feat: deployment engine

foundry.toml

@@ -6,8 +6,7 @@ libs = ['lib']
 fs_permissions = [
   { access = "read", path = "tests/mocks/JsonBindings.sol" },
   { access = "read", path = "./config" },
-  { access = "read-write", path = "./output" },
-  { access = "read-write", path = "./scripts/deploy/inputs" }
+  { access = "read-write", path = "./output" }
 ]
 solc_version = "0.8.28"
 evm_version = "cancun"

scripts/deploy/AaveV4DeployBatchBase.s.sol

@@ -12,11 +12,15 @@ import {
 import {Script} from 'forge-std/Script.sol';
 
 abstract contract AaveV4DeployBatchBaseScript is Script, InputUtils {
-  string internal constant INPUT_PATH = 'scripts/deploy/inputs/';
-  string internal constant OUTPUT_DIR = 'output/reports/deployments/';
+  struct Warnings {
+    string[] s;
+  }
 
+  string internal constant INPUT_PATH = 'config/';
+  string internal constant OUTPUT_DIR = 'output/reports/deployments/';
   string internal _inputFileName;
   string internal _outputFileName;
+  Warnings internal _warnings;
 
   constructor(string memory inputFileName_, string memory outputFileName_) {
     _inputFileName = inputFileName_;
@@ -30,8 +34,7 @@ abstract contract AaveV4DeployBatchBaseScript is Script, InputUtils {
       string.concat(INPUT_PATH, _inputFileName)
     );
     (, address deployer, ) = vm.readCallers();
-    _loadWarnings(logger, inputs);
-    inputs = _sanitizeInputs(inputs, deployer);
+    inputs = _loadWarningsAndSanitizeInputs(logger, inputs, deployer);
 
     logger.log('...Starting Aave V4 Batch Deployment...');
     vm.startBroadcast(deployer);
@@ -44,119 +47,119 @@ abstract contract AaveV4DeployBatchBaseScript is Script, InputUtils {
     logger.save({fileName: _outputFileName, withTimestamp: true});
   }
 
-  function _loadWarnings(MetadataLogger logger, FullDeployInputs memory inputs) internal virtual {
+  function _loadWarningsAndSanitizeInputs(
+    MetadataLogger logger,
+    FullDeployInputs memory inputs,
+    address deployer
+  ) internal virtual returns (FullDeployInputs memory) {
+    FullDeployInputs memory sanitizedInputs = inputs;
     bool hadWarnings = false;
-    string memory warnings = '';
     if (inputs.grantRoles) {
-      warnings = _logAndAppend(logger, warnings, 'WARNING: Roles are being set');
+      _logAndAppend(logger, 'WARNING: Roles are being set');
       hadWarnings = true;
       if (inputs.accessManagerAdmin == address(0)) {
-        warnings = _logAndAppend(
+        _logAndAppend(
           logger,
-          warnings,
           'WARNING: Access Manager Admin is zero address; role will be granted to deployer by default'
         );
+        sanitizedInputs.accessManagerAdmin = deployer;
       }
       if (inputs.hubConfiguratorOwner == address(0)) {
-        warnings = _logAndAppend(
+        _logAndAppend(
           logger,
-          warnings,
           'WARNING: Hub Configurator Owner is zero address; role will be granted to deployer by default'
         );
+        sanitizedInputs.hubConfiguratorOwner = deployer;
       }
       if (inputs.spokeConfiguratorOwner == address(0)) {
-        warnings = _logAndAppend(
+        _logAndAppend(
           logger,
-          warnings,
           'WARNING: Spoke Configurator Owner is zero address; role will be granted to deployer by default'
         );
+        sanitizedInputs.spokeConfiguratorOwner = deployer;
       }
       if (inputs.spokeProxyAdminOwner == address(0)) {
-        warnings = _logAndAppend(
+        _logAndAppend(
           logger,
-          warnings,
           'WARNING: Spoke Proxy Admin Owner is zero address; role will be granted to deployer by default'
         );
+        sanitizedInputs.spokeProxyAdminOwner = deployer;
       }
       if (inputs.treasurySpokeOwner == address(0)) {
-        warnings = _logAndAppend(
+        _logAndAppend(
           logger,
-          warnings,
           'WARNING: Treasury Spoke Owner is zero address; role will be granted to deployer by default'
         );
+        sanitizedInputs.treasurySpokeOwner = deployer;
       }
       if (inputs.spokeAdmin == address(0)) {
-        warnings = _logAndAppend(
+        _logAndAppend(
           logger,
-          warnings,
           'WARNING: Spoke Admin is zero address; spoke admin roles will be granted to deployer by default'
         );
+        sanitizedInputs.spokeAdmin = deployer;
+      }
+      if (inputs.hubAdmin == address(0)) {
+        _logAndAppend(
+          logger,
+          'WARNING: Hub Admin is zero address; hub admin roles will be granted to deployer by default'
+        );
+        sanitizedInputs.hubAdmin = deployer;
       }
     }
     if (inputs.hubLabels.length == 0) {
-      warnings = _logAndAppend(logger, warnings, 'WARNING: Hub will not be deployed');
+      _logAndAppend(logger, 'WARNING: Hub will not be deployed');
       hadWarnings = true;
+      sanitizedInputs.hubLabels = new string[](0);
     }
     if (inputs.spokeLabels.length == 0) {
-      warnings = _logAndAppend(logger, warnings, 'WARNING: Spoke will not be deployed');
+      _logAndAppend(logger, 'WARNING: Spoke will not be deployed');
       hadWarnings = true;
+      sanitizedInputs.spokeLabels = new string[](0);
     }
     if (inputs.nativeWrapper == address(0)) {
-      warnings = _logAndAppend(
+      _logAndAppend(
         logger,
-        warnings,
         'WARNING: Native wrapper zero address; NativeTokenGateway & SignatureGateway will not be deployed'
       );
       hadWarnings = true;
+      sanitizedInputs.nativeWrapper = address(0);
+    }
+    if (inputs.gatewayOwner == address(0)) {
+      _logAndAppend(
+        logger,
+        'WARNING: Gateway owner zero address; role will be granted to deployer by default'
+      );
+      hadWarnings = true;
+      sanitizedInputs.gatewayOwner = deployer;
     }
-    logger.log('');
-
     if (hadWarnings) {
-      _executeUserPrompt(warnings);
+      _executeUserPrompt();
     }
+    return sanitizedInputs;
   }
 
