@bananapus/721-hook-v6 0.0.30 → 0.0.32

package/ARCHITECTURE.md

@@ -65,7 +65,7 @@ holder burns NFT
 ## Dependencies
 
 - `nana-core-v6` hooks, permissions, controller, and terminal surfaces
-- Optional token URI resolvers such as `banny-retail-v6` and `defifa-collection-deployer-v6`
+- Optional token URI resolvers such as `banny-retail-v6` and `defifa`
 
 ## Safe Change Guide
 

package/CHANGELOG.md

@@ -39,7 +39,7 @@ This file describes the verified change from `nana-721-hook-v5` to the current `
 
 ## Indexer impact
 
-- New events: `AddToBalanceReverted`, `SetName`, `SetSymbol`, `SplitPayoutReverted`.
+- New events: `AddToBalanceReverted` (declared but no longer emitted -- replaced by `JB721TiersHookLib_SplitFallbackFailed` revert error), `SetName`, `SetSymbol`, `SplitPayoutReverted`.
 - Tier config decoding changed because `JB721TierConfig` is no longer v5-compatible.
 - Collection metadata can now change after deployment, so one-time indexing of `name` and `symbol` is no longer sufficient.
 
@@ -58,7 +58,7 @@ This file describes the verified change from `nana-721-hook-v5` to the current `
   - `pricingContext()`
   - `setMetadata(...)`
 - Added events
-  - `AddToBalanceReverted`
+  - `AddToBalanceReverted` (declared in interface but no longer emitted; the library now reverts with `JB721TiersHookLib_SplitFallbackFailed` instead)
   - `SetName`
   - `SetSymbol`
   - `SplitPayoutReverted`

package/README.md

@@ -115,6 +115,7 @@ script/
 ## Risks And Notes
 
 - tier accounting is sensitive to reserve minting, split routing, and cross-currency normalization
+- tiny split allocations can round down to zero recipient amounts; integrations should not rely on dust-sized split routing
 - custom token URI resolvers are part of the security surface because they define how metadata is served
 - projects need to be deliberate about whether the hook participates in pay, cash-out, or both paths
 - tier mutations after launch are powerful and should be permissioned carefully

package/RISKS.md

@@ -46,7 +46,7 @@ This file focuses on the tiered-NFT accounting, reserve-mint, and cash-out risks
 - **Split hook callbacks (`processSplitWith`).** During `afterPayRecordedWith` -> `_processPayment` -> `distributeAll`, the library calls `split.hook.processSplitWith{value}()` for each split with a hook. This executes arbitrary code. At callback time: NFTs already minted, `payCreditsOf` updated, `remainingSupply` decremented in the store. Reentering `afterPayRecordedWith` requires terminal authentication and processes as an independent payment. All split hook and terminal calls are wrapped in try-catch to prevent a single reverting recipient from bricking all payments to the project. For native token hooks, a revert returns false (ETH stays in the contract and routes to project balance). For ERC20 hooks, tokens are transferred before the callback; a revert still returns true because the tokens have already left the contract. Tested: `TestAuditGaps_Reentrancy` confirms reentrancy is blocked by terminal check.
 - **Split beneficiary ETH sends.** `_sendPayoutToSplit` uses `beneficiary.call{value: amount}("")`. If the beneficiary reverts, the function returns `false` and the failed amount is accumulated separately, then routed to the project's balance after the distribution loop via `addToBalanceOf`. Later split recipients receive only their proportional share, not the failed recipient's share. Does not revert the entire payment.
 - **Terminal `.pay()` / `.addToBalanceOf()` during split distribution.** For project-targeted splits, the library calls the target project's primary terminal via try-catch. A reverting terminal returns false, routing the funds to the project's balance instead. For ERC20 terminal calls, approval is reset to zero on failure to prevent dangling approvals. The target terminal could call back into the hook, but the hook's state is fully settled (supply, credits, mint state). Reentrancy through this path cannot double-mint or corrupt state.
-- **`afterCashOutRecordedWith` execution order.** Burns tokens via `_burn()` -> `_update()` -> `STORE.recordTransferForTier()` in a loop, then calls `STORE.recordBurn()`. ERC721 `_update` triggers the store's tier balance decrement. Burns go to `address(0)`, so no `onERC721Received` callback.
+- **`afterCashOutRecordedWith` execution order.** Burns tokens via `_burn()` -> `_update()` -> `STORE.tierTransferInfoOfTokenId()` in a loop, then calls `STORE.recordBurn()`. ERC721 `_update` triggers the store's tier balance decrement. Burns go to `address(0)`, so no `onERC721Received` callback.
 - **No `ReentrancyGuard`.** Protection relies on state ordering (all `STORE.record*` calls before external calls), terminal authentication checks, and try-catch wrapping of all external calls in `_sendPayoutToSplit`. `_mint()` uses the non-safe variant, avoiding `onERC721Received` callbacks during minting.
 
 ## 4. Gas/DoS Vectors
@@ -113,3 +113,7 @@ This file focuses on the tiered-NFT accounting, reserve-mint, and cash-out risks
 ### 8.3 Currency mismatch silently skips minting (accepted degradation)
 
 If the payment currency differs from the tier pricing currency and `PRICES == address(0)`, `_processPayment` returns without minting NFTs or creating credits. Funds enter the project balance but no NFTs are issued. This is accepted because: (1) reverting would block all payments in the mismatched currency, (2) the project owner chose not to configure price feeds (by not setting `PRICES`), and (3) the funds are not lost — they increase the project's surplus and are reclaimable via cash-out. Projects that need cross-currency NFT minting must configure `JBPrices`.
+
+### 8.4 Tiny split allocations can round down to zero recipient amounts
+
+Split metadata is expressed in whole token units after conversion and capping. For very small allocations, each rounded per-tier split amount can become zero even though the overall forwarded amount is still reduced by the capped split total. This is an accepted precision tradeoff for dust-sized payments: integrations should not rely on sub-precision split routing and should expect tiny split allocations to be economically lossy.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bananapus/721-hook-v6",
-  "version": "0.0.30",
+  "version": "0.0.32",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -17,9 +17,9 @@
     "artifacts": "source ./.env && npx sphinx artifacts --org-id 'ea165b21-7cdc-4d7b-be59-ecdd4c26bee4' --project-name 'nana-721-hook-v6'"
   },
   "dependencies": {
-    "@bananapus/address-registry-v6": "^0.0.16",
-    "@bananapus/core-v6": "^0.0.30",
-    "@bananapus/ownable-v6": "^0.0.16",
+    "@bananapus/address-registry-v6": "^0.0.17",
+    "@bananapus/core-v6": "^0.0.32",
+    "@bananapus/ownable-v6": "^0.0.17",
     "@bananapus/permission-ids-v6": "^0.0.15",
     "@openzeppelin/contracts": "^5.6.1",
     "@prb/math": "^4.1.0",

package/src/JB721TiersHook.sol

@@ -25,7 +25,6 @@ import {IJB721TokenUriResolver} from "./interfaces/IJB721TokenUriResolver.sol";
 import {JB721TiersHookLib} from "./libraries/JB721TiersHookLib.sol";
 import {JB721TiersRulesetMetadataResolver} from "./libraries/JB721TiersRulesetMetadataResolver.sol";
 import {JB721InitTiersConfig} from "./structs/JB721InitTiersConfig.sol";
-import {JB721Tier} from "./structs/JB721Tier.sol";
 import {JB721TierConfig} from "./structs/JB721TierConfig.sol";
 import {JB721TiersHookFlags} from "./structs/JB721TiersHookFlags.sol";
 import {JB721TiersMintReservesConfig} from "./structs/JB721TiersMintReservesConfig.sol";
@@ -401,12 +400,16 @@ contract JB721TiersHook is JBOwnable, ERC2771Context, JB721Hook, IJB721TiersHook
     /// @dev "Pending" means that the NFTs have been reserved, but have not been minted yet.
     /// @param reserveMintConfigs Contains information about how many reserved tokens to mint for each tier.
     function mintPendingReservesFor(JB721TiersMintReservesConfig[] calldata reserveMintConfigs) external override {
-        for (uint256 i; i < reserveMintConfigs.length; i++) {
+        for (uint256 i; i < reserveMintConfigs.length;) {
             // Get a reference to the params being iterated upon.
             JB721TiersMintReservesConfig memory params = reserveMintConfigs[i];
 
