feat: make Factory and NPM proxy-upgradeable

Factory is now Initializable (constructor → initialize(owner_), drops
NoDelegateCall). NPM uses a hybrid upgrade pattern: ERC721 / permit state
lives behind the proxy via ERC721PermitUpgradeable, while factory / WETH9
stay as impl-bytecode immutables set by the constructor. FullFlowTest
deploys both via TransparentUpgradeableProxy and asserts initializer
state. POOL_INIT_CODE_HASH refreshed for the metadata-hash change from
adding the new lib.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: razww

foundry.lock

@@ -11,6 +11,12 @@
       "rev": "04695aecbd4d17dddfd55de766d10e3805d6f42f"
     }
   },
+  "lib/openzeppelin-contracts-upgradeable": {
+    "tag": {
+      "name": "v3.4.2-solc-0.7",
+      "rev": "e0683346f70db930bd39551046b12449ea68f2dc"
+    }
+  },
   "lib/solidity-lib": {
     "rev": "c01640b0f0f1d8a85cba8de378cc48469fcfd9a6"
   }

lib/openzeppelin-contracts-upgradeable

@@ -1,16 +1,18 @@
 // SPDX-License-Identifier: GPL-2.0-or-later
 pragma solidity =0.7.6;
 
+import 'lib/openzeppelin-contracts-upgradeable/contracts/proxy/Initializable.sol';
+
 import './interfaces/IListaV3Factory.sol';
 
 import './ListaV3PoolDeployer.sol';
-import './NoDelegateCall.sol';
 
 import './ListaV3Pool.sol';
 
 /// @title Canonical Lista V3 factory
 /// @notice Deploys Lista V3 pools and manages ownership and control over pool protocol fees
-contract ListaV3Factory is IListaV3Factory, ListaV3PoolDeployer, NoDelegateCall {
+/// @dev Deployed behind a TransparentUpgradeableProxy; initialize() replaces the constructor.
+contract ListaV3Factory is IListaV3Factory, ListaV3PoolDeployer, Initializable {
     /// @inheritdoc IListaV3Factory
     address public override owner;
 
@@ -19,9 +21,13 @@ contract ListaV3Factory is IListaV3Factory, ListaV3PoolDeployer, NoDelegateCall
     /// @inheritdoc IListaV3Factory
     mapping(address => mapping(address => mapping(uint24 => address))) public override getPool;
 
-    constructor() {
-        owner = msg.sender;
-        emit OwnerChanged(address(0), msg.sender);
+    /// @dev Reserved for future layout additions behind the proxy.
+    uint256[50] private __gap;
+
+    function initialize(address owner_) external initializer {
+        require(owner_ != address(0));
+        owner = owner_;
+        emit OwnerChanged(address(0), owner_);
 
         feeAmountTickSpacing[500] = 10;
         emit FeeAmountEnabled(500, 10);
@@ -36,7 +42,7 @@ contract ListaV3Factory is IListaV3Factory, ListaV3PoolDeployer, NoDelegateCall
         address tokenA,
         address tokenB,
         uint24 fee
-    ) external override noDelegateCall returns (address pool) {
+    ) external override returns (address pool) {
         require(tokenA != tokenB);
         (address token0, address token1) = tokenA < tokenB ? (tokenA, tokenB) : (tokenB, tokenA);
         require(token0 != address(0));

src/core/ListaV3Factory.sol

@@ -2,6 +2,10 @@
 pragma solidity =0.7.6;
 pragma abicoder v2;
 
+import 'lib/openzeppelin-contracts-upgradeable/contracts/token/ERC721/ERC721Upgradeable.sol';
+import 'lib/openzeppelin-contracts-upgradeable/contracts/token/ERC721/IERC721MetadataUpgradeable.sol';
+import 'lib/openzeppelin-contracts-upgradeable/contracts/token/ERC721/IERC721Upgradeable.sol';
+
 import 'src/core/interfaces/IListaV3Pool.sol';
 import 'src/core/libraries/FixedPoint128.sol';
 import 'src/core/libraries/FullMath.sol';
@@ -13,17 +17,18 @@ import './libraries/PoolAddress.sol';
 import './base/LiquidityManagement.sol';
 import './base/PeripheryImmutableState.sol';
 import './base/Multicall.sol';
-import './base/ERC721Permit.sol';
+import './base/ERC721PermitUpgradeable.sol';
 import './base/PeripheryValidation.sol';
 import './base/SelfPermit.sol';
 import './base/PoolInitializer.sol';
 
