@bananapus/721-hook-v6 0.0.41 → 0.0.43

package/test/TestCheckpoints.t.sol

@@ -1,341 +0,0 @@
-// SPDX-License-Identifier: MIT
-pragma solidity 0.8.28;
-
-// forge-lint: disable-next-line(unaliased-plain-import)
-import "./utils/UnitTestSetup.sol";
-// forge-lint: disable-next-line(unaliased-plain-import)
-import "./utils/ForTest_JB721TiersHook.sol";
-import {JB721Checkpoints} from "../src/JB721Checkpoints.sol";
-import {IJB721Checkpoints} from "../src/interfaces/IJB721Checkpoints.sol";
-import {IJB721TiersHook} from "../src/interfaces/IJB721TiersHook.sol";
-import {IERC721} from "@openzeppelin/contracts/token/ERC721/IERC721.sol";
-
-/// @title TestCheckpoints
-/// @notice Tests the checkpoint module IVotes checkpointed voting power baked into the base hook:
-/// delegation, checkpoints, transfer, multi-tier, burn, and module deployment.
-contract TestCheckpoints is UnitTestSetup {
-    /// @notice Deploys a ForTest hook with the given number of tiers.
-    function _initializeHookWithCheckpoints(uint256 numberOfTiers) internal returns (ForTest_JB721TiersHook tiersHook) {
-        (JB721TierConfig[] memory tierConfigs,) = _createTiers(defaultTierConfig, numberOfTiers);
-
-        ForTest_JB721TiersHookStore hookStore = new ForTest_JB721TiersHookStore();
-
-        tiersHook = new ForTest_JB721TiersHook(
-            ForTest_JB721TiersHook.ForTestInitConfig({
-                projectId: projectId,
-                name: name,
-                symbol: symbol,
-                baseUri: baseUri,
-                tokenUriResolver: IJB721TokenUriResolver(mockTokenUriResolver),
-                contractUri: contractUri,
-                tiers: tierConfigs,
-                flags: JB721TiersHookFlags({
-                    preventOverspending: false,
-                    issueTokensForSplits: false,
-                    noNewTiersWithReserves: false,
-                    noNewTiersWithVotes: false,
-                    noNewTiersWithOwnerMinting: true
-                })
-            }),
-            IJBDirectory(mockJBDirectory),
-            IJBPrices(mockJBPrices),
-            IJBRulesets(mockJBRulesets),
-            IJB721TiersHookStore(address(hookStore)),
-            IJBSplits(mockJBSplits)
-        );
-
-        tiersHook.transferOwnership(owner);
-    }
-
-    // -------------------------------------------------------------------
-    // Test 1: Checkpoint module is deployed lazily on first transfer
-    // -------------------------------------------------------------------
-    function test_checkpointModule_isDeployedLazily() public {
-        defaultTierConfig.flags.allowOwnerMint = true;
-        defaultTierConfig.reserveFrequency = 0;
-
-        ForTest_JB721TiersHook tiersHook = _initializeHookWithCheckpoints(1);
-
-        // CHECKPOINTS should NOT be deployed after initialization (lazy deployment).
-        assertTrue(
-            address(tiersHook.CHECKPOINTS()) == address(0),
-            "Checkpoint module should not be deployed after initialization"
-        );
-
-        // Mint a token to trigger lazy deployment.
-        uint16[] memory tiersToMint = new uint16[](1);
-        tiersToMint[0] = 1;
-        vm.prank(owner);
-        tiersHook.mintFor(tiersToMint, owner);
-
-        // CHECKPOINTS should now be deployed after the first mint.
