feat: add managed OOv2 #4841

mrice32 · 2025-07-10T18:08:58Z

No description provided.

Signed-off-by: Matt Rice <[email protected]>

Reinis-FRP · 2025-07-10T19:24:08Z

packages/core/contracts/optimistic-oracle-v2/implementation/WhitelistOptimisticOracleV2.sol

+import "@openzeppelin/contracts/token/ERC20/IERC20.sol";
+import "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";
+import "@openzeppelin/contracts/utils/math/SafeMath.sol";
+import "@openzeppelin/contracts/utils/Address.sol";
+import "@openzeppelin/contracts/access/Ownable.sol";
+
+import "../../data-verification-mechanism/interfaces/StoreInterface.sol";
+import "../../data-verification-mechanism/interfaces/OracleAncillaryInterface.sol";
+import "../../data-verification-mechanism/interfaces/FinderInterface.sol";
+import "../../data-verification-mechanism/interfaces/IdentifierWhitelistInterface.sol";
+import "../../data-verification-mechanism/implementation/Constants.sol";
+
+import "../interfaces/OptimisticOracleV2Interface.sol";
+
+import "../../common/implementation/Testable.sol";
+import "../../common/implementation/Lockable.sol";
+import "../../common/implementation/FixedPoint.sol";
+import "../../common/implementation/AncillaryData.sol";
+import "../../common/implementation/AddressWhitelist.sol";


These imports are not strictly required as we have them in the inherited OptimisticOracleV2

removed and replaced with named imports

Reinis-FRP · 2025-07-10T19:27:56Z

packages/core/contracts/optimistic-oracle-v2/implementation/WhitelistOptimisticOracleV2.sol

+    using SafeERC20 for IERC20;
+    using Address for address;


These are not directly used in the derived contract

Reinis-FRP · 2025-07-10T22:14:18Z

packages/core/contracts/optimistic-oracle-v2/implementation/WhitelistOptimisticOracleV2.sol

+        bytes memory ancillaryData,
+        address whitelist
+    ) external nonReentrant() onlyOwner() {
+        customProposerWhitelists[_getId(requester, identifier, timestamp, ancillaryData)] = AddressWhitelistInterface(


It might make sense to also check if the given request state is State.Requested. This could help the caller be better assured that the applied whitelist would in fact be effective. Otherwise they could be under impression that the whitelist was set, but in fact the proposal has been already made against the default whitelist.

this no longer applies as we want the manager being able to set these before the request has be made

Reinis-FRP · 2025-07-10T22:16:34Z

packages/core/contracts/optimistic-oracle-v2/implementation/WhitelistOptimisticOracleV2.sol

+     * @notice Sets the requester whitelist.
+     * @param whitelist address of the whitelist to set.
+     */
+    function ownerSetRequesterWhitelist(address whitelist) external nonReentrant() onlyOwner() {


for the sake of completeness, shall we also have similar function for setting the default proposer whitelist?

Yep, this was my mistake. Good call!

packages/core/contracts/optimistic-oracle-v2/implementation/WhitelistOptimisticOracleV2.sol

pumpedlunch · 2025-07-14T20:08:01Z

packages/core/contracts/optimistic-oracle-v2/implementation/WhitelistOptimisticOracleV2.sol

+    ) public override returns (uint256 totalBond) {
+        AddressWhitelistInterface whitelist =
+            customProposerWhitelists[_getId(requester, identifier, timestamp, ancillaryData)];
+        if (address(whitelist) == address(0)) {


we should allow for a request to have no whitelist so it can be proposed by anyone.

added AllowAllList contract that always returns true when checking the address. so admin or manager can set whitelist to this AllowAllList contract if disabling the whitelist restrictions is desired.

