@pendle/core-v2 6.7.1 → 6.8.1

package/contracts/pt-looping/PendlePTLooper.sol

@@ -0,0 +1,318 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+pragma solidity ^0.8.30;
+
+import {PMath} from "../core/libraries/math/PMath.sol";
+import {MarketCtx, createMarketCtx} from "../interfaces/IMoneyMarket.sol";
+import {ApprovedCall, BoxData, IPLoopPositionBox} from "../interfaces/IPLoopPositionBox.sol";
+import {PTLooperBase} from "./PTLooperBase.sol";
+import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
+import {IPPrincipalToken} from "../interfaces/IPPrincipalToken.sol";
+import {IPPostPtLoopStateChecker} from "../interfaces/IPPostPtLoopStateChecker.sol";
+
+contract PendlePTLooper is PTLooperBase {
+    using PMath for uint256;
+
+    IPPostPtLoopStateChecker public immutable POST_LOOP_STATE_CHECKER;
+
+    constructor(address treasury, address positionBoxFactory, address postStateChecker)
+        PTLooperBase(treasury, positionBoxFactory)
+    {
+        _disableInitializers();
+        POST_LOOP_STATE_CHECKER = IPPostPtLoopStateChecker(postStateChecker);
+    }
+
+    function initialize(address _owner) external initializer {
+        __EIP712_init("Pendle PT Looper", "1");
+        __BoringOwnableV2_init(_owner);
+    }
+
+    /// @dev `requestHash` must match the currently-open session — caller proves *which* session
+    /// is being closed, not blindly clearing the slot.
+    function terminateSession(address owner, bytes32 boxId, bytes32 requestHash)
+        external
+        onlyExecutorOrBoxOwner(owner)
+    {
+        UserRequestInfo storage userReq = _userRequest[owner][boxId];
+        require(userReq.requestHash != bytes32(0), "PTLooper: no open session");
+        require(userReq.requestHash == requestHash, "PTLooper: requestHash mismatch");
+
+        uint32 newSessionNonce = ++userReq.sessionNonce;
+        delete userReq.requestHash;
+
+        emit SessionTerminated(owner, boxId, requestHash, newSessionNonce);
+    }
+
+    function increaseLoopPosition(
+        IncreasePositionMessage memory ms,
+        bytes memory proposerSig,
+        IncreasePositionRequest memory req,
+        bytes memory ownerSigIfFirstCall
+    ) external payable onlyExecutor {
+        (Session memory s, bytes32 requestHash) = _ensureSessionAndAuth(ms, req, proposerSig, ownerSigIfFirstCall);
+
+        uint256 preInBalance;
+        uint256 netPtToMM;
+        uint256 postDebtBal;
+
+        if (_onHub(s.bd)) {
+            (preInBalance, netPtToMM) = _runHubIncrease(ms, req, s);
+        } else {
+            netPtToMM = _boxBal(s.box, s.bd.spokePt);
+        }
+
+        if (_onSpoke(s.bd)) {
+            postDebtBal = _runSpokeIncrease(ms, req, s, netPtToMM);
+        }
+
+        POST_LOOP_STATE_CHECKER.check(s.box, ms.postStateCheckData);
+
+        emit PositionIncreased(
+            ms.permit.owner, ms.permit.boxId, requestHash, ms.permit.nonce, preInBalance, netPtToMM, postDebtBal
+        );
+    }
+
+    function _runHubIncrease(IncreasePositionMessage memory ms, IncreasePositionRequest memory req, Session memory s)
+        internal
+        returns (uint256 preInBalance, uint256 netPtToMM)
+    {
+        (address tokenIn, uint256 minSwapRate) = ms.permit.nonce == 0