-        assertTrue(
-            address(tiersHook.CHECKPOINTS()) != address(0), "Checkpoint module should be deployed after first mint"
-        );
-    }
-
-    // -------------------------------------------------------------------
-    // Test 2: supportsInterface still works for base hook
-    // -------------------------------------------------------------------
-    function test_supportsInterface() public {
-        defaultTierConfig.flags.allowOwnerMint = true;
-        defaultTierConfig.reserveFrequency = 0;
-
-        ForTest_JB721TiersHook tiersHook = _initializeHookWithCheckpoints(1);
-
-        assertTrue(tiersHook.supportsInterface(type(IJB721TiersHook).interfaceId), "Should support IJB721TiersHook");
-    }
-
-    // -------------------------------------------------------------------
-    // Test 3: Mint + manual delegate -> getVotes equals tier votingUnits
-    // -------------------------------------------------------------------
-    function test_mintAndDelegate_getVotes() public {
-        defaultTierConfig.flags.allowOwnerMint = true;
-        defaultTierConfig.reserveFrequency = 0;
-        defaultTierConfig.flags.useVotingUnits = true;
-        defaultTierConfig.votingUnits = 100;
-
-        ForTest_JB721TiersHook tiersHook = _initializeHookWithCheckpoints(1);
-
-        address user = makeAddr("user");
-
-        // Mint an NFT to user (CHECKPOINTS already deployed during init).
-        uint16[] memory tiersToMint = new uint16[](1);
-        tiersToMint[0] = 1;
-        vm.prank(owner);
-        tiersHook.mintFor(tiersToMint, user);
-
-        IJB721Checkpoints module = tiersHook.CHECKPOINTS();
-
-        // Without delegation, getVotes should be 0.
-        assertEq(module.getVotes(user), 0, "Votes should be 0 before delegation");
-
-        // User self-delegates.
-        vm.prank(user);
-        module.delegate(user);
-
-        assertEq(module.getVotes(user), 100, "Votes should be 100 after delegation");
-    }
-
-    // -------------------------------------------------------------------
-    // Test 4: No auto-delegation — delegates(user) stays address(0) after mint
-    // -------------------------------------------------------------------
-    function test_noAutoDelegation_delegateStaysZero() public {
-        defaultTierConfig.flags.allowOwnerMint = true;
-        defaultTierConfig.reserveFrequency = 0;
-        defaultTierConfig.flags.useVotingUnits = true;
-        defaultTierConfig.votingUnits = 100;
-
-        ForTest_JB721TiersHook tiersHook = _initializeHookWithCheckpoints(1);
-
-        address user = makeAddr("user");
-
-        // Mint an NFT to user (CHECKPOINTS already deployed during init).
-        uint16[] memory tiersToMint = new uint16[](1);
-        tiersToMint[0] = 1;
-        vm.prank(owner);
-        tiersHook.mintFor(tiersToMint, user);
-
-        IJB721Checkpoints module = tiersHook.CHECKPOINTS();
-
-        // Delegate should be address(0) — no auto-delegation.
-        assertEq(module.delegates(user), address(0), "Delegate should be zero after mint");
-    }
-
-    // -------------------------------------------------------------------
-    // Test 5: Transfer moves checkpointed votes (with manual delegation)
-    // -------------------------------------------------------------------
-    function test_transfer_movesCheckpointedVotes() public {
-        defaultTierConfig.flags.allowOwnerMint = true;
-        defaultTierConfig.reserveFrequency = 0;
-        defaultTierConfig.flags.useVotingUnits = true;
-        defaultTierConfig.votingUnits = 100;
-
-        ForTest_JB721TiersHook tiersHook = _initializeHookWithCheckpoints(1);
-
-        address alice = makeAddr("alice");
-        address bob = makeAddr("bob");
-
-        // Mint to alice (CHECKPOINTS already deployed during init).
-        uint16[] memory tiersToMint = new uint16[](1);
-        tiersToMint[0] = 1;
-        vm.prank(owner);
-        tiersHook.mintFor(tiersToMint, alice);
-
-        IJB721Checkpoints module = tiersHook.CHECKPOINTS();
-
-        // Both delegate to themselves.
-        vm.prank(alice);
-        module.delegate(alice);
-        vm.prank(bob);
-        module.delegate(bob);
-
-        assertEq(module.getVotes(alice), 100, "Alice should have 100 votes");
-        assertEq(module.getVotes(bob), 0, "Bob should have 0 votes");
-
-        // Transfer NFT from alice to bob.
