StonkScan — Robinhood Chain explorer

BLEND (Blendfi)0x72a9676fED3A14Ff3dd8b419e1acCbf032cbe1C8

TOKENCONTRACT

price

$0.0000571 -36%

24h dex volume

$52.3k

liquidity

$28.3k

mcap

$57.2k

fdv

$57.2k

created

—

chains

robinhood

holders

215

circ. supply

1.0B

total supply

1.0B

transfers

deployer

0x4e59b4…956C

token transactions transfers holders traders events charts contract

ContractVERIFIED

nameBlendfiTokenlanguagesoliditycompilerv0.8.36+commit.8a079791optimizationenabled (1 runs)evm versioncancunlicensenoneverified at2026-09-04abi surface29 functions · 8 eventsdeployer0x4e59b4…956Ccreation tx0xfa1f4c0

src/blendfi/token/BlendfiToken.solentry file

// SPDX-License-Identifier: GPL-2.0-or-later pragma solidity 0.8.36; import { ERC20 } from "solady/tokens/ERC20.sol"; import { IndexConstants } from "../../index/libraries/IndexConstants.sol"; import { BlendfiConstants } from "../libraries/BlendfiConstants.sol"; import { BlendfiConstantsGuard } from "../libraries/BlendfiConstantsGuard.sol"; // 🔴 THE ONLY IMPORT ON THIS FILE'S TRANSFER PATH, AND IT IS A LIBRARY RATHER THAN AN // INTERFACE ON PURPOSE. See header rule 1: the notify is `pop(call(...))` in assembly, and // the whole reason it lives in `RewardSinkNotifier` instead of being written out here is // that a `IBlendfiRewardSink(sink).onBlendfiTransfer(...)` typed call — which is what a // future editor will reach for — bubbles the callee's revert into every swap. Read that // file before changing this line. import { RewardSinkNotifier } from "../rewards/RewardSinkNotifier.sol"; /// @notice A constructor recipient was `address(0)`. /// @dev Both mints happen exactly once, in the constructor, and there is no mint function /// afterwards — so a zero recipient does not "lose 10% of supply until someone /// fixes it", it destroys that fraction of a fixed supply permanently, on a contract /// with no owner and no upgrade path. There is no recovery, which is why this is a /// revert and not a warning. /// /// Tagged rather than split into two selectors, matching the `bytes32 name` /// convention `BlendfiConstantOutOfRange` already sets in `src/blendfi/`: the tag says /// which argument, and one error keeps the surface at one. /// @param which The offending constructor argument, as a short ASCII tag — /// `"teamWallet"` or `"liquidityHolder"`. error BlendfiZeroRecipient(bytes32 which); /// @notice A constructor metadata string was empty. /// @dev ⚠ THIS IS A CHECK ON *LENGTH*, NEVER ON CONTENT. It refuses `""` and accepts /// every other byte string on earth — one character, five hundred characters, emoji, /// non-ASCII, leading spaces. It does not know, prefer, or default to any particular /// name, and this file does not contain one (see the contract header). /// /// Why refuse `""` at all, when the ERC-20 standard permits it: `name` and `symbol` /// are set once and have no setter, so a token deployed nameless renders as a blank /// row on every explorer, wallet and screener for the rest of its life, and the only /// fix is redeploying and re-seeding both pools. The check costs nothing at runtime /// and closes the one mistake this constructor's own flexibility creates — an /// un-passed argument in a deploy script reads as `""`, not as a compile error. /// /// It is two lines and one revert. If the owner would rather ship a nameless token, /// deleting those two lines is the entire change and nothing else in the file /// depends on them. /// @param which The offending constructor argument, `"name"` or `"symbol"`. error BlendfiEmptyMetadata(bytes32 which); /// @notice A registry-admin-only function was called by somebody else. /// @dev Carries the caller rather than the expected admin: the expected admin is a /// public getter anybody can read, and the useful half of a failed call is which /// key was actually holding it. /// @param caller The address that called. error BlendfiNotRegistryAdmin(address caller); /// @notice `setMinShareBalance` was given a value outside /// `[MIN_SHARE_BALANCE_FLOOR, MAX_SHARE_BALANCE_CEILING]`. /// @dev 🔴 THE CEILING IS THE ANTI-CONFISCATION BOUND, not a tidiness check — see /// `BlendfiConstants.MAX_SHARE_BALANCE_CEILING`. An admin who could raise the bar /// without limit could empty the eligible set, and an empty set sends the whole /// jackpot epoch to the treasury. /// @param value The rejected value. error BlendfiShareBalanceOutOfRange(uint256 value); /// @notice A constructor pre-exclusion entry was `address(0)`. /// @dev `address(0)` is already unconditionally ineligible (the transfer hook never /// admits it and `isEligible` refuses it), so passing it is not dangerous — it is /// evidence that an argument in the deploy script did not get filled in, which on /// the *other* entries of the same array would be. Refused for that reason. error BlendfiZeroExclusion(uint256 index); /// @title BlendfiToken /// @notice The platform token: a plain, fixed-supply ERC-20. 1,000,000,000 units, /// 18 decimals, minted once in this constructor and never again. /// /// @dev ═══════════════════════════════════════════════════════════════════════════════ /// 🔴 **THERE IS NO TRANSFER TAX IN THIS CONTRACT, AND THERE NEVER MAY BE.** /// ═══════════════════════════════════════════════════════════════════════════════ /// /// This is the single most important property of this file. It is not a style /// preference, it is not "we decided to be nice to holders", and it is not /// negotiable in a later version. It is a mechanical consequence of the venue we /// trade on, and the failure it prevents is total. /// /// `UniswapV3Pool.swap` pays the output first and then asserts that it was paid: /// /// ```solidity /// uint256 balance0Before = balance0(); /// IUniswapV3SwapCallback(msg.sender).uniswapV3SwapCallback(amount0, amount1, data); /// require(balance0Before.add(uint256(amount0)) <= balance0(), "IIA"); /// ``` /// /// `IIA` — "insufficient input amount". The pool measures its own balance before the /// callback, adds the amount it was promised, and requires that its balance afterwards /// is at least that. **A token that skims a fee on the way in makes the pool come up /// short by exactly the skim, the `require` fails, and the whole swap reverts.** Not /// "the trader pays a bit more" — the transaction reverts, every time, for everyone. /// /// For a token/WETH pool, the leg that pays the pool in *tokens* is the **sell**. So /// the one-line summary of what a transfer tax would do to this product is: /// **every sell on our V3 pool reverts, permanently, and the pool cannot be /// retiered, patched or migrated.** Buys would keep working, which is worse than a /// clean break — the chart would look alive while nobody could get out, and that is /// indistinguishable from a honeypot to every scanner and every trader who checks. /// /// Feature §2.2 states the rule by Uniswap version, and it is a property of the /// version, not of the design: /// /// | Version | Guaranteed cut on every trade? | Mechanism | /// |---------|--------------------------------|----------------------| /// | V2 | yes | tax inside the token | /// | **V3** | **no — the `IIA` check** | — | /// | V4 | yes | **hook on the pool** | /// /// **So our 1% is taken by `BlendfiFeeHook` on the V4 pool, and by the 1% LP fee tier we /// seed every pool at. Never by this contract.** That is also exactly what The Index — /// the live token this product was researched against — does; their own verified /// source carries the comment *"The 3% each-way tax is NOT here: it's taken in native /// ETH by IndexFeeHook on the pool."* (feature §1.2). /// /// Concretely, for anyone reading this file with a change in hand: /// /// · `transfer`, `transferFrom` and `_transfer` are inherited from Solady /// UNMODIFIED and must stay that way. There is no override of any of them here, /// and that absence is the specification. /// · `_beforeTokenTransfer` is deliberately **not** overridden and must stay that /// way. `_afterTokenTransfer` **is** overridden — for the reward registry and the /// reward notify, neither of which touches the amount. ⚠ This bullet used to claim /// both hooks were empty; that stopped being true when ADR-0025's registry landed /// and it is corrected here rather than left standing. The rule the bullet was /// protecting is unchanged and is stated exactly: **these are the hooks a "small /// fee" would be threaded through, and no override of either may ever read or /// write the transferred value.** What lives in `_afterTokenTransfer` today is a /// list write and a fire-and-forget notification; see the registry block below. /// · If a future requirement genuinely needs a per-trade cut that the hook cannot /// take, the answer is a new pool or a new hook — never a new token behaviour. /// /// ───────────────────────────────────────────────────────────────────────────────── /// **THE NAME AND THE TICKER ARE DEPLOY-TIME PARAMETERS. THIS FILE DOES NOT KNOW /// THEM, AND MUST NOT LEARN THEM.** /// /// `name` and `symbol` are constructor arguments. `docs/plan-2026-08-09.md` §6 open /// question #3 — *"token name and ticker?"* — is still open, the owner answers it at /// deploy, and the answer could be anything at all. /// /// ⚠ **"Blendfi" IS THE PRODUCT NAME, NOT THE TOKEN NAME, AND IT DOES NOT CONSTRAIN THE /// TOKEN NAME.** It is itself marked temporary in this repo and lives in exactly one /// place (`frontend/brand.config.json`). It appears in this codebase only as an /// *identifier* — the contract's own name, its directory, and the dial symbols it /// imports — because a codebase needs something to call things and a later rename is a /// mechanical find/replace. It is **not** a default, not a fallback, and not a hint. /// There is no string literal anywhere in this file that could become a token name. /// /// So, to the next reader — human or agent — who notices that the metadata is /// "missing" and reaches to be helpful: **do not add a default, a fallback, a constant, /// or an `if empty then …` branch.** Two lines refuse `""` and that is the whole of /// this file's opinion about naming. Everything else is the deploy script's business, /// and the deploy script is where the owner's answer goes, once. /// /// ───────────────────────────────────────────────────────────────────────────────── /// **WHAT THIS CONTRACT DELIBERATELY DOES NOT HAVE** /// /// No mint function. No burn function. No pause. No proxy and no initializer. After /// this constructor returns, `totalSupply()` is a constant for the life of the chain, /// and **no role in this file can move, freeze, seize or dilute one wei of anyone's /// balance.** /// /// ⚠ THIS PARAGRAPH USED TO SAY "no owner, no admin, no guardian" AND IT NO LONGER /// CAN. ADR-0025 put a reward registry in this token, and a registry has dials that /// must be turnable after deploy. So there is now ONE role, `registryAdmin`, and it /// holds **three dials, not two** — the eligibility threshold, the exclusion list, /// and (added 2026-08-31 for ADR-0026) `rewardSink`, the address this token notifies /// on every transfer. That third dial is stated separately from the first two on /// purpose: it is the only one that decides what CODE runs during a transfer rather /// than what a number is, and the argument for why that is nonetheless safe lives on /// `registryAdmin` and on `setRewardSink` below. It is deliberately NOT `Ownable`: /// there is no `onlyOwner` modifier on anything else here, because there is nothing /// else here it should be able to reach. The registry section below states its powers /// as a closed list and `BlendfiToken.t.sol` pins that list by testing that every /// OTHER function behaves identically for the admin and for a stranger. /// /// **Buyback-and-burn (feature §2.6) needs no contract support.** 30% of collected /// fees buys the token on the open market and the team sends it to `0x…dEaD` from an /// ordinary wallet. That is a plain `transfer`, it is what every observer can already /// verify from the event log, and it is strictly better than a `burn()` here: a burn /// function is a function, a function has a caller, and a caller is a privilege this /// product has spent its whole architecture refusing (`IndexFactory.sol` — /// *"there are no proxies anywhere"*). /// /// ⚠ One consequence, stated so nobody discovers it in an audit: because there is no /// burn, `totalSupply()` never falls, and tokens sent to `0x…dEaD` (or, for that /// matter, to `address(0)`, which Solady permits) remain inside `totalSupply()` /// forever. Circulating supply is therefore `totalSupply() - balanceOf(0x…dEaD)` and /// any surface that quotes a market cap must subtract it. This is deliberate: adding /// a `to != address(0)` check would put a branch on the transfer path, and a branch on /// the transfer path is precisely the thing this file exists to keep out. /// /// ───────────────────────────────────────────────────────────────────────────────── /// **THE REWARD REGISTRY — WHY A TRANSFER HOOK IS NOT A TRANSFER TAX.** /// /// 🔴 Read the tax block above first, then read this, because the two look alike from /// a distance and only one of them is forbidden. /// /// The tax block forbids **changing the amount**. `UniswapV3Pool.swap`'s `IIA` check /// compares the pool's balance before and after the callback against the amount it was /// promised; a token that skims makes that check fail and every sell reverts forever. /// That is a statement about *arithmetic on the transferred value*. /// /// `_afterTokenTransfer` below **does not touch the value.