@bananapus/core-v6 0.0.47 → 0.0.49

package/foundry.toml

@@ -1,5 +1,6 @@
 [profile.default]
 solc = '0.8.28'
+bytecode_hash = "none"
 evm_version = 'cancun'
 optimizer_runs = 200
 libs = ["node_modules", "lib"]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bananapus/core-v6",
-  "version": "0.0.47",
+  "version": "0.0.49",
   "license": "MIT",
   "repository": {
     "type": "git",

package/src/JBMultiTerminal.sol

@@ -319,7 +319,7 @@ contract JBMultiTerminal is JBPermissioned, ERC2771Context, IJBMultiTerminal {
         address originalMessageSender
     )
         external
-        returns (uint256 netPayoutAmount)
+        returns (uint256 netPayoutAmount, uint256 feeEligibleAmount)
     {
         // NOTICE: May only be called by this terminal itself.
         require(msg.sender == address(this));
@@ -334,36 +334,24 @@ contract JBMultiTerminal is JBPermissioned, ERC2771Context, IJBMultiTerminal {
                 revert JBMultiTerminal_SplitHookInvalid({hook: split.hook});
             }
 
-            // This payout is eligible for a fee since the funds are leaving this contract and the split hook isn't a
-            // feeless address.
             if (!_isFeeless({addr: address(split.hook), projectId: projectId})) {
                 unchecked {
                     netPayoutAmount -= _feeAmountFrom(amount);
                 }
             }
 
-            // Create the context to send to the split hook.
-            JBSplitHookContext memory context = JBSplitHookContext({
-                token: token,
-                amount: netPayoutAmount,
-                decimals: STORE.accountingContextOf({
-                    terminal: address(this), projectId: projectId, token: token
-                }).decimals,
+            // Delegate the partial-pull-aware hook invocation to the library so this branch stays compact.
+            // The library builds the hook context internally and infers fee-eligibility from
+            // `netPayoutAmount < amount` (`true` only when a fee was deducted above).
+            (netPayoutAmount, feeEligibleAmount) = JBPayoutSplitGroupLib.invokeSplitHookWithPartial({
+                split: split,
                 projectId: projectId,
-                groupId: uint256(uint160(token)),
-                split: split
+                token: token,
+                amount: amount,
+                netPayoutAmount: netPayoutAmount,
+                store: STORE
             });
 
-            // Trigger any inherited pre-transfer logic.
-            // Get a reference to the amount being paid in `msg.value`.
-            uint256 payValue = _beforeTransferTo({to: address(split.hook), token: token, amount: netPayoutAmount});
-
-            // If this terminal's token is the native token, send it in `msg.value`.
-            split.hook.processSplitWith{value: payValue}(context);
-
-            // Revoke the temporary pull allowance now that the hook call has finished.
-            _afterTransferTo({to: address(split.hook), token: token});
-
             // Otherwise, if a project is specified, make a payment to it.
         } else if (split.projectId != 0) {
             // Get a reference to the terminal being used.
@@ -383,6 +371,7 @@ contract JBMultiTerminal is JBPermissioned, ERC2771Context, IJBMultiTerminal {
                 unchecked {
                     netPayoutAmount -= _feeAmountFrom(amount);
                 }
+                feeEligibleAmount = amount;
             }
 
             // Track the fee-free payout amount. During cashout at zero tax rate, fees apply
@@ -446,6 +435,7 @@ contract JBMultiTerminal is JBPermissioned, ERC2771Context, IJBMultiTerminal {
                 unchecked {
                     netPayoutAmount -= _feeAmountFrom(amount);
                 }
+                feeEligibleAmount = amount;
             }
 
             // If there's a beneficiary, send the funds directly to the beneficiary. Otherwise send to the

package/src/libraries/JBPayoutSplitGroupLib.sol

@@ -1,11 +1,15 @@
 // SPDX-License-Identifier: MIT
 pragma solidity 0.8.28;
 
+import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
+import {SafeERC20} from "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";
 import {mulDiv} from "@prb/math/src/Common.sol";
 
+import {IJBSplitHook} from "../interfaces/IJBSplitHook.sol";
 import {IJBSplits} from "../interfaces/IJBSplits.sol";
 import {IJBTerminalStore} from "../interfaces/IJBTerminalStore.sol";
 import {JBSplit} from "../structs/JBSplit.sol";
+import {JBSplitHookContext} from "../structs/JBSplitHookContext.sol";
 import {JBConstants} from "./JBConstants.sol";
 