-        uint256 tokenId = _generateTokenId(1, 1);
-        vm.prank(alice);
-        IERC721(address(tiersHook)).transferFrom(alice, bob, tokenId);
-
-        assertEq(module.getVotes(alice), 0, "Alice should have 0 votes after transfer");
-        assertEq(module.getVotes(bob), 100, "Bob should have 100 votes after transfer");
-    }
-
-    // -------------------------------------------------------------------
-    // Test 6: getPastVotes / getPastTotalSupply checkpoints
-    // -------------------------------------------------------------------
-    function test_getPastVotes_checkpoint() public {
-        defaultTierConfig.flags.allowOwnerMint = true;
-        defaultTierConfig.reserveFrequency = 0;
-        defaultTierConfig.flags.useVotingUnits = true;
-        defaultTierConfig.votingUnits = 100;
-
-        ForTest_JB721TiersHook tiersHook = _initializeHookWithCheckpoints(1);
-
-        address user = makeAddr("user");
-
-        // Mint first NFT to test checkpoint tracking.
-        uint16[] memory tiersToMint = new uint16[](1);
-        tiersToMint[0] = 1;
-        vm.prank(owner);
-        tiersHook.mintFor(tiersToMint, user);
-
-        IJB721Checkpoints module = tiersHook.CHECKPOINTS();
-
-        // User self-delegates so checkpoints are created going forward.
-        vm.prank(user);
-        module.delegate(user);
-
-        uint256 blockBeforeSecondMint = block.number;
-        vm.roll(block.number + 1);
-
-        // Mint a second NFT.
-        vm.prank(owner);
-        tiersHook.mintFor(tiersToMint, user);
-
-        uint256 blockAfterSecondMint = block.number;
-        vm.roll(block.number + 1);
-
-        // Past votes before second mint = 100 (from first NFT + delegation).
-        assertEq(module.getPastVotes(user, blockBeforeSecondMint), 100, "Past votes before second mint should be 100");
-        // Past votes after second mint = 200.
-        assertEq(module.getPastVotes(user, blockAfterSecondMint), 200, "Past votes after second mint should be 200");
-
-        // Past total supply.
-        assertEq(
-            module.getPastTotalSupply(blockBeforeSecondMint), 100, "Past total supply before second mint should be 100"
-        );
-        assertEq(
-            module.getPastTotalSupply(blockAfterSecondMint), 200, "Past total supply after second mint should be 200"
-        );
-    }
-
-    // -------------------------------------------------------------------
-    // Test 7: Multi-tier with different voting units
-    // -------------------------------------------------------------------
-    function test_multiTier_differentVotingUnits() public {
-        defaultTierConfig.flags.allowOwnerMint = true;
-        defaultTierConfig.reserveFrequency = 0;
-        defaultTierConfig.flags.useVotingUnits = true;
-
-        ForTest_JB721TiersHook tiersHook = _initializeHookWithCheckpoints(3);
-
-        // Set custom voting units per tier.
-        tiersHook.test_store().ForTest_setTierVotingUnits(address(tiersHook), 1, 100);
-        tiersHook.test_store().ForTest_setTierVotingUnits(address(tiersHook), 2, 200);
-        tiersHook.test_store().ForTest_setTierVotingUnits(address(tiersHook), 3, 500);
-
-        address user = makeAddr("user");
-
-        // Mint one from tier 1 to test checkpoint tracking.
-        uint16[] memory tier1 = new uint16[](1);
-        tier1[0] = 1;
-        vm.prank(owner);
-        tiersHook.mintFor(tier1, user);
-
-        IJB721Checkpoints module = tiersHook.CHECKPOINTS();
-
-        // User self-delegates.
-        vm.prank(user);
-        module.delegate(user);
-
-        // Mint from remaining tiers.
-        uint16[] memory tier2 = new uint16[](1);
-        tier2[0] = 2;
-        uint16[] memory tier3 = new uint16[](1);
-        tier3[0] = 3;
-
-        vm.startPrank(owner);
-        tiersHook.mintFor(tier2, user);
-        tiersHook.mintFor(tier3, user);
-        vm.stopPrank();
-
-        // 100 + 200 + 500 = 800.
-        assertEq(module.getVotes(user), 800, "User should have 800 checkpointed votes");
-    }
-
-    // -------------------------------------------------------------------
-    // Test 8: Burn decreases checkpointed total supply
-    // -------------------------------------------------------------------
-    function test_burn_decreasesTotalSupply() public {
-        defaultTierConfig.flags.allowOwnerMint = true;
-        defaultTierConfig.reserveFrequency = 0;
-        defaultTierConfig.flags.useVotingUnits = true;
-        defaultTierConfig.votingUnits = 100;
-
-        ForTest_JB721TiersHook tiersHook = _initializeHookWithCheckpoints(1);
-
-        address user = makeAddr("user");
-
-        // Mint 2 NFTs (first one deploys CHECKPOINTS lazily).
