ReentrancyGuardUpgradeable} from "@openzeppelin/contracts-upgradeable/utils/ReentrancyGuardUpgradeable.sol";
 
+import {AccessManagerCloneable} from "./AccessManagerCloneable.sol";
 import {IAccessAdmin} from "./IAccessAdmin.sol";
 import {RoleId, RoleIdLib, ADMIN_ROLE, PUBLIC_ROLE} from "../type/RoleId.sol";
 import {Selector, SelectorLib, SelectorSetLib} from "../type/Selector.sol";
@@ -19,6 +20,7 @@ import {Timestamp, TimestampLib} from "../type/Timestamp.sol";
  */ 
 contract AccessAdmin is
     AccessManagedUpgradeable,
+    ReentrancyGuardUpgradeable,
     IAccessAdmin
 {
     using EnumerableSet for EnumerableSet.AddressSet;
@@ -27,7 +29,7 @@ contract AccessAdmin is
     string public constant PUBLIC_ROLE_NAME = "PublicRole";
 
     /// @dev the OpenZeppelin access manager driving the access admin contract
-    AccessManager internal _authority;
+    AccessManagerCloneable internal _authority;
 
     /// @dev stores the deployer address and allows to create initializers
     /// that are restricted to the deployer address.
@@ -106,7 +108,8 @@ contract AccessAdmin is
 
     constructor() {
         _deployer = msg.sender;
-        _authority = new AccessManager(address(this));
+        _authority = new AccessManagerCloneable();
+        _authority.initialize(address(this));
 
         _setAuthority(address(_authority)); // set authority for oz access managed
         _createAdminAndPublicRoles();
@@ -327,13 +330,7 @@ contract AccessAdmin is
             revert ErrorAuthorityAlreadySet();
         }
 
-        _authority = AccessManager(authorityAddress);
-
-        // TODO check if we really need this
-        // if(!hasRole(address(this), RoleId.wrap(_authority.ADMIN_ROLE()))) {
-        //     revert ErrorAdminRoleMissing();
-        // }
-
+        _authority = AccessManagerCloneable(authorityAddress);
         __AccessManaged_init(address(_authority));
     }
 
@@ -374,35 +371,6 @@ contract AccessAdmin is
                 roleType: RoleType.Gif,
                 maxMemberCount: type(uint32).max,
                 name: PUBLIC_ROLE_NAME}));
-
-        // TODO cleanup
-        // // setup manager role
-        // _managerRoleId = RoleIdLib.toRoleId(MANAGER_ROLE);
-        // _createRole(
-        //     _managerRoleId, 
-        //     adminRoleId,
-        //     MANAGER_ROLE_NAME,
-        //     isCustom,
-        //     3, // TODO think about max member count
-        //     false);
-
-        // // grant public role access to grant and revoke, renounce
-        // functions = new FunctionInfo[](3);
-        // functions[0] = toFunction(IAccessAdmin.grantRole.selector, "grantRole");
-        // functions[1] = toFunction(IAccessAdmin.revokeRole.selector, "revokeRole");
-        // functions[2] = toFunction(IAccessAdmin.renounceRole.selector, "renounceRole");
-        // _authorizeTargetFunctions(address(this), getPublicRole(), functions);
-
-        // // grant manager role access to the specified functions 
-        // functions = new FunctionInfo[](4);
-        // // TODO cleanup
-        // // functions[0] = toFunction(IAccessAdmin.createRole.selector, "createRole");
-        // functions[0] = toFunction(IAccessAdmin.setRoleDisabled.selector, "setRoleDisabled");
-        // // functions[1] = toFunction(IAccessAdmin.createTarget.selector, "createTarget");
-        // functions[1] = toFunction(IAccessAdmin.setTargetLocked.selector, "setTargetLocked");
-        // functions[2] = toFunction(IAccessAdmin.authorizeFunctions.selector, "authorizeFunctions");
-        // functions[3] = toFunction(IAccessAdmin.unauthorizeFunctions.selector, "unauthorizeFunctions");
-        // _authorizeTargetFunctions(address(this), getManagerRole(), functions);
     }
 
