aere-contracts/contracts/season1/AereRewardDistributor.sol

// SPDX-License-Identifier: MIT
pragma solidity 0.8.23;

import "@openzeppelin/contracts/access/Ownable.sol";
import "@openzeppelin/contracts/security/Pausable.sol";
import "@openzeppelin/contracts/security/ReentrancyGuard.sol";
import "@openzeppelin/contracts/utils/cryptography/MerkleProof.sol";
import "./interfaces/ISeason1.sol";

/**
 * @title AereRewardDistributor — AERE Season 1 "Altitude" reward claim (SECURITY-CRITICAL)
 * @notice Merkle-rooted claim of NATIVE AERE against a Foundation-published
 *         root, with cliff + linear vesting, pre-claim sybil EXCLUSION,
 *         post-expiry CLAWBACK, an optional locked-sAERE delivery path, and an
 *         emergency PAUSE.
 *
 *  ┌─────────────────────────── SAFETY POSTURE ───────────────────────────┐
 *  │ - This contract DEPLOYS UNFUNDED and holds 0 AERE. No Airdrop Reserve │
 *  │   funds move during the build. Only the founder signs the later       │
 *  │   funding transaction, and ONLY AFTER an external audit.              │
 *  │ - MUST BE EXTERNALLY AUDITED before it is funded. It will custody real│
 *  │   AERE once funded; treat every line as adversarial surface.          │
 *  │ - The owner (Foundation account, single-key EOA today, not a multisig) can pause, exclude sybils before    │
 *  │   claims begin, and claw back ONLY the UNCLAIMED remainder AFTER a     │
 *  │   long expiry. The owner CANNOT redirect a valid, vested claim away    │
 *  │   from its rightful account, and cannot shorten the claim window.     │
 *  └───────────────────────────────────────────────────────────────────────┘
 *
 *  Vesting: for an entitlement `total`, with start = rootPublishedAt,
 *    - t <  start + cliff                 -> 0
 *    - t >= start + duration              -> total
 *    - otherwise                          -> total * (t - start) / duration
 *  (cliff delays first unlock; at cliff a lump of total*cliff/duration is
 *   available, then it accrues linearly to full at start + duration.)
 *
 *  Delivery: liquid native AERE by default, OR (if deliverAsSAERE) the vested
 *  amount is wrapped to WAERE and deposited into the sAERE ERC-4626 vault with
 *  the shares minted straight to the claimant (a staked, drip-redeemable
 *  position instead of liquid AERE).
 *
 *  Leaf = keccak256(bytes.concat(keccak256(abi.encode(account, totalAmount)))),
 *  the OpenZeppelin StandardMerkleTree leaf encoding (second-preimage safe).
 *
 *  DISCLAIMER: Season 1 rewards are discretionary and depend on the network
 *  growing. Altitude Points are not a token and confer no right to value or
 *  returns. There is no listing. Nothing here is a promise of value.
 */
contract AereRewardDistributor is Ownable, Pausable, ReentrancyGuard {

    /* ------------------------------ immutable refs -------------------------- */

    /// @notice ERC-20 AERE (WAERE) used to feed the sAERE vault on the sAERE path.
    IWaereWrap      public immutable WAERE;
    /// @notice sAERE ERC-4626 vault (asset() must be WAERE).
    ISAEREVault public immutable SAERE;
    /// @notice Optional clawback destination (AereSink).
    address payable public immutable SINK;

    /* --------------------------------- campaign ----------------------------- */

    bytes32 public merkleRoot;
    uint64  public rootPublishedAt;   // vesting start; 0 == not published
    uint64  public cliffDuration;     // seconds after start before any unlock
    uint64  public vestingDuration;   // seconds after start to full unlock (>= cliff)
    uint64  public claimExpiry;       // absolute unix; after this, owner may clawback
    bool    public deliverAsSAERE;    // deliver locked sAERE instead of liquid AERE
    bool    public claimsStarted;     // once true, the root/params are frozen

    uint256 public totalClaimed;      // cumulative AERE (or AERE-equivalent) delivered
    mapping(address => uint256) public claimed;  // per-account cumulative delivered
    mapping(address => bool)    public excluded; // sybil revocation