** The amount credited to /// `to` is still bit-for-bit the amount debited from `from`; `transfer`, /// `transferFrom` and `_transfer` are still Solady's, unmodified, and /// `testFuzz_Transfer_SatisfiesTheV3IIACheck` still passes unchanged. What the hook /// does is maintain a LIST — after the balances have already settled, it asks whether /// the two touched wallets belong on the eligibility roll and adds or removes them. /// The pool's `IIA` arithmetic never sees it. /// /// This is the same place The Index maintains its own registry, on this same chain, /// across 77,907 swaps on its canonical pool without incident (see /// `docs/evidence/index-jackpot-research-2026-08-31/VERIFIED.md`, §2). /// /// **THE THREE RULES THE HOOK MUST OBEY, AND WHY EACH ONE IS A MONEY BUG IF BROKEN.** /// /// 1. **It must never revert.** It runs inside every transfer, including the ones /// inside a swap. A revert here is a token that cannot be sold — the honeypot the /// tax block spends forty lines refusing, arrived at from the other side. The /// registry half of the body honours that the easy way: no allocation, no /// division, no unchecked subtraction that could underflow, and no `require` of /// any kind. Everything it does is bounded storage writes on values it just read. /// /// ⚠ **AMENDED 2026-08-31, AND THE AMENDMENT IS THE POINT OF THIS PARAGRAPH.** /// This rule used to say *"the body contains no external call"* full stop, and /// since ADR-0026 landed that sentence would be a lie. The hook now ends with /// **exactly one external call** — `RewardSinkNotifier.notify(rewardSink, …)`, /// which tells the replaceable reward contract that BLEND moved. The rule itself /// did **not** weaken; what changed is that "no external call" was only ever a /// *sufficient* condition for it, and the notify satisfies the rule directly /// instead. /// /// **Why that call cannot break a transfer.** `notify` is one opcode's worth of /// assembly — `pop(call(GAS_STIPEND, sink, 0, in, inSize, codesize(), 0))` — and /// every hazard is closed by something *absent* rather than by a check: /// /// · **A revert cannot propagate.** `CALL` does not revert its caller when the /// callee reverts; it returns `0`. That flag is `pop`ped, and there is no /// expression anywhere downstream whose value depends on it. There is no /// `require`, no `if (!ok)`, no `try/catch` — so there is no line for the /// sink's failure to travel along. A sink that reverts, reverts with no data, /// `assert`s, or divides by zero is a no-op to this token. /// · **The return data is never read.** `retSize` is zero, so nothing is /// `returndatacopy`'d. A sink returning a megabyte of garbage costs this token /// nothing and cannot expand its memory. This is why the call is untyped: a /// typed call would decode the return and could be made to revert on it. /// · **An infinite loop cannot eat the swap's gas.** `GAS_STIPEND` (500,000, two /// times a *measured* worst case) is a hard ceiling. EIP-150's 63/64 rule is /// not a bound a swap can budget against; this is. And it is a **cap, not a /// charge** — an honest transfer pays only for what the sink actually used. /// · **A sink with no code is a 100-gas success**, and `address(0)` returns /// before the call is even made. `address(0)` is the state this token SHIPS /// in, so the notify is dormant until an admin points it somewhere. /// · **Re-entrancy is safe here and is not a special case.** The notify is the /// LAST statement in the hook, after `_refresh(from)` and `_refresh(to)` have /// already settled the registry, so a sink that calls back into this token /// finds its accounting complete rather than half-written. Nesting terminates /// on the shrinking gas budget, not on a flag. /// /// **So the rule in its exact modern form is: nothing in this hook may make a /// transfer fail.** "No external call" is one way to get there and is still the /// standing default for anything ADDED here; `pop(call(...))` with a stipend and /// no return read is the only other way that has been proven, and it was proven /// by test rather than by argument — a reverting, empty-reverting, looping, /// out-of-gas, garbage-returning, code-less, EOA and re-entering sink are each /// installed on a REAL `BlendfiToken` in `BlendfiTokenRewardHook.t.sol` and a /// transfer succeeds through every one of them. /// /// 🔴 **A CONSEQUENCE, STATED SO NOBODY DISCOVERS IT IN AN AUDIT: THE NOTIFY IS /// BEST-EFFORT AND THE TOKEN NEVER LEARNS WHETHER IT WORKED.** That is not a gap, /// it is the price of the paragraph above, and the reward contract is built to /// pay it: `BlendfiRewardStream.refresh(account)` is permissionless, so a /// notification lost to a starved stipend is repairable by anybody for ~30k gas, /// and the wallet that starved it is the only wallet it costs. If a future sink /// needs the token to know it succeeded, the sink is wrong, not this rule. /// 2. **It must be O(1).** Insert is two writes, remove is a swap-and-pop of three. /// There is no loop in it and there must never be one, because its gas is paid by /// every trader on every trade. /// 3. **It must ignore `address(0)`.** Solady calls this hook for mint (`from == 0`) /// and burn (`to == 0`) as well as transfer. Without the guard, the zero address /// enters the holder list at construction and the jackpot pays it. /// /// 🔴 **HOW TO READ EVERY MENTION OF `BlendfiJackpot` IN THIS FILE (added 2026-08-31, /// lane G — comment only, no behaviour changed).** `BlendfiJackpot` was **superseded /// before it was ever deployed** and is not in the release manifest. The contract that /// actually consumes this token's reward surface is **`BlendfiRewardStream`** /// (`src/blendfi/rewards/`), specified by /// `contracts/docs/thor-index/ADR-0026-claiming-and-the-reward-clock.md`. Three /// differences matter to anyone reading the NatSpec below, because the old sentences /// describe mechanics that no deployed contract has: /// /// - **Nothing walks this array to pay anybody.** The stream is notified by /// `_afterTokenTransfer` and keeps its own per-wallet weight. There is no payout /// loop, no page, no cycle and no per-epoch dedupe. So this registry is a /// **candidate list for indexers and screens** — it is no longer on the money path /// at all, which makes the "candidate list, not a truth" argument below stronger /// rather than weaker. /// - **This contract's `minShareBalance()` is NOT the bar that decides who is paid.** /// That bar is `BlendfiRewardStream.MIN_WEIGHT`, and it is **immutable** (ADR-0026 /// §7 — the setter, its event and the R-03 workaround were deleted, not guarded). /// Two numbers, two jobs; never describe either as the other. /// - **The stream does the `BlendfiLock` read itself**, gas-capped and failing to /// zero. The rule immediately below — that the lock read must never live in this /// file — is unchanged and is now load-bearing for a second reason: BLEND's /// transfer path notifies the reward contract on **every** transfer, so anything /// that can revert there is a token that cannot be sold. /// /// **THE REGISTRY IS A CANDIDATE LIST, NOT A TRUTH — AND THAT IS THE FIX FOR THE /// INDEX'S OWN STALENESS BUG.** Their `setMinShareBalance` does not rebuild the /// registry: raising the bar leaves entries that no longer qualify, lowering it leaves /// out wallets that now do, and each is only corrected when that wallet next transfers /// (their own verified source; report §"Registry behavior"). Rebuilding on a threshold /// change is not an option for anyone — it is an unbounded loop over thousands of /// wallets inside a setter. /// /// So this contract does not pretend membership is truth. **Eligibility is recomputed /// at read time**, by `isEligible`, from live balance and live exclusion; the array is /// only the set of wallets worth ASKING about. A stale entry therefore costs a /// consumer one wasted `balanceOf` and pays out nothing, and a threshold cut takes /// effect for everyone the instant it lands — no transfer required, no rebuild, no /// window in which the contract's answer disagrees with its own dial. `refresh` and /// `refreshMany` exist to prune the array back down; they are permissionless, because /// tidying a list nobody is paid to tidy should not need a key. /// /// ⚠ **CONSUMERS MUST FILTER, NOT TRUST.** Anything walking `holderAt(0..holderCount)` /// MUST call `isEligible` per entry. `BlendfiJackpot` does. A future consumer that /// skips it will pay wallets that fell below the bar. /// /// 🔴 **AND SINCE 2026-08-31 THIS REGISTRY IS NOT THE WHOLE ELIGIBLE SET.** The owner /// decided that locked BLENDFI counts toward the jackpot, and locked BLENDFI is not in /// anybody's wallet — it is in `BlendfiLock`. A wallet that locked its entire balance /// has `balanceOf == 0`, is therefore **correctly absent from this array**, and is /// still owed a jackpot share. `BlendfiJackpot` finds it by walking `BlendfiLock`'s /// own locker list as well as this one and deduping by address. /// /// ⚠ **THAT READ IS IN THE JACKPOT AND IT MUST NEVER BE IN THIS FILE.** The obvious /// "improvement" is to make `isEligible`/`_refresh` add the lock balance so the /// registry is complete on its own. It is forbidden, and not on taste: `_refresh` runs /// inside `_afterTokenTransfer`, i.e. inside every swap. A revert there — a lock that /// runs out of gas, a lock address that turns out to hold no code — is a token that /// cannot be sold. That is the honeypot the tax block at the top of this file spends /// forty lines refusing, re-created through a different door. /// /// ⚠ **AND THE ARRIVAL OF THE REWARD NOTIFY DOES NOT RE-OPEN THIS DOOR — READ THE /// AMENDMENT TO RULE 1 BEFORE ARGUING OTHERWISE.** Since 2026-08-31 this hook does make /// one external call, so "the token never calls out" is no longer the reason the lock /// read is banned. The real reason is sharper and survives intact: **`notify`'s result /// is thrown away, and a lock read's result is arithmetic the registry would then /// depend on.** A call whose answer you need is a call whose failure you must handle, /// and the only two ways to handle it here are to revert (a honeypot) or to silently /// substitute a wrong weight (a money bug). `notify` has neither problem because it /// needs no answer at all. So a `pop(call(...))` that discards its result may live on /// this path; a `staticcall` whose return value feeds `belongs` may not, whatever /// gas cap is wrapped around it. Header rule 1 still forbids it, and it is not /// negotiable. /// /// Note also that this whole staleness argument matters *less* than it did: the lock's /// weight now lands in `BlendfiRewardStream`, which is told about locking and /// withdrawing by this very notify — because both move BLEND — and which has its own /// permissionless `refresh` for the one case that moves no tokens (extending a lock). /// The registry below stays exactly what it was: wallet balances, and a hint. /// /// The jackpot's read is a `staticcall` in a keeper transaction that already costs /// gas, is already paginated, and can already be retried. Nobody's swap depends on it. /// /// ───────────────────────────────────────────────────────────────────────────────── /// **THE ALLOCATION.** `BLENDFI_TEAM_ALLOCATION_BPS` (10%) goes to `teamWallet` /// **directly, at deploy, with no vesting contract and no cliff** *(owner decision, /// 2026-08-09, feature §2)*. The remaining 90% goes to `liquidityHolder`, which is the /// address that seeds the two pools (feature §2.3). There is no vesting contract /// anywhere in this system — if you are looking for one because a 10% allocation /// implies one, stop looking; the decision was made and recorded. /// /// The team side is computed and the liquidity side is taken as the **remainder**, so /// the two mints sum to the total supply to the wei with no dust, at any retune of /// the allocation dial. Same house convention as `IndexVault`'s fee split, where the /// platform's cut is never computed, only left over. /// /// ───────────────────────────────────────────────────────────────────────────────── /// **EVERY NUMBER COMES FROM `BlendfiConstants`, AND A BAD ONE CANNOT DEPLOY.