feat: watchpug audit changes (#38)

* WP-H1, WP-M2, WP-H3, WP-H4, WP-H5, WP-I6

* polygon deployments

* mainnet deployments

.env.example

@@ -0,0 +1,4 @@
+ALCHEMY_ID=
+PK=
+ETHERSCAN_API_KEY=
+TEST_PK=

README.md

@@ -1,8 +1,12 @@
-# Vault V2 Core
+# V2 Core
 
-Arrakis Vault Version 2, Core Contracts
+Arrakis Vaults Version 2, Core Contracts
 
-# test
+## Setup
+
+fill in `.env` file (see: `.env.example` for necessary environment vars)
+
+# Test
 
 yarn
 

contracts/ArrakisV2.sol

@@ -29,7 +29,6 @@ import {Position} from "./libraries/Position.sol";
 import {Pool} from "./libraries/Pool.sol";
 import {Manager} from "./libraries/Manager.sol";
 import {Underlying as UnderlyingHelper} from "./libraries/Underlying.sol";
-import {UniswapV3Amounts} from "./libraries/UniswapV3Amounts.sol";
 
 /// @dev DO NOT ADD STATE VARIABLES - APPEND THEM TO ArrakisV2Storage
 contract ArrakisV2 is IUniswapV3MintCallback, ArrakisV2Storage {
@@ -79,16 +78,7 @@ contract ArrakisV2 is IUniswapV3MintCallback, ArrakisV2Storage {
                 )
                 : (init0, init1, 0, 0);
         uint256 denominator = totalSupply > 0 ? totalSupply : 1 ether;
-        /// @dev current0 and current1 include fees and left over.
-
-        (current0, current1) = UniswapV3Amounts.subtractAdminFeesOnAmounts(
-            fee0,
-            fee1,
-            Manager.getManagerFeeBPS(manager),
-            arrakisFeeBPS,
-            current0,
-            current1
-        );
+        /// @dev current0 and current1 include fees and left over (but not admin balances)
 
         amount0 = FullMath.mulDivRoundingUp(mintAmount_, current0, denominator);
         amount1 = FullMath.mulDivRoundingUp(mintAmount_, current1, denominator);
@@ -139,16 +129,6 @@ contract ArrakisV2 is IUniswapV3MintCallback, ArrakisV2Storage {
             (managerBalance1 + arrakisBalance1);
 
         {
-            (underlying.amount0, underlying.amount1) = UniswapV3Amounts
-                .subtractAdminFeesOnAmounts(
-                    underlying.fee0,
-                    underlying.fee1,
-                    Manager.getManagerFeeBPS(manager),
-                    arrakisFeeBPS,
-                    underlying.amount0,
-                    underlying.amount1
-                );
-
             // the proportion of user balance.
             amount0 = FullMath.mulDiv(
                 underlying.amount0,
@@ -262,6 +242,16 @@ contract ArrakisV2 is IUniswapV3MintCallback, ArrakisV2Storage {
             ranges.push(ranges_[i]);
         }
         _rebalance(rebalanceParams_);
+        require(
+            token0.balanceOf(address(this)) >=
+                managerBalance0 + arrakisBalance0,
+            "MB0"
+        );
+        require(
+            token1.balanceOf(address(this)) >=
+                managerBalance1 + arrakisBalance1,
+            "MB1"
+        );
         for (uint256 i = 0; i < rangesToRemove_.length; i++) {
             (bool exist, uint256 index) = Position.rangeExist(
                 ranges,
@@ -359,7 +349,7 @@ contract ArrakisV2 is IUniswapV3MintCallback, ArrakisV2Storage {
 
         if (rebalanceParams_.swap.amountIn > 0) {
             {
-                require(!_pools.contains(rebalanceParams_.swap.pool), "NP");
+                require(_routers.contains(rebalanceParams_.swap.router), "NR");
 
                 uint256 balance0Before = token0.balanceOf(address(this));
                 uint256 balance1Before = token1.balanceOf(address(this));
@@ -392,7 +382,7 @@ contract ArrakisV2 is IUniswapV3MintCallback, ArrakisV2Storage {
                         (balance1After >=
                             balance1Before +
                                 rebalanceParams_.swap.expectedMinReturn) &&
-                            (balance0After ==
+                            (balance0After >=
                                 balance0Before -
                                     rebalanceParams_.swap.amountIn),
                         "SF"
@@ -402,7 +392,7 @@ contract ArrakisV2 is IUniswapV3MintCallback, ArrakisV2Storage {
                         (balance0After >=
                             balance0Before +
                                 rebalanceParams_.swap.expectedMinReturn) &&
-                            (balance1After ==
+                            (balance1After >=
                                 balance1Before -
                                     rebalanceParams_.swap.amountIn),
                         "SF"

