@bananapus/core-v6 0.0.30 → 0.0.32

package/src/libraries/JBSurplus.sol

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity ^0.8.17;
+pragma solidity 0.8.28;
 
 import {IJBTerminal} from "../interfaces/IJBTerminal.sol";
 
@@ -30,10 +30,13 @@ library JBSurplus {
         uint256 numberOfTerminals = terminals.length;
 
         // Add the current surplus for each terminal.
-        for (uint256 i; i < numberOfTerminals; i++) {
+        for (uint256 i; i < numberOfTerminals;) {
             surplus += terminals[i].currentSurplusOf({
                 projectId: projectId, tokens: tokens, decimals: decimals, currency: currency
             });
+            unchecked {
+                ++i;
+            }
         }
     }
 }

package/src/structs/JBSplit.sol

@@ -24,7 +24,10 @@ import {IJBSplitHook} from "./../interfaces/IJBSplitHook.sol";
 /// @custom:member preferAddToBalance If this split were to `pay` a project through its terminal, this flag indicates
 /// whether it should prefer using the terminal's `addToBalance` function instead.
 /// @custom:member lockedUntil The split cannot be changed until this timestamp. The `lockedUntil` timestamp can be
-/// increased while a split is locked. If `lockedUntil` is zero, this split can be changed at any time.
+/// increased while a split is locked. If `lockedUntil` is zero, this split can be changed at any time. This lock is
+/// enforced only when rewriting the same split table. Queueing a successor ruleset with a different `rulesetId` can
+/// still replace future payout behavior before `lockedUntil`, so applications that need cross-ruleset continuity must
+/// preserve those splits at the governance/configuration layer.
 /// @custom:member hook A contract which will receive this split's tokens and properties, and can define custom
 /// behavior.
 // forge-lint: disable-next-line(pascal-case-struct)

package/test/TestForwardedTokenConsumption.sol

@@ -0,0 +1,419 @@
+// SPDX-License-Identifier: MIT
+pragma solidity >=0.8.6;
+
+import {ERC165} from "@openzeppelin/contracts/utils/introspection/ERC165.sol";
+import {IERC165} from "@openzeppelin/contracts/utils/introspection/IERC165.sol";
+
+import {TestBaseWorkflow} from "./helpers/TestBaseWorkflow.sol";
+import {JBMultiTerminal} from "../src/JBMultiTerminal.sol";
+import {IJBController} from "../src/interfaces/IJBController.sol";
+import {IJBCashOutHook} from "../src/interfaces/IJBCashOutHook.sol";
+import {IJBMultiTerminal} from "../src/interfaces/IJBMultiTerminal.sol";
+import {IJBPayHook} from "../src/interfaces/IJBPayHook.sol";
+import {IJBRulesetApprovalHook} from "../src/interfaces/IJBRulesetApprovalHook.sol";
+import {IJBRulesetDataHook} from "../src/interfaces/IJBRulesetDataHook.sol";
+import {IJBSplitHook} from "../src/interfaces/IJBSplitHook.sol";
+import {IJBTokens} from "../src/interfaces/IJBTokens.sol";
+import {JBConstants} from "../src/libraries/JBConstants.sol";
+import {JBAccountingContext} from "../src/structs/JBAccountingContext.sol";
+import {JBAfterCashOutRecordedContext} from "../src/structs/JBAfterCashOutRecordedContext.sol";
+import {JBAfterPayRecordedContext} from "../src/structs/JBAfterPayRecordedContext.sol";
+import {JBCashOutHookSpecification} from "../src/structs/JBCashOutHookSpecification.sol";
+import {JBCurrencyAmount} from "../src/structs/JBCurrencyAmount.sol";
+import {JBFundAccessLimitGroup} from "../src/structs/JBFundAccessLimitGroup.sol";