Signed-off-by: Reinis Martinsons <[email protected]>

md0x · 2025-07-16T14:25:53Z

packages/core/contracts/optimistic-oracle-v2/implementation/WhitelistOptimisticOracleV2.sol

+        require(_getState(requester, identifier, timestamp, ancillaryData) == State.Requested, "setBond: Requested");
+        _validateBond(bond);
+        Request storage request = _getRequest(requester, identifier, timestamp, ancillaryData);
+        request.requestSettings.bond = bond;


Just confirming - it looks like the request sender can still call setBond directly on the OOv2 and bypass the onlyRequestManager restriction. That might be acceptable but is this behavior intentded? Same for liveness.

yes, I believe its expected since requester would be an integration contract with known behavior. This contract only extends these requester's priviledges to request managers.

md0x · 2025-07-16T14:27:53Z

packages/core/contracts/optimistic-oracle-v2/implementation/WhitelistOptimisticOracleV2.sol

+     * @param whitelist address of the whitelist to set.
+     */
+    function _setDefaultProposerWhitelist(address whitelist) internal {
+        defaultProposerWhitelist = AddressWhitelistInterface(whitelist);


Should we require whitelist != zeroAddress?

good call, we should definitely check this

Reinis-FRP · 2025-07-16T15:02:29Z

packages/core/contracts/optimistic-oracle-v2/implementation/WhitelistOptimisticOracleV2.sol

+     * @param ancillaryData ancillary data of the price being requested.
+     * @return AddressWhitelistInterface the custom proposer whitelist for the request or zero address if not set.
+     */
+    function getCustomProposerWhitelist(


we should also extend this to have a function recursing the effective whitelist array and boolean on whether the whitelist is enabled.

added getProposerWhitelistWithEnforcementStatus

Signed-off-by: Reinis Martinsons <[email protected]>

Reinis-FRP · 2025-07-17T09:01:16Z

packages/core/contracts/optimistic-oracle-v2/implementation/WhitelistOptimisticOracleV2.sol

+            whitelist = defaultProposerWhitelist;
+        }
+
+        require(whitelist.isOnWhitelist(proposer) || msg.sender == owner(), "Proposer not whitelisted");


now that owner and manager roles are separated I don't think it makes any sense to allow admin owner to propose. so going to remove the owner check here

Signed-off-by: Reinis Martinsons <[email protected]>

Copilot

Pull Request Overview

This PR introduces a whitelisting layer on top of the OptimisticOracleV2, enabling default and per-request address restrictions for both requesters and proposers, as well as owner-managed bond and liveness limits.

Added WhitelistOptimisticOracleV2 contract with default/custom proposer and requester whitelists.
Enforced whitelist checks in requestPrice and proposePriceFor and provided admin functions to configure bounds and whitelists.
Updated OptimisticOracleV2 and whitelist contracts to expose/internalize functions for subclassing.

Reviewed Changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
packages/core/contracts/optimistic-oracle-v2/implementation/WhitelistOptimisticOracleV2.sol	New contract layering whitelist enforcement over OptimisticOracleV2
packages/core/contracts/optimistic-oracle-v2/implementation/OptimisticOracleV2.sol	Updated visibilities and added `virtual`/`internal` for subclass support
packages/core/contracts/common/interfaces/DisableableAddressWhitelistInterface.sol	New interface for togglable enforcement
packages/core/contracts/common/implementation/DisableableAddressWhitelist.sol	Implementation allowing enforcement toggling
packages/core/contracts/common/implementation/AddressWhitelist.sol	Changed `isOnWhitelist` to `public virtual` for override compatibility

Comments suppressed due to low confidence (2)

packages/core/contracts/optimistic-oracle-v2/implementation/WhitelistOptimisticOracleV2.sol:163

Add unit tests to cover the requestPrice path when the requester is not on the whitelist, as well as success cases.

    function requestPrice(

packages/core/contracts/optimistic-oracle-v2/implementation/WhitelistOptimisticOracleV2.sol:363

[nitpick] The error message is ambiguous; consider specifying Requester whitelist cannot be the zero address to clarify which whitelist is invalid.

        require(whitelist != address(0), "Whitelist cannot be zero address");

Copilot · 2025-07-17T10:02:27Z

packages/core/contracts/optimistic-oracle-v2/implementation/WhitelistOptimisticOracleV2.sol

+     * @return totalBond new bond + final fee that the proposer and disputer will be required to pay. This can be
+     * changed again with a subsequent call to setBond().
+     */
+    function requestManagerSetBond(


