@pendle/core-v2 6.11.0 → 6.12.0

package/contracts/interfaces/IPPTLooper.sol

@@ -77,12 +77,17 @@ interface IPPTLooperEIP712Types {
         RequestHeader header;
         uint256 minPtToDebtSwapRate;
         uint256 postWithdrawMaxLTV;
+        /// @notice Hub-only. If true, YT held by the box is approved alongside PT so the router can redeem
+        ///         PT + YT -> SY -> Token instead of swapping PT. YT must be consumed 1:1 with PT.
+        ///         Amount redeemed is min(PT, YT) held by the box; any PT above the YT balance stays in
+        ///         the box. The owner transfers YT in beforehand (the looper never acquires YT itself).
+        bool redeemWithPY;
     }
 
     struct DecreasePositionMessage {
         BoxPermit permit;
         // Hub-only: swap PT→debtToken.
-        /// @notice Set extRouter to address(0) to disable swapping.
+        /// @notice Set extRouter to address(0) to disable swapping. See `DecreasePositionRequest.redeemWithPY`.
         BoxApprovedCall swap;
         // Cross-chain only: hub bridges debt to spoke; spoke bridges PT back to hub.
         BridgeData bridge;
@@ -132,11 +137,19 @@ interface IPPTLooper is IPPTLooperEIP712Types {
         uint32 sessionNonce;
     }
 
+    enum RequestStatus {
+        DEFAULT,
+        PRE_APPROVED
+        /* CANCELLED */
+    }
+
     /// @notice Emitted on the first iteration call of a session, when the implicit init branch
     /// runs (owner signature verified, `userReq.requestHash` set). `sessionNonce` is the
     /// pre-increment value the session was opened with.
     event SessionInitiated(address indexed owner, bytes32 indexed boxId, bytes32 requestHash, uint32 sessionNonce);
 
+    event RequestPreApproved(address indexed owner, bytes32 requestHash);
+
     /// @notice Emitted by `terminateSession`. `sessionNonce` is the post-increment value that
     /// the next user request must match.
     event SessionTerminated(address indexed owner, bytes32 indexed boxId, bytes32 requestHash, uint32 sessionNonce);
@@ -153,6 +166,14 @@ interface IPPTLooper is IPPTLooperEIP712Types {
         uint256 netSwappedOut
     );
 
+    event PYRedeemed(
+        IPLoopPositionBox indexed box,
+        address indexed pt,
+        uint256 netPyIn,
+        address indexed tokenOut,
+        uint256 netSwappedOut
+    );
+
     event TokenBridged(IPLoopPositionBox indexed box, address indexed token, uint256 amount);
 
     event MoneyMarketLentThenBorrowed(IPLoopPositionBox indexed box, uint256 ptLent, uint256 debtBorrowed);
@@ -216,6 +237,8 @@ interface IPPTLooper is IPPTLooperEIP712Types {
 
     function userRequest(address owner, bytes32 boxId) external view returns (UserRequestInfo memory);
 
+    function requestStatus(address owner, bytes32 requestHash) external view returns (RequestStatus);
+
     // ========== Hash functions (exposed for off-chain typed-data tooling) ==========
 
     function hashRaw(BoxPermit memory permit) external pure returns (bytes32);
@@ -256,28 +279,36 @@ interface IPPTLooper is IPPTLooperEIP712Types {
 
     /// @notice One increase iteration. The first call for a `(owner, boxId)` slot also opens
     ///         the session — pass the owner's typed-data signature over `req` in
-    ///         `ownerSigIfFirstCall`. Subsequent iterations within the same session can pass
-    ///         empty bytes for that arg (it is ignored once the session is open).
+    ///         `ownerSigIfFirstCall` (if not pre-approved).
+    /// @notice `ownerSigIfFirstCall` can be passed as empty bytes:
+    ///         - at subsequent iterations within the same session (it is ignored once the session is open).
+    ///         - when the request is pre-approved (see `preApproveRequest`).
     function increaseLoopPosition(
         IncreasePositionMessage memory ms,
         bytes memory proposerSig,
         IncreasePositionRequest memory req,
         bytes memory ownerSigIfFirstCall
-    ) external payable;
+    ) external;
 
     function decreaseLoopPosition(
         DecreasePositionMessage memory ms,
         bytes memory proposerSig,
         DecreasePositionRequest memory req,
         bytes memory ownerSigIfFirstCall
-    ) external payable;
+    ) external;
 
     function swapBridgeWithdrawAll(
         SwapBridgeWithdrawAllMessage memory ms,
         bytes memory proposerSig,
         SwapBridgeWithdrawAllRequest memory req,
         bytes memory ownerSigIfFirstCall
-    ) external payable;
+    ) external;
+
+    /// @notice `msg.sender` call this function to approve a request instead of
+    ///         signing it with `ownerSigIfFirstCall`.
+    ///         The proposer signs the request hash.
+    ///         `ownerSigIfFirstCall` can then be left empty when a session is created.
+    function preApproveRequest(bytes32 requestHash, bytes memory proposerSig) external;
 