             // Mint pending reserved NFTs from the tier.
             mintPendingReservesFor({tierId: params.tierId, count: params.count});
+
+            unchecked {
+                ++i;
+            }
         }
     }
 
@@ -432,11 +435,15 @@ contract JB721TiersHook is JBOwnable, ERC2771Context, JB721Hook, IJB721TiersHook
             account: owner(), projectId: PROJECT_ID, permissionId: JBPermissionIds.SET_721_DISCOUNT_PERCENT
         });
 
-        for (uint256 i; i < configs.length; i++) {
+        for (uint256 i; i < configs.length;) {
             // Set the config being iterated on.
             JB721TiersSetDiscountPercentConfig memory config = configs[i];
 
             _setDiscountPercentOf({tierId: config.tierId, discountPercent: config.discountPercent});
+
+            unchecked {
+                ++i;
+            }
         }
     }
 
@@ -470,25 +477,28 @@ contract JB721TiersHook is JBOwnable, ERC2771Context, JB721Hook, IJB721TiersHook
             account: owner(), projectId: PROJECT_ID, permissionId: JBPermissionIds.SET_721_METADATA
         });
 
+        // Cache _msgSender() at function entry to avoid repeated calls.
+        address caller = _msgSender();
+
         if (bytes(name).length != 0) {
             // Store the new collection name.
             _setName(name);
-            emit SetName({name: name, caller: _msgSender()});
+            emit SetName({name: name, caller: caller});
         }
         if (bytes(symbol).length != 0) {
             // Store the new collection symbol.
             _setSymbol(symbol);
-            emit SetSymbol({symbol: symbol, caller: _msgSender()});
+            emit SetSymbol({symbol: symbol, caller: caller});
         }
         if (bytes(baseUri).length != 0) {
             // Store the new base URI.
             baseURI = baseUri;
-            emit SetBaseUri({baseUri: baseUri, caller: _msgSender()});
+            emit SetBaseUri({baseUri: baseUri, caller: caller});
         }
         if (bytes(contractUri).length != 0) {
             // Store the new contract URI.
             contractURI = contractUri;
-            emit SetContractUri({uri: contractUri, caller: _msgSender()});
+            emit SetContractUri({uri: contractUri, caller: caller});
         }
 
         // `address(this)` is the sentinel value meaning "leave unchanged" (since `address(0)` clears the resolver).
@@ -498,7 +508,7 @@ contract JB721TiersHook is JBOwnable, ERC2771Context, JB721Hook, IJB721TiersHook
             _recordSetTokenUriResolver(tokenUriResolver);
         }
         if (encodedIPFSUriTierId != 0 && encodedIPFSUri != bytes32(0)) {
-            emit SetEncodedIPFSUri({tierId: encodedIPFSUriTierId, encodedUri: encodedIPFSUri, caller: _msgSender()});
+            emit SetEncodedIPFSUri({tierId: encodedIPFSUriTierId, encodedUri: encodedIPFSUri, caller: caller});
 
             // Store the new encoded IPFS URI.
             STORE.recordSetEncodedIPFSUriOf({tierId: encodedIPFSUriTierId, encodedIPFSUri: encodedIPFSUri});
@@ -531,17 +541,22 @@ contract JB721TiersHook is JBOwnable, ERC2771Context, JB721Hook, IJB721TiersHook
         // slither-disable-next-line calls-loop
         address reserveBeneficiary = STORE.reserveBeneficiaryOf({hook: address(this), tierId: tierId});
 
-        for (uint256 i; i < count; i++) {
+        // Cache _msgSender() before the loop to avoid repeated calls.
+        address caller = _msgSender();
+
+        for (uint256 i; i < count;) {
             // Set the token ID.
             uint256 tokenId = tokenIds[i];
 
-            emit MintReservedNft({
-                tokenId: tokenId, tierId: tierId, beneficiary: reserveBeneficiary, caller: _msgSender()
-            });
+            emit MintReservedNft({tokenId: tokenId, tierId: tierId, beneficiary: reserveBeneficiary, caller: caller});
 
             // Mint the NFT.
             // slither-disable-next-line reentrency-events
             _mint({to: reserveBeneficiary, tokenId: tokenId});
+
+            unchecked {
+                ++i;
+            }
         }
     }
 
@@ -598,17 +613,24 @@ contract JB721TiersHook is JBOwnable, ERC2771Context, JB721Hook, IJB721TiersHook
     )
         internal
     {
-        for (uint256 i; i < tokenIds.length; i++) {
+        // Cache _msgSender() before the loop to avoid repeated calls.
+        address caller = _msgSender();
+
+        for (uint256 i; i < tokenIds.length;) {
             emit Mint({
                 tokenId: tokenIds[i],
                 tierId: tierIds[i],
                 beneficiary: beneficiary,
                 totalAmountPaid: totalAmountPaid,
-                caller: _msgSender()
+                caller: caller
             });
 
             // slither-disable-next-line reentrancy-events
             _mint({to: beneficiary, tokenId: tokenIds[i]});
+
+            unchecked {
+                ++i;
+            }
         }
     }
 
@@ -666,7 +688,9 @@ contract JB721TiersHook is JBOwnable, ERC2771Context, JB721Hook, IJB721TiersHook
                 (tokenIds, leftoverAmount, restrictedCost) =
                     STORE.recordMint({amount: leftoverAmount, tierIds: tierIdsToMint, isOwnerMint: false});
 
-                // Enforce `cantBuyWithCredits`: restricted tiers must be fully covered by fresh payment (not credits).
+                // Enforce `cantBuyWithCredits`: only tiers explicitly configured as credit-restricted must be fully
+                // covered by fresh payment (not stored credits). Split-bearing tiers are not automatically restricted;
+                // deployers must set that flag in tier configuration when they need that invariant.
                 if (restrictedCost > value) revert JB721TiersHook_CantBuyWithCredits();
 
                 // Mint each token.
@@ -766,9 +790,10 @@ contract JB721TiersHook is JBOwnable, ERC2771Context, JB721Hook, IJB721TiersHook
     /// @param to The address the NFT is being transferred to.
     /// @param tokenId The token ID of the NFT being transferred.
     function _update(address to, uint256 tokenId, address auth) internal virtual override returns (address from) {
-        // Get a reference to the tier.
+        // Get only the tier ID and transfersPausable flag (lightweight — avoids full struct construction).
         // slither-disable-next-line calls-loop
-        JB721Tier memory tier = STORE.tierOfTokenId({hook: address(this), tokenId: tokenId, includeResolvedUri: false});
+        (uint256 tierId, bool transfersPausable) =
+            STORE.tierTransferInfoOfTokenId({hook: address(this), tokenId: tokenId});
 
         // Record the transfers and keep a reference to where the token is coming from.
         from = super._update({to: to, tokenId: tokenId, auth: auth});
@@ -776,7 +801,7 @@ contract JB721TiersHook is JBOwnable, ERC2771Context, JB721Hook, IJB721TiersHook
         // Transfers must not be paused (when not minting or burning).
         if (from != address(0)) {
             // If transfers are pausable, check if they're paused.
-            if (tier.flags.transfersPausable) {
+            if (transfersPausable) {
                 // Get a reference to the project's current ruleset.
                 JBRuleset memory ruleset = _currentRulesetOf(PROJECT_ID);
 
