feat: Add ERC-20 whitelist check in debt-locker inititalize (SC-4149)

contracts/DebtLockerInitializer.sol

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
 pragma solidity ^0.8.7;
 
-import { IMapleLoanLike }  from "./interfaces/Interfaces.sol";
+import { IMapleGlobalsLike, IMapleLoanLike, IPoolFactoryLike, IPoolLike }  from "./interfaces/Interfaces.sol";
 
 import { DebtLockerStorage } from "./DebtLockerStorage.sol";
 
@@ -19,6 +19,11 @@ contract DebtLockerInitializer is DebtLockerStorage {
     fallback() external {
         ( address loan_, address pool_ ) = decodeArguments(msg.data);
 
+        IMapleGlobalsLike globals = IMapleGlobalsLike(IPoolFactoryLike(IPoolLike(pool_).superFactory()).globals());
+
+        require(globals.isValidCollateralAsset(IMapleLoanLike(loan_).collateralAsset()), "DL:I:INVALID_COLLATERAL_ASSET");
+        require(globals.isValidLiquidityAsset(IMapleLoanLike(loan_).fundsAsset()),       "DL:I:INVALID_FUNDS_ASSET");
+
         _loan = loan_;
         _pool = pool_;
 

contracts/interfaces/Interfaces.sol

@@ -18,14 +18,18 @@ interface IMapleGlobalsLike {
 
    function defaultUniswapPath(address fromAsset_, address toAsset_) external view returns (address intermediateAsset_);
 
+   function getLatestPrice(address asset_) external view returns (uint256 price_);
+
    function investorFee() external view returns (uint256 investorFee_);
 
+   function isValidCollateralAsset(address asset_) external view returns (bool isValid_);
+
+   function isValidLiquidityAsset(address asset_) external view returns (bool isValid_);
+
    function mapleTreasury() external view returns (address mapleTreasury_);
 
    function treasuryFee() external view returns (uint256 treasuryFee_);
 
-   function getLatestPrice(address asset_) external view returns (uint256 price_);
-
 }
 
 interface IMapleLoanLike {

contracts/test/DebtLocker.t.sol

@@ -56,6 +56,9 @@ contract DebtLockerTest is TestUtils {
         collateralAsset = new MockERC20("Collateral Asset", "CA", 18);
         fundsAsset      = new MockERC20("Funds Asset",      "FA", 18);
 
+        globals.setValidCollateralAsset(address(collateralAsset), true);
+        globals.setValidLiquidityAsset(address(fundsAsset), true);
+
         // Deploying and registering DebtLocker implementation and initializer
         address implementation = address(new DebtLocker());
         address initializer    = address(new DebtLockerInitializer());
@@ -170,6 +173,38 @@ contract DebtLockerTest is TestUtils {
         assertEq(details[6], 0);           // Zero shortfall since no liquidation
     }
 
+    function test_initialize_invalidCollateralAsset() public {
+        loan = _createLoan(1_000_000);
+
+        assertTrue(globals.isValidCollateralAsset(loan.collateralAsset()));
+
+        globals.setValidCollateralAsset(loan.collateralAsset(), false);
+
+        assertTrue(!globals.isValidCollateralAsset(loan.collateralAsset()));
+
+        try pool.createDebtLocker(address(dlFactory), address(loan)) { assertTrue(false, "Able to create DL with invalid collateralAsset"); } catch { }
+
+        globals.setValidCollateralAsset(loan.collateralAsset(), true);
+
+        assertTrue(pool.createDebtLocker(address(dlFactory), address(loan)) != address(0));
+    }
+
+    function test_initialize_invalidLiquidityAsset() public {
+        loan = _createLoan(1_000_000);
+
+        assertTrue(globals.isValidLiquidityAsset(loan.fundsAsset()));
+
+        globals.setValidLiquidityAsset(loan.fundsAsset(), false);
+
+        assertTrue(!globals.isValidLiquidityAsset(loan.fundsAsset()));
+
+        try pool.createDebtLocker(address(dlFactory), address(loan)) { assertTrue(false, "Able to create DL with invalid fundsAsset"); } catch { }
+
+        globals.setValidLiquidityAsset(loan.fundsAsset(), true);
+
+        assertTrue(pool.createDebtLocker(address(dlFactory), address(loan)) != address(0));
+    }
+
     function test_liquidation_shortfall(uint256 principalRequested_, uint256 collateralRequired_) public {
 
         /**********************************/

contracts/test/mocks/Mocks.sol

@@ -72,6 +72,9 @@ contract MockGlobals {
 
     address public governor;
 
+    mapping(address => bool) public isValidCollateralAsset;
+    mapping(address => bool) public isValidLiquidityAsset;
+
     mapping(address => uint256) assetPrices;
 
     constructor (address governor_) {
@@ -98,4 +101,12 @@ contract MockGlobals {
         return address(1);
     }
 
+    function setValidCollateralAsset(address asset_, bool valid_) external {
+        isValidCollateralAsset[asset_] = valid_;
+    }
+
+    function setValidLiquidityAsset(address asset_, bool valid_) external {
+        isValidLiquidityAsset[asset_] = valid_;
+    }
+
 }