@harvest-finance/harvest-strategy-arbitrum 0.0.1-security → 1.0.0

package/README.md

@@ -1,5 +1,127 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=%40harvest-finance%2Fharvest-strategy-arbitrum for more information.
+# Arbitrum Chain: Harvest Strategy Development
+
+This [Hardhat](https://hardhat.org/) environment is configured to use Mainnet fork by default and provides templates and utilities for strategy development and testing.
+
+## Installation
+
+1. Run `npm install` to install all the dependencies.
+2. Sign up on [Alchemy](https://dashboard.alchemyapi.io/signup/). We recommend using Alchemy over Infura to allow for a reproducible
+Mainnet fork testing environment as well as efficiency due to caching.
+3. Create a file `dev-keys.json`:
+  ```
+    {
+      "alchemyKey": "<your-alchemy-key>"
+    }
+  ```
+
+## Run
+
+All tests are located under the `test` folder.
+
+1. Run `npx hardhat test [test file location]`: `npx hardhat test ./test/balancer/wsteth-usdc.js` (if for some reason the NodeJS heap runs out of memory, make sure to explicitly increase its size via `export NODE_OPTIONS=--max_old_space_size=4096`). This will produce the following output:
+  ```
+  Arbitrum Mainnet Balancer wstETH-USDC
+Impersonating...
+0x6a74649aCFD7822ae8Fb78463a9f2192752E5Aa2
+0x0345Bc8EDdbba03E11e366cFb4E2b232b8f1b739
+Fetching Underlying at:  0x178E029173417b1F9C8bC16DCeC6f697bC323746
+New Vault Deployed:  0xa4B5Ad0ca0E05ea73E59046CBCb6b3641318c9d3
+Strategy Deployed:  0xf47FCd7914b24676C78222Af1431f4826B368F30
+    Happy path
+loop  0
+old shareprice:  1000000000000000000
+new shareprice:  1000000000000000000
+growth:  1
+instant APR: 0 %
+instant APY: 0 %
+loop  1
+old shareprice:  1000000000000000000
+new shareprice:  1000068403677420556
+growth:  1.0000684036774206
+instant APR: 26.04926042303911 %
+instant APY: 29.74485660521895 %
+loop  2
+old shareprice:  1000068403677420556
+new shareprice:  1000131319321304444
+growth:  1.0000629113405168
+instant APR: 23.95768699115301 %
+instant APY: 27.061149684423057 %
+loop  3
+old shareprice:  1000131319321304444
+new shareprice:  1000193897701257046
+growth:  1.0000625701632813
+instant APR: 23.827761013559037 %
+instant APY: 26.896279294823277 %
+loop  4
+old shareprice:  1000193897701257046
+new shareprice:  1000256321542735812
+growth:  1.000062411739986
+instant APR: 23.767430782293474 %
+instant APY: 26.819795416465155 %
+loop  5
+old shareprice:  1000256321542735812
+new shareprice:  1000318634555811359
+growth:  1.0000622970450008
+instant APR: 23.723753020397634 %
+instant APY: 26.76445146036619 %
+loop  6
+old shareprice:  1000318634555811359
+new shareprice:  1000380840931449184
+growth:  1.0000621865608508
+instant APR: 23.681678814655715 %
+instant APY: 26.711162141078937 %
+loop  7
+old shareprice:  1000380840931449184
+new shareprice:  1000442949039498353
+growth:  1.0000620844637442
+instant APR: 23.642798534864234 %
+instant APY: 26.661937967659497 %
+loop  8
+old shareprice:  1000442949039498353
+new shareprice:  1000479005035224559
+growth:  1.0000360400318287
+instant APR: 13.724644787553073 %
+instant APY: 14.708122498585574 %
+loop  9
+old shareprice:  1000479005035224559
+new shareprice:  1000479005035224559
+growth:  1
+instant APR: 0 %
+instant APY: 0 %
+earned!
