@etherisc/gif-next 3.0.0-ab0fcb2-112 → 3.0.0-b216819-597

package/contracts/examples/flight/FlightProductAuthorization.sol

@@ -3,19 +3,42 @@ pragma solidity ^0.8.20;
 
 import {IAccess} from "../../../contracts/authorization/IAccess.sol";
 
+import {AccessAdminLib} from "../../authorization/AccessAdminLib.sol";
 import {BasicProductAuthorization} from "../../product/BasicProductAuthorization.sol";
 import {FlightProduct} from "./FlightProduct.sol";
 import {ORACLE} from "../../../contracts/type/ObjectType.sol";
-import {PUBLIC_ROLE} from "../../../contracts/type/RoleId.sol";
+import {RoleId, ADMIN_ROLE, PUBLIC_ROLE} from "../../../contracts/type/RoleId.sol";
 
 
 contract FlightProductAuthorization
     is BasicProductAuthorization
 {
 
-    constructor(string memory poolName)
-        BasicProductAuthorization(poolName)
-    {}
+    uint64 public constant STATISTICS_PROVIDER_ROLE_IDX = 1; // 1st custom role for flight product
+    string public constant STATISTICS_PROVIDER_ROLE_NAME = "StatisticsProviderRole";
+    RoleId public STATISTICS_PROVIDER_ROLE;
+
+
+    constructor(string memory productName)
+        BasicProductAuthorization(productName)
+    { }
+
+
+    function _setupRoles()
+        internal
+        override
+    {
+        STATISTICS_PROVIDER_ROLE = AccessAdminLib.getCustomRoleId(STATISTICS_PROVIDER_ROLE_IDX);
+
+        _addRole(
+            STATISTICS_PROVIDER_ROLE,
+            AccessAdminLib.roleInfo(
+                ADMIN_ROLE(),
+                TargetType.Custom,
+                1, // max member count special case: instance nft owner is sole role owner
+                STATISTICS_PROVIDER_ROLE_NAME));
+    }
+
 
     function _setupTargetAuthorizations()
         internal
@@ -28,14 +51,16 @@ contract FlightProductAuthorization
         functions = _authorizeForTarget(getMainTargetName(), getServiceRole(ORACLE()));
         _authorize(functions, FlightProduct.flightStatusCallback.selector, "flightStatusCallback");
 
-        // authorize public role (open access to any account, only allows to lock target)
-        functions = _authorizeForTarget(getMainTargetName(), PUBLIC_ROLE());
-        _authorize(functions, FlightProduct.createPolicy.selector, "createPolicy");
+        // authorize statistics provider role 
+        functions = _authorizeForTarget(getMainTargetName(), STATISTICS_PROVIDER_ROLE);
         _authorize(functions, FlightProduct.createPolicyWithPermit.selector, "createPolicyWithPermit");
 
-        // TODO: only owner
-        _authorize(functions, FlightProduct.processFlightStatus.selector, "processFlightStatus");
-        _authorize(functions, FlightProduct.completeSetup.selector, "completeSetup");
+        // authorize public role (additional authz via onlyOwner)
+        functions = _authorizeForTarget(getMainTargetName(), PUBLIC_ROLE());
+        _authorize(functions, FlightProduct.resendRequest.selector, "resendRequest");
+        _authorize(functions, FlightProduct.processPayoutsAndClosePolicies.selector, "processPayoutsAndClosePolicies");
+        _authorize(functions, FlightProduct.setConstants.selector, "setConstants");
+        _authorize(functions, FlightProduct.setTestMode.selector, "setTestMode");
         _authorize(functions, FlightProduct.setDefaultBundle.selector, "setDefaultBundle");
         _authorize(functions, FlightProduct.approveTokenHandler.selector, "approveTokenHandler");
         _authorize(functions, FlightProduct.setLocked.selector, "setLocked");

