@bananapus/core-v6 0.0.16 → 0.0.17

package/test/units/static/JBSplits/TestSelfManagedSplitGroups.sol

@@ -57,9 +57,9 @@ contract TestSelfManagedSplitGroups_Local is JBSplitsSetup {
     // ──────────────────
 
     function test_CallerCanSetSplitsInOwnGroupNamespace() external {
-        // Any contract can set splits when groupId's lower 160 bits == msg.sender.
+        // Self-auth requires non-zero upper 96 bits + lower 160 bits == msg.sender.
         address caller = makeAddr("hookContract");
-        uint256 groupId = uint256(uint160(caller));
+        uint256 groupId = (1 << 160) | uint256(uint160(caller));
 
         JBSplitGroup[] memory groups = _makeSplitGroup(groupId, JBConstants.SPLITS_TOTAL_PERCENT / 2, _bene);
 
@@ -121,7 +121,7 @@ contract TestSelfManagedSplitGroups_Local is JBSplitsSetup {
     function test_CallerCanSetMultipleSplitsInOwnGroup() external {
         // Multiple splits in the same self-managed group.
         address caller = makeAddr("hookContract");
-        uint256 groupId = uint256(uint160(caller));
+        uint256 groupId = (1 << 160) | uint256(uint160(caller));
 
         address payable bene1 = payable(makeAddr("bene1"));
         address payable bene2 = payable(makeAddr("bene2"));
@@ -158,7 +158,7 @@ contract TestSelfManagedSplitGroups_Local is JBSplitsSetup {
     function test_CallerCanOverwriteOwnSplits() external {
         // Caller can overwrite their own splits.
         address caller = makeAddr("hookContract");
-        uint256 groupId = uint256(uint160(caller));
+        uint256 groupId = (1 << 160) | uint256(uint160(caller));
 
         address payable beneOld = payable(makeAddr("beneOld"));
         address payable beneNew = payable(makeAddr("beneNew"));
@@ -183,7 +183,7 @@ contract TestSelfManagedSplitGroups_Local is JBSplitsSetup {
     function test_SelfManagedSplitsEmitSetSplitEvent() external {
         // Setting self-managed splits emits SetSplit with correct caller.
         address caller = makeAddr("hookContract");
-        uint256 groupId = uint256(uint160(caller));
+        uint256 groupId = (1 << 160) | uint256(uint160(caller));
 
         JBSplitGroup[] memory groups = _makeSplitGroup(groupId, JBConstants.SPLITS_TOTAL_PERCENT, _bene);
 
@@ -197,7 +197,7 @@ contract TestSelfManagedSplitGroups_Local is JBSplitsSetup {
     function test_SelfManagedSplitsWorkAcrossRulesets() external {
         // Caller can set splits in the same group but different rulesets.
         address caller = makeAddr("hookContract");
-        uint256 groupId = uint256(uint160(caller));
+        uint256 groupId = (1 << 160) | uint256(uint160(caller));
 
         uint256 rulesetA = 100;
         uint256 rulesetB = 200;
@@ -227,7 +227,7 @@ contract TestSelfManagedSplitGroups_Local is JBSplitsSetup {
 
     function test_SelfManagedSplitsRevertOnZeroPercent() external {
         address caller = makeAddr("hookContract");
-        uint256 groupId = uint256(uint160(caller));
+        uint256 groupId = (1 << 160) | uint256(uint160(caller));
 
         JBSplitGroup[] memory groups = new JBSplitGroup[](1);
         JBSplit[] memory splits = new JBSplit[](1);
@@ -248,7 +248,7 @@ contract TestSelfManagedSplitGroups_Local is JBSplitsSetup {
 
     function test_SelfManagedSplitsRevertOnExcessPercent() external {
         address caller = makeAddr("hookContract");
-        uint256 groupId = uint256(uint160(caller));
+        uint256 groupId = (1 << 160) | uint256(uint160(caller));
 
         JBSplitGroup[] memory groups = new JBSplitGroup[](1);
         JBSplit[] memory splits = new JBSplit[](2);
@@ -278,7 +278,7 @@ contract TestSelfManagedSplitGroups_Local is JBSplitsSetup {
     function test_SelfManagedSplitsEnforceLocks() external {
         // Locked splits in a self-managed group cannot be removed.
         address caller = makeAddr("hookContract");
-        uint256 groupId = uint256(uint160(caller));
+        uint256 groupId = (1 << 160) | uint256(uint160(caller));
 
