temple gold contracts

.github/workflows/protocol-deep-invarianats.yaml

@@ -0,0 +1,159 @@
+name: Protocol Deep Invariant Tests
+on:
+  schedule:
+    - cron: "0 8 * * 0" # at 8:00pm UTC every Sunday
+  workflow_dispatch:
+    inputs:
+      invariantRuns:
+        default: "5000"
+        description: "Invariant runs: number of sequences of function calls generated and run."
+        required: false
+      invariantDepth:
+        default: "90"
+        description: "Invariant depth: number of function calls made in a given run."
+        required: false
+
+jobs:
+  build:
+    name: Build Contracts
+    runs-on: ${{ matrix.os }}
+    permissions:
+      # required for all workflows
+      security-events: write
+      # only required for workflows in private repositories
+      actions: read
+      contents: read
+    strategy:
+      matrix:
+        os:
+          - ubuntu-latest
+        node_version:
+          - 20
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          submodules: recursive
+
+      - name: Use Node.js ${{ matrix.node_version }}
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node_version }}
+          cache: 'yarn'
+          cache-dependency-path: apps/protocol/yarn.lock
+
+      - name: Install yarn project
+        run: yarn install
+        working-directory: protocol
+
+      - name: Install Foundry
+        uses: foundry-rs/foundry-toolchain@v1
+        with:
+          version: nightly
+
+      - name: Show the Foundry CI config
+        run: forge config
+        env:
+          FOUNDRY_PROFILE: ci
+
+      - name: Show the Foundry version
+        run: forge --version
+        working-directory: protocol
+
+      - name: "Forge Build"
+        run: "forge build"
+        working-directory: protocol
+        env:
+          FOUNDRY_PROFILE: ci
+
+      - name: Increase swapfile
+        run: |
+          sudo swapoff -a
+          sudo fallocate -l 15G /swapfile
+          sudo chmod 600 /swapfile
+          sudo mkswap /swapfile
+          sudo swapon /swapfile
+          sudo swapon --show
+
+      - name: "Cache the build and the node modules so that they can be re-used by the other jobs"
+        uses: "actions/cache/save@v3"
+        with:
+          key: "build-and-modules-${{ github.sha }}"
+          path: |
+            protocol/node_modules
+            protocol/cache-foundry
+            protocol/artifacts-foundry
+
+      - name: "Store the contract artifacts in CI"
+        uses: "actions/upload-artifact@v4"
+        with:
+          name: "contract-artifacts"
+          path: "protocol/artifacts-foundry"
+
+      - name: "Add build summary"
+        run: |
+          echo "## Build result" >> $GITHUB_STEP_SUMMARY
+          echo "✅ Passed" >> $GITHUB_STEP_SUMMARY
+
+  foundry-test-invariant:
+    name: Foundry Invariant Tests
+    needs: ["build"]
+    runs-on: ${{ matrix.os }}
+    permissions:
+      # required for all workflows
+      security-events: write
+      # only required for workflows in private repositories
+      actions: read
+      contents: read
+    strategy:
+      matrix:
+        os:
+          - ubuntu-latest
+        node_version:
+          - 20
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          submodules: recursive
+
+      - name: Use Node.js ${{ matrix.node_version }}
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node_version }}
+          cache: 'yarn'
+          cache-dependency-path: protocol/yarn.lock
+
+      - name: Install Foundry
+        uses: foundry-rs/foundry-toolchain@v1
+        with:
+          version: nightly
+      - name: "Restore the cached build and the node modules"
+        uses: "actions/cache/restore@v3"
+        with:
+          fail-on-cache-miss: true
+          key: "build-and-modules-${{ github.sha }}"
+          path: |
+            protocol/node_modules
+            protocol/cache-foundry
+            protocol/artifacts-foundry
+      - name: "Generate fuzz seed"
+        run: echo "FOUNDRY_FUZZ_SEED=$EPOCHSECONDS" >> $GITHUB_ENV
+
+      - name: "Log fuzz seed"
+        run: echo "FOUNDRY_FUZZ_SEED=$FOUNDRY_FUZZ_SEED"
+
+      - name: Foundry invariant tests
+        run: "forge test --match-path \"test/foundry/invariant/**/*.sol\""
+        working-directory: protocol
+        env:
+          FOUNDRY_PROFILE: ci
+          FOUNDRY_INVARIANT_DEPTH: ${{ inputs.invariantDepth || '90' }}
+          FOUNDRY_INVARIANT_RUNS: ${{ inputs.invariantRuns || '5000' }}
+          MAINNET_RPC_URL: ${{ secrets.TESTS_MAINNET_RPC_URL }}
+          POLYGON_RPC_URL: ${{ secrets.TESTS_POLYGON_RPC_URL }}
+
+      - name: "Add test summary"
+        run: |
+          echo "## Deep Invariant tests result" >> $GITHUB_STEP_SUMMARY
+          echo "✅ Passed" >> $GITHUB_STEP_SUMMARY

