@bananapus/721-hook-v6 0.0.37 → 0.0.39

package/ADMINISTRATION.md

@@ -36,6 +36,18 @@
 - `setMetadata(...)`
 - deployer setup and hook ownership transfer paths
 
+## Deployer Permission Model
+
+`JB721TiersHookProjectDeployer` requires callers to hold the correct Juicebox permission for each operation:
+
+| Function | Required Permissions |
+| --- | --- |
+| `launchProjectFor(...)` | None (creates a new project) |
+| `launchRulesetsFor(...)` | `LAUNCH_RULESETS` + `SET_TERMINALS` |
+| `queueRulesetsOf(...)` | `QUEUE_RULESETS` |
+
+Permissions are checked against the project owner via `_requirePermissionFrom`. The deployer calls the controller on the caller's behalf, so the controller sees the deployer as `msg.sender`.
+
 ## Immutable And One-Way
 
 - many tier properties are immutable once created

package/CHANGELOG.md

@@ -20,6 +20,10 @@ This file describes the verified change from `nana-721-hook-v5` to the current `
 - The repo now carries a dedicated helper library to keep the hook surface manageable and to support the larger v6 feature set.
 - The repo was upgraded from the v5 Solidity baseline to `0.8.28`.
 
+## Local audit remediations
+
+- `JB721TiersHookProjectDeployer.launchRulesetsFor` now checks `LAUNCH_RULESETS` instead of `QUEUE_RULESETS`. The previous check was semantically wrong — launching active rulesets should require the launch permission, not the queue permission.
+
 ## Verified deltas
 
 - `IJB721TiersHook.pricingContext()` changed from a three-value return to `(currency, decimals)`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bananapus/721-hook-v6",
-  "version": "0.0.37",
+  "version": "0.0.39",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -17,10 +17,10 @@
     "artifacts": "source ./.env && npx sphinx artifacts --org-id 'ea165b21-7cdc-4d7b-be59-ecdd4c26bee4' --project-name 'nana-721-hook-v6'"
   },
   "dependencies": {
-    "@bananapus/address-registry-v6": "^0.0.17",
-    "@bananapus/core-v6": "^0.0.34",
-    "@bananapus/ownable-v6": "^0.0.17",
-    "@bananapus/permission-ids-v6": "^0.0.17",
+    "@bananapus/address-registry-v6": "^0.0.20",
+    "@bananapus/core-v6": "^0.0.36",
+    "@bananapus/ownable-v6": "^0.0.20",
+    "@bananapus/permission-ids-v6": "^0.0.19",
     "@openzeppelin/contracts": "^5.6.1",
     "@prb/math": "^4.1.0",
     "solady": "^0.1.8"

package/src/JB721TiersHookProjectDeployer.sol

@@ -24,7 +24,7 @@ import {JBQueueRulesetsConfig} from "./structs/JBQueueRulesetsConfig.sol";
 
 /// @title JB721TiersHookProjectDeployer
 /// @notice Deploys a project and a 721 tiers hook for it. Can be used to queue rulesets for the project if given
-/// `JBPermissionIds.QUEUE_RULESETS`.
+/// `JBPermissionIds.QUEUE_RULESETS` or `JBPermissionIds.LAUNCH_RULESETS`.
 contract JB721TiersHookProjectDeployer is ERC2771Context, JBPermissioned, IJB721TiersHookProjectDeployer {
     //*********************************************************************//
     // --------------- public immutable stored properties ---------------- //
@@ -102,7 +102,7 @@ contract JB721TiersHookProjectDeployer is ERC2771Context, JBPermissioned, IJB721
     }
 
     /// @notice Launches rulesets for a project with an attached 721 tiers hook.
-    /// @dev Only a project's owner or an operator with the `QUEUE_RULESETS & SET_TERMINALS` permission can launch its
+    /// @dev Only a project's owner or an operator with the `LAUNCH_RULESETS & SET_TERMINALS` permission can launch its
     /// rulesets.
     /// @param projectId The ID of the project that rulesets are being launched for.
     /// @param deployTiersHookConfig Configuration which dictates the behavior of the 721 tiers hook which is being
@@ -128,7 +128,7 @@ contract JB721TiersHookProjectDeployer is ERC2771Context, JBPermissioned, IJB721
 
         // Enforce permissions.
         _requirePermissionFrom({
-            account: PROJECTS.ownerOf(projectId), projectId: projectId, permissionId: JBPermissionIds.QUEUE_RULESETS
+            account: PROJECTS.ownerOf(projectId), projectId: projectId, permissionId: JBPermissionIds.LAUNCH_RULESETS
         });
 