@@ -796,6 +821,6 @@ contract JB721TiersHook is JBOwnable, ERC2771Context, JB721Hook, IJB721TiersHook
 
         // Record the transfer.
         // slither-disable-next-line reentrency-events,calls-loop
-        STORE.recordTransferForTier({tierId: tier.id, from: from, to: to});
+        STORE.recordTransferForTier({tierId: tierId, from: from, to: to});
     }
 }

package/src/JB721TiersHookProjectDeployer.sol

@@ -239,7 +239,7 @@ contract JB721TiersHookProjectDeployer is ERC2771Context, JBPermissioned, IJB721
             new JBRulesetConfig[](launchProjectConfig.rulesetConfigurations.length);
 
         // Set the data hook to be active for pay transactions for each ruleset configuration.
-        for (uint256 i; i < launchProjectConfig.rulesetConfigurations.length; i++) {
+        for (uint256 i; i < launchProjectConfig.rulesetConfigurations.length;) {
             // Set the pay data ruleset config being iterated on.
             JBPayDataHookRulesetConfig memory payDataRulesetConfig = launchProjectConfig.rulesetConfigurations[i];
 
@@ -274,6 +274,10 @@ contract JB721TiersHookProjectDeployer is ERC2771Context, JBPermissioned, IJB721
                 splitGroups: payDataRulesetConfig.splitGroups,
                 fundAccessLimitGroups: payDataRulesetConfig.fundAccessLimitGroups
             });
+
+            unchecked {
+                ++i;
+            }
         }
 
         // Launch the project.
@@ -307,7 +311,7 @@ contract JB721TiersHookProjectDeployer is ERC2771Context, JBPermissioned, IJB721
             new JBRulesetConfig[](launchRulesetsConfig.rulesetConfigurations.length);
 
         // Set the data hook to be active for pay transactions for each ruleset configuration.
-        for (uint256 i; i < launchRulesetsConfig.rulesetConfigurations.length; i++) {
+        for (uint256 i; i < launchRulesetsConfig.rulesetConfigurations.length;) {
             // Set the pay data ruleset config being iterated on.
             JBPayDataHookRulesetConfig memory payDataRulesetConfig = launchRulesetsConfig.rulesetConfigurations[i];
 
@@ -342,6 +346,10 @@ contract JB721TiersHookProjectDeployer is ERC2771Context, JBPermissioned, IJB721
                 splitGroups: payDataRulesetConfig.splitGroups,
                 fundAccessLimitGroups: payDataRulesetConfig.fundAccessLimitGroups
             });
+
+            unchecked {
+                ++i;
+            }
         }
 
         // Launch the rulesets.
@@ -373,7 +381,7 @@ contract JB721TiersHookProjectDeployer is ERC2771Context, JBPermissioned, IJB721
             new JBRulesetConfig[](queueRulesetsConfig.rulesetConfigurations.length);
 
         // Set the data hook to be active for pay transactions for each ruleset configuration.
-        for (uint256 i; i < queueRulesetsConfig.rulesetConfigurations.length; i++) {
+        for (uint256 i; i < queueRulesetsConfig.rulesetConfigurations.length;) {
             // Set the pay data ruleset config being iterated on.
             JBPayDataHookRulesetConfig memory payDataRulesetConfig = queueRulesetsConfig.rulesetConfigurations[i];
 
@@ -408,6 +416,10 @@ contract JB721TiersHookProjectDeployer is ERC2771Context, JBPermissioned, IJB721
                 splitGroups: payDataRulesetConfig.splitGroups,
                 fundAccessLimitGroups: payDataRulesetConfig.fundAccessLimitGroups
             });
+
+            unchecked {
+                ++i;
+            }
         }
 
         // Queue the rulesets.

package/src/JB721TiersHookStore.sol

@@ -214,6 +214,47 @@ contract JB721TiersHookStore is IJB721TiersHookStore {
         });
     }
 
+    /// @notice Get only the pricing fields for a tier, avoiding full struct construction.
+    /// @param hook The 721 contract that the tier belongs to.
+    /// @param id The tier ID.
+    /// @return price The tier price.
+    /// @return splitPercent The split percent.
+    /// @return discountPercent The discount percent.
+    function tierPricingOf(
+        address hook,
+        uint256 id
+    )
+        external
+        view
+        override
+        returns (uint104 price, uint32 splitPercent, uint8 discountPercent)
+    {
+        JBStored721Tier memory storedTier = _storedTierOf[hook][id];
+        price = storedTier.price;
+        splitPercent = storedTier.splitPercent;
+        discountPercent = storedTier.discountPercent;
+    }
+
+    /// @notice Get only the tier ID and transfersPausable flag for a token, avoiding full struct construction.
+    /// @param hook The 721 hook address.
+    /// @param tokenId The token ID.
+    /// @return tierId The tier ID.
+    /// @return transfersPausable Whether transfers are paused for this tier.
+    function tierTransferInfoOfTokenId(
+        address hook,
+        uint256 tokenId
+    )
+        external
+        view
+        override
+        returns (uint256 tierId, bool transfersPausable)
+    {
+        tierId = tierIdOfToken(tokenId);
+        JBStored721Tier memory storedTier = _storedTierOf[hook][tierId];
+        // Bit 1 (0-indexed) of packedBools is transfersPausable.
+        transfersPausable = (storedTier.packedBools & 0x2) != 0;
+    }
+
     /// @notice Gets an array of currently active 721 tiers for the provided 721 contract.
     /// @param hook The 721 contract to get the tiers of.
     /// @param categories An array tier categories to get tiers from. Send an empty array to get all categories.
@@ -345,12 +386,19 @@ contract JB721TiersHookStore is IJB721TiersHookStore {
         // Keep a reference to the greatest tier ID.
         uint256 maxTierId = maxTierIdOf[hook];
 
-        for (uint256 i = maxTierId; i != 0; i--) {
+        for (uint256 i = maxTierId; i != 0;) {
             // Set the tier being iterated on.
             JBStored721Tier memory storedTier = _storedTierOf[hook][i];
 
-            // Increment the total supply by the number of tokens already minted.
-            supply += storedTier.initialSupply - (storedTier.remainingSupply + numberOfBurnedFor[hook][i]);
+            // Skip unminted tiers — they contribute zero supply.
+            if (storedTier.initialSupply != storedTier.remainingSupply) {
+                // Increment the total supply by the number of tokens already minted.
+                supply += storedTier.initialSupply - (storedTier.remainingSupply + numberOfBurnedFor[hook][i]);
+            }
+
+            unchecked {
+                --i;
+            }
         }
     }
 
@@ -366,12 +414,17 @@ contract JB721TiersHookStore is IJB721TiersHookStore {
         uint256 maxTierId = maxTierIdOf[hook];
 
         // Loop through all tiers.
-        for (uint256 i = maxTierId; i != 0; i--) {
+        for (uint256 i = maxTierId; i != 0;) {
             // Get a reference to the account's balance in this tier.
             uint256 balance = tierBalanceOf[hook][account][i];
 
             // If the account has no balance, return.
-            if (balance == 0) continue;
+            if (balance == 0) {
+                unchecked {
+                    --i;
+                }
+                continue;
+            }
 
             // Get the tier.
             JBStored721Tier memory storedTier = _storedTierOf[hook][i];
@@ -382,6 +435,10 @@ contract JB721TiersHookStore is IJB721TiersHookStore {
             // Add the voting units for the address' balance in this tier.
             // Use custom voting units if set. Otherwise, use the tier's price.
             units += balance * (useVotingUnits ? _tierVotingUnitsOf[hook][i] : storedTier.price);
+
+            unchecked {
+                --i;
+            }
         }
     }
 
