@bananapus/omnichain-deployers-v6 0.0.23 → 0.0.24

package/ARCHITECTURE.md

@@ -31,6 +31,15 @@ caller
   -> project ownership is transferred to the intended owner
 ```
 
+### 721 Hook Carry-Forward (Queue Path)
+
+When `queueRulesetsOf` is called without new tiers, the deployer carries the existing 721 hook forward. The source ruleset is chosen with this precedence:
+
+1. **Latest queued ruleset** — if its approval status is `Approved` or `Empty` (no approval hook) and it has a hook config stored in the deployer.
+2. **Current active ruleset** — fallback when no qualifying queued ruleset exists.
+
+This ensures that a recently queued (and approved) ruleset's hook config takes precedence over a potentially stale active ruleset. The `useDataHookForCashOut` flag is also preserved from whichever source ruleset is selected.
+
 ### Pay And Cash-Out Wrapping
 
 ```text
@@ -47,6 +56,7 @@ runtime callback
 - Hook order matters: the 721 hook runs first, and the extra hook receives the updated context.
 - The deployer's predicted ruleset IDs must stay aligned with `JBRulesets` behavior; the storage keys depend on it.
 - Every project launched through this repo gets a 721 hook surface, even if it starts with zero tiers.
+- Carry-forward must prefer the latest approved queued ruleset over the current ruleset to avoid losing hook config from a recently queued update.
 
 ## Where Complexity Lives
 

package/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## v6 post-audit (M-11 fix)
+
+- **Carry-forward hook selection improved.** `queueRulesetsOf` now checks `latestQueuedOf(projectId)` before falling back to `currentOf(projectId)` when carrying forward a 721 hook. Previously it only read `currentOf`, which could miss a recently queued (and approved) ruleset's hook config. The source ruleset must have approval status `Approved` or `Empty` and a stored hook config in the deployer.
+- The `useDataHookForCashOut` flag is preserved from whichever source ruleset is selected during carry-forward.
+
 ## Scope
 
 This file describes the verified change from `nana-omnichain-deployers-v5` to the current `nana-omnichain-deployers-v6` repo.

package/RISKS.md

@@ -52,7 +52,7 @@ This file focuses on the risks in the deployer layer that launches Juicebox proj
 ## 6. Integration Risks
 
 - **Hook config keyed by predicted rulesetId.** Configs stored at `block.timestamp + i` must match the actual rulesetId assigned by the controller. If the controller assigns different IDs (e.g., due to approval hook delays), the stored configs become unreachable -- payments/cashouts fall through to default behavior (no 721 handling, no extra hook).
-- **Carried-forward 721 hook on queue.** When `tiers.length == 0`, `queueRulesetsOf` carries forward the hook from `_tiered721HookOf[projectId][latestRulesetId]`. If the latest ruleset was not deployed through this deployer, the mapping is empty and the call reverts with `JBOmnichainDeployer_InvalidHook`.
+- **Carried-forward 721 hook on queue.** When `tiers.length == 0`, `queueRulesetsOf` carries forward the hook from a previous ruleset. The source is selected by first checking `latestQueuedOf(projectId)` — if the queued ruleset's approval status is `Approved` or `Empty` and it has a stored hook config, that config is used. Otherwise it falls back to `currentOf(projectId)`. If neither has a hook deployed through this deployer, the mapping is empty and the call reverts with `JBOmnichainDeployer_InvalidHook`. The `useDataHookForCashOut` flag is also preserved from whichever source ruleset is selected.
 - **ERC721Receiver restriction.** `onERC721Received` only accepts from `PROJECTS`. Any other NFTs sent to this contract are permanently lost.
 - **Cross-reference: sucker registration.** The deployer grants `MAP_SUCKER_TOKEN` to `SUCKER_REGISTRY` with `projectId=0` (wildcard). This means the registry can map tokens for ALL projects deployed through this deployer. See [nana-suckers-v6 RISKS.md](../nana-suckers-v6/RISKS.md) for the full sucker lifecycle risks.
 - **Cross-reference: core reentrancy.** The deployer delegates to `JBController` and `JBMultiTerminal` for all fund operations. See [nana-core-v6 RISKS.md](../nana-core-v6/RISKS.md) section 3 for the reentrancy surface of these contracts.

package/USER_JOURNEYS.md

@@ -36,10 +36,11 @@
 **Success:** the deployer carries the existing hook forward, stores it against the queued ruleset, and preserves the ownership and wrapper assumptions bridge flows need.
 
