Skip to content

feat: adapt ListaRevenueDistributor for ETH + add emergencyWithdraw + deploy script - #111

Merged
qingyang-lista merged 11 commits into
masterfrom
feature/revenue-distributor-eth-support
Jul 14, 2026
Merged

feat: adapt ListaRevenueDistributor for ETH + add emergencyWithdraw + deploy script#111
qingyang-lista merged 11 commits into
masterfrom
feature/revenue-distributor-eth-support

Conversation

@LuckyTian1725

@LuckyTian1725 LuckyTian1725 commented Jul 6, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Summary

Adapt ListaRevenueDistributor for ETH mainnet deployment:

  1. Allow distribution target addresses to be address(0) — revenue stays in contract when targets are unset
  2. Add emergencyWithdraw() with dedicated EMERGENCY_WITHDRAWER role for manual token extraction (cross-chain bridge to BSC for buyback)
  3. Fix event accuracy: emit actual transferred amounts, early return when all targets are zero
  4. Add ETH mainnet deploy script (Foundry + Hardhat)

Change Type

  • Configuration change (existing contract)
  • Deploy script (new)
  • New contract
  • Test (new)
  • Upgrade (existing proxy)
  • Bug fix (audit response)

Contracts Changed

Contract File Type Description
ListaRevenueDistributor contracts/dao/ListaRevenueDistributor.sol modified address(0) guards + emergencyWithdraw + audit fixes
Deploy script (Foundry) scripts/foundry/eth/deploy_listaRevenueDistributor.sol new ETH deploy script (Foundry)
Deploy script (Hardhat) scripts/eth/deploy_listaRevenueDistributor.ts new ETH deploy script (Hardhat)

Key Changes

1. address(0) Guard Pattern

Area Before After
initialize() Requires autoBuyback/revenueWallet/listaDistributeTo non-zero Only admin, manager, listaTokenAddress required non-zero
_distributeToken() Always transfers to all targets, emits computed amounts Early returns if all targets are address(0); emits actual transferred amounts only
_distributeTokenWithCost() Always transfers to all targets, emits computed amounts Emits actual transferred amounts only
changeAutoBuybackAddress() Rejects address(0) Allows address(0)
changeRevenueWalletAddress() Rejects address(0) Allows address(0)
changeListaDistributeToAddress() Rejects address(0) Allows address(0)

2. emergencyWithdraw (NEW)

function emergencyWithdraw(address _token, address _to, uint256 _amount) external onlyRole(EMERGENCY_WITHDRAWER)
  • Dedicated EMERGENCY_WITHDRAWER role — separate from MANAGER, never granted to bot hot wallets
  • Only granted to Manager Safe / Timelock (multisig control)
  • Primary use case: ETH revenue accumulates in contract → multisig withdraws → bridges to BSC → buyback LISTA
  • Guards: _to != address(0), _amount > 0
  • Emits EmergencyWithdrawn(token, to, amount) event for on-chain auditability

3. Event Accuracy Fix (Audit Response)

  • _distributeToken(): Early returns when all targets are address(0) — no misleading events, no gas waste, no balance re-splitting
  • _distributeToken() / _distributeTokenWithCost(): Events report actual transferred amounts (not computed split amounts)
  • Resolves CONS-003: retained shares can no longer be re-distributed on next call

ETH Revenue Flow

Moolah Core (fee accrues as supplyShares)
    ↓ BOT calls LendingFeeRecipient.claimMarketFee()
LendingFeeRecipient (0xd10a...e30)
    ↓ withdraws from Moolah, transfers to marketFeeRecipient
ListaRevenueDistributor (this contract)
    ↓ EMERGENCY_WITHDRAWER (Manager Safe multisig) calls emergencyWithdraw()
Manual bridge to BSC → LISTA buyback

Deploy Order

1. Deploy ListaRevenueDistributor (this PR's script)
2. Grant EMERGENCY_WITHDRAWER role to Manager Safe (done in deploy script)
3. Record proxy address
4. Fill into moolah MarketFactory deploy script (PR #206)
5. (Multisig) LendingFeeRecipient(0xd10a...e30).setMarketFeeRecipient(new proxy address)
   - Caller: Manager Safe (0x8d388136...B0c6) — holds MANAGER role on LendingFeeRecipient
   - No TimeLock required

Storage Layout

No new state variables — EMERGENCY_WITHDRAWER is a bytes32 public constant (compiled into bytecode, not stored in storage). Pure logic change — safe for upgrade on BSC.

