Contract Source Code:

// SPDX-License-Identifier: MIXED

// File @boringcrypto/boring-solidity/contracts/libraries/[email protected]
// License-Identifier: MIT
pragma solidity 0.6.12;
pragma experimental ABIEncoderV2;

/// @notice A library for performing overflow-/underflow-safe math,
/// updated with awesomeness from of DappHub (https://github.com/dapphub/ds-math).
library BoringMath {
  function add(uint256 a, uint256 b) internal pure returns (uint256 c) {
    require((c = a + b) >= b, 'BoringMath: Add Overflow');
  }

  function sub(uint256 a, uint256 b) internal pure returns (uint256 c) {
    require((c = a - b) <= a, 'BoringMath: Underflow');
  }

  function mul(uint256 a, uint256 b) internal pure returns (uint256 c) {
    require(b == 0 || (c = a * b) / b == a, 'BoringMath: Mul Overflow');
  }

  function to128(uint256 a) internal pure returns (uint128 c) {
    require(a <= uint128(-1), 'BoringMath: uint128 Overflow');
    c = uint128(a);
  }

  function to64(uint256 a) internal pure returns (uint64 c) {
    require(a <= uint64(-1), 'BoringMath: uint64 Overflow');
    c = uint64(a);
  }

  function to32(uint256 a) internal pure returns (uint32 c) {
    require(a <= uint32(-1), 'BoringMath: uint32 Overflow');
    c = uint32(a);
  }
}

/// @notice A library for performing overflow-/underflow-safe addition and subtraction on uint128.
library BoringMath128 {
  function add(uint128 a, uint128 b) internal pure returns (uint128 c) {
    require((c = a + b) >= b, 'BoringMath: Add Overflow');
  }

  function sub(uint128 a, uint128 b) internal pure returns (uint128 c) {
    require((c = a - b) <= a, 'BoringMath: Underflow');
  }
}

/// @notice A library for performing overflow-/underflow-safe addition and subtraction on uint64.
library BoringMath64 {
  function add(uint64 a, uint64 b) internal pure returns (uint64 c) {
    require((c = a + b) >= b, 'BoringMath: Add Overflow');
  }

  function sub(uint64 a, uint64 b) internal pure returns (uint64 c) {
    require((c = a - b) <= a, 'BoringMath: Underflow');
  }
}

/// @notice A library for performing overflow-/underflow-safe addition and subtraction on uint32.
library BoringMath32 {
  function add(uint32 a, uint32 b) internal pure returns (uint32 c) {
    require((c = a + b) >= b, 'BoringMath: Add Overflow');
  }

  function sub(uint32 a, uint32 b) internal pure returns (uint32 c) {
    require((c = a - b) <= a, 'BoringMath: Underflow');
  }
}

// File @boringcrypto/boring-solidity/contracts/interfaces/[email protected]
// License-Identifier: MIT

interface IERC20 {
  function totalSupply() external view returns (uint256);

  function balanceOf(address account) external view returns (uint256);

  function allowance(address owner, address spender) external view returns (uint256);

  function approve(address spender, uint256 amount) external returns (bool);

  event Transfer(address indexed from, address indexed to, uint256 value);
  event Approval(address indexed owner, address indexed spender, uint256 value);

  /// @notice EIP 2612
  function permit(
    address owner,
    address spender,
    uint256 value,
    uint256 deadline,
    uint8 v,
    bytes32 r,
    bytes32 s
  ) external;
}

// File @boringcrypto/boring-solidity/contracts/libraries/[email protected]
// License-Identifier: MIT

