/// @notice Callback function for the flash loan taken out in increaseLever
    /// @param data The encoded bytes that were passed into the flash loan
    function onFlashLoan(
        address /*initiator*/,
        address /*token*/,
        uint256 amount,
        uint256 fee,
        bytes calldata data
    ) external returns (bytes32) {
@@ 425,446 @@
        if (msg.sender != address(flashlender)) revert PositionAction__onFlashLoan__invalidSender();

        (LeverParams memory leverParams, address upFrontToken, uint256 upFrontAmount) = abi.decode(
            data,
            (LeverParams, address, uint256)
        );

        // perform a pre swap from arbitrary token to collateral token if necessary
        if (leverParams.auxSwap.assetIn != address(0)) {
            bytes memory auxSwapData = _delegateCall(
                address(swapAction),
                abi.encodeWithSelector(swapAction.swap.selector, leverParams.auxSwap)
            );
            upFrontAmount = abi.decode(auxSwapData, (uint256));
        }

        // handle the flash loan swap
        bytes memory swapData = _delegateCall(
            address(swapAction),
            abi.encodeWithSelector(swapAction.swap.selector, leverParams.primarySwap)
        );
        uint256 swapAmountOut = abi.decode(swapData, (uint256));

        // deposit collateral and handle any CDP specific actions
        uint256 collateral = _onIncreaseLever(leverParams, upFrontToken, upFrontAmount, swapAmountOut);

        // derive the amount of normal debt from the swap amount out
        uint256 addDebt = amount + fee;

        // add collateral and debt
        ICDPVault(leverParams.vault).modifyCollateralAndDebt(
            leverParams.position,
            address(this),
            address(this),
            toInt256(collateral),
            toInt256(addDebt)
        );

        underlyingToken.forceApprove(address(flashlender), addDebt);

        return CALLBACK_SUCCESS;
    }

@@ 406,413 @@
    /// @notice Modifies a Position's collateral and debt balances
    /// @dev Checks that the global debt ceiling and the vault's debt ceiling have not been exceeded via the CDM,
    /// - that the Position is still safe after the modification,
    /// - that the msg.sender has the permission of the owner to decrease the collateral-to-debt ratio,
    /// - that the msg.sender has the permission of the collateralizer to put up new collateral,
    /// - that the msg.sender has the permission of the creditor to settle debt with their credit,
    /// - that that the vault debt floor is exceeded
    /// - that the vault minimum collateralization ratio is met
    /// @param owner Address of the owner of the position
    /// @param collateralizer Address of who puts up or receives the collateral delta
    /// @param creditor Address of who provides or receives the credit delta for the debt delta
    /// @param deltaCollateral Amount of collateral to put up (+) or to remove (-) from the position [wad]
    /// @param deltaDebt Amount of normalized debt (gross, before rate is applied) to generate (+) or
    /// to settle (-) on this position [wad]
    function modifyCollateralAndDebt(
        address owner,
        address collateralizer,
        address creditor,
        int256 deltaCollateral,
        int256 deltaDebt
    ) public {
@@ 427,505 @@
        if (
            // position is either more safe than before or msg.sender has the permission from the owner
            ((deltaDebt > 0 || deltaCollateral < 0) && !hasPermission(owner, msg.sender)) ||
            // msg.sender has the permission of the collateralizer to collateralize the position using their cash
            (deltaCollateral > 0 && !hasPermission(collateralizer, msg.sender)) ||
            // msg.sender has the permission of the creditor to use their credit to repay the debt
            (deltaDebt < 0 && !hasPermission(creditor, msg.sender))
        ) revert CDPVault__modifyCollateralAndDebt_noPermission();

        // if the vault is paused allow only debt decreases
        if (deltaDebt > 0 || deltaCollateral != 0) {
            _requireNotPaused();
        }

        Position memory position = positions[owner];
        DebtData memory debtData = _calcDebt(position);

        uint256 newDebt;
        uint256 newCumulativeIndex;

        uint256 profit;
        int256 quotaRevenueChange;
        if (deltaDebt > 0) {
            uint256 debtToIncrease = uint256(deltaDebt);

            // Internal debt calculation remains in 18-decimal precision
            (newDebt, newCumulativeIndex) = CreditLogic.calcIncrease(
                debtToIncrease,
                position.debt,
                debtData.cumulativeIndexNow,
                position.cumulativeIndexLastUpdate
            );

            position.cumulativeQuotaInterest = debtData.cumulativeQuotaInterest;
            position.cumulativeQuotaIndexLU = debtData.cumulativeQuotaIndexNow;
            quotaRevenueChange = _calcQuotaRevenueChange(deltaDebt);

            uint256 scaledDebtIncrease = wmul(debtToIncrease, poolUnderlyingScale);
            pool.lendCreditAccount(scaledDebtIncrease, creditor);
        } else if (deltaDebt < 0) {
            uint256 debtToDecrease = abs(deltaDebt);

