@bananapus/core-v6 0.0.72 → 0.0.74

package/README.md

@@ -2,13 +2,22 @@
 
 `@bananapus/core-v6` is the base protocol package for Juicebox on EVM chains. It defines projects, rulesets, terminals, permissions, token issuance, cash outs, splits, price feeds, and the accounting that the rest of the V6 ecosystem builds on.
 
-Docs: <https://docs.juicebox.money>
-Architecture: [ARCHITECTURE.md](./ARCHITECTURE.md)  
-User journeys: [USER_JOURNEYS.md](./USER_JOURNEYS.md)  
-Skills: [SKILLS.md](./SKILLS.md)  
-Risks: [RISKS.md](./RISKS.md)  
-Administration: [ADMINISTRATION.md](./ADMINISTRATION.md)  
-Audit instructions: [AUDIT_INSTRUCTIONS.md](./AUDIT_INSTRUCTIONS.md)
+
+## Documentation
+
+In-repo docs (entry points for this repo):
+
+- [ARCHITECTURE.md](./ARCHITECTURE.md) — module layout, data flow, critical-flow diagrams, and accounting model.
+- [INVARIANTS.md](./INVARIANTS.md) — per-contract operation inventory and the guarantees core makes to users, owners, and integrators.
+- [ADMINISTRATION.md](./ADMINISTRATION.md) — admin surfaces, role matrix, immutable decisions, and recovery posture.
+- [RISKS.md](./RISKS.md) — threat model, accepted risks, and invariants to verify.
+- [USER_JOURNEYS.md](./USER_JOURNEYS.md) — example end-to-end flows (launch, pay, cash out, payout, migrate, delegate).
+- [AUDIT_INSTRUCTIONS.md](./AUDIT_INSTRUCTIONS.md) — what to focus on for a security audit and how to start.
+- [SKILLS.md](./SKILLS.md) — implementation nuances, gotchas, and reading order for working on this codebase.
+- [STYLE_GUIDE.md](./STYLE_GUIDE.md) — Solidity conventions and repo layout used across the V6 ecosystem.
+- [CHANGELOG.md](./CHANGELOG.md) — v5 → v6 ABI and behavior deltas.
+- [references/entrypoints.md](./references/entrypoints.md) — callable entrypoints by contract.
+- [references/types-errors-events.md](./references/types-errors-events.md) — packed metadata, errors, events, and hook return shapes.
 
 ## Overview
 
@@ -134,6 +143,8 @@ script/
 
 ## Risks And Notes
 
+See [RISKS.md](./RISKS.md) for the full risk register. In short:
+
 - Hooks can materially change payment and cash-out behavior.
 - Permissions are flexible, which makes broad or wildcard grants risky.
 - Multi-terminal and multi-token accounting is powerful, but it is easy to misuse if an integration assumes a single-terminal model.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bananapus/core-v6",
-  "version": "0.0.72",
+  "version": "0.0.74",
   "license": "MIT",
   "repository": {
     "type": "git",

package/references/entrypoints.md

@@ -169,6 +169,7 @@ The core Juicebox V6 protocol on EVM: a modular system for launching treasury-ba
 | `setFeelessHook(IJBFeelessHook hook)` | Sets or clears the optional hook consulted by `isFeelessFor`. Owner-only. (`JBFeelessAddresses`) |
 | `isFeelessFor(address addr, uint256 projectId, address caller)` | Returns whether an address is feeless for a project, checking static grants and the optional caller-aware hook. (`JBFeelessAddresses`) |
 | `creationFee()` / `creationFeeReceiver()` | Return the current project creation fee and receiver. (`JBProjects`) |
-| `setCreationFee(uint256 fee, address payable receiver)` | Sets the native-token project creation fee. Owner-only. (`JBProjects`) |
+| `MAX_CREATION_FEE()` | Hardcoded ceiling (`0.001 ether`) on the native-token project creation fee the owner can set. (`JBProjects`) |
+| `setCreationFee(uint256 fee, address payable receiver)` | Sets the native-token project creation fee. Reverts if `fee > MAX_CREATION_FEE`. Owner-only. (`JBProjects`) |
 | `setControllerAllowed(uint256 projectId)` | Returns whether a project's controller can currently be set. (`IJBDirectoryAccessControl`) |
 | `setTerminalsAllowed(uint256 projectId)` | Returns whether a project's terminals can currently be set. (`IJBDirectoryAccessControl`) |

package/src/JBChainlinkV3SequencerPriceFeed.sol

@@ -8,7 +8,7 @@ import {JBChainlinkV3PriceFeed} from "./JBChainlinkV3PriceFeed.sol";
 