// solhint-disable avoid-low-level-calls

library BoringERC20 {
  bytes4 private constant SIG_SYMBOL = 0x95d89b41; // symbol()
  bytes4 private constant SIG_NAME = 0x06fdde03; // name()
  bytes4 private constant SIG_DECIMALS = 0x313ce567; // decimals()
  bytes4 private constant SIG_TRANSFER = 0xa9059cbb; // transfer(address,uint256)
  bytes4 private constant SIG_TRANSFER_FROM = 0x23b872dd; // transferFrom(address,address,uint256)

  function returnDataToString(bytes memory data) internal pure returns (string memory) {
    if (data.length >= 64) {
      return abi.decode(data, (string));
    } else if (data.length == 32) {
      uint8 i = 0;
      while (i < 32 && data[i] != 0) {
        i++;
      }
      bytes memory bytesArray = new bytes(i);
      for (i = 0; i < 32 && data[i] != 0; i++) {
        bytesArray[i] = data[i];
      }
      return string(bytesArray);
    } else {
      return '???';
    }
  }

  /// @notice Provides a safe ERC20.symbol version which returns '???' as fallback string.
  /// @param token The address of the ERC-20 token contract.
  /// @return (string) Token symbol.
  function safeSymbol(IERC20 token) internal view returns (string memory) {
    (bool success, bytes memory data) = address(token).staticcall(
      abi.encodeWithSelector(SIG_SYMBOL)
    );
    return success ? returnDataToString(data) : '???';
  }

  /// @notice Provides a safe ERC20.name version which returns '???' as fallback string.
  /// @param token The address of the ERC-20 token contract.
  /// @return (string) Token name.
  function safeName(IERC20 token) internal view returns (string memory) {
    (bool success, bytes memory data) = address(token).staticcall(abi.encodeWithSelector(SIG_NAME));
    return success ? returnDataToString(data) : '???';
  }

  /// @notice Provides a safe ERC20.decimals version which returns '18' as fallback value.
  /// @param token The address of the ERC-20 token contract.
  /// @return (uint8) Token decimals.
  function safeDecimals(IERC20 token) internal view returns (uint8) {
    (bool success, bytes memory data) = address(token).staticcall(
      abi.encodeWithSelector(SIG_DECIMALS)
    );
    return success && data.length == 32 ? abi.decode(data, (uint8)) : 18;
  }

  /// @notice Provides a safe ERC20.transfer version for different ERC-20 implementations.
  /// Reverts on a failed transfer.
  /// @param token The address of the ERC-20 token.
  /// @param to Transfer tokens to.
  /// @param amount The token amount.
  function safeTransfer(IERC20 token, address to, uint256 amount) internal {
    (bool success, bytes memory data) = address(token).call(
      abi.encodeWithSelector(SIG_TRANSFER, to, amount)
    );
    require(
      success && (data.length == 0 || abi.decode(data, (bool))),
      'BoringERC20: Transfer failed'
    );
  }

  /// @notice Provides a safe ERC20.transferFrom version for different ERC-20 implementations.
  /// Reverts on a failed transfer.
  /// @param token The address of the ERC-20 token.
  /// @param from Transfer tokens from.
  /// @param to Transfer tokens to.
  /// @param amount The token amount.
  function safeTransferFrom(IERC20 token, address from, address to, uint256 amount) internal {
    (bool success, bytes memory data) = address(token).call(
      abi.encodeWithSelector(SIG_TRANSFER_FROM, from, to, amount)
    );
    require(
      success && (data.length == 0 || abi.decode(data, (bool))),
      'BoringERC20: TransferFrom failed'
    );
  }
}

// File @boringcrypto/boring-solidity/contracts/[email protected]
// License-Identifier: MIT
// Based on code and smartness by Ross Campbell and Keno
// Uses immutable to store the domain separator to reduce gas usage
// If the chain id changes due to a fork, the forked chain will calculate on the fly.

