feat(v3-lp): gate deposits behind an optional whitelist

Adds an opt-in allowlist for a gated launch. Shares are already
non-transferable except by Moolah, so closing the deposit entry point is enough
to keep them off non-whitelisted addresses; nothing else needs a gate.

Both msg.sender and onBehalf are checked — gating only the caller would let a
whitelisted address open a position for anyone.

Withdraw, redeemShares, withdrawShares, the Moolah liquidation callback and the
BOT paths are deliberately left open. Gating an exit would strand a delisted
holder's funds, and gating a seizure would socialise bad debt to lenders; two of
the new tests pin that behaviour so a later change cannot quietly extend the
gate to those paths.

Disabled by default, so existing deployments and tests are unaffected until
MANAGER turns it on.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: razww

src/provider/interfaces/IV3Provider.sol

@@ -103,4 +103,12 @@ interface IV3Provider is IProvider {
     uint256 minAmount1,
     address receiver
   ) external returns (uint256 amount0, uint256 amount1);
+
+  function depositWhitelistEnabled() external view returns (bool);
+
+  function depositWhitelist(address account) external view returns (bool);
+
+  function setDepositWhitelistEnabled(bool enabled) external;
+
+  function setDepositWhitelist(address[] calldata accounts, bool allowed) external;
 }

src/provider/v3/V3Provider.sol

@@ -90,8 +90,12 @@ abstract contract V3Provider is
   /// @dev Cumulative rebalance loss (8-decimal USD) recorded so far for `dailyLossDay`.
   uint256 public dailyLossAccum;
 
+  /// @dev Gate on the deposit entry point only. Disabled by default; flip on for a gated launch.
+  bool public depositWhitelistEnabled;
+  mapping(address => bool) public depositWhitelist;
+
   /// @dev Reserved storage for future base variables (keep subclass storage stable on upgrade).
-  uint256[46] private __gap;
+  uint256[44] private __gap;
 
   /* ───────────────────────────── events ───────────────────────────── */
 
@@ -115,6 +119,8 @@ abstract contract V3Provider is
   event SharesRedeemed(address indexed redeemer, uint256 shares, uint256 amount0, uint256 amount1, address receiver);
   event MaxRebalanceLossBpChanged(uint256 maxRebalanceLossBp);
   event MaxDailyLossUsdChanged(uint256 maxDailyLossUsd);
+  event DepositWhitelistEnabledChanged(bool enabled);
+  event DepositWhitelistChanged(address indexed account, bool allowed);
   event RebalanceDailyLossAccrued(uint256 indexed day, uint256 loss, uint256 accum);
 
   /* ───────────────────────────── errors ───────────────────────────── */
@@ -127,6 +133,7 @@ abstract contract V3Provider is
   error Unauthorized();
   error InsufficientShares();
   error OnlyMoolah();
+  error NotWhitelisted();
   error InvalidMarket();
   error StandardEntryDisabled();
   error BnbTransferFailed();
@@ -195,6 +202,23 @@ abstract contract V3Provider is
     emit MaxDailyLossUsdChanged(maxDailyLossUsd);
   }
 
+  /// @notice Turn the deposit whitelist on or off. onlyRole MANAGER.
+  function setDepositWhitelistEnabled(bool enabled) external onlyRole(MANAGER) {
+    depositWhitelistEnabled = enabled;
+    emit DepositWhitelistEnabledChanged(enabled);
+  }
+
+  /// @notice Allow or disallow accounts on the deposit whitelist. onlyRole MANAGER.
+  /// @dev    Removing an account only closes new deposits — it never blocks that account's withdraw,
+  ///         redeem or liquidation.
+  function setDepositWhitelist(address[] calldata accounts, bool allowed) external onlyRole(MANAGER) {
+    for (uint256 i; i < accounts.length; ++i) {
+      if (accounts[i] == address(0)) revert ZeroAddress();
+      depositWhitelist[accounts[i]] = allowed;
+      emit DepositWhitelistChanged(accounts[i], allowed);
+    }
+  }
+
   /* ──────────────────── ERC20 transfer restrictions ───────────────── */
 
   /// @dev Only Moolah may transfer shares (prevents orphaning the position by moving collateral out).
@@ -229,6 +253,9 @@ abstract contract V3Provider is
   ) external payable nonReentrant returns (uint256 shares, uint256 amount0Used, uint256 amount1Used) {
     if (marketParams.collateralToken != address(this)) revert InvalidCollateralToken();
     if (onBehalf == address(0)) revert ZeroAddress();
+    // Check both: gating only msg.sender would let a whitelisted caller open a position for anyone.
+    if (depositWhitelistEnabled && (!depositWhitelist[msg.sender] || !depositWhitelist[onBehalf]))
+      revert NotWhitelisted();
 
     uint256 _amount0Desired = amount0Desired;
     uint256 _amount1Desired = amount1Desired;

test/provider/SlisBNBV3Provider.t.sol

@@ -317,6 +317,97 @@ contract SlisBNBV3ProviderTest is Test {
     vm.stopPrank();
   }
 
