Contract Address Details

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.26;

import {AccessControl} from "@openzeppelin/contracts/access/AccessControl.sol";
import {IPulseXPair} from "../interfaces/IProtocol.sol";

/// @title TwapOracle
/// @notice Time-weighted average price oracle over PulseX (Uniswap V2) cumulative prices.
/// @dev Bond pricing and router allocation both read TWAP, never spot. Spot is used
///      only as a sanity bound: if spot deviates from TWAP by more than
///      `maxDeviationBps`, consumers can reject the quote. That combination resists
///      both flash-loan manipulation (which moves spot, not a long TWAP) and stale
///      oracles (which `maxStaleness` rejects).
contract TwapOracle is AccessControl {
    bytes32 public constant UPDATER_ROLE = keccak256("UPDATER_ROLE");

    uint16 public constant BPS_DENOMINATOR = 10_000;

    struct Observation {
        uint256 price0Cumulative;
        uint256 price1Cumulative;
        uint32 timestamp;
        bool initialized;
    }

    /// @notice The newest observation for a pair. May be immature immediately after an
    ///         `update()`, in which case reads fall back to `previousObservations`.
    mapping(address => Observation) public observations;

    /// @notice The observation `update()` displaced. Always at least `minPeriod` older than
    ///         `observations[pair]`, because `update()` refuses to run any sooner.
    ///
    /// @dev THIS SLOT IS THE FIX. With one slot, `update()` reset the averaging window to
    ///      zero and the feed went dark for `minPeriod` - and since `update()`'s own rate
    ///      limit is also `minPeriod`, any caller could hold it dark indefinitely for the
    ///      price of one transaction per window.
    ///
    ///      Keeping the displaced observation means a fresh one never blanks the feed: it
    ///      queues behind a mature one. Availability then depends only on elapsed time,
    ///      which is the property `test/OracleAvailabilityInvariant.t.sol` pins.
    mapping(address => Observation) public previousObservations;

    /// @notice Minimum seconds between observations. Shorter windows are easier to manipulate.
    uint32 public minPeriod = 30 minutes;
    /// @notice An observation older than this is considered unusable.
    /// @notice Oldest observation `consult` will answer from.
    ///
    /// @dev WAS 24 HOURS, AND THAT IS UNUSABLE ONCE THE TWAP IS A TRADING FLOOR.
    ///
    ///      `consult` averages over the whole elapsed window, so a stale observation does
    ///      not merely risk being out of date - it produces a LONGER average, which lags
    ///      spot further in any trend. The router's floor budget is 2%, of which the
    ///      trade's own impact (1% cap) and the pool fee (0.29%) consume 1.29%, leaving
    ///      0.71% for the gap between spot and the average:
    ///
    ///        window   0.5%/h trend   1%/h    2%/h
    ///          30m        0.1%       0.2%    0.5%   <- inside budget
    ///           1h        0.2%       0.5%    1.0%
    ///           2h        0.5%       1.0%    2.0%
    ///          24h        6.0%      12.0%   24.0%   <- 3x the entire floor
    ///
    ///      Both directions hurt, differently. A falling market pushes spot below the
    ///      average and the legs stand down - safe, but the protocol stops buying exactly
    ///      when it is cheapest. A rising market leaves the floor BELOW spot by the lag,
    ///      and that gap is room a sandwicher can take while still clearing the floor.
    ///
    ///      Two hours is the backstop, not the operating point: with `update()` called
    ///      every `minPeriod` the window in use stays at 30-60 minutes, and this only
    ///      binds after three consecutive missed refreshes.
    uint32 public maxStaleness = 2 hours;
    /// @notice Maximum tolerated spot-vs-TWAP divergence before a quote is unsafe.
    uint16 public maxDeviationBps = 1_000; // 10%

    event ObservationUpdated(address indexed pair, uint256 price0Cumulative, uint256 price1Cumulative, uint32 timestamp);
    event OracleParamsUpdated(uint32 minPeriod, uint32 maxStaleness, uint16 maxDeviationBps);

    error PairNotInitialized(address pair);
    error PeriodNotElapsed(address pair, uint32 elapsed, uint32 required);
    error ObservationStale(address pair, uint32 age, uint32 maxAge);
    error NoLiquidity(address pair);
    error TokenNotInPair(address pair, address token);
    error InvalidParams();

    constructor(address admin) {
        if (admin == address(0)) revert InvalidParams();
        _grantRole(DEFAULT_ADMIN_ROLE, admin);
    }

