@gooddollar/goodprotocol 1.0.31-beta.0 → 2.0.1

package/contracts/governance/GReputation.sol

@@ -11,6 +11,8 @@ import "../Interfaces.sol";
  * to return the current reputation token.
  * The DAO avatar will be the owner of this reputation token and not the Controller.
  * Minting by the DAO will be done using controller.genericCall and not via controller.mintReputation
+ *
+ * V2 fixes merkle tree bug
  */
 contract GReputation is Reputation {
 	bytes32 public constant ROOT_STATE = keccak256("rootState");
@@ -99,25 +101,36 @@ contract GReputation is Reputation {
 
 	function _canMint() internal view override {
 		require(
-			_msgSender() == nameService.getAddress("GDAO_CLAIMERS") ||
-				_msgSender() == nameService.getAddress("GDAO_STAKING") ||
-				_msgSender() == nameService.getAddress("GDAO_STAKERS") ||
-				hasRole(MINTER_ROLE, _msgSender()),
+			hasRole(MINTER_ROLE, _msgSender()) ||
+				(address(nameService) != address(0) &&
+					(_msgSender() == nameService.getAddress("GDAO_CLAIMERS") ||
+						_msgSender() == nameService.getAddress("GDAO_STAKING") ||
+						_msgSender() == nameService.getAddress("GDAO_STAKERS"))),
 			"GReputation: need minter role or be GDAO contract"
 		);
 	}
 
-	/// @notice internal function that overrides Reputation.sol with consideration to delegation
-	/// @param _user the address to mint for
-	/// @param _amount the amount of rep to mint
-	/// @return the actual amount minted
 	function _mint(address _user, uint256 _amount)
 		internal
 		override
 		returns (uint256)
 	{
+		return _mint(_user, _amount, false);
+	}
+
+	/// @notice internal function that overrides Reputation.sol with consideration to delegation
+	/// @param _user the address to mint for
+	/// @param _amount the amount of rep to mint
+	/// @return the actual amount minted
+	function _mint(
+		address _user,
+		uint256 _amount,
+		bool ignoreRepTarget
+	) internal returns (uint256) {
 		address repTarget = reputationRecipients[_user];
-		repTarget = repTarget != address(0) ? repTarget : _user;
+		repTarget = ignoreRepTarget == false && repTarget != address(0)
+			? repTarget
+			: _user;
 
 		super._mint(repTarget, _amount);
 
@@ -368,24 +381,75 @@ contract GReputation is Reputation {
 	}
 
 	/**
-	 * @notice prove user balance in a specific blockchain state hash
+	 * @notice prove user balance in a specific blockchain state hash, uses new sorted pairs trees and double hash for preimage attack mitigation
 	 * @dev "rootState" is a special state that can be supplied once, and actually mints reputation on the current blockchain
 	 * we use non sorted merkle tree, as sorting while preparing merkle tree is heavy
 	 * @param _id the string id of the blockchain we supply proof for
 	 * @param _user the user to prove his balance
 	 * @param _balance the balance we are prooving
 	 * @param _proof array of byte32 with proof data (currently merkle tree path)
- 	 * @param _nodeIndex index of node in the tree (for unsorted merkle tree proof)
-
 	 * @return true if proof is valid
 	 */
 	function proveBalanceOfAtBlockchain(
+		string memory _id,
+		address _user,
+		uint256 _balance,
+		bytes32[] memory _proof
+	) public returns (bool) {
+		return
+			_proveBalanceOfAtBlockchain(
+				_id,
+				_user,
+				_balance,
+				_proof,
+				new bool[](0),
+				0,
+				false
+			);
+	}
+
+	/**
+	 * DEPRECATED: future state hashes will be with sorted pairs and with double hash leaf values
+	 * @notice prove user balance in a specific blockchain state hash
+	 * @dev "rootState" is a special state that can be supplied once, and actually mints reputation on the current blockchain
+	 * we use non sorted merkle tree, as sorting while preparing merkle tree is heavy
+	 * @param _id the string id of the blockchain we supply proof for
+	 * @param _user the user to prove his balance
+	 * @param _balance the balance we are prooving
+	 * @param _proof array of byte32 with proof data (currently merkle tree path)
+	 * @param _isRightNode array of bool with indication if should be hashed on right or left
+	 * @param _nodeIndex index of node in the tree (for unsorted merkle tree proof)
+	 * @return true if proof is valid
+	 */
+	function proveBalanceOfAtBlockchainLegacy(
 		string memory _id,
 		address _user,
 		uint256 _balance,
 		bytes32[] memory _proof,
+		bool[] memory _isRightNode,
 		uint256 _nodeIndex
 	) public returns (bool) {
+		return
+			_proveBalanceOfAtBlockchain(
+				_id,
+				_user,
+				_balance,
+				_proof,
+				_isRightNode,
+				_nodeIndex,
+				true
+			);
+	}
+
+	function _proveBalanceOfAtBlockchain(
+		string memory _id,
+		address _user,
+		uint256 _balance,
+		bytes32[] memory _proof,
+		bool[] memory _isRightNode,
+		uint256 _nodeIndex,
+		bool legacy
+	) internal returns (bool) {
 		bytes32 idHash = keccak256(bytes(_id));
 		require(
 			blockchainStates[idHash].length > 0,
@@ -402,11 +466,17 @@ contract GReputation is Reputation {
 		);
 