@@ -399,9 +456,13 @@ contract JB721TiersHookStore is IJB721TiersHookStore {
         uint256 maxTierId = maxTierIdOf[hook];
 
         // Loop through all tiers.
-        for (uint256 i = maxTierId; i != 0; i--) {
+        for (uint256 i = maxTierId; i != 0;) {
             // Get a reference to the account's balance within this tier.
             balance += tierBalanceOf[hook][owner][i];
+
+            unchecked {
+                --i;
+            }
         }
     }
 
@@ -418,8 +479,12 @@ contract JB721TiersHookStore is IJB721TiersHookStore {
         // that affect the purchase price, but the NFT's weight in the cash out curve is always based on its
         // tier's original price. This prevents discount changes from altering the cash out value of already-minted
         // NFTs.
-        for (uint256 i; i < tokenIds.length; i++) {
+        for (uint256 i; i < tokenIds.length;) {
             weight += _storedTierOf[hook][tierIdOfToken(tokenIds[i])].price;
+
+            unchecked {
+                ++i;
+            }
         }
     }
 
@@ -474,18 +539,32 @@ contract JB721TiersHookStore is IJB721TiersHookStore {
 
         // Add each 721's original price (from its tier) to the weight.
         // Uses the full tier price, not the discounted price — by design. See `cashOutWeightOf` for rationale.
-        for (uint256 i = 1; i <= maxTierId; i++) {
+        for (uint256 i = 1; i <= maxTierId;) {
             // Keep a reference to the stored tier.
             JBStored721Tier memory storedTier = _storedTierOf[hook][i];
 
+            // Skip empty tiers (zero mints and zero burns) — they contribute zero weight.
+            if (storedTier.initialSupply == storedTier.remainingSupply && numberOfBurnedFor[hook][i] == 0) {
+                unchecked {
+                    ++i;
+                }
+                continue;
+            }
+
             // Add the tier's price multiplied by the number of minted NFTs plus pending reserves.
             // Pending reserves are included by design — they represent committed obligations that will be
             // minted to the reserve beneficiary. Including them in the denominator ensures cash-out values
             // account for the full diluted supply, preventing early cashers from extracting more than their
             // fair share before reserves are minted.
+            // Note: removed tiers are NOT skipped here because minted NFTs from removed tiers still carry
+            // cash-out weight, and their pending reserves can still be minted.
             weight += storedTier.price
             * ((storedTier.initialSupply - (storedTier.remainingSupply + numberOfBurnedFor[hook][i]))
                 + _numberOfPendingReservesFor({hook: hook, tierId: i, storedTier: storedTier}));
+
+            unchecked {
+                ++i;
+            }
         }
     }
 
@@ -831,7 +910,7 @@ contract JB721TiersHookStore is IJB721TiersHookStore {
         // Keep a reference to the 721 contract's flags.
         JB721TiersHookFlags memory flags = _flagsOf[msg.sender];
 
-        for (uint256 i; i < tiersToAdd.length; i++) {
+        for (uint256 i; i < tiersToAdd.length;) {
             // Set the tier being iterated upon.
             JB721TierConfig memory tierToAdd = tiersToAdd[i];
 
@@ -841,17 +920,14 @@ contract JB721TiersHookStore is IJB721TiersHookStore {
                 revert JB721TiersHookStore_InvalidQuantity(tierToAdd.initialSupply, _ONE_BILLION - 1);
             }
 
-            // Keep a reference to the previous tier.
-            JB721TierConfig memory previousTier;
-
             // Make sure the tier's category is greater than or equal to the previously added tier's category.
+            // Access calldata directly for the previous tier's category — it's only used once per iteration.
             if (i != 0) {
-                // Set the reference to the previously added tier.
-                previousTier = tiersToAdd[i - 1];
+                uint256 previousCategory = tiersToAdd[i - 1].category;
 
                 // Revert if the category is not equal or greater than the previously added tier's category.
-                if (tierToAdd.category < previousTier.category) {
-                    revert JB721TiersHookStore_InvalidCategorySortOrder(tierToAdd.category, previousTier.category);
+                if (tierToAdd.category < previousCategory) {
+                    revert JB721TiersHookStore_InvalidCategorySortOrder(tierToAdd.category, previousCategory);
                 }
             }
 
@@ -928,7 +1004,9 @@ contract JB721TiersHookStore is IJB721TiersHookStore {
             // If this is the first tier in a new category, store it as the first tier in that category.
             // The `_startingTierIdOfCategory` of the category "0" will always be the same as the `_tierIdAfter` the 0th
             // tier.
-            if (previousTier.category != tierToAdd.category && tierToAdd.category != 0) {
+            // Access the previous tier's category directly from calldata (0 when i == 0, matching the old
+            // uninitialized-memory behavior).
+            if ((i == 0 ? 0 : tiersToAdd[i - 1].category) != tierToAdd.category && tierToAdd.category != 0) {
                 _startingTierIdOfCategory[msg.sender][tierToAdd.category] = tierId;
             }
 
@@ -1028,6 +1106,10 @@ contract JB721TiersHookStore is IJB721TiersHookStore {
 
             // Add the tier ID to the array being returned.
             tierIds[i] = tierId;
+
+            unchecked {
+                ++i;
+            }
         }
 
         // Update the maximum tier ID to include the new tiers.
@@ -1041,7 +1123,7 @@ contract JB721TiersHookStore is IJB721TiersHookStore {
     /// @param tokenIds The token IDs of the NFTs to burn.
     function recordBurn(uint256[] calldata tokenIds) external override {
         // Iterate through all token IDs to increment the burn count.
-        for (uint256 i; i < tokenIds.length; i++) {
+        for (uint256 i; i < tokenIds.length;) {
             // Set the 721's token ID.
             uint256 tokenId = tokenIds[i];
 
@@ -1049,6 +1131,10 @@ contract JB721TiersHookStore is IJB721TiersHookStore {
 
             // Increment the number of NFTs burned from the tier.
             numberOfBurnedFor[msg.sender][tierId]++;
+
+            unchecked {
+                ++i;
+            }
         }
     }
 
@@ -1090,7 +1176,7 @@ contract JB721TiersHookStore is IJB721TiersHookStore {
         // Initialize a `JBBitmapWord` for checking whether tiers have been removed.
         JBBitmapWord memory bitmapWord;
 
-        for (uint256 i; i < numberOfTiers; i++) {
+        for (uint256 i; i < numberOfTiers;) {
             // Set the tier ID being iterated on.
             uint256 tierId = tierIds[i];
 
@@ -1150,6 +1236,10 @@ contract JB721TiersHookStore is IJB721TiersHookStore {
             ) {
                 revert JB721TiersHookStore_InsufficientSupplyRemaining(tierId);
             }
+
+            unchecked {
+                ++i;
+            }
         }
     }
 
@@ -1181,11 +1271,15 @@ contract JB721TiersHookStore is IJB721TiersHookStore {
         // Initialize an array for the token IDs to be returned.
         tokenIds = new uint256[](count);
 
-        for (uint256 i; i < count; i++) {
+        for (uint256 i; i < count;) {
             // Generate the NFTs.
             tokenIds[i] = _generateTokenId({
                 tierId: tierId, tokenNumber: storedTier.initialSupply - --storedTier.remainingSupply
             });
+
+            unchecked {
+                ++i;
+            }
         }
     }
 
