@venusprotocol/liquidity-hub 2.1.0-dev.7 → 2.1.0-dev.8

package/README.md

@@ -524,6 +524,6 @@ Ordering is guaranteed by the call-array index (`addHub` before any `addYieldGro
 
 **Reconciliation:** a Hub is live the moment script 06 runs but discoverable only after its VIP — `deploy/ReconcileHubRegistry.s.sol` (read-only, unnumbered) diffs the committed `deployments/<network>/Hub_*.json` set against `registry.getHubs()` in both directions and reverts on any mismatch (shadow Hubs deployed-but-unregistered, or registered-but-untracked). Run it after every onboarding VIP and periodically from monitoring.
 
-`deploy/config/<network>.json` holds only public addresses and parameters — `acm`, `governance`, `fluxLendingResolver`, `wbnb` / `vBNB` (the Migrator's native path; both keys are required, set them to `0x0` to deploy with that path disabled), and per-asset `key` / `asset` / `name` / `symbol` / `decimalsOffset` / `initialMaxWithdrawalSize` / `blocksPerYear` / `feeRecipient`. The committed `bscmainnet.json` ships with `0x0` placeholders for governance/acm/resolver/recipient and must be filled before a real deploy. Secrets (deployer key, RPC URLs, Etherscan key) live only in `.env` (see `.env.example`). Deployed addresses are committed under `deployments/<network>/<name>.json`; `broadcast/` is gitignored and is not the source of truth.
+`deploy/config/<network>.json` holds only public addresses and parameters — `acm`, `governance`, `fluxLendingResolver`, `wbnb` / `vBNB` (the Migrator's native path; both keys are required and must be non-zero, since the constructor rejects a zero address), and per-asset `key` / `asset` / `name` / `symbol` / `decimalsOffset` / `initialMaxWithdrawalSize` / `blocksPerYear` / `feeRecipient`. The committed `bscmainnet.json` ships with `0x0` placeholders for governance/acm/resolver/recipient and must be filled before a real deploy. Secrets (deployer key, RPC URLs, Etherscan key) live only in `.env` (see `.env.example`). Deployed addresses are committed under `deployments/<network>/<name>.json`; `broadcast/` is gitignored and is not the source of truth.
 
 **Networks:** RPC aliases are pre-wired for `bsc_mainnet`, `bsc_testnet`, `ethereum`, `sepolia` (one Etherscan V2 key across chains). v1 targets BNB Chain.

package/contracts/YieldGroup/base/NavGuard.sol

@@ -10,14 +10,15 @@ import { INavGuard } from "../../interfaces/INavGuard.sol";
  *         value is reported by a counterparty that nothing else validates.
  * @dev The band vouches for a value: the last counterparty figure we accepted, grown at `driftBps`
  *      a year, plus whatever we have moved in or out since. {_guardedNav} holds valuation a gap
- *      either side of that and never reverts. The gaps are a percentage of the counterparty's part
- *      only, so our own moves never widen them. Take everything out and the band closes; a deposit
+ *      either side of that and never reverts. The gaps are a percentage of `anchor`. Our own moves
+ *      shift only `centre`, so they do not widen the gaps until the next re-anchor, which adopts the
+ *      whole position as the new `anchor`. Take everything out and the band closes; a deposit
  *      or {setNavGuardSnapshot} reopens it.
  *
  *      Two stored numbers carry that, and {_currentBand} is the only place they are combined:
  *
- *      - `anchor` is the counterparty's part: the last figure they reported that we accepted, less
- *        anything we have withdrawn beyond our own deposits. Both gaps are sized off it alone, and
+ *      - `anchor` is what both gaps are sized off: the position value adopted at the last
+ *        re-anchor, less anything we have withdrawn beyond our own deposits since.
  *        {_updateNavGuard} moves it once per `interval`.
  *      - `centre` is where the band sits: the anchor plus our own deposits since. {_recordInflow}
  *        and {_recordOutflow} move it.