 /// @notice Extends `JBChainlinkV3PriceFeed` with L2 sequencer uptime checks (for Optimism, Arbitrum, etc.). Reverts if
 /// the sequencer is down or has not been back online for at least `GRACE_PERIOD_TIME` seconds — preventing stale
-/// prices from to use immediately after an outage.
+/// prices from being used immediately after an outage.
 contract JBChainlinkV3SequencerPriceFeed is JBChainlinkV3PriceFeed {
     //*********************************************************************//
     // --------------------------- custom errors ------------------------- //

package/src/JBProjects.sol

@@ -18,9 +18,19 @@ contract JBProjects is ERC721, ERC2771Context, Ownable, IJBProjects {
     // --------------------------- custom errors ------------------------- //
     //*********************************************************************//
 
+    error JBProjects_CreationFeeExceedsMax(uint256 fee, uint256 max);
     error JBProjects_InvalidCreationFee(uint256 value, uint256 requiredFee);
     error JBProjects_ZeroCreationFeeReceiver();
 
+    //*********************************************************************//
+    // ------------------------- public constants ------------------------ //
+    //*********************************************************************//
+
+    /// @notice The maximum native-token fee the owner can require to create a project.
+    /// @dev Hardcoded as a cap on the owner's `setCreationFee` authority so the fee can never become an effective
+    /// barrier to project creation.
+    uint256 public constant override MAX_CREATION_FEE = 0.001 ether;
+
     //*********************************************************************//
     // --------------------- public stored properties -------------------- //
     //*********************************************************************//
@@ -66,10 +76,14 @@ contract JBProjects is ERC721, ERC2771Context, Ownable, IJBProjects {
     //*********************************************************************//
 
     /// @notice Set the native-token fee required to create a project and the address that receives it.
-    /// @dev Only this contract's owner can change the fee. A non-zero fee requires a non-zero receiver.
-    /// @param fee The required creation fee. Set to 0 to disable creation fees.
+    /// @dev Only this contract's owner can change the fee. A non-zero fee requires a non-zero receiver. The fee may
+    /// not exceed `MAX_CREATION_FEE`.
+    /// @param fee The required creation fee. Set to 0 to disable creation fees. Must be `<= MAX_CREATION_FEE`.
     /// @param receiver The address that receives project creation fees.
     function setCreationFee(uint256 fee, address payable receiver) external override onlyOwner {
+        // Enforce the hardcoded ceiling so the owner can never price project creation out of reach.
+        if (fee > MAX_CREATION_FEE) revert JBProjects_CreationFeeExceedsMax({fee: fee, max: MAX_CREATION_FEE});
+
         // Non-zero fees need somewhere to go.
         if (fee != 0 && receiver == address(0)) revert JBProjects_ZeroCreationFeeReceiver();
 

package/src/interfaces/IJBProjects.sol

@@ -24,6 +24,9 @@ interface IJBProjects is IERC721 {
     /// @param caller The address that set the resolver.
     event SetTokenUriResolver(IJBTokenUriResolver indexed resolver, address caller);
 
+    /// @notice Returns the maximum native-token fee the owner can require to create a project.
+    function MAX_CREATION_FEE() external view returns (uint256);
+
     /// @notice Returns the native-token fee required to create a project.
     function creationFee() external view returns (uint256);
 
@@ -42,7 +45,7 @@ interface IJBProjects is IERC721 {
     function createFor(address owner) external payable returns (uint256 projectId);
 
     /// @notice Sets the native-token fee required to create a project and the address that receives it.
-    /// @param fee The required creation fee. Set to 0 to disable creation fees.
+    /// @param fee The required creation fee. Set to 0 to disable creation fees. Must be `<= MAX_CREATION_FEE`.
     /// @param receiver The address that receives creation fees. Must be non-zero when `fee` is non-zero.
     function setCreationFee(uint256 fee, address payable receiver) external;