 		bytes32 leafHash = keccak256(abi.encode(_user, _balance));
+		//v2 double hash fix to prevent preimage attack
+		if (legacy == false) {
+			leafHash = keccak256(abi.encode(leafHash));
+		}
 		bool isProofValid = checkProofOrdered(
 			_proof,
+			_isRightNode,
 			stateHash,
 			leafHash,
-			_nodeIndex
+			_nodeIndex,
+			legacy == false
 		);
 
 		require(isProofValid, "invalid merkle proof");
@@ -414,7 +484,10 @@ contract GReputation is Reputation {
 		//if initiial state then set real balance
 		if (idHash == ROOT_STATE) {
 			uint256 curTotalSupply = totalSupplyLocalAt(block.number);
-			_mint(_user, _balance);
+			// on proof for ROOT_HASH we force to ignore the repTarget, so it is the same wallet address receiving the reputation (prevent double voting power on snapshot)
+			// also it should behave the same as blockchain sync proof which also doesnt use repTarget, but updates the same address as in the proof
+			_mint(_user, _balance, true);
+
 			updateValueAtNow(totalSupplyHistory, curTotalSupply); // we undo the totalsupply, as we alredy set the totalsupply of the airdrop
 		}
 
@@ -544,9 +617,11 @@ contract GReputation is Reputation {
 	 */
 	function checkProofOrdered(
 		bytes32[] memory _proof,
+		bool[] memory _isRightNode,
 		bytes32 _root,
 		bytes32 _hash,
-		uint256 _index
+		uint256 _index,
+		bool sorted
 	) public pure returns (bool) {
 		// use the index to determine the node ordering
 		// index ranges 1 to n
@@ -558,6 +633,16 @@ contract GReputation is Reputation {
 		for (uint256 j = 0; j < _proof.length; j++) {
 			proofElement = _proof[j];
 
+			// for new sorted format
+			if (sorted) {
+				computedHash = proofElement < computedHash
+					? keccak256(abi.encodePacked(proofElement, computedHash))
+					: keccak256(abi.encodePacked(computedHash, proofElement));
+				continue;
+			}
+
+			// start of legacy format for the first GOOD airdrop
+
 			// calculate remaining elements in proof
 			remaining = _proof.length - j;
 
@@ -568,7 +653,10 @@ contract GReputation is Reputation {
 				_index = _index / 2 + 1;
 			}
 