// solhint-disable no-inline-assembly

contract Domain {
  bytes32 private constant DOMAIN_SEPARATOR_SIGNATURE_HASH =
    keccak256('EIP712Domain(uint256 chainId,address verifyingContract)');
  // See https://eips.ethereum.org/EIPS/eip-191
  string private constant EIP191_PREFIX_FOR_EIP712_STRUCTURED_DATA = '\x19\x01';

  // solhint-disable var-name-mixedcase
  bytes32 private immutable _DOMAIN_SEPARATOR;
  uint256 private immutable DOMAIN_SEPARATOR_CHAIN_ID;

  /// @dev Calculate the DOMAIN_SEPARATOR
  function _calculateDomainSeparator(uint256 chainId) private view returns (bytes32) {
    return keccak256(abi.encode(DOMAIN_SEPARATOR_SIGNATURE_HASH, chainId, address(this)));
  }

  constructor() public {
    uint256 chainId;
    assembly {
      chainId := chainid()
    }
    _DOMAIN_SEPARATOR = _calculateDomainSeparator(DOMAIN_SEPARATOR_CHAIN_ID = chainId);
  }

  /// @dev Return the DOMAIN_SEPARATOR
  // It's named internal to allow making it public from the contract that uses it by creating a simple view function
  // with the desired public name, such as DOMAIN_SEPARATOR or domainSeparator.
  // solhint-disable-next-line func-name-mixedcase
  function _domainSeparator() internal view returns (bytes32) {
    uint256 chainId;
    assembly {
      chainId := chainid()
    }
    return
      chainId == DOMAIN_SEPARATOR_CHAIN_ID ? _DOMAIN_SEPARATOR : _calculateDomainSeparator(chainId);
  }

  function _getDigest(bytes32 dataHash) internal view returns (bytes32 digest) {
    digest = keccak256(
      abi.encodePacked(EIP191_PREFIX_FOR_EIP712_STRUCTURED_DATA, _domainSeparator(), dataHash)
    );
  }
}

// File @boringcrypto/boring-solidity/contracts/[email protected]
// License-Identifier: MIT

// solhint-disable no-inline-assembly
// solhint-disable not-rely-on-time

// Data part taken out for building of contracts that receive delegate calls
contract ERC20Data {
  /// @notice owner > balance mapping.
  mapping(address => uint256) public balanceOf;
  /// @notice owner > spender > allowance mapping.
  mapping(address => mapping(address => uint256)) public allowance;
  /// @notice owner > nonce mapping. Used in `permit`.
  mapping(address => uint256) public nonces;
}

abstract contract ERC20 is IERC20, Domain {
  /// @notice owner > balance mapping.
  mapping(address => uint256) public override balanceOf;
  /// @notice owner > spender > allowance mapping.
  mapping(address => mapping(address => uint256)) public override allowance;
  /// @notice owner > nonce mapping. Used in `permit`.
  mapping(address => uint256) public nonces;

  event Transfer(address indexed _from, address indexed _to, uint256 _value);
  event Approval(address indexed _owner, address indexed _spender, uint256 _value);

  /// @notice Transfers `amount` tokens from `msg.sender` to `to`.
  /// @param to The address to move the tokens.
  /// @param amount of the tokens to move.
  /// @return (bool) Returns True if succeeded.
  function transfer(address to, uint256 amount) public returns (bool) {
    // If `amount` is 0, or `msg.sender` is `to` nothing happens
    if (amount != 0 || msg.sender == to) {
      uint256 srcBalance = balanceOf[msg.sender];
      require(srcBalance >= amount, 'ERC20: balance too low');
      if (msg.sender != to) {
        require(to != address(0), 'ERC20: no zero address'); // Moved down so low balance calls safe some gas

        balanceOf[msg.sender] = srcBalance - amount; // Underflow is checked
        balanceOf[to] += amount;
      }
    }
    emit Transfer(msg.sender, to, amount);
    return true;
  }

  /// @notice Transfers `amount` tokens from `from` to `to`. Caller needs approval for `from`.
  /// @param from Address to draw tokens from.
  /// @param to The address to move the tokens.
  /// @param amount The token amount to move.
  /// @return (bool) Returns True if succeeded.
  function transferFrom(address from, address to, uint256 amount) public returns (bool) {
    // If `amount` is 0, or `from` is `to` nothing happens
    if (amount != 0) {
      uint256 srcBalance = balanceOf[from];
      require(srcBalance >= amount, 'ERC20: balance too low');

      if (from != to) {
        uint256 spenderAllowance = allowance[from][msg.sender];
        // If allowance is infinite, don't decrease it to save on gas (breaks with EIP-20).
        if (spenderAllowance != type(uint256).max) {
          require(spenderAllowance >= amount, 'ERC20: allowance too low');
          allowance[from][msg.sender] = spenderAllowance - amount; // Underflow is checked
        }
        require(to != address(0), 'ERC20: no zero address'); // Moved down so other failed calls safe some gas

        balanceOf[from] = srcBalance - amount; // Underflow is checked
        balanceOf[to] += amount;
      }
    }
    emit Transfer(from, to, amount);
    return true;
  }

