@harvest-finance/harvest-strategy-arbitrum 0.0.1-security → 1.0.0

package/contracts/base/interface/balancer/IBalancerMinter.sol

@@ -0,0 +1,114 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+pragma solidity 0.8.26;
+
+
+/**
+ * @dev Base minter interface, applicable to Mainnet minter or L2 pseudo minters.
+ */
+interface IBalancerMinter {
+    event Minted(address indexed recipient, address gauge, uint256 minted);
+
+    /**
+     * @notice Returns the address of the Balancer Governance Token
+     */
+    function getBalancerToken() external view returns (address);
+
+    /**
+     * @notice Mint everything which belongs to `msg.sender` and send to them
+     * @param gauge `LiquidityGauge` address to get mintable amount from
+     */
+    function mint(address gauge) external returns (uint256);
+
+    /**
+     * @notice Mint everything which belongs to `msg.sender` across multiple gauges
+     * @param gauges List of `LiquidityGauge` addresses
+     */
+    function mintMany(address[] calldata gauges) external returns (uint256);
+
+    /**
+     * @notice Mint tokens for `user`
+     * @dev Only possible when `msg.sender` has been approved by `user` to mint on their behalf
+     * @param gauge `LiquidityGauge` address to get mintable amount from
+     * @param user Address to mint to
+     */
+    function mintFor(address gauge, address user) external returns (uint256);
+
+    /**
+     * @notice Mint tokens for `user` across multiple gauges
+     * @dev Only possible when `msg.sender` has been approved by `user` to mint on their behalf
+     * @param gauges List of `LiquidityGauge` addresses
+     * @param user Address to mint to
+     */
+    function mintManyFor(address[] calldata gauges, address user) external returns (uint256);
+
+    /**
+     * @notice The total number of tokens minted for `user` from `gauge`
+     */
+    function minted(address user, address gauge) external view returns (uint256);
+
+    /**
+     * @notice Whether `minter` is approved to mint tokens for `user`
+     */
+    function getMinterApproval(address minter, address user) external view returns (bool);
+
+    /**
+     * @notice Set whether `minter` is approved to mint tokens on your behalf
+     */
+    function setMinterApproval(address minter, bool approval) external;
+
+    /**
+     * @notice Set whether `minter` is approved to mint tokens on behalf of `user`, who has signed a message authorizing
+     * them.
+     */
+    function setMinterApprovalWithSignature(
+        address minter,
+        bool approval,
+        address user,
+        uint256 deadline,
+        uint8 v,
+        bytes32 r,
+        bytes32 s
+    ) external;
+
+    // The below functions are near-duplicates of functions available above.
+    // They are included for ABI compatibility with snake_casing as used in vyper contracts.
+    // solhint-disable func-name-mixedcase
+
+    /**
+     * @notice Whether `minter` is approved to mint tokens for `user`
+     */
+    function allowed_to_mint_for(address minter, address user) external view returns (bool);
+
+    /**
+     * @notice Mint everything which belongs to `msg.sender` across multiple gauges
+     * @dev This function is not recommended as `mintMany()` is more flexible and gas efficient
+     * @param gauges List of `LiquidityGauge` addresses
+     */
+    function mint_many(address[8] calldata gauges) external;
+
+    /**
+     * @notice Mint tokens for `user`
+     * @dev Only possible when `msg.sender` has been approved by `user` to mint on their behalf
+     * @param gauge `LiquidityGauge` address to get mintable amount from
+     * @param user Address to mint to
+     */
+    function mint_for(address gauge, address user) external;
+
+    /**
+     * @notice Toggle whether `minter` is approved to mint tokens for `user`
+     */
+    function toggle_approve_mint(address minter) external;
+}

package/contracts/base/interface/balancer/IGyroPool.sol

@@ -0,0 +1,7 @@
+//SPDX-License-Identifier: Unlicense
+pragma solidity 0.8.26;
+
+interface IGyroPool {
+    function getPrice() external view returns(uint256);
+    function getActualSupply() external view returns(uint256);
+}

