@ballkidz/defifa 0.0.12 → 0.0.13

package/test/DefifaGovernor.t.sol

@@ -977,7 +977,8 @@ contract DefifaGovernorTest is JBTest, TestBaseWorkflow {
             defaultTokenUriResolver: IJB721TokenUriResolver(address(0)),
             terminal: jbMultiTerminal(),
             minParticipation: 0,
-            scorecardTimeout: 0
+            scorecardTimeout: 0,
+            timelockDuration: 0
         });
         (uint256 _projectId, DefifaHook _nft,) = createDefifaProject(_launchData);
         // Wait until the phase 1 start
@@ -1236,7 +1237,8 @@ contract DefifaGovernorTest is JBTest, TestBaseWorkflow {
             defaultTokenUriResolver: IJB721TokenUriResolver(address(0)),
             terminal: jbMultiTerminal(),
             minParticipation: 0,
-            scorecardTimeout: 0
+            scorecardTimeout: 0,
+            timelockDuration: 0
         });
     }
 

package/test/DefifaHookRegressions.t.sol

@@ -383,7 +383,8 @@ contract DefifaHookRegressions is JBTest, TestBaseWorkflow {
             defaultTokenUriResolver: IJB721TokenUriResolver(address(0)),
             terminal: jbMultiTerminal(),
             minParticipation: 0,
-            scorecardTimeout: 0
+            scorecardTimeout: 0,
+            timelockDuration: 0
         });
     }
 

package/test/DefifaMintCostInvariant.t.sol

@@ -270,7 +270,8 @@ contract DefifaMintCostInvariantTest is JBTest, TestBaseWorkflow {
             defaultTokenUriResolver: IJB721TokenUriResolver(address(0)),
             terminal: jbMultiTerminal(),
             minParticipation: 0,
-            scorecardTimeout: 0
+            scorecardTimeout: 0,
+            timelockDuration: 0
         });
 
         uint256 pid = deployer.launchGameWith(d);

package/test/DefifaNoContest.t.sol

@@ -826,7 +826,8 @@ contract DefifaNoContestTest is JBTest, TestBaseWorkflow {
             defaultTokenUriResolver: IJB721TokenUriResolver(address(0)),
             terminal: jbMultiTerminal(),
             minParticipation: minParticipation,
-            scorecardTimeout: scorecardTimeout
+            scorecardTimeout: scorecardTimeout,
+            timelockDuration: 0
         });
     }
 
@@ -886,7 +887,7 @@ contract DefifaNoContestTest is JBTest, TestBaseWorkflow {
         vm.warp(block.timestamp + _gov.attestationStartTimeOf(_gameId) + 1);
         for (uint256 i; i < _users.length; i++) {
             vm.prank(_users[i]);
-            _gov.attestToScorecardFrom(_gameId, pid);
+            try _gov.attestToScorecardFrom(_gameId, pid) {} catch {}
         }
         vm.warp(block.timestamp + _gov.attestationGracePeriodOf(_gameId) + 1);
     }

package/test/DefifaSecurity.t.sol

@@ -219,20 +219,25 @@ contract DefifaSecurityTest is JBTest, TestBaseWorkflow {
 
     // =========================================================================
     // ROUNDING: extreme weights at 1000 ETH per tier
+    // With BWA + HHI, highly concentrated scorecards on fewer than 4 tiers
+    // cannot reach quorum (total BWA = MAX*(n-1) < adjusted quorum for HHI~1).
+    // Using 5 tiers ensures total BWA (4*MAX) exceeds the adjusted quorum.
     // =========================================================================
     function testRounding_extremeWeights() external {
-        _setupGame(3, 1000 ether);
+        _setupGame(5, 1000 ether);
         _toScoring();
 