         _requirePermissionFrom({

package/test/audit/20260425CodexNemesisFutureTierRemoval.t.sol

@@ -0,0 +1,56 @@
+// SPDX-License-Identifier: MIT
+pragma solidity 0.8.28;
+
+import {Test} from "forge-std/Test.sol";
+import {JBSplit} from "@bananapus/core-v6/src/structs/JBSplit.sol";
+
+import {JB721TiersHookStore} from "../../src/JB721TiersHookStore.sol";
+import {JB721TierConfig} from "../../src/structs/JB721TierConfig.sol";
+import {JB721TierConfigFlags} from "../../src/structs/JB721TierConfigFlags.sol";
+
+contract Test_20260425CodexNemesisFutureTierRemoval is Test {
+    JB721TiersHookStore internal store;
+
+    function setUp() external {
+        store = new JB721TiersHookStore();
+    }
+
+    function test_futureRemovedTierIdIsBornRemovedAndCannotMint() external {
+        JB721TierConfig[] memory firstTier = new JB721TierConfig[](1);
+        firstTier[0] = _tier(1);
+        uint256[] memory firstIds = store.recordAddTiers(firstTier);
+        assertEq(firstIds[0], 1);
+
+        uint256[] memory futureIds = new uint256[](1);
+        futureIds[0] = 2;
+        store.recordRemoveTierIds(futureIds);
+        assertTrue(store.isTierRemoved({hook: address(this), tierId: 2}));
+
+        JB721TierConfig[] memory secondTier = new JB721TierConfig[](1);
+        secondTier[0] = _tier(2);
+        uint256[] memory secondIds = store.recordAddTiers(secondTier);
+        assertEq(secondIds[0], 2);
+        assertTrue(store.isTierRemoved({hook: address(this), tierId: 2}));
+
+        uint16[] memory tierIds = new uint16[](1);
+        tierIds[0] = 2;
+        vm.expectRevert(abi.encodeWithSignature("JB721TiersHookStore_TierRemoved(uint256)", 2));
+        store.recordMint({amount: 1, tierIds: tierIds, isOwnerMint: false});
+    }
+
+    function _tier(uint24 category) internal pure returns (JB721TierConfig memory tier) {
+        tier.price = 1;
+        tier.initialSupply = 10;
+        tier.category = category;
+        tier.flags = JB721TierConfigFlags({
+            allowOwnerMint: false,
+            useReserveBeneficiaryAsDefault: false,
+            transfersPausable: false,
+            useVotingUnits: false,
+            cantBeRemoved: false,
+            cantIncreaseDiscountPercent: false,
+            cantBuyWithCredits: false
+        });
+        tier.splits = new JBSplit[](0);
+    }
+}

package/test/audit/20260425CodexNemesisReserveActivation.t.sol

@@ -0,0 +1,93 @@
+// SPDX-License-Identifier: MIT
+pragma solidity 0.8.28;
+
+import {Test} from "forge-std/Test.sol";
+import {JBSplit} from "@bananapus/core-v6/src/structs/JBSplit.sol";
+
+import {JB721TiersHookStore} from "../../src/JB721TiersHookStore.sol";
+import {JB721Tier} from "../../src/structs/JB721Tier.sol";
+import {JB721TierConfig} from "../../src/structs/JB721TierConfig.sol";
+import {JB721TierConfigFlags} from "../../src/structs/JB721TierConfigFlags.sol";
+
+contract Test_20260425CodexNemesisReserveActivation is Test {
+    JB721TiersHookStore internal store;
+
+    function setUp() external {
+        store = new JB721TiersHookStore();
+    }
+
+    function test_retroactiveDefaultReserveBeneficiaryCreatesUnmintablePendingReserves() external {
+        JB721TierConfig[] memory initialTiers = new JB721TierConfig[](1);
+        initialTiers[0] = _tier({
+            price: 1,
+            initialSupply: 10,
+            reserveFrequency: 2,
+            reserveBeneficiary: address(0),
+            useReserveBeneficiaryAsDefault: false,
+            category: 1
+        });
+        store.recordAddTiers(initialTiers);
+
+        uint16[] memory tierIds = new uint16[](10);
+        for (uint256 i; i < tierIds.length; i++) {
+            tierIds[i] = 1;
+        }
+        store.recordMint({amount: 10, tierIds: tierIds, isOwnerMint: false});
+
+        JB721Tier memory beforeDefault = store.tierOf({hook: address(this), id: 1, includeResolvedUri: false});
+        assertEq(beforeDefault.remainingSupply, 0);
+        assertEq(beforeDefault.reserveFrequency, 0);
+        assertEq(store.numberOfPendingReservesFor({hook: address(this), tierId: 1}), 0);
+        assertEq(store.totalCashOutWeight(address(this)), 10);
+
+        JB721TierConfig[] memory laterTiers = new JB721TierConfig[](1);
+        laterTiers[0] = _tier({
+            price: 1,
+            initialSupply: 10,
+            reserveFrequency: 2,
+            reserveBeneficiary: address(0xBEEF),
+            useReserveBeneficiaryAsDefault: true,
+            category: 2
+        });
+        store.recordAddTiers(laterTiers);
+
+        JB721Tier memory afterDefault = store.tierOf({hook: address(this), id: 1, includeResolvedUri: false});
+        assertEq(afterDefault.remainingSupply, 0);
+        assertEq(afterDefault.reserveFrequency, 2);
+        assertEq(afterDefault.reserveBeneficiary, address(0xBEEF));
+        assertEq(store.numberOfPendingReservesFor({hook: address(this), tierId: 1}), 5);
+        assertEq(store.totalCashOutWeight(address(this)), 15);
+
+        vm.expectRevert();
+        store.recordMintReservesFor({tierId: 1, count: 1});
+    }
+
+    function _tier(
+        uint104 price,
+        uint32 initialSupply,
+        uint16 reserveFrequency,
+        address reserveBeneficiary,
+        bool useReserveBeneficiaryAsDefault,
+        uint24 category
+    )
+        internal
+        pure
+        returns (JB721TierConfig memory tier)
+    {
+        tier.price = price;
+        tier.initialSupply = initialSupply;
+        tier.reserveFrequency = reserveFrequency;
+        tier.reserveBeneficiary = reserveBeneficiary;
+        tier.category = category;
+        tier.flags = JB721TierConfigFlags({
+            allowOwnerMint: false,
+            useReserveBeneficiaryAsDefault: useReserveBeneficiaryAsDefault,
+            transfersPausable: false,
+            useVotingUnits: false,
+            cantBeRemoved: false,
+            cantIncreaseDiscountPercent: false,
+            cantBuyWithCredits: false
+        });
+        tier.splits = new JBSplit[](0);
+    }
+}

