HUBS-224 crowdsale with individual locking staking periods #170
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,54 @@ | ||
| // SPDX-License-Identifier: MIT | ||
| pragma solidity ^0.8.18; | ||
|
|
||
| import "forge-std/Script.sol"; | ||
| import "forge-std/console.sol"; | ||
| import { ERC1967Proxy } from "@openzeppelin/contracts/proxy/ERC1967/ERC1967Proxy.sol"; | ||
| import { IPNFT } from "../../src/IPNFT.sol"; | ||
| import { IPermissioner, TermsAcceptedPermissioner } from "../../src/Permissioner.sol"; | ||
| import { StakedLockingCrowdSale } from "../../src/crowdsale/StakedLockingCrowdSale.sol"; | ||
| import { LockingCrowdSale } from "../../src/crowdsale/LockingCrowdSale.sol"; | ||
| import { TimelockedToken } from "../../src/TimelockedToken.sol"; | ||
| import { TokenVesting } from "@moleculeprotocol/token-vesting/TokenVesting.sol"; | ||
|
|
||
| TimelockedToken constant timelockedTokenImplementation = TimelockedToken(0xF8F79c1E02387b0Fc9DE0945cD9A2c06F127D851); | ||
| address constant moleculeDevMultisig = 0x9d5a6ae551f1117946FF6e0e86ef9A1B20C90Cb0; | ||
|
|
||
| //mainnet 0xCfA0F84660fB33bFd07C369E5491Ab02C449f71B; | ||
|
|
||
| contract RolloutV25Sale is Script { | ||
| function run() public { | ||
|
|
||
| TokenVesting vesting = TokenVesting(0x8f80d1183CD983B01B0C9AC6777cC732Ec9800de); //Moldao | ||
|
|
||
| vm.startBroadcast(); | ||
| StakedLockingCrowdSale stakedLockingCrowdSale = new StakedLockingCrowdSale(timelockedTokenImplementation); | ||
| vesting.grantRole(vesting.ROLE_CREATE_SCHEDULE(), address(stakedLockingCrowdSale)); | ||
| //stakedLockingCrowdSale.trustLockingContract(IERC20()); | ||
| stakedLockingCrowdSale.trustVestingContract(vesting); | ||
| // stakedLockingCrowdSale.transferOwnership(moleculeDevMultisig); | ||
|
Comment on lines
+27
to
+29
There was a problem hiding this comment. 💡 Codebase verification Based on the search results, I can now provide a final response: Critical: Trust relationships and ownership transfer must be properly configured The commented lines in RolloutV25Sale.sol require attention:
Required actions:
🔗 Analysis chainCritical: Implement contract trust relationships The commented lines indicate missing trust relationships between contracts: //stakedLockingCrowdSale.trustLockingContract(IERC20());
stakedLockingCrowdSale.trustVestingContract(vesting);
//stakedLockingCrowdSale.transferOwnership(moleculeDevMultisig);These relationships are crucial for the crowdsale functionality. 🏁 Scripts executedThe following scripts were executed for the analysis: Script: #!/bin/bash
# Description: Verify vesting contract configuration
# Check if vesting contract exists and has correct roles
echo "Checking vesting contract at 0x8f80d1183CD983B01B0C9AC6777cC732Ec9800de..."
cast call 0x8f80d1183CD983B01B0C9AC6777cC732Ec9800de "hasRole(bytes32,address)" \
$(cast --format-bytes32-string "ROLE_CREATE_SCHEDULE") \
0x2d309CF13dC3872f9c9B1B06Ebf6F60caDe08d55
Length of output: 526 Script: #!/bin/bash
# Let's analyze the contract relationships and dependencies
# Find all references to trustLockingContract and trustVestingContract
echo "Searching for trust relationships..."
rg -A 3 "trustLockingContract|trustVestingContract" --type solidity
# Find ownership transfer patterns
echo -e "\nSearching for ownership transfers..."
