merge develop into master (#485)

* chore - add tinlake 0.3.0 audit report (#481)

* chore - add assessor admin contract (#483)

* chore: add assessor admin fab (#484)

src/lender/admin/assessor.sol

@@ -0,0 +1,40 @@
+// Copyright (C) 2020 Centrifuge
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+pragma solidity >=0.5.15 <0.6.0;
+
+import "tinlake-auth/auth.sol";
+
+interface AssessorLike {
+     function file(bytes32 name, uint value) external;
+}
+
+// Wrapper contract for permission restriction on the assessor.
+// This contract ensures that only the maxReserve size of the pool can be set
+contract AssessorAdmin is Auth {
+    AssessorLike  public assessor;
+    constructor() public {
+        wards[msg.sender] = 1;
+    }
+
+    function depend(bytes32 contractName, address addr) public auth {
+        if (contractName == "assessor") {
+            assessor = AssessorLike(addr);
+        } else revert();
+    }
+
+    function setMaxReserve(uint value) public auth {
+        assessor.file("maxReserve", value);
+    }
+}

src/lender/deployer.sol

@@ -14,7 +14,7 @@
 // along with this program.  If not, see <https://www.gnu.org/licenses/>.
 pragma solidity >=0.5.15 <0.6.0;
 
-import { ReserveFabLike, AssessorFabLike, TrancheFabLike, CoordinatorFabLike, OperatorFabLike, MemberlistFabLike, RestrictedTokenFabLike } from "./fabs/interfaces.sol";
+import { ReserveFabLike, AssessorFabLike, TrancheFabLike, CoordinatorFabLike, OperatorFabLike, MemberlistFabLike, RestrictedTokenFabLike, AssessorAdminFabLike } from "./fabs/interfaces.sol";
 
 import {FixedPoint}      from "./../fixed_point.sol";
 
@@ -48,6 +48,7 @@ contract LenderDeployer is FixedPoint {
     OperatorFabLike         public operatorFab;
     MemberlistFabLike       public memberlistFab;
     RestrictedTokenFabLike  public restrictedTokenFab;
+    AssessorAdminFabLike    public assessorAdminFab;
 
     // lender state variables
     Fixed27             public minSeniorRatio;
@@ -59,6 +60,7 @@ contract LenderDeployer is FixedPoint {
 
     // contract addresses
     address             public assessor;
+    address             public assessorAdmin;
     address             public seniorTranche;
     address             public juniorTranche;
     address             public seniorOperator;
@@ -80,7 +82,7 @@ contract LenderDeployer is FixedPoint {
 
     address             public deployer;
 
-    constructor(address root_, address currency_, address trancheFab_, address memberlistFab_, address restrictedtokenFab_, address reserveFab_, address assessorFab_, address coordinatorFab_, address operatorFab_) public {
+    constructor(address root_, address currency_, address trancheFab_, address memberlistFab_, address restrictedtokenFab_, address reserveFab_, address assessorFab_, address coordinatorFab_, address operatorFab_, address assessorAdminFab_) public {
 
         deployer = msg.sender;
         root = root_;
@@ -91,6 +93,7 @@ contract LenderDeployer is FixedPoint {
         restrictedTokenFab = RestrictedTokenFabLike(restrictedtokenFab_);
         reserveFab = ReserveFabLike(reserveFab_);
         assessorFab = AssessorFabLike(assessorFab_);
+        assessorAdminFab = AssessorAdminFabLike(assessorAdminFab_);
         coordinatorFab = CoordinatorFabLike(coordinatorFab_);
         operatorFab = OperatorFabLike(operatorFab_);
     }
@@ -151,6 +154,12 @@ contract LenderDeployer is FixedPoint {
         AuthLike(assessor).rely(root);
     }
 
+    function deployAssessorAdmin() public {
+        require(assessorAdmin == address(0) && deployer == address(1));
+        assessorAdmin = assessorAdminFab.newAssessorAdmin();
+        AuthLike(assessorAdmin).rely(root);
+    }
+
     function deployCoordinator() public {
         require(coordinator == address(0) && deployer == address(1));
         coordinator = coordinatorFab.newCoordinator(challengeTime);
@@ -210,6 +219,12 @@ contract LenderDeployer is FixedPoint {
 
         AuthLike(assessor).rely(coordinator);
         AuthLike(assessor).rely(reserve);
+        AuthLike(assessor).rely(assessorAdmin);
+
+        // assessorAdmin
+        DependLike(assessorAdmin).depend("assessor", assessor);
+
+
 
         FileLike(assessor).file("seniorInterestRate", seniorInterestRate.value);
         FileLike(assessor).file("maxReserve", maxReserve);

src/lender/fabs/assessoradmin.sol

@@ -0,0 +1,29 @@
+// Copyright (C) 2020 Centrifuge
+
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+pragma solidity >=0.5.15 <0.6.0;
+
+import { AssessorAdmin } from "./../admin/assessor.sol";
+
+contract AssessorAdminFab {
+    function newAssessorAdmin() public returns (address assessorAdmin) {
+        AssessorAdmin assessorAdmin = new AssessorAdmin();
+
+        assessorAdmin.rely(msg.sender);
+        assessorAdmin.deny(address(this));
+
+        return address(assessorAdmin);
+    }
+}

src/lender/fabs/interfaces.sol

@@ -42,4 +42,8 @@ interface RestrictedTokenFabLike {
     function newRestrictedToken(string calldata, string calldata) external returns (address);
 }
 