package/test/audit/CodexNemesisFreshAudit.t.sol

@@ -0,0 +1,272 @@
+// SPDX-License-Identifier: MIT
+pragma solidity 0.8.28;
+
+import {UnitTestSetup} from "../utils/UnitTestSetup.sol";
+import {ForTest_JB721TiersHook} from "../utils/ForTest_JB721TiersHook.sol";
+import {IJB721TiersHookStore} from "../../src/interfaces/IJB721TiersHookStore.sol";
+import {JB721TierConfig} from "../../src/structs/JB721TierConfig.sol";
+import {JB721TierConfigFlags} from "../../src/structs/JB721TierConfigFlags.sol";
+import {JBBeforePayRecordedContext} from "@bananapus/core-v6/src/structs/JBBeforePayRecordedContext.sol";
+import {JBAfterPayRecordedContext} from "@bananapus/core-v6/src/structs/JBAfterPayRecordedContext.sol";
+import {JBPayHookSpecification} from "@bananapus/core-v6/src/structs/JBPayHookSpecification.sol";
+import {JBTokenAmount} from "@bananapus/core-v6/src/structs/JBTokenAmount.sol";
+import {JBSplit} from "@bananapus/core-v6/src/structs/JBSplit.sol";
+import {IJBSplitHook} from "@bananapus/core-v6/src/interfaces/IJBSplitHook.sol";
+import {IJBSplits} from "@bananapus/core-v6/src/interfaces/IJBSplits.sol";
+import {IJBDirectory} from "@bananapus/core-v6/src/interfaces/IJBDirectory.sol";
+import {JBConstants} from "@bananapus/core-v6/src/libraries/JBConstants.sol";
+
+contract CodexNemesisFreshAudit is UnitTestSetup {
+    function _buildPayMetadata(
+        address hookAddress,
+        bool allowOverspending,
+        uint16[] memory tierIdsToMint
+    )
+        internal
+        view
+        returns (bytes memory)
+    {
+        bytes[] memory data = new bytes[](1);
+        data[0] = abi.encode(allowOverspending, tierIdsToMint);
+
+        bytes4[] memory ids = new bytes4[](1);
+        ids[0] = metadataHelper.getId("pay", hookAddress);
+
+        return metadataHelper.createMetadata(ids, data);
+    }
+
+    function _nativeAmount(uint256 value) internal pure returns (JBTokenAmount memory) {
+        return JBTokenAmount({
+            token: JBConstants.NATIVE_TOKEN,
+            value: value,
+            decimals: 18,
+            currency: uint32(uint160(JBConstants.NATIVE_TOKEN))
+        });
+    }
+
+    function test_payCredits_can_underfund_split_bearing_tier_mints() public {
+        ForTest_JB721TiersHook testHook = _initializeForTestHook(0);
+        IJB721TiersHookStore hookStore = testHook.STORE();
+        address splitReceiver = makeAddr("splitReceiver");
+
+        JB721TierConfig[] memory tiersToAdd = new JB721TierConfig[](1);
+        tiersToAdd[0] = JB721TierConfig({
+            price: uint104(1 ether),
+            initialSupply: uint32(10),
+            votingUnits: 0,
+            reserveFrequency: 0,
+            reserveBeneficiary: address(0),
+            encodedIPFSUri: bytes32(uint256(1)),
+            category: uint24(1),
+            discountPercent: 0,
+            flags: JB721TierConfigFlags({
+                allowOwnerMint: false,
+                useReserveBeneficiaryAsDefault: false,
+                transfersPausable: false,
+                useVotingUnits: false,
+                cantBeRemoved: false,
+                cantIncreaseDiscountPercent: false,
+                cantBuyWithCredits: false
+            }),
+            splitPercent: uint32(JBConstants.SPLITS_TOTAL_PERCENT),
+            splits: new JBSplit[](0)
+        });
+
+        vm.prank(owner);
+        testHook.adjustTiers(tiersToAdd, new uint256[](0));
+
+        JBSplit[] memory splits = new JBSplit[](1);
+        splits[0] = JBSplit({
+            percent: uint32(JBConstants.SPLITS_TOTAL_PERCENT),
+            projectId: 0,
+            beneficiary: payable(splitReceiver),
+            preferAddToBalance: false,
+            lockedUntil: 0,
+            hook: IJBSplitHook(address(0))
+        });
+
