Skip to content

Commit b2c7e4c

Browse files
thedavidmeisterthedavidmeister
committed
wip on freeze
1 parent 1795ba5 commit b2c7e4c

6 files changed

+23
-53
lines changed

‎src/concrete/authorize/OffchainAssetReceiptVaultAuthorizerV1.sol‎

Lines changed: 7 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -46,12 +46,6 @@ bytes32 constant DEPOSIT_ADMIN = keccak256("DEPOSIT_ADMIN");
4646
/// @dev Rolename for withdraw admins.
4747
bytes32 constant WITHDRAW_ADMIN = keccak256("WITHDRAW_ADMIN");
4848

49-
/// @dev Rolename for handlers.
50-
/// Handler role is required to accept tokens during system freeze.
51-
bytes32 constant FREEZE_HANDLER = keccak256("FREEZE_HANDLER");
52-
/// @dev Rolename for handler admins.
53-
bytes32 constant FREEZE_HANDLER_ADMIN = keccak256("FREEZE_HANDLER_ADMIN");
54-
5549
/// @dev Configuration for the OffchainAssetReceiptVaultAuthorizorV1.
5650
/// @param initialAdmin The initial admin of the contract.
5751
/// @param authorizee The address that is authorized to perform actions.
@@ -106,15 +100,11 @@ contract OffchainAssetReceiptVaultAuthorizerV1 is IAuthorizeV1, ICloneableV2, Ac
106100
_setRoleAdmin(WITHDRAW, WITHDRAW_ADMIN);
107101
_setRoleAdmin(WITHDRAW_ADMIN, WITHDRAW_ADMIN);
108102

109-
_setRoleAdmin(FREEZE_HANDLER, FREEZE_HANDLER_ADMIN);
110-
_setRoleAdmin(FREEZE_HANDLER_ADMIN, FREEZE_HANDLER_ADMIN);
111-
112103
_grantRole(CERTIFY_ADMIN, config.initialAdmin);
113104
_grantRole(CONFISCATE_RECEIPT_ADMIN, config.initialAdmin);
114105
_grantRole(CONFISCATE_SHARES_ADMIN, config.initialAdmin);
115106
_grantRole(DEPOSIT_ADMIN, config.initialAdmin);
116107
_grantRole(WITHDRAW_ADMIN, config.initialAdmin);
117-
_grantRole(FREEZE_HANDLER_ADMIN, config.initialAdmin);
118108

119109
return ICLONEABLE_V2_SUCCESS;
120110
}
@@ -173,13 +163,6 @@ contract OffchainAssetReceiptVaultAuthorizerV1 is IAuthorizeV1, ICloneableV2, Ac
173163

174164
// Everyone else can only transfer while the certification is valid.
175165
if (isCertificationExpired) {
176-
// Handlers can ALWAYS send and receive funds.
177-
// Handlers bypass BOTH the timestamp on certification AND tier based
178-
// restriction.
179-
if (hasRole(FREEZE_HANDLER, from) || hasRole(FREEZE_HANDLER, to)) {
180-
return;
181-
}
182-
183166
// Minting and burning is always allowed for the respective roles if they
184167
// interact directly with the shares/receipt. Minting and burning is ALSO
185168
// valid after the certification expires as it is likely the only way to
@@ -188,10 +171,13 @@ contract OffchainAssetReceiptVaultAuthorizerV1 is IAuthorizeV1, ICloneableV2, Ac
188171
return;
189172
}
190173

191-
// Confiscation is always allowed as it likely represents some kind of
192-
// regulatory/legal requirement. It may also be required to satisfy
193-
// certification requirements.
194-
if (hasRole(CONFISCATE_SHARES, to) || hasRole(CONFISCATE_RECEIPT, to)) {
174+
// Confiscators bypass the certification check when they are the
175+
// user. This allows for legal confiscation during system freeze
176+
// and for certification repair.
177+
if (
178+
(permission == TRANSFER_SHARES && hasRole(CONFISCATE_SHARES, user))
179+
|| (permission == TRANSFER_RECEIPT && hasRole(CONFISCATE_RECEIPT, user))
180+
) {
195181
return;
196182
}
197183

