@ballkidz/defifa 0.0.18 → 0.0.20

package/foundry.lock

@@ -0,0 +1,17 @@
+{
+  "lib/base64": {
+    "branch": {
+      "name": "v1.1.0",
+      "rev": "dcbf852ba545b3d15de0ac0ef88dce934c090c8e"
+    }
+  },
+  "lib/capsules": {
+    "rev": "7432ba95ac69ba4902076660b0dc9a90aeb26706"
+  },
+  "lib/forge-std": {
+    "rev": "8bbcf6e3f8f62f419e5429a0bd89331c85c37824"
+  },
+  "lib/typeface": {
+    "rev": "edd52e2f7c8adc44e75b207bd279710f9b72f5e9"
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ballkidz/defifa",
-  "version": "0.0.18",
+  "version": "0.0.20",
   "license": "MIT",
   "engines": {
     "node": ">=20.0.0"
@@ -13,17 +13,17 @@
     "url": "https://github.com/BallKidz/defifa-collection-deployer"
   },
   "dependencies": {
-    "@bananapus/721-hook-v6": "^0.0.30",
-    "@bananapus/address-registry-v6": "^0.0.16",
-    "@bananapus/core-v6": "^0.0.30",
+    "@bananapus/721-hook-v6": "^0.0.31",
+    "@bananapus/core-v6": "^0.0.31",
     "@bananapus/permission-ids-v6": "^0.0.15",
-    "@croptop/core-v6": "^0.0.26",
+    "@croptop/core-v6": "^0.0.30",
     "@openzeppelin/contracts": "^5.6.1",
     "@prb/math": "^4.1.1",
-    "@rev-net/core-v6": "^0.0.24",
+    "@rev-net/core-v6": "^0.0.28",
     "scripty.sol": "^2.1.1"
   },
   "devDependencies": {
+    "@bananapus/address-registry-v6": "^0.0.17",
     "@sphinx-labs/plugins": "^0.33.1"
   },
   "scripts": {

package/script/Deploy.s.sol

@@ -22,9 +22,8 @@ contract DeployMainnet is Script, Sphinx {
     /// @notice tracks the deployment of the address registry for the chain we are deploying to.
     AddressRegistryDeployment registry;
 
-    // NOTE: This id is revnet, this is temporary until we have a defifa revnet.
-    uint256 _defifaProjectId = 3;
-    uint256 _baseProtocolProjectId = 1;
+    uint256 _defifaProjectId;
+    uint256 _baseProtocolProjectId;
 
     bytes32 _salt = bytes32(keccak256("0.0.2"));
 
@@ -53,6 +52,9 @@ contract DeployMainnet is Script, Sphinx {
             )
         );
 
+        _defifaProjectId = vm.envUint("DEFIFA_PROJECT_ID");
+        _baseProtocolProjectId = vm.envUint("BASE_PROTOCOL_PROJECT_ID");
+
         defifaToken = IERC20(address(core.tokens.tokenOf(_defifaProjectId)));
         baseProtocolToken = IERC20(address(core.tokens.tokenOf(_baseProtocolProjectId)));
 

package/src/DefifaDeployer.sol

@@ -275,6 +275,7 @@ contract DefifaDeployer is IDefifaDeployer, IDefifaGamePhaseReporter, IDefifaGam
         uint256 _defifaProjectId,
         uint256 _baseProtocolProjectId
     ) {
+        // slither-disable-next-line missing-zero-check
         HOOK_CODE_ORIGIN = _hookCodeOrigin;
         TOKEN_URI_RESOLVER = _tokenUriResolver;
         GOVERNOR = _governor;
@@ -549,8 +550,13 @@ contract DefifaDeployer is IDefifaDeployer, IDefifaGamePhaseReporter, IDefifaGam
         // Transfer ownership to the specified owner.
         hook.transferOwnership(address(GOVERNOR));
 
-        // Add the hook to the registry, contract nonce starts at 1
-        REGISTRY.registerAddress({deployer: address(this), nonce: currentNonce});
+        // Register the actual CREATE2 clone address using the same salt and minimal-proxy init code
+        // that produced the deployed hook.
+        REGISTRY.registerAddress({
+            deployer: address(this),
+            salt: keccak256(abi.encodePacked(msg.sender, currentNonce)),
+            bytecode: _cloneCreationCodeFor(address(HOOK_CODE_ORIGIN))
+        });
 
         // slither-disable-next-line reentrancy-events
         emit LaunchGame(gameId, hook, GOVERNOR, uriResolver, msg.sender);
@@ -939,4 +945,19 @@ contract DefifaDeployer is IDefifaDeployer, IDefifaGamePhaseReporter, IDefifaGam
             projectId: gameId, rulesetConfigurations: rulesetConfigs, memo: "Defifa game has finished."
         });
     }
+
+    /// @notice Returns the minimal-proxy init code used to deploy a clone for the provided implementation.
+    /// @dev Defifa deploys hooks with `Clones.cloneDeterministic`, which uses `CREATE2`.
+    /// The address registry's CREATE2 path must be given the exact init code hash that was used at deployment time,
+    /// not the runtime bytecode and not a CREATE nonce. This helper reconstructs the standard EIP-1167 creation code
+    /// by inserting the implementation address into OpenZeppelin's minimal-proxy init-code template.
+    /// @param implementation The contract address the clone will delegate all calls to.
+    /// @return bytecode The full EIP-1167 creation bytecode hashed by CREATE2 to derive the clone address.
+    function _cloneCreationCodeFor(address implementation) internal pure returns (bytes memory bytecode) {
+        // EIP-1167 minimal proxy init code, mirroring OpenZeppelin's Clones.sol layout:
+        // [prefix (20 bytes)] [implementation address (20 bytes)] [suffix (15 bytes)]
+        bytecode = abi.encodePacked(
+            hex"3d602d80600a3d3981f3363d3d373d3d3d363d73", bytes20(implementation), hex"5af43d82803e903d91602b57fd5bf3"
+        );
+    }
 }

package/src/DefifaGovernor.sol

@@ -18,6 +18,7 @@ import {IDefifaHook} from "./interfaces/IDefifaHook.sol";
 import {DefifaAttestations} from "./structs/DefifaAttestations.sol";
 import {DefifaScorecard} from "./structs/DefifaScorecard.sol";
 import {DefifaTierCashOutWeight} from "./structs/DefifaTierCashOutWeight.sol";
+import {DefifaHookLib} from "./libraries/DefifaHookLib.sol";
 
 /// @notice Manages the ratification of Defifa scorecards.
 contract DefifaGovernor is Ownable, IDefifaGovernor {
@@ -83,12 +84,20 @@ contract DefifaGovernor is Ownable, IDefifaGovernor {
     mapping(uint256 => mapping(uint256 => DefifaAttestations)) internal _scorecardAttestationsOf;
 
