@etherisc/gif-next 0.0.2-e94f4c7-084 → 0.0.2-e964d24-516

package/contracts/instance/IInstanceService.sol

@@ -1,16 +1,17 @@
 // SPDX-License-Identifier: Apache-2.0
 pragma solidity ^0.8.20;
 
-import {NftId} from "../types/NftId.sol";
-import {ObjectType} from "../types/ObjectType.sol";
-import {RoleId} from "../types/RoleId.sol";
+import {NftId} from "../type/NftId.sol";
+import {ObjectType} from "../type/ObjectType.sol";
+import {RoleId} from "../type/RoleId.sol";
 import {IService} from "../shared/IService.sol";
 
-import {AccessManagerUpgradeableInitializeable} from "./AccessManagerUpgradeableInitializeable.sol";
+import {AccessManagerUpgradeableInitializeable} from "../shared/AccessManagerUpgradeableInitializeable.sol";
 import {InstanceAccessManager} from "./InstanceAccessManager.sol";
 import {Instance} from "./Instance.sol";
 import {InstanceReader} from "./InstanceReader.sol";
 import {BundleManager} from "./BundleManager.sol";
+import {InstanceStore} from "./InstanceStore.sol";
 
 interface IInstanceService is IService {
 
@@ -25,15 +26,16 @@ interface IInstanceService is IService {
     error ErrorInstanceServiceInstanceReaderSameAsMasterInstanceReader();
     error ErrorInstanceServiceInstanceReaderInstanceMismatch();
 
-    error ErrorInstanceServiceOzAccessManagerZero();
     error ErrorInstanceServiceInstanceAccessManagerZero();
     error ErrorInstanceServiceInstanceReaderZero();
     error ErrorInstanceServiceBundleManagerZero();
+    error ErrorInstanceServiceInstanceStoreZero();
 
     error ErrorInstanceServiceInstanceAuthorityMismatch();
     error ErrorInstanceServiceBundleManagerAuthorityMismatch();
     error ErrorInstanceServiceInstanceReaderInstanceMismatch2();
     error ErrorInstanceServiceBundleMangerInstanceMismatch();
+    error ErrorInstanceServiceInstanceStoreAuthorityMismatch();
 
     error ErrorInstanceServiceRequestUnauhorized(address caller);
     error ErrorInstanceServiceNotInstanceOwner(address caller, NftId instanceNftId);
@@ -42,17 +44,21 @@ interface IInstanceService is IService {
     error ErrorInstanceServiceInstanceComponentMismatch(NftId instanceNftId, NftId componentNftId);
     error ErrorInstanceServiceInvalidComponentType(address componentAddress, ObjectType expectedType, ObjectType componentType);
     
-    event LogInstanceCloned(address clonedOzAccessManager, address clonedInstanceAccessManager, address clonedInstance, address clonedBundleManager, address clonedInstanceReader, NftId clonedInstanceNftId);
+    event LogInstanceCloned(
+        address clonedOzAccessManager,
+        address clonedInstanceAccessManager,
+        address clonedInstance,
+        address clonedInstanceStore,
+        address clonedBundleManager, 
+        address clonedInstanceReader, 
+        NftId clonedInstanceNftId
+    );
 
     function createInstanceClone()
         external 
         returns (
-            AccessManagerUpgradeableInitializeable clonedOzAccessManager,
-            InstanceAccessManager clonedInstanceAccessManager, 
             Instance clonedInstance,
-            NftId instanceNftId,
-            InstanceReader clonedInstanceReader,
-            BundleManager clonedBundleManager
+            NftId instanceNftId
         );
 
     function createGifTarget(
@@ -64,5 +70,4 @@ interface IInstanceService is IService {
     ) external;
 
     function setComponentLocked(bool locked) external;
-}
-
+}

package/contracts/instance/Instance.sol

@@ -3,19 +3,19 @@ pragma solidity ^0.8.20;
 
 import {AccessManagedUpgradeable} from "@openzeppelin/contracts-upgradeable/access/manager/AccessManagedUpgradeable.sol";
 
