@bananapus/core-v6 0.0.36 → 0.0.37

package/RISKS.md

@@ -44,7 +44,7 @@ This file covers the main accounting, permission, and liveness risks in the core
 
 ### Weight Decay
 
-- **Stale weight cache can block a project.** Short-duration rulesets with nonzero `weightCutPercent` can hit `WeightCacheRequired` after enough cycles.
+- **Stale weight cache can block a project.** Short-duration rulesets with nonzero `weightCutPercent` can hit `WeightCacheRequired` after 20,000 elapsed cycles (`_WEIGHT_CUT_MULTIPLE_CACHE_LOOKUP_THRESHOLD`). Projects approaching this limit must call `updateRulesetWeightCache()` to pre-cache decayed weights.
 - **Weight-cache correctness matters more than overflow.** Overflow is already bounded at queue time. The real risk is stale or wrongly-updated cache state.
 
 ### Surplus Manipulation

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bananapus/core-v6",
-  "version": "0.0.36",
+  "version": "0.0.37",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -26,7 +26,7 @@
     "artifacts": "source ./.env && npx sphinx artifacts --org-id 'ea165b21-7cdc-4d7b-be59-ecdd4c26bee4' --project-name 'nana-core-v6'"
   },
   "dependencies": {
-    "@bananapus/permission-ids-v6": "^0.0.17",
+    "@bananapus/permission-ids-v6": "^0.0.19",
     "@chainlink/contracts": "^1.5.0",
     "@openzeppelin/contracts": "^5.6.1",
     "@prb/math": "^4.1.1",

package/src/JBController.sol

@@ -525,6 +525,10 @@ contract JBController is JBPermissioned, ERC2771Context, IJBController, IJBMigra
         // Cache common values used in both permission checks.
         address sender = _msgSender();
         bool senderIsTerminal = _isTerminalOf(projectId, sender);
+        bool senderIsTerminalOrDataHook = senderIsTerminal || sender == ruleset.dataHook();
+        // Only query the data hook if the sender isn't already a terminal or the data hook itself.
+        bool senderHasDataHookMintPermission =
+            !senderIsTerminalOrDataHook && _hasDataHookMintPermissionFor(projectId, ruleset, sender);
 
         // Minting is restricted to: the project's owner, addresses with permission to `MINT_TOKENS`, the project's
         // terminals, and the project's data hook.
@@ -532,15 +536,14 @@ contract JBController is JBPermissioned, ERC2771Context, IJBController, IJBMigra
             account: PROJECTS.ownerOf(projectId),
             projectId: projectId,
             permissionId: JBPermissionIds.MINT_TOKENS,
-            alsoGrantAccessIf: senderIsTerminal || sender == ruleset.dataHook()
-                || _hasDataHookMintPermissionFor(projectId, ruleset, sender)
+            alsoGrantAccessIf: senderIsTerminalOrDataHook || senderHasDataHookMintPermission
         });
 
         // If the message sender is not the project's terminal or data hook, the ruleset must have `allowOwnerMinting`
         // set to `true`.
         if (
-            ruleset.id != 0 && !ruleset.allowOwnerMinting() && !senderIsTerminal && sender != ruleset.dataHook()
-                && !_hasDataHookMintPermissionFor(projectId, ruleset, sender)
+            ruleset.id != 0 && !ruleset.allowOwnerMinting() && !senderIsTerminalOrDataHook
+                && !senderHasDataHookMintPermission
         ) {
             revert JBController_MintNotAllowedAndNotTerminalOrHook(sender);
         }

package/src/JBMultiTerminal.sol

@@ -1150,20 +1150,24 @@ contract JBMultiTerminal is JBPermissioned, ERC2771Context, IJBMultiTerminal {
         // Cache whether the beneficiary is feeless.
         bool beneficiaryIsFeeless = _isFeeless(beneficiary);
 
-        // Record the cash out.
-        (ruleset, reclaimAmount, cashOutTaxRate, hookSpecifications) = STORE.recordCashOutFor({
-            holder: holder,
-            projectId: projectId,
-            cashOutCount: cashOutCount,
-            tokenToReclaim: tokenToReclaim,
-            beneficiaryIsFeeless: beneficiaryIsFeeless,
-            metadata: metadata
-        });
+        {
+            // Cache the controller to avoid a redundant external call (also used inside STORE.recordCashOutFor).
+            IJBController controller = _controllerOf(projectId);
+
+            // Record the cash out.
+            (ruleset, reclaimAmount, cashOutTaxRate, hookSpecifications) = STORE.recordCashOutFor({
+                holder: holder,
+                projectId: projectId,
+                cashOutCount: cashOutCount,
+                tokenToReclaim: tokenToReclaim,
+                beneficiaryIsFeeless: beneficiaryIsFeeless,
+                metadata: metadata
+            });
 
