feat(upgrade): remove WithdrawalVault upgrade from upgrade

contracts/0.8.25/utils/UpgradeTemplateV3.sol

@@ -54,6 +54,9 @@
     function isMigrationAllowed() external view returns (bool);
 }
 
+interface IStakingRouter is IAccessControlEnumerable {
+}
+
 interface IUpgradeableBeacon {
     function implementation() external view returns (address);
     function owner() external view returns (address);
@@ -64,10 +67,6 @@
     function implementation() external view returns (address);
 }
 
-interface IWithdrawalVault is IAccessControlEnumerable, IVersioned, IWithdrawalsManagerProxy {
-    function getConsensusContract() external view returns (address);
-}
-
 interface IVaultFactory {
     function BEACON() external view returns (address);
     function DELEGATION_IMPL() external view returns (address);
@@ -143,7 +142,6 @@
         // New non-aragon implementations
         address accountingOracleImplementation;
         address newLocatorImplementation;
-        address withdrawalVaultImplementation;
 
         // Existing proxies and contracts
         address agent;
@@ -156,13 +154,13 @@
         address wstETH;
     }
     // Old upgraded non-proxy contracts
     IBurner public immutable _oldBurner;
     IOracleReportSanityChecker public immutable _oldOracleReportSanityChecker;
 
     // New proxy contracts
     IAccounting public immutable _accounting;
     IVaultHub public immutable _vaultHub;
     IPredepositGuarantee public immutable _predepositGuarantee;
 
     // New non-proxy contracts
     IBurner public immutable _burner;
@@ -180,7 +178,6 @@
     // New non-aragon implementations
     address public immutable _accountingOracleImplementation;
     address public immutable _newLocatorImplementation;
-    address public immutable _withdrawalVaultImplementation;
 
     // Existing proxies and contracts
     address public immutable _agent;
@@ -192,10 +189,10 @@
     ILidoLocator public immutable _locator;
     address public immutable _nodeOperatorsRegistry;
     address public immutable _simpleDvt;
+    IStakingRouter public immutable _stakingRouter;
     address public immutable _validatorsExitBusOracle;
     address public immutable _voting;
     address public immutable _withdrawalQueue;
-    IWithdrawalVault public immutable _withdrawalVault;
     address public immutable _wstETH;
 
     // Values to set
@@ -234,10 +231,8 @@
         keccak256("SECOND_OPINION_MANAGER_ROLE");
     bytes32 public constant INITIAL_SLASHING_AND_PENALTIES_MANAGER_ROLE =
         keccak256("INITIAL_SLASHING_AND_PENALTIES_MANAGER_ROLE");
-
-    // WithdrawalVault
-    bytes32 internal constant ADD_FULL_WITHDRAWAL_REQUEST_ROLE = keccak256("ADD_FULL_WITHDRAWAL_REQUEST_ROLE");
-
+    // StakingRouter
+    bytes32 public constant REPORT_REWARDS_MINTED_ROLE = keccak256("REPORT_REWARDS_MINTED_ROLE");
     // VaultHub
     bytes32 public constant VAULT_MASTER_ROLE = keccak256("Vaults.VaultHub.VaultMasterRole");
     bytes32 public constant VAULT_REGISTRY_ROLE = keccak256("Vaults.VaultHub.VaultRegistryRole");
@@ -248,7 +243,6 @@
 
     uint256 internal constant EXPECTED_FINAL_LIDO_VERSION = 3;
     uint256 internal constant EXPECTED_FINAL_ACCOUNTING_ORACLE_VERSION = 3;
-    uint256 internal constant EXPECTED_FINAL_WITHDRAWAL_VAULT_VERSION = 2;
 
     //
     // Constants
@@ -304,17 +298,16 @@
 
         _accountingOracleImplementation = params.accountingOracleImplementation;
         _newLocatorImplementation = params.newLocatorImplementation;
-        _withdrawalVaultImplementation = params.withdrawalVaultImplementation;
 
