Merge remote-tracking branch 'upstream/master' into next-v5.0

2 years ago · 5955d8e85b
parent 13d5e0466a 09329f8a18
commit 5955d8e85b
125 changed files with 255 additions and 437 deletions
--- a/.changeset/beige-buses-drop.md
+++ b/.changeset/beige-buses-drop.md
@ -1,7 +0,0 @@
---
-'openzeppelin-solidity': patch
---
-
-`Initializable`: optimize `_disableInitializers` by using `!=` instead of `<`.
-
-pr: #3787
--- a/.changeset/curvy-shrimps-enjoy.md
+++ b/.changeset/curvy-shrimps-enjoy.md
@ -1,7 +0,0 @@
---
-'openzeppelin-solidity': minor
---
-
-`ReentrancyGuard`: Add a `_reentrancyGuardEntered` function to expose the guard status.
-
-pr: #3714
--- a/.changeset/curvy-suns-sort.md
+++ b/.changeset/curvy-suns-sort.md
@ -1,7 +0,0 @@
---
-'openzeppelin-solidity': patch
---
-
-`Ownable2Step`: make `acceptOwnership` public virtual to enable usecases that require overriding it.
-
-pr: #3960
--- a/.changeset/early-oranges-raise.md
+++ b/.changeset/early-oranges-raise.md
@ -1,5 +0,0 @@
---
-'openzeppelin-solidity': minor
---
-
-`ERC721Wrapper`: add a new extension of the `ERC721` token which wraps an underlying token. Deposit and withdraw guarantee that the ownership of each token is backed by a corresponding underlying token with the same identifier.
--- a/.changeset/famous-rules-burn.md
+++ b/.changeset/famous-rules-burn.md
@ -1,7 +0,0 @@
---
-'openzeppelin-solidity': minor
---
-
-`EnumerableMap`: add a `keys()` function that returns an array containing all the keys.
-
-pr: #3920
--- a/.changeset/five-ducks-develop.md
+++ b/.changeset/five-ducks-develop.md
@ -1,5 +0,0 @@
---
-'openzeppelin-solidity': patch
---
-
-`UUPSUpgradeable.sol`: Change visibility to the functions `upgradeTo ` and `upgradeToAndCall ` from `external` to `public`.
--- a/.changeset/five-poets-mix.md
+++ b/.changeset/five-poets-mix.md
@ -1,5 +0,0 @@
---
-'openzeppelin-solidity': patch
---
-
-`TimelockController`: Add the `CallSalt` event to emit on operation schedule.
--- a/.changeset/flat-deers-end.md
+++ b/.changeset/flat-deers-end.md
@ -1,5 +0,0 @@
---
-'openzeppelin-solidity': minor
---
-
-`Governor`: add a public `cancel(uint256)` function.
--- a/.changeset/four-bats-sniff.md
+++ b/.changeset/four-bats-sniff.md
@ -1,5 +0,0 @@
---
-'openzeppelin-solidity': minor
---
-
-`Governor`: Enable timestamp operation for blockchains without a stable block time. This is achieved by connecting a Governor's internal clock to match a voting token's EIP-6372 interface.
--- a/.changeset/funny-rockets-compete.md
+++ b/.changeset/funny-rockets-compete.md
@ -1,7 +0,0 @@
---
-'openzeppelin-solidity': patch
---
-
-Reformatted codebase with latest version of Prettier Solidity.
-
-pr: #3898
--- a/.changeset/gold-chicken-clean.md
+++ b/.changeset/gold-chicken-clean.md
@ -1,7 +0,0 @@
---
-'openzeppelin-solidity': minor
---
-
-`Strings`: add `equal` method.
-
-pr: #3774
--- a/.changeset/happy-socks-travel.md
+++ b/.changeset/happy-socks-travel.md
@ -1,5 +0,0 @@
---
-'openzeppelin-solidity': minor
---
-
-`IERC5313`: Add an interface for EIP-5313 that is now final.
--- a/.changeset/healthy-squids-stare.md
+++ b/.changeset/healthy-squids-stare.md
@ -1,7 +0,0 @@
---
-'openzeppelin-solidity': patch
---
-
-`Math`: optimize `log256` rounding check.
-
-pr: #3745
--- a/.changeset/lemon-dogs-kiss.md
+++ b/.changeset/lemon-dogs-kiss.md
@ -1,7 +0,0 @@
---
-'openzeppelin-solidity': patch
---
-
-`ERC20Votes`: optimize by using unchecked arithmetic.
-
-pr: #3748
--- a/.changeset/little-kiwis-ring.md
+++ b/.changeset/little-kiwis-ring.md
@ -1,7 +0,0 @@
---
-'openzeppelin-solidity': patch
---
-
-`Multicall`: annotate `multicall` function as upgrade safe to not raise a flag for its delegatecall.
-
-pr: #3961
--- a/.changeset/loud-wolves-promise.md
+++ b/.changeset/loud-wolves-promise.md
@ -1,5 +0,0 @@
---
-'openzeppelin-solidity': patch
---
-
-`AccessControlDefaultAdminRules`: Clean up pending admin schedule on renounce.
--- a/.changeset/lovely-dragons-appear.md
+++ b/.changeset/lovely-dragons-appear.md
@ -1,5 +0,0 @@
---
-'openzeppelin-solidity': minor
---
-
-`IERC4906`: Add an interface for ERC-4906 that is now Final.
--- a/.changeset/modern-games-exist.md
+++ b/.changeset/modern-games-exist.md
@ -1,5 +0,0 @@
---
-'openzeppelin-solidity': minor
---
-
-`StorageSlot`: Add support for `string` and `bytes`.
--- a/.changeset/new-ways-own.md
+++ b/.changeset/new-ways-own.md
@ -1,5 +0,0 @@
---
-'openzeppelin-solidity': patch
---
-
-`ERC20Pausable`, `ERC721Pausable`, `ERC1155Pausable`: Add note regarding missing public pausing functionality
--- a/.changeset/ninety-hornets-kick.md
+++ b/.changeset/ninety-hornets-kick.md
@ -1,5 +0,0 @@
---
-'openzeppelin-solidity': minor
---
-
-`Votes`, `ERC20Votes`, `ERC721Votes`: support timestamp checkpointing using EIP-6372.
--- a/.changeset/perfect-insects-listen.md
+++ b/.changeset/perfect-insects-listen.md
@ -1,5 +0,0 @@
---
-'openzeppelin-solidity': minor
---
-
-`ERC4626`: Add mitigation to the inflation attack through virtual shares and assets.
--- a/.changeset/pretty-hornets-play.md
+++ b/.changeset/pretty-hornets-play.md
@ -1,7 +0,0 @@
---
-'openzeppelin-solidity': minor
---
-
-`Strings`: add `toString` method for signed integers.
-
-pr: #3773
--- a/.changeset/proud-comics-deliver.md
+++ b/.changeset/proud-comics-deliver.md
@ -1,5 +0,0 @@
---
-'openzeppelin-solidity': minor
---
-
-`ERC20Wrapper`: Make the `underlying` variable private and add a public accessor.
--- a/.changeset/short-roses-judge.md
+++ b/.changeset/short-roses-judge.md
@ -1,5 +0,0 @@
---
-'openzeppelin-solidity': minor
---
-
-`EIP712`: add EIP-5267 support for better domain discovery.
--- a/.changeset/silent-dancers-type.md
+++ b/.changeset/silent-dancers-type.md
@ -1,5 +0,0 @@
---
-'openzeppelin-solidity': minor
---
-
-`AccessControlDefaultAdminRules`: Add an extension of `AccessControl` with additional security rules for the `DEFAULT_ADMIN_ROLE`.