contracts/ArrakisV2Resolver.sol

@@ -16,7 +16,6 @@ import {
 import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
 import {Underlying as UnderlyingHelper} from "./libraries/Underlying.sol";
 import {UniswapV3Amounts} from "./libraries/UniswapV3Amounts.sol";
-import {Manager} from "./libraries/Manager.sol";
 import {Position as PositionHelper} from "./libraries/Position.sol";
 import {FullMath} from "@arrakisfi/v3-lib-0.8/contracts/FullMath.sol";
 import {TickMath} from "@arrakisfi/v3-lib-0.8/contracts/TickMath.sol";
@@ -170,24 +169,14 @@ contract ArrakisV2Resolver is IArrakisV2Resolver {
                     self: address(vaultV2_)
                 })
             );
-            underlying.leftOver0 = vaultV2_.token0().balanceOf(
-                address(vaultV2_)
-            );
-            underlying.leftOver1 = vaultV2_.token1().balanceOf(
-                address(vaultV2_)
-            );
-
-            {
-                (uint256 fee0, uint256 fee1) = UniswapV3Amounts
-                    .subtractAdminFees(
-                        underlying.fee0,
-                        underlying.fee1,
-                        Manager.getManagerFeeBPS(vaultV2_.manager()),
-                        vaultV2_.arrakisFeeBPS()
-                    );
-                underlying.amount0 += underlying.leftOver0 + fee0;
-                underlying.amount1 += underlying.leftOver1 + fee1;
-            }
+            underlying.leftOver0 =
+                vaultV2_.token0().balanceOf(address(vaultV2_)) -
+                vaultV2_.managerBalance0() -
+                vaultV2_.arrakisBalance0();
+            underlying.leftOver1 =
+                vaultV2_.token1().balanceOf(address(vaultV2_)) -
+                vaultV2_.managerBalance1() -
+                vaultV2_.arrakisBalance1();
 
             {
                 uint256 amount0 = FullMath.mulDiv(

contracts/abstract/ArrakisV2Storage.sol

@@ -63,6 +63,7 @@ abstract contract ArrakisV2Storage is
     // #endregion manager data
 
     EnumerableSet.AddressSet internal _pools;
+    EnumerableSet.AddressSet internal _routers;
 
     // #region events
 
@@ -97,7 +98,8 @@ abstract contract ArrakisV2Storage is
     event LogRemovePools(address[] pools);
     event LogSetManager(address newManager);
     event LogRestrictedMint(address minter);
-
+    event LogWhitelistRouters(address[] routers);
+    event LogBlacklistRouters(address[] routers);
     // #endregion Setting events
 
     // #endregion events
@@ -130,12 +132,11 @@ abstract contract ArrakisV2Storage is
 
         require(params_.init0 > 0 || params_.init1 > 0, "I");
 
-        require(params_.manager != address(0), "NAZM");
-
         __ERC20_init(name_, symbol_);
         __ReentrancyGuard_init();
 
         _addPools(params_.feeTiers, params_.token0, params_.token1);
+        _whitelistRouters(params_.routers);
 
         token0 = IERC20(params_.token0);
         token1 = IERC20(params_.token1);
@@ -151,6 +152,7 @@ abstract contract ArrakisV2Storage is
 
     // #region setter functions
     function setInits(uint256 init0_, uint256 init1_) external {
+        require(init0_ > 0 || init1_ > 0, "I");
         require(totalSupply() == 0, "TS");
         address requiredCaller = restrictedMint == address(0)
             ? owner()
@@ -173,6 +175,20 @@ abstract contract ArrakisV2Storage is
         emit LogRemovePools(pools_);
     }
 