-import {Key32} from "../types/Key32.sol";
-import {NftId} from "../types/NftId.sol";
-import {ClaimId} from "../types/ClaimId.sol";
-import {DistributorType} from "../types/DistributorType.sol";
-import {PayoutId} from "../types/PayoutId.sol";
-import {ObjectType, BUNDLE, DISTRIBUTION, INSTANCE, POLICY, POOL, PRODUCT, DISTRIBUTOR} from "../types/ObjectType.sol";
-import {ReferralId} from "../types/Referral.sol";
-import {RiskId} from "../types/RiskId.sol";
-import {INSTANCE_OWNER_ROLE} from "../types/RoleId.sol";
-import {StateId} from "../types/StateId.sol";
-import {VersionPart, VersionPartLib} from "../types/Version.sol";
+import {Key32} from "../type/Key32.sol";
+import {NftId} from "../type/NftId.sol";
+import {RiskId} from "../type/RiskId.sol";
+import {ObjectType, BUNDLE, DISTRIBUTION, INSTANCE, POLICY, POOL, ROLE, PRODUCT, TARGET, COMPONENT, DISTRIBUTOR, DISTRIBUTOR_TYPE} from "../type/ObjectType.sol";
+import {RoleId, RoleIdLib, eqRoleId, ADMIN_ROLE, INSTANCE_ROLE, INSTANCE_OWNER_ROLE} from "../type/RoleId.sol";
+import {VersionPart, VersionPartLib} from "../type/Version.sol";
+import {ClaimId} from "../type/ClaimId.sol";
+import {ReferralId} from "../type/Referral.sol";
+import {PayoutId} from "../type/PayoutId.sol";
+import {DistributorType} from "../type/DistributorType.sol";
 
 import {Registerable} from "../shared/Registerable.sol";
+import {TokenHandler} from "../shared/TokenHandler.sol";
 
 import {IRegistry} from "../registry/IRegistry.sol";
 
@@ -23,6 +23,7 @@ import {IInstance} from "./IInstance.sol";
 import {InstanceReader} from "./InstanceReader.sol";
 import {InstanceAccessManager} from "./InstanceAccessManager.sol";
 import {BundleManager} from "./BundleManager.sol";
+import {InstanceStore} from "./InstanceStore.sol";
 
 import {KeyValueStore} from "./base/KeyValueStore.sol";
 
@@ -33,28 +34,25 @@ import {IPolicy} from "./module/IPolicy.sol";
 import {IRisk} from "./module/IRisk.sol";
 import {ISetup} from "./module/ISetup.sol";
 
-import {VersionPart, VersionPartLib} from "../types/Version.sol";
+import {IDistributionService} from "../distribution/IDistributionService.sol";
+import {IPoolService} from "../pool/IPoolService.sol";
+import {IProductService} from "../product/IProductService.sol";
+import {IPolicyService} from "../product/IPolicyService.sol";
+import {IBundleService} from "../pool/IBundleService.sol";
 
 contract Instance is
     IInstance,
     AccessManagedUpgradeable,
-    Registerable,
-    KeyValueStore
+    Registerable
 {
-
     uint256 public constant GIF_MAJOR_VERSION = 3;
 
-    uint64 public constant ADMIN_ROLE = type(uint64).min;
-    uint64 public constant PUBLIC_ROLE = type(uint64).max;
-    uint64 public constant CUSTOM_ROLE_ID_MIN = 10000;
-
-    uint32 public constant EXECUTION_DELAY = 0;
-
     bool private _initialized;
 
     InstanceAccessManager internal _accessManager;
     InstanceReader internal _instanceReader;
     BundleManager internal _bundleManager;
+    InstanceStore internal _instanceStore;
 
     modifier onlyChainNft() {
         if(msg.sender != getRegistry().getChainNftAddress()) {
@@ -64,171 +62,74 @@ contract Instance is
     }
 
     function initialize(address authority, address registryAddress, address initialOwner) 
-        public 
+        external 
         initializer()
     {
+        if(authority == address(0)) {
+            revert ErrorInstanceInstanceAccessManagerZero();
+        }
+
         __AccessManaged_init(authority);
         
