Merge pull request #1499 from lidofinance/feat/deploy-v3-hoodi

feat: deploy params V3 hoodi

Author: tamtamchik

.github/workflows/tests-integration-mainnet.yml

@@ -41,7 +41,7 @@ jobs:
           GAS_PRIORITY_FEE: 1
           GAS_MAX_FEE: 100
           NETWORK_STATE_FILE: deployed-mainnet-upgrade.json
-          GENESIS_TIME: 1606824023 # needed only for TW upgrade
+          UPGRADE_PARAMETERS_FILE: upgrade-parameters-mainnet.toml
 
       - name: Mock Aragon voting
         run: yarn upgrade:mock-voting

.github/workflows/tests-integration-upgrade-template.yml

@@ -26,4 +26,3 @@ jobs:
         env:
           RPC_URL: "${{ secrets.ETH_RPC_URL }}"
           UPGRADE_PARAMETERS_FILE: upgrade-parameters-mainnet.json
-          GENESIS_TIME: 1606824023 # needed only for TW upgrade

README.md

@@ -65,7 +65,7 @@ Please refer to the [Lido Contributor Code of Conduct](/CODE_OF_CONDUCT.md).
 
 ## License
 
-2024 Lido <info@lido.fi>
+2025 Lido <info@lido.fi>
 
 This program is free software: you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by

contracts/0.8.25/utils/V3TemporaryAdmin.sol

@@ -54,6 +54,10 @@ interface ICSModule {
     function accounting() external view returns (address);
 }
 
+interface IVaultsAdapter {
+    function evmScriptExecutor() external view returns (address);
+}
+
 interface ILidoLocator {
     function vaultHub() external view returns (address);
     function predepositGuarantee() external view returns (address);
@@ -75,15 +79,14 @@ contract V3TemporaryAdmin {
     bytes32 public constant DEFAULT_ADMIN_ROLE = 0x00;
 
     address public immutable AGENT;
-    address public immutable GATE_SEAL;
+    bool public immutable IS_HOODI;
 
     bool public isSetupComplete;
 
-    constructor(address _agent, address _gateSeal) {
+    constructor(address _agent, bool _isHoodi) {
         if (_agent == address(0)) revert ZeroAddress();
-        if (_gateSeal == address(0)) revert ZeroAddress();
         AGENT = _agent;
-        GATE_SEAL = _gateSeal;
+        IS_HOODI = _isHoodi;
     }
 
     /**
@@ -96,10 +99,10 @@ contract V3TemporaryAdmin {
 
         IStakingRouter.StakingModule[] memory stakingModules = IStakingRouter(_stakingRouter).getStakingModules();
 
-        // Find the Community Staking module (index 2)
+        // Find the Community Staking module (index 2 or 3 on Hoodi)
         if (stakingModules.length <= 2) revert CsmModuleNotFound();
 
-        IStakingRouter.StakingModule memory csm = stakingModules[2];
+        IStakingRouter.StakingModule memory csm = stakingModules[IS_HOODI ? 3 : 2];
         if (keccak256(bytes(csm.name)) != keccak256(bytes("Community Staking"))) {
             revert CsmModuleNotFound();
         }
@@ -111,13 +114,11 @@ contract V3TemporaryAdmin {
      * @notice Complete setup for all contracts - grants all roles and transfers admin to agent
      * @dev This is the main external function that should be called after deployment
      * @param _lidoLocatorImpl The new LidoLocator implementation address
-     * @param _evmScriptExecutor The EVM script executor address from easyTrack
      * @param _vaultsAdapter The vaults' adapter address from easyTrack
      */
-    function completeSetup(address _lidoLocatorImpl, address _evmScriptExecutor, address _vaultsAdapter) external {
+    function completeSetup(address _lidoLocatorImpl, address _vaultsAdapter, address _gateSeal) external {
         if (isSetupComplete) revert SetupAlreadyCompleted();
         if (_lidoLocatorImpl == address(0)) revert ZeroLidoLocator();
-        if (_evmScriptExecutor == address(0)) revert ZeroEvmScriptExecutor();
         if (_vaultsAdapter == address(0)) revert ZeroVaultsAdapter();
 
         isSetupComplete = true;
@@ -126,11 +127,11 @@ contract V3TemporaryAdmin {
 
         address csmAccounting = getCsmAccountingAddress(locator.stakingRouter());
 
-        _setupPredepositGuarantee(locator.predepositGuarantee());
+        _setupPredepositGuarantee(locator.predepositGuarantee(), _gateSeal);
         _setupLazyOracle(locator.lazyOracle());
-        _setupOperatorGrid(locator.operatorGrid(), _evmScriptExecutor, _vaultsAdapter);
+        _setupOperatorGrid(locator.operatorGrid(), IVaultsAdapter(_vaultsAdapter).evmScriptExecutor(), _vaultsAdapter);
         _setupBurner(locator.burner(), locator.accounting(), csmAccounting);
-        _setupVaultHub(locator.vaultHub(), _vaultsAdapter);
+        _setupVaultHub(locator.vaultHub(), _vaultsAdapter, _gateSeal);
     }
 