+  /* ─────────────────────── deposit whitelist ─────────────────────── */
+
+  function _allow(address who, bool ok) internal {
+    address[] memory a = new address[](1);
+    a[0] = who;
+    vm.prank(manager);
+    provider.setDepositWhitelist(a, ok);
+  }
+
+  function _enableWhitelist() internal {
+    vm.prank(manager);
+    provider.setDepositWhitelistEnabled(true);
+  }
+
+  function test_depositWhitelist_offByDefault() public {
+    assertFalse(provider.depositWhitelistEnabled(), "off by default");
+    _deposit(user, 1 ether, 1 ether); // unlisted user still gets in
+  }
+
+  function test_depositWhitelist_blocksUnlistedDepositor() public {
+    _enableWhitelist();
+    deal(SLISBNB, user, 1 ether);
+    deal(WBNB, user, 1 ether);
+    vm.startPrank(user);
+    IERC20(SLISBNB).approve(address(provider), 1 ether);
+    IERC20(WBNB).approve(address(provider), 1 ether);
+    vm.expectRevert(V3Provider.NotWhitelisted.selector);
+    provider.deposit(marketParams, 1 ether, 1 ether, 0, 0, 0, user);
+    vm.stopPrank();
+
+    _allow(user, true);
+    (uint256 shares, , ) = _deposit(user, 1 ether, 1 ether);
+    assertGt(shares, 0, "listed depositor gets in");
+  }
+
+  /// @dev Gating only msg.sender would let a listed caller open a position for an unlisted address.
+  function test_depositWhitelist_blocksUnlistedOnBehalf() public {
+    _enableWhitelist();
+    _allow(user, true);
+    deal(SLISBNB, user, 1 ether);
+    deal(WBNB, user, 1 ether);
+    vm.startPrank(user);
+    IERC20(SLISBNB).approve(address(provider), 1 ether);
+    IERC20(WBNB).approve(address(provider), 1 ether);
+    vm.expectRevert(V3Provider.NotWhitelisted.selector);
+    provider.deposit(marketParams, 1 ether, 1 ether, 0, 0, 0, user2);
+    vm.stopPrank();
+  }
+
+  /// @dev A delisted holder must never be trapped: exits stay open after the gate closes on them.
+  function test_depositWhitelist_neverBlocksExit() public {
+    (uint256 shares, , ) = _deposit(user, 5 ether, 5 ether);
+    _enableWhitelist(); // user is NOT listed
+
+    vm.prank(user);
+    provider.withdraw(marketParams, shares / 2, 0, 0, user, user);
+
+    vm.prank(user);
+    provider.withdrawShares(marketParams, shares / 4, user, user);
+    vm.prank(user);
+    provider.redeemShares(shares / 4, 0, 0, user);
+
+    // All three exit paths ran under the gate: collateral shrank and the shares pulled to the wallet
+    // were redeemed rather than stranded there.
+    assertEq(_collateral(user), shares - shares / 2 - shares / 4, "collateral drawn down while gated");
+    assertEq(provider.balanceOf(user), 0, "wallet shares redeemed while gated");
+  }
+
+  /// @dev Liquidation must keep working under the gate, or bad debt is socialised to lenders.
+  function test_depositWhitelist_neverBlocksLiquidation() public {
+    (uint256 shares, , ) = _deposit(user, 10 ether, 10 ether);
+    _borrowAgainstCollateral(user);
+    _enableWhitelist(); // nobody is listed
+    _makeUnhealthy();
+
+    uint256 seize = _collateral(user) / 2;
+    deal(LISUSD, address(this), 1_000_000 ether);
+    IERC20(LISUSD).approve(MOOLAH_PROXY, type(uint256).max);
+    moolah.liquidate(marketParams, user, seize, 0, "");
+    assertLt(_collateral(user), shares, "liquidation still seizes under the gate");
+  }
+
+  function test_setDepositWhitelist_onlyManager() public {
+    address[] memory a = new address[](1);
+    a[0] = user;
+    vm.expectRevert();
+    provider.setDepositWhitelist(a, true);
+    vm.expectRevert();
+    provider.setDepositWhitelistEnabled(true);
+  }
+
   function _collateral(address _user) internal view returns (uint256) {
     (, , uint256 col) = moolah.position(marketId, _user);
     return col;