@harvest-finance/harvest-strategy-arbitrum 0.0.1-security → 1.0.1

package/contracts/base/PotPool.sol

@@ -0,0 +1,367 @@
+// SPDX-License-Identifier: Unlicense
+pragma solidity 0.8.26;
+
+import "./inheritance/Controllable.sol";
+import "./interface/IController.sol";
+
+import "@openzeppelin/contracts/token/ERC20/ERC20.sol";
+import "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";
+import "@openzeppelin/contracts/token/ERC20/IERC20.sol";
+import "@openzeppelin/contracts/utils/math/SafeMath.sol";
+import "@openzeppelin/contracts/utils/math/Math.sol";
+import "@openzeppelin/contracts/utils/Address.sol";
+import "@openzeppelin/contracts/access/Ownable.sol";
+
+abstract contract IRewardDistributionRecipient is Ownable {
+
+    mapping (address => bool) public rewardDistribution;
+
+    constructor(address[] memory _rewardDistributions) {
+        // multisig on Arbitrum
+        rewardDistribution[0xf3D1A027E858976634F81B7c41B09A05A46EdA21] = true;
+        // NotifyHelper
+        rewardDistribution[0xC0cE53f755feAe93Fd219b2Cd0F58a4Fd0d535Dd] = true;
+
+        for(uint256 i = 0; i < _rewardDistributions.length; i++) {
+          rewardDistribution[_rewardDistributions[i]] = true;
+        }
+    }
+
+    function notifyTargetRewardAmount(address rewardToken, uint256 reward) external virtual;
+    function notifyRewardAmount(uint256 reward) external virtual;
+
+    modifier onlyRewardDistribution() {
+        require(rewardDistribution[_msgSender()], "Caller is not reward distribution");
+        _;
+    }
+
+    function setRewardDistribution(address[] calldata _newRewardDistribution, bool _flag)
+        external
+        onlyOwner
+    {
+        for(uint256 i = 0; i < _newRewardDistribution.length; i++){
+          rewardDistribution[_newRewardDistribution[i]] = _flag;
+        }
+    }
+}
+
+contract PotPool is IRewardDistributionRecipient, Controllable, ERC20 {
+
+    using Address for address;
+    using SafeERC20 for IERC20;
+    using SafeMath for uint256;
+
+    address public lpToken;
+    uint256 public duration; // making it not a constant is less gas efficient, but portable
+
+    mapping(address => uint256) public stakedBalanceOf;
+
+    mapping (address => bool) smartContractStakers;
+    address[] public rewardTokens;
+    mapping(address => uint256) public periodFinishForToken;
+    mapping(address => uint256) public rewardRateForToken;
+    mapping(address => uint256) public lastUpdateTimeForToken;
+    mapping(address => uint256) public rewardPerTokenStoredForToken;
+    mapping(address => mapping(address => uint256)) public userRewardPerTokenPaidForToken;
+    mapping(address => mapping(address => uint256)) public rewardsForToken;
+
+    event RewardAdded(address rewardToken, uint256 reward);
+    event Staked(address indexed user, uint256 amount);
+    event Withdrawn(address indexed user, uint256 amount);
+    event RewardPaid(address indexed user, address rewardToken, uint256 reward);
+    event RewardDenied(address indexed user, address rewardToken, uint256 reward);
+    event SmartContractRecorded(address indexed smartContractAddress, address indexed smartContractInitiator);
+
+    modifier onlyGovernanceOrRewardDistribution() {
+      require(msg.sender == governance() || rewardDistribution[msg.sender], "Not governance nor reward distribution");
+      _;
+    }
+
+    modifier updateRewards(address account) {
+      for(uint256 i = 0; i < rewardTokens.length; i++ ){
+        address rt = rewardTokens[i];
+        rewardPerTokenStoredForToken[rt] = rewardPerToken(rt);
+        lastUpdateTimeForToken[rt] = lastTimeRewardApplicable(rt);
+        if (account != address(0)) {
+            rewardsForToken[rt][account] = earned(rt, account);
+            userRewardPerTokenPaidForToken[rt][account] = rewardPerTokenStoredForToken[rt];
+        }
