Add validators manager delegation to NodesManager (#133)

tsudmi · web-flow · commit 2eed9b3b2a3e · 2026-03-03T18:52:37.000+02:00
diff --git a/contracts/interfaces/INodesManager.sol b/contracts/interfaces/INodesManager.sol
@@ -122,6 +122,13 @@ interface INodesManager is IERC5267, IERC1822Proxiable, IMulticall {
         address indexed operator, uint128 totalAssets, uint128 cumPenaltyAssets, uint128 cumEarnedFeeShares
     );
 
+    /**
+     * @notice Event emitted when the validators manager is updated for an operator
+     * @param operator The address of the operator
+     * @param validatorsManager The new validators manager address
+     */
+    event ValidatorsManagerUpdated(address indexed operator, address indexed validatorsManager);
+
     /**
      * @notice Event emitted when the state update delay is updated
      * @param stateUpdateDelay The new state update delay in seconds
@@ -287,19 +294,37 @@ interface INodesManager is IERC5267, IERC1822Proxiable, IMulticall {
     function setWithdrawalsManager(address newWithdrawalsManager) external;
 
     /**
-     * @notice Registers validators with oracle-approved signatures
+     * @notice The validators manager address for the given operator
+     * @param operator The operator address
+     * @return The validators manager address
+     */
+    function validatorsManagers(address operator) external view returns (address);
+
+    /**
+     * @notice Sets the validators manager address for the calling operator
+     * @param validatorsManager The new validators manager address
+     */
+    function setValidatorsManager(address validatorsManager) external;
+
+    /**
+     * @notice Registers validators with oracle-approved signatures. Can only be called by the operator's validators manager.
+     * @param operator The address of the operator
      * @param keeperParams The keeper approval parameters containing validator data
      * @param signatures The concatenation of the oracles' signatures
      */
-    function registerValidators(IKeeperValidators.ApprovalParams calldata keeperParams, bytes calldata signatures)
-        external;
+    function registerValidators(
+        address operator,
+        IKeeperValidators.ApprovalParams calldata keeperParams,
+        bytes calldata signatures
+    ) external;
 
     /**
-     * @notice Funds validators with oracle-approved signatures
+     * @notice Funds validators with oracle-approved signatures. Can only be called by the operator's validators manager.
+     * @param operator The address of the operator
      * @param validators The concatenation of the validators' data
      * @param signatures The concatenation of the oracles' signatures approving the funding
      */
-    function fundValidators(bytes calldata validators, bytes calldata signatures) external;
+    function fundValidators(address operator, bytes calldata validators, bytes calldata signatures) external;
 
     /**
      * @notice Enters the exit queue by locking operator shares in the vault's exit queue
@@ -324,9 +349,10 @@ interface INodesManager is IERC5267, IERC1822Proxiable, IMulticall {
 
     /**
      * @notice Updates the operator state by verifying a merkle proof against the current state root
+     * @param operator The address of the operator to update
      * @param params The parameters for updating the operator state
      */
-    function updateOperatorState(OperatorStateUpdateParams calldata params) external;
+    function updateOperatorState(address operator, OperatorStateUpdateParams calldata params) external;
 
     /**
      * @notice Checks whether state can be updated
diff --git a/contracts/nodes/NodesManager.sol b/contracts/nodes/NodesManager.sol
@@ -66,6 +66,9 @@ abstract contract NodesManager is
     /// @inheritdoc INodesManager
     mapping(address operator => uint256 penaltyAssets) public override pendingPenaltyAssets;
 
+    /// @inheritdoc INodesManager
+    mapping(address operator => address manager) public override validatorsManagers;
+
     mapping(uint256 positionTicket => address operator) private _exitPositions;
 
     /**
@@ -128,6 +131,13 @@ abstract contract NodesManager is
         emit WithdrawalsManagerUpdated(newWithdrawalsManager);
     }
 
+    /// @inheritdoc INodesManager
+    function setValidatorsManager(address validatorsManager) external override {
+        if (validatorsManagers[msg.sender] == validatorsManager) revert Errors.ValueNotChanged();
+        validatorsManagers[msg.sender] = validatorsManager;
+        emit ValidatorsManagerUpdated(msg.sender, validatorsManager);
+    }
+
     /// @inheritdoc INodesManager
     function canUpdateState() external view override returns (bool) {
         // SLOAD to memory
@@ -182,17 +192,19 @@ abstract contract NodesManager is
     }
 