         IRegistry registry = IRegistry(registryAddress);
         initializeRegisterable(registryAddress, registry.getNftId(), INSTANCE(), true, initialOwner, "");
-        initializeLifecycle();
 
         registerInterface(type(IInstance).interfaceId);    
     }
 
-    //--- ProductSetup ------------------------------------------------------//
-    function createProductSetup(NftId productNftId, ISetup.ProductSetupInfo memory setup) external restricted() {
-        create(_toNftKey32(productNftId, PRODUCT()), abi.encode(setup));
-    }
-
-    function updateProductSetup(NftId productNftId, ISetup.ProductSetupInfo memory setup, StateId newState) external restricted() {
-        update(_toNftKey32(productNftId, PRODUCT()), abi.encode(setup), newState);
-    }
-
-    function updateProductSetupState(NftId productNftId, StateId newState) external restricted() {
-        updateState(_toNftKey32(productNftId, PRODUCT()), newState);
-    }
-
-    //--- DistributionSetup ------------------------------------------------------//
-    function createDistributionSetup(NftId distributionNftId, ISetup.DistributionSetupInfo memory setup) external restricted() {
-        create(_toNftKey32(distributionNftId, DISTRIBUTION()), abi.encode(setup));
-    }
-
-    function updateDistributionSetup(NftId distributionNftId, ISetup.DistributionSetupInfo memory setup, StateId newState) external restricted() {
-        update(_toNftKey32(distributionNftId, DISTRIBUTION()), abi.encode(setup), newState);
-    }
-
-    function updateDistributionSetupState(NftId distributionNftId, StateId newState) external restricted() {
-        updateState(_toNftKey32(distributionNftId, DISTRIBUTION()), newState);
-    }
-
-    //--- PoolSetup ------------------------------------------------------//
-    function createPoolSetup(NftId poolNftId, IComponents.ComponentInfo memory info) external restricted() {
-        create(_toNftKey32(poolNftId, POOL()), abi.encode(info));
-    }
-
-    function updatePoolSetup(NftId poolNftId, IComponents.ComponentInfo memory info, StateId newState) external restricted() {
-        update(_toNftKey32(poolNftId, POOL()), abi.encode(info), newState);
-    }
-
-    function updatePoolSetupState(NftId poolNftId, StateId newState) external restricted() {
-        updateState(_toNftKey32(poolNftId, POOL()), newState);
-    }
-
-    //--- DistributorType -------------------------------------------------------//
-    function createDistributorType(DistributorType distributorType, IDistribution.DistributorTypeInfo memory info) external restricted() {
-        create(distributorType.toKey32(), abi.encode(info));
-    }
-
-    function updateDistributorType(DistributorType distributorType, IDistribution.DistributorTypeInfo memory info, StateId newState) external restricted() {
-        update(distributorType.toKey32(), abi.encode(info), newState);
-    }
-
-    function updateDistributorTypeState(DistributorType distributorType, StateId newState) external restricted() {
-        updateState(distributorType.toKey32(), newState);
-    }
-
-    //--- Distributor -------------------------------------------------------//
-    function createDistributor(NftId distributorNftId, IDistribution.DistributorInfo memory info) external restricted() {
-        create(_toNftKey32(distributorNftId, DISTRIBUTOR()), abi.encode(info));
-    }
-
-    function updateDistributor(NftId distributorNftId, IDistribution.DistributorInfo memory info, StateId newState) external restricted() {
-        update(_toNftKey32(distributorNftId, DISTRIBUTOR()), abi.encode(info), newState);
-    }
-
-    function updateDistributorState(NftId distributorNftId, StateId newState) external restricted() {
-        updateState(_toNftKey32(distributorNftId, DISTRIBUTOR()), newState);
-    }
-
-    //--- Referral ----------------------------------------------------------//
-    function createReferral(ReferralId referralId, IDistribution.ReferralInfo memory referralInfo) external restricted() {
-        create(referralId.toKey32(), abi.encode(referralInfo));
-    }
-
-    function updateReferral(ReferralId referralId, IDistribution.ReferralInfo memory referralInfo, StateId newState) external restricted() {
-        update(referralId.toKey32(), abi.encode(referralInfo), newState);
-    }
-
-    function updateReferralState(ReferralId referralId, StateId newState) external restricted() {
-        updateState(referralId.toKey32(), newState);
-    }
-
-    //--- Bundle ------------------------------------------------------------//
-    function createBundle(NftId bundleNftId, IBundle.BundleInfo memory bundle) external restricted() {
-        create(_toNftKey32(bundleNftId, BUNDLE()), abi.encode(bundle));
-    }
-
-    function updateBundle(NftId bundleNftId, IBundle.BundleInfo memory bundle, StateId newState) external restricted() {
-        update(_toNftKey32(bundleNftId, BUNDLE()), abi.encode(bundle), newState);
-    }
+    //--- Roles ------------------------------------------------------------//
 
