@bananapus/core-v6 0.0.64 → 0.0.65

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bananapus/core-v6",
-  "version": "0.0.64",
+  "version": "0.0.65",
   "license": "MIT",
   "repository": {
     "type": "git",

package/script/DeployPeriphery.s.sol

@@ -148,8 +148,8 @@ contract DeployPeriphery is Script, Sphinx {
                 feed: feed
             }) {}
             catch {}
-        // `addPriceFeedFor` can revert if this feed was already registered. Still require the feed to exist so a
-        // different failure mode can't silently skip this required deployment step.
+        // `addPriceFeedFor` can revert if this feed was already registered. Still require this feed to be the
+        // authoritative default so a different existing feed can't silently satisfy this deployment step.
         require(
             address(
                 core.prices
@@ -158,8 +158,8 @@ contract DeployPeriphery is Script, Sphinx {
                         pricingCurrency: JBCurrencyIds.USD,
                         unitCurrency: uint32(uint160(JBConstants.NATIVE_TOKEN))
                     })
-            ) != address(0),
-            "Missing USD/native price feed"
+            ) == address(feed),
+            "Unexpected USD/native price feed"
         );
 
         // WARN: We are using the same price feed as the native token for the USD price feed. Which is only valid on
@@ -169,14 +169,14 @@ contract DeployPeriphery is Script, Sphinx {
                 projectId: 0, pricingCurrency: JBCurrencyIds.USD, unitCurrency: JBCurrencyIds.ETH, feed: feed
             }) {}
             catch {}
-        // `addPriceFeedFor` can revert if this feed was already registered. Still require the feed to exist so a
-        // different failure mode can't silently skip this required deployment step.
+        // `addPriceFeedFor` can revert if this feed was already registered. Still require this feed to be the
+        // authoritative default so a different existing feed can't silently satisfy this deployment step.
         require(
             address(
                 core.prices
                 .priceFeedFor({projectId: 0, pricingCurrency: JBCurrencyIds.USD, unitCurrency: JBCurrencyIds.ETH})
-            ) != address(0),
-            "Missing USD/ETH price feed"
+            ) == address(feed),
+            "Unexpected USD/ETH price feed"
         );
 
         // If the native asset for this chain is ether, then the conversion from native asset to ether is 1:1.
@@ -190,8 +190,8 @@ contract DeployPeriphery is Script, Sphinx {
                 feed: matchingPriceFeed
             }) {}
             catch {}
-        // `addPriceFeedFor` can revert if this feed was already registered. Still require the feed to exist so a
-        // different failure mode can't silently skip this required deployment step.
+        // `addPriceFeedFor` can revert if this feed was already registered. Still require this feed to be the
+        // authoritative default so a different existing feed can't silently satisfy this deployment step.
         require(
             address(
                 core.prices
@@ -200,8 +200,8 @@ contract DeployPeriphery is Script, Sphinx {
                         pricingCurrency: JBCurrencyIds.ETH,
                         unitCurrency: uint32(uint160(JBConstants.NATIVE_TOKEN))
                     })
-            ) != address(0),
-            "Missing ETH/native price feed"
+            ) == address(matchingPriceFeed),
+            "Unexpected ETH/native price feed"
         );
 
         // Deploy the USDC/USD price feed.
@@ -318,14 +318,14 @@ contract DeployPeriphery is Script, Sphinx {
                 projectId: 0, pricingCurrency: JBCurrencyIds.USD, unitCurrency: usdcCurrencyId, feed: usdcFeed
             }) {}
             catch {}
-        // `addPriceFeedFor` can revert if this feed was already registered. Still require the feed to exist so a
-        // different failure mode can't silently skip this required deployment step.
+        // `addPriceFeedFor` can revert if this feed was already registered. Still require this feed to be the
+        // authoritative default so a different existing feed can't silently satisfy this deployment step.
         require(
             address(
                 core.prices
                 .priceFeedFor({projectId: 0, pricingCurrency: JBCurrencyIds.USD, unitCurrency: usdcCurrencyId})
-            ) != address(0),
-            "Missing USD/USDC price feed"
+            ) == address(usdcFeed),
+            "Unexpected USD/USDC price feed"
         );
     }
 

package/src/JBMultiTerminal.sol

@@ -715,6 +715,9 @@ contract JBMultiTerminal is JBPermissioned, ERC2771Context, IJBMultiTerminal {
     /// @param token The token to process held fees for.
     /// @param count The number of fees to process.
     function processHeldFeesOf(uint256 projectId, address token, uint256 count) external override {
+        // Preserve any in-flight referral context if this function is reached through reentrancy.
+        uint256 previousReferralProjectId = currentReferralProjectId;
+
         // Keep a reference to the terminal that'll receive the fees.
         IJBTerminal feeTerminal = _primaryTerminalOf({projectId: JBConstants.FEE_BENEFICIARY_PROJECT_ID, token: token});
 