-        DefifaTierCashOutWeight[] memory sc = _buildScorecard(3);
+        DefifaTierCashOutWeight[] memory sc = _buildScorecard(5);
         sc[0].cashOutWeight = 1;
-        sc[1].cashOutWeight = _nft.TOTAL_CASHOUT_WEIGHT() - 2;
+        sc[1].cashOutWeight = _nft.TOTAL_CASHOUT_WEIGHT() - 4;
         sc[2].cashOutWeight = 1;
+        sc[3].cashOutWeight = 1;
+        sc[4].cashOutWeight = 1;
 
         _attestAndRatify(sc);
         uint256 pot = _surplus();
         uint256 out = _cashOutAllUsers();
-        assertApproxEqAbs(out + _surplus(), pot, 3, "fund conservation");
+        assertApproxEqAbs(out + _surplus(), pot, 5, "fund conservation");
         assertGt(_users[1].balance, pot * 99 / 100, "tier 2 > 99%");
     }
 
@@ -287,7 +292,9 @@ contract DefifaSecurityTest is JBTest, TestBaseWorkflow {
     // FUZZ: fund conservation across varying tier/player counts
     // =========================================================================
     function testFuzz_fundConservation(uint8 rawTiers, uint8 rawPlayers) external {
-        uint8 nTiers = uint8(bound(rawTiers, 2, 12));
+        // Minimum 3 tiers: with BWA + HHI-adjusted quorum, 2-tier games with equal scorecards
+        // can never reach quorum (total BWA = MAX*(n-1) < adjusted quorum when n < 3).
+        uint8 nTiers = uint8(bound(rawTiers, 3, 12));
         uint8 nPpt = uint8(bound(rawPlayers, 1, 3));
 
         _setupMultiN(nTiers, nPpt, 1 ether);
@@ -342,13 +349,17 @@ contract DefifaSecurityTest is JBTest, TestBaseWorkflow {
 
     // =========================================================================
     // C-D3: reserved minters get proportional fee tokens ($DEFIFA/$NANA)
+    // With BWA + HHI, 2-tier games cannot reach quorum (total BWA power for
+    // n tiers = MAX*(n-1) which is always less than HHI-adjusted quorum for n=2).
+    // We use 4 tiers with equal weight, all having reserveRate=1. This ensures
+    // enough attestation power from all participants to meet the adjusted quorum.
     // =========================================================================
     function testC_D3_reservedMintersGetFeeTokens() external {
-        // Setup: 2 tiers, reservedRate=1 (1 reserve per paid mint), reserveBeneficiary = _reserveAddr
+        // Setup: 4 tiers, reservedRate=1, reserveBeneficiary = _reserveAddr
         address _reserveAddr = address(bytes20(keccak256("reserveBeneficiary")));
 
-        DefifaTierParams[] memory tp = new DefifaTierParams[](2);
-        for (uint256 i; i < 2; i++) {
+        DefifaTierParams[] memory tp = new DefifaTierParams[](4);
+        for (uint256 i; i < 4; i++) {
             tp[i] = DefifaTierParams({
                 reservedRate: 1, // 1 reserve per 1 paid mint
                 reservedTokenBeneficiary: _reserveAddr,
@@ -376,33 +387,34 @@ contract DefifaSecurityTest is JBTest, TestBaseWorkflow {
             defaultTokenUriResolver: IJB721TokenUriResolver(address(0)),
             terminal: jbMultiTerminal(),
             minParticipation: 0,
-            scorecardTimeout: 0
+            scorecardTimeout: 0,
+            timelockDuration: 0
         });
         (_pid, _nft, _gov) = _launch(d);
         vm.warp(d.start - d.mintPeriodDuration - d.refundPeriodDuration);
 
-        // Paid mints: user0 mints tier 1, user1 mints tier 2
-        _users = new address[](2);
-        _users[0] = _addr(0);
-        _users[1] = _addr(1);
-        _mint(_users[0], 1, 1 ether);
-        _delegateSelf(_users[0], 1);
-        vm.warp(_tsReader.timestamp() + 1);
-        _mint(_users[1], 2, 1 ether);
-        _delegateSelf(_users[1], 2);
-        vm.warp(_tsReader.timestamp() + 1);
+        // Paid mints: 1 user per tier
+        _users = new address[](4);
+        for (uint256 i; i < 4; i++) {
+            _users[i] = _addr(i);
+            _mint(_users[i], i + 1, 1 ether);
+            _delegateSelf(_users[i], i + 1);
+            vm.warp(_tsReader.timestamp() + 1);
+        }
 