         // Set a locked split.
         JBSplitGroup[] memory groups = new JBSplitGroup[](1);
@@ -357,6 +357,46 @@ contract TestSelfManagedSplitGroups_Local is JBSplitsSetup {
         _splits.setSplitGroupsOf(_projectId, _rulesetId, groups);
     }
 
+    // ──────────────── Bare-address groupIds require controller auth
+    // ───────────────
+
+    function test_BareAddressGroupIdRequiresControllerEvenForMatchingSender() external {
+        // A contract cannot self-auth for groupId == uint256(uint160(self)) (upper 96 bits = 0).
+        // This prevents token contracts from hijacking terminal payout splits.
+        address caller = makeAddr("maliciousToken");
+        uint256 groupId = uint256(uint160(caller)); // bare address, upper bits = 0
+
+        JBSplitGroup[] memory groups = _makeSplitGroup(groupId, JBConstants.SPLITS_TOTAL_PERCENT, _bene);
+
+        _mockController(makeAddr("realController"));
+
+        vm.prank(caller);
+        vm.expectRevert(
+            abi.encodeWithSelector(
+                JBControlled.JBControlled_ControllerUnauthorized.selector, makeAddr("realController")
+            )
+        );
+        _splits.setSplitGroupsOf(_projectId, _rulesetId, groups);
+    }
+
+    function test_BareAddressGroupIdSucceedsWithControllerAuth() external {
+        // The controller CAN still set splits for bare-address groupIds (terminal payout groups).
+        address controller = makeAddr("controller");
+        address token = makeAddr("someToken");
+        uint256 groupId = uint256(uint160(token));
+
+        JBSplitGroup[] memory groups = _makeSplitGroup(groupId, JBConstants.SPLITS_TOTAL_PERCENT, _bene);
+
+        _mockController(controller);
+
+        vm.prank(controller);
+        _splits.setSplitGroupsOf(_projectId, _rulesetId, groups);
+
+        JBSplit[] memory result = _splits.splitsOf(_projectId, _rulesetId, groupId);
+        assertEq(result.length, 1);
+        assertEq(result[0].beneficiary, _bene);
+    }
+
     // ───────────────────── Controller can still set any group
     // ──────────────────
 
@@ -382,9 +422,10 @@ contract TestSelfManagedSplitGroups_Local is JBSplitsSetup {
     // ─────────────────────────────
 
     function test_MixedSelfManagedAndControllerGroupsInOneCall() external {
-        // A single setSplitGroupsOf call with one self-managed group and one controller-gated group.
+        // A single setSplitGroupsOf call with one self-managed group (non-zero upper bits) and one controller-gated
+        // group.
         address caller = makeAddr("hookContract");
-        uint256 selfGroupId = uint256(uint160(caller));
+        uint256 selfGroupId = (1 << 160) | uint256(uint160(caller));
         uint256 otherGroupId = 0;
 
         // Mock: caller IS the controller.
@@ -427,7 +468,7 @@ contract TestSelfManagedSplitGroups_Local is JBSplitsSetup {
     function test_MixedCallRevertsIfNonControllerSetsOtherGroup() external {
         // A call with one self-managed group (ok) and one non-owned group (reverts) in the same call.
         address caller = makeAddr("hookContract");
-        uint256 selfGroupId = uint256(uint160(caller));
+        uint256 selfGroupId = (1 << 160) | uint256(uint160(caller));
         uint256 otherGroupId = 0;
 
         _mockController(makeAddr("realController"));
@@ -472,6 +513,8 @@ contract TestSelfManagedSplitGroups_Local is JBSplitsSetup {
     function testFuzz_AnyAddressCanSetOwnNamespace(address caller, uint96 upperBits, uint32 percent) external {
         vm.assume(caller != address(0));
         vm.assume(percent > 0 && percent <= JBConstants.SPLITS_TOTAL_PERCENT);
+        // Self-auth requires non-zero upper bits.
+        vm.assume(upperBits > 0);
 
         uint256 groupId = (uint256(upperBits) << 160) | uint256(uint160(caller));
 

package/test/units/static/JBTerminalStore/TestRecordCashOutsFor.sol

@@ -336,6 +336,7 @@ contract TestRecordCashOutsFor_Local is JBTerminalStoreSetup {
             cashOutCount: _cashOutCount,
             accountingContext: _accountingContexts,
             balanceAccountingContexts: _balanceContexts,
+            beneficiaryIsFeeless: false,
             metadata: ""
         });
     }
@@ -369,6 +370,7 @@ contract TestRecordCashOutsFor_Local is JBTerminalStoreSetup {
             cashOutCount: _cashOutCount,
             accountingContext: _accountingContexts,
             balanceAccountingContexts: _balanceContexts,
+            beneficiaryIsFeeless: false,
             metadata: ""
         });
 