--- a/.changeset/slimy-knives-hug.md
+++ b/.changeset/slimy-knives-hug.md
@ -1,5 +0,0 @@
---
-'openzeppelin-solidity': minor
---
-
-`SignatureChecker`: Add `isValidERC1271SignatureNow` for checking a signature directly against a smart contract using ERC-1271.
--- a/.changeset/small-cars-appear.md
+++ b/.changeset/small-cars-appear.md
@ -1,5 +0,0 @@
---
-'openzeppelin-solidity': patch
---
-
-`ECDSA`: Add a function `toDataWithIntendedValidatorHash` that encodes data with version 0x00 following EIP-191.
--- a/.changeset/small-terms-sleep.md
+++ b/.changeset/small-terms-sleep.md
@ -1,5 +0,0 @@
---
-'openzeppelin-solidity': minor
---
-
-`SafeERC20`: Add a `forceApprove` function to improve compatibility with tokens behaving like USDT.
--- a/.changeset/smooth-books-wink.md
+++ b/.changeset/smooth-books-wink.md
@ -0,0 +1,5 @@
+---
+'openzeppelin-solidity': major
+---
+
+`ERC1155`: Remove check for address zero in `balanceOf`.
--- a/.changeset/strong-bulldogs-buy.md
+++ b/.changeset/strong-bulldogs-buy.md
@ -1,5 +0,0 @@
---
-'openzeppelin-solidity': minor
---
-
-`ERC1967Upgrade`: removed contract-wide `oz-upgrades-unsafe-allow delegatecall` annotation, replaced by granular annotation in `UUPSUpgradeable`.
--- a/.changeset/tame-ladybugs-sit.md
+++ b/.changeset/tame-ladybugs-sit.md
@ -1,7 +0,0 @@
---
-'openzeppelin-solidity': patch
---
-
-`MerkleProof`: optimize by using unchecked arithmetic.
-
-pr: #3745
--- a/.changeset/tender-needles-dance.md
+++ b/.changeset/tender-needles-dance.md
@ -1,7 +0,0 @@
---
-'openzeppelin-solidity': minor
---
-
-`ERC20Wrapper`: self wrapping and deposit by the wrapper itself are now explicitly forbidden.
-
-commit: 3214f6c25
--- a/.changeset/thin-dragons-report.md
+++ b/.changeset/thin-dragons-report.md
@ -1,5 +0,0 @@
---
-'openzeppelin-solidity': minor
---
-
-`ECDSA`: optimize bytes32 computation by using assembly instead of `abi.encodePacked`.
--- a/.changeset/thirty-swans-exercise.md
+++ b/.changeset/thirty-swans-exercise.md
@ -1,5 +0,0 @@
---
-'openzeppelin-solidity': minor
---
-
-`ERC721URIStorage`: Emit ERC-4906 `MetadataUpdate` in `_setTokenURI`.
--- a/.changeset/violet-frogs-hide.md
+++ b/.changeset/violet-frogs-hide.md
@ -1,5 +0,0 @@
---
-'openzeppelin-solidity': minor
---
-
-`ShortStrings`: Added a library for handling short strings in a gas efficient way, with fallback to storage for longer strings.
--- a/.changeset/warm-masks-obey.md
+++ b/.changeset/warm-masks-obey.md
@ -1,5 +0,0 @@
---
-'openzeppelin-solidity': minor
---
-
-`SignatureChecker`: Allow return data length greater than 32 from EIP-1271 signers.
--- a/.changeset/yellow-swans-cover.md
+++ b/.changeset/yellow-swans-cover.md
@ -1,5 +0,0 @@
---
-'openzeppelin-solidity': minor
---
-
-`UUPSUpgradeable`: added granular `oz-upgrades-unsafe-allow-reachable` annotation to improve upgrade safety checks on latest version of the Upgrades Plugins (starting with `@openzeppelin/upgrades-core@1.21.0`).
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@ -33,6 +33,44 @@ function supportsInterface(bytes4 interfaceId) public view virtual override retu
 }
 ```

+## 4.9.0 (2023-05-23)
+
+- `ReentrancyGuard`: Add a `_reentrancyGuardEntered` function to expose the guard status. ([#3714](https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3714))
+- `ERC721Wrapper`: add a new extension of the `ERC721` token which wraps an underlying token. Deposit and withdraw guarantee that the ownership of each token is backed by a corresponding underlying token with the same identifier. ([#3863](https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3863))
+- `EnumerableMap`: add a `keys()` function that returns an array containing all the keys. ([#3920](https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3920))
+- `Governor`: add a public `cancel(uint256)` function. ([#3983](https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3983))
+- `Governor`: Enable timestamp operation for blockchains without a stable block time. This is achieved by connecting a Governor's internal clock to match a voting token's EIP-6372 interface. ([#3934](https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3934))
+- `Strings`: add `equal` method. ([#3774](https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3774))
+- `IERC5313`: Add an interface for EIP-5313 that is now final. ([#4013](https://github.com/OpenZeppelin/openzeppelin-contracts/pull/4013))
+- `IERC4906`: Add an interface for ERC-4906 that is now Final. ([#4012](https://github.com/OpenZeppelin/openzeppelin-contracts/pull/4012))
+- `StorageSlot`: Add support for `string` and `bytes`. ([#4008](https://github.com/OpenZeppelin/openzeppelin-contracts/pull/4008))
+- `Votes`, `ERC20Votes`, `ERC721Votes`: support timestamp checkpointing using EIP-6372. ([#3934](https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3934))
+- `ERC4626`: Add mitigation to the inflation attack through virtual shares and assets. ([#3979](https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3979))
+- `Strings`: add `toString` method for signed integers. ([#3773](https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3773))
+- `ERC20Wrapper`: Make the `underlying` variable private and add a public accessor. ([#4029](https://github.com/OpenZeppelin/openzeppelin-contracts/pull/4029))
+- `EIP712`: add EIP-5267 support for better domain discovery. ([#3969](https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3969))
+- `AccessControlDefaultAdminRules`: Add an extension of `AccessControl` with additional security rules for the `DEFAULT_ADMIN_ROLE`. ([#4009](https://github.com/OpenZeppelin/openzeppelin-contracts/pull/4009))
+- `SignatureChecker`: Add `isValidERC1271SignatureNow` for checking a signature directly against a smart contract using ERC-1271. ([#3932](https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3932))
+- `SafeERC20`: Add a `forceApprove` function to improve compatibility with tokens behaving like USDT. ([#4067](https://github.com/OpenZeppelin/openzeppelin-contracts/pull/4067))
+- `ERC1967Upgrade`: removed contract-wide `oz-upgrades-unsafe-allow delegatecall` annotation, replaced by granular annotation in `UUPSUpgradeable`. ([#3971](https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3971))
+- `ERC20Wrapper`: self wrapping and deposit by the wrapper itself are now explicitly forbidden. ([#4100](https://github.com/OpenZeppelin/openzeppelin-contracts/pull/4100))
