Moose review (#1948)

* better cap fees

* add more constraints for user token accounts

* use oracle map for updating aum

* cargo tests pass and adding oracle map usage to derivative constituent in aum target as well

Author: moosecat2

programs/drift/src/instructions/lp_admin.rs

@@ -1079,7 +1079,6 @@ pub struct InitializeLpPool<'info> {
     spot_market_index: u16,
 )]
 pub struct InitializeConstituent<'info> {
-    #[account()]
     pub state: Box<Account<'info, State>>,
     #[account(
         mut,

programs/drift/src/instructions/lp_pool.rs

@@ -3,7 +3,6 @@ use anchor_spl::token_interface::{Mint, TokenAccount, TokenInterface};
 
 use crate::ids::lp_pool_swap_wallet;
 use crate::math::constants::PRICE_PRECISION_I64;
-use crate::math::oracle::OracleValidity;
 use crate::state::events::{DepositDirection, LPBorrowLendDepositRecord};
 use crate::state::paused_operations::ConstituentLpOperation;
 use crate::validation::whitelist::validate_whitelist_token;
@@ -32,7 +31,6 @@ use crate::{
             update_constituent_target_base_for_derivatives, AmmConstituentDatum,
             AmmConstituentMappingFixed, Constituent, ConstituentCorrelationsFixed,
             ConstituentTargetBaseFixed, LPPool, TargetsDatum, LP_POOL_SWAP_AUM_UPDATE_DELAY,
-            MAX_ORACLE_STALENESS_FOR_TARGET_CALC, MAX_STALENESS_FOR_TARGET_CALC,
         },
         oracle_map::OracleMap,
         perp_market_map::MarketSet,
@@ -45,7 +43,6 @@ use crate::{
     },
     validate,
 };
-use std::convert::TryFrom;
 use std::iter::Peekable;
 use std::slice::Iter;
 
@@ -164,7 +161,7 @@ pub fn handle_update_lp_pool_aum<'c: 'info, 'info>(
     let AccountMaps {
         perp_market_map: _,
         spot_market_map,
-        oracle_map: _,
+        mut oracle_map,
     } = load_maps(
         remaining_accounts,
         &MarketSet::new(),
@@ -202,6 +199,7 @@ pub fn handle_update_lp_pool_aum<'c: 'info, 'info>(
         slot,
         &constituent_map,
         &spot_market_map,
+        &mut oracle_map,
         &constituent_target_base,
         &amm_cache,
     )?;
@@ -227,6 +225,7 @@ pub fn handle_update_lp_pool_aum<'c: 'info, 'info>(
         &derivative_groups,
         &constituent_map,
         &spot_market_map,
+        &mut oracle_map,
         &mut constituent_target_base,
     )?;
 
@@ -1316,8 +1315,6 @@ pub fn handle_view_lp_pool_remove_liquidity_fees<'c: 'info, 'info>(
     )?;
     let out_oracle = out_oracle.clone();
 
-    // TODO: check self.aum validity
-
     if !is_oracle_valid_for_action(out_oracle_validity, Some(DriftAction::LpPoolSwap))? {
         msg!(
             "Out oracle data for spot market {} is invalid for lp pool swap.",
@@ -1330,7 +1327,7 @@ pub fn handle_view_lp_pool_remove_liquidity_fees<'c: 'info, 'info>(
         out_constituent.constituent_index,
         &out_spot_market,
         out_oracle.price,
-        lp_pool.last_aum, // TODO: remove out_amount * out_oracle to est post remove_liquidity aum
+        lp_pool.last_aum,
     )?;
 
     let dlp_total_supply = ctx.accounts.lp_mint.supply;
@@ -1410,7 +1407,6 @@ pub fn handle_deposit_to_program_vault<'c: 'info, 'info>(
     let deposit_plus_token_amount_before = amount.safe_add(spot_market_vault.amount)?;
 
     let oracle_data = oracle_map.get_price_data(&oracle_id)?;
-    let oracle_data_slot = clock.slot - oracle_data.delay.max(0i64).cast::<u64>()?;
 
     controller::spot_balance::update_spot_market_cumulative_interest(
         &mut spot_market,
@@ -1425,10 +1421,6 @@ pub fn handle_deposit_to_program_vault<'c: 'info, 'info>(
         .cast::<i64>()?
         .safe_sub(constituent.last_spot_balance_token_amount)?;
 
-    if constituent.last_oracle_slot < oracle_data_slot {
-        constituent.last_oracle_price = oracle_data.price;
-        constituent.last_oracle_slot = oracle_data_slot;
-    }
     constituent.sync_token_balance(ctx.accounts.constituent_token_account.amount);
     let balance_before = constituent.get_full_token_amount(&spot_market)?;
 
