@venusprotocol/liquidity-hub 2.0.0 → 2.1.0-dev.2

package/README.md

@@ -281,7 +281,7 @@ Every privileged call is gated by `AccessControlManagerV8` — the role is `kecc
 | `pauseHub`                                                                                   |         ✅         | ✅ (also Guardian) |
 | `deposit` / `mint` / `withdraw` / `redeem`, `accrueFees`, views                              |   permissionless   |   permissionless   |
 
-**ACM role strings.** Hub: `addYieldGroup(address,uint256,uint16)`, `removeYieldGroup(address)`, `raiseYieldGroupCap(...)`, `lowerYieldGroupCap(...)`, `setOuterDepositQueue(address[])`, `setOuterWithdrawQueue(address[])`, `pauseHub()`, `unpauseHub()`, `pauseYieldGroup(address)`, `unpauseYieldGroup(address)`, `raiseMaxWithdrawalSize(uint256)`, `lowerMaxWithdrawalSize(uint256)`, `setManagementFeeBps(uint16)`, `setPerformanceFeeBps(uint16)`, `setRedeemFeeBps(uint16)`, `setFeeRecipient(address)`, `sweep(address,address)`, `reallocate(...)`, `emergencyReallocate(...)`. Each YieldGroup: `addResource(address,address)`, `removeResource(address)`, `updateResourceAdapter(address,address)` (governance-only, repoints a resource's delegatecall adapter), `setInnerDepositQueue(address[])`, `setInnerWithdrawQueue(address[])`, `pauseResource(address)`, `unpauseResource(address)`, `sweep(address,address)`, and — Core & Flux only — `raiseResourceCap(address,uint256)`, `lowerResourceCap(address,uint256)`, `setBlocksPerYear(uint256)`; and — FRV only — `forceRemoveResource(address)`.
+**ACM role strings.** Hub: `addYieldGroup(address,uint256,uint16)`, `removeYieldGroup(address)`, `raiseYieldGroupCap(...)`, `lowerYieldGroupCap(...)`, `setOuterDepositQueue(address[])`, `setOuterWithdrawQueue(address[])`, `pauseHub()`, `unpauseHub()`, `pauseYieldGroup(address)`, `unpauseYieldGroup(address)`, `raiseMaxWithdrawalSize(uint256)`, `lowerMaxWithdrawalSize(uint256)`, `setManagementFeeBps(uint16)`, `setPerformanceFeeBps(uint16)`, `setRedeemFeeBps(uint16)`, `setFeeRecipient(address)`, `sweep(address,address)`, `reallocate(...)`, `emergencyReallocate(...)`. Each YieldGroup: `addResource(address,address)`, `removeResource(address)`, `updateResourceAdapter(address,address)` (governance-only, repoints a resource's delegatecall adapter), `setInnerDepositQueue(address[])`, `setInnerWithdrawQueue(address[])`, `pauseResource(address)`, `unpauseResource(address)`, `sweep(address,address)`, and — Core & Flux only — `raiseResourceCap(address,uint256)`, `lowerResourceCap(address,uint256)`, `setBlocksPerYear(uint256)`; — FRV & Centrifuge — `forceRemoveResource(address)`; and — Centrifuge only — `requestRedeem(address,uint256)`, `cancelDepositRequest(address)`, `cancelRedeemRequest(address)`, `claimDeposit(address)`, `claimRedeem(address)`, `claimCancelDeposit(address)`, `claimCancelRedeem(address)`, `setNavGuardRate(address,uint16,uint16,uint16,uint32,bool,bool)`, `setNavGuardSnapshot(address,uint128,uint64)`, `setNavGuardEnabled(address,bool,bool)`, `setSpotAPYBps(address,uint64)`. An onboarding VIP that skips the three `setNavGuard*` roles leaves that resource's NAV band unarmed for good: nothing else can arm it, and an unarmed band reports the counterparty's value to the Hub unclamped.
 
 ## Invariants & safety
 

package/contracts/Hub/Hub.sol

@@ -26,6 +26,8 @@ import { HubAdminLib } from "./lib/HubAdminLib.sol";
  *      Inheritance order is load-bearing for upgrade safety — do not reorder.
