Reserve Updates

.prettierrc

@@ -10,6 +10,12 @@
         "bracketSpacing": true,
         "explicitTypes": "always"
       }
+    },
+    {
+      "files": "test/**/*.ts",
+      "options": {
+        "printWidth": 80
+      }
     }
   ],
   "printWidth": 120,

contracts/governance/StakersDistribution.sol

@@ -52,6 +52,7 @@ contract StakersDistribution is
 	) external {
 		_onlyAvatar();
 		monthlyReputationDistribution = newMonthlyReputationDistribution;
+		_updateRewards();
 	}
 
 	/**
@@ -174,9 +175,10 @@ contract StakersDistribution is
 		_claimReputation(_staker, _stakingContracts);
 	}
 
-	function _claimReputation(address _staker, address[] memory _stakingContracts)
-		internal
-	{
+	function _claimReputation(
+		address _staker,
+		address[] memory _stakingContracts
+	) internal {
 		uint256 totalRep;
 		GoodFundManager gfm = GoodFundManager(
 			nameService.getAddress("FUND_MANAGER")
@@ -206,11 +208,10 @@ contract StakersDistribution is
 	 * @param _user the user to check rewards for
 	 * @return reputation rewards pending for user
 	 */
-	function getUserPendingRewards(address[] memory _contracts, address _user)
-		public
-		view
-		returns (uint256)
-	{
+	function getUserPendingRewards(
+		address[] memory _contracts,
+		address _user
+	) public view returns (uint256) {
 		uint256 pending;
 		for (uint256 i = 0; i < _contracts.length; i++) {
 			(
@@ -239,11 +240,10 @@ contract StakersDistribution is
 	 * @param _user account to get rewards status for
 	 * @return (minted, pending) in GDAO 18 decimals
 	 */
-	function getUserMintedAndPending(address[] memory _contracts, address _user)
-		public
-		view
-		returns (uint256, uint256)
-	{
+	function getUserMintedAndPending(
+		address[] memory _contracts,
+		address _user
+	) public view returns (uint256, uint256) {
 		uint256 pending = getUserPendingRewards(_contracts, _user);
 		uint256 minted;
 		for (uint256 i = 0; i < _contracts.length; i++) {

contracts/reserve/DistributionHelper.sol

@@ -182,10 +182,11 @@ contract DistributionHelper is
 		if (toDistribute == 0) return;
 
 		if (address(this).balance < feeSettings.minBalanceForFees) {
-			uint256 gdToSellfForFee = (toDistribute *
+			uint256 gdToSellForFee = (toDistribute *
 				feeSettings.percentageToSellForFee) / 100;
-			toDistribute -= gdToSellfForFee;
-			buyNativeWithGD(gdToSellfForFee);
+			gdToSellForFee = calcGDToSell(gdToSellForFee);
+			toDistribute -= gdToSellForFee;
+			buyNativeWithGD(gdToSellForFee);
 		}
 
 		uint256 totalDistributed;
@@ -276,6 +277,28 @@ contract DistributionHelper is
 		}
 	}
 
+	function calcGDToSell(
+		uint256 maxAmountToSell
+	) public view returns (uint256 gdToSell) {
+		uint24[] memory fees = new uint24[](1);
+		fees[0] = 500;
+
+		uint256 ethToBuy = feeSettings.minBalanceForFees * 3;
+		(uint256 ethValueInUSDC, ) = STATIC_ORACLE
+			.quoteSpecificFeeTiersWithTimePeriod(
+				uint128(ethToBuy),
+				WETH_TOKEN,
+				USDC_TOKEN,
+				fees,
+				60 //last 1 minute
+			);
+
+		uint256 gdPriceInDai = GoodReserveCDai(nameService.getAddress("RESERVE"))
+			.currentPriceDAI();
+		gdToSell = (ethValueInUSDC * 1e12 * 100) / gdPriceInDai; //* 1e12 to increase usdc to 12 decimals, mul by 100 so result is in 2 G$ 2 decimals
+		gdToSell = gdToSell > maxAmountToSell ? maxAmountToSell : gdToSell;
+	}
+
 	function buyNativeWithGD(uint256 amountToSell) internal {
 		address[] memory path = new address[](2);
 		path[0] = nameService.getAddress("DAI");