 **Flow**
-1. Queue the next ruleset through the deployer using the path that reuses the existing 721 hook.
-2. Validate the controller and queued ruleset inputs before relying on the result.
-3. Let the deployer transfer or confirm hook ownership as needed so future project-controlled behavior still resolves correctly.
-4. Confirm the queued ruleset now points at the carried-forward hook rather than accidentally dropping the 721 layer.
+1. Queue the next ruleset through the deployer using the path that reuses the existing 721 hook (pass zero tiers).
+2. The deployer selects the source hook: it first checks the latest queued ruleset (if approved or with no approval hook), then falls back to the current active ruleset. This prevents losing a recently queued hook config.
+3. The `useDataHookForCashOut` flag is preserved from whichever source ruleset is selected.
+4. Validate the controller and queued ruleset inputs before relying on the result.
+5. Confirm the queued ruleset now points at the carried-forward hook rather than accidentally dropping the 721 layer.
 
 ## Journey 4: Compose A Tiered 721 Hook With A Custom Extra Hook
 

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@bananapus/omnichain-deployers-v6",
-    "version": "0.0.23",
+    "version": "0.0.24",
     "license": "MIT",
     "repository": {
         "type": "git",
@@ -17,12 +17,12 @@
         "artifacts": "source ./.env && npx sphinx artifacts --org-id 'ea165b21-7cdc-4d7b-be59-ecdd4c26bee4' --project-name 'nana-omnichain-deployers-v6'"
     },
     "dependencies": {
-        "@bananapus/721-hook-v6": "^0.0.31",
-        "@bananapus/buyback-hook-v6": "^0.0.25",
-        "@bananapus/core-v6": "^0.0.31",
+        "@bananapus/721-hook-v6": "^0.0.32",
+        "@bananapus/buyback-hook-v6": "^0.0.26",
+        "@bananapus/core-v6": "^0.0.32",
         "@bananapus/ownable-v6": "^0.0.17",
         "@bananapus/permission-ids-v6": "^0.0.15",
-        "@bananapus/suckers-v6": "^0.0.21",
+        "@bananapus/suckers-v6": "^0.0.22",
         "@openzeppelin/contracts": "^5.6.1",
         "@uniswap/v4-core": "^1.0.2"
     },

package/src/JBOmnichainDeployer.sol

@@ -3,6 +3,7 @@ pragma solidity 0.8.28;
 
