feat: Check from in hub.add (#402)

* fix: check from in hub.add

* feat: update gas snapshots

* fix: test

* fix: comments

* fix: comments

* Update tests/unit/LiquidityHub/LiquidityHub.Supply.t.sol

Co-authored-by: miguelmtz <[email protected]>

* fix: tests

---------

Co-authored-by: miguelmtz <[email protected]>

Author: avniculae

snapshots/Hub.Operations.json

@@ -1,5 +1,5 @@
 {
-  "add": "186415",
+  "add": "186460",
   "draw": "122714",
   "remove: full": "79984",
   "remove: partial": "96270",

snapshots/Spoke.Operations.json

@@ -2,11 +2,11 @@
   "borrow": "481646",
   "repay: full": "221830",
   "repay: partial": "290042",
-  "supply: 0 debt, collateralDisabled": "171802",
-  "supply: 0 debt, collateralEnabled": "171778",
-  "supply: 1 debt": "171826",
-  "supply: 2 debt": "171837",
-  "supply: 3 debt": "171790",
+  "supply: 0 debt, collateralDisabled": "171847",
+  "supply: 0 debt, collateralEnabled": "171823",
+  "supply: 1 debt": "171871",
+  "supply: 2 debt": "171882",
+  "supply: 3 debt": "171835",
   "updateUserRiskPremium": "172555",
   "updateUserRiskPremium: 2 debts": "213546",
   "usingAsCollateral": "50661",

src/contracts/LiquidityHub.sol

@@ -114,7 +114,7 @@ contract LiquidityHub is ILiquidityHub {
     DataTypes.SpokeData storage spoke = _spokes[assetId][msg.sender];
 
     asset.accrue();
-    _validateSupply(asset, spoke, amount);
+    _validateSupply(asset, spoke, amount, from);
 
     asset.updateBorrowRate({liquidityAdded: amount, liquidityTaken: 0});
 
@@ -387,9 +387,11 @@ contract LiquidityHub is ILiquidityHub {
   function _validateSupply(
     DataTypes.Asset storage asset,
     DataTypes.SpokeData storage spoke,
-    uint256 amount
+    uint256 amount,
+    address from
   ) internal view {
     require(amount != 0, InvalidSupplyAmount());
+    require(from != address(this), InvalidAddFromHub());
     require(asset.config.active, AssetNotActive());
     require(!asset.config.paused, AssetPaused());
     require(!asset.config.frozen, AssetFrozen());

src/interfaces/ILiquidityHub.sol

@@ -20,11 +20,7 @@ interface ILiquidityHub {
     uint256 supplyCap
   );
 
-  event DrawnIndexUpdate(
-    uint256 indexed assetId, 
-    uint256 drawnIndex,
-    uint256 lastUpdateTimestamp
-  );
+  event DrawnIndexUpdate(uint256 indexed assetId, uint256 drawnIndex, uint256 lastUpdateTimestamp);
   event Add(
     uint256 indexed assetId,
     address indexed spoke,
@@ -60,6 +56,7 @@ interface ILiquidityHub {
   error MismatchedConfigs();
   error InvalidSharesAmount();
   error InvalidSupplyAmount();
+  error InvalidAddFromHub();
   error AssetNotListed();
   error AssetNotActive();
   error SupplyCapExceeded(uint256 supplyCap);

tests/unit/LiquidityHub/LiquidityHub.Supply.t.sol

@@ -311,19 +311,26 @@ contract LiquidityHubSupplyTest is LiquidityHubBase {
   }
 
   /// @dev User makes a first supply, shares and assets amounts are correct, no precision loss
-  function test_supply_fuzz_single_asset(uint256 assetId, uint256 amount) public {
+  function test_supply_fuzz_single_asset(uint256 assetId, address user, uint256 amount) public {
+    vm.assume(user != address(0) && user != address(hub));
+  
     assetId = bound(assetId, 0, hub.assetCount() - 2); // Exclude duplicated DAI
     amount = bound(amount, 1, MAX_SUPPLY_AMOUNT);
 
     uint256 expectedSupplyShares = hub.convertToSuppliedShares(daiAssetId, amount);
     IERC20 asset = hub.assetsList(assetId);
+
+    deal(address(asset), user, MAX_SUPPLY_AMOUNT);
+    vm.prank(user);
+    asset.approve(address(hub), amount);
+
     vm.expectEmit(address(asset));
-    emit IERC20.Transfer(alice, address(hub), amount);
+    emit IERC20.Transfer(user, address(hub), amount);
     vm.expectEmit(address(hub));
     emit ILiquidityHub.Add(assetId, address(spoke1), amount, amount);
 
     vm.prank(address(spoke1));
-    hub.add(assetId, amount, alice);
+    hub.add(assetId, amount, user);
 
