4.2.0 upgrade mitigations

common/registries.ts

@@ -24,8 +24,8 @@ export const registryConfig: Record<string, RegistryChainRecord> = {
     },
     registries: {
       roleRegistry: '0xE1eC57C8EE970280f237863910B606059e9641C9',
-      versionRegistry: '0x1895b15B3d0a70962be86Af0E337018aD63464e0',
-      assetPluginRegistry: '0x4a818c41131CB9FE65BadF2Bb8671dDE4D117135',
+      versionRegistry: '0xB031D7742367B92CcBEd0653B9a6341EFa47dd04',
+      assetPluginRegistry: '0x15A9e0CF2Fd9842B99E015E05073b5F0f58A1C29',
       daoFeeRegistry: '0xec716deD4eABa060937D1a915F166E237039342B',
       trustedFillerRegistry: '0x279ccF56441fC74f1aAC39E7faC165Dec5A88B3A',
     },
@@ -37,8 +37,8 @@ export const registryConfig: Record<string, RegistryChainRecord> = {
     },
     registries: {
       roleRegistry: '0xE1eC57C8EE970280f237863910B606059e9641C9',
-      versionRegistry: '0xBbC532A80DD141449330c1232C953Da6801Aed01',
-      assetPluginRegistry: '0x7Ac954307356301A10adDb0dB4f61b4a475d3551',
+      versionRegistry: '0xbD769ea5E93A4B232Cee08ED4C2a67Ff5Ba692Df',
+      assetPluginRegistry: '0x093c07787920eB34A0A0c7a09823510725Aee4Af',
       daoFeeRegistry: '0x3513D2c7D2F51c678889CeC083E7D7Ae27b219aD',
       trustedFillerRegistry: '0x72DB5f49D0599C314E2f2FEDf6Fe33E1bA6C7A18',
     },

contracts/p0/mixins/Trading.sol

@@ -104,6 +104,7 @@ abstract contract TradingP0 is RewardableP0, ITrading {
         // should not call any ERC20 functions, in case bricked
 
         IERC20Metadata sell = trade.sell();
+        require(trades[sell] == trade, "trade not found");
         delete trades[sell];
         tradesOpen--;
         emit TradeSettled(trade, sell, trade.buy(), 0, 0);

contracts/p1/BackingManager.sol

@@ -285,16 +285,20 @@ contract BackingManagerP1 is TradingP1, IBackingManager {
         ctx.minTradeVolume = minTradeVolume;
         ctx.maxTradeSlippage = maxTradeSlippage;
         ctx.quantities = new uint192[](reg.erc20s.length);
-        for (uint256 i = 0; i < reg.erc20s.length; ++i) {
-            ctx.quantities[i] = basketHandler.quantityUnsafe(reg.erc20s[i], reg.assets[i]);
-            // quantities round up, without any issuance premium
-        }
         ctx.bals = new uint192[](reg.erc20s.length);
+
         for (uint256 i = 0; i < reg.erc20s.length; ++i) {
-            ctx.bals[i] = reg.assets[i].bal(address(this)) + tokensOut[reg.erc20s[i]];
+            IERC20 erc20 = reg.erc20s[i];
+            IAsset asset = reg.assets[i];
+
+            ctx.quantities[i] = basketHandler.quantityUnsafe(erc20, asset);
+            // quantities round up, and exclude issuance premium
+
+            // include balances out on trade
+            ctx.bals[i] = asset.bal(address(this)) + tokensOut[erc20];
 
             // include StRSR's balance for RSR
-            if (reg.erc20s[i] == rsr) ctx.bals[i] += reg.assets[i].bal(address(stRSR));
+            if (erc20 == rsr) ctx.bals[i] += asset.bal(address(stRSR));
         }
     }
 
@@ -315,8 +319,8 @@ contract BackingManagerP1 is TradingP1, IBackingManager {
     /// @param trade The trade address itself
     /// @custom:governance
     function forceSettleTrade(ITrade trade) public override(TradingP1, ITrading) {
-        super.forceSettleTrade(trade); // enforces governance only
         delete tokensOut[trade.sell()];
+        super.forceSettleTrade(trade); // enforces governance only; nonReentrant
     }
 
     /// @custom:governance

contracts/p1/mixins/Trading.sol

@@ -151,11 +151,12 @@ abstract contract TradingP1 is Multicall, ComponentP1, ReentrancyGuardUpgradeabl
     /// Should only be called in case of censorship
     /// @param trade The trade address itself
     /// @custom:governance
-    function forceSettleTrade(ITrade trade) public virtual {
+    function forceSettleTrade(ITrade trade) public virtual globalNonReentrant {
         requireGovernanceOnly();
         // should not call any ERC20 functions, in case bricked
 
         IERC20Metadata sell = trade.sell();
+        require(trades[sell] == trade, "wrong trade");
         delete trades[sell];
         tradesOpen--;
         emit TradeSettled(trade, sell, trade.buy(), 0, 0);