 /// @notice Minimal callback surface used only by this library to call back into the terminal's `executePayout(...)`.
@@ -18,7 +22,11 @@ interface IJBPayoutSplitGroupExecutor {
     /// @param token The token being paid out.
     /// @param amount The amount assigned to the split.
     /// @param originalMessageSender The account that started the payout flow.
-    /// @return netPayoutAmount The amount that was actually paid after fees or hook behavior.
+    /// @return netPayoutAmount The amount the split recipient actually received (may be less than the
+    /// post-fee amount if a split hook accepted a partial pull).
+    /// @return feeEligibleAmount The gross-equivalent of `netPayoutAmount` that should accrue held fees.
+    /// Equals `amount` on a fully-consumed non-feeless payout, `0` on feeless or when the hook took nothing,
+    /// and a scaled value `amount * sent / netOffered` for a partial pull.
     function executePayout(
         JBSplit calldata split,
         uint256 projectId,
@@ -27,7 +35,7 @@ interface IJBPayoutSplitGroupExecutor {
         address originalMessageSender
     )
         external
-        returns (uint256 netPayoutAmount);
+        returns (uint256 netPayoutAmount, uint256 feeEligibleAmount);
 }
 
 /// @notice Handles distributing payouts to a project's split recipients. Iterates through each split, sends the
@@ -48,6 +56,105 @@ library JBPayoutSplitGroupLib {
         address caller
     );
 
+    /// @notice Invokes a split hook with partial-pull-aware allowance handling.
+    /// @dev For ERC-20: grants the hook an allowance, calls `processSplitWith`, and revokes any unconsumed
+    /// allowance. For native ETH: pushes via `msg.value`. The hook may take less than offered (revert or
+    /// short-pull); the unsent portion is routed back to the project balance via `store.recordAddedBalanceFor`,
+    /// scaled to include the proportional fee allocation so the held fee is effectively charged only on the
+    /// consumed amount. Fee-eligibility is inferred from `netPayoutAmount < amount`.
+    /// @dev Called via DELEGATECALL from the terminal, so `address(this)` is the terminal and `msg.sender`
+    /// observed by the hook is the terminal — hooks that check `DIRECTORY.isTerminalOf(msg.sender)` continue
+    /// to work unchanged.
+    /// @param split The split (must have a non-zero hook address).
+    /// @param projectId The originating project ID.
+    /// @param token The token being distributed. Use `JBConstants.NATIVE_TOKEN` for ETH.
+    /// @param amount The gross amount allocated to this split (pre-fee).
+    /// @param netPayoutAmount The amount the hook is offered (post-fee for non-feeless splits, == amount otherwise).
+    /// @param store The terminal store used to credit any refund back to the project and to look up decimals.
+    /// @return sent The amount the hook actually received.
+    /// @return feeEligibleAmount The gross-equivalent of `sent` (used for held-fee accounting). Zero for
+    /// feeless splits or when the hook consumed nothing.
+    function invokeSplitHookWithPartial(
+        JBSplit calldata split,
+        uint256 projectId,
+        address token,
+        uint256 amount,
+        uint256 netPayoutAmount,
+        IJBTerminalStore store
+    )
+        external
+        returns (uint256 sent, uint256 feeEligibleAmount)
+    {
+        // Native vs ERC-20 governs the transfer mechanism (push via msg.value vs allowance pull).
+        bool isNative = token == JBConstants.NATIVE_TOKEN;
+
+        // Build the hook context inline so the terminal call site doesn't have to. `decimals` is looked up from
+        // the terminal store's recorded accounting context for this (projectId, token) pair.
+        JBSplitHookContext memory context = JBSplitHookContext({
+            token: token,
+            amount: netPayoutAmount,
+            decimals: store.accountingContextOf({terminal: address(this), projectId: projectId, token: token}).decimals,
+            projectId: projectId,
+            groupId: uint256(uint160(token)),
+            split: split
+        });
+
+        // Set up the transfer: ETH is pushed via `value:` on the hook call; ERC-20 grants the hook a pull
+        // allowance for the offered net amount.
+        uint256 payValue;
+        if (isNative) {
+            payValue = netPayoutAmount;
+        } else {
+            SafeERC20.forceApprove({token: IERC20(token), spender: address(split.hook), value: netPayoutAmount});
+        }
+
+        // Wrap the hook call in try/catch so a reverting hook does not bubble out. On revert no tokens leave
+        // this contract (transferFrom inside the hook is rolled back; pushed ETH is returned). The success
+        // flag drives the native-ETH `sent` computation below — we cannot use a balance delta because the
+        // hook may reenter into this terminal (pay/cashOut/etc.) and shift our balance independently of its
+        // own consumption.
+        bool hookOk;
+        try split.hook.processSplitWith{value: payValue}(context) {
+            hookOk = true;
+        } catch {}
+
+        if (isNative) {
+            // Native ETH is pushed via `value:`. There is no on-the-fly "give some back" mechanism — a
+            // successful hook consumed exactly `netPayoutAmount`; a reverting hook consumed 0 (the EVM
+            // refunds the value on revert). Any side-effects the hook produced via reentrant terminal
+            // calls (pay/addToBalance/cashOut) are recorded through those calls' own bookkeeping and must
+            // not bleed into this split's consumption accounting.
+            sent = hookOk ? netPayoutAmount : 0;
+        } else {
+            // ERC-20 hooks pull via `transferFrom` against the allowance we granted. The allowance delta
+            // is the only consumption measure that is robust against reentrant balance manipulation: the
+            // hook cannot raise its own allowance, and any pull on this allowance reduces it 1:1 with
+            // what the hook actually received. Reentrant flows through other paths use independent
+            // allowances/values and so cannot inflate this measurement.
+            sent = netPayoutAmount - IERC20(token).allowance({owner: address(this), spender: address(split.hook)});
+
+            // Revoke any unconsumed ERC-20 allowance immediately after the call so the hook can never pull later.
+            SafeERC20.forceApprove({token: IERC20(token), spender: address(split.hook), value: 0});
+        }
+
+        // If the hook took less than offered, refund the proportional gross portion to the project's balance.
+        // refund = amount * (netPayoutAmount - sent) / netPayoutAmount. For full consumption this branch is
+        // skipped. For zero consumption this refunds the full `amount` (i.e. the gross, fee allocation included).
+        if (sent < netPayoutAmount) {
+            uint256 refund = mulDiv(amount, netPayoutAmount - sent, netPayoutAmount);
+            if (refund != 0) {
+                store.recordAddedBalanceFor({projectId: projectId, token: token, amount: refund});
+            }
+        }
+
+        // `netPayoutAmount < amount` iff the terminal deducted a fee above (non-feeless split). Report the
+        // gross-equivalent of what the hook actually consumed so the held fee scales with consumption rather
+        // than with the project's original payout intent.
+        if (netPayoutAmount < amount && sent != 0) {
+            feeEligibleAmount = mulDiv(amount, sent, netPayoutAmount);
+        }
+    }
+
     /// @notice Sends payouts to the payout splits group specified in a project's ruleset.
     /// @param splits The splits contract to read splits from.
     /// @param store The terminal store used to restore balance when a payout fails.
@@ -87,14 +194,25 @@ library JBPayoutSplitGroupLib {
             // The amount to send to the split.
             uint256 payoutAmount = mulDiv(leftoverAmount, split.percent, leftoverPercentage);
 
