feat: add master vault

contracts/tokenbridge/libraries/vault/IMasterVault.sol

@@ -0,0 +1,6 @@
+// SPDX-License-Identifier: Apache-2.0
+pragma solidity ^0.8.0;
+
+interface IMasterVault {
+    function setSubVault(address subVault, uint256 minSubVaultExchRateWad) external;
+}

contracts/tokenbridge/libraries/vault/IMasterVaultFactory.sol

@@ -0,0 +1,13 @@
+// SPDX-License-Identifier: Apache-2.0
+pragma solidity ^0.8.0;
+
+import "../gateway/IGatewayRouter.sol";
+
+interface IMasterVaultFactory {
+    event VaultDeployed(address indexed token, address indexed vault);
+
+    function initialize(address _owner, IGatewayRouter _gatewayRouter) external;
+    function deployVault(address token) external returns (address vault);
+    function calculateVaultAddress(address token) external view returns (address);
+    function getVault(address token) external returns (address);
+}

contracts/tokenbridge/libraries/vault/MasterVaultFactory.sol

@@ -0,0 +1,84 @@
+// SPDX-License-Identifier: Apache-2.0
+
+pragma solidity ^0.8.0;
+
+import "@openzeppelin/contracts/token/ERC20/extensions/IERC20Metadata.sol";
+import "@openzeppelin/contracts/proxy/beacon/UpgradeableBeacon.sol";
+import "@openzeppelin/contracts/token/ERC20/extensions/ERC4626.sol";
+import "../ClonableBeaconProxy.sol";
+import "./IMasterVault.sol";
+import "./IMasterVaultFactory.sol";
+import "./MasterVault.sol";
+import "../gateway/IGatewayRouter.sol";
+
+contract DefaultSubVault is ERC4626 {
+    constructor(address token) ERC4626(IERC20(token)) ERC20("Default SubVault", "DSV") {}
+}
+
+// todo: slim down this contract
+contract MasterVaultFactory is IMasterVaultFactory, Initializable {
+    error ZeroAddress();
+    error BeaconNotDeployed();
+
+    BeaconProxyFactory public beaconProxyFactory;
+    MasterVaultRoles public rolesRegistry;
+    IGatewayRouter public gatewayRouter;
+
+    function initialize(address _owner, IGatewayRouter _gatewayRouter) public initializer {
+        rolesRegistry = new MasterVaultRoles();
+        rolesRegistry.initialize(_owner);
+
+        gatewayRouter = _gatewayRouter;
+        MasterVault masterVaultImplementation = new MasterVault();
+        UpgradeableBeacon beacon = new UpgradeableBeacon(address(masterVaultImplementation));
+        beaconProxyFactory = new BeaconProxyFactory();
+        beaconProxyFactory.initialize(address(beacon));
+        beacon.transferOwnership(_owner);
+    }
+
+    function deployVault(address token) public returns (address vault) {
+        bytes32 userSalt = _getUserSalt(token);
+        vault = beaconProxyFactory.createProxy(userSalt);
+
+        string memory name = string(abi.encodePacked("Master ", _tryGetTokenName(token)));
+        string memory symbol = string(abi.encodePacked("m", _tryGetTokenSymbol(token)));
+
+        MasterVault(vault)
+            .initialize(new DefaultSubVault(token), name, symbol, rolesRegistry, gatewayRouter);
+
+        emit VaultDeployed(token, vault);
+    }
+
+    function _getUserSalt(address token) internal pure returns (bytes32) {
+        return keccak256(abi.encode(token));
+    }
+
+    function calculateVaultAddress(address token) public view returns (address) {
+        bytes32 userSalt = _getUserSalt(token);
+        return beaconProxyFactory.calculateExpectedAddress(address(this), userSalt);
+    }
+
+    function getVault(address token) external returns (address) {
+        address vault = calculateVaultAddress(token);
+        if (vault.code.length == 0) {
+            return deployVault(token);
+        }
+        return vault;
+    }
+
+    function _tryGetTokenName(address token) internal view returns (string memory) {
+        try IERC20Metadata(token).name() returns (string memory name) {
+            return name;
+        } catch {
+            return "";
+        }
+    }
+
+    function _tryGetTokenSymbol(address token) internal view returns (string memory) {
+        try IERC20Metadata(token).symbol() returns (string memory symbol) {
+            return symbol;
+        } catch {
+            return "";
+        }
+    }
+}

