GovernedSafeDiamondCut

Git Source

Inherits: IGovernedSafeDiamondCut, ISafeAuthority, IUpgradeRegistry, IFrozenSelectors, IEmergencyCut

Title: GovernedSafeDiamondCut

Author: David Dada <daveproxy80@gmail.com> (https://github.com/dadadave80)

Stateless Diamond facet exposing a Safe-multisig-gated EIP-2535 cut WITH a self-contained timelock: the pinned Safe scheduleCuts an upgrade, it matures past minDelay, and only then can the Safe executeCut it; a still-pending operation can be cancelCut-ed. No external Governor/TimelockController is required. Also serves the append-only on-chain IUpgradeRegistry, the frozen-selector protection layer, the guardian-gated emergency removal escape hatch, and self-administered Safe-rotation / min-delay setters. Unlike SafeDiamondCut it deliberately does NOT serve the synchronous cut selector 0x1f931c1c (every cut is delayed).

AUTHORITY: the Safe collects M-of-N owner signatures off-chain and verifies the threshold on-chain in execTransaction, then calls this facet. The facet does NOT re-verify signatures; it trusts solely that msg.sender == the pinned Safe. The Safe MUST dispatch with operation = Call (NEVER DelegateCall): a DelegateCall would run this code in the Safe's own context, where msg.sender is whoever called the Safe, defeating the gate.

Notes:

• lattice-version: 0.1.0
• lattice-source: Lattice original

Functions

scheduleCut

Schedules a cut for later execution. Gated to the pinned Safe and rejected while emergency-stopped. Reverts CutAlreadyScheduled if the id is already scheduled or was executed.

function scheduleCut(FacetCut[] calldata _diamondCut, address _init, bytes calldata _calldata, bytes32 _salt)
        external
        virtual
        returns (bytes32 id);

Parameters

Returns

executeCut

Executes a previously-scheduled, matured cut. Gated to the pinned Safe and rejected while emergency-stopped. Reverts CutNotScheduled if unknown, cancelled or already executed, CutNotReady if before eta, and the shared frozen-selector guard if a Replace/Remove touches a frozen selector. The arguments must match those passed to scheduleCut exactly (they re-derive the id).

function executeCut(FacetCut[] calldata _diamondCut, address _init, bytes calldata _calldata, bytes32 _salt)
        external
        payable
        virtual;

Parameters

cancelCut

Cancels a scheduled, not-yet-executed operation. Gated to the pinned Safe. Reverts CutNotScheduled if the id is not currently scheduled (including an executed id).

function cancelCut(bytes32 _id) external virtual;

Parameters

getTimestamp

Returns the ready timestamp (eta) of an operation.

function getTimestamp(bytes32 _id) external view virtual returns (uint256);

Parameters

Returns

isOperationPending

Returns whether _id is scheduled but not yet matured (eta in the future).

function isOperationPending(bytes32 _id) external view virtual returns (bool);

Parameters

Returns

isOperationReady

Returns whether _id is scheduled and matured (eta reached, not yet executed).

function isOperationReady(bytes32 _id) external view virtual returns (bool);

Parameters

Returns

isOperationDone

Returns whether _id has been executed. False for never-scheduled and cancelled ids.

function isOperationDone(bytes32 _id) external view virtual returns (bool);

Parameters

Returns

minDelay

Returns the minimum timelock delay (seconds) enforced between schedule and execute for operations scheduled now. A requested change shows here only once it takes effect.

function minDelay() external view virtual returns (uint256);

Returns

setMinDelay

Requests a new minimum timelock delay (seconds). Self-administered: callable only by the pinned Safe. The change takes effect max(current, new) seconds later, so a lowered delay waits out the delay it replaces, and applies to operations scheduled from then on. Emits MinDelayChangeScheduled.

function setMinDelay(uint256 _newDelay) external virtual;

Parameters

setSafe

Rotates the pinned Safe authority to _newSafe. Self-administered: callable ONLY by the current pinned Safe, so only the existing multisig can hand authority to its successor. _newSafe is validated (non-zero, real Safe whose threshold is at least the minimum meaningful threshold of 1). Emits SafeRotated.

function setSafe(address _newSafe) external virtual;

Parameters

safe

Returns the currently pinned Safe authority.

function safe() external view virtual returns (address);

Returns

emergencyRemoveCut

Zero-delay, removal-only emergency cut: instantly unbinds the supplied selectors from the diamond. Callable ONLY by an EMERGENCY_GUARDIAN_ROLE holder, and — unlike the governed diamondCut — it INTENTIONALLY works while EmergencyStop is engaged (it is the panic button). Every FacetCut must use action Remove (revert EmergencyCutMustBeRemoveOnly otherwise); none may target the cut entrypoint (revert EmergencyCutEntrypointProtected), a stop-recovery selector (same revert) or a frozen selector (revert IFrozenSelectors.FrozenSelectorProtected); no init delegatecall is permitted (nothing to initialize on a pure removal). The removal is recorded in the IUpgradeRegistry and emits EmergencyCutExecuted.

function emergencyRemoveCut(FacetCut[] calldata _cuts) external virtual;

Parameters

cutCount

Returns the number of governed cuts recorded so far, which is also the latest version.

function cutCount() external view virtual returns (uint256);

Returns

getCutRecord

Returns the immutable audit record for a given registry version.

function getCutRecord(uint256 _version) external view virtual returns (IUpgradeRegistry.CutRecord memory);

Parameters

Returns

freezeSelectors

Permanently marks selectors as frozen: once frozen, a selector can never be the target of a Replace or Remove in any future governed cut. Append-only — there is deliberately no unfreeze. Gated like the facet's cut: on GovernedDiamondCut, behind UPGRADE_EXECUTOR_ROLE (the single-holder role that gates diamondCut), so in its recipes only a timelock-relayed governance proposal can freeze (a co-cut self-call relay such as AccessManager execute would also reach it); on SafeDiamondCut and GovernedSafeDiamondCut, by the pinned Safe.

function freezeSelectors(bytes4[] calldata _selectors) external virtual;

Parameters

isSelectorFrozen

Returns whether selector is in the frozen set.

function isSelectorFrozen(bytes4 _selector) external view virtual returns (bool);

Parameters

Returns

frozenSelectors

Returns the full set of frozen selectors.

function frozenSelectors() external view virtual returns (bytes4[] memory);

Returns

previewCut

Pre-flight simulation of the frozen-selector guard against the CURRENT frozen set, with no state change and no broadcast. Lets an upgrade workflow fail fast — before proposing — if a cut would touch a frozen selector. Mirrors exactly the check the guarded diamondCut performs before applying: only Replace/Remove actions are inspected.

function previewCut(FacetCut[] calldata _cuts) external view virtual returns (bool ok, bytes4 offendingSelector);

Parameters

Returns

verifyInterfaceRegistered

Verifies whether interfaceId is currently advertised in the diamond's ERC-165 map.

function verifyInterfaceRegistered(bytes4 _interfaceId) external view virtual returns (bool);

Parameters

Returns

exportSelectors

ERC-8153 selector export: this facet's cuttable selectors, tightly packed (4 bytes each).

function exportSelectors() external pure virtual returns (bytes memory selectors);

Returns