-  function _executeUserPrompt(string memory warnings) internal virtual {
-    string memory ack = vm.prompt(string.concat(warnings, "\nEnter 'y' to continue"));
+  function _executeUserPrompt() internal virtual {
+    string memory ack = vm.prompt(
+      string.concat(_joinWarnings(_warnings), "\nEnter 'y' to continue")
+    );
     if (keccak256(bytes(ack)) != keccak256(bytes('y'))) {
       revert('User did not acknowledge warnings. Please try again.');
     }
   }
 
-  function _sanitizeInputs(
-    FullDeployInputs memory deployInputs,
-    address deployer
-  ) internal view virtual returns (FullDeployInputs memory) {
-    // if any admin is zero address, default to deployer as admin
-    InputUtils.FullDeployInputs memory sanitizedInputs = deployInputs;
-    sanitizedInputs.accessManagerAdmin = deployInputs.accessManagerAdmin != address(0)
-      ? deployInputs.accessManagerAdmin
-      : deployer;
-    sanitizedInputs.hubConfiguratorOwner = deployInputs.hubConfiguratorOwner != address(0)
-      ? deployInputs.hubConfiguratorOwner
-      : deployer;
-    sanitizedInputs.treasurySpokeOwner = deployInputs.treasurySpokeOwner != address(0)
-      ? deployInputs.treasurySpokeOwner
-      : deployer;
-    sanitizedInputs.spokeProxyAdminOwner = deployInputs.spokeProxyAdminOwner != address(0)
-      ? deployInputs.spokeProxyAdminOwner
-      : deployer;
-    sanitizedInputs.spokeConfiguratorOwner = deployInputs.spokeConfiguratorOwner != address(0)
-      ? deployInputs.spokeConfiguratorOwner
-      : deployer;
-    sanitizedInputs.gatewayOwner = deployInputs.gatewayOwner != address(0)
-      ? deployInputs.gatewayOwner
-      : deployer;
-
-    return sanitizedInputs;
+  function _logAndAppend(MetadataLogger logger, string memory warning) internal virtual {
+    logger.log(warning);
+    _warnings.s.push(warning);
   }
 
-  function _logAndAppend(
-    MetadataLogger logger,
-    string memory warnings,
-    string memory warning
-  ) internal virtual returns (string memory) {
-    logger.log(warning);
-    return string.concat(warnings, warning, '\n');
+  function _joinWarnings(Warnings storage warnings) internal view virtual returns (string memory) {
+    uint256 n = warnings.s.length;
+    if (n == 0) return '';
+    string memory out = warnings.s[0];
+    for (uint256 i = 1; i < n; i++) {
+      out = string.concat(out, '\n', warnings.s[i]);
+    }
+    return string.concat(out, '\n');
   }
 }

snapshots/Hub.Operations.json

@@ -1,6 +1,6 @@
 {
   "add": "88006",
-  "add: with transfer": "109642",
+  "add: with transfer": "109652",
   "draw": "105931",
   "eliminateDeficit: full": "59781",
   "eliminateDeficit: partial": "69429",
@@ -11,8 +11,8 @@
   "remove: partial": "81640",
   "reportDeficit": "115225",
   "restore: full": "80471",
-  "restore: full - with transfer": "173405",
+  "restore: full - with transfer": "173415",
   "restore: partial": "89137",
-  "restore: partial - with transfer": "147429",
+  "restore: partial - with transfer": "147439",
   "transferShares": "71180"
 }