+import {JBPayHookSpecification} from "../src/structs/JBPayHookSpecification.sol";
+import {JBRulesetConfig} from "../src/structs/JBRulesetConfig.sol";
+import {JBRulesetMetadata} from "../src/structs/JBRulesetMetadata.sol";
+import {JBSplit} from "../src/structs/JBSplit.sol";
+import {JBSplitGroup} from "../src/structs/JBSplitGroup.sol";
+import {JBTerminalConfig} from "../src/structs/JBTerminalConfig.sol";
+
+contract TestForwardedTokenConsumption_Local is TestBaseWorkflow {
+    uint112 private constant _WEIGHT = 1000 * 10 ** 18;
+    uint256 private constant _PAY_AMOUNT = 10 * 10 ** 6;
+    uint256 private constant _HOOK_FORWARD_AMOUNT = 1 * 10 ** 6;
+    uint256 private constant _PAYOUT_AMOUNT = 4 * 10 ** 6;
+    address private constant _DATA_HOOK = address(bytes20(keccak256("datahook")));
+
+    IJBController private _controller;
+    IJBMultiTerminal private _terminal;
+    IJBMultiTerminal private _terminal2;
+    IJBTokens private _tokens;
+    address private _projectOwner;
+
+    uint64 private _projectId;
+
+    function setUp() public override {
+        super.setUp();
+
+        _controller = jbController();
+        _terminal = jbMultiTerminal();
+        _terminal2 = jbMultiTerminal2();
+        _tokens = jbTokens();
+        _projectOwner = multisig();
+
+        // Launch the fee beneficiary project first so project ID 1 has a terminal and accounting context.
+        _launchProject({
+            terminal: _terminal,
+            projectUri: "fee-project",
+            metadata: _metadataWithHooks({useDataHookForPay: true, useDataHookForCashOut: true, dataHook: _DATA_HOOK}),
+            splitGroups: new JBSplitGroup[](0),
+            fundAccessLimitGroups: new JBFundAccessLimitGroup[](0)
+        });
+
+        _projectId = uint64(
+            _launchProject({
+                terminal: _terminal,
+                projectUri: "hook-project",
+                metadata: _metadataWithHooks({
+                    useDataHookForPay: true, useDataHookForCashOut: true, dataHook: _DATA_HOOK
+                }),
+                splitGroups: new JBSplitGroup[](0),
+                fundAccessLimitGroups: new JBFundAccessLimitGroup[](0)
+            })
+        );
+    }
+
+    function test_RevertIfERC20PayHookDoesNotConsumeForwardedTokens() external {
+        NonConsumingPayHook hook = new NonConsumingPayHook();
+        JBPayHookSpecification[] memory specifications = new JBPayHookSpecification[](1);
+        specifications[0] =
+            JBPayHookSpecification({hook: hook, noop: false, amount: _HOOK_FORWARD_AMOUNT, metadata: ""});
+
+        vm.mockCall(
+            _DATA_HOOK,
+            abi.encodeWithSelector(IJBRulesetDataHook.beforePayRecordedWith.selector),
+            abi.encode(_WEIGHT, specifications)
+        );
+
+        vm.prank(multisig());
+        jbFeelessAddresses().setFeelessAddress(address(hook), true);
+
+        address payer = makeAddr("payer");
+        usdcToken().mint(payer, _PAY_AMOUNT);
+        vm.prank(payer);
+        usdcToken().approve(address(_terminal), _PAY_AMOUNT);
+
+        vm.expectRevert(
+            abi.encodeWithSelector(
+                JBMultiTerminal.JBMultiTerminal_TemporaryAllowanceNotConsumed.selector,
+                address(usdcToken()),
+                address(hook),
+                _HOOK_FORWARD_AMOUNT
+            )
+        );
+        vm.prank(payer);
+        _terminal.pay({
