@harvest-finance/harvest-strategy-polygon 0.0.1-security → 1.0.0

package/contracts/base/ape-base/MiniApeV2Strategy.sol

@@ -0,0 +1,322 @@
+//SPDX-License-Identifier: Unlicense
+
+pragma solidity 0.6.12;
+
+import "@openzeppelin/contracts/math/Math.sol";
+import "@openzeppelin/contracts/math/SafeMath.sol";
+import "@openzeppelin/contracts/token/ERC20/SafeERC20.sol";
+import "@uniswap/v2-periphery/contracts/interfaces/IUniswapV2Router02.sol";
+import "@uniswap/v2-core/contracts/interfaces/IUniswapV2Pair.sol";
+import "../interface/IVault.sol";
+import "../upgradability/BaseUpgradeableStrategy.sol";
+import "./interface/IMiniChefV2.sol";
+import "@uniswap/v2-periphery/contracts/interfaces/IWETH.sol";
+
+
+contract MiniApeV2Strategy is BaseUpgradeableStrategy {
+
+  using SafeMath for uint256;
+  using SafeERC20 for IERC20;
+
+  address public constant apeswapRouterV2 = address(0xC0788A3aD43d79aa53B09c2EaCc313A787d1d607);
+
+  // additional storage slots (on top of BaseUpgradeableStrategy ones) are defined here
+  bytes32 internal constant _POOLID_SLOT = 0x3fd729bfa2e28b7806b03a6e014729f59477b530f995be4d51defc9dad94810b;
+
+  // this would be reset on each upgrade
+  mapping (address => address[]) public uniswapRoutes;
+
+  constructor() public BaseUpgradeableStrategy() {
+    assert(_POOLID_SLOT == bytes32(uint256(keccak256("eip1967.strategyStorage.poolId")) - 1));
+  }
+
+  function initializeBaseStrategy(
+    address _storage,
+    address _underlying,
+    address _vault,
+    address _rewardPool,
+    address _rewardToken,
+    uint256 _poolID
+  ) public initializer {
+
+    BaseUpgradeableStrategy.initialize(
+      _storage,
+      _underlying,
+      _vault,
+      _rewardPool,
+      _rewardToken,
+      80, // profit sharing numerator
+      1000, // profit sharing denominator
+      true, // sell
+      1e18, // sell floor
+      12 hours // implementation change delay
+    );
+
+    require(address(IMiniChefV2(rewardPool()).lpToken(_poolID)) == underlying(), "Pool Info does not match underlying");
+    _setPoolId(_poolID);
+
+    address uniLPComponentToken0 = IUniswapV2Pair(underlying()).token0();
+    address uniLPComponentToken1 = IUniswapV2Pair(underlying()).token1();
+
+    // these would be required to be initialized separately by governance
+    uniswapRoutes[uniLPComponentToken0] = new address[](0);
+    uniswapRoutes[uniLPComponentToken1] = new address[](0);
+
+  }
+
+  function depositArbCheck() public pure returns(bool) {
+    return true;
+  }
+
+  function rewardPoolBalance() internal view returns (uint256 bal) {
+      (bal,) = IMiniChefV2(rewardPool()).userInfo(poolId(), address(this));
+  }
+
+  function exitRewardPool() internal {
+      uint256 bal = rewardPoolBalance();
+      if (bal != 0) {
+          IMiniChefV2(rewardPool()).withdrawAndHarvest(poolId(), bal, address(this));
+      }
+  }
+
+  function emergencyExitRewardPool() internal {
+      uint256 bal = rewardPoolBalance();
+      if (bal != 0) {
+          IMiniChefV2(rewardPool()).emergencyWithdraw(poolId(), address(this));
+      }
+  }
+
+  function harvestReward() internal {
+      IMiniChefV2(rewardPool()).harvest(poolId(), address(this));
+  }
+
+  function unsalvagableTokens(address token) public view returns (bool) {
+    return (token == rewardToken() || token == underlying());
+  }
+
+  function enterRewardPool() internal {
+    uint256 entireBalance = IERC20(underlying()).balanceOf(address(this));
+    IERC20(underlying()).safeApprove(rewardPool(), 0);
+    IERC20(underlying()).safeApprove(rewardPool(), entireBalance);
+    IMiniChefV2(rewardPool()).deposit(poolId(), entireBalance, address(this));
+  }
+
+  /*
+  *   In case there are some issues discovered about the pool or underlying asset
+  *   Governance can exit the pool properly
