dexorder
This commit is contained in:
dexorder
852
lib_openzeppelin_contracts/contracts/governance/Governor.sol
Normal file
852
lib_openzeppelin_contracts/contracts/governance/Governor.sol
Normal file
@@ -0,0 +1,852 @@
|
||||
// SPDX-License-Identifier: MIT
|
||||
// OpenZeppelin Contracts (last updated v5.0.0) (governance/Governor.sol)
|
||||
|
||||
pragma solidity ^0.8.20;
|
||||
|
||||
import {IERC721Receiver} from "../token/ERC721/IERC721Receiver.sol";
|
||||
import {IERC1155Receiver} from "../token/ERC1155/IERC1155Receiver.sol";
|
||||
import {EIP712} from "../utils/cryptography/EIP712.sol";
|
||||
import {SignatureChecker} from "../utils/cryptography/SignatureChecker.sol";
|
||||
import {IERC165, ERC165} from "../utils/introspection/ERC165.sol";
|
||||
import {SafeCast} from "../utils/math/SafeCast.sol";
|
||||
import {DoubleEndedQueue} from "../utils/structs/DoubleEndedQueue.sol";
|
||||
import {Address} from "../utils/Address.sol";
|
||||
import {Context} from "../utils/Context.sol";
|
||||
import {Nonces} from "../utils/Nonces.sol";
|
||||
import {IGovernor, IERC6372} from "./IGovernor.sol";
|
||||
|
||||
/**
|
||||
* @dev Core of the governance system, designed to be extended through various modules.
|
||||
*
|
||||
* This contract is abstract and requires several functions to be implemented in various modules:
|
||||
*
|
||||
* - A counting module must implement {quorum}, {_quorumReached}, {_voteSucceeded} and {_countVote}
|
||||
* - A voting module must implement {_getVotes}
|
||||
* - Additionally, {votingPeriod} must also be implemented
|
||||
*/
|
||||
abstract contract Governor is Context, ERC165, EIP712, Nonces, IGovernor, IERC721Receiver, IERC1155Receiver {
|
||||
using DoubleEndedQueue for DoubleEndedQueue.Bytes32Deque;
|
||||
|
||||
bytes32 public constant BALLOT_TYPEHASH =
|
||||
keccak256("Ballot(uint256 proposalId,uint8 support,address voter,uint256 nonce)");
|
||||
bytes32 public constant EXTENDED_BALLOT_TYPEHASH =
|
||||
keccak256(
|
||||
"ExtendedBallot(uint256 proposalId,uint8 support,address voter,uint256 nonce,string reason,bytes params)"
|
||||
);
|
||||
|
||||
struct ProposalCore {
|
||||
address proposer;
|
||||
uint48 voteStart;
|
||||
uint32 voteDuration;
|
||||
bool executed;
|
||||
bool canceled;
|
||||
uint48 etaSeconds;
|
||||
}
|
||||
|
||||
bytes32 private constant ALL_PROPOSAL_STATES_BITMAP = bytes32((2 ** (uint8(type(ProposalState).max) + 1)) - 1);
|
||||
string private _name;
|
||||
|
||||
mapping(uint256 proposalId => ProposalCore) private _proposals;
|
||||
|
||||
// This queue keeps track of the governor operating on itself. Calls to functions protected by the {onlyGovernance}
|
||||
// modifier needs to be whitelisted in this queue. Whitelisting is set in {execute}, consumed by the
|
||||
// {onlyGovernance} modifier and eventually reset after {_executeOperations} completes. This ensures that the
|
||||
// execution of {onlyGovernance} protected calls can only be achieved through successful proposals.
|
||||
DoubleEndedQueue.Bytes32Deque private _governanceCall;
|
||||
|
||||
/**
|
||||
* @dev Restricts a function so it can only be executed through governance proposals. For example, governance
|
||||
* parameter setters in {GovernorSettings} are protected using this modifier.
|
||||
*
|
||||
* The governance executing address may be different from the Governor's own address, for example it could be a
|
||||
* timelock. This can be customized by modules by overriding {_executor}. The executor is only able to invoke these
|
||||
* functions during the execution of the governor's {execute} function, and not under any other circumstances. Thus,
|
||||
* for example, additional timelock proposers are not able to change governance parameters without going through the
|
||||
* governance protocol (since v4.6).
|
||||
*/
|
||||
modifier onlyGovernance() {
|
||||
_checkGovernance();
|
||||
_;
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Sets the value for {name} and {version}
|
||||
*/
|
||||
constructor(string memory name_) EIP712(name_, version()) {
|
||||
_name = name_;
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Function to receive ETH that will be handled by the governor (disabled if executor is a third party contract)
|
||||
*/
|
||||
receive() external payable virtual {
|
||||
if (_executor() != address(this)) {
|
||||
revert GovernorDisabledDeposit();
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev See {IERC165-supportsInterface}.
|
||||
*/
|
||||
function supportsInterface(bytes4 interfaceId) public view virtual override(IERC165, ERC165) returns (bool) {
|
||||
return
|
||||
interfaceId == type(IGovernor).interfaceId ||
|
||||
interfaceId == type(IERC1155Receiver).interfaceId ||
|
||||
super.supportsInterface(interfaceId);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev See {IGovernor-name}.
|
||||
*/
|
||||
function name() public view virtual returns (string memory) {
|
||||
return _name;
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev See {IGovernor-version}.
|
||||
*/
|
||||
function version() public view virtual returns (string memory) {
|
||||
return "1";
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev See {IGovernor-hashProposal}.
|
||||
*
|
||||
* The proposal id is produced by hashing the ABI encoded `targets` array, the `values` array, the `calldatas` array
|
||||
* and the descriptionHash (bytes32 which itself is the keccak256 hash of the description string). This proposal id
|
||||
* can be produced from the proposal data which is part of the {ProposalCreated} event. It can even be computed in
|
||||
* advance, before the proposal is submitted.
|
||||
*
|
||||
* Note that the chainId and the governor address are not part of the proposal id computation. Consequently, the
|
||||
* same proposal (with same operation and same description) will have the same id if submitted on multiple governors
|
||||
* across multiple networks. This also means that in order to execute the same operation twice (on the same
|
||||
* governor) the proposer will have to change the description in order to avoid proposal id conflicts.
|
||||
*/
|
||||
function hashProposal(
|
||||
address[] memory targets,
|
||||
uint256[] memory values,
|
||||
bytes[] memory calldatas,
|
||||
bytes32 descriptionHash
|
||||
) public pure virtual returns (uint256) {
|
||||
return uint256(keccak256(abi.encode(targets, values, calldatas, descriptionHash)));
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev See {IGovernor-state}.
|
||||
*/
|
||||
function state(uint256 proposalId) public view virtual returns (ProposalState) {
|
||||
// We read the struct fields into the stack at once so Solidity emits a single SLOAD
|
||||
ProposalCore storage proposal = _proposals[proposalId];
|
||||
bool proposalExecuted = proposal.executed;
|
||||
bool proposalCanceled = proposal.canceled;
|
||||
|
||||
if (proposalExecuted) {
|
||||
return ProposalState.Executed;
|
||||
}
|
||||
|
||||
if (proposalCanceled) {
|
||||
return ProposalState.Canceled;
|
||||
}
|
||||
|
||||
uint256 snapshot = proposalSnapshot(proposalId);
|
||||
|
||||
if (snapshot == 0) {
|
||||
revert GovernorNonexistentProposal(proposalId);
|
||||
}
|
||||
|
||||
uint256 currentTimepoint = clock();
|
||||
|
||||
if (snapshot >= currentTimepoint) {
|
||||
return ProposalState.Pending;
|
||||
}
|
||||
|
||||
uint256 deadline = proposalDeadline(proposalId);
|
||||
|
||||
if (deadline >= currentTimepoint) {
|
||||
return ProposalState.Active;
|
||||
} else if (!_quorumReached(proposalId) || !_voteSucceeded(proposalId)) {
|
||||
return ProposalState.Defeated;
|
||||
} else if (proposalEta(proposalId) == 0) {
|
||||
return ProposalState.Succeeded;
|
||||
} else {
|
||||
return ProposalState.Queued;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev See {IGovernor-proposalThreshold}.
|
||||
*/
|
||||
function proposalThreshold() public view virtual returns (uint256) {
|
||||
return 0;
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev See {IGovernor-proposalSnapshot}.
|
||||
*/
|
||||
function proposalSnapshot(uint256 proposalId) public view virtual returns (uint256) {
|
||||
return _proposals[proposalId].voteStart;
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev See {IGovernor-proposalDeadline}.
|
||||
*/
|
||||
function proposalDeadline(uint256 proposalId) public view virtual returns (uint256) {
|
||||
return _proposals[proposalId].voteStart + _proposals[proposalId].voteDuration;
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev See {IGovernor-proposalProposer}.
|
||||
*/
|
||||
function proposalProposer(uint256 proposalId) public view virtual returns (address) {
|
||||
return _proposals[proposalId].proposer;
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev See {IGovernor-proposalEta}.
|
||||
*/
|
||||
function proposalEta(uint256 proposalId) public view virtual returns (uint256) {
|
||||
return _proposals[proposalId].etaSeconds;
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev See {IGovernor-proposalNeedsQueuing}.
|
||||
*/
|
||||
function proposalNeedsQueuing(uint256) public view virtual returns (bool) {
|
||||
return false;
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Reverts if the `msg.sender` is not the executor. In case the executor is not this contract
|
||||
* itself, the function reverts if `msg.data` is not whitelisted as a result of an {execute}
|
||||
* operation. See {onlyGovernance}.
|
||||
*/
|
||||
function _checkGovernance() internal virtual {
|
||||
if (_executor() != _msgSender()) {
|
||||
revert GovernorOnlyExecutor(_msgSender());
|
||||
}
|
||||
if (_executor() != address(this)) {
|
||||
bytes32 msgDataHash = keccak256(_msgData());
|
||||
// loop until popping the expected operation - throw if deque is empty (operation not authorized)
|
||||
while (_governanceCall.popFront() != msgDataHash) {}
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Amount of votes already cast passes the threshold limit.
|
||||
*/
|
||||
function _quorumReached(uint256 proposalId) internal view virtual returns (bool);
|
||||
|
||||
/**
|
||||
* @dev Is the proposal successful or not.
|
||||
*/
|
||||
function _voteSucceeded(uint256 proposalId) internal view virtual returns (bool);
|
||||
|
||||
/**
|
||||
* @dev Get the voting weight of `account` at a specific `timepoint`, for a vote as described by `params`.
|
||||
*/
|
||||
function _getVotes(address account, uint256 timepoint, bytes memory params) internal view virtual returns (uint256);
|
||||
|
||||
/**
|
||||
* @dev Register a vote for `proposalId` by `account` with a given `support`, voting `weight` and voting `params`.
|
||||
*
|
||||
* Note: Support is generic and can represent various things depending on the voting system used.
|
||||
*/
|
||||
function _countVote(
|
||||
uint256 proposalId,
|
||||
address account,
|
||||
uint8 support,
|
||||
uint256 weight,
|
||||
bytes memory params
|
||||
) internal virtual;
|
||||
|
||||
/**
|
||||
* @dev Default additional encoded parameters used by castVote methods that don't include them
|
||||
*
|
||||
* Note: Should be overridden by specific implementations to use an appropriate value, the
|
||||
* meaning of the additional params, in the context of that implementation
|
||||
*/
|
||||
function _defaultParams() internal view virtual returns (bytes memory) {
|
||||
return "";
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev See {IGovernor-propose}. This function has opt-in frontrunning protection, described in {_isValidDescriptionForProposer}.
|
||||
*/
|
||||
function propose(
|
||||
address[] memory targets,
|
||||
uint256[] memory values,
|
||||
bytes[] memory calldatas,
|
||||
string memory description
|
||||
) public virtual returns (uint256) {
|
||||
address proposer = _msgSender();
|
||||
|
||||
// check description restriction
|
||||
if (!_isValidDescriptionForProposer(proposer, description)) {
|
||||
revert GovernorRestrictedProposer(proposer);
|
||||
}
|
||||
|
||||
// check proposal threshold
|
||||
uint256 votesThreshold = proposalThreshold();
|
||||
if (votesThreshold > 0) {
|
||||
uint256 proposerVotes = getVotes(proposer, clock() - 1);
|
||||
if (proposerVotes < votesThreshold) {
|
||||
revert GovernorInsufficientProposerVotes(proposer, proposerVotes, votesThreshold);
|
||||
}
|
||||
}
|
||||
|
||||
return _propose(targets, values, calldatas, description, proposer);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Internal propose mechanism. Can be overridden to add more logic on proposal creation.
|
||||
*
|
||||
* Emits a {IGovernor-ProposalCreated} event.
|
||||
*/
|
||||
function _propose(
|
||||
address[] memory targets,
|
||||
uint256[] memory values,
|
||||
bytes[] memory calldatas,
|
||||
string memory description,
|
||||
address proposer
|
||||
) internal virtual returns (uint256 proposalId) {
|
||||
proposalId = hashProposal(targets, values, calldatas, keccak256(bytes(description)));
|
||||
|
||||
if (targets.length != values.length || targets.length != calldatas.length || targets.length == 0) {
|
||||
revert GovernorInvalidProposalLength(targets.length, calldatas.length, values.length);
|
||||
}
|
||||
if (_proposals[proposalId].voteStart != 0) {
|
||||
revert GovernorUnexpectedProposalState(proposalId, state(proposalId), bytes32(0));
|
||||
}
|
||||
|
||||
uint256 snapshot = clock() + votingDelay();
|
||||
uint256 duration = votingPeriod();
|
||||
|
||||
ProposalCore storage proposal = _proposals[proposalId];
|
||||
proposal.proposer = proposer;
|
||||
proposal.voteStart = SafeCast.toUint48(snapshot);
|
||||
proposal.voteDuration = SafeCast.toUint32(duration);
|
||||
|
||||
emit ProposalCreated(
|
||||
proposalId,
|
||||
proposer,
|
||||
targets,
|
||||
values,
|
||||
new string[](targets.length),
|
||||
calldatas,
|
||||
snapshot,
|
||||
snapshot + duration,
|
||||
description
|
||||
);
|
||||
|
||||
// Using a named return variable to avoid stack too deep errors
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev See {IGovernor-queue}.
|
||||
*/
|
||||
function queue(
|
||||
address[] memory targets,
|
||||
uint256[] memory values,
|
||||
bytes[] memory calldatas,
|
||||
bytes32 descriptionHash
|
||||
) public virtual returns (uint256) {
|
||||
uint256 proposalId = hashProposal(targets, values, calldatas, descriptionHash);
|
||||
|
||||
_validateStateBitmap(proposalId, _encodeStateBitmap(ProposalState.Succeeded));
|
||||
|
||||
uint48 etaSeconds = _queueOperations(proposalId, targets, values, calldatas, descriptionHash);
|
||||
|
||||
if (etaSeconds != 0) {
|
||||
_proposals[proposalId].etaSeconds = etaSeconds;
|
||||
emit ProposalQueued(proposalId, etaSeconds);
|
||||
} else {
|
||||
revert GovernorQueueNotImplemented();
|
||||
}
|
||||
|
||||
return proposalId;
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Internal queuing mechanism. Can be overridden (without a super call) to modify the way queuing is
|
||||
* performed (for example adding a vault/timelock).
|
||||
*
|
||||
* This is empty by default, and must be overridden to implement queuing.
|
||||
*
|
||||
* This function returns a timestamp that describes the expected ETA for execution. If the returned value is 0
|
||||
* (which is the default value), the core will consider queueing did not succeed, and the public {queue} function
|
||||
* will revert.
|
||||
*
|
||||
* NOTE: Calling this function directly will NOT check the current state of the proposal, or emit the
|
||||
* `ProposalQueued` event. Queuing a proposal should be done using {queue}.
|
||||
*/
|
||||
function _queueOperations(
|
||||
uint256 /*proposalId*/,
|
||||
address[] memory /*targets*/,
|
||||
uint256[] memory /*values*/,
|
||||
bytes[] memory /*calldatas*/,
|
||||
bytes32 /*descriptionHash*/
|
||||
) internal virtual returns (uint48) {
|
||||
return 0;
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev See {IGovernor-execute}.
|
||||
*/
|
||||
function execute(
|
||||
address[] memory targets,
|
||||
uint256[] memory values,
|
||||
bytes[] memory calldatas,
|
||||
bytes32 descriptionHash
|
||||
) public payable virtual returns (uint256) {
|
||||
uint256 proposalId = hashProposal(targets, values, calldatas, descriptionHash);
|
||||
|
||||
_validateStateBitmap(
|
||||
proposalId,
|
||||
_encodeStateBitmap(ProposalState.Succeeded) | _encodeStateBitmap(ProposalState.Queued)
|
||||
);
|
||||
|
||||
// mark as executed before calls to avoid reentrancy
|
||||
_proposals[proposalId].executed = true;
|
||||
|
||||
// before execute: register governance call in queue.
|
||||
if (_executor() != address(this)) {
|
||||
for (uint256 i = 0; i < targets.length; ++i) {
|
||||
if (targets[i] == address(this)) {
|
||||
_governanceCall.pushBack(keccak256(calldatas[i]));
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
_executeOperations(proposalId, targets, values, calldatas, descriptionHash);
|
||||
|
||||
// after execute: cleanup governance call queue.
|
||||
if (_executor() != address(this) && !_governanceCall.empty()) {
|
||||
_governanceCall.clear();
|
||||
}
|
||||
|
||||
emit ProposalExecuted(proposalId);
|
||||
|
||||
return proposalId;
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Internal execution mechanism. Can be overridden (without a super call) to modify the way execution is
|
||||
* performed (for example adding a vault/timelock).
|
||||
*
|
||||
* NOTE: Calling this function directly will NOT check the current state of the proposal, set the executed flag to
|
||||
* true or emit the `ProposalExecuted` event. Executing a proposal should be done using {execute} or {_execute}.
|
||||
*/
|
||||
function _executeOperations(
|
||||
uint256 /* proposalId */,
|
||||
address[] memory targets,
|
||||
uint256[] memory values,
|
||||
bytes[] memory calldatas,
|
||||
bytes32 /*descriptionHash*/
|
||||
) internal virtual {
|
||||
for (uint256 i = 0; i < targets.length; ++i) {
|
||||
(bool success, bytes memory returndata) = targets[i].call{value: values[i]}(calldatas[i]);
|
||||
Address.verifyCallResult(success, returndata);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev See {IGovernor-cancel}.
|
||||
*/
|
||||
function cancel(
|
||||
address[] memory targets,
|
||||
uint256[] memory values,
|
||||
bytes[] memory calldatas,
|
||||
bytes32 descriptionHash
|
||||
) public virtual returns (uint256) {
|
||||
// The proposalId will be recomputed in the `_cancel` call further down. However we need the value before we
|
||||
// do the internal call, because we need to check the proposal state BEFORE the internal `_cancel` call
|
||||
// changes it. The `hashProposal` duplication has a cost that is limited, and that we accept.
