Merge branch 'main' into feat/maverick-v2-executor

foundry/src/executors/BalancerV2Executor.sol

@@ -10,14 +10,17 @@ import {
 import {IAsset} from "@balancer-labs/v2-interfaces/contracts/vault/IAsset.sol";
 // slither-disable-next-line solc-version
 import {IVault} from "@balancer-labs/v2-interfaces/contracts/vault/IVault.sol";
+import {TokenTransfer} from "./TokenTransfer.sol";
 
 error BalancerV2Executor__InvalidDataLength();
 
-contract BalancerV2Executor is IExecutor {
+contract BalancerV2Executor is IExecutor, TokenTransfer {
     using SafeERC20 for IERC20;
 
     address private constant VAULT = 0xBA12222222228d8Ba445958a75a0704d566BF2C8;
 
+    constructor(address _permit2) TokenTransfer(_permit2) {}
+
     // slither-disable-next-line locked-ether
     function swap(uint256 givenAmount, bytes calldata data)
         external
@@ -29,12 +32,23 @@ contract BalancerV2Executor is IExecutor {
             IERC20 tokenOut,
             bytes32 poolId,
             address receiver,
-            bool needsApproval
+            bool needsApproval,
+            TransferType transferType
         ) = _decodeData(data);
 
+        _transfer(
+            address(tokenIn),
+            msg.sender,
+            // Receiver can never be the pool, since the pool expects funds in the router contract
+            // Thus, this call will only ever be used to transfer funds from the user into the router.
+            address(this),
+            givenAmount,
+            transferType
+        );
+
         if (needsApproval) {
             // slither-disable-next-line unused-return
-            tokenIn.approve(VAULT, type(uint256).max);
+            tokenIn.forceApprove(VAULT, type(uint256).max);
         }
 
         IVault.SingleSwap memory singleSwap = IVault.SingleSwap({
@@ -67,10 +81,11 @@ contract BalancerV2Executor is IExecutor {
             IERC20 tokenOut,
             bytes32 poolId,
             address receiver,
-            bool needsApproval
+            bool needsApproval,
+            TransferType transferType
         )
     {
-        if (data.length != 93) {
+        if (data.length != 94) {
             revert BalancerV2Executor__InvalidDataLength();
         }
 
@@ -79,5 +94,6 @@ contract BalancerV2Executor is IExecutor {
         poolId = bytes32(data[40:72]);
         receiver = address(bytes20(data[72:92]));
         needsApproval = uint8(data[92]) > 0;
+        transferType = TransferType(uint8(data[93]));
     }
 }

foundry/src/executors/CurveExecutor.sol

@@ -3,8 +3,11 @@ pragma solidity ^0.8.26;
 
 import "@interfaces/IExecutor.sol";
 import "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";
+import "./TokenTransfer.sol";
+import "@openzeppelin/contracts/utils/Address.sol";
 
 error CurveExecutor__AddressZero();
+error CurveExecutor__InvalidDataLength();
 
 interface CryptoPool {
     // slither-disable-next-line naming-convention
@@ -32,12 +35,14 @@ interface CryptoPoolETH {
     // slither-disable-end naming-convention
 }
 
-contract CurveExecutor is IExecutor {
+contract CurveExecutor is IExecutor, TokenTransfer {
     using SafeERC20 for IERC20;
 
     address public immutable nativeToken;
 
-    constructor(address _nativeToken) {
+    constructor(address _nativeToken, address _permit2)
+        TokenTransfer(_permit2)
+    {
         if (_nativeToken == address(0)) {
             revert CurveExecutor__AddressZero();
         }
@@ -50,6 +55,8 @@ contract CurveExecutor is IExecutor {
         payable
         returns (uint256)
     {
+        if (data.length != 85) revert CurveExecutor__InvalidDataLength();
+
         (
             address tokenIn,
             address tokenOut,
@@ -57,12 +64,24 @@ contract CurveExecutor is IExecutor {
             uint8 poolType,
             int128 i,
             int128 j,
-            bool tokenApprovalNeeded
+            bool tokenApprovalNeeded,
+            TransferType transferType,
+            address receiver
         ) = _decodeData(data);
 
+        _transfer(
+            tokenIn,
+            msg.sender,
+            // Receiver can never be the pool, since the pool expects funds in the router contract
+            // Thus, this call will only ever be used to transfer funds from the user into the router.
+            address(this),
+            amountIn,
+            transferType
+        );
+
         if (tokenApprovalNeeded && tokenIn != nativeToken) {
             // slither-disable-next-line unused-return
-            IERC20(tokenIn).approve(address(pool), type(uint256).max);
+            IERC20(tokenIn).forceApprove(address(pool), type(uint256).max);
         }
 
         /// Inspired by Curve's router contract: https://github.com/curvefi/curve-router-ng/blob/9ab006ca848fc7f1995b6fbbecfecc1e0eb29e2a/contracts/Router.vy#L44
@@ -92,7 +111,16 @@ contract CurveExecutor is IExecutor {
         }
 
         uint256 balanceAfter = _balanceOf(tokenOut);
-        return balanceAfter - balanceBefore;
+        uint256 amountOut = balanceAfter - balanceBefore;
+
+        if (receiver != address(this)) {
+            if (tokenOut == nativeToken) {
+                Address.sendValue(payable(receiver), amountOut);
+            } else {
+                IERC20(tokenOut).safeTransfer(receiver, amountOut);
+            }
+        }
+        return amountOut;
     }
 
     function _decodeData(bytes calldata data)
@@ -105,7 +133,9 @@ contract CurveExecutor is IExecutor {
             uint8 poolType,
             int128 i,
             int128 j,
-            bool tokenApprovalNeeded
+            bool tokenApprovalNeeded,
+            TransferType transferType,
+            address receiver
         )
     {
         tokenIn = address(bytes20(data[0:20]));
@@ -115,6 +145,8 @@ contract CurveExecutor is IExecutor {
         i = int128(uint128(uint8(data[61])));
         j = int128(uint128(uint8(data[62])));
         tokenApprovalNeeded = data[63] != 0;
+        transferType = TransferType(uint8(data[64]));
+        receiver = address(bytes20(data[65:85]));
     }
 
