@bananapus/router-terminal-v6 0.0.31 → 0.0.32

package/RISKS.md

@@ -17,7 +17,7 @@ Pool discovery ranks candidates by instantaneous liquidity, so an attacker could
 When a user provides `quoteForSwap` metadata, the quote may not match the auto-selected output token. Frontends should set `quoteForSwap` per the expected output token.
 
 **Multi-hop cashout slippage cleared after first hop.** *(Minor)*
-Only the final output matters; the outer function enforces end-to-end minimum via `minReclaimed`. Intermediate per-hop slippage checks are intentionally omitted.
+Only the final output matters; the outer function enforces end-to-end minimum via `minReclaimed`. Intermediate per-hop slippage checks are intentionally omitted. Maximum 20 recursive cashout iterations allowed (`_MAX_CASHOUT_ITERATIONS`); beyond that the operation reverts.
 
 **Zero oracle quote disables swap protection.** *(Minor)*
 When the oracle returns zero (no liquidity), slippage tolerance becomes zero. The swap would fail anyway due to lack of liquidity, so this has no practical impact.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bananapus/router-terminal-v6",
-  "version": "0.0.31",
+  "version": "0.0.32",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -17,9 +17,9 @@
     "artifacts": "source ./.env && npx sphinx artifacts --org-id 'ea165b21-7cdc-4d7b-be59-ecdd4c26bee4' --project-name 'nana-router-terminal-v6'"
   },
   "dependencies": {
-    "@bananapus/buyback-hook-v6": "^0.0.27",
-    "@bananapus/core-v6": "^0.0.34",
-    "@bananapus/permission-ids-v6": "^0.0.17",
+    "@bananapus/buyback-hook-v6": "^0.0.30",
+    "@bananapus/core-v6": "^0.0.36",
+    "@bananapus/permission-ids-v6": "^0.0.19",
     "@openzeppelin/contracts": "^5.6.1",
     "@uniswap/permit2": "github:Uniswap/permit2",
     "@uniswap/v3-core": "github:Uniswap/v3-core#0.8",

package/src/JBPayRouteResolver.sol

@@ -274,9 +274,23 @@ contract JBPayRouteResolver is IJBPayRouteResolver {
             }
 
             // Decode only the minimum token-count commitments needed to score the buyback-enhanced preview.
-            (,,,,,,,,, uint256 minimumBeneficiaryTokenCount, uint256 minimumReservedTokenCount,) = abi.decode(
+            (,,,,,,,,,, uint256 minimumBeneficiaryTokenCount, uint256 minimumReservedTokenCount,) = abi.decode(
                 specification.metadata,
-                (bool, uint256, uint256, bool, address, uint256, int24, uint128, bytes32, uint256, uint256, uint256)
+                (
+                    bool,
+                    uint256,
+                    uint256,
+                    bool,
+                    address,
+                    uint256,
+                    uint256,
+                    int24,
+                    uint128,
+                    bytes32,
+                    uint256,
+                    uint256,
+                    uint256
+                )
             );
 
             // Keep whichever decoded hook commitment implies the stronger user-visible preview outcome.

package/src/JBRouterTerminal.sol

@@ -2331,7 +2331,7 @@ contract JBRouterTerminal is
         if (address(key.hooks) != address(0)) {
             // Build the two-element lookback array: [_TWAP_WINDOW seconds ago, now].
             uint32[] memory secondsAgos = new uint32[](2);
-            secondsAgos[0] = _TWAP_WINDOW; // Start of the window (30 seconds ago).
+            secondsAgos[0] = _TWAP_WINDOW; // Start of the window (120 seconds ago).
             secondsAgos[1] = 0; // End of the window (current block).
 