     /// @notice Snapshot of pending reserves per tier at scorecard submission time.
-    /// @dev Prevents reserve dilution between submission and attestation.
+    /// @dev Used to keep unminted reserve units in the BWA denominator.
     /// @custom:param gameId The ID of the game.
     /// @custom:param scorecardId The ID of the scorecard.
     /// @custom:param tierId The tier ID (1-indexed).
     mapping(uint256 => mapping(uint256 => mapping(uint256 => uint256))) internal _pendingReservesSnapshotOf;
 
+    /// @notice Snapshot of each tier's minted attestation units at scorecard submission time.
+    /// @dev Caps later checkpoint reads so reserve mints after submission can't increase the denominator
+    /// before the pending-reserve snapshot is added back in.
+    /// @custom:param gameId The ID of the game.
+    /// @custom:param scorecardId The ID of the scorecard.
+    /// @custom:param tierId The tier ID (1-indexed).
+    mapping(uint256 => mapping(uint256 => mapping(uint256 => uint256))) internal _submittedTierAttestationUnitsOf;
+
     /// @notice Tier weights per scorecard for BWA computation.
     /// @custom:param gameId The ID of the game.
     /// @custom:param scorecardId The ID of the scorecard.
@@ -260,15 +269,23 @@ contract DefifaGovernor is Ownable, IDefifaGovernor {
         }
 
         // If there's a weight assigned to the tier, make sure there is a token backed by it.
+        // slither-disable-next-line calls-loop
         for (uint256 i; i < numberOfTierWeights; i++) {
-            if (
-                tierWeights[i].cashOutWeight > 0
-                    && IDefifaHook(metadata.dataHook).currentSupplyOfTier(tierWeights[i].id) == 0
-            ) {
+            // A nonzero cashout weight is only valid once that tier has live ownership.
+            // slither-disable-next-line calls-loop
+            uint256 currentTierSupply = IDefifaHook(metadata.dataHook).currentSupplyOfTier(tierWeights[i].id);
+            if (tierWeights[i].cashOutWeight > 0 && currentTierSupply == 0) {
                 revert DefifaGovernor_UnownedProposedCashoutValue();
             }
         }
 
+        // Run the same structural validation the hook will apply at ratification time so malformed
+        // scorecards fail on submission instead of reaching a misleading SUCCEEDED state first.
+        // slither-disable-next-line unused-return
+        DefifaHookLib.validateAndBuildWeights({
+            tierWeights: tierWeights, hookStore: IDefifaHook(metadata.dataHook).store(), hook: metadata.dataHook
+        });
+
         // Hash the scorecard.
         scorecardId =
             _hashScorecardOf({gameHook: metadata.dataHook, calldataBytes: _buildScorecardCalldataFor(tierWeights)});
@@ -295,15 +312,25 @@ contract DefifaGovernor is Ownable, IDefifaGovernor {
             _scorecardTierWeightsOf[gameId][scorecardId][tierWeights[i].id - 1] = tierWeights[i].cashOutWeight;
         }
 
-        // Snapshot pending reserves for each tier at submission time.
-        // This prevents reserve minting between submission and attestation from diluting votes.
+        // Snapshot each tier's pending reserves and minted attestation units at submission time.
+        // BWA later reads an account checkpoint at `attestationsBegin - 1`. If reserve mints happen
+        // after submission but before that checkpoint, clamp the live total back down to the minted
+        // units that existed at submission and only then add the snapshotted pending reserves.
         {
             IJB721TiersHookStore _store = IDefifaHook(metadata.dataHook).store();
             uint256 _numberOfTiers = _store.maxTierIdOf(metadata.dataHook);
+            // slither-disable-next-line calls-loop
             for (uint256 i; i < _numberOfTiers; i++) {
                 uint256 tierId = i + 1;
-                _pendingReservesSnapshotOf[gameId][scorecardId][tierId] =
-                    _store.numberOfPendingReservesFor(metadata.dataHook, tierId);
+                // slither-disable-next-line calls-loop
+                JB721Tier memory tier = _store.tierOf({hook: metadata.dataHook, id: tierId, includeResolvedUri: false});
+                // slither-disable-next-line calls-loop
+                uint256 pendingReserves = _store.numberOfPendingReservesFor(metadata.dataHook, tierId);
+                // slither-disable-next-line calls-loop
+                uint256 submittedTierAttestationUnits =
+                    IDefifaHook(metadata.dataHook).currentSupplyOfTier(tierId) * tier.votingUnits;
+                _pendingReservesSnapshotOf[gameId][scorecardId][tierId] = pendingReserves;
+                _submittedTierAttestationUnitsOf[gameId][scorecardId][tierId] = submittedTierAttestationUnits;
             }
         }
 
@@ -490,16 +517,17 @@ contract DefifaGovernor is Ownable, IDefifaGovernor {
         // Get a reference to the number of tiers.
         uint256 numberOfTiers = store.maxTierIdOf(metadata.dataHook);
 
-        // slither-disable-next-line calls-inside-a-loop
         for (uint256 i; i < numberOfTiers; i++) {
             // Tiers are 1-indexed.
             uint256 tierId = i + 1;
 
             // Get this account's attestation units within the tier (snapshot at timestamp).
+            // slither-disable-next-line calls-loop
             uint256 tierAttestationUnitsForAccount =
                 hook.getPastTierAttestationUnitsOf({account: account, tier: tierId, timestamp: timestamp});
 
             // Get the total attestation units for this tier (snapshot at timestamp).
+            // slither-disable-next-line calls-loop
             uint256 tierTotalAttestationUnits =
                 hook.getPastTierTotalAttestationUnitsOf({tier: tierId, timestamp: timestamp});
 
@@ -508,8 +536,10 @@ contract DefifaGovernor is Ownable, IDefifaGovernor {
             // When the reserve beneficiary later mints, their new NFTs add to the numerator while
             // pending reserves decrease by the same amount — so no one's voting power shifts.
             {
+                // slither-disable-next-line calls-loop
                 uint256 pendingReserves = store.numberOfPendingReservesFor(metadata.dataHook, tierId);
                 if (pendingReserves != 0) {
+                    // slither-disable-next-line calls-loop
                     JB721Tier memory tier =
                         store.tierOf({hook: metadata.dataHook, id: tierId, includeResolvedUri: false});
                     tierTotalAttestationUnits += pendingReserves * tier.votingUnits;
@@ -567,30 +597,33 @@ contract DefifaGovernor is Ownable, IDefifaGovernor {
         // Cache the total cashout weight denominator from the hook.
         uint256 totalCashOutWeight = hook.TOTAL_CASHOUT_WEIGHT();
 
-        // slither-disable-next-line calls-inside-a-loop
         for (uint256 i; i < numberOfTiers; i++) {
             // Tiers are 1-indexed.
             uint256 tierId = i + 1;
 
