Modular Gho Stewards

[CheyenneAtapour]

Support CCIP controls for GhoSteward

• Splits GhoStewardV2 into multiple Stewards:
  • GhoCcipSteward: Handles all CCIP parameters
  • GhoGsmSteward: Handles all GSM parameters
  • GhoAaveSteward: Handles all GHO and AAVE related parameters
• On Ethereum:
  • Added ability to change bridge limit
  • Aded ability to change CCIP token pool rate limit
• On Arbitrum:
  • Added ability to change CCIP token pool rate limit
  • Added ability to change Facilitator bucket capacity of CCIP

Closes #415

Background

We've decided to split the GhoStewardV2 into multiple different stewards, each with independent responsibilities, in order to remove the need to redeploy the entire steward contract whenever we wish to make an upgrade or change. Now, only the corresponding steward will need a change, and the rest can stay untouched.

In addition, we've implemented some new features to allow for controlling parameters related to CCIP.

Usage

Allows approved risk provider to change GHO, GSM and CCIP parameters.

Steps from governance to work as intended

The following contracts must be granted these roles by the DAO:

• GhoAaveSteward
  • RiskAdmin in Aave V3 Ethereum Pool
• GhoBucketSteward (both on Ethereum and Arbitrum)
  • GhoTokenBucketManagerRole on GhoToken
• GhoCcipSteward
  • RateLimitAdmin and BridgeLimitAdmin roles on GhoTokenPool (just rateLimitAdmin on Arbitrum)
• GhoGsmSteward
  • Configurator in every GSM asset that the DAO wants the risk council to manage

Owner of the contract (DAO) needs to add each facilitator (GHO AToken/GSM) to a controlled list in GhoBucketSteward, with setControlledFacilitator method

FixedRateStrategyFactory must be deployed before deploying the GhoAaveSteward contract, as its used for creating fixed rate strategies for updating the GHO borrow rate.

Limitations on calls and/or parameters:

General:

• Methods that change facilitators, GSM or GHO parameters can only be called by approved risk council
• Those methods have a timelock of 2 days

Authorized Parties

• We have 2 distinct parties who may each call particular functions: the Aave DAO and the risk council
• The DAO acts as the contracts' owner, calling administrative functions like updating the list of facilitators and changing risk configuration
• The risk council is allowed to change parameters on the stewards, as defined below
• Below, we note which functions can be called by which actors

The following functions can only be called by the risk council:

GhoBucketSteward:

• updateFacilitatorBucketCapacity:
  • The update changes up to 100% upwards
  • Facilitator must be in controlled list
  • Only callable by the risk council

GhoAaveSteward:

• updateGhoBorrowCap:
  • The update changes up to 100% upwards and downwards
  • Only callable by the risk council
• updateGhoBorrowRate:
  • The update changes up to 5.0% (configurable by the DAO) upwards or downwards the following four variables:
    • optimalUsageRatio
    • baseVariableBorrowRate
    • variableRateSlope1
    • variableRateSlope2
  • The initially allowed amount of change for these variables is 5%, but is configurable by the DAO
  • Max value for borrow rate is 25.0%
    • Note that this is enforced by GHO_BORROW_RATE_MAX and is an absolute max on the final value, whereas the other update conditions enforce how much a value is allowed to change on each individual update (and there is no enforced maximum value)
  • Only callable by the risk council
• updateGhoSupplyCap
  • The update changes up to 100% upwards
  • Only callable by the risk council

GhoCcipSteward:

• updateBridgeLimit:
  • The update changes up to 100% upwards or downwards
  • Only callable by the risk council
• updateRateLimit:
  • The update changes up to 100% upwards or downwards
  • Only callable by the risk council

GhoGsmSteward:

• updateGsmExposureCap:
  • The update changes up to 100% upwards
  • Only callable by the risk council
• updateGsmBuySellFees:
  • The update changes up to 0.5% upwards or downwards (in both buy and sell individually)
  • Asumes that strategy is FixedFeeStrategy created by FixedFeeStrategyFactory
  • Only callable by the risk council

Management:

The following functions can only be called by the owner (the Aave DAO)

• setControlledFacilitator on GhoBucketSteward
  • Only callable by owner (Aave DAO)
• setRiskConfig on GhoAaveSteward
  • Sets the max percent changes for each of the four required parameters for Gho borrow rate (optimal usage ratio, base variable borrow rate, variable slope rate 1 and 2)
  • Only callable by owner (Aave DAO)

Considerations:

• There is no expiration set for the contract, so DAO should remove roles in case that they want to deprecate the functionality or call setControlledFacilitator with false if they want to disable it for certain GSMs

[height]

Link Height tasks by mentioning a task ID in the pull request title or commit messages, or description and comments with the keyword link (e.g. "Link T-123").

💡Tip: You can also use "Close T-X" to automatically close a task when the pull request is merged.