Savings donation-attack guard, audits, and multi-chain upgrade deployment

.github/workflows/ci.yml

@@ -39,6 +39,8 @@ jobs:
 
       - name: Install Foundry
         uses: foundry-rs/foundry-toolchain@v1
+        with:
+          version: v1.5.1
 
       - name: Compile foundry
         run: forge build --sizes
@@ -70,6 +72,8 @@ jobs:
 
       - name: Install Foundry
         uses: foundry-rs/foundry-toolchain@v1
+        with:
+          version: v1.5.1
 
       - uses: actions/cache/restore@v4
         with:
@@ -96,6 +100,8 @@ jobs:
 
       - name: Install Foundry
         uses: foundry-rs/foundry-toolchain@v1
+        with:
+          version: v1.5.1
 
       - uses: actions/cache/restore@v4
         with:

contracts/interfaces/IGetters.sol

@@ -142,6 +142,10 @@ interface IGetters {
   /// @dev Maximum slippage tolerance is 1e9 (100%)
   function getSlippageTolerance(address collateral) external view returns (uint256);
 
+  /// @notice Returns the minimum collateral ratio that must hold after surplus processing
+  /// @dev Expressed in base 1e9, and always >= 1e9
+  function getSurplusBufferRatio() external view returns (uint64);
+
   /// @notice Computes the surplus of a collateral.
   /// @param collateral The collateral address to compute the surplus of.
   /// @return collateralSurplus The collateral surplus amount.

contracts/interfaces/IRedeemer.sol

@@ -34,6 +34,22 @@ interface IRedeemer {
     external
     returns (address[] memory tokens, uint256[] memory amounts);
 
+  /// @notice Same as `redeemWithForfeit` but using a single EIP-3009 authorization for the tokenP
+  /// transfer.
+  /// @dev The signed EIP-3009 nonce MUST equal `LibAuthorization.computeRedeemNonce(...)` so that
+  /// mutating `receiver`, `amount`, `deadline`, `minAmountOuts` or `forfeitTokens` invalidates the
+  /// signature. `authData.nonce` carries the caller-chosen `userSalt`.
+  function redeemWithAuthorization(
+    uint256 amount,
+    address receiver,
+    uint256 deadline,
+    uint256[] memory minAmountOuts,
+    address[] memory forfeitTokens,
+    bytes memory authData
+  )
+    external
+    returns (address[] memory tokens, uint256[] memory amounts);
+
   /// @notice Simulate the exact output that a redemption of `amount` of stablecoins would give at a given block
   /// @return tokens List of tokens that would be given
   /// @return amounts Amount that would be obtained for each token in the `tokens` array