+            projectId: _projectId,
+            token: address(usdcToken()),
+            amount: _PAY_AMOUNT,
+            beneficiary: payer,
+            minReturnedTokens: 0,
+            memo: "",
+            metadata: ""
+        });
+    }
+
+    function test_RevertIfERC20CashOutHookDoesNotConsumeForwardedTokens() external {
+        JBPayHookSpecification[] memory emptyPaySpecifications = new JBPayHookSpecification[](0);
+        vm.mockCall(
+            _DATA_HOOK,
+            abi.encodeWithSelector(IJBRulesetDataHook.beforePayRecordedWith.selector),
+            abi.encode(_WEIGHT, emptyPaySpecifications)
+        );
+
+        usdcToken().mint(address(this), _PAY_AMOUNT);
+        usdcToken().approve(address(_terminal), _PAY_AMOUNT);
+
+        _terminal.pay({
+            projectId: _projectId,
+            token: address(usdcToken()),
+            amount: _PAY_AMOUNT,
+            beneficiary: address(this),
+            minReturnedTokens: 0,
+            memo: "",
+            metadata: ""
+        });
+
+        uint256 cashOutCount = _tokens.totalBalanceOf(address(this), _projectId) / 2;
+
+        NonConsumingCashOutHook hook = new NonConsumingCashOutHook();
+        JBCashOutHookSpecification[] memory specifications = new JBCashOutHookSpecification[](1);
+        specifications[0] =
+            JBCashOutHookSpecification({hook: hook, noop: false, amount: _HOOK_FORWARD_AMOUNT, metadata: ""});
+
+        vm.mockCall(
+            _DATA_HOOK,
+            abi.encodeWithSelector(IJBRulesetDataHook.beforeCashOutRecordedWith.selector),
+            abi.encode(0, cashOutCount, _controller.totalTokenSupplyWithReservedTokensOf(_projectId), specifications)
+        );
+
+        vm.prank(multisig());
+        jbFeelessAddresses().setFeelessAddress(address(hook), true);
+
+        vm.expectRevert(
+            abi.encodeWithSelector(
+                JBMultiTerminal.JBMultiTerminal_TemporaryAllowanceNotConsumed.selector,
+                address(usdcToken()),
+                address(hook),
+                _HOOK_FORWARD_AMOUNT
+            )
+        );
+        _terminal.cashOutTokensOf({
+            holder: address(this),
+            projectId: _projectId,
+            cashOutCount: cashOutCount,
+            tokenToReclaim: address(usdcToken()),
+            minTokensReclaimed: 0,
+            beneficiary: payable(address(this)),
+            metadata: ""
+        });
+    }
+
+    function test_SendPayoutsToMultiTerminalAddToBalanceConsumesForwardedAllowance() external {
+        uint256 recipientProjectId = _launchProject({
+            terminal: _terminal2,
+            projectUri: "recipient-add-to-balance",
+            metadata: _metadataWithHooks({
+                useDataHookForPay: false, useDataHookForCashOut: false, dataHook: address(0)
+            }),
+            splitGroups: new JBSplitGroup[](0),
+            fundAccessLimitGroups: new JBFundAccessLimitGroup[](0)
+        });
+
+        uint256 sourceProjectId = _launchProject({
+            terminal: _terminal,
+            projectUri: "source-add-to-balance",
+            metadata: _metadataWithHooks({
+                useDataHookForPay: false, useDataHookForCashOut: false, dataHook: address(0)
+            }),
+            splitGroups: _splitGroupsToProject({targetProjectId: recipientProjectId, preferAddToBalance: true}),
+            fundAccessLimitGroups: _usdcPayoutLimitGroups({terminal: _terminal, payoutAmount: _PAYOUT_AMOUNT})