    // --- Observation maintenance --------------------------------------------

    /// @notice Seed the first observation for a pair. Callable once per pair.
    function initialize(address pair) external {
        Observation storage obs = observations[pair];
        if (obs.initialized) return;

        (uint256 price0Cumulative, uint256 price1Cumulative, uint32 timestamp) = currentCumulativePrices(pair);
        obs.price0Cumulative = price0Cumulative;
        obs.price1Cumulative = price1Cumulative;
        obs.timestamp = timestamp;
        obs.initialized = true;

        emit ObservationUpdated(pair, price0Cumulative, price1Cumulative, timestamp);
    }

    /// @notice Roll the observation forward. Permissionless: anyone may keep the
    ///         oracle fresh, but `minPeriod` bounds how often it can be moved.
    function update(address pair) external {
        Observation storage obs = observations[pair];
        if (!obs.initialized) revert PairNotInitialized(pair);

        (uint256 price0Cumulative, uint256 price1Cumulative, uint32 timestamp) = currentCumulativePrices(pair);
        uint32 elapsed;
        unchecked {
            elapsed = timestamp - obs.timestamp; // wraps correctly on uint32 overflow
        }
        if (elapsed < minPeriod) revert PeriodNotElapsed(pair, elapsed, minPeriod);

        // Rotate, do not overwrite. The displaced observation is what keeps the feed
        // answering during the `minPeriod` the new one needs to mature.
        previousObservations[pair] = obs;

        obs.price0Cumulative = price0Cumulative;
        obs.price1Cumulative = price1Cumulative;
        obs.timestamp = timestamp;

        emit ObservationUpdated(pair, price0Cumulative, price1Cumulative, timestamp);
    }

    /// @notice The newest observation that has matured, which is what every read uses.
    ///
    /// @dev Prefers `observations[pair]` once it is at least `minPeriod` old, because a
    ///      more recent window is a tighter average. Falls back to the displaced one while
    ///      the newest is still maturing.
    ///
    ///      The fallback is guaranteed usable rather than merely likely: `update()` reverts
    ///      unless `minPeriod` has elapsed, so anything it displaces is by construction at
    ///      least that old. There is no state in which both slots are immature except
    ///      during the first `minPeriod` after `initialize()`, which is honest - nothing
    ///      has been observed for long enough to average yet.
    function _readable(address pair)
        private
        view
        returns (Observation storage obs, uint32 elapsed)
    {
        (,, uint32 timestamp) = currentCumulativePrices(pair);

        obs = observations[pair];
        unchecked {
            elapsed = timestamp - obs.timestamp;
        }
        if (elapsed >= minPeriod) return (obs, elapsed);

        Observation storage prev = previousObservations[pair];
        if (prev.initialized) {
            uint32 prevElapsed;
            unchecked {
                prevElapsed = timestamp - prev.timestamp;
            }
            if (prevElapsed >= minPeriod) return (prev, prevElapsed);
        }

        // Neither has matured. Return the newest so the caller's own floor/staleness
        // checks produce the accurate error rather than a misleading one.
        return (obs, elapsed);
    }

    // --- Quotes -------------------------------------------------------------

    /// @notice TWAP quote: how much of the other token `amountIn` of `tokenIn` is worth.
    /// @dev Reverts if the observation is missing or stale.
    function consult(address pair, address tokenIn, uint256 amountIn) public view returns (uint256 amountOut) {
        if (!observations[pair].initialized) revert PairNotInitialized(pair);

        (uint256 price0Cumulative, uint256 price1Cumulative,) = currentCumulativePrices(pair);

        // The newest MATURE observation, not simply the newest. See `_readable`.
        (Observation storage obs, uint32 elapsed) = _readable(pair);
        // The averaging window must be at least minPeriod, not merely non-zero.
        //
        // A TWAP is only manipulation-resistant in proportion to the time it averages
        // over. An earlier revision rejected only elapsed == 0, so a one-second-old
        // observation produced a one-second average - spot price wearing a TWAP label.
        // Worse, isQuoteSafe compares spot against that same near-spot average, so the
        // deviation guard endorsed the manipulated number instead of rejecting it.
        //
        // This is NOT specific to initialize(). The exposure recurred after every
        // update(), which is permissionless, so any caller could reset the window and
        // read a manipulated price one block later. Enforcing the floor here fixes both
        // at the read side, where the actual decision is made.
        if (elapsed < minPeriod) revert PeriodNotElapsed(pair, elapsed, minPeriod);
        if (elapsed > maxStaleness) revert ObservationStale(pair, elapsed, maxStaleness);

