CYS3-03: DEX Quotes Are A Single Point Of Failure For Claim Settlement

.env.example

@@ -52,7 +52,7 @@ STAKE_MANAGER=
 SLASHING_MANAGER=
 REWARDS_MANAGER=
 SSP_ROUTER=
-CHAINLINK_PRICE_FEED=
+ORACLE_PRICE_FEED=
 
 # ── Token addresses ───────────────────────────────────────────
 COLLATERAL_TOKEN=                    # EigenLayer strategy underlying (e.g. wstETH)

.env.fork

@@ -27,7 +27,7 @@ QUOTE_SIGNER_PRIVATE_KEY=0x7c852118294e51e653712a81e05800f419141751be58f605c371e
 PAYOUT_TOKEN=0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2
 
 # ── Live Catalysis Core contracts (Ethereum mainnet — docs/deployment/Ethereum-Mainnet.md) ─
-CHAINLINK_PRICE_FEED=0x57F750E3B8e095A5b3AE96030F0cac5dFe2f8A16
+ORACLE_PRICE_FEED=0x57F750E3B8e095A5b3AE96030F0cac5dFe2f8A16
 STAKE_MANAGER=0x5be5220F81e76e0CF6089fb7E7aE9eF48a8D64Be
 REWARDS_MANAGER=0x8ae0F0B94fe782D7F055B04d4699c3cc01632b46
 SLASHING_MANAGER=0x7Bc39bf135eF3c30E542C196719c91455ff489f0

.github/workflows/ci.yml

@@ -81,7 +81,7 @@ jobs:
           SLASHING_MANAGER: "0x0000000000000000000000000000000000000002"
           STAKE_MANAGER: "0x0000000000000000000000000000000000000003"
           REWARDS_MANAGER: "0x0000000000000000000000000000000000000004"
-          CHAINLINK_PRICE_FEED: "0x0000000000000000000000000000000000000005"
+          ORACLE_PRICE_FEED: "0x0000000000000000000000000000000000000005"
         run: make deploy-anvil
 
       - name: Generate coverage report

AGENTS.md

@@ -22,7 +22,7 @@ Coverage contracts live in `src/`. Tests in `test/unit`, `test/fuzz`, and `test/
 
 ### Interfaces (`src/interfaces/`)
 
-Interfaces mirror each core contract (`ICoverPool`, `IClaimManager`, `ISpecRegistry`, etc.) plus external Catalysis Core dependencies (`ISlashingManager`, `IRewardsManager`, `IChainlinkPriceFeed`, `IStakeManager`). Additional interfaces cover hook callbacks (`IBindPolicyHook`), swap adapter patterns (`IQuotableAdapter`, `IQuoterV2`), evaluation logic (`ISpec`), and token wrappers (`IWETH`).
+Interfaces mirror each core contract (`ICoverPool`, `IClaimManager`, `ISpecRegistry`, etc.) plus external Catalysis Core dependencies (`ISlashingManager`, `IRewardsManager`, `IOraclePriceFeed`, `IStakeManager`). Additional interfaces cover hook callbacks (`IBindPolicyHook`), swap adapter patterns (`IQuotableAdapter`, `IQuoterV2`), evaluation logic (`ISpec`), and token wrappers (`IWETH`).
 
 ### Swappers (`src/swappers/`)
 
@@ -127,7 +127,7 @@ All network deployments extend `Deploy.s.sol`. The base script deploys contracts
 **All deployments:**
 - `PRIVATE_KEY` – deployer key
 - Network-specific RPC: `SEPOLIA_RPC_URL`, `ETHEREUM_RPC_URL`
-- Catalysis Core addresses: `NATIVE_WRAPPER`, `CHAINLINK_PRICE_FEED`, `SLASHING_MANAGER`, `STAKE_MANAGER`, `REWARDS_MANAGER`
+- Catalysis Core addresses: `NATIVE_WRAPPER`, `ORACLE_PRICE_FEED`, `SLASHING_MANAGER`, `STAKE_MANAGER`, `REWARDS_MANAGER`
 