     receive() external payable {

foundry/src/executors/EkuboExecutor.sol

@@ -3,6 +3,7 @@ pragma solidity ^0.8.26;
 
 import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
 import {IExecutor} from "@interfaces/IExecutor.sol";
+import {ICallback} from "@interfaces/ICallback.sol";
 import {ICore} from "@ekubo/interfaces/ICore.sol";
 import {ILocker, IPayer} from "@ekubo/interfaces/IFlashAccountant.sol";
 import {NATIVE_TOKEN_ADDRESS} from "@ekubo/math/constants.sol";
@@ -10,18 +11,28 @@ import {SafeTransferLib} from "@solady/utils/SafeTransferLib.sol";
 import {LibBytes} from "@solady/utils/LibBytes.sol";
 import {Config, EkuboPoolKey} from "@ekubo/types/poolKey.sol";
 import {MAX_SQRT_RATIO, MIN_SQRT_RATIO} from "@ekubo/types/sqrtRatio.sol";
+import {TokenTransfer} from "./TokenTransfer.sol";
 
-contract EkuboExecutor is IExecutor, ILocker, IPayer {
+contract EkuboExecutor is
+    IExecutor,
+    ILocker,
+    IPayer,
+    ICallback,
+    TokenTransfer
+{
     error EkuboExecutor__InvalidDataLength();
     error EkuboExecutor__CoreOnly();
     error EkuboExecutor__UnknownCallback();
 
     ICore immutable core;
 
-    uint256 constant POOL_DATA_OFFSET = 92;
+    uint256 constant POOL_DATA_OFFSET = 77;
     uint256 constant HOP_BYTE_LEN = 52;
 
-    constructor(address _core) {
+    bytes4 constant LOCKED_SELECTOR = 0xb45a3c0e; // locked(uint256)
+    bytes4 constant PAY_CALLBACK_SELECTOR = 0x599d0714; // payCallback(uint256,address)
+
+    constructor(address _core, address _permit2) TokenTransfer(_permit2) {
         core = ICore(_core);
     }
 
@@ -30,67 +41,57 @@ contract EkuboExecutor is IExecutor, ILocker, IPayer {
         payable
         returns (uint256 calculatedAmount)
     {
-        if (data.length < 92) revert EkuboExecutor__InvalidDataLength();
+        if (data.length < 93) revert EkuboExecutor__InvalidDataLength();
 
         // amountIn must be at most type(int128).MAX
-        calculatedAmount =
-            uint256(_lock(bytes.concat(bytes16(uint128(amountIn)), data)));
+        calculatedAmount = uint256(
+            _lock(
+                bytes.concat(
+                    bytes16(uint128(amountIn)), bytes20(msg.sender), data
+                )
+            )
+        );
     }
 
-    function locked(uint256) external coreOnly {
-        int128 nextAmountIn = int128(uint128(bytes16(msg.data[36:52])));
-        uint128 tokenInDebtAmount = uint128(nextAmountIn);
+    function handleCallback(bytes calldata raw)
+        external
+        returns (bytes memory)
+    {
+        verifyCallback(raw);
 
-        address receiver = address(bytes20(msg.data[52:72]));
-        address tokenIn = address(bytes20(msg.data[72:POOL_DATA_OFFSET]));
+        // Without selector and locker id
+        bytes calldata stripped = raw[36:];
 
-        address nextTokenIn = tokenIn;
+        bytes4 selector = bytes4(raw[:4]);
 
-        uint256 hopsLength = (msg.data.length - POOL_DATA_OFFSET) / HOP_BYTE_LEN;
-
-        uint256 offset = POOL_DATA_OFFSET;
-
-        for (uint256 i = 0; i < hopsLength; i++) {
-            address nextTokenOut =
-                address(bytes20(LibBytes.loadCalldata(msg.data, offset)));
-            Config poolConfig =
-                Config.wrap(LibBytes.loadCalldata(msg.data, offset + 20));
-
-            (address token0, address token1, bool isToken1) = nextTokenIn
-                > nextTokenOut
-                ? (nextTokenOut, nextTokenIn, true)
-                : (nextTokenIn, nextTokenOut, false);
-
-            // slither-disable-next-line calls-loop
-            (int128 delta0, int128 delta1) = core.swap_611415377(
-                EkuboPoolKey(token0, token1, poolConfig),
-                nextAmountIn,
-                isToken1,
-                isToken1 ? MAX_SQRT_RATIO : MIN_SQRT_RATIO,
-                0
-            );
-
-            nextTokenIn = nextTokenOut;
-            nextAmountIn = -(isToken1 ? delta0 : delta1);
-
-            offset += HOP_BYTE_LEN;
+        bytes memory result = "";
+        if (selector == LOCKED_SELECTOR) {
+            int128 calculatedAmount = _locked(stripped);
+            result = abi.encodePacked(calculatedAmount);
+        } else if (selector == PAY_CALLBACK_SELECTOR) {
+            _payCallback(stripped);
+        } else {
+            revert EkuboExecutor__UnknownCallback();
         }
 
-        _pay(tokenIn, tokenInDebtAmount);
+        return result;
+    }
 
-        core.withdraw(nextTokenIn, receiver, uint128(nextAmountIn));
+    function verifyCallback(bytes calldata) public view coreOnly {}
 
+    function locked(uint256) external coreOnly {
+        // Without selector and locker id
+        int128 calculatedAmount = _locked(msg.data[36:]);
         // slither-disable-next-line assembly
         assembly ("memory-safe") {
-            mstore(0, nextAmountIn)
+            mstore(0, calculatedAmount)
             return(0x10, 16)
         }
     }
 