        address token0 = IPulseXPair(pair).token0();
        address token1 = IPulseXPair(pair).token1();

        uint256 priceAverage;
        if (tokenIn == token0) {
            unchecked {
                priceAverage = (price0Cumulative - obs.price0Cumulative) / elapsed;
            }
        } else if (tokenIn == token1) {
            unchecked {
                priceAverage = (price1Cumulative - obs.price1Cumulative) / elapsed;
            }
        } else {
            revert TokenNotInPair(pair, tokenIn);
        }

        // priceAverage is UQ112x112; shift back down after multiplying.
        amountOut = (priceAverage * amountIn) >> 112;
    }

    /// @notice Current spot quote straight from reserves, for the deviation guard only.
    function spotQuote(address pair, address tokenIn, uint256 amountIn) public view returns (uint256) {
        (uint112 reserve0, uint112 reserve1,) = IPulseXPair(pair).getReserves();
        if (reserve0 == 0 || reserve1 == 0) revert NoLiquidity(pair);

        address token0 = IPulseXPair(pair).token0();
        address token1 = IPulseXPair(pair).token1();

        if (tokenIn == token0) {
            return (amountIn * reserve1) / reserve0;
        } else if (tokenIn == token1) {
            return (amountIn * reserve0) / reserve1;
        }
        revert TokenNotInPair(pair, tokenIn);
    }

    /// @notice True when spot sits within `maxDeviationBps` of the TWAP.
    /// @dev Consumers should treat `false` as "do not trade right now".
    function isQuoteSafe(address pair, address tokenIn, uint256 amountIn) external view returns (bool) {
        uint256 twap = consult(pair, tokenIn, amountIn);
        if (twap == 0) return false;

        uint256 spot = spotQuote(pair, tokenIn, amountIn);
        uint256 diff = spot > twap ? spot - twap : twap - spot;
        return (diff * BPS_DENOMINATOR) / twap <= maxDeviationBps;
    }

    /// @notice Seconds until the observation `consult` reads is `minPeriod` old, or 0 once
    ///         it is. Reverts only if the pair was never initialized.
    ///
    ///         0 does not mean `consult` answers - `isQuotable` says that. Past
    ///         `maxStaleness` this reads 0 too: while nobody refreshes, and for up to
    ///         `minPeriod` after a refresh that came too late, when the observation it
    ///         displaced is the readable one. In the second case the wait is what remains
    ///         of `minPeriod` on `observations(pair)`; in the first, only `update()` starts it.
    /// @dev A quote refusal during an immature window is a safety behaviour, but it
    ///      reaches a user as a revert, which is indistinguishable from a broken
    ///      contract. This lets a caller render "try again in N seconds" instead, so
    ///      nobody is tempted to "fix" the safety behaviour later. Read it together with
    ///      `isQuotable`, as `scripts/lib/oracle-state.js` does.
    function secondsUntilQuotable(address pair) external view returns (uint256) {
        if (!observations[pair].initialized) revert PairNotInitialized(pair);

        // Must agree with `consult`, which reads the newest MATURE observation. Reading
        // the raw newest slot here would report a wait that consult does not actually
        // impose - the reporting bug that hides the fix rather than the defect.
        (, uint32 elapsed) = _readable(pair);
        return elapsed >= minPeriod ? 0 : minPeriod - elapsed;
    }

    /// @notice True when `consult` would answer for this pair right now.
    function isQuotable(address pair) external view returns (bool) {
        if (!observations[pair].initialized) return false;

        // Same source of truth as `consult`. These two disagreeing is how a monitor
        // reports a healthy feed that cannot answer, or a dark feed that can.
        (, uint32 elapsed) = _readable(pair);
        return elapsed >= minPeriod && elapsed <= maxStaleness;
    }

    // --- Cumulative price reader --------------------------------------------

    /// @notice Cumulative prices brought forward to `block.timestamp`.
    /// @dev Mirrors UniswapV2OracleLibrary: the pair only writes cumulatives on sync,
    ///      so the elapsed-since-sync portion must be added in by the reader.
    function currentCumulativePrices(address pair)
        public
        view
        returns (uint256 price0Cumulative, uint256 price1Cumulative, uint32 blockTimestamp)
    {
        blockTimestamp = uint32(block.timestamp % 2 ** 32);
        price0Cumulative = IPulseXPair(pair).price0CumulativeLast();
        price1Cumulative = IPulseXPair(pair).price1CumulativeLast();