     /// @notice Closes the open session at `(owner, boxId)`. `requestHash` must equal the
     ///         currently-stored `userReq.requestHash` (proves the caller identifies which

package/contracts/limit/LimitRouterBase.sol

@@ -28,7 +28,6 @@ abstract contract LimitRouterBase is
 
     uint128 internal constant _ORDER_DOES_NOT_EXIST = 0;
     uint128 internal constant _ORDER_FILLED = 1;
-    uint256 internal constant MAX_LN_FEE_RATE_ROOT = 48_790_164_169_432_003; // ln(1.05)
 
     address public feeRecipient;
 
@@ -519,7 +518,6 @@ abstract contract LimitRouterBase is
 
         for (uint256 i = 0; i < len; i++) {
             require(lnFeeRateRoots[i] > 0 || allowZeroFees, "LOP: zero fee must be allowed explicitly");
-            require(lnFeeRateRoots[i] <= MAX_LN_FEE_RATE_ROOT, "LOP: fee too high");
 
             __lnFeeRateRoot[YTs[i]] = lnFeeRateRoots[i];
         }

package/contracts/offchain-helpers/PendleFeeSetter.sol

@@ -9,13 +9,11 @@ import {IPYieldToken} from "../interfaces/IPYieldToken.sol";
 
 import {BoringOwnableUpgradeableV2} from "../core/libraries/BoringOwnableUpgradeableV2.sol";
 import {Errors} from "../core/libraries/Errors.sol";
-import {LogExpMath} from "../core/libraries/math/LogExpMath.sol";
 import {PMath} from "../core/libraries/math/PMath.sol";
 
 contract PendleFeeSetter is BoringOwnableUpgradeableV2 {
     using PMath for uint256;
     using PMath for int256;
-    using LogExpMath for int256;
 
     event FeeFactorSet(uint128 impliedRateToFeeFactor, uint128 routerLnFeeToLimitLnFeeFactor);
     event SetterSet(address indexed setter);
@@ -106,13 +104,14 @@ contract PendleFeeSetter is BoringOwnableUpgradeableV2 {
     {
         uint256 marketLnFee = IPMarket(market).getNonOverrideLnFeeRateRoot();
         MarketState memory state = IPMarket(market).readState(router);
-        uint256 impliedRate = state.lastLnImpliedRate.Int().exp().Uint();
 
-        uint256 newFee = (impliedRate - PMath.ONE).mulDown(_impliedRateToFeeFactor) + PMath.ONE;
-        uint256 newLnFeeRateRoot = newFee.Int().ln().Uint();
+        // Fee root scales the ln implied rate, so fee / yield = (e^{phi*t} - 1) / (e^{r*t} - 1), which is at most
+        // `factor` and converges to `factor` as expiry approaches. Scaling the annual APY instead
+        // (ln(1 + factor * APY)) overcharges for t < 1 year and blows up at high rates (15000% -> 300% fee root).
+        uint256 newLnFeeRateRoot = state.lastLnImpliedRate.mulDown(_impliedRateToFeeFactor);
 
         routerLnFeeRateRoot = marketLnFee.min(newLnFeeRateRoot);
-        limitLnFeeRateRoot = LIMIT_MAX_LN_FEE_RATE_ROOT.min(routerLnFeeRateRoot.mulDown(_routerLnFeeToLimitLnFeeFactor));
+        limitLnFeeRateRoot = newLnFeeRateRoot.mulDown(_routerLnFeeToLimitLnFeeFactor);
 