-            // The final payout amount after taking out any fees.
-            uint256 netPayoutAmount = _sendPayoutToSplit({
-                store: store, split: split, projectId: projectId, token: token, amount: payoutAmount, caller: caller
-            });
-
-            // If the split hook is a feeless address, this payout doesn't incur a fee.
-            if (netPayoutAmount != 0 && netPayoutAmount != payoutAmount) {
-                amountEligibleForFees += payoutAmount;
+            // Send the payout (inlined to keep stack pressure manageable with the tuple return).
+            // Returns (netPayoutAmount sent, feeEligible gross-equivalent). For non-hook splits and fully-consumed
+            // hook splits, `feeEligible` equals `payoutAmount` (non-feeless) or 0 (feeless). For a partial split-hook
+            // pull, `feeEligible` scales with consumed. Failed payouts consume the payout limit by design — the
+            // try/catch keeps a single bad split from DoS-ing the rest and restores balance.
+            uint256 netPayoutAmount;
+            try IJBPayoutSplitGroupExecutor(address(this))
+                .executePayout({
+                split: split, projectId: projectId, token: token, amount: payoutAmount, originalMessageSender: caller
+            }) returns (
+                uint256 sentAmount, uint256 feeEligible
+            ) {
+                netPayoutAmount = sentAmount;
+                amountEligibleForFees += feeEligible;
+            } catch (bytes memory failureReason) {
+                emit PayoutReverted({
+                    projectId: projectId, split: split, amount: payoutAmount, reason: failureReason, caller: caller
+                });
+                store.recordAddedBalanceFor({projectId: projectId, token: token, amount: payoutAmount});
             }
 
