ROHME-4: install LpBondLister so new LP bonds no longer need a vote
THE PROBLEM. Adding a single LP bond asset currently costs a full governance cycle - roughly
8 days from filing to execution. ROHME-3 spends an entire decree registering two pairs. There
are 37 approved reserves, so at one decree per pair this does not scale.
WHAT THIS DOES.
1. Authority.pushGovernor(0x5c288FfD4E766C8932E62F064A463380b39C89f4, effectiveImmediately=false)
`false` means only `newGovernor` is set, leaving the Timelock as the live governor; the lister
then claims the role through its own permissionless acceptGovernor(). After that, listing
ROHM/SNDK - or any other approved reserve - is a single operator transaction.
WHY THIS IS NOT A GENERAL LOOSENING OF THE MINT PERMISSION. setPriceFeed + enable(RESERVETOKEN)
IS the mint permission: an arbitrary token with a lying feed can be deposited to mint ROHM
against nothing. This contract does not open that for arbitrary assets. It opens it for a
strictly DERIVED class where the caller supplies no trusted input at all:
- the paired token must ALREADY be an enabled RESERVETOKEN that governance vetted, and must
NOT itself be a Uniswap pair (checked structurally against the canonical factory, so an LP
that governance registered directly - such as the genesis POL - is also rejected);
- the aggregator is read from the Treasury's OWN registry for that token, never passed in;
- the pair address is resolved through the canonical factory, so no look-alike can be
substituted;
- the valuation feed is deployed BY the contract, so its bytecode cannot lie;
- heartbeat and the ERC-8056 pause flag are inherited from the approved config, and the
haircut is max(inherited, 2000 bps) - never looser than the leg.
The operator's only degree of freedom is WHICH governance-approved reserve to pair with.
Listing is also inert on its own: it makes an LP depositable, but PolicyGuard.createMarket
(onlyOperator) still has to price a market before anything can be minted.
GOVERNANCE LOSES NOTHING. relay(target, data) lets the Timelock execute any call this contract
could make, so every power governance holds today it still holds afterwards, routed through
here. Governance can also hand the governor role back, rotate the operator (2-step), re-point
the contract at a new Timelock after a Governor migration, and delist a pair.
AUDIT HISTORY. This contract was audited and four findings are fixed in the deployed bytecode:
the anti-nesting guard is now structural rather than local bookkeeping (the previous version
let the genesis ROHM/WETH POL LP, registered directly by governance and therefore invisible to
that bookkeeping, be paired into a doubly self-referential nested LP); a governance de-listing
is no longer reversible by the operator; relay rejects a code-less target instead of silently
succeeding and reporting success to the Timelock; and the timelock reference is no longer
immutable, which would otherwise have stranded governor power inside this contract after the
ROHME-1 migration.
ONE RESIDUAL RISK, NOT FIXED. The LP valuation requires the paired token to be HOOKLESS - a
transfer callback opens a read-only-reentrancy window during Uniswap's burn() that inflates the
per-LP mark. Governance vetted each leg as a RESERVE, a review that never asked about transfer
hooks, and this contract cannot check for it. The 4x price band caps the exposure to a
PriceOutOfBounds skip rather than an over-mint. If a hook-bearing token is ever approved as a
reserve, this path should first be gated behind an explicit hookless allowlist. Note also that
the equity tokens are upgradeable beacon proxies, so hooklessness is not a permanent property.
This is a real transfer of a sensitive permission to a contract. Vote against it if you would
rather each LP listing keep costing a decree.