@ballkidz/defifa 0.0.22 → 0.0.24

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ballkidz/defifa",
-  "version": "0.0.22",
+  "version": "0.0.24",
   "license": "MIT",
   "engines": {
     "node": ">=20.0.0"

package/references/operations.md

@@ -1,9 +1,11 @@
 # Defifa Operations
 
+Use this file when the task is about launch config, phase timing, governance windows, or deciding whether a symptom is operational drift or runtime logic.
+
 ## Deployment Surface
 
 - [`src/DefifaDeployer.sol`](../src/DefifaDeployer.sol) is the first stop for launch-time config, phase queueing, and post-ratification fulfillment.
-- [`script/Deploy.s.sol`](../script/Deploy.s.sol) is the deployment entry point when the task is about current wiring rather than game mechanics.
+- [`script/Deploy.s.sol`](../script/Deploy.s.sol) and [`script/helpers/DefifaDeploymentLib.sol`](../script/helpers/DefifaDeploymentLib.sol) are the deployment entrypoints when the task is about current wiring rather than game mechanics.
 - [`src/structs/`](../src/structs/) and [`src/enums/`](../src/enums/) define launch data, phase types, and other inputs that often drift from remembered assumptions.
 
 ## Change Checklist
@@ -12,6 +14,7 @@
 - If you edit hook settlement logic, re-check fee accounting and mint-cost invariants.
 - If you touch governance thresholds or attestation behavior, inspect the governor tests before assuming the change is local.
 - If you touch token metadata or rendering, verify whether the bug belongs in the resolver instead of settlement code.
+- If you touch anything supply-sensitive, inspect the audit tests around pending reserves and quorum before relying on current intuition.
 
 ## Common Failure Modes
 
@@ -19,9 +22,11 @@
 - Governance behavior looks wrong, but the real issue is stale launch configuration.
 - Settlement changes accidentally affect fee distribution or redemption accounting.
 - Resolver issues get misdiagnosed as hook or governor problems because they surface through NFTs.
+- Audit-style failures around reserve dilution or attestation counting are treated as isolated math issues even though they cross deployer, hook, and governor boundaries.
 
 ## Useful Proof Points
 
 - [`test/Fork.t.sol`](../test/Fork.t.sol) for live-integration assumptions.
 - [`test/TestAuditGaps.sol`](../test/TestAuditGaps.sol) and [`test/TestQALastMile.t.sol`](../test/TestQALastMile.t.sol) for pinned edge cases.
 - [`test/BWAFunctionComparison.t.sol`](../test/BWAFunctionComparison.t.sol) and [`test/DefifaUSDC.t.sol`](../test/DefifaUSDC.t.sol) when currency or accounting context matters.
+- [`test/audit/`](../test/audit/) when a change touches pending reserves, registry alignment, quorum griefing, or double-counting.

package/references/runtime.md

@@ -1,5 +1,7 @@
 # Defifa Runtime
 
+Use this file when `defifa/SKILLS.md` has already routed you here and you need to reason about the game as a state machine rather than as isolated contracts.
+
 ## Contract Roles
 
 - [`src/DefifaDeployer.sol`](../src/DefifaDeployer.sol) launches games, manages phase progression, fulfills commitments, and triggers safety exits such as no-contest.
@@ -12,9 +14,9 @@
 
 1. Countdown before minting opens.
 2. Mint phase where players buy outcome NFTs and can delegate attestation power.
-3. Optional refund phase.
+3. Optional refund phase if the launch configuration allows it.
 4. Scoring phase where scorecards are submitted, attested, and ratified.
-5. Complete or no-contest settlement depending on governance and safety conditions.
+5. Complete or no-contest settlement depending on governance outcome and safety checks.
 