-        uint16[] memory tiersToMint = new uint16[](2);
-        tiersToMint[0] = 1;
-        tiersToMint[1] = 1;
-        vm.prank(owner);
-        tiersHook.mintFor(tiersToMint, user);
-
-        IJB721Checkpoints module = tiersHook.CHECKPOINTS();
-
-        // User self-delegates.
-        vm.prank(user);
-        module.delegate(user);
-
-        assertEq(module.getVotes(user), 200, "User should have 200 votes from 2 NFTs");
-
-        uint256 blockBeforeBurn = block.number;
-        vm.roll(block.number + 1);
-
-        // Burn one NFT.
-        uint256[] memory tokensToBurn = new uint256[](1);
-        tokensToBurn[0] = _generateTokenId(1, 1);
-        tiersHook.burn(tokensToBurn);
-
-        assertEq(module.getVotes(user), 100, "User should have 100 votes after burning 1 NFT");
-
-        vm.roll(block.number + 1);
-
-        assertEq(module.getPastTotalSupply(blockBeforeBurn), 200, "Past total supply before burn should be 200");
-    }
-
-    // -------------------------------------------------------------------
-    // Test 9: Unauthorized onTransfer reverts
-    // -------------------------------------------------------------------
-    function test_unauthorizedOnTransfer_reverts() public {
-        defaultTierConfig.flags.allowOwnerMint = true;
-        defaultTierConfig.reserveFrequency = 0;
-
-        ForTest_JB721TiersHook tiersHook = _initializeHookWithCheckpoints(1);
-
-        // Mint to test checkpoint tracking.
-        uint16[] memory tiersToMint = new uint16[](1);
-        tiersToMint[0] = 1;
-        vm.prank(owner);
-        tiersHook.mintFor(tiersToMint, makeAddr("user"));
-
-        IJB721Checkpoints module = tiersHook.CHECKPOINTS();
-
-        vm.expectRevert(JB721Checkpoints.JB721Checkpoints_Unauthorized.selector);
-        module.onTransfer(address(0), address(1), 1);
-    }
-}

package/test/TestSafeTransferReentrancy.t.sol

@@ -1,305 +0,0 @@
-// SPDX-License-Identifier: MIT
-pragma solidity 0.8.28;
-
-// forge-lint: disable-next-line(unaliased-plain-import)
-import "./utils/UnitTestSetup.sol";
-import {IJB721TiersHookStore} from "../src/interfaces/IJB721TiersHookStore.sol";
-import {IJBDirectory} from "@bananapus/core-v6/src/interfaces/IJBDirectory.sol";
-import {IERC721Receiver} from "@openzeppelin/contracts/token/ERC721/IERC721Receiver.sol";
-import {IERC721} from "@openzeppelin/contracts/token/ERC721/IERC721.sol";
-
-// =====================================================================
-// Malicious ERC721 receiver that attempts reentrancy via safeTransferFrom
-// =====================================================================
-
-/// @notice A malicious ERC721 receiver that attempts to re-enter the hook contract during onERC721Received.
-contract MaliciousReceiver is IERC721Receiver {
-    address public target;
-    bytes public reentryCalldata;
-    bool public reentryAttempted;
-    bool public reentrySucceeded;
-
-    function setReentryTarget(address _target, bytes memory _calldata) external {
-        target = _target;
-        reentryCalldata = _calldata;
-    }
-
-    function onERC721Received(address, address, uint256, bytes memory) external override returns (bytes4) {
-        if (reentryCalldata.length > 0) {
-            reentryAttempted = true;
-            (bool success,) = target.call(reentryCalldata);
-            reentrySucceeded = success;
-        }
-        return IERC721Receiver.onERC721Received.selector;
-    }
-
-    receive() external payable {}
-}
-
-/// @notice A malicious ERC721 receiver that attempts to transfer the NFT it just received back to itself during
-/// onERC721Received, testing reentrancy via safeTransferFrom.