-			if (_index % 2 == 0) {
+			if (
+				(_isRightNode.length > 0 && _isRightNode[j] == false) ||
+				(_isRightNode.length == 0 && _index % 2 == 0)
+			) {
 				computedHash = keccak256(abi.encodePacked(proofElement, computedHash));
 				_index = _index / 2;
 			} else {

package/contracts/governance/GoodDollarStaking.sol

@@ -13,10 +13,22 @@ import "../DAOStackInterfaces.sol";
 import "./MultiBaseGovernanceShareField.sol";
 import "../staking/utils/StakingRewardsFixedAPY.sol";
 
+// import "hardhat/console.sol";
+
 interface RewardsMinter {
 	function sendOrMint(address to, uint256 amount) external returns (uint256);
 }
 
+interface IGovernanceStaking {
+	function withdrawRewards() external returns (uint256);
+}
+
+interface IStakingUpgrade {
+	function upgradeFrom(address staker, uint256 amount)
+		external
+		returns (uint256 newShares);
+}
+
 /**
  * @title Staking contract that allows citizens to stake G$ to get GOOD + G$ rewards
  * it implements
@@ -60,6 +72,15 @@ contract GoodDollarStaking is
 		uint256 actualRewardsSent //maybe rewards could not be minted
 	);
 
+	event StakeUpgraded(
+		address indexed staker,
+		uint256 amount, //amount withdrawn including actualRewardsSent
+		uint256 sharesRedeemed, //shares requested to redeem
+		uint256 goodRewards,
+		uint256 gdRewards,
+		uint256 newShares
+	);
+
 	/**
 	 * @dev Emitted when `staker` withdraws but MintBurnWrapper could not allocate/mint the rewards
 	 */
@@ -157,35 +178,26 @@ contract GoodDollarStaking is
 		return true;
 	}
 
-	/**
-	 * @notice Withdraws _amount from the staker principle
-	 * in _withdraw we use getPrinciple and not getProductivity because the user can have more G$ to withdraw than he staked
-	 * @param _shares amount to withdraw
-	 * @return goodRewards how much GOOD rewards were transfered to staker
-	 * @return gdRewards out of withdrawn amount how much was taken from earned interest (amount-gdRewards = taken from deposit)
-	 */
-	function withdrawStake(uint256 _shares)
-		public
-		nonReentrant
-		returns (uint256 goodRewards, uint256 gdRewards)
+	function _withdrawStake(
+		address from,
+		address to,
+		uint256 _shares
+	)
+		internal
+		returns (
+			uint256 goodRewards,
+			uint256 gdRewards,
+			uint256 actualRewardsSent,
+			uint256 depositComponent
+		)
 	{
-		uint256 depositComponent;
-
-		//in case amount is 0 this will just withdraw the GOOD rewards, this is required for withdrawRewards
-		uint256 originalBalance = sharesOf(msg.sender);
 		if (_shares > 0) {
 			/* G$ rewards update */
 			//we get the relative part user is withdrawing from his original deposit, his principle is composed of deposit+earned interest
-			(depositComponent, gdRewards) = _withdraw(msg.sender, _shares);
+			(depositComponent, gdRewards) = _withdraw(from, _shares);
 			/* Good rewards update */
-			_decreaseProductivity(
-				address(this),
-				msg.sender,
-				_shares,
-				0,
-				block.number
-			);
-			_burn(msg.sender, _shares); // burn their staking tokens
+			_decreaseProductivity(address(this), from, _shares, 0, block.number);
+			_burn(from, _shares); // burn their staking tokens
 		}
 
 		// console.log(
@@ -194,23 +206,45 @@ contract GoodDollarStaking is
 		// 	gdRewards
 		// );
 
-		goodRewards = _mintGOODRewards(msg.sender);
+		goodRewards = _mintGOODRewards(from);
 
 		//rewards are paid via the rewards distribution contract
-		uint256 actualRewardsSent;
 		if (gdRewards > 0) {
-			actualRewardsSent = _mintGDRewards(msg.sender, gdRewards);
+			actualRewardsSent = _mintGDRewards(from, to, gdRewards);
 		}
 
