@bananapus/721-hook-v6 0.0.22 → 0.0.24

package/src/libraries/JB721TiersHookLib.sol

@@ -26,6 +26,7 @@ import {JBIpfsDecoder} from "./JBIpfsDecoder.sol";
 /// @notice External library for JB721TiersHook operations extracted to stay within the EIP-170 contract size limit.
 /// @dev Handles tier adjustments, split calculations, price normalization, and split fund distribution.
 library JB721TiersHookLib {
+    error JB721TiersHookLib_NoTerminalForLeftover(uint256 projectId, address token, uint256 leftoverAmount);
     // Events mirrored from IJB721TiersHook (emitted via DELEGATECALL from the hook's context).
     event AddToBalanceReverted(uint256 indexed projectId, address token, uint256 amount, bytes reason);
     event AddTier(uint256 indexed tierId, JB721TierConfig tier, address caller);
@@ -221,73 +222,26 @@ library JB721TiersHookLib {
         }
     }
 
-    /// @notice Converts split amounts from tier pricing denomination to payment token denomination.
-    /// @dev Called after `calculateSplitAmounts` when the payment currency differs from the tier pricing currency.
-    /// @param totalSplitAmount The total split amount in tier pricing denomination.
-    /// @param splitMetadata The encoded per-tier breakdown (tierIds, amounts) from calculateSplitAmounts.
-    /// @param packedPricingContext The packed pricing context (currency, decimals).
-    /// @param prices The prices contract used for currency conversion.
-    /// @param projectId The project ID.
-    /// @param amountCurrency The payment amount currency.
-    /// @param amountDecimals The payment amount decimals.
-    /// @return convertedTotal The total split amount converted to payment token denomination.
-    /// @return convertedMetadata The re-encoded per-tier breakdown with converted amounts.
-    function convertSplitAmounts(
-        uint256 totalSplitAmount,
-        bytes memory splitMetadata,
-        uint256 packedPricingContext,
-        IJBPrices prices,
-        uint256 projectId,
-        uint256 amountCurrency,
-        uint256 amountDecimals
-    )
-        external
-        view
-        returns (uint256 convertedTotal, bytes memory convertedMetadata)
-    {
-        // forge-lint: disable-next-line(unsafe-typecast)
-        uint256 pricingCurrency = uint256(uint32(packedPricingContext));
-        if (amountCurrency == pricingCurrency) return (totalSplitAmount, splitMetadata);
-
-        // No price oracle available to convert between currencies. Return 0 to skip the split rather than
-        // forwarding an unconverted amount denominated in the wrong currency, which would over- or under-pay.
-        if (address(prices) == address(0)) return (0, splitMetadata);
-
-        // forge-lint: disable-next-line(unsafe-typecast)
-        uint256 pricingDecimals = uint256(uint8(packedPricingContext >> 32));
-        uint256 ratio = prices.pricePerUnitOf({
-            projectId: projectId,
-            pricingCurrency: amountCurrency,
-            unitCurrency: pricingCurrency,
-            decimals: amountDecimals
-        });
-
-        (uint16[] memory tierIds, uint256[] memory amounts) = abi.decode(splitMetadata, (uint16[], uint256[]));
-        for (uint256 i; i < amounts.length; i++) {
-            amounts[i] = mulDiv({x: amounts[i], y: ratio, denominator: 10 ** pricingDecimals});
-            convertedTotal += amounts[i];
-        }
-        convertedMetadata = abi.encode(tierIds, amounts);
-    }
-
     /// @notice Calculates the weight for token minting after accounting for tier split amounts.
     /// @dev Extracted from the hook to keep mulDiv's bytecode out of the hook (EIP-170 compliance).
     /// @param contextWeight The original weight from the payment context.
     /// @param amountValue The payment amount value.
     /// @param totalSplitAmount The total amount routed to tier splits.
-    /// @param issueTokensForSplits Whether to issue tokens for the full payment regardless of splits.
+    /// @param store The 721 tiers hook store (to read flags).
+    /// @param hook The hook address.
     /// @return weight The adjusted weight for token minting.
     function calculateWeight(
         uint256 contextWeight,
         uint256 amountValue,
         uint256 totalSplitAmount,
-        bool issueTokensForSplits
+        IJB721TiersHookStore store,
+        address hook
     )
         external
-        pure
+        view
         returns (uint256 weight)
     {
-        if (totalSplitAmount == 0 || issueTokensForSplits) {
+        if (totalSplitAmount == 0 || store.flagsOf(hook).issueTokensForSplits) {
             // No splits, or hook configured to give full token credit regardless — full weight.
             weight = contextWeight;
         } else if (amountValue > totalSplitAmount) {
@@ -299,6 +253,96 @@ library JB721TiersHookLib {
         }
     }
 
+    /// @notice Converts split amounts from tier pricing to payment denomination (if currencies differ), then caps
+    /// the total at the actual payment value — proportionally reducing per-tier amounts when the cap applies.