+  *   The function is only used for emergency to exit the pool
+  */
+  function emergencyExit() public onlyGovernance {
+    emergencyExitRewardPool();
+    _setPausedInvesting(true);
+  }
+
+  /*
+  *   Resumes the ability to invest into the underlying reward pools
+  */
+
+  function continueInvesting() public onlyGovernance {
+    _setPausedInvesting(false);
+  }
+
+  function setLiquidationPath(address _token, address [] memory _route) public onlyGovernance {
+    uniswapRoutes[_token] = _route;
+  }
+
+  // We assume that all the tradings can be done on Uniswap
+  function _liquidateReward() internal {
+    // we can accept 1 as minimum because this is called only by a trusted role
+    uint256 amountOutMin = 1;
+
+    uint256 rewardBalance = IERC20(rewardToken()).balanceOf(address(this));
+    if (!sell() || rewardBalance < sellFloor()) {
+      // Profits can be disabled for possible simplified and rapid exit
+      emit ProfitsNotCollected(sell(), rewardBalance < sellFloor());
+      return;
+    }
+
+    notifyProfitInRewardToken(rewardBalance);
+    uint256 remainingRewardBalance = IERC20(rewardToken()).balanceOf(address(this));
+
+    if (remainingRewardBalance == 0) {
+      return;
+    }
+
+    // allow Uniswap to sell our reward
+    IERC20(rewardToken()).safeApprove(apeswapRouterV2, 0);
+    IERC20(rewardToken()).safeApprove(apeswapRouterV2, remainingRewardBalance);
+
+
+    address uniLPComponentToken0 = IUniswapV2Pair(underlying()).token0();
+    address uniLPComponentToken1 = IUniswapV2Pair(underlying()).token1();
+
+    uint256 toToken0 = remainingRewardBalance.div(2);
+    uint256 toToken1 = remainingRewardBalance.sub(toToken0);
+
+    uint256 token0Amount;
+
+    if (uniswapRoutes[uniLPComponentToken0].length > 1) {
+      // if we need to liquidate the token0
+      IUniswapV2Router02(apeswapRouterV2).swapExactTokensForTokens(
+        toToken0,
+        amountOutMin,
+        uniswapRoutes[uniLPComponentToken0],
+        address(this),
+        block.timestamp
+      );
+      token0Amount = IERC20(uniLPComponentToken0).balanceOf(address(this));
+    } else {
+      // otherwise we assme token0 is the reward token itself
+      token0Amount = toToken0;
+    }
+
+    uint256 token1Amount;
+
+    if (uniswapRoutes[uniLPComponentToken1].length > 1) {
+      // sell reward token to token1
+      IUniswapV2Router02(apeswapRouterV2).swapExactTokensForTokens(
+        toToken1,
+        amountOutMin,
+        uniswapRoutes[uniLPComponentToken1],
+        address(this),
+        block.timestamp
+      );
+      token1Amount = IERC20(uniLPComponentToken1).balanceOf(address(this));
+    } else {
+      token1Amount = toToken1;
+    }
+
+    // provide token1 and token2 to ape
+    IERC20(uniLPComponentToken0).safeApprove(apeswapRouterV2, 0);
+    IERC20(uniLPComponentToken0).safeApprove(apeswapRouterV2, token0Amount);
+
+    IERC20(uniLPComponentToken1).safeApprove(apeswapRouterV2, 0);
+    IERC20(uniLPComponentToken1).safeApprove(apeswapRouterV2, token1Amount);
+
+    // we provide liquidity to ape
+    uint256 liquidity;
+    (,,liquidity) = IUniswapV2Router02(apeswapRouterV2).addLiquidity(
+      uniLPComponentToken0,
+      uniLPComponentToken1,
+      token0Amount,
+      token1Amount,
+      1,  // we are willing to take whatever the pair gives us
+      1,  // we are willing to take whatever the pair gives us
+      address(this),
+      block.timestamp
+    );
+
+  }
+
+  /*
+  *   Stakes everything the strategy holds into the reward pool
+  */
+  function investAllUnderlying() internal onlyNotPausedInvesting {
+    // this check is needed, because most of the SNX reward pools will revert if
+    // you try to stake(0).
+    if(IERC20(underlying()).balanceOf(address(this)) > 0) {
+      enterRewardPool();
+    }