** The /// constructor's first statement is `BlendfiConstantsGuard.validate()`, per that /// library's contract with its consumers. It validates *every* dial in the file, not /// only the token block, deliberately — the dial nobody reads is the one that will be /// wrong, and this contract is the first thing that deploys. Every input is a /// compile-time `constant`, so the whole check folds away under the optimizer and /// costs zero bytes and zero gas. contract BlendfiToken is ERC20 { /*////////////////////////////////////////////////////////////// IMMUTABLE RECIPIENTS //////////////////////////////////////////////////////////////*/ /// @notice The wallet that received the team allocation at deploy. /// @dev Recorded on-chain so "did the team really receive exactly 10%, and who is /// the team" is answerable by two `eth_call`s — `teamWallet()` and /// `balanceOf(teamWallet())` at the deploy block — rather than by log /// archaeology against a chain whose public RPC keeps roughly 6–8k blocks of /// state (`docs/plan-2026-08-09.md` §5). Immutable, so it is bytecode rather /// than storage: it costs nothing to read and nothing to hold, and there is no /// setter because there is nothing to set — it names a past event, not a role. address public immutable teamWallet; /// @notice The wallet that received the remaining supply, to seed the pools. /// @dev Same reasoning as `teamWallet`. It is NOT a treasury and carries no /// privilege here: this contract never reads it after the constructor and /// never sends anything to it again. address public immutable liquidityHolder; /*////////////////////////////////////////////////////////////// REGISTRY EVENTS //////////////////////////////////////////////////////////////*/ // 🔴 EVERY REGISTRY MUTATION EMITS. This is the one place this contract deliberately // diverges from the reference implementation rather than porting it, and the reason is // a finding rather than a preference: The Index's `setMinShareBalance` and // `setRewardsExcluded` emit NOTHING, so their whole eligibility history has to be // recovered from raw transaction input — the report's own Medium finding, and its // closing advice is "future implementations should never copy this observability gap". // Reward eligibility is money. If it changes, the chain says so. /// @notice The eligibility threshold changed. /// @param previous The old bar, in wei of BLENDFI. /// @param current The new bar. event MinShareBalanceSet(uint256 previous, uint256 current); /// @notice A wallet was excluded from, or restored to, reward eligibility. /// @param account The wallet. /// @param excluded `true` if it is now barred from the jackpot. event RewardsExclusionSet(address indexed account, bool excluded); /// @notice The registry admin key changed. `current == address(0)` is final: the two /// dials freeze at their present values for the life of the chain. /// @param previous The old key. /// @param current The new key, or `address(0)` to renounce forever. event RegistryAdminSet(address indexed previous, address indexed current); /// @notice A wallet entered the candidate list. /// @dev Membership is not eligibility — see the registry block in the contract /// header. This says "worth asking about", not "will be paid". event HolderAdded(address indexed account); /// @notice A wallet left the candidate list. event HolderRemoved(address indexed account); /// @notice The reward contract this token notifies on every transfer changed. /// @dev `current == address(0)` means the notification is switched off entirely, which /// is the state the token ships in and a valid state to return to. Emitted on /// every set including a no-op re-set, because "the admin pointed it at the same /// place again" is a fact worth having in the log when the previous value is /// being audited. /// @param previous The old reward contract, or `address(0)` for none. /// @param current The new reward contract, or `address(0)` to switch it off. event RewardSinkSet(address indexed previous, address indexed current); /*////////////////////////////////////////////////////////////// REGISTRY STATE //////////////////////////////////////////////////////////////*/ /// @notice The key that may set the threshold and the exclusion list. Nothing else. /// @dev ⚠ ITS COMPLETE POWER, AS A CLOSED LIST: `setMinShareBalance` (bounded by two /// compile-time constants it cannot move), `setRewardsExcluded`, `setRewardSink` /// and `setRegistryAdmin` (including renouncing to `address(0)`). That is all /// four functions that carry the check. It CANNOT mint, burn, pause, transfer, /// seize, approve on anyone's behalf, blacklist a transfer, or change /// `name`/`symbol` — not because it is trusted not to, but because no such /// function exists in this file for it to call. /// /// ⚠ **THE LIST BECAME FOUR ON 2026-08-31 AND THAT IS THE ONE ENTRY WORTH /// ARGUING ABOUT.** `setRewardSink` points this token's transfer notification at /// a contract, so the holder of this key chooses which code runs — within a /// 500,000-gas cap and with its result discarded — on the tail of every /// transfer. What that power is NOT: it cannot make a transfer revert (header /// rule 1, and `BlendfiTokenRewardHook.t.sol` installs a deliberately hostile /// sink and sells through it), it cannot change an amount, it cannot read or /// move a balance, and it is handed no ETH and no allowance. What it CAN do is /// make every transfer cost up to the stipend, and point the reward stream's ear /// at a contract that mis-accounts. Both are visible — `RewardSinkSet` is on the /// chain — and both are undone by pointing it back, or frozen forever by /// `setRegistryAdmin(address(0))`. /// /// Storage, not immutable, precisely so it can be handed to a multisig after /// deploy and later renounced. The report's High governance finding against the /// reference is that ONE EOA owns the token, the treasury and both distributors; /// the answer is not to delete the role — the threshold genuinely has to move — /// it is to make the role narrow enough that holding it is not worth attacking, /// and then to move it off an EOA. address public registryAdmin; /// @dev The candidate list. Order is not meaningful and MUST NOT be relied on: removal /// is swap-and-pop, so an entry's index changes when an unrelated wallet drops /// below the bar. A consumer paginating this array across two transactions can see /// the same wallet twice or miss one entirely — which is exactly the churn that /// broke the reference's V1 distributor. ⚠ **The per-epoch dedupe mark this line /// used to point at lived in `BlendfiJackpot`, which is superseded and never /// deployed — see the "how to read every mention" note in the header.** /// `BlendfiRewardStream` does not paginate this array at all, so it needs no /// dedupe. The warning still stands for **any** consumer that does walk it. address[] private _holders; /// @dev `index + 1` into `_holders`, so that `0` means absent and no separate presence /// flag is needed. One slot per holder rather than two. mapping(address => uint256) private _holderIndexPlusOne; /// @dev The live eligibility bar. Starts at `BLENDFI_MIN_SHARE_BALANCE`. uint256 private _minShareBalance; /// @dev Wallets barred from the jackpot regardless of balance: the pool manager, the /// burn address, the LP lock, the treasury, the jackpot itself and the vesting /// locker. Infrastructure is not a holder. mapping(address => bool) private _rewardsExcluded; /// @notice The reward contract told about every transfer, or `address(0)` for none. /// /// @dev 🔴 **THE TOKEN SHIPS WITH THIS UNSET, AND THAT IS DELIBERATE, NOT AN /// OVERSIGHT IN THE DEPLOY SCRIPT.** `BlendfiRewardStream` takes this token's /// address in its own constructor and refuses a caller that is not it, so the /// two cannot both be constructed knowing each other. The deploy order is /// therefore token → stream → `setRewardSink(stream)`, and until that third step /// lands the notify is a single `if (sink == address(0)) return` — no call, no /// measurable gas. /// /// **Storage and settable, for the reason the whole reward system is a separate /// contract at all.** ADR-0026: The Index's V1 distributor was drained and they /// shipped a V2; an accumulator welded into an immutable token could never have /// been replaced. This one address is what makes replacement possible, and the /// stream's own `proposeSuccessor`/`commitSuccessor` is what makes it possible /// *without stranding anyone's accrued balance* — a retired stream stays a claim /// window forever. Repointing this is therefore not an escape hatch that loses /// money; it is a change of ear. /// /// ⚠ **PUBLIC, SO THE ANSWER TO "WHAT RUNS INSIDE MY TRANSFER" IS ONE /// `eth_call`.** A holder should never have to read a trace to find out. address public rewardSink; /*////////////////////////////////////////////////////////////// ERC-20 METADATA //////////////////////////////////////////////////////////////*/ /// @dev **WHY `name` AND `symbol` ARE STORAGE AND NOT CONSTANTS.** /// /// Because they are undecided and must stay editable until the deploy transaction /// is signed — see the naming block in the contract header. Solidity has no /// `immutable string`, so the only ways to carry a runtime-chosen string are /// storage or `LibClone` immutable args, and this contract is deployed once by a /// script rather than cloned per fund, so storage is the honest choice and a clone /// factory would be ceremony for one deployment. /// /// Set once in the constructor. **There is no setter and there must never be one.** /// A settable name is a settable EIP-712 domain, which silently invalidates every /// outstanding `permit` signature at the moment it changes, and it is the classic /// shape of a rug: launch as one thing, rename to another after listing. /// /// The cost of storage over a constant is two `SLOAD`s on `name()`/`symbol()`, /// which are metadata reads that appear on no money path in this system, plus the /// one re-hash of the name that `permit` and `DOMAIN_SEPARATOR` pay — see /// `_constantNameHash` below, where that cost is accepted on purpose. string private _name; /// @dev See `_name`. string private _symbol; /*////////////////////////////////////////////////////////////// CONSTRUCTOR //////////////////////////////////////////////////////////////*/ /// @notice Deploys the token and mints the entire fixed supply, once, to two recipients. /// @dev The whole life cycle of this token's supply is the body of this function. /// /// Two `_mint` calls rather than one mint plus a transfer, deliberately: each /// emits the standard `Transfer(address(0), recipient, amount)` that explorers, /// indexers and every ERC-20 accounting tool treat as issuance, so the full /// supply and its split are reconstructable from the log alone with no /// intermediate hop that looks like the team sending itself money. /// /// ⚠ `teamWallet_` and `liquidityHolder_` being the **same** address is /// permitted. It is a coherent deploy — one custodian receives 100% and /// distributes off-chain — and refusing it would block that legitimately. But /// it collapses the two mints into one balance, and the "10% to the team" claim /// then has no on-chain witness beyond the two events. The deploy script, not /// this contract, is where that call gets made. /// @param name_ Token name. **Owner-chosen at deploy, open question #3.** /// Any non-empty byte string; this contract has no opinion /// about its content and no default. /// @param symbol_ Token ticker. Same: owner-chosen, any non-empty string. /// @param teamWallet_ Receives `BLENDFI_TEAM_ALLOCATION_BPS` of supply, unvested. /// @param liquidityHolder_ Receives the remainder, to seed the V3 and V4 pools. /// @param registryAdmin_ The key that may move the eligibility threshold and the /// exclusion list, and nothing else. **`address(0)` is /// permitted and is FINAL** — it ships the token with the /// threshold frozen at `BLENDFI_MIN_SHARE_BALANCE` and the /// exclusion list frozen at `preExcluded_` forever. That is a /// coherent, maximally trustless deploy and it is refused by /// nothing here; it is not the shipped choice only because the /// bar has to be raisable if the holder count ever makes the /// payout loop expensive. /// @param preExcluded_ Infrastructure to bar from the jackpot before a single /// token moves — the pool manager, `0x…dEaD`, the LP lock, the /// treasury, the jackpot, the vesting locker. /// /// ⚠ **THIS EXISTS SO THE ADMIN KEY IS NOT NEEDED FOR THE /// KNOWN SET.