    /* --------------------------------- events ------------------------------- */

    event Funded(address indexed from, uint256 amount);
    event RootPublished(
        bytes32 indexed merkleRoot,
        uint64 rootPublishedAt,
        uint64 cliffDuration,
        uint64 vestingDuration,
        uint64 claimExpiry,
        bool   deliverAsSAERE
    );
    event ExclusionSet(address indexed account, bool excluded);
    event Claimed(address indexed account, uint256 amount, uint256 cumulative, uint256 total, bool asSAERE);
    event ClaimExpiryExtended(uint64 newExpiry);
    event ClawedBack(address indexed to, uint256 amount);

    /* --------------------------------- errors ------------------------------- */

    error NotPublished();
    error RootFrozen();
    error ZeroRoot();
    error BadVesting();
    error BadExpiry();
    error IsExcluded();
    error BadProof();
    error NothingToClaim();
    error ClawbackTooEarly();
    error TransferFailed();
    error ApproveFailed();

    constructor(address waere, address sAERE, address payable sink) {
        require(waere != address(0) && sAERE != address(0) && sink != address(0), "zero-ref");
        // Sanity: sAERE must vault WAERE, else the sAERE path cannot work.
        require(ISAEREVault(sAERE).asset() == waere, "sAERE-asset-mismatch");
        WAERE = IWaereWrap(waere);
        SAERE = ISAEREVault(sAERE);
        SINK = sink;
        // Deploys UNFUNDED: no value accepted in the constructor; balance == 0.
    }

    /// @notice Accept native AERE funding. The founder sends the funding tx
    ///         LATER, after an external audit. Nothing here pulls reserve funds.
    receive() external payable {
        emit Funded(msg.sender, msg.value);
    }

    /* --------------------------------- admin -------------------------------- */

    /// @notice Publish (or, before the first claim, re-publish to correct) the
    ///         Merkle root and vesting/expiry parameters. Frozen once the first
    ///         claim lands.
    function publishRoot(
        bytes32 root,
        uint64 _cliffDuration,
        uint64 _vestingDuration,
        uint64 _claimExpiry,
        bool   _deliverAsSAERE
    ) external onlyOwner {
        if (claimsStarted) revert RootFrozen();
        if (root == bytes32(0)) revert ZeroRoot();
        if (_vestingDuration == 0 || _vestingDuration < _cliffDuration) revert BadVesting();
        // Expiry must outlast the vesting schedule so every claimant can claim.
        if (_claimExpiry <= block.timestamp + _vestingDuration) revert BadExpiry();

        merkleRoot = root;
        rootPublishedAt = uint64(block.timestamp);
        cliffDuration = _cliffDuration;
        vestingDuration = _vestingDuration;
        claimExpiry = _claimExpiry;
        deliverAsSAERE = _deliverAsSAERE;

        emit RootPublished(root, rootPublishedAt, _cliffDuration, _vestingDuration, _claimExpiry, _deliverAsSAERE);
    }

    /// @notice Exclude (or re-include) an address. Excluding blocks that
    ///         address from claiming; it can never move a claim to a third
    ///         party. Intended for sybil revocation, ideally before claims
    ///         begin, but permitted anytime as a safety valve.
    function setExcluded(address account, bool value) external onlyOwner {
        excluded[account] = value;
        emit ExclusionSet(account, value);
    }

    /// @notice Push the claim expiry LATER (never earlier). Lets the Foundation
    ///         extend the window; it can never shorten it to strand claimants.
    function extendClaimExpiry(uint64 newExpiry) external onlyOwner {
        if (newExpiry <= claimExpiry) revert BadExpiry();
        claimExpiry = newExpiry;
        emit ClaimExpiryExtended(newExpiry);
    }

    function pause() external onlyOwner { _pause(); }
    function unpause() external onlyOwner { _unpause(); }