+    /// @dev Combines currency conversion and cap into one external call to keep hook bytecode under EIP-170.
+    /// @param totalSplitAmount The total split amount in tier pricing denomination.
+    /// @param splitMetadata The encoded per-tier breakdown (tierIds, amounts).
+    /// @param packedPricingContext The packed pricing context (currency in bits 0-31, decimals in bits 32-39).
+    /// @param prices The prices contract used for currency conversion.
+    /// @param projectId The project ID.
+    /// @param amountCurrency The payment amount currency.
+    /// @param amountDecimals The payment amount decimals.
+    /// @param amountValue The actual payment value (used as the cap).
+    /// @return convertedTotal The total split amount after conversion and capping.
+    /// @return convertedMetadata The re-encoded per-tier breakdown with adjusted amounts.
+    function convertAndCapSplitAmounts(
+        uint256 totalSplitAmount,
+        bytes memory splitMetadata,
+        uint256 packedPricingContext,
+        IJBPrices prices,
+        uint256 projectId,
+        uint256 amountCurrency,
+        uint256 amountDecimals,
+        uint256 amountValue
+    )
+        external
+        view
+        returns (uint256 convertedTotal, bytes memory convertedMetadata)
+    {
+        // Start from the input values; conversion and capping modify them in-place below.
+        convertedTotal = totalSplitAmount;
+        convertedMetadata = splitMetadata;
+
+        // Convert each per-tier amount from the tier pricing currency to the payment currency.
+        // forge-lint: disable-next-line(unsafe-typecast)
+        if (amountCurrency != uint256(uint32(packedPricingContext))) {
+            // No price oracle available — return 0 to skip the split rather than forwarding an unconverted
+            // amount denominated in the wrong currency, which would over- or under-pay.
+            if (address(prices) == address(0)) return (0, convertedMetadata);
+
+            {
+                // Get the price ratio: how many payment-currency units per one tier-pricing-currency unit.
+                // forge-lint: disable-next-line(unsafe-typecast)
+                uint256 ratio = prices.pricePerUnitOf({
+                    projectId: projectId,
+                    pricingCurrency: amountCurrency,
+                    // forge-lint: disable-next-line(unsafe-typecast)
+                    unitCurrency: uint256(uint32(packedPricingContext)),
+                    decimals: amountDecimals
+                });
+
+                // The denominator scales each amount from tier-pricing decimals to payment-token decimals.
+                // forge-lint: disable-next-line(unsafe-typecast)
+                uint256 denom = 10 ** uint256(uint8(packedPricingContext >> 32));
+
+                // Decode per-tier breakdown so each amount can be converted individually.
+                (uint16[] memory tierIds, uint256[] memory amounts) =
+                    abi.decode(convertedMetadata, (uint16[], uint256[]));
+
+                // Re-accumulate the total from converted amounts to avoid rounding drift.
+                convertedTotal = 0;
+                for (uint256 i; i < amounts.length; i++) {
+                    // Convert this tier's amount: amount * ratio / 10^pricingDecimals.
+                    amounts[i] = mulDiv({x: amounts[i], y: ratio, denominator: denom});
+                    convertedTotal += amounts[i];
+                }
+
+                // Re-encode with the converted amounts.
+                convertedMetadata = abi.encode(tierIds, amounts);
+            }
+        }
+
+        // Cap the total at the actual payment value. Pay credits fund NFT minting (virtual), but splits
+        // require real tokens to distribute. Without this cap, a user with sufficient pay credits but
+        // insufficient ETH would revert because the terminal can't forward more than what was actually paid.
+        if (convertedTotal > amountValue) {
+            // Proportionally reduce each per-tier amount to stay in sync with the capped total.
+            if (convertedMetadata.length != 0) {
+                (uint16[] memory tierIds, uint256[] memory amounts) =
+                    abi.decode(convertedMetadata, (uint16[], uint256[]));
+                for (uint256 i; i < amounts.length; i++) {
+                    // Scale down: amount * amountValue / originalTotal.
+                    amounts[i] = mulDiv({x: amounts[i], y: amountValue, denominator: convertedTotal});
+                }
+                convertedMetadata = abi.encode(tierIds, amounts);
+            }
+
+            // Clamp the total to the payment value.