-contract MaliciousRetransferReceiver is IERC721Receiver {
-    address public hookAddress;
-    bool public reentryAttempted;
-    bool public reentryReverted;
-    uint256 public receivedTokenId;
-    address public nextRecipient;
-
-    constructor(address _hook, address _nextRecipient) {
-        hookAddress = _hook;
-        nextRecipient = _nextRecipient;
-    }
-
-    function onERC721Received(address, address, uint256 tokenId, bytes memory) external override returns (bytes4) {
-        receivedTokenId = tokenId;
-        reentryAttempted = true;
-        // Attempt to transfer the just-received NFT to another address during the callback.
-        try IERC721(hookAddress).safeTransferFrom(address(this), nextRecipient, tokenId) {
-            reentryReverted = false;
-        } catch {
-            reentryReverted = true;
-        }
-        return IERC721Receiver.onERC721Received.selector;
-    }
-
-    receive() external payable {}
-}
-
-// =====================================================================
-// Test Contract: Reentrancy via safeTransferFrom / onERC721Received
-// =====================================================================
-
-/// @title TestSafeTransferReentrancy
-/// @notice Tests that malicious ERC721 receivers cannot exploit reentrancy during safeTransferFrom.
-/// @dev The safeTransferFrom flow calls _checkOnERC721Received AFTER the transfer is complete
-/// (state already updated), so the receiver's onERC721Received callback fires with consistent state.
-/// These tests verify that re-entering the hook during that callback does not corrupt state.
-contract TestSafeTransferReentrancy is UnitTestSetup {
-    using stdStorage for StdStorage;
-
-    // ---------------------------------------------------------------
-    // Test 1: Malicious receiver tries to re-enter afterPayRecordedWith
-    // ---------------------------------------------------------------
-    /// @notice A malicious receiver tries to call afterPayRecordedWith when receiving an NFT via safeTransferFrom.
-    /// The re-entry fails because the receiver is not registered as a terminal.
-    function test_safeTransferFrom_maliciousReceiver_cannotReenterAfterPay() public {
-        // Set up hook with tiers and mint an NFT.
-        defaultTierConfig.flags.allowOwnerMint = true;
-        defaultTierConfig.reserveFrequency = 0;
-        ForTest_JB721TiersHook testHook = _initializeForTestHook(10);
-
-        // Mint an NFT to the beneficiary.
-        uint16[] memory tiersToMint = new uint16[](1);
-        tiersToMint[0] = 1;
-        vm.prank(owner);
-        testHook.mintFor(tiersToMint, beneficiary);
-
-        uint256 tokenId = _generateTokenId(1, 1);
-        assertEq(testHook.ownerOf(tokenId), beneficiary, "Beneficiary should own the NFT");
-
-        // Deploy the malicious receiver.
-        MaliciousReceiver malicious = new MaliciousReceiver();
-
-        // Build reentrant calldata: try to call afterPayRecordedWith.
-        uint16[] memory mintIds = new uint16[](1);
-        mintIds[0] = 1;
-
-        bytes[] memory data = new bytes[](1);
-        data[0] = abi.encode(false, mintIds);
-        bytes4[] memory ids = new bytes4[](1);
-        ids[0] = metadataHelper.getId("pay", address(testHook));
-        bytes memory payerMetadata = metadataHelper.createMetadata(ids, data);
-
-        JBAfterPayRecordedContext memory reentrantContext = JBAfterPayRecordedContext({
-            payer: beneficiary,
-            projectId: projectId,
-            rulesetId: 0,
-            amount: JBTokenAmount({
-                token: JBConstants.NATIVE_TOKEN,
-                value: 1 ether,
-                decimals: 18,
-                currency: uint32(uint160(JBConstants.NATIVE_TOKEN))
-            }),
-            forwardedAmount: JBTokenAmount({
-                token: JBConstants.NATIVE_TOKEN,
-                value: 0,
-                decimals: 18,
-                currency: uint32(uint160(JBConstants.NATIVE_TOKEN))
-            }),
-            weight: 10e18,
-            newlyIssuedTokenCount: 0,
-            beneficiary: address(malicious),
-            hookMetadata: bytes(""),
-            payerMetadata: payerMetadata
-        });
-
-        malicious.setReentryTarget(address(testHook), abi.encodeCall(testHook.afterPayRecordedWith, (reentrantContext)));
-
-        // Mock: the malicious receiver is NOT a terminal.
