From d9d57a28a2aa29c2e325cd288e1cc84c0ae17d94 Mon Sep 17 00:00:00 2001
From: Flocqst <flocastet@icloud.com>
Date: Wed, 12 Jun 2024 18:53:28 +0200
Subject: [PATCH] =?UTF-8?q?=F0=9F=91=B7=20Include=20access=20restriction?=
 =?UTF-8?q?=20to=20the=20upgrade=20mechanism?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/KSXVault.sol             | 14 +++++++++-----
 src/interfaces/IKSXVault.sol | 23 +++++++++++++++++++++++
 2 files changed, 32 insertions(+), 5 deletions(-)
 create mode 100644 src/interfaces/IKSXVault.sol

diff --git a/src/KSXVault.sol b/src/KSXVault.sol
index 6a542b9..e30e1bd 100644
--- a/src/KSXVault.sol
+++ b/src/KSXVault.sol
@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: UNLICENSED
 pragma solidity 0.8.25;
 
+import {IKSXVault} from "src/interfaces/IKSXVault.sol";
 import {ERC4626} from
     "@openzeppelin/contracts/token/ERC20/extensions/ERC4626.sol";
 import {ERC20, IERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
@@ -10,7 +11,7 @@ import "@openzeppelin/contracts/proxy/utils/UUPSUpgradeable.sol";
 /// @title KSXVault Contract
 /// @notice KSX ERC4626 Vault
 /// @author Flocqst (florian@kwenta.io)
-contract KSXVault is ERC4626, UUPSUpgradeable {
+contract KSXVault is IKSXVault, ERC4626, UUPSUpgradeable {
     /*//////////////////////////////////////////////////////////////
                                IMMUTABLES
     //////////////////////////////////////////////////////////////*/
@@ -26,7 +27,7 @@ contract KSXVault is ERC4626, UUPSUpgradeable {
     /*//////////////////////////////////////////////////////////////
                               CONSTRUCTOR
     //////////////////////////////////////////////////////////////*/
-    
+
     /// @notice Constructs the KSXVault contract
     /// @param _token Kwenta token address
     /// @param _pDAO Kwenta owned/operated multisig address
@@ -45,9 +46,12 @@ contract KSXVault is ERC4626, UUPSUpgradeable {
     //////////////////////////////////////////////////////////////*/
 
     /// @inheritdoc UUPSUpgradeable
-    function _authorizeUpgrade(address newImplementation)
+    function _authorizeUpgrade(address /* _newImplementation */ )
         internal
-        virtual
+        view
         override
-    {}
+    {
+        if (pDAO == address(0)) revert NonUpgradeable();
+        if (msg.sender != pDAO) revert OnlyPDAO();
+    }
 }
diff --git a/src/interfaces/IKSXVault.sol b/src/interfaces/IKSXVault.sol
new file mode 100644
index 0000000..8e10106
--- /dev/null
+++ b/src/interfaces/IKSXVault.sol
@@ -0,0 +1,23 @@
+// SPDX-License-Identifier: UNLICENSED
+pragma solidity 0.8.25;
+
+import "@openzeppelin/contracts/proxy/utils/UUPSUpgradeable.sol";
+import "@openzeppelin/contracts/token/ERC20/extensions/ERC4626.sol";
+
+/// @title Kwenta KSXVault Interface
+/// @author Flocqst (florian@kwenta.io)
+interface IKSXVault {
+    /*//////////////////////////////////////////////////////////////
+                                 ERRORS
+    //////////////////////////////////////////////////////////////*/
+
+    /// @notice thrown when attempting to update
+    /// the KSXVault when caller is not the Kwenta pDAO
+    error OnlyPDAO();
+
+    /// @notice thrown when attempting to upgrade
+    /// the KSXVault when the KSXVault is not upgradeable
+    /// @dev the KSXVault is not upgradeable when
+    /// the pDAO has been set to the zero address
+    error NonUpgradeable();
+}