 ## High-Risk Areas
 
@@ -22,11 +24,20 @@
 - No-contest and refund behavior: these paths are economic safety valves, not edge-case garnish.
 - Fee accounting and commitment fulfillment: payout ordering and accounting drift can change final redemption value.
 - Hook/governor/deployer coupling: many bugs come from changing one layer while assuming the others are passive.
+- Pending reserved supply and snapshot assumptions: settlement and quorum logic can drift if supply-sensitive views are taken at the wrong time.
+- Scorecards that miss quorum do not naturally “finish.” New scorecards can still be submitted until no-contest logic takes over, so do not assume a clean defeated terminal state.
+
+## Common Misdiagnoses
+
+- A settlement bug is blamed on [`src/DefifaHook.sol`](../src/DefifaHook.sol) even though the wrong phase or grace-period state was created in [`src/DefifaDeployer.sol`](../src/DefifaDeployer.sol) or [`src/DefifaGovernor.sol`](../src/DefifaGovernor.sol).
+- A governance bug is blamed on the governor even though attestation power or delegation semantics were wrong in the hook layer.
+- An NFT-facing bug is blamed on settlement code even though the problem is resolver output in [`src/DefifaTokenUriResolver.sol`](../src/DefifaTokenUriResolver.sol).
+- A Defifa-specific payout result is patched in this repo when the real bug is shared 721 or core protocol behavior upstream.
 
 ## Tests To Trust First
 
 - [`test/DefifaGovernor.t.sol`](../test/DefifaGovernor.t.sol) for governance flow.
 - [`test/DefifaNoContest.t.sol`](../test/DefifaNoContest.t.sol) for safety exits.
 - [`test/DefifaFeeAccounting.t.sol`](../test/DefifaFeeAccounting.t.sol) and [`test/DefifaMintCostInvariant.t.sol`](../test/DefifaMintCostInvariant.t.sol) for economic correctness.
-- [`test/DefifaHookRegressions.t.sol`](../test/DefifaHookRegressions.t.sol) and [`test/regression/`](../test/regression/) for pinned regressions.
-- [`test/DefifaSecurity.t.sol`](../test/DefifaSecurity.t.sol) and [`test/DefifaGovernanceHardening.t.sol`](../test/DefifaGovernanceHardening.t.sol) for adversarial cases.
+- [`test/DefifaHookRegressions.t.sol`](../test/DefifaHookRegressions.t.sol), [`test/regression/GracePeriodBypass.t.sol`](../test/regression/GracePeriodBypass.t.sol), [`test/regression/FulfillmentBlocksRatification.t.sol`](../test/regression/FulfillmentBlocksRatification.t.sol), and [`test/regression/AttestationDelegateBeneficiary.t.sol`](../test/regression/AttestationDelegateBeneficiary.t.sol) for pinned regressions.
+- [`test/DefifaSecurity.t.sol`](../test/DefifaSecurity.t.sol), [`test/DefifaGovernanceHardening.t.sol`](../test/DefifaGovernanceHardening.t.sol), [`test/DefifaAdversarialQuorum.t.sol`](../test/DefifaAdversarialQuorum.t.sol), and [`test/audit/`](../test/audit/) for adversarial and audit-derived cases.

package/src/DefifaDeployer.sol

@@ -53,6 +53,7 @@ contract DefifaDeployer is IDefifaDeployer, IDefifaGamePhaseReporter, IDefifaGam
     error DefifaDeployer_InvalidFeePercent();
     error DefifaDeployer_InvalidGameConfiguration();
     error DefifaDeployer_IncorrectDecimalAmount();
+    error DefifaDeployer_InvalidCurrency();
     error DefifaDeployer_NotNoContest();
     error DefifaDeployer_NoContestAlreadyTriggered();
     error DefifaDeployer_TerminalNotFound();
@@ -337,16 +338,12 @@ contract DefifaDeployer is IDefifaDeployer, IDefifaGamePhaseReporter, IDefifaGam
         fulfilledCommitmentsOf[gameId] = feeAmount > 0 ? feeAmount : 1;
 