             // Get this account's attestation units within the tier (snapshot at timestamp).
+            // slither-disable-next-line calls-loop
             uint256 tierAttestationUnitsForAccount =
                 hook.getPastTierAttestationUnitsOf({account: account, tier: tierId, timestamp: timestamp});
 
             if (tierAttestationUnitsForAccount != 0) {
-                // Get the total attestation units for this tier (snapshot at timestamp).
+                // Start from the checkpointed tier total at the requested timestamp.
+                // If reserve mints happened after submission, clamp them out before adding the
+                // pending-reserve snapshot back in so each reserve unit is counted exactly once.
+                // slither-disable-next-line calls-loop
                 uint256 tierTotalAttestationUnits =
                     hook.getPastTierTotalAttestationUnitsOf({tier: tierId, timestamp: timestamp});
+                uint256 submittedTierAttestationUnits = _submittedTierAttestationUnitsOf[gameId][scorecardId][tierId];
+                if (tierTotalAttestationUnits > submittedTierAttestationUnits) {
+                    tierTotalAttestationUnits = submittedTierAttestationUnits;
+                }
 
-                // Include unminted pending reserves in the total (denominator only).
-                // Uses the snapshot taken at scorecard submission time to prevent reserve
-                // minting between submission and attestation from diluting votes.
-                {
-                    uint256 pendingReserves = _pendingReservesSnapshotOf[gameId][scorecardId][tierId];
-                    if (pendingReserves != 0) {
-                        JB721Tier memory tier =
-                            store.tierOf({hook: metadata.dataHook, id: tierId, includeResolvedUri: false});
-                        tierTotalAttestationUnits += pendingReserves * tier.votingUnits;
-                    }
+                uint256 pendingReserves = _pendingReservesSnapshotOf[gameId][scorecardId][tierId];
+                if (pendingReserves != 0) {
+                    // slither-disable-next-line calls-loop
+                    JB721Tier memory tier =
+                        store.tierOf({hook: metadata.dataHook, id: tierId, includeResolvedUri: false});
+                    tierTotalAttestationUnits += pendingReserves * tier.votingUnits;
                 }
 
                 // Raw power for this tier.
@@ -630,18 +663,18 @@ contract DefifaGovernor is Ownable, IDefifaGovernor {
         // Keep a reference to the total eligible tier weight.
         uint256 eligibleTierWeights;
 
-        // slither-disable-next-line calls-inside-a-loop
         for (uint256 i; i < numberOfTiers; i++) {
             uint256 tierId = i + 1;
 
             // A tier contributes to quorum if it has circulating tokens OR unminted pending reserves.
-            // Pending reserves exist when participation occurred (mints triggered reserve accrual),
-            // even if all paid tokens were later burned during REFUND. The reserve beneficiary still
-            // has a stake in that tier's outcome, so the tier should count toward governance quorum.
-            if (
-                hook.currentSupplyOfTier(tierId) != 0
-                    || store.numberOfPendingReservesFor(metadata.dataHook, tierId) != 0
-            ) {
+            // Pending reserves still belong economically to the reserve beneficiary, even after the
+            // last paid token in the tier is burned during REFUND, so excluding them would let a
+            // burner erase another participant's quorum contribution without erasing their claim.
+            // slither-disable-next-line calls-loop
+            uint256 currentTierSupply = hook.currentSupplyOfTier(tierId);
+            // slither-disable-next-line calls-loop
+            uint256 pendingReserves = store.numberOfPendingReservesFor(metadata.dataHook, tierId);
+            if (currentTierSupply != 0 || pendingReserves != 0) {
                 eligibleTierWeights += MAX_ATTESTATION_POWER_TIER;
             }
         }

package/src/DefifaHook.sol

@@ -59,6 +59,8 @@ contract DefifaHook is JB721Hook, Ownable, IDefifaHook {
     error DefifaHook_TransfersPaused();
     error DefifaHook_Unauthorized(uint256 tokenId, address owner, address caller);
 
+    event PricingCurrencySet(uint256 currency, address caller);
+
     //*********************************************************************//
     // --------------------- public constant properties ------------------ //
     //*********************************************************************//
@@ -497,6 +499,7 @@ contract DefifaHook is JB721Hook, Ownable, IDefifaHook {
         pricingCurrency = _currency;
         gamePhaseReporter = _gamePhaseReporter;
         gamePotReporter = _gamePotReporter;
+        // slither-disable-next-line missing-zero-check
         defaultAttestationDelegate = _defaultAttestationDelegate;
 
         // Store the base URI if provided.
@@ -529,19 +532,22 @@ contract DefifaHook is JB721Hook, Ownable, IDefifaHook {
 
         // Transfer ownership to the initializer.
         _transferOwnership(msg.sender);
+
+        emit PricingCurrencySet(_currency, msg.sender);
     }
 
     /// @notice Mint reserved tokens within the tier for the provided value.
     /// @param tierId The ID of the tier to mint within.
     /// @param count The number of reserved tokens to mint.
-    // slither-disable-next-line reentrancy-no-eth
     function mintReservesFor(uint256 tierId, uint256 count) public override {
         // Minting reserves must not be paused.
+        // slither-disable-next-line calls-loop
         if (JB721TiersRulesetMetadataResolver.mintPendingReservesPaused(
                 (JBRulesetMetadataResolver.metadata(rulesets.currentOf(PROJECT_ID)))
             )) revert DefifaHook_ReservedTokenMintingPaused();
 
         // Keep a reference to the reserved token beneficiary.
+        // slither-disable-next-line calls-loop
         address reservedTokenBeneficiary = store.reserveBeneficiaryOf({hook: address(this), tierId: tierId});
 
         // Get a reference to the old delegate.
@@ -559,12 +565,14 @@ contract DefifaHook is JB721Hook, Ownable, IDefifaHook {
         }
 
         // Record the minted reserves for the tier.
+        // slither-disable-next-line calls-loop
         uint256[] memory tokenIds = store.recordMintReservesFor({tierId: tierId, count: count});
 
         // Keep a reference to the token ID being iterated on.
         uint256 tokenId;
 
         // Fetch the tier details (needed for votingUnits below).
+        // slither-disable-next-line calls-loop
         JB721Tier memory tier = store.tierOf({hook: address(this), id: tierId, includeResolvedUri: false});
 
         // Increment _totalMintCost so reserved recipients can claim their share of fee tokens ($DEFIFA/$NANA).
@@ -579,6 +587,7 @@ contract DefifaHook is JB721Hook, Ownable, IDefifaHook {
             tokenId = tokenIds[i];
 
             // Mint the token.
+            // slither-disable-next-line reentrancy-no-eth
             _mint({to: reservedTokenBeneficiary, tokenId: tokenId});
 
             emit MintReservedToken(tokenId, tierId, reservedTokenBeneficiary, msg.sender);
@@ -589,6 +598,7 @@ contract DefifaHook is JB721Hook, Ownable, IDefifaHook {
         }
 