 **Optional role overrides** (default to deployer/admin):
 - `ADMIN`, `PLATFORM_TREASURY`, `COVER_POOL_FACTORY_CREATOR`, `SWAP_MANAGER`, `PLATFORM_FEE_BPS`

README.md

@@ -34,7 +34,7 @@ External dependencies from Catalysis Core:
 | `SlashingManager` | Collateral slashing execution across restaking networks. |
 | `StakeManager` | Manages restaker stake and delegation. |
 | `RewardsManager` | Distributes rewards to restakers. |
-| `ChainlinkPriceFeed` | Converts token amounts to USD values for slashing calculations. |
+| `OraclePriceFeed` | Converts token amounts to USD values for slashing calculations. |
 
 ### Swappers (`src/swappers/`)
 
@@ -169,7 +169,7 @@ See [`.env.example`](.env.example) for all variables with inline documentation.
 | Variable | Description |
 |----------|-------------|
 | `NATIVE_WRAPPER` | WETH or equivalent native token wrapper |
-| `CHAINLINK_PRICE_FEED` | ChainlinkPriceFeed contract |
+| `ORACLE_PRICE_FEED` | OraclePriceFeed contract |
 | `SLASHING_MANAGER` | SlashingManager from Catalysis Core |
 | `STAKE_MANAGER` | StakeManager from Catalysis Core |
 | `REWARDS_MANAGER` | RewardsManager from Catalysis Core |

docs/architecture/01-system-overview.md

@@ -61,7 +61,7 @@ graph TB
         SM[StakeManager]
         RM[RewardsManager]
         SLM[SlashingManager]
-        PF[ChainlinkPriceFeed]
+        PF[OraclePriceFeed]
     end
 
     subgraph Restaking

docs/architecture/02-smart-contracts.md

@@ -19,7 +19,7 @@ graph LR
     SW[Swapper]
     UV3[UniswapV3Adapter]
     CVW[CoveredVaultWrapper]
-    PF[ChainlinkPriceFeed]
+    PF[OraclePriceFeed]
 
     CPF --> CP
     PM --> CP
@@ -193,7 +193,7 @@ Note: `PolicyManager` stores a `claimManager` address for reference but does **n
    - otherwise: swap through `Swapper` using `quoteSwap`-derived `amountOutMin`; surplus forwarded similarly.
    - Surplus routing is wrapped in a `try`/`catch`; failures emit `SwapSurplusDistributionFailed` and leave tokens in the contract for recovery via `recoverTokens`.
 
-No USD conversion or `ChainlinkPriceFeed` is used in the claim execution path.
+No USD conversion or `OraclePriceFeed` is used in the claim execution path.
 
 ### 6) SpecRegistry
 
@@ -309,7 +309,7 @@ Coverage contracts rely on Core interfaces:
 - `IStakeManager` for committee create/operator/vault and stake reads,
 - `IRewardsManager` for reward fan-out trigger,
 - `ISlashingManager` for committee slashing execution,
-- `IChainlinkPriceFeed` for stake-to-USD conversion at bind time (stake sufficiency check in `PolicyManager`).
+- `IOraclePriceFeed` for stake-to-USD conversion at bind time (stake sufficiency check in `PolicyManager`).
 