package/contracts/interfaces/IMigrator.sol

@@ -7,8 +7,10 @@ pragma solidity 0.8.25;
  * @notice One-click migration from an existing Venus Core position into a Liquidity Hub. In a
  *         single atomic transaction the Migrator pulls a user's Core vToken, redeems it to the
  *         underlying, and deposits that into the matching Hub, minting share tokens to `receiver`.
- * @dev A single immutable, permissionless deployment serves every Hub — the target is chosen per
- *      call via the `hub` argument. Two paths exist because Venus splits its markets by asset type:
+ * @dev A single immutable, permissionless deployment serves every registered Hub — the target is
+ *      chosen per call via the `hub` argument and must be present in the HubRegistry, so a migration
+ *      can only ever land in a governance-registered Hub. Two paths exist because Venus splits its
+ *      markets by asset type:
  *      ERC-20-backed markets (vUSDT, vUSDC, ...) go through {migrateFromCore}; the native market
  *      (vBNB) redeems raw BNB and so has the dedicated {migrateFromCoreBNB} path that wraps to WBNB
  *      before depositing into the WBNB Hub.
@@ -36,6 +38,8 @@ interface IMigrator {
     error ZeroAddress();
     /// @notice A required amount argument was zero.
     error ZeroAmount();
+    /// @notice The target `hub` is not a governance-registered Hub in the HubRegistry.
+    error HubNotRegistered(address hub);
     /// @notice The vToken's underlying does not match the Hub's asset.
     error AssetMismatch(address vTokenUnderlying, address hubAsset);
     /// @notice The Core market returned a non-zero (failure) error code on redeem.
@@ -44,8 +48,6 @@ interface IMigrator {
     error NothingReceived();
     /// @notice The minted shares were below the caller's `minShares` floor.
     error InsufficientShares(uint256 shares, uint256 minShares);
-    /// @notice The native (vBNB → WBNB) path is unavailable: this deployment has no WBNB/vBNB wired.
-    error BNBMigrationUnsupported();
     /// @notice Native value was received from an address other than the configured vBNB market.
     error OnlyVBNB();
 
@@ -95,8 +97,8 @@ interface IMigrator {
     /**
      * @notice Migrate a native vBNB position into the WBNB Hub.
      * @dev Caller must first `approve` this Migrator to transfer `vBNBAmount` of the configured
-     *      vBNB market. The redeemed BNB is wrapped to WBNB before deposit. Reverts unless this
-     *      deployment has WBNB/vBNB wired, `IHub(hub).asset() == WBNB`, and `shares >= minShares`.
+     *      vBNB market. The redeemed BNB is wrapped to WBNB before deposit. Reverts unless `hub` is a
+     *      registered WBNB Hub (`IHub(hub).asset() == WBNB`) and `shares >= minShares`.
      *      This is the no-consent path — use {migrateFromCoreBNBWithConsent} to record consent.
      * @param vBNBAmount vBNB receipts to pull and redeem.
      * @param hub The WBNB Hub to deposit into.