+            ? (req.initTokenIn, req.initMinToPtSwapRate)
+            : (s.bd.hubDebtToken, req.minDebtToPtSwapRate);
+
+        preInBalance = _boxBal(s.box, tokenIn);
+
+        require(ms.fee <= preInBalance.mulDown(req.maxFeeRate), "PTLooper: fee exceeds maxFeeRate");
+        _boxWithdraw(s.box, TREASURY, tokenIn, ms.fee);
+
+        uint256 netIn = preInBalance - ms.fee;
+
+        uint256 netPtSwappedOut;
+        (netPtToMM, netPtSwappedOut) = _boxSwapToken(s.box, tokenIn, netIn, s.bd.hubPt, minSwapRate, ms.swap);
+        if (req.isZeroPriceImpact) {
+            _boxWithdraw(s.box, ms.permit.owner, IPPrincipalToken(s.bd.hubPt).YT(), netPtSwappedOut);
+        }
+
+        if (_isCrossChain(s.bd)) {
+            _boxBridgeToken(s, ms.bridge, s.bd.hubPt, netPtToMM, s.bd.spokePt, req.header.swapBridgeSlippage, false);
+        }
+    }
+
+    function _runSpokeIncrease(
+        IncreasePositionMessage memory ms,
+        IncreasePositionRequest memory req,
+        Session memory s,
+        uint256 netPtToMM
+    ) internal returns (uint256 postDebtBal) {
+        _lendBorrowWithLTV(req, s, netPtToMM, ms.amountDebtBorrowed);
+
+        postDebtBal = _boxBal(s.box, s.bd.spokeDebtToken);
+        if (_isCrossChain(s.bd)) {
+            _boxBridgeToken(
+                s, ms.bridge, s.bd.spokeDebtToken, postDebtBal, s.bd.hubDebtToken, req.header.swapBridgeSlippage, false
+            );
+        }
+    }
+
+    function decreaseLoopPosition(
+        DecreasePositionMessage memory ms,
+        bytes memory proposerSig,
+        DecreasePositionRequest memory req,
+        bytes memory ownerSigIfFirstCall
+    ) external payable onlyExecutor {
+        (Session memory s, bytes32 requestHash) = _ensureSessionAndAuth(ms, req, proposerSig, ownerSigIfFirstCall);
+
+        uint256 preDebtBal;
+        uint256 netPtToSwap;
+        uint256 postDebtBal;
+
+        if (_onSpoke(s.bd)) {
+            (preDebtBal, netPtToSwap) = _runSpokeDecrease(ms, req, s);
+        } else {
+            netPtToSwap = _boxBal(s.box, s.bd.hubPt);
+        }
+
+        if (_onHub(s.bd)) {
+            postDebtBal = _runHubDecrease(ms, req, s, netPtToSwap);
+        }
+
+        POST_LOOP_STATE_CHECKER.check(s.box, ms.postStateCheckData);
+
+        emit PositionDecreased(
+            ms.permit.owner, ms.permit.boxId, requestHash, ms.permit.nonce, preDebtBal, netPtToSwap, postDebtBal
+        );
+    }
+
+    function _runSpokeDecrease(DecreasePositionMessage memory ms, DecreasePositionRequest memory req, Session memory s)
+        internal
+        returns (uint256 preDebtBal, uint256 netPtToSwap)
+    {
+        preDebtBal = _boxBal(s.box, s.bd.spokeDebtToken);
+        _repayWithdrawWithLTV(req, s, preDebtBal, ms.amountPtWithdrawn);
+
+        netPtToSwap = _boxBal(s.box, s.bd.spokePt);
+        if (_isCrossChain(s.bd)) {
+            _boxBridgeToken(s, ms.bridge, s.bd.spokePt, netPtToSwap, s.bd.hubPt, req.header.swapBridgeSlippage, false);
+        }
+    }
+
+    function _runHubDecrease(
+        DecreasePositionMessage memory ms,
+        DecreasePositionRequest memory req,
+        Session memory s,
+        uint256 netPtToSwap
+    ) internal returns (uint256 postDebtBal) {
+        (postDebtBal,) = _boxSwapToken(