[nitpick] Consider emitting an event (e.g., RequestBondUpdated) when a request manager updates the bond, to aid off-chain indexing and auditing.

not yet sure on this as the parent contract is not emitting events on this

Copilot · 2025-07-17T10:02:27Z

packages/core/contracts/optimistic-oracle-v2/implementation/WhitelistOptimisticOracleV2.sol

+     * @param ancillaryData ancillary data of the price being requested.
+     * @param customLiveness new custom liveness.
+     */
+    function requestManagerSetCustomLiveness(


[nitpick] It may be helpful to emit an event (e.g., RequestLivenessUpdated) when custom liveness is set, improving transparency of changes.

not yet sure on this as the parent contract is not emitting events on this

Copilot · 2025-07-17T10:02:27Z

packages/core/contracts/optimistic-oracle-v2/implementation/WhitelistOptimisticOracleV2.sol

+        bytes memory ancillaryData
+    ) external view returns (address[] memory allowedProposers, bool isEnforced) {
+        DisableableAddressWhitelistInterface whitelist =
+            _getEffectiveProposerWhitelist(requester, identifier, ancillaryData);
+        isEnforced = whitelist.isEnforced();
+        allowedProposers = isEnforced ? whitelist.getWhitelist() : new address[](0);
+        return (allowedProposers, isEnforced);


Fetching the entire whitelist array can be expensive if it grows large; consider pagination or limiting the maximum size for on-chain calls.

Suggested change

bytes memory ancillaryData

) external view returns (address[] memory allowedProposers, bool isEnforced) {

DisableableAddressWhitelistInterface whitelist =

_getEffectiveProposerWhitelist(requester, identifier, ancillaryData);

isEnforced = whitelist.isEnforced();

allowedProposers = isEnforced ? whitelist.getWhitelist() : new address[](0);

return (allowedProposers, isEnforced);

bytes memory ancillaryData,

uint256 startIndex,

uint256 pageSize

) external view returns (address[] memory paginatedProposers, bool isEnforced) {

DisableableAddressWhitelistInterface whitelist =

_getEffectiveProposerWhitelist(requester, identifier, ancillaryData);

isEnforced = whitelist.isEnforced();

if (isEnforced) {

address[] memory fullWhitelist = whitelist.getWhitelist();

uint256 endIndex = startIndex + pageSize > fullWhitelist.length

? fullWhitelist.length

: startIndex + pageSize;

paginatedProposers = new address[](endIndex - startIndex);

for (uint256 i = startIndex; i < endIndex; i++) {

paginatedProposers[i - startIndex] = fullWhitelist[i];

}

} else {

paginatedProposers = new address[](0);

}

return (paginatedProposers, isEnforced);

this is meant for offchain usage only

md0x · 2025-07-17T12:56:58Z

packages/core/contracts/common/implementation/DisableableAddressWhitelist.sol

+    function isOnWhitelist(address elementToCheck)
+        public
+        view
+        override(AddressWhitelist, AddressWhitelistInterface)


Should we add the nonReentrantView() that the parent function has?

yes, added it here, as well as to setWhitelistEnforcement

md0x · 2025-07-17T12:58:56Z

packages/core/contracts/optimistic-oracle-v2/implementation/WhitelistOptimisticOracleV2.sol

+        uint256 timestamp,
+        bytes memory ancillaryData,
+        IERC20 currency,
+        uint256 reward


should we add the nonReentrant() modifier that the parent has?

I'm afraid the _preEntranceCheck in parent would fail then?

md0x · 2025-07-17T12:59:30Z

packages/core/contracts/optimistic-oracle-v2/implementation/WhitelistOptimisticOracleV2.sol

+        bytes32 identifier,
+        uint256 timestamp,
+        bytes memory ancillaryData,
+        int256 proposedPrice


Should we add nonReentrant()?

I'm afraid the _preEntranceCheck in parent would fail then?