+            convertedTotal = amountValue;
+        }
+    }
+
     /// @notice Sets split groups in JBSplits for tiers that have splits configured.
     function _setSplitGroupsFor(
         IJBSplits splits,
@@ -395,17 +439,18 @@ library JB721TiersHookLib {
         bool isNativeToken = token == JBConstants.NATIVE_TOKEN;
         uint256 leftoverPercentage = JBConstants.SPLITS_TOTAL_PERCENT;
         uint256 leftoverAmount = amount;
+        amount = 0;
 
         for (uint256 j; j < tierSplits.length; j++) {
             uint256 payoutAmount =
                 mulDiv({x: leftoverAmount, y: tierSplits[j].percent, denominator: leftoverPercentage});
             if (payoutAmount != 0) {
-                // Always subtract from leftover to prevent failed splits from inflating later recipients'
-                // shares. Failed amounts stay in the contract and are routed to the project's balance with
-                // the leftover below.
                 unchecked {
                     leftoverAmount -= payoutAmount;
                 }
+                // On failure, don't re-add to leftoverAmount — this prevents inflating later recipients.
+                // Failed amounts accumulate as the gap between `amount` and `leftoverAmount + total sent`.
+                // After the loop, we re-add leftoverPercentage-based residual naturally.
                 if (!_sendPayoutToSplit({
                         directory: directory,
                         split: tierSplits[j],
@@ -415,10 +460,10 @@ library JB721TiersHookLib {
                         groupId: groupId,
                         decimals: decimals
                     })) {
-                    // The payout failed — the funds are still in this contract. Add back to leftover so they
-                    // route to the project's balance after the loop.
+                    // Payout failed — route to project balance by returning to leftover after the loop.
+                    // We add back to `amount` (parameter, no longer used for its original purpose).
                     unchecked {
-                        leftoverAmount += payoutAmount;
+                        amount += payoutAmount;
                     }
                 }
             }
@@ -427,39 +472,44 @@ library JB721TiersHookLib {
             }
         }
 
+        // Route failed payout amounts to the project's balance.
+        leftoverAmount += amount;
+
         if (leftoverAmount != 0) {
             // slither-disable-next-line calls-loop
             IJBTerminal terminal = directory.primaryTerminalOf({projectId: projectId, token: token});
-            if (address(terminal) != address(0)) {
-                if (isNativeToken) {
-                    // slither-disable-next-line arbitrary-send-eth,calls-loop
-                    try terminal.addToBalanceOf{value: leftoverAmount}({
-                        projectId: projectId,
-                        token: token,
-                        amount: leftoverAmount,
-                        shouldReturnHeldFees: false,
-                        memo: "",
-                        metadata: bytes("")
-                    }) {}
-                    catch (bytes memory reason) {
-                        emit AddToBalanceReverted(projectId, token, leftoverAmount, reason);
-                    }
-                } else {
-                    SafeERC20.forceApprove({token: IERC20(token), spender: address(terminal), value: leftoverAmount});
-                    // slither-disable-next-line calls-loop
-                    try terminal.addToBalanceOf({
-                        projectId: projectId,
-                        token: token,
-                        amount: leftoverAmount,
-                        shouldReturnHeldFees: false,
-                        memo: "",
-                        metadata: bytes("")
-                    }) {}
-                    catch (bytes memory reason) {
-                        // Reset approval on failure.
-                        SafeERC20.forceApprove({token: IERC20(token), spender: address(terminal), value: 0});
-                        emit AddToBalanceReverted(projectId, token, leftoverAmount, reason);
-                    }
+            // Revert if there are leftover funds but no terminal to route them to.
+            if (address(terminal) == address(0)) {
+                revert JB721TiersHookLib_NoTerminalForLeftover(projectId, token, leftoverAmount);
+            }
+            if (isNativeToken) {
+                // slither-disable-next-line arbitrary-send-eth,calls-loop
+                try terminal.addToBalanceOf{value: leftoverAmount}({
+                    projectId: projectId,
+                    token: token,
+                    amount: leftoverAmount,
+                    shouldReturnHeldFees: false,
+                    memo: "",
+                    metadata: bytes("")
+                }) {}
+                catch (bytes memory reason) {
+                    emit AddToBalanceReverted(projectId, token, leftoverAmount, reason);
+                }
+            } else {
+                SafeERC20.forceApprove({token: IERC20(token), spender: address(terminal), value: leftoverAmount});
+                // slither-disable-next-line calls-loop
+                try terminal.addToBalanceOf({
+                    projectId: projectId,
+                    token: token,
+                    amount: leftoverAmount,
+                    shouldReturnHeldFees: false,
+                    memo: "",
+                    metadata: bytes("")
+                }) {}
+                catch (bytes memory reason) {
+                    // Reset approval on failure.