+        });
+
+        usdcToken().mint(address(this), _PAYOUT_AMOUNT);
+        usdcToken().approve(address(_terminal), _PAYOUT_AMOUNT);
+
+        _terminal.pay({
+            projectId: sourceProjectId,
+            token: address(usdcToken()),
+            amount: _PAYOUT_AMOUNT,
+            beneficiary: address(this),
+            minReturnedTokens: 0,
+            memo: "",
+            metadata: ""
+        });
+
+        uint256 fee = _PAYOUT_AMOUNT * _terminal.FEE() / JBConstants.MAX_FEE;
+        uint256 expectedNetPayout = _PAYOUT_AMOUNT - fee;
+
+        _terminal.sendPayoutsOf({
+            projectId: sourceProjectId,
+            amount: _PAYOUT_AMOUNT,
+            currency: uint32(uint160(address(usdcToken()))),
+            token: address(usdcToken()),
+            minTokensPaidOut: 0
+        });
+
+        assertEq(usdcToken().allowance(address(_terminal), address(_terminal2)), 0);
+        assertEq(jbTerminalStore().balanceOf(address(_terminal), sourceProjectId, address(usdcToken())), fee);
+        assertEq(
+            jbTerminalStore().balanceOf(address(_terminal2), recipientProjectId, address(usdcToken())),
+            expectedNetPayout
+        );
+        assertEq(usdcToken().balanceOf(address(_terminal2)), expectedNetPayout);
+    }
+
+    function test_SendPayoutsToMultiTerminalPayConsumesForwardedAllowance() external {
+        uint256 recipientProjectId = _launchProject({
+            terminal: _terminal2,
+            projectUri: "recipient-pay",
+            metadata: _metadataWithHooks({
+                useDataHookForPay: false, useDataHookForCashOut: false, dataHook: address(0)
+            }),
+            splitGroups: new JBSplitGroup[](0),
+            fundAccessLimitGroups: new JBFundAccessLimitGroup[](0)
+        });
+
+        uint256 sourceProjectId = _launchProject({
+            terminal: _terminal,
+            projectUri: "source-pay",
+            metadata: _metadataWithHooks({
+                useDataHookForPay: false, useDataHookForCashOut: false, dataHook: address(0)
+            }),
+            splitGroups: _splitGroupsToProject({targetProjectId: recipientProjectId, preferAddToBalance: false}),
+            fundAccessLimitGroups: _usdcPayoutLimitGroups({terminal: _terminal, payoutAmount: _PAYOUT_AMOUNT})
+        });
+
+        usdcToken().mint(address(this), _PAYOUT_AMOUNT);
+        usdcToken().approve(address(_terminal), _PAYOUT_AMOUNT);
+
+        _terminal.pay({
+            projectId: sourceProjectId,
+            token: address(usdcToken()),
+            amount: _PAYOUT_AMOUNT,
+            beneficiary: address(this),
+            minReturnedTokens: 0,
+            memo: "",
+            metadata: ""
+        });
+
+        uint256 fee = _PAYOUT_AMOUNT * _terminal.FEE() / JBConstants.MAX_FEE;
+        uint256 expectedNetPayout = _PAYOUT_AMOUNT - fee;
+
+        _terminal.sendPayoutsOf({
+            projectId: sourceProjectId,
+            amount: _PAYOUT_AMOUNT,
+            currency: uint32(uint160(address(usdcToken()))),
+            token: address(usdcToken()),
+            minTokensPaidOut: 0
+        });
+
+        assertEq(usdcToken().allowance(address(_terminal), address(_terminal2)), 0);
+        assertEq(jbTerminalStore().balanceOf(address(_terminal), sourceProjectId, address(usdcToken())), fee);
+        assertEq(
+            jbTerminalStore().balanceOf(address(_terminal2), recipientProjectId, address(usdcToken())),