         // Send only the fee portion as payouts. The remaining balance stays as surplus for cash-outs.
+        // Use the ruleset's baseCurrency — this matches the currency under which payout limits were stored
+        // at launch time, regardless of whether the token is native ETH or an ERC-20.
         // Wrapped in try-catch so the final ruleset is always queued even if payout fails.
         // slither-disable-next-line unused-return,reentrancy-no-eth
         try terminal.sendPayoutsOf({
-            projectId: gameId,
-            token: token,
-            amount: feeAmount,
-            // Casting address to uint32 via uint160 is the standard Juicebox token-to-currency conversion.
-            // forge-lint: disable-next-line(unsafe-typecast)
-            currency: token == JBConstants.NATIVE_TOKEN ? metadata.baseCurrency : uint32(uint160(token)),
-            minTokensPaidOut: 0
+            projectId: gameId, token: token, amount: feeAmount, currency: metadata.baseCurrency, minTokensPaidOut: 0
         }) {}
         catch (bytes memory reason) {
             // Payout failed — fee stays in pot. Reset to sentinel (1) so currentGamePotOf
@@ -394,6 +391,16 @@ contract DefifaDeployer is IDefifaDeployer, IDefifaGamePhaseReporter, IDefifaGam
                     < block.timestamp + launchProjectData.refundPeriodDuration + launchProjectData.mintPeriodDuration
         ) revert DefifaDeployer_InvalidGameConfiguration();
 
+        // The hook and governor hardcode uint256[128] tier-weight tables, so reject games with more than 128 tiers.
+        if (launchProjectData.tiers.length > 128) revert DefifaDeployer_InvalidGameConfiguration();
+
+        // Reject ERC-20 games with a zero currency — a zero baseCurrency would cause payout limit lookups
+        // in fulfillCommitmentsOf to silently fail, skipping all commitment payouts.
+        // slither-disable-next-line incorrect-equality
+        if (launchProjectData.token.token != JBConstants.NATIVE_TOKEN && launchProjectData.token.currency == 0) {
+            revert DefifaDeployer_InvalidCurrency();
+        }
+
         // Get the game ID, optimistically knowing it will be one greater than the current count.
         // Note: this prediction can race with other concurrent project deployments. If another project is
         // created between reading count() and launchProjectFor(), the actual ID will differ. This is

package/src/DefifaHook.sol

@@ -131,6 +131,10 @@ contract DefifaHook is JB721Hook, Ownable, IDefifaHook {
     /// @notice The contract reporting the game pot.
     IDefifaGamePotReporter public override gamePotReporter;
 
+    /// @notice Whether a token was minted through reserves (free) rather than paid for.
+    /// @dev Reserve-minted tokens are excluded from refund calculations since no funds were contributed for them.
+    mapping(uint256 tokenId => bool) public override isReserveMint;
+
     /// @notice The currency that is accepted when minting tier NFTs.
     uint256 public override pricingCurrency;
 
@@ -289,6 +293,27 @@ contract DefifaHook is JB721Hook, Ownable, IDefifaHook {
             tokenIds: decodedTokenIds, hookStore: hookStore, hook: address(this)
         });
 
+        // During refund phases, exclude reserve-minted tokens — they were minted for free and have no paid amount
+        // to refund.
+        if (
+            gamePhase == DefifaGamePhase.MINT || gamePhase == DefifaGamePhase.REFUND
+                || gamePhase == DefifaGamePhase.NO_CONTEST
+        ) {
+            for (uint256 i; i < decodedTokenIds.length;) {
+                if (isReserveMint[decodedTokenIds[i]]) {
+                    // slither-disable-next-line calls-loop
+                    cumulativeMintPrice -= hookStore.tierOfTokenId({
+                        hook: address(this), tokenId: decodedTokenIds[i], includeResolvedUri: false
+                    })
+                    .price;
+                }
+
+                unchecked {
+                    ++i;
+                }
+            }
+        }
+
         // Use this contract as the only cash out hook.
         hookSpecifications = new JBCashOutHookSpecification[](1);
         hookSpecifications[0] =
@@ -599,6 +624,9 @@ contract DefifaHook is JB721Hook, Ownable, IDefifaHook {
             // Set the token ID.
             tokenId = tokenIds[i];
 