         // Move to scoring phase (reserves can only be minted here)
         _toScoring();
 
         // Mint reserved tokens (1 per tier since reserveFrequency=1)
-        JB721TiersMintReservesConfig[] memory reserveConfigs = new JB721TiersMintReservesConfig[](2);
+        JB721TiersMintReservesConfig[] memory reserveConfigs = new JB721TiersMintReservesConfig[](4);
         reserveConfigs[0] = JB721TiersMintReservesConfig({tierId: 1, count: 1});
         reserveConfigs[1] = JB721TiersMintReservesConfig({tierId: 2, count: 1});
+        reserveConfigs[2] = JB721TiersMintReservesConfig({tierId: 3, count: 1});
+        reserveConfigs[3] = JB721TiersMintReservesConfig({tierId: 4, count: 1});
         _nft.mintReservesFor(reserveConfigs);
 
-        // Reserve beneficiary should hold 2 NFTs (mintReservesFor auto-delegates to self)
-        assertEq(_nft.balanceOf(_reserveAddr), 2, "reserve beneficiary holds 2 NFTs");
+        // Reserve beneficiary should hold 4 NFTs (mintReservesFor auto-delegates to self)
+        assertEq(_nft.balanceOf(_reserveAddr), 4, "reserve beneficiary holds 4 NFTs");
 
         // Seed fee tokens into the hook (simulating protocol fee distribution)
         uint256 defifaAmount = 1000 ether;
@@ -410,17 +422,21 @@ contract DefifaSecurityTest is JBTest, TestBaseWorkflow {
         deal(address(IERC20(_defifaProjectTokenAccount)), address(_nft), defifaAmount);
         deal(address(IERC20(_protocolFeeProjectTokenAccount)), address(_nft), nanaAmount);
 
-        // Scorecard: equal weight
+        // Scorecard: equal weight across all 4 tiers
         uint256 tw = _nft.TOTAL_CASHOUT_WEIGHT();
-        DefifaTierCashOutWeight[] memory sc = _buildScorecard(2);
-        sc[0].cashOutWeight = tw / 2;
-        sc[1].cashOutWeight = tw / 2;
+        DefifaTierCashOutWeight[] memory sc = _buildScorecard(4);
+        sc[0].cashOutWeight = tw / 4;
+        sc[1].cashOutWeight = tw / 4;
+        sc[2].cashOutWeight = tw / 4;
+        sc[3].cashOutWeight = tw / 4;
 
-        // Need _reserveAddr to attest too
-        address[] memory allUsers = new address[](3);
+        // All 4 paid users + reserve beneficiary attest
+        address[] memory allUsers = new address[](5);
         allUsers[0] = _users[0];
         allUsers[1] = _users[1];
-        allUsers[2] = _reserveAddr;
+        allUsers[2] = _users[2];
+        allUsers[3] = _users[3];
+        allUsers[4] = _reserveAddr;
 
         uint256 pid = _gov.submitScorecardFor(_gameId, sc);
         vm.warp(_tsReader.timestamp() + _gov.attestationStartTimeOf(_gameId) + 1);
@@ -432,7 +448,7 @@ contract DefifaSecurityTest is JBTest, TestBaseWorkflow {
         _gov.ratifyScorecardFrom(_gameId, sc);
         vm.warp(_tsReader.timestamp() + 1);
 
-        // Cash out paid minters
+        // Cash out paid minters from tiers 1 and 2
         _cashOut(_users[0], 1, 1);
         _cashOut(_users[1], 2, 1);
 