+            s.box, s.bd.hubPt, netPtToSwap, s.bd.hubDebtToken, req.minPtToDebtSwapRate, ms.swap
+        );
+
+        if (_isCrossChain(s.bd)) {
+            _boxBridgeToken(
+                s, ms.bridge, s.bd.hubDebtToken, postDebtBal, s.bd.spokeDebtToken, req.header.swapBridgeSlippage, false
+            );
+        }
+    }
+
+    function swapBridgeWithdrawAll(
+        SwapBridgeWithdrawAllMessage memory ms,
+        bytes memory proposerSig,
+        SwapBridgeWithdrawAllRequest memory req,
+        bytes memory ownerSigIfFirstCall
+    ) external payable onlyExecutor {
+        (Session memory s, bytes32 requestHash) = _ensureSessionAndAuth(ms, req, proposerSig, ownerSigIfFirstCall);
+
+        address tokenOutHere = _onHub(s.bd) ? req.hubTokenOut : req.dstTokenOut;
+
+        uint256 postBal;
+        {
+            address tokenIn = _debtTokenHere(s.bd);
+            (postBal,) = _boxSwapToken(s.box, tokenIn, _boxBal(s.box, tokenIn), tokenOutHere, 0, ms.swap);
+        }
+        require(postBal >= req.minTokenWithdrawn, "PTLooper: insufficient token out");
+
+        uint32 destChainId = req.receiveOnSpoke ? s.bd.spokeChainId : s.bd.hubChainId;
+        if (destChainId != block.chainid) {
+            _boxBridgeToken(s, ms.bridge, tokenOutHere, postBal, req.dstTokenOut, req.header.swapBridgeSlippage, false);
+        } else {
+            _boxWithdraw(s.box, ms.permit.owner, tokenOutHere, postBal);
+            emit Withdrawn(ms.permit.owner, ms.permit.boxId, requestHash, ms.permit.nonce, tokenOutHere, postBal);
+        }
+
+        POST_LOOP_STATE_CHECKER.check(s.box, ms.postStateCheckData);
+    }
+
+    /// @param tokenInBal the box's `tokenIn` whole balance (`_boxBal(box, tokenIn)`) right **before** this function is called.
+    /// @return postTokenOutBal the box's `tokenOut` whole balance (`_boxBal(box, tokenOut)`) right **after** this function is called.
+    /// @return netSwappedOut the net amount of `tokenOut` swapped. If no swap occurs, returns 0.
+    /// @dev `minSwapRate` check is performed only when an actual swap occurs.
+    function _boxSwapToken(
+        IPLoopPositionBox box,
+        address tokenIn,
+        uint256 tokenInBal,
+        address tokenOut,
+        uint256 minSwapRate,
+        BoxApprovedCall memory swap
+    ) internal returns (uint256 postTokenOutBal, uint256 netSwappedOut) {
+        if (tokenIn == tokenOut) {
+            return (tokenInBal, 0);
+        }
+
+        uint256 preTokenOutBal = _boxBal(box, tokenOut);
+        if (swap.extRouter == address(0)) {
+            return (preTokenOutBal, 0);
+        }
+
+        box.approveAndCall(
+            ApprovedCall({ //
+                token: tokenIn,
+                amount: tokenInBal,
+                approveTo: swap.approve,
+                callTo: swap.extRouter,
+                data: swap.callData
+            }),
+            address(box)
+        );
+        postTokenOutBal = _boxBal(box, tokenOut);
+        netSwappedOut = postTokenOutBal - preTokenOutBal;
+
+        require(netSwappedOut * PMath.ONE >= tokenInBal * minSwapRate, "PTLooper: swap below minSwapRate");
+        emit TokenSwapped(box, tokenIn, tokenInBal, tokenOut, netSwappedOut);
+    }
+
+    /// @notice Only bridge between hubChain and spokeChain.