        (uint112 reserve0, uint112 reserve1, uint32 blockTimestampLast) = IPulseXPair(pair).getReserves();
        if (reserve0 == 0 || reserve1 == 0) revert NoLiquidity(pair);

        if (blockTimestampLast != blockTimestamp) {
            uint32 timeElapsed;
            unchecked {
                timeElapsed = blockTimestamp - blockTimestampLast;
                price0Cumulative += uint256(_encodeDiv(reserve1, reserve0)) * timeElapsed;
                price1Cumulative += uint256(_encodeDiv(reserve0, reserve1)) * timeElapsed;
            }
        }
    }

    /// @dev UQ112x112 encode-then-divide: (numerator << 112) / denominator.
    function _encodeDiv(uint112 numerator, uint112 denominator) private pure returns (uint224) {
        return uint224((uint224(numerator) << 112) / denominator);
    }

    // --- Governance ---------------------------------------------------------

    function setParams(uint32 minPeriod_, uint32 maxStaleness_, uint16 maxDeviationBps_)
        external
        onlyRole(DEFAULT_ADMIN_ROLE)
    {
        if (minPeriod_ == 0 || maxStaleness_ < minPeriod_ || maxDeviationBps_ > BPS_DENOMINATOR) {
            revert InvalidParams();
        }
        minPeriod = minPeriod_;
        maxStaleness = maxStaleness_;
        maxDeviationBps = maxDeviationBps_;
        emit OracleParamsUpdated(minPeriod_, maxStaleness_, maxDeviationBps_);
    }
}
        

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.26;

/// @notice Minimal PulseX (Uniswap V2) surface used across the protocol.
interface IPulseXFactory {
    function getPair(address tokenA, address tokenB) external view returns (address pair);
    function createPair(address tokenA, address tokenB) external returns (address pair);
}

interface IPulseXPair {
    function token0() external view returns (address);
    function token1() external view returns (address);
    function getReserves() external view returns (uint112 reserve0, uint112 reserve1, uint32 blockTimestampLast);
    function price0CumulativeLast() external view returns (uint256);
    function price1CumulativeLast() external view returns (uint256);
    function totalSupply() external view returns (uint256);
    /// @dev A V2 pair is itself the LP ERC-20, so holdings are read from the pair.
    function balanceOf(address account) external view returns (uint256);
}

interface IPulseXRouter {
    function factory() external view returns (address);
    function swapExactTokensForTokensSupportingFeeOnTransferTokens(
        uint256 amountIn,
        uint256 amountOutMin,
        address[] calldata path,
        address to,
        uint256 deadline
    ) external;
    function addLiquidity(
        address tokenA,
        address tokenB,
        uint256 amountADesired,
        uint256 amountBDesired,
        uint256 amountAMin,
        uint256 amountBMin,
        address to,
        uint256 deadline
    ) external returns (uint256 amountA, uint256 amountB, uint256 liquidity);
    function getAmountsOut(uint256 amountIn, address[] calldata path) external view returns (uint256[] memory amounts);
}

/// @notice Burnable subset of PBURN used by the router and the credit ledger.
interface IBurnable {
    function burn(uint256 amount) external;
    function totalSupply() external view returns (uint256);
}

/// @notice Credit accrual hook. Only protocol contracts may call the granting functions.
interface IBurnCreditLedger {
    function creditsOf(address account) external view returns (uint256);
    function feeDiscountBps(address account) external view returns (uint16);
    function grantForBurn(address account, uint256 burnedAmount) external;
    function grantForBond(address account, uint256 lpValue) external;
    function grantForGovernance(address account, uint256 weight) external;
}

/// @notice Read-only composite treasury health score consumed by the router.
interface ITSI {
    /// @return score Composite score in basis points (0..10000).
    function score() external view returns (uint256);
    function components()
        external
        view
        returns (uint256 treasuryValue, uint256 polValue, uint256 burnRate, uint256 liquidityDepth, uint256 supplyTrend);
}

/// @notice Treasury deposit surface used by the router and bonding vault.
interface ITreasury {
    function recordDeposit(address asset, uint256 amount) external;
    function recordLpDeposit(address pair, uint256 amount) external;
}