         // Fix up `routerLnFeeRateRoot` for this case:
         // https://github.com/pendle-finance/pendle-core-v2/blob/6169376d0a8c12030307e3d64d02e84b07ffe4f9/contracts/core/Market/v3/PendleMarketFactoryV3.sol#L131-L135

package/contracts/offchain-helpers/deploy/PendleCommonPoolDeployHelperV2.sol

@@ -7,15 +7,6 @@ import "../../interfaces/IPCommonSYFactory.sol";
 import "./PendlePoolDeployHelperV2.sol";
 
 contract PendleCommonPoolDeployHelperV2 is PendlePoolDeployHelperV2, BoringOwnableUpgradeableV2 {
-    bytes32 public constant ERC4626_DEPLOY_ID = keccak256("PendleERC4626SYV2"); // 0x1278efc0e6754cd30fef2df25ff5ced072ebb194d348b0b1b9548166d24352ef
-    bytes32 public constant ERC4626_NOT_REDEEMABLE_DEPLOY_ID = keccak256("PendleERC4626NotRedeemableToAssetSYV2"); // 0x6f089cd4afdd945c5c26b3f4542d0c294d19ec0e339c6ce4f8eafa94d700d05d
-    bytes32 public constant ERC20_DEPLOY_ID = keccak256("PendleERC20SY"); // 0xfcf22a9a515753d83e4f2a81cf368c7226408c64f52411ae95241ebf5ed53304
-
-    bytes32 public constant ERC4626_WITH_ADAPTER_ID = keccak256("PendleERC4626WithAdapterSY"); // 0x73f41560741d6765943d3c955034291fe23d9141e3a4719bc97422d5bf019adc
-    bytes32 public constant ERC4626_NO_REDEEM_WITH_ADAPTER_ID = keccak256("PendleERC4626NoRedeemWithAdapterSY"); // 0x3b8dd2b992f773444e5422ba1db289c4657c57110d740dca7975dc095632ef23
-    bytes32 public constant ERC20_WITH_ADAPTER_ID = keccak256("PendleERC20WithAdapterSY"); // 0xe5cce2b1999bf8c2cc4cf6d96d0569a24d8b782ba1647c09a8e1aa8bbfb98996
-    bytes32 public constant ERC4626_NO_DEPOSIT_NO_REDEEM = keccak256("PendleERC4626NoRedeemNoDepositUpgSY"); // 0x5c1cddc0128e0b02bb711f84a022bf1c13177d4ab028830b702f3a77280025ea
-
     address public immutable syFactory;
 
     constructor(address _syFactory, address _router, address _yieldContractFactory, address _marketFactory)
@@ -31,79 +22,18 @@ contract PendleCommonPoolDeployHelperV2 is PendlePoolDeployHelperV2, BoringOwnab
 
     function deployCommonMarketById(
         bytes32 id,
-        bytes memory constructorParams,
-        bytes memory initData,
-        PoolConfig memory config,
-        address tokenToSeedLiqudity,
-        uint256 amountToSeed,
-        address syOwner
-    ) external returns (PoolDeploymentAddrs memory) {
-        address SY = IPCommonSYFactory(syFactory).deployUpgradableSY(id, constructorParams, initData, syOwner);
-        return deploy5115MarketAndSeedLiquidity(SY, config, tokenToSeedLiqudity, amountToSeed);
-    }
-
-    // Those 3 are all not payable as they should not accept tokenIn as native
-
-    function deployERC4626Market(
         bytes memory constructorParams,
         PoolConfig memory config,
         address tokenToSeedLiqudity,
         uint256 amountToSeed,
         address syOwner
     ) external returns (PoolDeploymentAddrs memory) {
-        address SY = IPCommonSYFactory(syFactory).deploySY(ERC4626_DEPLOY_ID, constructorParams, syOwner);
+        address SY = IPCommonSYFactory(syFactory).deploySY(id, constructorParams, syOwner);
         return deploy5115MarketAndSeedLiquidity(SY, config, tokenToSeedLiqudity, amountToSeed);
     }
 