     /// @inheritdoc INodesManager
-    function updateOperatorState(OperatorStateUpdateParams calldata params) external override {
+    function updateOperatorState(address operator, OperatorStateUpdateParams calldata params) external override {
+        if (operator == address(0)) revert Errors.ZeroAddress();
+
         // check whether the vault is harvested
         if (_keeper.isHarvestRequired(vault)) revert Errors.NotHarvested();
 
         // SLOAD to memory
-        OperatorState memory operatorState = operatorStates[msg.sender];
+        OperatorState memory operatorState = operatorStates[operator];
         StateData memory _stateData = stateData;
         uint128 currentNonce = _stateData.currentNonce;
 
         // skip update if the state is already up to date
-        if (operatorNonces[msg.sender][OperatorNonceType.LastStateUpdate] == currentNonce) return;
+        if (operatorNonces[operator][OperatorNonceType.LastStateUpdate] == currentNonce) return;
 
         // verify merkle proof against current state root
         if (!MerkleProof.verifyCalldata(
@@ -201,9 +213,7 @@ abstract contract NodesManager is
                 keccak256(
                     bytes.concat(
                         keccak256(
-                            abi.encode(
-                                msg.sender, params.totalAssets, params.cumPenaltyAssets, params.cumEarnedFeeShares
-                            )
+                            abi.encode(operator, params.totalAssets, params.cumPenaltyAssets, params.cumEarnedFeeShares)
                         )
                     )
                 )
@@ -218,7 +228,7 @@ abstract contract NodesManager is
         // calculate total penalty including any pending penalty from previous updates
         uint256 totalPenaltyShares;
         uint256 penaltyAssetsDelta = params.cumPenaltyAssets - operatorState.cumPenaltyAssets;
-        uint256 totalPenaltyAssets = penaltyAssetsDelta + pendingPenaltyAssets[msg.sender];
+        uint256 totalPenaltyAssets = penaltyAssetsDelta + pendingPenaltyAssets[operator];
         if (totalPenaltyAssets > 0) {
             totalPenaltyShares = IVaultState(vault).convertToShares(totalPenaltyAssets);
         }
@@ -227,11 +237,11 @@ abstract contract NodesManager is
         uint256 penaltySharesToDonate;
         if (totalPenaltyShares <= availableShares) {
             operatorState.balanceShares = SafeCast.toUint128(availableShares - totalPenaltyShares);
-            pendingPenaltyAssets[msg.sender] = 0;
+            pendingPenaltyAssets[operator] = 0;
             penaltySharesToDonate = totalPenaltyShares;
         } else {
             uint256 coveredPenaltyAssets = IVaultState(vault).convertToAssets(availableShares);
-            pendingPenaltyAssets[msg.sender] = totalPenaltyAssets - coveredPenaltyAssets;
+            pendingPenaltyAssets[operator] = totalPenaltyAssets - coveredPenaltyAssets;
             operatorState.balanceShares = 0;
             penaltySharesToDonate = availableShares;
         }
@@ -240,27 +250,32 @@ abstract contract NodesManager is
         operatorState.totalAssets = params.totalAssets;
         operatorState.cumPenaltyAssets = params.cumPenaltyAssets;
         operatorState.cumEarnedFeeShares = params.cumEarnedFeeShares;
-        operatorStates[msg.sender] = operatorState;
-        operatorNonces[msg.sender][OperatorNonceType.LastStateUpdate] = currentNonce;
+        operatorStates[operator] = operatorState;
+        operatorNonces[operator][OperatorNonceType.LastStateUpdate] = currentNonce;
 
         // donate penalty shares to the vault
         if (penaltySharesToDonate > 0) {
             IVaultState(vault).donateShares(penaltySharesToDonate);
         }
 
-        emit OperatorStateUpdated(msg.sender, params.totalAssets, params.cumPenaltyAssets, params.cumEarnedFeeShares);
+        emit OperatorStateUpdated(operator, params.totalAssets, params.cumPenaltyAssets, params.cumEarnedFeeShares);
     }
 
     /// @inheritdoc INodesManager
-    function registerValidators(IKeeperValidators.ApprovalParams calldata keeperParams, bytes calldata signatures)
-        external
-        override
-    {
+    function registerValidators(
+        address operator,
+        IKeeperValidators.ApprovalParams calldata keeperParams,
+        bytes calldata signatures
+    ) external override {
+        if (validatorsManagers[operator] != msg.sender) {
+            revert Errors.AccessDenied();
+        }
+
         // verify oracles approved registering these validators
-        uint256 nonce = _useOperatorNonce(msg.sender, OperatorNonceType.RegisterValidatorsSig);
+        uint256 nonce = _useOperatorNonce(operator, OperatorNonceType.RegisterValidatorsSig);
         bytes32 digest = _hashTypedDataV4(
             keccak256(
-                abi.encode(_registerValidatorsTypeHash, msg.sender, nonce, vault, keccak256(keeperParams.validators))
+                abi.encode(_registerValidatorsTypeHash, operator, nonce, vault, keccak256(keeperParams.validators))
             )
         );
         _verifySignatures(digest, signatures);
@@ -269,35 +284,37 @@ abstract contract NodesManager is
         IVaultValidators(vault).registerValidators(keeperParams, bytes(""));
 