Access Control

Operation Role Note
changeAutoBuybackAddress(address(0)) DEFAULT_ADMIN_ROLE Now permitted
changeRevenueWalletAddress(address(0)) DEFAULT_ADMIN_ROLE Now permitted
changeListaDistributeToAddress(address(0)) DEFAULT_ADMIN_ROLE Now permitted
distributeTokens() MANAGER Early returns when all targets are address(0)
emergencyWithdraw() EMERGENCY_WITHDRAWER New role — only multisig, never bot

Audit Fixes Applied

Finding Severity Fix
SOL-003 — emergencyWithdraw reuses MANAGER, bot gains arbitrary withdrawal on BSC upgrade Medium Split to dedicated EMERGENCY_WITHDRAWER role
CONS-003 — Retained shares re-distributed exponentially on repeated distribute calls Low Early return when all targets are address(0)
I02 — Missing event for emergencyWithdraw Informational Added EmergencyWithdrawn event
Event accuracy — emit reports undistributed amounts as distributed Informational Emit actual transferred amounts only

Risk Assessment

Area Risk Note
Storage collision None No new state variables (constant doesn't occupy storage)
Fund safety Low emergencyWithdraw restricted to EMERGENCY_WITHDRAWER (multisig only)
BSC impact None All addresses non-zero on BSC — zero-address path never triggers; bot does not hold EMERGENCY_WITHDRAWER
BSC upgrade safety Safe If BSC upgrades to this impl, bot cannot call emergencyWithdraw (different role)
Revert risk None Early return prevents unnecessary execution
Upgrade path Safe Can be deployed as new impl and upgraded via UUPS proxy

Test Plan

npx hardhat test test/dao/ListaRevenueDistributor.t.sol

Scenarios:

  • initialize() succeeds with distribution targets = address(0)
  • distributeTokens() early returns when all targets are address(0) — no event emitted, tokens stay in contract
  • distributeTokens() emits actual transferred amounts (not computed split) when one target is address(0)
  • distributeTokens() correctly transfers when addresses are non-zero (BSC regression)
  • emergencyWithdraw() transfers specified token amount to destination
  • emergencyWithdraw() reverts for non-EMERGENCY_WITHDRAWER (including MANAGER)
  • emergencyWithdraw() reverts for _to = address(0) or _amount = 0
  • emergencyWithdraw() emits EmergencyWithdrawn event
  • changeAutoBuybackAddress(address(0)) succeeds
  • BSC regression: with all addresses set, behavior identical to original

@hashdit-bot

hashdit-bot Bot commented Jul 6, 2026

Copy link
Copy Markdown

Pull Request Review

This PR modifies the Solidity upgradeable contract ListaRevenueDistributor to allow autoBuybackAddress, revenueWalletAddress, and listaDistributeToAddress to be set to address(0) during initialization and via admin setters. Distribution logic in _distributeToken and _distributeTokenWithCost now conditionally skips safeTransfer when any of those destination addresses are zero, leaving tokens in the contract instead of reverting. Access roles, storage layout, and function signatures remain unchanged, making this a logic-only behavior change intended to support manual bridging workflows.

Sensitive Content

No sensitive content detected.

Security Issues

🟡 [MEDIUM] Access control / safety check relaxed for critical destination setters

File: contracts/dao/ListaRevenueDistributor.sol
The PR removes non-zero-address validation from existing admin functions changeAutoBuybackAddress(address), changeRevenueWalletAddress(address), and changeListaDistributeToAddress(address), and also from initialize(...) for these destination fields. While role-gated (DEFAULT_ADMIN_ROLE), this is still a relaxation of previously enforced safety constraints and can intentionally or accidentally route protocol behavior into “retain funds in contract” mode.
Recommendation: Confirm this relaxation is explicitly intended for production across all deployments. If only needed on ETH, consider chain/environment-guarded configuration, explicit “paused distribution mode” flags, stronger eventing/alerts when set to zero, and an admin recovery/withdraw playbook to avoid operational fund lockups.

Generated by Hashdit Bot. This tool can absolutely NOT replace manual audits.