     /// @dev check if target exists and reverts if it doesn't
@@ -556,6 +524,7 @@ contract AccessAdmin is
         bool custom
     )
         internal
+        nonReentrant()
     {
         // check target does not yet exist
         if(targetExists(target)) {

package/contracts/authorization/AccessManagerCloneable.sol

@@ -0,0 +1,16 @@
+// SPDX-License-Identifier: UNLICENSED
+pragma solidity ^0.8.20;
+
+import {AccessManagerUpgradeable} from "@openzeppelin/contracts-upgradeable/access/manager/AccessManagerUpgradeable.sol";
+
+contract AccessManagerCloneable is
+    AccessManagerUpgradeable
+{
+
+    function initialize(address initialAdmin)
+        external
+        initializer()
+    {
+        __AccessManager_init(initialAdmin);
+    }
+}

package/contracts/authorization/Authorization.sol

@@ -134,7 +134,6 @@ contract Authorization
                RoleIdLib.toComponentRoleId(componentType, 0),
                _toTargetRoleName(
                     getTargetName()));
-
      }
 
      /// @dev Add a contract role for the provided role id and name.

package/contracts/authorization/IServiceAuthorization.sol

@@ -19,6 +19,9 @@ interface IServiceAuthorization {
           view
           returns(VersionPart release);
 
+     /// @dev Returns the service domain for the provided index.
+     function getServiceDomain(uint idx) external view returns(ObjectType serviceDomain);
+
      /// @dev Returns the full list of service domains for this release.
      /// Services need to be registered for the release in revers order of this list.
      function getServiceDomains() external view returns(ObjectType[] memory serviceDomains);

package/contracts/authorization/ModuleAuthorization.sol

@@ -16,40 +16,13 @@ contract ModuleAuthorization is
      IModuleAuthorization
 {
 
-     // TODO cleanup
-     // Str[] internal _targets;
      ObjectType[] internal _serviceDomains;
-
      mapping(ObjectType domain => Str target) internal _serviceTarget;
-     // mapping(Str target => RoleId roleid) internal _targetRole;
-     // mapping(Str target => bool exists) internal _targetExists;
-
-     // RoleId[] internal _roles;
-     // mapping(RoleId role => RoleInfo info) internal _roleInfo;
-
-     // mapping(Str target => RoleId[] authorizedRoles) internal _authorizedRoles;
-     // mapping(Str target => mapping(RoleId authorizedRole => IAccess.FunctionInfo[] functions)) internal _authorizedFunctions;
 
      constructor(string memory moduleName)
           Authorization(moduleName)
      { }
 
-     // function getRoles() external view returns(RoleId[] memory roles) {
-     //      return _roles;
-     // }
-
-     // function getRoleInfo(RoleId roleId) external view returns (RoleInfo memory info) {
-     //      return _roleInfo[roleId];
-     // }
-
-     // function roleExists(RoleId roleId) public view returns(bool exists) {
-     //      return _roleInfo[roleId].roleType != RoleType.Undefined;
-     // }
-
-     // function getTargets() external view returns(Str[] memory targets) {
-     //      return _targets;
-     // }
-
      function getServiceDomains() external view returns(ObjectType[] memory serviceDomains) {
           return _serviceDomains;
      }
@@ -58,33 +31,6 @@ contract ModuleAuthorization is
           return _serviceTarget[serviceDomain];
      }
 
-     // function getTargetRole(Str target) external view returns(RoleId roleId) {
-     //      return _targetRole[target];
-     // }
-
-     // function getAuthorizedRoles(Str target) external view returns(RoleId[] memory roleIds) {
-     //      return _authorizedRoles[target];
-     // }
-
-     // function getAuthorizedFunctions(Str target, RoleId roleId) external view returns(IAccess.FunctionInfo[] memory authorizatedFunctions) {
-     //      return _authorizedFunctions[target][roleId];
-     // }
-
-     // /// @dev Overwrite this function for a specific realease.
-     // function _setupTargets() internal virtual {}
-
-     // /// @dev Overwrite this function for a specific realease.
-     // function _setupRoles() internal virtual {}
-
-     // /// @dev Overwrite this function for a specific realease.
-     // function _setupTargetAuthorizations() internal virtual {}
-
-     // /// @dev Use this method to to add an authorized role.
-     // function _addRole(RoleId roleId, RoleInfo memory info) internal {
-     //      _roles.push(roleId);
-     //      _roleInfo[roleId] = info;
-     // }
-
      /// @dev Add a GIF role for the provided role id and name.
      function _addGifRole(RoleId roleId, string memory name) internal returns (RoleInfo memory info) {
           _addRole(
@@ -96,17 +42,6 @@ contract ModuleAuthorization is
                     name));
      }
 
-     // /// @dev Add a contract role for the provided role id and name.
-     // function _addContractRole(RoleId roleId, string memory name) internal {
-     //      _addRole(
-     //           roleId,
-     //           _toRoleInfo(
-     //                ADMIN_ROLE(),
-     //                RoleType.Contract,
-     //                1,
-     //                name));
-     // }
-
      /// @dev Add the service target role for the specified service domain
      function _addServiceTargetWithRole(ObjectType serviceDomain) internal {
           // add service domain
@@ -132,66 +67,6 @@ contract ModuleAuthorization is
                serviceRoleName);
      }
 
