@harvest-finance/harvest-strategy-arbitrum 0.0.1-security → 1.0.1

package/contracts/base/upgradability/BaseUpgradeableStrategyStorage.sol

@@ -0,0 +1,284 @@
+//SPDX-License-Identifier: Unlicense
+pragma solidity 0.8.26;
+
+import "../interface/IController.sol";
+import "../inheritance/ControllableInit.sol";
+
+contract BaseUpgradeableStrategyStorage is ControllableInit {
+
+  event ProfitsNotCollected(
+      address indexed rewardToken,
+      bool sell,
+      bool floor
+  );
+  event ProfitLogInReward(
+      address indexed rewardToken,
+      uint256 profitAmount,
+      uint256 feeAmount,
+      uint256 timestamp
+  );
+  event PlatformFeeLogInReward(
+      address indexed treasury,
+      address indexed rewardToken,
+      uint256 profitAmount,
+      uint256 feeAmount,
+      uint256 timestamp
+  );
+  event StrategistFeeLogInReward(
+      address indexed strategist,
+      address indexed rewardToken,
+      uint256 profitAmount,
+      uint256 feeAmount,
+      uint256 timestamp
+  );
+
+  bytes32 internal constant _UNDERLYING_SLOT = 0xa1709211eeccf8f4ad5b6700d52a1a9525b5f5ae1e9e5f9e5a0c2fc23c86e530;
+  bytes32 internal constant _VAULT_SLOT = 0xefd7c7d9ef1040fc87e7ad11fe15f86e1d11e1df03c6d7c87f7e1f4041f08d41;
+
+  bytes32 internal constant _REWARD_TOKEN_SLOT = 0xdae0aafd977983cb1e78d8f638900ff361dc3c48c43118ca1dd77d1af3f47bbf;
+  // bytes32 internal constant _REWARD_TOKENS_SLOT = 0x45418d9b5c2787ae64acbffccad43f2b487c1a16e24385aa9d2b059f9d1d163c;
+  bytes32 internal constant _REWARD_POOL_SLOT = 0x3d9bb16e77837e25cada0cf894835418b38e8e18fbec6cfd192eb344bebfa6b8;
+  // bytes32 internal constant _SELL_FLOOR_SLOT = 0xc403216a7704d160f6a3b5c3b149a1226a6080f0a5dd27b27d9ba9c022fa0afc;
+  bytes32 internal constant _SELL_SLOT = 0x656de32df98753b07482576beb0d00a6b949ebf84c066c765f54f26725221bb6;
+  bytes32 internal constant _PAUSED_INVESTING_SLOT = 0xa07a20a2d463a602c2b891eb35f244624d9068572811f63d0e094072fb54591a;
+
+  bytes32 internal constant _PROFIT_SHARING_NUMERATOR_SLOT = 0xe3ee74fb7893020b457d8071ed1ef76ace2bf4903abd7b24d3ce312e9c72c029;
+  bytes32 internal constant _PROFIT_SHARING_DENOMINATOR_SLOT = 0x0286fd414602b432a8c80a0125e9a25de9bba96da9d5068c832ff73f09208a3b;
+
+  bytes32 internal constant _NEXT_IMPLEMENTATION_SLOT = 0x29f7fcd4fe2517c1963807a1ec27b0e45e67c60a874d5eeac7a0b1ab1bb84447;
+  bytes32 internal constant _NEXT_IMPLEMENTATION_TIMESTAMP_SLOT = 0x414c5263b05428f1be1bfa98e25407cc78dd031d0d3cd2a2e3d63b488804f22e;
+  bytes32 internal constant _NEXT_IMPLEMENTATION_DELAY_SLOT = 0x82b330ca72bcd6db11a26f10ce47ebcfe574a9c646bccbc6f1cd4478eae16b31;
+
+  bytes32 internal constant _STRATEGIST_SLOT = 0x6a7b588c950d46e2de3db2f157e5e0e4f29054c8d60f17bf0c30352e223a458d;
+
+  constructor() {
+    assert(_UNDERLYING_SLOT == bytes32(uint256(keccak256("eip1967.strategyStorage.underlying")) - 1));
+    assert(_VAULT_SLOT == bytes32(uint256(keccak256("eip1967.strategyStorage.vault")) - 1));
+    assert(_REWARD_TOKEN_SLOT == bytes32(uint256(keccak256("eip1967.strategyStorage.rewardToken")) - 1));
+    // assert(_REWARD_TOKENS_SLOT == bytes32(uint256(keccak256("eip1967.strategyStorage.rewardTokens")) - 1));
+    assert(_REWARD_POOL_SLOT == bytes32(uint256(keccak256("eip1967.strategyStorage.rewardPool")) - 1));
+    // assert(_SELL_FLOOR_SLOT == bytes32(uint256(keccak256("eip1967.strategyStorage.sellFloor")) - 1));
+    assert(_SELL_SLOT == bytes32(uint256(keccak256("eip1967.strategyStorage.sell")) - 1));
+    assert(_PAUSED_INVESTING_SLOT == bytes32(uint256(keccak256("eip1967.strategyStorage.pausedInvesting")) - 1));
+
