Always revert when there is a value already pending

src/MetaMorpho.sol

@@ -268,10 +268,10 @@ contract MetaMorpho is ERC4626, ERC20Permit, Ownable2Step, Multicall, IMetaMorph
     /// @inheritdoc IMetaMorphoBase
     function submitCap(MarketParams memory marketParams, uint256 newSupplyCap) external onlyCuratorRole {
         Id id = marketParams.id();
-        uint256 supplyCap = config[id].cap;
         if (marketParams.loanToken != asset()) revert ErrorsLib.InconsistentAsset(id);
         if (MORPHO.lastUpdate(id) == 0) revert ErrorsLib.MarketNotCreated();
         if (pendingCap[id].validAt != 0) revert ErrorsLib.AlreadyPending();
+        uint256 supplyCap = config[id].cap;
         if (newSupplyCap == supplyCap) revert ErrorsLib.AlreadySet();
 
         if (newSupplyCap < supplyCap) {
@@ -286,10 +286,10 @@ contract MetaMorpho is ERC4626, ERC20Permit, Ownable2Step, Multicall, IMetaMorph
     /// @inheritdoc IMetaMorphoBase
     function submitMarketRemoval(Id id) external onlyCuratorRole {
         if (config[id].removableAt != 0) revert ErrorsLib.AlreadyPending();
+        if (pendingCap[id].validAt != 0) revert ErrorsLib.PendingCap();
+        if (config[id].cap != 0) revert ErrorsLib.NonZeroCap();
         if (!config[id].enabled) revert ErrorsLib.MarketNotEnabled();
 
-        _setCap(id, 0);
-
         // Safe "unchecked" cast because timelock <= MAX_TIMELOCK.
         config[id].removableAt = uint64(block.timestamp + timelock);
 

src/interfaces/IMetaMorpho.sol

@@ -74,8 +74,8 @@ interface IMetaMorphoBase {
     function lastTotalAssets() external view returns (uint256);
 
     /// @notice Submits a `newTimelock`.
+    /// @dev Warning: Reverts if a timelock is already pending. Revoke the pending timelock to overwrite it.
     /// @dev In case the new timelock is higher than the current one, the timelock is set immediately.
-    /// @dev Warning: Submitting a timelock will overwrite the current pending timelock.
     function submitTimelock(uint256 newTimelock) external;
 
     /// @notice Accepts the pending timelock.
@@ -85,8 +85,8 @@ interface IMetaMorphoBase {
     function revokePendingTimelock() external;
 
     /// @notice Submits a `newSupplyCap` for the market defined by `marketParams`.
+    /// @dev Warning: Reverts if a cap is already pending. Revoke the pending cap to overwrite it.
     /// @dev In case the new cap is lower than the current one, the cap is set immediately.
-    /// @dev Warning: Submitting a cap will overwrite the current pending cap.
     function submitCap(MarketParams memory marketParams, uint256 newSupplyCap) external;
 
     /// @notice Accepts the pending cap of the market defined by `id`.
@@ -96,7 +96,6 @@ interface IMetaMorphoBase {
     function revokePendingCap(Id id) external;
 
     /// @notice Submits a forced market removal from the vault, potentially losing all funds supplied to the market.
-    /// @dev Warning: Submitting a forced removal will overwrite the timestamp at which the market will be removable.
     function submitMarketRemoval(Id id) external;
 
     /// @notice Revokes the pending removal of the market defined by `id`.

src/libraries/ErrorsLib.sol

@@ -42,6 +42,12 @@ library ErrorsLib {
     /// @notice Thrown when a value is already pending.
     error AlreadyPending();
 
+    /// @notice Thrown when submitting a market removal for a market for which a cap is already pending.
+    error PendingCap();
+
+    /// @notice Thrown when submitting a market removal for a market with a non zero cap.abi
+    error NonZeroCap();
+
     /// @notice Thrown when market `id` is a duplicate in the new withdraw queue to set.
     error DuplicateMarket(Id id);
 

test/forge/MarketTest.sol

@@ -182,17 +182,35 @@ contract MarketTest is IntegrationTest {
     }
 
     function testSubmitMarketRemoval() public {
+        vm.startPrank(CURATOR);
+        vault.submitCap(allMarkets[2], 0);
         vm.expectEmit();
         emit EventsLib.SubmitMarketRemoval(CURATOR, allMarkets[2].id());
-        vm.prank(CURATOR);
         vault.submitMarketRemoval(allMarkets[2].id());
+        vm.stopPrank();
 
         assertEq(vault.config(allMarkets[2].id()).cap, 0);
         assertEq(vault.config(allMarkets[2].id()).removableAt, block.timestamp + TIMELOCK);
     }
 
-    function testSubmitMarketRemovalAlreadySet() public {
+    function testSubmitMarketRemovalPendingCap() public {
+        vm.startPrank(CURATOR);
+        vault.submitCap(allMarkets[2], vault.config(allMarkets[2].id()).cap + 1);
+        vm.expectRevert(ErrorsLib.PendingCap.selector);
+        vault.submitMarketRemoval(allMarkets[2].id());
+        vm.stopPrank();
+    }
+
+    function testSubmitMarketRemovalNonZeroCap() public {
+        vm.startPrank(CURATOR);
+        vm.expectRevert(ErrorsLib.NonZeroCap.selector);
+        vault.submitMarketRemoval(allMarkets[2].id());
+        vm.stopPrank();
+    }
+
+    function testSubmitMarketRemovalAlreadyPending() public {
         vm.startPrank(CURATOR);
+        vault.submitCap(allMarkets[2], 0);
         vault.submitMarketRemoval(allMarkets[2].id());
         vm.expectRevert(ErrorsLib.AlreadyPending.selector);
         vault.submitMarketRemoval(allMarkets[2].id());