-    function deployERC4626NotRedeemableMarket(
-        bytes memory constructorParams,
-        PoolConfig memory config,
-        address tokenToSeedLiqudity,
-        uint256 amountToSeed,
-        address syOwner
-    ) external returns (PoolDeploymentAddrs memory) {
-        address SY = IPCommonSYFactory(syFactory).deploySY(ERC4626_NOT_REDEEMABLE_DEPLOY_ID, constructorParams, syOwner);
-        return deploy5115MarketAndSeedLiquidity(SY, config, tokenToSeedLiqudity, amountToSeed);
-    }
-
-    function deployERC20Market(
-        bytes memory constructorParams,
-        PoolConfig memory config,
-        address tokenToSeedLiqudity,
-        uint256 amountToSeed,
-        address syOwner
-    ) external returns (PoolDeploymentAddrs memory) {
-        address SY = IPCommonSYFactory(syFactory).deploySY(ERC20_DEPLOY_ID, constructorParams, syOwner);
-        return deploy5115MarketAndSeedLiquidity(SY, config, tokenToSeedLiqudity, amountToSeed);
-    }
-
-    function deployERC4626WithAdapterMarket(
-        bytes memory constructorParams,
-        bytes memory initData,
-        PoolConfig memory config,
-        address tokenToSeedLiqudity,
-        uint256 amountToSeed,
-        address syOwner
-    ) external returns (PoolDeploymentAddrs memory) {
-        address SY = IPCommonSYFactory(syFactory)
-            .deployUpgradableSY(ERC4626_WITH_ADAPTER_ID, constructorParams, initData, syOwner);
-        return deploy5115MarketAndSeedLiquidity(SY, config, tokenToSeedLiqudity, amountToSeed);
-    }
-
-    function deployERC4626NoRedeemWithAdapterMarket(
-        bytes memory constructorParams,
-        bytes memory initData,
-        PoolConfig memory config,
-        address tokenToSeedLiqudity,
-        uint256 amountToSeed,
-        address syOwner
-    ) external returns (PoolDeploymentAddrs memory) {
-        address SY = IPCommonSYFactory(syFactory)
-            .deployUpgradableSY(ERC4626_NO_REDEEM_WITH_ADAPTER_ID, constructorParams, initData, syOwner);
-        return deploy5115MarketAndSeedLiquidity(SY, config, tokenToSeedLiqudity, amountToSeed);
-    }
-
-    function deployERC20WithAdapterMarket(
+    function deployCommonMarketById(
+        bytes32 id,
         bytes memory constructorParams,
         bytes memory initData,
         PoolConfig memory config,
@@ -111,8 +41,7 @@ contract PendleCommonPoolDeployHelperV2 is PendlePoolDeployHelperV2, BoringOwnab
         uint256 amountToSeed,
         address syOwner
     ) external returns (PoolDeploymentAddrs memory) {
-        address SY = IPCommonSYFactory(syFactory)
-            .deployUpgradableSY(ERC20_WITH_ADAPTER_ID, constructorParams, initData, syOwner);
+        address SY = IPCommonSYFactory(syFactory).deployUpgradableSY(id, constructorParams, initData, syOwner);
         return deploy5115MarketAndSeedLiquidity(SY, config, tokenToSeedLiqudity, amountToSeed);
     }
 }

package/contracts/offchain-helpers/deploy/PendleCommonSYFactory.sol

@@ -68,7 +68,10 @@ contract PendleCommonSYFactory is BoringOwnableUpgradeableV2 {
         );
 
         emit DeployedSY(id, constructorParams, SY);
-        IOwnable(SY).transferOwnership(syOwner, true, false);
+
+        if (IOwnable(SY).owner() != syOwner) {
+            IOwnable(SY).transferOwnership(syOwner, true, false);
+        }
     }
 
     function deployUpgradableSY(bytes32 id, bytes memory constructorParams, bytes memory initData, address syOwner)
@@ -94,7 +97,10 @@ contract PendleCommonSYFactory is BoringOwnableUpgradeableV2 {
 
         emit DeployedSY(id, constructorParams, proxy);
 
-        IOwnable(proxy).transferOwnership(syOwner, true, false);
+        if (IOwnable(proxy).owner() != syOwner) {
+            IOwnable(proxy).transferOwnership(syOwner, true, false);
+        }
+
         return proxy;
     }
 }

package/contracts/pt-looping/PTLooperBase.sol

@@ -21,6 +21,7 @@ abstract contract PTLooperBase is IPPTLooper, EIP712Upgradeable, BoringOwnableUp
     address public proposer;
     mapping(address owner => mapping(bytes32 requestHash => uint256 nonce)) public proposerNonce;
     mapping(address owner => mapping(bytes32 boxId => UserRequestInfo)) internal _userRequest;
+    mapping(address owner => mapping(bytes32 requestHash => RequestStatus)) public requestStatus;
 
     constructor(address treasury_, address positionBoxFactory_) {
         TREASURY = treasury_;
@@ -182,6 +183,16 @@ abstract contract PTLooperBase is IPPTLooper, EIP712Upgradeable, BoringOwnableUp
         );
     }
 