@@ -1194,7 +1288,7 @@ contract JB721TiersHookStore is IJB721TiersHookStore {
     /// Call `cleanTiers()` after removing tiers to update the sorting sequence and prevent stale tier iteration.
     /// @param tierIds The IDs of the tiers being removed.
     function recordRemoveTierIds(uint256[] calldata tierIds) external override {
-        for (uint256 i; i < tierIds.length; i++) {
+        for (uint256 i; i < tierIds.length;) {
             // Set the tier being iterated upon (0-indexed).
             uint256 tierId = tierIds[i];
 
@@ -1209,6 +1303,10 @@ contract JB721TiersHookStore is IJB721TiersHookStore {
 
             // Remove the tier by marking it as removed in the bitmap.
             _removedTiersBitmapWordOf[msg.sender].removeTier(tierId);
+
+            unchecked {
+                ++i;
+            }
         }
     }
 

package/src/abstract/JB721Hook.sol

@@ -209,7 +209,7 @@ abstract contract JB721Hook is ERC721, IJB721Hook {
         if (metadataExists) decodedTokenIds = abi.decode(metadata, (uint256[]));
 
         // Iterate through the NFTs, burning them if the owner is correct.
-        for (uint256 i; i < decodedTokenIds.length; i++) {
+        for (uint256 i; i < decodedTokenIds.length;) {
             // Set the current NFT's token ID.
             uint256 tokenId = decodedTokenIds[i];
 
@@ -218,6 +218,10 @@ abstract contract JB721Hook is ERC721, IJB721Hook {
 
             // Burn the token.
             _burn(tokenId);
+
+            unchecked {
+                ++i;
+            }
         }
 
         // Call the hook.

package/src/interfaces/IJB721TiersHookStore.sol

@@ -124,6 +124,33 @@ interface IJB721TiersHookStore {
         view
         returns (JB721Tier memory tier);
 
+    /// @notice Get only the pricing fields for a tier, avoiding full struct construction.
+    /// @param hook The 721 contract that the tier belongs to.
+    /// @param id The tier ID.
+    /// @return price The tier price.
+    /// @return splitPercent The split percent.
+    /// @return discountPercent The discount percent.
+    function tierPricingOf(
+        address hook,
+        uint256 id
+    )
+        external
+        view
+        returns (uint104 price, uint32 splitPercent, uint8 discountPercent);
+
+    /// @notice Get only the tier ID and transfersPausable flag for a token, avoiding full struct construction.
+    /// @param hook The 721 hook address.
+    /// @param tokenId The token ID.
+    /// @return tierId The tier ID.
+    /// @return transfersPausable Whether transfers are paused for this tier.
+    function tierTransferInfoOfTokenId(
+        address hook,
+        uint256 tokenId
+    )
+        external
+        view
+        returns (uint256 tierId, bool transfersPausable);
+
     /// @notice Get an array of currently active 721 tiers for the provided 721 contract.
     /// @param hook The 721 contract to get the tiers of.
     /// @param categories An array of tier categories to get tiers from. Empty for all categories.

package/src/libraries/JB721TiersHookLib.sol

@@ -18,7 +18,6 @@ import {JBSplitGroup} from "@bananapus/core-v6/src/structs/JBSplitGroup.sol";
 
 import {IJB721TiersHookStore} from "../interfaces/IJB721TiersHookStore.sol";
 import {IJB721TokenUriResolver} from "../interfaces/IJB721TokenUriResolver.sol";
-import {JB721Tier} from "../structs/JB721Tier.sol";
 import {JB721TierConfig} from "../structs/JB721TierConfig.sol";
 import {JB721Constants} from "./JB721Constants.sol";
 import {JBIpfsDecoder} from "./JBIpfsDecoder.sol";
@@ -27,8 +26,8 @@ import {JBIpfsDecoder} from "./JBIpfsDecoder.sol";
 /// @dev Handles tier adjustments, split calculations, price normalization, and split fund distribution.
 library JB721TiersHookLib {
     error JB721TiersHookLib_NoTerminalForLeftover(uint256 projectId, address token, uint256 leftoverAmount);
-    // Events mirrored from IJB721TiersHook (emitted via DELEGATECALL from the hook's context).
-    event AddToBalanceReverted(uint256 indexed projectId, address token, uint256 amount, bytes reason);
+    error JB721TiersHookLib_SplitFallbackFailed(uint256 projectId, address token, uint256 amount, bytes reason);
+    error JB721TiersHookLib_TokenTransferAmountMismatch(uint256 expectedAmount, uint256 receivedAmount);
     event AddTier(uint256 indexed tierId, JB721TierConfig tier, address caller);
     event RemoveTier(uint256 indexed tierId, address caller);
     event SplitPayoutReverted(uint256 indexed projectId, JBSplit split, uint256 amount, bytes reason, address caller);
@@ -55,8 +54,12 @@ library JB721TiersHookLib {
     {
         // Remove tiers.
         if (tierIdsToRemove.length != 0) {
-            for (uint256 i; i < tierIdsToRemove.length; i++) {
+            for (uint256 i; i < tierIdsToRemove.length;) {
                 emit RemoveTier({tierId: tierIdsToRemove[i], caller: caller});
+
+                unchecked {
+                    ++i;
+                }
             }
             // slither-disable-next-line reentrancy-events
             store.recordRemoveTierIds(tierIdsToRemove);
@@ -67,8 +70,12 @@ library JB721TiersHookLib {
             uint256[] memory tierIdsAdded = store.recordAddTiers(tiersToAdd);
 
             // slither-disable-next-line reentrancy-events
-            for (uint256 i; i < tiersToAdd.length; i++) {
+            for (uint256 i; i < tiersToAdd.length;) {
                 emit AddTier({tierId: tierIdsAdded[i], tier: tiersToAdd[i], caller: caller});
+
+                unchecked {
+                    ++i;
+                }
             }
 
             // Set split groups for tiers that have splits configured.
@@ -102,9 +109,13 @@ library JB721TiersHookLib {
     {
         uint256[] memory tierIdsAdded = store.recordAddTiers(tiersToAdd);
 
-        // slither-disable-next-line reentrancy-events
-        for (uint256 i; i < tiersToAdd.length; i++) {
+        for (uint256 i; i < tiersToAdd.length;) {
+            // slither-disable-next-line reentrancy-events
             emit AddTier({tierId: tierIdsAdded[i], tier: tiersToAdd[i], caller: caller});
+
+            unchecked {
+                ++i;
+            }
         }
 
         // Set split groups for tiers that have splits configured.
@@ -140,12 +151,18 @@ library JB721TiersHookLib {
     {
         // forge-lint: disable-next-line(unsafe-typecast)
         uint256 pricingCurrency = uint256(uint32(packedPricingContext));
-        if (amountCurrency == pricingCurrency) return (amountValue, true);
+        // forge-lint: disable-next-line(unsafe-typecast)
+        uint256 pricingDecimals = uint256(uint8(packedPricingContext >> 32));
+        if (amountCurrency == pricingCurrency) {
+            if (amountDecimals == pricingDecimals) return (amountValue, true);
+            if (amountDecimals > pricingDecimals) {
+                return (amountValue / (10 ** (amountDecimals - pricingDecimals)), true);
+            }
+            return (amountValue * (10 ** (pricingDecimals - amountDecimals)), true);
+        }
 
         if (address(prices) == address(0)) return (0, false);
 