** The reference excluded its pool manager and /// burn address in the constructor but had to send a separate /// owner transaction for its LP lock — which landed two blocks /// before the pool did, a gap that happened to be harmless and /// did not have to be. Everything knowable at deploy is set at /// deploy, in the same transaction as the mint. constructor( string memory name_, string memory symbol_, address teamWallet_, address liquidityHolder_, address registryAdmin_, address[] memory preExcluded_ ) { // A mis-typed dial makes this contract UNDEPLOYABLE rather than permanently wrong. // `validate()` and not `validateToken()`: see `BlendfiConstantsGuard`'s header — a // contract that checks only "its own" dials leaves the rest unchecked until // something else happens to deploy, and this is the first thing that deploys. BlendfiConstantsGuard.validate(); // Length only. No content check, no default, no fallback — see `BlendfiEmptyMetadata`. if (bytes(name_).length == 0) revert BlendfiEmptyMetadata("name"); if (bytes(symbol_).length == 0) revert BlendfiEmptyMetadata("symbol"); if (teamWallet_ == address(0)) revert BlendfiZeroRecipient("teamWallet"); if (liquidityHolder_ == address(0)) revert BlendfiZeroRecipient("liquidityHolder"); _name = name_; _symbol = symbol_; teamWallet = teamWallet_; liquidityHolder = liquidityHolder_; // ── REGISTRY SET-UP, AND IT MUST HAPPEN BEFORE THE MINTS. ── // // `_mint` runs `_afterTokenTransfer`, which reads `_minShareBalance` and // `_rewardsExcluded`. Set them after the mints and the two founding wallets are // classified against a threshold of ZERO and an empty exclusion list — the team // wallet and the liquidity holder both enter the candidate list holding the entire // supply between them, and the very first jackpot pays the float. // // ⚠ The ordering is the whole of the correctness here. Do not move these three // statements below the mints "to group the assignments"; `BlendfiToken.t.sol` // asserts the deployed registry is empty and the suite goes red if they move. _minShareBalance = BlendfiConstants.BLENDFI_MIN_SHARE_BALANCE; registryAdmin = registryAdmin_; uint256 exclusions = preExcluded_.length; for (uint256 i = 0; i < exclusions; ++i) { address barred = preExcluded_[i]; if (barred == address(0)) revert BlendfiZeroExclusion(i); _rewardsExcluded[barred] = true; emit RewardsExclusionSet(barred, true); } // Emitted even when the admin is `address(0)`: "this token shipped with no registry // key" is exactly the fact an indexer most wants and would otherwise have to infer // from an absence. emit RegistryAdminSet(address(0), registryAdmin_); emit MinShareBalanceSet(0, BlendfiConstants.BLENDFI_MIN_SHARE_BALANCE); // The team side is COMPUTED and the liquidity side is the REMAINDER, so the two // mints sum to `BLENDFI_TOTAL_SUPPLY` exactly at any retune of the allocation dial and // any rounding dust lands on the liquidity side. Checked arithmetic on purpose: // this runs once, at deploy, and `1e27 * 2000` (the dial's own ceiling) is twelve // orders of magnitude short of `type(uint256).max`, so the check costs a constructor // gas rounding error and buys an unconditional guarantee. uint256 teamAmount = (BlendfiConstants.BLENDFI_TOTAL_SUPPLY * BlendfiConstants.BLENDFI_TEAM_ALLOCATION_BPS) / IndexConstants.BPS_DENOMINATOR; uint256 liquidityAmount = BlendfiConstants.BLENDFI_TOTAL_SUPPLY - teamAmount; _mint(teamWallet_, teamAmount); _mint(liquidityHolder_, liquidityAmount); } /*////////////////////////////////////////////////////////////// ERC-20 METADATA VIEWS //////////////////////////////////////////////////////////////*/ /// @inheritdoc ERC20 /// @dev Solady declares `name()` and `symbol()` abstract, so overriding them is /// mandatory rather than optional — the contract does not compile without both. /// Returns the constructor argument verbatim, byte for byte, with no /// normalisation, truncation or substitution of any kind. function name() public view override returns (string memory name_) { name_ = _name; } /// @inheritdoc ERC20 function symbol() public view override returns (string memory symbol_) { symbol_ = _symbol; } /// @inheritdoc ERC20 /// @dev Solady's base already returns a hardcoded `18`. Overridden anyway so the value /// is read from `BlendfiConstants.BLENDFI_DECIMALS` like every other number in this /// feature, per the dial-file mandate — an inherited literal is still a literal, /// and it is one that `BlendfiConstants`' own header explicitly ties to the `…e18` /// form of `BLENDFI_TOTAL_SUPPLY` and all four `LOCK_TIER*_WEIGHT` thresholds. /// `BlendfiConstantsGuard.validateToken()` pins it to exactly 18 for that reason, so /// this override cannot disagree with the base and still deploy. /// /// `pure`, tightening the base's `view`: nothing here reads state. function decimals() public pure override returns (uint8) { return BlendfiConstants.BLENDFI_DECIMALS; } /*////////////////////////////////////////////////////////////// REGISTRY — THE HOOK //////////////////////////////////////////////////////////////*/ /// @inheritdoc ERC20 /// @dev 🔴 **THE ONE OVERRIDE ON THE TRANSFER PATH, AND IT MOVES NO VALUE.** Read the /// registry block in the contract header before editing a line of this — the /// distinction between "maintains a list after the fact" and "changes the amount" /// is the difference between this contract and a permanent honeypot. /// /// `_afterTokenTransfer` and not `_before`: the classification has to see the /// SETTLED balances. Run it before and `to` is judged on the balance it had /// without the incoming tokens, so the wallet that just crossed the bar is not /// admitted until its *next* transfer — a one-transfer lag that would make the /// candidate list wrong in exactly the way the header says it must not be. /// /// `amount` is unread **by the registry**, and that has not changed: whether a /// wallet belongs on the roll is a question about its resulting BALANCE, never /// about the size of the transfer that produced it — a 1-wei transfer that tips a /// wallet over the bar admits it, and a billion-token transfer between two /// already-eligible wallets changes nothing. /// /// ⚠ It IS read now, by the notify, and it used to carry a `forge-lint: /// disable(unused-param)`. The reward stream needs it for a question the registry /// never had to ask — *"was the weight I have been paying this wallet actually /// right for the span I am about to settle?"* — which it answers by reconstructing /// the PRE-transfer balances as `fromBalance + amount` and `toBalance - amount`. /// See `IBlendfiRewardSink`. This hook does not interpret it; it forwards it. /// /// **CANNOT REVERT.** No arithmetic that can overflow or underflow (the only /// subtraction is `length - 1` under a proven-nonzero length), no `require`, no /// loop. Both registry branches are a fixed number of storage writes. /// /// 🔴 **THE ONE EXTERNAL CALL, AND ITS ORDER IS LOAD-BEARING.** The notify is the /// LAST statement, after both `_refresh` calls have settled the registry. That is /// effects-before-interaction and it is what makes a re-entering sink harmless: it /// finds this token's own accounting already complete. Its failure is discarded by /// construction — `RewardSinkNotifier.notify` is `pop(call(...))` with a gas cap /// and a zero return size, so a reverting, looping, out-of-gas, garbage-returning /// or code-less sink is a no-op to this transfer. **Read the amendment to header /// rule 1 before touching this line**; the whole argument is there. /// /// The balances handed over are the SETTLED ones, read after the move, which is the /// same reason this is `_afterTokenTransfer` and not `_before`. function _afterTokenTransfer( address from, address to, uint256 amount ) internal override { _refresh(from); _refresh(to); // ⚠ NOT A TYPED CALL, AND NOT A `try`. `RewardSinkNotifier` exists so this line // cannot be written any other way by accident. `rewardSink == address(0)` — the // shipped state — returns inside the library before any call is attempted. RewardSinkNotifier.notify(rewardSink, from, to, amount, balanceOf(from), balanceOf(to)); } /// @dev Put `account` on the candidate list, or take it off, to match its balance. /// Idempotent in both directions, so the permissionless `refresh` below cannot be /// used to corrupt anything by being called repeatedly or by being called on a /// wallet that is already correct. /// /// ⚠ `address(0)` returns immediately. Solady calls the transfer hook for mint and /// for burn, so without this the zero address joins the list during the /// constructor's own `_mint` and the jackpot pays it. See header rule 3. function _refresh( address account ) private { if (account == address(0)) return; uint256 slot = _holderIndexPlusOne[account]; bool listed = slot != 0; // Membership is decided on the SAME predicate `isEligible` reads, so the array can // never disagree with the view about a wallet that has just transferred. It can // still hold entries that went stale for a reason OTHER than a transfer — a // threshold rise — and that is the documented, deliberate looseness. bool belongs = !_rewardsExcluded[account] && balanceOf(account) >= _minShareBalance; if (belongs == listed) return; if (belongs) { _holders.push(account); _holderIndexPlusOne[account] = _holders.length; emit HolderAdded(account); } else { // SWAP AND POP. `slot` is `index + 1` and is nonzero here, so `slot - 1` is the // real index and `_holders.length` is at least 1 — neither subtraction can // underflow. uint256 index = slot - 1; uint256 last = _holders.length - 1; if (index != last) { address moved = _holders[last]; _holders[index] = moved; _holderIndexPlusOne[moved] = slot; } _holders.pop(); _holderIndexPlusOne[account] = 0; emit HolderRemoved(account); } } /*////////////////////////////////////////////////////////////// REGISTRY — PERMISSIONLESS //////////////////////////////////////////////////////////////*/ /// @notice Reconcile one wallet's membership with its live balance and exclusion flag. /// @dev **Permissionless on purpose.** The only thing this can do is make the array /// agree with `isEligible`, which is the predicate every payout already applies /// independently — so there is no state a caller could steer toward and nothing /// to gate. Gating it would mean the list can only be tidied by someone we pay /// to tidy it, and an untidied list costs the jackpot's payout loop real gas. /// /// Its reason to exist is the threshold. `setMinShareBalance` cannot rebuild the /// registry — that is an unbounded loop over every holder inside a setter — so /// after a threshold move the array is stale until each wallet is touched. This /// is how it gets touched without waiting for a transfer. /// @param account The wallet to reconcile. `address(0)` is a no-op, not a revert. function refresh( address account ) external { _refresh(account); } /// @notice `refresh` over many wallets in one transaction. /// @dev Bounded by `MAX_REGISTRY_PAGE` so a caller cannot ask for a loop that runs /// out of gas half-way and leaves them guessing how far it got. Reverting on an /// over-long list is strictly kinder than reverting on gas: the failure names /// the cause and the page size that would have worked. /// @param accounts The wallets to reconcile. Duplicates are harmless — `_refresh` is /// idempotent — and are not filtered, because filtering them would /// cost every honest caller a second loop. function refreshMany( address[] calldata accounts ) external { uint256 n = accounts.length; if (n > BlendfiConstants.MAX_REGISTRY_PAGE) { revert BlendfiShareBalanceOutOfRange(n); } for (uint256 i = 0; i < n; ++i) { _refresh(accounts[i]); } } /*////////////////////////////////////////////////////////////// REGISTRY — ADMIN (THREE DIALS) //////////////////////////////////////////////////////////////*/ /// @dev The whole of the privilege in this file. Three functions carry it; nothing else /// does, and `BlendfiToken.t.sol` proves the negative by exercising every other /// external function from the admin key and from a stranger and asserting the two /// transcripts are identical. modifier onlyRegistryAdmin() { if (msg.sender != registryAdmin) revert BlendfiNotRegistryAdmin(msg.sender); _; } /// @notice Move the eligibility bar. /// @dev 🔴 **BOUNDED BY TWO COMPILE-TIME CONSTANTS THE ADMIN CANNOT MOVE**, and the /// ceiling is the anti-confiscation bound rather than a tidiness check: an /// unbounded bar could empty the eligible set in one transaction, and an empty /// set routes the whole epoch's user pot to the treasury under ADR-0025's /// empty-epoch rule. `BlendfiConstants.MAX_SHARE_BALANCE_CEILING` carries the /// full argument and `BlendfiConstantsGuard.validateRegistry` proves the band is /// coherent at deploy. /// /// **The registry is NOT rebuilt**, deliberately — that is an unbounded loop in /// a setter. It does not need to be: `isEligible` reads the new bar immediately, /// so the change is effective for every payout from this block on, and the array /// catches up through `refresh`/`refreshMany` or the wallets' own next transfer. /// A raised bar therefore leaves entries that read `isEligible == false` and are /// paid nothing; a lowered bar leaves newly-qualified wallets off the array /// until refreshed, which is the one direction that costs a real user something /// and is why `refreshMany` is permissionless. /// @param value The new bar, in wei of BLENDFI. function setMinShareBalance( uint256 value ) external onlyRegistryAdmin { if (value < BlendfiConstants.MIN_SHARE_BALANCE_FLOOR || value > BlendfiConstants.MAX_SHARE_BALANCE_CEILING) { revert BlendfiShareBalanceOutOfRange(value); } emit MinShareBalanceSet(_minShareBalance, value); _minShareBalance = value; } /// @notice Bar a wallet from the jackpot, or restore it. /// @dev **This reconciles the array immediately, and the reference does not.** Theirs /// leaves a re-included holder out of the registry until it next transfers — /// "re-enabling an excluded holder does not immediately reinsert it" — so a /// wallet restored by an owner silently keeps missing payouts until it happens /// to move tokens. Here the `_refresh` on the last line closes that window, and /// it costs one bounded write because it is one wallet rather than all of them. /// /// ⚠ This is a REWARD-ELIGIBILITY power, not a transfer power. An excluded /// wallet keeps every token it holds and can send, receive, sell and approve /// exactly as before; the only thing it loses is a share of the jackpot. There /// is no blacklist in this contract and no function through which this flag /// could become one. /// @param account The wallet. /// @param excluded `true` to bar it. function setRewardsExcluded( address account, bool excluded ) external onlyRegistryAdmin { _rewardsExcluded[account] = excluded; emit RewardsExclusionSet(account, excluded); _refresh(account); } /// @notice Point the per-transfer reward notification at a contract, or switch it off. /// @dev 🔴 **THE THIRD DIAL, ADDED 2026-08-31 FOR ADR-0026.** The registry block used /// to say the admin had "exactly two dials"; it has three, and this is the one /// that decides which code is handed control on the tail of every transfer. /// /// **What it cannot do, which is the whole reason it is allowed to exist.** A /// sink set here cannot make a transfer fail, cannot change an amount, cannot /// see or move a balance beyond the

