Dev

.github/workflows/ci.yml

@@ -13,14 +13,12 @@ jobs:
 
     steps:
       - name: "Check out the repo"
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           submodules: recursive
 
       - name: "Install Pnpm"
         uses: pnpm/action-setup@v6
-        with:
-          version: "10"
 
       - name: "Setup Node.js"
         uses: actions/setup-node@v6
@@ -68,14 +66,12 @@ jobs:
 
     steps:
       - name: "Check out the repo"
-        uses: "actions/checkout@v6"
+        uses: "actions/checkout@v7"
         with:
           submodules: recursive
 
       - name: "Install Pnpm"
         uses: pnpm/action-setup@v6
-        with:
-          version: "10"
 
       - name: "Setup Node.js"
         uses: actions/setup-node@v6
@@ -109,14 +105,12 @@ jobs:
 
     steps:
       - name: "Check out the repo"
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           submodules: recursive
 
       - name: "Install Pnpm"
         uses: pnpm/action-setup@v6
-        with:
-          version: "10"
 
       - name: "Setup Node.js"
         uses: actions/setup-node@v6

contracts/LiquidityOrchestrator.sol

@@ -31,7 +31,7 @@
  *      - Handling slippage and market execution differences from adapter price estimates via liquidity buffer.
  * @custom:security-contact security@orionfinance.ai
  */
 contract LiquidityOrchestrator is
     Initializable,
     Ownable2StepUpgradeable,
     ReentrancyGuardTransient,
@@ -112,7 +112,7 @@
     uint256 public pendingProtocolFees;
 
     /// @notice Tokens that failed during the current epoch's sell/buy execution (cleared at epoch end)
-    address[] private _failedEpochTokens;
+    address[] internal _failedEpochTokens;
 
     /// @notice Cached assets hash from last full commitment build
     bytes32 private _cachedAssetsHash;
@@ -159,6 +159,9 @@
     /// @notice On-chain resume cursor for the active sell/buy minibatch window.
     uint16 public completedInCurrentMinibatch;
 
+    /// @notice Buffer snapshot at BuyingLeg entry (after bufferIncrease apply) [assets]
+    uint256 public buyingLegEntryBuffer;
+
     /* -------------------------------------------------------------------------- */
     /*                                MODIFIERS                                   */
     /* -------------------------------------------------------------------------- */
@@ -474,25 +477,23 @@
         } else if (currentPhase == LiquidityUpkeepPhase.SellingLeg) {
             StatesStruct memory states = _verifyPerformData(_publicValues, proofBytes, statesBytes);
 
-            if (currentMinibatchIndex == 0) {
-                bufferAmount = states.bufferAmount;
+            _processMinibatchSell(states.sellLeg);
+            if (currentPhase == LiquidityUpkeepPhase.BuyingLeg) {
+                bufferAmount += states.bufferIncrease;
                 _pendingEpochProtocolFees = states.epochProtocolFees;
+                buyingLegEntryBuffer = bufferAmount;
             }
-
-            _processMinibatchSell(states.sellLeg);
         } else if (currentPhase == LiquidityUpkeepPhase.BuyingLeg) {
             StatesStruct memory states = _verifyPerformData(_publicValues, proofBytes, statesBytes);
             _processMinibatchBuy(states.buyLeg);
         } else if (currentPhase == LiquidityUpkeepPhase.ProcessVaultOperations) {
             StatesStruct memory states = _verifyPerformData(_publicValues, proofBytes, statesBytes);
             _processMinibatchVaultsOperations(states.vaults);
 
-            if (currentMinibatchIndex == 0) {
-                // After the final minibatch, currentMinibatchIndex resets to 0, triggering epoch end
+            if (currentPhase == LiquidityUpkeepPhase.Idle) {
                 address[] memory failedTokens = _failedEpochTokens;
                 delete _failedEpochTokens;
                 config.completeAssetsRemoval(failedTokens);
-                // Emit epoch end and increment epoch counter.
                 emit EventsLib.EpochEnd(epochCounter, states.nettedRebalanceVolumeUnderlying);
                 ++epochCounter;
             }
@@ -524,6 +525,7 @@
 