-     // /// @dev Use this method to to add an authorized target together with its target role.
-     // function _addTargetWithRole(
-     //      string memory targetName, 
-     //      RoleId roleId, 
-     //      string memory roleName
-     // )
-     //      internal
-     // {
-     //      // add target
-     //      Str target = StrLib.toStr(targetName);
-     //      _targets.push(target);
-
-     //      _targetExists[target] = true;
-
-     //      // link role to target if defined
-     //      if (roleId != RoleIdLib.zero()) {
-     //           // add role if new
-     //           if (!roleExists(roleId)) {
-     //                _addContractRole(roleId, roleName);
-     //           }
-
-     //           // link target to role
-     //           _targetRole[target] = roleId;
-     //      }
-     // }
-
-     // /// @dev creates a role info object from the provided parameters
-     // function _toRoleInfo(RoleId adminRoleId, RoleType roleType, uint32 maxMemberCount, string memory name) internal view returns (RoleInfo memory info) {
-     //      return RoleInfo({
-     //           name: StrLib.toStr(name),
-     //           adminRoleId: adminRoleId,
-     //           roleType: roleType,
-     //           maxMemberCount: maxMemberCount,
-     //           createdAt: TimestampLib.blockTimestamp()});
-     // }
-
-     // /// @dev Use this method to to add an authorized target.
-     // function _addTarget(string memory name) internal {
-     //      _addTargetWithRole(name, RoleIdLib.zero(), "");
-     // }
-
-     // /// @dev Use this method to authorize the specified role to access the target.
-     // function _authorizeForTarget(string memory target, RoleId authorizedRoleId)
-     //      internal
-     //      returns (IAccess.FunctionInfo[] storage authorizatedFunctions)
-     // {
-     //      Str targetStr = StrLib.toStr(target);
-     //      _authorizedRoles[targetStr].push(authorizedRoleId);
-     //      return _authorizedFunctions[targetStr][authorizedRoleId];
-     // }
-
-     // /// @dev Use this method to authorize a specific function authorization
-     // function _authorize(IAccess.FunctionInfo[] storage functions, bytes4 selector, string memory name) internal {
-     //      functions.push(
-     //           IAccess.FunctionInfo({
-     //                selector: SelectorLib.toSelector(selector),
-     //                name: StrLib.toStr(name),
-     //                createdAt: TimestampLib.blockTimestamp()}));
-     // }
-
      /// @dev role id for targets registry, staking and instance
      function _getTargetRoleId(ObjectType targetDomain) 
           internal

package/contracts/authorization/ServiceAuthorization.sol

@@ -40,6 +40,10 @@ contract ServiceAuthorization
           return _serviceDomains;
      }
 
+     function getServiceDomain(uint idx) external view returns(ObjectType serviceDomain) {
+          return _serviceDomains[idx];
+     }
+
      function getServiceAddress(ObjectType serviceDomain) external view returns(address service) {
           return _serviceAddress[serviceDomain];
      }

package/contracts/distribution/BasicDistribution.sol

@@ -1,25 +1,14 @@
 // SPDX-License-Identifier: Apache-2.0
 pragma solidity ^0.8.20;
 
-import {COMPONENT, DISTRIBUTION} from "../type/ObjectType.sol";
 import {Distribution} from "./Distribution.sol";
 import {IAuthorization} from "../authorization/IAuthorization.sol";
-import {IDistributionService} from "./IDistributionService.sol";
-import {IProductService} from "../product/IProductService.sol";
-import {NftId, NftIdLib} from "../type/NftId.sol";
-import {ReferralId, ReferralStatus, ReferralLib} from "../type/Referral.sol";
-import {Fee, FeeLib} from "../type/Fee.sol";
-import {InstanceLinkedComponent} from "../shared/InstanceLinkedComponent.sol";
-import {IComponentService} from "../shared/IComponentService.sol";
-import {IDistribution} from "../instance/module/IDistribution.sol";
-import {IDistributionComponent} from "./IDistributionComponent.sol";
-import {IRegistry} from "../registry/IRegistry.sol";
-import {TokenHandler} from "../shared/TokenHandler.sol";
-import {InstanceReader} from "../instance/InstanceReader.sol";
+import {NftId} from "../type/NftId.sol";
+import {ReferralId} from "../type/Referral.sol";
+import {Fee} from "../type/Fee.sol";
 import {UFixed} from "../type/UFixed.sol";
 import {DistributorType} from "../type/DistributorType.sol";
-import {Timestamp, TimestampLib} from "../type/Timestamp.sol";
-import {ITransferInterceptor} from "../registry/ITransferInterceptor.sol";
+import {Timestamp} from "../type/Timestamp.sol";
 