  *      Function ordering follows the Solidity style guide: external → public → internal →
  *      private, mutating before view within each group.
+ *      {HubAdminLib} is linked for EIP-170 headroom; a library declares no state, so it cannot shift this layout.
+ * @custom:oz-upgrades-unsafe-allow external-library-linking
  */
 contract Hub is ERC4626Upgradeable, AccessControlledV8, ReentrancyGuardUpgradeable, HubStorage, IHub {
     using SafeERC20Upgradeable for IERC20Upgradeable;

package/contracts/YieldGroup/YieldGroupCentrifuge.sol

@@ -0,0 +1,442 @@
+// SPDX-License-Identifier: BUSL-1.1
+pragma solidity 0.8.25;
+
+import { IERC20 } from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
+import { Address } from "@openzeppelin/contracts/utils/Address.sol";
+
+import { IAdapterCentrifuge } from "../interfaces/IAdapterCentrifuge.sol";
+import { IHub } from "../interfaces/IHub.sol";
+import { IResourceAdapter } from "../interfaces/IResourceAdapter.sol";
+import { IYieldGroupBase } from "../interfaces/IYieldGroupBase.sol";
+import { IYieldGroupCentrifuge } from "../interfaces/IYieldGroupCentrifuge.sol";
+import { NavGuard } from "./base/NavGuard.sol";
+import { YieldGroupBase } from "./base/YieldGroupBase.sol";
+
+/**
+ * @title YieldGroupCentrifuge
+ * @author Venus
+ * @notice Connects a Hub to one or more Centrifuge ERC-7540 vaults, such as JTRSY and JAAA,
+ *         that use the same underlying asset. Each proxy belongs to one Hub and asset.
+ * @dev The Hub routes assets synchronously, while Centrifuge fulfils requests asynchronously. This
+ *      contract adds the missing lifecycle operations: redeem and cancellation requests, claims
+ *      after settlement, holder-specific deposit capacity, an optional valuation band, and
+ *      forced removal, while the Hub is paused, when governance writes off a resource.
+ *
+ *      PRICING. Centrifuge is a separate protocol with its own accounting, and a position here is
+ *      worth `face + shares x price` — every term of which Centrifuge computes off-chain and
+ *      publishes to BSC. The guards below are how those published numbers are carried into the
+ *      Hub's NAV safely: the Hub's share price is built on them and every Hub flow reads it, so an
+ *      unexpected value in any term has to be bounded before it reaches that far. Two defences:
+ *
+ *      1. Is there a price at all? The adapter reverts on a zero share price
+ *         (`AdapterCentrifuge.ZeroSharePrice`). Always on, not configurable.
+ *      2. Is the VALUE plausible? {setNavGuardRate} arms a band around what the position is worth,
+ *         and `totalAssets()` reports it clamped into that band. Opt-in per resource, and it never
+ *         reverts.
+ *
+ *      Defence 1 binds only where a price is actually read, so it never fires for a position
+ *      holding nothing measured in shares — it is worth the same at any price. Defence 2 binds on
+ *      every valuation, priced or not, since the face counters are published the same way.
+ *
+ *      What the band does on each side is not symmetric, and the difference matters. Above the cap
+ *      it protects the Hub: an inflated position is reported lower than Centrifuge published it, so
+ *      nobody withdraws against value that is not there. Below the floor it does the opposite — a
+ *      real loss is reported higher than it is, so the markdown is rate-limited rather than landing
+ *      at once, and whoever exits during that walk-down is paid ahead of whoever exits after.
+ *      Accepted deliberately: the band is denominated in the underlying asset, not a reference
+ *      currency, so what it can under-report by is a fund's own drawdown rather than a token price
+ *      collapsing, and `downGapBps` is sized against that. See `INavGuard.setNavGuardRate`.
+ *
+ *      The band covers the price risk too: with a resource's value bounded, its shares cannot be
+ *      valued above the band whatever price is published. What it bounds is the RATE at which a
+ *      wrong value can move valuation, not the total, and that is what buys the time to notice it.
+ *
+ *      State preparation: the adapter includes held, pending, and claimable balances in valuation,
+ *      so `_prepareResource` does not need to update the vault before a read.
