fei-protocol · thomas-waite · May 20, 2022 · Apr 10, 2022 · Apr 10, 2022 · Apr 10, 2022
diff --git a/.circleci/config.yml b/.circleci/config.yml
@@ -1,75 +1,81 @@
 version: 2.1
-orbs:
-  discord: antonioned/[email protected]
 
-jobs:
-  build:
-    working_directory: ~/repo
+executors:
+  nodeimage:
     docker:
       - image: cimg/node:16.14
+    working_directory: ~/repo
     resource_class: xlarge
+
+jobs:
+  build:
+    executor: nodeimage
     steps:
-      - checkout 
-      - run:
-          name: 'Update NPM'
-          command: sudo npm install -g [email protected]
-      - run:
-          name: 'Set caching variables'
-          command: |
-            LAST_SUCCESSFUL_BUILD_URL="https://circleci.com/api/v1.1/project/github/$CIRCLE_PROJECT_USERNAME/$CIRCLE_PROJECT_REPONAME/tree/master?filter=successful&limit=1"
-            LAST_SUCCESSFUL_COMMIT=`curl -Ss -u "$CIRCLE_TOKEN:" $LAST_SUCCESSFUL_BUILD_URL | jq -r '.[0]["vcs_revision"]'`
-            echo $LAST_SUCCESSFUL_COMMIT > /tmp/last-successful-commit
-            echo $CIRCLE_SHA1 > /tmp/current-commit
-      - restore_cache:
-          keys:
-            - build-cache-{{ .Branch }}-{{ checksum "/tmp/last-successful-commit" }}
-      - run:
+      - checkout
+      - restore_cache: # This one restores node_modules, and .npm if the package-lock.json checksum is the same
+          key: package-cache-{{ checksum "package-lock.json" }}
+      - run: # we use npm install and not npm ci because npm ci removes node-modules entirely
           name: Install dependencies
           command: npm install
+      - save_cache: # Save the node_modules and .npm directories into the cache by the checksum of package-lock.json
+          key: package-cache-{{ checksum "package-lock.json" }}
+          paths:
+            - node_modules
+      - run: # generate a checksum of all of the source solidity files to see if they have changed, which we use as the key for caching
+          name: Generate solidity source checksum
+          command: ./sol-checksum.sh /tmp/sol-checksum.txt
+      - restore_cache: # Restore the solidity files cache the same way we do node_modules (by the checksum of the .json file)
+          key: solcache-{{ checksum "/tmp/sol-checksum.txt" }}
       - run:
           name: Compile contracts
           command: npm run compile:hardhat
-      - save_cache:
-          key: repo-{{ .Environment.CIRCLE_SHA1 }}
+      - run: # generate a checksum of all of the source solidity files to see if they have changed, which we use as the key for caching
+          name: Generate solidity source checksum (again)
+          command: ./sol-checksum.sh /tmp/sol-checksum.txt
+      - save_cache: # Save the solidity files cache, the compiled artifacts, and the generated types
+          key: solcache-{{ checksum "/tmp/sol-checksum.txt" }}
+          paths:
+            - artifacts
+            - types/contracts
+            - cache/solidity-files-cache.json
+      - restore_cache: # Restore the hardhat network fork cache if the hardhat-config hasn't changed
+          key: hardhat-config-{{ checksum "hardhat.config.ts" }}
+      - persist_to_workspace:
+          root: ~/repo
           paths:
-            - ~/repo
+            - ./
   lint:
     working_directory: ~/repo
-    docker:
-      - image: cimg/node:16.14
+    executor: nodeimage
     steps:
-      - restore_cache:
-          keys:
-            - repo-{{ .Environment.CIRCLE_SHA1 }}
+      - attach_workspace:
+          at: ./
       - run:
           name: Run linter
           command: npm run lint
   test:
     working_directory: ~/repo
-    docker:
-      - image: cimg/node:16.14
+    executor: nodeimage
     parallelism: 16
-    resource_class: large
     steps:
-      - restore_cache:
-          keys:
-            - repo-{{ .Environment.CIRCLE_SHA1 }}
+      - attach_workspace:
+          at: ./
       - run:
           name: Run tests
           command: |
             circleci tests glob "test/unit/**/*.ts" | circleci tests split --split-by=filesize > /tmp/tests-to-run
             npm run test:hardhat $(cat /tmp/tests-to-run)
       - store_test_results:
-            path: test-results
+          path: test-results
       - store_artifacts:
-            path: test-results
+          path: test-results
 