  /// @notice Approves `amount` from sender to be spend by `spender`.
  /// @param spender Address of the party that can draw from msg.sender's account.
  /// @param amount The maximum collective amount that `spender` can draw.
  /// @return (bool) Returns True if approved.
  function approve(address spender, uint256 amount) public override returns (bool) {
    allowance[msg.sender][spender] = amount;
    emit Approval(msg.sender, spender, amount);
    return true;
  }

  // solhint-disable-next-line func-name-mixedcase
  function DOMAIN_SEPARATOR() external view returns (bytes32) {
    return _domainSeparator();
  }

  // keccak256("Permit(address owner,address spender,uint256 value,uint256 nonce,uint256 deadline)");
  bytes32 private constant PERMIT_SIGNATURE_HASH =
    0x6e71edae12b1b97f4d1f60370fef10105fa2faae0126114a169c64845d6126c9;

  /// @notice Approves `value` from `owner_` to be spend by `spender`.
  /// @param owner_ Address of the owner.
  /// @param spender The address of the spender that gets approved to draw from `owner_`.
  /// @param value The maximum collective amount that `spender` can draw.
  /// @param deadline This permit must be redeemed before this deadline (UTC timestamp in seconds).
  function permit(
    address owner_,
    address spender,
    uint256 value,
    uint256 deadline,
    uint8 v,
    bytes32 r,
    bytes32 s
  ) external override {
    require(owner_ != address(0), 'ERC20: Owner cannot be 0');
    require(block.timestamp < deadline, 'ERC20: Expired');
    require(
      ecrecover(
        _getDigest(
          keccak256(
            abi.encode(PERMIT_SIGNATURE_HASH, owner_, spender, value, nonces[owner_]++, deadline)
          )
        ),
        v,
        r,
        s
      ) == owner_,
      'ERC20: Invalid Signature'
    );
    allowance[owner_][spender] = value;
    emit Approval(owner_, spender, value);
  }
}

contract ERC20WithSupply is IERC20, ERC20 {
  uint256 public override totalSupply;

  function _mint(address user, uint256 amount) private {
    uint256 newTotalSupply = totalSupply + amount;
    require(newTotalSupply >= totalSupply, 'Mint overflow');
    totalSupply = newTotalSupply;
    balanceOf[user] += amount;
  }

  function _burn(address user, uint256 amount) private {
    require(balanceOf[user] >= amount, 'Burn too much');
    totalSupply -= amount;
    balanceOf[user] -= amount;
  }
}

// File @boringcrypto/boring-solidity/contracts/[email protected]
// License-Identifier: MIT

// solhint-disable avoid-low-level-calls
// solhint-disable no-inline-assembly

// Audit on 5-Jan-2021 by Keno and BoringCrypto

contract BaseBoringBatchable {
  /// @dev Helper function to extract a useful revert message from a failed call.
  /// If the returned data is malformed or not correctly abi encoded then this call can fail itself.
  function _getRevertMsg(bytes memory _returnData) internal pure returns (string memory) {
    // If the _res length is less than 68, then the transaction failed silently (without a revert message)
    if (_returnData.length < 68) return 'Transaction reverted silently';

    assembly {
      // Slice the sighash.
      _returnData := add(_returnData, 0x04)
    }
    return abi.decode(_returnData, (string)); // All that remains is the revert string
  }