+APR: 18.24131008308575 %
+APY: 20.005517445690145 %
+      ✔ Farmer should earn money (32947ms)
+
+
+  1 passing (37s)
+  ```
+
+## Develop
+
+Under `contracts/strategies`, there are plenty of examples to choose from in the repository already, therefore, creating a strategy is no longer a complicated task. Copy-pasting existing strategies with minor modifications is acceptable.
+
+Under `contracts/base`, there are existing base interfaces and contracts that can speed up development.
+
+## Contribute
+
+When ready, open a pull request with the following information:
+1. Instructions on how to run the test and at which block number
+2. A **mainnet fork test output** (like the one above in the README) clearly showing the increases of share price
+3. Info about the protocol, including:
+   - Live farm page(s)
+   - GitHub link(s)
+   - Etherscan link(s)
+   - Start/end dates for rewards
+   - Any limitations (e.g., maximum pool size)
+   - Current pool sizes used for liquidation (to make sure they are not too shallow)
+
+   The first few items can be omitted for well-known protocols (such as `curve.fi`).
+
+5. A description of **potential value** for Harvest: why should your strategy be live? High APYs, decent pool sizes, longevity of rewards, well-secured protocols, high-potential collaborations, etc.
+
+A more extensive checklist for assessing protocols and farming opportunities can be found [here](https://www.notion.so/harvestfinance/Farm-ops-check-list-7cd2e0d9da364252ac465cb8a176f0e0)
+
+## Deployment
+
+If your pull request is merged and given a green light for deployment, the Harvest team will take care of on-chain deployment.

package/contracts/base/Controller.sol

@@ -0,0 +1,358 @@
+// SPDX-License-Identifier: Unlicense
+pragma solidity 0.8.26;
+
+import "@openzeppelin/contracts/utils/Address.sol";
+import "@openzeppelin/contracts/utils/math/SafeMath.sol";
+import "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";
+import "@openzeppelin/contracts/token/ERC20/IERC20.sol";
+
+import "./inheritance/Governable.sol";
+
+import "./interface/IController.sol";
+import "./interface/IStrategy.sol";
+import "./interface/IVault.sol";
+
+import "./RewardForwarder.sol";
+
+
+contract Controller is Governable {
+    using SafeERC20 for IERC20;
+    using Address for address;
+    using SafeMath for uint256;
+
+    // ========================= Fields =========================
+
+    // external parties
+    address public targetToken;
+    address public protocolFeeReceiver;
+    address public profitSharingReceiver;
+    address public rewardForwarder;
+    address public universalLiquidator;
+    address public dolomiteYieldFarmingRouter;
+
+    uint256 public nextImplementationDelay;
+
+    /// 15% of fees captured go to iFARM stakers
+    uint256 public profitSharingNumerator = 700;
+    uint256 public nextProfitSharingNumerator = 0;
+    uint256 public nextProfitSharingNumeratorTimestamp = 0;
+
+    /// 5% of fees captured go to strategists
+    uint256 public strategistFeeNumerator = 0;
+    uint256 public nextStrategistFeeNumerator = 0;
+    uint256 public nextStrategistFeeNumeratorTimestamp = 0;
+
+    /// 5% of fees captured go to the devs of the platform
+    uint256 public platformFeeNumerator = 300;
+    uint256 public nextPlatformFeeNumerator = 0;
+    uint256 public nextPlatformFeeNumeratorTimestamp = 0;
+
+    /// used for queuing a new delay
+    uint256 public tempNextImplementationDelay = 0;
+    uint256 public tempNextImplementationDelayTimestamp = 0;
+
+    uint256 public constant MAX_TOTAL_FEE = 3000;