+- `ECDSA`: optimize bytes32 computation by using assembly instead of `abi.encodePacked`. ([#3853](https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3853))
+- `ERC721URIStorage`: Emit ERC-4906 `MetadataUpdate` in `_setTokenURI`. ([#4012](https://github.com/OpenZeppelin/openzeppelin-contracts/pull/4012))
+- `ShortStrings`: Added a library for handling short strings in a gas efficient way, with fallback to storage for longer strings. ([#4023](https://github.com/OpenZeppelin/openzeppelin-contracts/pull/4023))
+- `SignatureChecker`: Allow return data length greater than 32 from EIP-1271 signers. ([#4038](https://github.com/OpenZeppelin/openzeppelin-contracts/pull/4038))
+- `UUPSUpgradeable`: added granular `oz-upgrades-unsafe-allow-reachable` annotation to improve upgrade safety checks on latest version of the Upgrades Plugins (starting with `@openzeppelin/upgrades-core@1.21.0`). ([#3971](https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3971))
+- `Initializable`: optimize `_disableInitializers` by using `!=` instead of `<`. ([#3787](https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3787))
+- `Ownable2Step`: make `acceptOwnership` public virtual to enable usecases that require overriding it. ([#3960](https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3960))
+- `UUPSUpgradeable.sol`: Change visibility to the functions `upgradeTo ` and `upgradeToAndCall ` from `external` to `public`. ([#3959](https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3959))
+- `TimelockController`: Add the `CallSalt` event to emit on operation schedule. ([#4001](https://github.com/OpenZeppelin/openzeppelin-contracts/pull/4001))
+- Reformatted codebase with latest version of Prettier Solidity. ([#3898](https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3898))
+- `Math`: optimize `log256` rounding check. ([#3745](https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3745))
+- `ERC20Votes`: optimize by using unchecked arithmetic. ([#3748](https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3748))
+- `Multicall`: annotate `multicall` function as upgrade safe to not raise a flag for its delegatecall. ([#3961](https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3961))
+- `ERC20Pausable`, `ERC721Pausable`, `ERC1155Pausable`: Add note regarding missing public pausing functionality ([#4007](https://github.com/OpenZeppelin/openzeppelin-contracts/pull/4007))
+- `ECDSA`: Add a function `toDataWithIntendedValidatorHash` that encodes data with version 0x00 following EIP-191. ([#4063](https://github.com/OpenZeppelin/openzeppelin-contracts/pull/4063))
+- `MerkleProof`: optimize by using unchecked arithmetic. ([#3745](https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3745))
+
 ### Breaking changes

 - `EIP712`: Addition of ERC5267 support requires support for user defined value types, which was released in Solidity version 0.8.8. This requires a pragma change from `^0.8.0` to `^0.8.8`.
--- a/certora/specs/AccessControlDefaultAdminRules.spec
+++ b/certora/specs/AccessControlDefaultAdminRules.spec
@ -12,44 +12,23 @@ use rule onlyGrantCanGrant filtered {
 │ Helpers                                                                                                             │
 └─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┘
 */
+definition timeSanity(env e) returns bool =
+  e.block.timestamp > 0 && e.block.timestamp + defaultAdminDelay(e) < max_uint48();

-function max_uint48() returns mathint {
-    return (1 << 48) - 1;
-}
+definition delayChangeWaitSanity(env e, uint48 newDelay) returns bool =
+  e.block.timestamp + delayChangeWait_(e, newDelay) < max_uint48();

-function nonZeroAccount(address account) returns bool {
-  return account != 0;
-}
+definition isSet(uint48 schedule) returns bool =
+  schedule != 0;

-function timeSanity(env e) returns bool {
-  return
-    e.block.timestamp > 0 && // Avoids 0 schedules
-    e.block.timestamp + defaultAdminDelay(e) < max_uint48();
-}
+definition hasPassed(env e, uint48 schedule) returns bool =
+  schedule < e.block.timestamp;

-function delayChangeWaitSanity(env e, uint48 newDelay) returns bool {
-  return e.block.timestamp + delayChangeWait_(e, newDelay) < max_uint48();
-}
+definition increasingDelaySchedule(env e, uint48 newDelay) returns mathint =
+  e.block.timestamp + min(newDelay, defaultAdminDelayIncreaseWait());

-function isSet(uint48 schedule) returns bool {
-  return schedule != 0;
-}
-
-function hasPassed(env e, uint48 schedule) returns bool {
-  return schedule < e.block.timestamp;
-}
-
-function min(uint48 a, uint48 b) returns mathint {
-  return a < b ? a : b;
-}
-
-function increasingDelaySchedule(env e, uint48 newDelay) returns mathint {
-  return e.block.timestamp + min(newDelay, defaultAdminDelayIncreaseWait());
-}
-
-function decreasingDelaySchedule(env e, uint48 newDelay) returns mathint {
-  return e.block.timestamp + defaultAdminDelay(e) - newDelay;
-}
+definition decreasingDelaySchedule(env e, uint48 newDelay) returns mathint =
+  e.block.timestamp + defaultAdminDelay(e) - newDelay;

 /*
 ┌─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐
@ -57,11 +36,10 @@ function decreasingDelaySchedule(env e, uint48 newDelay) returns mathint {
 └─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┘
 */
 invariant defaultAdminConsistency(address account)
-  defaultAdmin() == account <=> hasRole(DEFAULT_ADMIN_ROLE(), account)
+  (account == defaultAdmin() && account != 0) <=> hasRole(DEFAULT_ADMIN_ROLE(), account)
  {
-    preserved {
-      // defaultAdmin() returns the zero address when there's no default admin
-      require nonZeroAccount(account);
+    preserved with (env e) {
+      require nonzerosender(e);
    }
  }

@ -72,10 +50,12 @@ invariant defaultAdminConsistency(address account)
 */
 invariant singleDefaultAdmin(address account, address another)
  hasRole(DEFAULT_ADMIN_ROLE(), account) && hasRole(DEFAULT_ADMIN_ROLE(), another) => another == account
-  // We filter here because we couldn't find a way to force Certora to have an initial state with
-  // only one DEFAULT_ADMIN_ROLE enforced, so a counter example is a different default admin since inception
-  // triggering the transfer, which is known to be impossible by definition.
