untrusted filler

[tbrent]

Summary by CodeRabbit

Summary

• Bug Fixes

  • Improved trusted-fill state tracking and balance accounting using cached active trusted-fill details.
  • Refined trusted-fill closure logic to better compute outcomes and support disabling/removal decisions based on floor price thresholds.
  • Enhanced circuit-breaker behavior when trusted filler view calls fail, including safer emergency-closure handling.

• Tests

  • Added a dishonest trusted-filler mock and expanded coverage for circuit breaker and emergency close scenarios, including expected poke() state transitions.

Limitations of this approach

1. stateChangeActive() returns true in more cases. Easier to DoS systems built on top, but not substantially so.
2. Gas griefing possible for activeTrustedFill.emergencyCloseFiller() call. Gas griefing also possible within CowSwapFiller though for the ERC20 transfers, so seems like this doesn't substantially change things either.

[coderabbitai]

Caution

Review failed

An error occurred during the review process. Please try again later.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch draft-untrusted-filler

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Warning

Review limit reached

@tbrent, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 56 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 154b6ddd-426a-4f24-8c7c-2163677a3c85

📥 Commits

Reviewing files that changed from the base of the PR and between 9f1c005 and f926d1c.

📒 Files selected for processing (2)

• contracts/Folio.sol
• test/Folio.t.sol

📝 Walkthrough

Walkthrough

Adds cached trusted-fill metadata, uses it during close and balance handling, and extends closeTrustedFill to return a registry-disable signal based on realized price versus floor price. New tests cover dishonest filler behavior and emergency close flows.

Changes

Trusted-fill circuit breaker with cached metadata

Layer / File(s)	Summary
Cached trusted-fill metadata contracts/interfaces/IFolio.sol, contracts/Folio.sol	Defines ActiveTrustedFillInfo in the interface and adds the Folio storage slot for cached trusted-fill state.
Populate and read cached fill state contracts/Folio.sol	createTrustedFill stores sell/buy tokens, sell amount, and floor price in the cache; stateChangeActive now checks only whether a trusted fill exists; _balanceOfToken uses cached token addresses.
Trusted-fill close accounting contracts/utils/RebalancingLib.sol	closeTrustedFill now accepts cached metadata, computes sold from the cached sell amount, and returns a second flag when realized price falls below the cached floor price.
Folio close handling contracts/Folio.sol	_closeTrustedFill passes cached metadata into the library, handles both returned flags, suppresses emergency-close errors with try/catch, and clears both trusted-fill state variables.
Dishonest filler mock and trusted-fill tests test/utils/MockDishonestTrustedFiller.sol, test/Folio.t.sol	Adds a mock that can revert on view access or emergency close, plus tests for circuit-breaker behavior, stateChangeActive clearing, and emergency-close outcomes.

Estimated code review effort: 4 (Complex) | ~45 minutes

Possibly related PRs

• reserve-protocol/reserve-index-dtf#178: Updates the same trusted-fill close flow and floor-price behavior in RebalancingLib.sol and Folio.sol.
• reserve-protocol/reserve-index-dtf#185: Touches the trusted-fill cache/close path and the closeTrustedFill return shape in the same area of code.

Suggested reviewers: akshatmittal

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Title check	❓ Inconclusive	The title is related to the new trusted-filler work, but it is too vague to clearly describe the main change.	Use a more specific title such as 'Add untrusted trusted-filler circuit breaker' or 'Cache trusted-fill state for closure checks'.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch draft-untrusted-filler

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@contracts/Folio.sol`:
- Around line 1174-1181: The cleanup code in the catch block following
emergencyCloseFiller() deletes the activeTrustedFill and activeTrustedFillInfo
without first revoking the sell-token allowance that was granted to the filler
at line 841. If emergencyCloseFiller() reverts, the filler retains approval to
transfer tokens from Folio even though the fill is no longer tracked, creating a
security vulnerability. Before deleting activeTrustedFill and
activeTrustedFillInfo, add code to revoke the sell-token allowance granted to
the filler address by setting the approval to zero, ensuring the filler cannot
execute transfers after the fill record is deleted.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: a0527e16-8155-4f7c-beae-38a85d07182d

📥 Commits

Reviewing files that changed from the base of the PR and between f25f3a3 and f6e5963.

📒 Files selected for processing (5)

• contracts/Folio.sol
• contracts/interfaces/IFolio.sol
• contracts/utils/RebalancingLib.sol
• test/Folio.t.sol
• test/utils/MockDishonestTrustedFiller.sol