     // hub
     assertEq(hub.getAssetSuppliedAmount(assetId), amount, 'hub asset suppliedAmount after');
@@ -344,7 +351,7 @@ contract LiquidityHubSupplyTest is LiquidityHubBase {
     );
     assertEq(hub.getAsset(assetId).lastUpdateTimestamp, vm.getBlockTimestamp());
     // token balance
-    assertEq(asset.balanceOf(alice), MAX_SUPPLY_AMOUNT - amount, 'user token balance post-supply');
+    assertEq(asset.balanceOf(user), MAX_SUPPLY_AMOUNT - amount, 'user token balance post-supply');
     assertEq(asset.balanceOf(address(spoke1)), 0, 'spoke token balance post-supply');
     assertEq(asset.balanceOf(address(hub)), amount, 'hub token balance post-supply');
   }
@@ -508,6 +515,13 @@ contract LiquidityHubSupplyTest is LiquidityHubBase {
     hub.add(daiAssetId, supplyAmount, alice);
   }
 
+  function test_supply_revertsWith_InvalidAddFromHub() public {
+    vm.expectRevert(ILiquidityHub.InvalidAddFromHub.selector, address(hub));
+
+    vm.prank(address(spoke1));
+    hub.add(daiAssetId, 100e18, address(hub));
+  }
+
   function test_supply_with_increased_index() public {
     uint256 daiAmount = 100e18;
 

tests/unit/Spoke/Spoke.Repay.Scenario.t.sol

@@ -1308,7 +1308,7 @@ contract SpokeRepayScenarioTest is SpokeBase {
     address caller,
     uint256 assets
   ) public {
-    vm.assume(caller != address(0));
+    vm.assume(caller != address(0) && caller != address(hub));
     reserveId = bound(reserveId, 0, spoke1.reserveCount() - 1);
     userBorrowing = bound(userBorrowing, 0, MAX_SUPPLY_AMOUNT / 2 - 1); // Allow some buffer from borrow cap
     skipTime = uint40(bound(skipTime, 0, MAX_SKIP_TIME));
@@ -1361,7 +1361,7 @@ contract SpokeRepayScenarioTest is SpokeBase {
     uint256 assets
   ) public {
     uint256 MAX_BORROW_AMOUNT = MAX_SUPPLY_AMOUNT / 2;
-    vm.assume(caller != address(0));
+    vm.assume(caller != address(0) && caller != address(hub));
     reserveId = bound(reserveId, 0, spoke1.reserveCount() - 1);
     userBorrowing = bound(userBorrowing, 0, MAX_BORROW_AMOUNT - 2); // Allow some buffer from borrow cap
     skipTime = uint40(bound(skipTime, 0, MAX_SKIP_TIME));

tests/unit/Spoke/Spoke.Withdraw.Scenario.t.sol

@@ -306,7 +306,7 @@ contract SpokeWithdrawScenarioTest is SpokeBase {
     address caller,
     uint256 assets
   ) public {
-    vm.assume(caller != address(0));
+    vm.assume(caller != address(0) && caller != address(hub));
     reserveId = bound(reserveId, 0, spoke1.reserveCount() - 1);
     protocolStartingBalance = bound(protocolStartingBalance, 1, MAX_SUPPLY_AMOUNT - 1); // Allow some buffer from supply cap
     assets = bound(assets, 1, MAX_SUPPLY_AMOUNT - protocolStartingBalance);
@@ -353,7 +353,7 @@ contract SpokeWithdrawScenarioTest is SpokeBase {
     address caller,
     uint256 assets
   ) public {
-    vm.assume(caller != address(0));
+    vm.assume(caller != address(0) && caller != address(hub));
     reserveId = bound(reserveId, 0, spoke1.reserveCount() - 1);
     protocolStartingBalance = bound(protocolStartingBalance, 1, MAX_SUPPLY_AMOUNT - 1); // Allow some buffer from supply cap
     assets = bound(assets, 1, MAX_SUPPLY_AMOUNT - protocolStartingBalance);