feat(dao): launchpool topUpEpoch remediation + impl deploy tooling

[toccata-yy-lista]

Summary

• topUpEpoch (audit remediation): adds topUpEpoch(epochId, newTotalAmount) to ClisBNBLaunchPoolDistributor so an under-funded epoch (totalAmount set below the sum of merkle leaves, blocking tail claimers) can be raised to the correct total. Admin-only, active-epoch-only (audit M02: rejects not-yet-started epochs), requires the delta to be pre-funded.
• Audit report: adds ListaDao_ClisBNBLaunchPoolDistributor_Update_Audit_Report_Final.pdf to audits/.
• Impl deploy script rework (scripts/foundry/dao/deploy_ClisBNBLaunchPoolDistributor_impl.sol): replaces the plain deploy with a linking-aware, impl-only script:
  • MerkleVerifier (external public library → delegatecall linking) is resolved at run time: reused when KNOWN_MERKLE_VERIFIER's on-chain code matches the local build (masked-bytecode comparison), freshly deployed otherwise;
  • the implementation is deployed from artifact bytecode with the link placeholder patched in — no --libraries flag or foundry.toml linking needed;
  • impl only: no proxy interaction; storage layout is reviewed with a visual diff tool after deployment and the upgrade is executed separately by the ProxyAdmin owner;
  • sender via --account keystore; chain-id argument guards against wrong-network broadcasts.
• Fork tests (test/dao/DeployClisBNBLaunchPoolDistributorImplScript.t.sol): fresh-library deploy, unchanged-library reuse, and stale-library redeploy paths, all against a BSC testnet fork (skipped when BSC_TESTNET_RPC is unset).
• foundry.toml: grants read fs_permissions on ./out (the script reads the artifact for linking).

Testnet deployment (BSC 97)

• New implementation: 0x95d01dd09097196c750f83a9de996c124835737c
• MerkleVerifier: 0x0d1f7f112316d628a7540a484dc5d09a3cf08cbb (foundry-built baseline; pass as KNOWN_MERKLE_VERIFIER for reuse in future upgrades)
• Proxy (unchanged, upgrade pending layout review): 0x6b443E62F20Ea572178aE3c1c037eae0823396f8

Test plan

• forge test --match-path test/dao/DeployClisBNBLaunchPoolDistributorImplScript.t.sol (3 fork tests pass)
• Script broadcast on BSC testnet; deployed impl verified to link the freshly deployed library
• Storage layout visual diff vs live impl 0x61dEe01c2785E9BE58Ce2CaB215af61703eeA50f, then proxy upgrade by ProxyAdmin owner

🤖 Generated with Claude Code

[hashdit-bot]

Pull Request Review

This PR reworks the Foundry deployment script to deploy only the ClisBNBLaunchPoolDistributor implementation, dynamically deploy or reuse a bytecode-matching MerkleVerifier library, patch the implementation artifact’s link placeholder, and enforce BSC chain-ID checks. It also grants read access to build artifacts and adds BSC testnet fork tests for fresh, reused, and stale library scenarios; the PR description additionally states that an admin-only topUpEpoch remediation and an audit report are included, although those changes are not present in the supplied diff.

Sensitive Content

No sensitive content detected.

Security Issues

No serious security issues detected.

---

Generated by Hashdit Bot. This tool can absolutely NOT replace manual audits.