-    function payCallback(uint256, address token) external coreOnly {
-        uint128 amount = uint128(bytes16(msg.data[68:84]));
-
-        SafeTransferLib.safeTransfer(token, address(core), amount);
+    function payCallback(uint256, address /*token*/ ) external coreOnly {
+        // Without selector and locker id
+        _payCallback(msg.data[36:]);
     }
 
     function _lock(bytes memory data)
@@ -121,7 +122,58 @@ contract EkuboExecutor is IExecutor, ILocker, IPayer {
         }
     }
 
-    function _pay(address token, uint128 amount) internal {
+    function _locked(bytes calldata swapData) internal returns (int128) {
+        int128 nextAmountIn = int128(uint128(bytes16(swapData[0:16])));
+        uint128 tokenInDebtAmount = uint128(nextAmountIn);
+        address sender = address(bytes20(swapData[16:36]));
+        uint8 transferType = uint8(swapData[36]);
+
+        address receiver = address(bytes20(swapData[37:57]));
+        address tokenIn = address(bytes20(swapData[57:77]));
+
+        address nextTokenIn = tokenIn;
+
+        uint256 hopsLength = (swapData.length - POOL_DATA_OFFSET) / HOP_BYTE_LEN;
+
+        uint256 offset = POOL_DATA_OFFSET;
+
+        for (uint256 i = 0; i < hopsLength; i++) {
+            address nextTokenOut =
+                address(bytes20(LibBytes.loadCalldata(swapData, offset)));
+            Config poolConfig =
+                Config.wrap(LibBytes.loadCalldata(swapData, offset + 20));
+
+            (address token0, address token1, bool isToken1) = nextTokenIn
+                > nextTokenOut
+                ? (nextTokenOut, nextTokenIn, true)
+                : (nextTokenIn, nextTokenOut, false);
+
+            // slither-disable-next-line calls-loop
+            (int128 delta0, int128 delta1) = core.swap_611415377(
+                EkuboPoolKey(token0, token1, poolConfig),
+                nextAmountIn,
+                isToken1,
+                isToken1 ? MAX_SQRT_RATIO : MIN_SQRT_RATIO,
+                0
+            );
+
+            nextTokenIn = nextTokenOut;
+            nextAmountIn = -(isToken1 ? delta0 : delta1);
+
+            offset += HOP_BYTE_LEN;
+        }
+
+        _pay(tokenIn, tokenInDebtAmount, sender, transferType);
+        core.withdraw(nextTokenIn, receiver, uint128(nextAmountIn));
+        return nextAmountIn;
+    }
+
+    function _pay(
+        address token,
+        uint128 amount,
+        address sender,
+        uint8 transferType
+    ) internal {
         address target = address(core);
 
         if (token == NATIVE_TOKEN_ADDRESS) {
@@ -134,9 +186,11 @@ contract EkuboExecutor is IExecutor, ILocker, IPayer {
                 mstore(free, shl(224, 0x0c11dedd))
                 mstore(add(free, 4), token)
                 mstore(add(free, 36), shl(128, amount))
+                mstore(add(free, 52), shl(96, sender))
+                mstore(add(free, 72), shl(248, transferType))
 
-                // if it failed, pass through revert
-                if iszero(call(gas(), target, 0, free, 52, 0, 0)) {
+                // 4 (selector) + 32 (token) + 16 (amount) + 20 (sender) + 1 (transferType) = 73
+                if iszero(call(gas(), target, 0, free, 73, 0, 0)) {
                     returndatacopy(0, 0, returndatasize())
                     revert(0, returndatasize())
                 }
@@ -144,6 +198,14 @@ contract EkuboExecutor is IExecutor, ILocker, IPayer {
         }
     }
 
+    function _payCallback(bytes calldata payData) internal {
+        address token = address(bytes20(payData[12:32])); // This arg is abi-encoded
+        uint128 amount = uint128(bytes16(payData[32:48]));
+        address sender = address(bytes20(payData[48:68]));
+        TransferType transferType = TransferType(uint8(payData[68]));
+        _transfer(token, sender, address(core), amount, transferType);
+    }
+
     // To receive withdrawals from Core
     receive() external payable {}
 