         // Transfer the attestation units to the delegate.
+        // slither-disable-next-line reentrancy-no-eth
         _transferTierAttestationUnits({
             from: address(0), to: reservedTokenBeneficiary, tierId: tierId, amount: tier.votingUnits * tokenIds.length
         });
@@ -602,7 +612,6 @@ contract DefifaHook is JB721Hook, Ownable, IDefifaHook {
     /// `context.beneficiary`. Part of `IJBCashOutHook`.
     /// @dev Reverts if the calling contract is not one of the project's terminals.
     /// @param context The cash out context passed in by the terminal.
-    // slither-disable-next-line locked-ether,reentrancy-no-eth
     function afterCashOutRecordedWith(JBAfterCashOutRecordedContext calldata context)
         external
         payable
@@ -654,6 +663,7 @@ contract DefifaHook is JB721Hook, Ownable, IDefifaHook {
 
             if (isComplete) {
                 unchecked {
+                    // slither-disable-next-line reentrancy-no-eth,calls-loop
                     ++tokensRedeemedFrom[store.tierIdOfToken(tokenId)];
                 }
             }
@@ -674,6 +684,7 @@ contract DefifaHook is JB721Hook, Ownable, IDefifaHook {
             // Claim the $DEFIFA and $NANA tokens for the user.
             // Include pending reserve mint cost in the denominator so that unminted reserves
             // are accounted for, preventing paid holders from claiming a disproportionate share.
+            // slither-disable-next-line reentrancy-events
             beneficiaryReceivedTokens = _claimTokensFor({
                 beneficiary: context.holder,
                 shareToBeneficiary: cumulativeMintPrice,
@@ -795,8 +806,10 @@ contract DefifaHook is JB721Hook, Ownable, IDefifaHook {
 
         for (uint256 i; i < numberOfTiers;) {
             uint256 tierId = i + 1;
+            // slither-disable-next-line calls-loop
             uint256 pendingReserves = _store.numberOfPendingReservesFor({hook: hook, tierId: tierId});
             if (pendingReserves != 0) {
+                // slither-disable-next-line calls-loop
                 JB721Tier memory tier = _store.tierOf({hook: hook, id: tierId, includeResolvedUri: false});
                 cost += pendingReserves * tier.price;
             }
@@ -862,6 +875,7 @@ contract DefifaHook is JB721Hook, Ownable, IDefifaHook {
     /// @param tierId The ID of the tier to get attestation units for.
     /// @return The attestation units.
     function _getTierAttestationUnits(address account, uint256 tierId) internal view virtual returns (uint256) {
+        // slither-disable-next-line calls-loop
         return store.tierVotingUnitsOf({hook: address(this), account: account, tierId: tierId});
     }
 
@@ -994,8 +1008,12 @@ contract DefifaHook is JB721Hook, Ownable, IDefifaHook {
 
             // If there's either a new delegate or old delegate, set delegation and transfer units.
             if (attestationDelegate != address(0) || oldDelegate != address(0)) {
-                // Switch delegates if needed.
-                if (attestationDelegate != address(0) && attestationDelegate != oldDelegate) {
+                // Delegation is beneficiary-owned state. A third-party payer can fund this mint, but
+                // cannot overwrite the beneficiary's long-lived delegate preference through metadata.
+                if (
+                    context.payer == context.beneficiary && attestationDelegate != address(0)
+                        && attestationDelegate != oldDelegate
+                ) {
                     _delegateTier({account: context.beneficiary, delegatee: attestationDelegate, tierId: tierId});
                 }
 
@@ -1085,6 +1103,7 @@ contract DefifaHook is JB721Hook, Ownable, IDefifaHook {
             // If transfers are pausable, check if they're paused.
             if (tier.flags.transfersPausable) {
                 // Get a reference to the project's current ruleset.
+                // slither-disable-next-line calls-loop
                 JBRuleset memory ruleset = rulesets.currentOf(PROJECT_ID);
 
                 // If transfers are paused and the NFT isn't being transferred to the zero address, revert.
@@ -1101,14 +1120,15 @@ contract DefifaHook is JB721Hook, Ownable, IDefifaHook {
             if (_firstOwnerOf[tokenId] == address(0)) _firstOwnerOf[tokenId] = from;
         }
 
-        // Record the transfer.
-        // slither-disable-next-line reentrancy-events,calls-loop
-        store.recordTransferForTier({tierId: tier.id, from: from, to: to});
-
         // Dont transfer on mint since the delegation will be transferred more efficiently in _processPayment.
-        if (from == address(0)) return from;
+        if (from != address(0)) {
+            _transferTierAttestationUnits({from: from, to: to, tierId: tier.id, amount: tier.votingUnits});
+        }
+
+        // Record the transfer after local delegation state has been finalized.
+        // slither-disable-next-line calls-loop
+        store.recordTransferForTier({tierId: tier.id, from: from, to: to});
 
-        // Transfer the attestation units.
-        _transferTierAttestationUnits({from: from, to: to, tierId: tier.id, amount: tier.votingUnits});
+        return from;
     }
 }

package/src/libraries/DefifaHookLib.sol

@@ -62,6 +62,7 @@ library DefifaHookLib {
             lastTierId = tierWeights[i].id;
 
             // Get the tier.
+            // slither-disable-next-line calls-loop
             tier = hookStore.tierOf({hook: hook, id: tierWeights[i].id, includeResolvedUri: false});
 
             // Can't set a cashOut weight for tiers not in category 0.
@@ -104,9 +105,11 @@ library DefifaHookLib {
         returns (uint256)
     {
         // Keep a reference to the token's tier ID.
+        // slither-disable-next-line calls-loop
         uint256 tierId = hookStore.tierIdOfToken(tokenId);
 
         // Keep a reference to the tier.
+        // slither-disable-next-line calls-loop
         JB721Tier memory tier = hookStore.tierOf({hook: hook, id: tierId, includeResolvedUri: false});
 
         // Get the tier's weight.
@@ -116,6 +119,7 @@ library DefifaHookLib {
         if (weight == 0) return 0;
 
         // Get the amount of tokens that have already been burned.
+        // slither-disable-next-line calls-loop
         uint256 burnedTokens = hookStore.numberOfBurnedFor({hook: hook, tierId: tierId});
 
         // If no tiers were minted, nothing to redeem.
@@ -129,6 +133,7 @@ library DefifaHookLib {
         // could cash out before reserves are minted and extract value that should be diluted across
         // both paid and reserved holders. By counting pending reserves, each token's share of the
         // tier weight is computed against the full eventual supply.
+        // slither-disable-next-line calls-loop
         uint256 pendingReserves = hookStore.numberOfPendingReservesFor({hook: hook, tierId: tierId});
         totalTokensForCashoutInTier += pendingReserves;
 