-		uint256 actualSharesRedeemed = originalBalance - sharesOf(msg.sender);
-
 		//stake is withdrawn from original deposit sent to this contract
 		if (depositComponent > 0) {
-			require(
-				token.transfer(msg.sender, depositComponent),
-				"withdraw transfer failed"
-			);
+			require(token.transfer(to, depositComponent), "withdraw transfer failed");
 		}
+	}
+
+	/**
+	 * @notice Withdraws _amount from the staker principle
+	 * in _withdraw we use getPrinciple and not getProductivity because the user can have more G$ to withdraw than he staked
+	 * @param _shares amount to withdraw
+	 * @return goodRewards how much GOOD rewards were transfered to staker
+	 * @return gdRewards out of withdrawn amount how much was taken from earned interest (amount-gdRewards = taken from deposit)
+	 */
+	function withdrawStake(uint256 _shares)
+		public
+		nonReentrant
+		returns (uint256 goodRewards, uint256 gdRewards)
+	{
+		//in case amount is 0 this will just withdraw the GOOD rewards, this is required for withdrawRewards
+		uint256 originalBalance = sharesOf(msg.sender);
+		uint256 depositComponent;
+		uint256 actualRewardsSent;
+
+		(
+			goodRewards,
+			gdRewards,
+			actualRewardsSent,
+			depositComponent
+		) = _withdrawStake(msg.sender, msg.sender, _shares);
+
+		uint256 actualSharesRedeemed = originalBalance - sharesOf(msg.sender);
+
 		emit StakeWithdraw(
 			msg.sender,
 			actualSharesRedeemed,
@@ -224,21 +258,23 @@ contract GoodDollarStaking is
 
 	/**
 	 * @notice helper to mint/send G$ rewards from fixed APY
-	 * @param _to address of recipient
+	 * @param _account address of the staker
+	 * @param _recipient address of G$ recipient
 	 * @param _amount how much to mint/send
 	 * @return actualSent how much rewards were actually minted/sent. If RewardsMinter is passed its limit it could be that not all requested amount was awarded.
 	 */
-	function _mintGDRewards(address _to, uint256 _amount)
-		internal
-		returns (uint256 actualSent)
-	{
+	function _mintGDRewards(
+		address _account,
+		address _recipient,
+		uint256 _amount
+	) internal returns (uint256 actualSent) {
 		//make sure RewardsMinter failure doesnt prevent withdrawl of stake
-		//console.log("_mintGDRewards: sending amount: %s to: %s", _amount, _to);
+		//console.log("_mintGDRewards: sending amount: %s to: %s", _amount, _account);
 		address minter = nameService.getAddress("MINTBURN_WRAPPER");
 		if (minter != address(0)) {
 			try
 				RewardsMinter(nameService.getAddress("MINTBURN_WRAPPER")).sendOrMint(
-					_to,
+					_recipient,
 					_amount
 				)
 			returns (uint256 _res) {
@@ -258,10 +294,10 @@ contract GoodDollarStaking is
 			// 	actualSent,
 			// 	_amount - actualSent
 			// );
-			uint256 shares = _undoReward(_to, _amount - actualSent);
-			_increaseProductivity(address(this), _to, shares, 0, block.number); //increase productivity back for GOOD rewards
-			_mint(_to, shares); //mint shares worth of undone rewards
-			emit RewardsNotSent(_to, _amount, actualSent);
+			uint256 shares = _undoReward(_account, _amount - actualSent);
+			_increaseProductivity(address(this), _account, shares, 0, block.number); //increase productivity back for GOOD rewards
+			_mint(_account, shares); //mint shares worth of undone rewards
+			emit RewardsNotSent(_account, _amount, actualSent);
 		}
 	}
 
@@ -271,7 +307,7 @@ contract GoodDollarStaking is
 	 * @return gdRewards recieved G$ rewards
 	 */
 	function withdrawRewards()
-		public
+		external
 		returns (uint256 goodRewards, uint256 gdRewards)
 	{
 		uint256 gdRewardsShares = amountToShares(earned(msg.sender));
@@ -363,6 +399,11 @@ contract GoodDollarStaking is
 		emit GOODRewardsSet(_monthlyAmount);
 	}
 