package/contracts/interfaces/INavGuard.sol

@@ -9,8 +9,9 @@ pragma solidity 0.8.25;
  * @dev The band vouches for a value: the last counterparty figure we accepted, grown at the
  *      expected rate, plus whatever we have moved in or out since. Valuation is held a gap either
  *      side of that, `min(max(observed, floor), cap)`, and never reverts. The gaps are a percentage
- *      of the counterparty's part only, so our own moves never widen them. Take everything out and
- *      the band closes; a deposit or governance reopens it.
+ *      of `anchor`. Our own moves shift only `centre`, so they do not widen the gaps until the next
+ *      re-anchor, which adopts the whole position as the new `anchor`. Take everything out and the
+ *      band closes; a deposit or governance reopens it.
  *
  *      It bounds value, not price: a position marked as `quantity x price` can be inflated
  *      through either factor. Value is the product plus whatever has no price at all, so one band
@@ -46,9 +47,9 @@ interface INavGuard {
      *      `anchor` and `centre` are stored as of `driftFrom`, and each grows at `driftBps` from
      *      there when read. A closed band has both at zero: every armed side then values the
      *      position at nothing, and only a deposit or {setNavGuardSnapshot} reopens it.
-     * @param anchor The counterparty's part of the position: the value accepted at the last
-     *        re-anchor, or forced by governance, less what withdrawals have since taken past our own
-     *        deposits. Never above `centre`. Both gaps are sized to it.
+     * @param anchor The whole position value accepted at the last re-anchor, or forced by
+     *        governance, less what withdrawals have since taken past our own deposits. Never above
+     *        `centre`. Both gaps are sized to it.
      * @param centre `anchor` plus our own deposits since. What valuation is held around.
      * @param anchoredAt When `anchor` was last set. `interval` is measured from here, and only a
      *        re-anchor moves it, so our own flows can never delay or bring one forward.
@@ -124,10 +125,10 @@ interface INavGuard {
 
     /**
      * @notice We moved value into or out of a resource, and its centre moved by exactly that. The
-     *         clock is untouched, and the anchor moves only when a withdrawal reaches into the
-     *         counterparty's part.
+     *         clock is untouched, and the anchor moves only when a withdrawal takes more than our
+     *         own deposits since the last re-anchor.
      * @param resource Resource whose centre moved.
-     * @param anchor The counterparty's part after the move. Zero right after a deposit means the
+     * @param anchor The anchor after the move. Zero right after a deposit means the
      *        deposit opened the band, and the band has no width until its first re-anchor.
      * @param centre New stored centre, before drift.
      */

package/contracts/migrator/Migrator.sol

@@ -6,6 +6,7 @@ import { SafeERC20 } from "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.s
 import { ReentrancyGuard } from "@openzeppelin/contracts/security/ReentrancyGuard.sol";
 
 import { IHub } from "../interfaces/IHub.sol";
+import { IHubRegistry } from "../interfaces/IHubRegistry.sol";
 import { IMigrator } from "../interfaces/IMigrator.sol";
 import { IVBep20 } from "../interfaces/external/IVBep20.sol";
 import { IWBNB } from "../interfaces/external/IWBNB.sol";
@@ -14,12 +15,16 @@ import { IWBNB } from "../interfaces/external/IWBNB.sol";
  * @title Migrator
  * @author Venus
  * @notice One-click migration from a Venus Core position into a Liquidity Hub. A single immutable,
- *         permissionless deployment serves every Hub; the target Hub is supplied per call.
+ *         permissionless deployment serves every registered Hub; the target Hub is supplied per call
+ *         and must be present in the HubRegistry.
  * @dev Stateless by design — no proxy, no admin, no funds held between calls. Each migration is
  *      atomic: pull the user's vToken, redeem it to the underlying, deposit that into the Hub, and
  *      mint shares straight to the receiver. If any leg fails the whole call reverts and the user
  *      keeps their vToken.
  *
+ *      The target `hub` is checked against the immutable {HUB_REGISTRY} before any funds move, so a
+ *      migration can only land in a Hub governance has registered.
+ *
  *      Accounting is done by balance delta, never by a self-reported amount: Core `redeem` returns
  *      a Compound error code (not the redeemed amount) and silently nets out any Comptroller
  *      treasury fee, so the Migrator measures what actually arrived and deposits exactly that. The
@@ -34,16 +39,24 @@ import { IWBNB } from "../interfaces/external/IWBNB.sol";
 contract Migrator is IMigrator, ReentrancyGuard {
     using SafeERC20 for IERC20;
 