 
@@ -139,15 +140,15 @@ contract V3TemporaryAdmin {
      * @param _vaultHub The VaultHub contract address
      * @param _vaultsAdapter The vaults' adapter address
      */
-    function _setupVaultHub(address _vaultHub, address _vaultsAdapter) private {
+    function _setupVaultHub(address _vaultHub, address _vaultsAdapter, address _gateSeal) private {
         // Get roles from the contract
         bytes32 pauseRole = IPausableUntil(_vaultHub).PAUSE_ROLE();
         bytes32 vaultMasterRole = IVaultHub(_vaultHub).VAULT_MASTER_ROLE();
         bytes32 redemptionMasterRole = IVaultHub(_vaultHub).REDEMPTION_MASTER_ROLE();
         bytes32 validatorExitRole = IVaultHub(_vaultHub).VALIDATOR_EXIT_ROLE();
         bytes32 badDebtMasterRole = IVaultHub(_vaultHub).BAD_DEBT_MASTER_ROLE();
 
-        IAccessControl(_vaultHub).grantRole(pauseRole, GATE_SEAL);
+        IAccessControl(_vaultHub).grantRole(pauseRole, _gateSeal);
 
         IAccessControl(_vaultHub).grantRole(vaultMasterRole, AGENT);
         IAccessControl(_vaultHub).grantRole(redemptionMasterRole, AGENT);
@@ -163,9 +164,9 @@ contract V3TemporaryAdmin {
      * @notice Setup PredepositGuarantee with PAUSE_ROLE for gateSeal and transfer admin to agent
      * @param _predepositGuarantee The PredepositGuarantee contract address
      */
-    function _setupPredepositGuarantee(address _predepositGuarantee) private {
+    function _setupPredepositGuarantee(address _predepositGuarantee, address _gateSeal) private {
         bytes32 pauseRole = IPausableUntil(_predepositGuarantee).PAUSE_ROLE();
-        IAccessControl(_predepositGuarantee).grantRole(pauseRole, GATE_SEAL);
+        IAccessControl(_predepositGuarantee).grantRole(pauseRole, _gateSeal);
         _transferAdminToAgent(_predepositGuarantee);
     }
 
@@ -196,6 +197,7 @@ contract V3TemporaryAdmin {
     /**
      * @notice Setup Burner with required roles and transfer admin to agent
      * @param _burner The Burner contract address
+     * @param _accounting The Accounting contract address
      * @param _csmAccounting The CSM Accounting contract address
      */
     function _setupBurner(

contracts/common/interfaces/IGateSeal.sol

@@ -0,0 +1,13 @@
+// SPDX-FileCopyrightText: 2025 Lido <info@lido.fi>
+// SPDX-License-Identifier: GPL-3.0
+
+// See contracts/COMPILERS.md
+// solhint-disable-next-line
+pragma solidity >=0.4.24 <0.9.0;
+
+// https://github.com/lidofinance/gate-seals/blob/main/contracts/GateSeal.vy
+interface IGateSeal {
+    function seal(address[] memory _sealables) external;
+    function is_expired() external view returns (bool);
+    function get_sealing_committee() external view returns (address);
+}

contracts/upgrade/V3Addresses.sol

@@ -4,6 +4,10 @@ pragma solidity 0.8.25;
 import {IAccessControlEnumerable} from "@openzeppelin/contracts-v4.4/access/AccessControlEnumerable.sol";
 import {ILidoLocator} from "contracts/common/interfaces/ILidoLocator.sol";
 
+interface IVaultsAdapter {
+    function evmScriptExecutor() external view returns (address);
+}
+
 interface IStakingRouter is IAccessControlEnumerable {
     struct StakingModule {
         uint24 id;
@@ -53,7 +57,6 @@ contract V3Addresses {
         address gateSealForVaults;
 
         // EasyTrack addresses
-        address evmScriptExecutor;
         address vaultsAdapter;
 
         // Existing proxies and contracts
@@ -107,8 +110,8 @@ contract V3Addresses {
     //
     // -------- EasyTrack addresses --------
     //
-    address public immutable EVM_SCRIPT_EXECUTOR;
     address public immutable VAULTS_ADAPTER;
+    address public immutable EVM_SCRIPT_EXECUTOR;
 
     //
     // -------- Unchanged contracts --------
@@ -127,6 +130,7 @@ contract V3Addresses {
     address public immutable NODE_OPERATORS_REGISTRY;
     address public immutable SIMPLE_DVT;
     address public immutable CSM_ACCOUNTING;
+    address public immutable HOODI_SANDBOX_MODULE;
 
     constructor(
         V3AddressesParams memory params
@@ -157,7 +161,7 @@ contract V3Addresses {
         STAKING_VAULT_IMPL = params.stakingVaultImpl;
         DASHBOARD_IMPL = params.dashboardImpl;
         GATE_SEAL = params.gateSealForVaults;
-        EVM_SCRIPT_EXECUTOR = params.evmScriptExecutor;
+        EVM_SCRIPT_EXECUTOR = IVaultsAdapter(params.vaultsAdapter).evmScriptExecutor();
         VAULTS_ADAPTER = params.vaultsAdapter;
 