contracts/tokenbridge/libraries/vault/MasterVaultRoles.sol

@@ -0,0 +1,52 @@
+// SPDX-License-Identifier: Apache-2.0
+pragma solidity ^0.8.0;
+
+import {
+    AccessControlEnumerableUpgradeable
+} from "@openzeppelin/contracts-upgradeable/access/AccessControlEnumerableUpgradeable.sol";
+
+/// @notice Roles system for MasterVaults.
+///         Each MasterVault will have a reference to a singleton MasterVaultRoles contract, in addition to inheriting MasterVaultRoles directly.
+///         This allows for easier management of roles across multiple vaults.
+contract MasterVaultRoles is AccessControlEnumerableUpgradeable {
+    /// @notice The admin can:
+    ///         - Grant/revoke GENERAL_MANAGER_ROLE and ADMIN_ROLE
+    ///         - Add/remove whitelisted subvaults
+    bytes32 public constant ADMIN_ROLE = keccak256("ADMIN_ROLE");
+    /// @notice The general manager can:
+    ///         - Grant/revoke FEE_MANAGER_ROLE, PAUSER_ROLE, and KEEPER_ROLE
+    ///         - Set the subVault to any whitelisted subVault
+    ///         - Set the target allocation
+    ///         - Set the minimum rebalance amount
+    ///         - Set the rebalance cooldown
+    bytes32 public constant GENERAL_MANAGER_ROLE = keccak256("GENERAL_MANAGER_ROLE");
+    /// @notice The fee manager can:
+    ///         - Toggle performance fees on/off
+    ///         - Set the performance fee beneficiary
+    bytes32 public constant FEE_MANAGER_ROLE = keccak256("FEE_MANAGER_ROLE");
+    /// @notice The pauser can:
+    ///         - pause/unpause deposits and withdrawals
+    bytes32 public constant PAUSER_ROLE = keccak256("PAUSER_ROLE");
+    /// @notice The keeper can:
+    ///         - rebalance
+    ///         - distribute performance fees
+    bytes32 public constant KEEPER_ROLE = keccak256("KEEPER_ROLE");
+
+    function __MasterVaultRoles_init() internal onlyInitializing {
+        __AccessControlEnumerable_init();
+    }
+
+    function initialize(address admin) external initializer {
+        // set ADMIN_ROLE as admin of appropriate roles
+        _setRoleAdmin(ADMIN_ROLE, ADMIN_ROLE);
+        _setRoleAdmin(GENERAL_MANAGER_ROLE, ADMIN_ROLE);
+
+        // set GENERAL_MANAGER_ROLE as admin of appropriate roles
+        _setRoleAdmin(FEE_MANAGER_ROLE, GENERAL_MANAGER_ROLE);
+        _setRoleAdmin(PAUSER_ROLE, GENERAL_MANAGER_ROLE);
+        _setRoleAdmin(KEEPER_ROLE, GENERAL_MANAGER_ROLE);
+
+        // grant ADMIN_ROLE to admin
+        _grantRole(ADMIN_ROLE, admin);
+    }
+}

contracts/tokenbridge/test/MockSubVault.sol

@@ -0,0 +1,22 @@
+// SPDX-License-Identifier: Apache-2.0
+pragma solidity ^0.8.0;
+
+import {ERC4626} from "@openzeppelin/contracts/token/ERC20/extensions/ERC4626.sol";
+import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
+import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
+
+contract MockSubVault is ERC4626 {
+    constructor(
+        IERC20 _asset,
+        string memory _name,
+        string memory _symbol
+    ) ERC20(_name, _symbol) ERC4626(_asset) {}
+
+    function totalAssets() public view override returns (uint256) {
+        return IERC20(asset()).balanceOf(address(this));
+    }
+
+    function adminMint(address to, uint256 amount) external {
+        _mint(to, amount);
+    }
+}

contracts/tokenbridge/test/TestERC20.sol

@@ -28,6 +28,10 @@ contract TestERC20 is aeERC20 {
     function mint() external {
         _mint(msg.sender, 50000000);
     }
+
+    function mint(uint256 amount) external {
+        _mint(msg.sender, amount);
+    }
 }
 