-    /// @notice Canonical wrapped-native token; `address(0)` disables the native path.
+    /// @notice Governance-curated directory of valid Hubs.
+    IHubRegistry public immutable HUB_REGISTRY;
+    /// @notice Canonical wrapped-native token (WBNB).
     IWBNB public immutable WBNB;
-    /// @notice Canonical Venus native market (vBNB); `address(0)` disables the native path.
+    /// @notice Canonical Venus native market (vBNB).
     IVBep20 public immutable VBNB;
 
     /**
-     * @param wbnb_ Wrapped-native token, or `address(0)` on chains/deployments with no WBNB Hub.
-     * @param vbnb_ Venus native market (vBNB), or `address(0)` to leave the native path disabled.
+     * @param wbnb_ Wrapped-native token (WBNB). Mandatory; the constructor reverts on the zero address.
+     * @param vbnb_ Venus native market (vBNB). Mandatory; the constructor reverts on the zero address.
+     * @param hubRegistry_ The HubRegistry every migration target is validated against. Mandatory;
+     *        the constructor reverts on the zero address, since without it no Hub would be accepted.
      */
-    constructor(IWBNB wbnb_, IVBep20 vbnb_) {
+    constructor(IWBNB wbnb_, IVBep20 vbnb_, IHubRegistry hubRegistry_) {
+        if (address(wbnb_) == address(0) || address(vbnb_) == address(0) || address(hubRegistry_) == address(0)) {
+            revert ZeroAddress();
+        }
+        HUB_REGISTRY = hubRegistry_;
         WBNB = wbnb_;
         VBNB = vbnb_;
     }
@@ -111,6 +124,7 @@ contract Migrator is IMigrator, ReentrancyGuard {
             revert ZeroAddress();
         }
         if (vTokenAmount == 0) revert ZeroAmount();
+        if (!HUB_REGISTRY.isHub(hub)) revert HubNotRegistered(hub);
 
         address asset = IHub(hub).asset();
         address vTokenUnderlying = IVBep20(vToken).underlying();
@@ -135,11 +149,9 @@ contract Migrator is IMigrator, ReentrancyGuard {
         private
         returns (uint256 shares)
     {
-        if (address(WBNB) == address(0) || address(VBNB) == address(0)) {
-            revert BNBMigrationUnsupported();
-        }
         if (hub == address(0) || receiver == address(0)) revert ZeroAddress();
         if (vBNBAmount == 0) revert ZeroAmount();
+        if (!HUB_REGISTRY.isHub(hub)) revert HubNotRegistered(hub);
 
         address asset = IHub(hub).asset();
         if (asset != address(WBNB)) revert AssetMismatch(address(WBNB), asset);

package/deployments/bscmainnet/Migrator.json

@@ -1,6 +1,6 @@
 {
-  "address": "0xfe6b8BEf1215C19Cd247FbF495ef560932F1Eb9B",
-  "block": 112781054,
+  "address": "0xb0D77DC86d4E6a8282eECF3d4d456B3b94F2a7aD",
+  "block": 115268335,
   "chainId": 56,
   "contract": "Migrator",
   "abi": [
@@ -16,6 +16,11 @@
           "name": "vbnb_",
           "type": "address",
           "internalType": "contract IVBep20"
+        },
+        {
+          "name": "hubRegistry_",
+          "type": "address",
+          "internalType": "contract IHubRegistry"
         }
       ],
       "stateMutability": "nonpayable"
@@ -24,6 +29,19 @@
       "type": "receive",
       "stateMutability": "payable"
     },
+    {
+      "type": "function",
+      "name": "HUB_REGISTRY",
+      "inputs": [],
+      "outputs": [
+        {
+          "name": "",
+          "type": "address",
+          "internalType": "contract IHubRegistry"
+        }
+      ],
+      "stateMutability": "view"
+    },
     {
       "type": "function",
       "name": "VBNB",
@@ -292,8 +310,14 @@
     },
     {
       "type": "error",
-      "name": "BNBMigrationUnsupported",
-      "inputs": []
+      "name": "HubNotRegistered",
+      "inputs": [
+        {
+          "name": "hub",
+          "type": "address",
+          "internalType": "address"
+        }
+      ]
     },
     {
       "type": "error",

