WIP Strat/morpho

.github/workflows/olympix.yml

@@ -0,0 +1,13 @@
+name: Integrated Security Workflow
+on: push
+jobs:
+  security:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - name: Olympix Integrated Security
+        uses: olympix/integrated-security@main
+        env:
+          OLYMPIX_API_TOKEN: ${{ secrets.OLYMPIX_API_TOKEN }}
+        with:
+          args: -f json --no-uninitialized-state-variable --no-default-visibility --no-missing-revert-reason-tests

.gitmodules

@@ -10,3 +10,27 @@
 [submodule "lib/chimera"]
 	path = lib/chimera
 	url = https://github.com/recon-fuzz/chimera
+[submodule "lib/v4-core"]
+	path = lib/v4-core
+	url = https://github.com/uniswap/v4-core
+[submodule "lib/v4-periphery"]
+	path = lib/v4-periphery
+	url = https://github.com/uniswap/v4-periphery
+[submodule "lib/permit2"]
+	path = lib/permit2
+	url = https://github.com/uniswap/permit2
+[submodule "lib/universal-router"]
+	path = lib/universal-router
+	url = https://github.com/uniswap/universal-router
+[submodule "lib/v3-core"]
+	path = lib/v3-core
+	url = https://github.com/uniswap/v3-core
+[submodule "lib/v2-core"]
+	path = lib/v2-core
+	url = https://github.com/uniswap/v2-core
+[submodule "lib/openzeppelin-contracts"]
+	path = lib/openzeppelin-contracts
+	url = https://github.com/OpenZeppelin/openzeppelin-contracts
+[submodule "lib/morpho-blue"]
+	path = lib/morpho-blue
+	url = https://github.com/morpho-org/morpho-blue

.olympix-ignore.json

@@ -0,0 +1,18 @@
+{
+    "IgnoredVulnerabilities" : {
+        "missing-revert-reason-tests" : {
+            "contracts" : []
+        },
+        "reentrancy" : {
+            "contracts/tranches/Accounting.sol" : [330, 393],
+            "contracts/tranches/StrataCDO.sol" : [392],
+            "contracts/tranches/base/cooldown/UnstakeCooldown.sol": [113]
+        }
+    },
+    "IgnoredPaths": [
+        "contracts/test",
+        "contracts/oz",
+        "contracts/lens",
+        "test/PoC"
+    ]
+}

