@bananapus/omnichain-deployers-v6 0.0.23 → 0.0.25

package/ARCHITECTURE.md

@@ -31,6 +31,15 @@ caller
   -> project ownership is transferred to the intended owner
 ```
 
+### 721 Hook Carry-Forward (Queue Path)
+
+When `queueRulesetsOf` is called without new tiers, the deployer carries the existing 721 hook forward. The source ruleset is chosen with this precedence:
+
+1. **Latest queued ruleset** — if its approval status is `Approved` or `Empty` (no approval hook) and it has a hook config stored in the deployer.
+2. **Current active ruleset** — fallback when no qualifying queued ruleset exists.
+
+This ensures that a recently queued (and approved) ruleset's hook config takes precedence over a potentially stale active ruleset. The `useDataHookForCashOut` flag is also preserved from whichever source ruleset is selected.
+
 ### Pay And Cash-Out Wrapping
 
 ```text
@@ -47,6 +56,7 @@ runtime callback
 - Hook order matters: the 721 hook runs first, and the extra hook receives the updated context.
 - The deployer's predicted ruleset IDs must stay aligned with `JBRulesets` behavior; the storage keys depend on it.
 - Every project launched through this repo gets a 721 hook surface, even if it starts with zero tiers.
+- Carry-forward must prefer the latest approved queued ruleset over the current ruleset to avoid losing hook config from a recently queued update.
 
 ## Where Complexity Lives
 

package/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## v6 post-audit (M-11 fix)
+
+- **Carry-forward hook selection improved.** `queueRulesetsOf` now checks `latestQueuedOf(projectId)` before falling back to `currentOf(projectId)` when carrying forward a 721 hook. Previously it only read `currentOf`, which could miss a recently queued (and approved) ruleset's hook config. The source ruleset must have approval status `Approved` or `Empty` and a stored hook config in the deployer.
+- The `useDataHookForCashOut` flag is preserved from whichever source ruleset is selected during carry-forward.
+
 ## Scope
 
 This file describes the verified change from `nana-omnichain-deployers-v5` to the current `nana-omnichain-deployers-v6` repo.

package/RISKS.md

@@ -52,7 +52,7 @@ This file focuses on the risks in the deployer layer that launches Juicebox proj
 ## 6. Integration Risks
 
 - **Hook config keyed by predicted rulesetId.** Configs stored at `block.timestamp + i` must match the actual rulesetId assigned by the controller. If the controller assigns different IDs (e.g., due to approval hook delays), the stored configs become unreachable -- payments/cashouts fall through to default behavior (no 721 handling, no extra hook).
-- **Carried-forward 721 hook on queue.** When `tiers.length == 0`, `queueRulesetsOf` carries forward the hook from `_tiered721HookOf[projectId][latestRulesetId]`. If the latest ruleset was not deployed through this deployer, the mapping is empty and the call reverts with `JBOmnichainDeployer_InvalidHook`.
+- **Carried-forward 721 hook on queue.** When `tiers.length == 0`, `queueRulesetsOf` carries forward the hook from a previous ruleset. The source is selected by first checking `latestQueuedOf(projectId)` — if the queued ruleset's approval status is `Approved` or `Empty` and it has a stored hook config, that config is used. Otherwise it falls back to `currentOf(projectId)`. If neither has a hook deployed through this deployer, the mapping is empty and the call reverts with `JBOmnichainDeployer_InvalidHook`. The `useDataHookForCashOut` flag is also preserved from whichever source ruleset is selected.
 - **ERC721Receiver restriction.** `onERC721Received` only accepts from `PROJECTS`. Any other NFTs sent to this contract are permanently lost.
 - **Cross-reference: sucker registration.** The deployer grants `MAP_SUCKER_TOKEN` to `SUCKER_REGISTRY` with `projectId=0` (wildcard). This means the registry can map tokens for ALL projects deployed through this deployer. See [nana-suckers-v6 RISKS.md](../nana-suckers-v6/RISKS.md) for the full sucker lifecycle risks.
 - **Cross-reference: core reentrancy.** The deployer delegates to `JBController` and `JBMultiTerminal` for all fund operations. See [nana-core-v6 RISKS.md](../nana-core-v6/RISKS.md) section 3 for the reentrancy surface of these contracts.

package/USER_JOURNEYS.md

@@ -36,10 +36,11 @@
 **Success:** the deployer carries the existing hook forward, stores it against the queued ruleset, and preserves the ownership and wrapper assumptions bridge flows need.
 
 **Flow**
-1. Queue the next ruleset through the deployer using the path that reuses the existing 721 hook.
-2. Validate the controller and queued ruleset inputs before relying on the result.
-3. Let the deployer transfer or confirm hook ownership as needed so future project-controlled behavior still resolves correctly.
-4. Confirm the queued ruleset now points at the carried-forward hook rather than accidentally dropping the 721 layer.
+1. Queue the next ruleset through the deployer using the path that reuses the existing 721 hook (pass zero tiers).
+2. The deployer selects the source hook: it first checks the latest queued ruleset (if approved or with no approval hook), then falls back to the current active ruleset. This prevents losing a recently queued hook config.
+3. The `useDataHookForCashOut` flag is preserved from whichever source ruleset is selected.
+4. Validate the controller and queued ruleset inputs before relying on the result.
+5. Confirm the queued ruleset now points at the carried-forward hook rather than accidentally dropping the 721 layer.
 
 ## Journey 4: Compose A Tiered 721 Hook With A Custom Extra Hook
 

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@bananapus/omnichain-deployers-v6",
-    "version": "0.0.23",
+    "version": "0.0.25",
     "license": "MIT",
     "repository": {
         "type": "git",
@@ -17,12 +17,12 @@
         "artifacts": "source ./.env && npx sphinx artifacts --org-id 'ea165b21-7cdc-4d7b-be59-ecdd4c26bee4' --project-name 'nana-omnichain-deployers-v6'"
     },
     "dependencies": {
-        "@bananapus/721-hook-v6": "^0.0.31",
-        "@bananapus/buyback-hook-v6": "^0.0.25",
-        "@bananapus/core-v6": "^0.0.31",
+        "@bananapus/721-hook-v6": "^0.0.33",
+        "@bananapus/buyback-hook-v6": "^0.0.27",
+        "@bananapus/core-v6": "^0.0.34",
         "@bananapus/ownable-v6": "^0.0.17",
-        "@bananapus/permission-ids-v6": "^0.0.15",
-        "@bananapus/suckers-v6": "^0.0.21",
+        "@bananapus/permission-ids-v6": "^0.0.17",
+        "@bananapus/suckers-v6": "^0.0.25",
         "@openzeppelin/contracts": "^5.6.1",
         "@uniswap/v4-core": "^1.0.2"
     },
@@ -30,4 +30,4 @@
         "@bananapus/address-registry-v6": "^0.0.17",
         "@sphinx-labs/plugins": "^0.33.2"
     }
-}
+}

package/src/JBOmnichainDeployer.sol

@@ -3,6 +3,7 @@ pragma solidity 0.8.28;
 
 import {IJB721TiersHook} from "@bananapus/721-hook-v6/src/interfaces/IJB721TiersHook.sol";
 import {IJB721TiersHookDeployer} from "@bananapus/721-hook-v6/src/interfaces/IJB721TiersHookProjectDeployer.sol";
+import {JBApprovalStatus} from "@bananapus/core-v6/src/enums/JBApprovalStatus.sol";
 import {JBPermissioned} from "@bananapus/core-v6/src/abstract/JBPermissioned.sol";
 import {IJBController} from "@bananapus/core-v6/src/interfaces/IJBController.sol";
 import {IJBPermissions} from "@bananapus/core-v6/src/interfaces/IJBPermissions.sol";
@@ -132,13 +133,14 @@ contract JBOmnichainDeployer is
     // ------------------------- external views -------------------------- //
     //*********************************************************************//
 
-    /// @notice Allow cash outs from suckers without a tax.
+    /// @notice Allow cash outs from suckers without a tax, and compute cross-chain tax supply for non-sucker cash outs.
     /// @dev This function is part of `IJBRulesetDataHook`, and gets called before the revnet processes a cash out.
     /// @param context Standard Juicebox cash out context. See `JBBeforeCashOutRecordedContext`.
     /// @return cashOutTaxRate The cash out tax rate, which influences the amount of terminal tokens which get cashed
     /// out.
     /// @return cashOutCount The number of project tokens that are cashed out.
-    /// @return totalSupply The total project token supply.
+    /// @return totalSupply The total token supply across all chains (for both proportional reclaim and tax).
+    /// @return effectiveSurplusValue The global surplus across all chains for proportional reclaim.
     /// @return hookSpecifications The amount of funds and the data to send to cash out hooks (this contract).
     function beforeCashOutRecordedWith(JBBeforeCashOutRecordedContext calldata context)
         external
@@ -148,18 +150,28 @@ contract JBOmnichainDeployer is
             uint256 cashOutTaxRate,
             uint256 cashOutCount,
             uint256 totalSupply,
+            uint256 effectiveSurplusValue,
             JBCashOutHookSpecification[] memory hookSpecifications
         )
     {
         // If the cash out is from a sucker, bypass all taxes and fees.
+        // Pass through the local surplus so the reclaim calculation can compute the pro-rata share.
         if (SUCKER_REGISTRY.isSuckerOf({projectId: context.projectId, addr: context.holder})) {
-            return (0, context.cashOutCount, context.totalSupply, hookSpecifications);
+            return (0, context.cashOutCount, context.totalSupply, context.surplus.value, hookSpecifications);
         }
 