+      }
+      _;
+    }
+
+    modifier updateReward(address account, address rt){
+      rewardPerTokenStoredForToken[rt] = rewardPerToken(rt);
+      lastUpdateTimeForToken[rt] = lastTimeRewardApplicable(rt);
+      if (account != address(0)) {
+          rewardsForToken[rt][account] = earned(rt, account);
+          userRewardPerTokenPaidForToken[rt][account] = rewardPerTokenStoredForToken[rt];
+      }
+      _;
+    }
+
+    /** View functions to respect old interface */
+    function rewardToken() public view returns(address) {
+      return rewardTokens[0];
+    }
+
+    function rewardPerToken() public view returns(uint256) {
+      return rewardPerToken(rewardTokens[0]);
+    }
+
+    function periodFinish() public view returns(uint256) {
+      return periodFinishForToken[rewardTokens[0]];
+    }
+
+    function rewardRate() public view returns(uint256) {
+      return rewardRateForToken[rewardTokens[0]];
+    }
+
+    function lastUpdateTime() public view returns(uint256) {
+      return lastUpdateTimeForToken[rewardTokens[0]];
+    }
+
+    function rewardPerTokenStored() public view returns(uint256) {
+      return rewardPerTokenStoredForToken[rewardTokens[0]];
+    }
+
+    function userRewardPerTokenPaid(address user) public view returns(uint256) {
+      return userRewardPerTokenPaidForToken[rewardTokens[0]][user];
+    }
+
+    function rewards(address user) public view returns(uint256) {
+      return rewardsForToken[rewardTokens[0]][user];
+    }
+
+    // [Hardwork] setting the reward, lpToken, duration, and rewardDistribution for each pool
+    constructor(
+        address[] memory _rewardTokens,
+        address _lpToken,
+        uint256 _duration,
+        address[] memory _rewardDistribution,
+        address _storage,
+        string memory _name,
+        string memory _symbol,
+        uint8 _decimals
+      )
+      ERC20(_name, _symbol)
+      IRewardDistributionRecipient(_rewardDistribution)
+      Controllable(_storage) // only used for referencing the grey list
+    {
+        require(_decimals == ERC20(_lpToken).decimals(), "decimals has to be aligned with the lpToken");
+        require(_rewardTokens.length != 0, "should initialize with at least 1 rewardToken");
+        rewardTokens = _rewardTokens;
+        lpToken = _lpToken;
+        duration = _duration;
+    }
+
+    //Overwrite ERC20's transfer function to block transfer of pTokens,
+    //as transferring the token does not transfer the rewards or rights to unstake.
+    function transfer(address /*recipient*/, uint256 amount) public override returns (bool) {
+      if (amount > 0) {
+        revert("Staked assets cannot be transferred");
+      }
+    }
+
+    function lastTimeRewardApplicable(uint256 i) public view returns (uint256) {
+        return lastTimeRewardApplicable(rewardTokens[i]);
+    }
+
+    function lastTimeRewardApplicable(address rt) public view returns (uint256) {
+        return Math.min(block.timestamp, periodFinishForToken[rt]);
+    }
+
+    function lastTimeRewardApplicable() public view returns (uint256) {
+        return lastTimeRewardApplicable(rewardTokens[0]);
+    }
+
+    function rewardPerToken(uint256 i) public view returns (uint256) {
+        return rewardPerToken(rewardTokens[i]);
+    }
+
+    function rewardPerToken(address rt) public view returns (uint256) {
+        if (totalSupply() == 0) {
+            return rewardPerTokenStoredForToken[rt];
+        }
+        return
+            rewardPerTokenStoredForToken[rt].add(
+                lastTimeRewardApplicable(rt)
+                    .sub(lastUpdateTimeForToken[rt])
+                    .mul(rewardRateForToken[rt])
+                    .mul(1e18)
+                    .div(totalSupply())
+            );
+    }
+
+    function earned(uint256 i, address account) public view returns (uint256) {
