SafeDiamondCut

Git Source

Inherits: ISafeDiamondCut, IUpgradeRegistry, IFrozenSelectors, IEmergencyCut

Title: SafeDiamondCut

Author: David Dada <daveproxy80@gmail.com> (https://github.com/dadadave80)

Stateless Diamond facet exposing the EIP-2535 diamondCut function at the canonical selector 0x1f931c1c, gated behind EmergencyStop + a pinned Gnosis Safe multisig. Drop-in replacement for diamond-lib's owner-gated DiamondCutFacet in a Safe-governed deployment. Also serves the append-only on-chain IUpgradeRegistry of every executed cut and a self-administered Safe-rotation entry point. This is the INSTANT (no-delay) variant; use GovernedSafeDiamondCut when a mandatory timelock between approval and execution is wanted.

AUTHORITY: the Safe collects M-of-N owner signatures off-chain and verifies the threshold on-chain in execTransaction, then calls this facet. The facet does NOT re-verify signatures; it trusts solely that msg.sender == the pinned Safe. The Safe MUST dispatch with operation = Call (NEVER DelegateCall): a DelegateCall would run this code in the Safe's own context, where msg.sender is whoever called the Safe, defeating the gate.

Notes:

• lattice-version: 0.1.0
• lattice-source: Lattice original

Functions

diamondCut

Add/replace/remove any number of functions and optionally execute a function with delegatecall — but only when not emergency-stopped and the caller is the pinned Safe. The Safe MUST call with operation = Call.

function diamondCut(FacetCut[] calldata _diamondCut, address _init, bytes calldata _calldata)
        external
        payable
        virtual;

Parameters

setSafe

Rotates the pinned Safe authority to _newSafe. Self-administered: callable ONLY by the current pinned Safe, so only the existing multisig can hand authority to its successor. _newSafe is validated (non-zero, real Safe whose threshold is at least the minimum meaningful threshold of 1). Emits SafeRotated.

function setSafe(address _newSafe) external virtual;

Parameters

safe

Returns the currently pinned Safe authority.

function safe() external view virtual returns (address);

Returns

emergencyRemoveCut

Zero-delay, removal-only emergency cut: instantly unbinds the supplied selectors from the diamond. Callable ONLY by an EMERGENCY_GUARDIAN_ROLE holder, and — unlike the governed diamondCut — it INTENTIONALLY works while EmergencyStop is engaged (it is the panic button). Every FacetCut must use action Remove (revert EmergencyCutMustBeRemoveOnly otherwise); none may target the cut entrypoint (revert EmergencyCutEntrypointProtected), a stop-recovery selector (same revert) or a frozen selector (revert IFrozenSelectors.FrozenSelectorProtected); no init delegatecall is permitted (nothing to initialize on a pure removal). The removal is recorded in the IUpgradeRegistry and emits EmergencyCutExecuted.

function emergencyRemoveCut(FacetCut[] calldata _cuts) external virtual;

Parameters

cutCount

Returns the number of governed cuts recorded so far, which is also the latest version.

function cutCount() external view virtual returns (uint256);

Returns

getCutRecord

Returns the immutable audit record for a given registry version.

function getCutRecord(uint256 _version) external view virtual returns (IUpgradeRegistry.CutRecord memory);

Parameters

Returns

freezeSelectors

Permanently marks selectors as frozen: once frozen, a selector can never be the target of a Replace or Remove in any future governed cut. Append-only — there is deliberately no unfreeze. Gated like the facet's cut: on GovernedDiamondCut, behind UPGRADE_EXECUTOR_ROLE (the single-holder role that gates diamondCut), so in its recipes only a timelock-relayed governance proposal can freeze (a co-cut self-call relay such as AccessManager execute would also reach it); on SafeDiamondCut and GovernedSafeDiamondCut, by the pinned Safe.

function freezeSelectors(bytes4[] calldata _selectors) external virtual;

Parameters

isSelectorFrozen

Returns whether selector is in the frozen set.

function isSelectorFrozen(bytes4 _selector) external view virtual returns (bool);

Parameters

Returns

frozenSelectors

Returns the full set of frozen selectors.

function frozenSelectors() external view virtual returns (bytes4[] memory);

Returns

previewCut

Pre-flight simulation of the frozen-selector guard against the CURRENT frozen set, with no state change and no broadcast. Lets an upgrade workflow fail fast — before proposing — if a cut would touch a frozen selector. Mirrors exactly the check the guarded diamondCut performs before applying: only Replace/Remove actions are inspected.

function previewCut(FacetCut[] calldata _cuts) external view virtual returns (bool ok, bytes4 offendingSelector);

Parameters

Returns

verifyInterfaceRegistered

Verifies whether interfaceId is currently advertised in the diamond's ERC-165 map.

function verifyInterfaceRegistered(bytes4 _interfaceId) external view virtual returns (bool);

Parameters

Returns

exportSelectors

ERC-8153 selector export: this facet's cuttable selectors, tightly packed (4 bytes each).

function exportSelectors() external pure virtual returns (bytes memory selectors);

Returns