         //
@@ -193,9 +197,18 @@ contract V3Addresses {
             IStakingRouter.StakingModule memory simpleDvt = stakingModules[1];
             if (_hash(simpleDvt.name) != _hash(SIMPLE_DVT_MODULE_NAME)) revert IncorrectStakingModuleName(simpleDvt.name);
             SIMPLE_DVT = simpleDvt.stakingModuleAddress;
-            IStakingRouter.StakingModule memory csm = stakingModules[2];
+
+            // NB: there is additional module on Hoodi before CSM
+            uint256 csmIndex = stakingModules.length - 1;
+            IStakingRouter.StakingModule memory csm = stakingModules[csmIndex];
             if (_hash(csm.name) != _hash(CSM_MODULE_NAME)) revert IncorrectStakingModuleName(csm.name);
             CSM_ACCOUNTING = ICSModule(csm.stakingModuleAddress).accounting();
+
+            if (stakingModules.length == 4) {
+                IStakingRouter.StakingModule memory hoodiSandbox = stakingModules[2];
+                if (_hash(hoodiSandbox.name) != _hash("Sandbox")) revert IncorrectStakingModuleName(hoodiSandbox.name);
+                HOODI_SANDBOX_MODULE = hoodiSandbox.stakingModuleAddress;
+            }
         }
     }
 

contracts/upgrade/V3Template.sol

@@ -129,6 +129,10 @@ contract V3Template is V3Addresses {
         contractsWithBurnerAllowances.push(CSM_ACCOUNTING);
     }
 
+    function isHoodi() internal view returns (bool) {
+        return HOODI_SANDBOX_MODULE != address(0);
+    }
+
     /// @notice Must be called before LidoLocator is upgraded
     function startUpgrade() external {
         if (msg.sender != AGENT) revert OnlyAgentCanUpgrade();
@@ -224,7 +228,11 @@ contract V3Template is V3Addresses {
     function _assertFinalACL() internal view {
         // Burner
         bytes32 requestBurnSharesRole = IBurner(BURNER).REQUEST_BURN_SHARES_ROLE();
-        _assertZeroOZRoleHolders(OLD_BURNER, requestBurnSharesRole);
+        if (isHoodi()) {
+            _assertSingleOZRoleHolder(OLD_BURNER, requestBurnSharesRole, HOODI_SANDBOX_MODULE);
+        } else {
+            _assertZeroOZRoleHolders(OLD_BURNER, requestBurnSharesRole);
+        }
 
         _assertProxyAdmin(IOssifiableProxy(BURNER), AGENT);
         _assertSingleOZRoleHolder(BURNER, DEFAULT_ADMIN_ROLE, AGENT);

contracts/upgrade/V3VoteScript.sol

@@ -30,7 +30,7 @@ contract V3VoteScript is OmnibusBase {
     //
     // Constants
     //
-    uint256 public constant VOTE_ITEMS_COUNT = 13;
+    uint256 public constant VOTE_ITEMS_COUNT = 14;
 
     //
     // Immutables
@@ -188,6 +188,16 @@ contract V3VoteScript is OmnibusBase {
             call: _forwardCall(TEMPLATE.AGENT(), params.upgradeTemplate, abi.encodeCall(V3Template.finishUpgrade, ()))
         });
 
+        // Revoke REQUEST_BURN_SHARES_ROLE from Hoodi Sandbox module (only on Hoodi)
+        voteItems[index++] = VoteItem({
+            description: "14. Revoke REQUEST_BURN_SHARES_ROLE from Hoodi Sandbox",
+            call: _forwardCall(
+                TEMPLATE.AGENT(),
+                TEMPLATE.OLD_BURNER(),
+                abi.encodeCall(IAccessControl.revokeRole, (requestBurnSharesRole, TEMPLATE.HOODI_SANDBOX_MODULE()))
+            )
+        });
+
         assert(index == VOTE_ITEMS_COUNT);
     }
 }

contracts/upgrade/mocks/VaultsAdapterMock.sol

@@ -0,0 +1,22 @@
+// SPDX-License-Identifier: GPL-3.0
+pragma solidity 0.8.25;
+
+
+/**
+ * @title VaultsAdapterMock
+ * @notice Stores immutable addresses required for the V3 upgrade process.
+ * This contract centralizes address management for V3Template and V3VoteScript.
+ */
+contract VaultsAdapterMock {
+
+    address public immutable EVM_SCRIPT_EXECUTOR;
+
+    constructor(address _evmScriptExecutor) {
+        EVM_SCRIPT_EXECUTOR = _evmScriptExecutor;
+    }
+
+    function evmScriptExecutor() external view returns (address) {
+        return EVM_SCRIPT_EXECUTOR;
+    }
+
+}