reserve-protocol · tbrent · Sep 26, 2025 · Jun 25, 2025 · Jun 25, 2025 · Jun 25, 2025
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,17 @@
 # Changelog
 
+# 4.2.0
+
+- **Trusted Fillers**: Rtokens are now integrated with [Trusted Fillers](https://github.com/reserve-protocol/trusted-fillers/) and can be enabled by governance to allow async fillers to compete in auctions to provide better prices. All auction limitations still apply to these fillers. Currently, the only supported async filler is CoW Swap.
+
+# 4.1.0
+
+This release implements a global lock on `Main` (by inherinting from `GlobalReentrancyGuard.sol`), which can be used by individual components to define the `globalNonReentrant` modifier and allow global reentrancy checks accross core protocol functions. See [docs/solidity-style.md](./docs/solidity-style.md#Reentrancy-safety)
+
+- Adds `mixins/GlobalReentrancyGuard.sol` contract
+- Implements the `globalNonReentrant` modifier on `ComponentP1`
+- Adds to `globalNonReentrant` modifier on impacted functions to enforce global reentrancy checks
+
 # 4.0.0
 
 This release prepares the core protocol for veRSR through the introduction of 3 registries (`DAOFeeRegistry`, `AssetPluginRegistry`, and `VersionRegistry`) and through restricting component upgrades to be handled by `Main`, where upgrade constraints can be enforced.

diff --git a/common/registries.ts b/common/registries.ts
@@ -3,6 +3,7 @@ interface IRegistries {
   versionRegistry: string
   assetPluginRegistry: string
   daoFeeRegistry: string
+  trustedFillerRegistry: string
 }
 
 interface IRegistryControl {
@@ -26,6 +27,7 @@ export const registryConfig: Record<string, RegistryChainRecord> = {
       versionRegistry: '',
       assetPluginRegistry: '',
       daoFeeRegistry: '',
+      trustedFillerRegistry: '0x279ccF56441fC74f1aAC39E7faC165Dec5A88B3A',
     },
   },
   '8453': {
@@ -38,6 +40,7 @@ export const registryConfig: Record<string, RegistryChainRecord> = {
       versionRegistry: '',
       assetPluginRegistry: '',
       daoFeeRegistry: '',
+      trustedFillerRegistry: '0x72DB5f49D0599C314E2f2FEDf6Fe33E1bA6C7A18',
     },
   },
   '56': {
@@ -50,6 +53,7 @@ export const registryConfig: Record<string, RegistryChainRecord> = {
       versionRegistry: '',
       assetPluginRegistry: '',
       daoFeeRegistry: '',
+      trustedFillerRegistry: '0x08424d7C52bf9edd4070701591Ea3FE6dca6449B',
     },
   },
 }

diff --git a/contracts/interfaces/IBroker.sol b/contracts/interfaces/IBroker.sol
@@ -2,6 +2,7 @@
 pragma solidity 0.8.19;
 
 import "@openzeppelin/contracts/token/ERC20/extensions/IERC20Metadata.sol";
+import "@reserve-protocol/trusted-fillers/contracts/interfaces/ITrustedFillerRegistry.sol";
 import "./IAsset.sol";
 import "./IComponent.sol";
 import "./IGnosis.sol";
@@ -40,6 +41,7 @@ interface IBroker is IComponent {
     event DutchAuctionLengthSet(uint48 oldVal, uint48 newVal);
     event BatchTradeDisabledSet(bool prevVal, bool newVal);
     event DutchTradeDisabledSet(IERC20Metadata indexed erc20, bool prevVal, bool newVal);
+    event TrustedFillerRegistrySet(address trustedFillerRegistry, bool isEnabled);
 
     // Initialization
     function init(
@@ -71,6 +73,12 @@ interface IExtendedBroker is IBroker {
     function setBatchTradeImplementation(ITrade newTradeImplementation) external;
 
     function setDutchTradeImplementation(ITrade newTradeImplementation) external;
+
+    function setTrustedFillerRegistry(address newRegistry, bool enabled) external;
+
+    function trustedFillerRegistry() external view returns (ITrustedFillerRegistry);
+
+    function trustedFillerEnabled() external view returns (bool);
 }
 
 interface TestIBroker is IBroker {
@@ -98,4 +106,10 @@ interface TestIBroker is IBroker {
 