+    function preApproveRequest(bytes32 requestHash, bytes memory proposerSig) external {
+        require(
+            SignatureChecker.isValidSignatureNow(proposer, requestHash, proposerSig),
+            "PTLooper: invalid proposer signature"
+        );
+        require(requestStatus[msg.sender][requestHash] == RequestStatus.DEFAULT, "PTLooper: invalid request status");
+        requestStatus[msg.sender][requestHash] = RequestStatus.PRE_APPROVED;
+        emit RequestPreApproved(msg.sender, requestHash);
+    }
+
     /// @dev Per-iteration auth + implicit session init. First call for a slot
     /// (`userReq.requestHash == 0`) opens the session — checks `boxId`/`sessionNonce` agree and
     /// verifies the owner sig. Subsequent calls just match `userReq.requestHash`;
@@ -206,7 +217,8 @@ abstract contract PTLooperBase is IPPTLooper, EIP712Upgradeable, BoringOwnableUp
             require(header.boxId == permit.boxId, "PTLooper: req/permit boxId mismatch");
             require(header.sessionNonce == userReq.sessionNonce, "PTLooper: invalid session nonce");
             require(
-                SignatureChecker.isValidSignatureNow(permit.owner, requestHash, ownerSigIfFirstCall),
+                SignatureChecker.isValidSignatureNow(permit.owner, requestHash, ownerSigIfFirstCall)
+                    || requestStatus[permit.owner][requestHash] == RequestStatus.PRE_APPROVED,
                 "PTLooper: invalid owner signature"
             );
             userReq.requestHash = requestHash;

package/contracts/pt-looping/PTLooperEIP712TypesEncodeDataLib.sol

@@ -112,15 +112,16 @@ library PTLooperEIP712TypesEncodeDataLib {
     // IPPTLooper.sol > IPPTLooperEIP712Types > DecreasePositionRequest
     function encodeData(IPPTLooperEIP712Types.DecreasePositionRequest memory data) internal pure returns (bytes32) {
         /* bytes32 typeHash = keccak256(
-            "DecreasePositionRequest(RequestHeader header,uint256 minPtToDebtSwapRate,uint256 postWithdrawMaxLTV)" 
+            "DecreasePositionRequest(RequestHeader header,uint256 minPtToDebtSwapRate,uint256 postWithdrawMaxLTV,bool redeemWithPY)" 
             "RequestHeader(bytes32 boxId,uint256 expiry,uint32 sessionNonce,uint32 permitNonceCap,uint256 swapBridgeSlippage,bytes offchainMetadata)" 
         ); */
-        bytes32 typeHash = 0xf2fd81fd04f9cee0ece251f806445c3b1d5103fcd06f31002a34371094102b59;
+        bytes32 typeHash = 0xcef8ce2150dc900a3944ee876f241e8fdc5f7f7e3c93a83a807ca2f6df6dcef6;
         return keccak256(abi.encode(
             typeHash,
             encodeData(data.header),
             data.minPtToDebtSwapRate,
-            data.postWithdrawMaxLTV
+            data.postWithdrawMaxLTV,
+            data.redeemWithPY
         ));
     }
     

package/contracts/pt-looping/PendlePTLooper.sol

@@ -2,8 +2,9 @@
 pragma solidity ^0.8.30;
 
 import {PMath} from "../core/libraries/math/PMath.sol";
+import {ArrayLib} from "../core/libraries/ArrayLib.sol";
 import {MarketCtx, createMarketCtx} from "../interfaces/IMoneyMarket.sol";
-import {ApprovedCall, BoxData, IPLoopPositionBox} from "../interfaces/IPLoopPositionBox.sol";
+import {BoxCall, BoxData, IPLoopPositionBox} from "../interfaces/IPLoopPositionBox.sol";
 import {PTLooperBase} from "./PTLooperBase.sol";
 import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
 import {IPPrincipalToken} from "../interfaces/IPPrincipalToken.sol";
@@ -47,7 +48,7 @@ contract PendlePTLooper is PTLooperBase {
         bytes memory proposerSig,
         IncreasePositionRequest memory req,
         bytes memory ownerSigIfFirstCall
-    ) external payable onlyExecutor {
+    ) external onlyExecutor {
         (Session memory s, bytes32 requestHash) = _ensureSessionAndAuth(ms, req, proposerSig, ownerSigIfFirstCall);
 
         uint256 preInBalance;
@@ -117,7 +118,7 @@ contract PendlePTLooper is PTLooperBase {
         bytes memory proposerSig,
         DecreasePositionRequest memory req,
         bytes memory ownerSigIfFirstCall
-    ) external payable onlyExecutor {
+    ) external onlyExecutor {
         (Session memory s, bytes32 requestHash) = _ensureSessionAndAuth(ms, req, proposerSig, ownerSigIfFirstCall);
 