+    assert(_PROFIT_SHARING_NUMERATOR_SLOT == bytes32(uint256(keccak256("eip1967.strategyStorage.profitSharingNumerator")) - 1));
+    assert(_PROFIT_SHARING_DENOMINATOR_SLOT == bytes32(uint256(keccak256("eip1967.strategyStorage.profitSharingDenominator")) - 1));
+
+    assert(_NEXT_IMPLEMENTATION_SLOT == bytes32(uint256(keccak256("eip1967.strategyStorage.nextImplementation")) - 1));
+    assert(_NEXT_IMPLEMENTATION_TIMESTAMP_SLOT == bytes32(uint256(keccak256("eip1967.strategyStorage.nextImplementationTimestamp")) - 1));
+    assert(_NEXT_IMPLEMENTATION_DELAY_SLOT == bytes32(uint256(keccak256("eip1967.strategyStorage.nextImplementationDelay")) - 1));
+
+    assert(_STRATEGIST_SLOT == bytes32(uint256(keccak256("eip1967.strategyStorage.strategist")) - 1));
+  }
+
+  function _setUnderlying(address _address) internal {
+    setAddress(_UNDERLYING_SLOT, _address);
+  }
+
+  function underlying() public virtual view returns (address) {
+    return getAddress(_UNDERLYING_SLOT);
+  }
+
+  function _setRewardPool(address _address) internal {
+    setAddress(_REWARD_POOL_SLOT, _address);
+  }
+
+  function rewardPool() public view returns (address) {
+    return getAddress(_REWARD_POOL_SLOT);
+  }
+
+  function _setRewardToken(address _address) internal {
+    setAddress(_REWARD_TOKEN_SLOT, _address);
+  }
+
+  function rewardToken() public view returns (address) {
+    return getAddress(_REWARD_TOKEN_SLOT);
+  }
+
+  // function _setRewardTokens(address[] memory _rewardTokens) internal {
+  //   setAddressArray(_REWARD_TOKENS_SLOT, _rewardTokens);
+  // }
+
+  // function isRewardToken(address _token) public view returns (bool) {
+  //   return _isAddressInList(_token, rewardTokens());
+  // }
+
+  // function rewardTokens() public view returns (address[] memory) {
+  //   return getAddressArray(_REWARD_TOKENS_SLOT);
+  // }
+
+  function _isAddressInList(address _searchValue, address[] memory _list) internal pure returns (bool) {
+    for (uint i = 0; i < _list.length; i++) {
+      if (_list[i] == _searchValue) {
+        return true;
+      }
+    }
+    return false;
+  }
+
+  function _setStrategist(address _strategist) internal {
+    setAddress(_STRATEGIST_SLOT, _strategist);
+  }
+
+  function strategist() public view returns (address) {
+    return getAddress(_STRATEGIST_SLOT);
+  }
+
+  function _setVault(address _address) internal {
+    setAddress(_VAULT_SLOT, _address);
+  }
+
+  function vault() public virtual view returns (address) {
+    return getAddress(_VAULT_SLOT);
+  }
+
+  // a flag for disabling selling for simplified emergency exit
+  function _setSell(bool _value) internal {
+    setBoolean(_SELL_SLOT, _value);
+  }
+
+  function sell() public view returns (bool) {
+    return getBoolean(_SELL_SLOT);
+  }
+
+  function _setPausedInvesting(bool _value) internal {
+    setBoolean(_PAUSED_INVESTING_SLOT, _value);
+  }
+
+  function pausedInvesting() public view returns (bool) {
+    return getBoolean(_PAUSED_INVESTING_SLOT);
+  }
+
+  // function _setSellFloor(uint256 _value) internal {
+  //   setUint256(_SELL_FLOOR_SLOT, _value);
+  // }
+
+  // function sellFloor() public view returns (uint256) {
+  //   return getUint256(_SELL_FLOOR_SLOT);
+  // }
+
+  function profitSharingNumerator() public view returns (uint256) {
+    return IController(controller()).profitSharingNumerator();
+  }
+
+  function platformFeeNumerator() public view returns (uint256) {
+    return IController(controller()).platformFeeNumerator();
+  }
+
+  function strategistFeeNumerator() public view returns (uint256) {
+    return IController(controller()).strategistFeeNumerator();
+  }
+