         // Start with the values from the context. Hooks below may override these.
         cashOutTaxRate = context.cashOutTaxRate;
         cashOutCount = context.cashOutCount;
-        totalSupply = context.totalSupply;
+
+        // Compute the cross-chain total supply: local supply + sum of known peer chain supplies.
+        // This prevents the cash out tax from vanishing when a holder dominates the local supply.
+        totalSupply = context.totalSupply + SUCKER_REGISTRY.remoteTotalSupplyOf(context.projectId);
+
+        // Compute the cross-chain surplus: local surplus + sum of known peer chain surpluses.
+        // This prevents disproportionate reclaim when tokens bridge away but surplus stays.
+        effectiveSurplusValue = context.surplus.value
+            + SUCKER_REGISTRY.remoteSurplusOf(context.projectId, 18, uint256(uint160(context.surplus.token)));
 
         // Will hold the 721 hook's cash out specifications (always 0 or 1 element).
         JBCashOutHookSpecification[] memory tiered721HookSpecifications;
@@ -169,8 +181,11 @@ contract JBOmnichainDeployer is
 
         // If a 721 hook is set and opted into cash out handling, let it adjust the cash out parameters.
         if (address(tiered721Config.hook) != address(0) && tiered721Config.useDataHookForCashOut) {
-            // Forward to the 721 hook. It may change the tax rate, count, supply, and return hook specs.
-            (cashOutTaxRate, cashOutCount, totalSupply, tiered721HookSpecifications) =
+            // Forward to the 721 hook. It may change the tax rate, count, and return hook specs.
+            // We discard the inner hook's effectiveSurplusValue — this contract computes the cross-chain values.
+            // We also discard its totalSupply since this contract computes the cross-chain supply.
+            // slither-disable-next-line unused-return
+            (cashOutTaxRate, cashOutCount,,, tiered721HookSpecifications) =
                 IJBRulesetDataHook(address(tiered721Config.hook)).beforeCashOutRecordedWith(context);
         }
 
@@ -188,14 +203,17 @@ contract JBOmnichainDeployer is
             hookContext.cashOutCount = cashOutCount;
             hookContext.totalSupply = totalSupply;
 
-            // Forward to the extra hook. It may further change the tax rate, count, supply, and return hook specs.
-            (cashOutTaxRate, cashOutCount, totalSupply, extraHookSpecifications) =
+            // Forward to the extra hook. It may further change the tax rate, count, and return hook specs.
+            // We discard the inner hook's effectiveSurplusValue — this contract computes the cross-chain values.
+            // We also discard its totalSupply since this contract computes the cross-chain supply.
+            // slither-disable-next-line unused-return
+            (cashOutTaxRate, cashOutCount,,, extraHookSpecifications) =
                 extraHook.dataHook.beforeCashOutRecordedWith(hookContext);
         }
 
         // If neither hook returned any specifications, return the adjusted values with no hook specs.
         if (tiered721HookSpecifications.length == 0 && extraHookSpecifications.length == 0) {
-            return (cashOutTaxRate, cashOutCount, totalSupply, hookSpecifications);
+            return (cashOutTaxRate, cashOutCount, totalSupply, effectiveSurplusValue, hookSpecifications);
         }
 
         // Merge both hooks' specifications: 721 spec (if any) first, then extra hook specs.
@@ -214,7 +232,7 @@ contract JBOmnichainDeployer is
             hookSpecifications = extraHookSpecifications;
         }
 
-        return (cashOutTaxRate, cashOutCount, totalSupply, hookSpecifications);
+        return (cashOutTaxRate, cashOutCount, totalSupply, effectiveSurplusValue, hookSpecifications);
     }
 
     /// @notice Forward the call to the original data hook.
@@ -613,6 +631,10 @@ contract JBOmnichainDeployer is
         });
     }
 
+    //*********************************************************************//
+    // -------------------------- internal views ------------------------ //
+    //*********************************************************************//
+
     //*********************************************************************//
     // ------------------------ internal functions ----------------------- //
     //*********************************************************************//
@@ -808,10 +830,24 @@ contract JBOmnichainDeployer is
             // Use the caller-provided flag when deploying a new hook.
             use721ForCashOut = deploy721Config.useDataHookForCashOut;
         } else {
-            // Read the *current* (approved) ruleset — not `latestRulesetId` — because a queued-but-unapproved
-            // ruleset may have been rejected by the approval hook, so its hook config should not be carried forward.
-            uint256 currentRulesetId = controller.RULESETS().currentOf(projectId).id;
-            JBTiered721HookConfig memory previousConfig = _tiered721HookOf[projectId][currentRulesetId];
+            uint256 sourceRulesetId;
+            {
+                // First try the latest queued ruleset — if it's been explicitly approved
+                // (or has no approval hook), its hook config should take precedence.
+                (JBRuleset memory latestQueued, JBApprovalStatus approvalStatus) =
+                    controller.RULESETS().latestQueuedOf(projectId);
+                if (
+                    latestQueued.id != 0
+                        && (approvalStatus == JBApprovalStatus.Approved || approvalStatus == JBApprovalStatus.Empty)
+                        && address(_tiered721HookOf[projectId][latestQueued.id].hook) != address(0)
+                ) {
+                    sourceRulesetId = latestQueued.id;
+                } else {
+                    // Fall back to the current (active, approved) ruleset.
+                    sourceRulesetId = controller.RULESETS().currentOf(projectId).id;
+                }
+            }
+            JBTiered721HookConfig memory previousConfig = _tiered721HookOf[projectId][sourceRulesetId];
             hook = previousConfig.hook;
             // Revert if no hook exists to carry forward — this means no tiers were provided and
             // no previous ruleset had a 721 hook deployed through this contract.

package/test/JBOmnichainDeployer.t.sol

@@ -3,6 +3,7 @@ pragma solidity 0.8.28;
 
 import {Test} from "forge-std/Test.sol";
 
+import {JBApprovalStatus} from "@bananapus/core-v6/src/enums/JBApprovalStatus.sol";
 import {IJBController} from "@bananapus/core-v6/src/interfaces/IJBController.sol";
 import {IJBDirectory} from "@bananapus/core-v6/src/interfaces/IJBDirectory.sol";
 import {IJBPermissions} from "@bananapus/core-v6/src/interfaces/IJBPermissions.sol";
@@ -88,6 +89,18 @@ contract TestJBOmnichainDeployer is Test {
             abi.encodeWithSelector(IJBRulesetDataHook.beforePayRecordedWith.selector),
             abi.encode(uint256(1000), new JBPayHookSpecification[](0))
         );
+
+        // Default: no remote supply or surplus (non-omnichain project).
+        vm.mockCall(
+            address(suckerRegistry),
+            abi.encodeWithSelector(IJBSuckerRegistry.remoteTotalSupplyOf.selector),
+            abi.encode(uint256(0))
+        );
+        vm.mockCall(
+            address(suckerRegistry),
+            abi.encodeWithSelector(IJBSuckerRegistry.remoteSurplusOf.selector),
+            abi.encode(uint256(0))
+        );
     }
 
     //*********************************************************************//
@@ -206,7 +219,7 @@ contract TestJBOmnichainDeployer is Test {
 
         JBBeforeCashOutRecordedContext memory context = _makeCashOutContext(projectId, rulesetId, sucker);
 
-        (uint256 cashOutTaxRate, uint256 cashOutCount, uint256 totalSupply,) =
+        (uint256 cashOutTaxRate, uint256 cashOutCount, uint256 totalSupply,,) =
             deployer.beforeCashOutRecordedWith(context);
 
         assertEq(cashOutTaxRate, 0, "sucker should get 0 tax");
@@ -222,7 +235,7 @@ contract TestJBOmnichainDeployer is Test {
 
         JBBeforeCashOutRecordedContext memory context = _makeCashOutContext(projectId, rulesetId, randomAddr);
 
-        (uint256 cashOutTaxRate, uint256 cashOutCount, uint256 totalSupply,) =
+        (uint256 cashOutTaxRate, uint256 cashOutCount, uint256 totalSupply,,) =
             deployer.beforeCashOutRecordedWith(context);
 
         assertEq(cashOutTaxRate, context.cashOutTaxRate, "non-sucker should get original tax");
@@ -393,10 +406,22 @@ contract TestJBOmnichainDeployer is Test {
             abi.encode(launchTimestamp)
         );
 
-        // Mock currentOf to return a ruleset whose id matches the launch so carry-forward can look up the stored 721
-        // hook.
+        // Mock latestQueuedOf to return the launch ruleset with Empty approval status.
+        {
+            JBRuleset memory latestQueuedRuleset;
+            // forge-lint: disable-next-line(unsafe-typecast)
+            latestQueuedRuleset.id = uint48(launchTimestamp);
+            vm.mockCall(
+                address(rulesets),
+                abi.encodeWithSelector(IJBRulesets.latestQueuedOf.selector, projectId),
+                abi.encode(latestQueuedRuleset, JBApprovalStatus.Empty)
+            );
+        }
+
+        // Mock currentOf as a fallback (not reached when latestQueuedOf succeeds).
         {
             JBRuleset memory currentRuleset;
+            // forge-lint: disable-next-line(unsafe-typecast)
             currentRuleset.id = uint48(launchTimestamp);
             vm.mockCall(
                 address(rulesets),
@@ -485,9 +510,19 @@ contract TestJBOmnichainDeployer is Test {
             abi.encode(launchTimestamp)
         );
 