+            // Flag this token as reserve-minted so it is excluded from refund calculations.
+            isReserveMint[tokenId] = true;
+
             // Mint the token to the reserve beneficiary.
             // slither-disable-next-line reentrancy-no-eth
             _mint({to: reservedTokenBeneficiary, tokenId: tokenId});

package/src/interfaces/IDefifaHook.sol

@@ -162,6 +162,11 @@ interface IDefifaHook is IJB721Hook {
     /// @return The total attestation units.
     function getTierTotalAttestationUnitsOf(uint256 tier) external view returns (uint256);
 
+    /// @notice Whether a token was minted through reserves rather than paid for.
+    /// @param tokenId The ID of the token to check.
+    /// @return True if the token was minted as a reserve.
+    function isReserveMint(uint256 tokenId) external view returns (bool);
+
     /// @notice The pricing currency used by this hook.
     /// @return The currency identifier.
     function pricingCurrency() external view returns (uint256);

package/src/structs/DefifaTierParams.sol

@@ -11,7 +11,6 @@ struct DefifaTierParams {
     string name;
     uint16 reservedRate;
     address reservedTokenBeneficiary;
-    // forge-lint: disable-next-line(mixed-case-variable)
     bytes32 encodedIPFSUri;
     bool shouldUseReservedTokenBeneficiaryAsDefault;
 }