@LuckyTian1725
feat: allow address(0) for ETH deployment in ListaRevenueDistributor
778d276 
- Remove require != address(0) checks in initialize() for autoBuyback/revenueWallet/listaDistributeTo
- Add address(0) guards in _distributeToken() and _distributeTokenWithCost() to skip transfers
- Remove require != address(0) from setter methods to allow resetting to address(0)

This enables deploying ListaRevenueDistributor on ETH where revenue stays in the contract
for manual cross-chain bridging instead of auto-distributing.
@LuckyTian1725
LuckyTian1725 force-pushed the feature/revenue-distributor-eth-support branch from 7446de3 to 778d276 Compare July 6, 2026 07:48
@hashdit-bot

hashdit-bot Bot commented Jul 6, 2026

Copy link
Copy Markdown

Pull Request Review

This PR updates the Solidity ListaRevenueDistributor contract to allow autoBuybackAddress, revenueWalletAddress, and listaDistributeToAddress to be set to address(0) during initialization and via admin setter functions. It also changes distribution logic in _distributeToken and _distributeTokenWithCost to skip transfers when the corresponding destination is zero, causing tokens to remain in the contract instead of reverting. The change is a behavior/configuration relaxation for an upgradeable revenue flow, primarily to support ETH-side manual bridging workflows.

Sensitive Content

No sensitive content detected.

Security Issues

🟡 [MEDIUM] Access control / safety constraint relaxed for critical payout addresses

File: contracts/dao/ListaRevenueDistributor.sol
Existing setter functions (changeAutoBuybackAddress, changeRevenueWalletAddress, changeListaDistributeToAddress) removed non-zero address validation, and initialize() also removed non-zero checks for these fields. While role restrictions remain, this is a meaningful relaxation of a prior safety guard and allows a state where distributions silently retain funds in-contract. Please confirm this is intentional governance behavior for production, since operational mistakes (setting zero unintentionally) can alter fund flow indefinitely.
Recommendation: If intentional, add explicit events/flags indicating “paused destination” mode and consider adding a dedicated emergency/manual-bridge mode switch with clearer operational semantics. Optionally require a timelock or two-step confirmation when setting any destination to address(0).

Generated by Hashdit Bot. This tool can absolutely NOT replace manual audits.

@LuckyTian1725
feat: add emergencyWithdraw method for manual token extraction
ca03731 
Add MANAGER-callable emergencyWithdraw(token, to, amount) to allow
manual withdrawal of tokens from the contract for cross-chain bridging
when distribution addresses are set to address(0) on ETH deployment.
@hashdit-bot

hashdit-bot Bot commented Jul 6, 2026

Copy link
Copy Markdown

Pull Request Review

This PR modifies ListaRevenueDistributor to allow autoBuybackAddress, revenueWalletAddress, and listaDistributeToAddress to be set to address(0) during initialization and via admin update functions, and adds conditional transfer guards so distribution silently skips zero-address targets. It also introduces a new emergencyWithdraw function that allows a MANAGER to transfer arbitrary ERC20 tokens from the contract. Overall, the change enables token accumulation in-contract for manual bridging workflows, but materially changes token custody and operational trust assumptions.

Sensitive Content

No sensitive content detected.

Security Issues

🟠 [HIGH] Privileged arbitrary token drain via new emergencyWithdraw (MANAGER role)

File: contracts/dao/ListaRevenueDistributor.sol
A new external function was added:
emergencyWithdraw(address _token, address _to, uint256 _amount) external onlyRole(MANAGER).
This allows any account with MANAGER role to transfer arbitrary token amounts to any non-zero address at any time, bypassing the intended distribution/cost logic and effectively granting full custody over contract-held funds. Given this contract can intentionally accumulate funds when recipient addresses are zero, this introduces a high-impact centralized-drain capability if manager keys are compromised or misused.
Recommendation: Restrict emergency withdrawal to DEFAULT_ADMIN_ROLE (or stronger governance/timelock), constrain destinations (e.g., approved recovery vault), add pausable/emergency-only guardrails, and emit a dedicated event with clear incident semantics. If this power is intentional, document it explicitly in risk disclosures and role-management procedures.

Generated by Hashdit Bot. This tool can absolutely NOT replace manual audits.