contracts/reserve/ExchangeHelper.sol

@@ -78,6 +78,17 @@ contract ExchangeHelper is DAOUpgradeableContract {
 		cDaiAddress = nameService.getAddress("CDAI");
 		// Approve transfer to cDAI contract
 		ERC20(daiAddress).approve(cDaiAddress, type(uint256).max);
+		address reserve = nameService.getAddress("RESERVE");
+		if (reserve != address(0)) {
+			ERC20(nameService.getAddress("GOODDOLLAR")).approve(
+				nameService.getAddress("RESERVE"),
+				type(uint256).max
+			);
+			ERC20(cDaiAddress).approve(
+				nameService.getAddress("RESERVE"),
+				type(uint256).max
+			);
+		}
 		ERC20(daiAddress).approve(
 			nameService.getAddress("UNISWAP_ROUTER"),
 			type(uint256).max
@@ -121,11 +132,9 @@ contract ExchangeHelper is DAOUpgradeableContract {
 			require(
 				ERC20(_buyPath[0]).transferFrom(
 					msg.sender,
-					address(_buyPath[0]) == cDaiAddress
-						? address(reserve)
-						: address(this),
+					address(this),
 					_tokenAmount
-				) == true,
+				),
 				"transferFrom failed, make sure you approved input token transfer"
 			);
 		}
@@ -191,8 +200,9 @@ contract ExchangeHelper is DAOUpgradeableContract {
 		GoodReserveCDai reserve = GoodReserveCDai(
 			nameService.getAddress("RESERVE")
 		);
-		IGoodDollar(nameService.getAddress("GOODDOLLAR")).burnFrom(
+		ERC20(nameService.getAddress("GOODDOLLAR")).transferFrom(
 			msg.sender,
+			address(this),
 			_gdAmount
 		);
 
@@ -290,7 +300,6 @@ contract ExchangeHelper is DAOUpgradeableContract {
 		require(cDaiResult == 0, "Minting cDai failed");
 
 		uint256 cDaiInput = cDai.balanceOf(address(this)) - currCDaiBalance;
-		cDai.transfer(address(reserve), cDaiInput);
 		return reserve.buy(cDaiInput, _minReturn, _targetAddress);
 	}
 
@@ -333,8 +342,9 @@ contract ExchangeHelper is DAOUpgradeableContract {
 			);
 			return swap;
 		} else {
-			if (isBuy)
+			if (isBuy) {
 				ERC20(_inputPath[0]).approve(address(uniswapContract), _tokenAmount);
+			}
 			swap = uniswapContract.swapExactTokensForTokens(
 				_tokenAmount,
 				isBuy ? _minDAIAmount : _minTokenReturn,