+  }
+
+  /*
+  *   Withdraws all the asset to the vault
+  */
+  function withdrawAllToVault() public restricted {
+    if (address(rewardPool()) != address(0)) {
+      exitRewardPool();
+    }
+    _liquidateReward();
+    IERC20(underlying()).safeTransfer(vault(), IERC20(underlying()).balanceOf(address(this)));
+  }
+
+  /*
+  *   Withdraws all the asset to the vault
+  */
+  function withdrawToVault(uint256 amount) public restricted {
+    // Typically there wouldn't be any amount here
+    // however, it is possible because of the emergencyExit
+    uint256 entireBalance = IERC20(underlying()).balanceOf(address(this));
+
+    if(amount > entireBalance){
+      // While we have the check above, we still using SafeMath below
+      // for the peace of mind (in case something gets changed in between)
+      uint256 needToWithdraw = amount.sub(entireBalance);
+      uint256 toWithdraw = Math.min(rewardPoolBalance(), needToWithdraw);
+      IMiniChefV2(rewardPool()).withdraw(poolId(), toWithdraw, address(this));
+    }
+
+    IERC20(underlying()).safeTransfer(vault(), amount);
+  }
+
+  /*
+  *   Note that we currently do not have a mechanism here to include the
+  *   amount of reward that is accrued.
+  */
+  function investedUnderlyingBalance() external view returns (uint256) {
+    if (rewardPool() == address(0)) {
+      return IERC20(underlying()).balanceOf(address(this));
+    }
+    // Adding the amount locked in the reward pool and the amount that is somehow in this contract
+    // both are in the units of "underlying"
+    // The second part is needed because there is the emergency exit mechanism
+    // which would break the assumption that all the funds are always inside of the reward pool
+    return rewardPoolBalance().add(IERC20(underlying()).balanceOf(address(this)));
+  }
+
+  /*
+  *   Governance or Controller can claim coins that are somehow transferred into the contract
+  *   Note that they cannot come in take away coins that are used and defined in the strategy itself
+  */
+  function salvage(address recipient, address token, uint256 amount) external onlyControllerOrGovernance {
+     // To make sure that governance cannot come in and take away the coins
+    require(!unsalvagableTokens(token), "token is defined as not salvagable");
+    IERC20(token).safeTransfer(recipient, amount);
+  }
+
+  /*
+  *   Get the reward, sell it in exchange for underlying, invest what you got.
+  *   It's not much, but it's honest work.
+  *
+  *   Note that although `onlyNotPausedInvesting` is not added here,
+  *   calling `investAllUnderlying()` affectively blocks the usage of `doHardWork`
+  *   when the investing is being paused by governance.
+  */
+  function doHardWork() external onlyNotPausedInvesting restricted {
+    harvestReward();
+    _liquidateReward();
+    investAllUnderlying();
+  }
+
+  /**
+  * Can completely disable claiming BANANA rewards and selling. Good for emergency withdraw in the
+  * simplest possible way.
+  */
+  function setSell(bool s) public onlyGovernance {
+    _setSell(s);
+  }
+
+  /**
+  * Sets the minimum amount of reward needed to trigger a sale.
+  */
+  function setSellFloor(uint256 floor) public onlyGovernance {
+    _setSellFloor(floor);
+  }
+
+  // masterchef rewards pool ID
+  function _setPoolId(uint256 _value) internal {
+    setUint256(_POOLID_SLOT, _value);
+  }
+
+  function poolId() public view returns (uint256) {
+    return getUint256(_POOLID_SLOT);
+  }
+
+  function finalizeUpgrade() external onlyGovernance {
+    _finalizeUpgrade();
+    // reset the liquidation paths
+    // they need to be re-set manually
+    uniswapRoutes[IUniswapV2Pair(underlying()).token0()] = new address[](0);
+    uniswapRoutes[IUniswapV2Pair(underlying()).token1()] = new address[](0);
+  }
+}