package/contracts/base/interface/balancer/linearPool/ILinearPool.sol

@@ -0,0 +1,184 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+pragma solidity 0.8.26;
+
+import "./IPoolSwapStructs.sol";
+
+interface IBasePool is IPoolSwapStructs {
+    /**
+     * @dev Called by the Vault when a user calls `IVault.joinPool` to add liquidity to this Pool. Returns how many of
+     * each registered token the user should provide, as well as the amount of protocol fees the Pool owes to the Vault.
+     * The Vault will then take tokens from `sender` and add them to the Pool's balances, as well as collect
+     * the reported amount in protocol fees, which the pool should calculate based on `protocolSwapFeePercentage`.
+     *
+     * Protocol fees are reported and charged on join events so that the Pool is free of debt whenever new users join.
+     *
+     * `sender` is the account performing the join (from which tokens will be withdrawn), and `recipient` is the account
+     * designated to receive any benefits (typically pool shares). `balances` contains the total balances
+     * for each token the Pool registered in the Vault, in the same order that `IVault.getPoolTokens` would return.
+     *
+     * `lastChangeBlock` is the last block in which *any* of the Pool's registered tokens last changed its total
+     * balance.
+     *
+     * `userData` contains any pool-specific instructions needed to perform the calculations, such as the type of
+     * join (e.g., proportional given an amount of pool shares, single-asset, multi-asset, etc.)
+     *
+     * Contracts implementing this function should check that the caller is indeed the Vault before performing any
+     * state-changing operations, such as minting pool shares.
+     */
+    function onJoinPool(
+        bytes32 poolId,
+        address sender,
+        address recipient,
+        uint256[] memory balances,
+        uint256 lastChangeBlock,
+        uint256 protocolSwapFeePercentage,
+        bytes memory userData
+    ) external returns (uint256[] memory amountsIn, uint256[] memory dueProtocolFeeAmounts);
+
+    /**
+     * @dev Called by the Vault when a user calls `IVault.exitPool` to remove liquidity from this Pool. Returns how many
+     * tokens the Vault should deduct from the Pool's balances, as well as the amount of protocol fees the Pool owes
+     * to the Vault. The Vault will then take tokens from the Pool's balances and send them to `recipient`,
+     * as well as collect the reported amount in protocol fees, which the Pool should calculate based on
+     * `protocolSwapFeePercentage`.
+     *
+     * Protocol fees are charged on exit events to guarantee that users exiting the Pool have paid their share.
+     *
+     * `sender` is the account performing the exit (typically the pool shareholder), and `recipient` is the account
+     * to which the Vault will send the proceeds. `balances` contains the total token balances for each token
+     * the Pool registered in the Vault, in the same order that `IVault.getPoolTokens` would return.
+     *
+     * `lastChangeBlock` is the last block in which *any* of the Pool's registered tokens last changed its total
+     * balance.
+     *
+     * `userData` contains any pool-specific instructions needed to perform the calculations, such as the type of
+     * exit (e.g., proportional given an amount of pool shares, single-asset, multi-asset, etc.)
+     *
+     * Contracts implementing this function should check that the caller is indeed the Vault before performing any
+     * state-changing operations, such as burning pool shares.
+     */
+    function onExitPool(
+        bytes32 poolId,
+        address sender,
+        address recipient,
+        uint256[] memory balances,
+        uint256 lastChangeBlock,
+        uint256 protocolSwapFeePercentage,
+        bytes memory userData
+    ) external returns (uint256[] memory amountsOut, uint256[] memory dueProtocolFeeAmounts);
+
+    /**
+     * @dev Returns this Pool's ID, used when interacting with the Vault (to e.g. join the Pool or swap with it).
+     */
+    function getPoolId() external view returns (bytes32);
+
+    /**
+     * @dev Returns the current swap fee percentage as a 18 decimal fixed point number, so e.g. 1e17 corresponds to a
+     * 10% swap fee.
+     */
+    function getSwapFeePercentage() external view returns (uint256);
+
+    /**
+     * @dev Returns the scaling factors of each of the Pool's tokens. This is an implementation detail that is typically
+     * not relevant for outside parties, but which might be useful for some types of Pools.
+     */
+    function getScalingFactors() external view returns (uint256[] memory);
+
+    function queryJoin(
+        bytes32 poolId,
+        address sender,
+        address recipient,
+        uint256[] memory balances,
+        uint256 lastChangeBlock,
+        uint256 protocolSwapFeePercentage,
+        bytes memory userData
+    ) external returns (uint256 bptOut, uint256[] memory amountsIn);
+
+    function queryExit(
+        bytes32 poolId,
+        address sender,
+        address recipient,
+        uint256[] memory balances,
+        uint256 lastChangeBlock,
+        uint256 protocolSwapFeePercentage,
+        bytes memory userData
+    ) external returns (uint256 bptIn, uint256[] memory amountsOut);
+}
+
+interface ILinearPool is IBasePool {
+    /**
+     * @dev Returns the Pool's main token.
+     */
+    function getMainToken() external view returns (address);
+
+    /**
+     * @dev Returns the Pool's wrapped token.
+     */
+    function getWrappedToken() external view returns (address);
+
+    /**
+     * @dev Returns the index of the Pool's BPT in the Pool tokens array (as returned by IVault.getPoolTokens).
+     */
+    function getBptIndex() external view returns (uint256);
+
+    /**
+     * @dev Returns the index of the Pool's main token in the Pool tokens array (as returned by IVault.getPoolTokens).
+     */
+    function getMainIndex() external view returns (uint256);
+
+    /**
+     * @dev Returns the index of the Pool's wrapped token in the Pool tokens array (as returned by
+     * IVault.getPoolTokens).
+     */
+    function getWrappedIndex() external view returns (uint256);
+
+    /**
+     * @dev Returns the Pool's targets for the main token balance. These values have had the main token's scaling
+     * factor applied to them.
+     */
+    function getTargets() external view returns (uint256 lowerTarget, uint256 upperTarget);
+
+    /**
+     * @notice Set the lower and upper bounds of the zero-fee trading range for the main token balance.
+     * @dev For a new target range to be valid:
+     *      - the current balance must be between the current targets (meaning no fees are currently pending)
+     *      - the current balance must be between the new targets (meaning setting them does not create pending fees)
+     *
+     * The first requirement could be relaxed, as the LPs actually benefit from the pending fees not being paid out,
+     * but being stricter makes analysis easier at little expense.
+     *
+     * This is a permissioned function, reserved for the pool owner. It will revert when called within a Vault context
+     * (i.e. in the middle of a join or an exit).
+     *
+     * Correct behavior depends on the token balances from the Vault, which may be out of sync with the state of
+     * the pool during execution of a Vault hook.
+     *
+     * See https://forum.balancer.fi/t/reentrancy-vulnerability-scope-expanded/4345 for reference.
+     */
+    function setTargets(uint256 newLowerTarget, uint256 newUpperTarget) external;
+
+    /**
+     * @notice Set the swap fee percentage.
+     * @dev This is a permissioned function, reserved for the pool owner. It will revert when called within a Vault
+     * context (i.e. in the middle of a join or an exit).
+     *
+     * Correct behavior depends on the token balances from the Vault, which may be out of sync with the state of
+     * the pool during execution of a Vault hook.
+     *
+     * See https://forum.balancer.fi/t/reentrancy-vulnerability-scope-expanded/4345 for reference.
+     */
+    function setSwapFeePercentage(uint256 swapFeePercentage) external;
+}