-        // Mock currentOf to return a ruleset whose id matches the launch so carry-forward can look up the stored 721
-        // hook.
+        // Mock latestQueuedOf to return the launch ruleset with Empty approval status.
+        JBRuleset memory latestQueuedRuleset;
+        // forge-lint: disable-next-line(unsafe-typecast)
+        latestQueuedRuleset.id = uint48(launchTimestamp);
+        vm.mockCall(
+            address(rulesets),
+            abi.encodeWithSelector(IJBRulesets.latestQueuedOf.selector, projectId),
+            abi.encode(latestQueuedRuleset, JBApprovalStatus.Empty)
+        );
+
+        // Mock currentOf as a fallback (not reached when latestQueuedOf succeeds).
         JBRuleset memory currentRuleset;
+        // forge-lint: disable-next-line(unsafe-typecast)
         currentRuleset.id = uint48(launchTimestamp);
         vm.mockCall(
             address(rulesets),

package/test/JBOmnichainDeployerGuard.t.sol

@@ -82,6 +82,18 @@ contract MockSuckerRegistry is IJBSuckerRegistry {
         return new address[](0);
     }
 
+    function remoteTotalSupplyOf(uint256) external pure override returns (uint256) {
+        return 0;
+    }
+
+    function remoteBalanceOf(uint256, uint256, uint256) external pure override returns (uint256) {
+        return 0;
+    }
+
+    function remoteSurplusOf(uint256, uint256, uint256) external pure override returns (uint256) {
+        return 0;
+    }
+
     function removeDeprecatedSucker(uint256, address) external override {}
     function removeSuckerDeployer(address) external override {}
 }

package/test/OmnichainDeployerAttacks.t.sol

@@ -43,7 +43,7 @@ contract RevertingDataHook is IJBRulesetDataHook {
         external
         pure
         override
-        returns (uint256, uint256, uint256, JBCashOutHookSpecification[] memory)
+        returns (uint256, uint256, uint256, uint256, JBCashOutHookSpecification[] memory)
     {
         revert("Hook always reverts");
     }
@@ -72,9 +72,11 @@ contract InflatingDataHook is IJBRulesetDataHook {
         external
         pure
         override
-        returns (uint256, uint256, uint256, JBCashOutHookSpecification[] memory)
+        returns (uint256, uint256, uint256, uint256, JBCashOutHookSpecification[] memory)
     {
-        return (context.cashOutTaxRate, context.cashOutCount, context.totalSupply, new JBCashOutHookSpecification[](0));
+        return (
+            context.cashOutTaxRate, context.cashOutCount, context.totalSupply, 0, new JBCashOutHookSpecification[](0)
+        );
     }
 
     function hasMintPermissionFor(uint256, JBRuleset calldata, address) external pure override returns (bool) {
@@ -142,6 +144,18 @@ contract OmnichainDeployerAttacks is Test {
             abi.encodeWithSelector(IJBRulesetDataHook.beforePayRecordedWith.selector),
             abi.encode(uint256(1000), new JBPayHookSpecification[](0))
         );
+
+        // Default: no remote supply or surplus (non-omnichain project).
+        vm.mockCall(
+            address(suckerRegistry),
+            abi.encodeWithSelector(IJBSuckerRegistry.remoteTotalSupplyOf.selector),
+            abi.encode(uint256(0))
+        );
+        vm.mockCall(
+            address(suckerRegistry),
+            abi.encodeWithSelector(IJBSuckerRegistry.remoteSurplusOf.selector),
+            abi.encode(uint256(0))
+        );
     }
 
     // =========================================================================
@@ -166,7 +180,7 @@ contract OmnichainDeployerAttacks is Test {
 
         JBBeforeCashOutRecordedContext memory ctx = _makeCashOutContext(projectId, rulesetId, sucker);
 
-        (uint256 cashOutTaxRate,,,) = deployer.beforeCashOutRecordedWith(ctx);
+        (uint256 cashOutTaxRate,,,,) = deployer.beforeCashOutRecordedWith(ctx);
         assertEq(cashOutTaxRate, 0, "Sucker should get 0 tax");
     }
 
@@ -182,7 +196,7 @@ contract OmnichainDeployerAttacks is Test {
 
         JBBeforeCashOutRecordedContext memory ctx = _makeCashOutContext(projectId, rulesetId, attacker);
 
-        (uint256 cashOutTaxRate,,,) = deployer.beforeCashOutRecordedWith(ctx);
+        (uint256 cashOutTaxRate,,,,) = deployer.beforeCashOutRecordedWith(ctx);
         assertEq(cashOutTaxRate, 5000, "Non-sucker should get original tax");
     }
 
@@ -291,7 +305,7 @@ contract OmnichainDeployerAttacks is Test {
         JBBeforeCashOutRecordedContext memory ctx = _makeCashOutContext(projectId, storedRulesetId, sucker);
 
         // Sucker gets early return with 0 tax — never hits the reverting hook.
-        (uint256 cashOutTaxRate,,,) = deployer.beforeCashOutRecordedWith(ctx);
+        (uint256 cashOutTaxRate,,,,) = deployer.beforeCashOutRecordedWith(ctx);
         assertEq(cashOutTaxRate, 0, "Sucker bypasses hook and gets 0 tax");
     }
 

package/test/OmnichainDeployerEdgeCases.t.sol

@@ -3,6 +3,7 @@ pragma solidity 0.8.28;
 
 import {Test} from "forge-std/Test.sol";
 
+import {JBApprovalStatus} from "@bananapus/core-v6/src/enums/JBApprovalStatus.sol";
 import {IJBController} from "@bananapus/core-v6/src/interfaces/IJBController.sol";
 import {IJBDirectory} from "@bananapus/core-v6/src/interfaces/IJBDirectory.sol";
 import {IJBCashOutHook} from "@bananapus/core-v6/src/interfaces/IJBCashOutHook.sol";
@@ -77,7 +78,7 @@ contract CustomCashOutHook is IJBRulesetDataHook {
         external
         view
         override
-        returns (uint256, uint256, uint256, JBCashOutHookSpecification[] memory)
+        returns (uint256, uint256, uint256, uint256, JBCashOutHookSpecification[] memory)
     {
         JBCashOutHookSpecification[] memory hookSpecifications;
 
@@ -91,7 +92,7 @@ contract CustomCashOutHook is IJBRulesetDataHook {
             });
         }
 
-        return (cashOutTaxRateReturn, cashOutCountReturn, totalSupplyReturn, hookSpecifications);
+        return (cashOutTaxRateReturn, cashOutCountReturn, totalSupplyReturn, 0, hookSpecifications);
     }
 
     function hasMintPermissionFor(uint256, JBRuleset calldata, address) external view override returns (bool) {
@@ -144,6 +145,18 @@ contract OmnichainDeployerEdgeCases is Test {
             address(suckerRegistry), abi.encodeWithSelector(IJBSuckerRegistry.isSuckerOf.selector), abi.encode(false)
         );
 
+        // Default: no remote supply or surplus (non-omnichain project).
+        vm.mockCall(
+            address(suckerRegistry),
+            abi.encodeWithSelector(IJBSuckerRegistry.remoteTotalSupplyOf.selector),
+            abi.encode(uint256(0))
+        );
+        vm.mockCall(
+            address(suckerRegistry),
+            abi.encodeWithSelector(IJBSuckerRegistry.remoteSurplusOf.selector),
+            abi.encode(uint256(0))
+        );
+
         // Hook deployer mocks (every path now deploys a 721 hook).
         vm.mockCall(
             address(hookDeployer),
@@ -323,7 +336,7 @@ contract OmnichainDeployerEdgeCases is Test {
 
         JBBeforeCashOutRecordedContext memory ctx = _makeCashOutContext(projectId, rulesetId, attacker);
 
-        (uint256 cashOutTaxRate, uint256 cashOutCount, uint256 totalSupply,) = deployer.beforeCashOutRecordedWith(ctx);
+        (uint256 cashOutTaxRate, uint256 cashOutCount, uint256 totalSupply,,) = deployer.beforeCashOutRecordedWith(ctx);
         assertEq(cashOutTaxRate, 5000, "Should return original tax rate");
         assertEq(cashOutCount, 1000, "Should return original cashOutCount");
         assertEq(totalSupply, 10_000, "Should return original totalSupply");
@@ -340,10 +353,12 @@ contract OmnichainDeployerEdgeCases is Test {
 
         JBBeforeCashOutRecordedContext memory ctx = _makeCashOutContext(projectId, rulesetId, attacker);
 
-        (uint256 cashOutTaxRate, uint256 cashOutCount, uint256 totalSupply,) = deployer.beforeCashOutRecordedWith(ctx);
+        (uint256 cashOutTaxRate, uint256 cashOutCount, uint256 totalSupply,,) = deployer.beforeCashOutRecordedWith(ctx);
         assertEq(cashOutTaxRate, 2000, "Should return custom hook tax rate");
         assertEq(cashOutCount, 500, "Should return custom hook cashOutCount");
-        assertEq(totalSupply, 8000, "Should return custom hook totalSupply");
+        // The deployer discards the inner hook's totalSupply and computes cross-chain supply instead.
+        // With no suckers, this equals context.totalSupply.
+        assertEq(totalSupply, ctx.totalSupply, "Should return cross-chain totalSupply (context value with no suckers)");
     }
 