@@ -1559,11 +1551,6 @@ pub fn handle_withdraw_from_program_vault<'c: 'info, 'info>(
         .cast::<i64>()?
         .safe_sub(constituent.last_spot_balance_token_amount)?;
 
-    if constituent.last_oracle_slot < oracle_data_slot {
-        constituent.last_oracle_price = oracle_data.price;
-        constituent.last_oracle_slot = oracle_data_slot;
-    }
-
     let mint = &Some(*ctx.accounts.mint.clone());
     transfer_from_program_vault(
         amount,
@@ -1865,12 +1852,12 @@ pub struct LPPoolSwap<'info> {
 
     #[account(
         mut,
-        constraint = user_in_token_account.mint.eq(&constituent_in_token_account.mint)
+        constraint = user_in_token_account.mint.eq(&constituent_in_token_account.mint) && user_in_token_account.owner == authority.key()
     )]
     pub user_in_token_account: Box<InterfaceAccount<'info, TokenAccount>>,
     #[account(
         mut,
-        constraint = user_out_token_account.mint.eq(&constituent_out_token_account.mint)
+        constraint = user_out_token_account.mint.eq(&constituent_out_token_account.mint) && user_out_token_account.owner == authority.key()
     )]
     pub user_out_token_account: Box<InterfaceAccount<'info, TokenAccount>>,
 
@@ -1900,7 +1887,6 @@ pub struct LPPoolSwap<'info> {
 
     pub authority: Signer<'info>,
 
-    // TODO: in/out token program
     pub token_program: Interface<'info, TokenInterface>,
 }
 
@@ -1974,7 +1960,7 @@ pub struct LPPoolAddLiquidity<'info> {
 
     #[account(
         mut,
-        constraint = user_in_token_account.mint.eq(&constituent_in_token_account.mint)
+        constraint = user_in_token_account.mint.eq(&constituent_in_token_account.mint) && user_in_token_account.owner == authority.key()
     )]
     pub user_in_token_account: Box<InterfaceAccount<'info, TokenAccount>>,
 
@@ -2058,7 +2044,7 @@ pub struct LPPoolRemoveLiquidity<'info> {
 
     #[account(
         mut,
-        constraint = user_out_token_account.mint.eq(&constituent_out_token_account.mint)
+        constraint = user_out_token_account.mint.eq(&constituent_out_token_account.mint) && user_out_token_account.owner == authority.key()
     )]
     pub user_out_token_account: Box<InterfaceAccount<'info, TokenAccount>>,
     #[account(

programs/drift/src/state/lp_pool.rs

@@ -1,18 +1,22 @@
 use std::collections::BTreeMap;
+use std::f32::consts::E;
 
 use crate::error::{DriftResult, ErrorCode};
 use crate::math::casting::Cast;
 use crate::math::constants::{
     BASE_PRECISION_I128, PERCENTAGE_PRECISION, PERCENTAGE_PRECISION_I128, PERCENTAGE_PRECISION_I64,
     PERCENTAGE_PRECISION_U64, PRICE_PRECISION, QUOTE_PRECISION_I128, QUOTE_PRECISION_U64,
 };
+use crate::math::oracle::{is_oracle_valid_for_action, DriftAction};
 use crate::math::safe_math::SafeMath;
 use crate::math::safe_unwrap::SafeUnwrap;
 use crate::math::spot_balance::{get_signed_token_amount, get_token_amount};
 use crate::state::amm_cache::{AmmCacheFixed, CacheInfo};
 use crate::state::constituent_map::ConstituentMap;
+use crate::state::oracle_map::OracleMap;
 use crate::state::paused_operations::ConstituentLpOperation;
 use crate::state::spot_market_map::SpotMarketMap;
+use crate::state::user::MarketType;
 use anchor_lang::prelude::*;
 use borsh::{BorshDeserialize, BorshSerialize};
 use enumflags2::BitFlags;
@@ -32,9 +36,8 @@ pub const CONSTITUENT_CORRELATIONS_PDA_SEED: &str = "constituent_correlations";
 pub const CONSTITUENT_VAULT_PDA_SEED: &str = "CONSTITUENT_VAULT";
 pub const LP_POOL_TOKEN_VAULT_PDA_SEED: &str = "LP_POOL_TOKEN_VAULT";
 