 import {IJB721TiersHook} from "@bananapus/721-hook-v6/src/interfaces/IJB721TiersHook.sol";
 import {IJB721TiersHookDeployer} from "@bananapus/721-hook-v6/src/interfaces/IJB721TiersHookProjectDeployer.sol";
+import {JBApprovalStatus} from "@bananapus/core-v6/src/enums/JBApprovalStatus.sol";
 import {JBPermissioned} from "@bananapus/core-v6/src/abstract/JBPermissioned.sol";
 import {IJBController} from "@bananapus/core-v6/src/interfaces/IJBController.sol";
 import {IJBPermissions} from "@bananapus/core-v6/src/interfaces/IJBPermissions.sol";
@@ -808,10 +809,24 @@ contract JBOmnichainDeployer is
             // Use the caller-provided flag when deploying a new hook.
             use721ForCashOut = deploy721Config.useDataHookForCashOut;
         } else {
-            // Read the *current* (approved) ruleset — not `latestRulesetId` — because a queued-but-unapproved
-            // ruleset may have been rejected by the approval hook, so its hook config should not be carried forward.
-            uint256 currentRulesetId = controller.RULESETS().currentOf(projectId).id;
-            JBTiered721HookConfig memory previousConfig = _tiered721HookOf[projectId][currentRulesetId];
+            uint256 sourceRulesetId;
+            {
+                // First try the latest queued ruleset — if it's been explicitly approved
+                // (or has no approval hook), its hook config should take precedence.
+                (JBRuleset memory latestQueued, JBApprovalStatus approvalStatus) =
+                    controller.RULESETS().latestQueuedOf(projectId);
+                if (
+                    latestQueued.id != 0
+                        && (approvalStatus == JBApprovalStatus.Approved || approvalStatus == JBApprovalStatus.Empty)
+                        && address(_tiered721HookOf[projectId][latestQueued.id].hook) != address(0)
+                ) {
+                    sourceRulesetId = latestQueued.id;
+                } else {
+                    // Fall back to the current (active, approved) ruleset.
+                    sourceRulesetId = controller.RULESETS().currentOf(projectId).id;
+                }
+            }
+            JBTiered721HookConfig memory previousConfig = _tiered721HookOf[projectId][sourceRulesetId];
             hook = previousConfig.hook;
             // Revert if no hook exists to carry forward — this means no tiers were provided and
             // no previous ruleset had a 721 hook deployed through this contract.

package/test/JBOmnichainDeployer.t.sol

@@ -3,6 +3,7 @@ pragma solidity 0.8.28;
 
 import {Test} from "forge-std/Test.sol";
 
+import {JBApprovalStatus} from "@bananapus/core-v6/src/enums/JBApprovalStatus.sol";
 import {IJBController} from "@bananapus/core-v6/src/interfaces/IJBController.sol";
 import {IJBDirectory} from "@bananapus/core-v6/src/interfaces/IJBDirectory.sol";
 import {IJBPermissions} from "@bananapus/core-v6/src/interfaces/IJBPermissions.sol";
@@ -393,10 +394,22 @@ contract TestJBOmnichainDeployer is Test {
             abi.encode(launchTimestamp)
         );
 
-        // Mock currentOf to return a ruleset whose id matches the launch so carry-forward can look up the stored 721
-        // hook.
+        // Mock latestQueuedOf to return the launch ruleset with Empty approval status.
+        {
+            JBRuleset memory latestQueuedRuleset;
+            // forge-lint: disable-next-line(unsafe-typecast)
+            latestQueuedRuleset.id = uint48(launchTimestamp);
+            vm.mockCall(
+                address(rulesets),
+                abi.encodeWithSelector(IJBRulesets.latestQueuedOf.selector, projectId),
+                abi.encode(latestQueuedRuleset, JBApprovalStatus.Empty)
+            );
+        }
+
+        // Mock currentOf as a fallback (not reached when latestQueuedOf succeeds).
         {
             JBRuleset memory currentRuleset;
+            // forge-lint: disable-next-line(unsafe-typecast)
             currentRuleset.id = uint48(launchTimestamp);
             vm.mockCall(
                 address(rulesets),
@@ -485,9 +498,19 @@ contract TestJBOmnichainDeployer is Test {
             abi.encode(launchTimestamp)
         );
 
-        // Mock currentOf to return a ruleset whose id matches the launch so carry-forward can look up the stored 721
-        // hook.
+        // Mock latestQueuedOf to return the launch ruleset with Empty approval status.
+        JBRuleset memory latestQueuedRuleset;
+        // forge-lint: disable-next-line(unsafe-typecast)
+        latestQueuedRuleset.id = uint48(launchTimestamp);
+        vm.mockCall(
+            address(rulesets),
+            abi.encodeWithSelector(IJBRulesets.latestQueuedOf.selector, projectId),
+            abi.encode(latestQueuedRuleset, JBApprovalStatus.Empty)
+        );
+
+        // Mock currentOf as a fallback (not reached when latestQueuedOf succeeds).
         JBRuleset memory currentRuleset;
+        // forge-lint: disable-next-line(unsafe-typecast)
         currentRuleset.id = uint48(launchTimestamp);
         vm.mockCall(
             address(rulesets),

package/test/OmnichainDeployerEdgeCases.t.sol

@@ -3,6 +3,7 @@ pragma solidity 0.8.28;
 
 import {Test} from "forge-std/Test.sol";
 
