feat: redeem reserve push base with burner

Author: bulbozaur

contracts/0.4.24/Lido.sol

@@ -15,12 +15,9 @@ import {IPostTokenRebaseReceiver} from "./interfaces/IPostTokenRebaseReceiver.so
 
 import {WithdrawalQueue} from "./WithdrawalQueue.sol";
 
-interface IRedeemsReserveVault {
-    function withdrawToLido(uint256 _amount) external;
-    function getRedeemedShares() external view returns (uint256);
+interface IRedeemsBuffer {
     function getRedeemedEther() external view returns (uint256);
-    function flushSharesToBurner() external;
-    function resetRedeemedEther() external;
+    function withdrawUnredeemed() external;
 }
 
 interface IStakingRouter {
@@ -102,6 +99,8 @@ contract Accounting {
         uint256 postTotalShares;
         /// @notice amount of ether under the protocol after the report is applied
         uint256 postTotalPooledEther;
+        /// @notice number of redeem shares to burn (outside the rebase limiter, rate-neutral)
+        uint256 redeemSharesToBurn;
     }
 
     /// @notice precalculated numbers of shares that should be minted as fee to NO
@@ -193,7 +192,7 @@ contract Accounting {
         // Principal CL balance is sum of previous balances and new deposits
         update.principalClBalance = _pre.clValidatorsBalance + _pre.clPendingBalance + _pre.depositedBalance;
 
-        // Read redemption counters from vault (on-chain, includes all redemptions)
+        // Read redemption counters from buffer (on-chain, includes all redemptions)
         (uint256 redeemedShares, uint256 redeemedEther) = _getRedeemedCounters();
 
         // Limit the rebase to avoid oracle frontrunning.
@@ -215,12 +214,13 @@ contract Accounting {
             update.sharesToFinalizeWQ
         );
 
-        // Add redemption shares outside the limiter — rate-neutral, must all burn on this report
-        update.totalSharesToBurn += redeemedShares;
+        // Redeem shares are burned via a separate commit (outside the rebase limiter, rate-neutral)
+        update.redeemSharesToBurn = redeemedShares;
 
         uint256 postInternalSharesBeforeFees = _pre.totalShares -
             _pre.externalShares - // internal shares before
-            update.totalSharesToBurn; // shares to be burned (WQ + cover + redemptions)
+            update.totalSharesToBurn - // shares to be burned (WQ + cover)
+            update.redeemSharesToBurn; // redeem shares burned separately
 
         update.postInternalEther =
             _pre.totalPooledEther - _pre.externalEther
@@ -386,16 +386,20 @@ contract Accounting {
             LIDO.internalizeExternalBadDebt(_pre.badDebtToInternalize);
         }
 
-        // Flush accumulated redemption shares from vault to Burner before commit
-        _flushVaultSharesToBurner();
+        // Burn all redeem shares (rate-neutral, outside limiter)
+        // Shares are already on Burner — sent during each redeem() call
+        _contracts.burner.commitRedeemSharesToBurn();
 
+        // Burn limiter-constrained cover/nonCover shares
         if (_update.totalSharesToBurn > 0) {
             _contracts.burner.commitSharesToBurn(_update.totalSharesToBurn);
         }
 
-        // Reconcile RedeemsReserveVault — tracked vault ETH updated to actual.
-        _reconcileRedeemsReserveVault();
+        // ETH round-trip: withdraw unredeemed → reconcile bufferedEther
+        _withdrawAndReconcileRedeemsBuffer();
 
+        // Standard flow — runs on clean state (bufferedEther == Lido.balance)
+        // _updateBufferedEtherAllocation() inside grows the redeems reserve snapshot
         LIDO.collectRewardsAndProcessWithdrawals(
             _report.timestamp,
             _report.clValidatorsBalance + _report.clPendingBalance,
@@ -407,8 +411,8 @@ contract Accounting {
             _update.etherToFinalizeWQ
         );
 
-        // Replenish RedeemsReserveVault: push/pull ETH to match target
-        _replenishRedeemsReserveVault();
+        // Push new reserve to buffer (bufferedEther NOT decremented — soft-reserved)
+        _pushRedeemsReserveToBuffer();
 
         if (_update.sharesToMintAsFees > 0) {
             // this is a final action that changes share rate.
@@ -437,70 +441,45 @@ contract Accounting {
         );
     }
 
-    /// @dev Reads redemption counters from the vault. Returns (0, 0) if no vault configured.
+    /// @dev Reads redemption counters. Shares from Burner redeem track, ether from buffer.
+    ///      Returns (0, 0) if no buffer configured.
     function _getRedeemedCounters() internal view returns (uint256 redeemedShares, uint256 redeemedEther) {
-        address vault = LIDO.getRedeemsReserveVault();
-        if (vault == address(0)) return (0, 0);
+        address buffer = LIDO.getRedeemsBuffer();
+        if (buffer == address(0)) return (0, 0);
 