-  filtered { f -> f.selector != acceptDefaultAdminTransfer().selector }
+  {
+    preserved {
+      requireInvariant defaultAdminConsistency(account);
+      requireInvariant defaultAdminConsistency(another);
+    }
+  }

 /*
 ┌─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐
@ -118,7 +98,8 @@ rule revokeRoleEffect(env e, bytes32 role) {
      "roles can only be revoked by their owner except for the default admin role";

    // effect
-    assert success => !hasRole(role, account), "role is revoked";
+    assert success => !hasRole(role, account),
+      "role is revoked";

    // no side effect
    assert hasOtherRoleBefore != hasOtherRoleAfter => (role == otherRole && account == otherAccount),
@ -137,35 +118,59 @@ rule renounceRoleEffect(env e, bytes32 role) {
    address account;
    address otherAccount;

-    bool hasOtherRoleBefore = hasRole(otherRole, otherAccount);
-    uint48 scheduleBefore = pendingDefaultAdminSchedule_();
+    bool    hasOtherRoleBefore = hasRole(otherRole, otherAccount);
+    address adminBefore        = defaultAdmin();
    address pendingAdminBefore = pendingDefaultAdmin_();
+    uint48  scheduleBefore     = pendingDefaultAdminSchedule_();

    renounceRole@withrevert(e, role, account);
    bool success = !lastReverted;

-    bool hasOtherRoleAfter = hasRole(otherRole, otherAccount);
+    bool    hasOtherRoleAfter = hasRole(otherRole, otherAccount);
+    address adminAfter        = defaultAdmin();
+    address pendingAdminAfter = pendingDefaultAdmin_();
+    uint48  scheduleAfter     = pendingDefaultAdminSchedule_();

    // liveness
    assert success <=> (
      account == e.msg.sender &&
      (
+        role    != DEFAULT_ADMIN_ROLE() ||
+        account != adminBefore          ||
        (
-          role != DEFAULT_ADMIN_ROLE()
-        ) || (
-          role == DEFAULT_ADMIN_ROLE() &&
          pendingAdminBefore == 0 &&
          isSet(scheduleBefore) &&
          hasPassed(e, scheduleBefore)
        )
      )
-    ), "an account only can renounce by itself with a delay for the default admin role";
+    ),
+      "an account only can renounce by itself with a delay for the default admin role";

    // effect
-    assert success => !hasRole(role, account), "role is renounced";
+    assert success => !hasRole(role, account),
+      "role is renounced";
+
+    assert success => (
+      (
+        role    == DEFAULT_ADMIN_ROLE() &&
+        account == adminBefore
+      ) ? (
+        adminAfter        == 0 &&
+        pendingAdminAfter == 0 &&
+        scheduleAfter     == 0
+      ) : (
+        adminAfter        == adminBefore        &&
+        pendingAdminAfter == pendingAdminBefore &&
+        scheduleAfter     == scheduleBefore
+      )
+    ),
+      "renouncing default admin role cleans state iff called by previous admin";

    // no side effect
-    assert hasOtherRoleBefore != hasOtherRoleAfter => (role == otherRole && account == otherAccount),
+    assert hasOtherRoleBefore != hasOtherRoleAfter => (
+      role == otherRole &&
+      account == otherAccount
+    ),
      "no other role is affected";
 }

@ -175,10 +180,6 @@ rule renounceRoleEffect(env e, bytes32 role) {
 └─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┘
 */
 rule noDefaultAdminChange(env e, method f, calldataarg args) {
-  require nonZeroAccount(e.msg.sender);
-  requireInvariant defaultAdminConsistency(defaultAdmin());
-  requireInvariant singleDefaultAdmin(e.msg.sender, defaultAdmin());
-
  address adminBefore = defaultAdmin();
  f(e, args);
  address adminAfter = defaultAdmin();
@ -186,18 +187,17 @@ rule noDefaultAdminChange(env e, method f, calldataarg args) {
  assert adminBefore != adminAfter => (
    f.selector == acceptDefaultAdminTransfer().selector ||
    f.selector == renounceRole(bytes32,address).selector
-  ), "default admin is only affected by accepting an admin transfer or renoucing";
+  ),
+    "default admin is only affected by accepting an admin transfer or renoucing";
 }

 /*
 ┌─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐
-│ Rule: pendingDefaultAdmin is only affected by beginning, accepting or canceling an admin transfer                   │
+│ Rule: pendingDefaultAdmin is only affected by beginning, completing (accept or renounce), or canceling an admin     │
+│ transfer                                                                                                            │
 └─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┘
 */
 rule noPendingDefaultAdminChange(env e, method f, calldataarg args) {
-  requireInvariant defaultAdminConsistency(defaultAdmin());
-  requireInvariant singleDefaultAdmin(e.msg.sender, defaultAdmin());
-
  address pendingAdminBefore = pendingDefaultAdmin_();
  address scheduleBefore = pendingDefaultAdminSchedule_();
  f(e, args);
@ -210,8 +210,10 @@ rule noPendingDefaultAdminChange(env e, method f, calldataarg args) {
  ) => (
    f.selector == beginDefaultAdminTransfer(address).selector ||
    f.selector == acceptDefaultAdminTransfer().selector ||
-    f.selector == cancelDefaultAdminTransfer().selector
-  ), "pending admin and its schedule is only affected by beginning, accepting or cancelling an admin transfer";
+    f.selector == cancelDefaultAdminTransfer().selector ||
+    f.selector == renounceRole(bytes32,address).selector
+  ),
+    "pending admin and its schedule is only affected by beginning, completing, or cancelling an admin transfer";
 }

 /*
@ -224,7 +226,8 @@ rule noDefaultAdminDelayChange(env e, method f, calldataarg args) {
  f(e, args);
  uint48 delayAfter = defaultAdminDelay(e);

-  assert delayBefore == delayAfter, "delay can't be changed atomically by any function";
+  assert delayBefore == delayAfter,
+    "delay can't be changed atomically by any function";
 }

 /*
@ -240,7 +243,8 @@ rule noPendingDefaultAdminDelayChange(env e, method f, calldataarg args) {
  assert pendingDelayBefore != pendingDelayAfter => (
    f.selector == changeDefaultAdminDelay(uint48).selector ||
    f.selector == rollbackDefaultAdminDelay().selector
-  ), "pending delay is only affected by changeDefaultAdminDelay or rollbackDefaultAdminDelay";
+  ),
+    "pending delay is only affected by changeDefaultAdminDelay or rollbackDefaultAdminDelay";
 }

 /*
@ -263,10 +267,10 @@ rule noDefaultAdminDelayIncreaseWaitChange(env e, method f, calldataarg args) {
 └─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┘
 */
 rule beginDefaultAdminTransfer(env e, address newAdmin) {
-  require nonpayable(e);
  require timeSanity(e);
-  requireInvariant defaultAdminConsistency(defaultAdmin());
-  requireInvariant singleDefaultAdmin(e.msg.sender, defaultAdmin());
+  require nonpayable(e);
+  require nonzerosender(e);
+  requireInvariant defaultAdminConsistency(e.msg.sender);

  beginDefaultAdminTransfer@withrevert(e, newAdmin);
  bool success = !lastReverted;
@ -288,18 +292,24 @@ rule beginDefaultAdminTransfer(env e, address newAdmin) {
 └─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┘
 */
 rule pendingDefaultAdminDelayEnforced(env e1, env e2, method f, calldataarg args, address newAdmin) {
-  require e1.block.timestamp < e2.block.timestamp;
+  require e1.block.timestamp <= e2.block.timestamp;

  uint48 delayBefore = defaultAdminDelay(e1);
  address adminBefore = defaultAdmin();
+
  // There might be a better way to generalize this without requiring `beginDefaultAdminTransfer`, but currently
  // it's the only way in which we can attest that only `delayBefore` has passed before a change.