+    function _boxBridgeToken(Session memory, BridgeData memory, address, uint256, address, uint256, bool)
+        internal
+        pure
+    {
+        revert("PTLooper: bridging not supported");
+    }
+
+    function _boxBal(IPLoopPositionBox box, address token) internal view returns (uint256) {
+        return _balanceOf(address(box), token);
+    }
+
+    function _boxWithdraw(IPLoopPositionBox box, address to, address token, uint256 amount) internal {
+        box.withdrawTo(to, token, amount);
+    }
+
+    function _onHub(BoxData memory bd) internal view returns (bool) {
+        return bd.hubChainId == block.chainid;
+    }
+
+    function _onSpoke(BoxData memory bd) internal view returns (bool) {
+        return bd.spokeChainId == block.chainid;
+    }
+
+    function _isCrossChain(BoxData memory bd) internal pure returns (bool) {
+        return bd.hubChainId != bd.spokeChainId;
+    }
+
+    function _debtTokenHere(BoxData memory bd) internal view returns (address) {
+        if (_onHub(bd)) return bd.hubDebtToken;
+        if (_onSpoke(bd)) return bd.spokeDebtToken;
+        revert("PTLooper: unsupported chainid");
+    }
+
+    function _ltvCheck(uint256 mmPtBal, uint256 mmDebtBal, uint256 mmOraclePtDebtRate, uint256 maxLTV) internal pure {
+        require(mmDebtBal <= mmPtBal.mulDown(mmOraclePtDebtRate).mulDown(maxLTV), "PTLooper: maxLTV exceeded");
+    }
+
+    function _lendBorrowWithLTV(IncreasePositionRequest memory req, Session memory s, uint256 ptIn, uint256 debtOut)
+        internal
+    {
+        MarketCtx memory ctx = _marketCtx(s);
+        (uint256 netLent, uint256 mmPtBal) = s.spokeMM.lend(ctx, ptIn);
+        (uint256 netBorrowed, uint256 mmDebtBal) = s.spokeMM.borrow(ctx, debtOut);
+        uint256 rate = s.spokeMM.oraclePtDebtRate(ctx);
+        _ltvCheck(mmPtBal, mmDebtBal, rate, req.postBorrowMaxLTV);
+        emit MoneyMarketLentThenBorrowed(s.box, netLent, netBorrowed);
+    }
+
+    function _repayWithdrawWithLTV(DecreasePositionRequest memory req, Session memory s, uint256 debtIn, uint256 ptOut)
+        internal
+    {
+        MarketCtx memory ctx = _marketCtx(s);
+        (uint256 netRepaid, uint256 mmDebtBal) = s.spokeMM.repay(ctx, debtIn);
+        (uint256 netWithdrawn, uint256 mmPtBal) = s.spokeMM.withdraw(ctx, ptOut);
+        uint256 rate = s.spokeMM.oraclePtDebtRate(ctx);
+        _ltvCheck(mmPtBal, mmDebtBal, rate, req.postWithdrawMaxLTV);
+        emit MoneyMarketRepaidThenWithdrawn(s.box, netRepaid, netWithdrawn);
+    }
+
+    function claimMMRewards(
+        ClaimMMRewardsMessage memory ms,
+        bytes memory proposerSig,
+        ClaimMMRewardsRequest memory req,
+        bytes memory ownerSigIfFirstCall
+    ) external onlyExecutor {
+        (Session memory s, bytes32 requestHash) = _ensureSessionAndAuth(ms, req, proposerSig, ownerSigIfFirstCall);
+        uint256[] memory claimedAmounts =
+            s.spokeMM.claimRewards(_marketCtx(s), req.extRewardController, req.data, req.rewardTokens);
+        emit RewardsClaimed(
+            ms.permit.owner, ms.permit.boxId, requestHash, ms.permit.nonce, req.rewardTokens, claimedAmounts
+        );
+    }
+
+    function _marketCtx(Session memory s) internal pure returns (MarketCtx memory) {
+        return createMarketCtx(s.box, s.bd);
+    }
+}

package/contracts/pt-looping/PendlePTLooperView.sol