     // =========================================================================
@@ -369,7 +384,7 @@ contract OmnichainDeployerEdgeCases is Test {
 
         JBBeforeCashOutRecordedContext memory ctx = _makeCashOutContext(projectId, rulesetId, sucker);
 
-        (uint256 cashOutTaxRate, uint256 cashOutCount, uint256 totalSupply,) = deployer.beforeCashOutRecordedWith(ctx);
+        (uint256 cashOutTaxRate, uint256 cashOutCount, uint256 totalSupply,,) = deployer.beforeCashOutRecordedWith(ctx);
         assertEq(cashOutTaxRate, 0, "Sucker should get 0 tax regardless of hooks");
         assertEq(cashOutCount, 1000, "Sucker should get original cashOutCount");
         assertEq(totalSupply, 10_000, "Sucker should get original totalSupply");
@@ -390,14 +405,14 @@ contract OmnichainDeployerEdgeCases is Test {
         vm.mockCall(
             mock721,
             abi.encodeWithSelector(IJBRulesetDataHook.beforeCashOutRecordedWith.selector),
-            abi.encode(uint256(9999), uint256(1), uint256(1), new JBCashOutHookSpecification[](0))
+            abi.encode(uint256(9999), uint256(1), uint256(1), uint256(0), new JBCashOutHookSpecification[](0))
         );
 
         JBBeforeCashOutRecordedContext memory ctx = _makeCashOutContext(projectId, rulesetId, attacker);
 
         // Since useDataHookForCashOut is false, the 721 hook should NOT be called.
         // Original values should be returned.
-        (uint256 cashOutTaxRate, uint256 cashOutCount, uint256 totalSupply,) = deployer.beforeCashOutRecordedWith(ctx);
+        (uint256 cashOutTaxRate, uint256 cashOutCount, uint256 totalSupply,,) = deployer.beforeCashOutRecordedWith(ctx);
         assertEq(cashOutTaxRate, 5000, "Should return original tax rate, not 721 hook's 9999");
         assertEq(cashOutCount, 1000, "Should return original cashOutCount, not 721 hook's 1");
         assertEq(totalSupply, 10_000, "Should return original totalSupply, not 721 hook's 1");
@@ -416,10 +431,12 @@ contract OmnichainDeployerEdgeCases is Test {
         JBBeforeCashOutRecordedContext memory ctx = _makeCashOutContext(projectId, rulesetId, attacker);
 
         // Since useDataHookForCashOut is true, the custom hook SHOULD be called.
-        (uint256 cashOutTaxRate, uint256 cashOutCount, uint256 totalSupply,) = deployer.beforeCashOutRecordedWith(ctx);
+        (uint256 cashOutTaxRate, uint256 cashOutCount, uint256 totalSupply,,) = deployer.beforeCashOutRecordedWith(ctx);
         assertEq(cashOutTaxRate, 9999, "Should return custom hook's tax rate");
         assertEq(cashOutCount, 1, "Should return custom hook's cashOutCount");
-        assertEq(totalSupply, 1, "Should return custom hook's totalSupply");
+        // The deployer discards the inner hook's totalSupply and computes cross-chain supply instead.
+        // With no suckers, this equals context.totalSupply.
+        assertEq(totalSupply, ctx.totalSupply, "Should return cross-chain totalSupply (context value with no suckers)");
     }
 
     function test_beforeCashOut_merges721AndCustomHookSpecifications() public {
@@ -440,7 +457,7 @@ contract OmnichainDeployerEdgeCases is Test {
         vm.mockCall(
             mock721,
             abi.encodeWithSelector(IJBRulesetDataHook.beforeCashOutRecordedWith.selector),
-            abi.encode(uint256(4000), uint256(700), uint256(9000), specs)
+            abi.encode(uint256(4000), uint256(700), uint256(9000), uint256(0), specs)
         );
 
         JBBeforeCashOutRecordedContext memory ctx = _makeCashOutContext(projectId, rulesetId, attacker);
@@ -448,13 +465,15 @@ contract OmnichainDeployerEdgeCases is Test {
         (
             uint256 cashOutTaxRate,
             uint256 cashOutCount,
-            uint256 totalSupply,
+            uint256 totalSupply,,
             JBCashOutHookSpecification[] memory hookSpecifications
         ) = deployer.beforeCashOutRecordedWith(ctx);
 
         assertEq(cashOutTaxRate, 2000, "Custom hook should receive and override 721-adjusted tax rate");
         assertEq(cashOutCount, 500, "Custom hook should receive and override 721-adjusted cashOutCount");
-        assertEq(totalSupply, 8000, "Custom hook should receive and override 721-adjusted totalSupply");
+        // The deployer discards the inner hook's totalSupply and computes cross-chain supply instead.
+        // With no suckers, this equals context.totalSupply.
+        assertEq(totalSupply, ctx.totalSupply, "Should return cross-chain totalSupply (context value with no suckers)");
         assertEq(hookSpecifications.length, 2, "721 and custom cash out specs should both be returned");
         assertEq(address(hookSpecifications[0].hook), mock721, "721 hook spec should come first");
         assertEq(hookSpecifications[0].amount, 11, "721 hook spec amount should be preserved");
@@ -476,7 +495,7 @@ contract OmnichainDeployerEdgeCases is Test {
         JBBeforeCashOutRecordedContext memory ctx = _makeCashOutContext(projectId, rulesetId, attacker);
 
         // Since useDataHookForCashOut is false, the custom hook should NOT be called.
-        (uint256 cashOutTaxRate, uint256 cashOutCount, uint256 totalSupply,) = deployer.beforeCashOutRecordedWith(ctx);
+        (uint256 cashOutTaxRate, uint256 cashOutCount, uint256 totalSupply,,) = deployer.beforeCashOutRecordedWith(ctx);
         assertEq(cashOutTaxRate, 5000, "Should return original tax rate, not custom hook's 2000");
         assertEq(cashOutCount, 1000, "Should return original cashOutCount, not custom hook's 1");
         assertEq(totalSupply, 10_000, "Should return original totalSupply, not custom hook's 1");
@@ -493,7 +512,7 @@ contract OmnichainDeployerEdgeCases is Test {
         JBBeforeCashOutRecordedContext memory ctx = _makeCashOutContext(projectId, rulesetId, attacker);
 
         // No 721 hook, no custom hook — should fall through to original values.
-        (uint256 cashOutTaxRate, uint256 cashOutCount, uint256 totalSupply,) = deployer.beforeCashOutRecordedWith(ctx);
+        (uint256 cashOutTaxRate, uint256 cashOutCount, uint256 totalSupply,,) = deployer.beforeCashOutRecordedWith(ctx);
         assertEq(cashOutTaxRate, 5000, "Should return original tax rate");
         assertEq(cashOutCount, 1000, "Should return original cashOutCount");
         assertEq(totalSupply, 10_000, "Should return original totalSupply");
@@ -614,6 +633,17 @@ contract OmnichainDeployerEdgeCases is Test {
             abi.encode(uint256(50)) // A past ruleset ID — no hook stored at this ID
         );
 
+        // Mock latestQueuedOf to return a ruleset with id=50 (no hook stored for this id via the deployer).
+        // The carry-forward logic checks latestQueuedOf first; since no hook was stored at id=50,
+        // it falls through to currentOf.
+        JBRuleset memory latestQueuedRuleset;
+        latestQueuedRuleset.id = uint48(50);
+        vm.mockCall(
+            address(rulesets),
+            abi.encodeWithSelector(IJBRulesets.latestQueuedOf.selector, projectId),
+            abi.encode(latestQueuedRuleset, JBApprovalStatus.Empty)
+        );
+
         // Mock currentOf to return a ruleset with id=50 (no hook stored for this id via the deployer).
         JBRuleset memory currentRuleset;
         currentRuleset.id = uint48(50);

package/test/TestAuditGaps.sol

@@ -3,6 +3,7 @@ pragma solidity 0.8.28;
 
 import {Test} from "forge-std/Test.sol";
 
+import {JBApprovalStatus} from "@bananapus/core-v6/src/enums/JBApprovalStatus.sol";
 import {IJBController} from "@bananapus/core-v6/src/interfaces/IJBController.sol";
 import {IJBDirectory} from "@bananapus/core-v6/src/interfaces/IJBDirectory.sol";
 import {IJBPayHook} from "@bananapus/core-v6/src/interfaces/IJBPayHook.sol";
@@ -54,9 +55,11 @@ contract PayRevertingHook is IJBRulesetDataHook {
         external
         pure
         override
-        returns (uint256, uint256, uint256, JBCashOutHookSpecification[] memory)
+        returns (uint256, uint256, uint256, uint256, JBCashOutHookSpecification[] memory)
     {
-        return (context.cashOutTaxRate, context.cashOutCount, context.totalSupply, new JBCashOutHookSpecification[](0));
+        return (
+            context.cashOutTaxRate, context.cashOutCount, context.totalSupply, 0, new JBCashOutHookSpecification[](0)
+        );
     }
 