   test-forge:
     working_directory: ~/repo
-    docker:
-      - image: cimg/node:16.14
-    resource_class: xlarge
+    executor: nodeimage
     steps:
+      - attach_workspace:
+          at: ./
       - checkout
       - restore_cache:
           keys:
@@ -80,7 +86,7 @@ jobs:
       - run:
           name: Finish setting up env
           command: echo "export PATH=$PATH:$(pwd)/.foundry/bin" >> /home/circleci/.bashrc
-      - run: 
+      - run:
           name: Install Foundry
           command: curl -L https://foundry.paradigm.xyz | bash; source /home/circleci/.bashrc; $HOME/.foundry/bin/foundryup
       - run:
@@ -91,37 +97,54 @@ jobs:
 
   e2e-test:
     working_directory: ~/repo
-    docker:
-      - image: cimg/node:16.14
-    parallelism: 5
-    resource_class: xlarge
+    executor: nodeimage
+    parallelism: 20
     steps:
+      - attach_workspace:
+          at: ./
       - restore_cache:
-          keys:
-            - repo-{{ .Environment.CIRCLE_SHA1 }}
+          key: fork-cache-{{ checksum "hardhat.config.ts" }}
       - run:
           name: Run end-to-end tests
           command: |
-            circleci tests glob "test/integration/**/*.ts" | circleci tests split --split-by=filesize > /tmp/tests-to-run
+            circleci tests glob "test/integration/tests/*.ts" | circleci tests split --split-by=filesize > /tmp/tests-to-run
             npm run test:e2e $(cat /tmp/tests-to-run)
       - store_test_results:
-            path: test-results
+          path: test-results
       - store_artifacts:
-            path: test-results
+          path: test-results
+      - persist_to_workspace:
+          root: ~/repo
+          paths:
+            - ./cache/hardhat-network-fork
+
+  save-network-fork-cache:
+    working_directory: ~/repo
+    executor: nodeimage
+    steps:
+      - attach_workspace:
+          at: ./
+      - save_cache: # Save the solidity files cache, the compiled artifacts, and the generated types
+          key: fork-cache-{{ checksum "hardhat.config.ts" }}
+          paths:
+            - cache/hardhat-network-fork
 
 workflows:
   main:
     jobs:
       - build
-      - lint: 
+      - lint:
           requires:
             - build
       - test-forge:
           requires:
-            - build          
+            - build
       - test:
           requires:
             - build
       - e2e-test:
           requires:
             - build
+      - save-network-fork-cache:
+          requires:
+            - e2e-test
diff --git a/.gitignore b/.gitignore
@@ -12,4 +12,4 @@ cache
 types/contracts
 .eslintcache
 .xml
-out
+out
@@ -39,7 +39,7 @@ library TribeRoles {
     /// @notice capable of granting and revoking other TribeRoles from having veto power over a pod
     bytes32 internal constant POD_VETO_ADMIN = keccak256("POD_VETO_ADMIN");
 
-    /// @notice can manage the majority of Tribe protocol parameters. Sets boundaries for MINOR_PARAM_ROLE.
+    /// @notice can manage the majority of Tribe protocol parameters
     bytes32 internal constant PARAMETER_ADMIN = keccak256("PARAMETER_ADMIN");
 
     /// @notice manages the Collateralization Oracle as well as other protocol oracles.
@@ -48,23 +48,23 @@ library TribeRoles {
     /// @notice manages TribalChief incentives and related functionality.
     bytes32 internal constant TRIBAL_CHIEF_ADMIN = keccak256("TRIBAL_CHIEF_ADMIN_ROLE");
 
+    /// @notice admin of the Tokemak PCV deposits
+    bytes32 internal constant TOKEMAK_DEPOSIT_ADMIN_ROLE = keccak256("TOKEMAK_DEPOSIT_ADMIN_ROLE");
+
     /// @notice admin of PCVGuardian
     bytes32 internal constant PCV_GUARDIAN_ADMIN = keccak256("PCV_GUARDIAN_ADMIN_ROLE");
 
-    /// @notice admin of all Minor Roles
-    bytes32 internal constant MINOR_ROLE_ADMIN = keccak256("MINOR_ROLE_ADMIN");
-
     /// @notice admin of the Fuse protocol
     bytes32 internal constant FUSE_ADMIN = keccak256("FUSE_ADMIN");
 
-    /// @notice capable of vetoing DAO votes or optimistic timelocks
-    bytes32 internal constant VETO_ADMIN = keccak256("VETO_ADMIN");
+    /// @notice admin of minting Fei for specific scoped contracts
+    bytes32 internal constant FEI_MINT_ADMIN = keccak256("FEI_MINT_ADMIN");
 