imports6 files

lib/solady/src/tokens/ERC20.sol

// SPDX-License-Identifier: MIT pragma solidity ^0.8.4; /// @notice Simple ERC20 + EIP-2612 implementation. /// @author Solady (https://github.com/vectorized/solady/blob/main/src/tokens/ERC20.sol) /// @author Modified from Solmate (https://github.com/transmissions11/solmate/blob/main/src/tokens/ERC20.sol) /// @author Modified from OpenZeppelin (https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/token/ERC20/ERC20.sol) /// /// @dev Note: /// - The ERC20 standard allows minting and transferring to and from the zero address, /// minting and transferring zero tokens, as well as self-approvals. /// For performance, this implementation WILL NOT revert for such actions. /// Please add any checks with overrides if desired. /// - The `permit` function uses the ecrecover precompile (0x1). /// /// If you are overriding: /// - NEVER violate the ERC20 invariant: /// the total sum of all balances must be equal to `totalSupply()`. /// - Check that the overridden function is actually used in the function you want to /// change the behavior of. Much of the code has been manually inlined for performance. abstract contract ERC20 { /*´:°•.°+.*•´.*:˚.°*.˚•´.°:°•.°•.*•´.*:˚.°*.˚•´.°:°•.°+.*•´.*:*/ /* CUSTOM ERRORS */ /*.•°:°.´+˚.*°.˚:*.´•*.+°.•°:´*.´•*.•°.•°:°.´:•˚°.*°.˚:*.´+°.•*/ /// @dev The total supply has overflowed. error TotalSupplyOverflow(); /// @dev The allowance has overflowed. error AllowanceOverflow(); /// @dev The allowance has underflowed. error AllowanceUnderflow(); /// @dev Insufficient balance. error InsufficientBalance(); /// @dev Insufficient allowance. error InsufficientAllowance(); /// @dev The permit is invalid. error InvalidPermit(); /// @dev The permit has expired. error PermitExpired(); /// @dev The allowance of Permit2 is fixed at infinity. error Permit2AllowanceIsFixedAtInfinity(); /*´:°•.°+.*•´.*:˚.°*.˚•´.°:°•.°•.*•´.*:˚.°*.˚•´.°:°•.°+.*•´.*:*/ /* EVENTS */ /*.•°:°.´+˚.*°.˚:*.´•*.+°.•°:´*.´•*.•°.•°:°.´:•˚°.*°.˚:*.´+°.•*/ /// @dev Emitted when `amount` tokens is transferred from `from` to `to`. event Transfer(address indexed from, address indexed to, uint256 amount); /// @dev Emitted when `amount` tokens is approved by `owner` to be used by `spender`. event Approval(address indexed owner, address indexed spender, uint256 amount); /// @dev `keccak256(bytes("Transfer(address,address,uint256)"))`. uint256 private constant _TRANSFER_EVENT_SIGNATURE = 0xddf252ad1be2c89b69c2b068fc378daa952ba7f163c4a11628f55a4df523b3ef; /// @dev `keccak256(bytes("Approval(address,address,uint256)"))`. uint256 private constant _APPROVAL_EVENT_SIGNATURE = 0x8c5be1e5ebec7d5bd14f71427d1e84f3dd0314c0f7b2291e5b200ac8c7c3b925; /*´:°•.°+.*•´.*:˚.°*.˚•´.°:°•.°•.*•´.*:˚.°*.˚•´.°:°•.°+.*•´.*:*/ /* STORAGE */ /*.•°:°.´+˚.*°.˚:*.´•*.+°.•°:´*.´•*.•°.•°:°.´:•˚°.*°.˚:*.´+°.•*/ /// @dev The storage slot for the total supply. uint256 private constant _TOTAL_SUPPLY_SLOT = 0x05345cdf77eb68f44c; /// @dev The balance slot of `owner` is given by: /// ``` /// mstore(0x0c, _BALANCE_SLOT_SEED) /// mstore(0x00, owner) /// let balanceSlot := keccak256(0x0c, 0x20) /// ``` uint256 private constant _BALANCE_SLOT_SEED = 0x87a211a2; /// @dev The allowance slot of (`owner`, `spender`) is given by: /// ``` /// mstore(0x20, spender) /// mstore(0x0c, _ALLOWANCE_SLOT_SEED) /// mstore(0x00, owner) /// let allowanceSlot := keccak256(0x0c, 0x34) /// ``` uint256 private constant _ALLOWANCE_SLOT_SEED = 0x7f5e9f20; /// @dev The nonce slot of `owner` is given by: /// ``` /// mstore(0x0c, _NONCES_SLOT_SEED) /// mstore(0x00, owner) /// let nonceSlot := keccak256(0x0c, 0x20) /// ``` uint256 private constant _NONCES_SLOT_SEED = 0x38377508; /*´:°•.°+.*•´.*:˚.°*.˚•´.°:°•.°•.*•´.*:˚.°*.˚•´.°:°•.°+.*•´.*:*/ /* CONSTANTS */ /*.•°:°.´+˚.*°.˚:*.´•*.+°.•°:´*.´•*.•°.•°:°.´:•˚°.*°.˚:*.´+°.•*/ /// @dev `(_NONCES_SLOT_SEED << 16) | 0x1901`. uint256 private constant _NONCES_SLOT_SEED_WITH_SIGNATURE_PREFIX = 0x383775081901; /// @dev `keccak256("EIP712Domain(string name,string version,uint256 chainId,address verifyingContract)")`. bytes32 private constant _DOMAIN_TYPEHASH = 0x8b73c3c69bb8fe3d512ecc4cf759cc79239f7b179b0ffacaa9a75d522b39400f; /// @dev `keccak256("1")`. /// If you need to use a different version, override `_versionHash`. bytes32 private constant _DEFAULT_VERSION_HASH = 0xc89efdaa54c0f20c7adf612882df0950f5a951637e0307cdcb4c672f298b8bc6; /// @dev `keccak256("Permit(address owner,address spender,uint256 value,uint256 nonce,uint256 deadline)")`. bytes32 private constant _PERMIT_TYPEHASH = 0x6e71edae12b1b97f4d1f60370fef10105fa2faae0126114a169c64845d6126c9; /// @dev The canonical Permit2 address. /// For signature-based allowance granting for single transaction ERC20 `transferFrom`. /// Enabled by default. To disable, override `_givePermit2InfiniteAllowance()`. /// [Github](https://github.com/Uniswap/permit2) /// [Etherscan](https://etherscan.io/address/0x000000000022D473030F116dDEE9F6B43aC78BA3) address internal constant _PERMIT2 = 0x000000000022D473030F116dDEE9F6B43aC78BA3; /*´:°•.°+.*•´.*:˚.°*.˚•´.°:°•.°•.*•´.*:˚.°*.˚•´.°:°•.°+.*•´.*:*/ /* ERC20 METADATA */ /*.•°:°.´+˚.*°.˚:*.´•*.+°.•°:´*.´•*.•°.•°:°.´:•˚°.*°.˚:*.´+°.•*/ /// @dev Returns the name of the token. function name() public view virtual returns (string memory); /// @dev Returns the symbol of the token. function symbol() public view virtual returns (string memory); /// @dev Returns the decimals places of the token. function decimals() public view virtual returns (uint8) { return 18; } /*´:°•.°+.*•´.*:˚.°*.˚•´.°:°•.°•.*•´.*:˚.°*.˚•´.°:°•.°+.*•´.*:*/ /* ERC20 */ /*.•°:°.´+˚.*°.˚:*.´•*.+°.•°:´*.´•*.•°.•°:°.´:•˚°.*°.˚:*.´+°.•*/ /// @dev Returns the amount of tokens in existence. function totalSupply() public view virtual returns (uint256 result) { /// @solidity memory-safe-assembly assembly { result := sload(_TOTAL_SUPPLY_SLOT) } } /// @dev Returns the amount of tokens owned by `owner`. function balanceOf(address owner) public view virtual returns (uint256 result) { /// @solidity memory-safe-assembly assembly { mstore(0x0c, _BALANCE_SLOT_SEED) mstore(0x00, owner) result := sload(keccak256(0x0c, 0x20)) } } /// @dev Returns the amount of tokens that `spender` can spend on behalf of `owner`. function allowance(address owner, address spender) public view virtual returns (uint256 result) { if (_givePermit2InfiniteAllowance()) { if (spender == _PERMIT2) return type(uint256).max; } /// @solidity memory-safe-assembly assembly { mstore(0x20, spender) mstore(0x0c, _ALLOWANCE_SLOT_SEED) mstore(0x00, owner) result := sload(keccak256(0x0c, 0x34)) } } /// @dev Sets `amount` as the allowance of `spender` over the caller's tokens. /// /// Emits a {Approval} event. function approve(address spender, uint256 amount) public virtual returns (bool) { if (_givePermit2InfiniteAllowance()) { /// @solidity memory-safe-assembly assembly { // If `spender == _PERMIT2 && amount != type(uint256).max`. if iszero(or(xor(shr(96, shl(96, spender)), _PERMIT2), iszero(not(amount)))) { mstore(0x00, 0x3f68539a) // `Permit2AllowanceIsFixedAtInfinity()`. revert(0x1c, 0x04) } } } /// @solidity memory-safe-assembly assembly { // Compute the allowance slot and store the amount. mstore(0x20, spender) mstore(0x0c, _ALLOWANCE_SLOT_SEED) mstore(0x00, caller()) sstore(keccak256(0x0c, 0x34), amount) // Emit the {Approval} event. mstore(0x00, amount) log3(0x00, 0x20, _APPROVAL_EVENT_SIGNATURE, caller(), shr(96, mload(0x2c))) } return true; } /// @dev Transfer `amount` tokens from the caller to `to`. /// /// Requirements: /// - `from` must at least have `amount`. /// /// Emits a {Transfer} event. function transfer(address to, uint256 amount) public virtual returns (bool) { _beforeTokenTransfer(msg.sender, to, amount); /// @solidity memory-safe-assembly assembly { // Compute the balance slot and load its value. mstore(0x0c, _BALANCE_SLOT_SEED) mstore(0x00, caller()) let fromBalanceSlot := keccak256(0x0c, 0x20) let fromBalance := sload(fromBalanceSlot) // Revert if insufficient balance. if gt(amount, fromBalance) { mstore(0x00, 0xf4d678b8) // `InsufficientBalance()`. revert(0x1c, 0x04) } // Subtract and store the updated balance. sstore(fromBalanceSlot, sub(fromBalance, amount)) // Compute the balance slot of `to`. mstore(0x00, to) let toBalanceSlot := keccak256(0x0c, 0x20) // Add and store the updated balance of `to`. // Will not overflow because the sum of all user balances // cannot exceed the maximum uint256 value. sstore(toBalanceSlot, add(sload(toBalanceSlot), amount)) // Emit the {Transfer} event. mstore(0x20, amount) log3(0x20, 0x20, _TRANSFER_EVENT_SIGNATURE, caller(), shr(96, mload(0x0c))) } _afterTokenTransfer(msg.sender, to, amount); return true; } /// @dev Transfers `amount` tokens from `from` to `to`. /// /// Note: Does not update the allowance if it is the maximum uint256 value. /// /// Requirements: /// - `from` must at least have `amount`. /// - The caller must have at least `amount` of allowance to transfer the tokens of `from`. /// /// Emits a {Transfer} event. function transferFrom(address from, address to, uint256 amount) public virtual returns (bool) { _beforeTokenTransfer(from, to, amount); // Code duplication is for zero-cost abstraction if possible. if (_givePermit2InfiniteAllowance()) { /// @solidity memory-safe-assembly assembly { let from_ := shl(96, from) if iszero(eq(caller(), _PERMIT2)) { // Compute the allowance slot and load its value. mstore(0x20, caller()) mstore(0x0c, or(from_, _ALLOWANCE_SLOT_SEED)) let allowanceSlot := keccak256(0x0c, 0x34) let allowance_ := sload(allowanceSlot) // If the allowance is not the maximum uint256 value. if not(allowance_) { // Revert if the amount to be transferred exceeds the allowance. if gt(amount, allowance_) { mstore(0x00, 0x13be252b) // `InsufficientAllowance()`. revert(0x1c, 0x04) } // Subtract and store the updated allowance. sstore(allowanceSlot, sub(allowance_, amount)) } } // Compute the balance slot and load its value. mstore(0x0c, or(from_, _BALANCE_SLOT_SEED)) let fromBalanceSlot := keccak256(0x0c, 0x20) let fromBalance := sload(fromBalanceSlot) // Revert if insufficient balance. if gt(amount, fromBalance) { mstore(0x00, 0xf4d678b8) // `InsufficientBalance()`. revert(0x1c, 0x04) } // Subtract and store the updated balance. sstore(fromBalanceSlot, sub(fromBalance, amount)) // Compute the balance slot of `to`. mstore(0x00, to) let toBalanceSlot := keccak256(0x0c, 0x20) // Add and store the updated balance of `to`. // Will not overflow because the sum of all user balances // cannot exceed the maximum uint256 value. sstore(toBalanceSlot, add(sload(toBalanceSlot), amount)) // Emit the {Transfer} event. mstore(0x20, amount) log3(0x20, 0x20, _TRANSFER_EVENT_SIGNATURE, shr(96, from_), shr(96, mload(0x0c))) } } else { /// @solidity memory-safe-assembly assembly { let from_ := shl(96, from) // Compute the allowance slot and load its value. mstore(0x20, caller()) mstore(0x0c, or(from_, _ALLOWANCE_SLOT_SEED)) let allowanceSlot := keccak256(0x0c, 0x34) let allowance_ := sload(allowanceSlot) // If the allowance is not the maximum uint256 value. if not(allowance_) { // Revert if the amount to be transferred exceeds the allowance. if gt(amount, allowance_) { mstore(0x00, 0x13be252b) // `InsufficientAllowance()`. revert(0x1c, 0x04) } // Subtract and store the updated allowance. sstore(allowanceSlot, sub(allowance_, amount)) } // Compute the balance slot and load its value. mstore(0x0c, or(from_, _BALANCE_SLOT_SEED)) let fromBalanceSlot := keccak256(0x0c, 0x20) let fromBalance := sload(fromBalanceSlot) // Revert if insufficient balance. if gt(amount, fromBalance) { mstore(0x00, 0xf4d678b8) // `InsufficientBalance()`. revert(0x1c, 0x04) } // Subtract and store the updated balance. sstore(fromBalanceSlot, sub(fromBalance, amount)) // Compute the balance slot of `to`. mstore(0x00, to) let toBalanceSlot := keccak256(0x0c, 0x20) // Add and store the updated balance of `to`. // Will not overflow because the sum of all user balances // cannot exceed the maximum uint256 value. sstore(toBalanceSlot, add(sload(toBalanceSlot), amount)) // Emit the {Transfer} event. mstore(0x20, amount) log3(0x20, 0x20, _TRANSFER_EVENT_SIGNATURE, shr(96, from_), shr(96, mload(0x0c))) } } _afterTokenTransfer(from, to, amount); return true; } /*´:°•.°+.*•´.*:˚.°*.˚•´.°:°•.°•.*•´.*:˚.°*.˚•´.°:°•.°+.*•´.*:*/ /* EIP-2612 */ /*.•°:°.´+˚.*°.˚:*.´•*.+°.•°:´*.´•*.•°.•°:°.´:•˚°.*°.˚:*.´+°.•*/ /// @dev For more performance, override to return the constant value /// of `keccak256(bytes(name()))` if `name()` will never change. function _constantNameHash() internal view virtual returns (bytes32 result) {} /// @dev If you need a different value, override this function. function _versionHash() internal view virtual returns (bytes32 result) { result = _DEFAULT_VERSION_HASH; } /// @dev For inheriting contracts to increment the nonce. function _incrementNonce(address owner) internal virtual { /// @solidity memory-safe-assembly assembly { mstore(0x0c, _NONCES_SLOT_SEED) mstore(0x00, owner) let nonceSlot := keccak256(0x0c, 0x20) sstore(nonceSlot, add(1, sload(nonceSlot))) } } /// @dev Returns the current nonce for `owner`. /// This value is used to compute the signature for EIP-2612 permit. function nonces(address owner) public view virtual returns (uint256 result) { /// @solidity memory-safe-assembly assembly { // Compute the nonce slot and load its value. mstore(0x0c, _NONCES_SLOT_SEED) mstore(0x00, owner) result := sload(keccak256(0x0c, 0x20)) } } /// @dev Sets `value` as the allowance of `spender` over the tokens of `owner`, /// authorized by a signed approval by `owner`. /// /// Emits a {Approval} event. function permit( address owner, address spender, uint256 value, uint256 deadline, uint8 v, bytes32 r, bytes32 s ) public virtual { if (_givePermit2InfiniteAllowance()) { /// @solidity memory-safe-assembly assembly { // If `spender == _PERMIT2 && value != type(uint256).max`. if iszero(or(xor(shr(96, shl(96, spender)), _PERMIT2), iszero(not(value)))) { mstore(0x00, 0x3f68539a) // `Permit2AllowanceIsFixedAtInfinity()`. revert(0x1c, 0x04) } } } bytes32 nameHash = _constantNameHash(); // We simply calculate it on-the-fly to allow for cases where the `name` may change. if (nameHash == bytes32(0)) nameHash = keccak256(bytes(name())); bytes32 versionHash = _versionHash(); /// @solidity memory-safe-assembly assembly { // Revert if the block timestamp is greater than `deadline`. if gt(timestamp(), deadline) { mstore(0x00, 0x1a15a3cc) // `PermitExpired()`. revert(0x1c, 0x04) } let m := mload(0x40) // Grab the free memory pointer. // Clean the upper 96 bits. owner := shr(96, shl(96, owner)) spender := shr(96, shl(96, spender)) // Compute the nonce slot and load its value. mstore(0x0e, _NONCES_SLOT_SEED_WITH_SIGNATURE_PREFIX) mstore(0x00, owner) let nonceSlot := keccak256(0x0c, 0x20) let nonceValue := sload(nonceSlot) // Prepare the domain separator. mstore(m, _DOMAIN_TYPEHASH) mstore(add(m, 0x20), nameHash) mstore(add(m, 0x40), versionHash) mstore(add(m, 0x60), chainid()) mstore(add(m, 0x80), address()) mstore(0x2e, keccak256(m, 0xa0)) // Prepare the struct hash. mstore(m, _PERMIT_TYPEHASH) mstore(add(m, 0x20), owner) mstore(add(m, 0x40), spender) mstore(add(m, 0x60), value) mstore(add(m, 0x80), nonceValue) mstore(add(m, 0xa0), deadline) mstore(0x4e, keccak256(m, 0xc0)) // Prepare the ecrecover calldata. mstore(0x00, keccak256(0x2c, 0x42)) mstore(0x20, and(0xff, v)) mstore(0x40, r) mstore(0x60, s) let t := staticcall(gas(), 1, 0x00, 0x80, 0x20, 0x20) // If the ecrecover fails, the returndatasize will be 0x00, // `owner` will be checked if it equals the hash at 0x00, // which evaluates to false (i.e. 0), and we will revert. // If the ecrecover succeeds, the returndatasize will be 0x20, // `owner` will be compared against the returned address