  beginDefaultAdminTransfer(e1, newAdmin);
  f(e2, args);
+
  address adminAfter = defaultAdmin();

-  assert adminAfter == newAdmin => ((e2.block.timestamp >= e1.block.timestamp + delayBefore) || adminBefore == newAdmin),
-    "A delay can't change in less than applied schedule";
+  // change can only happen towards the newAdmin, with the delay
+  assert adminAfter != adminBefore => (
+    adminAfter == newAdmin &&
+    e2.block.timestamp >= e1.block.timestamp + delayBefore
+  ),
+    "The admin can only change after the enforced delay and to the previously scheduled new admin";
 }

 /*
@ -309,17 +319,19 @@ rule pendingDefaultAdminDelayEnforced(env e1, env e2, method f, calldataarg args
 */
 rule acceptDefaultAdminTransfer(env e) {
  require nonpayable(e);
-  requireInvariant defaultAdminConsistency(defaultAdmin());
-  requireInvariant singleDefaultAdmin(e.msg.sender, defaultAdmin());

  address pendingAdminBefore = pendingDefaultAdmin_();
-  uint48 scheduleAfter = pendingDefaultAdminSchedule_();
+  uint48 scheduleBefore = pendingDefaultAdminSchedule_();

  acceptDefaultAdminTransfer@withrevert(e);
  bool success = !lastReverted;

  // liveness
-  assert success <=> e.msg.sender == pendingAdminBefore && isSet(scheduleAfter) && hasPassed(e, scheduleAfter),
+  assert success <=> (
+    e.msg.sender == pendingAdminBefore &&
+    isSet(scheduleBefore) &&
+    hasPassed(e, scheduleBefore)
+  ),
    "only the pending default admin can accept the role after the schedule has been set and passed";

  // effect
@ -338,8 +350,8 @@ rule acceptDefaultAdminTransfer(env e) {
 */
 rule cancelDefaultAdminTransfer(env e) {
  require nonpayable(e);
-  requireInvariant defaultAdminConsistency(defaultAdmin());
-  requireInvariant singleDefaultAdmin(e.msg.sender, defaultAdmin());
+  require nonzerosender(e);
+  requireInvariant defaultAdminConsistency(e.msg.sender);

  cancelDefaultAdminTransfer@withrevert(e);
  bool success = !lastReverted;
@ -361,11 +373,11 @@ rule cancelDefaultAdminTransfer(env e) {
 └─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┘
 */
 rule changeDefaultAdminDelay(env e, uint48 newDelay) {
-  require nonpayable(e);
  require timeSanity(e);
+  require nonpayable(e);
+  require nonzerosender(e);
  require delayChangeWaitSanity(e, newDelay);
-  requireInvariant defaultAdminConsistency(defaultAdmin());
-  requireInvariant singleDefaultAdmin(e.msg.sender, defaultAdmin());
+  requireInvariant defaultAdminConsistency(e.msg.sender);

  uint48 delayBefore = defaultAdminDelay(e);

@ -377,7 +389,9 @@ rule changeDefaultAdminDelay(env e, uint48 newDelay) {
    "only the current default admin can begin a delay change";

  // effect
-  assert success => pendingDelay_(e) == newDelay, "pending delay is set";
+  assert success => pendingDelay_(e) == newDelay,
+    "pending delay is set";
+
  assert success => (
    pendingDelaySchedule_(e) > e.block.timestamp ||
    delayBefore == newDelay || // Interpreted as decreasing, x - x = 0
@ -392,17 +406,22 @@ rule changeDefaultAdminDelay(env e, uint48 newDelay) {
 └─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┘
 */
 rule pendingDelayWaitEnforced(env e1, env e2, method f, calldataarg args, uint48 newDelay) {
-  require e1.block.timestamp < e2.block.timestamp;
+  require e1.block.timestamp <= e2.block.timestamp;

  uint48 delayBefore = defaultAdminDelay(e1);
+
  changeDefaultAdminDelay(e1, newDelay);
  f(e2, args);
+
  uint48 delayAfter = defaultAdminDelay(e2);

  mathint delayWait = newDelay > delayBefore ? increasingDelaySchedule(e1, newDelay) : decreasingDelaySchedule(e1, newDelay);

-  assert delayAfter == newDelay => (e2.block.timestamp >= delayWait || delayBefore == newDelay),
-    "A delay can't change in less than applied schedule";
+  assert delayAfter != delayBefore => (
+    delayAfter == newDelay &&
+    e2.block.timestamp >= delayWait
+  ),
+    "A delay can only change after the applied schedule";
 }

 /*
@ -427,8 +446,8 @@ rule pendingDelayWait(env e, uint48 newDelay) {
 */
 rule rollbackDefaultAdminDelay(env e) {
  require nonpayable(e);
-  requireInvariant defaultAdminConsistency(defaultAdmin());
-  requireInvariant singleDefaultAdmin(e.msg.sender, defaultAdmin());
+  require nonzerosender(e);
+  requireInvariant defaultAdminConsistency(e.msg.sender);

  rollbackDefaultAdminDelay@withrevert(e);
  bool success = !lastReverted;
@ -443,58 +462,3 @@ rule rollbackDefaultAdminDelay(env e) {
  assert success => pendingDelaySchedule_(e) == 0,
    "Pending default admin delay is reset";
 }
-
-/*
-┌─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐
-│ Rule: pending default admin and the delay can only change along with their corresponding schedules                  │
-└─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┘
-*/
-rule pendingValueAndScheduleCoupling(env e, address newAdmin, uint48 newDelay) {
-  requireInvariant defaultAdminConsistency(defaultAdmin());
-  requireInvariant singleDefaultAdmin(e.msg.sender, defaultAdmin());
-
-  // Pending admin
-  address pendingAdminBefore = pendingDefaultAdmin_();
-  uint48 pendingAdminScheduleBefore = pendingDefaultAdminSchedule_();
-
-  beginDefaultAdminTransfer(e, newAdmin);
-
-  address pendingAdminAfter = pendingDefaultAdmin_();
-  uint48 pendingAdminScheduleAfter = pendingDefaultAdminSchedule_();
-
-  assert (
-    pendingAdminScheduleBefore != pendingDefaultAdminSchedule_() &&
-    pendingAdminBefore == pendingAdminAfter
-  ) => newAdmin == pendingAdminBefore, "pending admin stays the same if the new admin set is the same";
-
-  assert (
-    pendingAdminBefore != pendingAdminAfter &&
-    pendingAdminScheduleBefore == pendingDefaultAdminSchedule_()
-  ) => (
-    // Schedule doesn't change if:
-    // - The defaultAdminDelay was reduced to a value such that added to the block.timestamp is equal to previous schedule
-    e.block.timestamp + defaultAdminDelay(e) == pendingAdminScheduleBefore
-  ), "pending admin stays the same if a default admin transfer is begun on accepted edge cases";
-
-  // Pending delay
-  address pendingDelayBefore = pendingDelay_(e);
-  uint48 pendingDelayScheduleBefore = pendingDelaySchedule_(e);
-
-  changeDefaultAdminDelay(e, newDelay);
-
-  address pendingDelayAfter = pendingDelay_(e);
-  uint48 pendingDelayScheduleAfter = pendingDelaySchedule_(e);
-
-  assert (
-    pendingDelayScheduleBefore != pendingDelayScheduleAfter &&
-    pendingDelayBefore == pendingDelayAfter
-  ) => newDelay == pendingDelayBefore || pendingDelayBefore == 0, "pending delay stays the same if the new delay set is the same";
-
-  assert (
-    pendingDelayBefore != pendingDelayAfter &&
-    pendingDelayScheduleBefore == pendingDelayScheduleAfter
-  ) => (
-    increasingDelaySchedule(e, newDelay) == pendingDelayScheduleBefore ||
-    decreasingDelaySchedule(e, newDelay) == pendingDelayScheduleBefore
-  ), "pending delay stays the same if a default admin transfer is begun on accepted edge cases";
-}
--- a/certora/specs/helpers/helpers.spec
+++ b/certora/specs/helpers/helpers.spec
@ -1 +1,10 @@
+// environment
 definition nonpayable(env e) returns bool = e.msg.value == 0;
+definition nonzerosender(env e) returns bool = e.msg.sender != 0;