|
||||
uint256 proposalId = hashProposal(targets, values, calldatas, descriptionHash);
|
||||
|
||||
// public cancel restrictions (on top of existing _cancel restrictions).
|
||||
_validateStateBitmap(proposalId, _encodeStateBitmap(ProposalState.Pending));
|
||||
if (_msgSender() != proposalProposer(proposalId)) {
|
||||
revert GovernorOnlyProposer(_msgSender());
|
||||
}
|
||||
|
||||
return _cancel(targets, values, calldatas, descriptionHash);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Internal cancel mechanism with minimal restrictions. A proposal can be cancelled in any state other than
|
||||
* Canceled, Expired, or Executed. Once cancelled a proposal can't be re-submitted.
|
||||
*
|
||||
* Emits a {IGovernor-ProposalCanceled} event.
|
||||
*/
|
||||
function _cancel(
|
||||
address[] memory targets,
|
||||
uint256[] memory values,
|
||||
bytes[] memory calldatas,
|
||||
bytes32 descriptionHash
|
||||
) internal virtual returns (uint256) {
|
||||
uint256 proposalId = hashProposal(targets, values, calldatas, descriptionHash);
|
||||
|
||||
_validateStateBitmap(
|
||||
proposalId,
|
||||
ALL_PROPOSAL_STATES_BITMAP ^
|
||||
_encodeStateBitmap(ProposalState.Canceled) ^
|
||||
_encodeStateBitmap(ProposalState.Expired) ^
|
||||
_encodeStateBitmap(ProposalState.Executed)
|
||||
);
|
||||
|
||||
_proposals[proposalId].canceled = true;
|
||||
emit ProposalCanceled(proposalId);
|
||||
|
||||
return proposalId;
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev See {IGovernor-getVotes}.
|
||||
*/
|
||||
function getVotes(address account, uint256 timepoint) public view virtual returns (uint256) {
|
||||
return _getVotes(account, timepoint, _defaultParams());
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev See {IGovernor-getVotesWithParams}.
|
||||
*/
|
||||
function getVotesWithParams(
|
||||
address account,
|
||||
uint256 timepoint,
|
||||
bytes memory params
|
||||
) public view virtual returns (uint256) {
|
||||
return _getVotes(account, timepoint, params);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev See {IGovernor-castVote}.
|
||||
*/
|
||||
function castVote(uint256 proposalId, uint8 support) public virtual returns (uint256) {
|
||||
address voter = _msgSender();
|
||||
return _castVote(proposalId, voter, support, "");
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev See {IGovernor-castVoteWithReason}.
|
||||
*/
|
||||
function castVoteWithReason(
|
||||
uint256 proposalId,
|
||||
uint8 support,
|
||||
string calldata reason
|
||||
) public virtual returns (uint256) {
|
||||
address voter = _msgSender();
|
||||
return _castVote(proposalId, voter, support, reason);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev See {IGovernor-castVoteWithReasonAndParams}.
|
||||
*/
|
||||
function castVoteWithReasonAndParams(
|
||||
uint256 proposalId,
|
||||
uint8 support,
|
||||
string calldata reason,
|
||||
bytes memory params
|
||||
) public virtual returns (uint256) {
|
||||
address voter = _msgSender();
|
||||
return _castVote(proposalId, voter, support, reason, params);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev See {IGovernor-castVoteBySig}.
|
||||
*/
|
||||
function castVoteBySig(
|
||||
uint256 proposalId,
|
||||
uint8 support,
|
||||
address voter,
|
||||
bytes memory signature
|
||||
) public virtual returns (uint256) {
|
||||
bool valid = SignatureChecker.isValidSignatureNow(
|
||||
voter,
|
||||
_hashTypedDataV4(keccak256(abi.encode(BALLOT_TYPEHASH, proposalId, support, voter, _useNonce(voter)))),
|
||||
signature
|
||||
);
|
||||
|
||||
if (!valid) {
|
||||
revert GovernorInvalidSignature(voter);
|
||||
}
|
||||
|
||||
return _castVote(proposalId, voter, support, "");
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev See {IGovernor-castVoteWithReasonAndParamsBySig}.
|
||||
*/
|
||||
function castVoteWithReasonAndParamsBySig(
|
||||
uint256 proposalId,
|
||||
uint8 support,
|
||||
address voter,
|
||||
string calldata reason,
|
||||
bytes memory params,
|
||||
bytes memory signature
|
||||
) public virtual returns (uint256) {
|
||||
bool valid = SignatureChecker.isValidSignatureNow(
|
||||
voter,
|
||||
_hashTypedDataV4(
|
||||
keccak256(
|
||||
abi.encode(
|
||||
EXTENDED_BALLOT_TYPEHASH,
|
||||
proposalId,
|
||||
support,
|
||||
voter,
|
||||
_useNonce(voter),
|
||||
keccak256(bytes(reason)),
|
||||
keccak256(params)
|
||||
)
|
||||
)
|
||||
),
|
||||
signature
|
||||
);
|
||||
|
||||
if (!valid) {
|
||||
revert GovernorInvalidSignature(voter);
|
||||
}
|
||||
|
||||
return _castVote(proposalId, voter, support, reason, params);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Internal vote casting mechanism: Check that the vote is pending, that it has not been cast yet, retrieve
|
||||
* voting weight using {IGovernor-getVotes} and call the {_countVote} internal function. Uses the _defaultParams().
|
||||
*
|
||||
* Emits a {IGovernor-VoteCast} event.
|
||||
*/
|
||||
function _castVote(
|
||||
uint256 proposalId,
|
||||
address account,
|
||||
uint8 support,
|
||||
string memory reason
|
||||
) internal virtual returns (uint256) {
|
||||
return _castVote(proposalId, account, support, reason, _defaultParams());
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Internal vote casting mechanism: Check that the vote is pending, that it has not been cast yet, retrieve
|
||||
* voting weight using {IGovernor-getVotes} and call the {_countVote} internal function.
|
||||
*
|
||||
* Emits a {IGovernor-VoteCast} event.
|
||||
*/
|
||||
function _castVote(
|
||||
uint256 proposalId,
|
||||
address account,
|
||||
uint8 support,
|
||||
string memory reason,
|
||||
bytes memory params
|
||||
) internal virtual returns (uint256) {
|
||||
_validateStateBitmap(proposalId, _encodeStateBitmap(ProposalState.Active));
|
||||
|
||||
uint256 weight = _getVotes(account, proposalSnapshot(proposalId), params);
|
||||
_countVote(proposalId, account, support, weight, params);
|
||||
|
||||
if (params.length == 0) {
|
||||
emit VoteCast(account, proposalId, support, weight, reason);
|
||||
} else {
|
||||
emit VoteCastWithParams(account, proposalId, support, weight, reason, params);
|
||||
}
|
||||
|
||||
return weight;
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Relays a transaction or function call to an arbitrary target. In cases where the governance executor
|
||||
* is some contract other than the governor itself, like when using a timelock, this function can be invoked
|
||||
* in a governance proposal to recover tokens or Ether that was sent to the governor contract by mistake.
|
||||
* Note that if the executor is simply the governor itself, use of `relay` is redundant.
|
||||
*/
|
||||
function relay(address target, uint256 value, bytes calldata data) external payable virtual onlyGovernance {
|
||||
(bool success, bytes memory returndata) = target.call{value: value}(data);
|
||||
Address.verifyCallResult(success, returndata);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Address through which the governor executes action. Will be overloaded by module that execute actions
|
||||
* through another contract such as a timelock.
|
||||
*/
|
||||
function _executor() internal view virtual returns (address) {
|
||||
return address(this);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev See {IERC721Receiver-onERC721Received}.
|
||||
* Receiving tokens is disabled if the governance executor is other than the governor itself (eg. when using with a timelock).
|
||||
*/
|
||||
function onERC721Received(address, address, uint256, bytes memory) public virtual returns (bytes4) {
|
||||
if (_executor() != address(this)) {
|
||||
revert GovernorDisabledDeposit();
|
||||
}
|
||||
return this.onERC721Received.selector;
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev See {IERC1155Receiver-onERC1155Received}.
|
||||
* Receiving tokens is disabled if the governance executor is other than the governor itself (eg. when using with a timelock).
|
||||
*/
|
||||
function onERC1155Received(address, address, uint256, uint256, bytes memory) public virtual returns (bytes4) {
|
||||
if (_executor() != address(this)) {
|
||||
revert GovernorDisabledDeposit();
|
||||
}
|
||||
return this.onERC1155Received.selector;
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev See {IERC1155Receiver-onERC1155BatchReceived}.
|
||||
* Receiving tokens is disabled if the governance executor is other than the governor itself (eg. when using with a timelock).
|
||||
*/
|
||||
function onERC1155BatchReceived(
|
||||
address,
|
||||
address,
|
||||
uint256[] memory,
|
||||
uint256[] memory,
|
||||
bytes memory
|
||||
) public virtual returns (bytes4) {
|
||||
if (_executor() != address(this)) {
|
||||
revert GovernorDisabledDeposit();
|
||||
}
|
||||
return this.onERC1155BatchReceived.selector;
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Encodes a `ProposalState` into a `bytes32` representation where each bit enabled corresponds to
|
||||
* the underlying position in the `ProposalState` enum. For example:
|
||||
*
|
||||
* 0x000...10000
|
||||
* ^^^^^^------ ...
|
||||
* ^----- Succeeded
|
||||
* ^---- Defeated
|
||||
* ^--- Canceled
|
||||
* ^-- Active
|
||||
* ^- Pending
|
||||
*/
|
||||
function _encodeStateBitmap(ProposalState proposalState) internal pure returns (bytes32) {
|
||||
return bytes32(1 << uint8(proposalState));
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Check that the current state of a proposal matches the requirements described by the `allowedStates` bitmap.
|
||||
* This bitmap should be built using `_encodeStateBitmap`.
|
||||
*
|
||||
* If requirements are not met, reverts with a {GovernorUnexpectedProposalState} error.
|
||||
*/
|
||||
function _validateStateBitmap(uint256 proposalId, bytes32 allowedStates) private view returns (ProposalState) {
|
||||
ProposalState currentState = state(proposalId);
|
||||
if (_encodeStateBitmap(currentState) & allowedStates == bytes32(0)) {
|
||||
revert GovernorUnexpectedProposalState(proposalId, currentState, allowedStates);
|
||||
}
|
||||
return currentState;
|
||||
}
|
||||
|
||||
/*
|
||||
* @dev Check if the proposer is authorized to submit a proposal with the given description.
|
||||
*
|
||||
* If the proposal description ends with `#proposer=0x???`, where `0x???` is an address written as a hex string
|
||||
* (case insensitive), then the submission of this proposal will only be authorized to said address.
|
||||
*
|
||||
* This is used for frontrunning protection. By adding this pattern at the end of their proposal, one can ensure
|
||||
* that no other address can submit the same proposal. An attacker would have to either remove or change that part,
|
||||
* which would result in a different proposal id.
|
||||
*
|
||||
* If the description does not match this pattern, it is unrestricted and anyone can submit it. This includes:
|
||||
* - If the `0x???` part is not a valid hex string.
|
||||
* - If the `0x???` part is a valid hex string, but does not contain exactly 40 hex digits.
|
||||
* - If it ends with the expected suffix followed by newlines or other whitespace.
|
||||
* - If it ends with some other similar suffix, e.g. `#other=abc`.
|
||||
* - If it does not end with any such suffix.
|
||||
*/
|
||||
function _isValidDescriptionForProposer(
|
||||
address proposer,
|
||||
string memory description
|
||||
) internal view virtual returns (bool) {
|
||||
uint256 len = bytes(description).length;
|
||||
|
||||
// Length is too short to contain a valid proposer suffix
|
||||
if (len < 52) {
|
||||
return true;
|
||||
}
|
||||
|
||||
// Extract what would be the `#proposer=0x` marker beginning the suffix
|
||||
bytes12 marker;
|
||||
assembly {
|
||||
// - Start of the string contents in memory = description + 32
|
||||
// - First character of the marker = len - 52
|
||||
// - Length of "#proposer=0x0000000000000000000000000000000000000000" = 52
|
||||
// - We read the memory word starting at the first character of the marker:
|
||||
// - (description + 32) + (len - 52) = description + (len - 20)
|
||||
// - Note: Solidity will ignore anything past the first 12 bytes
|
||||
marker := mload(add(description, sub(len, 20)))
|
||||
}
|
||||
|
||||
// If the marker is not found, there is no proposer suffix to check
|
||||
if (marker != bytes12("#proposer=0x")) {
|
||||
return true;
|
||||
}
|
||||
|
||||
// Parse the 40 characters following the marker as uint160
|
||||
uint160 recovered = 0;
|
||||
for (uint256 i = len - 40; i < len; ++i) {
|
||||
(bool isHex, uint8 value) = _tryHexToUint(bytes(description)[i]);
|
||||
// If any of the characters is not a hex digit, ignore the suffix entirely
|
||||
if (!isHex) {
|
||||
return true;
|
||||
}
|
||||
recovered = (recovered << 4) | value;
|
||||
}
|
||||
|
||||
return recovered == uint160(proposer);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Try to parse a character from a string as a hex value. Returns `(true, value)` if the char is in
|
||||
* `[0-9a-fA-F]` and `(false, 0)` otherwise. Value is guaranteed to be in the range `0 <= value < 16`
|
||||
*/
|
||||
function _tryHexToUint(bytes1 char) private pure returns (bool, uint8) {
|
||||
uint8 c = uint8(char);
|
||||
unchecked {
|
||||
// Case 0-9
|
||||
if (47 < c && c < 58) {
|
||||
return (true, c - 48);
|
||||
}
|
||||
// Case A-F
|
||||
else if (64 < c && c < 71) {
|
||||
return (true, c - 55);
|
||||
}
|
||||
// Case a-f
|
||||
else if (96 < c && c < 103) {
|
||||
return (true, c - 87);
|
||||
}
|
||||
// Else: not a hex char
|
||||
else {
|
||||
return (false, 0);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* @inheritdoc IERC6372
|
||||
*/
|
||||
function clock() public view virtual returns (uint48);
|
||||
|
||||
/**
|
||||
* @inheritdoc IERC6372
|
||||
*/
|
||||
// solhint-disable-next-line func-name-mixedcase
|
||||
function CLOCK_MODE() public view virtual returns (string memory);
|
||||
|
||||
/**
|
||||
* @inheritdoc IGovernor
|
||||
*/
|
||||
function votingDelay() public view virtual returns (uint256);
|
||||
|
||||
/**
|
||||
* @inheritdoc IGovernor
|
||||
*/
|
||||
function votingPeriod() public view virtual returns (uint256);
|
||||
|
||||
/**
|
||||
* @inheritdoc IGovernor
|
||||
*/
|
||||
function quorum(uint256 timepoint) public view virtual returns (uint256);
|
||||
}
|
||||
433
lib_openzeppelin_contracts/contracts/governance/IGovernor.sol
Normal file
433
lib_openzeppelin_contracts/contracts/governance/IGovernor.sol
Normal file
@@ -0,0 +1,433 @@
|
||||
// SPDX-License-Identifier: MIT
|
||||
// OpenZeppelin Contracts (last updated v5.0.0) (governance/IGovernor.sol)
|
||||
|
||||
pragma solidity ^0.8.20;
|
||||
|
||||
import {IERC165} from "../interfaces/IERC165.sol";
|
||||
import {IERC6372} from "../interfaces/IERC6372.sol";
|
||||
|
||||
/**
|
||||
* @dev Interface of the {Governor} core.
|
||||
*/
|
||||
interface IGovernor is IERC165, IERC6372 {
|
||||
enum ProposalState {
|
||||
Pending,
|
||||
Active,
|
||||
Canceled,
|
||||
Defeated,
|
||||
Succeeded,
|
||||
Queued,
|
||||
Expired,
|
||||
Executed
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Empty proposal or a mismatch between the parameters length for a proposal call.
|
||||
*/
|
||||
error GovernorInvalidProposalLength(uint256 targets, uint256 calldatas, uint256 values);
|
||||
|
||||
/**
|
||||
* @dev The vote was already cast.
|
||||
*/
|
||||
error GovernorAlreadyCastVote(address voter);
|
||||
|
||||
/**
|
||||
* @dev Token deposits are disabled in this contract.
|
||||
*/
|
||||
error GovernorDisabledDeposit();
|
||||
|
||||
/**
|
||||
* @dev The `account` is not a proposer.
|
||||
*/
|
||||
error GovernorOnlyProposer(address account);
|
||||
|
||||
/**
|
||||
* @dev The `account` is not the governance executor.
|
||||
*/
|
||||
error GovernorOnlyExecutor(address account);
|
||||
|
||||
/**
|
||||
* @dev The `proposalId` doesn't exist.
|
||||
*/
|
||||
error GovernorNonexistentProposal(uint256 proposalId);
|
||||
|
||||
/**
|
||||
* @dev The current state of a proposal is not the required for performing an operation.
|
||||
* The `expectedStates` is a bitmap with the bits enabled for each ProposalState enum position
|
||||
* counting from right to left.
|
||||
*
|
||||
* NOTE: If `expectedState` is `bytes32(0)`, the proposal is expected to not be in any state (i.e. not exist).
|
||||
* This is the case when a proposal that is expected to be unset is already initiated (the proposal is duplicated).
|
||||
*
|
||||
* See {Governor-_encodeStateBitmap}.
|
||||
*/
|
||||
error GovernorUnexpectedProposalState(uint256 proposalId, ProposalState current, bytes32 expectedStates);
|
||||
|
||||
/**
|
||||
* @dev The voting period set is not a valid period.
|
||||
*/
|
||||
error GovernorInvalidVotingPeriod(uint256 votingPeriod);
|
||||
|
||||
/**
|
||||
* @dev The `proposer` does not have the required votes to create a proposal.
|
||||
*/
|
||||
error GovernorInsufficientProposerVotes(address proposer, uint256 votes, uint256 threshold);
|
||||
|
||||
/**
|
||||
* @dev The `proposer` is not allowed to create a proposal.
|
||||
*/
|
||||
error GovernorRestrictedProposer(address proposer);
|
||||
|
||||
/**
|
||||
* @dev The vote type used is not valid for the corresponding counting module.
|
||||
*/
|
||||
error GovernorInvalidVoteType();
|
||||
|
||||
/**
|
||||
* @dev Queue operation is not implemented for this governor. Execute should be called directly.
|
||||
*/
|
||||
error GovernorQueueNotImplemented();
|
||||
|
||||
/**
|
||||
* @dev The proposal hasn't been queued yet.