+import {JBApprovalStatus} from "@bananapus/core-v6/src/enums/JBApprovalStatus.sol";
 import {IJBController} from "@bananapus/core-v6/src/interfaces/IJBController.sol";
 import {IJBDirectory} from "@bananapus/core-v6/src/interfaces/IJBDirectory.sol";
 import {IJBCashOutHook} from "@bananapus/core-v6/src/interfaces/IJBCashOutHook.sol";
@@ -614,6 +615,17 @@ contract OmnichainDeployerEdgeCases is Test {
             abi.encode(uint256(50)) // A past ruleset ID — no hook stored at this ID
         );
 
+        // Mock latestQueuedOf to return a ruleset with id=50 (no hook stored for this id via the deployer).
+        // The carry-forward logic checks latestQueuedOf first; since no hook was stored at id=50,
+        // it falls through to currentOf.
+        JBRuleset memory latestQueuedRuleset;
+        latestQueuedRuleset.id = uint48(50);
+        vm.mockCall(
+            address(rulesets),
+            abi.encodeWithSelector(IJBRulesets.latestQueuedOf.selector, projectId),
+            abi.encode(latestQueuedRuleset, JBApprovalStatus.Empty)
+        );
+
         // Mock currentOf to return a ruleset with id=50 (no hook stored for this id via the deployer).
         JBRuleset memory currentRuleset;
         currentRuleset.id = uint48(50);

package/test/TestAuditGaps.sol

@@ -3,6 +3,7 @@ pragma solidity 0.8.28;
 
 import {Test} from "forge-std/Test.sol";
 
+import {JBApprovalStatus} from "@bananapus/core-v6/src/enums/JBApprovalStatus.sol";
 import {IJBController} from "@bananapus/core-v6/src/interfaces/IJBController.sol";
 import {IJBDirectory} from "@bananapus/core-v6/src/interfaces/IJBDirectory.sol";
 import {IJBPayHook} from "@bananapus/core-v6/src/interfaces/IJBPayHook.sol";
@@ -539,6 +540,7 @@ contract TestAuditGaps is Test {
         // latestRulesetIdOf still = BASE_TIME (from launch).
         // Guard: BASE_TIME >= BASE_TIME + 1 -> false -> passes.
         _mockLatestRulesetId(BASE_TIME);
+        _mockLatestQueuedRuleset(BASE_TIME, JBApprovalStatus.Empty);
         _mockCurrentRulesetId(BASE_TIME);
 
         uint256 expectedQueuedId = BASE_TIME + 1;
@@ -566,6 +568,7 @@ contract TestAuditGaps is Test {
         // Warp forward 1 second for first queue.
         vm.warp(BASE_TIME + 1);
         _mockLatestRulesetId(BASE_TIME);
+        _mockLatestQueuedRuleset(BASE_TIME, JBApprovalStatus.Empty);
         _mockCurrentRulesetId(BASE_TIME);
 
         uint256 firstQueueTime = BASE_TIME + 1;
@@ -596,6 +599,7 @@ contract TestAuditGaps is Test {
 
         // Warp forward 1 more second. Now block.timestamp = BASE_TIME + 2.
         vm.warp(BASE_TIME + 2);
+        _mockLatestQueuedRuleset(firstQueueTime, JBApprovalStatus.Empty);
 
         uint256 secondQueueTime = BASE_TIME + 2;
         vm.mockCall(
@@ -674,6 +678,7 @@ contract TestAuditGaps is Test {
         // Warp past the latestRulesetId: block.timestamp = BASE_TIME + 3.
         vm.warp(BASE_TIME + 3);
         _mockLatestRulesetId(latestRulesetId);
+        _mockLatestQueuedRuleset(BASE_TIME, JBApprovalStatus.Empty);
         _mockCurrentRulesetId(BASE_TIME);
 