+        return earned(rewardTokens[i], account);
+    }
+
+    function earned(address account) public view returns (uint256) {
+        return earned(rewardTokens[0], account);
+    }
+
+    function earned(address rt, address account) public view returns (uint256) {
+        return
+            stakedBalanceOf[account]
+                .mul(rewardPerToken(rt).sub(userRewardPerTokenPaidForToken[rt][account]))
+                .div(1e18)
+                .add(rewardsForToken[rt][account]);
+    }
+
+    function stake(uint256 amount) public updateRewards(msg.sender) {
+        require(amount > 0, "Cannot stake 0");
+        recordSmartContract();
+        super._mint(msg.sender, amount); // ERC20 is used as a staking receipt
+        stakedBalanceOf[msg.sender] = stakedBalanceOf[msg.sender].add(amount);
+        IERC20(lpToken).safeTransferFrom(msg.sender, address(this), amount);
+        emit Staked(msg.sender, amount);
+    }
+
+    function withdraw(uint256 amount) public updateRewards(msg.sender) {
+        require(amount > 0, "Cannot withdraw 0");
+        super._burn(msg.sender, amount);
+        stakedBalanceOf[msg.sender] = stakedBalanceOf[msg.sender].sub(amount);
+        IERC20(lpToken).safeTransfer(msg.sender, amount);
+        emit Withdrawn(msg.sender, amount);
+    }
+
+    function exit() external {
+        withdraw(Math.min(stakedBalanceOf[msg.sender], balanceOf(msg.sender)));
+        getAllRewards();
+    }
+
+    /// A push mechanism for accounts that have not claimed their rewards for a long time.
+    /// The implementation is semantically analogous to getReward(), but uses a push pattern
+    /// instead of pull pattern.
+    function pushAllRewards(address recipient) public updateRewards(recipient) onlyGovernance {
+      bool rewardPayout = (!smartContractStakers[recipient] || !IController(controller()).greyList(recipient));
+      for(uint256 i = 0 ; i < rewardTokens.length; i++ ){
+        uint256 reward = earned(rewardTokens[i], recipient);
+        if (reward > 0) {
+            rewardsForToken[rewardTokens[i]][recipient] = 0;
+            // If it is a normal user and not smart contract,
+            // then the requirement will pass
+            // If it is a smart contract, then
+            // make sure that it is not on our greyList.
+            if (rewardPayout) {
+                IERC20(rewardTokens[i]).safeTransfer(recipient, reward);
+                emit RewardPaid(recipient, rewardTokens[i], reward);
+            } else {
+                emit RewardDenied(recipient, rewardTokens[i], reward);
+            }
+        }
+      }
+    }
+
+    function getAllRewards() public updateRewards(msg.sender) {
+      recordSmartContract();
+      bool rewardPayout = (!smartContractStakers[msg.sender] || !IController(controller()).greyList(msg.sender));
+      for(uint256 i = 0 ; i < rewardTokens.length; i++ ){
+        _getRewardAction(rewardTokens[i], rewardPayout);
+      }
+    }
+
+    function getReward(address rt) public updateReward(msg.sender, rt) {
+      recordSmartContract();
+      _getRewardAction(
+        rt,
+        // don't payout if it is a grey listed smart contract
+        (!smartContractStakers[msg.sender] || !IController(controller()).greyList(msg.sender))
+      );
+    }
+
+    function getReward() public {
+      getReward(rewardTokens[0]);
+    }
+
+    function _getRewardAction(address rt, bool rewardPayout) internal {
+      uint256 reward = earned(rt, msg.sender);
+      if (reward > 0 && IERC20(rt).balanceOf(address(this)) >= reward ) {
+          rewardsForToken[rt][msg.sender] = 0;
+          // If it is a normal user and not smart contract,
+          // then the requirement will pass
+          // If it is a smart contract, then
+          // make sure that it is not on our greyList.