package/contracts/examples/flight/FlightProductManager.sol

@@ -0,0 +1,49 @@
+// SPDX-License-Identifier: Apache-2.0
+pragma solidity ^0.8.20;
+
+import {IAuthorization} from "../../authorization/IAuthorization.sol";
+import {IVersionable} from "../../upgradeability/IVersionable.sol";
+
+import {NftId} from "../../type/NftId.sol";
+import {ProxyManager} from "../../upgradeability/ProxyManager.sol";
+import {FlightProduct} from "./FlightProduct.sol";
+
+
+contract FlightProductManager is ProxyManager {
+
+    FlightProduct private _flightProduct;
+    bytes32 private _salt = "0x1234";
+
+    /// @dev initializes proxy manager with flight product implementation 
+    constructor(
+        address registry,
+        NftId instanceNftId,
+        string memory componentName,
+        IAuthorization authorization
+    ) 
+    {
+        // FlightProduct prd = new FlightProduct{salt: _salt}();
+        // bytes memory data = abi.encode(
+        //     registry, 
+        //     instanceNftId, 
+        //     componentName, 
+        //     authorization);
+
+        // IVersionable versionable = initialize(
+        //     registry,
+        //     address(prd), 
+        //     data,
+        //     _salt);
+
+        // _flightProduct = FlightProduct(address(versionable));
+    }
+
+    //--- view functions ----------------------------------------------------//
+    function getFlightProduct()
+        external
+        view
+        returns (FlightProduct flightProduct)
+    {
+        return _flightProduct;
+    }
+}

package/contracts/examples/unpermissioned/SimpleDistribution.sol

@@ -17,12 +17,14 @@ contract SimpleDistribution is
 {
     
     constructor(
+        address registry,
         NftId productNftId,
         IAuthorization authorization,
         address initialOwner
     ) 
     {
         initialize(
+            registry,
             productNftId,
             authorization,
             initialOwner,
@@ -30,6 +32,7 @@ contract SimpleDistribution is
     }
 
     function initialize(
+        address registry,
         NftId productNftId,
         IAuthorization authorization,
         address initialOwner,
@@ -40,6 +43,7 @@ contract SimpleDistribution is
         initializer()
     {
         _initializeBasicDistribution(
+            registry,
             productNftId,
             authorization,
             initialOwner,

package/contracts/examples/unpermissioned/SimpleOracle.sol

@@ -31,12 +31,14 @@ contract SimpleOracle is
     event LogSimpleOracleSyncResponseSent(RequestId requestId, string responseText);
 
     constructor(
+        address registry,
         NftId productNftId,
         IAuthorization authorization,
         address initialOwner
     ) 
     {
         initialize(
+            registry,
             productNftId,
             authorization,
             initialOwner,
@@ -45,6 +47,7 @@ contract SimpleOracle is
     }
 
     function initialize(
+        address registry,
         NftId productNftId,
         IAuthorization authorization,
         address initialOwner,
@@ -55,6 +58,7 @@ contract SimpleOracle is
         initializer()
     {
         _initializeBasicOracle(
+            registry,
             productNftId,
             authorization,
             initialOwner,

package/contracts/examples/unpermissioned/SimplePool.sol

@@ -17,6 +17,7 @@ contract SimplePool is
 {
     
     constructor(
+        address registry,
         NftId productNftId,
         IComponents.PoolInfo memory poolInfo,
         IAuthorization authorization,
@@ -24,6 +25,7 @@ contract SimplePool is
     ) 
     {
         initialize(
+            registry,
             productNftId,
             poolInfo,
             authorization,
@@ -33,6 +35,7 @@ contract SimplePool is
 
 
     function initialize(
+        address registry,
         NftId productNftId,
         IComponents.PoolInfo memory poolInfo,
         IAuthorization authorization,
@@ -43,6 +46,7 @@ contract SimplePool is
         initializer()
     {
         _initializeBasicPool(
+            registry,
             productNftId,
             "SimplePool",
             poolInfo,