@@ -0,0 +1,42 @@
+//SPDX-License-Identifier: BUSL-1.1
+pragma solidity ^0.8.20;
+
+import {IPLoopPositionBoxFactory} from "../interfaces/IPLoopPositionBoxFactory.sol";
+import {IMoneyMarketView} from "../interfaces/IMoneyMarketView.sol";
+import {BoringOwnableUpgradeableV2} from "../core/libraries/BoringOwnableUpgradeableV2.sol";
+import {IPLoopPositionBox, BoxData} from "../interfaces/IPLoopPositionBox.sol";
+import {IPPTLooperView, PositionView} from "../interfaces/IPPTLooperView.sol";
+
+contract PendlePTLooperView is IPPTLooperView, BoringOwnableUpgradeableV2 {
+    IPLoopPositionBoxFactory public immutable POSITION_BOX_FACTORY;
+
+    mapping(address spokeMMBeacon => IMoneyMarketView) public moneyMarketView;
+
+    constructor(address _positionBoxFactory) {
+        _disableInitializers();
+        POSITION_BOX_FACTORY = IPLoopPositionBoxFactory(_positionBoxFactory);
+    }
+
+    function initialize(address _owner) external initializer {
+        __BoringOwnableV2_init(_owner);
+    }
+
+    function getAll(address owner, bytes32 boxId) external returns (PositionView memory v) {
+        (IPLoopPositionBox box,, BoxData memory bd) = POSITION_BOX_FACTORY.deployPositionBoxAndMoneyMarket(owner, boxId);
+        IMoneyMarketView mmView = moneyMarketView[bd.spokeMMBeacon];
+
+        (v.mmPtBalance, v.mmDebtBalance) = mmView.moneyMarketBalances(box);
+        (v.ltv, v.liquidationThreshold) = mmView.thresholds(box);
+        (v.borrowingLiquidity, v.lendingLiquidity) = mmView.liquidity(box);
+        (v.borrowingRewards, v.lendingRewards) = mmView.rewards(box);
+        v.limits = mmView.limits(box);
+        (v.borrowingRate, v.lendingRate) = mmView.rates(box);
+        v.ptDebtRateWad = mmView.ptDebtRate(box);
+    }
+
+    // ========== Admin functions ==========
+    function registerMoneyMarketView(address spokeMM, address mmView) external onlyOwner {
+        moneyMarketView[spokeMM] = IMoneyMarketView(mmView);
+        emit MoneyMarketViewRegistered(spokeMM, mmView);
+    }
+}

package/contracts/pt-looping/PostPtLoopStateChecker.sol

@@ -0,0 +1,79 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.0;
+
+import {IPPostPtLoopStateChecker} from "../interfaces/IPPostPtLoopStateChecker.sol";
+import {IPLoopPositionBox, BoxData} from "../interfaces/IPLoopPositionBox.sol";
+import {IPLoopPositionBoxFactory} from "../interfaces/IPLoopPositionBoxFactory.sol";
+import {IMoneyMarket, MarketCtx, createMarketCtx} from "../interfaces/IMoneyMarket.sol";
+import {TokenHelper} from "../core/libraries/TokenHelper.sol";
+
+contract PostPtLoopStateChecker is IPPostPtLoopStateChecker, TokenHelper {
+    IPLoopPositionBoxFactory public immutable BOX_FACTORY;
+
+    constructor(address boxFactory) {
+        BOX_FACTORY = IPLoopPositionBoxFactory(boxFactory);
+    }
+
+    struct BalanceCheck {
+        address token;
+        uint256 lowerBound;
+        uint256 upperBound;
+    }
+
+    struct StateCheck {
+        BalanceCheck[] boxBalances;
+        BalanceCheck[] ownerBalances;
+    }
+
+    /// @dev MM collateral/debt balances, resolved once per `check`. `valid` is false when the box has
+    /// no spoke money market on this chain; `MM_COLAT`/`MM_DEBT` checks then fall through to a raw
+    /// token balance read, exactly as the prior `withMMBalances` flag did.