Signed-off-by: Reinis Martinsons <[email protected]>

pumpedlunch · 2025-07-17T22:59:02Z

packages/core/contracts/optimistic-oracle-v2/implementation/WhitelistOptimisticOracleV2.sol

+    mapping(bytes32 => AddressWhitelistInterface) public customProposerWhitelists;
+
+    // Owner controlled bounds limiting the changes that can be made by request managers.
+    uint256 public maximumBond;


this assumes only a single bond collateral will be used. consider making this a mapping of collateral token address to maximumBond.

good call, will implement this

added in 0888783

Signed-off-by: Reinis Martinsons <[email protected]>

md0x · 2025-07-18T14:45:45Z

packages/core/contracts/optimistic-oracle-v2/implementation/ManagedOptimisticOracleV2.sol

+            _getEffectiveProposerWhitelist(requester, identifier, ancillaryData);
+
+        require(whitelist.isOnWhitelist(proposer), "Proposer not whitelisted");
+        require(whitelist.isOnWhitelist(msg.sender), "Sender not whitelisted");


Question: Do we expect msg.sender to ever differ from the proposer here?
I would have assumed msg.sender == proposer, effectively making proposePriceFor behave like proposePrice conceptually. So we should only need to check that msg.sender is whitelisted.

yes, it might not be strictly necessary to check for proposer, but since the msg.sender is not emitted in events it would be harder to curate the whitelist in case the admin needs to remove proposers with high dispute rate. Otherwise a msg.sender that is part of whitelist could submit bad proposals using different proposer address making it harder for the manager to analyze. Its still possible to track the msg.sender, but that would require inspecting transaction call traces that puts extra burden on maintainer.

md0x

Looks good!
Just a follow-up question in proposePriceFor whitelist requires: https://github.com/UMAprotocol/protocol/pull/4841/files#r2216241197

Signed-off-by: Reinis Martinsons <[email protected]>

feat: add whitelisted proposer OO

df8e482

Signed-off-by: Matt Rice <[email protected]>

Reinis-FRP reviewed Jul 10, 2025

View reviewed changes

pumpedlunch reviewed Jul 12, 2025

View reviewed changes

packages/core/contracts/optimistic-oracle-v2/implementation/WhitelistOptimisticOracleV2.sol Outdated Show resolved Hide resolved

pumpedlunch reviewed Jul 14, 2025

View reviewed changes

Reinis-FRP added 14 commits July 16, 2025 07:25

fix: use named imports

9b39f74

Signed-off-by: Reinis Martinsons <[email protected]>

fix: owner can set default proposer whitelist

d658fbd

Signed-off-by: Reinis Martinsons <[email protected]>

fix: separate request manager role

5e14aaa

Signed-off-by: Reinis Martinsons <[email protected]>

fix: remove unused manager functions

46ee07b

Signed-off-by: Reinis Martinsons <[email protected]>

fix: helper methods to curate request managers

b55a233

Signed-off-by: Reinis Martinsons <[email protected]>

fix: ignore request timestamp in whitelist mapping

489d59a

Signed-off-by: Reinis Martinsons <[email protected]>

fix: cap maximum request bond

3438c71

Signed-off-by: Reinis Martinsons <[email protected]>

fix: bound minimum liveness

25e9233

Signed-off-by: Reinis Martinsons <[email protected]>

feat: allow all list

551e5a1

Signed-off-by: Reinis Martinsons <[email protected]>

fix: add events

552db87

Signed-off-by: Reinis Martinsons <[email protected]>

fix: missing natspec

6080049

Signed-off-by: Reinis Martinsons <[email protected]>

fix: add helper view functions

3072e8b

Signed-off-by: Reinis Martinsons <[email protected]>

fix: rename view function

b226b87

Signed-off-by: Reinis Martinsons <[email protected]>

fix: reorder functions

f3b5156

Signed-off-by: Reinis Martinsons <[email protected]>

Reinis-FRP marked this pull request as ready for review July 16, 2025 12:19

Reinis-FRP requested review from chrismaree and md0x as code owners July 16, 2025 12:19