+          if (rewardPayout) {
+              IERC20(rt).safeTransfer(msg.sender, reward);
+              emit RewardPaid(msg.sender, rt, reward);
+          } else {
+              emit RewardDenied(msg.sender, rt, reward);
+          }
+      }
+    }
+
+    function addRewardToken(address rt) public onlyGovernanceOrRewardDistribution {
+      require(getRewardTokenIndex(rt) == type(uint256).max, "Reward token already exists");
+      rewardTokens.push(rt);
+    }
+
+    function removeRewardToken(address rt) public onlyGovernanceOrRewardDistribution {
+      uint256 i = getRewardTokenIndex(rt);
+      require(i != type(uint256).max, "Reward token does not exists");
+      require(periodFinishForToken[rewardTokens[i]] < block.timestamp, "Can only remove when the reward period has passed");
+      require(rewardTokens.length > 1, "Cannot remove the last reward token");
+      uint256 lastIndex = rewardTokens.length - 1;
+
+      // swap
+      rewardTokens[i] = rewardTokens[lastIndex];
+
+      // delete last element
+      rewardTokens.pop();
+    }
+
+    // If the return value is MAX_UINT256, it means that
+    // the specified reward token is not in the list
+    function getRewardTokenIndex(address rt) public view returns(uint256) {
+      for(uint i = 0 ; i < rewardTokens.length ; i++){
+        if(rewardTokens[i] == rt)
+          return i;
+      }
+      return type(uint256).max;
+    }
+
+    function notifyTargetRewardAmount(address _rewardToken, uint256 reward)
+        public override
+        onlyRewardDistribution
+        updateRewards(address(0))
+    {
+        // overflow fix according to https://sips.synthetix.io/sips/sip-77
+        require(reward < type(uint256).max / 1e18, "the notified reward cannot invoke multiplication overflow");
+
+        uint256 i = getRewardTokenIndex(_rewardToken);
+        require(i != type(uint256).max, "rewardTokenIndex not found");
+
+        if (block.timestamp >= periodFinishForToken[_rewardToken]) {
+            rewardRateForToken[_rewardToken] = reward.div(duration);
+        } else {
+            uint256 remaining = periodFinishForToken[_rewardToken].sub(block.timestamp);
+            uint256 leftover = remaining.mul(rewardRateForToken[_rewardToken]);
+            rewardRateForToken[_rewardToken] = reward.add(leftover).div(duration);
+        }
+        lastUpdateTimeForToken[_rewardToken] = block.timestamp;
+        periodFinishForToken[_rewardToken] = block.timestamp.add(duration);
+        emit RewardAdded(_rewardToken, reward);
+    }
+
+    function notifyRewardAmount(uint256 reward)
+        external override
+        onlyRewardDistribution
+        updateRewards(address(0))
+    {
+      notifyTargetRewardAmount(rewardTokens[0], reward);
+    }
+
+    function rewardTokensLength() public view returns(uint256){
+      return rewardTokens.length;
+    }
+
+    // Harvest Smart Contract recording
+    function recordSmartContract() internal {
+      if( tx.origin != msg.sender ) {
+        smartContractStakers[msg.sender] = true;
+        emit SmartContractRecorded(msg.sender, tx.origin);
+      }
+    }
+
+}

package/contracts/base/ProfitSharingReceiver.sol

@@ -0,0 +1,38 @@
+// SPDX-License-Identifier: Unlicense
+pragma solidity 0.8.26;
+
+import "@openzeppelin/contracts/utils/Address.sol";
+import "@openzeppelin/contracts/utils/math/SafeMath.sol";
+import "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";
+import "@openzeppelin/contracts/token/ERC20/IERC20.sol";
+
+import "./inheritance/Governable.sol";
+import "./interface/IProfitSharingReceiver.sol";
+
+
+/**
+ * A simple contract for receiving tokens for profit sharing. This contract is designed to pool rewards that will be
