Feat/p3 fee router

[robertocarlous]

P3 fees & treasury — implementation summary (#43)

What was built

New contracts

• DinTreasury.sol — upgradeable custodial contract that holds ETH and ERC20 tokens on behalf of the protocol. Receives ETH via receive(), supports partial-amount withdrawETH and withdrawERC20 (SafeERC20). Owner-controlled, reentrancy-guarded, __gap[50].

• DinFeeRouter.sol — single router that splits incoming fees across five named buckets in basis points, summing to 10 000. Handles two assets independently:

  • DIN fees — DinSplit { validatorPoolBps, treasuryBps, burnBps, storageBps, publicGoodsBps }. Pulls DIN via transferFrom, burns the burn slice, transfers the treasury slice to DinTreasury, and accrues the rest into on-contract mappings (accruedDin) for future settlement.
  • ETH fees — EthSplit { validatorPoolBps, treasuryBps, storageBps, publicGoodsBps }. No burn field — ETH burn is impossible by design (compile-time, not a runtime check). Forwards the treasury slice to DinTreasury, accrues the rest into accruedEth.
  • Default split at deploy: 95 % validator pool / 5 % treasury on both assets. Burn starts at 0 % (hook exists, off by default). storageBps and publicGoodsBps reserved at 0 (RES-1 / public-goods slot).
  • Treasury ceiling hard-capped at 20 % (treasuryBpsCeiling), DAO-settable downward.
  • onlyFeeSource allowlist — only registered contracts (addFeeSource / removeFeeSource) can call routing functions.

Modified contracts

• DinToken.sol — added burn(uint256 amount) (self-burn, no role required) and TokensBurned event. Required by DinFeeRouter to execute the burn slice of DIN fees.

• DinCoordinator.sol — withdraw() now sends the contract's full ETH balance to the configured treasury address instead of owner(). New setTreasury(address) setter and TreasuryNotSet guard. ETH continues to accumulate in the coordinator on every depositAndMint call (no per-deposit forwarding). One new storage slot; __gap reduced from [50] → [49].

• DINModelRegistry.sol — parallel DIN fee rail added alongside the existing ETH rail:

  • requestModelRegistrationDIN(bytes32, address, address, bool) — same slasher/ownership validation as the ETH path; fee pulled from caller via feeRouter.routeFeeDIN; flags modelRequestPaidInDIN[requestId] = true.
  • requestManifestUpdateDIN(uint256, bytes32) — same pattern for manifest updates; flags manifestRequestPaidInDIN[reqId] = true.
  • ETH path (requestModelRegistration / requestManifestUpdate) — unchanged signatures, now routes msg.value through feeRouter.routeFeeETH when a router is wired; falls back to the existing withdrawFees() balance when it is not (backward-compatible).
  • New state: dinToken, feeRouter, four DIN fee amounts (openSourceFeeDIN, proprietaryFeeDIN, openSourceUpdateFeeDIN, proprietaryUpdateFeeDIN), two payment-flag mappings. __gap reduced from [50] → [42].

Deploy script & fixtures

• DeployPlatform.s.sol — updated to the 13-step wiring order: deploy treasury → token → coordinator → wire token → set treasury on coordinator → deploy fee router → deploy stake → wire stake → deploy registry → set DIN token on registry → set fee router on registry → add registry as fee source → set DIN fees.
• DeployPlatform.t.sol — _deployPlatform() rewritten to the same 13-step order; new ProxyWiringTest assertions for every new wired address; new ReInitializerProtectionTest entries for DinTreasury and DinFeeRouter.
• SecurityFindings.t.sol — _deployPlatform() split into four private helpers to stay under the Yul stack-depth limit while incorporating the new wiring.
• UpgradeValidation.t.sol — extended with test_validateImplementation_DinTreasury and test_validateImplementation_DinFeeRouter.

---

Test coverage

File | Tests -- | -- DinTreasury.t.sol | 11 DinFeeRouter.t.sol | 21 (incl. split-sum fuzz + no-ETH-burn invariant) DinToken.t.sol | 6 DinCoordinator.t.sol | 7 DINModelRegistry.t.sol | 11 Total | 56 new · 109 suite total · 0 failed

[robertocarlous]

Hi @umeradl

Pls can you review this, Thank you