     function hasMintPermissionFor(uint256, JBRuleset calldata, address) external pure override returns (bool) {
@@ -85,7 +88,7 @@ contract CashOutRevertingHook is IJBRulesetDataHook {
         external
         pure
         override
-        returns (uint256, uint256, uint256, JBCashOutHookSpecification[] memory)
+        returns (uint256, uint256, uint256, uint256, JBCashOutHookSpecification[] memory)
     {
         revert CustomCashOutError();
     }
@@ -116,9 +119,11 @@ contract MintPermissionRevertingHook is IJBRulesetDataHook {
         external
         pure
         override
-        returns (uint256, uint256, uint256, JBCashOutHookSpecification[] memory)
+        returns (uint256, uint256, uint256, uint256, JBCashOutHookSpecification[] memory)
     {
-        return (context.cashOutTaxRate, context.cashOutCount, context.totalSupply, new JBCashOutHookSpecification[](0));
+        return (
+            context.cashOutTaxRate, context.cashOutCount, context.totalSupply, 0, new JBCashOutHookSpecification[](0)
+        );
     }
 
     function hasMintPermissionFor(uint256, JBRuleset calldata, address) external pure override returns (bool) {
@@ -145,10 +150,10 @@ contract ExtremeCashOutHook is IJBRulesetDataHook {
         external
         pure
         override
-        returns (uint256, uint256, uint256, JBCashOutHookSpecification[] memory)
+        returns (uint256, uint256, uint256, uint256, JBCashOutHookSpecification[] memory)
     {
         // Return extreme values: max tax rate, zero count, max supply.
-        return (type(uint256).max, 0, type(uint256).max, new JBCashOutHookSpecification[](0));
+        return (type(uint256).max, 0, type(uint256).max, 0, new JBCashOutHookSpecification[](0));
     }
 
     function hasMintPermissionFor(uint256, JBRuleset calldata, address) external pure override returns (bool) {
@@ -188,9 +193,11 @@ contract ManySpecsHook is IJBRulesetDataHook {
         external
         pure
         override
-        returns (uint256, uint256, uint256, JBCashOutHookSpecification[] memory)
+        returns (uint256, uint256, uint256, uint256, JBCashOutHookSpecification[] memory)
     {
-        return (context.cashOutTaxRate, context.cashOutCount, context.totalSupply, new JBCashOutHookSpecification[](0));
+        return (
+            context.cashOutTaxRate, context.cashOutCount, context.totalSupply, 0, new JBCashOutHookSpecification[](0)
+        );
     }
 
     function hasMintPermissionFor(uint256, JBRuleset calldata, address) external pure override returns (bool) {
@@ -218,9 +225,11 @@ contract ZeroWeightHook is IJBRulesetDataHook {
         external
         pure
         override
-        returns (uint256, uint256, uint256, JBCashOutHookSpecification[] memory)
+        returns (uint256, uint256, uint256, uint256, JBCashOutHookSpecification[] memory)
     {
-        return (context.cashOutTaxRate, context.cashOutCount, context.totalSupply, new JBCashOutHookSpecification[](0));
+        return (
+            context.cashOutTaxRate, context.cashOutCount, context.totalSupply, 0, new JBCashOutHookSpecification[](0)
+        );
     }
 
     function hasMintPermissionFor(uint256, JBRuleset calldata, address) external pure override returns (bool) {
@@ -309,6 +318,18 @@ contract TestAuditGaps is Test {
             address(suckerRegistry), abi.encodeWithSelector(IJBSuckerRegistry.isSuckerOf.selector), abi.encode(false)
         );
 
+        // Default: no remote supply or surplus (non-omnichain project).
+        vm.mockCall(
+            address(suckerRegistry),
+            abi.encodeWithSelector(IJBSuckerRegistry.remoteTotalSupplyOf.selector),
+            abi.encode(uint256(0))
+        );
+        vm.mockCall(
+            address(suckerRegistry),
+            abi.encodeWithSelector(IJBSuckerRegistry.remoteSurplusOf.selector),
+            abi.encode(uint256(0))
+        );
+
         // Default 721 hook mock: returns context weight and empty specs (0 tiers, no splits).
         // A real 721 hook with no tiers returns contextWeight unchanged.
         vm.mockCall(
@@ -368,7 +389,7 @@ contract TestAuditGaps is Test {
         JBBeforeCashOutRecordedContext memory ctx = _makeCashOutContext(projectId, storedRulesetId, sucker);
 
         // Sucker gets early return -- never hits the reverting hook.
-        (uint256 cashOutTaxRate, uint256 cashOutCount, uint256 totalSupply,) = deployer.beforeCashOutRecordedWith(ctx);
+        (uint256 cashOutTaxRate, uint256 cashOutCount, uint256 totalSupply,,) = deployer.beforeCashOutRecordedWith(ctx);
         assertEq(cashOutTaxRate, 0, "Sucker should get 0 tax even with reverting hook");
         assertEq(cashOutCount, ctx.cashOutCount, "Sucker cashOutCount should pass through");
         assertEq(totalSupply, ctx.totalSupply, "Sucker totalSupply should pass through");
@@ -426,10 +447,12 @@ contract TestAuditGaps is Test {
 
         JBBeforeCashOutRecordedContext memory ctx = _makeCashOutContext(projectId, storedRulesetId, attacker);
 
-        (uint256 cashOutTaxRate, uint256 cashOutCount, uint256 totalSupply,) = deployer.beforeCashOutRecordedWith(ctx);
+        (uint256 cashOutTaxRate, uint256 cashOutCount, uint256 totalSupply,,) = deployer.beforeCashOutRecordedWith(ctx);
         assertEq(cashOutTaxRate, type(uint256).max, "Should pass through max tax rate from hook");
         assertEq(cashOutCount, 0, "Should pass through 0 count from hook");
-        assertEq(totalSupply, type(uint256).max, "Should pass through max supply from hook");
+        // The deployer discards the inner hook's totalSupply and computes cross-chain supply instead.
+        // With no suckers, this equals context.totalSupply.
+        assertEq(totalSupply, ctx.totalSupply, "Should return cross-chain totalSupply (context value with no suckers)");
     }
 
     // -------------------------------------------------------------------------
@@ -481,7 +504,7 @@ contract TestAuditGaps is Test {
         // Cash out should work since the hook only reverts for pay (useDataHookForCashOut = false).
         JBBeforeCashOutRecordedContext memory ctx = _makeCashOutContext(projectId, storedRulesetId, attacker);
 
-        (uint256 cashOutTaxRate, uint256 cashOutCount, uint256 totalSupply,) = deployer.beforeCashOutRecordedWith(ctx);
+        (uint256 cashOutTaxRate, uint256 cashOutCount, uint256 totalSupply,,) = deployer.beforeCashOutRecordedWith(ctx);
         assertEq(cashOutTaxRate, ctx.cashOutTaxRate, "Cash out should return original tax rate");
         assertEq(cashOutCount, ctx.cashOutCount, "Cash out should return original count");
         assertEq(totalSupply, ctx.totalSupply, "Cash out should return original supply");
@@ -539,6 +562,7 @@ contract TestAuditGaps is Test {
         // latestRulesetIdOf still = BASE_TIME (from launch).
         // Guard: BASE_TIME >= BASE_TIME + 1 -> false -> passes.
         _mockLatestRulesetId(BASE_TIME);
+        _mockLatestQueuedRuleset(BASE_TIME, JBApprovalStatus.Empty);
         _mockCurrentRulesetId(BASE_TIME);
 
         uint256 expectedQueuedId = BASE_TIME + 1;
@@ -566,6 +590,7 @@ contract TestAuditGaps is Test {
         // Warp forward 1 second for first queue.
         vm.warp(BASE_TIME + 1);
         _mockLatestRulesetId(BASE_TIME);
+        _mockLatestQueuedRuleset(BASE_TIME, JBApprovalStatus.Empty);
         _mockCurrentRulesetId(BASE_TIME);
 
         uint256 firstQueueTime = BASE_TIME + 1;
@@ -596,6 +621,7 @@ contract TestAuditGaps is Test {
 
         // Warp forward 1 more second. Now block.timestamp = BASE_TIME + 2.
         vm.warp(BASE_TIME + 2);
+        _mockLatestQueuedRuleset(firstQueueTime, JBApprovalStatus.Empty);
 
         uint256 secondQueueTime = BASE_TIME + 2;
         vm.mockCall(
@@ -674,6 +700,7 @@ contract TestAuditGaps is Test {
         // Warp past the latestRulesetId: block.timestamp = BASE_TIME + 3.
         vm.warp(BASE_TIME + 3);
         _mockLatestRulesetId(latestRulesetId);
+        _mockLatestQueuedRuleset(BASE_TIME, JBApprovalStatus.Empty);
         _mockCurrentRulesetId(BASE_TIME);
 
         uint256 expectedQueuedId = BASE_TIME + 3;
@@ -702,6 +729,7 @@ contract TestAuditGaps is Test {
         // Warp forward.
         vm.warp(BASE_TIME + 100);
         _mockLatestRulesetId(BASE_TIME);
+        _mockLatestQueuedRuleset(BASE_TIME, JBApprovalStatus.Empty);
         _mockCurrentRulesetId(BASE_TIME);
 
         uint256 expectedQueuedId = BASE_TIME + 100;
@@ -742,16 +770,8 @@ contract TestAuditGaps is Test {
         // Warp forward.
         vm.warp(BASE_TIME + 50);
         _mockLatestRulesetId(BASE_TIME);
-
-        // Mock currentOf to return a ruleset whose id matches the launch ruleset so carry-forward can look up the
-        // stored 721 hook.
-        JBRuleset memory currentRuleset;
-        currentRuleset.id = uint48(BASE_TIME);
-        vm.mockCall(
-            address(rulesetsContract),
-            abi.encodeWithSelector(IJBRulesets.currentOf.selector, projectId),
-            abi.encode(currentRuleset)
-        );
+        _mockLatestQueuedRuleset(BASE_TIME, JBApprovalStatus.Empty);
+        _mockCurrentRulesetId(BASE_TIME);
 
         uint256 expectedQueuedId = BASE_TIME + 50;
         vm.mockCall(
@@ -834,6 +854,7 @@ contract TestAuditGaps is Test {
 
         vm.warp(BASE_TIME + 10);
         _mockLatestRulesetId(BASE_TIME);
+        _mockLatestQueuedRuleset(BASE_TIME, JBApprovalStatus.Empty);
         _mockCurrentRulesetId(BASE_TIME);
 
         uint256 expectedQueuedId = BASE_TIME + 10;
@@ -883,12 +904,24 @@ contract TestAuditGaps is Test {
 
     function _mockCurrentRulesetId(uint256 currentRulesetId) internal {
         JBRuleset memory r;
+        // forge-lint: disable-next-line(unsafe-typecast)
         r.id = uint48(currentRulesetId);
         vm.mockCall(
             address(rulesetsContract), abi.encodeWithSelector(IJBRulesets.currentOf.selector, projectId), abi.encode(r)
         );
     }
 