+        uint256 groupId = uint256(uint160(address(testHook))) | (uint256(1) << 160);
+        vm.mockCall(
+            mockJBSplits, abi.encodeWithSelector(IJBSplits.splitsOf.selector, projectId, 0, groupId), abi.encode(splits)
+        );
+        vm.mockCall(
+            mockJBDirectory,
+            abi.encodeWithSelector(IJBDirectory.isTerminalOf.selector, projectId, mockTerminalAddress),
+            abi.encode(true)
+        );
+
+        JBAfterPayRecordedContext memory seedCredits = JBAfterPayRecordedContext({
+            payer: beneficiary,
+            projectId: projectId,
+            rulesetId: 0,
+            amount: _nativeAmount(1 ether),
+            forwardedAmount: _nativeAmount(0),
+            weight: 10e18,
+            newlyIssuedTokenCount: 0,
+            beneficiary: beneficiary,
+            hookMetadata: bytes(""),
+            payerMetadata: bytes("")
+        });
+
+        vm.prank(mockTerminalAddress);
+        testHook.afterPayRecordedWith(seedCredits);
+        assertEq(testHook.payCreditsOf(beneficiary), 1 ether, "setup: credits should be seeded");
+
+        uint16[] memory tierIds = new uint16[](1);
+        tierIds[0] = 1;
+        bytes memory payerMetadata = _buildPayMetadata(address(testHook), true, tierIds);
+
+        JBBeforePayRecordedContext memory beforeContext = JBBeforePayRecordedContext({
+            terminal: mockTerminalAddress,
+            payer: beneficiary,
+            amount: _nativeAmount(1),
+            projectId: projectId,
+            rulesetId: 0,
+            beneficiary: beneficiary,
+            weight: 10e18,
+            reservedPercent: 0,
+            metadata: payerMetadata
+        });
+
+        (uint256 weight, JBPayHookSpecification[] memory hookSpecifications) =
+            testHook.beforePayRecordedWith(beforeContext);
+
+        assertEq(weight, 0, "all fresh payment value is treated as split-routed");
+        assertEq(hookSpecifications.length, 1, "expected single pay hook spec");
+        assertEq(hookSpecifications[0].amount, 1, "split forwarding is capped to the fresh payment only");
+
+        JBAfterPayRecordedContext memory mintWithCredits = JBAfterPayRecordedContext({
+            payer: beneficiary,
+            projectId: projectId,
+            rulesetId: 0,
+            amount: _nativeAmount(1),
+            forwardedAmount: _nativeAmount(hookSpecifications[0].amount),
+            weight: weight,
+            newlyIssuedTokenCount: 0,
+            beneficiary: beneficiary,
+            hookMetadata: hookSpecifications[0].metadata,
+            payerMetadata: payerMetadata
+        });
+
+        vm.deal(mockTerminalAddress, 1);
+        vm.prank(mockTerminalAddress);
+        testHook.afterPayRecordedWith{value: 1}(mintWithCredits);
+
+        assertEq(testHook.balanceOf(beneficiary), 1, "beneficiary still mints the split-bearing NFT");
+        assertEq(testHook.payCreditsOf(beneficiary), 1, "stored credits fund essentially the entire mint");
+        assertEq(splitReceiver.balance, 1, "split receiver only receives the fresh 1 wei payment");
+        assertEq(hookStore.totalCashOutWeight(address(testHook)), 1 ether, "full-price NFT still enters cash-out math");
+    }
+
+    function test_new_default_reserve_beneficiary_retroactively_dilutes_existing_tiers() public {
+        ForTest_JB721TiersHook testHook = _initializeForTestHook(0);
+        IJB721TiersHookStore hookStore = testHook.STORE();
+        address retroReserveBeneficiary = makeAddr("retroReserveBeneficiary");
+
+        vm.mockCall(
+            mockJBDirectory,
+            abi.encodeWithSelector(IJBDirectory.isTerminalOf.selector, projectId, mockTerminalAddress),
+            abi.encode(true)
+        );
+
+        JB721TierConfig[] memory initialTier = new JB721TierConfig[](1);