|
||||
*/
|
||||
error GovernorNotQueuedProposal(uint256 proposalId);
|
||||
|
||||
/**
|
||||
* @dev The proposal has already been queued.
|
||||
*/
|
||||
error GovernorAlreadyQueuedProposal(uint256 proposalId);
|
||||
|
||||
/**
|
||||
* @dev The provided signature is not valid for the expected `voter`.
|
||||
* If the `voter` is a contract, the signature is not valid using {IERC1271-isValidSignature}.
|
||||
*/
|
||||
error GovernorInvalidSignature(address voter);
|
||||
|
||||
/**
|
||||
* @dev Emitted when a proposal is created.
|
||||
*/
|
||||
event ProposalCreated(
|
||||
uint256 proposalId,
|
||||
address proposer,
|
||||
address[] targets,
|
||||
uint256[] values,
|
||||
string[] signatures,
|
||||
bytes[] calldatas,
|
||||
uint256 voteStart,
|
||||
uint256 voteEnd,
|
||||
string description
|
||||
);
|
||||
|
||||
/**
|
||||
* @dev Emitted when a proposal is queued.
|
||||
*/
|
||||
event ProposalQueued(uint256 proposalId, uint256 etaSeconds);
|
||||
|
||||
/**
|
||||
* @dev Emitted when a proposal is executed.
|
||||
*/
|
||||
event ProposalExecuted(uint256 proposalId);
|
||||
|
||||
/**
|
||||
* @dev Emitted when a proposal is canceled.
|
||||
*/
|
||||
event ProposalCanceled(uint256 proposalId);
|
||||
|
||||
/**
|
||||
* @dev Emitted when a vote is cast without params.
|
||||
*
|
||||
* Note: `support` values should be seen as buckets. Their interpretation depends on the voting module used.
|
||||
*/
|
||||
event VoteCast(address indexed voter, uint256 proposalId, uint8 support, uint256 weight, string reason);
|
||||
|
||||
/**
|
||||
* @dev Emitted when a vote is cast with params.
|
||||
*
|
||||
* Note: `support` values should be seen as buckets. Their interpretation depends on the voting module used.
|
||||
* `params` are additional encoded parameters. Their interpepretation also depends on the voting module used.
|
||||
*/
|
||||
event VoteCastWithParams(
|
||||
address indexed voter,
|
||||
uint256 proposalId,
|
||||
uint8 support,
|
||||
uint256 weight,
|
||||
string reason,
|
||||
bytes params
|
||||
);
|
||||
|
||||
/**
|
||||
* @notice module:core
|
||||
* @dev Name of the governor instance (used in building the EIP-712 domain separator).
|
||||
*/
|
||||
function name() external view returns (string memory);
|
||||
|
||||
/**
|
||||
* @notice module:core
|
||||
* @dev Version of the governor instance (used in building the EIP-712 domain separator). Default: "1"
|
||||
*/
|
||||
function version() external view returns (string memory);
|
||||
|
||||
/**
|
||||
* @notice module:voting
|
||||
* @dev A description of the possible `support` values for {castVote} and the way these votes are counted, meant to
|
||||
* be consumed by UIs to show correct vote options and interpret the results. The string is a URL-encoded sequence of
|
||||
* key-value pairs that each describe one aspect, for example `support=bravo&quorum=for,abstain`.
|
||||
*
|
||||
* There are 2 standard keys: `support` and `quorum`.
|
||||
*
|
||||
* - `support=bravo` refers to the vote options 0 = Against, 1 = For, 2 = Abstain, as in `GovernorBravo`.
|
||||
* - `quorum=bravo` means that only For votes are counted towards quorum.
|
||||
* - `quorum=for,abstain` means that both For and Abstain votes are counted towards quorum.
|
||||
*
|
||||
* If a counting module makes use of encoded `params`, it should include this under a `params` key with a unique
|
||||
* name that describes the behavior. For example:
|
||||
*
|
||||
* - `params=fractional` might refer to a scheme where votes are divided fractionally between for/against/abstain.
|
||||
* - `params=erc721` might refer to a scheme where specific NFTs are delegated to vote.
|
||||
*
|
||||
* NOTE: The string can be decoded by the standard
|
||||
* https://developer.mozilla.org/en-US/docs/Web/API/URLSearchParams[`URLSearchParams`]
|
||||
* JavaScript class.
|
||||
*/
|
||||
// solhint-disable-next-line func-name-mixedcase
|
||||
function COUNTING_MODE() external view returns (string memory);
|
||||
|
||||
/**
|
||||
* @notice module:core
|
||||
* @dev Hashing function used to (re)build the proposal id from the proposal details..
|
||||
*/
|
||||
function hashProposal(
|
||||
address[] memory targets,
|
||||
uint256[] memory values,
|
||||
bytes[] memory calldatas,
|
||||
bytes32 descriptionHash
|
||||
) external pure returns (uint256);
|
||||
|
||||
/**
|
||||
* @notice module:core
|
||||
* @dev Current state of a proposal, following Compound's convention
|
||||
*/
|
||||
function state(uint256 proposalId) external view returns (ProposalState);
|
||||
|
||||
/**
|
||||
* @notice module:core
|
||||
* @dev The number of votes required in order for a voter to become a proposer.
|
||||
*/
|
||||
function proposalThreshold() external view returns (uint256);
|
||||
|
||||
/**
|
||||
* @notice module:core
|
||||
* @dev Timepoint used to retrieve user's votes and quorum. If using block number (as per Compound's Comp), the
|
||||
* snapshot is performed at the end of this block. Hence, voting for this proposal starts at the beginning of the
|
||||
* following block.
|
||||
*/
|
||||
function proposalSnapshot(uint256 proposalId) external view returns (uint256);
|
||||
|
||||
/**
|
||||
* @notice module:core
|
||||
* @dev Timepoint at which votes close. If using block number, votes close at the end of this block, so it is
|
||||
* possible to cast a vote during this block.
|
||||
*/
|
||||
function proposalDeadline(uint256 proposalId) external view returns (uint256);
|
||||
|
||||
/**
|
||||
* @notice module:core
|
||||
* @dev The account that created a proposal.
|
||||
*/
|
||||
function proposalProposer(uint256 proposalId) external view returns (address);
|
||||
|
||||
/**
|
||||
* @notice module:core
|
||||
* @dev The time when a queued proposal becomes executable ("ETA"). Unlike {proposalSnapshot} and
|
||||
* {proposalDeadline}, this doesn't use the governor clock, and instead relies on the executor's clock which may be
|
||||
* different. In most cases this will be a timestamp.
|
||||
*/
|
||||
function proposalEta(uint256 proposalId) external view returns (uint256);
|
||||
|
||||
/**
|
||||
* @notice module:core
|
||||
* @dev Whether a proposal needs to be queued before execution.
|
||||
*/
|
||||
function proposalNeedsQueuing(uint256 proposalId) external view returns (bool);
|
||||
|
||||
/**
|
||||
* @notice module:user-config
|
||||
* @dev Delay, between the proposal is created and the vote starts. The unit this duration is expressed in depends
|
||||
* on the clock (see ERC-6372) this contract uses.
|
||||
*
|
||||
* This can be increased to leave time for users to buy voting power, or delegate it, before the voting of a
|
||||
* proposal starts.
|
||||
*
|
||||
* NOTE: While this interface returns a uint256, timepoints are stored as uint48 following the ERC-6372 clock type.
|
||||
* Consequently this value must fit in a uint48 (when added to the current clock). See {IERC6372-clock}.
|
||||
*/
|
||||
function votingDelay() external view returns (uint256);
|
||||
|
||||
/**
|
||||
* @notice module:user-config
|
||||
* @dev Delay between the vote start and vote end. The unit this duration is expressed in depends on the clock
|
||||
* (see ERC-6372) this contract uses.
|
||||
*
|
||||
* NOTE: The {votingDelay} can delay the start of the vote. This must be considered when setting the voting
|
||||
* duration compared to the voting delay.
|
||||
*
|
||||
* NOTE: This value is stored when the proposal is submitted so that possible changes to the value do not affect
|
||||
* proposals that have already been submitted. The type used to save it is a uint32. Consequently, while this
|
||||
* interface returns a uint256, the value it returns should fit in a uint32.
|
||||
*/
|
||||
function votingPeriod() external view returns (uint256);
|
||||
|
||||
/**
|
||||
* @notice module:user-config
|
||||
* @dev Minimum number of cast voted required for a proposal to be successful.
|
||||
*
|
||||
* NOTE: The `timepoint` parameter corresponds to the snapshot used for counting vote. This allows to scale the
|
||||
* quorum depending on values such as the totalSupply of a token at this timepoint (see {ERC20Votes}).
|
||||
*/
|
||||
function quorum(uint256 timepoint) external view returns (uint256);
|
||||
|
||||
/**
|
||||
* @notice module:reputation
|
||||
* @dev Voting power of an `account` at a specific `timepoint`.
|
||||
*
|
||||
* Note: this can be implemented in a number of ways, for example by reading the delegated balance from one (or
|
||||
* multiple), {ERC20Votes} tokens.
|
||||
*/
|
||||
function getVotes(address account, uint256 timepoint) external view returns (uint256);
|
||||
|
||||
/**
|
||||
* @notice module:reputation
|
||||
* @dev Voting power of an `account` at a specific `timepoint` given additional encoded parameters.
|
||||
*/
|
||||
function getVotesWithParams(
|
||||
address account,
|
||||
uint256 timepoint,
|
||||
bytes memory params
|
||||
) external view returns (uint256);
|
||||
|
||||
/**
|
||||
* @notice module:voting
|
||||
* @dev Returns whether `account` has cast a vote on `proposalId`.
|
||||
*/
|
||||
function hasVoted(uint256 proposalId, address account) external view returns (bool);
|
||||
|
||||
/**
|
||||
* @dev Create a new proposal. Vote start after a delay specified by {IGovernor-votingDelay} and lasts for a
|
||||
* duration specified by {IGovernor-votingPeriod}.
|
||||
*
|
||||
* Emits a {ProposalCreated} event.
|
||||
*
|
||||
* NOTE: The state of the Governor and `targets` may change between the proposal creation and its execution.
|
||||
* This may be the result of third party actions on the targeted contracts, or other governor proposals.
|
||||
* For example, the balance of this contract could be updated or its access control permissions may be modified,
|
||||
* possibly compromising the proposal's ability to execute successfully (e.g. the governor doesn't have enough
|
||||
* value to cover a proposal with multiple transfers).
|
||||
*/
|
||||
function propose(
|
||||
address[] memory targets,
|
||||
uint256[] memory values,
|
||||
bytes[] memory calldatas,
|
||||
string memory description
|
||||
) external returns (uint256 proposalId);
|
||||
|
||||
/**
|
||||
* @dev Queue a proposal. Some governors require this step to be performed before execution can happen. If queuing
|
||||
* is not necessary, this function may revert.
|
||||
* Queuing a proposal requires the quorum to be reached, the vote to be successful, and the deadline to be reached.
|
||||
*
|
||||
* Emits a {ProposalQueued} event.
|
||||
*/
|
||||
function queue(
|
||||
address[] memory targets,
|
||||
uint256[] memory values,
|
||||
bytes[] memory calldatas,
|
||||
bytes32 descriptionHash
|
||||
) external returns (uint256 proposalId);
|
||||
|
||||
/**
|
||||
* @dev Execute a successful proposal. This requires the quorum to be reached, the vote to be successful, and the
|
||||
* deadline to be reached. Depending on the governor it might also be required that the proposal was queued and
|
||||
* that some delay passed.
|
||||
*
|
||||
* Emits a {ProposalExecuted} event.
|
||||
*
|
||||
* NOTE: Some modules can modify the requirements for execution, for example by adding an additional timelock.
|
||||
*/
|
||||
function execute(
|
||||
address[] memory targets,
|
||||
uint256[] memory values,
|
||||
bytes[] memory calldatas,
|
||||
bytes32 descriptionHash
|
||||
) external payable returns (uint256 proposalId);
|
||||
|
||||
/**
|
||||
* @dev Cancel a proposal. A proposal is cancellable by the proposer, but only while it is Pending state, i.e.
|
||||
* before the vote starts.
|
||||
*
|
||||
* Emits a {ProposalCanceled} event.
|
||||
*/
|
||||
function cancel(
|
||||
address[] memory targets,
|
||||
uint256[] memory values,
|
||||
bytes[] memory calldatas,
|
||||
bytes32 descriptionHash
|
||||
) external returns (uint256 proposalId);
|
||||
|
||||
/**
|
||||
* @dev Cast a vote
|
||||
*
|
||||
* Emits a {VoteCast} event.
|
||||
*/
|
||||
function castVote(uint256 proposalId, uint8 support) external returns (uint256 balance);
|
||||
|
||||
/**
|
||||
* @dev Cast a vote with a reason
|
||||
*
|
||||
* Emits a {VoteCast} event.
|
||||
*/
|
||||
function castVoteWithReason(
|
||||
uint256 proposalId,
|
||||
uint8 support,
|
||||
string calldata reason
|
||||
) external returns (uint256 balance);
|
||||
|
||||
/**
|
||||
* @dev Cast a vote with a reason and additional encoded parameters
|
||||
*
|
||||
* Emits a {VoteCast} or {VoteCastWithParams} event depending on the length of params.
|
||||
*/
|
||||
function castVoteWithReasonAndParams(
|
||||
uint256 proposalId,
|
||||
uint8 support,
|
||||
string calldata reason,
|
||||
bytes memory params
|
||||
) external returns (uint256 balance);
|
||||
|
||||
/**
|
||||
* @dev Cast a vote using the voter's signature, including ERC-1271 signature support.
|
||||
*
|
||||
* Emits a {VoteCast} event.
|
||||
*/
|
||||
function castVoteBySig(
|
||||
uint256 proposalId,
|
||||
uint8 support,
|
||||
address voter,
|
||||
bytes memory signature
|
||||
) external returns (uint256 balance);
|
||||
|
||||
/**
|
||||
* @dev Cast a vote with a reason and additional encoded parameters using the voter's signature,
|
||||
* including ERC-1271 signature support.
|
||||
*
|
||||
* Emits a {VoteCast} or {VoteCastWithParams} event depending on the length of params.
|
||||
*/
|
||||
function castVoteWithReasonAndParamsBySig(
|
||||
uint256 proposalId,
|
||||
uint8 support,
|
||||
address voter,
|
||||
string calldata reason,
|
||||
bytes memory params,
|
||||
bytes memory signature
|
||||
) external returns (uint256 balance);
|
||||
}
|
||||
171
lib_openzeppelin_contracts/contracts/governance/README.adoc
Normal file
171
lib_openzeppelin_contracts/contracts/governance/README.adoc
Normal file
@@ -0,0 +1,171 @@
|
||||
= Governance
|
||||
|
||||
[.readme-notice]
|
||||
NOTE: This document is better viewed at https://docs.openzeppelin.com/contracts/api/governance
|
||||
|
||||
This directory includes primitives for on-chain governance.
|
||||
|
||||
== Governor
|
||||
|
||||
This modular system of Governor contracts allows the deployment on-chain voting protocols similar to https://compound.finance/docs/governance[Compound's Governor Alpha & Bravo] and beyond, through the ability to easily customize multiple aspects of the protocol.
|
||||
|
||||
[TIP]
|
||||
====
|
||||
For a guided experience, set up your Governor contract using https://wizard.openzeppelin.com/#governor[Contracts Wizard].
|
||||
|
||||
For a written walkthrough, check out our guide on xref:ROOT:governance.adoc[How to set up on-chain governance].
|
||||
====
|
||||
|
||||
* {Governor}: The core contract that contains all the logic and primitives. It is abstract and requires choosing one of each of the modules below, or custom ones.
|
||||
|
||||
Votes modules determine the source of voting power, and sometimes quorum number.
|
||||
|
||||
* {GovernorVotes}: Extracts voting weight from an {ERC20Votes}, or since v4.5 an {ERC721Votes} token.
|
||||
|
||||
* {GovernorVotesQuorumFraction}: Combines with `GovernorVotes` to set the quorum as a fraction of the total token supply.
|
||||
|
||||
Counting modules determine valid voting options.
|
||||
|
||||
* {GovernorCountingSimple}: Simple voting mechanism with 3 voting options: Against, For and Abstain.
|
||||
|
||||
Timelock extensions add a delay for governance decisions to be executed. The workflow is extended to require a `queue` step before execution. With these modules, proposals are executed by the external timelock contract, thus it is the timelock that has to hold the assets that are being governed.
|
||||
|
||||
* {GovernorTimelockAccess}: Connects with an instance of an {AccessManager}. This allows restrictions (and delays) enforced by the manager to be considered by the Governor and integrated into the AccessManager's "schedule + execute" workflow.
|
||||
|
||||
* {GovernorTimelockControl}: Connects with an instance of {TimelockController}. Allows multiple proposers and executors, in addition to the Governor itself.
|
||||
|
||||
* {GovernorTimelockCompound}: Connects with an instance of Compound's https://github.com/compound-finance/compound-protocol/blob/master/contracts/Timelock.sol[`Timelock`] contract.
|
||||
|
||||
Other extensions can customize the behavior or interface in multiple ways.
|
||||
|
||||
* {GovernorStorage}: Stores the proposal details onchain and provides enumerability of the proposals. This can be useful for some L2 chains where storage is cheap compared to calldata.
|
||||
|
||||
* {GovernorSettings}: Manages some of the settings (voting delay, voting period duration, and proposal threshold) in a way that can be updated through a governance proposal, without requiring an upgrade.
|
||||
|
||||
* {GovernorPreventLateQuorum}: Ensures there is a minimum voting period after quorum is reached as a security protection against large voters.
|
||||
|
||||
In addition to modules and extensions, the core contract requires a few virtual functions to be implemented to your particular specifications:
|
||||
|
||||
* <<Governor-votingDelay-,`votingDelay()`>>: Delay (in ERC-6372 clock) since the proposal is submitted until voting power is fixed and voting starts. This can be used to enforce a delay after a proposal is published for users to buy tokens, or delegate their votes.
|
||||
* <<Governor-votingPeriod-,`votingPeriod()`>>: Delay (in ERC-6372 clock) since the proposal starts until voting ends.
|
||||
* <<Governor-quorum-uint256-,`quorum(uint256 timepoint)`>>: Quorum required for a proposal to be successful. This function includes a `timepoint` argument (see ERC-6372) so the quorum can adapt through time, for example, to follow a token's `totalSupply`.
|
||||
|
||||
NOTE: Functions of the `Governor` contract do not include access control. If you want to restrict access, you should add these checks by overloading the particular functions. Among these, {Governor-_cancel} is internal by default, and you will have to expose it (with the right access control mechanism) yourself if this function is needed.