-pub const BASE_SWAP_FEE: i128 = 300; // 0.75% in PERCENTAGE_PRECISION
-pub const MAX_SWAP_FEE: i128 = 75_000; // 0.75% in PERCENTAGE_PRECISION
-pub const MIN_SWAP_FEE: i128 = 200; // 0.75% in PERCENTAGE_PRECISION
+pub const BASE_SWAP_FEE: i128 = 300; // 0.3% in PERCENTAGE_PRECISION
+pub const MAX_SWAP_FEE: i128 = 37_500; // 37.5% in PERCENTAGE_PRECISION
 
 pub const MIN_AUM_EXECUTION_FEE: u128 = 10_000_000_000_000;
 
@@ -225,6 +228,9 @@ impl LPPool {
             out_target_oracle_slot_delay,
         )?;
 
+        in_fee = in_fee.min(MAX_SWAP_FEE);
+        out_fee = out_fee.min(MAX_SWAP_FEE);
+
         let in_fee_amount = in_amount
             .cast::<i128>()?
             .safe_mul(in_fee)?
@@ -279,6 +285,7 @@ impl LPPool {
             in_target_position_slot_delay,
             in_target_oracle_slot_delay,
         )?;
+        in_fee_pct = in_fee_pct.min(MAX_SWAP_FEE * 2);
 
         let in_fee_amount = in_amount
             .cast::<i128>()?
@@ -383,6 +390,8 @@ impl LPPool {
             out_target_oracle_slot_delay,
         )?;
         out_fee_pct = in_fee_pct.safe_add(out_fee_pct)?;
+        out_fee_pct = out_fee_pct.min(MAX_SWAP_FEE * 2);
+
         let out_fee_amount = out_amount
             .cast::<i128>()?
             .safe_mul(out_fee_pct)?
@@ -629,10 +638,7 @@ impl LPPool {
             .safe_add(out_quadratic_inventory_fee)?
             .safe_add(BASE_SWAP_FEE.safe_div(2)?)?;
 
-        Ok((
-            total_in_fee.min(MAX_SWAP_FEE.safe_div(2)?),
-            total_out_fee.min(MAX_SWAP_FEE.safe_div(2)?),
-        ))
+        Ok((total_in_fee, total_out_fee))
     }
 
     pub fn get_target_uncertainty_fees(
@@ -686,6 +692,7 @@ impl LPPool {
         slot: u64,
         constituent_map: &ConstituentMap,
         spot_market_map: &SpotMarketMap,
+        oracle_map: &mut OracleMap,
         constituent_target_base: &AccountZeroCopyMut<'_, TargetsDatum, ConstituentTargetBaseFixed>,
         amm_cache: &AccountZeroCopyMut<'_, CacheInfo, AmmCacheFixed>,
     ) -> DriftResult<(u128, i128, BTreeMap<u16, Vec<u16>>)> {
@@ -723,10 +730,28 @@ impl LPPool {
             }
 
             let spot_market = spot_market_map.get_ref(&constituent.spot_market_index)?;
+            let oracle_and_validity = oracle_map.get_price_data_and_validity(
+                MarketType::Spot,
+                constituent.spot_market_index,
+                &spot_market.oracle_id(),
+                spot_market.historical_oracle_data.last_oracle_price_twap,
+                spot_market.get_max_confidence_interval_multiplier()?,
+                0,
+            )?;
+            if !is_oracle_valid_for_action(
+                oracle_and_validity.1,
+                Some(DriftAction::UpdateLpPoolAum),
+            )? {
+                msg!(
+                    "Constituent {} oracle is not valid for action",
+                    constituent.constituent_index
+                );
+                return Err(ErrorCode::InvalidOracle.into());
+            }
 
             let constituent_aum = constituent
                 .get_full_token_amount(&spot_market)?
-                .safe_mul(constituent.last_oracle_price as i128)?
+                .safe_mul(oracle_and_validity.0.price as i128)?
                 .safe_div(10_i128.pow(spot_market.decimals))?;
             msg!(
                 "constituent: {}, balance: {}, aum: {}, deriv index: {}, bl token balance {}, bl balance type {}, vault balance: {}",
@@ -747,7 +772,7 @@ impl LPPool {
                     .get(constituent.constituent_index as u32)
                     .target_base
                     .cast::<i128>()?
-                    .safe_mul(constituent.last_oracle_price.cast::<i128>()?)?
+                    .safe_mul(oracle_and_validity.0.price.cast::<i128>()?)?
                     .safe_div(10_i128.pow(constituent.decimals as u32))?
                     .cast::<i64>()?;
                 crypto_delta = crypto_delta.safe_add(constituent_target_notional.cast()?)?;
@@ -1579,8 +1604,8 @@ impl ConstituentCorrelations {
             "ConstituentCorrelation correlations must be between 0 and PERCENTAGE_PRECISION"
         )?;
 