+        initialTier[0] = JB721TierConfig({
+            price: uint104(1 ether),
+            initialSupply: uint32(5),
+            votingUnits: 0,
+            reserveFrequency: uint16(2),
+            reserveBeneficiary: address(0),
+            encodedIPFSUri: bytes32(uint256(2)),
+            category: uint24(1),
+            discountPercent: 0,
+            flags: JB721TierConfigFlags({
+                allowOwnerMint: false,
+                useReserveBeneficiaryAsDefault: false,
+                transfersPausable: false,
+                useVotingUnits: false,
+                cantBeRemoved: false,
+                cantIncreaseDiscountPercent: false,
+                cantBuyWithCredits: false
+            }),
+            splitPercent: 0,
+            splits: new JBSplit[](0)
+        });
+
+        vm.prank(owner);
+        testHook.adjustTiers(initialTier, new uint256[](0));
+
+        uint16[] memory tierIds = new uint16[](2);
+        tierIds[0] = 1;
+        tierIds[1] = 1;
+
+        JBAfterPayRecordedContext memory initialMint = JBAfterPayRecordedContext({
+            payer: beneficiary,
+            projectId: projectId,
+            rulesetId: 0,
+            amount: _nativeAmount(2 ether),
+            forwardedAmount: _nativeAmount(0),
+            weight: 10e18,
+            newlyIssuedTokenCount: 0,
+            beneficiary: beneficiary,
+            hookMetadata: bytes(""),
+            payerMetadata: _buildPayMetadata(address(testHook), false, tierIds)
+        });
+
+        vm.prank(mockTerminalAddress);
+        testHook.afterPayRecordedWith(initialMint);
+
+        assertEq(
+            hookStore.numberOfPendingReservesFor(address(testHook), 1), 0, "no reserve obligation before default set"
+        );
+        assertEq(testHook.totalCashOutWeight(), 2 ether, "cash-out denominator initially matches sold NFTs");
+
+        JB721TierConfig[] memory activatingTier = new JB721TierConfig[](1);
+        activatingTier[0] = JB721TierConfig({
+            price: uint104(2 ether),
+            initialSupply: uint32(5),
+            votingUnits: 0,
+            reserveFrequency: uint16(1),
+            reserveBeneficiary: retroReserveBeneficiary,
+            encodedIPFSUri: bytes32(uint256(3)),
+            category: uint24(2),
+            discountPercent: 0,
+            flags: JB721TierConfigFlags({
+                allowOwnerMint: false,
+                useReserveBeneficiaryAsDefault: true,
+                transfersPausable: false,
+                useVotingUnits: false,
+                cantBeRemoved: false,
+                cantIncreaseDiscountPercent: false,
+                cantBuyWithCredits: false
+            }),
+            splitPercent: 0,
+            splits: new JBSplit[](0)
+        });
+
+        vm.prank(owner);
+        testHook.adjustTiers(activatingTier, new uint256[](0));
+
+        assertEq(
+            hookStore.defaultReserveBeneficiaryOf(address(testHook)),
+            retroReserveBeneficiary,
+            "new tier overwrites the hook-wide default reserve beneficiary"
+        );
+        assertEq(
+            hookStore.numberOfPendingReservesFor(address(testHook), 1),
+            1,
+            "historic mints on the older tier now retroactively create reserve debt"
+        );
+        assertEq(
+            testHook.totalCashOutWeight(),
+            3 ether,
+            "cash-out denominator dilutes existing holders before any new payment occurs"
+        );
+
+        testHook.mintPendingReservesFor(1, 1);
+
+        assertEq(
+            testHook.balanceOf(retroReserveBeneficiary), 1, "the new default beneficiary can mint retroactive reserves"
+        );
+        assertEq(hookStore.numberOfPendingReservesFor(address(testHook), 1), 0, "reserve debt is realized after mint");
+    }
+}

