Repository navigation
feat: onboard PT-srUSDe-22OCT2026 to the LlamaRisk PT Risk Oracle on Ethereum Core - #1184
Conversation
…Ethereum Core Registers a discount rate agent and an eMode agent on MiscEthereum.AGENT_HUB, grants both RISK_ADMIN, and bounds every parameter step they can inject. The role grants are the part most easily missed. The discount agent resolves the PT price source through the Aave oracle and calls setDiscountRatePerYear on the PendlePriceCapAdapter, which gates on isRiskAdmin || isPoolAdmin. The eMode agent delegatecalls the config engine, and delegatecall preserves the caller, so the PoolConfigurator sees the agent rather than the engine and the role has to sit on the agent there too. The range configs are equally not optional. A freshly assigned agent id inherits no default config and the module reads a missing one as a zero bound, which rejects every injection, so omitting them would register two permanently inert agents. They are absolute rather than relative, because a relative cap is measured against a previous injection that a fresh id does not have. Agent ids are captured from registerAgent rather than assumed. agentCount++ decides them, anything registered between drafting and execution shifts them, and the range configs are keyed by them. The three LlamaRisk addresses are placeholders until the stack is deployed. Every Aave address comes from the address book. Update types are unsuffixed, matching agents built with an empty updateTypeSuffix against a RiskOracle dedicated to this stack. Tests assert registration fields, the agent context resolving to the current config engine, isRiskAdmin for both, and all four range configs. The snapshot diff is empty by design: the payload changes no reserve configuration.
Both agents were named as pre-deployed placeholder constants, which meant governance approved an address rather than the code behind it. The payload now constructs AaveDiscountRateAgent and AaveEModeAgent in execute() and registers what it just built, so the code reviewed is the code registered and there is no window in which a registered agent points at something the proposal did not deploy. aave-risk-agents is added as a submodule to compile them, pinned to the head of aave-dao/aave-risk-agents#6, which restores the isolated field that AaveEModeAgent must pass to the current config engine. That pull request has to merge, and this pin move to a commit on main, before submission. LLAMARISK_RISK_ORACLE is filled in with the deployed address, read back from mainnet: owner is the LlamaRisk multisig and its update types are PendleDiscountRateUpdate and EModeCategoryUpdate. It stays a constant because it is shared across every PT this instance onboards rather than being an artifact of this proposal.
There was a problem hiding this comment.
Please consider raising the required PRs in aave-address-book & aave-helpers and refactor this one accordingly, and build a Deploy Engine and Config Engine in the aave-risk-agents repo or local repo for reusability and consistency with the other processes.
🌈Test ResultsCompiling 514 files with Solc 0.8.28 Solc 0.8.28 finished in 190.85s Compiler run successful with warnings: Warning (2018): Function state mutability can be restricted to view --> lib/aave-helpers/src/dependencies/v4/Helpers.sol:42:3: | 42 | function _makeSigner() internal returns (uint256 privateKey, address signer) { | ^ (Relevant source part starts here and spans across multiple lines).Ran 7 tests for src/20260817_AaveV3Ethereum_Onboard_PTsrUSDe22OCT2026_Oracle/AaveV3Ethereum_Onboard_PTsrUSDe22OCT2026_Oracle_20260817.t.sol:AaveV3Ethereum_Onboard_PTsrUSDe22OCT2026_Oracle_20260817_Test [PASS] test_e2eAgentsInjectRiskOracleUpdates() (gas: 2111147) Ran 1 test suite in 185.40s (185.35s CPU time): 7 tests passed, 0 failed, 0 skipped (7 total tests) |
Registers both PT oracle agents with the protocol guardian as agent admin rather than the governance executor, so a misbehaving agent can be disabled without waiting on a governance cycle. The split holds because the AgentHub guards these separately: setAgentEnabled is onlyOwnerOrAgentAdmin, while registerAgent and setAgentAdmin stay onlyOwner. The guardian can therefore stop an agent but never register one or reassign the admin role. Note this also grants the guardian setDefaultRangeConfig on the RangeValidationModule, which shares the same modifier.
Replaces the placeholder URL in the payload header, the AIP write-up (frontmatter and references) and config.ts.
AgentHubAgentActivationPayload is generic, so it should not carry discount/eMode specific constants. The aliases were pure pass-throughs to AgentHubConfigs and only existed as a getter surface for the tests, which now read the library directly.