package/test/audit/CodexNemesisCurrencyMismatchBypass.t.sol

@@ -0,0 +1,112 @@
+// SPDX-License-Identifier: UNLICENSED
+pragma solidity 0.8.28;
+
+import {DefifaUSDCTest} from "../DefifaUSDC.t.sol";
+import {DefifaLaunchProjectData} from "../../src/structs/DefifaLaunchProjectData.sol";
+import {DefifaTierCashOutWeight} from "../../src/structs/DefifaTierCashOutWeight.sol";
+import {DefifaTierParams} from "../../src/structs/DefifaTierParams.sol";
+import {JB721TiersHookStore} from "@bananapus/721-hook-v6/src/JB721TiersHookStore.sol";
+import {IJB721TokenUriResolver} from "@bananapus/721-hook-v6/src/interfaces/IJB721TokenUriResolver.sol";
+import {JBAccountingContext} from "@bananapus/core-v6/src/structs/JBAccountingContext.sol";
+import {JBConstants} from "@bananapus/core-v6/src/libraries/JBConstants.sol";
+import {JBSplit} from "@bananapus/core-v6/src/structs/JBSplit.sol";
+
+/// @notice Regression test for the currency mismatch fix: ERC-20 games now correctly resolve payout limits via
+/// baseCurrency. Before the fix, using a non-canonical currency (e.g. currency=1 for USDC) caused sendPayoutsOf to use
+/// uint32(uint160(token)) which didn't match the stored payout limit currency, silently skipping payouts.
+/// After the fix, fulfillCommitmentsOf uses metadata.baseCurrency which always matches the stored limit.
+contract CodexNemesisCurrencyMismatchBypassTest is DefifaUSDCTest {
+    /// @notice Verify that an ERC-20 game with non-canonical currency (1) correctly pays out commitment fees.
+    function test_nonCanonicalCurrencyPayoutsNowSucceed() external {
+        uint104 tierPrice = 100e6;
+
+        (_pid, _nft, _gov) = _launch(_launchDataUsdcNonCanonical(tierPrice));
+        _users = new address[](2);
+        _users[0] = _addr(0);
+        _users[1] = _addr(1);
+
+        vm.warp(block.timestamp + 1 days + 1);
+
+        _mintUsdc(_users[0], 1, tierPrice);
+        _mintUsdc(_users[1], 2, tierPrice);
+        _delegateSelf(_users[0], 1);
+        _delegateSelf(_users[1], 2);
+
+        vm.warp(block.timestamp + 2 days);
+
+        DefifaTierCashOutWeight[] memory scorecard = new DefifaTierCashOutWeight[](2);
+        scorecard[0] = DefifaTierCashOutWeight({id: 1, cashOutWeight: _nft.TOTAL_CASHOUT_WEIGHT()});
+        scorecard[1] = DefifaTierCashOutWeight({id: 2, cashOutWeight: 0});
+
+        vm.prank(_users[1]);
+        uint256 scorecardId = _gov.submitScorecardFor(_pid, scorecard);
+
+        vm.prank(_users[1]);
+        _gov.attestToScorecardFrom(_pid, scorecardId);
+
+        vm.warp(block.timestamp + _gov.attestationGracePeriodOf(_pid) + 1);
+
+        uint256 preRatificationBalance = _balance();
+        uint256 expectedFee = (preRatificationBalance * 75_000_000) / JBConstants.SPLITS_TOTAL_PERCENT;
+
+        vm.prank(_users[1]);
+        _gov.ratifyScorecardFrom(_pid, scorecard);
+
+        // After the fix: payout succeeds, fulfilledCommitmentsOf stores the actual fee (not the sentinel).
+        assertEq(
+            deployer.fulfilledCommitmentsOf(_pid), expectedFee, "fulfilled commitments equals the expected fee amount"
+        );
+
+        // The fee has been paid out, reducing the game pot.
+        assertEq(_balance(), preRatificationBalance - expectedFee, "balance decreased by the fee amount");
+
+        // Winner cashes out and receives only the post-fee surplus, not the full pot.
+        uint256 winnerBalBefore = usdc.balanceOf(_users[0]);
+        _cashOutUsdc(_users[0], 1, 1);
+        uint256 winnerReceived = usdc.balanceOf(_users[0]) - winnerBalBefore;
+
+        assertEq(
+            winnerReceived,
+            preRatificationBalance - expectedFee,
+            "winner receives the post-fee surplus, not the full pot"
+        );
+    }
+
+    function _launchDataUsdcNonCanonical(uint104 tierPrice) internal returns (DefifaLaunchProjectData memory) {
+        DefifaTierParams[] memory tp = new DefifaTierParams[](2);
+        for (uint256 i; i < 2; i++) {
+            tp[i] = DefifaTierParams({
+                reservedRate: 1001,
+                reservedTokenBeneficiary: address(0),
+                encodedIPFSUri: bytes32(0),
+                shouldUseReservedTokenBeneficiaryAsDefault: false,
+                name: "DEFIFA"
+            });
+        }
+
+        // Non-canonical currency (1 = ETH currency ID) for a USDC token.
+        // Before the fix, this caused fulfillCommitmentsOf to silently skip payouts.
+        return DefifaLaunchProjectData({
+            name: "DEFIFA_USDC_NONCANONICAL",
+            projectUri: "",
+            contractUri: "",
+            baseUri: "",
+            token: JBAccountingContext({token: address(usdc), decimals: 6, currency: 1}),
+            mintPeriodDuration: 1 days,
+            start: uint48(block.timestamp + 3 days),
+            refundPeriodDuration: 1 days,
+            store: new JB721TiersHookStore(),
+            splits: new JBSplit[](0),
+            attestationStartTime: 0,
+            attestationGracePeriod: 1 days,
+            defaultAttestationDelegate: address(0),
+            tierPrice: tierPrice,
+            tiers: tp,
+            defaultTokenUriResolver: IJB721TokenUriResolver(address(0)),
+            terminal: jbMultiTerminal(),
+            minParticipation: 0,
+            scorecardTimeout: 0,
+            timelockDuration: 0
+        });
+    }
+}