.vscode/settings.json

@@ -1,76 +1,78 @@
 {
-    "recon.foundryConfigPath": "foundry.toml",
-    "recon.defaultFuzzer": "medusa",
-    "security.olympix.detectors.arbitraryAddressSpoofingAttack": true,
-    "security.olympix.detectors.arbitraryTransferFrom": true,
-    "security.olympix.detectors.noAccessControlPayableFallback": true,
-    "security.olympix.detectors.ownerSinglePointOfFailure": true,
-    "security.olympix.detectors.anyTxOrigin": true,
-    "security.olympix.detectors.faultyDiv": true,
-    "security.olympix.detectors.enumConversionOutOfRange": true,
-    "security.olympix.detectors.uintToIntConversion": true,
-    "security.olympix.detectors.downcastOfNumberToAddress": true,
-    "security.olympix.detectors.unsafeDowncast": true,
-    "security.olympix.detectors.swappedShiftParams": true,
-    "security.olympix.detectors.unaryPlusExpression": true,
-    "security.olympix.detectors.uncheckedBlockWithSubtraction": true,
-    "security.olympix.detectors.assemblyReturnInsteadOfLeave": true,
-    "security.olympix.detectors.callsAssemblyReturn": true,
-    "security.olympix.detectors.delegateCallInLoop": true,
-    "security.olympix.detectors.emptyPayableFallback": true,
-    "security.olympix.detectors.lowLevelCallParamsVerified": true,
-    "security.olympix.detectors.improperDiamondPattern": true,
-    "security.olympix.detectors.missingGapVariable": true,
-    "security.olympix.detectors.unenforcedStateMaintenanceKeywords": true,
-    "security.olympix.detectors.unboundedPragma": true,
-    "security.olympix.detectors.directionalOverrideCharacter": true,
-    "security.olympix.detectors.abiEncodePackedDynamicTypes": true,
-    "security.olympix.detectors.callsInLoop": true,
-    "security.olympix.detectors.callWithoutGasBudget": true,
-    "security.olympix.detectors.msgValueReuse": true,
-    "security.olympix.detectors.abiEncoderArray": true,
-    "security.olympix.detectors.blockRandomness": true,
-    "security.olympix.project.includePath": "/contracts",
-    "security.olympix.project.testsPath": "/test",
-    "security.olympix.project.opixTestDir": "/test/auto",
-    "security.olympix.detectors.arbitraryDelegatecall": true,
-    "security.olympix.detectors.increasingLengthArrayAsLoopVariable": true,
-    "security.olympix.detectors.noParameterValidationInConstructor": true,
-    "security.olympix.detectors.reentrancy": true,
-    "security.olympix.detectors.reentrancyEvents": true,
-    "security.olympix.detectors.uncheckedLowLevel": true,
-    "security.olympix.detectors.uncheckedSend": true,
-    "security.olympix.detectors.uncheckedTokenTransfer": true,
-    "security.olympix.detectors.unsafeSelfDestruct": true,
-    "security.olympix.detectors.unusedReturnFunctionCall": true,
-    "security.olympix.detectors.signatureReplayAttacks": true,
-    "security.olympix.detectors.arrayLengthAssignment": true,
-    "security.olympix.detectors.arrayParameterLocation": true,
-    "security.olympix.detectors.nestedStructInMapping": true,
-    "security.olympix.detectors.insufficientParameterAssertion": true,
-    "security.olympix.detectors.uninitializedFunctionPointerConstructor": true,
-    "security.olympix.detectors.uninitializedLocalStorage": true,
-    "security.olympix.detectors.uninitializedStateVariable": true,
-    "security.olympix.detectors.structWithMappingDeletion": true,
-    "security.olympix.detectors.signedIntegerArray": true,
-    "security.olympix.detectors.erc20Interface": true,
-    "security.olympix.detectors.erc721Interface": true,
-    "security.olympix.detectors.functionSelectorClash": true,
-    "security.olympix.detectors.defaultVisibility": true,
-    "security.olympix.detectors.missingRevertReasonTests": true,
-    "security.olympix.detectors.multipleConstructors": true,
-    "security.olympix.detectors.sameNamedContracts": true,
-    "security.olympix.detectors.shadowingBuiltin": true,
-    "security.olympix.detectors.shadowingReservedKeyword": true,
-    "security.olympix.detectors.shadowingState": true,
-    "security.olympix.detectors.arbitrarySendEther": true,
-    "security.olympix.detectors.etherBalanceCheckStrictEquality": true,
-    "security.olympix.detectors.eventsPriceChange": true,
-    "security.olympix.detectors.externalCallPotentialOutOfGas": true,
-    "security.olympix.detectors.expectsOptionalErc20Functionality": true,
-    "security.olympix.detectors.lockedEther": true,
-    "security.olympix.detectors.possibleDivisionByZero": true,
-    "security.olympix.detectors.zeroAsParameter": true,
-    "security.olympix.detectors.oracleManipulation": true,
-    "security.olympix.project.useAiToPruneFindings": true
+  // "files.exclude": {
+  //   "**/lib": true
+  // },
+  "security.olympix.detectors.arbitraryAddressSpoofingAttack": true,
+  "security.olympix.detectors.arbitraryTransferFrom": true,
+  "security.olympix.detectors.noAccessControlPayableFallback": true,
+  "security.olympix.detectors.ownerSinglePointOfFailure": true,