-        self.correlations[(i as usize * num_constituents + j as usize)] = corr;
-        self.correlations[(j as usize * num_constituents + i as usize)] = corr;
+        self.correlations[i as usize * num_constituents + j as usize] = corr;
+        self.correlations[j as usize * num_constituents + i as usize] = corr;
 
         self.validate()?;
 
@@ -1662,34 +1687,81 @@ pub fn update_constituent_target_base_for_derivatives(
     derivative_groups: &BTreeMap<u16, Vec<u16>>,
     constituent_map: &ConstituentMap,
     spot_market_map: &SpotMarketMap,
+    oracle_map: &mut OracleMap,
     constituent_target_base: &mut AccountZeroCopyMut<'_, TargetsDatum, ConstituentTargetBaseFixed>,
 ) -> DriftResult<()> {
     for (parent_index, constituent_indexes) in derivative_groups.iter() {
         let parent_constituent = constituent_map.get_ref(parent_index)?;
+
+        let parent_spot_market = spot_market_map.get_ref(&parent_constituent.spot_market_index)?;
+        let parent_oracle_price_and_validity = oracle_map.get_price_data_and_validity(
+            MarketType::Spot,
+            parent_spot_market.market_index,
+            &parent_spot_market.oracle_id(),
+            parent_spot_market
+                .historical_oracle_data
+                .last_oracle_price_twap,
+            parent_spot_market.get_max_confidence_interval_multiplier()?,
+            0,
+        )?;
+        if !is_oracle_valid_for_action(
+            parent_oracle_price_and_validity.1,
+            Some(DriftAction::UpdateLpPoolAum),
+        )? {
+            msg!(
+                "Parent constituent {} oracle is invalid",
+                parent_constituent.constituent_index
+            );
+            return Err(ErrorCode::InvalidOracle);
+        }
+        let parent_constituent_price = parent_oracle_price_and_validity.0.price;
+
         let parent_target_base = constituent_target_base
             .get(*parent_index as u32)
             .target_base;
         let target_parent_weight = calculate_target_weight(
             parent_target_base,
             &*spot_market_map.get_ref(&parent_constituent.spot_market_index)?,
-            parent_constituent.last_oracle_price,
+            parent_oracle_price_and_validity.0.price,
             aum,
         )?;
         let mut derivative_weights_sum: u64 = 0;
         for constituent_index in constituent_indexes {
             let constituent = constituent_map.get_ref(constituent_index)?;
-            if constituent.last_oracle_price
-                < parent_constituent
-                    .last_oracle_price
+            let constituent_spot_market =
+                spot_market_map.get_ref(&constituent.spot_market_index)?;
+            let constituent_oracle_price_and_validity = oracle_map.get_price_data_and_validity(
+                MarketType::Spot,
+                constituent.spot_market_index,
+                &constituent_spot_market.oracle_id(),
+                constituent_spot_market
+                    .historical_oracle_data
+                    .last_oracle_price_twap,
+                constituent_spot_market.get_max_confidence_interval_multiplier()?,
+                0,
+            )?;
+            if !is_oracle_valid_for_action(
+                constituent_oracle_price_and_validity.1,
+                Some(DriftAction::UpdateLpPoolAum),
+            )? {
+                msg!(
+                    "Constituent {} oracle is invalid",
+                    constituent.constituent_index
+                );
+                return Err(ErrorCode::InvalidOracle);
+            }
+
+            if constituent_oracle_price_and_validity.0.price
+                < parent_constituent_price
                     .safe_mul(constituent.constituent_derivative_depeg_threshold as i64)?
                     .safe_div(PERCENTAGE_PRECISION_I64)?
             {
                 msg!(
                     "Constituent {} last oracle price {} is too low compared to parent constituent {} last oracle price {}. Assuming depegging and setting target base to 0.",
                     constituent.constituent_index,
-                    constituent.last_oracle_price,
+                    constituent_oracle_price_and_validity.0.price,
                     parent_constituent.constituent_index,
-                    parent_constituent.last_oracle_price
+                    parent_constituent_price
                 );
                 constituent_target_base
                     .get_mut(*constituent_index as u32)
@@ -1714,7 +1786,7 @@ pub fn update_constituent_target_base_for_derivatives(
                 .safe_mul(target_weight)?
                 .safe_div(PERCENTAGE_PRECISION_I128)?
                 .safe_mul(10_i128.pow(constituent.decimals as u32))?
-                .safe_div(constituent.last_oracle_price as i128)?;
+                .safe_div(constituent_oracle_price_and_validity.0.price as i128)?;
 
             msg!(
                 "constituent: {}, target base: {}",