-        vm.mockCall(
-            address(mockJBDirectory),
-            abi.encodeWithSelector(IJBDirectory.isTerminalOf.selector, projectId, address(malicious)),
-            abi.encode(false)
-        );
-
-        // Transfer the NFT to the malicious receiver via safeTransferFrom.
-        vm.prank(beneficiary);
-        testHook.safeTransferFrom(beneficiary, address(malicious), tokenId);
-
-        // Verify the transfer succeeded (state is consistent).
-        assertEq(testHook.ownerOf(tokenId), address(malicious), "Malicious receiver should own the NFT");
-
-        // Verify the reentrancy was attempted but failed.
-        assertTrue(malicious.reentryAttempted(), "Reentrancy should have been attempted");
-        assertFalse(malicious.reentrySucceeded(), "Reentrancy should have failed");
-    }
-
-    // ---------------------------------------------------------------
-    // Test 2: Malicious receiver tries to re-enter adjustTiers
-    // ---------------------------------------------------------------
-    /// @notice A malicious receiver tries to call adjustTiers during onERC721Received.
-    /// The call is blocked by permission checks.
-    function test_safeTransferFrom_maliciousReceiver_cannotReenterAdjustTiers() public {
-        // Set up hook with tiers and mint an NFT.
-        defaultTierConfig.flags.allowOwnerMint = true;
-        defaultTierConfig.reserveFrequency = 0;
-        ForTest_JB721TiersHook testHook = _initializeForTestHook(10);
-
-        // Mint an NFT to the beneficiary.
-        uint16[] memory tiersToMint = new uint16[](1);
-        tiersToMint[0] = 1;
-        vm.prank(owner);
-        testHook.mintFor(tiersToMint, beneficiary);
-
-        uint256 tokenId = _generateTokenId(1, 1);
-
-        // Deploy the malicious receiver that tries to remove tiers.
-        MaliciousReceiver malicious = new MaliciousReceiver();
-
-        // Build reentrant calldata: try to remove tier 1 via adjustTiers.
-        uint256[] memory tierIdsToRemove = new uint256[](1);
-        tierIdsToRemove[0] = 1;
-        malicious.setReentryTarget(
-            address(testHook), abi.encodeCall(testHook.adjustTiers, (new JB721TierConfig[](0), tierIdsToRemove))
-        );
-
-        // Mock: the malicious receiver does NOT have permission.
-        vm.mockCall(mockJBPermissions, abi.encodeWithSelector(IJBPermissions.hasPermission.selector), abi.encode(false));
-
-        // Transfer the NFT.
-        vm.prank(beneficiary);
-        testHook.safeTransferFrom(beneficiary, address(malicious), tokenId);
-
-        // Verify state consistency.
-        assertEq(testHook.ownerOf(tokenId), address(malicious), "Malicious receiver should own the NFT");
-        assertTrue(malicious.reentryAttempted(), "Reentrancy should have been attempted");
-        assertFalse(malicious.reentrySucceeded(), "adjustTiers reentrancy should have failed");
-    }
-
-    // ---------------------------------------------------------------
-    // Test 3: Malicious receiver re-transfers NFT during callback
-    // ---------------------------------------------------------------
-    /// @notice A malicious receiver tries to transfer the NFT it just received to another address
-    /// during onERC721Received. This tests the re-entrant safeTransferFrom scenario.
-    /// Since _update completes BEFORE _checkOnERC721Received is called, state is already settled
-    /// and a re-transfer should succeed with correct state.
-    function test_safeTransferFrom_maliciousReceiver_retransferDuringCallback() public {
-        // Set up hook with tiers and mint an NFT.
-        defaultTierConfig.flags.allowOwnerMint = true;
-        defaultTierConfig.reserveFrequency = 0;
-        ForTest_JB721TiersHook testHook = _initializeForTestHook(10);
-
-        // Mint an NFT to the beneficiary.