@hashdit-bot

hashdit-bot Bot commented Jul 6, 2026

Copy link
Copy Markdown

Pull Request Review

This PR modifies the Solidity ListaRevenueDistributor logic to allow three destination addresses (autoBuybackAddress, revenueWalletAddress, listaDistributeToAddress) to be set to address(0), and conditionally skips transfers to zero addresses so funds remain in-contract. It also updates admin setter functions to accept zero addresses and adds a new emergencyWithdraw function callable by MANAGER for manual token extraction. Additionally, a new ETH deployment script is introduced with hardcoded operational addresses and comments for mainnet fee-routing setup.

Sensitive Content

Blockchain Address:

  • 0xd10a024602E042dcb9C19e21682c3b896c8B0d30 (Ethereum address) in scripts/eth/deploy_listaRevenueDistributor.ts — referenced as LendingFeeRecipient
  • 0x8d388136d578dCD791D081c6042284CED6d9B0c6 (Ethereum address) in scripts/eth/deploy_listaRevenueDistributor.ts — hardcoded manager safe (bot)

Security Issues

🟡 [MEDIUM] Access control is relaxed for critical destination-address setters

File: contracts/dao/ListaRevenueDistributor.sol
Existing admin functions changeAutoBuybackAddress(address), changeRevenueWalletAddress(address), and changeListaDistributeToAddress(address) removed zero-address validation, allowing DEFAULT_ADMIN_ROLE to set payout targets to address(0). While this appears intentional for ETH workflow, it is still a relaxation of safety checks that can silently divert normal distribution into contract custody.
Recommendation: Confirm this is intentional and add explicit event signaling/documentation for “paused destination” semantics; consider adding a dedicated boolean/config mode for ETH instead of relying on zero-address sentinel values.

No serious security issues detected.

Generated by Hashdit Bot. This tool can absolutely NOT replace manual audits.

@LuckyTian1725 LuckyTian1725 changed the title feat: allow address(0) in ListaRevenueDistributor for ETH deployment feat: adapt ListaRevenueDistributor for ETH + add emergencyWithdraw + deploy script Jul 6, 2026
@LuckyTian1725
fix: add block number guard to test_buyback_with_native_token
d63513d 
The test uses hardcoded 1inch swap calldata that is only valid at
block 43143645. Without the guard, it fails on any other fork block.
Consistent with test_buyback() which already has the same pattern.
@hashdit-bot

hashdit-bot Bot commented Jul 6, 2026

Copy link
Copy Markdown

Pull Request Review

This PR updates a Solidity upgradeable revenue distributor to support an ETH-mainnet mode where distribution target addresses may be set to address(0), causing funds to remain in-contract instead of reverting on transfer. It also adds a new emergencyWithdraw(address _token, address _to, uint256 _amount) function restricted to MANAGER, plus a new ETH deployment script configuring zero-address distribution targets and a specific manager safe. A minor test-file adjustment adds an early return guard by block number in an existing buyback test.

Sensitive Content

Blockchain Address:

  • 0x8d388136d578dCD791D081c6042284CED6d9B0c6 (Ethereum address) in scripts/eth/deploy_listaRevenueDistributor.ts — configured as manager/bot safe
  • 0xd10a024602E042dcb9C19e21682c3b896c8B0d30 (Ethereum address) in scripts/eth/deploy_listaRevenueDistributor.ts comments — referenced LendingFeeRecipient contract

Security Issues

No serious security issues detected.

Generated by Hashdit Bot. This tool can absolutely NOT replace manual audits.

@hashdit-bot

hashdit-bot Bot commented Jul 6, 2026

Copy link
Copy Markdown

Pull Request Review

This PR updates a Solidity upgradeable revenue distributor to support ETH deployment scenarios where distribution targets may be unset (address(0)), preventing transfers to zero addresses and allowing funds to remain in-contract. It also adds a new emergencyWithdraw(address _token, address _to, uint256 _amount) function gated by onlyRole(MANAGER) for manual token extraction, and introduces an ETH deployment script with mainnet-specific parameters. Additionally, Hardhat compiler settings were restructured to use compiler arrays plus an override for Buyback.sol, and a test guard was added in a buyback test.