@@ -420,6 +422,7 @@ contract TestRecordCashOutsFor_Local is JBTerminalStoreSetup {
             surplus: _reclaimedTokenAmount,
             useTotalSurplus: true,
             cashOutTaxRate: 0,
+            beneficiaryIsFeeless: false,
             metadata: ""
         });
 
@@ -442,6 +445,7 @@ contract TestRecordCashOutsFor_Local is JBTerminalStoreSetup {
             cashOutCount: _cashOutCount,
             accountingContext: _accountingContexts,
             balanceAccountingContexts: _balanceContexts,
+            beneficiaryIsFeeless: false,
             metadata: ""
         });
 
@@ -487,10 +491,78 @@ contract TestRecordCashOutsFor_Local is JBTerminalStoreSetup {
             cashOutCount: _cashOutCount,
             accountingContext: _accountingContexts,
             balanceAccountingContexts: _balanceContexts,
+            beneficiaryIsFeeless: false,
             metadata: ""
         });
     }
 
+    function test_GivenBeneficiaryIsFeeless_DataHookReceivesTrue()
+        external
+        whenCurrentRulesetUseTotalSurplusForCashOutsEqTrueWithHook
+    {
+        // it will pass beneficiaryIsFeeless=true through to the data hook context
+
+        // mock JBController totalTokenSupplyWithReservedTokensOf
+        mockExpect(
+            address(_controller),
+            abi.encodeCall(IJBController.totalTokenSupplyWithReservedTokensOf, (_projectId)),
+            abi.encode(_totalSupply)
+        );
+
+        // call params
+        JBAccountingContext memory _accountingContexts =
+            JBAccountingContext({token: address(_token), decimals: 18, currency: _currency});
+        JBAccountingContext[] memory _balanceContexts = new JBAccountingContext[](1);
+
+        _balanceContexts[0] = JBAccountingContext({token: address(_token), decimals: 18, currency: _currency});
+
+        uint256 _cashOutCount = 1e18;
+        uint256 expectedCashOuts = mulDiv(3e18, _cashOutCount, _totalSupply);
+
+        // Create the expected context — beneficiaryIsFeeless should be true.
+        JBBeforeCashOutRecordedContext memory _context = JBBeforeCashOutRecordedContext({
+            terminal: address(this),
+            holder: address(this),
+            projectId: _projectId,
+            rulesetId: uint48(block.timestamp),
+            cashOutCount: _cashOutCount,
+            totalSupply: _totalSupply,
+            surplus: JBTokenAmount({
+                token: _accountingContexts.token,
+                value: 3e18,
+                decimals: _accountingContexts.decimals,
+                currency: _accountingContexts.currency
+            }),
+            useTotalSurplus: true,
+            cashOutTaxRate: 0,
+            beneficiaryIsFeeless: true,
+            metadata: ""
+        });
+
+        // return data
+        JBCashOutHookSpecification[] memory _spec = new JBCashOutHookSpecification[](1);
+        _spec[0] = JBCashOutHookSpecification({hook: _cashOutHook, amount: 0, metadata: ""});
+
+        // The mock will only match if the context has beneficiaryIsFeeless=true.
+        mockExpect(
+            address(_dataHook),
+            abi.encodeCall(IJBRulesetDataHook.beforeCashOutRecordedWith, (_context)),
+            abi.encode(0, 1e18, _totalSupply, _spec)
+        );
+
+        (, uint256 reclaimed,,) = _store.recordCashOutFor({
+            holder: address(this),
+            projectId: _projectId,
+            cashOutCount: _cashOutCount,
+            accountingContext: _accountingContexts,
+            balanceAccountingContexts: _balanceContexts,
+            beneficiaryIsFeeless: true,
+            metadata: ""
+        });
+
+        assertEq(expectedCashOuts, reclaimed);
+    }
+
     // Probably unnecessary even though it may give us a bit of cov %.. skipping for now
     /* function test_WhenTheCurrentRulesetUseTotalSurplusForCashOutsEqFalse() external {
         // it will use the standard surplus calculation