package/contracts/base/interface/balancer/linearPool/ILinearPoolFactory.sol

@@ -0,0 +1,16 @@
+// SPDX-License-Identifier: Unlicense
+
+pragma solidity 0.8.26;
+
+interface ILinearPoolFactory {
+    function create(
+        string memory name,
+        string memory symbol,
+        address mainToken,
+        address wrappedToken,
+        uint256 upperTarget,
+        uint256 swapFeePercentage,
+        address owner,
+        uint256 protocolId
+    ) external returns (address);
+}

package/contracts/base/interface/balancer/linearPool/ILinearPoolRebalancer.sol

@@ -0,0 +1,8 @@
+// SPDX-License-Identifier: Unlicense
+
+pragma solidity 0.8.26;
+
+interface ILinearPoolRebalancer {
+    function rebalance(address recipient) external;
+    function rebalanceWithExtraMain(address recipient, uint extraMain) external;
+}

package/contracts/base/interface/balancer/linearPool/IPoolSwapStructs.sol

@@ -0,0 +1,56 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+pragma solidity 0.8.26;
+
+import "../IBVault.sol";
+
+interface IPoolSwapStructs {
+    // This is not really an interface - it just defines common structs used by other interfaces: IGeneralPool and
+    // IMinimalSwapInfoPool.
+    //
+    // This data structure represents a request for a token swap, where `kind` indicates the swap type ('given in' or
+    // 'given out') which indicates whether or not the amount sent by the pool is known.
+    //
+    // The pool receives `tokenIn` and sends `tokenOut`. `amount` is the number of `tokenIn` tokens the pool will take
+    // in, or the number of `tokenOut` tokens the Pool will send out, depending on the given swap `kind`.
+    //
+    // All other fields are not strictly necessary for most swaps, but are provided to support advanced scenarios in
+    // some Pools.
+    //
+    // `poolId` is the ID of the Pool involved in the swap - this is useful for Pool contracts that implement more than
+    // one Pool.
+    //
+    // The meaning of `lastChangeBlock` depends on the Pool specialization:
+    //  - Two Token or Minimal Swap Info: the last block in which either `tokenIn` or `tokenOut` changed its total
+    //    balance.
+    //  - General: the last block in which *any* of the Pool's registered tokens changed its total balance.
+    //
+    // `from` is the origin address for the funds the Pool receives, and `to` is the destination address
+    // where the Pool sends the outgoing tokens.
+    //
+    // `userData` is extra data provided by the caller - typically a signature from a trusted party.
+    struct SwapRequest {
+        IBVault.SwapKind kind;
+        address tokenIn;
+        address tokenOut;
+        uint256 amount;
+        // Misc data
+        bytes32 poolId;
+        uint256 lastChangeBlock;
+        address from;
+        address to;
+        bytes userData;
+    }
+}