package/deployments/bscmainnet_addresses.json

@@ -30,7 +30,7 @@
     "Hub_U": "0x0e5AA174d4F31b757a237eb1999DE151596788B0",
     "Hub_USDC": "0x9D2D9592cF8DFbf59107fAab703d08494BE14617",
     "Hub_USDT": "0x18AfDACF30F8671021dec4b78297E39d2FE87226",
-    "Migrator": "0xfe6b8BEf1215C19Cd247FbF495ef560932F1Eb9B",
+    "Migrator": "0xb0D77DC86d4E6a8282eECF3d4d456B3b94F2a7aD",
     "SpokeBeacon": "0x652AAa1CD21f47a92D04680C1d9Bf99cC1Fb8975",
     "SpokeSource_U": "0xcA3f9AFD7C4c1022E4A37a12671Ef57B8A7bfc51",
     "SpokeSource_USDC": "0x4cd4aB2F88E39D3F3e481bb2555EcdF00266f717",

package/deployments/bsctestnet/Migrator.json

@@ -1,6 +1,6 @@
 {
-  "address": "0x343D518d8C89f9B5D770000F1ed80f45bF1419f5",
-  "block": 119460060,
+  "address": "0x907d344E53A6e51Cb3E01cb76495D6C5325d72e8",
+  "block": 124402350,
   "chainId": 97,
   "contract": "Migrator",
   "abi": [
@@ -16,6 +16,11 @@
           "name": "vbnb_",
           "type": "address",
           "internalType": "contract IVBep20"
+        },
+        {
+          "name": "hubRegistry_",
+          "type": "address",
+          "internalType": "contract IHubRegistry"
         }
       ],
       "stateMutability": "nonpayable"
@@ -24,6 +29,19 @@
       "type": "receive",
       "stateMutability": "payable"
     },
+    {
+      "type": "function",
+      "name": "HUB_REGISTRY",
+      "inputs": [],
+      "outputs": [
+        {
+          "name": "",
+          "type": "address",
+          "internalType": "contract IHubRegistry"
+        }
+      ],
+      "stateMutability": "view"
+    },
     {
       "type": "function",
       "name": "VBNB",
@@ -292,8 +310,14 @@
     },
     {
       "type": "error",
-      "name": "BNBMigrationUnsupported",
-      "inputs": []
+      "name": "HubNotRegistered",
+      "inputs": [
+        {
+          "name": "hub",
+          "type": "address",
+          "internalType": "address"
+        }
+      ]
     },
     {
       "type": "error",

package/deployments/bsctestnet_addresses.json

@@ -22,7 +22,7 @@
     "HubRegistryImpl": "0x4D2C18fB4520c2e4f7C754979e9a4F3BbC1BCe92",
     "HubRegistryProxyAdmin": "0x9f8413eEE33D434F6D4f40C83181f32A831c9ef7",
     "Hub_USDT": "0x7cE6ADF754D0eC81A6CF8ACd9C7454F45077dc61",
-    "Migrator": "0x343D518d8C89f9B5D770000F1ed80f45bF1419f5",
+    "Migrator": "0x907d344E53A6e51Cb3E01cb76495D6C5325d72e8",
     "MockCentrifugeShare_USDT": "0xFF5254510b85D00a4f28fEb850bddF18d6deB043",
     "MockCentrifugeVault_USDT": "0x8a3C1f806B635230b74741066DE9B0Aa902F83dC",
     "SpokeBeacon": "0x58099BEaa6A00F493eF67fF953866DDA4a502389",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@venusprotocol/liquidity-hub",
-  "version": "2.1.0-dev.7",
+  "version": "2.1.0-dev.8",
   "description": "Per-asset ERC-4626 allocator vault",
   "author": "Venus",
   "license": "BUSL-1.1",