+	function setBlockPerYear(uint128 _blocksPerYear) external {
+		_onlyAvatar();
+		numberOfBlocksPerYear = _blocksPerYear;
+	}
+
 	/**
 	 * @dev interest rate per one block in 1e18 precision.
 	 * for example APY=5% then per block = nroot(1+0.05,numberOfBlocksPerYear)
@@ -465,14 +506,19 @@ contract GoodDollarStaking is
 		emit GOODRewardsSet(2 ether * 1e6);
 
 		//this will make sure rewards are set at 0, so no withdraw issue will happen.
-		//on governacnestaking anyone withdrawing from now on will get 0 GOOD, not matter how long he has been staking
-		(bool ok, ) = dao.genericCall(
-			nameService.getAddress("GDAO_STAKING"),
-			abi.encodeWithSignature("setMonthlyRewards(uint256)", 0),
-			avatar,
-			0
-		);
-		require(ok, "calling setMonthlyRewards failed");
+		address curStaking = nameService.getAddress("GDAO_STAKING");
+		bool ok;
+		if (curStaking != address(0)) {
+			//this will trigger updating of accumulated rewards, so everyone's rewards are updated to this point
+			IGovernanceStaking(curStaking).withdrawRewards();
+			(ok, ) = dao.genericCall(
+				curStaking,
+				abi.encodeWithSignature("setMonthlyRewards(uint256)", 0),
+				avatar,
+				0
+			);
+			require(ok, "calling setMonthlyRewards failed");
+		}
 
 		//this will set this contract as the GDAO_STAKING contract and give us minting rights on the reputation token
 		(ok, ) = dao.genericCall(
@@ -507,4 +553,44 @@ contract GoodDollarStaking is
 		}
 		setGdApy(_interestRatePerBlock);
 	}
+
+	/**
+	 * @dev allow to withdraw the balance (principle+rewards) to a new staking contract
+	 * @param _newStaking the addres of the new staking contract, needs to be a registered DAO scheme and implement IStakingUpgrade
+	 */
+	function upgradeTo(address _newStaking) external nonReentrant {
+		//in case amount is 0 this will just withdraw the GOOD rewards, this is required for withdrawRewards
+		uint256 _shares = sharesOf(msg.sender);
+		require(_shares > 0, "no balance");
+
+		//check that target contract was approved by the dao to prevent possible fraud
+		require(
+			dao.isSchemeRegistered(_newStaking, avatar),
+			"not DAO approved upgrade"
+		);
+
+		(
+			uint256 goodRewards,
+			uint256 gdRewards,
+			uint256 actualRewardsSent,
+			uint256 depositComponent
+		) = _withdrawStake(msg.sender, _newStaking, _shares);
+
+		require(actualRewardsSent == gdRewards, "unable to mint rewards");
+
+		//target new staking contract need to trust we transfered the tokens
+		uint256 newShares = IStakingUpgrade(_newStaking).upgradeFrom(
+			msg.sender,
+			depositComponent + gdRewards
+		);
+
+		emit StakeUpgraded(
+			msg.sender,
+			depositComponent + actualRewardsSent,
+			_shares,
+			goodRewards,
+			gdRewards,
+			newShares
+		);
+	}
 }

package/contracts/governance/GovernanceStaking.sol

@@ -29,7 +29,7 @@ contract GovernanceStaking is
 	 * @dev Emitted when `staker` earns an `amount` of GOOD tokens
 	 */
 	event ReputationEarned(address indexed staker, uint256 amount);
-	
+
 	/**
 	 * @dev Emitted when `staker` stakes an `amount` of GoodDollars
 	 */
@@ -44,7 +44,7 @@ contract GovernanceStaking is
 	 * @dev Constructor
 	 * @param _ns The address of the INameService contract
 	 */
-	constructor(INameService _ns) {
+	constructor(INameService _ns) initializer {
 		setDAO(_ns);
 		token = ERC20(nameService.getAddress("GOODDOLLAR"));
 		__ERC20_init("G$ Staking For GOOD", "sG$");