+  function feeDenominator() public view returns (uint256) {
+    return IController(controller()).feeDenominator();
+  }
+
+  function universalLiquidator() public view returns (address) {
+    return IController(controller()).universalLiquidator();
+  }
+
+  // upgradeability
+
+  function _setNextImplementation(address _address) internal {
+    setAddress(_NEXT_IMPLEMENTATION_SLOT, _address);
+  }
+
+  function nextImplementation() public view returns (address) {
+    return getAddress(_NEXT_IMPLEMENTATION_SLOT);
+  }
+
+  function _setNextImplementationTimestamp(uint256 _value) internal {
+    setUint256(_NEXT_IMPLEMENTATION_TIMESTAMP_SLOT, _value);
+  }
+
+  function nextImplementationTimestamp() public view returns (uint256) {
+    return getUint256(_NEXT_IMPLEMENTATION_TIMESTAMP_SLOT);
+  }
+
+    function nextImplementationDelay() public view returns (uint256) {
+        return IController(controller()).nextImplementationDelay();
+    }
+
+  function setBoolean(bytes32 slot, bool _value) internal {
+    setUint256(slot, _value ? 1 : 0);
+  }
+
+  function getBoolean(bytes32 slot) internal view returns (bool) {
+    return (getUint256(slot) == 1);
+  }
+
+  function setAddress(bytes32 slot, address _address) internal {
+    // solhint-disable-next-line no-inline-assembly
+    assembly {
+      sstore(slot, _address)
+    }
+  }
+
+  function setUint256(bytes32 slot, uint256 _value) internal {
+    // solhint-disable-next-line no-inline-assembly
+    assembly {
+      sstore(slot, _value)
+    }
+  }
+
+  function getAddress(bytes32 slot) internal view returns (address str) {
+    // solhint-disable-next-line no-inline-assembly
+    assembly {
+      str := sload(slot)
+    }
+  }
+
+  function getUint256(bytes32 slot) internal view returns (uint256 str) {
+    // solhint-disable-next-line no-inline-assembly
+    assembly {
+      str := sload(slot)
+    }
+  }
+
+      function setUint256Array(bytes32 slot, uint256[] memory _values) internal {
+        // solhint-disable-next-line no-inline-assembly
+        setUint256(slot, _values.length);
+        for (uint i = 0; i < _values.length; i++) {
+            setUint256(bytes32(uint(slot) + 1 + i), _values[i]);
+        }
+    }
+
+    function setAddressArray(bytes32 slot, address[] memory _values) internal {
+        // solhint-disable-next-line no-inline-assembly
+        setUint256(slot, _values.length);
+        for (uint i = 0; i < _values.length; i++) {
+            setAddress(bytes32(uint(slot) + 1 + i), _values[i]);
+        }
+    }
+
+
+    function getUint256Array(bytes32 slot) internal view returns (uint[] memory values) {
+        // solhint-disable-next-line no-inline-assembly
+        values = new uint[](getUint256(slot));
+        for (uint i = 0; i < values.length; i++) {
+            values[i] = getUint256(bytes32(uint(slot) + 1 + i));
+        }
+    }
+
+    function getAddressArray(bytes32 slot) internal view returns (address[] memory values) {
+        // solhint-disable-next-line no-inline-assembly
+        values = new address[](getUint256(slot));
+        for (uint i = 0; i < values.length; i++) {
+            values[i] = getAddress(bytes32(uint(slot) + 1 + i));
+        }
+    }
+
+    function setBytes32(bytes32 slot, bytes32 _value) internal {
+        // solhint-disable-next-line no-inline-assembly
+        assembly {
+        sstore(slot, _value)
+        }
+    }
+
+    function getBytes32(bytes32 slot) internal view returns (bytes32 str) {
+        // solhint-disable-next-line no-inline-assembly
+        assembly {
+        str := sload(slot)
+        }
+    }
+}