+ *
+ *      Claims: keepers explicitly collect each claimable bucket. A resource-targeted withdrawal can
+ *      also collect settled redeem assets through `AdapterCentrifuge.withdraw`. {accrue} claims
+ *      nothing — it only re-anchors the NAV bands — so Hub fee accrual does not proactively move
+ *      claimable value into this contract. A claim preserves the position's value but may move it from a resource-specific
+ *      bucket to idle assets, which changes the withdrawal path that can reach it. The two claims
+ *      that move value out of the vault also tell the band, for the reason given on {_dispatchDeposit}.
+ *
+ *      Deposit limits: `_minDeposit` remains zero because the current Centrifuge vault does not
+ *      expose or enforce an on-chain minimum.
+ *
+ *      Deposit cancellation: Centrifuge rejects new deposits while this group's cancellation is
+ *      pending. `_resourceDepositRoom` reads that holder-specific state and reports zero capacity
+ *      until the cancellation settles, so the Hub does not route another deposit to the vault.
+ *
+ *      Reallocation withdrawals depend on the leg's `resource`. A nonzero resource targets one
+ *      vault through `withdrawResource`. This path can pull only redeem assets that Centrifuge has
+ *      already settled and exposed through `maxWithdraw`; it does not open a new redeem request or
+ *      use assets held idle by this contract.
+ *
+ *      Settled redeem assets stay in Centrifuge as `maxWithdraw` until something claims them.
+ *      `AdapterCentrifuge.withdraw` claims them on the way out, so a targeted leg can reach them
+ *      without a keeper call. Once a keeper claims them into this contract, they become idle and
+ *      are no longer attributable to one resource.
+ *
+ *      A processed deposit cancellation remains in `claimableCancelDepositRequest` until a keeper
+ *      claims it, after which it also becomes idle. It never enters `maxWithdraw`, so a targeted
+ *      withdrawal cannot reach it before or after the claim.
+ *
+ *      To withdraw idle assets, the reallocation leg must use `resource == address(0)`. The Hub then
+ *      calls the group-level `withdraw`, which spends idle assets before using the withdraw queue.
+ *
+ *      Sweep bars `asset()` and every registered resource. Here the resource is the vault, while
+ *      the tokens this contract holds are the vault's `share()`, so `sweep` can move the whole fund
+ *      position out. That is deliberate, not an oversight. It tells the band nothing, though, so a
+ *      sweep that leaves anything behind leaves the floor still reporting the swept value.
+ *      Re-anchor with {INavGuard.setNavGuardSnapshot} in the same transaction.
+ */
+contract YieldGroupCentrifuge is YieldGroupBase, NavGuard, IYieldGroupCentrifuge {
+    using Address for address;
+
+    // ============================== State =====================================
+
+    /// @notice The annual rate governance has published for each resource, in basis points.
+    /// @dev Centrifuge reports a fund's return as a new NAV and publishes no rate on-chain, so
+    ///      nothing here can derive or check this figure — it is whatever governance last set.
+    ///      Cleared on removal, or a re-added vault would come back advertising a stale rate.
+    mapping(address resource => uint64 apyBps) internal _spotAPYBps;
+
+    /// @dev Reserved slots for future Centrifuge-only state. Shrink by the number of slots a new
+    ///      field consumes when extending.
+    uint256[19] private __gap;
+
+    // ============================== External — mutating =======================
+
+    /// @inheritdoc IYieldGroupCentrifuge
+    function initialize(address hub_, address asset_, address acm_) external initializer {
+        // No per-block rate to annualise: Centrifuge reports yield as NAV changes, and the rate the
+        // group advertises is set whole by {setSpotAPYBps}, already annual.
+        __YieldGroupBase_init(hub_, asset_, 0, acm_);
+    }
+
+    // -- Operator: async redeem / cancels --
+
+    /// @inheritdoc IYieldGroupCentrifuge
+    /// @dev Allowed while the resource is paused as a wind-down action. Cancelling a redeem request
+    ///      is asynchronous and may block another redeem request until Centrifuge settles the cancellation.