package/contracts/examples/unpermissioned/SimpleProduct.sol

@@ -34,6 +34,7 @@ contract SimpleProduct is
     IOracleService private _oracleService;
 
     constructor(
+        address registry,
         NftId instanceNftId,
         string memory name,
         IComponents.ProductInfo memory productInfo,
@@ -43,6 +44,7 @@ contract SimpleProduct is
     )
     {
         initialize(
+            registry,
             instanceNftId,
             name,
             productInfo,
@@ -53,6 +55,7 @@ contract SimpleProduct is
 
 
     function initialize(
+        address registry,
         NftId instanceNftid,
         string memory name,
         IComponents.ProductInfo memory productInfo,
@@ -65,6 +68,7 @@ contract SimpleProduct is
         initializer()
     {
         _initializeBasicProduct(
+            registry,
             instanceNftid,
             name,
             productInfo,

package/contracts/instance/Instance.sol

@@ -26,6 +26,8 @@ contract Instance is
     IInstance,
     Registerable
 {
+    bool private _initialized;
+
     IComponentService internal _componentService;
     IInstanceService internal _instanceService;
 
@@ -57,6 +59,8 @@ contract Instance is
 
     function initialize(
         InstanceContracts memory instanceContracts,
+        IRegistry registry, 
+        VersionPart release,
         address initialOwner,
         bool tokenRegistryDisabled // only disable for testing
     ) 
@@ -70,9 +74,9 @@ contract Instance is
         _instanceAdmin = instanceContracts.instanceAdmin;
 
         // setup instance object info
-        IRegistry registry = _getRegistry();
         __Registerable_init({
             authority: instanceContracts.instanceAdmin.authority(),
+            registry: address(registry), 
             parentNftId: registry.getNftId(), 
             objectType: INSTANCE(), 
             isInterceptor: false, 
@@ -89,19 +93,19 @@ contract Instance is
         // initialize instance supporting contracts
         _instanceStore.initialize();
         _productStore.initialize();
-        _bundleSet.initialize(instanceContracts.instanceAdmin.authority());
-        _riskSet.initialize(instanceContracts.instanceAdmin.authority());
+        _bundleSet.initialize(instanceContracts.instanceAdmin.authority(), address(registry));
+        _riskSet.initialize(instanceContracts.instanceAdmin.authority(), address(registry));
         _instanceReader.initialize();
 
         _componentService = IComponentService(
-            registry.getServiceAddress(
+            getRegistry().getServiceAddress(
                 COMPONENT(), 
-                getRelease()));
+                release));
 
         _instanceService = IInstanceService(
-            registry.getServiceAddress(
+            getRegistry().getServiceAddress(
                 INSTANCE(), 
-                getRelease()));
+                release));
 
         _tokenRegistryDisabled = tokenRegistryDisabled;
 

package/contracts/instance/InstanceAdmin.sol

@@ -11,10 +11,9 @@ import {AccessAdminLib} from "../authorization/AccessAdminLib.sol";
 import {AccessManagerCloneable} from "../authorization/AccessManagerCloneable.sol";
 import {ObjectType, INSTANCE} from "../type/ObjectType.sol";
 import {RoleId, ADMIN_ROLE} from "../type/RoleId.sol";
-import {GIF_INITIAL_RELEASE} from "../registry/Registry.sol";
 import {Str} from "../type/String.sol";
-import {INSTANCE_TARGET_NAME, INSTANCE_ADMIN_TARGET_NAME, INSTANCE_STORE_TARGET_NAME, PRODUCT_STORE_TARGET_NAME, BUNDLE_SET_TARGET_NAME, RISK_SET_TARGET_NAME} from "./TargetNames.sol";
 import {VersionPart} from "../type/Version.sol";
+import {INSTANCE_TARGET_NAME, INSTANCE_ADMIN_TARGET_NAME, INSTANCE_STORE_TARGET_NAME, PRODUCT_STORE_TARGET_NAME, BUNDLE_SET_TARGET_NAME, RISK_SET_TARGET_NAME} from "./TargetNames.sol";
 
 
 contract InstanceAdmin is
@@ -27,12 +26,13 @@ contract InstanceAdmin is
     error ErrorInstanceAdminNotComponentOrCustomTarget(address target);
 