-        redeemedShares = IRedeemsReserveVault(vault).getRedeemedShares();
-        redeemedEther = IRedeemsReserveVault(vault).getRedeemedEther();
+        redeemedShares = IBurner(LIDO_LOCATOR.burner()).getRedeemSharesRequestedToBurn();
+        redeemedEther = IRedeemsBuffer(buffer).getRedeemedEther();
     }
 
-    /// @dev Flushes accumulated redemption shares from vault to Burner.
-    ///      Called before commitSharesToBurn so redeemed shares are included in the burn.
-    function _flushVaultSharesToBurner() internal {
-        address vault = LIDO.getRedeemsReserveVault();
-        if (vault == address(0)) return;
+    /// @dev ETH round-trip: withdraw unredeemed ETH from buffer back to Lido,
+    ///      then reconcile bufferedEther by subtracting redeemedEther.
+    ///      After this call: bufferedEther == Lido.balance (clean state).
+    function _withdrawAndReconcileRedeemsBuffer() internal {
+        address buffer = LIDO.getRedeemsBuffer();
+        if (buffer == address(0)) return;
 
-        IRedeemsReserveVault(vault).flushSharesToBurner();
-    }
+        uint256 redeemedEther = IRedeemsBuffer(buffer).getRedeemedEther();
 
-    /// @dev Reconciles the RedeemsReserveVault tracked ETH to the actual vault balance
-    ///      and resets the redeemed ether counter.
-    function _reconcileRedeemsReserveVault() internal {
-        address vault = LIDO.getRedeemsReserveVault();
-        if (vault == address(0)) return;
+        // Withdraw unredeemed ETH back to Lido (resets buffer counters)
+        IRedeemsBuffer(buffer).withdrawUnredeemed();
 
-        LIDO.reconcileRedeemsReserveVault(vault.balance);
-        IRedeemsReserveVault(vault).resetRedeemedEther();
+        // Reconcile: bufferedEther -= redeemedEther
+        LIDO.reconcileRedeemedEther(redeemedEther);
     }
 
-    /// @dev Replenishes or drains the RedeemsReserveVault to match the reserve target.
-    ///      Called after collectRewardsAndProcessWithdrawals when the buffer is finalized.
-    ///      Fills to target from unreserved surplus first. When surplus is insufficient,
-    ///      splits the shared allocation (withdrawalsReserve + unreserved) by growthShareBP.
-    function _replenishRedeemsReserveVault() internal {
-        address vault = LIDO.getRedeemsReserveVault();
-        if (vault == address(0)) return;
-
-        uint256 target = LIDO.getRedeemsReserveTarget();
-        uint256 actual = vault.balance;
-
-        if (target > actual) {
-            uint256 deficit = target - actual;
-            uint256 depositableEther = LIDO.getDepositableEther();
-            uint256 toPush;
-
-            if (depositableEther >= deficit) {
-                toPush = deficit;
-            } else {
-                uint256 shareBP = LIDO.getRedeemsReserveGrowthShare();
-                if (shareBP == 0) {
-                    toPush = depositableEther;
-                } else {
-                    uint256 withdrawalsReserve = LIDO.getWithdrawalsReserve();
-                    uint256 sharedAllocation = withdrawalsReserve + depositableEther;
-                    uint256 reserveShare = sharedAllocation * shareBP / TOTAL_BASIS_POINTS;
-                    toPush = reserveShare > depositableEther ? reserveShare : depositableEther;
-                    if (toPush > deficit) toPush = deficit;
-                }
-            }
-
-            if (toPush > 0) {
-                LIDO.pushToRedeemsReserveVault(toPush);
-            }
-        } else if (actual > target) {
-            LIDO.pullFromRedeemsReserveVault(actual - target);
+    /// @dev After standard flow + _updateBufferedEtherAllocation() grew the reserve,
+    ///      push the new reserve amount to the buffer.
+    ///      bufferedEther is NOT decremented — ETH is soft-reserved.
+    /// @dev After collectRewardsAndProcessWithdrawals, _updateBufferedEtherAllocation()
+    ///      has set the new REDEEMS_RESERVE_POSITION via _growRedeemsReserve().
+    ///      Push that amount to the buffer. bufferedEther is NOT decremented.
+    function _pushRedeemsReserveToBuffer() internal {
+        address buffer = LIDO.getRedeemsBuffer();
+        if (buffer == address(0)) return;
+
+        uint256 toPush = LIDO.getRedeemsReserve();
+        if (toPush > 0) {
+            LIDO.pushToRedeemsBuffer(toPush);
         }
     }
 

contracts/0.8.9/Accounting.sol

@@ -81,6 +81,9 @@ contract Burner is IBurner, AccessControlEnumerable, Versioned {
 
         uint256 totalCoverSharesBurnt;
         uint256 totalNonCoverSharesBurnt;
+
+        uint256 redeemSharesBurnRequested;
+        uint256 totalRedeemSharesBurnt;
     }
 