+ * sent by governance to Ethereum mainnet for FARM buybacks
+ */
+contract ProfitSharingReceiver is Governable {
+    using SafeERC20 for IERC20;
+
+    event WithdrawToken(address indexed token, address indexed receiver, uint amount);
+
+    constructor(
+        address _store
+    )
+    Governable(_store) {}
+
+    function withdrawTokens(address[] calldata _tokens) external onlyGovernance {
+        address _governance = governance();
+        for (uint i = 0; i < _tokens.length; ++i) {
+            uint amount = IERC20(_tokens[i]).balanceOf(address(this));
+            if (amount > 0) {
+                IERC20(_tokens[i]).safeTransfer(_governance, amount);
+                emit WithdrawToken(_tokens[i], _governance, amount);
+            }
+        }
+    }
+
+}

package/contracts/base/Reader.sol

@@ -0,0 +1,54 @@
+// SPDX-License-Identifier: Unlicense
+pragma solidity 0.8.26;
+
+import "@openzeppelin/contracts-upgradeable/token/ERC20/IERC20Upgradeable.sol";
+import "./interface/IVault.sol";
+
+contract Reader {
+
+  function getAllInformation(address who, address[] memory vaults, address[] memory pools)
+  public view returns (uint256[] memory, uint256[] memory, uint256[] memory) {
+    return (unstakedBalances(who, vaults), stakedBalances(who, pools), vaultSharePrices(vaults));
+  }
+
+  function unstakedBalances(address who, address[] memory vaults) public view returns (uint256[] memory) {
+    uint256[] memory result = new uint256[](vaults.length);
+    for (uint256 i = 0; i < vaults.length; i++) {
+      result[i] = IERC20Upgradeable(vaults[i]).balanceOf(who);
+    }
+    return result;
+  }
+
+  function stakedBalances(address who, address[] memory pools) public view returns (uint256[] memory) {
+    uint256[] memory result = new uint256[](pools.length);
+    for (uint256 i = 0; i < pools.length; i++) {
+      result[i] = IERC20Upgradeable(pools[i]).balanceOf(who);
+    }
+    return result;
+  }
+
+  function underlyingBalances(address who, address[] memory vaults) public view returns (uint256[] memory) {
+    uint256[] memory result = new uint256[](vaults.length);
+    for (uint256 i = 0; i < vaults.length; i++) {
+      result[i] = IERC20Upgradeable(IVault(vaults[i]).underlying()).balanceOf(who);
+    }
+    return result;
+  }
+
+  function vaultSharePrices(address[] memory vaults) public view returns (uint256[] memory) {
+    uint256[] memory result = new uint256[](vaults.length);
+    for (uint256 i = 0; i < vaults.length; i++) {
+      result[i] = IVault(vaults[i]).getPricePerFullShare();
+    }
+    return result;
+  }
+
+  function underlyingBalanceWithInvestmentForHolder(address who, address[] memory vaults)
+  public view returns (uint256[] memory) {
+    uint256[] memory result = new uint256[](vaults.length);
+    for (uint256 i = 0; i < vaults.length; i++) {
+      result[i] = IVault(vaults[i]).underlyingBalanceWithInvestmentForHolder(who);
+    }
+    return result;
+  }
+}

package/contracts/base/RewardForwarder.sol

@@ -0,0 +1,109 @@
+// SPDX-License-Identifier: Unlicense
+pragma solidity 0.8.26;
+
+import "@openzeppelin/contracts/utils/math/SafeMath.sol";
+import "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";
+import "@openzeppelin/contracts/token/ERC20/IERC20.sol";
+
+import "./inheritance/Governable.sol";
+import "./interface/IController.sol";
+import "./interface/IRewardForwarder.sol";
+import "./interface/IProfitSharingReceiver.sol";
+import "./interface/IStrategy.sol";
+import "./interface/IUniversalLiquidator.sol";
+import "./inheritance/Controllable.sol";
+
+/**
+ * @dev This contract receives rewards from strategies and is responsible for routing the reward's liquidation into
+ *      specific buyback tokens and profit tokens for the DAO.