+    uint256 public constant FEE_DENOMINATOR = 10000;
+
+    /// @notice This mapping allows certain contracts to stake on a user's behalf
+    mapping (address => bool) public addressWhitelist;
+    mapping (bytes32 => bool) public codeWhitelist;
+
+    // All eligible hardWorkers that we have
+    mapping (address => bool) public hardWorkers;
+
+    // ========================= Events =========================
+
+    event QueueProfitSharingChange(uint profitSharingNumerator, uint validAtTimestamp);
+    event ConfirmProfitSharingChange(uint profitSharingNumerator);
+
+    event QueueStrategistFeeChange(uint strategistFeeNumerator, uint validAtTimestamp);
+    event ConfirmStrategistFeeChange(uint strategistFeeNumerator);
+
+    event QueuePlatformFeeChange(uint platformFeeNumerator, uint validAtTimestamp);
+    event ConfirmPlatformFeeChange(uint platformFeeNumerator);
+
+    event QueueNextImplementationDelay(uint implementationDelay, uint validAtTimestamp);
+    event ConfirmNextImplementationDelay(uint implementationDelay);
+
+    event AddedAddressToWhitelist(address indexed _address);
+    event RemovedAddressFromWhitelist(address indexed _address);
+
+    event AddedCodeToWhitelist(address indexed _address);
+    event RemovedCodeFromWhitelist(address indexed _address);
+
+    event SharePriceChangeLog(
+        address indexed vault,
+        address indexed strategy,
+        uint256 oldSharePrice,
+        uint256 newSharePrice,
+        uint256 timestamp
+    );
+
+    // ========================= Modifiers =========================
+
+    modifier onlyHardWorkerOrGovernance() {
+        require(hardWorkers[msg.sender] || (msg.sender == governance()),
+            "only hard worker can call this");
+        _;
+    }
+
+    constructor(
+        address _storage,
+        address _targetToken,
+        address _protocolFeeReceiver,
+        address _profitSharingReceiver,
+        address _rewardForwarder,
+        address _universalLiquidator,
+        uint _nextImplementationDelay
+    )
+    Governable(_storage)
+    {
+        require(_targetToken != address(0), "_targetToken should not be empty");
+        require(_protocolFeeReceiver != address(0), "_protocolFeeReceiver should not be empty");
+        require(_profitSharingReceiver != address(0), "_profitSharingReceiver should not be empty");
+        require(_rewardForwarder != address(0), "_rewardForwarder should not be empty");
+        require(_nextImplementationDelay > 0, "_nextImplementationDelay should be gt 0");
+
+        targetToken = _targetToken;
+        protocolFeeReceiver = _protocolFeeReceiver;
+        profitSharingReceiver = _profitSharingReceiver;
+        rewardForwarder = _rewardForwarder;
+        universalLiquidator = _universalLiquidator;
+        nextImplementationDelay = _nextImplementationDelay;
+    }
+
+        // [Grey list]
+    // An EOA can safely interact with the system no matter what.
+    // If you're using Metamask, you're using an EOA.
+    // Only smart contracts may be affected by this grey list.
+    //
+    // This contract will not be able to ban any EOA from the system
+    // even if an EOA is being added to the greyList, he/she will still be able
+    // to interact with the whole system as if nothing happened.
+    // Only smart contracts will be affected by being added to the greyList.
+    function greyList(address _addr) public view returns (bool) {
+        return !addressWhitelist[_addr] && !codeWhitelist[getContractHash(_addr)];
+    }
+
+    // Only smart contracts will be affected by the whitelist.