-    function updateBundleState(NftId bundleNftId, StateId newState) external restricted() {
-        updateState(_toNftKey32(bundleNftId, BUNDLE()), newState);
-    }
-
-    //--- Risk --------------------------------------------------------------//
-    function createRisk(RiskId riskId, IRisk.RiskInfo memory risk) external restricted() {
-        create(riskId.toKey32(), abi.encode(risk));
-    }
-
-    function updateRisk(RiskId riskId, IRisk.RiskInfo memory risk, StateId newState) external restricted() {
-        update(riskId.toKey32(), abi.encode(risk), newState);
-    }
-
-    function updateRiskState(RiskId riskId, StateId newState) external restricted() {
-        updateState(riskId.toKey32(), newState);
-    }
-
-    //--- Application (Policy) ----------------------------------------------//
-    function createApplication(NftId applicationNftId, IPolicy.PolicyInfo memory policy) external restricted() {
-        create(_toNftKey32(applicationNftId, POLICY()), abi.encode(policy));
-    }
-
-    function updateApplication(NftId applicationNftId, IPolicy.PolicyInfo memory policy, StateId newState) external restricted() {
-        update(_toNftKey32(applicationNftId, POLICY()), abi.encode(policy), newState);
-    }
-
-    function updateApplicationState(NftId applicationNftId, StateId newState) external restricted() {
-        updateState(_toNftKey32(applicationNftId, POLICY()), newState);
-    }
-
-    //--- Policy ------------------------------------------------------------//
-    function updatePolicy(NftId policyNftId, IPolicy.PolicyInfo memory policy, StateId newState) external restricted() {
-        update(_toNftKey32(policyNftId, POLICY()), abi.encode(policy), newState);
-    }
-
-    function updatePolicyState(NftId policyNftId, StateId newState) external restricted() {
-        updateState(_toNftKey32(policyNftId, POLICY()), newState);
+    function createRole(string memory roleName, string memory adminName)
+        external
+        restricted // INSTANCE_OWNER_ROLE
+        returns (RoleId roleId, RoleId admin)
+    {
+        (roleId, admin) = _accessManager.createRole(roleName, adminName);
     }
 
-    //--- Claim -------------------------------------------------------------//
-    function createClaim(NftId policyNftId, ClaimId claimId, IPolicy.ClaimInfo memory claim) external restricted() {
-        create(_toClaimKey32(policyNftId, claimId), abi.encode(claim));
+    function grantRole(RoleId roleId, address account) 
+        external 
+        restricted // INSTANCE_OWNER_ROLE
+    {
+        _accessManager.grantRole(roleId, account);
     }
 
-    function updateClaim(NftId policyNftId, ClaimId claimId, IPolicy.ClaimInfo memory claim, StateId newState) external restricted() {
-        update(_toClaimKey32(policyNftId, claimId), abi.encode(claim), newState);
+    function revokeRole(RoleId roleId, address account) 
+        external 
+        restricted // INSTANCE_OWNER_ROLE
+    {
+        _accessManager.revokeRole(roleId, account);
     }
 