  /// @notice Allows batched call to self (this contract).
  /// @param calls An array of inputs for each call.
  /// @param revertOnFail If True then reverts after a failed call and stops doing further calls.
  // F1: External is ok here because this is the batch function, adding it to a batch makes no sense
  // F2: Calls in the batch may be payable, delegatecall operates in the same context, so each call in the batch has access to msg.value
  // C3: The length of the loop is fully under user control, so can't be exploited
  // C7: Delegatecall is only used on the same contract, so it's safe
  function batch(bytes[] calldata calls, bool revertOnFail) external payable {
    for (uint256 i = 0; i < calls.length; i++) {
      (bool success, bytes memory result) = address(this).delegatecall(calls[i]);
      if (!success && revertOnFail) {
        revert(_getRevertMsg(result));
      }
    }
  }
}

contract BoringBatchable is BaseBoringBatchable {
  /// @notice Call wrapper that performs `ERC20.permit` on `token`.
  /// Lookup `IERC20.permit`.
  // F6: Parameters can be used front-run the permit and the user's permit will fail (due to nonce or other revert)
  //     if part of a batch this could be used to grief once as the second call would not need the permit
  function permitToken(
    IERC20 token,
    address from,
    address to,
    uint256 amount,
    uint256 deadline,
    uint8 v,
    bytes32 r,
    bytes32 s
  ) public {
    token.permit(from, to, amount, deadline, v, r, s);
  }
}

// File contracts/sSpell.sol
//License-Identifier: MIT

// Staking in sSpell inspired by Chef Nomi's SushiBar - MIT license (originally WTFPL)
// modified by BoringCrypto for DictatorDAO

contract sSpellV1 is IERC20, Domain {
  using BoringMath for uint256;
  using BoringMath128 for uint128;
  using BoringERC20 for IERC20;

  string public constant symbol = 'xUwU';
  string public constant name = 'Staked UwU';
  uint8 public constant decimals = 18;
  uint256 public override totalSupply;
  uint256 private constant LOCK_TIME = 3 days;

  IERC20 public immutable token;

  constructor(IERC20 _token) public {
    token = _token;
  }

  struct User {
    uint128 balance;
    uint128 lockedUntil;
  }

  /// @notice owner > balance mapping.
  mapping(address => User) public users;
  /// @notice owner > spender > allowance mapping.
  mapping(address => mapping(address => uint256)) public override allowance;
  /// @notice owner > nonce mapping. Used in `permit`.
  mapping(address => uint256) public nonces;

  event Transfer(address indexed _from, address indexed _to, uint256 _value);
  event Approval(address indexed _owner, address indexed _spender, uint256 _value);

  function balanceOf(address user) public view override returns (uint256 balance) {
    return users[user].balance;
  }

  function _transfer(address from, address to, uint256 shares) internal {
    User memory fromUser = users[from];
    require(block.timestamp >= fromUser.lockedUntil, 'Locked');
    if (shares != 0) {
      require(fromUser.balance >= shares, 'Low balance');
      if (from != to) {
        require(to != address(0), 'Zero address'); // Moved down so other failed calls safe some gas
        User memory toUser = users[to];
        users[from].balance = fromUser.balance - shares.to128(); // Underflow is checked
        users[to].balance = toUser.balance + shares.to128(); // Can't overflow because totalSupply would be greater than 2^128-1;
      }
    }
    emit Transfer(from, to, shares);
  }

  function _useAllowance(address from, uint256 shares) internal {
    if (msg.sender == from) {
      return;
    }
    uint256 spenderAllowance = allowance[from][msg.sender];
    // If allowance is infinite, don't decrease it to save on gas (breaks with EIP-20).
    if (spenderAllowance != type(uint256).max) {
      require(spenderAllowance >= shares, 'Low allowance');
      allowance[from][msg.sender] = spenderAllowance - shares; // Underflow is checked
    }
  }

  /// @notice Transfers `shares` tokens from `msg.sender` to `to`.
  /// @param to The address to move the tokens.
  /// @param shares of the tokens to move.
  /// @return (bool) Returns True if succeeded.
  function transfer(address to, uint256 shares) public returns (bool) {
    _transfer(msg.sender, to, shares);
    return true;
  }