at 0x20. if iszero(eq(mload(returndatasize()), owner)) { mstore(0x00, 0xddafbaef) // `InvalidPermit()`. revert(0x1c, 0x04) } // Increment and store the updated nonce. sstore(nonceSlot, add(nonceValue, t)) // `t` is 1 if ecrecover succeeds. // Compute the allowance slot and store the value. // The `owner` is already at slot 0x20. mstore(0x40, or(shl(160, _ALLOWANCE_SLOT_SEED), spender)) sstore(keccak256(0x2c, 0x34), value) // Emit the {Approval} event. log3(add(m, 0x60), 0x20, _APPROVAL_EVENT_SIGNATURE, owner, spender) mstore(0x40, m) // Restore the free memory pointer. mstore(0x60, 0) // Restore the zero pointer. } } /// @dev Returns the EIP-712 domain separator for the EIP-2612 permit. function DOMAIN_SEPARATOR() public view virtual returns (bytes32 result) { bytes32 nameHash = _constantNameHash(); // We simply calculate it on-the-fly to allow for cases where the `name` may change. if (nameHash == bytes32(0)) nameHash = keccak256(bytes(name())); bytes32 versionHash = _versionHash(); /// @solidity memory-safe-assembly assembly { let m := mload(0x40) // Grab the free memory pointer. mstore(m, _DOMAIN_TYPEHASH) mstore(add(m, 0x20), nameHash) mstore(add(m, 0x40), versionHash) mstore(add(m, 0x60), chainid()) mstore(add(m, 0x80), address()) result := keccak256(m, 0xa0) } } /*´:°•.°+.*•´.*:˚.°*.˚•´.°:°•.°•.*•´.*:˚.°*.˚•´.°:°•.°+.*•´.*:*/ /* INTERNAL MINT FUNCTIONS */ /*.•°:°.´+˚.*°.˚:*.´•*.+°.•°:´*.´•*.•°.•°:°.´:•˚°.*°.˚:*.´+°.•*/ /// @dev Mints `amount` tokens to `to`, increasing the total supply. /// /// Emits a {Transfer} event. function _mint(address to, uint256 amount) internal virtual { _beforeTokenTransfer(address(0), to, amount); /// @solidity memory-safe-assembly assembly { let totalSupplyBefore := sload(_TOTAL_SUPPLY_SLOT) let totalSupplyAfter := add(totalSupplyBefore, amount) // Revert if the total supply overflows. if lt(totalSupplyAfter, totalSupplyBefore) { mstore(0x00, 0xe5cfe957) // `TotalSupplyOverflow()`. revert(0x1c, 0x04) } // Store the updated total supply. sstore(_TOTAL_SUPPLY_SLOT, totalSupplyAfter) // Compute the balance slot and load its value. mstore(0x0c, _BALANCE_SLOT_SEED) mstore(0x00, to) let toBalanceSlot := keccak256(0x0c, 0x20) // Add and store the updated balance. sstore(toBalanceSlot, add(sload(toBalanceSlot), amount)) // Emit the {Transfer} event. mstore(0x20, amount) log3(0x20, 0x20, _TRANSFER_EVENT_SIGNATURE, 0, shr(96, mload(0x0c))) } _afterTokenTransfer(address(0), to, amount); } /*´:°•.°+.*•´.*:˚.°*.˚•´.°:°•.°•.*•´.*:˚.°*.˚•´.°:°•.°+.*•´.*:*/ /* INTERNAL BURN FUNCTIONS */ /*.•°:°.´+˚.*°.˚:*.´•*.+°.•°:´*.´•*.•°.•°:°.´:•˚°.*°.˚:*.´+°.•*/ /// @dev Burns `amount` tokens from `from`, reducing the total supply. /// /// Emits a {Transfer} event. function _burn(address from, uint256 amount) internal virtual { _beforeTokenTransfer(from, address(0), amount); /// @solidity memory-safe-assembly assembly { // Compute the balance slot and load its value. mstore(0x0c, _BALANCE_SLOT_SEED) mstore(0x00, from) let fromBalanceSlot := keccak256(0x0c, 0x20) let fromBalance := sload(fromBalanceSlot) // Revert if insufficient balance. if gt(amount, fromBalance) { mstore(0x00, 0xf4d678b8) // `InsufficientBalance()`. revert(0x1c, 0x04) } // Subtract and store the updated balance. sstore(fromBalanceSlot, sub(fromBalance, amount)) // Subtract and store the updated total supply. sstore(_TOTAL_SUPPLY_SLOT, sub(sload(_TOTAL_SUPPLY_SLOT), amount)) // Emit the {Transfer} event. mstore(0x00, amount) log3(0x00, 0x20, _TRANSFER_EVENT_SIGNATURE, shr(96, shl(96, from)), 0) } _afterTokenTransfer(from, address(0), amount); } /*´:°•.°+.*•´.*:˚.°*.˚•´.°:°•.°•.*•´.*:˚.°*.˚•´.°:°•.°+.*•´.*:*/ /* INTERNAL TRANSFER FUNCTIONS */ /*.•°:°.´+˚.*°.˚:*.´•*.+°.•°:´*.´•*.•°.•°:°.´:•˚°.*°.˚:*.´+°.•*/ /// @dev Moves `amount` of tokens from `from` to `to`. function _transfer(address from, address to, uint256 amount) internal virtual { _beforeTokenTransfer(from, to, amount); /// @solidity memory-safe-assembly assembly { let from_ := shl(96, from) // Compute the balance slot and load its value. mstore(0x0c, or(from_, _BALANCE_SLOT_SEED)) let fromBalanceSlot := keccak256(0x0c, 0x20) let fromBalance := sload(fromBalanceSlot) // Revert if insufficient balance. if gt(amount, fromBalance) { mstore(0x00, 0xf4d678b8) // `InsufficientBalance()`. revert(0x1c, 0x04) } // Subtract and store the updated balance. sstore(fromBalanceSlot, sub(fromBalance, amount)) // Compute the balance slot of `to`. mstore(0x00, to) let toBalanceSlot := keccak256(0x0c, 0x20) // Add and store the updated balance of `to`. // Will not overflow because the sum of all user balances // cannot exceed the maximum uint256 value. sstore(toBalanceSlot, add(sload(toBalanceSlot), amount)) // Emit the {Transfer} event. mstore(0x20, amount) log3(0x20, 0x20, _TRANSFER_EVENT_SIGNATURE, shr(96, from_), shr(96, mload(0x0c))) } _afterTokenTransfer(from, to, amount); } /*´:°•.°+.*•´.*:˚.°*.˚•´.°:°•.°•.*•´.*:˚.°*.˚•´.°:°•.°+.*•´.*:*/ /* INTERNAL ALLOWANCE FUNCTIONS */ /*.•°:°.´+˚.*°.˚:*.´•*.+°.•°:´*.´•*.•°.•°:°.´:•˚°.*°.˚:*.´+°.•*/ /// @dev Updates the allowance of `owner` for `spender` based on spent `amount`. function _spendAllowance(address owner, address spender, uint256 amount) internal virtual { if (_givePermit2InfiniteAllowance()) { if (spender == _PERMIT2) return; // Do nothing, as allowance is infinite. } /// @solidity memory-safe-assembly assembly { // Compute the allowance slot and load its value. mstore(0x20, spender) mstore(0x0c, _ALLOWANCE_SLOT_SEED) mstore(0x00, owner) let allowanceSlot := keccak256(0x0c, 0x34) let allowance_ := sload(allowanceSlot) // If the allowance is not the maximum uint256 value. if not(allowance_) { // Revert if the amount to be transferred exceeds the allowance. if gt(amount, allowance_) { mstore(0x00, 0x13be252b) // `InsufficientAllowance()`. revert(0x1c, 0x04) } // Subtract and store the updated allowance. sstore(allowanceSlot, sub(allowance_, amount)) } } } /// @dev Sets `amount` as the allowance of `spender` over the tokens of `owner`. /// /// Emits a {Approval} event. function _approve(address owner, address spender, uint256 amount) internal virtual { if (_givePermit2InfiniteAllowance()) { /// @solidity memory-safe-assembly assembly { // If `spender == _PERMIT2 && amount != type(uint256).max`. if iszero(or(xor(shr(96, shl(96, spender)), _PERMIT2), iszero(not(amount)))) { mstore(0x00, 0x3f68539a) // `Permit2AllowanceIsFixedAtInfinity()`. revert(0x1c, 0x04) } } } /// @solidity memory-safe-assembly assembly { let owner_ := shl(96, owner) // Compute the allowance slot and store the amount. mstore(0x20, spender) mstore(0x0c, or(owner_, _ALLOWANCE_SLOT_SEED)) sstore(keccak256(0x0c, 0x34), amount) // Emit the {Approval} event. mstore(0x00, amount) log3(0x00, 0x20, _APPROVAL_EVENT_SIGNATURE, shr(96, owner_), shr(96, mload(0x2c))) } } /*´:°•.°+.*•´.*:˚.°*.˚•´.°:°•.°•.*•´.*:˚.°*.˚•´.°:°•.°+.*•´.*:*/ /* HOOKS TO OVERRIDE */ /*.•°:°.´+˚.*°.˚:*.´•*.+°.•°:´*.´•*.•°.•°:°.´:•˚°.*°.˚:*.´+°.•*/ /// @dev Hook that is called before any transfer of tokens. /// This includes minting and burning. function _beforeTokenTransfer(address from, address to, uint256 amount) internal virtual {} /// @dev Hook that is called after any transfer of tokens. /// This includes minting and burning. function _afterTokenTransfer(address from, address to, uint256 amount) internal virtual {} /*´:°•.°+.*•´.*:˚.°*.˚•´.°:°•.°•.*•´.*:˚.°*.˚•´.°:°•.°+.*•´.*:*/ /* PERMIT2 */ /*.•°:°.´+˚.*°.˚:*.´•*.+°.•°:´*.´•*.•°.•°:°.´:•˚°.*°.˚:*.´+°.•*/ /// @dev Returns whether to fix the Permit2 contract's allowance at infinity. /// /// This value should be kept constant after contract initialization, /// or else the actual allowance values may not match with the {Approval} events. /// For best performance, return a compile-time constant for zero-cost abstraction. function _givePermit2InfiniteAllowance() internal view virtual returns (bool) { return true; } }