-    /// @notice capable of setting FEI Minters within global rate limits and caps
-    bytes32 internal constant MINTER_ADMIN = keccak256("MINTER_ADMIN");
+    /// @notice capable of admin functionality on PCVDeposits
+    bytes32 internal constant PCV_MINOR_PARAM_ROLE = keccak256("PCV_MINOR_PARAM_ROLE");
 
-    /// @notice manages the constituents of Optimistic Timelocks, including Proposers and Executors
-    bytes32 internal constant OPTIMISTIC_ADMIN = keccak256("OPTIMISTIC_ADMIN");
+    /// @notice capable of setting FEI Minters within global rate limits and caps
+    bytes32 internal constant RATE_LIMITED_MINTER_ADMIN = keccak256("RATE_LIMITED_MINTER_ADMIN");
 
     /// @notice manages meta-governance actions, like voting & delegating.
     /// Also used to vote for gauge weights & similar liquid governance things.
@@ -78,23 +78,26 @@ library TribeRoles {
     /// @notice manages whitelisting of gauges where the protocol's tokens can be staked
     bytes32 internal constant METAGOVERNANCE_GAUGE_ADMIN = keccak256("METAGOVERNANCE_GAUGE_ADMIN");
 
+    /// @notice capable of performing swaps on Balancer LBP Swapper
+    bytes32 internal constant SWAP_ADMIN_ROLE = keccak256("SWAP_ADMIN_ROLE");
+
+    /// @notice capable of setting properties on Balancer BasePool utility wrapper
+    bytes32 internal constant BALANCER_MANAGER_ADMIN_ROLE = keccak256("BALANCER_MANAGER_ADMIN_ROLE");
+
     /*///////////////////////////////////////////////////////////////
                                  Minor Roles
     //////////////////////////////////////////////////////////////*/
     bytes32 internal constant POD_METADATA_REGISTER_ROLE = keccak256("POD_METADATA_REGISTER_ROLE");
 
-    /// @notice capable of poking existing LBP auctions to exchange tokens.
-    bytes32 internal constant LBP_SWAP_ROLE = keccak256("SWAP_ADMIN_ROLE");
-
     /// @notice capable of engaging with Votium for voting incentives.
     bytes32 internal constant VOTIUM_ROLE = keccak256("VOTIUM_ADMIN_ROLE");
 
     /// @notice capable of adding an address to multi rate limited
     bytes32 internal constant ADD_MINTER_ROLE = keccak256("ADD_MINTER_ROLE");
 
-    /// @notice capable of changing parameters within non-critical ranges
-    bytes32 internal constant MINOR_PARAM_ROLE = keccak256("MINOR_PARAM_ROLE");
-
     /// @notice capable of changing PCV Deposit and Global Rate Limited Minter in the PSM
     bytes32 internal constant PSM_ADMIN_ROLE = keccak256("PSM_ADMIN_ROLE");
+
+    /// @notice capable of moving PCV between safe addresses on the PCVGuardian
+    bytes32 internal constant PCV_SAFE_MOVER_ROLE = keccak256("PCV_SAFE_MOVER_ROLE");
 }
@@ -6,6 +6,7 @@ import "../refs/CoreRef.sol";
 import "./IPCVGuardian.sol";
 import "./IPCVDeposit.sol";
 import "../libs/CoreRefPauseableLib.sol";
+import {TribeRoles} from "../core/TribeRoles.sol";
 
 contract PCVGuardian is IPCVGuardian, CoreRef {
     using CoreRefPauseableLib for address;
@@ -15,8 +16,6 @@ contract PCVGuardian is IPCVGuardian, CoreRef {
     EnumerableSet.AddressSet private safeAddresses;
 
     constructor(address _core, address[] memory _safeAddresses) CoreRef(_core) {
-        _setContractAdminRole(keccak256("PCV_GUARDIAN_ADMIN_ROLE"));
-
         for (uint256 i = 0; i < _safeAddresses.length; i++) {
             _setSafeAddress(_safeAddresses[i]);
         }
@@ -35,34 +34,50 @@ contract PCVGuardian is IPCVGuardian, CoreRef {
         return safeAddresses.values();
     }
 
-    // ---------- Governor-or-Admin-Only State-Changing API ----------
+    // ---------- GOVERNOR-or-PCV_GUARDIAN_ADMIN-Only State-Changing API ----------
 
     /// @notice governor-only method to set an address as "safe" to withdraw funds to
     /// @param pcvDeposit the address to set as safe
-    function setSafeAddress(address pcvDeposit) external override onlyGovernorOrAdmin {
+    function setSafeAddress(address pcvDeposit)
+        external
+        override
+        hasAnyOfTwoRoles(TribeRoles.GOVERNOR, TribeRoles.PCV_GUARDIAN_ADMIN)
+    {
         _setSafeAddress(pcvDeposit);
     }
 