@@ -202,6 +207,7 @@ library DefifaHookLib {
         // Calculate the amount paid to mint the tokens that are being burned.
         uint256 cumulativeMintPrice;
         for (uint256 i; i < numberOfTokens; i++) {
+            // slither-disable-next-line calls-loop
             cumulativeMintPrice += hookStore.tierOfTokenId({
                 hook: hook, tokenId: tokenIds[i], includeResolvedUri: false
             })
@@ -229,6 +235,7 @@ library DefifaHookLib {
     {
         uint256 numberOfTokenIds = tokenIds.length;
         for (uint256 i; i < numberOfTokenIds; i++) {
+            // slither-disable-next-line calls-loop
             cumulativeMintPrice += hookStore.tierOfTokenId({
                 hook: hook, tokenId: tokenIds[i], includeResolvedUri: false
             })
@@ -323,6 +330,7 @@ library DefifaHookLib {
                 }
                 if (tierIdsToMint[i] < currentTierId) revert DefifaHook_BadTierOrder();
                 currentTierId = tierIdsToMint[i];
+                // slither-disable-next-line calls-loop
                 attestationUnits =
                 hookStore.tierOf({hook: hook, id: currentTierId, includeResolvedUri: false}).votingUnits;
                 accumulated = attestationUnits;

package/test/DefifaGovernor.t.sol

@@ -433,7 +433,7 @@ contract DefifaGovernorTest is JBTest, TestBaseWorkflow {
         // We can't have a neutral outcome, so we only give shares to tiers that are an even number (in our array)
         for (uint256 i = 0; i < scorecards.length; i++) {
             scorecards[i].id = i + 1;
-            scorecards[i].cashOutWeight = i % 2 == 0 ? 1_000_000_000 / (scorecards.length / 2) : 0;
+            scorecards[i].cashOutWeight = i % 2 == 0 ? 1e18 / (scorecards.length / 2) : 0;
         }
         // Forward time so proposals can be created
         uint256 _proposalId = _governor.submitScorecardFor(_gameId, scorecards);
@@ -1019,7 +1019,7 @@ contract DefifaGovernorTest is JBTest, TestBaseWorkflow {
         // We can't have a neutral outcome, so we only give shares to tiers that are an even number (in our array)
         for (uint256 i = 0; i < scorecards.length; i++) {
             scorecards[i].id = i + 1;
-            scorecards[i].cashOutWeight = i % 2 == 0 ? 1_000_000_000 / (scorecards.length / 2) : 0;
+            scorecards[i].cashOutWeight = i % 2 == 0 ? 1e18 / (scorecards.length / 2) : 0;
         }
 
         vm.expectRevert(abi.encodeWithSignature("DefifaGovernor_UnownedProposedCashoutValue()"));
@@ -1111,7 +1111,7 @@ contract DefifaGovernorTest is JBTest, TestBaseWorkflow {
         // We can't have a neutral outcome, so we only give shares to tiers that are an even number (in our array)
         for (uint256 i = 0; i < scorecards.length; i++) {
             scorecards[i].id = i + 1;
-            scorecards[i].cashOutWeight = i % 2 == 0 ? 1_000_000_000 / (scorecards.length / 2) : 0;
+            scorecards[i].cashOutWeight = i % 2 == 0 ? 1e18 / (scorecards.length / 2) : 0;
         }
         // Forward time so proposals can be created
         uint256 _proposalId = _governor.submitScorecardFor(_gameId, scorecards);
@@ -1132,80 +1132,103 @@ contract DefifaGovernorTest is JBTest, TestBaseWorkflow {
         // As a sanity check we let it also run for less than 10 to see if it does not error in that case.
         nTiers = uint8(bound(nTiers, 2, 20));
 
+        // With exact-weight validation, only nTiers == 10 produces weights that sum to TOTAL_CASHOUT_WEIGHT.
+        // Delegate to separate helpers to avoid stack-too-deep.
+        if (nTiers == 10) {
+            _testCashOutWeightExact(nTiers);
+        } else {
+            _testCashOutWeightInvalid(nTiers);
+        }
+    }
+
+    /// @dev nTiers == 10: all weights valid, full flow (submit → vote → ratify).
+    function _testCashOutWeightExact(uint8 nTiers) internal {
         address[] memory _users = new address[](nTiers);
         DefifaLaunchProjectData memory defifaData = getBasicDefifaLaunchData(nTiers);
         (uint256 _projectId, DefifaHook _nft, DefifaGovernor _governor) = createDefifaProject(defifaData);
 
         uint256 cashOutWeight = _nft.TOTAL_CASHOUT_WEIGHT() / 10;
 
-        // Phase 1: Mint
         vm.warp(defifaData.start - defifaData.mintPeriodDuration - defifaData.refundPeriodDuration);
-        //deployer.queueNextPhaseOf(_projectId);
         for (uint256 i = 0; i < nTiers; i++) {
-            // Generate a new address for each tier
             _users[i] = address(bytes20(keccak256(abi.encode("user", Strings.toString(i)))));
-            // fund user
             vm.deal(_users[i], 1 ether);
-            // Build metadata to buy specific NFT
             uint16[] memory rawMetadata = new uint16[](1);
             // forge-lint: disable-next-line(unsafe-typecast)
-            rawMetadata[0] = uint16(i + 1); // reward tier, 1 indexed
+            rawMetadata[0] = uint16(i + 1);
             bytes memory metadata = _buildPayMetadata(abi.encode(_users[i], rawMetadata));
-            // Pay to the project and mint an NFT
             vm.prank(_users[i]);
             jbMultiTerminal().pay{value: 1 ether}(
                 _projectId, JBConstants.NATIVE_TOKEN, 1 ether, _users[i], 0, "", metadata
             );
-            // Set the delegate as the user themselves
             DefifaDelegation[] memory tiered721SetDelegatesData = new DefifaDelegation[](1);
             tiered721SetDelegatesData[0] = DefifaDelegation({delegatee: _users[i], tierId: uint256(i + 1)});
             vm.prank(_users[i]);
             _nft.setTierDelegatesTo(tiered721SetDelegatesData);
-            // Forward 1 block, user should receive all the voting power of the tier, as its the only NFT
             assertEq(
                 _governor.MAX_ATTESTATION_POWER_TIER(),
                 // forge-lint: disable-next-line(unsafe-typecast)
                 _governor.getAttestationWeight(_gameId, _users[i], uint48(block.timestamp))
             );
         }
-        // Warp to scoring phase (past start time)
         vm.warp(defifaData.start + 1);
 
-        // Generate the scorecards
         DefifaTierCashOutWeight[] memory scorecards = new DefifaTierCashOutWeight[](nTiers);
-
-        // We can't have a neutral outcome, so we only give shares to tiers that are an even number (in our array)
         for (uint256 i = 0; i < scorecards.length; i++) {
             scorecards[i].id = i + 1;
             scorecards[i].cashOutWeight = cashOutWeight;
         }
 
-        // Forward time so proposals can be created
         uint256 _proposalId = _governor.submitScorecardFor(_gameId, scorecards);
-        // Forward time so voting becomes active
         vm.warp(block.timestamp + _governor.attestationStartTimeOf(_gameId));
-        // No voting delay after the initial voting delay has passed in
-        // assertEq(_governor.attestationStartTimeOf(_gameId), 0);
-        // All the users vote
-        // 0 = Against
-        // 1 = For
-        // 2 = Abstain
         for (uint256 i = 0; i < _users.length; i++) {
             vm.prank(_users[i]);
             _governor.attestToScorecardFrom(_gameId, _proposalId);
         }
-
-        // Forward the amount of blocks needed to reach the end (and round up)
         vm.warp(block.timestamp + _governor.attestationGracePeriodOf(_gameId) + 1);
+        _governor.ratifyScorecardFrom(_gameId, scorecards);
+    }
+
+    /// @dev nTiers != 10: weights don't sum to TOTAL_CASHOUT_WEIGHT, submitScorecardFor reverts.
+    function _testCashOutWeightInvalid(uint8 nTiers) internal {
+        address[] memory _users = new address[](nTiers);
+        DefifaLaunchProjectData memory defifaData = getBasicDefifaLaunchData(nTiers);
+        (uint256 _projectId, DefifaHook _nft, DefifaGovernor _governor) = createDefifaProject(defifaData);
 
