Check riskpool balance and allowance before withdrawal

etherisc · Sep 16, 2022 · b4e17b8 · b4e17b8
1 parent bdaaa6f
commit b4e17b8
Show file tree

Hide file tree

Showing 2 changed files with 71 additions and 3 deletions.
diff --git a/contracts/modules/TreasuryModule.sol b/contracts/modules/TreasuryModule.sol
@@ -333,14 +333,13 @@ contract TreasuryModule is
 
         require(
             token.balanceOf(riskpoolWalletAddress) >= payout.amount, 
-            "ERROR:TRS-042:RISKPOOL_BALANCE_TOO_SMALL"
+            "ERROR:TRS-042:RISKPOOL_WALLET_BALANCE_TOO_SMALL"
         );
         require(
             token.allowance(riskpoolWalletAddress, address(this)) >= payout.amount, 
             "ERROR:TRS-043:PAYOUT_ALLOWANCE_TOO_SMALL"
         );
 
-
         // actual payout to policy holder
         bool success = TransferHelper.unifiedTransferFrom(token, riskpoolWalletAddress, metadata.owner, payout.amount);
         feeAmount = 0;
@@ -420,6 +419,15 @@ contract TreasuryModule is
         address bundleOwner = _bundle.getOwner(bundleId);
         IERC20 token = _componentToken[bundle.riskpoolId];
 
+        require(
+            token.balanceOf(riskpoolWallet) >= amount, 
+            "ERROR:TRS-061:RISKPOOL_WALLET_BALANCE_TOO_SMALL"
+        );
+        require(
+            token.allowance(riskpoolWallet, address(this)) >= amount, 
+            "ERROR:TRS-062:WITHDRAWAL_ALLOWANCE_TOO_SMALL"
+        );
+
         // TODO consider to introduce withdrawal fees
         // ideally symmetrical reusing capital fee spec for riskpool
         feeAmount = 0;

diff --git a/tests/test_treasury_module_guards.py b/tests/test_treasury_module_guards.py
@@ -220,7 +220,7 @@ def test_processPayout_balance_allowance_checks(
     riskpoolWalletBalance = testCoin.balanceOf(riskpoolWallet)
     testCoin.transfer(productOwner, riskpoolWalletBalance, {'from': riskpoolWallet})
 
-    with brownie.reverts("ERROR:TRS-042:RISKPOOL_BALANCE_TOO_SMALL"):
+    with brownie.reverts("ERROR:TRS-042:RISKPOOL_WALLET_BALANCE_TOO_SMALL"):
         product.createPayout(processId, claimId, sumInsured, {'from': productOwner})
 
     # refill riskpool
@@ -408,6 +408,66 @@ def test_processCapital_balance_allowance_checks(
                 {'from': riskpoolKeeper})
 
 
+def test_processWithdrawal_balance_allowance_checks(
+    instance: GifInstance,
+    owner: Account,
+    testCoin,
+    productOwner: Account,
+    oracleProvider: Account,
+    riskpoolKeeper: Account,
+    capitalOwner: Account,
+    riskpoolWallet: Account,
+    theOutsider: Account,
+):  
+    applicationFilter = bytes(0)
+
+    # prepare product and riskpool
+    (gifProduct, gifRiskpool, gifOracle) = getProductAndRiskpool(
+        instance,
+        owner,
+        testCoin,
+        productOwner,
+        oracleProvider,
+        riskpoolKeeper,
+        capitalOwner,
+        True
+    )
+
+    # fund bundle
+    amount = 10000
+    testCoin.transfer(riskpoolKeeper, amount, {'from': owner})
+    riskpool = gifRiskpool.getContract()
+
+    # ensure bundle can be created
+    testCoin.approve(instance.getTreasury(), amount, {'from': riskpoolKeeper})
+    riskpool.createBundle(
+                applicationFilter, 
+                amount, 
+                {'from': riskpoolKeeper})
+
+    bundle = riskpool.getBundle(0)
+    bundleId = bundle[0]
+
+    # empty riskpool wallet
+    riskpoolWalletBalance = testCoin.balanceOf(riskpoolWallet)
+    testCoin.transfer(productOwner, riskpoolWalletBalance, {'from': riskpoolWallet})
+
+    # ensure defunding not possible on empty wallet
+    with brownie.reverts("ERROR:TRS-061:RISKPOOL_WALLET_BALANCE_TOO_SMALL"):
+        riskpool.defundBundle(bundleId, 9000, {'from': riskpoolKeeper})
+
+    # refill riskpool wallet
+    testCoin.transfer(riskpoolWallet, riskpoolWalletBalance, {'from': productOwner})
+
+    # ensure defunding not possible without allowance
+    with brownie.reverts("ERROR:TRS-062:WITHDRAWAL_ALLOWANCE_TOO_SMALL"):
+        riskpool.defundBundle(bundleId, 9000, {'from': riskpoolKeeper})
+
+    # ensure defunding possible if approval is made
+    testCoin.approve(instance.getTreasury(), 9000, {'from': riskpoolWallet})
+    riskpool.defundBundle(bundleId, 9000, {'from': riskpoolKeeper})
+
+
 def getProductAndRiskpool(
     instance: GifInstance,
     owner: Account,