    /* --------------------------------- claim -------------------------------- */

    /// @notice Claim the currently-vested, not-yet-claimed portion of `account`'s
    ///         entitlement. Anyone may submit (relayer/paymaster friendly); the
    ///         reward always goes to `account`, which is bound in the leaf.
    function claim(
        address account,
        uint256 totalAmount,
        bytes32[] calldata proof
    ) external nonReentrant whenNotPaused {
        if (merkleRoot == bytes32(0)) revert NotPublished();
        if (excluded[account]) revert IsExcluded();

        bytes32 leaf = keccak256(bytes.concat(keccak256(abi.encode(account, totalAmount))));
        if (!MerkleProof.verify(proof, merkleRoot, leaf)) revert BadProof();

        uint256 vested = _vested(totalAmount, block.timestamp);
        uint256 already = claimed[account];
        if (vested <= already) revert NothingToClaim();
        uint256 amount = vested - already;

        // Effects.
        claimed[account] = vested;
        totalClaimed += amount;
        if (!claimsStarted) claimsStarted = true;

        // Interaction / delivery.
        if (deliverAsSAERE) {
            _deliverSAERE(account, amount);
        } else {
            (bool ok, ) = payable(account).call{value: amount}("");
            if (!ok) revert TransferFailed();
        }

        emit Claimed(account, amount, vested, totalAmount, deliverAsSAERE);
    }

    /// @dev Wrap native AERE to WAERE and deposit into sAERE, minting shares
    ///      directly to the claimant.
    function _deliverSAERE(address account, uint256 amount) internal {
        WAERE.deposit{value: amount}();
        if (!WAERE.approve(address(SAERE), amount)) revert ApproveFailed();
        SAERE.deposit(amount, account);
    }

    /* ------------------------------- clawback ------------------------------- */

    /// @notice After the (long) claim expiry, recover the UNCLAIMED remainder.
    ///         Destination is the Foundation owner, or AereSink if `toSink`.
    ///         Recovers only whatever native AERE is left; it cannot touch a
    ///         claim that has already been delivered.
    function clawbackUnclaimed(bool toSink) external onlyOwner nonReentrant {
        if (claimExpiry == 0) revert NotPublished();
        if (block.timestamp <= claimExpiry) revert ClawbackTooEarly();
        uint256 bal = address(this).balance;
        address payable dest = toSink ? SINK : payable(owner());
        (bool ok, ) = dest.call{value: bal}("");
        if (!ok) revert TransferFailed();
        emit ClawedBack(dest, bal);
    }

    /* --------------------------------- views -------------------------------- */

    function _vested(uint256 total, uint256 atTime) internal view returns (uint256) {
        if (rootPublishedAt == 0) return 0;
        uint256 start = rootPublishedAt;
        if (atTime < start + cliffDuration) return 0;
        uint256 end = start + vestingDuration;
        if (atTime >= end) return total;
        return (total * (atTime - start)) / vestingDuration;
    }

    /// @notice Vested amount for a given entitlement at a given time.
    function vestedAmount(uint256 total, uint256 atTime) external view returns (uint256) {
        return _vested(total, atTime);
    }

    /// @notice Currently-claimable amount for `account` given their entitlement
    ///         `totalAmount` (caller supplies the total; not proof-checked here).
    function claimableNow(address account, uint256 totalAmount) external view returns (uint256) {
        if (excluded[account]) return 0;
        uint256 vested = _vested(totalAmount, block.timestamp);
        uint256 already = claimed[account];
        return vested > already ? vested - already : 0;
    }

    /// @notice Verify a leaf against the current root without state changes.
    function verifyEntry(address account, uint256 totalAmount, bytes32[] calldata proof)
        external
        view
        returns (bool)
    {
        if (merkleRoot == bytes32(0)) return false;
        bytes32 leaf = keccak256(bytes.concat(keccak256(abi.encode(account, totalAmount))));
        return MerkleProof.verify(proof, merkleRoot, leaf);
    }
}