RACE #37 Of The Secureum Bootcamp Epoch∞

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

contract CollateralDeposit is Ownable {

    /**
     * @dev Base collateral requirement. Represents a minimum required deposit amount
     *      related to some underlying asset or protocol rule.
     */
    uint256 public baseCollateralRate;

    /**
     * @dev Volatility factor that scales the base requirement up or down
     *      depending on current market or protocol conditions.
     */
    uint256 public volatilityFactor;

    /**
     * @dev Dynamic risk multiplier. Adjusts deposit requirements to account for
     *      additional risk factors such as market uncertainty or leverage considerations.
     */
    uint256 public riskMultiplier;

    /**
     * @dev Keeps track of how much collateral each address has deposited in ETH.
     */
    mapping(address => uint256) public deposits;

    /**
     * @param _baseCollateralRate Initial baseCollateralRate (replaces systemVarA).
     * @param _volatilityFactor   Initial volatilityFactor (replaces systemVarB).
     * @param _riskMultiplier     Initial riskMultiplier (replaces scalingFactor).
     */
    constructor(
        uint256 _baseCollateralRate,
        uint256 _volatilityFactor,
        uint256 _riskMultiplier
    ) {
        baseCollateralRate = _baseCollateralRate;
        volatilityFactor = _volatilityFactor;
        riskMultiplier = _riskMultiplier;
    }

    /**
     * @dev Allows a user to deposit ETH. The required amount is calculated by multiplying
     *      the three parameters: baseCollateralRate, volatilityFactor, and riskMultiplier.
     * 
     *      After the deposit is validated, we call the internal `_updateCollateralParameters`
     *      function to adjust the baseCollateralRate and volatilityFactor for subsequent deposits.
     */
    function depositEth() external payable {
        // 1. Retrieve the user’s sanctioned loan amount
        uint256 loanAmount = userLoans[msg.sender];

        uint256 requiredDeposit = (loanAmount * baseCollateralRatio) / 100;

        // 3. Optionally incorporate a volatility factor or risk multiplier
        requiredDeposit = requiredDeposit * volatilityFactor * riskMultiplier;

        require(msg.value >= requiredDeposit, "Incorrect deposit amount");

        // Record the deposit
        deposits[msg.sender] += requiredDeposit;
        // Automatically adjust system parameters for the next deposit.
        _updateCollateralParameters();
        
        //Code to update users load data omitted

    }

    function _updateCollateralParameters() internal {
        // Potentially update the following under certain conditions only. Code omitted
        // Increase baseCollateralRate by 2%
        baseCollateralRate = baseCollateralRate + (baseCollateralRate * 2 / 100);

        // Increase volatilityFactor by 1%
        volatilityFactor = volatilityFactor + (volatilityFactor * 1 / 100);
    }

    function updateRiskMultiplier(uint256 _riskMultiplier) external onlyOwner {
        riskMultiplier = _riskMultiplier;
    }
    // Rest of the contract logicis functioning as expected
}

/**
 * @dev Processes a reward claim on behalf of a user for all assets in the lending pool,
 *      including any pending (unclaimed) rewards.
 * @param executor The address allowed to initiate the reward claim on behalf of the user
 * @param account The address whose rewards are being claimed
 * @param receiver The address that will receive the claimed rewards
 */
function _claimRewards(
    address executor,
    address account,
    address receiver,
    AccruedRewards[] memory claimableRewards
) internal virtual {
    for (uint256 i = 0; i < claimableRewards.length; i++) {
        uint256 outstandingRewards = _usersUnclaimedRewards[account][claimableRewards[i].programId];

        // Aggregate any previously unclaimed rewards
        claimableRewards[i].amount += outstandingRewards;

        if (claimableRewards[i].amount != 0) {
            emit RewardsAccrued(
                account,
                claimableRewards[i].rewardToken,
                getProgramName(claimableRewards[i].programId),
                claimableRewards[i].amount
            );