         uint256 expectedQueuedId = BASE_TIME + 3;
@@ -702,6 +707,7 @@ contract TestAuditGaps is Test {
         // Warp forward.
         vm.warp(BASE_TIME + 100);
         _mockLatestRulesetId(BASE_TIME);
+        _mockLatestQueuedRuleset(BASE_TIME, JBApprovalStatus.Empty);
         _mockCurrentRulesetId(BASE_TIME);
 
         uint256 expectedQueuedId = BASE_TIME + 100;
@@ -742,16 +748,8 @@ contract TestAuditGaps is Test {
         // Warp forward.
         vm.warp(BASE_TIME + 50);
         _mockLatestRulesetId(BASE_TIME);
-
-        // Mock currentOf to return a ruleset whose id matches the launch ruleset so carry-forward can look up the
-        // stored 721 hook.
-        JBRuleset memory currentRuleset;
-        currentRuleset.id = uint48(BASE_TIME);
-        vm.mockCall(
-            address(rulesetsContract),
-            abi.encodeWithSelector(IJBRulesets.currentOf.selector, projectId),
-            abi.encode(currentRuleset)
-        );
+        _mockLatestQueuedRuleset(BASE_TIME, JBApprovalStatus.Empty);
+        _mockCurrentRulesetId(BASE_TIME);
 
         uint256 expectedQueuedId = BASE_TIME + 50;
         vm.mockCall(
@@ -834,6 +832,7 @@ contract TestAuditGaps is Test {
 
         vm.warp(BASE_TIME + 10);
         _mockLatestRulesetId(BASE_TIME);
+        _mockLatestQueuedRuleset(BASE_TIME, JBApprovalStatus.Empty);
         _mockCurrentRulesetId(BASE_TIME);
 
         uint256 expectedQueuedId = BASE_TIME + 10;
@@ -883,12 +882,24 @@ contract TestAuditGaps is Test {
 
     function _mockCurrentRulesetId(uint256 currentRulesetId) internal {
         JBRuleset memory r;
+        // forge-lint: disable-next-line(unsafe-typecast)
         r.id = uint48(currentRulesetId);
         vm.mockCall(
             address(rulesetsContract), abi.encodeWithSelector(IJBRulesets.currentOf.selector, projectId), abi.encode(r)
         );
     }
 
+    function _mockLatestQueuedRuleset(uint256 rulesetId, JBApprovalStatus status) internal {
+        JBRuleset memory r;
+        // forge-lint: disable-next-line(unsafe-typecast)
+        r.id = uint48(rulesetId);
+        vm.mockCall(
+            address(rulesetsContract),
+            abi.encodeWithSelector(IJBRulesets.latestQueuedOf.selector, projectId),
+            abi.encode(r, status)
+        );
+    }
+
     function _makePayContext(uint256 pid, uint256 rid) internal returns (JBBeforePayRecordedContext memory) {
         return JBBeforePayRecordedContext({
             terminal: makeAddr("terminal"),

package/test/audit/CarryForwardRejectedHook.t.sol

@@ -30,6 +30,7 @@ import {JBOmnichain721Config} from "../../src/structs/JBOmnichain721Config.sol";
 import {JBSuckerDeploymentConfig} from "../../src/structs/JBSuckerDeploymentConfig.sol";
 
 contract RejectingApprovalHook is ERC165, IJBRulesetApprovalHook {
+    // forge-lint: disable-next-line(mixed-case-function)
     function DURATION() external pure override returns (uint256) {
         return 0;
     }
@@ -73,10 +74,12 @@ contract SequentialHookDeployer is IJB721TiersHookDeployer {
 }
 
 contract MockSuckerRegistryCarryForward is IJBSuckerRegistry {
+    // forge-lint: disable-next-line(mixed-case-function)
     function DIRECTORY() external pure override returns (IJBDirectory) {
         return IJBDirectory(address(0));
     }
 