|
||||
|
||||
=== Core
|
||||
|
||||
{{IGovernor}}
|
||||
|
||||
{{Governor}}
|
||||
|
||||
=== Modules
|
||||
|
||||
{{GovernorCountingSimple}}
|
||||
|
||||
{{GovernorVotes}}
|
||||
|
||||
{{GovernorVotesQuorumFraction}}
|
||||
|
||||
=== Extensions
|
||||
|
||||
{{GovernorTimelockAccess}}
|
||||
|
||||
{{GovernorTimelockControl}}
|
||||
|
||||
{{GovernorTimelockCompound}}
|
||||
|
||||
{{GovernorSettings}}
|
||||
|
||||
{{GovernorPreventLateQuorum}}
|
||||
|
||||
{{GovernorStorage}}
|
||||
|
||||
== Utils
|
||||
|
||||
{{Votes}}
|
||||
|
||||
== Timelock
|
||||
|
||||
In a governance system, the {TimelockController} contract is in charge of introducing a delay between a proposal and its execution. It can be used with or without a {Governor}.
|
||||
|
||||
{{TimelockController}}
|
||||
|
||||
[[timelock-terminology]]
|
||||
==== Terminology
|
||||
|
||||
* *Operation:* A transaction (or a set of transactions) that is the subject of the timelock. It has to be scheduled by a proposer and executed by an executor. The timelock enforces a minimum delay between the proposition and the execution (see xref:access-control.adoc#operation_lifecycle[operation lifecycle]). If the operation contains multiple transactions (batch mode), they are executed atomically. Operations are identified by the hash of their content.
|
||||
* *Operation status:*
|
||||
** *Unset:* An operation that is not part of the timelock mechanism.
|
||||
** *Waiting:* An operation that has been scheduled, before the timer expires.
|
||||
** *Ready:* An operation that has been scheduled, after the timer expires.
|
||||
** *Pending:* An operation that is either waiting or ready.
|
||||
** *Done:* An operation that has been executed.
|
||||
* *Predecessor*: An (optional) dependency between operations. An operation can depend on another operation (its predecessor), forcing the execution order of these two operations.
|
||||
* *Role*:
|
||||
** *Admin:* An address (smart contract or EOA) that is in charge of granting the roles of Proposer and Executor.
|
||||
** *Proposer:* An address (smart contract or EOA) that is in charge of scheduling (and cancelling) operations.
|
||||
** *Executor:* An address (smart contract or EOA) that is in charge of executing operations once the timelock has expired. This role can be given to the zero address to allow anyone to execute operations.
|
||||
|
||||
[[timelock-operation]]
|
||||
==== Operation structure
|
||||
|
||||
Operation executed by the xref:api:governance.adoc#TimelockController[`TimelockController`] can contain one or multiple subsequent calls. Depending on whether you need to multiple calls to be executed atomically, you can either use simple or batched operations.
|
||||
|
||||
Both operations contain:
|
||||
|
||||
* *Target*, the address of the smart contract that the timelock should operate on.
|
||||
* *Value*, in wei, that should be sent with the transaction. Most of the time this will be 0. Ether can be deposited before-end or passed along when executing the transaction.
|
||||
* *Data*, containing the encoded function selector and parameters of the call. This can be produced using a number of tools. For example, a maintenance operation granting role `ROLE` to `ACCOUNT` can be encoded using web3js as follows:
|
||||
|
||||
```javascript
|
||||
const data = timelock.contract.methods.grantRole(ROLE, ACCOUNT).encodeABI()
|
||||
```
|
||||
|
||||
* *Predecessor*, that specifies a dependency between operations. This dependency is optional. Use `bytes32(0)` if the operation does not have any dependency.
|
||||
* *Salt*, used to disambiguate two otherwise identical operations. This can be any random value.
|
||||
|
||||
In the case of batched operations, `target`, `value` and `data` are specified as arrays, which must be of the same length.
|
||||
|
||||
[[timelock-operation-lifecycle]]
|
||||
==== Operation lifecycle
|
||||
|
||||
Timelocked operations are identified by a unique id (their hash) and follow a specific lifecycle:
|
||||
|
||||
`Unset` -> `Pending` -> `Pending` + `Ready` -> `Done`
|
||||
|
||||
* By calling xref:api:governance.adoc#TimelockController-schedule-address-uint256-bytes-bytes32-bytes32-uint256-[`schedule`] (or xref:api:governance.adoc#TimelockController-scheduleBatch-address---uint256---bytes---bytes32-bytes32-uint256-[`scheduleBatch`]), a proposer moves the operation from the `Unset` to the `Pending` state. This starts a timer that must be longer than the minimum delay. The timer expires at a timestamp accessible through the xref:api:governance.adoc#TimelockController-getTimestamp-bytes32-[`getTimestamp`] method.
|
||||
* Once the timer expires, the operation automatically gets the `Ready` state. At this point, it can be executed.
|
||||
* By calling xref:api:governance.adoc#TimelockController-TimelockController-execute-address-uint256-bytes-bytes32-bytes32-[`execute`] (or xref:api:governance.adoc#TimelockController-executeBatch-address---uint256---bytes---bytes32-bytes32-[`executeBatch`]), an executor triggers the operation's underlying transactions and moves it to the `Done` state. If the operation has a predecessor, it has to be in the `Done` state for this transition to succeed.
|
||||
* xref:api:governance.adoc#TimelockController-TimelockController-cancel-bytes32-[`cancel`] allows proposers to cancel any `Pending` operation. This resets the operation to the `Unset` state. It is thus possible for a proposer to re-schedule an operation that has been cancelled. In this case, the timer restarts when the operation is re-scheduled.
|
||||
|
||||
Operations status can be queried using the functions:
|
||||
|
||||
* xref:api:governance.adoc#TimelockController-isOperationPending-bytes32-[`isOperationPending(bytes32)`]
|
||||
* xref:api:governance.adoc#TimelockController-isOperationReady-bytes32-[`isOperationReady(bytes32)`]
|
||||
* xref:api:governance.adoc#TimelockController-isOperationDone-bytes32-[`isOperationDone(bytes32)`]
|
||||
|
||||
[[timelock-roles]]
|
||||
==== Roles
|
||||
|
||||
[[timelock-admin]]
|
||||
===== Admin
|
||||
|
||||
The admins are in charge of managing proposers and executors. For the timelock to be self-governed, this role should only be given to the timelock itself. Upon deployment, the admin role can be granted to any address (in addition to the timelock itself). After further configuration and testing, this optional admin should renounce its role such that all further maintenance operations have to go through the timelock process.
|
||||
|
||||
[[timelock-proposer]]
|
||||
===== Proposer
|
||||
|
||||
The proposers are in charge of scheduling (and cancelling) operations. This is a critical role, that should be given to governing entities. This could be an EOA, a multisig, or a DAO.
|
||||
|
||||
WARNING: *Proposer fight:* Having multiple proposers, while providing redundancy in case one becomes unavailable, can be dangerous. As proposer have their say on all operations, they could cancel operations they disagree with, including operations to remove them for the proposers.
|
||||
|
||||
This role is identified by the *PROPOSER_ROLE* value: `0xb09aa5aeb3702cfd50b6b62bc4532604938f21248a27a1d5ca736082b6819cc1`
|
||||
|
||||
[[timelock-executor]]
|
||||
===== Executor
|
||||
|
||||
The executors are in charge of executing the operations scheduled by the proposers once the timelock expires. Logic dictates that multisig or DAO that are proposers should also be executors in order to guarantee operations that have been scheduled will eventually be executed. However, having additional executors can reduce the cost (the executing transaction does not require validation by the multisig or DAO that proposed it), while ensuring whoever is in charge of execution cannot trigger actions that have not been scheduled by the proposers. Alternatively, it is possible to allow _any_ address to execute a proposal once the timelock has expired by granting the executor role to the zero address.
|
||||
|
||||
This role is identified by the *EXECUTOR_ROLE* value: `0xd8aa0f3194971a2a116679f7c2090f6939c8d4e01a2a8d7e41d55e5351469e63`
|
||||
|
||||
WARNING: A live contract without at least one proposer and one executor is locked. Make sure these roles are filled by reliable entities before the deployer renounces its administrative rights in favour of the timelock contract itself. See the {AccessControl} documentation to learn more about role management.
|
||||
@@ -0,0 +1,472 @@
|
||||
// SPDX-License-Identifier: MIT
|
||||
// OpenZeppelin Contracts (last updated v5.0.0) (governance/TimelockController.sol)
|
||||
|
||||
pragma solidity ^0.8.20;
|
||||
|
||||
import {AccessControl} from "../access/AccessControl.sol";
|
||||
import {ERC721Holder} from "../token/ERC721/utils/ERC721Holder.sol";
|
||||
import {ERC1155Holder} from "../token/ERC1155/utils/ERC1155Holder.sol";
|
||||
import {Address} from "../utils/Address.sol";
|
||||
|
||||
/**
|
||||
* @dev Contract module which acts as a timelocked controller. When set as the
|
||||
* owner of an `Ownable` smart contract, it enforces a timelock on all
|
||||
* `onlyOwner` maintenance operations. This gives time for users of the
|
||||
* controlled contract to exit before a potentially dangerous maintenance
|
||||
* operation is applied.
|
||||
*
|
||||
* By default, this contract is self administered, meaning administration tasks
|
||||
* have to go through the timelock process. The proposer (resp executor) role
|
||||
* is in charge of proposing (resp executing) operations. A common use case is
|
||||
* to position this {TimelockController} as the owner of a smart contract, with
|
||||
* a multisig or a DAO as the sole proposer.
|
||||
*/
|
||||
contract TimelockController is AccessControl, ERC721Holder, ERC1155Holder {
|
||||
bytes32 public constant PROPOSER_ROLE = keccak256("PROPOSER_ROLE");
|
||||
bytes32 public constant EXECUTOR_ROLE = keccak256("EXECUTOR_ROLE");
|
||||
bytes32 public constant CANCELLER_ROLE = keccak256("CANCELLER_ROLE");
|
||||
uint256 internal constant _DONE_TIMESTAMP = uint256(1);
|
||||
|
||||
mapping(bytes32 id => uint256) private _timestamps;
|
||||
uint256 private _minDelay;
|
||||
|
||||
enum OperationState {
|
||||
Unset,
|
||||
Waiting,
|
||||
Ready,
|
||||
Done
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Mismatch between the parameters length for an operation call.
|
||||
*/
|
||||
error TimelockInvalidOperationLength(uint256 targets, uint256 payloads, uint256 values);
|
||||
|
||||
/**
|
||||
* @dev The schedule operation doesn't meet the minimum delay.
|
||||
*/
|
||||
error TimelockInsufficientDelay(uint256 delay, uint256 minDelay);
|
||||
|
||||
/**
|
||||
* @dev The current state of an operation is not as required.
|
||||
* The `expectedStates` is a bitmap with the bits enabled for each OperationState enum position
|
||||
* counting from right to left.
|
||||
*
|
||||
* See {_encodeStateBitmap}.
|
||||
*/
|
||||
error TimelockUnexpectedOperationState(bytes32 operationId, bytes32 expectedStates);
|
||||
|
||||
/**
|
||||
* @dev The predecessor to an operation not yet done.
|
||||
*/
|
||||
error TimelockUnexecutedPredecessor(bytes32 predecessorId);
|
||||
|
||||
/**
|
||||
* @dev The caller account is not authorized.
|
||||
*/
|
||||
error TimelockUnauthorizedCaller(address caller);
|
||||
|
||||
/**
|
||||
* @dev Emitted when a call is scheduled as part of operation `id`.
|
||||
*/
|
||||
event CallScheduled(
|
||||
bytes32 indexed id,
|
||||
uint256 indexed index,
|
||||
address target,
|
||||
uint256 value,
|
||||
bytes data,
|
||||
bytes32 predecessor,
|
||||
uint256 delay
|
||||
);
|
||||
|
||||
/**
|
||||
* @dev Emitted when a call is performed as part of operation `id`.
|
||||
*/
|
||||
event CallExecuted(bytes32 indexed id, uint256 indexed index, address target, uint256 value, bytes data);
|
||||
|
||||
/**
|
||||
* @dev Emitted when new proposal is scheduled with non-zero salt.
|
||||
*/
|
||||
event CallSalt(bytes32 indexed id, bytes32 salt);
|
||||
|
||||
/**
|
||||
* @dev Emitted when operation `id` is cancelled.
|
||||
*/
|
||||
event Cancelled(bytes32 indexed id);
|
||||
|
||||
/**
|
||||
* @dev Emitted when the minimum delay for future operations is modified.
|
||||
*/
|
||||
event MinDelayChange(uint256 oldDuration, uint256 newDuration);
|
||||
|
||||
/**
|
||||
* @dev Initializes the contract with the following parameters:
|
||||
*
|
||||
* - `minDelay`: initial minimum delay in seconds for operations
|
||||
* - `proposers`: accounts to be granted proposer and canceller roles
|
||||
* - `executors`: accounts to be granted executor role
|
||||
* - `admin`: optional account to be granted admin role; disable with zero address
|
||||
*
|
||||
* IMPORTANT: The optional admin can aid with initial configuration of roles after deployment
|
||||
* without being subject to delay, but this role should be subsequently renounced in favor of
|
||||
* administration through timelocked proposals. Previous versions of this contract would assign
|
||||
* this admin to the deployer automatically and should be renounced as well.
|
||||
*/
|
||||
constructor(uint256 minDelay, address[] memory proposers, address[] memory executors, address admin) {
|
||||
// self administration
|
||||
_grantRole(DEFAULT_ADMIN_ROLE, address(this));
|
||||
|
||||
// optional admin
|
||||
if (admin != address(0)) {
|
||||
_grantRole(DEFAULT_ADMIN_ROLE, admin);
|
||||
}
|
||||
|
||||
// register proposers and cancellers
|
||||
for (uint256 i = 0; i < proposers.length; ++i) {
|
||||
_grantRole(PROPOSER_ROLE, proposers[i]);
|
||||
_grantRole(CANCELLER_ROLE, proposers[i]);
|
||||
}
|
||||
|
||||
// register executors
|
||||
for (uint256 i = 0; i < executors.length; ++i) {
|
||||
_grantRole(EXECUTOR_ROLE, executors[i]);
|
||||
}
|
||||
|
||||
_minDelay = minDelay;
|
||||
emit MinDelayChange(0, minDelay);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Modifier to make a function callable only by a certain role. In
|
||||
* addition to checking the sender's role, `address(0)` 's role is also
|
||||
* considered. Granting a role to `address(0)` is equivalent to enabling
|
||||
* this role for everyone.
|
||||
*/
|
||||
modifier onlyRoleOrOpenRole(bytes32 role) {
|
||||
if (!hasRole(role, address(0))) {
|
||||
_checkRole(role, _msgSender());
|
||||
}
|
||||
_;
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Contract might receive/hold ETH as part of the maintenance process.
|
||||
*/
|
||||
receive() external payable {}
|
||||
|
||||
/**
|
||||
* @dev See {IERC165-supportsInterface}.
|
||||
*/
|
||||
function supportsInterface(
|
||||
bytes4 interfaceId
|
||||
) public view virtual override(AccessControl, ERC1155Holder) returns (bool) {
|
||||
return super.supportsInterface(interfaceId);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Returns whether an id corresponds to a registered operation. This
|
||||
* includes both Waiting, Ready, and Done operations.
|
||||
*/
|
||||
function isOperation(bytes32 id) public view returns (bool) {
|
||||
return getOperationState(id) != OperationState.Unset;
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Returns whether an operation is pending or not. Note that a "pending" operation may also be "ready".
|
||||
*/
|
||||
function isOperationPending(bytes32 id) public view returns (bool) {
|
||||
OperationState state = getOperationState(id);
|
||||
return state == OperationState.Waiting || state == OperationState.Ready;
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Returns whether an operation is ready for execution. Note that a "ready" operation is also "pending".
|
||||
*/
|
||||
function isOperationReady(bytes32 id) public view returns (bool) {
|
||||
return getOperationState(id) == OperationState.Ready;
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Returns whether an operation is done or not.
|
||||
*/
|
||||
function isOperationDone(bytes32 id) public view returns (bool) {
|
||||
return getOperationState(id) == OperationState.Done;
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Returns the timestamp at which an operation becomes ready (0 for
|
||||
* unset operations, 1 for done operations).
|
||||
*/
|
||||
function getTimestamp(bytes32 id) public view virtual returns (uint256) {
|
||||
return _timestamps[id];
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Returns operation state.
|
||||
*/
|
||||
function getOperationState(bytes32 id) public view virtual returns (OperationState) {
|
||||
uint256 timestamp = getTimestamp(id);
|
||||
if (timestamp == 0) {
|
||||
return OperationState.Unset;
|
||||
} else if (timestamp == _DONE_TIMESTAMP) {
|
||||
return OperationState.Done;
|
||||
} else if (timestamp > block.timestamp) {
|
||||
return OperationState.Waiting;
|
||||
} else {
|
||||
return OperationState.Ready;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Returns the minimum delay in seconds for an operation to become valid.
|
||||
*
|
||||
* This value can be changed by executing an operation that calls `updateDelay`.
|
||||
*/
|
||||
function getMinDelay() public view virtual returns (uint256) {
|
||||
return _minDelay;
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Returns the identifier of an operation containing a single
|
||||
* transaction.
|
||||
*/
|
||||
function hashOperation(
|
||||
address target,
|
||||
uint256 value,
|
||||
bytes calldata data,
|
||||
bytes32 predecessor,
|
||||
bytes32 salt
|
||||
) public pure virtual returns (bytes32) {
|
||||
return keccak256(abi.encode(target, value, data, predecessor, salt));
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Returns the identifier of an operation containing a batch of
|
||||
* transactions.
|
||||
*/
|
||||
function hashOperationBatch(
|
||||
address[] calldata targets,
|
||||
uint256[] calldata values,
|
||||
bytes[] calldata payloads,
|
||||
bytes32 predecessor,
|
||||
bytes32 salt
|
||||
) public pure virtual returns (bytes32) {
|
||||
return keccak256(abi.encode(targets, values, payloads, predecessor, salt));
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Schedule an operation containing a single transaction.
|
||||
*
|
||||
* Emits {CallSalt} if salt is nonzero, and {CallScheduled}.
|
||||
*
|
||||
* Requirements:
|
||||
*
|
||||
* - the caller must have the 'proposer' role.
|
||||
*/
|
||||
function schedule(
|
||||
address target,
|
||||
uint256 value,
|
||||
bytes calldata data,
|
||||
bytes32 predecessor,
|
||||
bytes32 salt,
|
||||
uint256 delay
|
||||
) public virtual onlyRole(PROPOSER_ROLE) {
|
||||
bytes32 id = hashOperation(target, value, data, predecessor, salt);
|
||||
_schedule(id, delay);
|
||||
emit CallScheduled(id, 0, target, value, data, predecessor, delay);
|
||||
if (salt != bytes32(0)) {
|
||||
emit CallSalt(id, salt);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Schedule an operation containing a batch of transactions.