+            expectedNetPayout
+        );
+        assertEq(usdcToken().balanceOf(address(_terminal2)), expectedNetPayout);
+    }
+
+    function _launchProject(
+        IJBMultiTerminal terminal,
+        string memory projectUri,
+        JBRulesetMetadata memory metadata,
+        JBSplitGroup[] memory splitGroups,
+        JBFundAccessLimitGroup[] memory fundAccessLimitGroups
+    )
+        internal
+        returns (uint256)
+    {
+        JBRulesetConfig[] memory rulesetConfigurations = new JBRulesetConfig[](1);
+        rulesetConfigurations[0].mustStartAtOrAfter = 0;
+        rulesetConfigurations[0].duration = 0;
+        rulesetConfigurations[0].weight = _WEIGHT;
+        rulesetConfigurations[0].weightCutPercent = 0;
+        rulesetConfigurations[0].approvalHook = IJBRulesetApprovalHook(address(0));
+        rulesetConfigurations[0].metadata = metadata;
+        rulesetConfigurations[0].splitGroups = splitGroups;
+        rulesetConfigurations[0].fundAccessLimitGroups = fundAccessLimitGroups;
+
+        JBTerminalConfig[] memory terminalConfigurations = new JBTerminalConfig[](1);
+        terminalConfigurations[0] =
+            JBTerminalConfig({terminal: terminal, accountingContextsToAccept: _usdcAccountingContexts()});
+
+        return _controller.launchProjectFor({
+            owner: _projectOwner,
+            projectUri: projectUri,
+            rulesetConfigurations: rulesetConfigurations,
+            terminalConfigurations: terminalConfigurations,
+            memo: ""
+        });
+    }
+
+    function _metadataWithHooks(
+        bool useDataHookForPay,
+        bool useDataHookForCashOut,
+        address dataHook
+    )
+        internal
+        view
+        returns (JBRulesetMetadata memory)
+    {
+        return JBRulesetMetadata({
+            reservedPercent: 0,
+            cashOutTaxRate: 0,
+            baseCurrency: uint32(uint160(address(usdcToken()))),
+            pausePay: false,
+            pauseCreditTransfers: false,
+            allowOwnerMinting: false,
+            allowSetCustomToken: false,
+            allowTerminalMigration: false,
+            allowSetTerminals: false,
+            ownerMustSendPayouts: false,
+            allowSetController: false,
+            allowAddAccountingContext: true,
+            allowAddPriceFeed: false,
+            holdFees: false,
+            useTotalSurplusForCashOuts: false,
+            useDataHookForPay: useDataHookForPay,
+            useDataHookForCashOut: useDataHookForCashOut,
+            dataHook: dataHook,
+            metadata: 0
+        });
+    }
+
+    function _splitGroupsToProject(
+        uint256 targetProjectId,
+        bool preferAddToBalance
+    )
+        internal
+        view
+        returns (JBSplitGroup[] memory)
+    {
+        JBSplit[] memory splits = new JBSplit[](1);
+        splits[0].percent = uint32(JBConstants.SPLITS_TOTAL_PERCENT);
+        // forge-lint: disable-next-line(unsafe-typecast)
+        splits[0].projectId = uint64(targetProjectId);
+        splits[0].beneficiary = payable(address(0));
+        splits[0].preferAddToBalance = preferAddToBalance;
+        splits[0].lockedUntil = 0;
+        splits[0].hook = IJBSplitHook(address(0));
+
+        JBSplitGroup[] memory splitGroups = new JBSplitGroup[](1);
+        splitGroups[0] = JBSplitGroup({groupId: uint256(uint160(address(usdcToken()))), splits: splits});