Sensitive Content

Blockchain Address:

  • 0xd10a024602E042dcb9C19e21682c3b896c8B0d30 (Ethereum address) in scripts/eth/deploy_listaRevenueDistributor.ts — referenced LendingFeeRecipient address in deployment comments
  • 0x8d388136d578dCD791D081c6042284CED6d9B0c6 (Ethereum address) in scripts/eth/deploy_listaRevenueDistributor.ts — hardcoded manager/bot Safe address

Security Issues

🟡 [MEDIUM] Access control behavior relaxed for critical fund-flow configuration (confirm intended)

File: contracts/dao/ListaRevenueDistributor.sol
Existing admin setters changeAutoBuybackAddress, changeRevenueWalletAddress, and changeListaDistributeToAddress no longer enforce non-zero addresses, and initialize also dropped non-zero checks for these targets. While this appears intentional for ETH flow, it relaxes prior constraints and allows routing to be effectively disabled, changing fund-handling behavior from mandatory distribution to optional/manual withdrawal.
Recommendation: Confirm this relaxation is explicitly intended for all deployments; if chain-specific, consider guarding by deployment mode/chain config and emit explicit events when any destination is set to address(0) to improve operational safety and monitoring.

No serious security issues detected.

Generated by Hashdit Bot. This tool can absolutely NOT replace manual audits.

@hashdit-bot

hashdit-bot Bot commented Jul 7, 2026

Copy link
Copy Markdown

Pull Request Review

This PR modifies ListaRevenueDistributor to support ETH deployment scenarios where distribution target addresses can be address(0), causing funds to remain in-contract instead of reverting or transferring. It also introduces a new emergencyWithdraw(address _token, address _to, uint256 _amount) function callable by MANAGER, and adds an ETH deployment script with preconfigured mainnet addresses and zeroed distribution targets. Additionally, Hardhat compiler config was refactored to use compilers/overrides, and a minor test guard was added in a buyback test.

Sensitive Content

Blockchain Address:

  • 0x8d388136d578dCD791D081c6042284CED6d9B0c6 (Ethereum address) in scripts/eth/deploy_listaRevenueDistributor.ts — manager safe/bot address
  • 0xFceB31A79F71AC9CBDCF853519c1b12D379EdC46 (Ethereum address) in scripts/eth/deploy_listaRevenueDistributor.ts — LISTA token address placeholder/current config
  • 0xd10a024602E042dcb9C19e21682c3b896c8B0d30 (Ethereum address) in scripts/eth/deploy_listaRevenueDistributor.ts — LendingFeeRecipient reference in deployment comments

Security Issues

🟡 [MEDIUM] Confirm intentional fund custody change due to zero-address target allowance

File: contracts/dao/ListaRevenueDistributor.sol
The PR removes non-zero checks in initialize() and address-change functions, and skips transfers when destination addresses are address(0). This is intentional per PR notes, but it materially changes operational safety: distributed funds can now remain in the contract indefinitely and require manual extraction via emergencyWithdraw.
Recommendation: Confirm this custody model is explicitly intended for ETH deployment only, and consider adding explicit events/monitoring when transfers are skipped due to zero targets to reduce operational risk.

No serious security issues detected.

Generated by Hashdit Bot. This tool can absolutely NOT replace manual audits.

@hashdit-bot

hashdit-bot Bot commented Jul 7, 2026

Copy link
Copy Markdown

Pull Request Review

This PR updates a Solidity upgradeable revenue distribution contract and deployment tooling for Ethereum mainnet. The contract now allows zero-address distribution targets (so funds can remain in-contract), adds a new emergencyWithdraw function callable by MANAGER, and adjusts distribution logic to skip transfers when target addresses are unset. It also introduces new ETH deploy scripts (Hardhat + Foundry) and minor Hardhat compiler override changes.

Sensitive Content

Blockchain Address:

  • 0x8d388136d578dCD791D081c6042284CED6d9B0c6 (Ethereum address, Manager Safe) in scripts/eth/deploy_listaRevenueDistributor.ts and scripts/foundry/eth/deploy_listaRevenueDistributor.sol
  • 0xFceB31A79F71AC9CBDCF853519c1b12D379EdC46 (Ethereum token address) in scripts/eth/deploy_listaRevenueDistributor.ts and scripts/foundry/eth/deploy_listaRevenueDistributor.sol
  • 0xd10a024602E042dcb9C19e21682c3b896c8B0d30 (Ethereum address referenced in comments) in scripts/eth/deploy_listaRevenueDistributor.ts and scripts/foundry/eth/deploy_listaRevenueDistributor.sol

Security Issues

🟡 [MEDIUM] Access control relaxed in initialization/address-setting flow (zero-address constraints removed)

File: contracts/dao/ListaRevenueDistributor.sol
Existing protections requiring non-zero _autoBuybackAddress, _revenueWalletAddress, and _listaDistributeToAddress were removed in initialize, and corresponding non-zero checks were removed in admin setters. This is an intentional behavioral change per PR description, but it weakens prior guardrails and can leave funds parked in-contract if addresses are misconfigured.
Recommendation: Confirm this relaxation is intended for all environments (not only ETH). Consider adding an explicit mode flag (e.g., manualDistributionMode) or chain-specific deployment guard to prevent accidental zero-address config on networks where auto-distribution is expected.

