merge master

.gitmodules

@@ -19,10 +19,10 @@
 	path = lib/array-lib
 	url = https://github.com/grappafinance/array-lib
 [submodule "lib/core-physical"]
-	# set to commit c5da376a on branch master
+	# set to commit a38e664 on branch master
 	path = lib/core-physical
 	url = https://github.com/grappafinance/core-physical
 [submodule "lib/core-cash"]
-	# set to commit 8e67b0be on branch master
+	# set to commit 9e4440c on branch master
 	path = lib/core-cash
 	url = https://github.com/grappafinance/core-cash

script/deploy-upgrade-cash.sol

@@ -0,0 +1,30 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.0;
+
+import "forge-std/Script.sol";
+
+import "../src/settled-cash/CrossMarginCashEngine.sol";
+
+contract Deploy is Script {
+    function run() external {
+        console.log("Deployer", msg.sender);
+
+        vm.startBroadcast();
+
+        address grappa = vm.envAddress("GrappaProxy");
+        address optionToken = vm.envAddress("GrappaOptionToken");
+
+        // // deploy and register Cross Margin Engine
+        deployCrossMarginEngine(grappa, optionToken);
+
+        vm.stopBroadcast();
+    }
+
+    function deployCrossMarginEngine(address grappa, address optionToken) public {
+        // ============ Deploy Cross Margin Engine (Upgradable) ============== //
+        address engineImplementation =
+            address(new CrossMarginCashEngine(address(grappa), optionToken, vm.envAddress("CrossMarginCashOracle")));
+
+        console.log("CrossMargin Cash Engine: \t\t\t", engineImplementation);
+    }
+}

script/deploy-upgrade-physical.sol

@@ -0,0 +1,24 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.0;
+
+import "forge-std/Script.sol";
+
+import "../src/settled-physical/CrossMarginPhysicalEngine.sol";
+
+contract DeployPhysicalMarginEngine is Script {
+    function run() external {
+        console.log("Deployer", msg.sender);
+
+        vm.startBroadcast();
+
+        // ============ Deploy Cross Margin Engine (Upgradable) ============== //
+        address engineImplementation =
+            address(new CrossMarginPhysicalEngine(vm.envAddress("PomaceProxy"), vm.envAddress("PomaceOptionToken")));
+
+        console.log("CrossMargin Physical Engine: \t\t", engineImplementation);
+
+        vm.stopBroadcast();
+    }
+
+    function deployCrossMarginPhysicalEngine(address pomace, address optionToken) public {}
+}

src/config/errors.sol

@@ -29,6 +29,9 @@ error CM_CannotMintOptionWithThisCollateral();
 /// @dev invalid tokenId specify to mint / burn actions
 error CM_InvalidToken();
 
+//// @dev invalid signed message
+error CM_InvalidSignature();
+
 /* -------------------------- *
  *  Cross Margin Math Errors
  * -------------------------- */

src/settled-cash/CrossMarginCashEngine.sol

@@ -60,6 +60,14 @@ contract CrossMarginCashEngine is
     using SafeCast for int256;
     using TokenIdUtil for uint256;
 
+    /*///////////////////////////////////////////////////////////////
+                            Immutables
+    //////////////////////////////////////////////////////////////*/
+
+    /// @dev initial chain id used in domain separator
+    uint256 public immutable initialChainId;
+
+    /// @dev oracle to handle partial margining
     IOracle public immutable oracle;
 
     /*///////////////////////////////////////////////////////////////
@@ -85,6 +93,17 @@ contract CrossMarginCashEngine is
     ///      assetId => assetId masks
     mapping(uint256 => uint256) private collateralizable;
 
+    /*///////////////////////////////////////////////////////////////
+                         State Variables V3
+    //////////////////////////////////////////////////////////////*/
+
+    /// @dev initial cached domain separator
+    bytes32 public initialDomainSeparator;
+
+    /// @dev nonce for signed messages to prevent replay attacks
+    ///      address => nonce
+    mapping(address => uint256) public nonces;
+
     /*///////////////////////////////////////////////////////////////
                             Events
     //////////////////////////////////////////////////////////////*/
@@ -99,6 +118,7 @@ contract CrossMarginCashEngine is
         // solhint-disable-next-line reason-string
         if (_oracle == address(0)) revert();
 
+        initialChainId = block.chainid;
         oracle = IOracle(_oracle);
     }
 