+
+// constants
+definition max_uint48() returns mathint = (1 << 48) - 1;
+
+// math
+definition min(mathint a, mathint b) returns mathint = a < b ? a : b;
+definition max(mathint a, mathint b) returns mathint = a > b ? a : b;
--- a/contracts/access/AccessControl.sol
+++ b/contracts/access/AccessControl.sol
@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Contracts (last updated v4.8.0) (access/AccessControl.sol)
+// OpenZeppelin Contracts (last updated v4.9.0) (access/AccessControl.sol)

 pragma solidity ^0.8.0;

--- a/contracts/access/AccessControlDefaultAdminRules.sol
+++ b/contracts/access/AccessControlDefaultAdminRules.sol
@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Contracts (last updated v4.8.0) (access/AccessControlDefaultAdminRules.sol)
+// OpenZeppelin Contracts (last updated v4.9.0) (access/AccessControlDefaultAdminRules.sol)

 pragma solidity ^0.8.0;

--- a/contracts/access/IAccessControlDefaultAdminRules.sol
+++ b/contracts/access/IAccessControlDefaultAdminRules.sol
@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Contracts v4.9.0 (access/IAccessControlDefaultAdminRules.sol)
+// OpenZeppelin Contracts (last updated v4.9.0) (access/IAccessControlDefaultAdminRules.sol)

 pragma solidity ^0.8.0;

--- a/contracts/access/Ownable.sol
+++ b/contracts/access/Ownable.sol
@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Contracts (last updated v4.7.0) (access/Ownable.sol)
+// OpenZeppelin Contracts (last updated v4.9.0) (access/Ownable.sol)

 pragma solidity ^0.8.0;

--- a/contracts/access/Ownable2Step.sol
+++ b/contracts/access/Ownable2Step.sol
@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Contracts (last updated v4.8.0) (access/Ownable2Step.sol)
+// OpenZeppelin Contracts (last updated v4.9.0) (access/Ownable2Step.sol)

 pragma solidity ^0.8.0;

--- a/contracts/finance/VestingWallet.sol
+++ b/contracts/finance/VestingWallet.sol
@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Contracts (last updated v4.8.0) (finance/VestingWallet.sol)
+// OpenZeppelin Contracts (last updated v4.9.0) (finance/VestingWallet.sol)
 pragma solidity ^0.8.0;

 import "../token/ERC20/utils/SafeERC20.sol";
--- a/contracts/governance/Governor.sol
+++ b/contracts/governance/Governor.sol
@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Contracts (last updated v4.8.0) (governance/Governor.sol)
+// OpenZeppelin Contracts (last updated v4.9.0) (governance/Governor.sol)

 pragma solidity ^0.8.0;

--- a/contracts/governance/IGovernor.sol
+++ b/contracts/governance/IGovernor.sol
@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Contracts (last updated v4.8.0) (governance/IGovernor.sol)
+// OpenZeppelin Contracts (last updated v4.9.0) (governance/IGovernor.sol)

 pragma solidity ^0.8.0;

--- a/contracts/governance/TimelockController.sol
+++ b/contracts/governance/TimelockController.sol
@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Contracts (last updated v4.8.2) (governance/TimelockController.sol)
+// OpenZeppelin Contracts (last updated v4.9.0) (governance/TimelockController.sol)

 pragma solidity ^0.8.0;

--- a/contracts/governance/compatibility/GovernorCompatibilityBravo.sol
+++ b/contracts/governance/compatibility/GovernorCompatibilityBravo.sol
@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Contracts (last updated v4.8.3) (governance/compatibility/GovernorCompatibilityBravo.sol)
+// OpenZeppelin Contracts (last updated v4.9.0) (governance/compatibility/GovernorCompatibilityBravo.sol)

 pragma solidity ^0.8.0;

--- a/contracts/governance/compatibility/IGovernorCompatibilityBravo.sol
+++ b/contracts/governance/compatibility/IGovernorCompatibilityBravo.sol
@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Contracts v4.4.1 (governance/compatibility/IGovernorCompatibilityBravo.sol)
+// OpenZeppelin Contracts (last updated v4.9.0) (governance/compatibility/IGovernorCompatibilityBravo.sol)

 pragma solidity ^0.8.0;

--- a/contracts/governance/extensions/GovernorCountingSimple.sol
+++ b/contracts/governance/extensions/GovernorCountingSimple.sol
@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Contracts (last updated v4.8.0) (governance/extensions/GovernorCountingSimple.sol)
+// OpenZeppelin Contracts (last updated v4.9.0) (governance/extensions/GovernorCountingSimple.sol)

 pragma solidity ^0.8.0;

--- a/contracts/governance/extensions/GovernorPreventLateQuorum.sol
+++ b/contracts/governance/extensions/GovernorPreventLateQuorum.sol
@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Contracts (last updated v4.6.0) (governance/extensions/GovernorPreventLateQuorum.sol)
+// OpenZeppelin Contracts (last updated v4.9.0) (governance/extensions/GovernorPreventLateQuorum.sol)

 pragma solidity ^0.8.0;

--- a/contracts/governance/extensions/GovernorSettings.sol
+++ b/contracts/governance/extensions/GovernorSettings.sol
@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Contracts v4.4.1 (governance/extensions/GovernorSettings.sol)
+// OpenZeppelin Contracts (last updated v4.9.0) (governance/extensions/GovernorSettings.sol)

 pragma solidity ^0.8.0;

--- a/contracts/governance/extensions/GovernorTimelockCompound.sol
+++ b/contracts/governance/extensions/GovernorTimelockCompound.sol
@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Contracts (last updated v4.6.0) (governance/extensions/GovernorTimelockCompound.sol)
+// OpenZeppelin Contracts (last updated v4.9.0) (governance/extensions/GovernorTimelockCompound.sol)

 pragma solidity ^0.8.0;

--- a/contracts/governance/extensions/GovernorTimelockControl.sol
+++ b/contracts/governance/extensions/GovernorTimelockControl.sol
@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Contracts (last updated v4.6.0) (governance/extensions/GovernorTimelockControl.sol)
+// OpenZeppelin Contracts (last updated v4.9.0) (governance/extensions/GovernorTimelockControl.sol)

 pragma solidity ^0.8.0;

--- a/contracts/governance/extensions/GovernorVotes.sol
+++ b/contracts/governance/extensions/GovernorVotes.sol
@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Contracts (last updated v4.6.0) (governance/extensions/GovernorVotes.sol)
+// OpenZeppelin Contracts (last updated v4.9.0) (governance/extensions/GovernorVotes.sol)

 pragma solidity ^0.8.0;

--- a/contracts/governance/extensions/GovernorVotesComp.sol
+++ b/contracts/governance/extensions/GovernorVotesComp.sol
@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Contracts (last updated v4.6.0) (governance/extensions/GovernorVotesComp.sol)
+// OpenZeppelin Contracts (last updated v4.9.0) (governance/extensions/GovernorVotesComp.sol)

 pragma solidity ^0.8.0;

--- a/contracts/governance/extensions/GovernorVotesQuorumFraction.sol
+++ b/contracts/governance/extensions/GovernorVotesQuorumFraction.sol
@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Contracts (last updated v4.8.0) (governance/extensions/GovernorVotesQuorumFraction.sol)
+// OpenZeppelin Contracts (last updated v4.9.0) (governance/extensions/GovernorVotesQuorumFraction.sol)

 pragma solidity ^0.8.0;

--- a/contracts/governance/utils/IVotes.sol
+++ b/contracts/governance/utils/IVotes.sol