-        // With exact-weight validation, only nTiers == 10 produces an exact sum.
-        // Any other count (under or over) triggers INVALID_CASHOUT_WEIGHTS.
-        if (nTiers != 10) {
-            vm.expectRevert(DefifaHook.DefifaHook_InvalidCashoutWeights.selector);
+        uint256 cashOutWeight = _nft.TOTAL_CASHOUT_WEIGHT() / 10;
+
+        vm.warp(defifaData.start - defifaData.mintPeriodDuration - defifaData.refundPeriodDuration);
+        for (uint256 i = 0; i < nTiers; i++) {
+            _users[i] = address(bytes20(keccak256(abi.encode("user", Strings.toString(i)))));
+            vm.deal(_users[i], 1 ether);
+            uint16[] memory rawMetadata = new uint16[](1);
+            // forge-lint: disable-next-line(unsafe-typecast)
+            rawMetadata[0] = uint16(i + 1);
+            bytes memory metadata = _buildPayMetadata(abi.encode(_users[i], rawMetadata));
+            vm.prank(_users[i]);
+            jbMultiTerminal().pay{value: 1 ether}(
+                _projectId, JBConstants.NATIVE_TOKEN, 1 ether, _users[i], 0, "", metadata
+            );
+            DefifaDelegation[] memory tiered721SetDelegatesData = new DefifaDelegation[](1);
+            tiered721SetDelegatesData[0] = DefifaDelegation({delegatee: _users[i], tierId: uint256(i + 1)});
+            vm.prank(_users[i]);
+            _nft.setTierDelegatesTo(tiered721SetDelegatesData);
+            assertEq(
+                _governor.MAX_ATTESTATION_POWER_TIER(),
+                // forge-lint: disable-next-line(unsafe-typecast)
+                _governor.getAttestationWeight(_gameId, _users[i], uint48(block.timestamp))
+            );
         }
+        vm.warp(defifaData.start + 1);
 
-        // Execute the proposal
-        _governor.ratifyScorecardFrom(_gameId, scorecards);
+        DefifaTierCashOutWeight[] memory scorecards = new DefifaTierCashOutWeight[](nTiers);
+        for (uint256 i = 0; i < scorecards.length; i++) {
+            scorecards[i].id = i + 1;
+            scorecards[i].cashOutWeight = cashOutWeight;
+        }
+
+        vm.expectRevert(DefifaHook.DefifaHook_InvalidCashoutWeights.selector);
+        _governor.submitScorecardFor(_gameId, scorecards);
     }
 
     function getBasicDefifaLaunchData(uint8 nTiers) internal returns (DefifaLaunchProjectData memory) {

package/test/DefifaSecurity.t.sol

@@ -253,10 +253,8 @@ contract DefifaSecurityTest is JBTest, TestBaseWorkflow {
             sc[i].cashOutWeight = (_nft.TOTAL_CASHOUT_WEIGHT() * 30) / 100; // 120% total
         }
 
-        uint256 pid = _gov.submitScorecardFor(_gameId, sc);
-        _attestAllFor(pid);
         vm.expectRevert(DefifaHook.DefifaHook_InvalidCashoutWeights.selector);
-        _gov.ratifyScorecardFrom(_gameId, sc);
+        _gov.submitScorecardFor(_gameId, sc);
     }
 
     // =========================================================================

package/test/Fork.t.sol

@@ -339,10 +339,8 @@ contract DefifaForkTest is JBTest, TestBaseWorkflow {
             sc[i].cashOutWeight = (_nft.TOTAL_CASHOUT_WEIGHT() * 30) / 100; // 120% total
         }
 
-        uint256 pid = _gov.submitScorecardFor(_gameId, sc);
-        _attestAllFor(pid);
         vm.expectRevert(DefifaHook.DefifaHook_InvalidCashoutWeights.selector);
-        _gov.ratifyScorecardFrom(_gameId, sc);
+        _gov.submitScorecardFor(_gameId, sc);
     }
 
     // =========================================================================
@@ -358,10 +356,8 @@ contract DefifaForkTest is JBTest, TestBaseWorkflow {
             sc[i].cashOutWeight = (_nft.TOTAL_CASHOUT_WEIGHT() * 20) / 100; // 80% total
         }
 
-        uint256 pid = _gov.submitScorecardFor(_gameId, sc);
-        _attestAllFor(pid);
         vm.expectRevert(DefifaHook.DefifaHook_InvalidCashoutWeights.selector);
-        _gov.ratifyScorecardFrom(_gameId, sc);
+        _gov.submitScorecardFor(_gameId, sc);
     }
 
     // =========================================================================
@@ -2010,10 +2006,8 @@ contract DefifaForkTest is JBTest, TestBaseWorkflow {
         sc[2] = DefifaTierCashOutWeight({id: 2, cashOutWeight: _nft.TOTAL_CASHOUT_WEIGHT() / 4});
         sc[3] = DefifaTierCashOutWeight({id: 4, cashOutWeight: _nft.TOTAL_CASHOUT_WEIGHT() / 4});
 
-        uint256 pid = _gov.submitScorecardFor(_gameId, sc);
-        _attestAllFor(pid);
         vm.expectRevert(DefifaHookLib.DefifaHook_BadTierOrder.selector);
-        _gov.ratifyScorecardFrom(_gameId, sc);
+        _gov.submitScorecardFor(_gameId, sc);
     }
 