+
+        return splitGroups;
+    }
+
+    function _usdcAccountingContexts() internal view returns (JBAccountingContext[] memory) {
+        JBAccountingContext[] memory accountingContexts = new JBAccountingContext[](1);
+        accountingContexts[0] = JBAccountingContext({
+            token: address(usdcToken()),
+            decimals: usdcToken().decimals(),
+            currency: uint32(uint160(address(usdcToken())))
+        });
+
+        return accountingContexts;
+    }
+
+    function _usdcPayoutLimitGroups(
+        IJBMultiTerminal terminal,
+        uint256 payoutAmount
+    )
+        internal
+        view
+        returns (JBFundAccessLimitGroup[] memory)
+    {
+        JBCurrencyAmount[] memory payoutLimits = new JBCurrencyAmount[](1);
+        // forge-lint: disable-next-line(unsafe-typecast)
+        payoutLimits[0] =
+            JBCurrencyAmount({amount: uint224(payoutAmount), currency: uint32(uint160(address(usdcToken())))});
+
+        JBFundAccessLimitGroup[] memory fundAccessLimitGroups = new JBFundAccessLimitGroup[](1);
+        fundAccessLimitGroups[0] = JBFundAccessLimitGroup({
+            terminal: address(terminal),
+            token: address(usdcToken()),
+            payoutLimits: payoutLimits,
+            surplusAllowances: new JBCurrencyAmount[](0)
+        });
+
+        return fundAccessLimitGroups;
+    }
+}
+
+contract NonConsumingPayHook is ERC165, IJBPayHook {
+    function afterPayRecordedWith(JBAfterPayRecordedContext calldata) external payable override {}
+
+    function supportsInterface(bytes4 interfaceId) public view override(ERC165, IERC165) returns (bool) {
+        return interfaceId == type(IJBPayHook).interfaceId || super.supportsInterface(interfaceId);
+    }
+}
+
+contract NonConsumingCashOutHook is ERC165, IJBCashOutHook {
+    function afterCashOutRecordedWith(JBAfterCashOutRecordedContext calldata) external payable override {}
+
+    function supportsInterface(bytes4 interfaceId) public view override(ERC165, IERC165) returns (bool) {
+        return interfaceId == type(IJBCashOutHook).interfaceId || super.supportsInterface(interfaceId);
+    }
+}

package/test/audit/CrossTerminalSurplusSpoof.t.sol

@@ -0,0 +1,140 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.6;
+
+import {TestBaseWorkflow} from "../helpers/TestBaseWorkflow.sol";
+import {IJBController} from "../../src/interfaces/IJBController.sol";
+import {IJBDirectory} from "../../src/interfaces/IJBDirectory.sol";
+import {IJBTerminal} from "../../src/interfaces/IJBTerminal.sol";
+import {JBMultiTerminal} from "../../src/JBMultiTerminal.sol";
+import {JBConstants} from "../../src/libraries/JBConstants.sol";
+import {JBAccountingContext} from "../../src/structs/JBAccountingContext.sol";
+import {JBFundAccessLimitGroup} from "../../src/structs/JBFundAccessLimitGroup.sol";
+import {JBRulesetConfig} from "../../src/structs/JBRulesetConfig.sol";
+import {JBRulesetMetadata} from "../../src/structs/JBRulesetMetadata.sol";
+import {JBSplitGroup} from "../../src/structs/JBSplitGroup.sol";
+import {JBTerminalConfig} from "../../src/structs/JBTerminalConfig.sol";
+import {IJBRulesetApprovalHook} from "../../src/interfaces/IJBRulesetApprovalHook.sol";
+
+/// @notice Verifies that `useTotalSurplusForCashOuts` trusts every terminal in the directory,
+/// even though settlement still comes from the specific terminal the holder cashes out through.