package/contracts/base/ape-base/interface/IMiniChefV2.sol

@@ -0,0 +1,31 @@
+// SPDX-License-Identifier: MIT
+pragma solidity 0.6.12;
+pragma experimental ABIEncoderV2;
+
+import "@openzeppelin/contracts/token/ERC20/IERC20.sol";
+import "./IRewarder.sol";
+
+interface IMiniChefV2 {
+    struct UserInfo {
+        uint256 amount;
+        uint256 rewardDebt;
+    }
+
+    struct PoolInfo {
+        uint128 accSushiPerShare;
+        uint64 lastRewardTime;
+        uint64 allocPoint;
+    }
+
+    function rewarder(uint256 _pid) external view returns (IRewarder);
+    function poolLength() external view returns (uint256);
+    function updatePool(uint256 pid) external returns (IMiniChefV2.PoolInfo memory);
+    function userInfo(uint256 _pid, address _user) external view returns (uint256, uint256);
+    function lpToken(uint256 _pid) external view returns (IERC20);
+    function deposit(uint256 pid, uint256 amount, address to) external;
+    function withdraw(uint256 pid, uint256 amount, address to) external;
+    function harvest(uint256 pid, address to) external;
+    function withdrawAndHarvest(uint256 pid, uint256 amount, address to) external;
+    function emergencyWithdraw(uint256 pid, address to) external;
+    function pendingBanana(uint256 _pid, address _user) external view returns (uint256 pending);
+}

package/contracts/base/ape-base/interface/IRewarder.sol

@@ -0,0 +1,10 @@
+// SPDX-License-Identifier: MIT
+
+pragma solidity 0.6.12;
+
+import "@openzeppelin/contracts/token/ERC20/IERC20.sol";
+
+interface IRewarder {
+    function onBananaReward(uint256 pid, address user, address recipient, uint256 bananaAmount, uint256 newLpAmount) external;
+    function pendingTokens(uint256 pid, address user, uint256 bananaAmount) external view returns (IERC20[] memory, uint256[] memory);
+}