+    function _mockLatestQueuedRuleset(uint256 rulesetId, JBApprovalStatus status) internal {
+        JBRuleset memory r;
+        // forge-lint: disable-next-line(unsafe-typecast)
+        r.id = uint48(rulesetId);
+        vm.mockCall(
+            address(rulesetsContract),
+            abi.encodeWithSelector(IJBRulesets.latestQueuedOf.selector, projectId),
+            abi.encode(r, status)
+        );
+    }
+
     function _makePayContext(uint256 pid, uint256 rid) internal returns (JBBeforePayRecordedContext memory) {
         return JBBeforePayRecordedContext({
             terminal: makeAddr("terminal"),

package/test/Tiered721HookComposition.t.sol

@@ -106,6 +106,16 @@ contract Tiered721HookComposition is Test {
         vm.mockCall(
             address(suckerRegistry), abi.encodeWithSelector(IJBSuckerRegistry.isSuckerOf.selector), abi.encode(false)
         );
+        vm.mockCall(
+            address(suckerRegistry),
+            abi.encodeWithSelector(IJBSuckerRegistry.remoteTotalSupplyOf.selector),
+            abi.encode(uint256(0))
+        );
+        vm.mockCall(
+            address(suckerRegistry),
+            abi.encodeWithSelector(IJBSuckerRegistry.remoteSurplusOf.selector),
+            abi.encode(uint256(0))
+        );
         JBPayHookSpecification[] memory default721Specs = new JBPayHookSpecification[](1);
         default721Specs[0] =
             JBPayHookSpecification({hook: IJBPayHook(hookAddr), noop: false, amount: 0, metadata: bytes("")});
@@ -330,7 +340,7 @@ contract Tiered721HookComposition is Test {
             abi.encode(true)
         );
         JBBeforeCashOutRecordedContext memory context = _makeCashOutContext(projectId, block.timestamp, sucker);
-        (uint256 taxRate, uint256 cashOutCount, uint256 totalSupply,) = deployer.beforeCashOutRecordedWith(context);
+        (uint256 taxRate, uint256 cashOutCount, uint256 totalSupply,,) = deployer.beforeCashOutRecordedWith(context);
         assertEq(taxRate, 0, "sucker gets 0 tax");
         assertEq(cashOutCount, context.cashOutCount);
         assertEq(totalSupply, context.totalSupply);
@@ -349,13 +359,15 @@ contract Tiered721HookComposition is Test {
         vm.mockCall(
             buybackHookAddr,
             abi.encodeWithSelector(IJBRulesetDataHook.beforeCashOutRecordedWith.selector),
-            abi.encode(uint256(3000), uint256(500), uint256(5000), cashOutSpecs)
+            abi.encode(uint256(3000), uint256(500), uint256(5000), uint256(0), cashOutSpecs)
         );
         JBBeforeCashOutRecordedContext memory context = _makeCashOutContext(projectId, block.timestamp, randomAddr);
-        (uint256 taxRate, uint256 cashOutCount, uint256 totalSupply,) = deployer.beforeCashOutRecordedWith(context);
+        (uint256 taxRate, uint256 cashOutCount, uint256 totalSupply,,) = deployer.beforeCashOutRecordedWith(context);
         assertEq(taxRate, 3000, "buyback hook's tax rate");
         assertEq(cashOutCount, 500, "buyback hook's cashOutCount");
-        assertEq(totalSupply, 5000, "buyback hook's totalSupply");
+        // The deployer discards the inner hook's totalSupply and computes cross-chain supply instead.
+        // With no suckers, this equals context.totalSupply.
+        assertEq(totalSupply, context.totalSupply, "cross-chain totalSupply (context value with no suckers)");
     }
 
     function test_beforeCashOut_zeroTiers_forwardsToUserHook() public {
@@ -375,13 +387,15 @@ contract Tiered721HookComposition is Test {
         vm.mockCall(
             customHookAddr,
             abi.encodeWithSelector(IJBRulesetDataHook.beforeCashOutRecordedWith.selector),
-            abi.encode(uint256(2000), uint256(100), uint256(1000), cashOutSpecs)
+            abi.encode(uint256(2000), uint256(100), uint256(1000), uint256(0), cashOutSpecs)
         );
         JBBeforeCashOutRecordedContext memory context = _makeCashOutContext(projectId, block.timestamp, randomAddr);
-        (uint256 taxRate, uint256 cashOutCount, uint256 totalSupply,) = deployer.beforeCashOutRecordedWith(context);
+        (uint256 taxRate, uint256 cashOutCount, uint256 totalSupply,,) = deployer.beforeCashOutRecordedWith(context);
         assertEq(taxRate, 2000, "user hook's tax rate");
         assertEq(cashOutCount, 100, "user hook's cashOutCount");
-        assertEq(totalSupply, 1000, "user hook's totalSupply");
+        // The deployer discards the inner hook's totalSupply and computes cross-chain supply instead.
+        // With no suckers, this equals context.totalSupply.
+        assertEq(totalSupply, context.totalSupply, "cross-chain totalSupply (context value with no suckers)");
     }
 
     function test_beforeCashOut_zeroTiers_noUserHook_returnsOriginal() public {
@@ -398,7 +412,7 @@ contract Tiered721HookComposition is Test {
             controller
         );
         JBBeforeCashOutRecordedContext memory context = _makeCashOutContext(projectId, block.timestamp, randomAddr);
-        (uint256 taxRate, uint256 cashOutCount, uint256 totalSupply,) = deployer.beforeCashOutRecordedWith(context);
+        (uint256 taxRate, uint256 cashOutCount, uint256 totalSupply,,) = deployer.beforeCashOutRecordedWith(context);
         assertEq(taxRate, context.cashOutTaxRate, "original tax rate");
         assertEq(cashOutCount, context.cashOutCount);
         assertEq(totalSupply, context.totalSupply);

package/test/audit/CarryForwardRejectedHook.t.sol

@@ -30,6 +30,7 @@ import {JBOmnichain721Config} from "../../src/structs/JBOmnichain721Config.sol";
 import {JBSuckerDeploymentConfig} from "../../src/structs/JBSuckerDeploymentConfig.sol";
 
 contract RejectingApprovalHook is ERC165, IJBRulesetApprovalHook {
+    // forge-lint: disable-next-line(mixed-case-function)
     function DURATION() external pure override returns (uint256) {
         return 0;
     }
@@ -73,10 +74,12 @@ contract SequentialHookDeployer is IJB721TiersHookDeployer {
 }
 
 contract MockSuckerRegistryCarryForward is IJBSuckerRegistry {
+    // forge-lint: disable-next-line(mixed-case-function)
     function DIRECTORY() external pure override returns (IJBDirectory) {
         return IJBDirectory(address(0));
     }
 
+    // forge-lint: disable-next-line(mixed-case-function)
     function PROJECTS() external pure override returns (IJBProjects) {
         return IJBProjects(address(0));
     }
@@ -97,6 +100,7 @@ contract MockSuckerRegistryCarryForward is IJBSuckerRegistry {
         return new address[](0);
     }
 
+    // forge-lint: disable-next-line(mixed-case-function)
     function MAX_TO_REMOTE_FEE() external pure override returns (uint256) {
         return 0;
     }
@@ -122,6 +126,18 @@ contract MockSuckerRegistryCarryForward is IJBSuckerRegistry {
         return new address[](0);
     }
 
+    function remoteTotalSupplyOf(uint256) external pure override returns (uint256) {
+        return 0;
+    }
+
+    function remoteBalanceOf(uint256, uint256, uint256) external pure override returns (uint256) {
+        return 0;
+    }
+
+    function remoteSurplusOf(uint256, uint256, uint256) external pure override returns (uint256) {
+        return 0;
+    }
+
     function removeDeprecatedSucker(uint256, address) external override {}
     function removeSuckerDeployer(address) external override {}
 }
@@ -236,7 +252,8 @@ contract CarryForwardRejectedHookTest is TestBaseWorkflow {
 
     function _default721Config() internal pure returns (JBOmnichain721Config memory config) {
         config.deployTiersHookConfig.tiersConfig.currency =
-            uint32(uint160(address(0x000000000000000000000000000000000000EEEe)));
+        // forge-lint: disable-next-line(unsafe-typecast)
+        uint32(uint160(address(0x000000000000000000000000000000000000EEEe)));
         config.deployTiersHookConfig.tiersConfig.decimals = 18;
     }
 