.github/workflows/protocol-tests.yaml

@@ -50,6 +50,7 @@ jobs:
         working-directory: protocol
         env:
           TESTS_MAINNET_RPC_URL: ${{ secrets.TESTS_MAINNET_RPC_URL }}
+          ARBITRUM_ONE_RPC_URL: ${{ secrets.TESTS_ARBITRUM_ONE_RPC_URL }}
 
   foundryTests:
     name: Foundry Tests
@@ -100,12 +101,73 @@ jobs:
         run: forge --version
         working-directory: protocol
 
-      - name: Foundry tests
-        run: forge test --gas-report
+      - name: Foundry unit tests
+        run: forge test --match-path "test/forge/unit/**/*.t.sol"
         working-directory: protocol
         env:
           FOUNDRY_PROFILE: ci
           MAINNET_RPC_URL: ${{ secrets.TESTS_MAINNET_RPC_URL }}
+          ARBITRUM_ONE_RPC_URL: ${{ secrets.TESTS_ARBITRUM_ONE_RPC_URL }}
+
+  foundryInvariantTests:
+    name: Foundry Invariant Tests
+    runs-on: ${{ matrix.os }}
+    permissions:
+      # required for all workflows
+      security-events: write
+      # only required for workflows in private repositories
+      actions: read
+      contents: read
+    strategy:
+      matrix:
+        os:
+          - ubuntu-latest
+        node_version:
+          - 20
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          submodules: recursive
+
+      - name: Use Node.js ${{ matrix.node_version }}
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node_version }}
+          cache: 'yarn'
+          cache-dependency-path: protocol/yarn.lock
+
+      - name: Install yarn project
+        run: yarn install
+        working-directory: protocol
+
+      - name: Install Foundry
+        uses: foundry-rs/foundry-toolchain@v1
+        with:
+          version: nightly
+          #  version: nightly-ca67d15f4abd46394b324c50e21e66f306a1162d
+          cache: true
+
+      - name: Show the Foundry CI config
+        run: forge config
+        env:
+          FOUNDRY_PROFILE: ci
+
+      - name: Show the Foundry version
+        run: forge --version
+        working-directory: protocol
+
+      - name: Foundry invariant tests
+        run: forge test --match-path "test/forge/invariant/**/*.sol"
+        working-directory: protocol
+        env:
+          FOUNDRY_PROFILE: ci
+          FOUNDRY_INVARIANT_RUNS: 150  # Defer larger runs for another pipeline
+          FOUNDRY_INVARIANT_DEPTH: 80
+          MAINNET_RPC_URL: ${{ secrets.TESTS_MAINNET_RPC_URL }}
+          ARBITRUM_ONE_RPC_URL: ${{ secrets.TESTS_ARBITRUM_ONE_RPC_URL }}
+
 
   slither:
     name: Slither

protocol/.gitignore

@@ -27,4 +27,7 @@ lcov.info
 report
 
 # autogenerated fork args
-scripts/deploys/localhost/deploymentArgs
+scripts/deploys/localhost/deploymentArgs
+
+# templegold scripts
+test/forge/templegold/scripts/

protocol/contracts/amo/AuraStaking.sol

@@ -1,4 +1,4 @@
-pragma solidity 0.8.20;
+pragma solidity ^0.8.20;
 // SPDX-License-Identifier: AGPL-3.0-or-later
 // Temple (amo/AuraStaking.sol)
 

protocol/contracts/amo/Ramos.sol

@@ -1,4 +1,4 @@
-pragma solidity 0.8.20;
+pragma solidity ^0.8.20;
 // SPDX-License-Identifier: AGPL-3.0-or-later
 // Temple (amo/Ramos.sol)
 

protocol/contracts/common/CommonEventsAndErrors.sol

@@ -1,4 +1,4 @@
-pragma solidity 0.8.20;
+pragma solidity ^0.8.20;
 // SPDX-License-Identifier: AGPL-3.0-or-later
 // Temple (common/CommonEventsAndErrors.sol)
 
