Preliminary Report fixes

packages/contracts/package.json

@@ -10,7 +10,7 @@
     "dev": "yarn rm-dbdata && anvil --config-out localhost.json & make deploy-local",
     "build": "forge build && yarn gen-types",
     "test": "forge test",
-    "coverage": "forge coverage --report lcov && genhtml lcov.info -o out/test-reports/coverage --ignore-errors inconsistent",
+    "coverage": "forge coverage --report lcov && genhtml lcov.info --branch-coverage -o out/test-reports/coverage --ignore-errors inconsistent",
     "format": "forge fmt && prettier './script/**/*.js' --write",
     "lint": "forge fmt && eslint --fix --ignore-path .gitignore && yarn solhint './*(test|src)/**/*.sol'",
     "db-check": "tsc && node ./script/utils/checkDb.js",

packages/contracts/src/token/ERC1155/MultiTokenVault.sol

@@ -41,6 +41,7 @@ abstract contract MultiTokenVault is
     error MultiTokenVault__CallerMissingApprovalForAll(address operator, address owner);
     error MultiTokenVault__RedeemBeforeDeposit(address owner, uint256 depositPeriod, uint256 redeemPeriod);
     error MultiTokenVault__InvalidArrayLength(uint256 depositPeriodsLength, uint256 sharesLength);
+    error MultiTokenVault__FractionalSharesNotAllowed();
 
     constructor() {
         _disableInitializers();

packages/contracts/src/yield/CalcInterestMetadata.sol

@@ -40,4 +40,11 @@ abstract contract CalcInterestMetadata is Initializable, ICalcInterestMetadata {
     function scale() public view virtual returns (uint256 scale_) {
         return SCALE;
     }
+
+    /**
+     * @dev This empty reserved space is put in place to allow future versions to add new
+     * variables without shifting down storage in the inheritance chain.
+     * See https://docs.openzeppelin.com/contracts/4.x/upgradeable#storage_gaps
+     */
+    uint256[49] private __gap;
 }

packages/contracts/src/yield/LiquidContinuousMultiTokenVault.sol

@@ -73,7 +73,8 @@ contract LiquidContinuousMultiTokenVault is
 
     error LiquidContinuousMultiTokenVault__InvalidFrequency(uint256 frequency);
     error LiquidContinuousMultiTokenVault__InvalidAuthAddress(string authName, address authAddress);
-    error LiquidContinuousMultiTokenVault__ControllerMismatch(address sender, address controller);
+    error LiquidContinuousMultiTokenVault__ControllerNotSender(address sender, address controller);
+    error LiquidContinuousMultiTokenVault__UnAuthorized(address sender, address authorizedOwner);
     error LiquidContinuousMultiTokenVault__AmountMismatch(uint256 amount1, uint256 amount2);
     error LiquidContinuousMultiTokenVault__UnlockPeriodMismatch(uint256 unlockPeriod1, uint256 unlockPeriod2);
     error LiquidContinuousMultiTokenVault__InvalidComponentTokenAmount(
@@ -179,11 +180,12 @@ contract LiquidContinuousMultiTokenVault is
      * @param owner Source of the assets to deposit
      * @return requestId_ Discriminator between non-fungible requests
      */
-    function requestDeposit(uint256 assets, address controller, address owner) public returns (uint256 requestId_) {
-        if (controller != _msgSender()) {
-            revert LiquidContinuousMultiTokenVault__ControllerMismatch(_msgSender(), controller);
-        }
-
+    function requestDeposit(uint256 assets, address controller, address owner)
+        public
+        onlyAuthorized(owner)
+        onlyController(controller)
+        returns (uint256 requestId_)
+    {
         uint256 requestId = ZERO_REQUEST_ID; // requests and requestIds not used in buys.
 
         deposit(assets, owner, controller);
@@ -196,11 +198,11 @@ contract LiquidContinuousMultiTokenVault is
      * @param assets Amount of `asset` that was deposited by `requestDeposit`
      * @param receiver Address to receive the shares
      */
-    function deposit(uint256 assets, address receiver, address controller) public returns (uint256 shares_) {
-        if (controller != _msgSender()) {
-            revert LiquidContinuousMultiTokenVault__ControllerMismatch(_msgSender(), controller);
-        }
-
+    function deposit(uint256 assets, address receiver, address controller)
+        public
+        onlyController(controller)
+        returns (uint256 shares_)
+    {
         uint256 shares = deposit(assets, receiver);
         emit Deposit(controller, receiver, assets, shares);
         return shares;
@@ -212,42 +214,49 @@ contract LiquidContinuousMultiTokenVault is
      * @param owner Source of the shares to redeem
      * @return requestId_ Discriminator between non-fungible requests
      */
-    function requestRedeem(uint256 shares, address, /* controller */ address owner)
+    function requestRedeem(uint256 shares, address controller, address owner)
         public
+        onlyAuthorized(owner)
+        onlyController(controller)
         returns (uint256 requestId_)
     {
         // using optimize() variant in case "shares" represents the IComponent "principal + yield" which is our "assets".
         (uint256[] memory depositPeriods, uint256[] memory sharesAtPeriods) =
             _redeemOptimizer.optimize(this, owner, shares, shares, minUnlockPeriod());
 