snapshots/SignatureGateway.Operations.json

@@ -2,7 +2,7 @@
   "borrowWithSig": "215605",
   "repayWithSig": "188872",
   "setSelfAsUserPositionManagerWithSig": "75402",
-  "setUsingAsCollateralWithSig": "85065",
+  "setUsingAsCollateralWithSig": "85053",
   "supplyWithSig": "153205",
   "updateUserDynamicConfigWithSig": "62769",
   "updateUserRiskPremiumWithSig": "61579",

src/deployments/batches/AaveV4AccessBatch.sol

@@ -11,7 +11,6 @@ contract AaveV4AccessBatch is AaveV4AccessManagerEnumerableDeployProcedure {
   BatchReports.AccessBatchReport internal _report;
 
   constructor(address admin_) {
-    assert(admin_ != address(0));
     address accessManager = _deployAccessManagerEnumerable(admin_);
     _report = BatchReports.AccessBatchReport({accessManager: accessManager});
   }

src/deployments/batches/AaveV4ConfiguratorBatch.sol

@@ -17,9 +17,6 @@ contract AaveV4ConfiguratorBatch is
   BatchReports.ConfiguratorBatchReport internal _report;
 
   constructor(address hubConfiguratorOwner_, address spokeConfiguratorOwner_) {
-    assert(hubConfiguratorOwner_ != address(0));
-    assert(spokeConfiguratorOwner_ != address(0));
-
     address hubConfigurator = _deployHubConfigurator(hubConfiguratorOwner_);
     address spokeConfigurator = _deploySpokeConfigurator(spokeConfiguratorOwner_);
 

src/deployments/batches/AaveV4GatewayBatch.sol

@@ -17,9 +17,6 @@ contract AaveV4GatewayBatch is
   BatchReports.GatewaysBatchReport internal _report;
 
   constructor(address owner_, address nativeWrapper_) {
-    assert(owner_ != address(0));
-    assert(nativeWrapper_ != address(0));
-
     address nativeGateway = _deployNativeTokenGateway({
       nativeWrapper: nativeWrapper_,
       owner: owner_

src/deployments/batches/AaveV4HubBatch.sol

@@ -21,9 +21,6 @@ contract AaveV4HubBatch is
   BatchReports.HubBatchReport internal _report;
 
   constructor(address treasurySpokeOwner_, address accessManager_) {
-    assert(treasurySpokeOwner_ != address(0));
-    assert(accessManager_ != address(0));
-
     address hub = _deployHub(accessManager_);
     address irStrategy = _deployInterestRateStrategy(hub);
     address treasurySpoke = _deployTreasurySpoke(treasurySpokeOwner_, hub);

src/deployments/batches/AaveV4SpokeInstanceBatch.sol

@@ -23,11 +23,6 @@ contract AaveV4SpokeInstanceBatch is AaveV4SpokeDeployProcedure, AaveV4AaveOracl
     uint8 oracleDecimals_,
     string memory oracleDescription_
   ) {
-    assert(spokeProxyAdminOwner_ != address(0));
-    assert(accessManager_ != address(0));
-    assert(oracleDecimals_ > 0);
-    assert(bytes(oracleDescription_).length > 0);
-
     // additional 2 nonces for AaveOracle, SpokeInstance, starting from contract nonce of 1
     address predictedSpokeInstance = Utils.computeCreateAddress(address(this), 3);
 
@@ -42,9 +37,9 @@ contract AaveV4SpokeInstanceBatch is AaveV4SpokeDeployProcedure, AaveV4AaveOracl
       oracle: aaveOracle
     });
 
-    assert(spokeProxy == predictedSpokeInstance);
-    assert(ISpoke(spokeProxy).ORACLE() == aaveOracle);
-    assert(IAaveOracle(aaveOracle).SPOKE() == spokeProxy);
+    require(spokeProxy == predictedSpokeInstance, InvalidParam('predicted spoke instance'));
+    require(ISpoke(spokeProxy).ORACLE() == aaveOracle, InvalidParam('spoke oracle'));
+    require(IAaveOracle(aaveOracle).SPOKE() == spokeProxy, InvalidParam('aave oracle spoke'));
 