package/contracts/base/interface/compound/CTokenInterface.sol

@@ -0,0 +1,29 @@
+// SPDX-License-Identifier: BSD-3-Clause
+pragma solidity ^0.8.10;
+
+abstract contract CTokenInterface {
+    address public underlying;
+
+    function balanceOfUnderlying(address owner) external virtual returns (uint);
+
+    function borrowBalanceCurrent(
+        address account
+    ) external virtual returns (uint);
+
+    function exchangeRateCurrent() external virtual returns (uint);
+
+    function getCash() external view virtual returns (uint);
+
+    function totalBorrows() external view virtual returns (uint);
+
+    function mint(uint mintAmount) external virtual returns (uint);
+    function mint() external payable virtual;
+
+    function redeemUnderlying(uint redeemAmount) external virtual returns (uint);
+    function redeem(uint redeemTokens) external virtual returns (uint);
+
+    function borrow(uint borrowAmount) external virtual returns (uint);
+
+    function repayBorrow(uint repayAmount) external virtual returns (uint);
+    function repayBorrow() external payable virtual;
+}

package/contracts/base/interface/compound/IComptroller.sol

@@ -0,0 +1,9 @@
+// SPDX-License-Identifier: BSD-3-Clause
+pragma solidity ^0.8.10;
+
+interface IComptroller {
+    function enterMarkets(address[] memory cTokens) external returns (uint[] memory);
+    function borrowCaps(address cToken) external view returns (uint256);
+    function supplyCaps(address cToken) external view returns (uint256);
+    function getRewardDistributors() external view returns (address[] memory);
+}

package/contracts/base/interface/dolomite/IDepositWithdraw.sol

@@ -0,0 +1,13 @@
+// SPDX-License-Identifier: Unlicense
+pragma solidity 0.8.26;
+
+interface IDepositWithdraw {
+    enum BalanceCheckFlag {
+        Both,
+        From,
+        To,
+        None
+    }
+    function depositWeiIntoDefaultAccount(uint256 _marketId, uint256 _amountWei) external;
+    function withdrawWeiFromDefaultAccount(uint256 _marketId, uint256 _amountWei, BalanceCheckFlag _balanceCheckFlag) external;
+}

package/contracts/base/interface/dolomite/IDolomiteMargin.sol

@@ -0,0 +1,15 @@
+// SPDX-License-Identifier: Unlicense
+pragma solidity 0.8.26;
+
+interface IDolomiteMargin {
+    struct Info {
+        address owner;  // The address that owns the account
+        uint256 number; // A nonce that allows a single address to control many accounts
+    }
+    struct Wei {
+        bool sign; // true if positive
+        uint256 value;
+    }
+    function getAccountWei(Info calldata account, uint256 marketId) external view returns (Wei memory);
+    function getMarketIdByTokenAddress(address token) external view returns (uint256);
+}

package/contracts/base/interface/dolomite/IRewardsDistributor.sol

@@ -0,0 +1,11 @@
+// SPDX-License-Identifier: Unlicense
+pragma solidity 0.8.26;
+
+interface IRewardsDistributor {
+    struct ClaimInfo {
+        uint256 epoch;
+        uint256 amount;
+        bytes32[] proof;
+    }
+    function claim(ClaimInfo[] calldata _claimInfo) external;
+}

package/contracts/base/interface/gamma/IClearing.sol

@@ -0,0 +1,7 @@
+//SPDX-License-Identifier: Unlicense
+pragma solidity 0.8.26;
+
+interface IClearing {
+  function getSqrtTwapX96(address, uint32) external view returns(uint160);
+  function getDepositAmount(address, address, uint256) external view returns(uint256, uint256);
+}

package/contracts/base/interface/gamma/IHypervisor.sol

@@ -0,0 +1,9 @@
+//SPDX-License-Identifier: Unlicense
+pragma solidity 0.8.26;
+
+interface IHypervisor {
+  function token0() external view returns (address);
+  function token1() external view returns (address);
+  function getTotalAmounts() external view returns(uint256, uint256);
+  function withdraw(uint256 shares, address to, address from, uint256[4] calldata minAmounts) external;
+}

package/contracts/base/interface/gamma/IUniProxy.sol

@@ -0,0 +1,14 @@
+//SPDX-License-Identifier: Unlicense
+pragma solidity 0.8.26;
+
+interface IUniProxy {
+  function deposit(
+    uint256 deposit0,
+    uint256 deposit1,
+    address to,
+    address pos,
+    uint256[4] memory minIn
+  ) external;
+  function getSqrtTwapX96(address, uint32) external view returns(uint160);
+  function clearance() external view returns(address);
+}