@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Contracts (last updated v4.5.0) (governance/utils/IVotes.sol)
+// OpenZeppelin Contracts (last updated v4.9.0) (governance/utils/IVotes.sol)
 pragma solidity ^0.8.0;

 /**
--- a/contracts/governance/utils/Votes.sol
+++ b/contracts/governance/utils/Votes.sol
@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Contracts (last updated v4.8.0) (governance/utils/Votes.sol)
+// OpenZeppelin Contracts (last updated v4.9.0) (governance/utils/Votes.sol)
 pragma solidity ^0.8.0;

 import "../../interfaces/IERC5805.sol";
--- a/contracts/interfaces/IERC1363.sol
+++ b/contracts/interfaces/IERC1363.sol
@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Contracts v4.4.1 (interfaces/IERC1363.sol)
+// OpenZeppelin Contracts (last updated v4.9.0) (interfaces/IERC1363.sol)

 pragma solidity ^0.8.0;

--- a/contracts/interfaces/IERC1363Receiver.sol
+++ b/contracts/interfaces/IERC1363Receiver.sol
@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Contracts v4.4.1 (interfaces/IERC1363Receiver.sol)
+// OpenZeppelin Contracts (last updated v4.9.0) (interfaces/IERC1363Receiver.sol)

 pragma solidity ^0.8.0;

--- a/contracts/interfaces/IERC1363Spender.sol
+++ b/contracts/interfaces/IERC1363Spender.sol
@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Contracts v4.4.1 (interfaces/IERC1363Spender.sol)
+// OpenZeppelin Contracts (last updated v4.9.0) (interfaces/IERC1363Spender.sol)

 pragma solidity ^0.8.0;

--- a/contracts/interfaces/IERC1967.sol
+++ b/contracts/interfaces/IERC1967.sol
@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MIT
+// OpenZeppelin Contracts (last updated v4.9.0) (interfaces/IERC1967.sol)

 pragma solidity ^0.8.0;

--- a/contracts/interfaces/IERC2612.sol
+++ b/contracts/interfaces/IERC2612.sol
@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Contracts v4.4.1 (interfaces/IERC2612.sol)
+// OpenZeppelin Contracts (last updated v4.9.0) (interfaces/IERC2612.sol)

 pragma solidity ^0.8.0;

--- a/contracts/interfaces/IERC2981.sol
+++ b/contracts/interfaces/IERC2981.sol
@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Contracts (last updated v4.6.0) (interfaces/IERC2981.sol)
+// OpenZeppelin Contracts (last updated v4.9.0) (interfaces/IERC2981.sol)

 pragma solidity ^0.8.0;

--- a/contracts/interfaces/IERC3156FlashBorrower.sol
+++ b/contracts/interfaces/IERC3156FlashBorrower.sol
@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Contracts (last updated v4.7.0) (interfaces/IERC3156FlashBorrower.sol)
+// OpenZeppelin Contracts (last updated v4.9.0) (interfaces/IERC3156FlashBorrower.sol)

 pragma solidity ^0.8.0;

--- a/contracts/interfaces/IERC4626.sol
+++ b/contracts/interfaces/IERC4626.sol
@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Contracts (last updated v4.8.0) (interfaces/IERC4626.sol)
+// OpenZeppelin Contracts (last updated v4.9.0) (interfaces/IERC4626.sol)

 pragma solidity ^0.8.0;

--- a/contracts/interfaces/IERC4906.sol
+++ b/contracts/interfaces/IERC4906.sol
@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MIT
+// OpenZeppelin Contracts (last updated v4.9.0) (interfaces/IERC4906.sol)

 pragma solidity ^0.8.0;

--- a/contracts/interfaces/IERC5267.sol
+++ b/contracts/interfaces/IERC5267.sol
@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MIT
+// OpenZeppelin Contracts (last updated v4.9.0) (interfaces/IERC5267.sol)

 pragma solidity ^0.8.0;

--- a/contracts/interfaces/IERC5313.sol
+++ b/contracts/interfaces/IERC5313.sol
@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MIT
+// OpenZeppelin Contracts (last updated v4.9.0) (interfaces/IERC5313.sol)

 pragma solidity ^0.8.0;

--- a/contracts/interfaces/IERC5805.sol
+++ b/contracts/interfaces/IERC5805.sol
@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Contracts (interfaces/IERC5805.sol)
+// OpenZeppelin Contracts (last updated v4.9.0) (interfaces/IERC5805.sol)

 pragma solidity ^0.8.0;

--- a/contracts/interfaces/IERC6372.sol
+++ b/contracts/interfaces/IERC6372.sol
@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Contracts (interfaces/IERC6372.sol)
+// OpenZeppelin Contracts (last updated v4.9.0) (interfaces/IERC6372.sol)

 pragma solidity ^0.8.0;

--- a/contracts/metatx/MinimalForwarder.sol
+++ b/contracts/metatx/MinimalForwarder.sol
@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Contracts (last updated v4.8.0) (metatx/MinimalForwarder.sol)
+// OpenZeppelin Contracts (last updated v4.9.0) (metatx/MinimalForwarder.sol)

 pragma solidity ^0.8.0;

--- a/contracts/package.json
+++ b/contracts/package.json
@ -1,7 +1,7 @@
 {
  "name": "@openzeppelin/contracts",
  "description": "Secure Smart Contract library for Solidity",
-  "version": "4.8.2",
+  "version": "4.9.0",
  "files": [
    "**/*.sol",
    "/build/contracts/*.json",
--- a/contracts/proxy/Clones.sol
+++ b/contracts/proxy/Clones.sol
@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Contracts (last updated v4.8.0) (proxy/Clones.sol)
+// OpenZeppelin Contracts (last updated v4.9.0) (proxy/Clones.sol)

 pragma solidity ^0.8.0;

--- a/contracts/proxy/ERC1967/ERC1967Upgrade.sol
+++ b/contracts/proxy/ERC1967/ERC1967Upgrade.sol
@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Contracts (last updated v4.8.3) (proxy/ERC1967/ERC1967Upgrade.sol)
+// OpenZeppelin Contracts (last updated v4.9.0) (proxy/ERC1967/ERC1967Upgrade.sol)

 pragma solidity ^0.8.2;

--- a/contracts/proxy/transparent/TransparentUpgradeableProxy.sol
+++ b/contracts/proxy/transparent/TransparentUpgradeableProxy.sol
@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Contracts (last updated v4.8.3) (proxy/transparent/TransparentUpgradeableProxy.sol)
+// OpenZeppelin Contracts (last updated v4.9.0) (proxy/transparent/TransparentUpgradeableProxy.sol)

 pragma solidity ^0.8.0;

--- a/contracts/proxy/utils/Initializable.sol
+++ b/contracts/proxy/utils/Initializable.sol
@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Contracts (last updated v4.8.1) (proxy/utils/Initializable.sol)
+// OpenZeppelin Contracts (last updated v4.9.0) (proxy/utils/Initializable.sol)

 pragma solidity ^0.8.2;

--- a/contracts/proxy/utils/UUPSUpgradeable.sol
+++ b/contracts/proxy/utils/UUPSUpgradeable.sol
@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Contracts (last updated v4.8.0) (proxy/utils/UUPSUpgradeable.sol)
+// OpenZeppelin Contracts (last updated v4.9.0) (proxy/utils/UUPSUpgradeable.sol)

 pragma solidity ^0.8.0;

--- a/contracts/security/ReentrancyGuard.sol
+++ b/contracts/security/ReentrancyGuard.sol
@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Contracts (last updated v4.8.0) (security/ReentrancyGuard.sol)
+// OpenZeppelin Contracts (last updated v4.9.0) (security/ReentrancyGuard.sol)

 pragma solidity ^0.8.0;

--- a/contracts/token/ERC1155/ERC1155.sol
+++ b/contracts/token/ERC1155/ERC1155.sol
@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Contracts (last updated v4.8.0) (token/ERC1155/ERC1155.sol)
+// OpenZeppelin Contracts (last updated v4.9.0) (token/ERC1155/ERC1155.sol)

 pragma solidity ^0.8.1;

@ -65,7 +65,6 @@ contract ERC1155 is Context, ERC165, IERC1155, IERC1155MetadataURI {
     * - `account` cannot be the zero address.