             // Ask the hook for cumulative tick data over the window. Silently catch if it doesn't support it.

package/test/RouterTerminal.t.sol

@@ -2271,6 +2271,7 @@ contract RouterTerminalTest is Test {
                 false,
                 address(0),
                 uint256(0),
+                uint256(0),
                 int24(0),
                 uint128(0),
                 PoolId.wrap(bytes32(0)),

package/test/audit/DeployBuybackHookZero.t.sol

@@ -286,7 +286,8 @@ contract DeployBuybackHookZeroTest is Test {
         reclaimToken = new AuditMockERC20();
         nativeTerminal = new AuditMockPreviewDestTerminal(JBConstants.NATIVE_TOKEN, 100);
         tokenBTerminal = new AuditMockPreviewDestTerminal(address(reclaimToken), 150);
-        nativeCashOut = new AuditMockCashOutTerminal{value: 40}(jbToken, JBConstants.NATIVE_TOKEN, 40, 40);
+        vm.deal(address(this), 80);
+        nativeCashOut = new AuditMockCashOutTerminal{value: 80}(jbToken, JBConstants.NATIVE_TOKEN, 40, 40);
         tokenBCashOut = new AuditMockCashOutTerminal(jbToken, address(reclaimToken), 50, 50);
 
         reclaimToken.mint(address(tokenBCashOut), 50);
@@ -393,6 +394,7 @@ contract DeployBuybackHookZeroTest is Test {
                 false,
                 address(0),
                 uint256(0),
+                uint256(0),
                 int24(0),
                 uint128(0),
                 PoolId.wrap(bytes32(0)),