             if (payoutAmount != 0) {
@@ -123,47 +241,4 @@ library JBPayoutSplitGroupLib {
             }
         }
     }
-
-    /// @notice Sends a payout to a split.
-    /// @param store The terminal store used to restore balance when a payout fails.
-    /// @param split The split to pay.
-    /// @param projectId The ID of the project the split was specified by.
-    /// @param token The address of the token to pay out.
-    /// @param amount The total amount that the split is paid.
-    /// @param caller The original caller of the terminal payout flow.
-    /// @return netPayoutAmount The amount sent to the split after subtracting fees.
-    function _sendPayoutToSplit(
-        IJBTerminalStore store,
-        JBSplit memory split,
-        uint256 projectId,
-        address token,
-        uint256 amount,
-        address caller
-    )
-        private
-        returns (uint256 netPayoutAmount)
-    {
-        // Failed split payouts consume the payout limit by design. The try-catch prevents a single
-        // split from DoS-ing the entire payout. Failed splits' amounts are returned to the project balance via
-        // `recordAddedBalanceFor`. Payout limit consumption is correct because the project authorized the
-        // distribution.
-        try IJBPayoutSplitGroupExecutor(address(this))
-            .executePayout({
-            split: split, projectId: projectId, token: token, amount: amount, originalMessageSender: caller
-        }) returns (
-            uint256 payoutAmount
-        ) {
-            return payoutAmount;
-        } catch (bytes memory failureReason) {
-            emit PayoutReverted({
-                projectId: projectId, split: split, amount: amount, reason: failureReason, caller: caller
-            });
-
-            // Add balance back to the project.
-            store.recordAddedBalanceFor({projectId: projectId, token: token, amount: amount});
-
-            // Since the payout failed the netPayoutAmount is zero.
-            return 0;
-        }
-    }
 }

package/test/helpers/JBTest.sol

@@ -11,6 +11,27 @@ import {Test} from "lib/forge-std/src/Test.sol";
 contract JBTest is Test {
     using JBRulesetMetadataResolver for JBRulesetMetadata;
 
+    /// @notice The pinned CREATE2 address of `JBPayoutSplitGroupLib` from `foundry.toml`.
+    /// @dev Must match the `libraries = [...]` entry. Tests etch the runtime code here so
+    /// `JBMultiTerminal`'s delegatecalls into the library resolve.
+    address internal constant _JB_PAYOUT_SPLIT_GROUP_LIB = 0xE5767922e5f8d18c57C4685289Ef92D859eb980b;
+
+    /// @notice Deploy `JBPayoutSplitGroupLib` locally and etch its runtime bytecode at the pinned
+    /// address from `foundry.toml`. Forge auto-deploys linked libraries only when no `libraries`
+    /// entry is configured; once the address is pinned (needed so deploy-all-v6 can read
+    /// `artifacts/JBMultiTerminal.json::bytecode.object` as valid hex), unit tests must plant the
+    /// runtime code themselves or any path through `executePayout` / `sendPayoutsToSplitGroupOf`
+    /// reverts with `delegatecall to non-contract address`.
+    function _etchPayoutSplitGroupLib() internal {
+        bytes memory creationCode = vm.getCode("JBPayoutSplitGroupLib");
+        address libImpl;
+        assembly {
+            libImpl := create(0, add(creationCode, 0x20), mload(creationCode))
+        }
+        require(libImpl != address(0), "JBPayoutSplitGroupLib deploy failed");
+        vm.etch(_JB_PAYOUT_SPLIT_GROUP_LIB, libImpl.code);
+    }
+
     function mockExpect(address _where, bytes memory _encodedCall, bytes memory _returns) public {
         vm.mockCall(_where, _encodedCall, _returns);
         vm.expectCall(_where, _encodedCall);

package/test/helpers/TestBaseWorkflow.sol

@@ -290,6 +290,9 @@ contract TestBaseWorkflow is JBTest, DeployPermit2 {
 
     // Deploys and initializes contracts for testing.
     function setUp() public virtual {
+        // Plant `JBPayoutSplitGroupLib` at its pre-linked address so terminal delegatecalls resolve.
+        _etchPayoutSplitGroupLib();
+
         _jbPermissions = new JBPermissions(_trustedForwarder);
         _jbProjects = new JBProjects(_multisig, address(0), _trustedForwarder);
         _jbDirectory = new JBDirectory(_jbPermissions, _jbProjects, _multisig);