         _oldBurner = IBurner(_locator.burner());
         _oldOracleReportSanityChecker = IOracleReportSanityChecker(_locator.oracleReportSanityChecker());
         _oracleReportSanityChecker = IOracleReportSanityChecker(params.oracleReportSanityChecker);
         _accountingOracle = IAccountingOracle(_locator.accountingOracle());
         _elRewardsVault = _locator.elRewardsVault();
+        _stakingRouter = IStakingRouter(_locator.stakingRouter());
         _lido = ILido(_locator.lido());
         _validatorsExitBusOracle = _locator.validatorsExitBusOracle();
         _withdrawalQueue = _locator.withdrawalQueue();
-        _withdrawalVault = IWithdrawalVault(_locator.withdrawalVault());
     }
 
     /// @notice Must be called after LidoLocator is upgraded
@@ -416,9 +409,6 @@
     }
 
     function _assertInitialProxyImplementations() internal view {
-        if (_withdrawalVault.implementation() != _withdrawalVaultImplementation) {
-            revert IncorrectInitialImplementation(address(_withdrawalVault));
-        }
     }
 
     function _assertZeroOZRoleHolders(IAccessControlEnumerable accessControlled, bytes32 role) internal view {
@@ -467,10 +457,6 @@
 
         _assertBurnerAllowances();
 
-        if (_withdrawalVault.implementation() != _withdrawalVaultImplementation) {
-            revert IncorrectProxyImplementation(address(_withdrawalVault), _withdrawalVaultImplementation);
-        }
-
         if (_vaultFactory.BEACON() != address(_upgradeableBeacon)) {
             revert IncorrectVaultFactoryBeacon(address(_vaultFactory), address(_upgradeableBeacon));
         }
@@ -538,12 +524,12 @@
         }
     }
 
     function _assertAragonAppImplementation(IAragonAppRepo repo, address implementation) internal view {
         (, address actualImplementation, ) = repo.getLatest();
         if (actualImplementation != implementation) {
             revert IncorrectAragonAppImplementation(address(repo), implementation);
         }
     }
 
     function _assertFinalACL() internal view {
         address agent = _agent;
@@ -551,19 +537,17 @@
         // Burner
         IBurner burner = _burner;
         _assertSingleOZRoleHolder(burner, DEFAULT_ADMIN_ROLE, agent);
-        address[] memory holders = new address[](4);
-        holders[0] = address(_lido);
-        holders[1] = _nodeOperatorsRegistry;
-        holders[2] = _simpleDvt;
-        holders[3] = address(_accounting);
-        _assertOZRoleHolders(burner, REQUEST_BURN_SHARES_ROLE, holders);
+        {
+            address[] memory holders = new address[](4);
+            holders[0] = address(_lido);
+            holders[1] = _nodeOperatorsRegistry;
+            holders[2] = _simpleDvt;
+            holders[3] = address(_accounting);
+            _assertOZRoleHolders(burner, REQUEST_BURN_SHARES_ROLE, holders);
+        }
         // NB: we don't check REQUEST_BURN_SHARES_ROLE on the old burner is revoked
         //     because it is left intentionally to simplify aragon voting operations
 
-        // WithdrawalVault
-        _assertSingleOZRoleHolder(_withdrawalVault, DEFAULT_ADMIN_ROLE, _agent);
-        _assertSingleOZRoleHolder(_withdrawalVault, ADD_FULL_WITHDRAWAL_REQUEST_ROLE, _validatorsExitBusOracle);
-
         // VaultHub
         _assertSingleOZRoleHolder(_vaultHub, DEFAULT_ADMIN_ROLE, _agent);
         _assertSingleOZRoleHolder(_vaultHub, VAULT_MASTER_ROLE, _agent);
@@ -582,12 +566,19 @@
 