package/test/audit/CodexNemesisNoContestReserveDrain.t.sol

@@ -0,0 +1,238 @@
+// SPDX-License-Identifier: UNLICENSED
+pragma solidity 0.8.28;
+
+import {TestBaseWorkflow} from "@bananapus/core-v6/test/helpers/TestBaseWorkflow.sol";
+import {JBTest} from "@bananapus/core-v6/test/helpers/JBTest.sol";
+
+import {DefifaDeployer} from "../../src/DefifaDeployer.sol";
+import {DefifaGovernor} from "../../src/DefifaGovernor.sol";
+import {DefifaHook} from "../../src/DefifaHook.sol";
+import {DefifaTokenUriResolver} from "../../src/DefifaTokenUriResolver.sol";
+import {DefifaGamePhase} from "../../src/enums/DefifaGamePhase.sol";
+import {DefifaLaunchProjectData} from "../../src/structs/DefifaLaunchProjectData.sol";
+import {DefifaTierParams} from "../../src/structs/DefifaTierParams.sol";
+import {JB721TiersHookStore} from "@bananapus/721-hook-v6/src/JB721TiersHookStore.sol";
+import {JB721TiersMintReservesConfig} from "@bananapus/721-hook-v6/src/structs/JB721TiersMintReservesConfig.sol";
+import {IJB721TokenUriResolver} from "@bananapus/721-hook-v6/src/interfaces/IJB721TokenUriResolver.sol";
+import {JBAddressRegistry} from "@bananapus/address-registry-v6/src/JBAddressRegistry.sol";
+import {JBConstants} from "@bananapus/core-v6/src/libraries/JBConstants.sol";
+import {JBCurrencyIds} from "@bananapus/core-v6/src/libraries/JBCurrencyIds.sol";
+import {JBAccountingContext} from "@bananapus/core-v6/src/structs/JBAccountingContext.sol";
+import {JBTerminalConfig} from "@bananapus/core-v6/src/structs/JBTerminalConfig.sol";
+import {JBRulesetConfig} from "@bananapus/core-v6/src/structs/JBRulesetConfig.sol";
+import {JBRulesetMetadata} from "@bananapus/core-v6/src/structs/JBRulesetMetadata.sol";
+import {JBSplitGroup} from "@bananapus/core-v6/src/structs/JBSplitGroup.sol";
+import {JBFundAccessLimitGroup} from "@bananapus/core-v6/src/structs/JBFundAccessLimitGroup.sol";
+import {JBSplit} from "@bananapus/core-v6/src/structs/JBSplit.sol";
+import {IJBRulesetApprovalHook} from "@bananapus/core-v6/src/interfaces/IJBRulesetApprovalHook.sol";
+import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
+import {ITypeface} from "lib/typeface/contracts/interfaces/ITypeface.sol";
+
+contract CodexNemesisNoContestReserveDrainTest is JBTest, TestBaseWorkflow {
+    uint256 internal _protocolFeeProjectId;
+    uint256 internal _defifaProjectId;
+
+    DefifaDeployer internal _deployer;
+    DefifaHook internal _hookImpl;
+    DefifaGovernor internal _governorImpl;
+
+    address internal _projectOwner = address(bytes20(keccak256("projectOwner")));
+    address internal _player = address(bytes20(keccak256("player")));
+    address internal _reserveBeneficiary = address(bytes20(keccak256("reserveBeneficiary")));
+
+    function setUp() public virtual override {
+        super.setUp();
+
+        JBAccountingContext[] memory tokens = new JBAccountingContext[](1);
+        tokens[0] = JBAccountingContext({token: JBConstants.NATIVE_TOKEN, decimals: 18, currency: JBCurrencyIds.ETH});
+
+        JBTerminalConfig[] memory terminalConfigs = new JBTerminalConfig[](1);
+        terminalConfigs[0] = JBTerminalConfig({terminal: jbMultiTerminal(), accountingContextsToAccept: tokens});
+
+        JBRulesetConfig[] memory rulesetConfigs = new JBRulesetConfig[](1);
+        rulesetConfigs[0] = JBRulesetConfig({
+            mustStartAtOrAfter: 0,
+            duration: 10 days,
+            weight: 1e18,
+            weightCutPercent: 0,
+            approvalHook: IJBRulesetApprovalHook(address(0)),
+            metadata: JBRulesetMetadata({
+                reservedPercent: 0,
+                cashOutTaxRate: 0,
+                baseCurrency: JBCurrencyIds.ETH,
+                pausePay: false,