         uint256 preDebtBal;
@@ -160,9 +161,9 @@ contract PendlePTLooper is PTLooperBase {
         Session memory s,
         uint256 netPtToSwap
     ) internal returns (uint256 postDebtBal) {
-        (uint256 preFeeDebtBal,) = _boxSwapToken(
-            s.box, s.bd.hubPt, netPtToSwap, s.bd.hubDebtToken, req.minPtToDebtSwapRate, ms.swap
-        );
+        (uint256 preFeeDebtBal,) = req.redeemWithPY
+            ? _boxRedeemPYToToken(s.box, s.bd.hubPt, netPtToSwap, s.bd.hubDebtToken, req.minPtToDebtSwapRate, ms.swap)
+            : _boxSwapToken(s.box, s.bd.hubPt, netPtToSwap, s.bd.hubDebtToken, req.minPtToDebtSwapRate, ms.swap);
 
         _boxWithdraw(s.box, TREASURY, s.bd.hubDebtToken, ms.fee);
         postDebtBal = preFeeDebtBal - ms.fee;
@@ -179,7 +180,7 @@ contract PendlePTLooper is PTLooperBase {
         bytes memory proposerSig,
         SwapBridgeWithdrawAllRequest memory req,
         bytes memory ownerSigIfFirstCall
-    ) external payable onlyExecutor {
+    ) external onlyExecutor {
         (Session memory s, bytes32 requestHash) = _ensureSessionAndAuth(ms, req, proposerSig, ownerSigIfFirstCall);
 
         address tokenOutHere = _onHub(s.bd) ? req.hubTokenOut : req.dstTokenOut;
@@ -214,33 +215,80 @@ contract PendlePTLooper is PTLooperBase {
         uint256 minSwapRate,
         BoxApprovedCall memory swap
     ) internal returns (uint256 postTokenOutBal, uint256 netSwappedOut) {
-        if (tokenIn == tokenOut) {
-            return (tokenInBal, 0);
-        }
+        if (tokenIn == tokenOut) return (tokenInBal, 0);
+
+        BoxCall memory call = tokenIn == NATIVE
+            ? _toBoxCall(swap, new address[](0), new uint256[](0), tokenInBal)
+            : _toBoxCall(swap, ArrayLib.create(tokenIn), ArrayLib.create(tokenInBal), 0);
+
+        (postTokenOutBal, netSwappedOut) = _boxExecSwap(box, tokenInBal, tokenOut, minSwapRate, call);
 
+        if (netSwappedOut > 0) emit TokenSwapped(box, tokenIn, tokenInBal, tokenOut, netSwappedOut);
+    }
+
+    /// @dev PT -> `tokenOut`. The box's YT is approved
+    /// alongside PT (amount = min of the two) so the router can redeem PT + YT -> SY -> Token;
+    /// YT must be consumed 1:1 with PT. PT is never `tokenOut`, so no same-token short-circuit.
+    /// @param ptBal the box's `pt` whole balance (`_boxBal(box, pt)`) right **before** this function is
+    /// called — it is the minuend of the 1:1 check below, not just the approval size.
+    function _boxRedeemPYToToken(
+        IPLoopPositionBox box,
+        address pt,
+        uint256 ptBal,
+        address tokenOut,
+        uint256 minSwapRate,
+        BoxApprovedCall memory swap
+    ) internal returns (uint256 postTokenOutBal, uint256 netSwappedOut) {
+        address yt = IPPrincipalToken(pt).YT();
+        uint256 ytBal = _boxBal(box, yt);
+        uint256 netPyIn = PMath.min(ytBal, ptBal);
+
+        BoxCall memory call = _toBoxCall(swap, ArrayLib.create(pt, yt), ArrayLib.create(netPyIn, netPyIn), 0);
+        (postTokenOutBal, netSwappedOut) = _boxExecSwap(box, netPyIn, tokenOut, minSwapRate, call);
+
+        // Underflow (router returned PT/YT to the box) is an intended revert.
+        require(ytBal - _boxBal(box, yt) == ptBal - _boxBal(box, pt), "PTLooper: PY redeem mismatch");
+
+        if (netSwappedOut > 0) emit PYRedeemed(box, pt, netPyIn, tokenOut, netSwappedOut);
+    }
+
+    /// @dev Shared body of `_boxSwapToken` / `_boxRedeemPYToToken`. No-op (returns the current
+    /// `tokenOut` balance) when `call.extRouter == address(0)`; `minSwapRate` is checked against
+    /// `netIn` only when a swap occurs. Emitting is left to the callers, which report different events.
+    function _boxExecSwap(
+        IPLoopPositionBox box,
+        uint256 netIn,
+        address tokenOut,
+        uint256 minSwapRate,
+        BoxCall memory call
+    ) internal returns (uint256 postTokenOutBal, uint256 netSwappedOut) {
         uint256 preTokenOutBal = _boxBal(box, tokenOut);
-        if (swap.extRouter == address(0)) {
-            return (preTokenOutBal, 0);
-        }
+        if (call.extRouter == address(0)) return (preTokenOutBal, 0);
 