            // Transfer the total amount of rewards
            _transferRewards(
                claimableRewards[i].rewardToken,
                receiver,
                claimableRewards[i].amount
            );

            emit RewardsClaimed(
                account,
                receiver,
                claimableRewards[i].rewardToken,
                claimableRewards[i].programId,
                executor,
                claimableRewards[i].amount
            );
        }
    }
}

function _transferRewards(
    address rewardToken,
    address recipient,
    uint256 amount
) internal virtual {
    // Ensure the recipient address is valid (non-zero)
    require(recipient != address(0), "Invalid recipient address");

    // Perform the token transfer
    IERC20(rewardToken).safeTransfer(recipient, amount);
}

function _fetchProgramIds(string[] calldata _programNames)
        internal
        pure
        virtual
        returns (bytes32[] memory programIds)
    {
        programIds = new bytes32[](_programNames.length);

        for (uint256 i = 0; i < _programNames.length; i++) {
            programIds[i] = fetchProgramId(_programNames[i]);
        }
    }

function claimRewards(
    address _receiver,
    string[] calldata _rewardPrograms
)
    external
    virtual
    returns (AccruedRewards[] memory gatheredRewards)
{
    if (_receiver == address(0)) revert InvalidToAddress();

    bytes32[] memory retrievedProgramIds = _fetchProgramIds(_rewardPrograms);
    gatheredRewards = _accumulateRewardsForPrograms(msg.sender, retrievedProgramIds);
    _claimRewards(msg.sender, msg.sender, msg.sender, gatheredRewards);
}

// Assume the rest of the code works as intended

    function repayLoan(uint256 loanId) external nonReentrant {
        Loan memory _loan = loans[loanId];

        require(_loan.status == Status.Active, "invalid status");

        uint256 protocolFee = (_loan.repaymentAmount - _loan.assetAmount) * PROTOCOL_FEE / 10000;
        uint256 amountToLender = _loan.repaymentAmount - protocolFee;

        loans[loanId].status = Status.Repaid;

        //since the token could be ERC777 and the lender could be a contract, there is a possible DoS attack vector during repayment/liquidation
        //this is acceptable, since borrowers are expected to be aware of the risk when using non-standard tokens
        IERC20(_loan.asset).safeTransferFrom(_loan.borrower, _loan.lender, amountToLender); //return asset
        IERC20(_loan.collateral).safeTransfer(_loan.borrower, _loan.collateralAmount); //return collateral

        IERC20(_loan.asset).safeTransferFrom(_loan.borrower, feeCollector, protocolFee);

        emit LoanRepaid(loanId, _loan.borrower, _loan.lender);
        emit ProtocolRevenue(loanId, _loan.asset, protocolFee);
    } 

// SPDX-License-Identifier: GPL-2.0-or-later
pragma solidity ^0.8.0;

/// @notice library of functions related to protocol fees
library ProtocolFeeLibrary {
    /// @notice Max protocol fee is 0.1% (1000 pips)
    /// @dev Increasing these values could lead to overflow in Pool.swap
    uint16 public constant MAX_PROTOCOL_FEE = 1000;

    /// @notice Thresholds used for optimized bounds checks on protocol fees
    uint24 internal constant FEE_0_THRESHOLD = 1001;
    uint24 internal constant FEE_1_THRESHOLD = 1001 << 12;

    /// @notice the protocol fee is represented in hundredths of a bip
    uint256 internal constant PIPS_DENOMINATOR = 1_000_000;

    function getZeroForOneFee(uint24 self) internal pure returns (uint16) {
        return uint16(self & 0xfff);
    }

    function getOneForZeroFee(uint24 self) internal pure returns (uint16) {
        return uint16(self >> 12);
    }
    // This function is called when setting the protocol fees
    function isValidProtocolFee(uint24 self) internal pure returns (bool valid) {
        // Equivalent to: getZeroForOneFee(self) <= MAX_PROTOCOL_FEE && getOneForZeroFee(self) <= MAX_PROTOCOL_FEE
        assembly ("memory-safe") {
            let isZeroForOneFeeOk := lt(and(self, 0xfff), FEE_0_THRESHOLD)
            let isOneForZeroFeeOk := lt(and(self, 0xfff000), FEE_1_THRESHOLD)
            valid := and(isZeroForOneFeeOk, isOneForZeroFeeOk)
        }
    }

