Add boostrap in Factory to prevent donation attack

yieldnest · Aug 27, 2024 · dcee010 · dcee010
1 parent 2b87567
commit dcee010
Show file tree

Hide file tree

Showing 7 changed files with 26 additions and 12 deletions.
diff --git a/src/VaultFactory.sol b/src/VaultFactory.sol
@@ -6,7 +6,8 @@ import {
     TransparentUpgradeableProxy,
     TimelockController,
     ProxyAdmin,
-    IERC20
+    IERC20,
+    IERC4626
 } from "src/Common.sol";
 
 contract VaultFactory is AccessControlUpgradeable {
@@ -91,6 +92,11 @@ contract VaultFactory is AccessControlUpgradeable {
             abi.encodeWithSignature(funcSig, asset_, name_, symbol_, admin_, minDelay_, proposers_, executors_)
         );
         vaults[symbol_] = Vault(address(proxy), address(timelock), name_, symbol_, VaultType.SingleAsset);
+
+        // bootstrap 1 ether of underlying to prevent donation attacks
+        IERC20(asset_).approve(address(proxy), 1 ether);
+        IERC4626(address(proxy)).deposit(1 ether, address(this));
+
         emit NewVault(address(proxy), name_, symbol_, VaultType.SingleAsset);
         return address(proxy);
     }

diff --git a/test/factory/create.t.sol b/test/factory/create.t.sol
@@ -17,6 +17,7 @@ contract CreateTest is Test, LocalActors, TestConstants {
     address[] executors;
 
     function setUp() public {
+        vm.startPrank(ADMIN);
         asset = IERC20(address(new MockERC20(ASSET_NAME, ASSET_SYMBOL)));
         proposers = [PROPOSER_1, PROPOSER_2];
         executors = [EXECUTOR_1, EXECUTOR_2];
@@ -26,7 +27,8 @@ contract CreateTest is Test, LocalActors, TestConstants {
     }
 
     function testCreateSingleVault() public {
-        vm.startPrank(ADMIN);
+        asset.approve(address(factory), 1 ether);
+        asset.transfer(address(factory), 1 ether);
         address vault =
             factory.createSingleVault(asset, VAULT_NAME, VAULT_SYMBOL, ADMIN, minDelay, proposers, executors);
         (address vaultAddress,,,,) = factory.vaults(VAULT_SYMBOL);

diff --git a/test/single/access.t.sol b/test/single/access.t.sol
@@ -16,9 +16,11 @@ contract AccessControlTest is Test, LocalActors, TestConstants {
     function setUp() public {
         vm.startPrank(ADMIN);
         asset = IERC20(address(new MockERC20(ASSET_NAME, ASSET_SYMBOL)));
+
         DeployFactory deployFactory = new DeployFactory();
         VaultFactory factory = deployFactory.deploy(0);
-
+        asset.approve(address(factory), 1 ether);
+        asset.transfer(address(factory), 1 ether);
         address vaultAddress = factory.createSingleVault(
             asset,
             VAULT_NAME,

diff --git a/test/single/admin.t.sol b/test/single/admin.t.sol
@@ -19,7 +19,8 @@ contract TimelockTest is Test, LocalActors, TestConstants {
         asset = IERC20(address(new MockERC20(ASSET_NAME, ASSET_SYMBOL)));
         DeployFactory deployFactory = new DeployFactory();
         VaultFactory factory = deployFactory.deploy(0);
-
+        asset.approve(address(factory), 1 ether);
+        asset.transfer(address(factory), 1 ether);
         address vaultAddress = factory.createSingleVault(
             asset,
             VAULT_NAME,

diff --git a/test/single/deposit.t.sol b/test/single/deposit.t.sol
@@ -18,7 +18,8 @@ contract DepositTest is Test, LocalActors, TestConstants {
         asset = IERC20(address(new MockERC20(ASSET_NAME, ASSET_SYMBOL)));
         DeployFactory deployFactory = new DeployFactory();
         VaultFactory factory = deployFactory.deploy(0);
-
+        asset.approve(address(factory), 1 ether);
+        asset.transfer(address(factory), 1 ether);
         address vaultAddress = factory.createSingleVault(
             asset,
             VAULT_NAME,
@@ -38,9 +39,9 @@ contract DepositTest is Test, LocalActors, TestConstants {
         uint256 shares = vault.deposit(amount, ADMIN);
         assertEq(shares, amount, "Shares should be equal to the amount deposited");
         assertEq(vault.balanceOf(ADMIN), shares, "Balance of the user should be updated");
-        assertEq(asset.balanceOf(address(vault)), amount, "Vault should have received the asset");
-        assertEq(vault.totalAssets(), amount, "Vault totalAsset should be amount deposited");
-        assertEq(vault.totalSupply(), amount, "Vault totalSupply should be amount deposited");
+        assertEq(asset.balanceOf(address(vault)), amount + 1 ether, "Vault should have received the asset");
+        assertEq(vault.totalAssets(), amount + 1 ether, "Vault totalAsset should be amount deposited");
+        assertEq(vault.totalSupply(), amount + 1 ether, "Vault totalSupply should be amount deposited");
     }
 
     function skip_testDepositRevertsIfNotApproved() public {

diff --git a/test/single/initialize.t.sol b/test/single/initialize.t.sol
@@ -21,7 +21,8 @@ contract InitializeTest is Test, LocalActors, TestConstants {
         asset = IERC20(address(new MockERC20(ASSET_NAME, ASSET_SYMBOL)));
         deployFactory = new DeployFactory();
         factory = deployFactory.deploy(0);
-
+        asset.approve(address(factory), 1 ether);
+        asset.transfer(address(factory), 1 ether);
         address vaultAddress = factory.createSingleVault(
             asset,
             VAULT_NAME,

diff --git a/test/single/withdraw.t.sol b/test/single/withdraw.t.sol
@@ -20,7 +20,8 @@ contract WithdrawTest is Test, LocalActors, TestConstants {
         asset = IERC20(address(new MockERC20(ASSET_NAME, ASSET_SYMBOL)));
         DeployFactory deployFactory = new DeployFactory();
         VaultFactory factory = deployFactory.deploy(0);
-
+        asset.approve(address(factory), 1 ether);
+        asset.transfer(address(factory), 1 ether);
         address vaultAddress = factory.createSingleVault(
             asset,
             VAULT_NAME,
@@ -49,8 +50,8 @@ contract WithdrawTest is Test, LocalActors, TestConstants {
         assertEq(assetsReceived, expectedAssets, "Assets received should be equal to the expected amount");
         assertEq(newNetBalance, expectedAssets, "User should have received the expected amount of assets");
         assertEq(vault.balanceOf(ADMIN), 0, "User's balance in the vault should be zero after withdrawal");
-        assertEq(vault.totalAssets(), 0, "Vault totalAssets should be zero after withdrawal");
-        assertEq(vault.totalSupply(), 0, "Vault totalSupply should be zero after withdrawal");
+        assertEq(vault.totalAssets(), 1 ether, "Vault totalAssets should be 1 ether after withdrawal");
+        assertEq(vault.totalSupply(), 1 ether, "Vault totalSupply should be 1 ether after withdrawal");
         vm.stopPrank();
     }