foundry/src/executors/TokenTransfer.sol

@@ -0,0 +1,70 @@
+// SPDX-License-Identifier: BUSL-1.1
+pragma solidity ^0.8.26;
+
+import "@interfaces/IExecutor.sol";
+import "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";
+import "@permit2/src/interfaces/IAllowanceTransfer.sol";
+
+error TokenTransfer__AddressZero();
+
+contract TokenTransfer {
+    using SafeERC20 for IERC20;
+
+    IAllowanceTransfer public immutable permit2;
+
+    enum TransferType {
+        // Assume funds are in the TychoRouter - transfer into the pool
+        TRANSFER_TO_PROTOCOL,
+        // Assume funds are in msg.sender's wallet - transferFrom into the pool
+        TRANSFER_FROM_TO_PROTOCOL,
+        // Assume funds are in msg.sender's wallet - permit2TransferFrom into the pool
+        TRANSFER_PERMIT2_TO_PROTOCOL,
+        // Assume funds are in msg.sender's wallet - but the pool requires it to be
+        // in the router contract when calling swap - transferFrom into the router
+        // contract
+        TRANSFER_FROM_TO_ROUTER,
+        // Assume funds are in msg.sender's wallet - but the pool requires it to be
+        // in the router contract when calling swap - transferFrom into the router
+        // contract using permit2
+        TRANSFER_PERMIT2_TO_ROUTER,
+        // Assume funds have already been transferred into the pool. Do nothing.
+        NONE
+    }
+
+    constructor(address _permit2) {
+        if (_permit2 == address(0)) {
+            revert TokenTransfer__AddressZero();
+        }
+        permit2 = IAllowanceTransfer(_permit2);
+    }
+
+    function _transfer(
+        address tokenIn,
+        address sender,
+        address receiver,
+        uint256 amount,
+        TransferType transferType
+    ) internal {
+        if (transferType == TransferType.TRANSFER_TO_PROTOCOL) {
+            if (tokenIn == address(0)) {
+                payable(receiver).transfer(amount);
+            } else {
+                IERC20(tokenIn).safeTransfer(receiver, amount);
+            }
+        } else if (transferType == TransferType.TRANSFER_FROM_TO_PROTOCOL) {
+            // slither-disable-next-line arbitrary-send-erc20
+            IERC20(tokenIn).safeTransferFrom(sender, receiver, amount);
+        } else if (transferType == TransferType.TRANSFER_PERMIT2_TO_PROTOCOL) {
+            // Permit2.permit is already called from the TychoRouter
+            permit2.transferFrom(sender, receiver, uint160(amount), tokenIn);
+        } else if (transferType == TransferType.TRANSFER_FROM_TO_ROUTER) {
+            // slither-disable-next-line arbitrary-send-erc20
+            IERC20(tokenIn).safeTransferFrom(sender, address(this), amount);
+        } else if (transferType == TransferType.TRANSFER_PERMIT2_TO_ROUTER) {
+            // Permit2.permit is already called from the TychoRouter
+            permit2.transferFrom(
+                sender, address(this), uint160(amount), tokenIn
+            );
+        }
+    }
+}

foundry/src/executors/UniswapV2Executor.sol

@@ -4,20 +4,28 @@ pragma solidity ^0.8.26;
 import "@interfaces/IExecutor.sol";
 import "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";
 import "@uniswap-v2/contracts/interfaces/IUniswapV2Pair.sol";
+import "./TokenTransfer.sol";
 
 error UniswapV2Executor__InvalidDataLength();
 error UniswapV2Executor__InvalidTarget();
 error UniswapV2Executor__InvalidFactory();
 error UniswapV2Executor__InvalidInitCode();
+error UniswapV2Executor__InvalidFee();
 
-contract UniswapV2Executor is IExecutor {
+contract UniswapV2Executor is IExecutor, TokenTransfer {
     using SafeERC20 for IERC20;
 
     address public immutable factory;
     bytes32 public immutable initCode;
     address private immutable self;
+    uint256 public immutable feeBps;
 
-    constructor(address _factory, bytes32 _initCode) {
+    constructor(
+        address _factory,
+        bytes32 _initCode,
+        address _permit2,
+        uint256 _feeBps
+    ) TokenTransfer(_permit2) {
         if (_factory == address(0)) {
             revert UniswapV2Executor__InvalidFactory();
         }
@@ -26,6 +34,10 @@ contract UniswapV2Executor is IExecutor {
         }
         factory = _factory;
         initCode = _initCode;
+        if (_feeBps > 30) {
+            revert UniswapV2Executor__InvalidFee();
+        }
+        feeBps = _feeBps;
         self = address(this);
     }
 
@@ -35,17 +47,21 @@ contract UniswapV2Executor is IExecutor {
         payable
         returns (uint256 calculatedAmount)
     {
+        IERC20 tokenIn;
         address target;
         address receiver;
         bool zeroForOne;
-        IERC20 tokenIn;
+        TransferType transferType;
 
-        (tokenIn, target, receiver, zeroForOne) = _decodeData(data);
+        (tokenIn, target, receiver, zeroForOne, transferType) =
+            _decodeData(data);
 
         _verifyPairAddress(target);
 
         calculatedAmount = _getAmountOut(target, givenAmount, zeroForOne);
-        tokenIn.safeTransfer(target, givenAmount);
+        _transfer(
+            address(tokenIn), msg.sender, target, givenAmount, transferType
+        );
 
         IUniswapV2Pair pool = IUniswapV2Pair(target);
         if (zeroForOne) {
@@ -62,16 +78,18 @@ contract UniswapV2Executor is IExecutor {
             IERC20 inToken,
             address target,
             address receiver,
-            bool zeroForOne
+            bool zeroForOne,
+            TransferType transferType
         )
     {
-        if (data.length != 61) {
+        if (data.length != 62) {
             revert UniswapV2Executor__InvalidDataLength();
         }
         inToken = IERC20(address(bytes20(data[0:20])));
         target = address(bytes20(data[20:40]));
         receiver = address(bytes20(data[40:60]));
         zeroForOne = uint8(data[60]) > 0;
+        transferType = TransferType(uint8(data[61]));
     }
 
     function _getAmountOut(address target, uint256 amountIn, bool zeroForOne)
@@ -91,9 +109,9 @@ contract UniswapV2Executor is IExecutor {
         }
 
         require(reserveIn > 0 && reserveOut > 0, "L");
-        uint256 amountInWithFee = amountIn * 997;
+        uint256 amountInWithFee = amountIn * (10000 - feeBps);
         uint256 numerator = amountInWithFee * uint256(reserveOut);
-        uint256 denominator = (uint256(reserveIn) * 1000) + amountInWithFee;
+        uint256 denominator = (uint256(reserveIn) * 10000) + amountInWithFee;
         amount = numerator / denominator;
     }
 

foundry/src/executors/UniswapV3Executor.sol

@@ -5,13 +5,15 @@ import "@interfaces/IExecutor.sol";
 import "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";
 import "@uniswap/v3-core/contracts/interfaces/IUniswapV3Pool.sol";
 import "@interfaces/ICallback.sol";
+import {TokenTransfer} from "./TokenTransfer.sol";
 
 error UniswapV3Executor__InvalidDataLength();
 error UniswapV3Executor__InvalidFactory();
 error UniswapV3Executor__InvalidTarget();
 error UniswapV3Executor__InvalidInitCode();
+error UniswapV3Executor__InvalidTransferType(uint8 transferType);
 