package/test/audit/CodexNemesisFutureTierPoC.t.sol

@@ -0,0 +1,51 @@
+// SPDX-License-Identifier: MIT
+pragma solidity 0.8.28;
+
+import {UnitTestSetup} from "../utils/UnitTestSetup.sol";
+import {JB721TiersHookStore} from "../../src/JB721TiersHookStore.sol";
+import {IJB721TokenUriResolver} from "../../src/interfaces/IJB721TokenUriResolver.sol";
+import {JB721TierConfig} from "../../src/structs/JB721TierConfig.sol";
+
+contract CodexNemesisFutureTierPoC is UnitTestSetup {
+    function test_futureTierRemovalPersistsIntoNewTierAndBricksMint() external {
+        hook = _initHookDefaultTiers(0);
+
+        uint256[] memory futureTierIds = new uint256[](1);
+        futureTierIds[0] = 1;
+
+        vm.prank(owner);
+        hook.adjustTiers(new JB721TierConfig[](0), futureTierIds);
+
+        (JB721TierConfig[] memory tiersToAdd,) = _createTiers(defaultTierConfig, 1);
+
+        vm.prank(owner);
+        hook.adjustTiers(tiersToAdd, new uint256[](0));
+
+        assertTrue(hook.STORE().isTierRemoved(address(hook), 1), "future removal flag should persist");
+
+        uint16[] memory tierIds = new uint16[](1);
+        tierIds[0] = 1;
+        JB721TiersHookStore store = JB721TiersHookStore(address(hook.STORE()));
+
+        vm.expectRevert(abi.encodeWithSelector(JB721TiersHookStore.JB721TiersHookStore_TierRemoved.selector, 1));
+        vm.prank(address(hook));
+        store.recordMint(type(uint256).max, tierIds, false);
+    }
+
+    function test_futureTierUriCanBePoisonedBeforeTierExists() external {
+        hook = _initHookDefaultTiers(0);
+
+        bytes32 poisonedUri = bytes32(uint256(0x1234));
+
+        vm.prank(owner);
+        hook.setMetadata("", "", "", "", IJB721TokenUriResolver(address(hook)), 1, poisonedUri);
+
+        (JB721TierConfig[] memory tiersToAdd,) = _createTiers(defaultTierConfig, 1);
+        tiersToAdd[0].encodedIPFSUri = bytes32(0);
+
+        vm.prank(owner);
+        hook.adjustTiers(tiersToAdd, new uint256[](0));
+
+        assertEq(hook.STORE().encodedIPFSUriOf(address(hook), 1), poisonedUri, "future tier inherited stale uri");
+    }
+}

