IA: Audit fix/response for Issuance Allocator

[RembrandtK]

This PR adds two enhancements:

• Issuance Allocator now supports configurable default allocation for unallocated issuance
• Rewards Manager can now reclaim tokens that would otherwise be denied

Issuance Allocator: Default Allocation

The default allocation automatically receives whatever percentage is not explicitly allocated to other targets.

Added setDefaultAllocationAddress() to configure where unallocated issuance is sent.

Modified getTotalAllocation() to exclude the default allocation if it is the zero address (as it will in this scenario not be minted).

RewardsManager: Reclaim Addresses

Added two configurable reclaim addresses:

• indexerEligibilityReclaimAddress - receives rewards denied due to eligibility oracle
• subgraphDeniedReclaimAddress - receives rewards denied due to subgraph denylist

When rewards are denied and a reclaim address is set (non-zero), tokens are minted to that address instead of not being minted at all. Defaults to address(0) (original behavior).

[openzeppelin-code]

IA: Audit fix/response for Issuance Allocator

Generated at commit: cbe2bd1eb018d1490bed669385170ad91ceb1f89

🚨 Report Summary

	Severity Level	Results
Contracts	Critical High Medium Low Note Total	3 5 0 14 38 60
Dependencies	Critical High Medium Low Note Total	0 0 0 0 0 0

---

For more details view the full report in OpenZeppelin Code Inspector

[Copilot]

Pull request overview

This PR adds two enhancements to the Graph Protocol's issuance and rewards system:

Purpose: Enable better management of unallocated issuance and denied rewards through configurable reclaim mechanisms.

Key Changes:

• Issuance Allocator: Introduces a default allocation mechanism that automatically receives unallocated issuance portions, with address configurable via setDefaultAllocationAddress()
• Rewards Manager: Adds two reclaim addresses (indexerEligibilityReclaimAddress and subgraphDeniedReclaimAddress) that can receive rewards that would otherwise be denied, preventing token loss

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
IssuanceAllocator.sol	Implements default allocation mechanism with 100% invariant, adds setDefaultAllocationAddress(), modifies allocation tracking to exclude default from reported totals when address(0)
IIssuanceAllocationAdministration.sol	Adds setDefaultAllocationAddress() interface method
RewardsManager.sol	Implements reclaim functionality with two helper functions to handle denied rewards, refactors takeRewards() to use them
RewardsManagerStorage.sol	Adds storage variables for reclaim addresses with documentation
IRewardsManager.sol	Adds interface methods for setting reclaim addresses
MockRewardsManager.sol	Adds mock implementations of new reclaim setter methods
IssuanceAllocator.test.ts	Updates all tests to account for default allocation always existing at index 0
IssuanceSystem.test.ts	Updates tests with corrected total allocation expectations
DefaultAllocation.test.ts	New comprehensive test suite covering default allocation behavior, edge cases, and distribution scenarios
rewards-reclaim.test.ts	New comprehensive test suite covering reclaim address functionality for both denylist and eligibility scenarios
optimizedFixtures.ts	Updates reset helper to skip default allocation and reset it properly
InterfaceIdStability.test.ts (both)	Updates expected interface IDs for modified interfaces

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 86.09%. Comparing base (dbf5d2b) to head (cbe2bd1).

Additional details and impacted files

@@                   Coverage Diff                    @@
##           issuance-allocator-3    #1267      +/-   ##
========================================================
+ Coverage                 85.83%   86.09%   +0.26%     
========================================================
  Files                        45       45              
  Lines                      2294     2338      +44     
  Branches                    680      696      +16     
========================================================
+ Hits                       1969     2013      +44     
  Misses                      325      325              

Flag	Coverage Δ
unittests	86.09% <100.00%> (+0.26%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.