|
||||
*
|
||||
* Emits {CallSalt} if salt is nonzero, and one {CallScheduled} event per transaction in the batch.
|
||||
*
|
||||
* Requirements:
|
||||
*
|
||||
* - the caller must have the 'proposer' role.
|
||||
*/
|
||||
function scheduleBatch(
|
||||
address[] calldata targets,
|
||||
uint256[] calldata values,
|
||||
bytes[] calldata payloads,
|
||||
bytes32 predecessor,
|
||||
bytes32 salt,
|
||||
uint256 delay
|
||||
) public virtual onlyRole(PROPOSER_ROLE) {
|
||||
if (targets.length != values.length || targets.length != payloads.length) {
|
||||
revert TimelockInvalidOperationLength(targets.length, payloads.length, values.length);
|
||||
}
|
||||
|
||||
bytes32 id = hashOperationBatch(targets, values, payloads, predecessor, salt);
|
||||
_schedule(id, delay);
|
||||
for (uint256 i = 0; i < targets.length; ++i) {
|
||||
emit CallScheduled(id, i, targets[i], values[i], payloads[i], predecessor, delay);
|
||||
}
|
||||
if (salt != bytes32(0)) {
|
||||
emit CallSalt(id, salt);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Schedule an operation that is to become valid after a given delay.
|
||||
*/
|
||||
function _schedule(bytes32 id, uint256 delay) private {
|
||||
if (isOperation(id)) {
|
||||
revert TimelockUnexpectedOperationState(id, _encodeStateBitmap(OperationState.Unset));
|
||||
}
|
||||
uint256 minDelay = getMinDelay();
|
||||
if (delay < minDelay) {
|
||||
revert TimelockInsufficientDelay(delay, minDelay);
|
||||
}
|
||||
_timestamps[id] = block.timestamp + delay;
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Cancel an operation.
|
||||
*
|
||||
* Requirements:
|
||||
*
|
||||
* - the caller must have the 'canceller' role.
|
||||
*/
|
||||
function cancel(bytes32 id) public virtual onlyRole(CANCELLER_ROLE) {
|
||||
if (!isOperationPending(id)) {
|
||||
revert TimelockUnexpectedOperationState(
|
||||
id,
|
||||
_encodeStateBitmap(OperationState.Waiting) | _encodeStateBitmap(OperationState.Ready)
|
||||
);
|
||||
}
|
||||
delete _timestamps[id];
|
||||
|
||||
emit Cancelled(id);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Execute an (ready) operation containing a single transaction.
|
||||
*
|
||||
* Emits a {CallExecuted} event.
|
||||
*
|
||||
* Requirements:
|
||||
*
|
||||
* - the caller must have the 'executor' role.
|
||||
*/
|
||||
// This function can reenter, but it doesn't pose a risk because _afterCall checks that the proposal is pending,
|
||||
// thus any modifications to the operation during reentrancy should be caught.
|
||||
// slither-disable-next-line reentrancy-eth
|
||||
function execute(
|
||||
address target,
|
||||
uint256 value,
|
||||
bytes calldata payload,
|
||||
bytes32 predecessor,
|
||||
bytes32 salt
|
||||
) public payable virtual onlyRoleOrOpenRole(EXECUTOR_ROLE) {
|
||||
bytes32 id = hashOperation(target, value, payload, predecessor, salt);
|
||||
|
||||
_beforeCall(id, predecessor);
|
||||
_execute(target, value, payload);
|
||||
emit CallExecuted(id, 0, target, value, payload);
|
||||
_afterCall(id);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Execute an (ready) operation containing a batch of transactions.
|
||||
*
|
||||
* Emits one {CallExecuted} event per transaction in the batch.
|
||||
*
|
||||
* Requirements:
|
||||
*
|
||||
* - the caller must have the 'executor' role.
|
||||
*/
|
||||
// This function can reenter, but it doesn't pose a risk because _afterCall checks that the proposal is pending,
|
||||
// thus any modifications to the operation during reentrancy should be caught.
|
||||
// slither-disable-next-line reentrancy-eth
|
||||
function executeBatch(
|
||||
address[] calldata targets,
|
||||
uint256[] calldata values,
|
||||
bytes[] calldata payloads,
|
||||
bytes32 predecessor,
|
||||
bytes32 salt
|
||||
) public payable virtual onlyRoleOrOpenRole(EXECUTOR_ROLE) {
|
||||
if (targets.length != values.length || targets.length != payloads.length) {
|
||||
revert TimelockInvalidOperationLength(targets.length, payloads.length, values.length);
|
||||
}
|
||||
|
||||
bytes32 id = hashOperationBatch(targets, values, payloads, predecessor, salt);
|
||||
|
||||
_beforeCall(id, predecessor);
|
||||
for (uint256 i = 0; i < targets.length; ++i) {
|
||||
address target = targets[i];
|
||||
uint256 value = values[i];
|
||||
bytes calldata payload = payloads[i];
|
||||
_execute(target, value, payload);
|
||||
emit CallExecuted(id, i, target, value, payload);
|
||||
}
|
||||
_afterCall(id);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Execute an operation's call.
|
||||
*/
|
||||
function _execute(address target, uint256 value, bytes calldata data) internal virtual {
|
||||
(bool success, bytes memory returndata) = target.call{value: value}(data);
|
||||
Address.verifyCallResult(success, returndata);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Checks before execution of an operation's calls.
|
||||
*/
|
||||
function _beforeCall(bytes32 id, bytes32 predecessor) private view {
|
||||
if (!isOperationReady(id)) {
|
||||
revert TimelockUnexpectedOperationState(id, _encodeStateBitmap(OperationState.Ready));
|
||||
}
|
||||
if (predecessor != bytes32(0) && !isOperationDone(predecessor)) {
|
||||
revert TimelockUnexecutedPredecessor(predecessor);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Checks after execution of an operation's calls.
|
||||
*/
|
||||
function _afterCall(bytes32 id) private {
|
||||
if (!isOperationReady(id)) {
|
||||
revert TimelockUnexpectedOperationState(id, _encodeStateBitmap(OperationState.Ready));
|
||||
}
|
||||
_timestamps[id] = _DONE_TIMESTAMP;
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Changes the minimum timelock duration for future operations.
|
||||
*
|
||||
* Emits a {MinDelayChange} event.
|
||||
*
|
||||
* Requirements:
|
||||
*
|
||||
* - the caller must be the timelock itself. This can only be achieved by scheduling and later executing
|
||||
* an operation where the timelock is the target and the data is the ABI-encoded call to this function.
|
||||
*/
|
||||
function updateDelay(uint256 newDelay) external virtual {
|
||||
address sender = _msgSender();
|
||||
if (sender != address(this)) {
|
||||
revert TimelockUnauthorizedCaller(sender);
|
||||
}
|
||||
emit MinDelayChange(_minDelay, newDelay);
|
||||
_minDelay = newDelay;
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Encodes a `OperationState` into a `bytes32` representation where each bit enabled corresponds to
|
||||
* the underlying position in the `OperationState` enum. For example:
|
||||
*
|
||||
* 0x000...1000
|
||||
* ^^^^^^----- ...
|
||||
* ^---- Done
|
||||
* ^--- Ready
|
||||
* ^-- Waiting
|
||||
* ^- Unset
|
||||
*/
|
||||
function _encodeStateBitmap(OperationState operationState) internal pure returns (bytes32) {
|
||||
return bytes32(1 << uint8(operationState));
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,100 @@
|
||||
// SPDX-License-Identifier: MIT
|
||||
// OpenZeppelin Contracts (last updated v5.0.0) (governance/extensions/GovernorCountingSimple.sol)
|
||||
|
||||
pragma solidity ^0.8.20;
|
||||
|
||||
import {Governor} from "../Governor.sol";
|
||||
|
||||
/**
|
||||
* @dev Extension of {Governor} for simple, 3 options, vote counting.
|
||||
*/
|
||||
abstract contract GovernorCountingSimple is Governor {
|
||||
/**
|
||||
* @dev Supported vote types. Matches Governor Bravo ordering.
|
||||
*/
|
||||
enum VoteType {
|
||||
Against,
|
||||
For,
|
||||
Abstain
|
||||
}
|
||||
|
||||
struct ProposalVote {
|
||||
uint256 againstVotes;
|
||||
uint256 forVotes;
|
||||
uint256 abstainVotes;
|
||||
mapping(address voter => bool) hasVoted;
|
||||
}
|
||||
|
||||
mapping(uint256 proposalId => ProposalVote) private _proposalVotes;
|
||||
|
||||
/**
|
||||
* @dev See {IGovernor-COUNTING_MODE}.
|
||||
*/
|
||||
// solhint-disable-next-line func-name-mixedcase
|
||||
function COUNTING_MODE() public pure virtual override returns (string memory) {
|
||||
return "support=bravo&quorum=for,abstain";
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev See {IGovernor-hasVoted}.
|
||||
*/
|
||||
function hasVoted(uint256 proposalId, address account) public view virtual override returns (bool) {
|
||||
return _proposalVotes[proposalId].hasVoted[account];
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Accessor to the internal vote counts.
|
||||
*/
|
||||
function proposalVotes(
|
||||
uint256 proposalId
|
||||
) public view virtual returns (uint256 againstVotes, uint256 forVotes, uint256 abstainVotes) {
|
||||
ProposalVote storage proposalVote = _proposalVotes[proposalId];
|
||||
return (proposalVote.againstVotes, proposalVote.forVotes, proposalVote.abstainVotes);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev See {Governor-_quorumReached}.
|
||||
*/
|
||||
function _quorumReached(uint256 proposalId) internal view virtual override returns (bool) {
|
||||
ProposalVote storage proposalVote = _proposalVotes[proposalId];
|
||||
|
||||
return quorum(proposalSnapshot(proposalId)) <= proposalVote.forVotes + proposalVote.abstainVotes;
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev See {Governor-_voteSucceeded}. In this module, the forVotes must be strictly over the againstVotes.
|
||||
*/
|
||||
function _voteSucceeded(uint256 proposalId) internal view virtual override returns (bool) {
|
||||
ProposalVote storage proposalVote = _proposalVotes[proposalId];
|
||||
|
||||
return proposalVote.forVotes > proposalVote.againstVotes;
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev See {Governor-_countVote}. In this module, the support follows the `VoteType` enum (from Governor Bravo).
|
||||
*/
|
||||
function _countVote(
|
||||
uint256 proposalId,
|
||||
address account,
|
||||
uint8 support,
|
||||
uint256 weight,
|
||||
bytes memory // params
|
||||
) internal virtual override {
|
||||
ProposalVote storage proposalVote = _proposalVotes[proposalId];
|
||||
|
||||
if (proposalVote.hasVoted[account]) {
|
||||
revert GovernorAlreadyCastVote(account);
|
||||
}
|
||||
proposalVote.hasVoted[account] = true;
|
||||
|
||||
if (support == uint8(VoteType.Against)) {
|
||||
proposalVote.againstVotes += weight;
|
||||
} else if (support == uint8(VoteType.For)) {
|
||||
proposalVote.forVotes += weight;
|
||||
} else if (support == uint8(VoteType.Abstain)) {
|
||||
proposalVote.abstainVotes += weight;
|
||||
} else {
|
||||
revert GovernorInvalidVoteType();
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,102 @@
|
||||
// SPDX-License-Identifier: MIT
|
||||
// OpenZeppelin Contracts (last updated v5.0.0) (governance/extensions/GovernorPreventLateQuorum.sol)
|
||||
|
||||
pragma solidity ^0.8.20;
|
||||
|
||||
import {Governor} from "../Governor.sol";
|
||||
import {Math} from "../../utils/math/Math.sol";
|
||||
|
||||
/**
|
||||
* @dev A module that ensures there is a minimum voting period after quorum is reached. This prevents a large voter from
|
||||
* swaying a vote and triggering quorum at the last minute, by ensuring there is always time for other voters to react
|
||||
* and try to oppose the decision.
|
||||
*
|
||||
* If a vote causes quorum to be reached, the proposal's voting period may be extended so that it does not end before at
|
||||
* least a specified time has passed (the "vote extension" parameter). This parameter can be set through a governance
|
||||
* proposal.
|
||||
*/
|
||||
abstract contract GovernorPreventLateQuorum is Governor {
|
||||
uint48 private _voteExtension;
|
||||
|
||||
mapping(uint256 proposalId => uint48) private _extendedDeadlines;
|
||||
|
||||
/// @dev Emitted when a proposal deadline is pushed back due to reaching quorum late in its voting period.
|
||||
event ProposalExtended(uint256 indexed proposalId, uint64 extendedDeadline);
|
||||
|
||||
/// @dev Emitted when the {lateQuorumVoteExtension} parameter is changed.
|
||||
event LateQuorumVoteExtensionSet(uint64 oldVoteExtension, uint64 newVoteExtension);
|
||||
|
||||
/**
|
||||
* @dev Initializes the vote extension parameter: the time in either number of blocks or seconds (depending on the
|
||||
* governor clock mode) that is required to pass since the moment a proposal reaches quorum until its voting period
|
||||
* ends. If necessary the voting period will be extended beyond the one set during proposal creation.
|
||||
*/
|
||||
constructor(uint48 initialVoteExtension) {
|
||||
_setLateQuorumVoteExtension(initialVoteExtension);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Returns the proposal deadline, which may have been extended beyond that set at proposal creation, if the
|
||||
* proposal reached quorum late in the voting period. See {Governor-proposalDeadline}.
|
||||
*/
|
||||
function proposalDeadline(uint256 proposalId) public view virtual override returns (uint256) {
|
||||
return Math.max(super.proposalDeadline(proposalId), _extendedDeadlines[proposalId]);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Casts a vote and detects if it caused quorum to be reached, potentially extending the voting period. See
|
||||
* {Governor-_castVote}.
|
||||
*
|
||||
* May emit a {ProposalExtended} event.
|
||||
*/
|
||||
function _castVote(
|
||||
uint256 proposalId,
|
||||
address account,
|
||||
uint8 support,
|
||||
string memory reason,
|
||||
bytes memory params
|
||||
) internal virtual override returns (uint256) {
|
||||
uint256 result = super._castVote(proposalId, account, support, reason, params);
|
||||
|
||||
if (_extendedDeadlines[proposalId] == 0 && _quorumReached(proposalId)) {
|
||||
uint48 extendedDeadline = clock() + lateQuorumVoteExtension();
|
||||
|
||||
if (extendedDeadline > proposalDeadline(proposalId)) {
|
||||
emit ProposalExtended(proposalId, extendedDeadline);
|
||||
}
|
||||
|
||||
_extendedDeadlines[proposalId] = extendedDeadline;
|
||||
}
|
||||
|
||||
return result;
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Returns the current value of the vote extension parameter: the number of blocks that are required to pass
|
||||
* from the time a proposal reaches quorum until its voting period ends.
|
||||
*/
|
||||
function lateQuorumVoteExtension() public view virtual returns (uint48) {
|
||||
return _voteExtension;
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Changes the {lateQuorumVoteExtension}. This operation can only be performed by the governance executor,
|
||||
* generally through a governance proposal.
|
||||
*
|
||||
* Emits a {LateQuorumVoteExtensionSet} event.
|
||||
*/
|
||||
function setLateQuorumVoteExtension(uint48 newVoteExtension) public virtual onlyGovernance {
|
||||
_setLateQuorumVoteExtension(newVoteExtension);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Changes the {lateQuorumVoteExtension}. This is an internal function that can be exposed in a public function
|
||||
* like {setLateQuorumVoteExtension} if another access control mechanism is needed.
|
||||
*
|
||||
* Emits a {LateQuorumVoteExtensionSet} event.
|
||||
*/
|
||||
function _setLateQuorumVoteExtension(uint48 newVoteExtension) internal virtual {
|
||||
emit LateQuorumVoteExtensionSet(_voteExtension, newVoteExtension);
|
||||
_voteExtension = newVoteExtension;
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,112 @@
|
||||
// SPDX-License-Identifier: MIT
|
||||
// OpenZeppelin Contracts (last updated v5.0.0) (governance/extensions/GovernorSettings.sol)
|
||||
|
||||
pragma solidity ^0.8.20;
|
||||
|
||||
import {Governor} from "../Governor.sol";
|
||||
|
||||
/**
|
||||
* @dev Extension of {Governor} for settings updatable through governance.
|
||||
*/
|
||||
abstract contract GovernorSettings is Governor {
|
||||
// amount of token
|
||||
uint256 private _proposalThreshold;
|
||||
// timepoint: limited to uint48 in core (same as clock() type)
|
||||
uint48 private _votingDelay;
|
||||
// duration: limited to uint32 in core
|
||||
uint32 private _votingPeriod;
|
||||
|
||||
event VotingDelaySet(uint256 oldVotingDelay, uint256 newVotingDelay);
|
||||
event VotingPeriodSet(uint256 oldVotingPeriod, uint256 newVotingPeriod);
|
||||
event ProposalThresholdSet(uint256 oldProposalThreshold, uint256 newProposalThreshold);
|
||||
|
||||
/**
|
||||
* @dev Initialize the governance parameters.
|
||||
*/
|
||||
constructor(uint48 initialVotingDelay, uint32 initialVotingPeriod, uint256 initialProposalThreshold) {
|
||||
_setVotingDelay(initialVotingDelay);
|
||||
_setVotingPeriod(initialVotingPeriod);
|
||||
_setProposalThreshold(initialProposalThreshold);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev See {IGovernor-votingDelay}.
|
||||
*/
|
||||
function votingDelay() public view virtual override returns (uint256) {
|
||||
return _votingDelay;
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev See {IGovernor-votingPeriod}.
|
||||
*/
|
||||
function votingPeriod() public view virtual override returns (uint256) {
|
||||
return _votingPeriod;
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev See {Governor-proposalThreshold}.
|
||||
*/
|
||||
function proposalThreshold() public view virtual override returns (uint256) {
|
||||
return _proposalThreshold;
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Update the voting delay. This operation can only be performed through a governance proposal.
|
||||
*
|
||||
* Emits a {VotingDelaySet} event.
|
||||
*/
|
||||
function setVotingDelay(uint48 newVotingDelay) public virtual onlyGovernance {
|
||||
_setVotingDelay(newVotingDelay);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Update the voting period. This operation can only be performed through a governance proposal.
|
||||
*
|
||||
* Emits a {VotingPeriodSet} event.
|
||||
*/
|
||||
function setVotingPeriod(uint32 newVotingPeriod) public virtual onlyGovernance {
|
||||
_setVotingPeriod(newVotingPeriod);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Update the proposal threshold. This operation can only be performed through a governance proposal.