+interface AssessorAdminFabLike {
+    function newAssessorAdmin() external returns (address);
+}
+
 

src/lender/test/assessorAdmin.t.sol

@@ -0,0 +1,62 @@
+// Copyright (C) 2020 Centrifuge
+
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+pragma solidity >=0.5.15 <0.6.0;
+
+import "ds-test/test.sol";
+
+import "./../assessor.sol";
+import "./../admin/assessor.sol";
+
+
+contract AssessorAdminTest is DSTest {
+
+    Assessor assessor;
+    AssessorAdmin assessorAdmin;
+
+    address assessor_;
+    address assessorAdmin_;
+
+    function setUp() public {
+        assessor = new Assessor();
+        assessorAdmin = new AssessorAdmin();
+
+        assessor_ = address(assessor);
+        assessorAdmin_ = address(assessorAdmin);
+        assessorAdmin.depend("assessor", assessor_);
+    }
+
+    function callMaxReserve() public {
+        uint maxReserve = 150 ether;
+
+        // call setMaxReserve 
+        assessorAdmin.setMaxReserve(maxReserve);
+
+        // assert maxReserve value was set
+        assertEq(assessor.maxReserve(), maxReserve);
+    }
+
+    function testSetMaxReserve() public {
+        // rely assessorAdmin on assessor
+        assessor.rely(assessorAdmin_);
+        callMaxReserve(); 
+    }
+
+    function testFailSetMaxReserveNoPermissions() public {
+         // do not rely assessorAdmin on assessor
+        callMaxReserve(); 
+    }
+}
+

src/test/system/lender/integration.t.sol

@@ -27,6 +27,14 @@ contract LenderIntegrationTest is BaseSystemTest {
         createInvestorUser();
     }
 
+    function testAdminPermissions() public {
+        assertEq(assessor.wards(address(assessorAdmin)), 1);
+        uint newReserve = 200 ether;
+        assertEq(assessorAdmin.wards(address(this)), 1);
+        assessorAdmin.setMaxReserve(newReserve);
+        assertEq(assessor.maxReserve(), newReserve);
+    }
+
     function testSimpleSeniorOrder() public {
         uint amount = 100 ether;
         currency.mint(address(seniorInvestor), amount);

src/test/system/setup.sol

@@ -29,6 +29,7 @@ import { Reserve } from "../../lender/reserve.sol";
 import { Tranche } from "../../lender/tranche.sol";
 import { Operator } from "../../lender/operator.sol";
 import { Assessor } from "../../lender/assessor.sol";
+import { AssessorAdmin } from "../../lender/admin/assessor.sol";
 import { RestrictedToken } from "../../lender/token/restricted.sol";
 import { Memberlist } from "../../lender/token/memberlist.sol";
 
@@ -37,6 +38,7 @@ import { TrancheFab } from "../../lender/fabs/tranche.sol";
 import { RestrictedTokenFab } from "../../lender/fabs/restrictedtoken.sol";
 import { MemberlistFab } from "../../lender/fabs/memberlist.sol";
 import { AssessorFab } from "../../lender/fabs/assessor.sol";
+import { AssessorAdminFab } from "../../lender/fabs/assessoradmin.sol";
 import { ReserveFab } from "../../lender/fabs/reserve.sol";
 import { CoordinatorFab } from "../../lender/fabs/coordinator.sol";
 import { OperatorFab } from "../../lender/fabs/operator.sol";
@@ -83,6 +85,7 @@ contract TestSetup {
     Operator juniorOperator;
     Operator seniorOperator;
     Assessor assessor;
+    AssessorAdmin assessorAdmin;
     RestrictedToken seniorToken;
     RestrictedToken juniorToken;
     Memberlist seniorMemberlist;
@@ -175,14 +178,15 @@ contract TestSetup {
 
         ReserveFab reserveFab = new ReserveFab();
         AssessorFab assessorFab = new AssessorFab();
+        AssessorAdminFab assessorAdminFab = new AssessorAdminFab();
         TrancheFab  trancheFab = new TrancheFab();
         MemberlistFab memberlistFab = new MemberlistFab();
         RestrictedTokenFab restrictedTokenFab = new RestrictedTokenFab();
         OperatorFab operatorFab = new OperatorFab();
-        CoordinatorFab coordinatorFab = new CoordinatorFab();
+        CoordinatorFab coordinatorFab = new CoordinatorFab(); 
 
         // root is testcase
-        lenderDeployer = new LenderDeployer(rootAddr, currency_, address(trancheFab), address(memberlistFab), address(restrictedTokenFab), address(reserveFab), address(assessorFab), address(coordinatorFab), address(operatorFab));
+        lenderDeployer = new LenderDeployer(rootAddr, currency_, address(trancheFab), address(memberlistFab), address(restrictedTokenFab), address(reserveFab), address(assessorFab), address(coordinatorFab), address(operatorFab), address(assessorAdminFab));
     }
 
     function deployLender() public {
@@ -204,11 +208,13 @@ contract TestSetup {
         lenderDeployer.deploySenior();
         lenderDeployer.deployReserve();
         lenderDeployer.deployAssessor();
+        lenderDeployer.deployAssessorAdmin();
         lenderDeployer.deployCoordinator();
 
         lenderDeployer.deploy();
 
         assessor = Assessor(lenderDeployer.assessor());
+        assessorAdmin = AssessorAdmin(lenderDeployer.assessorAdmin());
         reserve = Reserve(lenderDeployer.reserve());
         coordinator = EpochCoordinator(lenderDeployer.coordinator());
         seniorTranche = Tranche(lenderDeployer.seniorTranche());