code/yieldomega
Watch
4
0
Fork
You've already forked yieldomega
 0
Code Issues 1 Pull requests 1 Projects Releases Packages Wiki Activity

PodiumVaults non-commingled pool integration test (#348) #529

Merged
PlasticDigits merged 1 commit from issue-348-podium-vaults-non-commingled into main 2026-06-28 04:49:47 +00:00
Conversation 2 Commits 1 Files changed 6 +267 -9
PlasticDigits commented 2026-06-28 02:50:14 +00:00 (Migrated from gitlab.com)

Summary

GitLab #348 — integration coverage for non-commingled PodiumVaults pool wiring.

  • Adds PodiumTranchePool: smart-contract tranche holder; only PodiumVaults (operator) can disburse via pushTo.
  • Fixes PodiumVaults external-pool paths: creditTranche no-ops off commingled ledgers; roll/payout use _moveFromPool (contract check reverts EOAs with PodiumVaults: external pool not contract).
  • Adds PodiumVaultsNonCommingled.t.sol: Last Buy (cat 0) wired to external pools through buy → roll → 4∶2∶1 payout → tranche promotion; asserts no stranded DOUB on seed/future pools after roll.
  • Documents wiring in PARAMETERS.md, time-arena.md, and invariants (INV-PODIUM-VAULTS-348-*).
  • DeployDev default unchanged (commingled address(vaults) for all slots).

Acceptance checklist

Criterion Command / step Result
New integration test passes cd contracts && forge test --match-contract PodiumVaultsNonCommingled PASS
Covers ≥1 category non-commingled through roll test_nonCommingled_lastBuy_buy_roll_payout_promotion PASS
No stranded DOUB on wrong pool after promotion same test (seed/future balance 0 post-roll) PASS
Full contract suite (excl. fork airdrop) cd contracts && forge test PASS (232 pass; 4 DoubAirdropMegaethFork fail without doub.csv — expected)
Misconfigured EOA pool fails safe test_nonCommingled_misconfigured_eoa_pool_reverts_on_roll PASS
Payout cannot drain via unauthorised push test_nonCommingled_pushTo_reverts_not_operator PASS
Docs / invariants updated manual review of linked files PASS

Verification for third parties

cd contracts && forge test --match-contract PodiumVaultsNonCommingled -vv
cd contracts && forge test   # expect 4 fork airdrop failures if doub.csv absent

Review:

  • contracts/src/arena/PodiumTranchePool.sol
  • contracts/src/arena/PodiumVaults.sol (_moveFromPool, creditTranche)
  • contracts/test/PodiumVaultsNonCommingled.t.sol
  • contracts/PARAMETERS.md (PodiumVaults pool wiring §348)
  • docs/testing/invariants-and-business-logic.md (§348)

Follow-ups

  • Future production wiring may consolidate per-tranche pools under governance-controlled contracts (see issue comment on #348); current MR keeps DeployDev commingled and only adds optional PodiumTranchePool + tests.
## Summary GitLab #348 — integration coverage for **non-commingled** PodiumVaults pool wiring. - Adds **`PodiumTranchePool`**: smart-contract tranche holder; only `PodiumVaults` (operator) can disburse via `pushTo`. - Fixes **`PodiumVaults`** external-pool paths: `creditTranche` no-ops off commingled ledgers; roll/payout use `_moveFromPool` (contract check reverts EOAs with `PodiumVaults: external pool not contract`). - Adds **`PodiumVaultsNonCommingled.t.sol`**: Last Buy (cat 0) wired to external pools through buy → roll → 4∶2∶1 payout → tranche promotion; asserts no stranded DOUB on seed/future pools after roll. - Documents wiring in `PARAMETERS.md`, `time-arena.md`, and invariants (`INV-PODIUM-VAULTS-348-*`). - **DeployDev default unchanged** (commingled `address(vaults)` for all slots). ## Acceptance checklist | Criterion | Command / step | Result | |-----------|----------------|--------| | New integration test passes | `cd contracts && forge test --match-contract PodiumVaultsNonCommingled` | PASS | | Covers ≥1 category non-commingled through roll | `test_nonCommingled_lastBuy_buy_roll_payout_promotion` | PASS | | No stranded DOUB on wrong pool after promotion | same test (`seed`/`future` balance 0 post-roll) | PASS | | Full contract suite (excl. fork airdrop) | `cd contracts && forge test` | PASS (232 pass; 4 `DoubAirdropMegaethFork` fail without `doub.csv` — expected) | | Misconfigured EOA pool fails safe | `test_nonCommingled_misconfigured_eoa_pool_reverts_on_roll` | PASS | | Payout cannot drain via unauthorised push | `test_nonCommingled_pushTo_reverts_not_operator` | PASS | | Docs / invariants updated | manual review of linked files | PASS | ## Verification for third parties ```bash cd contracts && forge test --match-contract PodiumVaultsNonCommingled -vv cd contracts && forge test # expect 4 fork airdrop failures if doub.csv absent ``` Review: - `contracts/src/arena/PodiumTranchePool.sol` - `contracts/src/arena/PodiumVaults.sol` (`_moveFromPool`, `creditTranche`) - `contracts/test/PodiumVaultsNonCommingled.t.sol` - `contracts/PARAMETERS.md` (PodiumVaults pool wiring §348) - `docs/testing/invariants-and-business-logic.md` (§348) ## Follow-ups - Future production wiring may consolidate per-tranche pools under governance-controlled contracts (see issue comment on #348); current MR keeps DeployDev commingled and only adds optional `PodiumTranchePool` + tests.
PlasticDigits commented 2026-06-28 02:53:51 +00:00 (Migrated from gitlab.com)

Security review — MR !529

Commit reviewed: 9674d3b1c9af67f4c51dceae19622862f4d38617
Scope: PodiumTranchePool.sol (new), PodiumVaults.sol (creditTranche no-op for external pools, _moveFromPool / SafeERC20), PodiumVaultsNonCommingled.t.sol, docs/invariants for #348.