-        // forge-lint: disable-next-line(unsafe-typecast)
-        uint256 pricingDecimals = uint256(uint8(packedPricingContext >> 32));
         value = mulDiv({
             x: amountValue,
             y: 10 ** pricingDecimals,
@@ -176,22 +193,27 @@ library JB721TiersHookLib {
         view
         returns (uint256 totalSplitAmount, bytes memory hookMetadata)
     {
-        (bool found, bytes memory data) = JBMetadataResolver.getDataFor({
-            id: JBMetadataResolver.getId({purpose: "pay", target: metadataIdTarget}), metadata: metadata
-        });
-        if (!found) return (0, bytes(""));
-
-        (, uint16[] memory tierIdsToMint) = abi.decode(data, (bool, uint16[]));
+        // Decode tier IDs from metadata within a scope to free stack slots for the loop below.
+        uint16[] memory tierIdsToMint;
+        {
+            (bool found, bytes memory data) = JBMetadataResolver.getDataFor({
+                id: JBMetadataResolver.getId({purpose: "pay", target: metadataIdTarget}), metadata: metadata
+            });
+            if (!found) return (0, bytes(""));
+            (, tierIdsToMint) = abi.decode(data, (bool, uint16[]));
+        }
         if (tierIdsToMint.length == 0) return (0, bytes(""));
 
         uint16[] memory splitTierIds = new uint16[](tierIdsToMint.length);
         uint256[] memory splitAmounts = new uint256[](tierIdsToMint.length);
         uint256 splitTierCount;
 
-        for (uint256 i; i < tierIdsToMint.length; i++) {
+        for (uint256 i; i < tierIdsToMint.length;) {
+            // Get only the pricing fields (lightweight — avoids full struct construction).
             // slither-disable-next-line calls-loop
-            JB721Tier memory tier = store.tierOf({hook: hook, id: tierIdsToMint[i], includeResolvedUri: false});
-            if (tier.splitPercent != 0) {
+            (uint104 tierPrice, uint32 tierSplitPercent, uint8 tierDiscountPercent) =
+                store.tierPricingOf({hook: hook, id: tierIdsToMint[i]});
+            if (tierSplitPercent != 0) {
                 // Apply discount to tier price to match the discounted price that recordMint charges.
                 // Note on discount semantics: `discountPercent` uses a denominator of 200 (JB721Constants
                 // .DISCOUNT_DENOMINATOR), so a value of 200 represents a 100% discount (free mint). Even with a
@@ -199,18 +221,22 @@ library JB721TiersHookLib {
                 // in `cashOutWeightOf`. This means free/discounted mints still carry their full cashout weight
                 // value. Project owners should be aware that discounted mints dilute the cashout pool at full
                 // weight while contributing less (or no) payment to the treasury.
-                uint256 effectivePrice = tier.price;
-                if (tier.discountPercent > 0) {
+                uint256 effectivePrice = tierPrice;
+                if (tierDiscountPercent > 0) {
                     effectivePrice -= mulDiv({
-                        x: effectivePrice, y: tier.discountPercent, denominator: JB721Constants.DISCOUNT_DENOMINATOR
+                        x: effectivePrice, y: tierDiscountPercent, denominator: JB721Constants.DISCOUNT_DENOMINATOR
                     });
                 }
                 splitTierIds[splitTierCount] = tierIdsToMint[i];
                 splitAmounts[splitTierCount] =
-                    mulDiv({x: effectivePrice, y: tier.splitPercent, denominator: JBConstants.SPLITS_TOTAL_PERCENT});
+                    mulDiv({x: effectivePrice, y: tierSplitPercent, denominator: JBConstants.SPLITS_TOTAL_PERCENT});
                 totalSplitAmount += splitAmounts[splitTierCount];
                 splitTierCount++;
             }
+
+            unchecked {
+                ++i;
+            }
         }
 
         if (splitTierCount != 0) {
@@ -312,10 +338,14 @@ library JB721TiersHookLib {
 
                 // Re-accumulate the total from converted amounts to avoid rounding drift.
                 convertedTotal = 0;
-                for (uint256 i; i < amounts.length; i++) {
+                for (uint256 i; i < amounts.length;) {
                     // Convert this tier's amount: amount * ratio / 10^pricingDecimals.
                     amounts[i] = mulDiv({x: amounts[i], y: ratio, denominator: denom});
                     convertedTotal += amounts[i];
+
+                    unchecked {
+                        ++i;
+                    }
                 }
 
                 // Re-encode with the converted amounts.
@@ -331,15 +361,22 @@ library JB721TiersHookLib {
             if (convertedMetadata.length != 0) {
                 (uint16[] memory tierIds, uint256[] memory amounts) =
                     abi.decode(convertedMetadata, (uint16[], uint256[]));
-                for (uint256 i; i < amounts.length; i++) {
+                uint256 uncappedTotal = convertedTotal;
+                convertedTotal = 0;
+                for (uint256 i; i < amounts.length;) {
                     // Scale down: amount * amountValue / originalTotal.
-                    amounts[i] = mulDiv({x: amounts[i], y: amountValue, denominator: convertedTotal});
+                    amounts[i] = mulDiv({x: amounts[i], y: amountValue, denominator: uncappedTotal});
+                    convertedTotal += amounts[i];
+
+                    unchecked {
+                        ++i;
+                    }
                 }
                 convertedMetadata = abi.encode(tierIds, amounts);
+            } else {
+                // Clamp the total to the payment value.
+                convertedTotal = amountValue;
             }
-
-            // Clamp the total to the payment value.
-            convertedTotal = amountValue;
         }
     }
 
@@ -354,20 +391,28 @@ library JB721TiersHookLib {
         private
     {
         uint256 splitGroupCount;
-        for (uint256 i; i < tiersToAdd.length; i++) {
+        for (uint256 i; i < tiersToAdd.length;) {
             if (tiersToAdd[i].splits.length != 0) splitGroupCount++;
+
+            unchecked {
+                ++i;
+            }
         }
         if (splitGroupCount == 0) return;
 
         JBSplitGroup[] memory splitGroups = new JBSplitGroup[](splitGroupCount);
         uint256 groupIndex;
-        for (uint256 i; i < tiersToAdd.length; i++) {
+        for (uint256 i; i < tiersToAdd.length;) {
             if (tiersToAdd[i].splits.length != 0) {
                 splitGroups[groupIndex] = JBSplitGroup({
                     groupId: uint256(uint160(hookAddress)) | (tierIdsAdded[i] << 160), splits: tiersToAdd[i].splits
                 });
                 groupIndex++;
             }
+
+            unchecked {
+                ++i;
+            }
         }
         splits.setSplitGroupsOf({projectId: projectId, rulesetId: 0, splitGroups: splitGroups});
     }
@@ -395,13 +440,23 @@ library JB721TiersHookLib {
     {
         // For ERC20 tokens, pull from terminal using the allowance it granted via _beforeTransferTo.
         if (token != JBConstants.NATIVE_TOKEN) {
+            uint256 balanceBefore = IERC20(token).balanceOf(address(this));
             SafeERC20.safeTransferFrom({token: IERC20(token), from: msg.sender, to: address(this), value: amount});
+            uint256 receivedAmount = IERC20(token).balanceOf(address(this)) - balanceBefore;
+            if (receivedAmount != amount) {
+                revert JB721TiersHookLib_TokenTransferAmountMismatch(amount, receivedAmount);
+            }
         }
 
         (uint16[] memory tierIds, uint256[] memory amounts) = abi.decode(encodedSplitData, (uint16[], uint256[]));
 
-        for (uint256 i; i < tierIds.length; i++) {
-            if (amounts[i] == 0) continue;
+        for (uint256 i; i < tierIds.length;) {
+            if (amounts[i] == 0) {
+                unchecked {
+                    ++i;
+                }
+                continue;
+            }
             uint256 groupId = uint256(uint160(hookAddress)) | (uint256(tierIds[i]) << 160);
             _distributeSingleSplit({
                 directory: directory,
@@ -412,6 +467,10 @@ library JB721TiersHookLib {
                 amount: amounts[i],
                 decimals: decimals
             });
+
+            unchecked {
+                ++i;
+            }
         }
     }
 