@@ -255,6 +272,7 @@ contract CarryForwardRejectedHookTest is TestBaseWorkflow {
             metadata: JBRulesetMetadata({
                 reservedPercent: 0,
                 cashOutTaxRate: 0,
+                // forge-lint: disable-next-line(unsafe-typecast)
                 baseCurrency: uint32(uint160(address(0x000000000000000000000000000000000000EEEe))),
                 pausePay: false,
                 pauseCreditTransfers: false,
@@ -290,6 +308,7 @@ contract CarryForwardRejectedHookTest is TestBaseWorkflow {
         jbPermissions()
             .setPermissionsFor(
                 owner,
+                // forge-lint: disable-next-line(unsafe-typecast)
                 JBPermissionsData({operator: address(this), projectId: uint64(projectId), permissionIds: permissionIds})
             );
 
@@ -298,7 +317,10 @@ contract CarryForwardRejectedHookTest is TestBaseWorkflow {
             .setPermissionsFor(
                 owner,
                 JBPermissionsData({
-                    operator: address(deployer), projectId: uint64(projectId), permissionIds: permissionIds
+                    operator: address(deployer),
+                    // forge-lint: disable-next-line(unsafe-typecast)
+                    projectId: uint64(projectId),
+                    permissionIds: permissionIds
                 })
             );
     }

package/test/audit/CodexNemesisAudit.t.sol

@@ -0,0 +1,158 @@
+// SPDX-License-Identifier: MIT
+pragma solidity 0.8.28;
+
+import {Test} from "forge-std/Test.sol";
+
+import {JBPermissioned} from "@bananapus/core-v6/src/abstract/JBPermissioned.sol";
+import {IJBController} from "@bananapus/core-v6/src/interfaces/IJBController.sol";
+import {IJBDirectory} from "@bananapus/core-v6/src/interfaces/IJBDirectory.sol";
+import {IJBPermissions} from "@bananapus/core-v6/src/interfaces/IJBPermissions.sol";
+import {IJBProjects} from "@bananapus/core-v6/src/interfaces/IJBProjects.sol";
+import {JBRulesetConfig} from "@bananapus/core-v6/src/structs/JBRulesetConfig.sol";
+import {JBRulesetMetadata} from "@bananapus/core-v6/src/structs/JBRulesetMetadata.sol";
+import {JBTerminalConfig} from "@bananapus/core-v6/src/structs/JBTerminalConfig.sol";
+import {JBConstants} from "@bananapus/core-v6/src/libraries/JBConstants.sol";
+import {IJB721TiersHook} from "@bananapus/721-hook-v6/src/interfaces/IJB721TiersHook.sol";
+import {IJB721TiersHookDeployer} from "@bananapus/721-hook-v6/src/interfaces/IJB721TiersHookProjectDeployer.sol";
+import {IJBOwnable} from "@bananapus/ownable-v6/src/interfaces/IJBOwnable.sol";
+import {JBPermissionIds} from "@bananapus/permission-ids-v6/src/JBPermissionIds.sol";
+import {JBSuckerRegistry} from "@bananapus/suckers-v6/src/JBSuckerRegistry.sol";
+import {IJBSuckerRegistry} from "@bananapus/suckers-v6/src/interfaces/IJBSuckerRegistry.sol";
+import {JBSuckerDeployerConfig} from "@bananapus/suckers-v6/src/structs/JBSuckerDeployerConfig.sol";
+import {IERC165} from "@openzeppelin/contracts/utils/introspection/IERC165.sol";
+import {IERC721} from "@openzeppelin/contracts/token/ERC721/IERC721.sol";
+
+import {JBOmnichainDeployer} from "../../src/JBOmnichainDeployer.sol";
+import {JBOmnichain721Config} from "../../src/structs/JBOmnichain721Config.sol";
+import {JBSuckerDeploymentConfig} from "../../src/structs/JBSuckerDeploymentConfig.sol";
+
+contract CodexNemesisAudit is Test {
+    IJBPermissions internal permissions = IJBPermissions(makeAddr("permissions"));
+    IJBProjects internal projects = IJBProjects(makeAddr("projects"));
+    IJB721TiersHookDeployer internal hookDeployer = IJB721TiersHookDeployer(makeAddr("hookDeployer"));
+    IJBSuckerRegistry internal mockSuckerRegistry = IJBSuckerRegistry(makeAddr("suckerRegistry"));
+    IJBController internal controller = IJBController(makeAddr("controller"));
+    IJBDirectory internal directory = IJBDirectory(makeAddr("directory"));
+    address internal hookAddr = makeAddr("hook721");
+    address internal projectOwner = makeAddr("projectOwner");
+    address internal operator = makeAddr("operator");
+
+    uint256 internal constant PROJECT_ID = 42;
+
+    function setUp() public {
+        vm.mockCall(
+            address(permissions), abi.encodeWithSelector(IJBPermissions.setPermissionsFor.selector), abi.encode()
+        );
+        vm.mockCall(
+            address(permissions), abi.encodeWithSelector(IJBPermissions.hasPermission.selector), abi.encode(true)
+        );
+        vm.mockCall(
+            address(projects), abi.encodeWithSelector(IERC721.ownerOf.selector, PROJECT_ID), abi.encode(projectOwner)
+        );
+        vm.mockCall(
+            address(hookDeployer),
+            abi.encodeWithSelector(IJB721TiersHookDeployer.deployHookFor.selector),
+            abi.encode(IJB721TiersHook(hookAddr))
+        );
+        vm.mockCall(hookAddr, abi.encodeWithSelector(IJBOwnable.transferOwnershipToProject.selector), abi.encode());
+    }
+
+    function test_poc_launchRulesetsFor_revertsWhenProjectHasNoControllerYet() public {
+        JBOmnichainDeployer deployer =
+            new JBOmnichainDeployer(mockSuckerRegistry, hookDeployer, permissions, projects, address(0));
+
+        vm.mockCall(
+            address(controller), abi.encodeWithSelector(IJBController.DIRECTORY.selector), abi.encode(directory)
+        );
+        // A freshly created project with no controller yet is valid for core launchRulesetsFor,
+        // but the deployer rejects it before the controller can set itself as first controller.
+        vm.mockCall(
+            address(directory),
+            abi.encodeWithSelector(IJBDirectory.controllerOf.selector, PROJECT_ID),
+            abi.encode(IERC165(address(0)))
+        );
+
+        JBRulesetConfig[] memory configs = new JBRulesetConfig[](1);
+        configs[0] = _makeRulesetConfig();
+
+        vm.prank(projectOwner);
+        vm.expectRevert(JBOmnichainDeployer.JBOmnichainDeployer_ControllerMismatch.selector);
+        deployer.launchRulesetsFor(PROJECT_ID, configs, new JBTerminalConfig[](0), "memo", controller);
+    }
+
+    function test_poc_deploySuckersFor_requiresHiddenPermissionForDeployerItself() public {
+        vm.mockCall(address(directory), abi.encodeWithSelector(IJBDirectory.PROJECTS.selector), abi.encode(projects));
+
+        JBSuckerRegistry registry = new JBSuckerRegistry(directory, permissions, address(this), address(0));
+        JBOmnichainDeployer deployer = new JBOmnichainDeployer(
+            IJBSuckerRegistry(address(registry)), hookDeployer, permissions, projects, address(0)
+        );
+
+        vm.mockCall(
+            address(permissions),
+            abi.encodeWithSelector(
+                IJBPermissions.hasPermission.selector,
+                operator,
+                projectOwner,
+                PROJECT_ID,
+                JBPermissionIds.DEPLOY_SUCKERS,
+                true,
+                true
+            ),
+            abi.encode(true)
+        );
+        vm.mockCall(
+            address(permissions),
+            abi.encodeWithSelector(
+                IJBPermissions.hasPermission.selector,
+                address(deployer),
+                projectOwner,
+                PROJECT_ID,
+                JBPermissionIds.DEPLOY_SUCKERS,
+                true,
+                true
+            ),
+            abi.encode(false)
+        );
+
+        JBSuckerDeploymentConfig memory config = JBSuckerDeploymentConfig({
+            deployerConfigurations: new JBSuckerDeployerConfig[](0), salt: bytes32("SUCKER_SALT")
+        });
+
+        vm.prank(operator);
+        vm.expectRevert(
+            abi.encodeWithSelector(
+                JBPermissioned.JBPermissioned_Unauthorized.selector,
+                projectOwner,
+                address(deployer),
+                PROJECT_ID,
+                JBPermissionIds.DEPLOY_SUCKERS
+            )
+        );
+        deployer.deploySuckersFor(PROJECT_ID, config);
+    }
+
+    function _makeRulesetConfig() internal pure returns (JBRulesetConfig memory config) {
+        config.metadata = JBRulesetMetadata({
+            reservedPercent: 0,
+            cashOutTaxRate: 0,
+            baseCurrency: uint32(uint160(JBConstants.NATIVE_TOKEN)),
+            pausePay: false,
+            pauseCreditTransfers: false,
+            allowOwnerMinting: false,
+            allowSetCustomToken: false,
+            allowTerminalMigration: false,
+            allowSetTerminals: false,
+            allowSetController: false,
+            allowAddAccountingContext: false,
+            allowAddPriceFeed: false,
+            ownerMustSendPayouts: false,
+            holdFees: false,
+            useTotalSurplusForCashOuts: false,
+            useDataHookForPay: false,
+            useDataHookForCashOut: false,
+            dataHook: address(0),
+            metadata: 0
+        });
+    }
+}

package/test/audit/JBOmnichainDeployer.t.sol

@@ -3,6 +3,7 @@ pragma solidity 0.8.28;
 
 import {Test} from "forge-std/Test.sol";
 