 ## Next Steps
 

docs/architecture/03-core-integration.md

@@ -19,7 +19,7 @@ This separation keeps restaking platform complexity out of Coverage contracts.
 | `CoverPool` | `StakeManager` | `setCommitteeVaults(policyId, vaults[], coverageLimit)` | Bind selected vaults/strategies; configures TVL limits on EigenLayer vaults |
 | `PolicyManager` | `StakeManager` | `getCommitteeVaults(policyId)` | Verify vault backing exists before bind finalization |
 | `PolicyManager` | `StakeManager` | `getCommitteeTokenStakes(policyId)` | Retrieve per-vault token-native stake amounts for USD sufficiency check |
-| `PolicyManager` | `ChainlinkPriceFeed` | `getUSDValue(token, amount)` | Convert `coverageLimit` and committee token stakes to USD for bind-time sufficiency check |
+| `PolicyManager` | `OraclePriceFeed` | `getUSDValue(token, amount)` | Convert `coverageLimit` and committee token stakes to USD for bind-time sufficiency check |
 | `PremiumManager` | `RewardsManager` | `distributeRewards(policyId, operator, amount, token, taskId)` | Trigger Core reward fan-out; RewardsManager pulls restaker share from PremiumManager, then routes via SSPRouter |
 | `ClaimManager` | `SlashingManager` | `previewSlashing(committeeId, operator)` | Read per-vault token-native stake amounts before executing |
 | `ClaimManager` | `SlashingManager` | `executeSlashing(committeeId, operator, VaultSlash[], taskId)` | Execute token-native per-vault slashing and return seized collateral |
@@ -81,7 +81,7 @@ Sequence:
    - `SSPRouter._configureEigenStrategies` runs internally: adds strategies to operator set, sets TVL limits (converting `coverageLimit` USD to token-native amounts), and locks duration vaults.
 3. `PolicyManager.bindPolicy(...)` checks:
    - committee has at least one vault (`getCommitteeVaults`),
-   - `getCommitteeTokenStakes(policyId)` returns per-vault stakes; their USD values (via `ChainlinkPriceFeed.getUSDValue`) sum to >= `coverageLimit` USD-equivalent.
+   - `getCommitteeTokenStakes(policyId)` returns per-vault stakes; their USD values (via `OraclePriceFeed.getUSDValue`) sum to >= `coverageLimit` USD-equivalent.
 
 Outcome:
 
@@ -129,7 +129,7 @@ No-shortfall withdrawal path:
 
 - Slash amounts passed to `executeSlashing` are **token-native** (not USD); `ClaimManager` computes them via `previewSlashing` + `quoteSwap`.
 - Coverage payouts are token-denominated by `payoutToken`.
-- `coverageLimit` in `Quote`/`BoundPolicy`/`PolicyMetadata` is denominated in **`payoutToken` native units** (not USD). At bind time, `PolicyManager.bindPolicy` converts it to USD via `ChainlinkPriceFeed.getUSDValue(payoutToken, coverageLimit)` and compares against the committee's total staked USD. This is the only point where `ChainlinkPriceFeed` is used in Coverage contracts. The `PolicyDraft` struct does not contain a `coverageAmount` field.
+- `coverageLimit` in `Quote`/`BoundPolicy`/`PolicyMetadata` is denominated in **`payoutToken` native units** (not USD). At bind time, `PolicyManager.bindPolicy` converts it to USD via `OraclePriceFeed.getUSDValue(payoutToken, coverageLimit)` and compares against the committee's total staked USD. This is the only point where `OraclePriceFeed` is used in Coverage contracts. The `PolicyDraft` struct does not contain a `coverageAmount` field.
 
 ## Trust and Failure Boundaries
 
@@ -151,7 +151,7 @@ Failure patterns:
 - Ensure restakers have deposited into the committee's duration vault before bind. Duration vaults act as EigenLayer operators — no separate magnitude allocation or operator-set registration is needed. See [Restaker Setup](./04-restaker-setup.md).
 - Register and verify vault module mappings in Core (`SSPRouter.registerVaultModule`) before bind.
 - Configure swap routes for expected collateral → payout token pairs before claims; `Swapper.quoteSwap` is used at claim time for slippage computation.
-- `WETH` price feed must be registered in `ChainlinkPriceFeed` before binding policies whose payout token is WETH (stake USD sufficiency check at bind).
+- `WETH` price feed must be registered in `OraclePriceFeed` before binding policies whose payout token is WETH (stake USD sufficiency check at bind).
 
 ## Next Steps
 

docs/architecture/04-restaker-setup.md

@@ -9,7 +9,7 @@ duration vault (and optionally a Symbiotic vault).
 The restaker deposit is performed directly against EigenLayer contracts (no Coverage script needed).
 Stake sufficiency is enforced at bind time by `PolicyManager.bindPolicy`, which reads
 `StakeManager.getCommitteeTokenStakes(policyId)` and converts each vault's token-native stake to USD
-via `ChainlinkPriceFeed.getUSDValue`, then requires the total >= `coverageLimit` in USD.
+via `OraclePriceFeed.getUSDValue`, then requires the total >= `coverageLimit` in USD.
 