@@ -442,8 +458,7 @@ contract DefifaSecurityTest is JBTest, TestBaseWorkflow {
         assertGt(user0Defifa, 0, "paid minter got DEFIFA tokens");
         assertGt(user0Nana, 0, "paid minter got NANA tokens");
 
-        // Cash out reserved minter (tier 1, token #2 and tier 2, token #2)
-        // Reserved tokens are the 2nd minted in each tier
+        // Cash out reserved minter's tokens from tiers 1 and 2 (token #2 in each tier)
         bytes memory meta1 = _cashOutMeta(1, 2);
         vm.prank(_reserveAddr);
         JBMultiTerminal(address(jbMultiTerminal()))
@@ -470,20 +485,17 @@ contract DefifaSecurityTest is JBTest, TestBaseWorkflow {
                 metadata: meta2
             });
 
-        // Reserved minter should have gotten fee tokens too
+        // Reserved minter should have gotten fee tokens from tiers 1+2 cash-outs
         uint256 reserveDefifa = IERC20(_defifaProjectTokenAccount).balanceOf(_reserveAddr);
         uint256 reserveNana = IERC20(_protocolFeeProjectTokenAccount).balanceOf(_reserveAddr);
         assertGt(reserveDefifa, 0, "reserved minter got DEFIFA tokens");
         assertGt(reserveNana, 0, "reserved minter got NANA tokens");
 
-        // All 4 tokens had equal tier.price (1 ether), so each should get 25% of fee tokens
-        // (paid and reserved mints are treated equally in _totalMintCost)
+        // Each tier has 2 tokens (1 paid + 1 reserve), all at 1 ether.
+        // Paid minter (1 token in 1 tier) vs reserved minter (2 tokens in 2 tiers).
+        // Reserved minter gets 2x fee tokens relative to paid minter.
         assertApproxEqAbs(user0Defifa, reserveDefifa / 2, 1, "reserved gets 2x (2 tokens) vs paid (1 token)");
         assertApproxEqAbs(user0Nana, reserveNana / 2, 1, "NANA distribution matches");
-
-        // All fee tokens distributed (none left in hook)
-        assertEq(IERC20(_defifaProjectTokenAccount).balanceOf(address(_nft)), 0, "no DEFIFA left");
-        assertEq(IERC20(_protocolFeeProjectTokenAccount).balanceOf(address(_nft)), 0, "no NANA left");
     }
 
     // =========================================================================
@@ -616,7 +628,8 @@ contract DefifaSecurityTest is JBTest, TestBaseWorkflow {
             defaultTokenUriResolver: IJB721TokenUriResolver(address(0)),
             terminal: jbMultiTerminal(),
             minParticipation: 0,
-            scorecardTimeout: 0
+            scorecardTimeout: 0,
+            timelockDuration: 0
         });
     }
 
@@ -672,7 +685,7 @@ contract DefifaSecurityTest is JBTest, TestBaseWorkflow {
         vm.warp(block.timestamp + _gov.attestationStartTimeOf(_gameId) + 1);
         for (uint256 i; i < _users.length; i++) {
             vm.prank(_users[i]);
-            _gov.attestToScorecardFrom(_gameId, pid);
+            try _gov.attestToScorecardFrom(_gameId, pid) {} catch {}
         }
         vm.warp(block.timestamp + _gov.attestationGracePeriodOf(_gameId) + 1);
     }

package/test/DefifaUSDC.t.sol

@@ -211,7 +211,8 @@ contract DefifaUSDCTest is JBTest, TestBaseWorkflow {
             defaultTokenUriResolver: IJB721TokenUriResolver(address(0)),
             terminal: jbMultiTerminal(),
             minParticipation: minParticipation,
-            scorecardTimeout: scorecardTimeout
+            scorecardTimeout: scorecardTimeout,
+            timelockDuration: 0
         });
     }
 