package/contracts/base/factory/MegaFactory.sol

@@ -0,0 +1,120 @@
+// SPDX-License-Identifier: Unlicense
+pragma solidity 0.6.12;
+
+import "@openzeppelin/contracts/access/Ownable.sol";
+import "./interface/IStrategyFactory.sol";
+import "./interface/IVaultFactory.sol";
+import "./interface/IPoolFactory.sol";
+
+import "../interface/IVault.sol";
+import "../inheritance/Governable.sol";
+
+contract MegaFactory is Ownable {
+
+  enum VaultType {
+    None,
+    Regular
+  }
+
+  enum StrategyType {
+    None,
+    Upgradable
+  }
+
+  address public potPoolFactory;
+  mapping(uint256 => address) public vaultFactories;
+  mapping(uint256 => address) public strategyFactories;
+
+  struct CompletedDeployment {
+    VaultType vaultType;
+    address Underlying;
+    address NewVault;
+    address NewStrategy;
+    address NewPool;
+  }
+
+  event DeploymentCompleted(string id);
+
+  mapping (string => CompletedDeployment) public completedDeployments;
+  mapping (address => bool) public authorizedDeployers;
+
+  address public multisig;
+  address public actualStorage;
+
+  /* methods to make compatible with Storage */
+  function governance() external view returns (address) {
+    return address(this); // fake governance
+  }
+
+  function isGovernance(address addr) external view returns (bool) {
+    return addr == address(this); // fake governance
+  }
+
+  function isController(address addr) external view returns (bool) {
+    return addr == address(this); // fake controller
+  }
+
+  modifier onlyAuthorizedDeployer(string memory id) {
+    require(completedDeployments[id].vaultType == VaultType.None, "cannot reuse id");
+    require(authorizedDeployers[msg.sender], "unauthorized deployer");
+    _;
+    emit DeploymentCompleted(id);
+  }
+
+  constructor(address _storage, address _multisig) public {
+    multisig = _multisig;
+    actualStorage = _storage;
+    setAuthorization(owner(), true);
+    setAuthorization(multisig, true);
+  }
+
+  function setAuthorization(address userAddress, bool isDeployer) public onlyOwner {
+    authorizedDeployers[userAddress] = isDeployer;
+  }
+
+  function setVaultFactory(uint256 vaultType, address factoryAddress) external onlyOwner {
+    vaultFactories[vaultType] = factoryAddress;
+  }
+
+  function setStrategyFactory(uint256 strategyType, address factoryAddress) external onlyOwner {
+    strategyFactories[strategyType] = factoryAddress;
+  }
+
+  function setPotPoolFactory(address factoryAddress) external onlyOwner {
+    potPoolFactory = factoryAddress;
+  }
+
+  function createRegularVault(string calldata id, address underlying) external onlyAuthorizedDeployer(id) {
+    address vault = IVaultFactory(vaultFactories[uint256(VaultType.Regular)]).deploy(
+     actualStorage,
+     underlying
+    );
+
+    completedDeployments[id] = CompletedDeployment(
+      VaultType.Regular,
+      underlying,
+      vault,
+      address(0),
+      IPoolFactory(potPoolFactory).deploy(actualStorage, vault)
+    );
+  }
+
+  function createRegularVaultUsingUpgradableStrategy(string calldata id, address underlying, address strategyImplementation) external onlyAuthorizedDeployer(id) {
+    address vault = IVaultFactory(vaultFactories[uint256(VaultType.Regular)]).deploy(
+     address(this), // using this as initial storage, then switching to actualStorage
+     underlying
+    );
+
+    address strategy = IStrategyFactory(strategyFactories[uint256(StrategyType.Upgradable)]).deploy(actualStorage, vault, strategyImplementation);
+    IVault(vault).setStrategy(strategy);
+    Governable(vault).setStorage(actualStorage);
+
+    completedDeployments[id] = CompletedDeployment(
+      VaultType.Regular,
+      underlying,
+      vault,
+      strategy,
+      IPoolFactory(potPoolFactory).deploy(actualStorage, vault)
+    );
+  }
+}

package/contracts/base/factory/interface/IPoolFactory.sol

@@ -0,0 +1,6 @@
+// SPDX-License-Identifier: Unlicense
+pragma solidity 0.6.12;
+
+interface IPoolFactory {
+  function deploy(address _storage, address _vault) external returns (address);
+}

package/contracts/base/factory/interface/IStrategyFactory.sol

@@ -0,0 +1,6 @@
+// SPDX-License-Identifier: Unlicense
+pragma solidity 0.6.12;
+
+interface IStrategyFactory {
+  function deploy(address _storage, address _vault, address _providedStrategyAddress) external returns (address);
+}

package/contracts/base/factory/interface/IVaultFactory.sol

@@ -0,0 +1,7 @@
+// SPDX-License-Identifier: Unlicense
+pragma solidity 0.6.12;
+
+interface IVaultFactory {
+  function deploy(address _storage, address _underlying) external returns (address);
+  function info(address vault) external view returns(address Underlying, address NewVault);
+}