    // The protocol fee is taken from the input amount first and then the LP fee is taken from the remaining
    // The swap fee is capped at 100%
    // Equivalent to protocolFee + lpFee(1_000_000 - protocolFee) / 1_000_000
    /// @dev here `self` is just a single direction's protocol fee, not a packed type of 2 protocol fees
    function calculateSwapFee(uint16 self, uint24 lpFee) internal pure returns (uint24 swapFee) {
        // protocolFee + lpFee - (protocolFee * lpFee / 1_000_000). Div rounds up to favor LPs over the protocol.
        assembly ("memory-safe") {
            self := and(self, 0xfff)
            lpFee := and(lpFee, 0xffffff)
            let numerator := mul(self, lpFee)
            let divRoundingUp := add(div(numerator, PIPS_DENOMINATOR), gt(mod(numerator, PIPS_DENOMINATOR), 0))
            swapFee := sub(add(self, lpFee), divRoundingUp)
        }
    }
}

/// @title Fee Accumulator.
/// @notice A system for managing fee collected through X DAO and X Protocol 
///         
/// @dev The Fee Accumulator acts as a unified hub for collecting and
///      transforming fees collected and their preparation for delivery
///      to X DAO users. Currently, fees can be swapped via offchain
///      solver integrations such as 1Inch. An alternative model of
///      permissionless dutch auctions such as the work seen by Uniswap/Euler
///      could be used. However, A/B testing may provide greater insight into
///      the superior model.
///
///      Fees can be marked for OTC which will allow the X DAO to
///      purchase them, at fair market value. The Fee accumulator also works
///      in collaboration with the Protocol Messaging Hub to manage system
///      information and fees. Epoch fee distributions are distributed once a
///      single chain has recorded fees accumulated and tokens locked across
///      all supported chains inside the X Protocol system.
///
///      These fees are distributed pro-rata based on the under of locked
///      veCVE tokens on each chain, see "CVELocker.sol" for more information
///      on this.
///
///      Native gas tokens are stored inside the contract to pay for all
///      crosschain actions. Locked token data actions are intended to be
///      moved over to Wormhole's CCQ prior to mainnet deployment.
///      At this time, payload/MessageType configuration + encoding/decoding
///      are not production ready.
///
contract FeeAccumulator is ReentrancyGuard {

    // Please note most of the code is omitted for brevity and works as intended


    /// @notice Address of fee token.
    address public immutable feeToken;
    /// @notice X DAO hub.
    ICentralRegistry public immutable centralRegistry;
    /// @notice Address of OneBalanceFeeManager contract.
    address public immutable oneBalanceFeeManager;
    /// @notice Fee token decimal unit.
    uint256 internal immutable _feeTokenUnit;
    receive() external payable {}

    /// @notice Sends all left over fees to new fee accumulator.
    /// @dev This does not need to be permissioned as it pulls data
    ///      directly from the Central Registry meaning a malicious actor
    ///      cannot abuse this. 
    ///      This function is only needed to be called in case of a need for migrating over to a new Fee Accumulator
    function migrateFeeAccumulator() external {
        address newFeeAccumulator = centralRegistry.feeAccumulator();
        if (newFeeAccumulator == address(this)) {
            revert FeeAccumulator__NewFeeAccumulatorIsNotChanged();
        }

        address[] memory currentRewardTokens = rewardTokens;
        uint256 numTokens = currentRewardTokens.length;
        uint256 tokenBalance;

        // Send remaining fee tokens to new fee accumulator, if any.
        for (uint256 i; i < numTokens; ) {
            tokenBalance = IERC20(currentRewardTokens[i]).balanceOf(
                address(this)
            );

            if (tokenBalance > 0) {
                SafeTransferLib.safeTransfer(
                    currentRewardTokens[i],
                    newFeeAccumulator,
                    tokenBalance
                );
            }

            unchecked {
                ++i;
            }
        }

        tokenBalance = IERC20(feeToken).balanceOf(address(this));

        // Send remaining fee token to new fee accumulator, if any.
        if (tokenBalance > 0) {
            SafeTransferLib.safeTransfer(
                feeToken,
                newFeeAccumulator,
                tokenBalance
            );
        }
    }