            uint256 maxRepayment = calcTotalDebt(debtData);
            if (debtToDecrease >= maxRepayment) {
                debtToDecrease = maxRepayment;
                deltaDebt = -toInt256(debtToDecrease);
            }

            uint256 scaledDebtDecrease = wmul(debtToDecrease, poolUnderlyingScale);
            poolUnderlying.safeTransferFrom(creditor, address(pool), scaledDebtDecrease);

            uint128 newCumulativeQuotaInterest;
            if (debtToDecrease == maxRepayment) {
                newDebt = 0;
                newCumulativeIndex = debtData.cumulativeIndexNow;
                profit = debtData.accruedInterest;
                newCumulativeQuotaInterest = 0;
            } else {
                (newDebt, newCumulativeIndex, profit, newCumulativeQuotaInterest) = calcDecrease(
                    debtToDecrease,
                    position.debt,
                    debtData.cumulativeIndexNow,
                    position.cumulativeIndexLastUpdate,
                    debtData.cumulativeQuotaInterest
                );
            }

            quotaRevenueChange = _calcQuotaRevenueChange(-int(debtData.debt - newDebt));

            uint256 scaledRemainingDebt = wmul(debtData.debt - newDebt, poolUnderlyingScale);
            uint256 scaledProfit = wmul(profit, poolUnderlyingScale);
            pool.repayCreditAccount(scaledRemainingDebt, scaledProfit, 0);

            position.cumulativeQuotaInterest = newCumulativeQuotaInterest;
            position.cumulativeQuotaIndexLU = debtData.cumulativeQuotaIndexNow;
        } else {
            newDebt = position.debt;
            newCumulativeIndex = debtData.cumulativeIndexLastUpdate;
        }

        if (deltaCollateral > 0) {
            uint256 amount = wmul(deltaCollateral.toUint256(), tokenScale);
            token.safeTransferFrom(collateralizer, address(this), amount);
        } else if (deltaCollateral < 0) {
            uint256 amount = wmul(abs(deltaCollateral), tokenScale);
            token.safeTransfer(collateralizer, amount);
        }

@@ 515,530 @@
        position = _modifyPosition(owner, position, newDebt, newCumulativeIndex, deltaCollateral, totalDebt);

        VaultConfig memory config = vaultConfig;
        uint256 spotPrice_ = spotPrice();
        uint256 collateralValue = wmul(position.collateral, spotPrice_);

        if (
            (deltaDebt > 0 || deltaCollateral < 0) &&
            !_isCollateralized(calcTotalDebt(_calcDebt(position)), collateralValue, config.liquidationRatio)
        ) revert CDPVault__modifyCollateralAndDebt_notSafe();

        if (quotaRevenueChange != 0) {
            int256 scaledQuotaRevenueChange = wmul(poolUnderlyingScale, quotaRevenueChange);
            IPoolV3(pool).updateQuotaRevenue(scaledQuotaRevenueChange);
        }
        emit ModifyCollateralAndDebt(owner, collateralizer, creditor, deltaCollateral, deltaDebt);
    }

function _onDecreaseLever(
    LeverParams memory leverParams,
    uint256 subCollateral
) internal override returns (uint256 tokenOut) {
    _onWithdraw(leverParams.vault, leverParams.position, address(0), subCollateral, 0);
    (address pendleToken, , ) = abi.decode(leverParams.auxAction.args, (address, uint256, address));
    penpieHelper.withdrawMarket(pendleToken, subCollateral);
    if (leverParams.auxAction.args.length != 0) {
        bytes memory exitData = _delegateCall(
            address(poolAction),
            abi.encodeWithSelector(poolAction.exit.selector, leverParams.auxAction)
        );

        tokenOut = abi.decode(exitData, (uint256));
    }
}

/// @notice General parameters relevant for both increasing and decreasing leverage
struct LeverParams {
    // position to lever
    address position;
    // the vault to lever
    address vault;
    // the vault's token
    address collateralToken;
    // the swap parameters to swap collateral to underlying token or vice versa
    SwapParams primarySwap;
    // optional swap parameters to swap an arbitrary token to the collateral token or vice versa
    SwapParams auxSwap;
    // optional action parameters
    PoolActionParams auxAction;
}

@@ 91,96 @@
    /// @notice Hook to increase lever by depositing collateral into the CDPVault
    /// @param leverParams LeverParams struct
    /// @param /*upFrontToken*/ the address of the token passed up front
    /// @param /*upFrontAmount*/ the amount of tokens passed up front [CDPVault.tokenScale()]
    /// @param /*swapAmountOut*/ the amount of tokens received from the stablecoin flash loan swap [CDPVault.tokenScale()]
    /// @return addCollateralAmount Amount of collateral added to CDPVault position [wad]
    function _onIncreaseLever(
        LeverParams memory leverParams,
        address /*upFrontToken*/,
        uint256 /*upFrontAmount*/,
        uint256 /*swapAmountOut*/
    ) internal override returns (uint256 addCollateralAmount) {
        if (leverParams.auxAction.args.length != 0) {
            _delegateCall(address(poolAction), abi.encodeWithSelector(poolAction.join.selector, leverParams.auxAction));
        }
        addCollateralAmount = IERC20(leverParams.collateralToken).balanceOf(address(this));
        IERC20(leverParams.collateralToken).forceApprove(address(penpieStaking), addCollateralAmount);
        penpieHelper.depositMarketFor(leverParams.collateralToken, address(this), addCollateralAmount);

        addCollateralAmount = ICDPVault(leverParams.vault).token().balanceOf(address(this));
        ICDPVault(leverParams.vault).token().forceApprove(leverParams.vault, addCollateralAmount);