 /// @title NFT positions
 /// @notice Wraps Lista V3 positions in the ERC721 non-fungible token interface
+/// @dev Deployed behind a TransparentUpgradeableProxy; initialize() replaces the constructor.
 contract NonfungiblePositionManager is
     INonfungiblePositionManager,
     Multicall,
-    ERC721Permit,
+    ERC721PermitUpgradeable,
     PeripheryImmutableState,
     PoolInitializer,
     LiquidityManagement,
@@ -60,20 +65,23 @@ contract NonfungiblePositionManager is
     /// @dev The token ID position data
     mapping(uint256 => Position) private _positions;
 
-    /// @dev The ID of the next token that will be minted. Skips 0
-    uint176 private _nextId = 1;
-    /// @dev The ID of the next pool that is used for the first time. Skips 0
-    uint80 private _nextPoolId = 1;
+    /// @dev The ID of the next token that will be minted. Skips 0. Set in initialize().
+    uint176 private _nextId;
+    /// @dev The ID of the next pool that is used for the first time. Skips 0. Set in initialize().
+    uint80 private _nextPoolId;
 
     /// @dev The address of the token descriptor contract, which handles generating token URIs for position tokens
-    address private immutable _tokenDescriptor;
+    address private _tokenDescriptor;
+
+    uint256[45] private __gap;
 
-    constructor(
-        address _factory,
-        address _WETH9,
-        address _tokenDescriptor_
-    ) ERC721Permit('Lista V3 Positions NFT-V1', 'LIS-V3-POS', '1') PeripheryImmutableState(_factory, _WETH9) {
+    constructor(address _factory, address _WETH9) PeripheryImmutableState(_factory, _WETH9) {}
+
+    function initialize(address _tokenDescriptor_) external initializer {
+        __ERC721Permit_init('Lista V3 Positions NFT-V1', 'LIS-V3-POS', '1');
         _tokenDescriptor = _tokenDescriptor_;
+        _nextId = 1;
+        _nextPoolId = 1;
     }
 
     /// @inheritdoc INonfungiblePositionManager
@@ -186,7 +194,12 @@ contract NonfungiblePositionManager is
         _;
     }
 
-    function tokenURI(uint256 tokenId) public view override(ERC721, IERC721Metadata) returns (string memory) {
+    function tokenURI(uint256 tokenId)
+        public
+        view
+        override(ERC721Upgradeable, IERC721MetadataUpgradeable)
+        returns (string memory)
+    {
         require(_exists(tokenId));
         return INonfungibleTokenPositionDescriptor(_tokenDescriptor).tokenURI(this, tokenId);
     }
@@ -385,15 +398,20 @@ contract NonfungiblePositionManager is
         return uint256(_positions[tokenId].nonce++);
     }
 
-    /// @inheritdoc IERC721
-    function getApproved(uint256 tokenId) public view override(ERC721, IERC721) returns (address) {
+    /// @inheritdoc IERC721Upgradeable
+    function getApproved(uint256 tokenId)
+        public
+        view
+        override(ERC721Upgradeable, IERC721Upgradeable)
+        returns (address)
+    {
         require(_exists(tokenId), 'ERC721: approved query for nonexistent token');
 
         return _positions[tokenId].operator;
     }
 
     /// @dev Overrides _approve to use the operator in the position, which is packed with the position permit nonce
-    function _approve(address to, uint256 tokenId) internal override(ERC721) {
+    function _approve(address to, uint256 tokenId) internal override(ERC721Upgradeable) {
         _positions[tokenId].operator = to;
         emit Approval(ownerOf(tokenId), to, tokenId);
     }