         // Freeze deterministic proof-input anchor at epoch start.
         initialEpochBufferAmount = bufferAmount;
+        buyingLegEntryBuffer = 0;
 
         // Reset incremental commitment state for the new epoch
         _partialVaultsHash = bytes32(0);
@@ -562,7 +564,7 @@
     }
 
     /// @notice Folds the next batch of vault leaves into the running accumulator.
     function _processCommitmentMinibatch() internal {
         uint16 vaultCount = uint16(_currentEpoch.vaultsEpoch.length);
         uint256 maxFulfillBatchSize = config.maxFulfillBatchSize();
 
@@ -721,7 +723,7 @@
     /// @param estimatedUnderlyingAmounts Leg underlying estimates
     /// @param isSell True for sell leg, false for buy leg
     // slither-disable-next-line reentrancy-no-eth
     function _processMinibatchLeg(
         address[] memory tokens,
         uint256[] memory amounts,
         uint256[] memory estimatedUnderlyingAmounts,
@@ -736,7 +738,7 @@
         }
 
         uint16 start = i0 + completedInCurrentMinibatch;
         if (start >= i1) {
             completedInCurrentMinibatch = 0;
             ++currentMinibatchIndex;
             _finalizeMinibatchLeg(isSell, i1 == tokenCount);
@@ -779,7 +781,7 @@
     }
 
     /// @notice Records a failed minibatch leg and refreshes the epoch commitment without advancing the minibatch index
     function _handleMinibatchLegFailure(address token) internal {
         _failedEpochTokens.push(token);
         _currentEpoch.epochStateCommitment = keccak256(
             abi.encode(_buildProtocolStateHash(), _cachedAssetsHash, _cachedVaultsHash)
@@ -788,7 +790,7 @@
     }
 
     /// @notice Applies phase transitions after a minibatch window completes successfully
     function _finalizeMinibatchLeg(bool isSell, bool legFinished) internal {
         if (!legFinished) {
             return;
         }
@@ -1006,5 +1008,5 @@
     }
 
     /// @dev Storage gap to allow for future upgrades
-    uint256[46] private __gap;
+    uint256[45] private __gap;
 }

contracts/OrionConfig.sol

@@ -30,7 +30,7 @@
  * @author Orion Finance
  * @custom:security-contact security@orionfinance.ai
  */
 contract OrionConfig is Initializable, Ownable2StepUpgradeable, UUPSUpgradeable, IOrionConfig {
     using EnumerableSet for EnumerableSet.AddressSet;
 
     /// @notice Guardian address for emergency pausing
@@ -534,11 +534,6 @@
             ILiquidityOrchestrator.LiquidityUpkeepPhase.Idle;
     }
 
-    /// @inheritdoc IOrionConfig
-    function getTokenDecimals(address token) external view returns (uint8) {
-        return tokenDecimals[token];
-    }
-
     /// @notice Sets the upgrade timelock address.
     /// @dev If no timelock is set yet, only the owner may call this. Once a timelock is active,
     ///      only the timelock itself may replace it, preventing the owner from bypassing the delay.

contracts/access_controllers/WhitelistAccessControl.sol

@@ -27,7 +27,7 @@ contract WhitelistAccessControl is IOrionAccessControl, Ownable2Step {
     constructor(address initialOwner_) Ownable(initialOwner_) {}
 