     // =========================================================================

package/test/audit/CodexRegistryMismatch.t.sol

@@ -0,0 +1,191 @@
+// SPDX-License-Identifier: UNLICENSED
+pragma solidity 0.8.28;
+
+import {DefifaDeployer} from "../../src/DefifaDeployer.sol";
+import {DefifaGovernor} from "../../src/DefifaGovernor.sol";
+import {DefifaHook} from "../../src/DefifaHook.sol";
+import {DefifaTokenUriResolver} from "../../src/DefifaTokenUriResolver.sol";
+import {DefifaLaunchProjectData} from "../../src/structs/DefifaLaunchProjectData.sol";
+import {DefifaTierParams} from "../../src/structs/DefifaTierParams.sol";
+
+import {JB721TiersHookStore} from "@bananapus/721-hook-v6/src/JB721TiersHookStore.sol";
+import {IJB721TokenUriResolver} from "@bananapus/721-hook-v6/src/interfaces/IJB721TokenUriResolver.sol";
+import {JBAddressRegistry} from "@bananapus/address-registry-v6/src/JBAddressRegistry.sol";
+import {JBTest} from "@bananapus/core-v6/test/helpers/JBTest.sol";
+import {TestBaseWorkflow} from "@bananapus/core-v6/test/helpers/TestBaseWorkflow.sol";
+import {JBAccountingContext} from "@bananapus/core-v6/src/structs/JBAccountingContext.sol";
+import {JBConstants} from "@bananapus/core-v6/src/libraries/JBConstants.sol";
+import {JBCurrencyIds} from "@bananapus/core-v6/src/libraries/JBCurrencyIds.sol";
+import {JBFundAccessLimitGroup} from "@bananapus/core-v6/src/structs/JBFundAccessLimitGroup.sol";
+import {JBRulesetConfig} from "@bananapus/core-v6/src/structs/JBRulesetConfig.sol";
+import {JBRulesetMetadata} from "@bananapus/core-v6/src/structs/JBRulesetMetadata.sol";
+import {JBSplit} from "@bananapus/core-v6/src/structs/JBSplit.sol";
+import {JBSplitGroup} from "@bananapus/core-v6/src/structs/JBSplitGroup.sol";
+import {JBTerminalConfig} from "@bananapus/core-v6/src/structs/JBTerminalConfig.sol";
+import {IJBRulesetApprovalHook} from "@bananapus/core-v6/src/interfaces/IJBRulesets.sol";
+
+import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
+import {ITypeface} from "lib/typeface/contracts/interfaces/ITypeface.sol";
+
+contract CodexRegistryMismatchTest is JBTest, TestBaseWorkflow {
+    JBAddressRegistry internal registry;
+    DefifaDeployer internal deployer;
+
+    function setUp() public virtual override {
+        super.setUp();
+
+        JBAccountingContext[] memory tokens = new JBAccountingContext[](1);
+        tokens[0] = JBAccountingContext({token: JBConstants.NATIVE_TOKEN, decimals: 18, currency: JBCurrencyIds.ETH});
+
+        JBTerminalConfig[] memory terminalConfigs = new JBTerminalConfig[](1);
+        terminalConfigs[0] = JBTerminalConfig({terminal: jbMultiTerminal(), accountingContextsToAccept: tokens});
+
+        JBRulesetConfig[] memory rulesetConfigs = new JBRulesetConfig[](1);
+        rulesetConfigs[0] = JBRulesetConfig({
+            mustStartAtOrAfter: 0,
+            duration: 10 days,
+            weight: 1e18,
+            weightCutPercent: 0,
+            approvalHook: IJBRulesetApprovalHook(address(0)),
+            metadata: JBRulesetMetadata({
+                reservedPercent: 0,
+                cashOutTaxRate: 0,
+                baseCurrency: JBCurrencyIds.ETH,
+                pausePay: false,
+                pauseCreditTransfers: false,
+                allowOwnerMinting: false,
+                allowSetCustomToken: false,
+                allowTerminalMigration: false,
+                allowSetTerminals: false,
+                allowSetController: false,
+                allowAddAccountingContext: false,
+                allowAddPriceFeed: false,
+                ownerMustSendPayouts: false,
+                holdFees: false,
+                useTotalSurplusForCashOuts: false,
+                useDataHookForPay: true,
+                useDataHookForCashOut: true,
+                dataHook: address(0),
+                metadata: 0
+            }),
+            splitGroups: new JBSplitGroup[](0),
+            fundAccessLimitGroups: new JBFundAccessLimitGroup[](0)
+        });
+
+        address projectOwner = address(bytes20(keccak256("projectOwner")));
+        uint256 protocolFeeProjectId =
+            jbController().launchProjectFor(projectOwner, "", rulesetConfigs, terminalConfigs, "");
+        vm.prank(projectOwner);
+        address nanaToken =
+            address(jbController().deployERC20For(protocolFeeProjectId, "Bananapus", "NANA", bytes32(0)));
+
+        uint256 defifaProjectId = jbController().launchProjectFor(projectOwner, "", rulesetConfigs, terminalConfigs, "");
+        vm.prank(projectOwner);
+        address defifaToken = address(jbController().deployERC20For(defifaProjectId, "Defifa", "DEFIFA", bytes32(0)));
+
+        DefifaHook hookCodeOrigin = new DefifaHook(jbDirectory(), IERC20(defifaToken), IERC20(nanaToken));
+        DefifaGovernor governor = new DefifaGovernor(jbController(), address(this));
+        registry = new JBAddressRegistry();
+        deployer = new DefifaDeployer(
+            address(hookCodeOrigin),
+            new DefifaTokenUriResolver(ITypeface(address(0))),
+            governor,
+            jbController(),
+            registry,
+            defifaProjectId,
+            protocolFeeProjectId
+        );
+
+        hookCodeOrigin.transferOwnership(address(deployer));
+        governor.transferOwnership(address(deployer));
+    }
+
+    function test_launchRegistersActualHookAddressInRegistry() external {
+        uint256 projectId = deployer.launchGameWith(_launchData());
+        (, JBRulesetMetadata memory metadata,) = jbController().latestQueuedRulesetOf(projectId);
+        address actualHook = metadata.dataHook;
+
+        address expectedCreateAddress = _createAddress(address(deployer), 1);
+
+        assertNotEq(actualHook, address(0), "queued ruleset should reference the deployed hook");
+        assertNotEq(actualHook, expectedCreateAddress, "cloneDeterministic did not use CREATE");
+        assertEq(registry.deployerOf(actualHook), address(deployer), "actual hook should be registered");
+        assertEq(
+            registry.deployerOf(expectedCreateAddress), address(0), "legacy CREATE address should stay unregistered"
+        );
+    }
+
+    function _launchData() internal returns (DefifaLaunchProjectData memory) {
+        DefifaTierParams[] memory tiers = new DefifaTierParams[](1);
+        tiers[0] = DefifaTierParams({
+            name: "Team 1",
+            reservedRate: 0,
+            reservedTokenBeneficiary: address(0),
+            encodedIPFSUri: bytes32(0),
+            shouldUseReservedTokenBeneficiaryAsDefault: false
+        });
+
+        return DefifaLaunchProjectData({
+            name: "DEFIFA",
+            projectUri: "",
+            contractUri: "",
+            baseUri: "",
+            tiers: tiers,
+            tierPrice: 1 ether,
+            token: JBAccountingContext({token: JBConstants.NATIVE_TOKEN, decimals: 18, currency: JBCurrencyIds.ETH}),
+            mintPeriodDuration: 1 days,
+            refundPeriodDuration: 1 days,
+            start: uint48(block.timestamp + 3 days),
+            splits: new JBSplit[](0),
+            attestationStartTime: 0,
+            attestationGracePeriod: 100_381,
+            defaultAttestationDelegate: address(0),
+            defaultTokenUriResolver: IJB721TokenUriResolver(address(0)),
+            terminal: jbMultiTerminal(),
+            store: new JB721TiersHookStore(),
+            minParticipation: 0,
+            scorecardTimeout: 0,
+            timelockDuration: 0
+        });
+    }
+
+    function _createAddress(address origin, uint256 nonce) internal pure returns (address addr) {
+        bytes memory data;
+        if (nonce == 0x00) {
+            data = abi.encodePacked(bytes1(0xd6), bytes1(0x94), origin, bytes1(0x80));
+        } else if (nonce <= 0x7f) {
+            // forge-lint: disable-next-line(unsafe-typecast)
+            data = abi.encodePacked(bytes1(0xd6), bytes1(0x94), origin, uint8(nonce));
+        } else if (nonce <= 0xff) {
+            // forge-lint: disable-next-line(unsafe-typecast)
+            data = abi.encodePacked(bytes1(0xd7), bytes1(0x94), origin, bytes1(0x81), uint8(nonce));
+        } else if (nonce <= 0xffff) {
+            // forge-lint: disable-next-line(unsafe-typecast)
+            data = abi.encodePacked(bytes1(0xd8), bytes1(0x94), origin, bytes1(0x82), uint16(nonce));
+        } else if (nonce <= 0xffffff) {
+            // forge-lint: disable-next-line(unsafe-typecast)
+            data = abi.encodePacked(bytes1(0xd9), bytes1(0x94), origin, bytes1(0x83), uint24(nonce));
+        } else if (nonce <= 0xffffffff) {
+            // forge-lint: disable-next-line(unsafe-typecast)
+            data = abi.encodePacked(bytes1(0xda), bytes1(0x94), origin, bytes1(0x84), uint32(nonce));
+        } else if (nonce <= 0xffffffffff) {
+            // forge-lint: disable-next-line(unsafe-typecast)
+            data = abi.encodePacked(bytes1(0xdb), bytes1(0x94), origin, bytes1(0x85), uint40(nonce));
+        } else if (nonce <= 0xffffffffffff) {
+            // forge-lint: disable-next-line(unsafe-typecast)
+            data = abi.encodePacked(bytes1(0xdc), bytes1(0x94), origin, bytes1(0x86), uint48(nonce));
+        } else if (nonce <= 0xffffffffffffff) {
+            // forge-lint: disable-next-line(unsafe-typecast)
+            data = abi.encodePacked(bytes1(0xdd), bytes1(0x94), origin, bytes1(0x87), uint56(nonce));
+        } else {
+            // forge-lint: disable-next-line(unsafe-typecast)
+            data = abi.encodePacked(bytes1(0xde), bytes1(0x94), origin, bytes1(0x88), uint64(nonce));
+        }
+
+        bytes32 hash = keccak256(data);
+        assembly {
+            mstore(0, hash)
+            addr := mload(0)
+        }
+    }
+}