Reinis-FRP requested a review from pumpedlunch July 16, 2025 12:20

md0x reviewed Jul 16, 2025

View reviewed changes

Reinis-FRP reviewed Jul 16, 2025

View reviewed changes

Reinis-FRP added 3 commits July 17, 2025 07:11

fix: check whitelist not zero

116ef79

Signed-off-by: Reinis Martinsons <[email protected]>

fix: disableable address whitelist

d284a23

Signed-off-by: Reinis Martinsons <[email protected]>

fix: lint

54c1a60

Signed-off-by: Reinis Martinsons <[email protected]>

Reinis-FRP reviewed Jul 17, 2025

View reviewed changes

Reinis-FRP added 2 commits July 17, 2025 09:05

fix: use disableable whitelist

3cf8a6e

Signed-off-by: Reinis Martinsons <[email protected]>

fix: remove owner from allowed proposers

b163468

Signed-off-by: Reinis Martinsons <[email protected]>

Reinis-FRP requested review from md0x and Copilot July 17, 2025 09:37

This comment was marked as outdated.

Sign in to view

Reinis-FRP added 2 commits July 17, 2025 09:47

fix: move zero address checks to internal functions

a8639aa

Signed-off-by: Reinis Martinsons <[email protected]>

fix: remove safemath

52fad1c

Signed-off-by: Reinis Martinsons <[email protected]>

Reinis-FRP requested a review from Copilot July 17, 2025 10:00

Copilot AI reviewed Jul 17, 2025

View reviewed changes

md0x reviewed Jul 17, 2025

View reviewed changes

fix: reentrancy guards in disableable whitelist

1ca9424

Signed-off-by: Reinis Martinsons <[email protected]>

Reinis-FRP requested a review from md0x July 17, 2025 18:21

pumpedlunch reviewed Jul 17, 2025

View reviewed changes

Reinis-FRP added 3 commits July 18, 2025 10:58

fix: check msg.sender in proposals

a5729f5

Signed-off-by: Reinis Martinsons <[email protected]>

fix: multiple currency bond limits

0888783

Signed-off-by: Reinis Martinsons <[email protected]>

fix: rename to managed oov2

2225f72

Signed-off-by: Reinis Martinsons <[email protected]>

Reinis-FRP changed the title ~~feat: add whitelisted proposer OO~~ feat: add managed OOv2 Jul 18, 2025

md0x reviewed Jul 18, 2025

View reviewed changes

md0x previously approved these changes Jul 18, 2025

View reviewed changes

fix: add multicaller

6e1f832

Signed-off-by: Reinis Martinsons <[email protected]>

Reinis-FRP dismissed md0x’s stale review via 6e1f832 July 21, 2025 09:07

md0x approved these changes Jul 21, 2025

View reviewed changes

-        bytes memory ancillaryData
-    ) external view returns (address[] memory allowedProposers, bool isEnforced) {
-        DisableableAddressWhitelistInterface whitelist =
-            _getEffectiveProposerWhitelist(requester, identifier, ancillaryData);
-        isEnforced = whitelist.isEnforced();
-        allowedProposers = isEnforced ? whitelist.getWhitelist() : new address[](0);
-        return (allowedProposers, isEnforced);
+        bytes memory ancillaryData,
+        uint256 startIndex,
+        uint256 pageSize
+    ) external view returns (address[] memory paginatedProposers, bool isEnforced) {
+        DisableableAddressWhitelistInterface whitelist =
+            _getEffectiveProposerWhitelist(requester, identifier, ancillaryData);
+        isEnforced = whitelist.isEnforced();
+        if (isEnforced) {
+            address[] memory fullWhitelist = whitelist.getWhitelist();
+            uint256 endIndex = startIndex + pageSize > fullWhitelist.length
+                ? fullWhitelist.length
+                : startIndex + pageSize;
+            paginatedProposers = new address[](endIndex - startIndex);
+            for (uint256 i = startIndex; i < endIndex; i++) {
+                paginatedProposers[i - startIndex] = fullWhitelist[i];
+            }
+        } else {
+            paginatedProposers = new address[](0);
+        }
+        return (paginatedProposers, isEnforced);

feat: add managed OOv2 #4841

Are you sure you want to change the base?

feat: add managed OOv2 #4841

Conversation

mrice32 commented Jul 10, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

md0x Jul 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

This comment was marked as outdated.

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI Jul 17, 2025

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jul 17, 2025

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jul 17, 2025

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

md0x Jul 16, 2025 •

edited

Loading