/// @notice Epoch parameter presets consumed by the router.
interface IEpoch {
    enum Phase {
        Bootstrapping,
        AcceleratedBurn,
        GovernanceAndGrowth,
        Sustainability
    }

    function currentPhase() external view returns (Phase);
    function allocation() external view returns (uint16 pburnBurnBps, uint16 pflyBurnBps, uint16 polBps, uint16 treasuryBps);
}
          

// SPDX-License-Identifier: MIT
// OpenZeppelin Contracts (last updated v5.1.0) (access/IAccessControl.sol)

pragma solidity ^0.8.20;

/**
 * @dev External interface of AccessControl declared to support ERC-165 detection.
 */
interface IAccessControl {
    /**
     * @dev The `account` is missing a role.
     */
    error AccessControlUnauthorizedAccount(address account, bytes32 neededRole);

    /**
     * @dev The caller of a function is not the expected one.
     *
     * NOTE: Don't confuse with {AccessControlUnauthorizedAccount}.
     */
    error AccessControlBadConfirmation();

    /**
     * @dev Emitted when `newAdminRole` is set as ``role``'s admin role, replacing `previousAdminRole`
     *
     * `DEFAULT_ADMIN_ROLE` is the starting admin for all roles, despite
     * {RoleAdminChanged} not being emitted signaling this.
     */
    event RoleAdminChanged(bytes32 indexed role, bytes32 indexed previousAdminRole, bytes32 indexed newAdminRole);

    /**
     * @dev Emitted when `account` is granted `role`.
     *
     * `sender` is the account that originated the contract call. This account bears the admin role (for the granted role).
     * Expected in cases where the role was granted using the internal {AccessControl-_grantRole}.
     */
    event RoleGranted(bytes32 indexed role, address indexed account, address indexed sender);

    /**
     * @dev Emitted when `account` is revoked `role`.
     *
     * `sender` is the account that originated the contract call:
     *   - if using `revokeRole`, it is the admin role bearer
     *   - if using `renounceRole`, it is the role bearer (i.e. `account`)
     */
    event RoleRevoked(bytes32 indexed role, address indexed account, address indexed sender);

    /**
     * @dev Returns `true` if `account` has been granted `role`.
     */
    function hasRole(bytes32 role, address account) external view returns (bool);

    /**
     * @dev Returns the admin role that controls `role`. See {grantRole} and
     * {revokeRole}.
     *
     * To change a role's admin, use {AccessControl-_setRoleAdmin}.
     */
    function getRoleAdmin(bytes32 role) external view returns (bytes32);

    /**
     * @dev Grants `role` to `account`.
     *
     * If `account` had not been already granted `role`, emits a {RoleGranted}
     * event.
     *
     * Requirements:
     *
     * - the caller must have ``role``'s admin role.
     */
    function grantRole(bytes32 role, address account) external;

    /**
     * @dev Revokes `role` from `account`.
     *
     * If `account` had been granted `role`, emits a {RoleRevoked} event.
     *
     * Requirements:
     *
     * - the caller must have ``role``'s admin role.
     */
    function revokeRole(bytes32 role, address account) external;

    /**
     * @dev Revokes `role` from the calling account.
     *
     * Roles are often managed via {grantRole} and {revokeRole}: this function's
     * purpose is to provide a mechanism for accounts to lose their privileges
     * if they are compromised (such as when a trusted device is misplaced).
     *
     * If the calling account had been granted `role`, emits a {RoleRevoked}
     * event.
     *
     * Requirements:
     *
     * - the caller must be `callerConfirmation`.
     */
    function renounceRole(bytes32 role, address callerConfirmation) external;
}
          

// SPDX-License-Identifier: MIT
// OpenZeppelin Contracts (last updated v5.0.1) (utils/Context.sol)

pragma solidity ^0.8.20;

/**
 * @dev Provides information about the current execution context, including the
 * sender of the transaction and its data. While these are generally available
 * via msg.sender and msg.data, they should not be accessed in such a direct
 * manner, since when dealing with meta-transactions the account sending and
 * paying for execution may not be the actual sender (as far as an application
 * is concerned).
 *
 * This contract is only required for intermediate, library-like contracts.
 */
abstract contract Context {
    function _msgSender() internal view virtual returns (address) {
        return msg.sender;
    }

    function _msgData() internal view virtual returns (bytes calldata) {
        return msg.data;
    }

    function _contextSuffixLength() internal view virtual returns (uint256) {
        return 0;
    }
}
          