+contract CrossTerminalSurplusSpoof_Local is TestBaseWorkflow {
+    IJBController private _controller;
+    IJBDirectory private _directory;
+    JBMultiTerminal private _terminal;
+    address private _projectOwner;
+    address private _holder;
+    uint32 private _nativeCurrency;
+    uint256 private _projectId;
+
+    function setUp() public override {
+        super.setUp();
+
+        _controller = jbController();
+        _directory = jbDirectory();
+        _terminal = jbMultiTerminal();
+        _projectOwner = multisig();
+        _holder = beneficiary();
+        _nativeCurrency = uint32(uint160(JBConstants.NATIVE_TOKEN));
+
+        JBRulesetMetadata memory metadata = JBRulesetMetadata({
+            reservedPercent: 0,
+            cashOutTaxRate: 0,
+            baseCurrency: _nativeCurrency,
+            pausePay: false,
+            pauseCreditTransfers: false,
+            allowOwnerMinting: true,
+            allowSetCustomToken: true,
+            allowTerminalMigration: false,
+            allowSetTerminals: true,
+            allowSetController: false,
+            allowAddAccountingContext: true,
+            allowAddPriceFeed: false,
+            ownerMustSendPayouts: false,
+            holdFees: false,
+            useTotalSurplusForCashOuts: true,
+            useDataHookForPay: false,
+            useDataHookForCashOut: false,
+            dataHook: address(0),
+            metadata: 0
+        });
+
+        JBRulesetConfig[] memory rulesetConfigs = new JBRulesetConfig[](1);
+        rulesetConfigs[0] = JBRulesetConfig({
+            mustStartAtOrAfter: 0,
+            duration: 0,
+            weight: 1000e18,
+            weightCutPercent: 0,
+            approvalHook: IJBRulesetApprovalHook(address(0)),
+            metadata: metadata,
+            splitGroups: new JBSplitGroup[](0),
+            fundAccessLimitGroups: new JBFundAccessLimitGroup[](0)
+        });
+
+        JBAccountingContext[] memory contexts = new JBAccountingContext[](1);
+        contexts[0] = JBAccountingContext({token: JBConstants.NATIVE_TOKEN, decimals: 18, currency: _nativeCurrency});
+
+        JBTerminalConfig[] memory terminalConfigs = new JBTerminalConfig[](1);
+        terminalConfigs[0] = JBTerminalConfig({terminal: _terminal, accountingContextsToAccept: contexts});
+
+        _projectId = _controller.launchProjectFor({
+            owner: _projectOwner,
+            projectUri: "spoofed-surplus",
+            rulesetConfigurations: rulesetConfigs,
+            terminalConfigurations: terminalConfigs,
+            memo: ""
+        });
+    }
+
+    function test_partialCashOutCanDrainLocalTerminalUsingSpoofedSiblingSurplus() external {
+        vm.deal(_holder, 1 ether);
+
+        vm.prank(_holder);
+        uint256 minted = _terminal.pay{value: 1 ether}({
+            projectId: _projectId,
+            token: JBConstants.NATIVE_TOKEN,
+            amount: 1 ether,
+            beneficiary: _holder,
+            minReturnedTokens: 0,
+            memo: "",
+            metadata: ""
+        });
+
+        assertEq(address(_terminal).balance, 1 ether, "terminal should hold the paid ETH");
+
+        address spoofedTerminal = makeAddr("spoofedTerminal");
+        IJBTerminal[] memory terminals = new IJBTerminal[](2);
+        terminals[0] = IJBTerminal(address(_terminal));
+        terminals[1] = IJBTerminal(spoofedTerminal);
+
+        vm.prank(_projectOwner);
+        _directory.setTerminalsOf(_projectId, terminals);
+
+        vm.mockCall(
+            spoofedTerminal,
+            abi.encodeCall(IJBTerminal.currentSurplusOf, (_projectId, new address[](0), 18, _nativeCurrency)),
+            abi.encode(1 ether)
+        );
+
+        uint256 holderBalanceBefore = _holder.balance;
+
+        vm.prank(_holder);
+        uint256 reclaimed = _terminal.cashOutTokensOf({
+            holder: _holder,
+            projectId: _projectId,
+            cashOutCount: minted / 2,
+            tokenToReclaim: JBConstants.NATIVE_TOKEN,
+            minTokensReclaimed: 0,
+            beneficiary: payable(_holder),
+            metadata: new bytes(0)
+        });
+
+        assertEq(reclaimed, 1 ether, "spoofed global surplus should let a half burn reclaim the full local balance");
+        assertEq(_holder.balance - holderBalanceBefore, 1 ether, "holder should receive the full terminal balance");
+        assertEq(address(_terminal).balance, 0, "the honest terminal should be fully drained");
+        assertEq(
+            jbTokens().totalBalanceOf(_holder, _projectId),
+            minted / 2,
+            "the holder should keep half their project tokens after draining the terminal"
+        );
+    }
+}