|
||||
*
|
||||
* Emits a {ProposalThresholdSet} event.
|
||||
*/
|
||||
function setProposalThreshold(uint256 newProposalThreshold) public virtual onlyGovernance {
|
||||
_setProposalThreshold(newProposalThreshold);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Internal setter for the voting delay.
|
||||
*
|
||||
* Emits a {VotingDelaySet} event.
|
||||
*/
|
||||
function _setVotingDelay(uint48 newVotingDelay) internal virtual {
|
||||
emit VotingDelaySet(_votingDelay, newVotingDelay);
|
||||
_votingDelay = newVotingDelay;
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Internal setter for the voting period.
|
||||
*
|
||||
* Emits a {VotingPeriodSet} event.
|
||||
*/
|
||||
function _setVotingPeriod(uint32 newVotingPeriod) internal virtual {
|
||||
if (newVotingPeriod == 0) {
|
||||
revert GovernorInvalidVotingPeriod(0);
|
||||
}
|
||||
emit VotingPeriodSet(_votingPeriod, newVotingPeriod);
|
||||
_votingPeriod = newVotingPeriod;
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Internal setter for the proposal threshold.
|
||||
*
|
||||
* Emits a {ProposalThresholdSet} event.
|
||||
*/
|
||||
function _setProposalThreshold(uint256 newProposalThreshold) internal virtual {
|
||||
emit ProposalThresholdSet(_proposalThreshold, newProposalThreshold);
|
||||
_proposalThreshold = newProposalThreshold;
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,115 @@
|
||||
// SPDX-License-Identifier: MIT
|
||||
// OpenZeppelin Contracts (last updated v5.0.0) (governance/extensions/GovernorStorage.sol)
|
||||
|
||||
pragma solidity ^0.8.20;
|
||||
|
||||
import {Governor} from "../Governor.sol";
|
||||
|
||||
/**
|
||||
* @dev Extension of {Governor} that implements storage of proposal details. This modules also provides primitives for
|
||||
* the enumerability of proposals.
|
||||
*
|
||||
* Use cases for this module include:
|
||||
* - UIs that explore the proposal state without relying on event indexing.
|
||||
* - Using only the proposalId as an argument in the {Governor-queue} and {Governor-execute} functions for L2 chains
|
||||
* where storage is cheap compared to calldata.
|
||||
*/
|
||||
abstract contract GovernorStorage is Governor {
|
||||
struct ProposalDetails {
|
||||
address[] targets;
|
||||
uint256[] values;
|
||||
bytes[] calldatas;
|
||||
bytes32 descriptionHash;
|
||||
}
|
||||
|
||||
uint256[] private _proposalIds;
|
||||
mapping(uint256 proposalId => ProposalDetails) private _proposalDetails;
|
||||
|
||||
/**
|
||||
* @dev Hook into the proposing mechanism
|
||||
*/
|
||||
function _propose(
|
||||
address[] memory targets,
|
||||
uint256[] memory values,
|
||||
bytes[] memory calldatas,
|
||||
string memory description,
|
||||
address proposer
|
||||
) internal virtual override returns (uint256) {
|
||||
uint256 proposalId = super._propose(targets, values, calldatas, description, proposer);
|
||||
|
||||
// store
|
||||
_proposalIds.push(proposalId);
|
||||
_proposalDetails[proposalId] = ProposalDetails({
|
||||
targets: targets,
|
||||
values: values,
|
||||
calldatas: calldatas,
|
||||
descriptionHash: keccak256(bytes(description))
|
||||
});
|
||||
|
||||
return proposalId;
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Version of {IGovernorTimelock-queue} with only `proposalId` as an argument.
|
||||
*/
|
||||
function queue(uint256 proposalId) public virtual {
|
||||
// here, using storage is more efficient than memory
|
||||
ProposalDetails storage details = _proposalDetails[proposalId];
|
||||
queue(details.targets, details.values, details.calldatas, details.descriptionHash);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Version of {IGovernor-execute} with only `proposalId` as an argument.
|
||||
*/
|
||||
function execute(uint256 proposalId) public payable virtual {
|
||||
// here, using storage is more efficient than memory
|
||||
ProposalDetails storage details = _proposalDetails[proposalId];
|
||||
execute(details.targets, details.values, details.calldatas, details.descriptionHash);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev ProposalId version of {IGovernor-cancel}.
|
||||
*/
|
||||
function cancel(uint256 proposalId) public virtual {
|
||||
// here, using storage is more efficient than memory
|
||||
ProposalDetails storage details = _proposalDetails[proposalId];
|
||||
cancel(details.targets, details.values, details.calldatas, details.descriptionHash);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Returns the number of stored proposals.
|
||||
*/
|
||||
function proposalCount() public view virtual returns (uint256) {
|
||||
return _proposalIds.length;
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Returns the details of a proposalId. Reverts if `proposalId` is not a known proposal.
|
||||
*/
|
||||
function proposalDetails(
|
||||
uint256 proposalId
|
||||
) public view virtual returns (address[] memory, uint256[] memory, bytes[] memory, bytes32) {
|
||||
// here, using memory is more efficient than storage
|
||||
ProposalDetails memory details = _proposalDetails[proposalId];
|
||||
if (details.descriptionHash == 0) {
|
||||
revert GovernorNonexistentProposal(proposalId);
|
||||
}
|
||||
return (details.targets, details.values, details.calldatas, details.descriptionHash);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Returns the details (including the proposalId) of a proposal given its sequential index.
|
||||
*/
|
||||
function proposalDetailsAt(
|
||||
uint256 index
|
||||
) public view virtual returns (uint256, address[] memory, uint256[] memory, bytes[] memory, bytes32) {
|
||||
uint256 proposalId = _proposalIds[index];
|
||||
(
|
||||
address[] memory targets,
|
||||
uint256[] memory values,
|
||||
bytes[] memory calldatas,
|
||||
bytes32 descriptionHash
|
||||
) = proposalDetails(proposalId);
|
||||
return (proposalId, targets, values, calldatas, descriptionHash);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,349 @@
|
||||
// SPDX-License-Identifier: MIT
|
||||
// OpenZeppelin Contracts (last updated v5.0.0) (governance/extensions/GovernorTimelockAccess.sol)
|
||||
|
||||
pragma solidity ^0.8.20;
|
||||
|
||||
import {Governor} from "../Governor.sol";
|
||||
import {AuthorityUtils} from "../../access/manager/AuthorityUtils.sol";
|
||||
import {IAccessManager} from "../../access/manager/IAccessManager.sol";
|
||||
import {Address} from "../../utils/Address.sol";
|
||||
import {Math} from "../../utils/math/Math.sol";
|
||||
import {SafeCast} from "../../utils/math/SafeCast.sol";
|
||||
import {Time} from "../../utils/types/Time.sol";
|
||||
|
||||
/**
|
||||
* @dev This module connects a {Governor} instance to an {AccessManager} instance, allowing the governor to make calls
|
||||
* that are delay-restricted by the manager using the normal {queue} workflow. An optional base delay is applied to
|
||||
* operations that are not delayed externally by the manager. Execution of a proposal will be delayed as much as
|
||||
* necessary to meet the required delays of all of its operations.
|
||||
*
|
||||
* This extension allows the governor to hold and use its own assets and permissions, unlike {GovernorTimelockControl}
|
||||
* and {GovernorTimelockCompound}, where the timelock is a separate contract that must be the one to hold assets and
|
||||
* permissions. Operations that are delay-restricted by the manager, however, will be executed through the
|
||||
* {AccessManager-execute} function.
|
||||
*
|
||||
* ==== Security Considerations
|
||||
*
|
||||
* Some operations may be cancelable in the `AccessManager` by the admin or a set of guardians, depending on the
|
||||
* restricted function being invoked. Since proposals are atomic, the cancellation by a guardian of a single operation
|
||||
* in a proposal will cause all of the proposal to become unable to execute. Consider proposing cancellable operations
|
||||
* separately.
|
||||
*
|
||||
* By default, function calls will be routed through the associated `AccessManager` whenever it claims the target
|
||||
* function to be restricted by it. However, admins may configure the manager to make that claim for functions that a
|
||||
* governor would want to call directly (e.g., token transfers) in an attempt to deny it access to those functions. To
|
||||
* mitigate this attack vector, the governor is able to ignore the restrictions claimed by the `AccessManager` using
|
||||
* {setAccessManagerIgnored}. While permanent denial of service is mitigated, temporary DoS may still be technically
|
||||
* possible. All of the governor's own functions (e.g., {setBaseDelaySeconds}) ignore the `AccessManager` by default.
|
||||
*
|
||||
* NOTE: `AccessManager` does not support scheduling more than one operation with the same target and calldata at
|
||||
* the same time. See {AccessManager-schedule} for a workaround.
|
||||
*/
|
||||
abstract contract GovernorTimelockAccess is Governor {
|
||||
// An execution plan is produced at the moment a proposal is created, in order to fix at that point the exact
|
||||
// execution semantics of the proposal, namely whether a call will go through {AccessManager-execute}.
|
||||
struct ExecutionPlan {
|
||||
uint16 length;
|
||||
uint32 delay;
|
||||
// We use mappings instead of arrays because it allows us to pack values in storage more tightly without
|
||||
// storing the length redundantly.
|
||||
// We pack 8 operations' data in each bucket. Each uint32 value is set to 1 upon proposal creation if it has
|
||||
// to be scheduled and executed through the manager. Upon queuing, the value is set to nonce + 2, where the
|
||||
// nonce is received from the manager when scheduling the operation.
|
||||
mapping(uint256 operationBucket => uint32[8]) managerData;
|
||||
}
|
||||
|
||||
// The meaning of the "toggle" set to true depends on the target contract.
|
||||
// If target == address(this), the manager is ignored by default, and a true toggle means it won't be ignored.
|
||||
// For all other target contracts, the manager is used by default, and a true toggle means it will be ignored.
|
||||
mapping(address target => mapping(bytes4 selector => bool)) private _ignoreToggle;
|
||||
|
||||
mapping(uint256 proposalId => ExecutionPlan) private _executionPlan;
|
||||
|
||||
uint32 private _baseDelay;
|
||||
|
||||
IAccessManager private immutable _manager;
|
||||
|
||||
error GovernorUnmetDelay(uint256 proposalId, uint256 neededTimestamp);
|
||||
error GovernorMismatchedNonce(uint256 proposalId, uint256 expectedNonce, uint256 actualNonce);
|
||||
error GovernorLockedIgnore();
|
||||
|
||||
event BaseDelaySet(uint32 oldBaseDelaySeconds, uint32 newBaseDelaySeconds);
|
||||
event AccessManagerIgnoredSet(address target, bytes4 selector, bool ignored);
|
||||
|
||||
/**
|
||||
* @dev Initialize the governor with an {AccessManager} and initial base delay.
|
||||
*/
|
||||
constructor(address manager, uint32 initialBaseDelay) {
|
||||
_manager = IAccessManager(manager);
|
||||
_setBaseDelaySeconds(initialBaseDelay);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Returns the {AccessManager} instance associated to this governor.
|
||||
*/
|
||||
function accessManager() public view virtual returns (IAccessManager) {
|
||||
return _manager;
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Base delay that will be applied to all function calls. Some may be further delayed by their associated
|
||||
* `AccessManager` authority; in this case the final delay will be the maximum of the base delay and the one
|
||||
* demanded by the authority.
|
||||
*
|
||||
* NOTE: Execution delays are processed by the `AccessManager` contracts, and according to that contract are
|
||||
* expressed in seconds. Therefore, the base delay is also in seconds, regardless of the governor's clock mode.
|
||||
*/
|
||||
function baseDelaySeconds() public view virtual returns (uint32) {
|
||||
return _baseDelay;
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Change the value of {baseDelaySeconds}. This operation can only be invoked through a governance proposal.
|
||||
*/
|
||||
function setBaseDelaySeconds(uint32 newBaseDelay) public virtual onlyGovernance {
|
||||
_setBaseDelaySeconds(newBaseDelay);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Change the value of {baseDelaySeconds}. Internal function without access control.
|
||||
*/
|
||||
function _setBaseDelaySeconds(uint32 newBaseDelay) internal virtual {
|
||||
emit BaseDelaySet(_baseDelay, newBaseDelay);
|
||||
_baseDelay = newBaseDelay;
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Check if restrictions from the associated {AccessManager} are ignored for a target function. Returns true
|
||||
* when the target function will be invoked directly regardless of `AccessManager` settings for the function.
|
||||
* See {setAccessManagerIgnored} and Security Considerations above.
|
||||
*/
|
||||
function isAccessManagerIgnored(address target, bytes4 selector) public view virtual returns (bool) {
|
||||
bool isGovernor = target == address(this);
|
||||
return _ignoreToggle[target][selector] != isGovernor; // equivalent to: isGovernor ? !toggle : toggle
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Configure whether restrictions from the associated {AccessManager} are ignored for a target function.
|
||||
* See Security Considerations above.
|
||||
*/
|
||||
function setAccessManagerIgnored(
|
||||
address target,
|
||||
bytes4[] calldata selectors,
|
||||
bool ignored
|
||||
) public virtual onlyGovernance {
|
||||
for (uint256 i = 0; i < selectors.length; ++i) {
|
||||
_setAccessManagerIgnored(target, selectors[i], ignored);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Internal version of {setAccessManagerIgnored} without access restriction.
|
||||
*/
|
||||
function _setAccessManagerIgnored(address target, bytes4 selector, bool ignored) internal virtual {
|
||||
bool isGovernor = target == address(this);
|
||||
if (isGovernor && selector == this.setAccessManagerIgnored.selector) {
|
||||
revert GovernorLockedIgnore();
|
||||
}
|
||||
_ignoreToggle[target][selector] = ignored != isGovernor; // equivalent to: isGovernor ? !ignored : ignored
|
||||
emit AccessManagerIgnoredSet(target, selector, ignored);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Public accessor to check the execution plan, including the number of seconds that the proposal will be
|
||||
* delayed since queuing, an array indicating which of the proposal actions will be executed indirectly through
|
||||
* the associated {AccessManager}, and another indicating which will be scheduled in {queue}. Note that
|
||||
* those that must be scheduled are cancellable by `AccessManager` guardians.
|
||||
*/
|
||||
function proposalExecutionPlan(
|
||||
uint256 proposalId
|
||||
) public view returns (uint32 delay, bool[] memory indirect, bool[] memory withDelay) {
|
||||
ExecutionPlan storage plan = _executionPlan[proposalId];
|
||||
|
||||
uint32 length = plan.length;
|
||||
delay = plan.delay;
|
||||
indirect = new bool[](length);
|
||||
withDelay = new bool[](length);
|
||||
for (uint256 i = 0; i < length; ++i) {
|
||||
(indirect[i], withDelay[i], ) = _getManagerData(plan, i);
|
||||
}
|
||||
|
||||
return (delay, indirect, withDelay);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev See {IGovernor-proposalNeedsQueuing}.
|
||||
*/
|
||||
function proposalNeedsQueuing(uint256 proposalId) public view virtual override returns (bool) {
|
||||
return _executionPlan[proposalId].delay > 0;
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev See {IGovernor-propose}
|
||||
*/
|
||||
function propose(
|
||||
address[] memory targets,
|
||||
uint256[] memory values,
|
||||
bytes[] memory calldatas,
|
||||
string memory description
|
||||
) public virtual override returns (uint256) {
|
||||
uint256 proposalId = super.propose(targets, values, calldatas, description);
|
||||
|
||||
uint32 neededDelay = baseDelaySeconds();
|
||||
|
||||
ExecutionPlan storage plan = _executionPlan[proposalId];
|
||||
plan.length = SafeCast.toUint16(targets.length);
|
||||
|
||||
for (uint256 i = 0; i < targets.length; ++i) {
|
||||
if (calldatas[i].length < 4) {
|
||||
continue;
|
||||
}
|
||||
address target = targets[i];
|
||||
bytes4 selector = bytes4(calldatas[i]);
|
||||
(bool immediate, uint32 delay) = AuthorityUtils.canCallWithDelay(
|
||||
address(_manager),
|
||||
address(this),
|
||||
target,
|
||||
selector
|
||||
);
|
||||
if ((immediate || delay > 0) && !isAccessManagerIgnored(target, selector)) {
|
||||
_setManagerData(plan, i, !immediate, 0);
|
||||
// downcast is safe because both arguments are uint32
|
||||
neededDelay = uint32(Math.max(delay, neededDelay));
|
||||
}
|
||||
}
|
||||
|
||||
plan.delay = neededDelay;
|
||||
|
||||
return proposalId;
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Mechanism to queue a proposal, potentially scheduling some of its operations in the AccessManager.
|
||||
*
|
||||
* NOTE: The execution delay is chosen based on the delay information retrieved in {propose}. This value may be
|
||||
* off if the delay was updated since proposal creation. In this case, the proposal needs to be recreated.
|
||||
*/
|
||||
function _queueOperations(
|
||||
uint256 proposalId,
|
||||
address[] memory targets,
|
||||
uint256[] memory /* values */,
|
||||
bytes[] memory calldatas,
|
||||
bytes32 /* descriptionHash */
|
||||
) internal virtual override returns (uint48) {
|
||||
ExecutionPlan storage plan = _executionPlan[proposalId];
|
||||
uint48 etaSeconds = Time.timestamp() + plan.delay;
|
||||
|
||||
for (uint256 i = 0; i < targets.length; ++i) {
|
||||
(, bool withDelay, ) = _getManagerData(plan, i);
|
||||
if (withDelay) {
|
||||
(, uint32 nonce) = _manager.schedule(targets[i], calldatas[i], etaSeconds);
|
||||
_setManagerData(plan, i, true, nonce);
|
||||
}
|
||||
}
|
||||
|
||||
return etaSeconds;
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Mechanism to execute a proposal, potentially going through {AccessManager-execute} for delayed operations.