 ## Duration Vault Model (EigenLayer)
 
@@ -61,7 +61,7 @@ The deposited amount must satisfy the coverage USD requirement. The USD value is
 `EigenAdapter.getStrategiesStakeUSD(vaults)` at bind time:
 
 ```
-stake_USD = totalShares * sharesToUnderlyingView() * ChainlinkPriceFeed.getUSDValue(token, 1e18) / 1e18
+stake_USD = totalShares * sharesToUnderlyingView() * OraclePriceFeed.getUSDValue(token, 1e18) / 1e18
 ```
 
 Example: to cover a `coverageLimit` equivalent to 1000 USD (at 8 decimals: `100_000_000_000` payout-token units, given a 1:1 price), at least `$1000 / ETH_USD_PRICE` ETH worth of WETH must be deposited.
@@ -75,7 +75,7 @@ These steps are performed by the curator via `CoverPool.bindPolicyForRequest(...
    sets TVL limits on the duration vault (converting `coverageLimit` USD to token-native amounts),
    and locks the duration vault.
 2. calls `PolicyManager.bindPolicy(...)` — verifies committee has at least one vault, reads
-   `getCommitteeTokenStakes(policyId)`, converts total stake to USD via `ChainlinkPriceFeed.getUSDValue`,
+   `getCommitteeTokenStakes(policyId)`, converts total stake to USD via `OraclePriceFeed.getUSDValue`,
    and requires `totalStakeUSD >= coverageLimitUSD` before activating the policy.
 
 ## Why a Separate Setup Phase Exists
@@ -131,12 +131,12 @@ StakeManager.getCommitteeTokenStakes(policyId)
 
 Then for each vault with non-zero stake:
 ```
-totalStakeUSD += ChainlinkPriceFeed.getUSDValue(tokens[i], tokenStakes[i])
+totalStakeUSD += OraclePriceFeed.getUSDValue(tokens[i], tokenStakes[i])
 ```
 
 And the coverage limit in USD:
 ```
-coverageLimitUSD = ChainlinkPriceFeed.getUSDValue(payoutToken, coverageLimit)
+coverageLimitUSD = OraclePriceFeed.getUSDValue(payoutToken, coverageLimit)
 ```
 
 Bind reverts with `InsufficientStake` if `totalStakeUSD < coverageLimitUSD`.
@@ -186,7 +186,7 @@ Duration vault addresses are looked up at runtime via `StakeManager.getCommittee
 |---------|-----------|-----|
 | `InsufficientStake` at bind | `totalStakeUSD` < `coverageLimitUSD` in `PolicyManager.bindPolicy` | Deposit more collateral or reduce `coverageLimit` in the quote |
 | `VaultModuleNotSet` at `setCommitteeVaults` | Duration vault not registered in `SSPRouter` | Core admin: `SSPRouter.registerVaultModule(vault, 2)` |
-| `PriceFeedNotFound` at bind | Token not registered in `ChainlinkPriceFeed` (used only at bind time in `PolicyManager.bindPolicy`; not used during `fileClaim`) | Core admin: `registerPriceFeed(token, aggregator, stalenessThreshold)` |
+| `PriceFeedNotFound` at bind | Token not registered in `OraclePriceFeed` (used only at bind time in `PolicyManager.bindPolicy`; not used during `fileClaim`) | Core admin: `registerPriceFeed(token, aggregator, stalenessThreshold)` |
 | `InvalidCommitteeId` | `policyId = 0` (not set from output of RequestCoverage) | Set `POLICY_ID` env var from `RequestCoverage.s.sol` output |
 | Stake reads 0 before bind | Vaults not yet added to committee (expected) | Stake = 0 until `bindPolicyForRequest` runs `setCommitteeVaults` |
 | `RewardsManager safeTransferFrom` reverts on distribution | Unexpected: `PremiumManager` uses ephemeral `forceApprove` internally before each `distributeRewards` call — no admin allowance setup is required | Check that `rewardsManager` is correctly configured in `PremiumManager` |

docs/architecture/05-policy-lifecycle.md

@@ -103,7 +103,7 @@ Entry: Curator (pool admin) calls `CoverPool.bindPolicyForRequest(...)`.
 - request fields (`buyer`, `beneficiary`, `claimer`, `payoutToken`) match the stored draft,
 - `policyId` matches `quote.policyId`,
 - committee has at least one vault,
-- committee total stake (USD) >= `coverageLimit` (payoutToken-denominated) converted to USD via `ChainlinkPriceFeed.getUSDValue`,
+- committee total stake (USD) >= `coverageLimit` (payoutToken-denominated) converted to USD via `OraclePriceFeed.getUSDValue`,
 - policy commit is unique.
 