No serious security issues detected.

Generated by Hashdit Bot. This tool can absolutely NOT replace manual audits.

@hashdit-bot

hashdit-bot Bot commented Jul 7, 2026

Copy link
Copy Markdown

Pull Request Review

This PR updates a Solidity upgradeable revenue distribution contract and adds Ethereum deployment scripts (Hardhat + Foundry) for ListaRevenueDistributor. The contract logic is modified to allow address(0) for distribution destinations (skipping transfers instead of reverting), and a new emergencyWithdraw function is introduced for the MANAGER role to transfer ERC20 tokens out of the contract. It also adjusts compiler settings in hardhat.config.ts and adds a minor guard in a test case.

Sensitive Content

Blockchain Address:

  • 0x8d388136d578dCD791D081c6042284CED6d9B0c6 (Ethereum address) in scripts/eth/deploy_listaRevenueDistributor.ts — configured as manager/bot safe
  • 0xFceB31A79F71AC9CBDCF853519c1b12D379EdC46 (Ethereum address) in scripts/eth/deploy_listaRevenueDistributor.ts — configured as LISTA token address placeholder
  • 0xd10a024602E042dcb9C19e21682c3b896c8B0d30 (Ethereum address) in scripts/eth/deploy_listaRevenueDistributor.ts comments — LendingFeeRecipient address
  • 0x8d388136d578dCD791D081c6042284CED6d9B0c6 (Ethereum address) in scripts/foundry/eth/deploy_listaRevenueDistributor.sol — configured as manager safe
  • 0xFceB31A79F71AC9CBDCF853519c1b12D379EdC46 (Ethereum address) in scripts/foundry/eth/deploy_listaRevenueDistributor.sol — LISTA token address placeholder

Security Issues

🟡 [MEDIUM] Centralized emergency token extraction capability added

File: contracts/dao/ListaRevenueDistributor.sol
A new emergencyWithdraw(address _token, address _to, uint256 _amount) function allows MANAGER to transfer arbitrary ERC20 balances from the contract to any non-zero address. While this appears intentional for bridging operations, it introduces a powerful hot-path privilege that can drain all funds if MANAGER is compromised or misconfigured.
Recommendation: Confirm this trust model is intended. Consider limiting withdraw destinations (whitelist), adding timelock/multisig-only execution, adding event fields for clearer monitoring, or constraining callable tokens/amounts by policy.

Generated by Hashdit Bot. This tool can absolutely NOT replace manual audits.

@hashdit-bot

hashdit-bot Bot commented Jul 13, 2026

Copy link
Copy Markdown

Pull Request Review

This PR updates a Solidity upgradeable revenue distribution contract and adds Ethereum deployment scripts (Hardhat + Foundry) for ListaRevenueDistributor. Core logic now permits address(0) for distribution targets (causing transfers to be skipped), introduces a new EMERGENCY_WITHDRAWER role with emergencyWithdraw, and adjusts compiler settings with a specific override for Buyback.sol. A small test change was also made to gate one native-token buyback test by block number.

Sensitive Content

Blockchain Address:

  • 0x8d388136d578dCD791D081c6042284CED6d9B0c6 (Ethereum address) in scripts/eth/deploy_listaRevenueDistributor.ts and scripts/foundry/eth/deploy_listaRevenueDistributor.sol — configured as manager safe
  • 0xFceB31A79F71AC9CBDCF853519c1b12D379EdC46 (Ethereum address) in scripts/eth/deploy_listaRevenueDistributor.ts and scripts/foundry/eth/deploy_listaRevenueDistributor.sol — placeholder LISTA token address
  • 0xd10a024602E042dcb9C19e21682c3b896c8B0d30 (Ethereum address) in scripts/eth/deploy_listaRevenueDistributor.ts comments — LendingFeeRecipient reference

Security Issues

🟡 [MEDIUM] Access control changed for emergency withdrawal role assignment (confirm intended privilege model)