|
||||
*/
|
||||
function _executeOperations(
|
||||
uint256 proposalId,
|
||||
address[] memory targets,
|
||||
uint256[] memory values,
|
||||
bytes[] memory calldatas,
|
||||
bytes32 /* descriptionHash */
|
||||
) internal virtual override {
|
||||
uint48 etaSeconds = SafeCast.toUint48(proposalEta(proposalId));
|
||||
if (block.timestamp < etaSeconds) {
|
||||
revert GovernorUnmetDelay(proposalId, etaSeconds);
|
||||
}
|
||||
|
||||
ExecutionPlan storage plan = _executionPlan[proposalId];
|
||||
|
||||
for (uint256 i = 0; i < targets.length; ++i) {
|
||||
(bool controlled, bool withDelay, uint32 nonce) = _getManagerData(plan, i);
|
||||
if (controlled) {
|
||||
uint32 executedNonce = _manager.execute{value: values[i]}(targets[i], calldatas[i]);
|
||||
if (withDelay && executedNonce != nonce) {
|
||||
revert GovernorMismatchedNonce(proposalId, nonce, executedNonce);
|
||||
}
|
||||
} else {
|
||||
(bool success, bytes memory returndata) = targets[i].call{value: values[i]}(calldatas[i]);
|
||||
Address.verifyCallResult(success, returndata);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev See {IGovernor-_cancel}
|
||||
*/
|
||||
function _cancel(
|
||||
address[] memory targets,
|
||||
uint256[] memory values,
|
||||
bytes[] memory calldatas,
|
||||
bytes32 descriptionHash
|
||||
) internal virtual override returns (uint256) {
|
||||
uint256 proposalId = super._cancel(targets, values, calldatas, descriptionHash);
|
||||
|
||||
uint48 etaSeconds = SafeCast.toUint48(proposalEta(proposalId));
|
||||
|
||||
ExecutionPlan storage plan = _executionPlan[proposalId];
|
||||
|
||||
// If the proposal has been scheduled it will have an ETA and we may have to externally cancel
|
||||
if (etaSeconds != 0) {
|
||||
for (uint256 i = 0; i < targets.length; ++i) {
|
||||
(, bool withDelay, uint32 nonce) = _getManagerData(plan, i);
|
||||
// Only attempt to cancel if the execution plan included a delay
|
||||
if (withDelay) {
|
||||
bytes32 operationId = _manager.hashOperation(address(this), targets[i], calldatas[i]);
|
||||
// Check first if the current operation nonce is the one that we observed previously. It could
|
||||
// already have been cancelled and rescheduled. We don't want to cancel unless it is exactly the
|
||||
// instance that we previously scheduled.
|
||||
if (nonce == _manager.getNonce(operationId)) {
|
||||
// It is important that all calls have an opportunity to be cancelled. We chose to ignore
|
||||
// potential failures of some of the cancel operations to give the other operations a chance to
|
||||
// be properly cancelled. In particular cancel might fail if the operation was already cancelled
|
||||
// by guardians previously. We don't match on the revert reason to avoid encoding assumptions
|
||||
// about specific errors.
|
||||
try _manager.cancel(address(this), targets[i], calldatas[i]) {} catch {}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return proposalId;
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Returns whether the operation at an index is delayed by the manager, and its scheduling nonce once queued.
|
||||
*/
|
||||
function _getManagerData(
|
||||
ExecutionPlan storage plan,
|
||||
uint256 index
|
||||
) private view returns (bool controlled, bool withDelay, uint32 nonce) {
|
||||
(uint256 bucket, uint256 subindex) = _getManagerDataIndices(index);
|
||||
uint32 value = plan.managerData[bucket][subindex];
|
||||
unchecked {
|
||||
return (value > 0, value > 1, value > 1 ? value - 2 : 0);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Marks an operation at an index as permissioned by the manager, potentially delayed, and
|
||||
* when delayed sets its scheduling nonce.
|
||||
*/
|
||||
function _setManagerData(ExecutionPlan storage plan, uint256 index, bool withDelay, uint32 nonce) private {
|
||||
(uint256 bucket, uint256 subindex) = _getManagerDataIndices(index);
|
||||
plan.managerData[bucket][subindex] = withDelay ? nonce + 2 : 1;
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Returns bucket and subindex for reading manager data from the packed array mapping.
|
||||
*/
|
||||
function _getManagerDataIndices(uint256 index) private pure returns (uint256 bucket, uint256 subindex) {
|
||||
bucket = index >> 3; // index / 8
|
||||
subindex = index & 7; // index % 8
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,167 @@
|
||||
// SPDX-License-Identifier: MIT
|
||||
// OpenZeppelin Contracts (last updated v5.0.0) (governance/extensions/GovernorTimelockCompound.sol)
|
||||
|
||||
pragma solidity ^0.8.20;
|
||||
|
||||
import {IGovernor, Governor} from "../Governor.sol";
|
||||
import {ICompoundTimelock} from "../../vendor/compound/ICompoundTimelock.sol";
|
||||
import {Address} from "../../utils/Address.sol";
|
||||
import {SafeCast} from "../../utils/math/SafeCast.sol";
|
||||
|
||||
/**
|
||||
* @dev Extension of {Governor} that binds the execution process to a Compound Timelock. This adds a delay, enforced by
|
||||
* the external timelock to all successful proposal (in addition to the voting duration). The {Governor} needs to be
|
||||
* the admin of the timelock for any operation to be performed. A public, unrestricted,
|
||||
* {GovernorTimelockCompound-__acceptAdmin} is available to accept ownership of the timelock.
|
||||
*
|
||||
* Using this model means the proposal will be operated by the {TimelockController} and not by the {Governor}. Thus,
|
||||
* the assets and permissions must be attached to the {TimelockController}. Any asset sent to the {Governor} will be
|
||||
* inaccessible from a proposal, unless executed via {Governor-relay}.
|
||||
*/
|
||||
abstract contract GovernorTimelockCompound is Governor {
|
||||
ICompoundTimelock private _timelock;
|
||||
|
||||
/**
|
||||
* @dev Emitted when the timelock controller used for proposal execution is modified.
|
||||
*/
|
||||
event TimelockChange(address oldTimelock, address newTimelock);
|
||||
|
||||
/**
|
||||
* @dev Set the timelock.
|
||||
*/
|
||||
constructor(ICompoundTimelock timelockAddress) {
|
||||
_updateTimelock(timelockAddress);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Overridden version of the {Governor-state} function with added support for the `Expired` state.
|
||||
*/
|
||||
function state(uint256 proposalId) public view virtual override returns (ProposalState) {
|
||||
ProposalState currentState = super.state(proposalId);
|
||||
|
||||
return
|
||||
(currentState == ProposalState.Queued &&
|
||||
block.timestamp >= proposalEta(proposalId) + _timelock.GRACE_PERIOD())
|
||||
? ProposalState.Expired
|
||||
: currentState;
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Public accessor to check the address of the timelock
|
||||
*/
|
||||
function timelock() public view virtual returns (address) {
|
||||
return address(_timelock);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev See {IGovernor-proposalNeedsQueuing}.
|
||||
*/
|
||||
function proposalNeedsQueuing(uint256) public view virtual override returns (bool) {
|
||||
return true;
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Function to queue a proposal to the timelock.
|
||||
*/
|
||||
function _queueOperations(
|
||||
uint256 proposalId,
|
||||
address[] memory targets,
|
||||
uint256[] memory values,
|
||||
bytes[] memory calldatas,
|
||||
bytes32 /*descriptionHash*/
|
||||
) internal virtual override returns (uint48) {
|
||||
uint48 etaSeconds = SafeCast.toUint48(block.timestamp + _timelock.delay());
|
||||
|
||||
for (uint256 i = 0; i < targets.length; ++i) {
|
||||
if (
|
||||
_timelock.queuedTransactions(keccak256(abi.encode(targets[i], values[i], "", calldatas[i], etaSeconds)))
|
||||
) {
|
||||
revert GovernorAlreadyQueuedProposal(proposalId);
|
||||
}
|
||||
_timelock.queueTransaction(targets[i], values[i], "", calldatas[i], etaSeconds);
|
||||
}
|
||||
|
||||
return etaSeconds;
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Overridden version of the {Governor-_executeOperations} function that run the already queued proposal
|
||||
* through the timelock.
|
||||
*/
|
||||
function _executeOperations(
|
||||
uint256 proposalId,
|
||||
address[] memory targets,
|
||||
uint256[] memory values,
|
||||
bytes[] memory calldatas,
|
||||
bytes32 /*descriptionHash*/
|
||||
) internal virtual override {
|
||||
uint256 etaSeconds = proposalEta(proposalId);
|
||||
if (etaSeconds == 0) {
|
||||
revert GovernorNotQueuedProposal(proposalId);
|
||||
}
|
||||
Address.sendValue(payable(_timelock), msg.value);
|
||||
for (uint256 i = 0; i < targets.length; ++i) {
|
||||
_timelock.executeTransaction(targets[i], values[i], "", calldatas[i], etaSeconds);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Overridden version of the {Governor-_cancel} function to cancel the timelocked proposal if it has already
|
||||
* been queued.
|
||||
*/
|
||||
function _cancel(
|
||||
address[] memory targets,
|
||||
uint256[] memory values,
|
||||
bytes[] memory calldatas,
|
||||
bytes32 descriptionHash
|
||||
) internal virtual override returns (uint256) {
|
||||
uint256 proposalId = super._cancel(targets, values, calldatas, descriptionHash);
|
||||
|
||||
uint256 etaSeconds = proposalEta(proposalId);
|
||||
if (etaSeconds > 0) {
|
||||
// do external call later
|
||||
for (uint256 i = 0; i < targets.length; ++i) {
|
||||
_timelock.cancelTransaction(targets[i], values[i], "", calldatas[i], etaSeconds);
|
||||
}
|
||||
}
|
||||
|
||||
return proposalId;
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Address through which the governor executes action. In this case, the timelock.
|
||||
*/
|
||||
function _executor() internal view virtual override returns (address) {
|
||||
return address(_timelock);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Accept admin right over the timelock.
|
||||
*/
|
||||
// solhint-disable-next-line private-vars-leading-underscore
|
||||
function __acceptAdmin() public {
|
||||
_timelock.acceptAdmin();
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Public endpoint to update the underlying timelock instance. Restricted to the timelock itself, so updates
|
||||
* must be proposed, scheduled, and executed through governance proposals.
|
||||
*
|
||||
* For security reasons, the timelock must be handed over to another admin before setting up a new one. The two
|
||||
* operations (hand over the timelock) and do the update can be batched in a single proposal.
|
||||
*
|
||||
* Note that if the timelock admin has been handed over in a previous operation, we refuse updates made through the
|
||||
* timelock if admin of the timelock has already been accepted and the operation is executed outside the scope of
|
||||
* governance.
|
||||
|
||||
* CAUTION: It is not recommended to change the timelock while there are other queued governance proposals.
|
||||
*/
|
||||
function updateTimelock(ICompoundTimelock newTimelock) external virtual onlyGovernance {
|
||||
_updateTimelock(newTimelock);
|
||||
}
|
||||
|
||||
function _updateTimelock(ICompoundTimelock newTimelock) private {
|
||||
emit TimelockChange(address(_timelock), address(newTimelock));
|
||||
_timelock = newTimelock;
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,170 @@
|
||||
// SPDX-License-Identifier: MIT
|
||||
// OpenZeppelin Contracts (last updated v5.0.0) (governance/extensions/GovernorTimelockControl.sol)
|
||||
|
||||
pragma solidity ^0.8.20;
|
||||
|
||||
import {IGovernor, Governor} from "../Governor.sol";
|
||||
import {TimelockController} from "../TimelockController.sol";
|
||||
import {IERC165} from "../../interfaces/IERC165.sol";
|
||||
import {SafeCast} from "../../utils/math/SafeCast.sol";
|
||||
|
||||
/**
|
||||
* @dev Extension of {Governor} that binds the execution process to an instance of {TimelockController}. This adds a
|
||||
* delay, enforced by the {TimelockController} to all successful proposal (in addition to the voting duration). The
|
||||
* {Governor} needs the proposer (and ideally the executor and canceller) roles for the {Governor} to work properly.
|
||||
*
|
||||
* Using this model means the proposal will be operated by the {TimelockController} and not by the {Governor}. Thus,
|
||||
* the assets and permissions must be attached to the {TimelockController}. Any asset sent to the {Governor} will be
|
||||
* inaccessible from a proposal, unless executed via {Governor-relay}.
|
||||
*
|
||||
* WARNING: Setting up the TimelockController to have additional proposers or cancellers besides the governor is very
|
||||
* risky, as it grants them the ability to: 1) execute operations as the timelock, and thus possibly performing
|
||||
* operations or accessing funds that are expected to only be accessible through a vote, and 2) block governance
|
||||
* proposals that have been approved by the voters, effectively executing a Denial of Service attack.
|
||||
*/
|
||||
abstract contract GovernorTimelockControl is Governor {
|
||||
TimelockController private _timelock;
|
||||
mapping(uint256 proposalId => bytes32) private _timelockIds;
|
||||
|
||||
/**
|
||||
* @dev Emitted when the timelock controller used for proposal execution is modified.
|
||||
*/
|
||||
event TimelockChange(address oldTimelock, address newTimelock);
|
||||
|
||||
/**
|
||||
* @dev Set the timelock.
|
||||
*/
|
||||
constructor(TimelockController timelockAddress) {
|
||||
_updateTimelock(timelockAddress);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Overridden version of the {Governor-state} function that considers the status reported by the timelock.
|
||||
*/
|
||||
function state(uint256 proposalId) public view virtual override returns (ProposalState) {
|
||||
ProposalState currentState = super.state(proposalId);
|
||||
|
||||
if (currentState != ProposalState.Queued) {
|
||||
return currentState;
|
||||
}
|
||||
|
||||
bytes32 queueid = _timelockIds[proposalId];
|
||||
if (_timelock.isOperationPending(queueid)) {
|
||||
return ProposalState.Queued;
|
||||
} else if (_timelock.isOperationDone(queueid)) {
|
||||
// This can happen if the proposal is executed directly on the timelock.
|
||||
return ProposalState.Executed;
|
||||
} else {
|
||||
// This can happen if the proposal is canceled directly on the timelock.
|
||||
return ProposalState.Canceled;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Public accessor to check the address of the timelock
|
||||
*/
|
||||
function timelock() public view virtual returns (address) {
|
||||
return address(_timelock);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev See {IGovernor-proposalNeedsQueuing}.
|
||||
*/
|
||||
function proposalNeedsQueuing(uint256) public view virtual override returns (bool) {
|
||||
return true;
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Function to queue a proposal to the timelock.
|
||||
*/
|
||||
function _queueOperations(
|
||||
uint256 proposalId,
|
||||
address[] memory targets,
|
||||
uint256[] memory values,
|
||||
bytes[] memory calldatas,
|
||||
bytes32 descriptionHash
|
||||
) internal virtual override returns (uint48) {
|
||||
uint256 delay = _timelock.getMinDelay();
|
||||
|
||||
bytes32 salt = _timelockSalt(descriptionHash);
|
||||
_timelockIds[proposalId] = _timelock.hashOperationBatch(targets, values, calldatas, 0, salt);
|
||||
_timelock.scheduleBatch(targets, values, calldatas, 0, salt, delay);
|
||||
|
||||
return SafeCast.toUint48(block.timestamp + delay);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Overridden version of the {Governor-_executeOperations} function that runs the already queued proposal
|
||||
* through the timelock.
|
||||
*/
|
||||
function _executeOperations(
|
||||
uint256 proposalId,
|
||||
address[] memory targets,
|
||||
uint256[] memory values,
|
||||
bytes[] memory calldatas,
|
||||
bytes32 descriptionHash
|
||||
) internal virtual override {
|
||||
// execute
|
||||
_timelock.executeBatch{value: msg.value}(targets, values, calldatas, 0, _timelockSalt(descriptionHash));
|
||||
// cleanup for refund
|
||||
delete _timelockIds[proposalId];
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Overridden version of the {Governor-_cancel} function to cancel the timelocked proposal if it has already
|
||||
* been queued.
|
||||
*/
|
||||
// This function can reenter through the external call to the timelock, but we assume the timelock is trusted and
|
||||
// well behaved (according to TimelockController) and this will not happen.
|
||||
// slither-disable-next-line reentrancy-no-eth
|
||||
function _cancel(
|
||||
address[] memory targets,
|
||||
uint256[] memory values,
|
||||
bytes[] memory calldatas,
|
||||
bytes32 descriptionHash
|
||||
) internal virtual override returns (uint256) {
|
||||
uint256 proposalId = super._cancel(targets, values, calldatas, descriptionHash);
|
||||
|
||||
bytes32 timelockId = _timelockIds[proposalId];
|
||||
if (timelockId != 0) {
|
||||
// cancel
|
||||
_timelock.cancel(timelockId);
|
||||
// cleanup
|
||||
delete _timelockIds[proposalId];
|
||||
}
|
||||
|
||||
return proposalId;
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Address through which the governor executes action. In this case, the timelock.
|
||||
*/
|
||||
function _executor() internal view virtual override returns (address) {
|
||||
return address(_timelock);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Public endpoint to update the underlying timelock instance. Restricted to the timelock itself, so updates
|
||||
* must be proposed, scheduled, and executed through governance proposals.
|
||||
*
|
||||
* CAUTION: It is not recommended to change the timelock while there are other queued governance proposals.
|
||||
*/
|
||||
function updateTimelock(TimelockController newTimelock) external virtual onlyGovernance {
|
||||
_updateTimelock(newTimelock);
|
||||
}
|
||||
|
||||
function _updateTimelock(TimelockController newTimelock) private {
|
||||
emit TimelockChange(address(_timelock), address(newTimelock));
|
||||
_timelock = newTimelock;
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Computes the {TimelockController} operation salt.
|
||||
*
|
||||
* It is computed with the governor address itself to avoid collisions across governor instances using the
|
||||
* same timelock.
|
||||
*/
|
||||
function _timelockSalt(bytes32 descriptionHash) private view returns (bytes32) {
|
||||
return bytes20(address(this)) ^ descriptionHash;
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,64 @@
|
||||
// SPDX-License-Identifier: MIT
|
||||
// OpenZeppelin Contracts (last updated v5.0.0) (governance/extensions/GovernorVotes.sol)
|
||||
|
||||
pragma solidity ^0.8.20;
|
||||
|
||||
import {Governor} from "../Governor.sol";
|
||||
import {IVotes} from "../utils/IVotes.sol";
|
||||
import {IERC5805} from "../../interfaces/IERC5805.sol";
|
||||
import {SafeCast} from "../../utils/math/SafeCast.sol";
|
||||
import {Time} from "../../utils/types/Time.sol";
|
||||
|
||||
/**
|
||||
* @dev Extension of {Governor} for voting weight extraction from an {ERC20Votes} token, or since v4.5 an {ERC721Votes}
|
||||
* token.
|
||||
*/
|
||||
abstract contract GovernorVotes is Governor {
|
||||
IERC5805 private immutable _token;
|
||||
|
||||
constructor(IVotes tokenAddress) {
|
||||
_token = IERC5805(address(tokenAddress));
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev The token that voting power is sourced from.
|
||||
*/
|
||||
function token() public view virtual returns (IERC5805) {
|
||||
return _token;
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Clock (as specified in ERC-6372) is set to match the token's clock. Fallback to block numbers if the token
|
||||
* does not implement ERC-6372.
|
||||
*/
|
||||
function clock() public view virtual override returns (uint48) {
|
||||
try token().clock() returns (uint48 timepoint) {
|
||||
return timepoint;
|
||||
} catch {
|
||||
return Time.blockNumber();
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Machine-readable description of the clock as specified in ERC-6372.