‎test/src/concrete/authorize/OffchainAssetReceiptVaultAuthorizerV1.authorize.t.sol‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,6 @@ import {
1717
CONFISCATE_SHARES,
1818
DEPOSIT,
1919
WITHDRAW,
20-
FREEZE_HANDLER,
2120
CertificationExpired
2221
} from "src/concrete/authorize/OffchainAssetReceiptVaultAuthorizerV1.sol";
2322
import {CloneFactory} from "rain.factory/concrete/CloneFactory.sol";
@@ -72,13 +71,12 @@ contract OffchainAssetReceiptVaultAuthorizerV1AuthorizeTest is Test {
7271
OffchainAssetReceiptVaultAuthorizerV1 authorizer =
7372
OffchainAssetReceiptVaultAuthorizerV1(factory.clone(address(authorizerImplementation), abi.encode(config)));
7473

75-
bytes32[] memory roles = new bytes32[](6);
74+
bytes32[] memory roles = new bytes32[](5);
7675
roles[0] = CERTIFY;
7776
roles[1] = CONFISCATE_SHARES;
7877
roles[2] = CONFISCATE_RECEIPT;
7978
roles[3] = DEPOSIT;
8079
roles[4] = WITHDRAW;
81-
roles[5] = FREEZE_HANDLER;
8280

8381
for (uint256 i = 0; i < roles.length; i++) {
8482
vm.assertTrue(!authorizer.hasRole(roles[i], user));

‎test/src/concrete/authorize/OffchainAssetReceiptVaultAuthorizerV1.construct.t.sol‎

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,6 @@ import {
1212
CONFISCATE_RECEIPT_ADMIN,
1313
DEPOSIT_ADMIN,
1414
WITHDRAW_ADMIN,
15-
FREEZE_HANDLER_ADMIN,
16-
FREEZE_HANDLER,
1715
CERTIFY,
1816
CONFISCATE_SHARES,
1917
CONFISCATE_RECEIPT,
@@ -49,13 +47,11 @@ contract OffchainAssetReceiptVaultAuthorizerV1ConstructTest is Test {
4947
vm.assume(badRole != CONFISCATE_RECEIPT_ADMIN);
5048
vm.assume(badRole != DEPOSIT_ADMIN);
5149
vm.assume(badRole != WITHDRAW_ADMIN);
52-
vm.assume(badRole != FREEZE_HANDLER_ADMIN);
5350
vm.assume(badRole != CERTIFY);
5451
vm.assume(badRole != CONFISCATE_SHARES);
5552
vm.assume(badRole != CONFISCATE_RECEIPT);
5653
vm.assume(badRole != DEPOSIT);
5754
vm.assume(badRole != WITHDRAW);
58-
vm.assume(badRole != FREEZE_HANDLER);
5955

6056
OffchainAssetReceiptVaultAuthorizerV1 authorizerImplementation = new OffchainAssetReceiptVaultAuthorizerV1();
6157

@@ -76,30 +72,26 @@ contract OffchainAssetReceiptVaultAuthorizerV1ConstructTest is Test {
7672
vm.assertTrue(authorizer.hasRole(CONFISCATE_RECEIPT_ADMIN, initialAdmin));
7773
vm.assertTrue(authorizer.hasRole(DEPOSIT_ADMIN, initialAdmin));
7874
vm.assertTrue(authorizer.hasRole(WITHDRAW_ADMIN, initialAdmin));
79-
vm.assertTrue(authorizer.hasRole(FREEZE_HANDLER_ADMIN, initialAdmin));
8075

8176
vm.assertTrue(!authorizer.hasRole(CERTIFY, initialAdmin));
8277
vm.assertTrue(!authorizer.hasRole(CONFISCATE_SHARES, initialAdmin));
8378
vm.assertTrue(!authorizer.hasRole(CONFISCATE_RECEIPT, initialAdmin));
8479
vm.assertTrue(!authorizer.hasRole(DEPOSIT, initialAdmin));
8580
vm.assertTrue(!authorizer.hasRole(WITHDRAW, initialAdmin));
86-
vm.assertTrue(!authorizer.hasRole(FREEZE_HANDLER, initialAdmin));
8781
vm.assertTrue(!authorizer.hasRole(badRole, initialAdmin));
8882