src/periphery/NonfungiblePositionManager.sol

@@ -0,0 +1,95 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+pragma solidity =0.7.6;
+
+import 'lib/openzeppelin-contracts-upgradeable/contracts/proxy/Initializable.sol';
+import 'lib/openzeppelin-contracts-upgradeable/contracts/token/ERC721/ERC721Upgradeable.sol';
+import 'lib/openzeppelin-contracts-upgradeable/contracts/utils/AddressUpgradeable.sol';
+
+import '../libraries/ChainId.sol';
+import '../interfaces/external/IERC1271.sol';
+import '../interfaces/IERC721PermitUpgradeable.sol';
+import './BlockTimestamp.sol';
+
+/// @title Upgradeable ERC721 with permit
+/// @notice Nonfungible tokens that support an approve via signature, i.e. permit.
+/// @dev Drop-in upgradeable equivalent of ERC721Permit. `nameHash` / `versionHash` are
+/// stored rather than immutable so they survive being deployed behind a proxy.
+abstract contract ERC721PermitUpgradeable is Initializable, BlockTimestamp, ERC721Upgradeable, IERC721PermitUpgradeable {
+    /// @dev Gets the current nonce for a token ID and then increments it, returning the original value
+    function _getAndIncrementNonce(uint256 tokenId) internal virtual returns (uint256);
+
+    /// @dev The hash of the name used in the permit signature verification
+    bytes32 private _nameHash;
+
+    /// @dev The hash of the version string used in the permit signature verification
+    bytes32 private _versionHash;
+
+    uint256[48] private __gap;
+
+    function __ERC721Permit_init(
+        string memory name_,
+        string memory symbol_,
+        string memory version_
+    ) internal initializer {
+        __ERC721_init(name_, symbol_);
+        __ERC721Permit_init_unchained(name_, version_);
+    }
+
+    function __ERC721Permit_init_unchained(string memory name_, string memory version_) internal initializer {
+        _nameHash = keccak256(bytes(name_));
+        _versionHash = keccak256(bytes(version_));
+    }
+
+    /// @inheritdoc IERC721PermitUpgradeable
+    function DOMAIN_SEPARATOR() public view override returns (bytes32) {
+        return
+            keccak256(
+                abi.encode(
+                    // keccak256('EIP712Domain(string name,string version,uint256 chainId,address verifyingContract)')
+                    0x8b73c3c69bb8fe3d512ecc4cf759cc79239f7b179b0ffacaa9a75d522b39400f,
+                    _nameHash,
+                    _versionHash,
+                    ChainId.get(),
+                    address(this)
+                )
+            );
+    }
+
+    /// @inheritdoc IERC721PermitUpgradeable
+    /// @dev Value is equal to keccak256("Permit(address spender,uint256 tokenId,uint256 nonce,uint256 deadline)");
+    bytes32 public constant override PERMIT_TYPEHASH =
+        0x49ecf333e5b8c95c40fdafc95c1ad136e8914a8fb55e9dc8bb01eaa83a2df9ad;
+
+    /// @inheritdoc IERC721PermitUpgradeable
+    function permit(
+        address spender,
+        uint256 tokenId,
+        uint256 deadline,
+        uint8 v,
+        bytes32 r,
+        bytes32 s
+    ) external payable override {
+        require(_blockTimestamp() <= deadline, 'Permit expired');
+
+        bytes32 digest =
+            keccak256(
+                abi.encodePacked(
+                    '\x19\x01',
+                    DOMAIN_SEPARATOR(),
+                    keccak256(abi.encode(PERMIT_TYPEHASH, spender, tokenId, _getAndIncrementNonce(tokenId), deadline))
+                )
+            );
+        address owner = ownerOf(tokenId);
+        require(spender != owner, 'ERC721Permit: approval to current owner');
+
+        if (AddressUpgradeable.isContract(owner)) {
+            require(IERC1271(owner).isValidSignature(digest, abi.encodePacked(r, s, v)) == 0x1626ba7e, 'Unauthorized');
+        } else {
+            address recoveredAddress = ecrecover(digest, v, r, s);
+            require(recoveredAddress != address(0), 'Invalid signature');
+            require(recoveredAddress == owner, 'Unauthorized');
+        }
+
+        _approve(spender, tokenId);
+    }
+}