+    /// @custom:oz-upgrades-unsafe-allow-reachable delegatecall
+    function requestRedeem(address resource, uint256 shares) external override nonReentrant {
+        _checkAccessAllowed("requestRedeem(address,uint256)");
+        if (shares == 0) revert ZeroShares();
+        address adapter = _requireRegistered(resource);
+        adapter.functionDelegateCall(abi.encodeCall(IAdapterCentrifuge.requestRedeem, (resource, shares)));
+        emit RedeemRequested(resource, shares);
+    }
+
+    /// @inheritdoc IYieldGroupCentrifuge
+    /// @custom:oz-upgrades-unsafe-allow-reachable delegatecall
+    function cancelDepositRequest(address resource) external override nonReentrant {
+        _checkAccessAllowed("cancelDepositRequest(address)");
+        address adapter = _requireRegistered(resource);
+        adapter.functionDelegateCall(abi.encodeCall(IAdapterCentrifuge.cancelDepositRequest, (resource)));
+        emit DepositCancelRequested(resource);
+    }
+
+    /// @inheritdoc IYieldGroupCentrifuge
+    /// @custom:oz-upgrades-unsafe-allow-reachable delegatecall
+    function cancelRedeemRequest(address resource) external override nonReentrant {
+        _checkAccessAllowed("cancelRedeemRequest(address)");
+        address adapter = _requireRegistered(resource);
+        adapter.functionDelegateCall(abi.encodeCall(IAdapterCentrifuge.cancelRedeemRequest, (resource)));
+        emit RedeemCancelRequested(resource);
+    }
+
+    // -- Keeper: claims (all idempotent; zero-claimable is a silent no-op) --
+
+    /// @inheritdoc IYieldGroupCentrifuge
+    function claimDeposit(address resource) external override nonReentrant returns (uint256 shares) {
+        _checkAccessAllowed("claimDeposit(address)");
+        return _claimDeposit(resource, _requireRegistered(resource));
+    }
+
+    /// @inheritdoc IYieldGroupCentrifuge
+    function claimRedeem(address resource) external override nonReentrant returns (uint256 assets) {
+        _checkAccessAllowed("claimRedeem(address)");
+        return _claimRedeem(resource, _requireRegistered(resource));
+    }
+
+    /// @inheritdoc IYieldGroupCentrifuge
+    function claimCancelDeposit(address resource) external override nonReentrant returns (uint256 assets) {
+        _checkAccessAllowed("claimCancelDeposit(address)");
+        return _claimCancelDeposit(resource, _requireRegistered(resource));
+    }
+
+    /// @inheritdoc IYieldGroupCentrifuge
+    function claimCancelRedeem(address resource) external override nonReentrant returns (uint256 shares) {
+        _checkAccessAllowed("claimCancelRedeem(address)");
+        return _claimCancelRedeem(resource, _requireRegistered(resource));
+    }
+
+    // -- Hub: per-block poke --
+
+    /// @inheritdoc IYieldGroupBase
+    /// @dev There's no interest to settle here — Centrifuge reports yield as NAV, not a
+    ///      block-lazy exchange rate — so this re-anchors each resource's NAV band instead, and
+    ///      logs a clamp the band is applying.
+    ///
+    ///      The Hub only reaches this once per block, because `Hub._accrueFees` returns early on
+    ///      any later call in the same block. That is fine: a band moves at most once per its own
+    ///      `interval`, which is orders of magnitude longer. It also means this is not where the
+    ///      band is enforced — Centrifuge could report a different value later in the same block
+    ///      and this function would never see it. Clamping is `totalAssets()`'s job, on every read.
+    ///
+    ///      MUST NOT REVERT: `Hub._accrueResources` has no try/catch, so a revert here takes down
+    ///      every Hub flow. `NavGuard._updateNavGuard` absorbs its own failures, and
+    ///      {_observedNav} swallows an unreadable position rather than propagating it.
+    function accrue() external override(YieldGroupBase, IYieldGroupBase) onlyHub {
+        address[] storage list = _resources;
+        uint256 len = list.length;
+        for (uint256 i; i < len; ++i) {
+            _updateNavGuard(list[i]);
+        }
+    }
+
+    // -- Governance: write-off removal --
+
+    /// @inheritdoc IYieldGroupCentrifuge
+    function forceRemoveResource(address resource) external override nonReentrant {
+        _checkAccessAllowed("forceRemoveResource(address)");
+        ResourceConfig storage cfg = _resourcesConfig[resource];
+        if (!cfg.registered) revert ResourceNotRegistered(resource);
+        // Normal removal requires an empty position. This escape hatch lets governance write off a
+        // position that Centrifuge has frozen or unlinked and that can no longer be claimed. Nothing
+        // on-chain proves the position is unrecoverable, so removing a funded resource immediately
+        // removes its remaining value from the Hub's NAV.