contracts/interfaces/ISavings.sol

@@ -0,0 +1,80 @@
+// SPDX-License-Identifier: GPL-3.0
+pragma solidity 0.8.28;
+
+import { IEIP3009 } from "./external/IEIP3009.sol";
+
+/// @title ISavings
+/// @author Cooper Labs
+/// @custom:contact security@cooperlabs.xyz
+interface ISavings is IEIP3009 {
+  /// @notice Deposit the underlying asset on behalf of `owner` and mint shares to `receiver`.
+  /// @param savingsSignature Signature over `DEPOSIT_WITH_AUTHORIZATION_TYPEHASH` against the
+  /// Savings contract's EIP-712 domain, binding `receiver` to prevent relayer front-running.
+  /// @param tokenSignature Standard EIP-3009 `ReceiveWithAuthorization` signature against the
+  /// underlying asset's EIP-712 domain, authorizing the transfer of `assets` into this contract.
+  function depositWithAuthorization(
+    uint256 assets,
+    address receiver,
+    address owner,
+    uint256 validAfter,
+    uint256 validBefore,
+    bytes32 nonce,
+    bytes calldata savingsSignature,
+    bytes calldata tokenSignature
+  )
+    external
+    returns (uint256 shares);
+
+  /// @notice Burn `shares` from `owner` and send the underlying asset to `receiver`.
+  /// @dev Signature is over `REDEEM_WITH_AUTHORIZATION_TYPEHASH` against the Savings contract's
+  /// EIP-712 domain and binds `receiver` to prevent relayer front-running.
+  function redeemWithAuthorization(
+    uint256 shares,
+    address receiver,
+    address owner,
+    uint256 validAfter,
+    uint256 validBefore,
+    bytes32 nonce,
+    uint8 v,
+    bytes32 r,
+    bytes32 s
+  )
+    external
+    returns (uint256 assets);
+
+  /// @notice EIP-1271 compatible variant of `redeemWithAuthorization`.
+  function redeemWithAuthorization(
+    uint256 shares,
+    address receiver,
+    address owner,
+    uint256 validAfter,
+    uint256 validBefore,
+    bytes32 nonce,
+    bytes calldata signature
+  )
+    external
+    returns (uint256 assets);
+
+  function cancelAuthorization(address authorizer, bytes32 nonce, uint8 v, bytes32 r, bytes32 s) external;
+
+  function authorizationState(address authorizer, bytes32 nonce) external view returns (bool);
+
+  // solhint-disable-next-line func-name-mixedcase
+  function DOMAIN_SEPARATOR() external view returns (bytes32);
+
+  function estimatedAPY() external view returns (uint256 apy);
+
+  function computeUpdatedAssets(uint256 totalAssets, uint256 exp) external view returns (uint256);
+
+  function pause() external;
+
+  function unpause() external;
+
+  function toggleTrusted(address trustedAddress) external;
+
+  function setRate(uint208 newRate) external;
+
+  function setMaxRate(uint256 newMaxRate) external;
+
+  function recoverSurplus(address to) external returns (uint256 surplus);
+}

contracts/interfaces/ISetters.sol

@@ -78,8 +78,13 @@ interface ISettersGovernor {
 /// @author Cooper Labs
 /// @custom:contact security@cooperlabs.xyz
 interface ISettersGuardian {
-  /// @notice Changes the pause status for mint or burn transactions for `collateral`
-  function togglePause(address collateral, ActionType action) external;
+  /// @notice Pauses `action` for `collateral` (or pauses redemption protocol-wide when
+  /// `action == Redeem`). Reverts if the action is already paused.
+  function pause(address collateral, ActionType action) external;
+
+  /// @notice Unpauses `action` for `collateral` (or unpauses redemption protocol-wide when
+  /// `action == Redeem`). Reverts if the action is not paused.
+  function unpause(address collateral, ActionType action) external;
 
   /// @notice Sets the mint or burn fees for `collateral`
   function setFees(address collateral, uint64[] memory xFee, int64[] memory yFee, bool mint) external;

contracts/interfaces/ISwapper.sol

@@ -72,6 +72,41 @@ interface ISwapper {
     external
     returns (uint256 amountIn);
 
+  /// @notice Same as `swapExactInput`, but using a single EIP-3009 authorization for `tokenIn`.
+  /// @dev The signed EIP-3009 nonce MUST equal `LibAuthorization.computeSwapExactInputNonce(...)`,
+  /// which binds the full swap intent. `authData.nonce` carries the caller-chosen `userSalt`; the
+  /// facet recomputes the derived nonce from the call arguments before forwarding it to the
+  /// token, so any tampering with `to`/slippage/deadline invalidates the signature.
+  /// @param authData ABI-encoded `AuthorizationParams` with `nonce = userSalt`
+  function swapExactInputWithAuthorization(
+    uint256 amountIn,
+    uint256 amountOutMin,
+    address tokenIn,
+    address tokenOut,
+    address to,
+    uint256 deadline,
+    bytes calldata authData
+  )
+    external
+    returns (uint256 amountOut);
+
+  /// @notice Same as `swapExactOutput`, but using a single EIP-3009 authorization for `tokenIn`.
+  /// @dev The authorization must be signed for `amountInMax`; the excess is refunded to the
+  /// authorizer. Derived-nonce scheme as in `swapExactInputWithAuthorization`, using
+  /// `LibAuthorization.computeSwapExactOutputNonce(...)`.
+  /// @param authData ABI-encoded `AuthorizationParams` with `nonce = userSalt`
+  function swapExactOutputWithAuthorization(
+    uint256 amountOut,
+    uint256 amountInMax,
+    address tokenIn,
+    address tokenOut,
+    address to,
+    uint256 deadline,
+    bytes calldata authData
+  )
+    external
+    returns (uint256 amountIn);
+
   /// @notice Simulates what a call to `swapExactInput` with `amountIn` of `tokenIn` for `tokenOut` would give.
   /// If called right before and at the same block, the `amountOut` outputted by this function is exactly the
   /// amount that will be obtained with `swapExactInput`