-    function updateClaimState(NftId policyNftId, ClaimId claimId, StateId newState) external restricted() {
-        updateState(_toClaimKey32(policyNftId, claimId), newState);
-    }
+    //--- Targets ------------------------------------------------------------//
 
-    //--- Payout ------------------------------------------------------------//
-    function createPayout(NftId policyNftId, PayoutId payoutId, IPolicy.PayoutInfo memory payout) external restricted() {
-        create(_toPayoutKey32(policyNftId, payoutId), abi.encode(payout));
+    function createTarget(address target, string memory name) 
+        external 
+        restricted // INSTANCE_OWNER_ROLE
+    {
+        _accessManager.createTarget(target, name);
     }
 
-    function updatePayout(NftId policyNftId, PayoutId payoutId, IPolicy.PayoutInfo memory payout, StateId newState) external restricted() {
-        update(_toPayoutKey32(policyNftId, payoutId), abi.encode(payout), newState);
+    function setTargetFunctionRole(
+        string memory targetName,
+        bytes4[] calldata selectors,
+        RoleId roleId
+    ) 
+        external 
+        restricted // INSTANCE_OWNER_ROLE
+    {
+        _accessManager.setTargetFunctionRole(targetName, selectors, roleId);
     }
 
-    function updatePayoutState(NftId policyNftId, PayoutId payoutId, StateId newState) external restricted() {
-        updateState(_toPayoutKey32(policyNftId, payoutId), newState);
+    function setTargetLocked(address target, bool locked)
+        external 
+        restricted // INSTANCE_OWNER_ROLE
+    {
+        _accessManager.setTargetLockedByInstance(target, locked);
     }
 
     //--- ITransferInterceptor ------------------------------------------------------------//
+
     function nftMint(address to, uint256 tokenId) external onlyChainNft {
         assert(_accessManager.roleMembers(INSTANCE_OWNER_ROLE()) == 0);// temp
         assert(_accessManager.grantRole(INSTANCE_OWNER_ROLE(), to) == true);
@@ -245,27 +146,22 @@ contract Instance is
         if(address(_accessManager) != address(0)) {
             revert ErrorInstanceInstanceAccessManagerAlreadySet(address(_accessManager));
         }
-
         if(accessManager.authority() != authority()) {
             revert ErrorInstanceInstanceAccessManagerAuthorityMismatch(authority());
         }
-
         _accessManager = accessManager;      
     }
-
+    
     function setBundleManager(BundleManager bundleManager) external restricted() {
         if(address(_bundleManager) != address(0)) {
             revert ErrorInstanceBundleManagerAlreadySet(address(_bundleManager));
         }
-
         if(bundleManager.getInstance() != Instance(this)) {
             revert ErrorInstanceBundleManagerInstanceMismatch(address(this));
         }
-
         if(bundleManager.authority() != authority()) {
             revert ErrorInstanceBundleManagerAuthorityMismatch(authority());
         }
-
         _bundleManager = bundleManager;
     }
 
@@ -291,20 +187,43 @@ contract Instance is
         return _accessManager;
     }
 
+    function setInstanceStore(InstanceStore instanceStore) external restricted {
+        if(address(_instanceStore) != address(0)) {
+            revert ErrorInstanceInstanceStoreAlreadySet(address(_instanceStore));
+        }
+        if(instanceStore.authority() != authority()) {
+            revert ErrorInstanceInstanceStoreAuthorityMismatch(authority());
+        }
+        _instanceStore = instanceStore;
+    }
+
+    function getInstanceStore() external view returns (InstanceStore) {
+        return _instanceStore;
+    }
+
     function getMajorVersion() external pure returns (VersionPart majorVersion) {
         return VersionPartLib.toVersionPart(GIF_MAJOR_VERSION);
     }
 
