feat: open position wrapper

[kaze-cow]

Description

Implements the CowEvcOpenPositionWrapper in order to satisfy a usecase for the Euler integration.

Context

Read up on notion

Considerations

• While we call this flow "open positoin wrapper", it could also be used to grow an existing position, or take on a position without buying any Euler tokens (by setting collateralAmount to 0)
• this should be compatible ewith CoW (if two users open opposite positions, for example)

Out of Scope

Every line of code in this PR should be considered in-scope.

Testing Instructions

Follow the test command instructions in the README

We want to make sure:

• the flow works as expected for the established cases of Euler finance.
• there are not security opportunities an arbitrary user on the open internet could take advantage of
• there are not security opportunities that a solver could take advantage that would give access to a significant amount of funds

fixes https://linear.app/cowswap/issue/COW-65/initial-merge-contract-of-cowevcopenpositionwrapper

[claude]

Claude encountered an error —— View job

---

Code Review In Progress

Performing comprehensive code review for the Open Position Wrapper implementation.

Tasks

• Read repository guidelines (CLAUDE.md)
• Review core contract implementation (CowEvcOpenPositionWrapper.sol)
• Review PreApprovedHashes contract
• Analyze test coverage and quality
• Security analysis (DeFi-specific concerns)
• Check documentation completeness
• Post review findings

[claude]

Security: Missing zero address validation

The constructor doesn't validate that _evc is not the zero address. If deployed with address(0), all evc.batch() calls would fail, making the wrapper completely non-functional.

Consider adding:

require(_evc != address(0), "Invalid EVC address");

[claude]

Code Quality: Hardcoded magic number

The value 224 represents the size of OpenPositionParams (7 fields × 32 bytes). This is fragile and error-prone if the struct changes.

Consider using a constant or documenting this more clearly:

// OpenPositionParams size: 7 fields × 32 bytes = 224 bytes
uint256 constant OPEN_POSITION_PARAMS_SIZE = 224;
uint256 consumed = OPEN_POSITION_PARAMS_SIZE + 64 + ((signature.length + 31) & ~uint256(31));

The same issue exists on line 145 in the assembly block.

[claude]

Security: No validation of critical parameters

The function doesn't validate that:

• params.collateralVault != address(0)
• params.borrowVault != address(0)
• params.collateralVault != params.borrowVault (using same vault for both could cause issues)
• params.deadline >= block.timestamp when using permit signature path (only checked in pre-approved path)

While some of these would fail later in EVC calls, explicit validation provides clearer error messages and fails faster.

[claude]

Security: Potential reentrancy vulnerability

While the EVC batch ensures atomicity, there's no reentrancy protection on this external function. An attacker could potentially call evcInternalSettle from within a malicious vault contract during the EVC batch execution.

The checks msg.sender == address(EVC) and onBehalfOfAccount == address(this) provide some protection, but consider whether this is sufficient given the complex call flow through EVC.

[claude]

Code Quality: Missing documentation on security model

The contract uses marker values PRE_APPROVED and CONSUMED_PRE_APPROVED to prevent replay attacks, but this security mechanism isn't well-documented. Consider adding:

/// @dev Three states exist for each (owner, hash) pair:
/// - 0: Not approved
/// - PRE_APPROVED: User has approved this hash, can be consumed once
/// - CONSUMED_PRE_APPROVED: Hash was consumed and cannot be used again (prevents replay attacks)

[claude]

Maintainability: Magic number should be a named constant

The value 224 represents OpenPositionParams size (7 fields × 32 bytes). This should be a named constant to prevent bugs if the struct changes:

Suggested change

	uint256 consumed = 224 + 64 + ((signature.length + 31) & ~uint256(31));
	// OpenPositionParams size: 7 fields × 32 bytes = 224 bytes
	uint256 constant OPEN_POSITION_PARAMS_SIZE = 224;
	uint256 consumed = OPEN_POSITION_PARAMS_SIZE + 64 + ((signature.length + 31) & ~uint256(31));

The same constant should replace the hardcoded 224 on line 145.

[claude]

Code Quality: Missing parameter validation

Consider validating critical parameters before proceeding:

Suggested change

	(params, signature,) = _parseOpenPositionParams(wrapperData);
	(params, signature,) = _parseOpenPositionParams(wrapperData);
	// Validate critical parameters
	require(params.collateralVault != address(0), "Invalid collateral vault");
	require(params.borrowVault != address(0), "Invalid borrow vault");
	require(params.collateralVault != params.borrowVault, "Vaults cannot be the same");

While these would fail later in EVC calls, explicit validation provides clearer error messages and fails faster.

[claude]

Code Quality: Inconsistent deadline validation

The pre-approved hash path validates params.deadline >= block.timestamp (line 207), but the permit signature path doesn't. While the permit call will handle this, consider adding explicit validation for consistency:

Suggested change

	if (!isPreApproved) {
	if (!isPreApproved) {
	require(params.deadline >= block.timestamp, OperationDeadlineExceeded(params.deadline, block.timestamp));
	items[itemIndex++] = IEVC.BatchItem({

[claude]

Documentation: Expand explanation of three-state model

The three-state security model (0 / PRE_APPROVED / CONSUMED_PRE_APPROVED) is clever for preventing replay attacks, but could be better documented:

Suggested change

	mapping(address => mapping(bytes32 => uint256)) public preApprovedHashes;
	/// @notice Storage indicating whether or not a signed calldata hash has been approved by an owner
	/// @dev Maps owner -> hash(signedCalldata) -> approval status
	/// Three states exist for each (owner, hash) pair:
	/// - 0: Not approved (default state)
	/// - PRE_APPROVED: User has approved this hash, can be consumed once
	/// - CONSUMED_PRE_APPROVED: Hash was consumed and cannot be used again (prevents replay attacks)
	/// Once consumed, the hash cannot be re-approved or revoked (permanent consumption)
	mapping(address => mapping(bytes32 => uint256)) public preApprovedHashes;