 Note: quote expiry and EIP-712 signature verification are performed exclusively in `CoverPool._verifyQuote`; `PolicyManager.bindPolicy` does not re-verify the signature even though the `BindPolicyRequest` struct carries the `signature` field.

docs/deployment/Ethereum-Mainnet.md

@@ -67,7 +67,7 @@
 - Proxy address: [0xe6168092892E545701D92BEe10149178bE0EEDF4](https://etherscan.io/address/0xe6168092892E545701D92BEe10149178bE0EEDF4)
 - Implementation address: [0xfaffe50bdccdecffddfdaf812ac8906765bfb4f6](https://etherscan.io/address/0xfaffe50bdccdecffddfdaf812ac8906765bfb4f6)
 
-### ChainlinkPriceFeed
+### OraclePriceFeed
 
 - Proxy address: [0x57F750E3B8e095A5b3AE96030F0cac5dFe2f8A16](https://etherscan.io/address/0x57F750E3B8e095A5b3AE96030F0cac5dFe2f8A16)
 - Implementation address: [0x99bba889b9b4df3d62e1ec8f9e03c48b97b580f6](https://etherscan.io/address/0x99bba889b9b4df3d62e1ec8f9e03c48b97b580f6)

docs/deployment/Sepolia-Testnet.md

@@ -63,7 +63,7 @@
 - Proxy address: [0xe6168092892E545701D92BEe10149178bE0EEDF4](https://sepolia.etherscan.io/address/0xe6168092892E545701D92BEe10149178bE0EEDF4)
 - Implementation address: [0xfaffe50bdccdecffddfdaf812ac8906765bfb4f6](https://sepolia.etherscan.io/address/0xfaffe50bdccdecffddfdaf812ac8906765bfb4f6)
 
-### ChainlinkPriceFeed
+### OraclePriceFeed
 
 - Proxy address: [0x57F750E3B8e095A5b3AE96030F0cac5dFe2f8A16](https://sepolia.etherscan.io/address/0x57F750E3B8e095A5b3AE96030F0cac5dFe2f8A16)
 - Implementation address: [0x99bba889b9b4df3d62e1ec8f9e03c48b97b580f6](https://sepolia.etherscan.io/address/0x99bba889b9b4df3d62e1ec8f9e03c48b97b580f6)