     IInstance internal _instance;
+    IRegistry internal _registry;
 
     uint64 internal _customRoleIdNext;
 
 
     modifier onlyInstanceService() {
-        if (msg.sender != _getRegistry().getServiceAddress(INSTANCE(), getRelease())) {
+        if (msg.sender != _registry.getServiceAddress(INSTANCE(), getRelease())) {
             revert ErrorInstanceAdminNotInstanceService(msg.sender);
         }
         _;
@@ -43,8 +43,7 @@ contract InstanceAdmin is
     constructor(address accessManager) {
         initialize(
             accessManager,
-            "MasterInstanceAdmin",
-            GIF_INITIAL_RELEASE());
+            "MasterInstanceAdmin");
     }
 
 
@@ -52,23 +51,32 @@ contract InstanceAdmin is
     /// Important: Initialization of instance admin is only complete after calling this function. 
     /// Important: The instance MUST be registered and all instance supporting contracts must be wired to this instance.
     function completeSetup(
+        address registry,
         address authorization,
+        VersionPart release,
         address instance
     )
         external
+        reinitializer(uint64(release.toInt()))
     {
         // checks
-        AccessAdminLib.checkIsRegistered(instance, INSTANCE(), getRelease());
+        AccessAdminLib.checkIsRegistered(registry, instance, INSTANCE());
 
         // effects
+        AccessManagerCloneable(
+            authority()).completeSetup(
+                registry, 
+                release); 
+
         AccessAdminLib.checkAuthorization(
             address(_authorization), 
             authorization, 
             INSTANCE(), // expectedDomain
-            getRelease(), // expectedRelease
+            release, // expectedRelease
             false, // expectServiceAuthorization
             true); // checkAlreadyInitialized
 
+        _registry = IRegistry(registry);
         _instance = IInstance(instance);
         _authorization = IAuthorization(authorization);
         _customRoleIdNext = 0;
@@ -97,7 +105,7 @@ contract InstanceAdmin is
         for(uint256 i = 0; i < serviceDomains.length; i++) {
             ObjectType serviceDomain = serviceDomains[i];
             RoleId serviceRoleId = authorization.getServiceRole(serviceDomain);
-            address service = _getRegistry().getServiceAddress(serviceDomain, getRelease());
+            address service = _registry.getServiceAddress(serviceDomain, getRelease());
 
             _grantRoleToAccount(
                 serviceRoleId,
@@ -122,13 +130,11 @@ contract InstanceAdmin is
         _createTarget(target, name, TargetType.Instance, true); 
     }
 
-
     /// @dev Initializes the authorization for the specified component.
     /// Important: The component MUST be registered.
     function initializeComponentAuthorization(
         address componentAddress,
-        ObjectType expectedType,
-        VersionPart expectedRelease
+        ObjectType expectedType
     )
         external
         restricted()

package/contracts/instance/InstanceAuthorizationV3.sol

@@ -13,9 +13,7 @@ import {InstanceStore} from "../instance/InstanceStore.sol";
 import {INSTANCE_TARGET_NAME, INSTANCE_ADMIN_TARGET_NAME, INSTANCE_STORE_TARGET_NAME, PRODUCT_STORE_TARGET_NAME, BUNDLE_SET_TARGET_NAME, RISK_SET_TARGET_NAME} from "./TargetNames.sol";
 import {ProductStore} from "../instance/ProductStore.sol";
 import {ADMIN_ROLE, INSTANCE_OWNER_ROLE, PUBLIC_ROLE} from "../type/RoleId.sol";
-import {GIF_INITIAL_RELEASE} from "../registry/Registry.sol";
-import {RiskSet} from "../instance/RiskSet.sol";
-import {VersionPartLib} from "../type/Version.sol";
+import {RiskSet} from "../instance/RiskSet.sol"; 
 