contracts/interfaces/external/IEIP3009.sol

@@ -0,0 +1,123 @@
+// SPDX-License-Identifier: MIT
+pragma solidity 0.8.28;
+
+/// @title IEIP3009
+/// @notice Interface for EIP-3009: Transfer With Authorization
+interface IEIP3009 {
+  /// @notice Execute a transfer with a signed authorization (EOA signature)
+  /// @dev SECURITY: anyone may submit this call (no `msg.sender` restriction). Integrators that
+  /// pair the transfer with downstream logic (e.g. swap, deposit, redeem) MUST use
+  /// `receiveWithAuthorization` instead: a mempool watcher can otherwise frontrun the original
+  /// transaction with a raw `transferWithAuthorization`, burning the nonce so the original
+  /// reverts while the funds still move - causing the post-transfer logic to be skipped.
+  /// Use this primitive only for direct payouts to a passive recipient (`msg.sender != to`).
+  /// @param from The address of the sender
+  /// @param to The address of the recipient
+  /// @param value The amount of tokens to transfer
+  /// @param validAfter The timestamp after which the authorization is valid
+  /// @param validBefore The timestamp before which the authorization is valid
+  /// @param nonce The nonce of the authorization
+  /// @param v The recovery id of the signature
+  /// @param r The r value of the signature
+  /// @param s The s value of the signature
+  function transferWithAuthorization(
+    address from,
+    address to,
+    uint256 value,
+    uint256 validAfter,
+    uint256 validBefore,
+    bytes32 nonce,
+    uint8 v,
+    bytes32 r,
+    bytes32 s
+  )
+    external;
+
+  /// @notice Execute a transfer with a signed authorization (EIP-1271 compatible)
+  /// @dev SECURITY: see the EOA overload - this primitive is frontrun-prone and must not be used
+  /// when the transfer is bound to follow-on logic. Use `receiveWithAuthorization` in that case.
+  /// @param from The payer's address (Authorizer)
+  /// @param to The payee's address
+  /// @param value The amount to be transferred
+  /// @param validAfter The time after which this is valid (unix time)
+  /// @param validBefore The time before which this is valid (unix time)
+  /// @param nonce The nonce
+  /// @param signature The signature bytes signed by an EOA wallet or a contract wallet
+  function transferWithAuthorization(
+    address from,
+    address to,
+    uint256 value,
+    uint256 validAfter,
+    uint256 validBefore,
+    bytes32 nonce,
+    bytes calldata signature
+  )
+    external;
+
+  /// @notice Receive a transfer with a signed authorization (EOA signature)
+  /// @dev The caller must be the payee (`to` address). This has an additional check to ensure
+  /// that the payee's address matches the caller of this function to prevent front-running attacks.
+  /// @param from The payer's address (Authorizer)
+  /// @param to The payee's address
+  /// @param value The amount to be transferred
+  /// @param validAfter The time after which this is valid (unix time)
+  /// @param validBefore The time before which this is valid (unix time)
+  /// @param nonce The nonce
+  /// @param v The recovery id of the signature
+  /// @param r The r value of the signature
+  /// @param s The s value of the signature
+  function receiveWithAuthorization(
+    address from,
+    address to,
+    uint256 value,
+    uint256 validAfter,
+    uint256 validBefore,
+    bytes32 nonce,
+    uint8 v,
+    bytes32 r,
+    bytes32 s
+  )
+    external;
+
+  /// @notice Receive a transfer with a signed authorization (EIP-1271 compatible)
+  /// @dev The caller must be the payee (`to` address)
+  /// @param from The payer's address (Authorizer)
+  /// @param to The payee's address
+  /// @param value The amount to be transferred
+  /// @param validAfter The time after which this is valid (unix time)
+  /// @param validBefore The time before which this is valid (unix time)
+  /// @param nonce The nonce
+  /// @param signature The signature bytes signed by an EOA wallet or a contract wallet
+  function receiveWithAuthorization(
+    address from,
+    address to,
+    uint256 value,
+    uint256 validAfter,
+    uint256 validBefore,
+    bytes32 nonce,
+    bytes calldata signature
+  )
+    external;
+
+  /// @notice Attempt to cancel an authorization
+  /// @dev Works only if the authorization is not yet used.
+  /// EOA wallet signatures should be packed in the order of r, s, v.
+  /// @param authorizer Authorizer's address
+  /// @param nonce Nonce of the authorization
+  /// @param v The recovery id of the signature
+  /// @param r The r value of the signature
+  /// @param s The s value of the signature
+  function cancelAuthorization(address authorizer, bytes32 nonce, uint8 v, bytes32 r, bytes32 s) external;
+
+  /// @notice Cancel an authorization (EIP-1271 compatible)
+  /// @param authorizer Authorizer's address
+  /// @param nonce Nonce of the authorization
+  /// @param signature The signature bytes signed by an EOA wallet or a contract wallet
+  function cancelAuthorization(address authorizer, bytes32 nonce, bytes calldata signature) external;
+
+  /// @notice Returns the state of an authorization
+  /// @param authorizer Authorizer's address
+  /// @param nonce Nonce of the authorization
+  /// @return true if the nonce is used
+  function authorizationState(address authorizer, bytes32 nonce) external view returns (bool);
+}