package/test/audit/CodexNemesisProjectDeployerAuth.t.sol

@@ -0,0 +1,273 @@
+// SPDX-License-Identifier: MIT
+pragma solidity 0.8.28;
+
+import "../utils/UnitTestSetup.sol";
+
+import {JB721TiersHookProjectDeployer} from "../../src/JB721TiersHookProjectDeployer.sol";
+import {JBDeploy721TiersHookConfig} from "../../src/structs/JBDeploy721TiersHookConfig.sol";
+import {JBLaunchRulesetsConfig} from "../../src/structs/JBLaunchRulesetsConfig.sol";
+import {JBQueueRulesetsConfig} from "../../src/structs/JBQueueRulesetsConfig.sol";
+import {JBPayDataHookRulesetConfig} from "../../src/structs/JBPayDataHookRulesetConfig.sol";
+import {JBPayDataHookRulesetMetadata} from "../../src/structs/JBPayDataHookRulesetMetadata.sol";
+import {JB721TierConfigFlags} from "../../src/structs/JB721TierConfigFlags.sol";
+import {JB721InitTiersConfig} from "../../src/structs/JB721InitTiersConfig.sol";
+import {JB721TiersHookFlags} from "../../src/structs/JB721TiersHookFlags.sol";
+import {IJB721TiersHook} from "../../src/interfaces/IJB721TiersHook.sol";
+import {IJBDirectory} from "@bananapus/core-v6/src/interfaces/IJBDirectory.sol";
+import {IJBPermissions} from "@bananapus/core-v6/src/interfaces/IJBPermissions.sol";
+import {IJBController} from "@bananapus/core-v6/src/interfaces/IJBController.sol";
+import {IJBRulesetApprovalHook} from "@bananapus/core-v6/src/interfaces/IJBRulesetApprovalHook.sol";
+import {IJBTerminal} from "@bananapus/core-v6/src/interfaces/IJBTerminal.sol";
+import {JBPermissionIds} from "@bananapus/permission-ids-v6/src/JBPermissionIds.sol";
+import {JBConstants} from "@bananapus/core-v6/src/libraries/JBConstants.sol";
+import {JBAccountingContext} from "@bananapus/core-v6/src/structs/JBAccountingContext.sol";
+import {JBTerminalConfig} from "@bananapus/core-v6/src/structs/JBTerminalConfig.sol";
+import {JBSplit} from "@bananapus/core-v6/src/structs/JBSplit.sol";
+
+contract MockProjectsForNemesis {
+    uint256 internal _count;
+    address internal _owner;
+
+    function setup(uint256 count_, address owner_) external {
+        _count = count_;
+        _owner = owner_;
+    }
+
+    function count() external view returns (uint256) {
+        return _count;
+    }
+
+    function ownerOf(uint256) external view returns (address) {
+        return _owner;
+    }
+
+    fallback() external {}
+}
+
+contract StrictControllerForNemesis {
+    address internal immutable EXPECTED_CALLER;
+
+    error UnexpectedCaller(address caller);
+
+    constructor(address expectedCaller) {
+        EXPECTED_CALLER = expectedCaller;
+    }
+
+    fallback() external payable {
+        if (msg.sender != EXPECTED_CALLER) revert UnexpectedCaller(msg.sender);
+        bytes memory result = abi.encode(uint256(42));
+        assembly {
+            return(add(result, 32), mload(result))
+        }
+    }
+}
+
+contract Test_CodexNemesisProjectDeployerAuth is UnitTestSetup {
+    JB721TiersHookProjectDeployer internal projectDeployer;
+    address internal operator = address(0xBEEF);
+    uint256 internal testProjectId = 5;
+
+    function setUp() public override {
+        super.setUp();
+
+        MockProjectsForNemesis projects = new MockProjectsForNemesis();
+        vm.etch(mockJBProjects, address(projects).code);
+        MockProjectsForNemesis(mockJBProjects).setup(testProjectId, owner);
+
+        vm.mockCall(mockJBDirectory, abi.encodeWithSelector(IJBDirectory.PROJECTS.selector), abi.encode(mockJBProjects));
+
+        projectDeployer = new JB721TiersHookProjectDeployer(
+            IJBDirectory(mockJBDirectory), IJBPermissions(mockJBPermissions), jbHookDeployer, address(0)
+        );
+    }
+
+    function test_launchRulesetsFor_revertsBecauseControllerSeesProjectDeployerAsCaller() external {
+        (JBDeploy721TiersHookConfig memory hookConfig, JBLaunchRulesetsConfig memory launchConfig) =
+            _launchConfig(testProjectId);
+
+        StrictControllerForNemesis controller = new StrictControllerForNemesis(owner);
+
+        vm.prank(owner);
+        vm.expectRevert(
+            abi.encodeWithSelector(StrictControllerForNemesis.UnexpectedCaller.selector, address(projectDeployer))
+        );
+        projectDeployer.launchRulesetsFor(
+            testProjectId, hookConfig, launchConfig, IJBController(address(controller)), bytes32(0)
+        );
+    }
+
+    function test_queueRulesetsOf_revertsBecauseControllerSeesProjectDeployerAsCaller() external {
+        (JBDeploy721TiersHookConfig memory hookConfig, JBQueueRulesetsConfig memory queueConfig) =
+            _queueConfig(testProjectId);
+
+        StrictControllerForNemesis controller = new StrictControllerForNemesis(owner);
+
+        vm.prank(owner);
+        vm.expectRevert(
+            abi.encodeWithSelector(StrictControllerForNemesis.UnexpectedCaller.selector, address(projectDeployer))
+        );
+        projectDeployer.queueRulesetsOf(
+            testProjectId, hookConfig, queueConfig, IJBController(address(controller)), bytes32(0)
+        );
+    }
+
+    function test_launchRulesetsFor_checksLaunchPermission() external {
+        (JBDeploy721TiersHookConfig memory hookConfig, JBLaunchRulesetsConfig memory launchConfig) =
+            _launchConfig(testProjectId);
+
+        address account = owner;
+        StrictControllerForNemesis controller = new StrictControllerForNemesis(owner);
+
+        // Grant LAUNCH_RULESETS and SET_TERMINALS, deny QUEUE_RULESETS.
+        vm.mockCall(
+            mockJBPermissions,
+            abi.encodeWithSelector(
+                IJBPermissions.hasPermission.selector,
+                operator,
+                account,
+                testProjectId,