@@ -441,7 +500,7 @@ library JB721TiersHookLib {
         uint256 leftoverAmount = amount;
         amount = 0;
 
-        for (uint256 j; j < tierSplits.length; j++) {
+        for (uint256 j; j < tierSplits.length;) {
             uint256 payoutAmount =
                 mulDiv({x: leftoverAmount, y: tierSplits[j].percent, denominator: leftoverPercentage});
             if (payoutAmount != 0) {
@@ -451,6 +510,7 @@ library JB721TiersHookLib {
                 // On failure, don't re-add to leftoverAmount — this prevents inflating later recipients.
                 // Failed amounts accumulate as the gap between `amount` and `leftoverAmount + total sent`.
                 // After the loop, we re-add leftoverPercentage-based residual naturally.
+                // slither-disable-next-line calls-loop,reentrancy-no-eth,reentrancy-benign,reentrancy-events
                 if (!_sendPayoutToSplit({
                         directory: directory,
                         split: tierSplits[j],
@@ -469,6 +529,7 @@ library JB721TiersHookLib {
             }
             unchecked {
                 leftoverPercentage -= tierSplits[j].percent;
+                ++j;
             }
         }
 
@@ -493,7 +554,7 @@ library JB721TiersHookLib {
                     metadata: bytes("")
                 }) {}
                 catch (bytes memory reason) {
-                    emit AddToBalanceReverted(projectId, token, leftoverAmount, reason);
+                    revert JB721TiersHookLib_SplitFallbackFailed(projectId, token, leftoverAmount, reason);
                 }
             } else {
                 SafeERC20.forceApprove({token: IERC20(token), spender: address(terminal), value: leftoverAmount});
@@ -509,7 +570,7 @@ library JB721TiersHookLib {
                 catch (bytes memory reason) {
                     // Reset approval on failure.
                     SafeERC20.forceApprove({token: IERC20(token), spender: address(terminal), value: 0});
-                    emit AddToBalanceReverted(projectId, token, leftoverAmount, reason);
+                    revert JB721TiersHookLib_SplitFallbackFailed(projectId, token, leftoverAmount, reason);
                 }
             }
         }
@@ -541,9 +602,11 @@ library JB721TiersHookLib {
             if (isNativeToken) {
                 // Wrap in try-catch so a reverting hook doesn't brick all project payments.
                 // On revert, ETH stays with the caller and we return false.
+                // slither-disable-next-line calls-loop,reentrancy-no-eth,reentrancy-events
                 try split.hook.processSplitWith{value: amount}(context) {
                     return true;
                 } catch (bytes memory reason) {
+                    // slither-disable-next-line reentrancy-events
                     emit SplitPayoutReverted({
                         projectId: projectId, split: split, amount: amount, reason: reason, caller: msg.sender
                     });
@@ -556,8 +619,10 @@ library JB721TiersHookLib {
                 // cause the caller to skip subtracting this amount from leftoverAmount, leading
                 // to a double-spend when the leftover is later sent to the project's balance.
                 SafeERC20.safeTransfer({token: IERC20(token), to: address(split.hook), value: amount});
+                // slither-disable-next-line calls-loop,reentrancy-no-eth,reentrancy-events
                 try split.hook.processSplitWith(context) {}
                 catch (bytes memory reason) {
+                    // slither-disable-next-line reentrancy-events
                     emit SplitPayoutReverted({
                         projectId: projectId, split: split, amount: amount, reason: reason, caller: msg.sender
                     });
@@ -572,7 +637,7 @@ library JB721TiersHookLib {
             // Wrap terminal calls in try-catch to prevent a failing terminal from bricking payments.
             if (split.preferAddToBalance) {
                 if (isNativeToken) {
-                    // slither-disable-next-line arbitrary-send-eth,calls-loop
+                    // slither-disable-next-line arbitrary-send-eth,calls-loop,reentrancy-no-eth,reentrancy-events
                     try terminal.addToBalanceOf{value: amount}({
                         projectId: split.projectId,
                         token: token,
@@ -583,6 +648,7 @@ library JB721TiersHookLib {
                     }) {
                         return true;
                     } catch (bytes memory reason) {
+                        // slither-disable-next-line reentrancy-events
                         emit SplitPayoutReverted({
                             projectId: projectId, split: split, amount: amount, reason: reason, caller: msg.sender
                         });
@@ -590,7 +656,7 @@ library JB721TiersHookLib {
                     }
                 } else {
                     SafeERC20.forceApprove({token: IERC20(token), spender: address(terminal), value: amount});
-                    // slither-disable-next-line calls-loop
+                    // slither-disable-next-line calls-loop,reentrancy-no-eth,reentrancy-events
                     try terminal.addToBalanceOf({
                         projectId: split.projectId,
                         token: token,
@@ -603,6 +669,7 @@ library JB721TiersHookLib {
                     } catch (bytes memory reason) {
                         // Reset approval on failure so tokens aren't left approved to the terminal.
                         SafeERC20.forceApprove({token: IERC20(token), spender: address(terminal), value: 0});
+                        // slither-disable-next-line reentrancy-events
                         emit SplitPayoutReverted({
                             projectId: projectId, split: split, amount: amount, reason: reason, caller: msg.sender
                         });
@@ -611,7 +678,7 @@ library JB721TiersHookLib {
                 }
             } else {
                 if (isNativeToken) {
-                    // slither-disable-next-line arbitrary-send-eth,unused-return,calls-loop
+                    // slither-disable-next-line arbitrary-send-eth,unused-return,calls-loop,reentrancy-events
                     try terminal.pay{value: amount}({
                         projectId: split.projectId,
                         token: token,
@@ -623,6 +690,7 @@ library JB721TiersHookLib {
                     }) {
                         return true;
                     } catch (bytes memory reason) {
+                        // slither-disable-next-line reentrancy-events
                         emit SplitPayoutReverted({
                             projectId: projectId, split: split, amount: amount, reason: reason, caller: msg.sender
                         });
@@ -630,7 +698,7 @@ library JB721TiersHookLib {
                     }
                 } else {
                     SafeERC20.forceApprove({token: IERC20(token), spender: address(terminal), value: amount});
-                    // slither-disable-next-line unused-return,calls-loop
+                    // slither-disable-next-line unused-return,calls-loop,reentrancy-no-eth,reentrancy-events
                     try terminal.pay({
                         projectId: split.projectId,
                         token: token,
@@ -644,6 +712,7 @@ library JB721TiersHookLib {
                     } catch (bytes memory reason) {
                         // Reset approval on failure so tokens aren't left approved to the terminal.
                         SafeERC20.forceApprove({token: IERC20(token), spender: address(terminal), value: 0});
+                        // slither-disable-next-line reentrancy-events
                         emit SplitPayoutReverted({
                             projectId: projectId, split: split, amount: amount, reason: reason, caller: msg.sender
                         });
@@ -661,6 +730,7 @@ library JB721TiersHookLib {
                 // false on failure instead of reverting. This handles non-standard tokens (e.g. USDT)
                 // that return void, while routing failed transfers to the project's balance instead
                 // of bricking all payments.
+                // slither-disable-next-line calls-loop
                 (bool callSuccess, bytes memory returndata) =
                     address(token).call(abi.encodeCall(IERC20.transfer, (split.beneficiary, amount)));
                 if (!callSuccess || (returndata.length != 0 && !abi.decode(returndata, (bool)))) return false;

package/src/libraries/JBIpfsDecoder.sol

@@ -41,7 +41,7 @@ library JBIpfsDecoder {
         uint8 digitlength = 1;
         uint256 sourceLength = source.length;
 
-        for (uint256 i; i < sourceLength; i++) {
+        for (uint256 i; i < sourceLength;) {
             // forge-lint: disable-next-line(unsafe-typecast)
             uint256 carry = uint8(source[i]);
 