+        //
+        // The pause keeps that drop untradeable, and out of the exchange-rate monitoring that would
+        // otherwise read it as an incident. `pauseHub` makes no external call, so a bricked
+        // `totalAssets()` cannot block pause -> remove -> unpause.
+        if (!IHub(_hub).hubPaused()) revert HubNotPaused();
+
+        address adapter = cfg.adapter;
+        // These values are only used for the event, and the value is the raw one — what the
+        // position is actually worth, not what the band would have reported. A broken price feed or
+        // unlinked vault may make either read fail, but must not prevent removal. A recorded zero
+        // may therefore mean that the value could not be read.
+        uint256 writtenOffValue;
+        try IResourceAdapter(adapter).totalAssets(resource, address(this)) returns (uint256 value) {
+            writtenOffValue = value;
+        } catch { }
+        uint256 orphanedReceipt;
+        try IResourceAdapter(adapter).receiptBalance(resource, address(this)) returns (uint256 held) {
+            orphanedReceipt = held;
+        } catch { }
+
+        uint256 idxPlusOne = _resourceIndex[resource];
+        uint256 idx = idxPlusOne - 1;
+        uint256 lastIdx = _resources.length - 1;
+        if (idx != lastIdx) {
+            address last = _resources[lastIdx];
+            _resources[idx] = last;
+            _resourceIndex[last] = idxPlusOne;
+        }
+        _resources.pop();
+        delete _resourceIndex[resource];
+
+        _removeFromQueue(_innerDepositQueue, resource);
+        _removeFromQueue(_innerWithdrawQueue, resource);
+
+        delete _resourcesConfig[resource];
+        _onResourceRemoved(resource);
+
+        emit ResourceForceRemoved(resource, writtenOffValue, orphanedReceipt);
+    }
+
+    // -- Governance: published spot APY --
+
+    /// @inheritdoc IYieldGroupCentrifuge
+    function setSpotAPYBps(address resource, uint64 apyBps) external override {
+        _checkAccessAllowed("setSpotAPYBps(address,uint64)");
+        _requireRegistered(resource);
+        uint64 oldApyBps = _spotAPYBps[resource];
+        _spotAPYBps[resource] = apyBps;
+        emit SpotAPYBpsSet(resource, oldApyBps, apyBps);
+    }
+
+    // ============================== External — view ============================
+
+    /// @inheritdoc IYieldGroupBase
+    /// @dev Sums each resource's value from its adapter, clamped to that resource's NAV band, plus
+    ///      the group's idle assets. The band is applied here rather than in the adapter because
+    ///      the adapter is stateless and shared; nothing else calls the adapter for a valuation the
+    ///      Hub will use, so nothing can reach the Hub around the band.
+    ///
+    ///      Idle assets are added unclamped. They are this contract's own ERC-20 balance, not a
+    ///      number Centrifuge reports, so there is nothing about them to disbelieve.
+    ///
+    ///      One thing makes this revert, on purpose, and it comes from the adapter: a missing or
+    ///      zero share price ({IAdapterCentrifuge.ZeroSharePrice}). It only reaches a position
+    ///      holding something denominated in shares, because that is the only case where a price is
+    ///      read; one made up entirely of asset-denominated balances is valued without touching the
+    ///      feed. The Hub sums every group's `totalAssets()`, so it halts every Hub flow —
+    ///      including for depositors with no Centrifuge exposure. A fresh price clears it.
+    ///
+    ///      The band never reverts. A value outside it is reported at the bound, and only
+    ///      `navGuardStatus` says so.