     // only present on pre-3.0.0 Brokers; used by EasyAuction regression test
     function disabled() external view returns (bool);
+
+    function setTrustedFillerRegistry(address newRegistry, bool enabled) external;
+
+    function trustedFillerRegistry() external view returns (ITrustedFillerRegistry);
+
+    function trustedFillerEnabled() external view returns (bool);
 }
diff --git a/contracts/interfaces/IDeployer.sol b/contracts/interfaces/IDeployer.sol
@@ -15,6 +15,7 @@ import "./IVersioned.sol";
 import "../registry/VersionRegistry.sol";
 import "../registry/AssetPluginRegistry.sol";
 import "../registry/DAOFeeRegistry.sol";
+import "@reserve-protocol/trusted-fillers/contracts/interfaces/ITrustedFillerRegistry.sol";
 
 /**
  * @title DeploymentParams
@@ -100,6 +101,7 @@ interface IDeployer is IVersioned {
         VersionRegistry versionRegistry;
         AssetPluginRegistry assetPluginRegistry;
         DAOFeeRegistry daoFeeRegistry;
+        ITrustedFillerRegistry trustedFillerRegistry;
     }
 
     /// Deploys an instance of the entire system

diff --git a/contracts/interfaces/IMain.sol b/contracts/interfaces/IMain.sol
@@ -183,9 +183,17 @@ interface IMain is IVersioned, IAuth, IComponentRegistry {
     function versionRegistry() external view returns (VersionRegistry);
 
     function daoFeeRegistry() external view returns (DAOFeeRegistry);
+
+    // === Control flow ===
+
+    function beginTx() external;
+
+    function endTx() external;
 }
 
 interface TestIMain is IMain {
+    error ReentrancyGuardReentrantCall();
+
     function setVersionRegistry(VersionRegistry) external;
 
     function setAssetPluginRegistry(AssetPluginRegistry) external;

diff --git a/contracts/mixins/Versioned.sol b/contracts/mixins/Versioned.sol
@@ -4,7 +4,7 @@ pragma solidity 0.8.19;
 import "../interfaces/IVersioned.sol";
 
 // This value should be updated on each release
-string constant VERSION = "4.0.0";
+string constant VERSION = "4.2.0";
 
 /**
  * @title Versioned

diff --git a/contracts/mocks/TrustedFillersImport.sol b/contracts/mocks/TrustedFillersImport.sol
@@ -0,0 +1,10 @@
+// SPDX-License-Identifier: BlueOak-1.0.0
+pragma solidity 0.8.28;
+
+// This file exists solely to force Hardhat to compile the trusted-fillers contracts
+// These imports ensure the contracts are available for testing
+
+import "@reserve-protocol/trusted-fillers/contracts/TrustedFillerRegistry.sol";
+// Note: CowSwapFiller cannot be imported due to OpenZeppelin version conflict
+// CowSwapFiller uses OZ 5.1.0 (Math.Rounding.Up) while protocol uses OZ 4.9.6 (Math.Rounding.Ceil)
+// import "@reserve-protocol/trusted-fillers/contracts/fillers/cowswap/CowSwapFiller.sol";
diff --git a/contracts/p0/Main.sol b/contracts/p0/Main.sol
@@ -59,4 +59,12 @@ contract MainP0 is Versioned, Initializable, Auth, ComponentRegistry, IMain {
     function daoFeeRegistry() external pure returns (DAOFeeRegistry) {
         return DAOFeeRegistry(address(0));
     }
+
+    // === Control flow ===
+
+    // solhint-disable-next-line no-empty-blocks
+    function beginTx() external virtual {}
+
+    // solhint-disable-next-line no-empty-blocks
+    function endTx() external virtual {}
 }
diff --git a/contracts/p0/mixins/Component.sol b/contracts/p0/mixins/Component.sol
@@ -44,4 +44,13 @@ abstract contract ComponentP0 is Versioned, Initializable, ContextUpgradeable, I
         require(main.hasRole(OWNER, _msgSender()), "governance only");
         _;
     }
+
+    // === Control Flow ===
+    // In P0 we do not apply locks
+
+    modifier globalNonReentrant() {
+        main.beginTx();
+        _;
+        main.endTx();
+    }
 }
diff --git a/contracts/p1/BackingManager.sol b/contracts/p1/BackingManager.sol
@@ -66,7 +66,7 @@ contract BackingManagerP1 is TradingP1, IBackingManager {
     // checks: erc20 in assetRegistry
     // action: set allowance on erc20 for rToken to UINT_MAX
     // Using two safeApprove calls instead of safeIncreaseAllowance to support USDT
-    function grantRTokenAllowance(IERC20 erc20) external notFrozen {
+    function grantRTokenAllowance(IERC20 erc20) external notFrozen globalNonReentrant {
         require(assetRegistry.isRegistered(erc20), "erc20 unregistered");
         // == Interaction ==
         IERC20(address(erc20)).safeApprove(address(rToken), 0);
@@ -105,9 +105,7 @@ contract BackingManagerP1 is TradingP1, IBackingManager {
     /// Apply the overall backing policy using the specified TradeKind, taking a haircut if unable
     /// @param kind TradeKind.DUTCH_AUCTION or TradeKind.BATCH_AUCTION
     /// @custom:interaction not RCEI; nonReentrant
-    // untested:
-    //      OZ nonReentrant line is assumed to be working. cost/benefit of direct testing is high
-    function rebalance(TradeKind kind) external nonReentrant {
+    function rebalance(TradeKind kind) external globalNonReentrant {
         requireNotTradingPausedOrFrozen();
 