+  "security.olympix.detectors.anyTxOrigin": true,
+  "security.olympix.detectors.faultyDiv": true,
+  "security.olympix.detectors.enumConversionOutOfRange": true,
+  "security.olympix.detectors.uintToIntConversion": true,
+  "security.olympix.detectors.downcastOfNumberToAddress": true,
+  "security.olympix.detectors.unsafeDowncast": true,
+  "security.olympix.detectors.swappedShiftParams": true,
+  "security.olympix.detectors.unaryPlusExpression": true,
+  "security.olympix.detectors.uncheckedBlockWithSubtraction": true,
+  "security.olympix.detectors.assemblyReturnInsteadOfLeave": true,
+  "security.olympix.detectors.callsAssemblyReturn": true,
+  "security.olympix.detectors.delegateCallInLoop": true,
+  "security.olympix.detectors.emptyPayableFallback": true,
+  "security.olympix.detectors.lowLevelCallParamsVerified": true,
+  "security.olympix.detectors.improperDiamondPattern": true,
+  "security.olympix.detectors.missingGapVariable": true,
+  "security.olympix.detectors.unenforcedStateMaintenanceKeywords": true,
+  "security.olympix.detectors.unboundedPragma": true,
+  "security.olympix.detectors.directionalOverrideCharacter": true,
+  "security.olympix.detectors.abiEncodePackedDynamicTypes": true,
+  "security.olympix.detectors.callsInLoop": true,
+  "security.olympix.detectors.callWithoutGasBudget": true,
+  "security.olympix.detectors.msgValueReuse": true,
+  "security.olympix.detectors.abiEncoderArray": true,
+  "security.olympix.detectors.blockRandomness": true,
+  "security.olympix.project.includePath": "/contracts",
+  "security.olympix.project.testsPath": "/test",
+  "security.olympix.project.opixTestDir": "/test/auto",
+  "security.olympix.detectors.arbitraryDelegatecall": true,
+  "security.olympix.detectors.increasingLengthArrayAsLoopVariable": true,
+  "security.olympix.detectors.noParameterValidationInConstructor": true,
+  "security.olympix.detectors.reentrancy": true,
+  "security.olympix.detectors.reentrancyEvents": true,
+  "security.olympix.detectors.uncheckedLowLevel": true,
+  "security.olympix.detectors.uncheckedSend": true,
+  "security.olympix.detectors.uncheckedTokenTransfer": true,
+  "security.olympix.detectors.unsafeSelfDestruct": true,
+  "security.olympix.detectors.unusedReturnFunctionCall": true,
+  "security.olympix.detectors.signatureReplayAttacks": true,
+  "security.olympix.detectors.arrayLengthAssignment": true,
+  "security.olympix.detectors.arrayParameterLocation": true,
+  "security.olympix.detectors.nestedStructInMapping": true,
+  "security.olympix.detectors.insufficientParameterAssertion": true,
+  "security.olympix.detectors.uninitializedFunctionPointerConstructor": true,
+  "security.olympix.detectors.uninitializedLocalStorage": true,
+  "security.olympix.detectors.uninitializedStateVariable": true,
+  "security.olympix.detectors.structWithMappingDeletion": true,
+  "security.olympix.detectors.signedIntegerArray": true,
+  "security.olympix.detectors.erc20Interface": true,
+  "security.olympix.detectors.erc721Interface": true,
+  "security.olympix.detectors.functionSelectorClash": true,
+  "security.olympix.detectors.defaultVisibility": true,
+  "security.olympix.detectors.missingRevertReasonTests": true,
+  "security.olympix.detectors.multipleConstructors": true,
+  "security.olympix.detectors.sameNamedContracts": true,
+  "security.olympix.detectors.shadowingBuiltin": true,
+  "security.olympix.detectors.shadowingReservedKeyword": true,
+  "security.olympix.detectors.shadowingState": true,
+  "security.olympix.detectors.arbitrarySendEther": true,
+  "security.olympix.detectors.etherBalanceCheckStrictEquality": true,
+  "security.olympix.detectors.eventsPriceChange": true,
+  "security.olympix.detectors.externalCallPotentialOutOfGas": true,
+  "security.olympix.detectors.expectsOptionalErc20Functionality": true,
+  "security.olympix.detectors.lockedEther": true,
+  "security.olympix.detectors.possibleDivisionByZero": true,
+  "security.olympix.detectors.zeroAsParameter": true,
+  "security.olympix.detectors.oracleManipulation": true,
+  "security.olympix.project.useAiToPruneFindings": true,
+  "security.olympix.detectors.missingEventsAssertion": false
 }

contracts/tranches/Accounting.sol

@@ -166,6 +166,15 @@ contract Accounting is IAccounting, CDOComponent {
     }
 
     function maxWithdraw(bool isJrt) external view returns (uint256) {
+        return maxWithdrawInner(isJrt, false);
+    }
+    function maxWithdraw(bool isJrt, bool ownerIsSharesCooldown) external view returns (uint256) {
+        return maxWithdrawInner(isJrt, ownerIsSharesCooldown);
+    }
+    function maxWithdrawInner(bool isJrt, bool ownerIsSharesCooldown) internal view returns (uint256) {
+        if (ownerIsSharesCooldown) {
+            return isJrt ? jrtNav : srtNav;
+        }
         if (isJrt) {
             uint256 minJrt = srtNav * minimumJrtSrtRatio / 1e18;
             return Math.saturatingSub(jrtNav, minJrt);