+    function totalAssets() external view override(YieldGroupBase, IYieldGroupBase) returns (uint256 total) {
+        address[] storage list = _resources;
+        uint256 len = list.length;
+        for (uint256 i; i < len; ++i) {
+            address resource = list[i];
+            address adapter = _resourcesConfig[resource].adapter;
+            total += _guardedNav(resource, IResourceAdapter(adapter).totalAssets(resource, address(this)));
+        }
+        total += IERC20(_assetToken).balanceOf(address(this));
+    }
+
+    /// @inheritdoc IYieldGroupCentrifuge
+    function resourceSpotAPYBps(address resource) external view override returns (uint64) {
+        return _spotAPYBps[resource];
+    }
+
+    // ============================== Internal — value bounds ==================
+
+    /// @inheritdoc YieldGroupBase
+    /// @dev Clears the vault's NAV band and its published rate. Re-adding the resource means arming
+    ///      the band and publishing the rate again.
+    function _onResourceRemoved(address resource) internal override {
+        _clearNavGuard(resource);
+        delete _spotAPYBps[resource];
+    }
+
+    /// @dev Gate for the three governance setters inherited from `NavGuard`. Each gets the same ACM
+    ///      check every other function here uses, so a VIP grants their roles the way it grants
+    ///      {forceRemoveResource}'s, then {ResourceNotRegistered} on a resource this group doesn't
+    ///      manage. Auth first, as the hook requires.
+    function _requireGuardConfig(string memory signature, address resource) internal view override {
+        _checkAccessAllowed(signature);
+        _requireRegistered(resource);
+    }
+
+    /// @dev The value `NavGuard` bounds: what the adapter says the position is worth right now,
+    ///      unclamped. Not read by valuation, which clamps the read `totalAssets()` already holds.
+    ///      A reverting read answers `readable = false` rather than propagating, which is what
+    ///      stops an unreachable vault taking down every Hub flow.
+    ///
+    ///      The adapter reverts {IAdapterCentrifuge.ZeroSharePrice} whenever the position holds
+    ///      shares and the published price is zero, so this is not only an unreachable vault: a
+    ///      price the publisher has not set yet lands here too.
+    function _observedNav(address resource) internal view override returns (uint256, bool) {
+        try IResourceAdapter(_resourcesConfig[resource].adapter).totalAssets(resource, address(this)) returns (
+            uint256 value
+        ) {
+            return (value, true);
+        } catch {
+            return (0, false);
+        }
+    }
+
+    /// @dev Tell the band that Venus itself put `amount` into the vault, on top of routing it.
+    ///      Without this it reads our own deposit as Centrifuge inflating the position: routing 1M
+    ///      moves the position's value by 1M in one transaction, past any plausible band.
+    ///
+    ///      Route first, record second. Either one failing unwinds the other, so the band is never
+    ///      told about value that did not move, and value never moves without the band being told.
+    function _dispatchDeposit(address adapter, address resource, uint256 amount) internal override {
+        IERC20 assetToken = IERC20(_assetToken);
+        uint256 balBefore = assetToken.balanceOf(address(this));
+
+        super._dispatchDeposit(adapter, resource, amount);
+
+        // Record what left, not what we asked: a vault booking a request without pulling widens the cap for free.
+        uint256 balAfter = assetToken.balanceOf(address(this));
+        _recordInflow(resource, balBefore > balAfter ? balBefore - balAfter : 0);
+    }
+
+    /// @dev The mirror of {_dispatchDeposit}. `AdapterCentrifuge.withdraw` opens no request — it
+    ///      only collects claims Centrifuge has already settled into `maxWithdraw` and forwards
+    ///      them to `to`. So the position shrinks by what it delivered, which is why the band is
+    ///      told here, and on `received` rather than `amount`.
+    function _dispatchWithdraw(address adapter, address resource, uint256 amount, address to)
+        internal
+        override
+        returns (uint256 received)
+    {
+        received = super._dispatchWithdraw(adapter, resource, amount, to);
+        _recordOutflow(resource, received);
+    }
+
+    // ============================== Internal — hooks ==========================
+
+    /// @dev Unlike `IResourceAdapter.maxDeposit`, `depositRoom` can inspect this YieldGroup's state
+    ///      for the vault. It returns zero while this group has a deposit cancellation pending, so
+    ///      the Hub does not advertise capacity that Centrifuge would reject.
