feat: wip

Author: rkolpakov

contracts/0.8.9/Accounting.sol

@@ -16,8 +16,8 @@ import {IPostTokenRebaseReceiver} from "./interfaces/IPostTokenRebaseReceiver.so
 import {WithdrawalQueue} from "./WithdrawalQueue.sol";
 
 interface IRedeemsBuffer {
-    function getRedeemedEther() external view returns (uint256);
-    function withdrawUnredeemed() external;
+    function getSettledRedeemedEther() external view returns (uint256);
+    function getSettledRedeemedShares() external view returns (uint256);
 }
 
 interface IStakingRouter {
@@ -194,35 +194,34 @@ contract Accounting {
         // Principal CL balance is sum of previous balances and new deposits
         update.principalClBalance = _pre.clValidatorsBalance + _pre.clPendingBalance + _pre.depositedBalance;
 
-        // Read redemption counters from buffer (on-chain, includes all redemptions)
+        // Read settled (pre-refSlot) redemption counters from buffer on-chain.
+        // Bucketing in RedeemsBuffer guarantees these are stable between refSlot and delivery.
         (uint256 redeemedShares, uint256 redeemedEther) = _getRedeemedCounters();
         update.redeemedEther = redeemedEther;
+        update.redeemSharesToBurn = redeemedShares;
 
         // Limit the rebase to avoid oracle frontrunning.
         // The base is reduced by redeemed ether AND shares so the limiter sees
         // a rate-neutral pre-state (as if the redeem never happened).
-        // Without the shares adjustment the pre-share-rate fed to the limiter
-        // would be artificially low, shrinking the shares-burn budget.
+        // sharesRequestedToBurn from oracle includes redeem shares (nonCover on Burner) —
+        // subtract them so the limiter only governs cover + regular nonCover.
         (
             update.withdrawalsVaultTransfer,
             update.elRewardsVaultTransfer,
             update.sharesToBurnForWithdrawals,
-            update.totalSharesToBurn // shares to burn from Burner balance (WQ + cover)
+            update.totalSharesToBurn
         ) = _contracts.oracleReportSanityChecker.smoothenTokenRebase(
             _pre.totalPooledEther - _pre.externalEther - redeemedEther,
             _pre.totalShares - _pre.externalShares - redeemedShares,
             update.principalClBalance,
             _report.clValidatorsBalance + _report.clPendingBalance,
             _report.withdrawalVaultBalance,
             _report.elRewardsVaultBalance,
-            _report.sharesRequestedToBurn,
+            _report.sharesRequestedToBurn - redeemedShares,
             update.etherToFinalizeWQ,
             update.sharesToFinalizeWQ
         );
 
-        // Redeem shares are burned via a separate commit (outside the rebase limiter, rate-neutral)
-        update.redeemSharesToBurn = redeemedShares;
-
         uint256 postInternalSharesBeforeFees = _pre.totalShares -
             _pre.externalShares - // internal shares before
             update.totalSharesToBurn - // shares to be burned (WQ + cover)
@@ -392,15 +391,13 @@ contract Accounting {
             LIDO.internalizeExternalBadDebt(_pre.badDebtToInternalize);
         }
 
-        // Burn all redeem shares (rate-neutral, outside limiter)
-        // Shares are already on Burner — sent during each redeem() call
-        if (_update.redeemSharesToBurn > 0) {
-            _contracts.burner.commitRedeemSharesToBurn();
-        }
-
-        // Burn limiter-constrained cover/nonCover shares
-        if (_update.totalSharesToBurn > 0) {
-            _contracts.burner.commitSharesToBurn(_update.totalSharesToBurn);
+        // Burn shares: limiter-constrained cover/nonCover + all settled redeem shares.
+        // Redeem shares sit on Burner as nonCover — burned together in one call.
+        {
+            uint256 totalBurn = _update.totalSharesToBurn + _update.redeemSharesToBurn;
+            if (totalBurn > 0) {
+                _contracts.burner.commitSharesToBurn(totalBurn);
+            }
         }
 