@@ -112,6 +132,8 @@ contract CrossMarginCashEngine is
 
         _transferOwnership(_owner);
         __ReentrancyGuard_init_unchained();
+
+        initialDomainSeparator = _computeDomainSeparator();
     }
 
     /*///////////////////////////////////////////////////////////////
@@ -130,6 +152,12 @@ contract CrossMarginCashEngine is
                         External Functions
     //////////////////////////////////////////////////////////////*/
 
+    function setDomainSeperator() external {
+        if (initialDomainSeparator != bytes32(0)) revert();
+
+        initialDomainSeparator = _computeDomainSeparator();
+    }
+
     /**
      * @notice Sets the whitelist contract
      * @param _whitelist is the address of the new whitelist
@@ -282,6 +310,66 @@ contract CrossMarginCashEngine is
         return _getMinCollateral(account);
     }
 
+    /**
+     * @notice  grant or revoke an account access to all your sub-accounts based on a signed message
+     * @dev     expected to have a valid signature signed with account private key
+     * @param   _subAccount account which grants the access
+     * @param   _actor account which is granted the access
+     * @param   _allowedExecutions how many times the account is authorized to update your accounts.
+     *          set to max(uint256) to allow permanent access
+     * @param   _v signature v
+     * @param   _r signature r
+     * @param   _s signature s
+     */
+    function permitAccountAccess(
+        address _subAccount,
+        address _actor,
+        uint256 _allowedExecutions,
+        uint8 _v,
+        bytes32 _r,
+        bytes32 _s
+    ) external {
+        unchecked {
+            address recoveredAddress = ecrecover(
+                keccak256(
+                    abi.encodePacked(
+                        "\x19\x01",
+                        DOMAIN_SEPARATOR(),
+                        keccak256(
+                            abi.encode(
+                                keccak256(
+                                    "PermitAccountAccess(address subAccount,address actor,uint256 allowedExecutions,uint256 nonce)"
+                                ),
+                                _subAccount,
+                                _actor,
+                                _allowedExecutions,
+                                nonces[_subAccount]++
+                            )
+                        )
+                    )
+                ),
+                _v,
+                _r,
+                _s
+            );
+
+            if (recoveredAddress == address(0) || recoveredAddress != _subAccount) revert CM_InvalidSignature();
+        }
+
+        uint160 maskedId = uint160(_subAccount) | 0xFF;
+        allowedExecutionLeft[maskedId][_actor] = _allowedExecutions;
+
+        emit AccountAuthorizationUpdate(maskedId, _actor, _allowedExecutions);
+    }
+
+    /*///////////////////////////////////////////////////////////////
+                                Public Functions
+    //////////////////////////////////////////////////////////////*/
+
+    function DOMAIN_SEPARATOR() public view virtual returns (bytes32) {
+        return block.chainid == initialChainId ? initialDomainSeparator : _computeDomainSeparator();
+    }
+
     /**
      * ========================================================= **
      *             Override Internal Functions For Each Action
@@ -515,4 +603,16 @@ contract CrossMarginCashEngine is
         uint256 mask = 1 << _assetId1;
         return collateralizable[_assetId0] & mask != 0;
     }
+
+    function _computeDomainSeparator() internal view returns (bytes32) {
+        return keccak256(
+            abi.encode(
+                keccak256("EIP712Domain(string name,string version,uint256 chainId,address verifyingContract)"),
+                keccak256("Cross Margin Cash Engine"),
+                keccak256("1"),
+                block.chainid,
+                address(this)
+            )
+        );
+    }
 }

src/settled-physical/CrossMarginPhysicalEngine.sol

@@ -60,6 +60,13 @@ contract CrossMarginPhysicalEngine is
     using SafeCast for int256;
     using TokenIdUtil for uint256;
 
+    /*///////////////////////////////////////////////////////////////
+                            Immutables
+    //////////////////////////////////////////////////////////////*/
+
+    /// @dev initial chain id used in domain separator
+    uint256 public immutable initialChainId;
+
     /*///////////////////////////////////////////////////////////////
                          State Variables V1
     //////////////////////////////////////////////////////////////*/
@@ -75,19 +82,28 @@ contract CrossMarginPhysicalEngine is
     ///     checks recipient on payCashValue
     IWhitelist public whitelist;
 
+    /// @dev token => SettlementTracker
+    mapping(uint256 => SettlementTracker) public tokenTracker;
+
     /*///////////////////////////////////////////////////////////////
-                         State Variables V1
+                         State Variables V2
     //////////////////////////////////////////////////////////////*/
 