@@ -749,11 +752,9 @@ contract JBMultiTerminal is JBPermissioned, ERC2771Context, IJBMultiTerminal {
                 _nextHeldFeeIndexOf[projectId][token] = currentIndex + 1;
             }
 
-            // Restore the originating fee-paying call's referral project for the duration of this fee's processing
-            // so the credit in `_processFee` attributes to the right (chain, project) pair. No save needed:
-            // `processHeldFeesOf` is a top-level keeper call in practice — the incoming transient is 0. Defensive
-            // cleanup happens once after the loop instead of per-iteration. Reconstructs the packed encoding from
-            // the two struct halves: `(chainId << 48) | projectId`.
+            // Restore the originating fee-paying call's referral project for this fee's processing so the credit in
+            // `_processFee` attributes to the right (chain, project) pair. Reconstructs the packed encoding from the
+            // two struct halves: `(chainId << 48) | projectId`.
             currentReferralProjectId = (uint256(heldFee.referralChainId) << 48) | uint256(heldFee.referralProjectId);
 
             // Process the standard fee on the original gross amount recorded when the held fee was created.
@@ -771,10 +772,8 @@ contract JBMultiTerminal is JBPermissioned, ERC2771Context, IJBMultiTerminal {
             }
         }
 
-        // Defensive cleanup: zero the transient so any subsequent in-tx work (e.g. hook reentrancy) doesn't
-        // inherit the last processed fee's referral. EIP-1153 would clear it at end-of-tx anyway, but in-tx
-        // reentry is the only case where this matters.
-        currentReferralProjectId = 0;
+        // Restore the previous transient value so reentrant held-fee processing does not erase an outer referral.
+        currentReferralProjectId = previousReferralProjectId;
 
         // If all held fees have been processed, reset the array and index entirely to bound storage growth.
         if (

package/src/JBTerminalStore.sol

@@ -339,18 +339,28 @@ contract JBTerminalStore is IJBTerminalStore {
             }
         }
 
-        // Cache the balance slot to avoid redundant storage reads.
-        uint256 currentBalance = balanceOf[msg.sender][projectId][tokenToReclaim];
+        // The selected terminal token can only pay out its own local surplus. Cash-out pricing may use shared surplus
+        // across terminals/tokens, but settlement must not dip into this token's payout-limit reserve.
+        JBAccountingContext memory accountingContext =
+            _accountingContextForTokenOf[msg.sender][projectId][tokenToReclaim];
+        uint256 localSurplus = _tokenSurplusFrom({
+            terminal: msg.sender,
+            projectId: projectId,
+            accountingContext: accountingContext,
+            ruleset: ruleset,
+            targetDecimals: accountingContext.decimals,
+            targetCurrency: accountingContext.currency
+        });
 
-        // The amount being reclaimed must be within the project's balance.
-        if (balanceDiff > currentBalance) {
-            revert JBTerminalStore_InadequateTerminalStoreBalance({amount: balanceDiff, balance: currentBalance});
+        // The amount being reclaimed must be within the project's local surplus.
+        if (balanceDiff > localSurplus) {
+            revert JBTerminalStore_InadequateTerminalStoreBalance({amount: balanceDiff, balance: localSurplus});
         }
 
         // Remove the reclaimed funds from the project's balance.
         if (balanceDiff != 0) {
             unchecked {
-                balanceOf[msg.sender][projectId][tokenToReclaim] = currentBalance - balanceDiff;
+                balanceOf[msg.sender][projectId][tokenToReclaim] -= balanceDiff;
             }
         }
     }

package/src/libraries/JBPayoutSplitGroupLib.sol

@@ -207,7 +207,10 @@ library JBPayoutSplitGroupLib {
                 uint256 sentAmount, uint256 feeEligible
             ) {
                 netPayoutAmount = sentAmount;
-                amountEligibleForFees += feeEligible;
+                // The standard fee is `STANDARD_FEE / MAX_FEE`, currently 25 / 1000 = 1 / 40. The `40` below is
+                // that reduced denominator, not an independent fee parameter. Round each split's fee basis down to
+                // it so aggregation cannot charge more than per-split floors.
+                amountEligibleForFees += feeEligible - (feeEligible % 40);
             } catch (bytes memory failureReason) {
                 emit PayoutReverted({
                     projectId: projectId, split: split, amount: payoutAmount, reason: failureReason, caller: caller