         // == Refresh ==
@@ -177,9 +175,7 @@ contract BackingManagerP1 is TradingP1, IBackingManager {
     /// Forward revenue to RevenueTraders; reverts if not fully collateralized
     /// @param erc20s The tokens to forward
     /// @custom:interaction not RCEI; nonReentrant
-    // untested:
-    //      OZ nonReentrant line is assumed to be working. cost/benefit of direct testing is high
-    function forwardRevenue(IERC20[] calldata erc20s) external nonReentrant {
+    function forwardRevenue(IERC20[] calldata erc20s) external globalNonReentrant {
         requireNotTradingPausedOrFrozen();
         require(ArrayLib.allUnique(erc20s), "duplicate tokens");
 

diff --git a/contracts/p1/Broker.sol b/contracts/p1/Broker.sol
@@ -4,6 +4,7 @@
 import "@openzeppelin/contracts-upgradeable/token/ERC20/utils/SafeERC20Upgradeable.sol";
 import "@openzeppelin/contracts/utils/structs/EnumerableSet.sol";
 import "@openzeppelin/contracts/proxy/Clones.sol";
+import "@reserve-protocol/trusted-fillers/contracts/interfaces/ITrustedFillerRegistry.sol";
 import "../interfaces/IBroker.sol";
 import "../interfaces/IMain.sol";
 import "../interfaces/ITrade.sol";
@@ -37,7 +38,7 @@

    /// @custom:oz-renamed-from gnosis
    // Deprecated in 4.0.0
    IGnosis public gnosis_DEPRECATED;

    /// @custom:oz-renamed-from auctionLength
    // {s} the length of a Gnosis EasyAuction. Governance parameter.
@@ -67,6 +68,11 @@
 
     IRToken private rToken;
 
+    // === 4.2.0 ===
+
+    ITrustedFillerRegistry public trustedFillerRegistry;
+    bool public trustedFillerEnabled;
+
     // ==== Invariant ====
     // (trades[addr] == true) iff this contract has created an ITrade clone at addr
 
@@ -172,6 +178,16 @@
 
     // === Setters ===
 
+    /// @dev _newFillerRegistry must be the already set registry if already set. This is to ensure
+    ///      correctness and in order to be explicit what registry is being enabled/disabled.
+    /// @custom:governance
+    function setTrustedFillerRegistry(address _newFillerRegistry, bool _enabled)
+        external
+        governance
+    {
+        _setTrustedFillerRegistry(_newFillerRegistry, _enabled);
+    }
+
     /// @custom:main
     function setBatchTradeImplementation(ITrade newTradeImplementation) public onlyMain {
         require(
@@ -289,10 +305,26 @@
         return asset.lastSave() == block.timestamp || address(asset.erc20()) == address(rToken);
     }
 
+    function _setTrustedFillerRegistry(address _newFillerRegistry, bool _enabled) internal {
+        if (address(trustedFillerRegistry) != _newFillerRegistry) {
+            require(
+                address(trustedFillerRegistry) == address(0),
+                "trusted filler registry already set"
+            );
+            trustedFillerRegistry = ITrustedFillerRegistry(_newFillerRegistry);
+        }
+
+        if (trustedFillerEnabled != _enabled) {
+            trustedFillerEnabled = _enabled;
+        }
+
+        emit TrustedFillerRegistrySet(address(trustedFillerRegistry), trustedFillerEnabled);
+    }
+
     /**
      * @dev This empty reserved space is put in place to allow future versions to add new
      * variables without shifting down storage in the inheritance chain.
      * See https://docs.openzeppelin.com/contracts/4.x/upgradeable#storage_gaps
      */
-    uint256[41] private __gap;
+    uint256[40] private __gap;
 }
diff --git a/contracts/p1/Deployer.sol b/contracts/p1/Deployer.sol
@@ -210,6 +210,7 @@ contract DeployerP1 is IDeployer, Versioned {
         // Init Furnace
         components.furnace.init(main, params.rewardRatio);
 
+        // Init Broker
         components.broker.init(
             main,
             _implementations.trading.gnosisTrade,
@@ -218,6 +219,14 @@ contract DeployerP1 is IDeployer, Versioned {
             params.dutchAuctionLength
         );
 