-contract UniswapV3Executor is IExecutor, ICallback {
+contract UniswapV3Executor is IExecutor, ICallback, TokenTransfer {
     using SafeERC20 for IERC20;
 
     uint160 private constant MIN_SQRT_RATIO = 4295128739;
@@ -22,7 +24,9 @@ contract UniswapV3Executor is IExecutor, ICallback {
     bytes32 public immutable initCode;
     address private immutable self;
 
-    constructor(address _factory, bytes32 _initCode) {
+    constructor(address _factory, bytes32 _initCode, address _permit2)
+        TokenTransfer(_permit2)
+    {
         if (_factory == address(0)) {
             revert UniswapV3Executor__InvalidFactory();
         }
@@ -46,7 +50,8 @@ contract UniswapV3Executor is IExecutor, ICallback {
             uint24 fee,
             address receiver,
             address target,
-            bool zeroForOne
+            bool zeroForOne,
+            TransferType transferType
         ) = _decodeData(data);
 
         _verifyPairAddress(tokenIn, tokenOut, fee, target);
@@ -55,7 +60,8 @@ contract UniswapV3Executor is IExecutor, ICallback {
         int256 amount1;
         IUniswapV3Pool pool = IUniswapV3Pool(target);
 
-        bytes memory callbackData = _makeV3CallbackData(tokenIn, tokenOut, fee);
+        bytes memory callbackData =
+            _makeV3CallbackData(tokenIn, tokenOut, fee, transferType);
 
         {
             (amount0, amount1) = pool.swap(
@@ -80,6 +86,7 @@ contract UniswapV3Executor is IExecutor, ICallback {
         returns (bytes memory result)
     {
         // The data has the following layout:
+        // - selector (4 bytes)
         // - amount0Delta (32 bytes)
         // - amount1Delta (32 bytes)
         // - dataOffset (32 bytes)
@@ -87,16 +94,25 @@ contract UniswapV3Executor is IExecutor, ICallback {
         // - protocolData (variable length)
 
         (int256 amount0Delta, int256 amount1Delta) =
-            abi.decode(msgData[:64], (int256, int256));
+            abi.decode(msgData[4:68], (int256, int256));
 
-        address tokenIn = address(bytes20(msgData[128:148]));
+        address tokenIn = address(bytes20(msgData[132:152]));
 
-        verifyCallback(msgData[128:]);
+        // Transfer type does not exist
+        if (uint8(msgData[175]) > uint8(TransferType.NONE)) {
+            revert UniswapV3Executor__InvalidTransferType(uint8(msgData[175]));
+        }
+
+        TransferType transferType = TransferType(uint8(msgData[175]));
+        address sender = address(bytes20(msgData[176:196]));
+
+        verifyCallback(msgData[132:]);
 
         uint256 amountOwed =
             amount0Delta > 0 ? uint256(amount0Delta) : uint256(amount1Delta);
 
-        IERC20(tokenIn).safeTransfer(msg.sender, amountOwed);
+        _transfer(tokenIn, sender, msg.sender, amountOwed, transferType);
+
         return abi.encode(amountOwed, tokenIn);
     }
 
@@ -113,13 +129,7 @@ contract UniswapV3Executor is IExecutor, ICallback {
         int256, /* amount1Delta */
         bytes calldata /* data */
     ) external {
-        uint256 dataOffset = 4 + 32 + 32 + 32; // Skip selector + 2 ints + data_offset
-        uint256 dataLength =
-            uint256(bytes32(msg.data[dataOffset:dataOffset + 32]));
-
-        bytes calldata fullData = msg.data[4:dataOffset + 32 + dataLength];
-
-        handleCallback(fullData);
+        handleCallback(msg.data);
     }
 
     function _decodeData(bytes calldata data)
@@ -131,10 +141,11 @@ contract UniswapV3Executor is IExecutor, ICallback {
             uint24 fee,
             address receiver,
             address target,
-            bool zeroForOne
+            bool zeroForOne,
+            TransferType transferType
         )
     {
-        if (data.length != 84) {
+        if (data.length != 85) {
             revert UniswapV3Executor__InvalidDataLength();
         }
         tokenIn = address(bytes20(data[0:20]));
@@ -143,14 +154,18 @@ contract UniswapV3Executor is IExecutor, ICallback {
         receiver = address(bytes20(data[43:63]));
         target = address(bytes20(data[63:83]));
         zeroForOne = uint8(data[83]) > 0;
+        transferType = TransferType(uint8(data[84]));
     }
 
-    function _makeV3CallbackData(address tokenIn, address tokenOut, uint24 fee)
-        internal
-        view
-        returns (bytes memory)
-    {
-        return abi.encodePacked(tokenIn, tokenOut, fee, self);
+    function _makeV3CallbackData(
+        address tokenIn,
+        address tokenOut,
+        uint24 fee,
+        TransferType transferType
+    ) internal view returns (bytes memory) {
+        return abi.encodePacked(
+            tokenIn, tokenOut, fee, uint8(transferType), msg.sender
+        );
     }
 
     function _verifyPairAddress(

foundry/src/executors/UniswapV4Executor.sol

@@ -2,27 +2,53 @@
 pragma solidity ^0.8.26;
 