package/test/audit/PendingReserveSnapshotBypass.t.sol

@@ -193,6 +193,45 @@ contract PendingReserveSnapshotBypassTest is JBTest, TestBaseWorkflow {
         );
     }
 
+    /// @notice Pending reserve mints in the delayed-attestation window must not change BWA power.
+    function test_mintingPendingReserveBeforeDelayedAttestationDoesNotChangeBWA() external {
+        DefifaLaunchProjectData memory data = _launchData();
+        data.attestationStartTime = uint48(block.timestamp + 5 days);
+
+        (_pid, _nft, _gov) = _launch(data);
+
+        vm.warp(block.timestamp + 1 days + 1);
+        _mint(_player0, 1);
+        _mint(_player1, 2);
+        _mint(_player2, 3);
+        _mint(_player3, 4);
+        _delegateSelf(_player0, 1);
+        _delegateSelf(_player1, 2);
+        _delegateSelf(_player2, 3);
+        _delegateSelf(_player3, 4);
+
+        vm.warp(block.timestamp + 2 days);
+
+        DefifaTierCashOutWeight[] memory scorecard = _evenScorecard();
+        uint256 scorecardId = _gov.submitScorecardFor(_gameId, scorecard);
+        uint48 futureSnapshotTime = uint48(_gov.attestationStartTimeOf(_gameId) - 1);
+
+        uint256 preRaw = _gov.getAttestationWeight(_gameId, _player0, futureSnapshotTime);
+        uint256 preBwa = _gov.getBWAAttestationWeight(_gameId, scorecardId, _player0, futureSnapshotTime);
+
+        JB721TiersMintReservesConfig[] memory reserveConfigs = new JB721TiersMintReservesConfig[](1);
+        reserveConfigs[0] = JB721TiersMintReservesConfig({tierId: 1, count: 1});
+        _nft.mintReservesFor(reserveConfigs);
+
+        uint256 postRaw = _gov.getAttestationWeight(_gameId, _player0, futureSnapshotTime);
+        uint256 postBwa = _gov.getBWAAttestationWeight(_gameId, scorecardId, _player0, futureSnapshotTime);
+
+        assertEq(preRaw, 500_000_000, "future raw snapshot includes the pending reserve exactly once");
+        assertEq(preBwa, 375_000_000, "future BWA starts from the reserve-adjusted submission denominator");
+        assertEq(postRaw, preRaw, "future raw power stays frozen before attestation begins");
+        assertEq(postBwa, preBwa, "reserve mint in delayed window must not change BWA power");
+    }
+
     function _evenScorecard() internal view returns (DefifaTierCashOutWeight[] memory scorecard) {
         scorecard = new DefifaTierCashOutWeight[](4);
         uint256 totalWeight = _nft.TOTAL_CASHOUT_WEIGHT();
@@ -259,6 +298,7 @@ contract PendingReserveSnapshotBypassTest is JBTest, TestBaseWorkflow {
     function _mint(address user, uint256 tierId) internal {
         vm.deal(user, 1 ether);
         uint16[] memory tiers = new uint16[](1);
+        // forge-lint: disable-next-line(unsafe-typecast)
         tiers[0] = uint16(tierId);
         bytes[] memory data = new bytes[](1);
         data[0] = abi.encode(user, tiers);

package/test/regression/AttestationDelegateBeneficiary.t.sol

@@ -178,8 +178,8 @@ contract AttestationDelegateBeneficiary is JBTest, TestBaseWorkflow {
         assertEq(delegate, user, "Default delegate should be self when payer == beneficiary");
     }
 
-    /// @notice When an explicit delegate is set, it should be used regardless of payer/beneficiary.
-    function test_explicitDelegateOverridesDefault() public {
+    /// @notice A third-party payer cannot override the beneficiary's delegate.
+    function test_explicitDelegateFromThirdPartyDoesNotOverrideBeneficiaryDefault() public {
         address payer = address(bytes20(keccak256("payer2")));
         address beneficiary = address(bytes20(keccak256("beneficiary2")));
         address explicitDelegate = address(bytes20(keccak256("explicitDelegate")));
@@ -204,10 +204,8 @@ contract AttestationDelegateBeneficiary is JBTest, TestBaseWorkflow {
             metadata: metadata
         });
 
-        // With the fix, delegation is stored on the beneficiary's account, not the payer's.
         address beneficiaryDelegate = _nft.getTierDelegateOf(beneficiary, 1);
-        assertEq(beneficiaryDelegate, explicitDelegate, "Explicit delegate should override default on beneficiary");
-        // Payer should have no delegation.
+        assertEq(beneficiaryDelegate, beneficiary, "third-party payer cannot overwrite beneficiary delegation");
         address payerDelegate = _nft.getTierDelegateOf(payer, 1);
         assertEq(payerDelegate, address(0), "Payer should have no delegation when payer != beneficiary");
     }