+import {JBApprovalStatus} from "@bananapus/core-v6/src/enums/JBApprovalStatus.sol";
 import {JBPermissioned} from "@bananapus/core-v6/src/abstract/JBPermissioned.sol";
 import {IJBController} from "@bananapus/core-v6/src/interfaces/IJBController.sol";
 import {IJBDirectory} from "@bananapus/core-v6/src/interfaces/IJBDirectory.sol";
@@ -144,6 +145,14 @@ contract JBOmnichainDeployerTest is Test {
             abi.encode()
         );
         vm.mockCall(suckerRegistry, abi.encodeWithSelector(IJBSuckerRegistry.isSuckerOf.selector), abi.encode(false));
+        vm.mockCall(
+            suckerRegistry,
+            abi.encodeWithSelector(IJBSuckerRegistry.remoteTotalSupplyOf.selector),
+            abi.encode(uint256(0))
+        );
+        vm.mockCall(
+            suckerRegistry, abi.encodeWithSelector(IJBSuckerRegistry.remoteSurplusOf.selector), abi.encode(uint256(0))
+        );
 
         JBOmnichainDeployer deployer =
             new JBOmnichainDeployer(IJBSuckerRegistry(suckerRegistry), hookDeployer, permissions, projects, address(0));
@@ -152,7 +161,7 @@ contract JBOmnichainDeployerTest is Test {
         vm.mockCall(
             hookAddr,
             abi.encodeWithSelector(IJBRulesetDataHook.beforeCashOutRecordedWith.selector),
-            abi.encode(uint256(1234), uint256(55), uint256(999), emptySpecs)
+            abi.encode(uint256(1234), uint256(55), uint256(999), uint256(0), emptySpecs)
         );
 
         JBRulesetConfig[] memory launchConfigs = new JBRulesetConfig[](1);
@@ -176,11 +185,13 @@ contract JBOmnichainDeployerTest is Test {
         assertTrue(initialUseForCashOut, "launch should store the initial cash-out flag");
 
         JBBeforeCashOutRecordedContext memory initialContext = _cashOutContext(initialRulesetId);
-        (uint256 initialTaxRate, uint256 initialCashOutCount, uint256 initialTotalSupply,) =
+        (uint256 initialTaxRate, uint256 initialCashOutCount, uint256 initialTotalSupply,,) =
             deployer.beforeCashOutRecordedWith(initialContext);
         assertEq(initialTaxRate, 1234, "initial ruleset should forward cash-outs into the 721 hook");
         assertEq(initialCashOutCount, 55, "initial ruleset should use the 721 hook cash-out count");
-        assertEq(initialTotalSupply, 999, "initial ruleset should use the 721 hook total supply");
+        // The deployer discards the inner hook's totalSupply and computes cross-chain supply instead.
+        // With no suckers, this equals context.totalSupply (777).
+        assertEq(initialTotalSupply, 777, "initial ruleset should use cross-chain totalSupply (context value)");
 
         vm.mockCall(
             address(controller), abi.encodeWithSelector(IJBController.DIRECTORY.selector), abi.encode(directory)
@@ -197,8 +208,20 @@ contract JBOmnichainDeployerTest is Test {
             abi.encode(initialRulesetId)
         );
 
-        // Mock currentOf to return a JBRuleset with id = initialRulesetId so the carry-forward lookup succeeds.
+        // Mock latestQueuedOf to return the initial ruleset with Empty approval status,
+        // so the carry-forward logic finds the 721 hook from the latest queued ruleset.
+        JBRuleset memory latestQueuedRuleset;
+        // forge-lint: disable-next-line(unsafe-typecast)
+        latestQueuedRuleset.id = uint48(initialRulesetId);
+        vm.mockCall(
+            address(rulesets),
+            abi.encodeWithSelector(IJBRulesets.latestQueuedOf.selector, PROJECT_ID),
+            abi.encode(latestQueuedRuleset, JBApprovalStatus.Empty)
+        );
+
+        // Mock currentOf as a fallback (not reached in this scenario since latestQueuedOf succeeds).
         JBRuleset memory currentRuleset;
+        // forge-lint: disable-next-line(unsafe-typecast)
         currentRuleset.id = uint48(initialRulesetId);
         vm.mockCall(
             address(rulesets),
@@ -226,13 +249,15 @@ contract JBOmnichainDeployerTest is Test {
         assertTrue(queuedUseForCashOut, "queue should preserve the existing 721 cash-out flag");
 
         JBBeforeCashOutRecordedContext memory queuedContext = _cashOutContext(queuedRulesetId);
-        (uint256 queuedTaxRate, uint256 queuedCashOutCount, uint256 queuedTotalSupply,) =
+        (uint256 queuedTaxRate, uint256 queuedCashOutCount, uint256 queuedTotalSupply,,) =
             deployer.beforeCashOutRecordedWith(queuedContext);
 
         // The 721 hook is properly consulted for cash-outs in the queued ruleset.
         assertEq(queuedTaxRate, 1234, "queued ruleset should forward cash-outs into the 721 hook");
         assertEq(queuedCashOutCount, 55, "queued ruleset should use the 721 hook cash-out count");
-        assertEq(queuedTotalSupply, 999, "queued ruleset should use the 721 hook total supply");
+        // The deployer discards the inner hook's totalSupply and computes cross-chain supply instead.
+        // With no suckers, this equals context.totalSupply (777).
+        assertEq(queuedTotalSupply, 777, "queued ruleset should use cross-chain totalSupply (context value)");
     }
 
     function _cashOutContext(uint256 rulesetId) internal pure returns (JBBeforeCashOutRecordedContext memory context) {

package/test/audit/WeightScalingComparison.t.sol

@@ -70,6 +70,18 @@ contract WeightScalingComparisonTest is Test {
             address(suckerRegistry), abi.encodeWithSelector(IJBSuckerRegistry.isSuckerOf.selector), abi.encode(false)
         );
 
+        // Default: no remote supply or surplus (non-omnichain project).
+        vm.mockCall(
+            address(suckerRegistry),
+            abi.encodeWithSelector(IJBSuckerRegistry.remoteTotalSupplyOf.selector),
+            abi.encode(uint256(0))
+        );
+        vm.mockCall(
+            address(suckerRegistry),
+            abi.encodeWithSelector(IJBSuckerRegistry.remoteSurplusOf.selector),
+            abi.encode(uint256(0))
+        );
+
         // Mock hook deployer to return our mock hook address.
         vm.mockCall(
             address(hookDeployer),

package/test/fork/OmnichainForkTestBase.sol

@@ -27,6 +27,7 @@ import {JBSuckerRegistry} from "@bananapus/suckers-v6/src/JBSuckerRegistry.sol";
 import {JB721TiersHookDeployer} from "@bananapus/721-hook-v6/src/JB721TiersHookDeployer.sol";
 import {JB721TiersHook} from "@bananapus/721-hook-v6/src/JB721TiersHook.sol";
 import {JB721TiersHookStore} from "@bananapus/721-hook-v6/src/JB721TiersHookStore.sol";
+import {JB721CheckpointsDeployer} from "@bananapus/721-hook-v6/src/JB721CheckpointsDeployer.sol";
 import {IJB721TiersHook} from "@bananapus/721-hook-v6/src/interfaces/IJB721TiersHook.sol";
 import {IJB721TiersHookDeployer} from "@bananapus/721-hook-v6/src/interfaces/IJB721TiersHookProjectDeployer.sol";
 import {IJB721TiersHookStore} from "@bananapus/721-hook-v6/src/interfaces/IJB721TiersHookStore.sol";
@@ -181,7 +182,14 @@ abstract contract OmnichainForkTestBase is TestBaseWorkflow {
         suckerRegistry = new JBSuckerRegistry(jbDirectory(), jbPermissions(), multisig(), address(0));
         hookStore = new JB721TiersHookStore();
         exampleHook = new JB721TiersHook(
-            jbDirectory(), jbPermissions(), jbPrices(), jbRulesets(), hookStore, jbSplits(), address(0)
+            jbDirectory(),
+            jbPermissions(),
+            jbPrices(),
+            jbRulesets(),
+            hookStore,
+            jbSplits(),
+            new JB721CheckpointsDeployer(),
+            address(0)
         );
         addressRegistry = new JBAddressRegistry();
         hookDeployer721 = new JB721TiersHookDeployer(exampleHook, hookStore, addressRegistry, multisig());

package/test/fork/TestSuckerDeploymentFork.t.sol

@@ -179,7 +179,7 @@ contract TestSuckerDeploymentFork is OmnichainForkTestBase {
         });
 
         // Call beforeCashOutRecordedWith directly on the omnichain deployer.
-        (uint256 returnedTaxRate, uint256 returnedCashOutCount, uint256 returnedTotalSupply,) =
+        (uint256 returnedTaxRate, uint256 returnedCashOutCount, uint256 returnedTotalSupply,,) =
             omnichainDeployer.beforeCashOutRecordedWith(context);
 
         // Sucker should get 0% tax.