package/contracts/base/factory/pool/PotPoolFactory.sol

@@ -0,0 +1,43 @@
+// SPDX-License-Identifier: Unlicense
+pragma solidity 0.6.12;
+
+import "@openzeppelin/contracts/token/ERC20/ERC20.sol";
+import "../../inheritance/Governable.sol";
+import "../../inheritance/OwnableWhitelist.sol";
+import "../interface/IPoolFactory.sol";
+import "../../PotPool.sol";
+
+contract PotPoolFactory is OwnableWhitelist, IPoolFactory {
+  address public iFARM = 0xab0b2ddB9C7e440fAc8E140A89c0dbCBf2d7Bbff;
+  address public wMATIC = 0x0d500B1d8E8eF31E21C99d1Db9A6444d3ADf1270;
+  uint256 public poolDefaultDuration = 604800; // 7 days
+
+  function setPoolDefaultDuration(uint256 _value) external onlyOwner {
+    poolDefaultDuration = _value;
+  }
+
+  function deploy(address actualStorage, address vault) override external onlyWhitelisted returns (address) {
+    address actualGovernance = Governable(vault).governance();
+
+    string memory tokenSymbol = ERC20(vault).symbol();
+    address[] memory rewardDistribution = new address[](1);
+    rewardDistribution[0] = actualGovernance;
+    address[] memory rewardTokens = new address[](2);
+    rewardTokens[0] = iFARM;
+    rewardTokens[1] = wMATIC;
+    PotPool pool = new PotPool(
+      rewardTokens,
+      vault,
+      poolDefaultDuration,
+      rewardDistribution,
+      actualStorage,
+      string(abi.encodePacked("p", tokenSymbol)),
+      string(abi.encodePacked("p", tokenSymbol)),
+      ERC20(vault).decimals()
+    );
+
+    Ownable(pool).transferOwnership(actualGovernance);
+
+    return address(pool);
+  }
+}

package/contracts/base/factory/strategy/UpgradableStrategyFactory.sol

@@ -0,0 +1,19 @@
+// SPDX-License-Identifier: Unlicense
+pragma solidity 0.6.12;
+
+import "../interface/IStrategyFactory.sol";
+import "../../upgradability/StrategyProxy.sol";
+import "../../inheritance/OwnableWhitelist.sol";
+
+interface IInitializableStrategy {
+  function initializeStrategy(address _storage, address _vault) external;
+}
+
+contract UpgradableStrategyFactory is OwnableWhitelist, IStrategyFactory {
+  function deploy(address actualStorage, address vault, address upgradableStrategyImplementation) override external onlyWhitelisted returns (address) {
+    StrategyProxy proxy = new StrategyProxy(upgradableStrategyImplementation);
+    IInitializableStrategy strategy = IInitializableStrategy(address(proxy));
+    strategy.initializeStrategy(actualStorage, vault);
+    return address(proxy);
+  }
+}

package/contracts/base/factory/vault/RegularVaultFactory.sol

@@ -0,0 +1,34 @@
+// SPDX-License-Identifier: Unlicense
+pragma solidity 0.6.12;
+
+import "../../VaultProxy.sol";
+import "../../interface/IVault.sol";
+import "../interface/IVaultFactory.sol";
+import "../../inheritance/OwnableWhitelist.sol";
+
+contract RegularVaultFactory is OwnableWhitelist, IVaultFactory {
+  address public vaultImplementation = 0xCf5F83F8FE0AB0f9E9C1db07E6606dD598b2bbf5;
+  address public lastDeployedAddress = address(0);
+
+  function deploy(address _storage, address underlying) override external onlyWhitelisted returns (address) {
+    lastDeployedAddress = address(new VaultProxy(vaultImplementation));
+    IVault(lastDeployedAddress).initializeVault(
+      _storage,
+      underlying,
+      10000,
+      10000
+    );
+
+    return lastDeployedAddress;
+  }
+
+  function changeDefaultImplementation(address newImplementation) external onlyOwner {
+    require(newImplementation != address(0), "Must be set");
+    vaultImplementation = newImplementation;
+  }
+
+  function info(address vault) override external view returns(address Underlying, address NewVault) {
+    Underlying = IVault(vault).underlying();
+    NewVault = vault;
+  }
+}