{"id":47795270,"url":"https://github.com/morpho-org/permissioned-wrapper-poc","last_synced_at":"2026-04-03T16:14:56.251Z","repository":{"id":326518651,"uuid":"1105496099","full_name":"morpho-org/permissioned-wrapper-poc","owner":"morpho-org","description":null,"archived":false,"fork":false,"pushed_at":"2025-11-28T16:33:39.000Z","size":28,"stargazers_count":0,"open_issues_count":1,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2025-11-30T18:32:51.921Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Solidity","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/morpho-org.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-11-27T17:38:22.000Z","updated_at":"2025-11-28T10:41:55.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/morpho-org/permissioned-wrapper-poc","commit_stats":null,"previous_names":["morpho-org/permissioned-wrapper-poc"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/morpho-org/permissioned-wrapper-poc","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/morpho-org%2Fpermissioned-wrapper-poc","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/morpho-org%2Fpermissioned-wrapper-poc/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/morpho-org%2Fpermissioned-wrapper-poc/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/morpho-org%2Fpermissioned-wrapper-poc/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/morpho-org","download_url":"https://codeload.github.com/morpho-org/permissioned-wrapper-poc/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/morpho-org%2Fpermissioned-wrapper-poc/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":31362716,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-03T15:19:21.178Z","status":"ssl_error","status_checked_at":"2026-04-03T15:19:20.670Z","response_time":107,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.6:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-04-03T16:14:55.562Z","updated_at":"2026-04-03T16:14:56.246Z","avatar_url":"https://github.com/morpho-org.png","language":"Solidity","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Permissioned ERC20 Wrapper - Proof of Concept\n\n## ⚠️ WARNING: PROOF OF CONCEPT ONLY\n\n**This repository is a Proof of Concept (PoC) and must NEVER be used in production as-is.**\n\nThis code has not been audited, lacks proper access controls, and is intended solely for demonstration purposes. Use at your own risk.\n\n---\n\n## Purpose\n\nThis repository demonstrates how to use an ERC20 wrapper token to implement permissioned access control for collateral supply in Morpho.\n\n---\n\n## 1. Allow List Mechanism\n\nThis PoC uses a simple allow list stored directly in the ERC20 wrapper contract. In production, you should use a separate contract with proper access controls to manage the allow list.\n\n### Allow List Management\n\n**Location**: [`src/PermissionedERC20.sol`](src/PermissionedERC20.sol#L20-L34)\n\n```solidity\n///-------------ALLOW LIST MANAGEMENT-------------\nmapping(address =\u003e bool) public allowed;\n\nfunction addToAllowList(address _address) public {\n    allowed[_address] = true;\n}\n\nfunction removeFromAllowList(address _address) public {\n    allowed[_address] = false;\n}\n\nfunction isAllowed(address _address) public view returns (bool) {\n    return allowed[_address];\n}\n///---------------END OF ALLOW LIST MANAGEMENT---------------\n```\n\n---\n\n## 2. Transfer Restrictions\n\nAll token operations (transfers, mints, and burns) are restricted by the allow list. The `_beforeTokenTransfer` hook checks if addresses are allowed before allowing any operation.\n\n**Location**: [`src/PermissionedERC20.sol`](src/PermissionedERC20.sol#L36-L51)\n\n```solidity\n///-------------GATING FUNCTIONS-------------\n/**\n * @dev Override the _beforeTokenTransfer function to check mint, burn and transfer permissions\n */\nfunction _beforeTokenTransfer(address from, address to, uint256 amount) internal virtual override {\n    // Check from address (skip for minting where from is address(0))\n    if (from != address(0) \u0026\u0026 !isAllowed(from)) {\n        revert FromAddressNotAllowed(from);\n    }\n    // Check to address (skip for burning where to is address(0))\n    if (to != address(0) \u0026\u0026 !isAllowed(to)) {\n        revert ToAddressNotAllowed(to);\n    }\n    super._beforeTokenTransfer(from, to, amount);\n}\n///---------------END OF GATING FUNCTIONS---------------\n```\n\n---\n\n## 3. Interacting with Morpho\n\nWhen using the permissioned wrapper with Morpho, you must add Morpho and users to the allow list. **Morpho must be whitelisted** because it receives permissioned tokens as collateral.\n\n**Location**: [`test/SupplyCollateralInMorpho.t.sol`](test/SupplyCollateralInMorpho.t.sol#L60-L66)\n\n```solidity\n// Add contracts and users to allow list\n// NOTE: Morpho needs to be whitelisted because it receives permissioned tokens as collateral\naddress[] memory allowListAddresses = new address[](3);\nallowListAddresses[0] = address(morpho);\nallowListAddresses[1] = allowedUser1;\nallowListAddresses[2] = allowedUser2;\nfor (uint256 i = 0; i \u003c allowListAddresses.length; i++) {\n    permissionedERC20.addToAllowList(allowListAddresses[i]);\n}\n```\n\nUsers can then directly call Morpho's `supplyCollateral` function:\n\n```solidity\nmorpho.supplyCollateral(marketParams, amount, onBehalf, hex\"\");\n```\n\n### Security Considerations\n\n**Important**: Permissioned wrappers that only check the recipient address could allow non-permissioned users to use the wrapper if they can get tokens through other means.\n\nThis implementation mitigates this risk by checking **both** the `from` address (sender) and `to` address (recipient) in the `_beforeTokenTransfer` hook. This means:\n- Non-whitelisted users cannot receive tokens (mint/transfer blocked)\n- Non-whitelisted users cannot send tokens (transfer blocked)\n- Even if tokens were somehow obtained, supplying collateral would fail because Morpho's `transferFrom` would check the `from` address\n\nThis dual-check approach ensures that only whitelisted addresses can participate in token transfers, providing defense-in-depth against potential bypasses.\n\n---\n\n## License\n\nMIT\n\n---\n\n## Disclaimer\n\nThis software is provided \"as is\", without warranty of any kind. The authors and contributors are not liable for any damages arising from the use of this software.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmorpho-org%2Fpermissioned-wrapper-poc","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmorpho-org%2Fpermissioned-wrapper-poc","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmorpho-org%2Fpermissioned-wrapper-poc/lists"}