+                    SafeERC20.forceApprove({token: IERC20(token), spender: address(terminal), value: 0});
+                    emit AddToBalanceReverted(projectId, token, leftoverAmount, reason);
                 }
             }
         }

package/test/audit/CodexPayCreditsBypassTierSplits.t.sol

@@ -0,0 +1,196 @@
+// SPDX-License-Identifier: MIT
+pragma solidity 0.8.28;
+
+// forge-lint: disable-next-line(unaliased-plain-import)
+import "../utils/UnitTestSetup.sol";
+import {IJB721TiersHookStore} from "../../src/interfaces/IJB721TiersHookStore.sol";
+import {IJBDirectory} from "@bananapus/core-v6/src/interfaces/IJBDirectory.sol";
+import {IJBSplits} from "@bananapus/core-v6/src/interfaces/IJBSplits.sol";
+import {JBBeforePayRecordedContext} from "@bananapus/core-v6/src/structs/JBBeforePayRecordedContext.sol";
+import {JBAfterPayRecordedContext} from "@bananapus/core-v6/src/structs/JBAfterPayRecordedContext.sol";
+import {JBPayHookSpecification} from "@bananapus/core-v6/src/structs/JBPayHookSpecification.sol";
+import {JBSplit} from "@bananapus/core-v6/src/structs/JBSplit.sol";
+import {IJBSplitHook} from "@bananapus/core-v6/src/interfaces/IJBSplitHook.sol";
+
+contract CodexPayCreditsBypassTierSplits is UnitTestSetup {
+    address internal splitBeneficiary = makeAddr("splitBeneficiary");
+
+    function setUp() public override {
+        super.setUp();
+        vm.etch(mockJBSplits, new bytes(0x69));
+    }
+
+    function _buildPayMetadata(
+        address hookAddress,
+        bool allowOverspending,
+        uint16[] memory tierIdsToMint
+    )
+        internal
+        view
+        returns (bytes memory)
+    {
+        bytes[] memory data = new bytes[](1);
+        data[0] = abi.encode(allowOverspending, tierIdsToMint);
+        bytes4[] memory ids = new bytes4[](1);
+        ids[0] = metadataHelper.getId("pay", hookAddress);
+        return metadataHelper.createMetadata(ids, data);
+    }
+
+    function _beforePayContext(
+        address hookAddress,
+        uint256 amountValue,
+        uint16[] memory tierIdsToMint
+    )
+        internal
+        view
+        returns (JBBeforePayRecordedContext memory)
+    {
+        return JBBeforePayRecordedContext({
+            terminal: mockTerminalAddress,
+            payer: beneficiary,
+            amount: JBTokenAmount({
+                token: JBConstants.NATIVE_TOKEN,
+                value: amountValue,
+                decimals: 18,
+                currency: uint32(uint160(JBConstants.NATIVE_TOKEN))
+            }),
+            projectId: projectId,
+            rulesetId: 0,
+            beneficiary: beneficiary,
+            weight: 10e18,
+            reservedPercent: 5000,
+            metadata: _buildPayMetadata(hookAddress, false, tierIdsToMint)
+        });
+    }
+
+    function _afterPayContext(
+        address hookAddress,
+        uint256 amountValue,
+        uint256 forwardedAmountValue,
+        bytes memory hookMetadata,
+        uint16[] memory tierIdsToMint
+    )
+        internal
+        view
+        returns (JBAfterPayRecordedContext memory)
+    {
+        return JBAfterPayRecordedContext({
+            payer: beneficiary,
+            projectId: projectId,
+            rulesetId: 0,
+            amount: JBTokenAmount({
+                token: JBConstants.NATIVE_TOKEN,
+                value: amountValue,
+                decimals: 18,
+                currency: uint32(uint160(JBConstants.NATIVE_TOKEN))
+            }),
+            forwardedAmount: JBTokenAmount({
+                token: JBConstants.NATIVE_TOKEN,
+                value: forwardedAmountValue,
+                decimals: 18,
+                currency: uint32(uint160(JBConstants.NATIVE_TOKEN))
+            }),
+            weight: 10e18,
+            newlyIssuedTokenCount: 0,
+            beneficiary: beneficiary,
+            hookMetadata: hookMetadata,
+            payerMetadata: _buildPayMetadata(hookAddress, true, tierIdsToMint)
+        });
+    }
+