     /// @custom:storage-location erc7201:Lido.Core.Burner.IsMigrationAllowed-v3Upgrade
@@ -116,6 +119,16 @@ contract Burner is IBurner, AccessControlEnumerable, Versioned {
      */
     event StETHBurnt(bool indexed isCover, uint256 amountOfStETH, uint256 amountOfShares);
 
+    /**
+     * Emitted when a new redeem burn request is added.
+     */
+    event RedeemStETHBurnRequested(address indexed requestedBy, uint256 amountOfStETH, uint256 amountOfShares);
+
+    /**
+     * Emitted when redeem shares are burnt.
+     */
+    event RedeemStETHBurnt(uint256 amountOfStETH, uint256 amountOfShares);
+
     /**
      * Emitted when the excessive stETH `amount` (corresponding to `amountOfShares` shares) recovered (i.e. transferred)
      * to the Lido treasure address by `requestedBy` sender.
@@ -280,6 +293,29 @@ contract Burner is IBurner, AccessControlEnumerable, Versioned {
         _requestBurn(_sharesAmountToBurn, stETHAmount, false /* _isCover */);
     }
 
+    /**
+     * @notice BE CAREFUL, the provided stETH shares will be burnt permanently.
+     *
+     * Transfers `_sharesAmountToBurn` stETH shares from `_from` and irreversibly locks these
+     * on the burner contract address. Marks the shares amount for burning on the isolated
+     * redeem track (burned outside the rebase limiter).
+     *
+     * @param _from address to transfer shares from
+     * @param _sharesAmountToBurn stETH shares to burn
+     */
+    function requestBurnSharesForRedeem(
+        address _from,
+        uint256 _sharesAmountToBurn
+    ) external onlyRole(REQUEST_BURN_SHARES_ROLE) {
+        if (_sharesAmountToBurn == 0) revert ZeroBurnAmount();
+
+        uint256 stETHAmount = LIDO.transferSharesFrom(_from, address(this), _sharesAmountToBurn);
+
+        emit RedeemStETHBurnRequested(msg.sender, stETHAmount, _sharesAmountToBurn);
+
+        _storage().redeemSharesBurnRequested += _sharesAmountToBurn;
+    }
+
     /**
      * Transfers the excess stETH amount (e.g. belonging to the burner contract address
      * but not marked for burning) to the Lido treasury address set upon the
@@ -392,6 +428,35 @@ contract Burner is IBurner, AccessControlEnumerable, Versioned {
         assert(sharesToBurnNow == _sharesToBurn);
     }
 
+    /**
+     * Commit all pending redeem shares to burn. Burns everything — no budget argument.
+     *
+     * Redeem shares are burned outside the rebase limiter (rate-neutral),
+     * so they are always fully burned on each oracle report.
+     *
+     * Increments `totalRedeemSharesBurnt` counter.
+     * Resets `redeemSharesBurnRequested` counter.
+     * Does nothing if zero shares are pending.
+     */
+    function commitRedeemSharesToBurn() external virtual override {
+        if (msg.sender != LOCATOR.accounting()) revert AppAuthFailed();
+
+        Storage storage $ = _storage();
+        uint256 redeemShares = $.redeemSharesBurnRequested;
+
+        if (redeemShares == 0) {
+            return;
+        }
+
+        $.redeemSharesBurnRequested = 0;
+        $.totalRedeemSharesBurnt += redeemShares;
+
+        uint256 stETHAmount = LIDO.getPooledEthByShares(redeemShares);
+        emit RedeemStETHBurnt(stETHAmount, redeemShares);
+
+        LIDO.burnShares(redeemShares);
+    }
+
     /**
      * Returns the current amount of shares locked on the contract to be burnt.
      */
@@ -421,6 +486,20 @@ contract Burner is IBurner, AccessControlEnumerable, Versioned {
         return _storage().totalNonCoverSharesBurnt;
     }
 
+    /**
+     * Returns the current amount of redeem shares locked on the contract to be burnt.
+     */
+    function getRedeemSharesRequestedToBurn() external view virtual override returns (uint256) {
+        return _storage().redeemSharesBurnRequested;
+    }
+
+    /**
+     * Returns the total redeem shares ever burnt.
+     */
+    function getRedeemSharesBurnt() external view virtual override returns (uint256) {
+        return _storage().totalRedeemSharesBurnt;
+    }
+
     /**
      * Returns the stETH amount belonging to the burner contract address but not marked for burning.
      */
@@ -430,7 +509,9 @@ contract Burner is IBurner, AccessControlEnumerable, Versioned {
 
     function _getExcessStETHShares() internal view returns (uint256) {
         Storage storage $ = _storage();
-        uint256 sharesBurnRequested = ($.coverSharesBurnRequested + $.nonCoverSharesBurnRequested);
+        uint256 sharesBurnRequested = $.coverSharesBurnRequested
+            + $.nonCoverSharesBurnRequested
+            + $.redeemSharesBurnRequested;
         uint256 totalShares = LIDO.sharesOf(address(this));
 
         // sanity check, don't revert