     /// @inheritdoc IOrionAccessControl
-    function canRequestDeposit(address sender) external view override returns (bool) {
+    function canRequestDeposit(address sender, bytes calldata) external view override returns (bool) {
         return whitelist[sender];
     }
 

contracts/execution/ERC4626ExecutionAdapter.sol

@@ -59,7 +59,7 @@ contract ERC4626ExecutionAdapter is IExecutionAdapter {
         try IERC4626(asset).asset() returns (address vaultUnderlying) {
             // 2. Verify registered vault decimals match config decimals
             try IERC20Metadata(asset).decimals() returns (uint8 vaultDecimals) {
-                if (vaultDecimals != CONFIG.getTokenDecimals(asset)) {
+                if (vaultDecimals != CONFIG.tokenDecimals(asset)) {
                     revert ErrorsLib.InvalidAdapter(asset);
                 }
             } catch {
@@ -69,7 +69,7 @@ contract ERC4626ExecutionAdapter is IExecutionAdapter {
             // 3. Verify underlying vault decimals match config decimals
             // (vault underlying must be whitelisted in config)
             try IERC20Metadata(vaultUnderlying).decimals() returns (uint8 vaultUnderlyingDecimals) {
-                if (vaultUnderlyingDecimals != CONFIG.getTokenDecimals(vaultUnderlying)) {
+                if (vaultUnderlyingDecimals != CONFIG.tokenDecimals(vaultUnderlying)) {
                     revert ErrorsLib.InvalidAdapter(asset);
                 }
             } catch {

contracts/interfaces/ILiquidityOrchestrator.sol

@@ -29,7 +29,7 @@ interface ILiquidityOrchestrator {
         VaultState[] vaults;
         SellLegOrders sellLeg;
         BuyLegOrders buyLeg;
-        uint256 bufferAmount;
+        uint256 bufferIncrease;
         uint256 epochProtocolFees;
         uint256 nettedRebalanceVolumeUnderlying;
     }
@@ -81,6 +81,10 @@ interface ILiquidityOrchestrator {
     /// @return The initial epoch buffer amount
     function initialEpochBufferAmount() external view returns (uint256);
 
+    /// @notice Returns the BuyingLeg-entry buffer snapshot (after sell→buy bufferIncrease apply)
+    /// @return The BuyingLeg entry buffer amount
+    function buyingLegEntryBuffer() external view returns (uint256);
+
     /// @notice Returns the pending protocol fees
     /// @return The pending protocol fees
     function pendingProtocolFees() external view returns (uint256);

contracts/interfaces/IOrionAccessControl.sol

@@ -10,9 +10,10 @@ pragma solidity ^0.8.34;
  */
 interface IOrionAccessControl {
     /**
-     * @notice Check if an address is allowed to request deposits to the vault
-     * @param sender Address attempting to deposit
-     * @return True if sender is allowed to deposit, false otherwise
+     * @notice Check if a deposit request is allowed
+     * @param sender The address of the sender of the deposit request
+     * @param data The data of the deposit request
+     * @return True if the deposit request is allowed, false otherwise
      */
-    function canRequestDeposit(address sender) external view returns (bool);
+    function canRequestDeposit(address sender, bytes calldata data) external view returns (bool);
 }

contracts/interfaces/IOrionConfig.sol

@@ -189,11 +189,10 @@ interface IOrionConfig {
     /// @return True if the system is idle, false otherwise
     function isSystemIdle() external view returns (bool);
 
-    /// @notice Returns the number of decimals for a given token
-    /// @dev This function returns the stored decimals for whitelisted tokens
-    /// @param token The address of the token
+    /// @notice Returns the stored decimals for a whitelisted token
+    /// @param token The token address
     /// @return The number of decimals for the token
-    function getTokenDecimals(address token) external view returns (uint8);
+    function tokenDecimals(address token) external view returns (uint8);
 
     /// @notice Returns the minimum deposit amount
     /// @return The minimum deposit amount in underlying asset units

contracts/price/ERC4626PriceAdapter.sol

@@ -64,7 +64,7 @@ contract ERC4626PriceAdapter is IPriceAdapter {
         uint256 totalSupply = vault.totalSupply();
 
         if (totalSupply == 0) {
-            return (0, PRICE_DECIMALS + CONFIG.getTokenDecimals(vaultUnderlying));
+            return (0, PRICE_DECIMALS + CONFIG.tokenDecimals(vaultUnderlying));
         }
 
         uint8 effectiveShareDecimals = _effectiveShareDecimals(totalAssets, totalSupply, vaultAssetDecimals);
@@ -81,7 +81,7 @@ contract ERC4626PriceAdapter is IPriceAdapter {
             10 ** CONFIG.priceAdapterDecimals()
         );
 