 
 contract InstanceAuthorizationV3
@@ -29,7 +27,7 @@ contract InstanceAuthorizationV3
           Authorization(
                INSTANCE_TARGET_NAME, 
                INSTANCE(), 
-               GIF_INITIAL_RELEASE(), 
+               3, 
                COMMIT_HASH,
                TargetType.Instance, 
                false)

package/contracts/instance/InstanceReader.sol

@@ -28,32 +28,27 @@ import {NftId} from "../type/NftId.sol";
 import {PayoutId, PayoutIdLib} from "../type/PayoutId.sol";
 import {PolicyServiceLib} from "../product/PolicyServiceLib.sol";
 import {ProductStore} from "./ProductStore.sol";
-import {RegistryLinked} from "../shared/RegistryLinked.sol";
 import {ReferralId, ReferralStatus, ReferralLib} from "../type/Referral.sol";
 import {RequestId} from "../type/RequestId.sol";
 import {RiskId} from "../type/RiskId.sol";
 import {RiskSet} from "./RiskSet.sol";
 import {RoleId, INSTANCE_OWNER_ROLE} from "../type/RoleId.sol";
 import {StateId} from "../type/StateId.sol";
+import {Str, StrLib} from "../type/String.sol";
 import {TokenHandler} from "../shared/TokenHandler.sol";
 import {UFixed, UFixedLib} from "../type/UFixed.sol";
 
 
 /// @dev Central reader contract for a specific instance.
 /// Provides reading functions for all instance data and related component data.
-contract InstanceReader is
-    RegistryLinked
-{
+contract InstanceReader {
 
     error ErrorInstanceReaderAlreadyInitialized();
     error ErrorInstanceReaderInstanceAddressZero();
-    // TODO make state immutable:
-    // 1. instance receives reader through setInstanceReader()
-    // 2. this way instance initialization is not depends on reader
-    // 3. and reader is simple contract with constructor
-    // 4. no _initialized in storage, the rest is immutable
+
     bool private _initialized = false;
 
+    IRegistry internal _registry;
     IInstance internal _instance;
     InstanceAdmin internal _instanceAdmin;
 
@@ -84,24 +79,27 @@ contract InstanceReader is
         _initialized = true;
         _instance = IInstance(instanceAddress);
         _instanceAdmin = _instance.getInstanceAdmin();
+        _registry = _instance.getRegistry();
 
         _store = _instance.getInstanceStore();
         _productStore = _instance.getProductStore();
         _bundleSet = _instance.getBundleSet();
         _riskSet = _instance.getRiskSet();
-
-        _distributionService = IDistributionService(
-            _getRegistry().getServiceAddress(DISTRIBUTION(), _instance.getRelease()));
+        _distributionService = IDistributionService(_registry.getServiceAddress(DISTRIBUTION(), _instance.getRelease()));
     }
 
 
     //--- instance functions ---------------------------------------------------------//
 
+    /// @dev Returns the registry this instance is registered in.
+    function getRegistry() public view returns (IRegistry registry) {
+        return _registry;
+    }
 
 
     /// @dev Returns the instance NFT ID.
     function getInstanceNftId() public view returns (NftId instanceNftid) {
-        return _getRegistry().getNftIdForAddress(address(_instance));
+        return _registry.getNftIdForAddress(address(_instance));
     }
 
 
@@ -438,7 +436,7 @@ contract InstanceReader is
         return _store.getReferralInfo(referralId);
     }
 