-        box.approveAndCall(
-            ApprovedCall({ //
-                token: tokenIn,
-                amount: tokenInBal,
-                approveTo: swap.approve,
-                callTo: swap.extRouter,
-                data: swap.callData
-            }),
-            address(box)
-        );
+        box.approveAndCall(call, address(box));
         postTokenOutBal = _boxBal(box, tokenOut);
         netSwappedOut = postTokenOutBal - preTokenOutBal;
 
-        require(netSwappedOut * PMath.ONE >= tokenInBal * minSwapRate, "PTLooper: swap below minSwapRate");
-        emit TokenSwapped(box, tokenIn, tokenInBal, tokenOut, netSwappedOut);
+        require(netSwappedOut * PMath.ONE >= netIn * minSwapRate, "PTLooper: swap below minSwapRate");
+    }
+
+    function _toBoxCall(
+        BoxApprovedCall memory swap,
+        address[] memory tokens,
+        uint256[] memory amounts,
+        uint256 nativeAmount
+    ) internal pure returns (BoxCall memory) {
+        return BoxCall({
+            tokens: tokens,
+            amounts: amounts,
+            nativeAmount: nativeAmount,
+            approve: swap.approve,
+            extRouter: swap.extRouter,
+            callData: swap.callData
+        });
     }
 
-    /// @notice Only bridge between hubChain and spokeChain.
+    /// @dev Stub until cross-chain lands; callers gate on `_isCrossChain`.
     function _boxBridgeToken(Session memory, BridgeData memory, address, uint256, address, uint256, bool)
         internal
         pure
@@ -274,7 +322,7 @@ contract PendlePTLooper is PTLooperBase {
         revert("PTLooper: unsupported chainid");
     }
 
-    function _ltvCheck(uint256 mmPtBal, uint256 mmDebtBal, uint256 mmOraclePtDebtRate, uint256 maxLTV) internal pure {
+    function _checkLTV(uint256 mmPtBal, uint256 mmDebtBal, uint256 mmOraclePtDebtRate, uint256 maxLTV) internal pure {
         require(mmDebtBal <= mmPtBal.mulDown(mmOraclePtDebtRate).mulDown(maxLTV), "PTLooper: maxLTV exceeded");
     }
 
@@ -285,7 +333,7 @@ contract PendlePTLooper is PTLooperBase {
         (uint256 netLent, uint256 mmPtBal) = s.spokeMM.lend(ctx, ptIn);
         (uint256 netBorrowed, uint256 mmDebtBal) = s.spokeMM.borrow(ctx, debtOut);
         uint256 rate = s.spokeMM.oraclePtDebtRate(ctx);
-        _ltvCheck(mmPtBal, mmDebtBal, rate, req.postBorrowMaxLTV);
+        _checkLTV(mmPtBal, mmDebtBal, rate, req.postBorrowMaxLTV);
         emit MoneyMarketLentThenBorrowed(s.box, netLent, netBorrowed);
     }
 
@@ -296,7 +344,7 @@ contract PendlePTLooper is PTLooperBase {
         (uint256 netRepaid, uint256 mmDebtBal) = s.spokeMM.repay(ctx, debtIn);
         (uint256 netWithdrawn, uint256 mmPtBal) = s.spokeMM.withdraw(ctx, ptOut);
         uint256 rate = s.spokeMM.oraclePtDebtRate(ctx);
-        _ltvCheck(mmPtBal, mmDebtBal, rate, req.postWithdrawMaxLTV);
+        _checkLTV(mmPtBal, mmDebtBal, rate, req.postWithdrawMaxLTV);
         emit MoneyMarketRepaidThenWithdrawn(s.box, netRepaid, netWithdrawn);
     }
 