 import "@interfaces/IExecutor.sol";
+import {ICallback} from "@interfaces/ICallback.sol";
+import {TokenTransfer} from "./TokenTransfer.sol";
 import {
     IERC20,
     SafeERC20
 } from "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";
+
 import {IPoolManager} from "@uniswap/v4-core/src/interfaces/IPoolManager.sol";
 import {
     Currency, CurrencyLibrary
 } from "@uniswap/v4-core/src/types/Currency.sol";
 import {PoolKey} from "@uniswap/v4-core/src/types/PoolKey.sol";
+import {BalanceDelta} from "@uniswap/v4-core/src/types/BalanceDelta.sol";
+import {TickMath} from "@uniswap/v4-core/src/libraries/TickMath.sol";
 import {IHooks} from "@uniswap/v4-core/src/interfaces/IHooks.sol";
-import {V4Router} from "@uniswap/v4-periphery/src/V4Router.sol";
-import {Actions} from "@uniswap/v4-periphery/src/libraries/Actions.sol";
-import {IV4Router} from "@uniswap/v4-periphery/src/interfaces/IV4Router.sol";
 import {PathKey} from "@uniswap/v4-periphery/src/libraries/PathKey.sol";
-import {ICallback} from "@interfaces/ICallback.sol";
+import {IUnlockCallback} from
+    "@uniswap/v4-core/src/interfaces/callback/IUnlockCallback.sol";
+import {SafeCast} from "@uniswap/v4-core/src/libraries/SafeCast.sol";
+import {TransientStateLibrary} from
+    "@uniswap/v4-core/src/libraries/TransientStateLibrary.sol";
 
 error UniswapV4Executor__InvalidDataLength();
+error UniswapV4Executor__NotPoolManager();
+error UniswapV4Executor__UnknownCallback(bytes4 selector);
+error UniswapV4Executor__DeltaNotPositive(Currency currency);
+error UniswapV4Executor__DeltaNotNegative(Currency currency);
+error UniswapV4Executor__V4TooMuchRequested(
+    uint256 maxAmountInRequested, uint256 amountRequested
+);
 
-contract UniswapV4Executor is IExecutor, V4Router, ICallback {
+contract UniswapV4Executor is
+    IExecutor,
+    IUnlockCallback,
+    ICallback,
+    TokenTransfer
+{
     using SafeERC20 for IERC20;
     using CurrencyLibrary for Currency;
+    using SafeCast for *;
+    using TransientStateLibrary for IPoolManager;
+
+    IPoolManager public immutable poolManager;
+    address private immutable _self;
+
+    bytes4 constant SWAP_EXACT_INPUT_SINGLE_SELECTOR = 0x8bc6d0d7;
+    bytes4 constant SWAP_EXACT_INPUT_SELECTOR = 0xaf90aeb1;
 
     struct UniswapV4Pool {
         address intermediaryToken;
@@ -30,7 +56,22 @@ contract UniswapV4Executor is IExecutor, V4Router, ICallback {
         int24 tickSpacing;
     }
 
-    constructor(IPoolManager _poolManager) V4Router(_poolManager) {}
+    constructor(IPoolManager _poolManager, address _permit2)
+        TokenTransfer(_permit2)
+    {
+        poolManager = _poolManager;
+        _self = address(this);
+    }
+
+    /**
+     * @dev Modifier to restrict access to only the pool manager.
+     */
+    modifier poolManagerOnly() virtual {
+        if (msg.sender != address(poolManager)) {
+            revert UniswapV4Executor__NotPoolManager();
+        }
+        _;
+    }
 
     function swap(uint256 amountIn, bytes calldata data)
         external
@@ -41,10 +82,10 @@ contract UniswapV4Executor is IExecutor, V4Router, ICallback {
             address tokenIn,
             address tokenOut,
             bool zeroForOne,
-            address callbackExecutor,
+            TransferType transferType,
+            address receiver,
             UniswapV4Executor.UniswapV4Pool[] memory pools
         ) = _decodeData(data);
-
         bytes memory swapData;
         if (pools.length == 1) {
             PoolKey memory key = PoolKey({
@@ -54,26 +95,16 @@ contract UniswapV4Executor is IExecutor, V4Router, ICallback {
                 tickSpacing: pools[0].tickSpacing,
                 hooks: IHooks(address(0))
             });
-            bytes memory actions = abi.encodePacked(
-                uint8(Actions.SWAP_EXACT_IN_SINGLE),
-                uint8(Actions.SETTLE_ALL),
-                uint8(Actions.TAKE_ALL)
+            swapData = abi.encodeWithSelector(
+                this.swapExactInputSingle.selector,
+                key,
+                zeroForOne,
+                amountIn,
+                msg.sender,
+                transferType,
+                receiver,
+                bytes("")
             );
-
-            bytes[] memory params = new bytes[](3);
-
-            params[0] = abi.encode(
-                IV4Router.ExactInputSingleParams({
-                    poolKey: key,
-                    zeroForOne: zeroForOne,
-                    amountIn: uint128(amountIn),
-                    amountOutMinimum: uint128(0),
-                    hookData: bytes("")
-                })
-            );
-            params[1] = abi.encode(tokenIn, amountIn); // currency to settle
-            params[2] = abi.encode(tokenOut, uint256(0)); // currency to take
-            swapData = abi.encode(actions, params);
         } else {
             PathKey[] memory path = new PathKey[](pools.length);
             for (uint256 i = 0; i < pools.length; i++) {
@@ -86,51 +117,22 @@ contract UniswapV4Executor is IExecutor, V4Router, ICallback {
                 });
             }
 
-            bytes memory actions = abi.encodePacked(
-                uint8(Actions.SWAP_EXACT_IN),
-                uint8(Actions.SETTLE_ALL),
-                uint8(Actions.TAKE_ALL)
-            );
-
-            bytes[] memory params = new bytes[](3);
-
             Currency currencyIn = Currency.wrap(tokenIn);
-            params[0] = abi.encode(
-                IV4Router.ExactInputParams({
-                    currencyIn: currencyIn,
-                    path: path,
-                    amountIn: uint128(amountIn),
-                    amountOutMinimum: uint128(0)
-                })
+            swapData = abi.encodeWithSelector(
+                this.swapExactInput.selector,
+                currencyIn,
+                path,
+                amountIn,
+                msg.sender,
+                transferType,
+                receiver
             );
-            params[1] = abi.encode(currencyIn, amountIn);
-            params[2] = abi.encode(Currency.wrap(tokenOut), uint256(0));
-            swapData = abi.encode(actions, params);
         }
-        bytes memory fullData = abi.encodePacked(swapData, callbackExecutor);
-        uint256 tokenOutBalanceBefore;
 
