@bananapus/core-v6 0.0.36 → 0.0.38

package/test/audit/CrossTerminalSurplusSpoof.t.sol

@@ -1,140 +0,0 @@
-// SPDX-License-Identifier: MIT
-pragma solidity ^0.8.6;
-
-import {TestBaseWorkflow} from "../helpers/TestBaseWorkflow.sol";
-import {IJBController} from "../../src/interfaces/IJBController.sol";
-import {IJBDirectory} from "../../src/interfaces/IJBDirectory.sol";
-import {IJBTerminal} from "../../src/interfaces/IJBTerminal.sol";
-import {JBMultiTerminal} from "../../src/JBMultiTerminal.sol";
-import {JBConstants} from "../../src/libraries/JBConstants.sol";
-import {JBAccountingContext} from "../../src/structs/JBAccountingContext.sol";
-import {JBFundAccessLimitGroup} from "../../src/structs/JBFundAccessLimitGroup.sol";
-import {JBRulesetConfig} from "../../src/structs/JBRulesetConfig.sol";
-import {JBRulesetMetadata} from "../../src/structs/JBRulesetMetadata.sol";
-import {JBSplitGroup} from "../../src/structs/JBSplitGroup.sol";
-import {JBTerminalConfig} from "../../src/structs/JBTerminalConfig.sol";
-import {IJBRulesetApprovalHook} from "../../src/interfaces/IJBRulesetApprovalHook.sol";
-
-/// @notice Verifies that `useTotalSurplusForCashOuts` trusts every terminal in the directory,
-/// even though settlement still comes from the specific terminal the holder cashes out through.
-contract CrossTerminalSurplusSpoof_Local is TestBaseWorkflow {
-    IJBController private _controller;
-    IJBDirectory private _directory;
-    JBMultiTerminal private _terminal;
-    address private _projectOwner;
-    address private _holder;
-    uint32 private _nativeCurrency;
-    uint256 private _projectId;
-
-    function setUp() public override {
-        super.setUp();
-
-        _controller = jbController();
-        _directory = jbDirectory();
-        _terminal = jbMultiTerminal();
-        _projectOwner = multisig();
-        _holder = beneficiary();
-        _nativeCurrency = uint32(uint160(JBConstants.NATIVE_TOKEN));
-
-        JBRulesetMetadata memory metadata = JBRulesetMetadata({
-            reservedPercent: 0,
-            cashOutTaxRate: 0,
-            baseCurrency: _nativeCurrency,
-            pausePay: false,
-            pauseCreditTransfers: false,
-            allowOwnerMinting: true,
-            allowSetCustomToken: true,
-            allowTerminalMigration: false,
-            allowSetTerminals: true,
-            allowSetController: false,
-            allowAddAccountingContext: true,
-            allowAddPriceFeed: false,
-            ownerMustSendPayouts: false,
-            holdFees: false,
-            useTotalSurplusForCashOuts: true,
-            useDataHookForPay: false,
-            useDataHookForCashOut: false,
-            dataHook: address(0),
-            metadata: 0
-        });
-
-        JBRulesetConfig[] memory rulesetConfigs = new JBRulesetConfig[](1);
-        rulesetConfigs[0] = JBRulesetConfig({
-            mustStartAtOrAfter: 0,
-            duration: 0,
-            weight: 1000e18,
-            weightCutPercent: 0,
-            approvalHook: IJBRulesetApprovalHook(address(0)),
-            metadata: metadata,
-            splitGroups: new JBSplitGroup[](0),
-            fundAccessLimitGroups: new JBFundAccessLimitGroup[](0)
-        });
-
-        JBAccountingContext[] memory contexts = new JBAccountingContext[](1);
-        contexts[0] = JBAccountingContext({token: JBConstants.NATIVE_TOKEN, decimals: 18, currency: _nativeCurrency});
-
-        JBTerminalConfig[] memory terminalConfigs = new JBTerminalConfig[](1);
-        terminalConfigs[0] = JBTerminalConfig({terminal: _terminal, accountingContextsToAccept: contexts});
-
-        _projectId = _controller.launchProjectFor({
-            owner: _projectOwner,
-            projectUri: "spoofed-surplus",
-            rulesetConfigurations: rulesetConfigs,
-            terminalConfigurations: terminalConfigs,
-            memo: ""
-        });
-    }
-
-    function test_partialCashOutCanDrainLocalTerminalUsingSpoofedSiblingSurplus() external {
-        vm.deal(_holder, 1 ether);
-
-        vm.prank(_holder);
-        uint256 minted = _terminal.pay{value: 1 ether}({
-            projectId: _projectId,
-            token: JBConstants.NATIVE_TOKEN,
-            amount: 1 ether,
-            beneficiary: _holder,
-            minReturnedTokens: 0,
-            memo: "",
-            metadata: ""
-        });
-
-        assertEq(address(_terminal).balance, 1 ether, "terminal should hold the paid ETH");
-