-        uint256 requestId = requestUnlock(_msgSender(), depositPeriods, sharesAtPeriods);
-        emit RedeemRequest(_msgSender(), owner, requestId, _msgSender(), shares);
+        uint256 requestId = requestUnlock(owner, depositPeriods, sharesAtPeriods);
+        emit RedeemRequest(controller, owner, requestId, _msgSender(), shares);
         return requestId;
     }
 
     /**
      * @notice Fulfill a request to redeem assets by transferring assets to the receiver
      * @param shares Amount of shares that was redeemed by `requestRedeem`
      * @param receiver Address to receive the assets
+     * @dev controller will only have tokens to redeem if they are also the owner
      */
-    function redeem(uint256 shares, address receiver, address /* controller */ ) public returns (uint256 assets) {
+    function redeem(uint256 shares, address receiver, address controller)
+        public
+        onlyController(controller)
+        returns (uint256 assets)
+    {
         uint256 requestId = currentPeriod(); // requestId = redeemPeriod, and redeem can only be called  where redeemPeriod = currentPeriod()
 
-        uint256 unlockRequestedAmount = unlockRequestAmount(receiver, requestId);
+        uint256 unlockRequestedAmount = unlockRequestAmount(controller, requestId);
         if (shares != unlockRequestedAmount) {
             revert LiquidContinuousMultiTokenVault__InvalidComponentTokenAmount(shares, unlockRequestedAmount);
         }
 
-        (uint256[] memory depositPeriods, uint256[] memory sharesAtPeriods) = unlock(receiver, requestId); // unlockPeriod = redeemPeriod
+        (uint256[] memory depositPeriods, uint256[] memory sharesAtPeriods) = unlock(controller, requestId); // unlockPeriod = redeemPeriod
 
         uint256 totalAssetsRedeemed = 0;
 
         for (uint256 i = 0; i < depositPeriods.length; ++i) {
             totalAssetsRedeemed += _redeemForDepositPeriodAfterUnlock(
-                sharesAtPeriods[i], receiver, _msgSender(), depositPeriods[i], requestId
+                sharesAtPeriods[i], receiver, controller, depositPeriods[i], requestId
             );
         }
-        emit Withdraw(_msgSender(), receiver, _msgSender(), totalAssetsRedeemed, shares);
+        emit Withdraw(_msgSender(), receiver, controller, totalAssetsRedeemed, shares);
         return totalAssetsRedeemed;
     }
 
@@ -393,6 +402,13 @@ contract LiquidContinuousMultiTokenVault is
         return balanceOf(account, depositPeriod);
     }
 
+    /// @inheritdoc TimelockAsyncUnlock
+    function _authorizeCaller(address caller, address owner) internal virtual override {
+        if (caller != owner && !isApprovedForAll(owner, caller)) {
+            revert LiquidContinuousMultiTokenVault__UnAuthorized(caller, owner);
+        }
+    }
+
     // ===================== TripleRateContext =====================
 
     /// @inheritdoc TripleRateContext
@@ -458,6 +474,22 @@ contract LiquidContinuousMultiTokenVault is
 
     // ===================== Utility =====================
 
+    // @dev ensure caller is permitted to act on the owner's tokens
+    modifier onlyAuthorized(address owner) {
+        _authorizeCaller(_msgSender(), owner);
+        _;
+    }
+
+    // @dev ensure the controller is the caller
+    modifier onlyController(address controller) {
+        address caller = _msgSender();
+
+        if (caller != controller) {
+            revert LiquidContinuousMultiTokenVault__ControllerNotSender(caller, controller);
+        }
+        _;
+    }
+
     function pause() public onlyRole(OPERATOR_ROLE) {
         _pause();
     }

packages/contracts/src/yield/strategy/TripleRateYieldStrategy.sol

@@ -102,7 +102,7 @@ contract TripleRateYieldStrategy is AbstractYieldStrategy {
         ITripleRateContext context = ITripleRateContext(contextContract);
 
         return CalcSimpleInterest.calcPriceFromInterest(
-            numPeriodsElapsed, context.rateScaled(), context.frequency(), context.scale()
+            context.rateScaled(), numPeriodsElapsed, context.frequency(), context.scale()
         );
     }