+                pauseCreditTransfers: false,
+                allowOwnerMinting: false,
+                allowSetCustomToken: false,
+                allowTerminalMigration: false,
+                allowSetTerminals: false,
+                allowSetController: false,
+                allowAddAccountingContext: false,
+                allowAddPriceFeed: false,
+                ownerMustSendPayouts: false,
+                holdFees: false,
+                useTotalSurplusForCashOuts: false,
+                useDataHookForPay: true,
+                useDataHookForCashOut: true,
+                dataHook: address(0),
+                metadata: 0
+            }),
+            splitGroups: new JBSplitGroup[](0),
+            fundAccessLimitGroups: new JBFundAccessLimitGroup[](0)
+        });
+
+        _protocolFeeProjectId =
+            jbController().launchProjectFor(address(_projectOwner), "", rulesetConfigs, terminalConfigs, "");
+        vm.prank(_projectOwner);
+        address nanaToken =
+            address(jbController().deployERC20For(_protocolFeeProjectId, "Bananapus", "NANA", bytes32(0)));
+
+        _defifaProjectId =
+            jbController().launchProjectFor(address(_projectOwner), "", rulesetConfigs, terminalConfigs, "");
+        vm.prank(_projectOwner);
+        address defifaToken = address(jbController().deployERC20For(_defifaProjectId, "Defifa", "DEFIFA", bytes32(0)));
+
+        _hookImpl = new DefifaHook(jbDirectory(), IERC20(defifaToken), IERC20(nanaToken));
+        _governorImpl = new DefifaGovernor(jbController(), address(this));
+        _deployer = new DefifaDeployer(
+            address(_hookImpl),
+            new DefifaTokenUriResolver(ITypeface(address(0))),
+            _governorImpl,
+            jbController(),
+            new JBAddressRegistry(),
+            _defifaProjectId,
+            _protocolFeeProjectId
+        );
+
+        _hookImpl.transferOwnership(address(_deployer));
+        _governorImpl.transferOwnership(address(_deployer));
+    }
+
+    function test_noContestReserveMintExcludedFromRefund() external {
+        DefifaLaunchProjectData memory data = _launchData();
+        uint256 projectId = _deployer.launchGameWith(data);
+
+        vm.warp(data.start - data.mintPeriodDuration - data.refundPeriodDuration);
+        vm.deal(_player, 1 ether);
+
+        uint16[] memory tierIds = new uint16[](1);
+        tierIds[0] = 1;
+        vm.prank(_player);
+        jbMultiTerminal().pay{value: 1 ether}(
+            projectId,
+            JBConstants.NATIVE_TOKEN,
+            1 ether,
+            _player,
+            0,
+            "",
+            _buildPayMetadata(abi.encode(_player, tierIds))
+        );
+
+        vm.warp(data.start + 1);
+        (, JBRulesetMetadata memory metadata) = jbController().currentRulesetOf(projectId);
+        DefifaHook hook = DefifaHook(metadata.dataHook);
+        assertEq(uint256(_deployer.currentGamePhaseOf(projectId)), uint256(DefifaGamePhase.NO_CONTEST));
+
+        JB721TiersMintReservesConfig[] memory reserveConfigs = new JB721TiersMintReservesConfig[](1);
+        reserveConfigs[0] = JB721TiersMintReservesConfig({tierId: 1, count: 1});
+        hook.mintReservesFor(reserveConfigs);
+
+        assertEq(hook.balanceOf(_reserveBeneficiary), 1, "reserve beneficiary received a free NFT");
+        assertTrue(hook.isReserveMint(_generateTokenId(1, 2)), "token flagged as reserve mint");
+
+        _deployer.triggerNoContestFor(projectId);
+
+        // Build metadata for the reserve token cashout before calling expectRevert.
+        uint256 reserveTokenId = _generateTokenId(1, 2);
+        uint256[] memory reserveTokenIds = new uint256[](1);
+        reserveTokenIds[0] = reserveTokenId;