+    function whitelistRouters(address[] calldata routers_) external onlyOwner {
+        _whitelistRouters(routers_);
+        emit LogWhitelistRouters(routers_);
+    }
+
+    function blacklistRouters(address[] calldata routers_) external onlyOwner {
+        for (uint256 i = 0; i < routers_.length; i++) {
+            require(_routers.contains(routers_[i]), "NR");
+
+            _routers.remove(routers_[i]);
+        }
+        emit LogBlacklistRouters(routers_);
+    }
+
     function setManager(IManager manager_) external onlyOwner {
         emit LogSetManager(address(manager = manager_));
     }
@@ -222,5 +238,18 @@ abstract contract ArrakisV2Storage is
         }
     }
 
+    function _whitelistRouters(address[] calldata routers_) internal {
+        for (uint256 i = 0; i < routers_.length; i++) {
+            require(
+                routers_[i] != address(token0) &&
+                    routers_[i] != address(token1),
+                "RT"
+            );
+            require(!_routers.contains(routers_[i]), "CR");
+            // explicit.
+            _routers.add(routers_[i]);
+        }
+    }
+
     // #endregion internal functions
 }

contracts/libraries/Underlying.sol

@@ -18,6 +18,7 @@ import {
 } from "../structs/SArrakisV2.sol";
 import {UniswapV3Amounts} from "./UniswapV3Amounts.sol";
 import {Position} from "./Position.sol";
+import {Manager} from "./Manager.sol";
 
 library Underlying {
     // solhint-disable-next-line function-max-lines
@@ -58,6 +59,15 @@ library Underlying {
 
         IArrakisV2 arrakisV2 = IArrakisV2(underlyingPayload_.self);
 
+        (amount0, amount1) = UniswapV3Amounts.subtractAdminFeesOnAmounts(
+            fee0,
+            fee1,
+            Manager.getManagerFeeBPS(arrakisV2.manager()),
+            arrakisV2.arrakisFeeBPS(),
+            amount0,
+            amount1
+        );
+
         amount0 +=
             IERC20(underlyingPayload_.token0).balanceOf(
                 underlyingPayload_.self

contracts/structs/SArrakisV2.sol

@@ -20,7 +20,6 @@ struct BurnLiquidity {
 
 struct SwapPayload {
     bytes payload;
-    address pool;
     address router;
     uint256 amountIn;
     uint256 expectedMinReturn;
@@ -54,6 +53,7 @@ struct InitializePayload {
     uint256 init0;
     uint256 init1;
     address manager;
+    address[] routers;
 }
 
 // #region internal Structs

deploy/ArrakisV2.deploy.ts

@@ -27,7 +27,6 @@ const func: DeployFunction = async (hre: HardhatRuntimeEnvironment) => {
       Pool: (await ethers.getContract("Pool")).address,
       Position: (await ethers.getContract("Position")).address,
       Underlying: (await ethers.getContract("Underlying")).address,
-      UniswapV3Amounts: (await ethers.getContract("UniswapV3Amounts")).address,
       Manager: (await ethers.getContract("Manager")).address,
     },
     log: hre.network.name != "hardhat" ? true : false,
@@ -45,10 +44,4 @@ func.skip = async (hre: HardhatRuntimeEnvironment) => {
   return shouldSkip ? true : false;
 };
 func.tags = ["ArrakisV2"];
-func.dependencies = [
-  "Pool",
-  "Position",
-  "Underlying",
-  "UniswapV3Amounts",
-  "Manager",
-];
+func.dependencies = ["Pool", "Position", "Underlying", "Manager"];

deploy/ArrakisV2Resolver.deploy.ts

@@ -53,5 +53,4 @@ func.dependencies = [
   "Position",
   "Underlying",
   "UniswapV3Amounts",
-  "Manager",
 ];

deploy/Underlying.deploy.ts

@@ -23,6 +23,7 @@ const func: DeployFunction = async (hre: HardhatRuntimeEnvironment) => {
     libraries: {
       Position: (await ethers.getContract("Position")).address,
       UniswapV3Amounts: (await ethers.getContract("UniswapV3Amounts")).address,
+      Manager: (await ethers.getContract("Manager")).address,
     },
     log: hre.network.name != "hardhat" ? true : false,
   });
@@ -39,4 +40,4 @@ func.skip = async (hre: HardhatRuntimeEnvironment) => {
   return shouldSkip ? true : false;
 };
 func.tags = ["Underlying"];
-func.dependencies = ["Position", "UniswapV3Amounts"];
+func.dependencies = ["Position", "UniswapV3Amounts", "Manager"];