-    // TODO reader dependce on service os wrong?
+
     function getDiscountPercentage(ReferralId referralId)
         public
         view
@@ -447,7 +445,10 @@ contract InstanceReader is
             ReferralStatus status
         )
     {
-        return _distributionService.getDiscountPercentage(
+        return IDistributionService(
+            _registry.getServiceAddress(
+                DISTRIBUTION(),
+                _instance.getRelease())).getDiscountPercentage(
                     this, // instance reader
                     referralId);
     }
@@ -466,6 +467,12 @@ contract InstanceReader is
     }
 
 
+    /// @dev Returns the role ID for the given index.
+    function getRoleForName(string memory name) public view returns (RoleId roleId, bool exists) {
+        return _instanceAdmin.getRoleForName(name);
+    }
+
+
     /// @dev Returns the role ID for the instance owner role.
     /// This role may be used as a "root" admin role for other custom roles defined for this instance.
     function getInstanceOwnerRole() public pure returns (RoleId roleId) {
@@ -595,13 +602,18 @@ contract InstanceReader is
     }
 
 
-    function toUFixed(uint256 value, int8 exp) public pure returns (UFixed) {
-        return UFixedLib.toUFixed(value, exp);
+    function toInt(UFixed value) public pure returns (uint256) {
+        return UFixedLib.toInt(value);
     }
 
 
-    function toInt(UFixed value) public pure returns (uint256) {
-        return UFixedLib.toInt(value);
+    function toString(Str str) public pure returns (string memory) {
+        return StrLib.toString(str);
+    }
+
+
+    function toUFixed(uint256 value, int8 exp) public pure returns (UFixed) {
+        return UFixedLib.toUFixed(value, exp);
     }
 
     //--- internal functions ----------------------------------------------------//

package/contracts/instance/InstanceService.sol

@@ -175,7 +175,7 @@ contract InstanceService is
         IInstance(instanceAddress).getInstanceAdmin().setInstanceLocked(locked);
 
         emit LogInstanceServiceInstanceLocked(
-            _getRegistry().getNftIdForAddress(instanceAddress),
+            getRegistry().getNftIdForAddress(instanceAddress),
             locked);
     }
 
@@ -204,11 +204,13 @@ contract InstanceService is
         // MUST be set after instance is set up and registered
         IAuthorization instanceAuthorization = InstanceAdmin(_masterInstanceAdmin).getInstanceAuthorization();
         instanceAdmin.completeSetup(
+            address(getRegistry()),
             address(instanceAuthorization),
+            getRelease(),
             address(instance));
 
         // hard checks for newly cloned instance
-        //assert(address(instance._getRegistry()) == address(_getRegistry()));// consider deleting this
+        assert(address(instance.getRegistry()) == address(getRegistry()));
         assert(instance.getRelease() == getRelease());
 
         // register cloned instance as staking target
@@ -229,7 +231,7 @@ contract InstanceService is
         restricted()
         onlyInstance()
     {
-        NftId instanceNftId = _getRegistry().getNftIdForAddress(msg.sender);
+        NftId instanceNftId = getRegistry().getNftIdForAddress(msg.sender);
         _stakingService.setInstanceLockingPeriod(
             instanceNftId,
             stakeLockingPeriod);
@@ -242,7 +244,7 @@ contract InstanceService is
         restricted()
         onlyInstance()
     {
-        NftId instanceNftId = _getRegistry().getNftIdForAddress(msg.sender);
+        NftId instanceNftId = getRegistry().getNftIdForAddress(msg.sender);
         _stakingService.setInstanceRewardRate(
             instanceNftId,
             rewardRate);
@@ -254,7 +256,7 @@ contract InstanceService is
         restricted()
         onlyInstance()
     {
-        NftId instanceNftId = _getRegistry().getNftIdForAddress(msg.sender);
+        NftId instanceNftId = getRegistry().getNftIdForAddress(msg.sender);
         _stakingService.setInstanceMaxStakedAmount(
             instanceNftId,
             maxStakedAmount);
@@ -268,7 +270,7 @@ contract InstanceService is
         onlyInstance()
         returns (Amount newBalance)
     {
-        NftId instanceNftId = _getRegistry().getNftIdForAddress(msg.sender);
+        NftId instanceNftId = getRegistry().getNftIdForAddress(msg.sender);
         newBalance = _stakingService.refillInstanceRewardReserves(
             instanceNftId,
             rewardProvider,
@@ -283,7 +285,7 @@ contract InstanceService is
         onlyInstance()
         returns (Amount newBalance)
     {
-        NftId instanceNftId = _getRegistry().getNftIdForAddress(msg.sender);
+        NftId instanceNftId = getRegistry().getNftIdForAddress(msg.sender);
         newBalance = _stakingService.withdrawInstanceRewardReserves(
             instanceNftId,
             dipAmount);
@@ -306,7 +308,7 @@ contract InstanceService is
         instance.setInstanceReader(upgradedInstanceReaderClone);
 