-    //--- internal view/pure functions --------------------------------------//
-    function _toNftKey32(NftId nftId, ObjectType objectType) private pure returns (Key32) {
-        return nftId.toKey32(objectType);
+    function getDistributionService() external view returns (IDistributionService) {
+        return IDistributionService(getRegistry().getServiceAddress(DISTRIBUTION(), VersionPart.wrap(3)));
+    }
+
+    function getProductService() external view returns (IProductService) {
+        return IProductService(getRegistry().getServiceAddress(PRODUCT(), VersionPart.wrap(3)));
+    }
+
+    function getPoolService() external view returns (IPoolService) {
+        return IPoolService(getRegistry().getServiceAddress(POOL(), VersionPart.wrap(3)));
     }
 
-    function _toClaimKey32(NftId policyNftId, ClaimId claimId) private pure returns (Key32) {
-        return claimId.toKey32(policyNftId);
+    function getPolicyService() external view returns (IPolicyService) {
+        return IPolicyService(getRegistry().getServiceAddress(POLICY(), VersionPart.wrap(3)));
     }
 
-    function _toPayoutKey32(NftId policyNftId, PayoutId payoutId) private pure returns (Key32) {
-        return payoutId.toKey32(policyNftId);
+    function getBundleService() external view returns (IBundleService) {
+        return IBundleService(getRegistry().getServiceAddress(BUNDLE(), VersionPart.wrap(3)));
     }
-}
+
+    //--- internal view/pure functions --------------------------------------//
+}

package/contracts/instance/InstanceAccessManager.sol

@@ -5,11 +5,11 @@ import {AccessManagedUpgradeable} from "@openzeppelin/contracts-upgradeable/acce
 import {EnumerableSet} from "@openzeppelin/contracts/utils/structs/EnumerableSet.sol";
 import {ShortString, ShortStrings} from "@openzeppelin/contracts/utils/ShortStrings.sol";
 
-import {RoleId, RoleIdLib, ADMIN_ROLE, PUBLIC_ROLE, INSTANCE_SERVICE_ROLE, INSTANCE_OWNER_ROLE, INSTANCE_ROLE} from "../types/RoleId.sol";
-import {TimestampLib} from "../types/Timestamp.sol";
-import {NftId} from "../types/NftId.sol";
+import {RoleId, RoleIdLib, ADMIN_ROLE, PUBLIC_ROLE, INSTANCE_SERVICE_ROLE, INSTANCE_OWNER_ROLE, INSTANCE_ROLE} from "../type/RoleId.sol";
+import {TimestampLib} from "../type/Timestamp.sol";
+import {NftId} from "../type/NftId.sol";
 
-import {AccessManagerUpgradeableInitializeable} from "./AccessManagerUpgradeableInitializeable.sol";
+import {AccessManagerUpgradeableInitializeable} from "../shared/AccessManagerUpgradeableInitializeable.sol";
 
 import {IRegistry} from "../registry/IRegistry.sol";
 
@@ -73,7 +73,7 @@ contract InstanceAccessManager is
         _createRole(ADMIN_ROLE(), ADMIN_ROLE_NAME, IAccess.Type.Core);
         _createRole(PUBLIC_ROLE(), PUBLIC_ROLE_NAME, IAccess.Type.Core);
         _createRole(INSTANCE_ROLE(), INSTANCE_ROLE_NAME, IAccess.Type.Core);
-        _createRole(INSTANCE_OWNER_ROLE(), INSTANCE_OWNER_ROLE_NAME, IAccess.Type.Gif);
+        _createRole(INSTANCE_OWNER_ROLE(), INSTANCE_OWNER_ROLE_NAME, IAccess.Type.Gif);// TODO should be of core type
 
         // assume `this` is already a member of ADMIN_ROLE
         EnumerableSet.add(_roleMembers[ADMIN_ROLE()], address(this));
@@ -105,6 +105,7 @@ contract InstanceAccessManager is
     }
 