+    // forge-lint: disable-next-line(mixed-case-function)
     function PROJECTS() external pure override returns (IJBProjects) {
         return IJBProjects(address(0));
     }
@@ -97,6 +100,7 @@ contract MockSuckerRegistryCarryForward is IJBSuckerRegistry {
         return new address[](0);
     }
 
+    // forge-lint: disable-next-line(mixed-case-function)
     function MAX_TO_REMOTE_FEE() external pure override returns (uint256) {
         return 0;
     }
@@ -236,7 +240,8 @@ contract CarryForwardRejectedHookTest is TestBaseWorkflow {
 
     function _default721Config() internal pure returns (JBOmnichain721Config memory config) {
         config.deployTiersHookConfig.tiersConfig.currency =
-            uint32(uint160(address(0x000000000000000000000000000000000000EEEe)));
+        // forge-lint: disable-next-line(unsafe-typecast)
+        uint32(uint160(address(0x000000000000000000000000000000000000EEEe)));
         config.deployTiersHookConfig.tiersConfig.decimals = 18;
     }
 
@@ -255,6 +260,7 @@ contract CarryForwardRejectedHookTest is TestBaseWorkflow {
             metadata: JBRulesetMetadata({
                 reservedPercent: 0,
                 cashOutTaxRate: 0,
+                // forge-lint: disable-next-line(unsafe-typecast)
                 baseCurrency: uint32(uint160(address(0x000000000000000000000000000000000000EEEe))),
                 pausePay: false,
                 pauseCreditTransfers: false,
@@ -290,6 +296,7 @@ contract CarryForwardRejectedHookTest is TestBaseWorkflow {
         jbPermissions()
             .setPermissionsFor(
                 owner,
+                // forge-lint: disable-next-line(unsafe-typecast)
                 JBPermissionsData({operator: address(this), projectId: uint64(projectId), permissionIds: permissionIds})
             );
 
@@ -298,7 +305,10 @@ contract CarryForwardRejectedHookTest is TestBaseWorkflow {
             .setPermissionsFor(
                 owner,
                 JBPermissionsData({
-                    operator: address(deployer), projectId: uint64(projectId), permissionIds: permissionIds
+                    operator: address(deployer),
+                    // forge-lint: disable-next-line(unsafe-typecast)
+                    projectId: uint64(projectId),
+                    permissionIds: permissionIds
                 })
             );
     }

package/test/audit/JBOmnichainDeployer.t.sol

@@ -3,6 +3,7 @@ pragma solidity 0.8.28;
 
 import {Test} from "forge-std/Test.sol";
 
+import {JBApprovalStatus} from "@bananapus/core-v6/src/enums/JBApprovalStatus.sol";
 import {JBPermissioned} from "@bananapus/core-v6/src/abstract/JBPermissioned.sol";
 import {IJBController} from "@bananapus/core-v6/src/interfaces/IJBController.sol";
 import {IJBDirectory} from "@bananapus/core-v6/src/interfaces/IJBDirectory.sol";
@@ -197,8 +198,20 @@ contract JBOmnichainDeployerTest is Test {
             abi.encode(initialRulesetId)
         );
 
-        // Mock currentOf to return a JBRuleset with id = initialRulesetId so the carry-forward lookup succeeds.
+        // Mock latestQueuedOf to return the initial ruleset with Empty approval status,
+        // so the carry-forward logic finds the 721 hook from the latest queued ruleset.
+        JBRuleset memory latestQueuedRuleset;
+        // forge-lint: disable-next-line(unsafe-typecast)
+        latestQueuedRuleset.id = uint48(initialRulesetId);
+        vm.mockCall(
+            address(rulesets),
+            abi.encodeWithSelector(IJBRulesets.latestQueuedOf.selector, PROJECT_ID),
+            abi.encode(latestQueuedRuleset, JBApprovalStatus.Empty)
+        );
+
+        // Mock currentOf as a fallback (not reached in this scenario since latestQueuedOf succeeds).
         JBRuleset memory currentRuleset;
+        // forge-lint: disable-next-line(unsafe-typecast)
         currentRuleset.id = uint48(initialRulesetId);
         vm.mockCall(
             address(rulesets),