+    struct MMBalances {
+        bool valid;
+        uint256 colat;
+        uint256 debt;
+    }
+
+    address public constant MM_COLAT = address(1);
+    address public constant MM_DEBT = address(2);
+
+    /// @notice non-view, as `collateralBalance` and `debtBalance` are non-view
+    function check(IPLoopPositionBox box, bytes calldata data) external {
+        StateCheck memory stateCheck = abi.decode(data, (StateCheck));
+
+        MMBalances memory mm; // valid == false until a spoke MM is found
+        address spokeMM = box.SPOKE_MONEY_MARKET();
+        if (spokeMM != address(0)) {
+            BoxData memory boxData = BOX_FACTORY.boxData(box.BOX_ID());
+            MarketCtx memory mctx = createMarketCtx(box, boxData);
+            mm = MMBalances({
+                valid: true,
+                colat: IMoneyMarket(spokeMM).collateralBalance(mctx),
+                debt: IMoneyMarket(spokeMM).debtBalance(mctx)
+            });
+        }
+        _checkBalances(address(box), stateCheck.boxBalances, mm);
+
+        if (stateCheck.ownerBalances.length > 0) {
+            _checkBalances(box.OWNER(), stateCheck.ownerBalances, MMBalances(false, 0, 0));
+        }
+    }
+
+    function _checkBalances(address acc, BalanceCheck[] memory checks, MMBalances memory mm) internal view {
+        for (uint256 i = 0; i < checks.length; i++) {
+            address token = checks[i].token;
+            uint256 bal;
+            if (token == MM_COLAT && mm.valid) {
+                bal = mm.colat;
+            } else if (token == MM_DEBT && mm.valid) {
+                bal = mm.debt;
+            } else {
+                bal = _balanceOf(acc, token);
+            }
+
+            require(
+                bal >= checks[i].lowerBound && bal <= checks[i].upperBound, "LoopStateChecker: balance check failed"
+            );
+        }
+    }
+}

package/contracts/pt-looping/StaticStableQuoter.sol

@@ -0,0 +1,46 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+pragma solidity ^0.8.30;
+
+import {IPStaticQuoter} from "../interfaces/IPStaticQuoter.sol";
+import {PMath} from "../core/libraries/math/PMath.sol";
+import {BoringOwnableUpgradeableV2} from "../core/libraries/BoringOwnableUpgradeableV2.sol";
+
+contract StaticStableQuoter is IPStaticQuoter, BoringOwnableUpgradeableV2 {
+    using PMath for uint256;
+
+    event WeiUSDPriceSet(uint256 chainId, address indexed token, uint256 wad);
+
+    /// example: for USDC with 6 decimals, _weiUSDPrice[USDC] = 1e12
+    mapping(uint256 chainId => mapping(address token => uint256 wad)) internal _weiUSDPrice;
+
+    constructor() {
+        _disableInitializers();
+    }
+
+    function initialize(address owner) external initializer {
+        __BoringOwnableV2_init(owner);
+    }
+
+    function weiUSDPrice(uint256 chainId, address token) public view returns (uint256 res) {
+        res = _weiUSDPrice[chainId][token];
+        require(res != 0, "StaticStableQuoter: token not supported");
+    }
+
+    function quote(
+        uint256 chainIdIn,
+        address tokenIn,
+        uint256 amountIn,
+        uint256 chainIdOut,
+        address tokenOut,
+        uint256 slippage
+    ) external view returns (uint256 minAmountOut) {
+        return (amountIn * weiUSDPrice(chainIdIn, tokenIn) / weiUSDPrice(chainIdOut, tokenOut)).tweakDown(slippage);
+    }
+
+    /// ========== Admin functions ==========
+
+    function setWeiUSDPrice(uint256 chainId, address token, uint256 wad) external onlyOwner {
+        _weiUSDPrice[chainId][token] = wad;