         emit LogInstanceServiceInstanceReaderUpgraded(
-            _getRegistry().getNftIdForAddress(instanceAddress),
+            getRegistry().getNftIdForAddress(instanceAddress),
             address(upgradedInstanceReaderClone));
     }
 
@@ -347,7 +349,6 @@ contract InstanceService is
             if(instanceStoreAddress == address(0)) { revert ErrorInstanceServiceInstanceStoreZero(); }
             if(productStoreAddress == address(0)) { revert ErrorInstanceServiceProductStoreZero(); } // TODO: rename exception
             
-            // TODO check instance cluster release
             if(instance.authority() != instanceAdmin.authority()) { revert ErrorInstanceServiceInstanceAuthorityMismatch(); }
             if(bundleSet.authority() != instanceAdmin.authority()) { revert ErrorInstanceServiceBundleSetAuthorityMismatch(); }
             if(riskSet.authority() != instanceAdmin.authority()) { revert ErrorInstanceServiceRiskSetAuthorityMismatch(); }
@@ -390,7 +391,7 @@ contract InstanceService is
         _masterInstanceReader = instanceReaderAddress;
 
         emit LogInstanceServiceMasterInstanceReaderUpgraded(
-            _getRegistry().getNftIdForAddress(_masterInstance),
+            getRegistry().getNftIdForAddress(_masterInstance),
             instanceReaderAddress);
     }
 
@@ -418,8 +419,7 @@ contract InstanceService is
 
         clonedAdmin.initialize(
             address(clonedAccessManager),
-            "InstanceAdmin",
-            getRelease());
+            "InstanceAdmin");
     }
 
 
@@ -445,6 +445,8 @@ contract InstanceService is
                 riskSet: RiskSet(Clones.clone(_masterInstanceRiskSet)),
                 instanceReader: InstanceReader(Clones.clone(address(_masterInstanceReader)))
             }),
+            getRegistry(),
+            getRelease(),
             instanceOwner,
             allowAnyToken);
 
@@ -459,13 +461,14 @@ contract InstanceService is
     )
         internal
         virtual override
-        onlyInitializing()
+        initializer()
     {
         (
-            address authority
-        ) = abi.decode(data, (address));
+            address authority,
+            address registry
+        ) = abi.decode(data, (address, address));
 
-        __Service_init(authority, owner);
+        __Service_init(authority, registry, owner);
 
         _registryService = IRegistryService(_getServiceAddress(REGISTRY()));
         _stakingService = IStakingService(_getServiceAddress(STAKING()));
@@ -483,8 +486,7 @@ contract InstanceService is
         virtual
         view
     {
-        // TODO use ContractLib to verify registration, type and release
-        IRegistry registry = _getRegistry();
+        IRegistry registry = getRegistry();
 
         NftId instanceNftId = registry.getNftIdForAddress(instanceAddress);
         if (instanceNftId.eqz()) {