         // collectRewardsAndProcessWithdrawals handles ETH round-trip internally:
@@ -444,14 +441,15 @@ contract Accounting {
         );
     }
 
-    /// @dev Reads redemption counters. Shares from Burner redeem track, ether from buffer.
+    /// @dev Reads settled (pre-refSlot) redemption counters from RedeemsBuffer.
+    ///      Both values are bucketed on-chain — stable between refSlot and delivery.
     ///      Returns (0, 0) if no buffer configured.
     function _getRedeemedCounters() internal view returns (uint256 redeemedShares, uint256 redeemedEther) {
         address buffer = LIDO.getRedeemsBuffer();
         if (buffer == address(0)) return (0, 0);
 
-        redeemedShares = IBurner(LIDO_LOCATOR.burner()).getRedeemSharesRequestedToBurn();
-        redeemedEther = IRedeemsBuffer(buffer).getRedeemedEther();
+        redeemedShares = IRedeemsBuffer(buffer).getSettledRedeemedShares();
+        redeemedEther = IRedeemsBuffer(buffer).getSettledRedeemedEther();
     }
 
     /// @dev checks the provided oracle data internally and against the sanity checker contract

contracts/0.8.9/Burner.sol

@@ -81,9 +81,6 @@ contract Burner is IBurner, AccessControlEnumerable, Versioned {
 
         uint256 totalCoverSharesBurnt;
         uint256 totalNonCoverSharesBurnt;
-
-        uint256 redeemSharesBurnRequested;
-        uint256 totalRedeemSharesBurnt;
     }
 
     /// @custom:storage-location erc7201:Lido.Core.Burner.IsMigrationAllowed-v3Upgrade
@@ -119,16 +116,6 @@ contract Burner is IBurner, AccessControlEnumerable, Versioned {
      */
     event StETHBurnt(bool indexed isCover, uint256 amountOfStETH, uint256 amountOfShares);
 
-    /**
-     * Emitted when a new redeem burn request is added.
-     */
-    event RedeemStETHBurnRequested(address indexed requestedBy, uint256 amountOfStETH, uint256 amountOfShares);
-
-    /**
-     * Emitted when redeem shares are burnt.
-     */
-    event RedeemStETHBurnt(uint256 amountOfStETH, uint256 amountOfShares);
-
     /**
      * Emitted when the excessive stETH `amount` (corresponding to `amountOfShares` shares) recovered (i.e. transferred)
      * to the Lido treasure address by `requestedBy` sender.
@@ -195,7 +182,7 @@ contract Burner is IBurner, AccessControlEnumerable, Versioned {
         Storage storage $ = _storage();
         $.totalCoverSharesBurnt = oldBurner.getCoverSharesBurnt();
         $.totalNonCoverSharesBurnt = oldBurner.getNonCoverSharesBurnt();
-        (uint256 coverShares, uint256 nonCoverShares,) = oldBurner.getSharesRequestedToBurn();
+        (uint256 coverShares, uint256 nonCoverShares) = oldBurner.getSharesRequestedToBurn();
         $.coverSharesBurnRequested = coverShares;
         $.nonCoverSharesBurnRequested = nonCoverShares;
     }
@@ -293,29 +280,6 @@ contract Burner is IBurner, AccessControlEnumerable, Versioned {
         _requestBurn(_sharesAmountToBurn, stETHAmount, false /* _isCover */);
     }
 