contracts/reserve/GoodReserveCDai.sol

@@ -59,6 +59,9 @@ contract GoodReserveCDai is
 
 	bool public gdxDisabled;
 	bool public discountDisabled;
+
+	uint256 private _reentrantStatus;
+
 	// Emits when new GD tokens minted
 	event UBIMinted(
 		//epoch of UBI
@@ -186,19 +189,21 @@ contract GoodReserveCDai is
 		uint256 _tokenAmount,
 		uint256 _minReturn,
 		address _targetAddress
-	) external returns (uint256) {
+	) external nonReentrant returns (uint256) {
 		ERC20 buyWith = ERC20(cDaiAddress);
 		uint256 gdReturn = getMarketMaker().buy(buyWith, _tokenAmount);
 		_targetAddress = _targetAddress == address(0x0)
 			? msg.sender
 			: _targetAddress;
 		address exchangeHelper = nameService.getAddress("EXCHANGE_HELPER");
-		if (msg.sender != exchangeHelper)
-			require(
-				buyWith.transferFrom(msg.sender, address(this), _tokenAmount) == true,
-				"transferFrom failed, make sure you approved input token transfer"
-			);
+
+		require(
+			buyWith.transferFrom(msg.sender, address(this), _tokenAmount) == true,
+			"transferFrom failed, make sure you approved input token transfer"
+		);
+
 		require(gdReturn >= _minReturn, "GD return must be above the minReturn");
+
 		_mintGoodDollars(_targetAddress, gdReturn, true);
 		//mint GDX
 		_mintGDX(_targetAddress, gdReturn);
@@ -224,7 +229,7 @@ contract GoodReserveCDai is
 		address _token,
 		address _to,
 		uint256 _amount
-	) external {
+	) external nonReentrant {
 		getMarketMaker().mintFromReserveRatio(ERC20(_token), _amount);
 		_mintGoodDollars(_to, _amount, false);
 		//mint GDX
@@ -247,16 +252,24 @@ contract GoodReserveCDai is
 		uint256 _minReturn,
 		address _target,
 		address _seller
-	) external returns (uint256, uint256) {
+	) external nonReentrant returns (uint256, uint256) {
 		require(paused() == false, "paused");
 		GoodMarketMaker mm = getMarketMaker();
 		if (msg.sender != nameService.getAddress("EXCHANGE_HELPER")) {
-			IGoodDollar(nameService.getAddress("GOODDOLLAR")).burnFrom(
-				msg.sender,
-				_gdAmount
-			);
 			_seller = msg.sender;
 		}
+
+		/**
+		 * transferfrom and then burn instead of burnfrom to make sure funds after fee are valid
+		 * ie specifically for addresses that hold stolen funds who has 100% fee applied
+		 */
+		IGoodDollar(nameService.getAddress("GOODDOLLAR")).transferFrom(
+			msg.sender,
+			address(this),
+			_gdAmount
+		);
+		IGoodDollar(nameService.getAddress("GOODDOLLAR")).burn(_gdAmount);
+
 		_target = _target == address(0x0) ? msg.sender : _target;
 		//discount on exit contribution based on gdx
 
@@ -358,18 +371,21 @@ contract GoodReserveCDai is
 	 * @dev only FundManager or other with mint G$ permission can call this to trigger minting.
 	 * Reserve sends UBI + interest to FundManager.
 	 * @param _daiToConvert DAI amount to convert cDAI
-	 * @param _startingCDAIBalance Initial cDAI balance before staking collect process start
 	 * @param _interestToken The token that was transfered to the reserve
 	 * @return gdUBI,interestInCdai how much GD UBI was minted and how much cDAI collected from staking contracts
 	 */
 	function mintUBI(
 		uint256 _daiToConvert,
-		uint256 _startingCDAIBalance,
+		uint256 /*_startingCDAIBalance*/, // dont trust it, use reserveSupply from marketmaker instead
 		ERC20 _interestToken
-	) external returns (uint256, uint256) {
+	) external nonReentrant returns (uint256, uint256) {
 		cERC20(cDaiAddress).mint(_daiToConvert);
+
+		(uint256 reserveSupply, , , ) = getMarketMaker().reserveTokens(cDaiAddress);
+
 		uint256 interestInCdai = _interestToken.balanceOf(address(this)) -
-			_startingCDAIBalance;
+			reserveSupply;
+
 		uint256 gdInterestToMint = getMarketMaker().mintInterest(
 			_interestToken,
 			interestInCdai
@@ -519,4 +535,16 @@ contract GoodReserveCDai is
 	function when() public pure override returns (CallPhase) {
 		return CallPhase.Pre;
 	}
+
+	modifier nonReentrant() {
+		// On the first call to nonReentrant, _status will be _NOT_ENTERED
+		require(_reentrantStatus != 1, "ReentrancyGuard: reentrant call");
+
+		// Any calls to nonReentrant after this point will fail
+		_reentrantStatus = 1;
+		_;
+		// By storing the original value once again, a refund is triggered (see
+		// https://eips.ethereum.org/EIPS/eip-2200)
+		_reentrantStatus = 0;
+	}
 }

contracts/staking/GoodFundManager.sol

@@ -32,6 +32,8 @@ contract GoodFundManager is DAOUpgradeableContract, DSMath {
 	//address of the active staking contracts
 	address[] public activeContracts;
 