+                JBPermissionIds.QUEUE_RULESETS,
+                true,
+                true
+            ),
+            abi.encode(false)
+        );
+        vm.mockCall(
+            mockJBPermissions,
+            abi.encodeWithSelector(
+                IJBPermissions.hasPermission.selector,
+                operator,
+                account,
+                testProjectId,
+                JBPermissionIds.LAUNCH_RULESETS,
+                true,
+                true
+            ),
+            abi.encode(true)
+        );
+        vm.mockCall(
+            mockJBPermissions,
+            abi.encodeWithSelector(
+                IJBPermissions.hasPermission.selector,
+                operator,
+                account,
+                testProjectId,
+                JBPermissionIds.SET_TERMINALS,
+                true,
+                true
+            ),
+            abi.encode(true)
+        );
+
+        // The permission check passes with LAUNCH_RULESETS. The call proceeds to the controller, which reverts
+        // because it sees the deployer contract as the caller rather than the original operator.
+        vm.prank(operator);
+        vm.expectRevert(
+            abi.encodeWithSelector(StrictControllerForNemesis.UnexpectedCaller.selector, address(projectDeployer))
+        );
+        projectDeployer.launchRulesetsFor(
+            testProjectId, hookConfig, launchConfig, IJBController(address(controller)), bytes32(0)
+        );
+    }
+
+    function _launchConfig(uint256 projectId_)
+        internal
+        view
+        returns (JBDeploy721TiersHookConfig memory hookConfig, JBLaunchRulesetsConfig memory launchConfig)
+    {
+        JB721TierConfig[] memory tierConfigs = new JB721TierConfig[](1);
+        tierConfigs[0] = JB721TierConfig({
+            price: uint104(10),
+            initialSupply: uint32(100),
+            votingUnits: uint16(0),
+            reserveFrequency: uint16(0),
+            reserveBeneficiary: reserveBeneficiary,
+            encodedIPFSUri: tokenUris[0],
+            category: uint24(1),
+            discountPercent: uint8(0),
+            flags: JB721TierConfigFlags({
+                allowOwnerMint: false,
+                useReserveBeneficiaryAsDefault: false,
+                transfersPausable: false,
+                useVotingUnits: false,
+                cantBeRemoved: false,
+                cantIncreaseDiscountPercent: false,
+                cantBuyWithCredits: false
+            }),
+            splitPercent: 0,
+            splits: new JBSplit[](0)
+        });
+
+        hookConfig = JBDeploy721TiersHookConfig({
+            name: name,
+            symbol: symbol,
+            baseUri: baseUri,
+            tokenUriResolver: IJB721TokenUriResolver(address(0)),
+            contractUri: contractUri,
+            tiersConfig: JB721InitTiersConfig({
+                tiers: tierConfigs, currency: uint32(uint160(JBConstants.NATIVE_TOKEN)), decimals: 18
+            }),
+            flags: JB721TiersHookFlags({
+                preventOverspending: false,
+                issueTokensForSplits: false,
+                noNewTiersWithReserves: true,
+                noNewTiersWithVotes: false,
+                noNewTiersWithOwnerMinting: true
+            })
+        });
+
+        JBPayDataHookRulesetConfig[] memory rulesetConfigs = new JBPayDataHookRulesetConfig[](1);
+        rulesetConfigs[0].mustStartAtOrAfter = 0;
+        rulesetConfigs[0].duration = 14;
+        rulesetConfigs[0].weight = 1e18;
+        rulesetConfigs[0].weightCutPercent = 0;
+        rulesetConfigs[0].approvalHook = IJBRulesetApprovalHook(address(0));
+        rulesetConfigs[0].metadata = JBPayDataHookRulesetMetadata({
+            reservedPercent: 5000,
+            cashOutTaxRate: 5000,
+            baseCurrency: uint32(uint160(JBConstants.NATIVE_TOKEN)),
+            pausePay: false,
+            pauseCreditTransfers: false,
+            allowOwnerMinting: false,
+            allowSetCustomToken: false,
+            allowTerminalMigration: false,
+            allowSetTerminals: false,
+            allowSetController: false,
+            ownerMustSendPayouts: false,
+            allowAddAccountingContext: false,
+            allowAddPriceFeed: false,
+            holdFees: false,
+            useTotalSurplusForCashOuts: false,
+            useDataHookForCashOut: false,
+            metadata: 0x00
+        });
+
+        JBAccountingContext[] memory accountingContexts = new JBAccountingContext[](1);
+        accountingContexts[0] = JBAccountingContext({
+            currency: uint32(uint160(JBConstants.NATIVE_TOKEN)), decimals: 18, token: JBConstants.NATIVE_TOKEN
+        });
+        JBTerminalConfig[] memory terminalConfigs = new JBTerminalConfig[](1);
+        terminalConfigs[0] = JBTerminalConfig({
+            terminal: IJBTerminal(mockTerminalAddress), accountingContextsToAccept: accountingContexts
+        });
+
+        launchConfig = JBLaunchRulesetsConfig({
+            projectId: uint56(projectId_),
+            rulesetConfigurations: rulesetConfigs,
+            terminalConfigurations: terminalConfigs,
+            memo: "launch"
+        });
+    }
+
+    function _queueConfig(uint256 projectId_)
+        internal
+        view
+        returns (JBDeploy721TiersHookConfig memory hookConfig, JBQueueRulesetsConfig memory queueConfig)
+    {
+        JBLaunchRulesetsConfig memory launchConfig;
+        (hookConfig, launchConfig) = _launchConfig(projectId_);
+        queueConfig = JBQueueRulesetsConfig({
+            projectId: uint56(projectId_), rulesetConfigurations: launchConfig.rulesetConfigurations, memo: "queue"
+        });
+    }
+}