@@ -64,14 +64,22 @@ library JBIpfsDecoder {
                 }
                 carry = carry / 58;
             }
+
+            unchecked {
+                ++i;
+            }
         }
         return string(_toAlphabet(_reverse(_truncate({array: digits, length: digitlength}))));
     }
 
     function _truncate(uint8[] memory array, uint8 length) private pure returns (uint8[] memory) {
         uint8[] memory output = new uint8[](length);
-        for (uint256 i; i < length; i++) {
+        for (uint256 i; i < length;) {
             output[i] = array[i];
+
+            unchecked {
+                ++i;
+            }
         }
         return output;
     }
@@ -79,9 +87,10 @@ library JBIpfsDecoder {
     function _reverse(uint8[] memory input) private pure returns (uint8[] memory) {
         uint256 inputLength = input.length;
         uint8[] memory output = new uint8[](inputLength);
-        for (uint256 i; i < inputLength; i++) {
+        for (uint256 i; i < inputLength;) {
             unchecked {
                 output[i] = input[input.length - 1 - i];
+                ++i;
             }
         }
         return output;
@@ -90,8 +99,12 @@ library JBIpfsDecoder {
     function _toAlphabet(uint8[] memory indices) private pure returns (bytes memory) {
         uint256 indicesLength = indices.length;
         bytes memory output = new bytes(indicesLength);
-        for (uint256 i; i < indicesLength; i++) {
+        for (uint256 i; i < indicesLength;) {
             output[i] = ALPHABET[indices[i]];
+
+            unchecked {
+                ++i;
+            }
         }
         return output;
     }

package/test/regression/BrokenTerminalDoesNotDos.t.sol

@@ -11,10 +11,9 @@ import {IJBSplitHook} from "@bananapus/core-v6/src/interfaces/IJBSplitHook.sol";
 import {IJBSplits} from "@bananapus/core-v6/src/interfaces/IJBSplits.sol";
 import {IJBTerminal} from "@bananapus/core-v6/src/interfaces/IJBTerminal.sol";
 import {IJBDirectory} from "@bananapus/core-v6/src/interfaces/IJBDirectory.sol";
-import {IJB721TiersHook} from "../../src/interfaces/IJB721TiersHook.sol";
 import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
 
-/// @notice Regression tests: a broken project terminal in _addToBalance should not DOS payments.
+/// @notice Regression tests: a broken project terminal in _addToBalance now reverts the payment (M-4 fix).
 contract Test_BrokenTerminalDoesNotDos is UnitTestSetup {
     using stdStorage for StdStorage;
 
@@ -76,15 +75,13 @@ contract Test_BrokenTerminalDoesNotDos is UnitTestSetup {
     }
 
     // ──────────────────────────────────────────────────────────────────────
-    // ETH: broken own-project terminal in _addToBalance should not revert
+    // ETH: broken own-project terminal in _addToBalance should revert (M-4)
     // ──────────────────────────────────────────────────────────────────────
 
     /// @notice When a split has no valid recipient (projectId==0, beneficiary==address(0)),
     /// funds route to the project's own terminal via _addToBalance. If that terminal reverts,
-    /// the old code would propagate the revert and DOS the entire payment. With the try-catch
-    /// fix, the function silently catches the failure and the payment succeeds (funds stay in
-    /// the hook contract).
-    function test_brokenOwnTerminal_eth_doesNotDosPayments() public {
+    /// the payment now reverts with JB721TiersHookLib_SplitFallbackFailed (M-4 fix).
+    function test_brokenOwnTerminal_eth_reverts() public {
         ForTest_JB721TiersHook testHook = _initializeForTestHook(0);
         IJB721TiersHookStore hookStore = testHook.STORE();
 
@@ -172,26 +169,19 @@ contract Test_BrokenTerminalDoesNotDos is UnitTestSetup {
 
         vm.deal(mockTerminalAddress, 2 ether);
 
-        // Expect AddToBalanceReverted event when the broken terminal reverts.
-        vm.expectEmit(true, false, false, false);
-        emit IJB721TiersHook.AddToBalanceReverted(projectId, JBConstants.NATIVE_TOKEN, 1 ether, "");
-
         vm.prank(mockTerminalAddress);
-        // Before the fix, this would revert with "terminal broken".
-        // With the try-catch, it succeeds, emits the event, and the ETH stays in the hook contract.
+        // The payment should now revert when the fallback addToBalanceOf call fails (M-4).
+        vm.expectRevert();
         testHook.afterPayRecordedWith{value: 1 ether}(payContext);
-
-        // The ETH should remain in the hook contract since the terminal call failed.
-        assertGe(address(testHook).balance, 1 ether, "ETH should stay in hook when terminal reverts");
     }
 
     // ──────────────────────────────────────────────────────────────────────
-    // ERC-20: broken own-project terminal in _addToBalance should not revert
+    // ERC-20: broken own-project terminal in _addToBalance should revert (M-4)
     // ──────────────────────────────────────────────────────────────────────
 
     /// @notice Same scenario as above but with ERC-20 tokens. On terminal failure, the
-    /// approval should be reset to 0 for safety, and the payment should not revert.
-    function test_brokenOwnTerminal_erc20_doesNotDosPayments() public {
+    /// approval is reset to 0 for safety and the payment now reverts (M-4 fix).
+    function test_brokenOwnTerminal_erc20_reverts() public {
         BrokenTerminalERC20 usdc = new BrokenTerminalERC20("USD Coin", "USDC", 6);
         uint32 usdcCurrency = uint32(uint160(address(usdc)));
 
@@ -217,24 +207,10 @@ contract Test_BrokenTerminalDoesNotDos is UnitTestSetup {
         vm.prank(mockTerminalAddress);
         usdc.approve(address(testHook), 100e6);
 
-        address brokenTerminal = makeAddr("brokenTerminal");
-
-        // Expect AddToBalanceReverted event when the broken terminal reverts.
-        vm.expectEmit(true, false, false, false);
-        emit IJB721TiersHook.AddToBalanceReverted(projectId, address(usdc), 100e6, "");
-
         vm.prank(mockTerminalAddress);
-        // Before the fix, this would revert with "terminal broken".
-        // With the try-catch, it succeeds and emits the event.
+        // The payment should now revert when the fallback addToBalanceOf call fails (M-4).
+        vm.expectRevert();
         testHook.afterPayRecordedWith(payContext);
-
-        // Tokens should remain in the hook (terminal call failed).
-        assertEq(usdc.balanceOf(address(testHook)), 100e6, "ERC20 should stay in hook when terminal reverts");
-
-        // Approval to the broken terminal should have been reset to 0.
-        assertEq(
-            usdc.allowance(address(testHook), brokenTerminal), 0, "Approval to broken terminal should be reset to 0"
-        );
     }
 
     /// @notice Sets up mocks for the ERC-20 broken terminal test (extracted to avoid stack-too-deep).

package/test/unit/AuditFixes_Unit.t.sol

@@ -112,8 +112,8 @@ contract Test_AuditFixes_Unit is UnitTestSetup {
 
         (, JBPayHookSpecification[] memory specs) = testHook.beforePayRecordedWith(context);
 
-        // The total forwarded amount must be capped at 2 ETH (the actual payment value).
-        assertEq(specs[0].amount, 2 ether, "Total split should be capped at payment value");
+        // The total forwarded amount must be capped at the payment value (may be up to 1 wei less due to rounding).
+        assertApproxEqAbs(specs[0].amount, 2 ether, 1, "Total split should be capped at payment value");
 
         // Decode the per-tier breakdown from hookMetadata.
         (uint16[] memory resultTierIds, uint256[] memory resultAmounts) =