Contract Viewer19 read methods

returns uint8

loading panels

querying index

0x60806040526004361015610011575f80fd5b5f3560e01c806306fdde0314610c38578063095ea7b314610bbc5780630afb040914610b9b57806318160ddd14610b76578063197bc33614610b3f5780631aab9a9f14610b2257806323b872dd14610a3f578063313ce56714610a245780633644e515146109c257806339069d8c14610955578063599270441461091157806363dbac78146108a057806366e305fd1461082b57806370a08231146107f957806374c16b23146107d25780637ecebe00146107a05780638bf2581c1461076357806395d89b411461065f578063966d849f146105d2578063a572c78b1461058e578063a9059cbb14610506578063afde442a146104e3578063d505accf14610356578063da5c8b7f14610325578063dd62ed3e146102f1578063eedeeab7146102c9578063f4e15ee7146102ac578063f688e7b5146102015763fb18718114610158575f80fd5b346101e85760203660031901126101e8576004356001600160401b0381116101e857366023820112156101e8576004810135906001600160401b0382116101e8573660248360051b830101116101e8576107d082116101ee575f5b828110156101ec57600581901b820160240135906001600160a01b03821682036101e8576101e2600192610ebc565b016101b3565b5f80fd5b005b5063458375bb60e01b5f5260045260245ffd5b346101e85760203660031901126101e8575f54600435906001600160a01b0316330361029957670de0b6b3a764000081108015610286575b610274577f6309d01e3dd1c9c822441a20953f11e19a33bc6d105e4626242962429377424160406003548151908152836020820152a1600355005b63458375bb60e01b5f5260045260245ffd5b5069d3c21bcecceda10000008111610239565b6378a2c3e160e11b5f523360045260245ffd5b346101e8575f3660031901126101e8576020600354604051908152f35b346101e8575f3660031901126101e8576005546040516001600160a01b039091168152602090f35b346101e85760403660031901126101e857602061031d61030f610c7d565b610317610c93565b90610e7f565b604051908152f35b346101e85760203660031901126101e8576040610348610343610c7d565b610e30565b825191825215156020820152f35b346101e85760e03660031901126101e85761036f610c7d565b610377610c93565b604435916064356084359260ff841684036101e8576001600160a01b0316936e22d473030f116ddee9f6b43ac78ba3851881191517156104d6576103b9610ce0565b60208151910120908242116104c9576040519360018060a01b03169465383775081901600e52855f5260c06020600c20958654955f5160206111cb5f395f51905f528252602082019586528660408301965f51602061116b5f395f51905f5288528b6060850198468a528c608087019330855260a08820602e527f6e71edae12b1b97f4d1f60370fef10105fa2faae0126114a169c64845d6126c9885252528688525260a082015220604e526042602c205f5260ff1660205260a43560405260c43560605260208060805f60015afa93853d51036104bc575f5160206111ab5f395f51905f5294602094019055856303faf4f960a51b176040526034602c2055a3005b63ddafbaef5f526004601cfd5b631a15a3cc5f526004601cfd5b633f68539a5f526004601cfd5b346101e85760203660031901126101e857602061031d610501610c7d565b610dda565b346101e85760403660031901126101e85761051f610c7d565b6024356387a211a2600c52335f526020600c2091825492838311610581578261057694039055805f526020600c2082815401905581602052600c5160601c335f51602061118b5f395f51905f52602080a333611090565b602060405160018152f35b63f4d678b85f526004601cfd5b346101e8575f3660031901126101e8576040517f000000000000000000000000acbbded29ec88404e158cde4a958fec3822eebd46001600160a01b03168152602090f35b346101e85760403660031901126101e8576105eb610c7d565b602435908115158092036101e8575f546001600160a01b03163303610299576101ec917f268934e8c6f57a04a33e890003d5f78c8c521f4293da60453b573f7d8f59a4e7602060018060a01b03841692835f526004825260405f2060ff1981541660ff8316179055604051908152a2610ebc565b346101e8575f3660031901126101e8576040515f6007548060011c90600181168015610759575b6020831081146107455782855290811561072157506001146106c3575b6106bf836106b381850382610ca9565b60405191829182610c53565b0390f35b60075f9081527fa66cc928b5edb82af9bd49922954155ab7b0942694bea4ce44661d9a8736c688939250905b808210610707575090915081016020016106b36106a3565b9192600181602092548385880101520191019092916106ef565b60ff191660208086019190915291151560051b840190910191506106b390506106a3565b634e487b7160e01b5f52602260045260245ffd5b91607f1691610686565b346101e85760203660031901126101e8576001600160a01b03610784610c7d565b165f526004602052602060ff60405f2054166040519015158152f35b346101e85760203660031901126101e8576107b9610c7d565b6338377508600c525f52602080600c2054604051908152f35b346101e8575f3660031901126101e8575f546040516001600160a01b039091168152602090f35b346101e85760203660031901126101e857610812610c7d565b6387a211a2600c525f52602080600c2054604051908152f35b346101e85760203660031901126101e857610844610c7d565b6001600160a01b0381168015159081610888575b508061086c575b6020906040519015158152f35b506387a211a2600c525f52602080600c2054600354111561085f565b90505f52600460205260ff60405f2054161582610858565b346101e85760203660031901126101e8576108b9610c7d565b5f546001600160a01b03163303610299576005546001600160a01b0391821691829082167f2618ecf737d2ad9e490fc0ee34c08c08462dfe6d24455b0ce70b36aaafa45a225f80a36001600160a01b03191617600555005b346101e8575f3660031901126101e8576040517f000000000000000000000000acbbded29ec88404e158cde4a958fec3822eebd46001600160a01b03168152602090f35b346101e85760203660031901126101e85761096e610c7d565b5f546001600160a01b0381169133839003610299576001600160a01b03169182907f815650adb4ef72836967ac79938aeeb53a77f6940b33dc5adffd631162e2189a5f80a36001600160a01b031916175f55005b346101e8575f3660031901126101e857602060a06109de610ce0565b828151910120604051905f5160206111cb5f395f51905f528252838201525f51602061116b5f395f51905f52604082015246606082015230608082015220604051908152f35b346101e8575f3660031901126101e857602060405160128152f35b346101e85760603660031901126101e857610a58610c7d565b610a60610c93565b604435908260601b6e22d473030f116ddee9f6b43ac78ba33303610ad8575b6387a211a217600c526020600c2092835493848411610581578361057695039055815f526020600c2083815401905582602052600c5160601c60018060a01b0382165f51602061118b5f395f51905f52602080a3611090565b33602052637f5e9f208117600c526034600c20908154918219610afe575b509050610a7f565b828511610b1557846387a211a29303905585610af6565b6313be252b5f526004601cfd5b346101e8575f3660031901126101e8576020600154604051908152f35b346101e85760203660031901126101e8576020610b5d600435610dae565b905460405160039290921b1c6001600160a01b03168152f35b346101e8575f3660031901126101e85760206805345cdf77eb68f44c54604051908152f35b346101e85760203660031901126101e8576101ec610bb7610c7d565b610ebc565b346101e85760403660031901126101e857610bd5610c7d565b602435906001600160a01b0381166e22d473030f116ddee9f6b43ac78ba31882191517156104d657602052637f5e9f20600c52335f52806034600c20555f52602c5160601c335f5160206111ab5f395f51905f5260205fa3602060405160018152f35b346101e8575f3660031901126101e8576106bf6106b3610ce0565b602060409281835280519182918282860152018484015e5f828201840152601f01601f1916010190565b600435906001600160a01b03821682036101e857565b602435906001600160a01b03821682036101e857565b601f909101601f19168101906001600160401b03821190821017610ccc57604052565b634e487b7160e01b5f52604160045260245ffd5b604051905f6006548060011c9160018216918215610da4575b602084108314610745578386528592908115610d855750600114610d26575b610d2492500383610ca9565b565b5060065f90815290917ff652222313e28459528d920b65115c16c04f3efc82aaedc97be59f3f377c0d3f5b818310610d69575050906020610d2492820101610d18565b6020919350806001915483858901015201910190918492610d51565b60209250610d2494915060ff191682840152151560051b820101610d18565b92607f1692610cf9565b600154811015610dc65760015f5260205f2001905f90565b634e487b7160e01b5f52603260045260245ffd5b6001600160a01b0381168015908115610e19575b50610e14576387a211a2600c525f526020600c2054906003548210610e0f57565b5f9150565b505f90565b90505f52600460205260ff60405f2054165f610dee565b6001600160a01b038116801591908215610e67575b5081610e5e576387a211a2600c525f526020600c205491565b50505f90600190565b5f9081526004602052604081205460ff169250610e45565b906001600160a01b0381166e22d473030f116ddee9f6b43ac78ba314610eb557602052637f5e9f20600c525f526034600c205490565b50505f1990565b6001600160a01b03811690811561108c57815f52600260205260405f2054825f52600460205260ff60405f2054161580611070575b8115158115151461106a5715610f7f575060015490600160401b821015610ccc57610f25826001610f499401600155610dae565b9080546001600160a01b0360039390931b83811b199091169290931690921b179055565b600154815f52600260205260405f20557f9894d458cf29e8bc4eb7e591bac54b31dc90125dfa852474419972ab4347dd125f80a2565b90505f198101818111611056576001545f19810190811161105657808203611018575b5050506001548015611004575f1901610fba81610dae565b81549060018060a01b039060031b1b19169055600155805f5260026020525f60408120557fd9bc583d1445615d8b795b7374f03ff79efa83b6359a91331efd95e4cf023ab65f80a2565b634e487b7160e01b5f52603160045260245ffd5b610f259161102861104292610dae565b905460039190911b1c6001600160a01b0316928391610dae565b5f52600260205260405f20555f8080610fa2565b634e487b7160e01b5f52601160045260245ffd5b50505050565b506387a211a2600c52815f526020600c20546003541115610ef1565b5050565b610d249261109d82610ebc565b6110a683610ebc565b6005546387a211a2600c8181525f85815260208083205493835290879052902054929594936001600160a01b0390921692908315611161575a9662061a80881061114757604051633626d98160e01b602082019081526001600160a01b0395861660248301529490961660448701526064860152608485015260a48085019190915283529293505f9261113a60c484610ca9565b8338935192620aae60f150565b87633d1ecb0560e11b5f5260045262061a8060245260445ffd5b5050505050905056fec89efdaa54c0f20c7adf612882df0950f5a951637e0307cdcb4c672f298b8bc6ddf252ad1be2c89b69c2b068fc378daa952ba7f163c4a11628f55a4df523b3ef8c5be1e5ebec7d5bd14f71427d1e84f3dd0314c0f7b2291e5b200ac8c7c3b9258b73c3c69bb8fe3d512ecc4cf759cc79239f7b179b0ffacaa9a75d522b39400f