// SPDX-License-Identifier: MIT
// OpenZeppelin Contracts (last updated v5.1.0) (utils/introspection/ERC165.sol)

pragma solidity ^0.8.20;

import {IERC165} from "./IERC165.sol";

/**
 * @dev Implementation of the {IERC165} interface.
 *
 * Contracts that want to implement ERC-165 should inherit from this contract and override {supportsInterface} to check
 * for the additional interface id that will be supported. For example:
 *
 * ```solidity
 * function supportsInterface(bytes4 interfaceId) public view virtual override returns (bool) {
 *     return interfaceId == type(MyInterface).interfaceId || super.supportsInterface(interfaceId);
 * }
 * ```
 */
abstract contract ERC165 is IERC165 {
    /**
     * @dev See {IERC165-supportsInterface}.
     */
    function supportsInterface(bytes4 interfaceId) public view virtual returns (bool) {
        return interfaceId == type(IERC165).interfaceId;
    }
}
          

// SPDX-License-Identifier: MIT
// OpenZeppelin Contracts (last updated v5.1.0) (utils/introspection/IERC165.sol)

pragma solidity ^0.8.20;

/**
 * @dev Interface of the ERC-165 standard, as defined in the
 * https://eips.ethereum.org/EIPS/eip-165[ERC].
 *
 * Implementers can declare support of contract interfaces, which can then be
 * queried by others ({ERC165Checker}).
 *
 * For an implementation, see {ERC165}.
 */
interface IERC165 {
    /**
     * @dev Returns true if this contract implements the interface defined by
     * `interfaceId`. See the corresponding
     * https://eips.ethereum.org/EIPS/eip-165#how-interfaces-are-identified[ERC section]
     * to learn more about how these ids are created.
     *
     * This function call must use less than 30 000 gas.
     */
    function supportsInterface(bytes4 interfaceId) external view returns (bool);
}
          

// SPDX-License-Identifier: MIT
// OpenZeppelin Contracts (last updated v5.0.0) (access/AccessControl.sol)

pragma solidity ^0.8.20;

import {IAccessControl} from "./IAccessControl.sol";
import {Context} from "../utils/Context.sol";
import {ERC165} from "../utils/introspection/ERC165.sol";

/**
 * @dev Contract module that allows children to implement role-based access
 * control mechanisms. This is a lightweight version that doesn't allow enumerating role
 * members except through off-chain means by accessing the contract event logs. Some
 * applications may benefit from on-chain enumerability, for those cases see
 * {AccessControlEnumerable}.
 *
 * Roles are referred to by their `bytes32` identifier. These should be exposed
 * in the external API and be unique. The best way to achieve this is by
 * using `public constant` hash digests:
 *
 * ```solidity
 * bytes32 public constant MY_ROLE = keccak256("MY_ROLE");
 * ```
 *
 * Roles can be used to represent a set of permissions. To restrict access to a
 * function call, use {hasRole}:
 *
 * ```solidity
 * function foo() public {
 *     require(hasRole(MY_ROLE, msg.sender));
 *     ...
 * }
 * ```
 *
 * Roles can be granted and revoked dynamically via the {grantRole} and
 * {revokeRole} functions. Each role has an associated admin role, and only
 * accounts that have a role's admin role can call {grantRole} and {revokeRole}.
 *
 * By default, the admin role for all roles is `DEFAULT_ADMIN_ROLE`, which means
 * that only accounts with this role will be able to grant or revoke other
 * roles. More complex role relationships can be created by using
 * {_setRoleAdmin}.
 *
 * WARNING: The `DEFAULT_ADMIN_ROLE` is also its own admin: it has permission to
 * grant and revoke this role. Extra precautions should be taken to secure
 * accounts that have been granted it. We recommend using {AccessControlDefaultAdminRules}
 * to enforce additional security measures for this role.
 */
abstract contract AccessControl is Context, IAccessControl, ERC165 {
    struct RoleData {
        mapping(address account => bool) hasRole;
        bytes32 adminRole;
    }

    mapping(bytes32 role => RoleData) private _roles;

    bytes32 public constant DEFAULT_ADMIN_ROLE = 0x00;

    /**
     * @dev Modifier that checks that an account has a specific role. Reverts
     * with an {AccessControlUnauthorizedAccount} error including the required role.
     */
    modifier onlyRole(bytes32 role) {
        _checkRole(role);
        _;
    }