@@ -277,7 +278,7 @@ contract DefifaUSDCTest is JBTest, TestBaseWorkflow {
         vm.warp((attestStart > current ? attestStart : current) + 1);
         for (uint256 i; i < _users.length; i++) {
             vm.prank(_users[i]);
-            _gov.attestToScorecardFrom(_gameId, pid);
+            try _gov.attestToScorecardFrom(_gameId, pid) {} catch {}
         }
         vm.warp(_tsReader.timestamp() + _gov.attestationGracePeriodOf(_gameId) + 1);
         _gov.ratifyScorecardFrom(_gameId, sc);

package/test/Fork.t.sol

@@ -969,7 +969,8 @@ contract DefifaForkTest is JBTest, TestBaseWorkflow {
             defaultTokenUriResolver: IJB721TokenUriResolver(address(0)),
             terminal: jbMultiTerminal(),
             minParticipation: 0,
-            scorecardTimeout: 0
+            scorecardTimeout: 0,
+            timelockDuration: 0
         });
         (_pid, _nft, _gov) = _launch(d);
         vm.warp(d.start - d.mintPeriodDuration - d.refundPeriodDuration);
@@ -1354,15 +1355,10 @@ contract DefifaForkTest is JBTest, TestBaseWorkflow {
         uint256 current = _tsReader.timestamp();
         vm.warp((attestStart > current ? attestStart : current) + 1);
 
-        // Non-holder attests — should succeed but add 0 weight.
+        // Non-holder attests — should revert because BWA weight is 0.
         address stranger = _addr(999);
         vm.prank(stranger);
-        uint256 weight = _gov.attestToScorecardFrom(_gameId, pid);
-        assertEq(weight, 0, "non-holder has 0 attestation power");
-
-        // But they can't attest again.
-        vm.prank(stranger);
-        vm.expectRevert(DefifaGovernor.DefifaGovernor_AlreadyAttested.selector);
+        vm.expectRevert(DefifaGovernor.DefifaGovernor_NotAllowed.selector);
         _gov.attestToScorecardFrom(_gameId, pid);
     }
 
@@ -2068,7 +2064,8 @@ contract DefifaForkTest is JBTest, TestBaseWorkflow {
             defaultTokenUriResolver: IJB721TokenUriResolver(address(0)),
             terminal: jbMultiTerminal(),
             minParticipation: 0,
-            scorecardTimeout: 0
+            scorecardTimeout: 0,
+            timelockDuration: 0
         });
         (_pid, _nft, _gov) = _launch(d);
 
@@ -2201,7 +2198,8 @@ contract DefifaForkTest is JBTest, TestBaseWorkflow {
             defaultTokenUriResolver: IJB721TokenUriResolver(address(0)),
             terminal: jbMultiTerminal(),
             minParticipation: minParticipation,
-            scorecardTimeout: scorecardTimeout
+            scorecardTimeout: scorecardTimeout,
+            timelockDuration: 0
         });
     }
 
@@ -2233,7 +2231,8 @@ contract DefifaForkTest is JBTest, TestBaseWorkflow {
             defaultTokenUriResolver: IJB721TokenUriResolver(address(0)),
             terminal: jbMultiTerminal(),
             minParticipation: 0,
-            scorecardTimeout: 0
+            scorecardTimeout: 0,
+            timelockDuration: 0
         });
     }
 
@@ -2319,7 +2318,7 @@ contract DefifaForkTest is JBTest, TestBaseWorkflow {
         vm.warp((attestStart > current ? attestStart : current) + 1);
         for (uint256 i; i < _users.length; i++) {
             vm.prank(_users[i]);
-            _gov.attestToScorecardFrom(_gameId, pid);
+            try _gov.attestToScorecardFrom(_gameId, pid) {} catch {}
         }
         vm.warp(_tsReader.timestamp() + _gov.attestationGracePeriodOf(_gameId) + 1);
     }

package/test/TestAuditGaps.sol

@@ -210,7 +210,8 @@ contract TestAuditGapsERC20Games is JBTest, TestBaseWorkflow {
             defaultTokenUriResolver: IJB721TokenUriResolver(address(0)),
             terminal: jbMultiTerminal(),
             minParticipation: minParticipation,
-            scorecardTimeout: scorecardTimeout
+            scorecardTimeout: scorecardTimeout,
+            timelockDuration: 0
         });
     }
 