src/periphery/base/ERC721PermitUpgradeable.sol

@@ -0,0 +1,32 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+pragma solidity >=0.7.5;
+
+import 'lib/openzeppelin-contracts-upgradeable/contracts/token/ERC721/IERC721Upgradeable.sol';
+
+/// @title ERC721 with permit (upgradeable variant)
+/// @notice Extension to ERC721Upgradeable that includes a permit function for signature based approvals
+interface IERC721PermitUpgradeable is IERC721Upgradeable {
+    /// @notice The permit typehash used in the permit signature
+    /// @return The typehash for the permit
+    function PERMIT_TYPEHASH() external pure returns (bytes32);
+
+    /// @notice The domain separator used in the permit signature
+    /// @return The domain seperator used in encoding of permit signature
+    function DOMAIN_SEPARATOR() external view returns (bytes32);
+
+    /// @notice Approve of a specific token ID for spending by spender via signature
+    /// @param spender The account that is being approved
+    /// @param tokenId The ID of the token that is being approved for spending
+    /// @param deadline The deadline timestamp by which the call must be mined for the approve to work
+    /// @param v Must produce valid secp256k1 signature from the holder along with `r` and `s`
+    /// @param r Must produce valid secp256k1 signature from the holder along with `v` and `s`
+    /// @param s Must produce valid secp256k1 signature from the holder along with `r` and `v`
+    function permit(
+        address spender,
+        uint256 tokenId,
+        uint256 deadline,
+        uint8 v,
+        bytes32 r,
+        bytes32 s
+    ) external payable;
+}

src/periphery/interfaces/IERC721PermitUpgradeable.sol

@@ -2,11 +2,11 @@
 pragma solidity >=0.7.5;
 pragma abicoder v2;
 
-import 'lib/openzeppelin-contracts/contracts/token/ERC721/IERC721Metadata.sol';
-import 'lib/openzeppelin-contracts/contracts/token/ERC721/IERC721Enumerable.sol';
+import 'lib/openzeppelin-contracts-upgradeable/contracts/token/ERC721/IERC721MetadataUpgradeable.sol';
+import 'lib/openzeppelin-contracts-upgradeable/contracts/token/ERC721/IERC721EnumerableUpgradeable.sol';
 
 import './IPoolInitializer.sol';
-import './IERC721Permit.sol';
+import './IERC721PermitUpgradeable.sol';
 import './IPeripheryPayments.sol';
 import './IPeripheryImmutableState.sol';
 
@@ -17,9 +17,9 @@ interface INonfungiblePositionManager is
     IPoolInitializer,
     IPeripheryPayments,
     IPeripheryImmutableState,
-    IERC721Metadata,
-    IERC721Enumerable,
-    IERC721Permit
+    IERC721MetadataUpgradeable,
+    IERC721EnumerableUpgradeable,
+    IERC721PermitUpgradeable
 {
     /// @notice Emitted when liquidity is increased for a position NFT
     /// @dev Also emitted when a token is minted

src/periphery/interfaces/INonfungiblePositionManager.sol

@@ -4,7 +4,7 @@ pragma solidity >=0.5.0;
 /// @title Provides functions for deriving a pool address from the factory, tokens, and the fee
 library PoolAddress {
     // Post-rename init code hash of ListaV3Pool; must match keccak256(type(ListaV3Pool).creationCode).
-    bytes32 internal constant POOL_INIT_CODE_HASH = 0x6c6332dbf3a9a0174451c95243ab532dbf6cfa5c66118e61ca86ce769cdc7900;
+    bytes32 internal constant POOL_INIT_CODE_HASH = 0x810bcfa2272833e7170faadd4e1478e6c08783b7a576c7ab4a48e11e679eeaad;
 
     /// @notice The identifying key of the pool
     struct PoolKey {