|
||||
*/
|
||||
// solhint-disable-next-line func-name-mixedcase
|
||||
function CLOCK_MODE() public view virtual override returns (string memory) {
|
||||
try token().CLOCK_MODE() returns (string memory clockmode) {
|
||||
return clockmode;
|
||||
} catch {
|
||||
return "mode=blocknumber&from=default";
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Read the voting weight from the token's built in snapshot mechanism (see {Governor-_getVotes}).
|
||||
*/
|
||||
function _getVotes(
|
||||
address account,
|
||||
uint256 timepoint,
|
||||
bytes memory /*params*/
|
||||
) internal view virtual override returns (uint256) {
|
||||
return token().getPastVotes(account, timepoint);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,110 @@
|
||||
// SPDX-License-Identifier: MIT
|
||||
// OpenZeppelin Contracts (last updated v5.0.0) (governance/extensions/GovernorVotesQuorumFraction.sol)
|
||||
|
||||
pragma solidity ^0.8.20;
|
||||
|
||||
import {GovernorVotes} from "./GovernorVotes.sol";
|
||||
import {SafeCast} from "../../utils/math/SafeCast.sol";
|
||||
import {Checkpoints} from "../../utils/structs/Checkpoints.sol";
|
||||
|
||||
/**
|
||||
* @dev Extension of {Governor} for voting weight extraction from an {ERC20Votes} token and a quorum expressed as a
|
||||
* fraction of the total supply.
|
||||
*/
|
||||
abstract contract GovernorVotesQuorumFraction is GovernorVotes {
|
||||
using Checkpoints for Checkpoints.Trace208;
|
||||
|
||||
Checkpoints.Trace208 private _quorumNumeratorHistory;
|
||||
|
||||
event QuorumNumeratorUpdated(uint256 oldQuorumNumerator, uint256 newQuorumNumerator);
|
||||
|
||||
/**
|
||||
* @dev The quorum set is not a valid fraction.
|
||||
*/
|
||||
error GovernorInvalidQuorumFraction(uint256 quorumNumerator, uint256 quorumDenominator);
|
||||
|
||||
/**
|
||||
* @dev Initialize quorum as a fraction of the token's total supply.
|
||||
*
|
||||
* The fraction is specified as `numerator / denominator`. By default the denominator is 100, so quorum is
|
||||
* specified as a percent: a numerator of 10 corresponds to quorum being 10% of total supply. The denominator can be
|
||||
* customized by overriding {quorumDenominator}.
|
||||
*/
|
||||
constructor(uint256 quorumNumeratorValue) {
|
||||
_updateQuorumNumerator(quorumNumeratorValue);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Returns the current quorum numerator. See {quorumDenominator}.
|
||||
*/
|
||||
function quorumNumerator() public view virtual returns (uint256) {
|
||||
return _quorumNumeratorHistory.latest();
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Returns the quorum numerator at a specific timepoint. See {quorumDenominator}.
|
||||
*/
|
||||
function quorumNumerator(uint256 timepoint) public view virtual returns (uint256) {
|
||||
uint256 length = _quorumNumeratorHistory._checkpoints.length;
|
||||
|
||||
// Optimistic search, check the latest checkpoint
|
||||
Checkpoints.Checkpoint208 storage latest = _quorumNumeratorHistory._checkpoints[length - 1];
|
||||
uint48 latestKey = latest._key;
|
||||
uint208 latestValue = latest._value;
|
||||
if (latestKey <= timepoint) {
|
||||
return latestValue;
|
||||
}
|
||||
|
||||
// Otherwise, do the binary search
|
||||
return _quorumNumeratorHistory.upperLookupRecent(SafeCast.toUint48(timepoint));
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Returns the quorum denominator. Defaults to 100, but may be overridden.
|
||||
*/
|
||||
function quorumDenominator() public view virtual returns (uint256) {
|
||||
return 100;
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Returns the quorum for a timepoint, in terms of number of votes: `supply * numerator / denominator`.
|
||||
*/
|
||||
function quorum(uint256 timepoint) public view virtual override returns (uint256) {
|
||||
return (token().getPastTotalSupply(timepoint) * quorumNumerator(timepoint)) / quorumDenominator();
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Changes the quorum numerator.
|
||||
*
|
||||
* Emits a {QuorumNumeratorUpdated} event.
|
||||
*
|
||||
* Requirements:
|
||||
*
|
||||
* - Must be called through a governance proposal.
|
||||
* - New numerator must be smaller or equal to the denominator.
|
||||
*/
|
||||
function updateQuorumNumerator(uint256 newQuorumNumerator) external virtual onlyGovernance {
|
||||
_updateQuorumNumerator(newQuorumNumerator);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Changes the quorum numerator.
|
||||
*
|
||||
* Emits a {QuorumNumeratorUpdated} event.
|
||||
*
|
||||
* Requirements:
|
||||
*
|
||||
* - New numerator must be smaller or equal to the denominator.
|
||||
*/
|
||||
function _updateQuorumNumerator(uint256 newQuorumNumerator) internal virtual {
|
||||
uint256 denominator = quorumDenominator();
|
||||
if (newQuorumNumerator > denominator) {
|
||||
revert GovernorInvalidQuorumFraction(newQuorumNumerator, denominator);
|
||||
}
|
||||
|
||||
uint256 oldQuorumNumerator = quorumNumerator();
|
||||
_quorumNumeratorHistory.push(clock(), SafeCast.toUint208(newQuorumNumerator));
|
||||
|
||||
emit QuorumNumeratorUpdated(oldQuorumNumerator, newQuorumNumerator);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,59 @@
|
||||
// SPDX-License-Identifier: MIT
|
||||
// OpenZeppelin Contracts (last updated v5.0.0) (governance/utils/IVotes.sol)
|
||||
pragma solidity ^0.8.20;
|
||||
|
||||
/**
|
||||
* @dev Common interface for {ERC20Votes}, {ERC721Votes}, and other {Votes}-enabled contracts.
|
||||
*/
|
||||
interface IVotes {
|
||||
/**
|
||||
* @dev The signature used has expired.
|
||||
*/
|
||||
error VotesExpiredSignature(uint256 expiry);
|
||||
|
||||
/**
|
||||
* @dev Emitted when an account changes their delegate.
|
||||
*/
|
||||
event DelegateChanged(address indexed delegator, address indexed fromDelegate, address indexed toDelegate);
|
||||
|
||||
/**
|
||||
* @dev Emitted when a token transfer or delegate change results in changes to a delegate's number of voting units.
|
||||
*/
|
||||
event DelegateVotesChanged(address indexed delegate, uint256 previousVotes, uint256 newVotes);
|
||||
|
||||
/**
|
||||
* @dev Returns the current amount of votes that `account` has.
|
||||
*/
|
||||
function getVotes(address account) external view returns (uint256);
|
||||
|
||||
/**
|
||||
* @dev Returns the amount of votes that `account` had at a specific moment in the past. If the `clock()` is
|
||||
* configured to use block numbers, this will return the value at the end of the corresponding block.
|
||||
*/
|
||||
function getPastVotes(address account, uint256 timepoint) external view returns (uint256);
|
||||
|
||||
/**
|
||||
* @dev Returns the total supply of votes available at a specific moment in the past. If the `clock()` is
|
||||
* configured to use block numbers, this will return the value at the end of the corresponding block.
|
||||
*
|
||||
* NOTE: This value is the sum of all available votes, which is not necessarily the sum of all delegated votes.
|
||||
* Votes that have not been delegated are still part of total supply, even though they would not participate in a
|
||||
* vote.
|
||||
*/
|
||||
function getPastTotalSupply(uint256 timepoint) external view returns (uint256);
|
||||
|
||||
/**
|
||||
* @dev Returns the delegate that `account` has chosen.
|
||||
*/
|
||||
function delegates(address account) external view returns (address);
|
||||
|
||||
/**
|
||||
* @dev Delegates votes from the sender to `delegatee`.
|
||||
*/
|
||||
function delegate(address delegatee) external;
|
||||
|
||||
/**
|
||||
* @dev Delegates votes from signer to `delegatee`.
|
||||
*/
|
||||
function delegateBySig(address delegatee, uint256 nonce, uint256 expiry, uint8 v, bytes32 r, bytes32 s) external;
|
||||
}
|
||||
251
lib_openzeppelin_contracts/contracts/governance/utils/Votes.sol
Normal file
251
lib_openzeppelin_contracts/contracts/governance/utils/Votes.sol
Normal file
@@ -0,0 +1,251 @@
|
||||
// SPDX-License-Identifier: MIT
|
||||
// OpenZeppelin Contracts (last updated v5.0.0) (governance/utils/Votes.sol)
|
||||
pragma solidity ^0.8.20;
|
||||
|
||||
import {IERC5805} from "../../interfaces/IERC5805.sol";
|
||||
import {Context} from "../../utils/Context.sol";
|
||||
import {Nonces} from "../../utils/Nonces.sol";
|
||||
import {EIP712} from "../../utils/cryptography/EIP712.sol";
|
||||
import {Checkpoints} from "../../utils/structs/Checkpoints.sol";
|
||||
import {SafeCast} from "../../utils/math/SafeCast.sol";
|
||||
import {ECDSA} from "../../utils/cryptography/ECDSA.sol";
|
||||
import {Time} from "../../utils/types/Time.sol";
|
||||
|
||||
/**
|
||||
* @dev This is a base abstract contract that tracks voting units, which are a measure of voting power that can be
|
||||
* transferred, and provides a system of vote delegation, where an account can delegate its voting units to a sort of
|
||||
* "representative" that will pool delegated voting units from different accounts and can then use it to vote in
|
||||
* decisions. In fact, voting units _must_ be delegated in order to count as actual votes, and an account has to
|
||||
* delegate those votes to itself if it wishes to participate in decisions and does not have a trusted representative.
|
||||
*
|
||||
* This contract is often combined with a token contract such that voting units correspond to token units. For an
|
||||
* example, see {ERC721Votes}.
|
||||
*
|
||||
* The full history of delegate votes is tracked on-chain so that governance protocols can consider votes as distributed
|
||||
* at a particular block number to protect against flash loans and double voting. The opt-in delegate system makes the
|
||||
* cost of this history tracking optional.
|
||||
*
|
||||
* When using this module the derived contract must implement {_getVotingUnits} (for example, make it return
|
||||
* {ERC721-balanceOf}), and can use {_transferVotingUnits} to track a change in the distribution of those units (in the
|
||||
* previous example, it would be included in {ERC721-_update}).
|
||||
*/
|
||||
abstract contract Votes is Context, EIP712, Nonces, IERC5805 {
|
||||
using Checkpoints for Checkpoints.Trace208;
|
||||
|
||||
bytes32 private constant DELEGATION_TYPEHASH =
|
||||
keccak256("Delegation(address delegatee,uint256 nonce,uint256 expiry)");
|
||||
|
||||
mapping(address account => address) private _delegatee;
|
||||
|
||||
mapping(address delegatee => Checkpoints.Trace208) private _delegateCheckpoints;
|
||||
|
||||
Checkpoints.Trace208 private _totalCheckpoints;
|
||||
|
||||
/**
|
||||
* @dev The clock was incorrectly modified.
|
||||
*/
|
||||
error ERC6372InconsistentClock();
|
||||
|
||||
/**
|
||||
* @dev Lookup to future votes is not available.
|
||||
*/
|
||||
error ERC5805FutureLookup(uint256 timepoint, uint48 clock);
|
||||
|
||||
/**
|
||||
* @dev Clock used for flagging checkpoints. Can be overridden to implement timestamp based
|
||||
* checkpoints (and voting), in which case {CLOCK_MODE} should be overridden as well to match.
|
||||
*/
|
||||
function clock() public view virtual returns (uint48) {
|
||||
return Time.blockNumber();
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Machine-readable description of the clock as specified in ERC-6372.
|
||||
*/
|
||||
// solhint-disable-next-line func-name-mixedcase
|
||||
function CLOCK_MODE() public view virtual returns (string memory) {
|
||||
// Check that the clock was not modified
|
||||
if (clock() != Time.blockNumber()) {
|
||||
revert ERC6372InconsistentClock();
|
||||
}
|
||||
return "mode=blocknumber&from=default";
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Returns the current amount of votes that `account` has.
|
||||
*/
|
||||
function getVotes(address account) public view virtual returns (uint256) {
|
||||
return _delegateCheckpoints[account].latest();
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Returns the amount of votes that `account` had at a specific moment in the past. If the `clock()` is
|
||||
* configured to use block numbers, this will return the value at the end of the corresponding block.
|
||||
*
|
||||
* Requirements:
|
||||
*
|
||||
* - `timepoint` must be in the past. If operating using block numbers, the block must be already mined.
|
||||
*/
|
||||
function getPastVotes(address account, uint256 timepoint) public view virtual returns (uint256) {
|
||||
uint48 currentTimepoint = clock();
|
||||
if (timepoint >= currentTimepoint) {
|
||||
revert ERC5805FutureLookup(timepoint, currentTimepoint);
|
||||
}
|
||||
return _delegateCheckpoints[account].upperLookupRecent(SafeCast.toUint48(timepoint));
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Returns the total supply of votes available at a specific moment in the past. If the `clock()` is
|
||||
* configured to use block numbers, this will return the value at the end of the corresponding block.
|
||||
*
|
||||
* NOTE: This value is the sum of all available votes, which is not necessarily the sum of all delegated votes.
|
||||
* Votes that have not been delegated are still part of total supply, even though they would not participate in a
|
||||
* vote.
|
||||
*
|
||||
* Requirements:
|
||||
*
|
||||
* - `timepoint` must be in the past. If operating using block numbers, the block must be already mined.
|
||||
*/
|
||||
function getPastTotalSupply(uint256 timepoint) public view virtual returns (uint256) {
|
||||
uint48 currentTimepoint = clock();
|
||||
if (timepoint >= currentTimepoint) {
|
||||
revert ERC5805FutureLookup(timepoint, currentTimepoint);
|
||||
}
|
||||
return _totalCheckpoints.upperLookupRecent(SafeCast.toUint48(timepoint));
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Returns the current total supply of votes.
|
||||
*/
|
||||
function _getTotalSupply() internal view virtual returns (uint256) {
|
||||
return _totalCheckpoints.latest();
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Returns the delegate that `account` has chosen.
|
||||
*/
|
||||
function delegates(address account) public view virtual returns (address) {
|
||||
return _delegatee[account];
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Delegates votes from the sender to `delegatee`.
|
||||
*/
|
||||
function delegate(address delegatee) public virtual {
|
||||
address account = _msgSender();
|
||||
_delegate(account, delegatee);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Delegates votes from signer to `delegatee`.
|
||||
*/
|
||||
function delegateBySig(
|
||||
address delegatee,
|
||||
uint256 nonce,
|
||||
uint256 expiry,
|
||||
uint8 v,
|
||||
bytes32 r,
|
||||
bytes32 s
|
||||
) public virtual {
|
||||
if (block.timestamp > expiry) {
|
||||
revert VotesExpiredSignature(expiry);
|
||||
}
|
||||
address signer = ECDSA.recover(
|
||||
_hashTypedDataV4(keccak256(abi.encode(DELEGATION_TYPEHASH, delegatee, nonce, expiry))),
|
||||
v,
|
||||
r,
|
||||
s
|
||||
);
|
||||
_useCheckedNonce(signer, nonce);
|
||||
_delegate(signer, delegatee);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Delegate all of `account`'s voting units to `delegatee`.
|
||||
*
|
||||
* Emits events {IVotes-DelegateChanged} and {IVotes-DelegateVotesChanged}.
|
||||
*/
|
||||
function _delegate(address account, address delegatee) internal virtual {
|
||||
address oldDelegate = delegates(account);
|
||||
_delegatee[account] = delegatee;
|
||||
|
||||
emit DelegateChanged(account, oldDelegate, delegatee);
|
||||
_moveDelegateVotes(oldDelegate, delegatee, _getVotingUnits(account));
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Transfers, mints, or burns voting units. To register a mint, `from` should be zero. To register a burn, `to`
|
||||
* should be zero. Total supply of voting units will be adjusted with mints and burns.
|
||||
*/
|
||||
function _transferVotingUnits(address from, address to, uint256 amount) internal virtual {
|
||||
if (from == address(0)) {
|
||||
_push(_totalCheckpoints, _add, SafeCast.toUint208(amount));
|
||||
}
|
||||
if (to == address(0)) {
|
||||
_push(_totalCheckpoints, _subtract, SafeCast.toUint208(amount));
|
||||
}
|
||||
_moveDelegateVotes(delegates(from), delegates(to), amount);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Moves delegated votes from one delegate to another.
|
||||
*/
|
||||
function _moveDelegateVotes(address from, address to, uint256 amount) internal virtual {
|
||||
if (from != to && amount > 0) {
|
||||
if (from != address(0)) {
|
||||
(uint256 oldValue, uint256 newValue) = _push(
|
||||
_delegateCheckpoints[from],
|
||||
_subtract,
|
||||
SafeCast.toUint208(amount)
|
||||
);
|
||||
emit DelegateVotesChanged(from, oldValue, newValue);
|
||||
}
|
||||
if (to != address(0)) {
|
||||
(uint256 oldValue, uint256 newValue) = _push(
|
||||
_delegateCheckpoints[to],
|
||||
_add,
|
||||
SafeCast.toUint208(amount)
|
||||
);
|
||||
emit DelegateVotesChanged(to, oldValue, newValue);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Get number of checkpoints for `account`.
|
||||
*/
|
||||
function _numCheckpoints(address account) internal view virtual returns (uint32) {
|
||||
return SafeCast.toUint32(_delegateCheckpoints[account].length());
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Get the `pos`-th checkpoint for `account`.
|
||||
*/
|
||||
function _checkpoints(
|
||||
address account,
|
||||
uint32 pos
|
||||
) internal view virtual returns (Checkpoints.Checkpoint208 memory) {
|
||||
return _delegateCheckpoints[account].at(pos);
|
||||
}
|
||||
|
||||
function _push(
|
||||
Checkpoints.Trace208 storage store,
|
||||
function(uint208, uint208) view returns (uint208) op,
|
||||
uint208 delta
|
||||
) private returns (uint208, uint208) {
|
||||
return store.push(clock(), op(store.latest(), delta));
|
||||
}
|
||||
|
||||
function _add(uint208 a, uint208 b) private pure returns (uint208) {
|
||||
return a + b;
|
||||
}
|
||||
|
||||
function _subtract(uint208 a, uint208 b) private pure returns (uint208) {
|
||||
return a - b;
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Must return the voting units held by an account.
|
||||
*/
|
||||
function _getVotingUnits(address) internal view virtual returns (uint256);
|
||||
}
|
||||
Reference in New Issue
Block a user