     _report = BatchReports.SpokeInstanceBatchReport({
       aaveOracle: aaveOracle,

src/deployments/orchestration/AaveV4DeployOrchestration.sol

@@ -87,7 +87,7 @@ library AaveV4DeployOrchestration {
 
       if (deployInputs.accessManagerAdmin != initialAdmin) {
         logger.log('...Granting AccessManager Root Admin role...');
-        AaveV4AccessManagerRolesProcedure.grantRootAdminRole({
+        AaveV4AccessManagerRolesProcedure.replaceDefaultAdminRole({
           accessManager: report.accessBatchReport.accessManager,
           adminToAdd: deployInputs.accessManagerAdmin,
           adminToRemove: initialAdmin

src/deployments/procedures/AaveV4DeployProcedureBase.sol

@@ -0,0 +1,10 @@
+// SPDX-License-Identifier: UNLICENSED
+// Copyright (c) 2025 Aave Labs
+pragma solidity ^0.8.0;
+
+contract AaveV4DeployProcedureBase {
+  error InvalidParam(string errorMessage);
+  function _validateZeroAddress(address addr, string memory errorMessage) internal pure {
+    require(addr != address(0), InvalidParam(errorMessage));
+  }
+}

src/deployments/procedures/deploy/AaveV4AccessManagerEnumerableDeployProcedure.sol

@@ -3,9 +3,11 @@
 pragma solidity ^0.8.0;
 
 import {AccessManagerEnumerable} from 'src/access/AccessManagerEnumerable.sol';
+import {AaveV4DeployProcedureBase} from 'src/deployments/procedures/AaveV4DeployProcedureBase.sol';
 
-contract AaveV4AccessManagerEnumerableDeployProcedure {
+contract AaveV4AccessManagerEnumerableDeployProcedure is AaveV4DeployProcedureBase {
   function _deployAccessManagerEnumerable(address admin) internal returns (address) {
+    _validateZeroAddress(admin, 'admin');
     return address(new AccessManagerEnumerable({initialAdmin_: admin}));
   }
 }

src/deployments/procedures/deploy/hub/AaveV4HubConfiguratorDeployProcedure.sol

@@ -3,9 +3,10 @@
 pragma solidity ^0.8.0;
 
 import {HubConfigurator} from 'src/hub/HubConfigurator.sol';
-
-contract AaveV4HubConfiguratorDeployProcedure {
+import {AaveV4DeployProcedureBase} from 'src/deployments/procedures/AaveV4DeployProcedureBase.sol';
+contract AaveV4HubConfiguratorDeployProcedure is AaveV4DeployProcedureBase {
   function _deployHubConfigurator(address owner) internal returns (address) {
+    _validateZeroAddress(owner, 'owner');
     return address(new HubConfigurator({owner_: owner}));
   }
 }

src/deployments/procedures/deploy/hub/AaveV4HubDeployProcedure.sol

@@ -3,9 +3,10 @@
 pragma solidity ^0.8.0;
 
 import {Hub} from 'src/hub/Hub.sol';
-
-contract AaveV4HubDeployProcedure {
+import {AaveV4DeployProcedureBase} from 'src/deployments/procedures/AaveV4DeployProcedureBase.sol';
+contract AaveV4HubDeployProcedure is AaveV4DeployProcedureBase {
   function _deployHub(address accessManager) internal returns (address) {
+    _validateZeroAddress(accessManager, 'access manager');
     return address(new Hub({authority_: accessManager}));
   }
 }

src/deployments/procedures/deploy/hub/AaveV4InterestRateStrategyDeployProcedure.sol

@@ -3,9 +3,10 @@
 pragma solidity ^0.8.0;
 
 import {AssetInterestRateStrategy} from 'src/hub/AssetInterestRateStrategy.sol';
-
-contract AaveV4InterestRateStrategyDeployProcedure {
+import {AaveV4DeployProcedureBase} from 'src/deployments/procedures/AaveV4DeployProcedureBase.sol';
+contract AaveV4InterestRateStrategyDeployProcedure is AaveV4DeployProcedureBase {
   function _deployInterestRateStrategy(address hub) internal returns (address) {
+    require(hub != address(0), InvalidParam('hub'));
     return address(new AssetInterestRateStrategy({hub_: hub}));
   }
 }

src/deployments/procedures/deploy/position-manager/AaveV4NativeTokenGatewayDeployProcedure.sol

@@ -3,12 +3,14 @@
 pragma solidity ^0.8.0;
 
 import {NativeTokenGateway} from 'src/position-manager/NativeTokenGateway.sol';
-
-contract AaveV4NativeTokenGatewayDeployProcedure {
+import {AaveV4DeployProcedureBase} from 'src/deployments/procedures/AaveV4DeployProcedureBase.sol';
+contract AaveV4NativeTokenGatewayDeployProcedure is AaveV4DeployProcedureBase {
   function _deployNativeTokenGateway(
     address nativeWrapper,
     address owner
   ) internal returns (address) {
+    _validateZeroAddress(nativeWrapper, 'native wrapper');
+    _validateZeroAddress(owner, 'owner');
     return address(new NativeTokenGateway({nativeWrapper_: nativeWrapper, initialOwner_: owner}));
   }
 }