+    function addToWhitelist(address _target) public onlyGovernance {
+        addressWhitelist[_target] = true;
+        emit AddedAddressToWhitelist(_target);
+    }
+
+    function addMultipleToWhitelist(address[] memory _targets) public onlyGovernance {
+        for (uint256 i = 0; i < _targets.length; i++) {
+        addressWhitelist[_targets[i]] = true;
+        }
+    }
+
+    function removeFromWhitelist(address _target) public onlyGovernance {
+        addressWhitelist[_target] = false;
+        emit RemovedAddressFromWhitelist(_target);
+    }
+
+    function removeMultipleFromWhitelist(address[] memory _targets) public onlyGovernance {
+        for (uint256 i = 0; i < _targets.length; i++) {
+        addressWhitelist[_targets[i]] = false;
+        }
+    }
+
+    function getContractHash(address a) public view returns (bytes32 hash) {
+        assembly {
+        hash := extcodehash(a)
+        }
+    }
+
+    function addCodeToWhitelist(address _target) public onlyGovernance {
+        codeWhitelist[getContractHash(_target)] = true;
+        emit AddedCodeToWhitelist(_target);
+    }
+
+    function removeCodeFromWhitelist(address _target) public onlyGovernance {
+        codeWhitelist[getContractHash(_target)] = false;
+        emit RemovedCodeFromWhitelist(_target);
+    }
+
+    function setRewardForwarder(address _rewardForwarder) public onlyGovernance {
+        require(_rewardForwarder != address(0), "new reward forwarder should not be empty");
+        rewardForwarder = _rewardForwarder;
+    }
+
+    function setTargetToken(address _targetToken) public onlyGovernance {
+        require(_targetToken != address(0), "new target token should not be empty");
+        targetToken = _targetToken;
+    }
+
+    function setProfitSharingReceiver(address _profitSharingReceiver) public onlyGovernance {
+        require(_profitSharingReceiver != address(0), "new profit sharing receiver should not be empty");
+        profitSharingReceiver = _profitSharingReceiver;
+    }
+
+    function setProtocolFeeReceiver(address _protocolFeeReceiver) public onlyGovernance {
+        require(_protocolFeeReceiver != address(0), "new protocol fee receiver should not be empty");
+        protocolFeeReceiver = _protocolFeeReceiver;
+    }
+
+    function setUniversalLiquidator(address _universalLiquidator) public onlyGovernance {
+        require(_universalLiquidator != address(0), "new universal liquidator should not be empty");
+        universalLiquidator = _universalLiquidator;
+    }
+
+    function setDolomiteYieldFarmingRouter(address _dolomiteYieldFarmingRouter) public onlyGovernance {
+        require(_dolomiteYieldFarmingRouter != address(0), "new reward forwarder should not be empty");
+        dolomiteYieldFarmingRouter = _dolomiteYieldFarmingRouter;
+    }
+
+    function getPricePerFullShare(address _vault) public view returns (uint256) {
+        return IVault(_vault).getPricePerFullShare();
+    }
+
+    function doHardWork(address _vault) external onlyHardWorkerOrGovernance {
+        uint256 oldSharePrice = IVault(_vault).getPricePerFullShare();
+        IVault(_vault).doHardWork();
+        emit SharePriceChangeLog(
+            _vault,
+            IVault(_vault).strategy(),
+            oldSharePrice,
+            IVault(_vault).getPricePerFullShare(),
+            block.timestamp
+        );
+    }
+
+    function addHardWorker(address _worker) public onlyGovernance {
+        require(_worker != address(0), "_worker must be defined");
+        hardWorkers[_worker] = true;
+    }
+
+    function removeHardWorker(address _worker) public onlyGovernance {
+        require(_worker != address(0), "_worker must be defined");
+        hardWorkers[_worker] = false;
+    }
+
+    // transfers token in the controller contract to the governance
+    function salvage(address _token, uint256 _amount) external onlyGovernance {
+        IERC20(_token).safeTransfer(governance(), _amount);
+    }
+
+    function salvageStrategy(address _strategy, address _token, uint256 _amount) external onlyGovernance {
+        // the strategy is responsible for maintaining the list of
+        // salvageable tokens, to make sure that governance cannot come