-        // Burn the project tokens.
-        if (cashOutCount != 0) {
-            _controllerOf(projectId)
-                .burnTokensOf({holder: holder, projectId: projectId, tokenCount: cashOutCount, memo: ""});
+            // Burn the project tokens.
+            if (cashOutCount != 0) {
+                controller.burnTokensOf({holder: holder, projectId: projectId, tokenCount: cashOutCount, memo: ""});
+            }
         }
 
         // Keep a reference to the amount being reclaimed that is subject to fees.

package/test/audit/CodexMigrationFeeFailure.t.sol

@@ -0,0 +1,163 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.6;
+
+import {TestBaseWorkflow} from "../helpers/TestBaseWorkflow.sol";
+import {JBMultiTerminal} from "../../src/JBMultiTerminal.sol";
+import {JBDirectory} from "../../src/JBDirectory.sol";
+import {JBTerminalStore} from "../../src/JBTerminalStore.sol";
+import {IJBController} from "../../src/interfaces/IJBController.sol";
+import {IJBTerminal} from "../../src/interfaces/IJBTerminal.sol";
+import {IJBRulesetApprovalHook} from "../../src/interfaces/IJBRulesetApprovalHook.sol";
+import {JBConstants} from "../../src/libraries/JBConstants.sol";
+import {JBFees} from "../../src/libraries/JBFees.sol";
+import {JBAccountingContext} from "../../src/structs/JBAccountingContext.sol";
+import {JBCurrencyAmount} from "../../src/structs/JBCurrencyAmount.sol";
+import {JBFundAccessLimitGroup} from "../../src/structs/JBFundAccessLimitGroup.sol";
+import {JBRulesetConfig} from "../../src/structs/JBRulesetConfig.sol";
+import {JBRulesetMetadata} from "../../src/structs/JBRulesetMetadata.sol";
+import {JBSplitGroup} from "../../src/structs/JBSplitGroup.sol";
+import {JBTerminalConfig} from "../../src/structs/JBTerminalConfig.sol";
+
+contract CodexMigrationFeeFailure is TestBaseWorkflow {
+    IJBController private _controller;
+    JBDirectory private _directory;
+    JBTerminalStore private _store;
+    JBMultiTerminal private _terminalA;
+    JBMultiTerminal private _terminalB;
+
+    address private _feeProjectOwner = address(420);
+    address private _projectOwner;
+    address private _payer;
+    uint256 private _projectId;
+
+    function setUp() public override {
+        super.setUp();
+
+        _controller = jbController();
+        _directory = jbDirectory();
+        _store = jbTerminalStore();
+        _terminalA = jbMultiTerminal();
+        _terminalB = jbMultiTerminal2();
+        _projectOwner = multisig();
+        _payer = beneficiary();
+
+        JBRulesetMetadata memory metadata = JBRulesetMetadata({
+            reservedPercent: 0,
+            cashOutTaxRate: 0,
+            baseCurrency: uint32(uint160(JBConstants.NATIVE_TOKEN)),
+            pausePay: false,
+            pauseCreditTransfers: false,
+            allowOwnerMinting: false,
+            allowSetCustomToken: false,
+            allowTerminalMigration: true,
+            allowSetTerminals: true,
+            allowSetController: false,
+            allowAddAccountingContext: false,
+            allowAddPriceFeed: false,
+            ownerMustSendPayouts: false,
+            holdFees: false,
+            useTotalSurplusForCashOuts: false,
+            useDataHookForPay: false,
+            useDataHookForCashOut: false,
+            dataHook: address(0),
+            metadata: 0
+        });
+
+        JBRulesetConfig[] memory rulesetConfig = new JBRulesetConfig[](1);
+        rulesetConfig[0].mustStartAtOrAfter = 0;
+        rulesetConfig[0].duration = 0;
+        rulesetConfig[0].weight = 1000 * 10 ** 18;
+        rulesetConfig[0].weightCutPercent = 0;
+        rulesetConfig[0].approvalHook = IJBRulesetApprovalHook(address(0));
+        rulesetConfig[0].metadata = metadata;
+        rulesetConfig[0].splitGroups = new JBSplitGroup[](0);
+        rulesetConfig[0].fundAccessLimitGroups = new JBFundAccessLimitGroup[](0);
+