package/contracts/pt-looping/loop-position-box/LoopPositionBox.sol

@@ -2,7 +2,7 @@
 pragma solidity ^0.8.30;
 
 import {TokenHelper} from "../../core/libraries/TokenHelper.sol";
-import {ApprovedCall, IPLoopPositionBox} from "../../interfaces/IPLoopPositionBox.sol";
+import {BoxCall, IPLoopPositionBox} from "../../interfaces/IPLoopPositionBox.sol";
 import {Initializable} from "@openzeppelin/contracts/proxy/utils/Initializable.sol";
 import {IERC20Metadata as IERC20} from "@openzeppelin/contracts/token/ERC20/extensions/IERC20Metadata.sol";
 import {SafeERC20} from "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";
@@ -52,22 +52,33 @@ contract LoopPositionBox is IPLoopPositionBox, TokenHelper, Initializable {
         _transferOut(token, to, amount);
     }
 
-    function approveAndCall(ApprovedCall memory call, address nativeRefund)
+    function approveAndCall(BoxCall memory call, address nativeRefund)
         external
         payable
         onlyManager
         returns (bytes memory result)
     {
-        uint256 nativeAmount = call.token == NATIVE ? call.amount : 0;
+        require(call.tokens.length == call.amounts.length, "LoopPositionBox: tokens/amounts length mismatch");
+        // `initialize` gave the spoke MM an infinite approval; the reset-to-zero below would wipe it.
+        require(
+            SPOKE_MONEY_MARKET == address(0) || call.approve != SPOKE_MONEY_MARKET,
+            "LoopPositionBox: approve cannot be spokeMM"
+        );
+
         uint256 nativeFee = msg.value;
 
-        // Back out the native the manager just sent in (call.amount if NATIVE, plus the msg.value fee)
-        // so the post-call diff refunds only router-returned surplus, not the box's pre-existing native.
-        uint256 initialNativeBalance = _selfBalance(NATIVE) - nativeAmount - nativeFee;
+        // `initialNativeBalance` is what the box ends with if the router keeps every wei we send it:
+        // pre-tx balance (current minus the msg.value fee) minus the box's own `nativeAmount`.
+        // Anything above that after the call is router surplus, refunded to `nativeRefund`.
+        uint256 initialNativeBalance = _selfBalance(NATIVE) - call.nativeAmount - nativeFee;
 
-        _approveForExtRouter(call.token, call.approveTo, call.amount);
-        result = call.callTo.functionCallWithValue(call.data, nativeAmount + nativeFee);
-        _approveForExtRouter(call.token, call.approveTo, 0);
+        for (uint256 i = 0; i < call.tokens.length; ++i) {
+            IERC20(call.tokens[i]).forceApprove(call.approve, call.amounts[i]);
+        }
+        result = call.extRouter.functionCallWithValue(call.callData, call.nativeAmount + nativeFee);
+        for (uint256 i = 0; i < call.tokens.length; ++i) {
+            IERC20(call.tokens[i]).forceApprove(call.approve, 0);
+        }
 
         uint256 finalNativeBalance = _selfBalance(NATIVE);
 
@@ -76,10 +87,5 @@ contract LoopPositionBox is IPLoopPositionBox, TokenHelper, Initializable {
         }
     }
 
-    function _approveForExtRouter(address token, address extRouter, uint256 amount) internal {
-        if (token == NATIVE || extRouter == SPOKE_MONEY_MARKET) return;
-        IERC20(token).forceApprove(extRouter, amount);
-    }
-
     receive() external payable {}
 }

package/contracts/pt-looping/money-market/implementations/aave/AaveMMPayloadLib.sol

@@ -3,14 +3,10 @@ pragma solidity ^0.8.20;
 
 /// @dev Encoding:
 /// - first byte: to encode eModeCategoryId
-/// - second byte, bit 0: isolationMode flag
 /// @dev eModeCategoryId == 0 means no eMode
 library AaveMMPayloadLib {
-    uint256 private constant ISOLATION_MODE_MASK = 1 << 8;
-
-    function unwrap(bytes32 payload) internal pure returns (uint8 eModeCategoryId, bool isolationMode) {
+    function unwrap(bytes32 payload) internal pure returns (uint8 eModeCategoryId) {
         uint256 rawPayload = uint256(payload);
         eModeCategoryId = uint8(rawPayload);
-        isolationMode = (rawPayload & ISOLATION_MODE_MASK) != 0;
     }
 }