-        address spoofedTerminal = makeAddr("spoofedTerminal");
-        IJBTerminal[] memory terminals = new IJBTerminal[](2);
-        terminals[0] = IJBTerminal(address(_terminal));
-        terminals[1] = IJBTerminal(spoofedTerminal);
-
-        vm.prank(_projectOwner);
-        _directory.setTerminalsOf(_projectId, terminals);
-
-        vm.mockCall(
-            spoofedTerminal,
-            abi.encodeCall(IJBTerminal.currentSurplusOf, (_projectId, new address[](0), 18, _nativeCurrency)),
-            abi.encode(1 ether)
-        );
-
-        uint256 holderBalanceBefore = _holder.balance;
-
-        vm.prank(_holder);
-        uint256 reclaimed = _terminal.cashOutTokensOf({
-            holder: _holder,
-            projectId: _projectId,
-            cashOutCount: minted / 2,
-            tokenToReclaim: JBConstants.NATIVE_TOKEN,
-            minTokensReclaimed: 0,
-            beneficiary: payable(_holder),
-            metadata: new bytes(0)
-        });
-
-        assertEq(reclaimed, 1 ether, "spoofed global surplus should let a half burn reclaim the full local balance");
-        assertEq(_holder.balance - holderBalanceBefore, 1 ether, "holder should receive the full terminal balance");
-        assertEq(address(_terminal).balance, 0, "the honest terminal should be fully drained");
-        assertEq(
-            jbTokens().totalBalanceOf(_holder, _projectId),
-            minted / 2,
-            "the holder should keep half their project tokens after draining the terminal"
-        );
-    }
-}

package/test/audit/CycledSurplusAllowanceReset.t.sol

@@ -1,184 +0,0 @@
-// SPDX-License-Identifier: MIT
-pragma solidity ^0.8.6;
-
-import {TestBaseWorkflow} from "../helpers/TestBaseWorkflow.sol";
-import {IJBRulesetApprovalHook} from "../../src/interfaces/IJBRulesetApprovalHook.sol";
-import {IJBTerminal} from "../../src/interfaces/IJBTerminal.sol";
-import {JBConstants} from "../../src/libraries/JBConstants.sol";
-import {JBAccountingContext} from "../../src/structs/JBAccountingContext.sol";
-import {JBCurrencyAmount} from "../../src/structs/JBCurrencyAmount.sol";
-import {JBFundAccessLimitGroup} from "../../src/structs/JBFundAccessLimitGroup.sol";
-import {JBRuleset} from "../../src/structs/JBRuleset.sol";
-import {JBRulesetConfig} from "../../src/structs/JBRulesetConfig.sol";
-import {JBRulesetMetadata} from "../../src/structs/JBRulesetMetadata.sol";
-import {JBSplitGroup} from "../../src/structs/JBSplitGroup.sol";
-import {JBTerminalConfig} from "../../src/structs/JBTerminalConfig.sol";
-
-contract CycledSurplusAllowanceResetTest is TestBaseWorkflow {
-    function test_surplusAllowanceDoesNotResetAcrossImplicitCycles() external {
-        _launchFeeProject();
-
-        JBRulesetConfig[] memory rulesetConfigurations = new JBRulesetConfig[](1);
-        rulesetConfigurations[0] = _makeRulesetConfig({
-            duration: 1 days,
-            metadata: _defaultMetadata(),
-            splitGroups: new JBSplitGroup[](0),
-            fundAccessLimitGroups: _makeFundAccessLimitGroup(1 ether)
-        });
-
-        uint256 projectId = jbController()
-            .launchProjectFor({
-                owner: multisig(),
-                projectUri: "cycle-allowance",
-                rulesetConfigurations: rulesetConfigurations,
-                terminalConfigurations: _makeTerminalConfig(),
-                memo: ""
-            });
-
-        address payer = makeAddr("payer");
-        vm.deal(payer, 5 ether);
-        vm.prank(payer);
-        jbMultiTerminal().pay{value: 5 ether}({
-            projectId: projectId,
-            amount: 5 ether,
-            token: JBConstants.NATIVE_TOKEN,
-            beneficiary: payer,
-            minReturnedTokens: 0,
-            memo: "",
-            metadata: new bytes(0)
-        });
-
-        vm.prank(multisig());
-        jbMultiTerminal()
-            .useAllowanceOf({
-                projectId: projectId,
-                token: JBConstants.NATIVE_TOKEN,
-                amount: 1 ether,
-                currency: uint32(uint160(JBConstants.NATIVE_TOKEN)),
-                minTokensPaidOut: 0,
-                beneficiary: payable(makeAddr("cycle1-beneficiary")),
-                feeBeneficiary: payable(multisig()),
-                memo: ""
-            });
-
-        JBRuleset memory cycleOneRuleset = jbRulesets().currentOf(projectId);
-        assertEq(cycleOneRuleset.cycleNumber, 1, "expected first cycle before warp");
-