+        // in and take away the coins
+        IStrategy(_strategy).salvageToken(governance(), _token, _amount);
+    }
+
+    function feeDenominator() public pure returns (uint) {
+        // keep the interface for this function as a `view` for now, in case it changes in the future
+        return FEE_DENOMINATOR;
+    }
+
+    function setProfitSharingNumerator(uint _profitSharingNumerator) public onlyGovernance {
+        require(
+            _profitSharingNumerator + strategistFeeNumerator + platformFeeNumerator <= MAX_TOTAL_FEE,
+            "total fee too high"
+        );
+
+        nextProfitSharingNumerator = _profitSharingNumerator;
+        nextProfitSharingNumeratorTimestamp = block.timestamp + nextImplementationDelay;
+        emit QueueProfitSharingChange(nextProfitSharingNumerator, nextProfitSharingNumeratorTimestamp);
+    }
+
+    function confirmSetProfitSharingNumerator() public onlyGovernance {
+        require(
+            nextProfitSharingNumerator != 0
+            && nextProfitSharingNumeratorTimestamp != 0
+            && block.timestamp >= nextProfitSharingNumeratorTimestamp,
+            "invalid timestamp or no new profit sharing numerator confirmed"
+        );
+        require(
+            nextProfitSharingNumerator + strategistFeeNumerator + platformFeeNumerator <= MAX_TOTAL_FEE,
+            "total fee too high"
+        );
+
+        profitSharingNumerator = nextProfitSharingNumerator;
+        nextProfitSharingNumerator = 0;
+        nextProfitSharingNumeratorTimestamp = 0;
+        emit ConfirmProfitSharingChange(profitSharingNumerator);
+    }
+
+    function setStrategistFeeNumerator(uint _strategistFeeNumerator) public onlyGovernance {
+        require(
+            _strategistFeeNumerator + platformFeeNumerator + profitSharingNumerator <= MAX_TOTAL_FEE,
+            "total fee too high"
+        );
+
+        nextStrategistFeeNumerator = _strategistFeeNumerator;
+        nextStrategistFeeNumeratorTimestamp = block.timestamp + nextImplementationDelay;
+        emit QueueStrategistFeeChange(nextStrategistFeeNumerator, nextStrategistFeeNumeratorTimestamp);
+    }
+
+    function confirmSetStrategistFeeNumerator() public onlyGovernance {
+        require(
+            nextStrategistFeeNumerator != 0
+            && nextStrategistFeeNumeratorTimestamp != 0
+            && block.timestamp >= nextStrategistFeeNumeratorTimestamp,
+            "invalid timestamp or no new strategist fee numerator confirmed"
+        );
+        require(
+            nextStrategistFeeNumerator + platformFeeNumerator + profitSharingNumerator <= MAX_TOTAL_FEE,
+            "total fee too high"
+        );
+
+        strategistFeeNumerator = nextStrategistFeeNumerator;
+        nextStrategistFeeNumerator = 0;
+        nextStrategistFeeNumeratorTimestamp = 0;
+        emit ConfirmStrategistFeeChange(strategistFeeNumerator);
+    }
+
+    function setPlatformFeeNumerator(uint _platformFeeNumerator) public onlyGovernance {
+        require(
+            _platformFeeNumerator + strategistFeeNumerator + profitSharingNumerator <= MAX_TOTAL_FEE,
+            "total fee too high"
+        );
+
+        nextPlatformFeeNumerator = _platformFeeNumerator;
+        nextPlatformFeeNumeratorTimestamp = block.timestamp + nextImplementationDelay;
+        emit QueuePlatformFeeChange(nextPlatformFeeNumerator, nextPlatformFeeNumeratorTimestamp);
+    }
+
+    function confirmSetPlatformFeeNumerator() public onlyGovernance {
+        require(
+            nextPlatformFeeNumerator != 0
+            && nextPlatformFeeNumeratorTimestamp != 0
+            && block.timestamp >= nextPlatformFeeNumeratorTimestamp,
+            "invalid timestamp or no new platform fee numerator confirmed"
+        );
+        require(
+            nextPlatformFeeNumerator + strategistFeeNumerator + profitSharingNumerator <= MAX_TOTAL_FEE,
+            "total fee too high"
+        );
+
+        platformFeeNumerator = nextPlatformFeeNumerator;
+        nextPlatformFeeNumerator = 0;
+        nextPlatformFeeNumeratorTimestamp = 0;
+        emit ConfirmPlatformFeeChange(platformFeeNumerator);
+    }
+
+    function setNextImplementationDelay(uint256 _nextImplementationDelay) public onlyGovernance {