+        bytes memory reserveCashOutMetadata = _buildCashOutMetadata(reserveTokenIds);
+
+        // The reserve beneficiary's cashout reverts — reserve-minted tokens are excluded from refund calculations.
+        vm.prank(_reserveBeneficiary);
+        vm.expectRevert();
+        jbMultiTerminal()
+            .cashOutTokensOf(
+                _reserveBeneficiary,
+                projectId,
+                0,
+                JBConstants.NATIVE_TOKEN,
+                0,
+                payable(_reserveBeneficiary),
+                reserveCashOutMetadata
+            );
+
+        // The paid player can still get their full refund.
+        uint256 playerTokenId = _generateTokenId(1, 1);
+        uint256 balanceBefore = _player.balance;
+        _cashOut(projectId, _player, playerTokenId);
+
+        // Player gets full refund (1 ether minus fee).
+        assertTrue(_player.balance > balanceBefore, "player received refund");
+        assertEq(hook.balanceOf(_player), 0, "player NFT burned");
+    }
+
+    function _cashOut(uint256 projectId, address holder, uint256 tokenId) internal {
+        uint256[] memory tokenIds = new uint256[](1);
+        tokenIds[0] = tokenId;
+        bytes memory cashOutMetadata = _buildCashOutMetadata(tokenIds);
+
+        vm.prank(holder);
+        jbMultiTerminal()
+            .cashOutTokensOf(holder, projectId, 0, JBConstants.NATIVE_TOKEN, 0, payable(holder), cashOutMetadata);
+    }
+
+    function _launchData() internal returns (DefifaLaunchProjectData memory) {
+        DefifaTierParams[] memory tierParams = new DefifaTierParams[](1);
+        tierParams[0] = DefifaTierParams({
+            reservedRate: 1,
+            reservedTokenBeneficiary: _reserveBeneficiary,
+            encodedIPFSUri: bytes32(0),
+            shouldUseReservedTokenBeneficiaryAsDefault: false,
+            name: "SOLE"
+        });
+
+        return DefifaLaunchProjectData({
+            name: "DEFIFA",
+            projectUri: "",
+            contractUri: "",
+            baseUri: "",
+            tiers: tierParams,
+            tierPrice: 1 ether,
+            token: JBAccountingContext({token: JBConstants.NATIVE_TOKEN, decimals: 18, currency: JBCurrencyIds.ETH}),
+            mintPeriodDuration: 1 days,
+            refundPeriodDuration: 1 days,
+            start: uint48(block.timestamp + 3 days),
+            splits: new JBSplit[](0),
+            attestationStartTime: 0,
+            attestationGracePeriod: 1 days,
+            defaultAttestationDelegate: address(0),
+            defaultTokenUriResolver: IJB721TokenUriResolver(address(0)),
+            terminal: jbMultiTerminal(),
+            store: new JB721TiersHookStore(),
+            minParticipation: 2 ether,
+            scorecardTimeout: 0,
+            timelockDuration: 0
+        });
+    }
+
+    function _buildPayMetadata(bytes memory decodedData) internal view returns (bytes memory) {
+        bytes4[] memory ids = new bytes4[](1);
+        ids[0] = metadataHelper().getId("pay", address(_hookImpl));
+        bytes[] memory datas = new bytes[](1);
+        datas[0] = decodedData;
+        return metadataHelper().createMetadata(ids, datas);
+    }
+
+    function _buildCashOutMetadata(uint256[] memory tokenIds) internal view returns (bytes memory) {
+        bytes4[] memory ids = new bytes4[](1);
+        ids[0] = metadataHelper().getId("cashOut", address(_hookImpl));
+        bytes[] memory datas = new bytes[](1);
+        datas[0] = abi.encode(tokenIds);
+        return metadataHelper().createMetadata(ids, datas);
+    }
+
+    function _generateTokenId(uint256 tierId, uint256 tokenNumber) internal pure returns (uint256) {
+        return (tierId * 1_000_000_000) + tokenNumber;
+    }
+}