8983
vm.assertTrue(!authorizer.hasRole(CERTIFY_ADMIN, authorizee));
9084
vm.assertTrue(!authorizer.hasRole(CONFISCATE_SHARES_ADMIN, authorizee));
9185
vm.assertTrue(!authorizer.hasRole(CONFISCATE_RECEIPT_ADMIN, authorizee));
9286
vm.assertTrue(!authorizer.hasRole(DEPOSIT_ADMIN, authorizee));
9387
vm.assertTrue(!authorizer.hasRole(WITHDRAW_ADMIN, authorizee));
94-
vm.assertTrue(!authorizer.hasRole(FREEZE_HANDLER_ADMIN, authorizee));
9588
vm.assertTrue(!authorizer.hasRole(badRole, authorizee));
9689

9790
vm.assertTrue(!authorizer.hasRole(CERTIFY, authorizee));
9891
vm.assertTrue(!authorizer.hasRole(CONFISCATE_SHARES, authorizee));
9992
vm.assertTrue(!authorizer.hasRole(CONFISCATE_RECEIPT, authorizee));
10093
vm.assertTrue(!authorizer.hasRole(DEPOSIT, authorizee));
10194
vm.assertTrue(!authorizer.hasRole(WITHDRAW, authorizee));
102-
vm.assertTrue(!authorizer.hasRole(FREEZE_HANDLER, authorizee));
10395
vm.assertTrue(!authorizer.hasRole(badRole, authorizee));
10496

10597
vm.startPrank(initialAdmin);
@@ -108,15 +100,13 @@ contract OffchainAssetReceiptVaultAuthorizerV1ConstructTest is Test {
108100
authorizer.grantRole(CONFISCATE_RECEIPT, authorizee);
109101
authorizer.grantRole(DEPOSIT, authorizee);
110102
authorizer.grantRole(WITHDRAW, authorizee);
111-
authorizer.grantRole(FREEZE_HANDLER, authorizee);
112103
vm.stopPrank();
113104

114105
vm.assertTrue(authorizer.hasRole(CERTIFY, authorizee));
115106
vm.assertTrue(authorizer.hasRole(CONFISCATE_SHARES, authorizee));
116107
vm.assertTrue(authorizer.hasRole(CONFISCATE_RECEIPT, authorizee));
117108
vm.assertTrue(authorizer.hasRole(DEPOSIT, authorizee));
118109
vm.assertTrue(authorizer.hasRole(WITHDRAW, authorizee));
119-
vm.assertTrue(authorizer.hasRole(FREEZE_HANDLER, authorizee));
120110
vm.assertTrue(!authorizer.hasRole(badRole, authorizee));
121111
}
122112

‎test/src/concrete/vault/OffchainAssetReceiptVault.authorizeReceiptTransfer.t.sol‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,7 @@ import {
99
import {LibUniqueAddressesGenerator} from "../../../lib/LibUniqueAddressesGenerator.sol";
1010
import {
1111
OffchainAssetReceiptVaultAuthorizerV1,
12-
CertificationExpired,
13-
FREEZE_HANDLER
12+
CertificationExpired
1413
} from "src/concrete/authorize/OffchainAssetReceiptVaultAuthorizerV1.sol";
1514
import {UnmanagedReceiptTransfer} from "src/interface/IReceiptManagerV2.sol";
1615

@@ -120,7 +119,8 @@ contract OffchainAssetReceiptVaultAuthorizeReceiptTransferTest is OffchainAssetR
120119
vm.stopPrank();
121120
}
122121