Outcome: FINDINGS: 0 medium+

Security review: no medium+ findings on this diff.

Summary

Reviewed attacker-controlled input paths into the new/changed sinks:

Sink Caller control Controls
PodiumTranchePool.pushTo Only operator (PodiumVaults) msg.sender == operator; tested in test_nonCommingled_pushTo_reverts_not_operator
PodiumVaults._moveFromPool → external pushTo Pool addresses are onlyOwner (setActivePool / setSeedPool / setFuturePool) from.code.length > 0 blocks EOAs; arena-only callers on payout/roll
PodiumVaults.creditTranche no-op Arena-only External-pool categories skip ledger writes; balances tracked on-chain in PodiumTranchePool
Buy routing to external pools Unchanged TimeArena batching disables when any slot is non-commingled Per-tranche safeTransfer to configured pool addresses

The MR correctly fixes the pre-existing external-pool disburse path: _moveFromPool pulls from the configured pool contract via pushTo instead of debiting the commingled vault balance. creditTranche no-op prevents buy-path reverts for non-commingled wiring without ledger inflation.

Residual risks (owner misconfiguration of pool addresses, non-PodiumTranchePool contracts with a compatible pushTo, mixed commingled/external tranches within one category) require onlyOwner governance actions and are out of scope per threat model.

Inline threads: none

## Security review — MR !529 **Commit reviewed:** `9674d3b1c9af67f4c51dceae19622862f4d38617` **Scope:** `PodiumTranchePool.sol` (new), `PodiumVaults.sol` (`creditTranche` no-op for external pools, `_moveFromPool` / `SafeERC20`), `PodiumVaultsNonCommingled.t.sol`, docs/invariants for #348. **Outcome:** `FINDINGS: 0` medium+ Security review: no medium+ findings on this diff. ### Summary Reviewed attacker-controlled input paths into the new/changed sinks: | Sink | Caller control | Controls | |------|----------------|----------| | `PodiumTranchePool.pushTo` | Only `operator` (`PodiumVaults`) | `msg.sender == operator`; tested in `test_nonCommingled_pushTo_reverts_not_operator` | | `PodiumVaults._moveFromPool` → external `pushTo` | Pool addresses are `onlyOwner` (`setActivePool` / `setSeedPool` / `setFuturePool`) | `from.code.length > 0` blocks EOAs; arena-only callers on payout/roll | | `PodiumVaults.creditTranche` no-op | Arena-only | External-pool categories skip ledger writes; balances tracked on-chain in `PodiumTranchePool` | | Buy routing to external pools | Unchanged `TimeArena` batching disables when any slot is non-commingled | Per-tranche `safeTransfer` to configured pool addresses | The MR correctly fixes the pre-existing external-pool disburse path: `_moveFromPool` pulls from the configured pool contract via `pushTo` instead of debiting the commingled vault balance. `creditTranche` no-op prevents buy-path reverts for non-commingled wiring without ledger inflation. Residual risks (owner misconfiguration of pool addresses, non-`PodiumTranchePool` contracts with a compatible `pushTo`, mixed commingled/external tranches within one category) require `onlyOwner` governance actions and are out of scope per threat model. **Inline threads:** none
PlasticDigits commented 2026-06-28 04:49:47 +00:00 (Migrated from gitlab.com)

mentioned in commit 670ba249ea

mentioned in commit 670ba249ead60d58151e26412ab3a04c50da2a75
PlasticDigits (Migrated from gitlab.com) merged commit 670ba249ea into main 2026-06-28 04:49:47 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
agent:fix_bugfix

   
agent:fix_conflicts

   
agent:fix_security

   
agent:gap_analysis

   
agent:implement

   
agent:open_issues

   
agents

   
agent:security_audit

   
agent:verify
  
area
timecurve

  
arena

   
arena-v2

   
audit

   
block:feature_review

   
block:security

   
bug

   
contracts

   
design

   
devops

   
docs
Documentation

  
documentation

   
enhancement

   
epic
Epic / umbrella issue

  
feature

   
frontend

   
indexer

   
low priority
Low priority, investigate other issues first

  
megaeth

   
operations

   
ops
Deploy and operations

  
performance

   
QA

   
qa checklist

   
referrals

   
removal
Legacy removal

  
security

   
smart-contracts

   
tech-debt

   
testing

   
time-arena
TimeArena v2 revamp

  
timecurve

   
visual-qa
No labels
agent:fix_bugfix
agent:fix_conflicts
agent:fix_security
agent:gap_analysis
agent:implement
agent:open_issues
agents
agent:security_audit
agent:verify
area
timecurve
arena
arena-v2
audit
block:feature_review
block:security
bug
contracts
design
devops
docs
documentation
enhancement
epic
feature
frontend
indexer
low priority
megaeth
operations
ops
performance
QA
qa checklist
referrals
removal
security
smart-contracts
tech-debt
testing
time-arena
timecurve
visual-qa
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
code/yieldomega!529
No description provided.