         // save state nonce at validator change
-        operatorNonces[msg.sender][OperatorNonceType.LastValidatorChange] = stateData.currentNonce;
+        operatorNonces[operator][OperatorNonceType.LastValidatorChange] = stateData.currentNonce;
 
         // extract public keys from validators data
         bytes memory publicKeys = _getValidatorsPublicKeys(keeperParams.validators);
 
         // emit event
-        emit ValidatorsRegistered(msg.sender, nonce, publicKeys);
+        emit ValidatorsRegistered(operator, nonce, publicKeys);
     }
 
     /// @inheritdoc INodesManager
-    function fundValidators(bytes calldata validators, bytes calldata signatures) external override {
+    function fundValidators(address operator, bytes calldata validators, bytes calldata signatures) external override {
+        if (validatorsManagers[operator] != msg.sender) revert Errors.AccessDenied();
+
         // verify oracles approved funding these validators
-        uint256 nonce = _useOperatorNonce(msg.sender, OperatorNonceType.FundValidatorsSig);
+        uint256 nonce = _useOperatorNonce(operator, OperatorNonceType.FundValidatorsSig);
         bytes32 digest = _hashTypedDataV4(
-            keccak256(abi.encode(_fundValidatorsTypeHash, msg.sender, nonce, vault, keccak256(validators)))
+            keccak256(abi.encode(_fundValidatorsTypeHash, operator, nonce, vault, keccak256(validators)))
         );
         _verifySignatures(digest, signatures);
 
         // fund validators in the vault
         IVaultValidators(vault).fundValidators(validators, bytes(""));
 
         // save state nonce at validator change
-        operatorNonces[msg.sender][OperatorNonceType.LastValidatorChange] = stateData.currentNonce;
+        operatorNonces[operator][OperatorNonceType.LastValidatorChange] = stateData.currentNonce;
 
         // extract public keys from validators data
         bytes memory publicKeys = _getValidatorsPublicKeys(validators);
 
         // emit event
-        emit ValidatorsFunded(msg.sender, nonce, publicKeys);
+        emit ValidatorsFunded(operator, nonce, publicKeys);
     }
 
     /// @inheritdoc INodesManager
diff --git a/snapshots/EthNodesManagerTest.json b/snapshots/EthNodesManagerTest.json
@@ -1,13 +1,13 @@
 {
-  "EthNodesManagerTest_test_claimExitedAssets": "99189",
-  "EthNodesManagerTest_test_deposit": "124426",
-  "EthNodesManagerTest_test_deposit_multipleDeposits_first": "124426",
-  "EthNodesManagerTest_test_deposit_multipleDeposits_second": "106677",
-  "EthNodesManagerTest_test_enterExitQueue": "138603",
-  "EthNodesManagerTest_test_fundValidators": "161806",
-  "EthNodesManagerTest_test_registerValidators": "321566",
-  "EthNodesManagerTest_test_setMinBalancePercent": "40917",
+  "EthNodesManagerTest_test_claimExitedAssets": "99124",
+  "EthNodesManagerTest_test_deposit": "124404",
+  "EthNodesManagerTest_test_deposit_multipleDeposits_first": "124404",
+  "EthNodesManagerTest_test_deposit_multipleDeposits_second": "106655",
+  "EthNodesManagerTest_test_enterExitQueue": "138581",
+  "EthNodesManagerTest_test_fundValidators": "164727",
+  "EthNodesManagerTest_test_registerValidators": "324473",
+  "EthNodesManagerTest_test_setMinBalancePercent": "40850",
   "EthNodesManagerTest_test_setMinDepositAssets": "40222",
   "EthNodesManagerTest_test_setWithdrawalsManager": "40580",
-  "EthNodesManagerTest_test_withdrawValidators": "87428"
+  "EthNodesManagerTest_test_withdrawValidators": "87361"
 }
diff --git a/test/EthNodesManager.t.sol b/test/EthNodesManager.t.sol