-        return (vaultPrice, PRICE_DECIMALS + CONFIG.getTokenDecimals(vaultUnderlying));
+        return (vaultPrice, PRICE_DECIMALS + CONFIG.tokenDecimals(vaultUnderlying));
     }
 
     /// @notice Resolves share scale for pricing when reported vault decimals understate per-share value.

contracts/test/LiquidityOrchestratorHarness.sol

@@ -2,6 +2,7 @@
 pragma solidity ^0.8.34;
 
 import { LiquidityOrchestrator } from "../LiquidityOrchestrator.sol";
+import { EventsLib } from "../libraries/EventsLib.sol";
 
 /**
  * @title LiquidityOrchestratorHarness
@@ -39,4 +40,78 @@ contract LiquidityOrchestratorHarness is LiquidityOrchestrator {
             shares
         );
     }
+
+    /// @notice Test-only: set upkeep phase
+    function h_setPhase(LiquidityUpkeepPhase phase) external {
+        currentPhase = phase;
+    }
+
+    /// @notice Test-only: set PVO/sell/buy minibatch index
+    function h_setCurrentMinibatchIndex(uint8 index) external {
+        currentMinibatchIndex = index;
+    }
+
+    /// @notice Test-only: set fulfill minibatch size (bypasses idle/owner checks)
+    function h_setMinibatchSize(uint8 size) external {
+        minibatchSize = size;
+    }
+
+    /// @notice Test-only: replace vaultsEpoch for the current epoch
+    function h_setVaultsEpoch(address[] calldata vaults) external {
+        delete _currentEpoch.vaultsEpoch;
+        for (uint256 i = 0; i < vaults.length; ++i) {
+            _currentEpoch.vaultsEpoch.push(vaults[i]);
+        }
+    }
+
+    /// @notice Test-only: run PVO minibatch + epoch-end gate (mirrors performUpkeep PVO branch, no ZK verify)
+    /// @param vaults Vault states aligned with vaultsEpoch indices
+    /// @param nettedRebalanceVolumeUnderlying Passed through to EpochEnd when completing
+    function h_processPvoMinibatchWithEpochEnd(
+        VaultState[] memory vaults,
+        uint256 nettedRebalanceVolumeUnderlying
+    ) external {
+        _processMinibatchVaultsOperations(vaults);
+        _maybeEpochEndAfterPvo(nettedRebalanceVolumeUnderlying);
+    }
+
+    /**
+     * @notice Test-only: advance PVO minibatch index using the same completion predicate as
+     *         `_processMinibatchVaultsOperations`, without vault I/O (avoids gas caps for wrap tests).
+     * @dev Mirrors: i0/i1 from currentMinibatchIndex*minibatchSize, ++index (uint8 wrap), Idle iff
+     *      i1 >= vaultsEpochLength. Then applies the Idle epoch-end gate.
+     * @param vaultsEpochLength Simulated `_currentEpoch.vaultsEpoch.length`
+     * @param nettedRebalanceVolumeUnderlying Passed through to EpochEnd when completing
+     */
+    function h_advancePvoIndexLikeProcessMinibatch(
+        uint256 vaultsEpochLength,
+        uint256 nettedRebalanceVolumeUnderlying
+    ) external {
+        uint16 i0 = uint16(currentMinibatchIndex) * uint16(minibatchSize);
+        uint16 i1 = i0 + uint16(minibatchSize);
+        // Production uses checked ++ (panic at 255); wrap this in unchecked so the test can
+        // assert the Idle gate ignores a uint8 wrap mid-PVO (the old `index == 0` footgun).
+        unchecked {
+            ++currentMinibatchIndex;
+        }
+
+        if (i1 > vaultsEpochLength || i1 == vaultsEpochLength) {
+            currentPhase = LiquidityUpkeepPhase.Idle;
+            currentMinibatchIndex = 0;
+            completedInCurrentMinibatch = 0;
+            // Skip _nextUpdateTime (private); not required for epoch-end gate assertions
+        }
+
+        _maybeEpochEndAfterPvo(nettedRebalanceVolumeUnderlying);
+    }
+
+    function _maybeEpochEndAfterPvo(uint256 nettedRebalanceVolumeUnderlying) private {
+        if (currentPhase == LiquidityUpkeepPhase.Idle) {
+            address[] memory failedTokens = _failedEpochTokens;
+            delete _failedEpochTokens;
+            config.completeAssetsRemoval(failedTokens);
+            emit EventsLib.EpochEnd(epochCounter, nettedRebalanceVolumeUnderlying);
+            ++epochCounter;
+        }
+    }
 }