     */
    function balanceOf(address account, uint256 id) public view virtual override returns (uint256) {
-        require(account != address(0), "ERC1155: address zero is not a valid owner");
        return _balances[id][account];
    }

--- a/contracts/token/ERC1155/IERC1155.sol
+++ b/contracts/token/ERC1155/IERC1155.sol
@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Contracts (last updated v4.7.0) (token/ERC1155/IERC1155.sol)
+// OpenZeppelin Contracts (last updated v4.9.0) (token/ERC1155/IERC1155.sol)

 pragma solidity ^0.8.0;

--- a/contracts/token/ERC1155/extensions/ERC1155Burnable.sol
+++ b/contracts/token/ERC1155/extensions/ERC1155Burnable.sol
@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Contracts (last updated v4.8.0) (token/ERC1155/extensions/ERC1155Burnable.sol)
+// OpenZeppelin Contracts (last updated v4.9.0) (token/ERC1155/extensions/ERC1155Burnable.sol)

 pragma solidity ^0.8.0;

--- a/contracts/token/ERC20/ERC20.sol
+++ b/contracts/token/ERC20/ERC20.sol
@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Contracts (last updated v4.8.0) (token/ERC20/ERC20.sol)
+// OpenZeppelin Contracts (last updated v4.9.0) (token/ERC20/ERC20.sol)

 pragma solidity ^0.8.0;

--- a/contracts/token/ERC20/IERC20.sol
+++ b/contracts/token/ERC20/IERC20.sol
@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Contracts (last updated v4.6.0) (token/ERC20/IERC20.sol)
+// OpenZeppelin Contracts (last updated v4.9.0) (token/ERC20/IERC20.sol)

 pragma solidity ^0.8.0;

--- a/contracts/token/ERC20/extensions/ERC20Pausable.sol
+++ b/contracts/token/ERC20/extensions/ERC20Pausable.sol
@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Contracts (last updated v4.8.2) (token/ERC20/extensions/ERC20Pausable.sol)
+// OpenZeppelin Contracts (last updated v4.9.0) (token/ERC20/extensions/ERC20Pausable.sol)

 pragma solidity ^0.8.0;

--- a/contracts/token/ERC20/extensions/ERC20Permit.sol
+++ b/contracts/token/ERC20/extensions/ERC20Permit.sol
@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Contracts (last updated v4.6.0) (token/ERC20/extensions/ERC20Permit.sol)
+// OpenZeppelin Contracts (last updated v4.9.0) (token/ERC20/extensions/ERC20Permit.sol)

 pragma solidity ^0.8.0;

--- a/contracts/token/ERC20/extensions/ERC20Snapshot.sol
+++ b/contracts/token/ERC20/extensions/ERC20Snapshot.sol
@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Contracts (last updated v4.7.0) (token/ERC20/extensions/ERC20Snapshot.sol)
+// OpenZeppelin Contracts (last updated v4.9.0) (token/ERC20/extensions/ERC20Snapshot.sol)

 pragma solidity ^0.8.0;

--- a/contracts/token/ERC20/extensions/ERC20Votes.sol
+++ b/contracts/token/ERC20/extensions/ERC20Votes.sol
@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Contracts (last updated v4.8.1) (token/ERC20/extensions/ERC20Votes.sol)
+// OpenZeppelin Contracts (last updated v4.9.0) (token/ERC20/extensions/ERC20Votes.sol)

 pragma solidity ^0.8.0;

--- a/contracts/token/ERC20/extensions/ERC20Wrapper.sol
+++ b/contracts/token/ERC20/extensions/ERC20Wrapper.sol
@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Contracts (last updated v4.6.0) (token/ERC20/extensions/ERC20Wrapper.sol)
+// OpenZeppelin Contracts (last updated v4.9.0) (token/ERC20/extensions/ERC20Wrapper.sol)

 pragma solidity ^0.8.0;

--- a/contracts/token/ERC20/extensions/ERC4626.sol
+++ b/contracts/token/ERC20/extensions/ERC4626.sol
@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Contracts (last updated v4.8.1) (token/ERC20/extensions/ERC4626.sol)
+// OpenZeppelin Contracts (last updated v4.9.0) (token/ERC20/extensions/ERC4626.sol)

 pragma solidity ^0.8.0;

--- a/contracts/token/ERC20/extensions/IERC20Permit.sol
+++ b/contracts/token/ERC20/extensions/IERC20Permit.sol
@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Contracts v4.4.1 (token/ERC20/extensions/IERC20Permit.sol)
+// OpenZeppelin Contracts (last updated v4.9.0) (token/ERC20/extensions/IERC20Permit.sol)

 pragma solidity ^0.8.0;

--- a/contracts/token/ERC20/utils/SafeERC20.sol
+++ b/contracts/token/ERC20/utils/SafeERC20.sol
@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Contracts (last updated v4.8.0) (token/ERC20/utils/SafeERC20.sol)
+// OpenZeppelin Contracts (last updated v4.9.0) (token/ERC20/utils/SafeERC20.sol)

 pragma solidity ^0.8.1;

--- a/contracts/token/ERC20/utils/TokenTimelock.sol
+++ b/contracts/token/ERC20/utils/TokenTimelock.sol
@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Contracts (last updated v4.5.0) (token/ERC20/utils/TokenTimelock.sol)
+// OpenZeppelin Contracts (last updated v4.9.0) (token/ERC20/utils/TokenTimelock.sol)

 pragma solidity ^0.8.0;

--- a/contracts/token/ERC721/ERC721.sol
+++ b/contracts/token/ERC721/ERC721.sol
@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Contracts (last updated v4.8.2) (token/ERC721/ERC721.sol)
+// OpenZeppelin Contracts (last updated v4.9.0) (token/ERC721/ERC721.sol)

 pragma solidity ^0.8.1;

--- a/contracts/token/ERC721/IERC721.sol
+++ b/contracts/token/ERC721/IERC721.sol
@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Contracts (last updated v4.8.0) (token/ERC721/IERC721.sol)
+// OpenZeppelin Contracts (last updated v4.9.0) (token/ERC721/IERC721.sol)

 pragma solidity ^0.8.0;

--- a/contracts/token/ERC721/extensions/ERC721Consecutive.sol
+++ b/contracts/token/ERC721/extensions/ERC721Consecutive.sol
@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Contracts (last updated v4.8.2) (token/ERC721/extensions/ERC721Consecutive.sol)
+// OpenZeppelin Contracts (last updated v4.9.0) (token/ERC721/extensions/ERC721Consecutive.sol)

 pragma solidity ^0.8.1;

--- a/contracts/token/ERC721/extensions/ERC721URIStorage.sol
+++ b/contracts/token/ERC721/extensions/ERC721URIStorage.sol
@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Contracts (last updated v4.7.0) (token/ERC721/extensions/ERC721URIStorage.sol)
+// OpenZeppelin Contracts (last updated v4.9.0) (token/ERC721/extensions/ERC721URIStorage.sol)

 pragma solidity ^0.8.0;

--- a/Show More
+++ b/Show More