contracts/parallelizer/Storage.sol

@@ -69,6 +69,15 @@ struct Permit2Details {
   bytes signature; // Permit signature of the user
 }
 
+struct AuthorizationParams {
+  address from; // Payer's address (Authorizer)
+  uint256 value; // Amount authorized to be transferred
+  uint256 validAfter; // The time after which this is valid (unix time)
+  uint256 validBefore; // The time before which this is valid (unix time)
+  bytes32 nonce; // Unique nonce
+  bytes signature; // EOA (r,s,v packed) or arbitrary-length EIP-1271 contract signature
+}
+
 struct FacetCut {
   address facetAddress; // Facet contract address
   FacetCutAction action; // Can be add, remove or replace

contracts/parallelizer/configs/DiamondInitializer.sol

@@ -30,15 +30,15 @@ contract DiamondInitializer {
       LibSetters.setFees(collateral.token, collateral.xMintFee, collateral.yMintFee, true);
       // Burn fees
       LibSetters.setFees(collateral.token, collateral.xBurnFee, collateral.yBurnFee, false);
-      LibSetters.togglePause(collateral.token, ActionType.Mint);
-      LibSetters.togglePause(collateral.token, ActionType.Burn);
+      LibSetters.unpause(collateral.token, ActionType.Mint);
+      LibSetters.unpause(collateral.token, ActionType.Burn);
       LibSetters.setStablecoinCap(collateral.token, 100_000_000 ether);
       if (collateral.targetMax) LibOracle.updateOracle(collateral.token);
     }
 
     // setRedemptionCurveParams
     if (_redemptionSetup.xRedeemFee.length > 0) {
-      LibSetters.togglePause(address(0), ActionType.Redeem);
+      LibSetters.unpause(address(0), ActionType.Redeem);
       LibSetters.setRedemptionCurveParams(_redemptionSetup.xRedeemFee, _redemptionSetup.yRedeemFee);
     }
   }