package/contracts/base/upgradability/IUpgradable.sol

@@ -0,0 +1,7 @@
+//SPDX-License-Identifier: Unlicense
+pragma solidity 0.8.26;
+
+interface IUpgradeableStrategy {
+  function scheduleUpgrade(address impl) external;
+  function upgrade() external;
+}

package/contracts/base/upgradability/ReentrancyGuardUpgradeable.sol

@@ -0,0 +1,51 @@
+//SPDX-License-Identifier: Unlicense
+pragma solidity 0.8.26;
+
+import "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol";
+
+/**
+ * Same old `ReentrancyGuard`, but can be used by upgradable contracts
+ */
+contract ReentrancyGuardUpgradeable is Initializable {
+
+    bytes32 internal constant _NOT_ENTERED_SLOT = 0x62ae7bf2df4e95c187ea09c8c47c3fc3d9abc36298f5b5b6c5e2e7b4b291fe25;
+
+    modifier nonReentrant() {
+        // On the first call to nonReentrant, _notEntered will be true
+        require(_getNotEntered(_NOT_ENTERED_SLOT), "ReentrancyGuard: reentrant call");
+
+        // Any calls to nonReentrant after this point will fail
+        _setNotEntered(_NOT_ENTERED_SLOT, false);
+
+        _;
+
+        // By storing the original value once again, a refund is triggered (see
+        // https://eips.ethereum.org/EIPS/eip-2200)
+        _setNotEntered(_NOT_ENTERED_SLOT, true);
+    }
+
+    constructor() {
+        assert(_NOT_ENTERED_SLOT == bytes32(uint256(keccak256("eip1967.reentrancyGuard.notEntered")) - 1));
+    }
+
+    function initialize() public initializer {
+        _setNotEntered(_NOT_ENTERED_SLOT, true);
+    }
+
+    function _getNotEntered(bytes32 slot) private view returns (bool) {
+        uint str;
+        // solhint-disable-next-line no-inline-assembly
+        assembly {
+            str := sload(slot)
+        }
+        return str == 1;
+    }
+
+    function _setNotEntered(bytes32 slot, bool _value) private {
+        // solhint-disable-next-line no-inline-assembly
+        assembly {
+            sstore(slot, _value)
+        }
+    }
+
+}

package/contracts/base/upgradability/StrategyProxy.sol

@@ -0,0 +1,34 @@
+//SPDX-License-Identifier: Unlicense
+pragma solidity 0.8.26;
+
+import "../inheritance/IUpgradeSource.sol";
+import "./BaseUpgradeabilityProxy.sol";
+
+contract StrategyProxy is BaseUpgradeabilityProxy {
+
+  constructor(address _implementation) {
+    _setImplementation(_implementation);
+  }
+
+  /**
+  * The main logic. If the timer has elapsed and there is a schedule upgrade,
+  * the governance can upgrade the strategy
+  */
+  function upgrade() external {
+    (bool should, address newImplementation) = IUpgradeSource(address(this)).shouldUpgrade();
+    require(should, "Upgrade not scheduled");
+    _upgradeTo(newImplementation);
+
+    // the finalization needs to be executed on itself to update the storage of this proxy
+    // it also needs to be invoked by the governance, not by address(this), so delegatecall is needed
+    (bool success,) = address(this).delegatecall(
+      abi.encodeWithSignature("finalizeUpgrade()")
+    );
+
+    require(success, "Issue when finalizing the upgrade");
+  }
+
+  function implementation() external view returns (address) {
+    return _implementation();
+  }
+}