+        require(
+            _nextImplementationDelay > 0,
+            "invalid _nextImplementationDelay"
+        );
+
+        tempNextImplementationDelay = _nextImplementationDelay;
+        tempNextImplementationDelayTimestamp = block.timestamp + nextImplementationDelay;
+        emit QueueNextImplementationDelay(tempNextImplementationDelay, tempNextImplementationDelayTimestamp);
+    }
+
+    function confirmNextImplementationDelay() public onlyGovernance {
+        require(
+            tempNextImplementationDelayTimestamp != 0 && block.timestamp >= tempNextImplementationDelayTimestamp,
+            "invalid timestamp or no new implementation delay confirmed"
+        );
+        nextImplementationDelay = tempNextImplementationDelay;
+        tempNextImplementationDelay = 0;
+        tempNextImplementationDelayTimestamp = 0;
+        emit ConfirmNextImplementationDelay(nextImplementationDelay);
+    }
+}

package/contracts/base/Drip.sol

@@ -0,0 +1,86 @@
+// SPDX-License-Identifier: Unlicense
+pragma solidity 0.8.26;
+
+import "@openzeppelin/contracts/utils/Address.sol";
+import "@openzeppelin/contracts/utils/math/Math.sol";
+import "@openzeppelin/contracts/utils/math/SafeMath.sol";
+import "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";
+import "@openzeppelin/contracts/token/ERC20/IERC20.sol";
+
+import "./inheritance/Controllable.sol";
+import "./interface/IERC4626.sol";
+
+contract Drip is Controllable {
+    using SafeERC20 for IERC20;
+    using Address for address;
+    using SafeMath for uint256;
+
+    event DripAdded(DripMode mode, address vault, uint256 perSecond);
+    event DripRemoved(DripMode mode, address vault, uint256 perSecond);
+    event Dripped(address vault, uint256 amount);
+
+    enum DripMode { TokenAmount, FixedRate}
+
+    struct DripInfo {
+        DripMode mode;
+        address vault;
+        uint256 perSecond;
+        uint256 lastDripTime;
+    }
+
+    DripInfo[] public drips;
+
+    constructor(address _storage) Controllable(_storage) {}
+
+    function addDrip(DripMode _mode, address _vault, uint256 _perSecond) public onlyGovernance {
+        drips.push(DripInfo({
+            mode: _mode,
+            vault: _vault,
+            perSecond: _perSecond,
+            lastDripTime: block.timestamp
+        }));
+        emit DripAdded(_mode, _vault, _perSecond);
+    }
+
+    function removeDrip(uint256 _dripIndex) public onlyGovernance {
+        require(_dripIndex < drips.length, "Invalid index");
+        emit DripRemoved(drips[_dripIndex].mode, drips[_dripIndex].vault, drips[_dripIndex].perSecond);
+        drips[_dripIndex] = drips[drips.length - 1];
+        drips.pop();
+    }
+
+    function drip(uint256 _dripIndex) public {
+        require(_dripIndex < drips.length, "Invalid index");
+        DripInfo storage dripInfo = drips[_dripIndex];
+        uint256 timePassed = block.timestamp.sub(dripInfo.lastDripTime);
+        if (timePassed > 0) {
+            address token = IERC4626(dripInfo.vault).asset();
+            uint256 amount;
+            if (dripInfo.mode == DripMode.TokenAmount) {
+                amount = dripInfo.perSecond.mul(timePassed);
+            } else if (dripInfo.mode == DripMode.FixedRate) {
+                uint256 totalAssets = IERC4626(dripInfo.vault).totalAssets();
+                uint256 rate = dripInfo.perSecond.mul(timePassed);
+                amount = totalAssets.mul(rate).div(1e18);
+            } else {
+                revert("Invalid drip mode");
+            }
+            uint256 balance = IERC20(token).balanceOf(address(this));
+            if (Math.min(amount, balance) > 0) {
+                dripInfo.lastDripTime = block.timestamp;
+                IERC20(token).safeTransfer(dripInfo.vault, Math.min(amount, balance));
+                emit Dripped(dripInfo.vault, Math.min(amount, balance));
+            }
+        }
+    }
+
+    function dripAll() public {
+        for (uint256 i = 0; i < drips.length; i++) {
+            drip(i);
+        }
+    }
+
+    function salvage(address _token, uint256 _amount) public onlyGovernance {
+        IERC20(_token).safeTransfer(governance(), _amount);
+    }
+}