         // PredepositGuarantee
         _assertProxyAdmin(_predepositGuarantee, _agent);
+
+        // StakingRouter
+        {
+            address[] memory holders = new address[](2);
+            holders[0] = address(_lido);
+            holders[1] = address(_accounting);
+            _assertOZRoleHolders(_stakingRouter, REPORT_REWARDS_MINTED_ROLE, holders);
+        }
     }
 
     function _checkContractVersions() internal view {
         _assertContractVersion(_lido, EXPECTED_FINAL_LIDO_VERSION);
         _assertContractVersion(_accountingOracle, EXPECTED_FINAL_ACCOUNTING_ORACLE_VERSION);
-        _assertContractVersion(_withdrawalVault, EXPECTED_FINAL_WITHDRAWAL_VAULT_VERSION);
     }
 
     function _assertContractVersion(IVersioned versioned, uint256 expectedVersion) internal view {

hardhat.config.ts

@@ -44,6 +44,11 @@ const config: HardhatUserConfig = {
         accountsBalance: "100000000000000000000000",
       },
       forking: getHardhatForkingConfig(),
+      // mining: {
+      //   mempool: {
+      //     order: "fifo"
+      //   }
+      // },
     },
     "custom": {
       url: RPC_URL,

scripts/scratch/steps/0150-transfer-roles.ts

@@ -24,7 +24,6 @@ export async function main() {
     { name: "OracleDaemonConfig", address: state.oracleDaemonConfig.address },
     { name: "OracleReportSanityChecker", address: state.oracleReportSanityChecker.address },
     { name: "VaultHub", address: state.vaultHub.proxy.address },
-    { name: "WithdrawalVault", address: state.withdrawalVault.proxy.address },
     { name: "PredepositGuarantee", address: state.predepositGuarantee.proxy.address },
   ];
 

scripts/upgrade/steps/0100-deploy-contracts.ts

@@ -60,9 +60,6 @@ export async function main() {
     [pdgDeployParams.gIndex, pdgDeployParams.gIndexAfterChange, pdgDeployParams.changeSlot],
   );
 
-  // Deploy WithdrawalVault new implementation
-  await deployImplementation(Sk.withdrawalVault, "WithdrawalVault", deployer, [lidoAddress, treasuryAddress]);
-
   // Deploy AccountingOracle new implementation
   const accountingOracleImpl = await deployImplementation(Sk.accountingOracle, "AccountingOracle", deployer, [
     locatorAddress,

scripts/upgrade/steps/0200-initialize-contracts.ts

@@ -51,12 +51,6 @@ export async function main(): Promise<void> {
 
   await makeTx(vaultHub, "renounceRole", [DEFAULT_ADMIN_ROLE, deployer], { from: deployer });
 
-  //
-  // WithdrawalVault
-  //
-
-  // NB: cannot grant ADD_FULL_WITHDRAWAL_REQUEST_ROLE here because WithdrawalVault need to be upgraded by agent first
-
   //
   // Burner
   //

scripts/upgrade/steps/0300-deploy-upgrade-template.ts

@@ -34,7 +34,6 @@ export async function main() {
       // New non-aragon implementations
       state[Sk.accountingOracle].implementation.address,
       state[Sk.lidoLocator].implementation.address,
-      state[Sk.withdrawalVault].implementation.address,
 
       // Existing proxies and contracts
       state[Sk.appAgent].proxy.address,

scripts/upgrade/steps/0500-mock-aragon-voting.ts

@@ -1,3 +1,5 @@
+import { mine } from "@nomicfoundation/hardhat-network-helpers";
+
 import {
   AccountingOracle,
   Kernel,
@@ -7,8 +9,6 @@ import {
   Repo,
   StakingRouter,
   UpgradeTemplateV3,
-  WithdrawalsManagerProxy,
-  WithdrawalVault,
 } from "typechain-types";
 