-        uint16[] memory tiersToMint = new uint16[](1);
-        tiersToMint[0] = 1;
-        vm.prank(owner);
-        testHook.mintFor(tiersToMint, beneficiary);
-
-        uint256 tokenId = _generateTokenId(1, 1);
-
-        // The final recipient is a simple EOA.
-        address finalRecipient = makeAddr("finalRecipient");
-
-        // Deploy the malicious re-transfer receiver.
-        MaliciousRetransferReceiver malicious = new MaliciousRetransferReceiver(address(testHook), finalRecipient);
-
-        // Transfer to the malicious receiver.
-        vm.prank(beneficiary);
-        testHook.safeTransferFrom(beneficiary, address(malicious), tokenId);
-
-        // The re-transfer should have succeeded (not reverted) because state was fully settled
-        // before onERC721Received was called.
-        assertTrue(malicious.reentryAttempted(), "Re-transfer should have been attempted");
-        assertFalse(malicious.reentryReverted(), "Re-transfer should have succeeded");
-
-        // Verify final state: the finalRecipient should own the NFT.
-        assertEq(testHook.ownerOf(tokenId), finalRecipient, "Final recipient should own the NFT");
-
-        // Verify voting units are tracked correctly after the double transfer.
-        // Beneficiary should have 0, malicious should have 0, finalRecipient should have the tier's balance.
-        IJB721TiersHookStore hookStore = testHook.STORE();
-        assertEq(
-            hookStore.tierBalanceOf(address(testHook), beneficiary, 1), 0, "Beneficiary should have 0 tier balance"
-        );
-        assertEq(
-            hookStore.tierBalanceOf(address(testHook), address(malicious), 1), 0, "Malicious should have 0 tier balance"
-        );
-        assertEq(
-            hookStore.tierBalanceOf(address(testHook), finalRecipient, 1),
-            1,
-            "Final recipient should have 1 tier balance"
-        );
-    }
-
-    // ---------------------------------------------------------------
-    // Test 4: State consistency after safeTransferFrom (no reentrancy)
-    // ---------------------------------------------------------------
-    /// @notice Verifies that a normal safeTransferFrom to a contract receiver keeps
-    /// tier balances, voting units, and firstOwner tracking consistent.
-    function test_safeTransferFrom_normalReceiver_stateConsistent() public {
-        // Set up hook with tiers and mint an NFT.
-        defaultTierConfig.flags.allowOwnerMint = true;
-        defaultTierConfig.reserveFrequency = 0;
-        ForTest_JB721TiersHook testHook = _initializeForTestHook(10);
-
-        // Mint an NFT to the beneficiary.
-        uint16[] memory tiersToMint = new uint16[](1);
-        tiersToMint[0] = 1;
-        vm.prank(owner);
-        testHook.mintFor(tiersToMint, beneficiary);
-
-        uint256 tokenId = _generateTokenId(1, 1);
-
-        // Deploy a clean receiver (no reentrancy).
-        MaliciousReceiver cleanReceiver = new MaliciousReceiver();
-        // Don't set any reentrancy target — it will just accept the NFT.
-
-        IJB721TiersHookStore hookStore = testHook.STORE();
-
-        // Verify pre-transfer state.
-        assertEq(
-            hookStore.tierBalanceOf(address(testHook), beneficiary, 1), 1, "Beneficiary should have 1 NFT pre-xfer"
-        );
-        assertEq(
-            hookStore.tierBalanceOf(address(testHook), address(cleanReceiver), 1),
-            0,
-            "Receiver should have 0 NFTs pre-xfer"
-        );
-
-        // Transfer.
-        vm.prank(beneficiary);
-        testHook.safeTransferFrom(beneficiary, address(cleanReceiver), tokenId);
-
-        // Verify post-transfer state.
-        assertEq(testHook.ownerOf(tokenId), address(cleanReceiver), "Receiver should own the NFT");
-        assertEq(
-            hookStore.tierBalanceOf(address(testHook), beneficiary, 1), 0, "Beneficiary should have 0 NFTs post-xfer"
-        );
-        assertEq(
-            hookStore.tierBalanceOf(address(testHook), address(cleanReceiver), 1),
-            1,
-            "Receiver should have 1 NFT post-xfer"
-        );
-        assertEq(testHook.firstOwnerOf(tokenId), beneficiary, "First owner should still be beneficiary");
-    }
-}