+        emit WeiUSDPriceSet(chainId, token, wad);
+    }
+}

package/contracts/pt-looping/loop-position-box/LoopPositionBox.sol

@@ -0,0 +1,85 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+pragma solidity ^0.8.30;
+
+import {TokenHelper} from "../../core/libraries/TokenHelper.sol";
+import {ApprovedCall, IPLoopPositionBox} from "../../interfaces/IPLoopPositionBox.sol";
+import {Initializable} from "@openzeppelin/contracts/proxy/utils/Initializable.sol";
+import {IERC20Metadata as IERC20} from "@openzeppelin/contracts/token/ERC20/extensions/IERC20Metadata.sol";
+import {SafeERC20} from "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";
+import {Address} from "@openzeppelin/contracts/utils/Address.sol";
+
+contract LoopPositionBox is IPLoopPositionBox, TokenHelper, Initializable {
+    using Address for address;
+    using SafeERC20 for IERC20;
+
+    address public immutable MANAGER;
+
+    /// @dev `OWNER` / `BOX_ID` / `SPOKE_MONEY_MARKET` are written once in `initialize` and never
+    /// mutated again. Named in ALL-CAPS to match `MANAGER` and signal "set-once" intent at the
+    /// callsite, even though they live in storage (BeaconProxy delegatecall rules out true
+    /// `immutable`). Renaming would break `IPLoopPositionBox` ABI consumers.
+    address public OWNER;
+    bytes32 public BOX_ID;
+    address public SPOKE_MONEY_MARKET;
+
+    constructor(address _manager) {
+        MANAGER = _manager;
+    }
+
+    modifier onlyManager() {
+        require(msg.sender == MANAGER, "LoopPositionBox: caller is not manager");
+        _;
+    }
+
+    function initialize(
+        address _owner,
+        bytes32 _boxId,
+        address _spokeMoneyMarket,
+        address _ptToApprove,
+        address _debtTokenToApprove
+    ) external initializer {
+        OWNER = _owner;
+        BOX_ID = _boxId;
+        SPOKE_MONEY_MARKET = _spokeMoneyMarket;
+
+        if (_spokeMoneyMarket != address(0)) {
+            _safeApproveInf(_ptToApprove, _spokeMoneyMarket);
+            _safeApproveInf(_debtTokenToApprove, _spokeMoneyMarket);
+        }
+    }
+
+    function withdrawTo(address to, address token, uint256 amount) external onlyManager {
+        _transferOut(token, to, amount);
+    }
+
+    function approveAndCall(ApprovedCall memory call, address nativeRefund)
+        external
+        payable
+        onlyManager
+        returns (bytes memory result)
+    {
+        uint256 nativeAmount = call.token == NATIVE ? call.amount : 0;
+        uint256 nativeFee = msg.value;
+
+        // Back out the native the manager just sent in (call.amount if NATIVE, plus the msg.value fee)
+        // so the post-call diff refunds only router-returned surplus, not the box's pre-existing native.
+        uint256 initialNativeBalance = _selfBalance(NATIVE) - nativeAmount - nativeFee;
+
+        _approveForExtRouter(call.token, call.approveTo, call.amount);
+        result = call.callTo.functionCallWithValue(call.data, nativeAmount + nativeFee);
+        _approveForExtRouter(call.token, call.approveTo, 0);
+
+        uint256 finalNativeBalance = _selfBalance(NATIVE);
+
+        if (finalNativeBalance > initialNativeBalance) {
+            _transferOut(NATIVE, nativeRefund, finalNativeBalance - initialNativeBalance);
+        }
+    }
+
+    function _approveForExtRouter(address token, address extRouter, uint256 amount) internal {
+        if (token == NATIVE || extRouter == SPOKE_MONEY_MARKET) return;
+        IERC20(token).forceApprove(extRouter, amount);
+    }
+
+    receive() external payable {}
+}