-        vm.warp(block.timestamp + 1 days + 1);
-
-        JBRuleset memory cycledRuleset = jbRulesets().currentOf(projectId);
-        assertEq(cycledRuleset.cycleNumber, 2, "expected implicit second cycle");
-        assertEq(cycledRuleset.id, cycleOneRuleset.id, "cycled ruleset reuses base ruleset id");
-
-        vm.expectRevert();
-        vm.prank(multisig());
-        jbMultiTerminal()
-            .useAllowanceOf({
-                projectId: projectId,
-                token: JBConstants.NATIVE_TOKEN,
-                amount: 1 ether,
-                currency: uint32(uint160(JBConstants.NATIVE_TOKEN)),
-                minTokensPaidOut: 0,
-                beneficiary: payable(makeAddr("cycle2-beneficiary")),
-                feeBeneficiary: payable(multisig()),
-                memo: ""
-            });
-    }
-
-    function _launchFeeProject() private returns (uint256) {
-        JBRulesetConfig[] memory rulesetConfigurations = new JBRulesetConfig[](1);
-        rulesetConfigurations[0] = _makeRulesetConfig({
-            duration: 1 days,
-            metadata: _defaultMetadata(),
-            splitGroups: new JBSplitGroup[](0),
-            fundAccessLimitGroups: new JBFundAccessLimitGroup[](0)
-        });
-
-        return jbController()
-            .launchProjectFor({
-                owner: multisig(),
-                projectUri: "fee-project",
-                rulesetConfigurations: rulesetConfigurations,
-                terminalConfigurations: _makeTerminalConfig(),
-                memo: ""
-            });
-    }
-
-    function _defaultMetadata() private pure returns (JBRulesetMetadata memory) {
-        return JBRulesetMetadata({
-            reservedPercent: 0,
-            cashOutTaxRate: 0,
-            baseCurrency: uint32(uint160(JBConstants.NATIVE_TOKEN)),
-            pausePay: false,
-            pauseCreditTransfers: false,
-            allowOwnerMinting: true,
-            allowSetCustomToken: true,
-            allowTerminalMigration: true,
-            allowSetTerminals: true,
-            ownerMustSendPayouts: false,
-            allowSetController: true,
-            allowAddAccountingContext: true,
-            allowAddPriceFeed: true,
-            holdFees: false,
-            useTotalSurplusForCashOuts: false,
-            useDataHookForPay: false,
-            useDataHookForCashOut: false,
-            dataHook: address(0),
-            metadata: 0
-        });
-    }
-
-    function _makeTerminalConfig() private view returns (JBTerminalConfig[] memory terminalConfigurations) {
-        terminalConfigurations = new JBTerminalConfig[](1);
-
-        JBAccountingContext[] memory accountingContexts = new JBAccountingContext[](1);
-        accountingContexts[0] = JBAccountingContext({
-            token: JBConstants.NATIVE_TOKEN, decimals: 18, currency: uint32(uint160(JBConstants.NATIVE_TOKEN))
-        });
-
-        terminalConfigurations[0] = JBTerminalConfig({
-            terminal: IJBTerminal(address(jbMultiTerminal())), accountingContextsToAccept: accountingContexts
-        });
-    }
-
-    function _makeFundAccessLimitGroup(uint224 surplusAllowanceAmount)
-        private
-        view
-        returns (JBFundAccessLimitGroup[] memory groups)
-    {
-        groups = new JBFundAccessLimitGroup[](1);
-
-        JBCurrencyAmount[] memory surplusAllowances = new JBCurrencyAmount[](1);
-        surplusAllowances[0] =
-            JBCurrencyAmount({amount: surplusAllowanceAmount, currency: uint32(uint160(JBConstants.NATIVE_TOKEN))});
-
-        groups[0] = JBFundAccessLimitGroup({
-            terminal: address(jbMultiTerminal()),
-            token: JBConstants.NATIVE_TOKEN,
-            payoutLimits: new JBCurrencyAmount[](0),
-            surplusAllowances: surplusAllowances
-        });
-    }
-
-    function _makeRulesetConfig(
-        uint32 duration,
-        JBRulesetMetadata memory metadata,
-        JBSplitGroup[] memory splitGroups,
-        JBFundAccessLimitGroup[] memory fundAccessLimitGroups
-    )
-        private
-        pure
-        returns (JBRulesetConfig memory)
-    {
-        return JBRulesetConfig({
-            mustStartAtOrAfter: 0,
-            duration: duration,
-            weight: 1000 * 10 ** 18,
-            weightCutPercent: 0,
-            approvalHook: IJBRulesetApprovalHook(address(0)),
-            metadata: metadata,
-            splitGroups: splitGroups,
-            fundAccessLimitGroups: fundAccessLimitGroups
-        });
-    }
-}