 
 contract BasicDistribution is

package/contracts/distribution/BasicDistributionAuthorization.sol

@@ -3,10 +3,11 @@ pragma solidity ^0.8.20;
 
 import {Authorization} from "../authorization/Authorization.sol";
 import {BasicDistribution} from "./BasicDistribution.sol"; 
+import {Distribution} from "./Distribution.sol";
 import {DISTRIBUTION} from "../type/ObjectType.sol";
 import {IAccess} from "../authorization/IAccess.sol";
+import {IInstanceLinkedComponent} from "../shared/IInstanceLinkedComponent.sol";
 import {PUBLIC_ROLE} from "../../contracts/type/RoleId.sol";
-import {RoleId} from "../type/RoleId.sol";
 
 
 contract BasicDistributionAuthorization
@@ -38,6 +39,9 @@ contract BasicDistributionAuthorization
           _authorize(functions, BasicDistribution.createDistributor.selector, "createDistributor");
           _authorize(functions, BasicDistribution.updateDistributorType.selector, "updateDistributorType");
           _authorize(functions, BasicDistribution.createReferral.selector, "createReferral");
+          
+          _authorize(functions, IInstanceLinkedComponent.withdrawFees.selector, "withdrawFees");
+          _authorize(functions, Distribution.withdrawCommission.selector, "withdrawCommission");
      }
 }
 

package/contracts/distribution/Distribution.sol

@@ -1,24 +1,19 @@
 // SPDX-License-Identifier: Apache-2.0
 pragma solidity ^0.8.20;
 
+import {Amount} from "../type/Amount.sol";
 import {COMPONENT, DISTRIBUTION} from "../type/ObjectType.sol";
 import {IAuthorization} from "../authorization/IAuthorization.sol";
 import {IDistributionService} from "./IDistributionService.sol";
-import {IProductService} from "../product/IProductService.sol";
 import {NftId, NftIdLib} from "../type/NftId.sol";
 import {ReferralId, ReferralStatus, ReferralLib} from "../type/Referral.sol";
-import {Fee, FeeLib} from "../type/Fee.sol";
+import {Fee} from "../type/Fee.sol";
 import {InstanceLinkedComponent} from "../shared/InstanceLinkedComponent.sol";
 import {IComponentService} from "../shared/IComponentService.sol";
-import {IDistribution} from "../instance/module/IDistribution.sol";
 import {IDistributionComponent} from "./IDistributionComponent.sol";
-import {IRegistry} from "../registry/IRegistry.sol";
-import {TokenHandler} from "../shared/TokenHandler.sol";
-import {InstanceReader} from "../instance/InstanceReader.sol";
 import {UFixed} from "../type/UFixed.sol";
 import {DistributorType} from "../type/DistributorType.sol";
-import {Timestamp, TimestampLib} from "../type/Timestamp.sol";
-import {ITransferInterceptor} from "../registry/ITransferInterceptor.sol";
+import {Timestamp} from "../type/Timestamp.sol";
 
 
 abstract contract Distribution is
@@ -41,13 +36,13 @@ abstract contract Distribution is
         _;
     }
 
-
     function register()
         external
         virtual
         onlyOwner()
     {
         _getDistributionStorage()._componentService.registerDistribution();
+        _approveTokenHandler(type(uint256).max);
     }
 
 
@@ -127,7 +122,18 @@ abstract contract Distribution is
         return true;
     }
 
-
+    /// @inheritdoc IDistributionComponent
+    function withdrawCommission(NftId distributorNftId, Amount amount) 
+        external 
+        virtual
+        restricted()
+        onlyDistributor()
+        onlyNftOwner(distributorNftId)
+        returns (Amount withdrawnAmount) 
+    {
+        return _withdrawCommission(distributorNftId, amount);
+    }
+        
     function _initializeDistribution(
         address registry,
         NftId instanceNftId,
@@ -266,6 +272,12 @@ abstract contract Distribution is
             data);
     }
 
+    function _withdrawCommission(NftId distributorNftId, Amount amount) 
+        internal
+        returns (Amount withdrawnAmount) 
+    {
+        return _getDistributionStorage()._distributionService.withdrawCommission(distributorNftId, amount);
+    }
 
     function _nftTransferFrom(address from, address to, uint256 tokenId) internal virtual override {
         // keep track of distributor nft owner