     // INSTANCE_OWNER_ROLE
+    // TODO specify how many owners role can have -> many roles MUST have exactly 1 member?
     function createRole(string memory roleName, string memory adminName)
         external
         restricted()
@@ -142,6 +143,7 @@ contract InstanceAccessManager is
         _roleInfo[roleId].admin = admin;      
     }
 
+    // TODO core role can be granted only to 1 member
     function grantRole(RoleId roleId, address member) 
         public
         restrictedToRoleAdmin(roleId) 
@@ -226,7 +228,7 @@ contract InstanceAccessManager is
         return _roleIds[idx];
     }
 
-    // TODO now: for non existent name returns ADMIN_ROLE id
+    // TODO returns ADMIN_ROLE id for non existent name
     function getRoleIdForName(string memory name) external view returns (RoleId roleId) {
         return _roleIdForName[ShortStrings.toShortString(name)];
     }
@@ -250,7 +252,7 @@ contract InstanceAccessManager is
         _createTarget(target, name, IAccess.Type.Core);
     }
     // INSTANCE_SERVICE_ROLE
-    // assume gif target is registered and belongs to the same instance as instance access manager
+    // TODO check for instance mismatch?
     function createGifTarget(address target, string memory name) external restricted() 
     {
         if(!_registry.isRegistered(target)) {
@@ -269,26 +271,22 @@ contract InstanceAccessManager is
         _createTarget(target, name, IAccess.Type.Custom);
     }
 
-    // INSTANCE_SERVICE_ROLE
-    // IMPORTANT: instance access manager MUST be of Core type -> otherwise will be locked forever
-    function setTargetLocked(address target, bool locked) 
+    // TODO instance owner locks component instead of revoking it access to the instance...
+    function setTargetLockedByService(address target, bool locked)
         external 
-        restricted() 
+        restricted // INSTANCE_SERVICE_ROLE
     {
-        IAccess.Type targetType = _targetInfo[target].ttype;
-        if(target == address(0) || targetType == IAccess.Type.NotInitialized) {
-            revert IAccess.ErrorIAccessTargetDoesNotExist(target);
-        }
-
-        if(targetType == IAccess.Type.Core) {
-            revert IAccess.ErrorIAccessTargetTypeInvalid(target, targetType);
-        }
+        _setTargetLocked(target, locked);
+    }
 
-        // TODO isLocked is redundant but makes getTargetInfo() faster
-        _targetInfo[target].isLocked = locked;
-        _accessManager.setTargetClosed(target, locked);
+    function setTargetLockedByInstance(address target, bool locked)
+        external
+        restricted // INSTANCE_ROLE
+    {
+        _setTargetLocked(target, locked);
     }
 
+
     // allowed combinations of roles and targets:
     //1) set core role for core target 
     //2) set gif role for gif target  
@@ -362,7 +360,7 @@ contract InstanceAccessManager is
     }
 
     function isTargetLocked(address target) public view returns (bool locked) {
-        return _accessManager.isTargetClosed(target);
+        return _targetInfo[target].isLocked;
     }
 
     function targetExists(address target) public view returns (bool exists) {
@@ -497,6 +495,22 @@ contract InstanceAccessManager is
         }
     }
 
+    // IMPORTANT: instance access manager MUST be of Core type -> otherwise can be locked forever
+    function _setTargetLocked(address target, bool locked) internal
+    {
+        IAccess.Type targetType = _targetInfo[target].ttype;
+        if(target == address(0) || targetType == IAccess.Type.NotInitialized) {
+            revert IAccess.ErrorIAccessTargetDoesNotExist(target);
+        }
+
+        if(targetType == IAccess.Type.Core) {
+            revert IAccess.ErrorIAccessTargetTypeInvalid(target, targetType);
+        }
+
+        _targetInfo[target].isLocked = locked;
+        _accessManager.setTargetClosed(target, locked);
+    }
+
     function _setTargetFunctionRole(
         address target,
         ShortString name,
@@ -524,4 +538,4 @@ contract InstanceAccessManager is
     ) public view virtual returns (bool immediate, uint32 delay) {
         return _accessManager.canCall(caller, target, selector);
     }
-}
+}