contracts/test/MockERC4626PriceAdapter.sol

@@ -98,7 +98,7 @@ contract MockERC4626PriceAdapter is IPriceAdapter {
 
         // 3. Verify vault decimals are registered in config
         try IERC20Metadata(asset).decimals() returns (uint8 decimals) {
-            if (decimals != config.getTokenDecimals(asset)) {
+            if (decimals != config.tokenDecimals(asset)) {
                 revert ErrorsLib.InvalidAdapter(asset);
             }
         } catch {

contracts/test/MockOrionConfig.sol

@@ -13,10 +13,8 @@ contract MockOrionConfig {
     address public liquidityOrchestrator;
     address public priceAdapterRegistryAddress;
     uint256 public slippageTolerance = 200; // 2% in basis points
-    mapping(address => uint8) private tokenDecimals;
+    mapping(address => uint8) public tokenDecimals;
     mapping(address => bool) private whitelisted;
-    /// @dev When true, return 0 for unset tokens (simulates real OrionConfig where unwhitelisted tokens have no entry)
-    bool public returnZeroForUnsetTokens;
     /// @dev Mirrors OrionConfig `isSystemIdle` for adapter tests; default true (idle).
     bool public systemIdle = true;
 
@@ -42,12 +40,6 @@ contract MockOrionConfig {
         return 14; // Protocol standard for price adapter decimals
     }
 
-    function getTokenDecimals(address token) external view returns (uint8) {
-        uint8 decimals = tokenDecimals[token];
-        if (returnZeroForUnsetTokens && decimals == 0) return 0;
-        return decimals == 0 ? 18 : decimals; // Default to 18 if not set
-    }
-
     // Mock helpers for testing
     function setSlippageTolerance(uint256 _tolerance) external {
         slippageTolerance = _tolerance;
@@ -73,10 +65,6 @@ contract MockOrionConfig {
         whitelisted[asset] = _whitelisted;
     }
 
-    function setReturnZeroForUnsetTokens(bool _returnZero) external {
-        returnZeroForUnsetTokens = _returnZero;
-    }
-
     function setGuardian(address _guardian) external {
         guardian = _guardian;
     }

contracts/vaults/OrionVault.sol

@@ -227,7 +227,7 @@
         if (!config.isSystemIdle()) return 0;
         if (isDecommissioning || config.isDecommissionedVault(address(this))) return 0;
         if (depositAccessControl != address(0)) {
-            if (!IOrionAccessControl(depositAccessControl).canRequestDeposit(receiver)) return 0;
+            if (!IOrionAccessControl(depositAccessControl).canRequestDeposit(receiver, "")) return 0;
         }
         return type(uint256).max;
     }
@@ -316,7 +316,7 @@
     /// @inheritdoc IOrionVault
     function requestDeposit(uint256 assets) external nonReentrant {
         if (depositAccessControl != address(0)) {
-            if (!IOrionAccessControl(depositAccessControl).canRequestDeposit(msg.sender))
+            if (!IOrionAccessControl(depositAccessControl).canRequestDeposit(msg.sender, msg.data))
                 revert ErrorsLib.DepositNotAllowed();
         }
 
@@ -437,7 +437,7 @@
             if (supported) {
                 IOrionStrategist(strategist_).setVault(address(this));
             }
         } catch {}
     }
 
     /// @inheritdoc IOrionVault