    /**
     * @dev See {IERC165-supportsInterface}.
     */
    function supportsInterface(bytes4 interfaceId) public view virtual override returns (bool) {
        return interfaceId == type(IAccessControl).interfaceId || super.supportsInterface(interfaceId);
    }

    /**
     * @dev Returns `true` if `account` has been granted `role`.
     */
    function hasRole(bytes32 role, address account) public view virtual returns (bool) {
        return _roles[role].hasRole[account];
    }

    /**
     * @dev Reverts with an {AccessControlUnauthorizedAccount} error if `_msgSender()`
     * is missing `role`. Overriding this function changes the behavior of the {onlyRole} modifier.
     */
    function _checkRole(bytes32 role) internal view virtual {
        _checkRole(role, _msgSender());
    }

    /**
     * @dev Reverts with an {AccessControlUnauthorizedAccount} error if `account`
     * is missing `role`.
     */
    function _checkRole(bytes32 role, address account) internal view virtual {
        if (!hasRole(role, account)) {
            revert AccessControlUnauthorizedAccount(account, role);
        }
    }

    /**
     * @dev Returns the admin role that controls `role`. See {grantRole} and
     * {revokeRole}.
     *
     * To change a role's admin, use {_setRoleAdmin}.
     */
    function getRoleAdmin(bytes32 role) public view virtual returns (bytes32) {
        return _roles[role].adminRole;
    }

    /**
     * @dev Grants `role` to `account`.
     *
     * If `account` had not been already granted `role`, emits a {RoleGranted}
     * event.
     *
     * Requirements:
     *
     * - the caller must have ``role``'s admin role.
     *
     * May emit a {RoleGranted} event.
     */
    function grantRole(bytes32 role, address account) public virtual onlyRole(getRoleAdmin(role)) {
        _grantRole(role, account);
    }

    /**
     * @dev Revokes `role` from `account`.
     *
     * If `account` had been granted `role`, emits a {RoleRevoked} event.
     *
     * Requirements:
     *
     * - the caller must have ``role``'s admin role.
     *
     * May emit a {RoleRevoked} event.
     */
    function revokeRole(bytes32 role, address account) public virtual onlyRole(getRoleAdmin(role)) {
        _revokeRole(role, account);
    }

    /**
     * @dev Revokes `role` from the calling account.
     *
     * Roles are often managed via {grantRole} and {revokeRole}: this function's
     * purpose is to provide a mechanism for accounts to lose their privileges
     * if they are compromised (such as when a trusted device is misplaced).
     *
     * If the calling account had been revoked `role`, emits a {RoleRevoked}
     * event.
     *
     * Requirements:
     *
     * - the caller must be `callerConfirmation`.
     *
     * May emit a {RoleRevoked} event.
     */
    function renounceRole(bytes32 role, address callerConfirmation) public virtual {
        if (callerConfirmation != _msgSender()) {
            revert AccessControlBadConfirmation();
        }

        _revokeRole(role, callerConfirmation);
    }

    /**
     * @dev Sets `adminRole` as ``role``'s admin role.
     *
     * Emits a {RoleAdminChanged} event.
     */
    function _setRoleAdmin(bytes32 role, bytes32 adminRole) internal virtual {
        bytes32 previousAdminRole = getRoleAdmin(role);
        _roles[role].adminRole = adminRole;
        emit RoleAdminChanged(role, previousAdminRole, adminRole);
    }

    /**
     * @dev Attempts to grant `role` to `account` and returns a boolean indicating if `role` was granted.
     *
     * Internal function without access restriction.
     *
     * May emit a {RoleGranted} event.
     */
    function _grantRole(bytes32 role, address account) internal virtual returns (bool) {
        if (!hasRole(role, account)) {
            _roles[role].hasRole[account] = true;
            emit RoleGranted(role, account, _msgSender());
            return true;
        } else {
            return false;
        }
    }

    /**
     * @dev Attempts to revoke `role` to `account` and returns a boolean indicating if `role` was revoked.
     *
     * Internal function without access restriction.
     *
     * May emit a {RoleRevoked} event.
     */
    function _revokeRole(bytes32 role, address account) internal virtual returns (bool) {
        if (hasRole(role, account)) {
            _roles[role].hasRole[account] = false;
            emit RoleRevoked(role, account, _msgSender());
            return true;
        } else {
            return false;
        }
    }
}