-        tokenOutBalanceBefore = tokenOut == address(0)
-            ? address(this).balance
-            : IERC20(tokenOut).balanceOf(address(this));
+        bytes memory result = poolManager.unlock(swapData);
+        uint128 amountOut = abi.decode(result, (uint128));
 
-        executeActions(fullData);
-
-        uint256 tokenOutBalanceAfter;
-
-        tokenOutBalanceAfter = tokenOut == address(0)
-            ? address(this).balance
-            : IERC20(tokenOut).balanceOf(address(this));
-
-        calculatedAmount = tokenOutBalanceAfter - tokenOutBalanceBefore;
-
-        return calculatedAmount;
-    }
-
-    // necessary to convert bytes memory to bytes calldata
-    function executeActions(bytes memory unlockData) public {
-        // slither-disable-next-line unused-return
-        poolManager.unlock(unlockData);
+        return amountOut;
     }
 
     function _decodeData(bytes calldata data)
@@ -140,22 +142,24 @@ contract UniswapV4Executor is IExecutor, V4Router, ICallback {
             address tokenIn,
             address tokenOut,
             bool zeroForOne,
-            address callbackExecutor,
+            TransferType transferType,
+            address receiver,
             UniswapV4Pool[] memory pools
         )
     {
-        if (data.length < 87) {
+        if (data.length < 88) {
             revert UniswapV4Executor__InvalidDataLength();
         }
 
         tokenIn = address(bytes20(data[0:20]));
         tokenOut = address(bytes20(data[20:40]));
         zeroForOne = (data[40] != 0);
-        callbackExecutor = address(bytes20(data[41:61]));
+        transferType = TransferType(uint8(data[41]));
+        receiver = address(bytes20(data[42:62]));
 
-        uint256 poolsLength = (data.length - 61) / 26; // 26 bytes per pool object
+        uint256 poolsLength = (data.length - 62) / 26; // 26 bytes per pool object
         pools = new UniswapV4Pool[](poolsLength);
-        bytes memory poolsData = data[61:];
+        bytes memory poolsData = data[62:];
         uint256 offset = 0;
         for (uint256 i = 0; i < poolsLength; i++) {
             address intermediaryToken;
@@ -173,6 +177,9 @@ contract UniswapV4Executor is IExecutor, V4Router, ICallback {
         }
     }
 
+    /**
+     * @notice Handles the callback from the pool manager. This is used for callbacks from the router.
+     */
     function handleCallback(bytes calldata data)
         external
         returns (bytes memory)
@@ -181,15 +188,253 @@ contract UniswapV4Executor is IExecutor, V4Router, ICallback {
         return _unlockCallback(data);
     }
 
-    function verifyCallback(bytes calldata) public view onlyPoolManager {}
+    function verifyCallback(bytes calldata) public view poolManagerOnly {}
 
-    function _pay(Currency token, address, uint256 amount) internal override {
-        IERC20(Currency.unwrap(token)).safeTransfer(
-            address(poolManager), amount
-        );
+    /**
+     * @notice Handles the unlock callback from the pool manager. This is used for swaps against the executor directly (bypassing the router).
+     */
+    function unlockCallback(bytes calldata data)
+        external
+        poolManagerOnly
+        returns (bytes memory)
+    {
+        return _unlockCallback(data);
     }
 