     /// @notice batch version of setSafeAddress
     /// @param _safeAddresses the addresses to set as safe, as calldata
-    function setSafeAddresses(address[] calldata _safeAddresses) external override onlyGovernorOrAdmin {
+    function setSafeAddresses(address[] calldata _safeAddresses)
+        external
+        override
+        hasAnyOfTwoRoles(TribeRoles.GOVERNOR, TribeRoles.PCV_GUARDIAN_ADMIN)
+    {
         require(_safeAddresses.length != 0, "empty");
         for (uint256 i = 0; i < _safeAddresses.length; i++) {
             _setSafeAddress(_safeAddresses[i]);
         }
     }
 
-    // ---------- Governor-or-Admin-Or-Guardian-Only State-Changing API ----------
+    // ---------- GOVERNOR-or-PCV_GUARDIAN_ADMIN-Or-GUARDIAN-Only State-Changing API ----------
 
     /// @notice governor-or-guardian-only method to un-set an address as "safe" to withdraw funds to
     /// @param pcvDeposit the address to un-set as safe
-    function unsetSafeAddress(address pcvDeposit) external override isGovernorOrGuardianOrAdmin {
+    function unsetSafeAddress(address pcvDeposit)
+        external
+        override
+        hasAnyOfThreeRoles(TribeRoles.GOVERNOR, TribeRoles.GUARDIAN, TribeRoles.PCV_GUARDIAN_ADMIN)
+    {
         _unsetSafeAddress(pcvDeposit);
     }
 
     /// @notice batch version of unsetSafeAddresses
     /// @param _safeAddresses the addresses to un-set as safe
-    function unsetSafeAddresses(address[] calldata _safeAddresses) external override isGovernorOrGuardianOrAdmin {
+    function unsetSafeAddresses(address[] calldata _safeAddresses)
+        external
+        override
+        hasAnyOfThreeRoles(TribeRoles.GOVERNOR, TribeRoles.GUARDIAN, TribeRoles.PCV_GUARDIAN_ADMIN)
+    {
         require(_safeAddresses.length != 0, "empty");
         for (uint256 i = 0; i < _safeAddresses.length; i++) {
             _unsetSafeAddress(_safeAddresses[i]);
@@ -81,7 +96,7 @@ contract PCVGuardian is IPCVGuardian, CoreRef {
         uint256 amount,
         bool pauseAfter,
         bool depositAfter
-    ) external override isGovernorOrGuardianOrAdmin {
+    ) external override hasAnyOfThreeRoles(TribeRoles.GOVERNOR, TribeRoles.PCV_SAFE_MOVER_ROLE, TribeRoles.GUARDIAN) {
         require(isSafeAddress(safeAddress), "Provided address is not a safe address!");
 
         pcvDeposit._ensureUnpaused();
@@ -111,7 +126,7 @@ contract PCVGuardian is IPCVGuardian, CoreRef {
         uint256 amount,
         bool pauseAfter,
         bool depositAfter
-    ) external override isGovernorOrGuardianOrAdmin {
+    ) external override hasAnyOfThreeRoles(TribeRoles.GOVERNOR, TribeRoles.PCV_SAFE_MOVER_ROLE, TribeRoles.GUARDIAN) {
         require(isSafeAddress(safeAddress), "Provided address is not a safe address!");
 
         pcvDeposit._ensureUnpaused();
@@ -142,7 +157,7 @@ contract PCVGuardian is IPCVGuardian, CoreRef {
         uint256 amount,
         bool pauseAfter,
         bool depositAfter
-    ) external override isGovernorOrGuardianOrAdmin {
+    ) external override hasAnyOfThreeRoles(TribeRoles.GOVERNOR, TribeRoles.PCV_SAFE_MOVER_ROLE, TribeRoles.GUARDIAN) {
         require(isSafeAddress(safeAddress), "Provided address is not a safe address!");
 
         pcvDeposit._ensureUnpaused();

diff --git a/hardhat.config.ts b/hardhat.config.ts
@@ -57,7 +57,7 @@ export default {
       forking: enableMainnetForking
         ? {
             url: `https://eth-mainnet.alchemyapi.io/v2/${mainnetAlchemyApiKey}`,
-            blockNumber: 14723389 // Friday, May 6th
+            blockNumber: 14807700 // Thursday, May 19th
           }
         : undefined
     },
-Original file line number
+Diff line change
@@ Expand Up / @@ -12,4 +12,4 @@ cache @@
     types/contracts
     .eslintcache
     .xml
-    out
+    out