-    /**
-     * @notice BE CAREFUL, the provided stETH shares will be burnt permanently.
-     *
-     * Transfers `_sharesAmountToBurn` stETH shares from `_from` and irreversibly locks these
-     * on the burner contract address. Marks the shares amount for burning on the isolated
-     * redeem track (burned outside the rebase limiter).
-     *
-     * @param _from address to transfer shares from
-     * @param _sharesAmountToBurn stETH shares to burn
-     */
-    function requestBurnSharesForRedeem(
-        address _from,
-        uint256 _sharesAmountToBurn
-    ) external onlyRole(REQUEST_BURN_SHARES_ROLE) {
-        if (_sharesAmountToBurn == 0) revert ZeroBurnAmount();
-
-        uint256 stETHAmount = LIDO.transferSharesFrom(_from, address(this), _sharesAmountToBurn);
-
-        emit RedeemStETHBurnRequested(msg.sender, stETHAmount, _sharesAmountToBurn);
-
-        _storage().redeemSharesBurnRequested += _sharesAmountToBurn;
-    }
-
     /**
      * Transfers the excess stETH amount (e.g. belonging to the burner contract address
      * but not marked for burning) to the Lido treasury address set upon the
@@ -428,35 +392,6 @@ contract Burner is IBurner, AccessControlEnumerable, Versioned {
         assert(sharesToBurnNow == _sharesToBurn);
     }
 
-    /**
-     * Commit all pending redeem shares to burn. Burns everything — no budget argument.
-     *
-     * Redeem shares are burned outside the rebase limiter (rate-neutral),
-     * so they are always fully burned on each oracle report.
-     *
-     * Increments `totalRedeemSharesBurnt` counter.
-     * Resets `redeemSharesBurnRequested` counter.
-     * Does nothing if zero shares are pending.
-     */
-    function commitRedeemSharesToBurn() external virtual override {
-        if (msg.sender != LOCATOR.accounting()) revert AppAuthFailed();
-
-        Storage storage $ = _storage();
-        uint256 redeemShares = $.redeemSharesBurnRequested;
-
-        if (redeemShares == 0) {
-            return;
-        }
-
-        $.redeemSharesBurnRequested = 0;
-        $.totalRedeemSharesBurnt += redeemShares;
-
-        uint256 stETHAmount = LIDO.getPooledEthByShares(redeemShares);
-        emit RedeemStETHBurnt(stETHAmount, redeemShares);
-
-        LIDO.burnShares(redeemShares);
-    }
-
     /**
      * Returns the current amount of shares locked on the contract to be burnt.
      */
@@ -465,12 +400,11 @@ contract Burner is IBurner, AccessControlEnumerable, Versioned {
         view
         virtual
         override
-        returns (uint256 coverShares, uint256 nonCoverShares, uint256 redeemShares)
+        returns (uint256 coverShares, uint256 nonCoverShares)
     {
         Storage storage $ = _storage();
         coverShares = $.coverSharesBurnRequested;
         nonCoverShares = $.nonCoverSharesBurnRequested;
-        redeemShares = $.redeemSharesBurnRequested;
     }
 
     /**
@@ -487,20 +421,6 @@ contract Burner is IBurner, AccessControlEnumerable, Versioned {
         return _storage().totalNonCoverSharesBurnt;
     }
 
-    /**
-     * Returns the current amount of redeem shares locked on the contract to be burnt.
-     */
-    function getRedeemSharesRequestedToBurn() external view virtual override returns (uint256) {
-        return _storage().redeemSharesBurnRequested;
-    }
-
-    /**
-     * Returns the total redeem shares ever burnt.
-     */
-    function getRedeemSharesBurnt() external view virtual override returns (uint256) {
-        return _storage().totalRedeemSharesBurnt;
-    }
-
     /**
      * Returns the stETH amount belonging to the burner contract address but not marked for burning.
      */
@@ -510,9 +430,7 @@ contract Burner is IBurner, AccessControlEnumerable, Versioned {
 
     function _getExcessStETHShares() internal view returns (uint256) {
         Storage storage $ = _storage();
-        uint256 sharesBurnRequested = $.coverSharesBurnRequested
-            + $.nonCoverSharesBurnRequested
-            + $.redeemSharesBurnRequested;
+        uint256 sharesBurnRequested = ($.coverSharesBurnRequested + $.nonCoverSharesBurnRequested);
         uint256 totalShares = LIDO.sharesOf(address(this));
 
         // sanity check, don't revert