 import { ether, log } from "lib";
@@ -28,18 +28,20 @@ export async function main(): Promise<void> {
   const lidoAddress = state[Sk.appLido].proxy.address;
   const locatorImplAddress = state[Sk.lidoLocator].implementation.address;
   const lidoImplAddress = state[Sk.appLido].implementation.address;
-  const withdrawalVaultAddress = state[Sk.withdrawalVault].proxy.address;
-  const withdrawalVaultImplAddress = state[Sk.withdrawalVault].implementation.address;
   const accountingOracleImplAddress = state[Sk.accountingOracle].implementation.address;
   const kernelAddress = state[Sk.aragonKernel].proxy.address;
   const stakingRouterAddress = state[Sk.stakingRouter].proxy.address;
   const accountingAddress = state[Sk.accounting].proxy.address;
-  const validatorsExitBusOracleAddress = state[Sk.validatorsExitBusOracle].proxy.address;
   const accountingOracleAddress = state[Sk.accountingOracle].proxy.address;
   const upgradeTemplateV3Address = state[Sk.upgradeTemplateV3].address;
   const simpleDvtAddress = state[Sk.appSimpleDvt].proxy.address;
   const nodeOperatorsRegistryAddress = state[Sk.appNodeOperatorsRegistry].proxy.address;
 
+  // Disable automine to ensure all transactions happen in the same block
+  // TODO: automine false and mempool fifo order and manual nonce management still doesn't work!
+  // await mine(1);
+  // await ethers.provider.send("evm_setAutomine", [false]);
+
   // while locator is not upgraded yet we can fetch the old burner address
   const locator = await loadContract<LidoLocator>("LidoLocator", locatorAddress);
   const oldBurnerAddress = locator.burner();
@@ -52,67 +54,64 @@ export async function main(): Promise<void> {
   const agentSigner = await impersonate(agentAddress, ether("1"));
   const votingSigner = await impersonate(votingAddress, ether("1"));
 
+  let agentNonce = await agentSigner.getNonce();
+  let votingNonce = await votingSigner.getNonce();
+
   const locatorProxy = await loadContract<OssifiableProxy>("OssifiableProxy", locatorAddress);
-  await locatorProxy.connect(agentSigner).proxy__upgradeTo(locatorImplAddress);
+  await locatorProxy.connect(agentSigner).proxy__upgradeTo(locatorImplAddress, { nonce: agentNonce });
+  agentNonce += 1;
   log("LidoLocator upgraded to implementation", locatorImplAddress);
 
   const upgradeTemplate = await loadContract<UpgradeTemplateV3>("UpgradeTemplateV3", upgradeTemplateV3Address);
-  await upgradeTemplate.connect(votingSigner).startUpgrade();
+  await upgradeTemplate.connect(votingSigner).startUpgrade({ nonce: votingNonce });
+  votingNonce += 1;
   log("UpgradeTemplateV3 startUpgrade");
 
-  const withdrawalsManagerProxy = await loadContract<WithdrawalsManagerProxy>(
-    "WithdrawalsManagerProxy",
-    withdrawalVaultAddress,
-  );
-  await withdrawalsManagerProxy.connect(votingSigner).proxy_upgradeTo(withdrawalVaultImplAddress, "0x");
-  log("WithdrawalsManagerProxy upgraded to implementation", withdrawalVaultImplAddress);
-
-  // This step is required to grant ADD_FULL_WITHDRAWAL_REQUEST_ROLE in the next step
-  const withdrawalVault = await loadContract<WithdrawalVault>("WithdrawalVault", withdrawalVaultAddress);
-  await withdrawalVault.connect(votingSigner).finalizeUpgrade_v2(agentAddress); // can be called by anyone
-  log("WithdrawalVault finalizeUpgrade_v2 with admin", agentAddress);
-
-  const addFullWithdrawalRequestRole = await withdrawalVault.ADD_FULL_WITHDRAWAL_REQUEST_ROLE();
-  await withdrawalVault.connect(agentSigner).grantRole(addFullWithdrawalRequestRole, validatorsExitBusOracleAddress);
-  log(
-    "WithdrawalVault granted ADD_FULL_WITHDRAWAL_REQUEST_ROLE to ValidatorsExitBusOracle",
-    validatorsExitBusOracleAddress,
-  );
-
   const lidoRepo = await loadContract<Repo>("Repo", MAINNET_LIDO_REPO);
-  await lidoRepo.connect(votingSigner).newVersion(lidoAppNewVersion, lidoImplAddress, "0x");
+  await lidoRepo.connect(votingSigner).newVersion(lidoAppNewVersion, lidoImplAddress, "0x", { nonce: votingNonce });
+  votingNonce += 1;
   log("Lido version updated in Lido App Repo");
 