-    function msgSender() public view override returns (address) {
-        return address(this);
+    /**
+     * @dev Internal function to handle the unlock callback.
+     */
+    function _unlockCallback(bytes calldata data)
+        internal
+        returns (bytes memory)
+    {
+        bytes4 selector = bytes4(data[:4]);
+        if (
+            selector != SWAP_EXACT_INPUT_SELECTOR
+                && selector != SWAP_EXACT_INPUT_SINGLE_SELECTOR
+        ) {
+            revert UniswapV4Executor__UnknownCallback(selector);
+        }
+
+        // here we expect to call either `swapExactInputSingle` or `swapExactInput`. See `swap` to see how we encode the selector and the calldata
+        // slither-disable-next-line low-level-calls
+        (bool success, bytes memory returnData) = _self.delegatecall(data);
+        if (!success) {
+            revert(
+                string(
+                    returnData.length > 0
+                        ? returnData
+                        : abi.encodePacked("Uniswap v4 Callback failed")
+                )
+            );
+        }
+        return returnData;
+    }
+
+    /**
+     * @notice Performs an exact input single swap. It settles and takes the tokens after the swap.
+     * @param poolKey The key of the pool to swap in.
+     * @param zeroForOne Whether the swap is from token0 to token1 (true) or vice versa (false).
+     * @param amountIn The amount of tokens to swap in.
+     * @param sender The address of the sender.
+     * @param transferType The type of transfer in to use.
+     * @param receiver The address of the receiver.
+     * @param hookData Additional data for hook contracts.
+     */
+    function swapExactInputSingle(
+        PoolKey memory poolKey,
+        bool zeroForOne,
+        uint128 amountIn,
+        address sender,
+        TransferType transferType,
+        address receiver,
+        bytes calldata hookData
+    ) external returns (uint128) {
+        uint128 amountOut = _swap(
+            poolKey, zeroForOne, -int256(uint256(amountIn)), hookData
+        ).toUint128();
+
+        Currency currencyIn = zeroForOne ? poolKey.currency0 : poolKey.currency1;
+        uint256 amount = _getFullDebt(currencyIn);
+        if (amount > amountIn) {
+            revert UniswapV4Executor__V4TooMuchRequested(amountIn, amount);
+        }
+        _settle(currencyIn, amount, sender, transferType);
+
+        Currency currencyOut =
+            zeroForOne ? poolKey.currency1 : poolKey.currency0;
+        _take(currencyOut, receiver, _mapTakeAmount(amountOut, currencyOut));
+        return amountOut;
+    }
+
+    /**
+     * @notice Performs an exact input swap along a path. It settles and takes the tokens after the swap.
+     * @param currencyIn The currency of the input token.
+     * @param path The path to swap along.
+     * @param amountIn The amount of tokens to swap in.
+     * @param sender The address of the sender.
+     * @param transferType The type of transfer in to use.
+     * @param receiver The address of the receiver.
+     */
+    function swapExactInput(
+        Currency currencyIn,
+        PathKey[] calldata path,
+        uint128 amountIn,
+        address sender,
+        TransferType transferType,
+        address receiver
+    ) external returns (uint128) {
+        uint128 amountOut = 0;
+        Currency swapCurrencyIn = currencyIn;
+        uint256 swapAmountIn = amountIn;
+        unchecked {
+            uint256 pathLength = path.length;
+            PathKey calldata pathKey;
+
+            for (uint256 i = 0; i < pathLength; i++) {
+                pathKey = path[i];
+                (PoolKey memory poolKey, bool zeroForOne) =
+                    pathKey.getPoolAndSwapDirection(swapCurrencyIn);
+                // The output delta will always be positive, except for when interacting with certain hook pools
+                amountOut = _swap(
+                    poolKey,
+                    zeroForOne,
+                    -int256(uint256(swapAmountIn)),
+                    pathKey.hookData
+                ).toUint128();
+
+                swapAmountIn = amountOut;
+                swapCurrencyIn = pathKey.intermediateCurrency;
+            }
+        }
+
+        uint256 amount = _getFullDebt(currencyIn);
+        if (amount > amountIn) {
+            revert UniswapV4Executor__V4TooMuchRequested(amountIn, amount);
+        }
+        _settle(currencyIn, amount, sender, transferType);
+
+        _take(
+            swapCurrencyIn, // at the end of the loop this is actually currency out
+            receiver,
+            _mapTakeAmount(amountOut, swapCurrencyIn)
+        );
+        return amountOut;
+    }
+
+    function _swap(
+        PoolKey memory poolKey,
+        bool zeroForOne,
+        int256 amountSpecified,
+        bytes calldata hookData
+    ) private returns (int128 reciprocalAmount) {
+        unchecked {
+            // slither-disable-next-line calls-loop
+            BalanceDelta delta = poolManager.swap(
+                poolKey,
+                IPoolManager.SwapParams(
+                    zeroForOne,
+                    amountSpecified,
+                    zeroForOne
+                        ? TickMath.MIN_SQRT_PRICE + 1
+                        : TickMath.MAX_SQRT_PRICE - 1
+                ),
+                hookData
+            );
+
+            reciprocalAmount = (zeroForOne == amountSpecified < 0)
+                ? delta.amount1()
+                : delta.amount0();
+        }
+    }
+
+    /**
+     * @notice Obtains the full amount owed by this contract (negative delta).
+     * @param currency The currency to get the delta for.
+     * @return amount The amount owed by this contract.
+     */
+    function _getFullCredit(Currency currency)
+        internal
+        view
+        returns (uint256 amount)
+    {
+        int256 _amount = poolManager.currencyDelta(address(this), currency);
+        // If the amount is negative, it should be settled not taken.
+        if (_amount < 0) revert UniswapV4Executor__DeltaNotPositive(currency);
+        amount = uint256(_amount);
+    }
+
+    /// @notice Obtain the full amount owed by this contract (negative delta)
+    /// @param currency Currency to get the delta for
+    /// @return amount The amount owed by this contract as a uint256
+    function _getFullDebt(Currency currency)
+        internal
+        view
+        returns (uint256 amount)
+    {
+        int256 _amount = poolManager.currencyDelta(address(this), currency);
+        // If the amount is positive, it should be taken not settled.
+        if (_amount > 0) revert UniswapV4Executor__DeltaNotNegative(currency);
+        // Casting is safe due to limits on the total supply of a pool
+        amount = uint256(-_amount);
+    }
+
+    /**
+     * @notice Pays and settles a currency to the pool manager.
+     * @dev The implementing contract must ensure that the `payer` is a secure address.
+     * @param currency The currency to settle.
+     * @param amount The amount to send.
+     * @param sender The address of the payer.
+     * @param transferType The type of transfer to use.
+     * @dev Returns early if the amount is 0.
+     */
+    function _settle(
+        Currency currency,
+        uint256 amount,
+        address sender,
+        TransferType transferType
+    ) internal {
+        if (amount == 0) return;
+        poolManager.sync(currency);
+        if (currency.isAddressZero()) {
+            // slither-disable-next-line unused-return
+            poolManager.settle{value: amount}();
+        } else {
+            _transfer(
+                Currency.unwrap(currency),
+                sender,
+                address(poolManager),
+                amount,
+                transferType
+            );
+            // slither-disable-next-line unused-return
+            poolManager.settle();
+        }
+    }
+
+    /**
+     * @notice Takes an amount of currency out of the pool manager.
+     * @param currency The currency to take.
+     * @param recipient The address to receive the currency.
+     * @param amount The amount to take.
+     * @dev Returns early if the amount is 0.
+     */
+    function _take(Currency currency, address recipient, uint256 amount)
+        internal
+    {
+        if (amount == 0) return;
+        poolManager.take(currency, recipient, amount);
+    }
+
+    function _mapTakeAmount(uint256 amount, Currency currency)
+        internal
+        view
+        returns (uint256)
+    {
+        if (amount == 0) {
+            return _getFullCredit(currency);
+        } else {
+            return amount;
+        }
     }
 }