 // test token code inspired from maker

foundry.toml

@@ -12,7 +12,23 @@ fs_permissions = [{ access = "read", path = "node_modules/@offchainlabs/stableco
 [fmt]
 number_underscore = 'thousands'
 line_length = 100
-# See more config options https://github.com/foundry-rs/foundry/tree/master/config
+tab_width = 4
+style = "space"
+bracket_spacing = false
+int_types = "long"
+multiline_func_header = "attributes_first"
+quote_style = "double"
+hex_underscore = "remove"
+single_line_statement_blocks = "preserve"
+override_spacing = false
+wrap_comments = false
+docs_style = "preserve"
+ignore = []
+contract_new_lines = false
+sort_imports = false
+pow_no_space = false
+prefer_compact = "all"
+single_line_imports = false
 
 [lint]
 lint_on_build = false

test-foundry/libraries/vault/MasterVault.t.sol

@@ -0,0 +1,146 @@
+// SPDX-License-Identifier: UNLICENSED
+pragma solidity ^0.8.0;
+
+import { MasterVaultCoreTest } from "./MasterVaultCore.t.sol";
+import { MockSubVault } from "../../../contracts/tokenbridge/test/MockSubVault.sol";
+import { IERC20 } from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
+import { IERC4626 } from "@openzeppelin/contracts/interfaces/IERC4626.sol";
+import { Math } from "@openzeppelin/contracts/utils/math/Math.sol";
+
+contract MasterVaultFirstDepositTest is MasterVaultCoreTest {
+    using Math for uint256;
+
+    // first deposit
+    function test_deposit(uint96 _depositAmount) public {
+        uint256 depositAmount = _depositAmount;
+        vm.startPrank(user);
+        token.mint(depositAmount);
+        token.approve(address(vault), depositAmount);
+        uint256 shares = vault.deposit(depositAmount, user);
+        vm.stopPrank();
+        _checkState(
+            State({
+                userShares: depositAmount * DEAD_SHARES,
+                masterVaultTotalAssets: depositAmount,
+                masterVaultTotalSupply: (1 + depositAmount) * DEAD_SHARES,
+                masterVaultTokenBalance: depositAmount,
+                masterVaultSubVaultShareBalance: 0,
+                masterVaultTotalPrincipal: 0,
+                subVaultTotalAssets: 0,
+                subVaultTotalSupply: 0,
+                subVaultTokenBalance: 0
+            })
+        );
+        assertEq(shares, depositAmount * DEAD_SHARES, "shares mismatch deposit return value");
+    }
+
+    function test_mint(uint96 _mintAmount) public {
+        uint256 mintAmount = _mintAmount;
+        vm.startPrank(user);
+        token.mint(mintAmount);
+        token.approve(address(vault), mintAmount);
+        uint256 assets = vault.mint(mintAmount, user);
+        vm.stopPrank();
+        _checkState(
+            State({
+                userShares: mintAmount,
+                masterVaultTotalAssets: mintAmount.ceilDiv(1e18),
+                masterVaultTotalSupply: mintAmount + DEAD_SHARES,
+                masterVaultTokenBalance: mintAmount.ceilDiv(1e18),
+                masterVaultSubVaultShareBalance: 0,
+                masterVaultTotalPrincipal: 0,
+                subVaultTotalAssets: 0,
+                subVaultTotalSupply: 0,
+                subVaultTokenBalance: 0
+            })
+        );
+        assertEq(assets, mintAmount.ceilDiv(1e18), "assets mismatch mint return value");
+    }
+
+    function test_withdraw(uint96 _firstDeposit, uint96 _withdrawAmount) public {
+        uint256 firstDeposit = _firstDeposit;
+        uint256 withdrawAmount = _withdrawAmount;
+        vm.assume(withdrawAmount <= firstDeposit);
