bootnodedev / nexus-covered-vaults

Nexus covered vaults

Pre-requirements

The following prerequisites are required:

• Node.js
• Yarn

Install dependencies

Before running any command, make sure to install dependencies:

yarn

Compile contracts

Compile the smart contracts with Hardhat:

yarn compile

Test

Run unit tests:

yarn test

Integration Test

Runs integration tests with Nexus Mutual V2 on a Mainnet fork.

Complete FORK_URL in .env file

Run tests

$ yarn test:fork

Coverage

Run unit tests coverage:

yarn coverage

Gas Report

Run unit tests with gas report:

yarn gas-report

Linter

Run typescript and solidity linters:

yarn lint

Deployment

Create .env file and complete the variables:

cp .env.example .env

Deploy the contracts to Mainnet Network

Deploy covered vault factory contract:

yarn deploy:factory:mainnet

Deploy cover manager contract:

yarn deploy:cover-manager:mainnet

Deploy a new covered vault contract:

yarn deploy:covered-vault:mainnet

Deploy the contracts to Goerli Network

Deploy mock contracts:

yarn deploy:mocks:goerli

Deploy covered vault factory contract:

yarn deploy:factory:goerli

Deploy cover manager contract:

yarn deploy:cover-manager:goerli

Deploy a new covered vault contract:

yarn deploy:covered-vault:goerli

nexus-covered-vaults's Issues

Create cover manager contract

Should decide if a whitelist is needed or not to interact with the methods

Implement withdraw method interaction with underlying vault

Add buyCover method in covered vault

Should validate min length cover period, store nft id
Read productId from immutable variable

Withdraw

Create nexus v2 contract mocks (if needed)

Implement mint method interaction with underlying vault

Add underlying vault value threshold

Checks in the methods and methods to update parameter

Add method to update cover manager in covered vault

Evaluate using internal accounting instead of using tokens instantaneous balances

Keep assets balances in internal accounting instead of using token.balanceOf() to calculate the current vault state. Most of other ERC4626 seems to be doing it for security reasons.

Benefits:

• A possible solution to avoid inflation attack https://ethereum-magicians.org/t/address-eip-4626-inflation-attacks-with-virtual-shares-and-assets/12677
• Increases security preventing instantaneous changes in the exchange rate.
• Improve gas usage on fees collection/distribution

Create basic covered vault contract

Should extend ERC-4626. We should decide between the following implementations:

• OpenZeppelin
• Solmate

Claim

User flows

Add underlying vault exchange rate threshold

Checks in the methods and methods to update parameter

Create ERC-4626 underlying vault contract mock

[Improvement] Add ERC4626 property tests

Add https://github.com/a16z/erc4626-tests as one more type of testing to validate the implementation

Repository

Create mechanism to deposit and withdraw funds into the cover manager

Should keep track of deposits in different assets and ETH

The deposited funds should be used on buyCover(), replacing the current mechanism where funds are transferred into the cover manager first and then returned remaining to the caller.

Methods to add:

• coverManager.depositOnBehalf(address _asset, uint256 _amount, address _to); (Anyone can call. validate _to is allowed if it is not msg.sender)
• coverManager.depositETHOnBehalf(address _to); (Anyone can call. validate _to is allowed)
• coverManager.withdraw(address _asset, uint256 _amount, address _to); (used for both assets and eth) use 0xEeeeeEeeeEeEeeEeEeEeeEEEeeeeEeeeeeeeEEeE; to withdraw ETH)
• coveredVault.withdrawCoverManagerAssets(address _asset, uint256 _amount, address _to); (onlyAdmin can call this method, ?to != address(this))

Methods to Update:
coverManager.buyCover()

• validate msg.sender has credit in mapping
• remove payable
• remove transferFrom
• rename remaining -> spent
• remove returning remaining
• update mapping to reduce spent amount on asset

Add EIP-2612 extension to covered vault

Update the covered vault contract to extend https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/token/ERC20/extensions/draft-ERC20Permit.sol

Implement deposit method interaction with underlying vault

Add cover manager redeemCover

Must validate:

• Only allowed can call this method
• msg.sender == coverNFT.ownerOf(coverId)

Requirements:

• caller should previously give allowance on the coverNFT to coverManager
• caller should previously give allowance on the product yield token address yieldTokenAddress

Logic:

• Should transfer depeggedTokens of yieldTokenAddress to the CM
• approve yieldTokenAddress depeggedTokens amount to YTI
• Call Should call YTI.redeemPayout() with following parameters:

    uint104 incidentId: passed by parameter
    uint32 coverId: passed by parameter
    uint segmentId: passed by parameter
    uint depeggedTokens: passed by parameter
    address payable payoutAddress: passed by parameter
    bytes calldata optionalParams: passed by parameter

• return payoutAmount and coverAsset (returned by redeemPayou())

Example how to get yieldTokenAddress:

CoverData memory coverData = coverContract.coverData(coverId);
Product memory product = coverContract.products(coverData.productId);
product.yieldTokenAddress

Internal code review

Final code review of the contracts looking for optimizations and improvements before delivering the project

Add covered vault buyCover params validations

• Amount >= invested?
• Should we validate the period? Nexus already has a min valid period MIN_COVER_PERIOD = 28 days
• Should we read coverAsset and/or payment asset from contract variables?
• Should use the existing coverId
• Should only allow to change the coverId if previous cover was expired (lastSegment.start + lastSegment.period <= block.timestamp)
• Review other parameters and think how to make them after to use

Nexus Interaction

Add cover manager buyCover

Add access control roles to covered vaults

Add docs in the repo

• Add/Improve NatSpec comments in the code
• Add docs in README file
• Add deployment/config/other needed docs in /docs

Operator flows

Repo setup

Reduce number of calls to underlying vault on deposit/mint method

With the changes introduced in the PR #55 now the deposit method will calculate the totalAsset twice (one on maxDeposit() y the second one in previewDeposit() internal calls). totalAssets() performs a call to the underlying vault so it is important to refactor the code to perform an internal to totalAssets() only once.

The same applies to the mint() method with maxMint() and previewMint()

Add cover manager editCover

Add Integration tests

Besides unit tests with mocked underlying vault and nexus contracts, we should add automated tests with a real instance of nexus v2 and an ERC-4626 underlying vault if available.

Review existing ERC4626 implementations looking for security measures

Add editCover logic in covererd vault

Should validate min length cover period
Should use the existing coverId
Should only allow to change the coverId if previous cover was expired (lastSegment.start + lastSegment.period <= block.timestamp)

Add management fee

Add in invest/uninvest methods workflow using a setFee/ApplyFee steps

Add deposit fee

Add in deposit/mint workflow using a setFee/ApplyFee steps

Create vault factory contract

Add nexus v2 into the repo for integration tests

Increase test coverage

Vault underlying asset and Nexus cover asset discussion

The ERC-4626 is defined as a standard API for tokenized Vaults representing shares of a single underlying EIP-20 token. That means that users must receive the same asset previously deposited when redeeming their shares. Otherwise receiving different or multiple assets will make it difficult to integrate with other vaults/protocols which is the main reason why this standard exists.

Nexus Mutual has a defined list of supported assets that can be specified as cover assets of a cover (ETH, DAI, Other?). The cover asset could not be the same as the one used by the covered product. For example, DAI could be used as a cover asset for a product that uses USDC.

For this first covered vault implementation, we propose to add the limitation that the cover cover asset MUST be the same as the underlying asset handled by the vault. This will simplify the complexity of the logic and the asset accounting and ensure users receive the correct assets. So for example if DAI is the only stablecoin supported as a cover asset in Nexus, only underlying vaults that use DAI could be deployed.

As Nexus Mutual supports more cover assets in the future, new products will be able to be used by this solution. For example, if USDC is supported as a cover asset, underlying vaults that use USDC could be used by covered vaults.

At the same time, this solution could be iterated in future versions to include functionality to swap the received cover asset into the underlying asset removing this limitation of being tied to supported cover assets in Nexus. However, this introduces a lot of complexity and risks in the system (integrations with DEXes and oracles) that's why we do not recommend going with this path at least for the first version.

Special consideration for ETH
Nexus Mutual supports ETH as a cover asset, which could allow for using WETH as an underlying asset in the covered vault if the ETH is wrapped after receiving it when redeeming a payout.

Add deposit/mint limit threshold

Add covered amount validation in invest method

Add tests for vault simulated scenarios in discovery phase

Add method to uninvest funds from underlying vault

Extend covered vault to implement EIP-5143

See https://eips.ethereum.org/EIPS/eip-5143

Add method to invest funds into underlying vault

Implement redeem method interaction with underlying vault

Add pausable capabilities for operator

Create deployment script

[Improvement] Add cover manager method to transfer Nexus membership

The CoverManager contract requires that a Nexus member transfer the membership to the contract in order to be able to operate with the Nexus protocol.

It could be the case that there is a change in Nexus Mutual and the CoverManager contract is no longer compatible with the new version of the protocol or that the CoverManager contract has some issue that prevents working correctly. In this case, a new CoverManager contract will need to be implemented and the admin will need to transfer the Nexus membership to a new contract, but there is no mechanism to do it.

However, this introduced the risk that the CoveredVault contracts that are using that CoverManager will no longer be able to interact with Nexus. One option could be to also introduce a mechanism to update the CoverManager in the CoveredVault contract but it could introduce some risks such as allowing the admin to withdraw the user's funds by introducing a new malicious CoverManager contract.

Add redeemCover method in covered vault

• Give nft allowance to cover manager
• Give yieldTokenAddress allowance to cover manager
• Call coverManager.redeemCover