+    function test_payCredits_can_bypass_most_of_tier_split_payment() public {
+        ForTest_JB721TiersHook testHook = _initializeForTestHook(0);
+        IJB721TiersHookStore hookStore = testHook.STORE();
+
+        vm.mockCall(
+            mockJBDirectory,
+            abi.encodeWithSelector(IJBDirectory.isTerminalOf.selector, projectId, mockTerminalAddress),
+            abi.encode(true)
+        );
+
+        JB721TierConfig[] memory tierConfigs = new JB721TierConfig[](1);
+        tierConfigs[0] = JB721TierConfig({
+            price: 1 ether,
+            initialSupply: 100,
+            votingUnits: 0,
+            reserveFrequency: 0,
+            reserveBeneficiary: reserveBeneficiary,
+            encodedIPFSUri: bytes32(uint256(0x1234)),
+            category: 1,
+            discountPercent: 0,
+            allowOwnerMint: false,
+            useReserveBeneficiaryAsDefault: false,
+            transfersPausable: false,
+            cannotBeRemoved: false,
+            cannotIncreaseDiscountPercent: false,
+            useVotingUnits: false,
+            splitPercent: 1_000_000_000,
+            splits: new JBSplit[](0)
+        });
+
+        vm.prank(address(testHook));
+        uint256[] memory tierIds = hookStore.recordAddTiers(tierConfigs);
+
+        uint16[] memory noTiers = new uint16[](0);
+        JBAfterPayRecordedContext memory creditSeedContext = JBAfterPayRecordedContext({
+            payer: beneficiary,
+            projectId: projectId,
+            rulesetId: 0,
+            amount: JBTokenAmount({
+                token: JBConstants.NATIVE_TOKEN,
+                value: 1 ether,
+                decimals: 18,
+                currency: uint32(uint160(JBConstants.NATIVE_TOKEN))
+            }),
+            forwardedAmount: JBTokenAmount({
+                token: JBConstants.NATIVE_TOKEN,
+                value: 0,
+                decimals: 18,
+                currency: uint32(uint160(JBConstants.NATIVE_TOKEN))
+            }),
+            weight: 10e18,
+            newlyIssuedTokenCount: 0,
+            beneficiary: beneficiary,
+            hookMetadata: "",
+            payerMetadata: _buildPayMetadata(address(testHook), true, noTiers)
+        });
+
+        vm.prank(mockTerminalAddress);
+        testHook.afterPayRecordedWith(creditSeedContext);
+        assertEq(testHook.payCreditsOf(beneficiary), 1 ether, "setup: credits should be seeded");
+
+        uint16[] memory mintIds = new uint16[](1);
+        mintIds[0] = uint16(tierIds[0]);
+
+        (, JBPayHookSpecification[] memory specs) =
+            testHook.beforePayRecordedWith(_beforePayContext(address(testHook), 1, mintIds));
+        assertEq(specs[0].amount, 1, "forwarded amount is capped to the fresh payment");
+
+        JBSplit[] memory splits = new JBSplit[](1);
+        splits[0] = JBSplit({
+            percent: 1_000_000_000,
+            projectId: 0,
+            beneficiary: payable(splitBeneficiary),
+            preferAddToBalance: false,
+            lockedUntil: 0,
+            hook: IJBSplitHook(address(0))
+        });
+
+        uint256 groupId = uint256(uint160(address(testHook))) | (uint256(tierIds[0]) << 160);
+        vm.mockCall(
+            mockJBSplits, abi.encodeWithSelector(IJBSplits.splitsOf.selector, projectId, 0, groupId), abi.encode(splits)
+        );
+
+        uint256 splitBalanceBefore = splitBeneficiary.balance;
+
+        JBAfterPayRecordedContext memory creditMintContext =
+            _afterPayContext(address(testHook), 1, 1, specs[0].metadata, mintIds);
+        vm.deal(mockTerminalAddress, 1);
+        vm.prank(mockTerminalAddress);
+        testHook.afterPayRecordedWith{value: 1}(creditMintContext);
+
+        assertEq(testHook.balanceOf(beneficiary), 1, "beneficiary should receive the NFT");
+        assertEq(testHook.payCreditsOf(beneficiary), 1, "credits should fund almost the entire mint");
+        assertEq(splitBeneficiary.balance - splitBalanceBefore, 1, "split recipient only gets the fresh payment");
+    }
+}