+    function _resourceDepositRoom(address resource, address adapter) internal view override returns (uint256) {
+        return IAdapterCentrifuge(adapter).depositRoom(resource, address(this));
+    }
+
+    // ============================== Private ===================================
+
+    /// @dev Verifies registration and returns the resource's adapter.
+    function _requireRegistered(address resource) private view returns (address adapter) {
+        ResourceConfig storage cfg = _resourcesConfig[resource];
+        if (!cfg.registered) revert ResourceNotRegistered(resource);
+        return cfg.adapter;
+    }
+
+    /// @dev Claims available deposit shares. Does nothing and emits no event when the amount is zero.
+    ///      The band already counted this deposit at {_dispatchDeposit}, while it was still pending.
+    ///      Settling it and claiming it only move it between buckets at the same value, so recording
+    ///      it again here would count the same assets twice.
+    /// @custom:oz-upgrades-unsafe-allow-reachable delegatecall
+    function _claimDeposit(address resource, address adapter) private returns (uint256 shares) {
+        bytes memory ret = adapter.functionDelegateCall(abi.encodeCall(IAdapterCentrifuge.claimDeposit, (resource)));
+        shares = abi.decode(ret, (uint256));
+        if (shares > 0) emit DepositClaimed(resource, shares);
+    }
+
+    /// @dev Runs an asset-delivering claim and returns what actually landed on this contract's
+    ///      balance. The adapter's own return value is skipped: it is the counter Centrifuge said
+    ///      it would pay out, and the band and the events have to carry what arrived.
+    /// @custom:oz-upgrades-unsafe-allow-reachable delegatecall
+    function _claimMeasuredAssets(address adapter, bytes memory data) private returns (uint256 assets) {
+        IERC20 assetToken = IERC20(_assetToken);
+        uint256 before = assetToken.balanceOf(address(this));
+        adapter.functionDelegateCall(data);
+        assets = assetToken.balanceOf(address(this)) - before;
+    }
+
+    /// @dev Claims available redemption assets. Does nothing and emits no event when the amount is zero.
+    ///
+    ///      Like {_dispatchWithdraw}, this collects claims Centrifuge has already confirmed into
+    ///      `maxWithdraw`. The difference is only where they stop: here they become this contract's
+    ///      idle balance instead of going on to a recipient. `totalAssets()` counts idle separately
+    ///      from the resource, so the band still has to be told the resource shed that amount.
+    function _claimRedeem(address resource, address adapter) private returns (uint256 assets) {
+        assets = _claimMeasuredAssets(adapter, abi.encodeCall(IAdapterCentrifuge.claimRedeem, (resource)));
+        if (assets > 0) {
+            _recordOutflow(resource, assets);
+            emit RedeemClaimed(resource, assets);
+        }
+    }
+
+    /// @dev Claims assets from a cancelled deposit. Does nothing and emits no event when the amount is zero.
+    ///      Moves value out of the resource the same way {_claimRedeem} does, and tells the band for
+    ///      the same reason.
+    function _claimCancelDeposit(address resource, address adapter) private returns (uint256 assets) {
+        assets = _claimMeasuredAssets(adapter, abi.encodeCall(IAdapterCentrifuge.claimCancelDeposit, (resource)));
+        if (assets > 0) {
+            _recordOutflow(resource, assets);
+            emit DepositCancelClaimed(resource, assets);
+        }
+    }
+
+    /// @dev Claims shares from a cancelled redemption. Does nothing and emits no event when the amount is zero.
+    ///      The band is not told, because {requestRedeem} never told it either: that only moved the
+    ///      shares from the group's balance into `pendingRedeemRequest`, both inside this resource.
+    ///      Undoing the request therefore has nothing to undo. What moves the band is the CLAIM, in
+    ///      {_claimRedeem}, since that is where assets actually leave the resource.
+    /// @custom:oz-upgrades-unsafe-allow-reachable delegatecall
+    function _claimCancelRedeem(address resource, address adapter) private returns (uint256 shares) {
+        bytes memory ret =
+            adapter.functionDelegateCall(abi.encodeCall(IAdapterCentrifuge.claimCancelRedeem, (resource)));
+        shares = abi.decode(ret, (uint256));
+        if (shares > 0) emit RedeemCancelClaimed(resource, shares);
+    }
+}