123-
/// Test AuthorizeReceiptTransfer does not revert without certification if transfers involve a handler role
122+
/// Test AuthorizeReceiptTransfer does not revert without certification if
123+
/// transfers involve a handler role
124124
function testAuthorizeReceiptTransferForHandlerFrom(
125125
uint256 aliceSeed,
126126
uint256 bobSeed,
@@ -137,7 +137,7 @@ contract OffchainAssetReceiptVaultAuthorizeReceiptTransferTest is OffchainAssetR
137137

138138
// Prank as Alice to set role
139139
vm.startPrank(alice);
140-
OffchainAssetReceiptVaultAuthorizerV1(address(vault.authorizer())).grantRole(FREEZE_HANDLER, bob);
140+
// OffchainAssetReceiptVaultAuthorizerV1(address(vault.authorizer())).grantRole(FREEZE_HANDLER, bob);
141141

142142
vm.startPrank(address(vault.receipt()));
143143

@@ -147,7 +147,7 @@ contract OffchainAssetReceiptVaultAuthorizeReceiptTransferTest is OffchainAssetR
147147

148148
vm.startPrank(alice);
149149
// Grant handler role to alice.
150-
OffchainAssetReceiptVaultAuthorizerV1(address(vault.authorizer())).grantRole(FREEZE_HANDLER, alice);
150+
// OffchainAssetReceiptVaultAuthorizerV1(address(vault.authorizer())).grantRole(FREEZE_HANDLER, alice);
151151

152152
vm.startPrank(address(vault.receipt()));
153153

‎test/src/concrete/vault/OffchainAssetReceiptVault.handler.t.sol‎

Lines changed: 10 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -2,14 +2,16 @@
22
// SPDX-FileCopyrightText: Copyright (c) 2020 Rain Open Source Software Ltd
33
pragma solidity =0.8.25;
44

5-
import {OffchainAssetReceiptVault, DEPOSIT, CERTIFY} from "src/concrete/vault/OffchainAssetReceiptVault.sol";
5+
import {
6+
OffchainAssetReceiptVault,
7+
DEPOSIT,
8+
CERTIFY,
9+
CONFISCATE_RECEIPT
10+
} from "src/concrete/vault/OffchainAssetReceiptVault.sol";
611
import {OffchainAssetReceiptVaultTest, Vm} from "test/abstract/OffchainAssetReceiptVaultTest.sol";
712
import {LibOffchainAssetVaultCreator} from "test/lib/LibOffchainAssetVaultCreator.sol";
813
import {Receipt as ReceiptContract} from "src/concrete/receipt/Receipt.sol";
9-
import {
10-
OffchainAssetReceiptVaultAuthorizerV1,
11-
FREEZE_HANDLER
12-
} from "src/concrete/authorize/OffchainAssetReceiptVaultAuthorizerV1.sol";
14+
import {OffchainAssetReceiptVaultAuthorizerV1} from "src/concrete/authorize/OffchainAssetReceiptVaultAuthorizerV1.sol";
1315
import {LibUniqueAddressesGenerator} from "../../../lib/LibUniqueAddressesGenerator.sol";
1416

1517
contract OffchainAssetReceiptVaultHandlerTest is OffchainAssetReceiptVaultTest {
@@ -69,7 +71,7 @@ contract OffchainAssetReceiptVaultHandlerTest is OffchainAssetReceiptVaultTest {
6971
vm.startPrank(alice);
7072

7173
OffchainAssetReceiptVaultAuthorizerV1(address(vault.authorizer())).grantRole(CERTIFY, alice);
72-
OffchainAssetReceiptVaultAuthorizerV1(address(vault.authorizer())).grantRole(FREEZE_HANDLER, bob);
74+
// OffchainAssetReceiptVaultAuthorizerV1(address(vault.authorizer())).grantRole(FREEZE_HANDLER, bob);
7375
OffchainAssetReceiptVaultAuthorizerV1(address(vault.authorizer())).grantRole(DEPOSIT, alice);
7476

7577
// Call the certify function
@@ -124,7 +126,7 @@ contract OffchainAssetReceiptVaultHandlerTest is OffchainAssetReceiptVaultTest {
124126
vm.startPrank(alice);
125127