+        JBAccountingContext[] memory contexts = new JBAccountingContext[](1);
+        contexts[0] = JBAccountingContext({
+            token: JBConstants.NATIVE_TOKEN, decimals: 18, currency: uint32(uint160(JBConstants.NATIVE_TOKEN))
+        });
+
+        JBTerminalConfig[] memory feeTerminalConfigs = new JBTerminalConfig[](1);
+        feeTerminalConfigs[0] = JBTerminalConfig({terminal: _terminalA, accountingContextsToAccept: contexts});
+
+        JBTerminalConfig[] memory projectTerminalConfigs = new JBTerminalConfig[](2);
+        projectTerminalConfigs[0] = JBTerminalConfig({terminal: _terminalA, accountingContextsToAccept: contexts});
+        projectTerminalConfigs[1] = JBTerminalConfig({terminal: _terminalB, accountingContextsToAccept: contexts});
+
+        _controller.launchProjectFor({
+            owner: _feeProjectOwner,
+            projectUri: "fee-project",
+            rulesetConfigurations: rulesetConfig,
+            terminalConfigurations: feeTerminalConfigs,
+            memo: ""
+        });
+
+        _projectId = _controller.launchProjectFor({
+            owner: _projectOwner,
+            projectUri: "migrating-project",
+            rulesetConfigurations: rulesetConfig,
+            terminalConfigurations: projectTerminalConfigs,
+            memo: ""
+        });
+    }
+
+    function test_migrationFeeFailure_strandsForgivenFeeAndChargesItAgainOnCleanup() external {
+        uint256 payAmount = 10 ether;
+        uint256 expectedFee = JBFees.feeAmountFrom({amountBeforeFee: payAmount, feePercent: _terminalA.FEE()});
+
+        vm.deal(_payer, payAmount);
+        vm.prank(_payer);
+        _terminalA.pay{value: payAmount}(_projectId, JBConstants.NATIVE_TOKEN, payAmount, _payer, 0, "", "");
+
+        // Break fee routing by removing every terminal from fee project #1.
+        vm.prank(_feeProjectOwner);
+        _directory.setTerminalsOf(1, new IJBTerminal[](0));
+
+        vm.prank(_projectOwner);
+        _terminalA.migrateBalanceOf(_projectId, JBConstants.NATIVE_TOKEN, _terminalB);
+
+        // The failed fee is credited back on terminal A instead of migrating with the project.
+        assertEq(
+            _store.balanceOf(address(_terminalA), _projectId, JBConstants.NATIVE_TOKEN),
+            expectedFee,
+            "failed migration fee remains on the source terminal"
+        );
+        assertEq(
+            _store.balanceOf(address(_terminalB), _projectId, JBConstants.NATIVE_TOKEN),
+            payAmount - expectedFee,
+            "only the post-fee amount reaches the destination terminal"
+        );
+        assertEq(
+            _store.balanceOf(address(_terminalA), 1, JBConstants.NATIVE_TOKEN),
+            0,
+            "fee project did not receive the forgiven migration fee"
+        );
+
+        // Restore fee routing and sweep the residual balance.
+        IJBTerminal[] memory feeTerminals = new IJBTerminal[](1);
+        feeTerminals[0] = IJBTerminal(address(_terminalA));
+        vm.prank(_feeProjectOwner);
+        _directory.setTerminalsOf(1, feeTerminals);
+
+        vm.prank(_projectOwner);
+        _terminalA.migrateBalanceOf(_projectId, JBConstants.NATIVE_TOKEN, _terminalB);
+
+        uint256 secondFee = JBFees.feeAmountFrom({amountBeforeFee: expectedFee, feePercent: _terminalA.FEE()});
+        assertEq(
+            _store.balanceOf(address(_terminalA), _projectId, JBConstants.NATIVE_TOKEN),
+            0,
+            "cleanup migration clears the stranded source balance"
+        );
+        assertEq(
+            _store.balanceOf(address(_terminalB), _projectId, JBConstants.NATIVE_TOKEN),
+            payAmount - secondFee,
+            "the previously forgiven fee is charged again during cleanup"
+        );
+        assertEq(
+            _store.balanceOf(address(_terminalA), 1, JBConstants.NATIVE_TOKEN),
+            secondFee,
+            "fee project only receives the second migration fee"
+        );
+    }
+}