script/Deploy.s.sol

@@ -44,7 +44,7 @@ import {CreateXDeployer} from "./CreateXDeployer.s.sol";
  *        - SLASHING_MANAGER: Catalysis Core SlashingManager address (required)
  *        - STAKE_MANAGER: Catalysis Core StakeManager address (required)
  *        - REWARDS_MANAGER: Catalysis Core RewardsManager address (required)
- *        - CHAINLINK_PRICE_FEED: ChainlinkPriceFeed address (required)
+ *        - ORACLE_PRICE_FEED: OraclePriceFeed address (required)
  *        - PLATFORM_TREASURY: Platform fee recipient (defaults to admin)
  *        - PLATFORM_FEE_BPS: Platform fee in basis points (defaults to 500 = 5%)
  *        - COVER_POOL_FACTORY_CREATOR: Factory creator role (defaults to admin)
@@ -69,14 +69,14 @@ abstract contract Deploy is CreateXDeployer {
      * @notice External contract addresses required for deployment.
      * @param nativeWrapper WETH or equivalent native token wrapper address.
      * @param slashingManager SlashingManager contract address from Catalysis Core.
-     * @param chainlinkPriceFeed ChainlinkPriceFeed contract address from Catalysis Core.
+     * @param oraclePriceFeed OraclePriceFeed contract address from Catalysis Core.
      * @param stakeManager StakeManager contract address from Catalysis Core.
      * @param rewardsManager RewardsManager contract address from Catalysis Core.
      */
     struct ExternalConfig {
         address nativeWrapper;
         address slashingManager;
-        address chainlinkPriceFeed;
+        address oraclePriceFeed;
         address stakeManager;
         address rewardsManager;
     }
@@ -181,7 +181,7 @@ abstract contract Deploy is CreateXDeployer {
         return ExternalConfig({
             nativeWrapper: vm.envOr("NATIVE_WRAPPER", address(0)),
             slashingManager: vm.envOr("SLASHING_MANAGER", address(0)),
-            chainlinkPriceFeed: vm.envOr("CHAINLINK_PRICE_FEED", address(0)),
+            oraclePriceFeed: vm.envOr("ORACLE_PRICE_FEED", address(0)),
             stakeManager: vm.envOr("STAKE_MANAGER", address(0)),
             rewardsManager: vm.envOr("REWARDS_MANAGER", address(0))
         });
@@ -393,7 +393,7 @@ abstract contract Deploy is CreateXDeployer {
                     external_.stakeManager,
                     roles.deployer, // Temporary placeholder for claimManager, will be set after ClaimManager deployment
                     roles.deployer, // Temporary placeholder for coverPoolFactory, will be set after factory deployment
-                    external_.chainlinkPriceFeed,
+                    external_.oraclePriceFeed,
                     getInitialPayoutTokens()
                 )
             )
@@ -427,6 +427,7 @@ abstract contract Deploy is CreateXDeployer {
         );
 
         ClaimManager(payable(contracts.claimManagerProxy)).setPremiumManager(contracts.premiumManagerProxy);
+        ClaimManager(payable(contracts.claimManagerProxy)).initializeV2(external_.oraclePriceFeed, 300);
 
         PolicyManager(contracts.policyManagerProxy).setClaimManager(contracts.claimManagerProxy);
 
@@ -616,7 +617,7 @@ abstract contract Deploy is CreateXDeployer {
         external_ = getExternalConfig();
         require(external_.nativeWrapper != address(0), "Native wrapper address required");
         require(external_.slashingManager != address(0), "SLASHING_MANAGER required");
-        require(external_.chainlinkPriceFeed != address(0), "CHAINLINK_PRICE_FEED required");
+        require(external_.oraclePriceFeed != address(0), "ORACLE_PRICE_FEED required");
         require(external_.stakeManager != address(0), "STAKE_MANAGER required");
         require(external_.rewardsManager != address(0), "REWARDS_MANAGER required");
     }

script/DeployAnvil.s.sol

@@ -10,11 +10,11 @@ import {Deploy} from "./Deploy.s.sol";
  *      - SLASHING_MANAGER: Address of SlashingManager from Catalysis Core
  *      - STAKE_MANAGER: Address of StakeManager from Catalysis Core
  *      - REWARDS_MANAGER: Address of RewardsManager from Catalysis Core
- *      - CHAINLINK_PRICE_FEED: Address of ChainlinkPriceFeed
+ *      - ORACLE_PRICE_FEED: Address of OraclePriceFeed
  *
  *      Usage:
  *        SLASHING_MANAGER=0x... STAKE_MANAGER=0x... REWARDS_MANAGER=0x...
- * CHAINLINK_PRICE_FEED=0x... \
+ * ORACLE_PRICE_FEED=0x... \
  *          forge script script/DeployAnvil.s.sol --broadcast --rpc-url http://localhost:8545
  */
 contract DeployAnvil is Deploy {
@@ -43,7 +43,7 @@ contract DeployAnvil is Deploy {
         return ExternalConfig({
             nativeWrapper: WETH_ANVIL,
             slashingManager: vm.envAddress("SLASHING_MANAGER"),
-            chainlinkPriceFeed: vm.envAddress("CHAINLINK_PRICE_FEED"),
+            oraclePriceFeed: vm.envAddress("ORACLE_PRICE_FEED"),
             stakeManager: vm.envAddress("STAKE_MANAGER"),
             rewardsManager: vm.envAddress("REWARDS_MANAGER")
         });