  /// @notice Transfers `shares` tokens from `from` to `to`. Caller needs approval for `from`.
  /// @param from Address to draw tokens from.
  /// @param to The address to move the tokens.
  /// @param shares The token shares to move.
  /// @return (bool) Returns True if succeeded.
  function transferFrom(address from, address to, uint256 shares) public returns (bool) {
    _useAllowance(from, shares);
    _transfer(from, to, shares);
    return true;
  }

  /// @notice Approves `amount` from sender to be spend by `spender`.
  /// @param spender Address of the party that can draw from msg.sender's account.
  /// @param amount The maximum collective amount that `spender` can draw.
  /// @return (bool) Returns True if approved.
  function approve(address spender, uint256 amount) public override returns (bool) {
    allowance[msg.sender][spender] = amount;
    emit Approval(msg.sender, spender, amount);
    return true;
  }

  // solhint-disable-next-line func-name-mixedcase
  function DOMAIN_SEPARATOR() external view returns (bytes32) {
    return _domainSeparator();
  }

  // keccak256("Permit(address owner,address spender,uint256 value,uint256 nonce,uint256 deadline)");
  bytes32 private constant PERMIT_SIGNATURE_HASH =
    0x6e71edae12b1b97f4d1f60370fef10105fa2faae0126114a169c64845d6126c9;

  /// @notice Approves `value` from `owner_` to be spend by `spender`.
  /// @param owner_ Address of the owner.
  /// @param spender The address of the spender that gets approved to draw from `owner_`.
  /// @param value The maximum collective amount that `spender` can draw.
  /// @param deadline This permit must be redeemed before this deadline (UTC timestamp in seconds).
  function permit(
    address owner_,
    address spender,
    uint256 value,
    uint256 deadline,
    uint8 v,
    bytes32 r,
    bytes32 s
  ) external override {
    require(owner_ != address(0), 'Zero owner');
    require(block.timestamp < deadline, 'Expired');
    require(
      ecrecover(
        _getDigest(
          keccak256(
            abi.encode(PERMIT_SIGNATURE_HASH, owner_, spender, value, nonces[owner_]++, deadline)
          )
        ),
        v,
        r,
        s
      ) == owner_,
      'Invalid Sig'
    );
    allowance[owner_][spender] = value;
    emit Approval(owner_, spender, value);
  }

  /// math is ok, because amount, totalSupply and shares is always 0 <= amount <= 100.000.000 * 10^18
  /// theoretically you can grow the amount/share ratio, but it's not practical and useless
  function mint(uint256 amount) public returns (bool) {
    require(msg.sender != address(0), 'Zero address');
    User memory user = users[msg.sender];

    uint256 totalTokens = token.balanceOf(address(this));
    uint256 shares = totalSupply == 0 ? amount : (amount * totalSupply) / totalTokens;
    user.balance += shares.to128();
    user.lockedUntil = (block.timestamp + LOCK_TIME).to128();
    users[msg.sender] = user;
    totalSupply += shares;

    token.safeTransferFrom(msg.sender, address(this), amount);

    emit Transfer(address(0), msg.sender, shares);
    return true;
  }

  function _burn(address from, address to, uint256 shares) internal {
    require(to != address(0), 'Zero address');
    User memory user = users[from];
    require(block.timestamp >= user.lockedUntil, 'Locked');
    uint256 amount = (shares * token.balanceOf(address(this))) / totalSupply;
    users[from].balance = user.balance.sub(shares.to128()); // Must check underflow
    totalSupply -= shares;

    token.safeTransfer(to, amount);

    emit Transfer(from, address(0), shares);
  }

  function burn(address to, uint256 shares) public returns (bool) {
    _burn(msg.sender, to, shares);
    return true;
  }

  function burnFrom(address from, address to, uint256 shares) public returns (bool) {
    _useAllowance(from, shares);
    _burn(from, to, shares);
    return true;
  }
}