   const aragonKernel = await loadContract<Kernel>("Kernel", kernelAddress);
   const appBasesNamespace = await aragonKernel.APP_BASES_NAMESPACE();
   const lidoAppId = state[Sk.appLido].aragonApp.id;
-  await aragonKernel.connect(votingSigner).setApp(appBasesNamespace, lidoAppId, lidoImplAddress);
+  await aragonKernel.connect(votingSigner).setApp(appBasesNamespace, lidoAppId, lidoImplAddress, { nonce: votingNonce });
+  votingNonce += 1;
   log("Lido upgraded to implementation", lidoImplAddress);
 
   const lido = await loadContract<Lido>("Lido", lidoAddress);
   await lido
     .connect(votingSigner)
-    .finalizeUpgrade_v3(oldBurnerAddress, simpleDvtAddress, nodeOperatorsRegistryAddress, csmAccountingAddress); // can be called by anyone
+    .finalizeUpgrade_v3(oldBurnerAddress, simpleDvtAddress, nodeOperatorsRegistryAddress, csmAccountingAddress, { nonce: votingNonce }); // can be called by anyone
+  votingNonce += 1;
   // NB: burner migration happens in Lido.finalizeUpgrade_v3()
   log("Lido finalizeUpgrade_v3");
 
   const accountingOracleProxy = await loadContract<OssifiableProxy>("OssifiableProxy", accountingOracleAddress);
-  await accountingOracleProxy.connect(agentSigner).proxy__upgradeTo(accountingOracleImplAddress);
+  await accountingOracleProxy.connect(agentSigner).proxy__upgradeTo(accountingOracleImplAddress, { nonce: agentNonce });
   log("AccountingOracle upgraded to implementation", accountingOracleImplAddress);
+  agentNonce += 1;
 
   const accountingOracle = await loadContract<AccountingOracle>(
     "AccountingOracle",
     state[Sk.accountingOracle].proxy.address,
   );
-  await accountingOracle.connect(agentSigner).finalizeUpgrade_v3(aoConsensusVersion); // can be called by anyone
+  await accountingOracle.connect(agentSigner).finalizeUpgrade_v3(aoConsensusVersion, { nonce: agentNonce }); // can be called by anyone
   log("AccountingOracle finalizeUpgrade_v3 with consensus version", aoConsensusVersion);
+  agentNonce += 1;
 
   const stakingRouter = await loadContract<StakingRouter>("StakingRouter", stakingRouterAddress);
   await stakingRouter
     .connect(agentSigner)
-    .grantRole(await stakingRouter.REPORT_REWARDS_MINTED_ROLE(), accountingAddress);
+    .grantRole(await stakingRouter.REPORT_REWARDS_MINTED_ROLE(), accountingAddress, { nonce: agentNonce });
   log("StakingRouter granted REPORT_REWARDS_MINTED_ROLE to Accounting", accountingAddress);
+  agentNonce += 1;
 
-  await upgradeTemplate.connect(votingSigner).finishUpgrade();
+  await upgradeTemplate.connect(votingSigner).finishUpgrade({ nonce: votingNonce });
+  votingNonce += 1;
   log("UpgradeTemplateV3 finishUpgrade");
+
+  // await ethers.provider.send("evm_setAutomine", [true]);
+
+  await mine(1);
 }