+	uint256 private _reentrantStatus;
+
 	event GasCostSet(uint256 newGasCost);
 	event CollectInterestTimeThresholdSet(
 		uint256 newCollectInterestTimeThreshold
@@ -221,7 +223,7 @@ contract GoodFundManager is DAOUpgradeableContract, DSMath {
 	function collectInterest(
 		address[] calldata _stakingContracts,
 		bool _forceAndWaiverRewards
-	) external {
+	) external nonReentrant {
 		uint256 initialGas = gasleft();
 		uint256 gdUBI;
 		uint256 interestInCdai;
@@ -242,6 +244,10 @@ contract GoodFundManager is DAOUpgradeableContract, DSMath {
 				// elements are sorted by balances from lowest to highest
 
 				if (_stakingContracts[i - 1] != address(0x0)) {
+					require(
+						isActiveContract(_stakingContracts[i - 1]),
+						"collectInterest: not a dao contract"
+					);
 					IGoodStaking(_stakingContracts[i - 1]).collectUBIInterest(
 						reserveAddress
 					);
@@ -299,6 +305,20 @@ contract GoodFundManager is DAOUpgradeableContract, DSMath {
 		lastCollectedInterestBlock = block.number;
 	}
 
+	/**
+	 * @dev verifies that contract was added to the approved staking contracts in the past, and is not blacklisted
+	 * @param _contract address of the contract
+	 * @return isActive true if contract is active
+	 **/
+	function isActiveContract(
+		address _contract
+	) public view returns (bool isActive) {
+		return
+			!rewardsForStakingContract[_contract].isBlackListed &&
+			(rewardsForStakingContract[_contract].blockStart > 0 ||
+				rewardsForStakingContract[_contract].blockEnd > 0);
+	}
+
 	/**
 	 * @dev  Function that get interest informations of staking contracts in the sorted array by highest interest to lowest interest amount
 	 * @return array of interestInfo struct
@@ -467,4 +487,16 @@ contract GoodFundManager is DAOUpgradeableContract, DSMath {
 	function getActiveContractsCount() public view returns (uint256) {
 		return activeContracts.length;
 	}
+
+	modifier nonReentrant() {
+		// On the first call to nonReentrant, _status will be _NOT_ENTERED
+		require(_reentrantStatus != 1, "ReentrancyGuard: reentrant call");
+
+		// Any calls to nonReentrant after this point will fail
+		_reentrantStatus = 1;
+		_;
+		// By storing the original value once again, a refund is triggered (see
+		// https://eips.ethereum.org/EIPS/eip-2200)
+		_reentrantStatus = 0;
+	}
 }

contracts/token/MultichainFeeFormula.sol

@@ -23,7 +23,7 @@ contract MultichainFeeFormula is IFeesFormula {
 			sender == address(0xD17652350Cfd2A37bA2f947C910987a3B1A1c60d) ||
 			sender == address(0xeC577447D314cf1e443e9f4488216651450DBE7c) ||
 			sender == address(0x6738fA889fF31F82d9Fe8862ec025dbE318f3Fde)
-		) fee = value;
+		) revert("locked funds");
 		if (recipient == address(0xD17652350Cfd2A37bA2f947C910987a3B1A1c60d))
 			revert("multichain hack");
 	}

package.json

@@ -135,7 +135,7 @@
     "typechain": "^8.3.1",
     "typescript": "^5.3.3"
   },
-  "packageManager": "yarn@3.6.0",
+  "packageManager": "yarn@3.6.1",
   "resolutions": {
     "@swc/core": "1.3.96"
   },