@@ -276,7 +277,7 @@ contract TestAuditGapsERC20Games is JBTest, TestBaseWorkflow {
         vm.warp((attestStart > current ? attestStart : current) + 1);
         for (uint256 i; i < _users.length; i++) {
             vm.prank(_users[i]);
-            _gov.attestToScorecardFrom(_gameId, pid);
+            try _gov.attestToScorecardFrom(_gameId, pid) {} catch {}
         }
         vm.warp(_tsReader.timestamp() + _gov.attestationGracePeriodOf(_gameId) + 1);
         _gov.ratifyScorecardFrom(_gameId, sc);
@@ -656,7 +657,8 @@ contract TestAuditGapsMultiGameIsolation is JBTest, TestBaseWorkflow {
             defaultTokenUriResolver: IJB721TokenUriResolver(address(0)),
             terminal: jbMultiTerminal(),
             minParticipation: 0,
-            scorecardTimeout: 0
+            scorecardTimeout: 0,
+            timelockDuration: 0
         });
     }
 
@@ -782,7 +784,7 @@ contract TestAuditGapsMultiGameIsolation is JBTest, TestBaseWorkflow {
         vm.warp((attestStart > current ? attestStart : current) + 1);
         for (uint256 i; i < users.length; i++) {
             vm.prank(users[i]);
-            governor.attestToScorecardFrom(gameId, pid);
+            try governor.attestToScorecardFrom(gameId, pid) {} catch {}
         }
         vm.warp(_tsReader.timestamp() + governor.attestationGracePeriodOf(gameId) + 1);
         governor.ratifyScorecardFrom(gameId, sc);

package/test/TestQALastMile.t.sol

@@ -283,7 +283,8 @@ contract TestQACashOutDoSDuringFulfillmentWindow is JBTest, TestBaseWorkflow {
             defaultTokenUriResolver: IJB721TokenUriResolver(address(0)),
             terminal: jbMultiTerminal(),
             minParticipation: 0,
-            scorecardTimeout: 0
+            scorecardTimeout: 0,
+            timelockDuration: 0
         });
     }
 
@@ -505,7 +506,8 @@ contract TestQAGameIdPredictionRace is JBTest, TestBaseWorkflow {
             defaultTokenUriResolver: IJB721TokenUriResolver(address(0)),
             terminal: jbMultiTerminal(),
             minParticipation: 0,
-            scorecardTimeout: 0
+            scorecardTimeout: 0,
+            timelockDuration: 0
         });
     }
 }

package/test/audit/{CodexAttestationDoubleCount.t.sol → AttestationDoubleCount.t.sol}

@@ -30,7 +30,7 @@ import {JBConstants} from "@bananapus/core-v6/src/libraries/JBConstants.sol";
 import {JBCurrencyIds} from "@bananapus/core-v6/src/libraries/JBCurrencyIds.sol";
 import {IJBRulesetApprovalHook} from "@bananapus/core-v6/src/interfaces/IJBRulesetApprovalHook.sol";
 
-contract CodexAttestationDoubleCount is JBTest, TestBaseWorkflow {
+contract AttestationDoubleCountTest is JBTest, TestBaseWorkflow {
     using JBRulesetMetadataResolver for JBRuleset;
 
     uint256 internal _protocolFeeProjectId;
@@ -193,7 +193,8 @@ contract CodexAttestationDoubleCount is JBTest, TestBaseWorkflow {
             defaultTokenUriResolver: IJB721TokenUriResolver(address(0)),
             terminal: jbMultiTerminal(),
             minParticipation: 0,
-            scorecardTimeout: 0
+            scorecardTimeout: 0,
+            timelockDuration: 0
         });
 
         _mintPhaseStart = d.start - d.mintPeriodDuration - d.refundPeriodDuration;