+ */
+contract RewardForwarder is Controllable {
+    using SafeERC20 for IERC20;
+    using SafeMath for uint256;
+
+    address public constant iFARM = address(0x9dCA587dc65AC0a043828B0acd946d71eb8D46c1);
+
+    constructor(
+        address _storage
+    ) Controllable(_storage) {}
+
+    function notifyFee(
+        address _token,
+        uint256 _profitSharingFee,
+        uint256 _strategistFee,
+        uint256 _platformFee
+    ) external {
+        _notifyFee(
+            _token,
+            _profitSharingFee,
+            _strategistFee,
+            _platformFee
+        );
+    }
+
+    function _notifyFee(
+        address _token,
+        uint256 _profitSharingFee,
+        uint256 _strategistFee,
+        uint256 _platformFee
+    ) internal {
+        address _controller = controller();
+        address liquidator = IController(_controller).universalLiquidator();
+
+        uint totalTransferAmount = _profitSharingFee.add(_strategistFee).add(_platformFee);
+        require(totalTransferAmount > 0, "totalTransferAmount should not be 0");
+        IERC20(_token).safeTransferFrom(msg.sender, address(this), totalTransferAmount);
+
+        address _targetToken = IController(_controller).targetToken();
+
+        if (_token != _targetToken) {
+            IERC20(_token).safeApprove(liquidator, 0);
+            IERC20(_token).safeApprove(liquidator, _platformFee);
+
+            uint amountOutMin = 1;
+
+            if (_platformFee > 0) {
+                IUniversalLiquidator(liquidator).swap(
+                    _token,
+                    _targetToken,
+                    _platformFee,
+                    amountOutMin,
+                    IController(_controller).protocolFeeReceiver()
+                );
+            }
+        } else {
+            IERC20(_targetToken).safeTransfer(IController(_controller).protocolFeeReceiver(), _platformFee);
+        }
+
+        if (_token != iFARM) {
+            IERC20(_token).safeApprove(liquidator, 0);
+            IERC20(_token).safeApprove(liquidator, _profitSharingFee.add(_strategistFee));
+
+            uint amountOutMin = 1;
+
+            if (_profitSharingFee > 0) {
+                IUniversalLiquidator(liquidator).swap(
+                    _token,
+                    iFARM,
+                    _profitSharingFee,
+                    amountOutMin,
+                    IController(_controller).profitSharingReceiver()
+                );
+            }
+            if (_strategistFee > 0) {
+                IUniversalLiquidator(liquidator).swap(
+                    _token,
+                    iFARM,
+                    _strategistFee,
+                    amountOutMin,
+                    IStrategy(msg.sender).strategist()
+                );
+            }
+        } else {
+            if (_strategistFee > 0) {
+                IERC20(iFARM).safeTransfer(IStrategy(msg.sender).strategist(), _strategistFee);
+            }
+            IERC20(iFARM).safeTransfer(IController(_controller).profitSharingReceiver(), _profitSharingFee);
+        }
+    }
+}

package/contracts/base/VaultProxy.sol

@@ -0,0 +1,34 @@
+// SPDX-License-Identifier: Unlicense
+pragma solidity 0.8.26;
+
+import "./interface/IUpgradeSource.sol";
+import "./upgradability/BaseUpgradeabilityProxy.sol";
+
+contract VaultProxy is BaseUpgradeabilityProxy {
+
+  constructor(address _implementation) {
+    _setImplementation(_implementation);
+  }
+
+  /**
+  * The main logic. If the timer has elapsed and there is a schedule upgrade,
+  * the governance can upgrade the vault
+  */
+  function upgrade() external {
+    (bool should, address newImplementation) = IUpgradeSource(address(this)).shouldUpgrade();
+    require(should, "Upgrade not scheduled");
+    _upgradeTo(newImplementation);
+
+    // the finalization needs to be executed on itself to update the storage of this proxy
+    // it also needs to be invoked by the governance, not by address(this), so delegatecall is needed
+    (bool success,) = address(this).delegatecall(
+      abi.encodeWithSignature("finalizeUpgrade()")
+    );
+
+    require(success, "Issue when finalizing the upgrade");
+  }
+
+  function implementation() external view returns (address) {
+    return _implementation();
+  }
+}