126128
OffchainAssetReceiptVaultAuthorizerV1(address(vault.authorizer())).grantRole(CERTIFY, alice);
127-
OffchainAssetReceiptVaultAuthorizerV1(address(vault.authorizer())).grantRole(FREEZE_HANDLER, bob);
129+
// OffchainAssetReceiptVaultAuthorizerV1(address(vault.authorizer())).grantRole(FREEZE_HANDLER, bob);
128130
OffchainAssetReceiptVaultAuthorizerV1(address(vault.authorizer())).grantRole(DEPOSIT, alice);
129131

130132
// Call the certify function
@@ -180,7 +182,7 @@ contract OffchainAssetReceiptVaultHandlerTest is OffchainAssetReceiptVaultTest {
180182
vm.startPrank(alice);
181183

182184
OffchainAssetReceiptVaultAuthorizerV1(address(vault.authorizer())).grantRole(CERTIFY, alice);
183-
OffchainAssetReceiptVaultAuthorizerV1(address(vault.authorizer())).grantRole(FREEZE_HANDLER, john);
185+
// OffchainAssetReceiptVaultAuthorizerV1(address(vault.authorizer())).grantRole(CONFISCATE_RECEIPT, john);
184186
OffchainAssetReceiptVaultAuthorizerV1(address(vault.authorizer())).grantRole(DEPOSIT, alice);
185187

186188
// Call the certify function

‎test/src/concrete/vault/OffchainAssetReceiptVault.roles.t.sol‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -26,13 +26,11 @@ import {
2626
CERTIFY_ADMIN,
2727
CONFISCATE_RECEIPT_ADMIN,
2828
CONFISCATE_SHARES_ADMIN,
29-
FREEZE_HANDLER_ADMIN,
3029
DEPOSIT_ADMIN,
3130
WITHDRAW_ADMIN,
3231
DEPOSIT,
3332
WITHDRAW,
3433
CERTIFY,
35-
FREEZE_HANDLER,
3634
CONFISCATE_RECEIPT,
3735
CONFISCATE_SHARES
3836
} from "src/concrete/authorize/OffchainAssetReceiptVaultAuthorizerV1.sol";
@@ -47,9 +45,6 @@ contract RolesTest is OffchainAssetReceiptVaultTest {
4745
assertTrue(OffchainAssetReceiptVaultAuthorizerV1(address(vault.authorizer())).hasRole(DEPOSIT_ADMIN, alice));
4846
assertTrue(OffchainAssetReceiptVaultAuthorizerV1(address(vault.authorizer())).hasRole(WITHDRAW_ADMIN, alice));
4947
assertTrue(OffchainAssetReceiptVaultAuthorizerV1(address(vault.authorizer())).hasRole(CERTIFY_ADMIN, alice));
50-
assertTrue(
51-
OffchainAssetReceiptVaultAuthorizerV1(address(vault.authorizer())).hasRole(FREEZE_HANDLER_ADMIN, alice)
52-
);
5348
assertTrue(
5449
OffchainAssetReceiptVaultAuthorizerV1(address(vault.authorizer())).hasRole(CONFISCATE_RECEIPT_ADMIN, alice)
5550
);
@@ -60,7 +55,6 @@ contract RolesTest is OffchainAssetReceiptVaultTest {
6055
assertTrue(!OffchainAssetReceiptVaultAuthorizerV1(address(vault.authorizer())).hasRole(DEPOSIT, alice));
6156
assertTrue(!OffchainAssetReceiptVaultAuthorizerV1(address(vault.authorizer())).hasRole(WITHDRAW, alice));
6257
assertTrue(!OffchainAssetReceiptVaultAuthorizerV1(address(vault.authorizer())).hasRole(CERTIFY, alice));
63-
assertTrue(!OffchainAssetReceiptVaultAuthorizerV1(address(vault.authorizer())).hasRole(FREEZE_HANDLER, alice));
6458
assertTrue(
6559
!OffchainAssetReceiptVaultAuthorizerV1(address(vault.authorizer())).hasRole(CONFISCATE_RECEIPT, alice)
6660
);

0 commit comments

Comments
 (0)