File: contracts/dao/ListaRevenueDistributor.sol, scripts/eth/deploy_listaRevenueDistributor.ts, scripts/foundry/eth/deploy_listaRevenueDistributor.sol
The newly added emergencyWithdraw is protected by onlyRole(EMERGENCY_WITHDRAWER) while initialization still grants only MANAGER and DEFAULT_ADMIN_ROLE. This creates a new sensitive privilege path dependent on post-deploy grantRole, and if role ops are misconfigured, funds may become stuck (no withdrawer) or overly accessible (extra grant).
Recommendation: Confirm this is intentional and enforce role setup atomically at deployment (or in initializer/reinitializer), with explicit runbook checks and events/monitoring for EMERGENCY_WITHDRAWER grants/revokes.

Generated by Hashdit Bot. This tool can absolutely NOT replace manual audits.

@hashdit-bot

hashdit-bot Bot commented Jul 13, 2026

Copy link
Copy Markdown

Pull Request Review

This PR updates a Solidity upgradeable revenue distribution system for ETH deployment by allowing zero-address distribution targets (so funds can remain in-contract), introducing an EMERGENCY_WITHDRAWER role with emergencyWithdraw(), and adding ETH deployment scripts in both Hardhat and Foundry. It also adjusts distribution logic to skip transfers when target addresses are unset and emits actual transferred amounts. Additionally, Hardhat compiler config was refactored to use compiler overrides, and a test guard was added in a buyback test case.

Sensitive Content

Blockchain Address:

  • 0x8d388136d578dCD791D081c6042284CED6d9B0c6 (Ethereum address) in scripts/eth/deploy_listaRevenueDistributor.ts and scripts/foundry/eth/deploy_listaRevenueDistributor.sol — manager safe / role grantee
  • 0xFceB31A79F71AC9CBDCF853519c1b12D379EdC46 (Ethereum address) in scripts/eth/deploy_listaRevenueDistributor.ts and scripts/foundry/eth/deploy_listaRevenueDistributor.sol — LISTA token placeholder
  • 0xd10a024602E042dcb9C19e21682c3b896c8B0d30 (Ethereum address) in scripts/eth/deploy_listaRevenueDistributor.ts comments — LendingFeeRecipient contract reference

Security Issues

No serious security issues detected.

Generated by Hashdit Bot. This tool can absolutely NOT replace manual audits.

@hashdit-bot

hashdit-bot Bot commented Jul 14, 2026

Copy link
Copy Markdown

Pull Request Review

This PR updates a Solidity upgradeable revenue distributor for ETH deployment by allowing zero-address distribution targets, adding a new EMERGENCY_WITHDRAWER role with emergencyWithdraw(), and adjusting events to emit actual transferred amounts. It also introduces Hardhat and Foundry deployment scripts for ETH/Sepolia and updates Hardhat compiler overrides. Overall, the changes are primarily operational and access-control related for cross-chain treasury handling.

Sensitive Content

Blockchain Address:

  • 0xd10a024602E042dcb9C19e21682c3b896c8B0d30 (Ethereum address) in scripts/eth/deploy_listaRevenueDistributor.ts — referenced LendingFeeRecipient
  • 0x8d388136d578dCD791D081c6042284CED6d9B0c6 (Ethereum address) in scripts/eth/deploy_listaRevenueDistributor.ts and scripts/foundry/eth/deploy_listaRevenueDistributor.sol — Manager Safe / role grantee
  • 0xFceB31A79F71AC9CBDCF853519c1b12D379EdC46 (Ethereum address) in scripts/eth/deploy_listaRevenueDistributor.ts and scripts/foundry/eth/deploy_listaRevenueDistributor.sol — placeholder LISTA token address

Security Issues

No serious security issues detected.

Generated by Hashdit Bot. This tool can absolutely NOT replace manual audits.

qingyang-lista
qingyang-lista approved these changes Jul 14, 2026
View reviewed changes

@qingyang-lista qingyang-lista left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@qingyang-lista
qingyang-lista merged commit afcb7d4 into master Jul 14, 2026
1 check passed
@qingyang-lista
qingyang-lista deleted the feature/revenue-distributor-eth-support branch July 14, 2026 07:38
This was referenced Jul 14, 2026
Merged
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@qingyang-lista qingyang-lista qingyang-lista approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@LuckyTian1725 @qingyang-lista