+        test_deposit(_firstDeposit);
+        vm.startPrank(user);
+        uint256 sharesRedeemed = vault.withdraw(withdrawAmount, user, user);
+        vm.stopPrank();
+        _checkState(
+            State({
+                userShares: (firstDeposit - withdrawAmount) * DEAD_SHARES,
+                masterVaultTotalAssets: firstDeposit - withdrawAmount,
+                masterVaultTotalSupply: (1 + firstDeposit - withdrawAmount) * DEAD_SHARES,
+                masterVaultTokenBalance: firstDeposit - withdrawAmount,
+                masterVaultSubVaultShareBalance: 0,
+                masterVaultTotalPrincipal: 0,
+                subVaultTotalAssets: 0,
+                subVaultTotalSupply: 0,
+                subVaultTokenBalance: 0
+            })
+        );
+        assertEq(
+            sharesRedeemed,
+            withdrawAmount * DEAD_SHARES,
+            "sharesRedeemed mismatch withdraw return value"
+        );
+    }
+
+    function test_redeem(uint96 _firstMint, uint96 _redeemAmount) public {
+        uint256 firstMint = _firstMint;
+        uint256 redeemAmount = _redeemAmount;
+        vm.assume(redeemAmount <= firstMint);
+        test_mint(_firstMint);
+        State memory beforeState = _getState();
+        vm.startPrank(user);
+        uint256 assets = vault.redeem(redeemAmount, user, user);
+        uint256 expectedAssets = ((1 + beforeState.masterVaultTotalAssets) * redeemAmount) /
+            (beforeState.masterVaultTotalSupply);
+        vm.stopPrank();
+        _checkState(
+            State({
+                userShares: beforeState.userShares - redeemAmount,
+                masterVaultTotalAssets: beforeState.masterVaultTotalAssets - expectedAssets,
+                masterVaultTotalSupply: beforeState.masterVaultTotalSupply - redeemAmount,
+                masterVaultTokenBalance: beforeState.masterVaultTokenBalance - expectedAssets,
+                masterVaultSubVaultShareBalance: 0,
+                masterVaultTotalPrincipal: 0,
+                subVaultTotalAssets: 0,
+                subVaultTotalSupply: 0,
+                subVaultTokenBalance: 0
+            })
+        );
+        assertEq(assets, expectedAssets, "assets mismatch redeem return value");
+    }
+}
+
+// contract MasterVaultTestWithSubvaultFresh is MasterVaultFirstDepositTest {
+//     function setUp() public override {
+//         super.setUp();
+//         MockSubVault _subvault = new MockSubVault(IERC20(address(token)), "TestSubvault", "TSV");
+//         vault.setSubVault(IERC4626(address(_subvault)));
+//     }
+// }
+
+// contract MasterVaultTestWithSubvaultHoldingAssets is MasterVaultFirstDepositTest {
+//     function setUp() public override {
+//         super.setUp();
+
+//         MockSubVault _subvault = new MockSubVault(IERC20(address(token)), "TestSubvault", "TSV");
+//         uint256 _initAmount = 97659743;
+//         token.mint(_initAmount);
+//         token.approve(address(_subvault), _initAmount);
+//         _subvault.deposit(_initAmount, address(this));
+//         assertEq(
+//             _initAmount,
+//             _subvault.totalAssets(),
+//             "subvault should be initiated with assets = _initAmount"
+//         );
+//         assertEq(
+//             _initAmount,
+//             _subvault.totalSupply(),
+//             "subvault should be initiated with shares = _initAmount"
+//         );
+
+//         vault.setSubVault(IERC4626(address(_subvault)));
+//     }
+// }