-    /// @dev token => SettlementTracker
-    mapping(uint256 => SettlementTracker) public tokenTracker;
+    /// @dev initial cached domain separator
+    bytes32 public initialDomainSeparator;
+
+    /// @dev nonce for signed messages to prevent replay attacks
+    ///      address => nonce
+    mapping(address => uint256) public nonces;
 
     /*///////////////////////////////////////////////////////////////
                 Constructor for implementation Contract
     //////////////////////////////////////////////////////////////*/
 
     // solhint-disable-next-line no-empty-blocks
-    constructor(address _pomace, address _optionToken) BaseEngine(_pomace, _optionToken) initializer {}
+    constructor(address _pomace, address _optionToken) BaseEngine(_pomace, _optionToken) initializer {
+        initialChainId = block.chainid;
+    }
 
     /*///////////////////////////////////////////////////////////////
                             Initializer
@@ -99,6 +115,8 @@ contract CrossMarginPhysicalEngine is
 
         _transferOwnership(_owner);
         __ReentrancyGuard_init_unchained();
+
+        initialDomainSeparator = _computeDomainSeparator();
     }
 
     /*///////////////////////////////////////////////////////////////
@@ -117,6 +135,12 @@ contract CrossMarginPhysicalEngine is
                         External Functions
     //////////////////////////////////////////////////////////////*/
 
+    function setDomainSeperator() external {
+        if (initialDomainSeparator != bytes32(0)) revert();
+
+        initialDomainSeparator = _computeDomainSeparator();
+    }
+
     /**
      * @notice Sets the whitelist contract
      * @param _whitelist is the address of the new whitelist
@@ -293,6 +317,70 @@ contract CrossMarginPhysicalEngine is
         return _getMinCollateral(account);
     }
 
+    /**
+     * @notice  grant or revoke an account access to all your sub-accounts based on a signed message
+     * @dev     expected to have a valid signature signed with account private key
+     * @param   _subAccount account which grants the access
+     * @param   _actor account which is granted the access
+     * @param   _allowedExecutions how many times the account is authorized to update your accounts.
+     *          set to max(uint256) to allow permanent access
+     * @param   _v signature v
+     * @param   _r signature r
+     * @param   _s signature s
+     */
+    function permitAccountAccess(
+        address _subAccount,
+        address _actor,
+        uint256 _allowedExecutions,
+        uint8 _v,
+        bytes32 _r,
+        bytes32 _s
+    ) external {
+        // assert valid signature
+        // Unchecked because the only math done is incrementing
+        // the owner's nonce which cannot realistically overflow.
+        unchecked {
+            address recoveredAddress = ecrecover(
+                keccak256(
+                    abi.encodePacked(
+                        "\x19\x01",
+                        DOMAIN_SEPARATOR(),
+                        keccak256(
+                            abi.encode(
+                                keccak256(
+                                    "PermitAccountAccess(address subAccount,address actor,uint256 allowedExecutions,uint256 nonce)"
+                                ),
+                                _subAccount,
+                                _actor,
+                                _allowedExecutions,
+                                nonces[_subAccount]++
+                            )
+                        )
+                    )
+                ),
+                _v,
+                _r,
+                _s
+            );
+
+            if (recoveredAddress == address(0) || recoveredAddress != _subAccount) revert CM_InvalidSignature();
+        }
+
+        // update account access
+        uint160 maskedId = uint160(_subAccount) | 0xFF;
+        allowedExecutionLeft[maskedId][_actor] = _allowedExecutions;
+
+        emit AccountAuthorizationUpdate(maskedId, _actor, _allowedExecutions);
+    }
+
+    /*///////////////////////////////////////////////////////////////
+                                Public Functions
+    //////////////////////////////////////////////////////////////*/
+
+    function DOMAIN_SEPARATOR() public view virtual returns (bytes32) {
+        return block.chainid == initialChainId ? initialDomainSeparator : _computeDomainSeparator();
+    }
+
     /**
      * ========================================================= **
      *             Override Internal Functions For Each Action
@@ -613,4 +701,16 @@ contract CrossMarginPhysicalEngine is
 
         return balances;
     }
+
+    function _computeDomainSeparator() internal view returns (bytes32) {
+        return keccak256(
+            abi.encode(
+                keccak256("EIP712Domain(string name,string version,uint256 chainId,address verifyingContract)"),
+                keccak256("Cross Margin Physical Engine"),
+                keccak256("1"),
+                block.chainid,
+                address(this)
+            )
+        );
+    }
 }