+        // Assign TrustedFillerRegistry
+        if (address(registries.trustedFillerRegistry) != address(0)) {
+            IExtendedBroker(address(components.broker)).setTrustedFillerRegistry(
+                address(registries.trustedFillerRegistry),
+                true
+            );
+        }
+
         // Init StRSR
         {
             string memory stRSRSymbol = string(abi.encodePacked(StringLib.toLower(symbol), "RSR"));

diff --git a/contracts/p1/Main.sol b/contracts/p1/Main.sol
@@ -6,6 +6,7 @@
 import "@openzeppelin/contracts-upgradeable/access/OwnableUpgradeable.sol";
 import "@openzeppelin/contracts/token/ERC20/IERC20.sol";
 import "../interfaces/IMain.sol";
+import "./mixins/GlobalReentrancyGuard.sol";
 import "../mixins/ComponentRegistry.sol";
 import "../mixins/Auth.sol";
 import "../mixins/Versioned.sol";
@@ -19,7 +20,15 @@
  * @notice The center of the system around which Components orbit.
  */
 // solhint-disable max-states-count
-contract MainP1 is Versioned, Initializable, Auth, ComponentRegistry, UUPSUpgradeable, IMain {
+contract MainP1 is
+    Versioned,
+    Initializable,
+    Auth,
+    ComponentRegistry,
+    UUPSUpgradeable,
+    GlobalReentrancyGuard,
+    IMain
+{
     IERC20 public rsr;
     VersionRegistry public versionRegistry;
     AssetPluginRegistry public assetPluginRegistry;
@@ -39,6 +48,7 @@
         require(address(rsr_) != address(0), "invalid RSR address");
         __Auth_init(shortFreeze_, longFreeze_);
         __ComponentRegistry_init(components);
+        __ReentrancyGuard_init();
         __UUPSUpgradeable_init();
 
         rsr = rsr_;
@@ -149,13 +159,23 @@
         );
     }
 
+    // === Control Flow ===
+
+    function beginTx() external virtual {
+        _nonReentrantBefore();
+    }
+
+    function endTx() external virtual {
+        _nonReentrantAfter();
+    }
+
     // === Upgradeability ===
     function _authorizeUpgrade(address) internal view override {
         require(msg.sender == address(this), "not self");
    }

    function _upgradeProxy(address proxy, address implementation) internal {
        (bool success, ) = proxy.call(
            abi.encodeWithSelector(UUPSUpgradeable.upgradeTo.selector, implementation)
        );


diff --git a/contracts/p1/RToken.sol b/contracts/p1/RToken.sol
@@ -102,7 +102,11 @@ contract RTokenP1 is ComponentP1, ERC20PermitUpgradeable, IRToken {
     /// @param amount {qRTok} The quantity of RToken to issue
     /// @custom:interaction RCEI
     // BU exchange rate cannot decrease, and it can only increase when < FIX_ONE.
-    function issueTo(address recipient, uint256 amount) public notIssuancePausedOrFrozen {
+    function issueTo(address recipient, uint256 amount)
+        public
+        notIssuancePausedOrFrozen
+        globalNonReentrant
+    {
         require(amount != 0, "Cannot issue zero");
 
         // == Refresh ==
@@ -180,7 +184,7 @@ contract RTokenP1 is ComponentP1, ERC20PermitUpgradeable, IRToken {
     /// @param recipient The address to receive the backing collateral tokens
     /// @param amount {qRTok} The quantity {qRToken} of RToken to redeem
     /// @custom:interaction RCEI
-    function redeemTo(address recipient, uint256 amount) public notFrozen {
+    function redeemTo(address recipient, uint256 amount) public notFrozen globalNonReentrant {
         // == Refresh ==
         assetRegistry.refresh();
 
@@ -258,7 +262,7 @@ contract RTokenP1 is ComponentP1, ERC20PermitUpgradeable, IRToken {
         uint192[] memory portions,
         address[] memory expectedERC20sOut,
         uint256[] memory minAmounts
-    ) external notFrozen {
+    ) external notFrozen globalNonReentrant {
         // == Refresh ==
         assetRegistry.refresh();
 
@@ -427,7 +431,7 @@ contract RTokenP1 is ComponentP1, ERC20PermitUpgradeable, IRToken {
 
     /// Sends all token balance of erc20 (if it is registered) to the BackingManager
     /// @custom:interaction
-    function monetizeDonations(IERC20 erc20) external notTradingPausedOrFrozen {
+    function monetizeDonations(IERC20 erc20) external notTradingPausedOrFrozen globalNonReentrant {
         require(assetRegistry.isRegistered(erc20), "erc20 unregistered");
         IERC20Upgradeable(address(erc20)).safeTransfer(
             address(backingManager),