Both fail against the address book this branch pins, where UmbrellaEthereumAssets.STK_* is IUmbrellaStakeToken rather than address: - 20260701_AaveV3Ethereum_UmbrellaParameterUpdate...: implicit conversion to address (9553) - 20260720_Multi_RiskStewardsCooldownReduction...: no matching assertEq overload for the token type (9322), in the test file Removed rather than fixed, to keep this PR to the PT oracle onboarding. Both are already-executed proposals and neither is referenced elsewhere.
Context
This payload onboards PT-srUSDe-22OCT2026 to the LlamaRisk PT Risk Oracle system on Ethereum. It registers the predeployed Aave discount-rate and eMode agents in
MiscEthereum.AGENT_HUB, grants the permissions required to apply updates, and configures the maximum change accepted per injection.Both agents are verified deployments of the official
aave-dao/aave-risk-agentsimplementations. Their addresses, the LlamaRisk RiskOracle, and the Router are sourced from the Aave address book.Reusable update types, delays, expiration periods, and range limits are defined in
src/helpers/agent-hub/Configs.sol. Shared agent registration, role-granting, and range-configuration logic lives inAgentHubAgentActivationPayload.sol.Summary
AaveDiscountRateAgentandAaveEModeAgentsourced fromMiscEthereum.MiscEthereum.LLAMARISK_RISK_ORACLE, using the IDs returned byregisterAgentrather than predicting them.RISK_ADMIN.Payload actions
MiscEthereum.LLAMARISK_PT_DISCOUNT_RATE_AGENTforPendleDiscountRateUpdate, with PT-srUSDe-22OCT2026 as its only allowed market, a 2-day minimum delay, and a 2-day expiration period.MiscEthereum.LLAMARISK_PT_EMODE_AGENTforEModeCategoryUpdate, with eMode categories 47 and 48 as its only allowed markets, a 3-day minimum delay, a 3-day expiration period, andAaveV3Ethereum.CONFIG_ENGINEencoded as its context.RISK_ADMINthroughAaveV3Ethereum.ACL_MANAGER.MiscEthereum.RANGE_VALIDATION_MODULE:PendleDiscountRateUpdate1e16)EModeLTVEModeLiquidationThresholdEModeLiquidationBonusBoth registrations use
GovernanceV3Ethereum.EXECUTOR_LVL_1as agent admin. Agent IDs are captured fromregisterAgent, so registrations occurring before execution cannot cause the payload to configure the wrong agents.Agent compatibility
The predeployed
AaveEModeAgentsuppliesisolated: EngineFlags.KEEP_CURRENTwhen constructing the six-fieldEModeCategoryUpdateexpected by the live v3.7 ConfigEngine. This preserves the existing governance-configured isolation setting. The discount-rate agent is unaffected by the v3.7 change and callssetDiscountRatePerYeardirectly on the Pendle price-cap adapter.Address-book dependencies
The payload imports the RiskOracle and both predeployed agents from
MiscEthereum:LLAMARISK_RISK_ORACLE:0x683d1A91599F971252Ef171eF1F987172be8369ALLAMARISK_RISK_ORACLE_ROUTER:0x1D85000D54ea1185C43E4f2b32833524d3cF3507LLAMARISK_PT_DISCOUNT_RATE_AGENT:0x529e2374afB38AC465D71979E7540ad93C05F6c5LLAMARISK_PT_EMODE_AGENT:0xbe2840440d4f77CD98CEC2de09913e6851907744No LlamaRisk contract addresses are hardcoded in the payload. The Router is used by the tests to publish RiskOracle updates through the authorized production path.
Post-AIP activation
This payload does not deploy CRE workflows or register Router routes. After the AIP executes, LlamaRisk will use the agent IDs assigned by the AgentHub to deploy and connect the production workflows. These operational steps are outside the scope of this payload.
Test plan
Local mainnet-fork result: 7 passed, 0 failed.
The suite verifies:
RISK_ADMINgrants;The generated execution report is committed under
diffs/and records the expected AgentHub, ACL Manager, and RangeValidationModule changes.Refs aave-dao/aave-risk-agents#6
Refs aave-dao/aave-address-book#1527
Refs aave-dao/aave-helpers#789