@bananapus/omnichain-deployers-v6 0.0.17 → 0.0.19

package/assets/findings/nana-omnichain-deployers-v6-pashov-ai-audit-report-20260330-103536.md

@@ -0,0 +1,39 @@
+# 🔐 Security Review — nana-omnichain-deployers-v6
+
+---
+
+## Scope
+
+|                                  |                                                                                                                                                                                                             |
+| -------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| **Mode**                         | ALL / default                                                                                                                                                                                               |
+| **Files reviewed**               | `script/Deploy.s.sol` · `script/helpers/DeployersDeploymentLib.sol` · `src/JBOmnichainDeployer.sol`<br>`src/structs/JBDeployerHookConfig.sol` · `src/structs/JBOmnichain721Config.sol` · `src/structs/JBSuckerDeploymentConfig.sol`<br>`src/structs/JBTiered721HookConfig.sol` |
+| **Confidence threshold (1-100)** | 75                                                                                                                                                                                                          |
+
+---
+
+## Findings
+
+None.
+
+---
+
+Findings List
+
+| # | Confidence | Title |
+|---|---|---|
+| - | - | None |
+
+---
+
+## Leads
+
+_Vulnerability trails with concrete code smells where the full exploit path could not be completed in one analysis pass. These are not false positives — they are high-signal leads for manual review. Not scored._
+
+- **Reflexive controller validation overstates what it proves** — `JBOmnichainDeployer._validateController` — Code smells: validation is anchored to `controller.DIRECTORY()` supplied by the same controller being checked, rather than to an immutable trusted directory — This did not survive to a finding because the path does not update the canonical project rulesets or directory, so I could not complete a live exploit that changes real terminal execution. It is still worth tightening or clarifying because the current comment implies stronger authenticity guarantees than the code actually enforces.
+- **`launchRulesetsFor` semantics depend on upstream “first launch only” behavior** — `JBOmnichainDeployer._launchRulesetsFor` — Code smells: the wrapper presents a generic launch entrypoint, but upstream `JBController.launchRulesetsFor` reverts once a project already has rulesets — I did not confirm a security impact, but the API/documentation boundary is easy to misuse and should remain regression-tested so integrations do not assume it can relaunch arbitrary existing projects.
+- **Pay-hook composition assumes the 721 hook preserves its current return-shape invariants** — `JBOmnichainDeployer.beforePayRecordedWith` — Code smells: only `tiered721HookSpecs[0]` is consumed and `projectAmount` is clamped to zero if the returned split amount exceeds the payment amount — I could not prove an exploitable path in the current dependency set because the bundled 721 hook maintains the expected single-spec invariant. This remains a dependency-sensitive integration trail if the upstream hook contract or interface expectations ever change.
+
+---
+
+> ⚠️ This review was performed by an AI assistant. AI analysis can never verify the complete absence of vulnerabilities and no guarantee of security is given. Team security reviews, bug bounty programs, and on-chain monitoring are strongly recommended. For a consultation regarding your projects' security, visit [https://www.pashov.com](https://www.pashov.com)

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@bananapus/omnichain-deployers-v6",
-    "version": "0.0.17",
+    "version": "0.0.19",
     "license": "MIT",
     "repository": {
         "type": "git",
@@ -17,7 +17,7 @@
         "artifacts": "source ./.env && npx sphinx artifacts --org-id 'ea165b21-7cdc-4d7b-be59-ecdd4c26bee4' --project-name 'nana-omnichain-deployers-v6'"
     },
     "dependencies": {
-        "@bananapus/721-hook-v6": "^0.0.25",
+        "@bananapus/721-hook-v6": "^0.0.28",
         "@bananapus/address-registry-v6": "^0.0.16",
         "@bananapus/buyback-hook-v6": "^0.0.24",
         "@bananapus/core-v6": "^0.0.30",

package/test/fork/OmnichainForkTestBase.sol

@@ -235,8 +235,9 @@ abstract contract OmnichainForkTestBase is TestBaseWorkflow {
             useReserveBeneficiaryAsDefault: false,
             transfersPausable: false,
             useVotingUnits: false,
-            cannotBeRemoved: false,
-            cannotIncreaseDiscountPercent: false,
+            cantBeRemoved: false,
+            cantIncreaseDiscountPercent: false,
+            cantBuyWithCredits: false,
             splitPercent: SPLIT_PERCENT,
             splits: tierSplits
         });

package/test/fork/TestOmnichain721QueueAndAdjust.t.sol

@@ -73,8 +73,9 @@ contract TestOmnichain721QueueAndAdjust is OmnichainForkTestBase {
             useReserveBeneficiaryAsDefault: false,
             transfersPausable: false,
             useVotingUnits: false,
-            cannotBeRemoved: false,
-            cannotIncreaseDiscountPercent: false,
+            cantBeRemoved: false,
+            cantIncreaseDiscountPercent: false,
+            cantBuyWithCredits: false,
             splitPercent: 0,
             splits: new JBSplit[](0)
         });
@@ -149,8 +150,9 @@ contract TestOmnichain721QueueAndAdjust is OmnichainForkTestBase {
             useReserveBeneficiaryAsDefault: false,
             transfersPausable: false,
             useVotingUnits: false,
-            cannotBeRemoved: false,
-            cannotIncreaseDiscountPercent: false,
+            cantBeRemoved: false,
+            cantIncreaseDiscountPercent: false,
+            cantBuyWithCredits: false,
             splitPercent: 0,
             splits: new JBSplit[](0)
         });
@@ -197,8 +199,9 @@ contract TestOmnichain721QueueAndAdjust is OmnichainForkTestBase {
             useReserveBeneficiaryAsDefault: false,
             transfersPausable: false,
             useVotingUnits: false,
-            cannotBeRemoved: false,
-            cannotIncreaseDiscountPercent: false,
+            cantBeRemoved: false,
+            cantIncreaseDiscountPercent: false,
+            cantBuyWithCredits: false,
             splitPercent: 0,
             splits: new JBSplit[](0)
         });