@@ -12,5 +12,4 @@ library CommonEventsAndErrors {
     error ExpectedNonZero();
     error Unimplemented();
     event TokenRecovered(address indexed to, address indexed token, uint256 amount);
-    error AccountBlacklisted(address account);
 }

protocol/contracts/common/SafeCast.sol

@@ -1,4 +1,4 @@
-pragma solidity 0.8.20;
+pragma solidity ^0.8.20;
 // SPDX-License-Identifier: AGPL-3.0-or-later
 // Temple (common/SafeCast.sol)
 

protocol/contracts/common/TempleMath.sol

@@ -0,0 +1,16 @@
+pragma solidity ^0.8.20;
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// Temple (common/TempleMath.sol)
+
+import { mulDiv } from "@prb/math/src/Common.sol";
+
+library TempleMath {
+    /// @notice mulDiv with an option to round the result up or down to the nearest wei
+    function mulDivRound(uint256 x, uint256 y, uint256 denominator, bool roundUp) internal pure returns (uint256 result) {
+        result = mulDiv(x, y, denominator);
+        // See OZ Math.sol for the equivalent mulDiv() with rounding.
+        if (roundUp && mulmod(x, y, denominator) > 0) {
+            result += 1;
+        }
+    }
+}

protocol/contracts/common/access/ElevatedAccess.sol

@@ -0,0 +1,86 @@
+pragma solidity ^0.8.20;
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// Temple (common/access/ElevatedAccess.sol)
+
+import { CommonEventsAndErrors } from "contracts/common/CommonEventsAndErrors.sol";
+import { IElevatedAccess } from "contracts/interfaces/common/access/IElevatedAccess.sol";
+
+/**
+ * @notice Inherit to add Owner roles for DAO elevated access.
+ */ 
+abstract contract ElevatedAccess is IElevatedAccess {
+    /**
+     * @notice The address of the current owner.
+     */ 
+    address public override owner;
+
+    /**
+     * @notice Explicit approval for an address to execute a function.
+     * allowedCaller => function selector => true/false
+     */
+    mapping(address => mapping(bytes4 => bool)) public override explicitFunctionAccess;
+
+    /// @dev Track proposed owner
+    address private _proposedNewOwner;
+
+    function _init(address initialOwner) internal {
+        if (owner != address(0)) revert CommonEventsAndErrors.InvalidAccess();
+        if (initialOwner == address(0)) revert CommonEventsAndErrors.InvalidAddress();
+        owner = initialOwner;
+    }
+
+    /**
+     * @notice Proposes a new Owner.
+     * Can only be called by the current owner
+     */
+    function proposeNewOwner(address account) external override onlyElevatedAccess {
+        if (account == address(0)) revert CommonEventsAndErrors.InvalidAddress();
+        emit NewOwnerProposed(owner, _proposedNewOwner, account);
+        _proposedNewOwner = account;
+    }
+
+    /**
+     * @notice Caller accepts the role as new Owner.
+     * Can only be called by the proposed owner
+     */
+    function acceptOwner() external override {
+        if (msg.sender != _proposedNewOwner) revert CommonEventsAndErrors.InvalidAccess();
+
+        emit NewOwnerAccepted(owner, msg.sender);
+        owner = msg.sender;
+        delete _proposedNewOwner;
+    }
+
+    /**
+     * @notice Grant `allowedCaller` the rights to call the function selectors in the access list.
+     * @dev fnSelector == bytes4(keccak256("fn(argType1,argType2,...)"))
+     */
+    function setExplicitAccess(address allowedCaller, ExplicitAccess[] calldata access) external override onlyElevatedAccess {
+        if (allowedCaller == address(0)) revert CommonEventsAndErrors.InvalidAddress();
+        uint256 _length = access.length;
+        ExplicitAccess memory _access;
+        for (uint256 i; i < _length; ++i) {
+            _access = access[i];
+            emit ExplicitAccessSet(allowedCaller, _access.fnSelector, _access.allowed);
+            explicitFunctionAccess[allowedCaller][_access.fnSelector] = _access.allowed;
+        }
+    }
+
+    function isElevatedAccess(address caller, bytes4 fnSelector) internal view returns (bool) {
+        return (
+            caller == owner || 
+            explicitFunctionAccess[caller][fnSelector]
+        );
+    }
+
+    /**
+     * @notice The owner is allowed to call, or if explicit access has been given to the caller.
+     * @dev Important: Only for use when called from an *external* contract. 
+     * If a function with this modifier is called internally then the `msg.sig` 
+     * will still refer to the top level externally called function.
+     */
+    modifier onlyElevatedAccess() {
+        if (!isElevatedAccess(msg.sender, msg.sig)) revert CommonEventsAndErrors.InvalidAccess();
+        _;
+    }
+}

protocol/contracts/core/MultiOtcOffer.sol

@@ -1,4 +1,4 @@
-pragma solidity 0.8.20;
+pragma solidity ^0.8.20;
 // SPDX-License-Identifier: AGPL-3.0-or-later
 // Temple (core/MultiOtcOffer.sol)