rg -A 3 "transferOwnership" --type solidity
# Find contract interfaces and implementations
echo -e "\nSearching for related contract definitions..."
rg -B 2 "contract StakedLockingCrowdSale|contract TokenVesting" --type solidity
Length of output: 573 Script: #!/bin/bash
# Let's analyze the contract relationships and dependencies without file type filter
# Find all references to trustLockingContract and trustVestingContract
echo "Searching for trust relationships..."
rg -A 3 "trustLockingContract|trustVestingContract"
# Find ownership transfer patterns
echo -e "\nSearching for ownership transfers..."
rg -A 3 "transferOwnership"
# Find contract interfaces and implementations
echo -e "\nSearching for related contract definitions..."
rg -B 2 "contract StakedLockingCrowdSale|contract TokenVesting"
# List all Solidity files to understand the contract structure
echo -e "\nListing Solidity files..."
fd -e sol
Length of output: 12463 |
||
| vm.stopBroadcast(); | ||
|
|
||
| console.log("STAKED_LOCKING_CROWDSALE_ADDRESS=%s", address(stakedLockingCrowdSale)); | ||
| console.log("timelocked token implementation=%s", address(timelockedTokenImplementation)); | ||
| // 0x7c36c64DA1c3a2065074caa9C48e7648FB733aAB | ||
| // vestedDaoToken.grantRole(vestedDaoToken.ROLE_CREATE_SCHEDULE(), address(stakedLockingCrowdSale)); | ||
| // stakedLockingCrowdSale.trustVestingContract(vestedDaoToken); | ||
| } | ||
|
Comment on lines
+34
to
+37
There was a problem hiding this comment. Critical: Uncomment and implement role management The commented code appears to handle critical role assignments: // vestedDaoToken.grantRole(vestedDaoToken.ROLE_CREATE_SCHEDULE(), address(stakedLockingCrowdSale));
// stakedLockingCrowdSale.trustVestingContract(vestedDaoToken);This should either be:
Also applies to: 47-49 |
||
| } | ||
|
|
||
| contract RolloutV25LockingSale is Script { | ||
| function run() public { | ||
|
|
||
| vm.startBroadcast(); | ||
| LockingCrowdSale lockingCrowdsale = new LockingCrowdSale(timelockedTokenImplementation); | ||
| //lockingCrowdsale.transferOwnership(moleculeDevMultisig); | ||
| vm.stopBroadcast(); | ||
|
Comment on lines
+44
to
+46
There was a problem hiding this comment. Critical: Implement ownership transfer The ownership transfer to the multisig is commented out: //lockingCrowdsale.transferOwnership(moleculeDevMultisig);This is a security risk as the deployer will retain control. |
||
|
|
||
| console.log("LOCKING_CROWDSALE_ADDRESS=%s", address(lockingCrowdsale)); | ||
| console.log("timelocked token implementation=%s", address(timelockedTokenImplementation)); | ||
| // 0x7c36c64DA1c3a2065074caa9C48e7648FB733aAB | ||
| // vestedDaoToken.grantRole(vestedDaoToken.ROLE_CREATE_SCHEDULE(), address(stakedLockingCrowdSale)); | ||
| // stakedLockingCrowdSale.trustVestingContract(vestedDaoToken); | ||
| } | ||
| } | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
💡 Codebase verification
Hardcoded addresses need to be updated for mainnet deployment
The hardcoded addresses in
RolloutV25Sale.solare currently set for the Sepolia testnet environment, as evidenced by:Please update these addresses with the appropriate mainnet values before deployment:
🔗 Analysis chain
Validate hardcoded contract addresses
The TimelockedToken implementation and multisig addresses should be validated before deployment.
Let me try to verify the addresses by searching for their usage in the codebase to understand the context better.
Let me search for more context about the TimelockedToken contract and its implementation.
🏁 Scripts executed
The following scripts were executed for the analysis:
Script:
Length of output: 1187
Script:
Length of output: 1750
Script:
Length of output: 7524