        // deposit into the CDP Vault
        return addCollateralAmount;
    }

    function _updateRewardIndex()
        internal
        virtual
        override
        returns (address[] memory tokens, uint256[] memory indexes)
    {
        tokens = _getRewardTokens();
        indexes = new uint256[](tokens.length);

        if (tokens.length == 0) return (tokens, indexes);

        if (lastRewardBlock != block.number) {
            // if we have not yet update the index for this block
            lastRewardBlock = block.number;

            uint256 totalShares = _rewardSharesTotal();
            address[] memory stakingTokens = new address[](1);
            stakingTokens[0] = stakingToken;
            address[][] memory rewardTokens = new address[][](1);
            // Claim external rewards
            masterPenpie.multiclaimFor(stakingTokens, rewardTokens, vault);
            for (uint256 i = 0; i < tokens.length; ++i) {
                address token = tokens[i];

                // the entire token balance of the contract must be the rewards of the contract
                RewardState memory _state = rewardState[token];
                (uint256 lastBalance, uint256 index) = (_state.lastBalance, _state.index);

                uint256 accrued = IERC20(tokens[i]).balanceOf(vault) - lastBalance;
                uint256 deltaIndex;
                uint256 advanceBalance;
                if (totalShares != 0) {
                    deltaIndex = accrued.divDown(totalShares);
                    advanceBalance = deltaIndex.mulDown(totalShares);
                }

                if (index == 0) index = INITIAL_REWARD_INDEX;
                if (totalShares != 0) index += deltaIndex;

                rewardState[token] = RewardState({
                    index: index.Uint128(),
                    lastBalance: (lastBalance + advanceBalance).Uint128()
                });

                indexes[i] = index;
            }
        } else {
            for (uint256 i = 0; i < tokens.length; i++) {
                indexes[i] = rewardState[tokens[i]].index;
            }
        }
    }

 /// @notice Hook to decrease lever by withdrawing collateral from the CDPVault
/// @param leverParams LeverParams struct
/// @param subCollateral Amount of collateral to subtract in CDPVault decimals [wad]
/// @return tokenOut Amount of underlying token withdrawn from CDPVault [CDPVault.tokenScale()]
function _onDecreaseLever(
    LeverParams memory leverParams,
    uint256 subCollateral
) internal override returns (uint256 tokenOut) {
    _onWithdraw(leverParams.vault, leverParams.position, address(0), subCollateral, 0);
    (address pendleToken, , ) = abi.decode(leverParams.auxAction.args, (address, uint256, address));
    penpieHelper.withdrawMarket(pendleToken, subCollateral);
    if (leverParams.auxAction.args.length != 0) {
        bytes memory exitData = _delegateCall(
            address(poolAction),
            abi.encodeWithSelector(poolAction.exit.selector, leverParams.auxAction)
        );

        tokenOut = abi.decode(exitData, (uint256));
    }
}

function _pendleExit(PoolActionParams memory poolActionParams) internal returns (uint256 retAmount) {
@@ 376,400 @@
    (address market, uint256 netLpIn, address tokenOut) = abi.decode(
        poolActionParams.args,
        (address, uint256, address)
    );

    (IStandardizedYield SY, IPPrincipalToken PT, IPYieldToken YT) = IPMarket(market).readTokens();

    if (poolActionParams.recipient != address(this)) {
        IPMarket(market).transferFrom(poolActionParams.recipient, market, netLpIn);
    } else {
        IPMarket(market).transfer(market, netLpIn);
    }

    uint256 netSyToRedeem;

    if (PT.isExpired()) {
        (uint256 netSyRemoved, ) = IPMarket(market).burn(address(SY), address(YT), netLpIn);
        uint256 netSyFromPt = YT.redeemPY(address(SY));
        netSyToRedeem = netSyRemoved + netSyFromPt;
    } else {
        (uint256 netSyRemoved, uint256 netPtRemoved) = IPMarket(market).burn(address(SY), market, netLpIn);
        bytes memory empty;
        (uint256 netSySwappedOut, ) = IPMarket(market).swapExactPtForSy(address(SY), netPtRemoved, empty);
        netSyToRedeem = netSyRemoved + netSySwappedOut;
    }

    return SY.redeem(poolActionParams.recipient, netSyToRedeem, tokenOut, poolActionParams.minOut, true);
}