package/test/codex/RegistryForwardingLossyToken.t.sol

@@ -0,0 +1,229 @@
+// SPDX-License-Identifier: MIT
+pragma solidity 0.8.28;
+
+import {Test} from "forge-std/Test.sol";
+
+import {IJBDirectory} from "@bananapus/core-v6/src/interfaces/IJBDirectory.sol";
+import {IJBPermissions} from "@bananapus/core-v6/src/interfaces/IJBPermissions.sol";
+import {IJBProjects} from "@bananapus/core-v6/src/interfaces/IJBProjects.sol";
+import {IJBTerminal} from "@bananapus/core-v6/src/interfaces/IJBTerminal.sol";
+import {IJBToken} from "@bananapus/core-v6/src/interfaces/IJBToken.sol";
+import {IJBTokens} from "@bananapus/core-v6/src/interfaces/IJBTokens.sol";
+import {JBAccountingContext} from "@bananapus/core-v6/src/structs/JBAccountingContext.sol";
+import {JBPayHookSpecification} from "@bananapus/core-v6/src/structs/JBPayHookSpecification.sol";
+import {JBRuleset} from "@bananapus/core-v6/src/structs/JBRuleset.sol";
+import {IJBRulesetApprovalHook} from "@bananapus/core-v6/src/interfaces/IJBRulesetApprovalHook.sol";
+import {IERC165} from "@openzeppelin/contracts/utils/introspection/IERC165.sol";
+import {IPermit2} from "@uniswap/permit2/src/interfaces/IPermit2.sol";
+import {IUniswapV3Factory} from "@uniswap/v3-core/contracts/interfaces/IUniswapV3Factory.sol";
+import {IPoolManager} from "@uniswap/v4-core/src/interfaces/IPoolManager.sol";
+
+import {JBRouterTerminal} from "../../src/JBRouterTerminal.sol";
+import {JBRouterTerminalRegistry} from "../../src/JBRouterTerminalRegistry.sol";
+import {IWETH9} from "../../src/interfaces/IWETH9.sol";
+
+contract LossyToken {
+    uint256 public constant BPS = 10_000;
+    uint256 public constant FEE_BPS = 1000;
+
+    mapping(address => uint256) public balanceOf;
+    mapping(address => mapping(address => uint256)) public allowance;
+
+    function mint(address to, uint256 amount) external {
+        balanceOf[to] += amount;
+    }
+
+    function approve(address spender, uint256 amount) external returns (bool) {
+        allowance[msg.sender][spender] = amount;
+        return true;
+    }
+
+    function transfer(address to, uint256 amount) external returns (bool) {
+        _transfer(msg.sender, to, amount);
+        return true;
+    }
+
+    function transferFrom(address from, address to, uint256 amount) external returns (bool) {
+        uint256 allowed = allowance[from][msg.sender];
+        if (allowed != type(uint256).max) allowance[from][msg.sender] = allowed - amount;
+        _transfer(from, to, amount);
+        return true;
+    }
+
+    function _transfer(address from, address to, uint256 amount) internal {
+        uint256 fee = amount * FEE_BPS / BPS;
+        uint256 received = amount - fee;
+        balanceOf[from] -= amount;
+        balanceOf[to] += received;
+    }
+}
+
+contract LossyFinalTerminal {
+    uint256 public lastNominalAmount;
+    uint256 public lastActualReceipt;
+
+    function pay(
+        uint256,
+        address token,
+        uint256 amount,
+        address,
+        uint256,
+        string calldata,
+        bytes calldata
+    )
+        external
+        returns (uint256)
+    {
+        lastNominalAmount = amount;
+        uint256 beforeBalance = LossyToken(token).balanceOf(address(this));
+        require(LossyToken(token).transferFrom(msg.sender, address(this), amount), "transferFrom failed");
+        lastActualReceipt = LossyToken(token).balanceOf(address(this)) - beforeBalance;
+        return lastActualReceipt;
+    }
+
+    function previewPayFor(
+        uint256,
+        address,
+        uint256 amount,
+        address,
+        bytes calldata
+    )
+        external
+        pure
+        returns (JBRuleset memory ruleset, uint256, uint256, JBPayHookSpecification[] memory hookSpecifications)
+    {
+        ruleset = JBRuleset({
+            cycleNumber: 1,
+            id: 1,
+            basedOnId: 0,
+            start: 0,
+            duration: 0,
+            weight: 0,
+            weightCutPercent: 0,
+            approvalHook: IJBRulesetApprovalHook(address(0)),
+            metadata: 0
+        });
+        hookSpecifications = new JBPayHookSpecification[](0);
+        return (ruleset, amount, 0, hookSpecifications);
+    }
+
+    function accountingContextsOf(uint256) external pure returns (JBAccountingContext[] memory contexts) {
+        contexts = new JBAccountingContext[](0);
+    }
+
+    function accountingContextForTokenOf(
+        uint256,
+        address token
+    )
+        external
+        pure
+        returns (JBAccountingContext memory context)
+    {
+        // forge-lint: disable-next-line(unsafe-typecast)
+        context = JBAccountingContext({token: token, decimals: 18, currency: uint32(uint160(token))});
+    }
+
+    function supportsInterface(bytes4) external pure returns (bool) {
+        return true;
+    }
+}
+
+contract RegistryForwardingLossyTokenTest is Test {
+    uint256 internal constant PROJECT_ID = 1;
+    uint256 internal constant AMOUNT = 100e18;
+
+    JBRouterTerminal internal router;
+    JBRouterTerminalRegistry internal registry;
+
+    IJBDirectory internal directory;
+    IJBPermissions internal permissions;
+    IJBProjects internal projects;
+    IJBTokens internal tokens;
+    IPermit2 internal permit2;
+    IWETH9 internal weth;
+    IUniswapV3Factory internal factory;
+    IPoolManager internal poolManager;
+
+    LossyToken internal token;
+    LossyFinalTerminal internal finalTerminal;
+
+    address internal owner = makeAddr("owner");
+    address internal payer = makeAddr("payer");
+
+    function setUp() public {
+        directory = IJBDirectory(makeAddr("directory"));
+        permissions = IJBPermissions(makeAddr("permissions"));
+        projects = IJBProjects(makeAddr("projects"));
+        tokens = IJBTokens(makeAddr("tokens"));
+        permit2 = IPermit2(makeAddr("permit2"));
+        weth = IWETH9(makeAddr("weth"));
+        factory = IUniswapV3Factory(makeAddr("factory"));
+        poolManager = IPoolManager(makeAddr("poolManager"));
+
+        vm.etch(address(directory), hex"00");
+        vm.etch(address(permissions), hex"00");
+        vm.etch(address(projects), hex"00");
+        vm.etch(address(tokens), hex"00");
+        vm.etch(address(permit2), hex"00");
+        vm.etch(address(weth), hex"00");
+        vm.etch(address(factory), hex"00");
+        vm.etch(address(poolManager), hex"00");
+
+        router = new JBRouterTerminal({
+            directory: directory,
+            tokens: tokens,
+            permit2: permit2,
+            weth: weth,
+            factory: factory,
+            poolManager: poolManager,
+            buybackHook: address(0),
+            univ4Hook: address(0),
+            trustedForwarder: address(0)
+        });
+
+        registry = new JBRouterTerminalRegistry({
+            permissions: permissions, projects: projects, permit2: permit2, owner: owner, trustedForwarder: address(0)
+        });
+
+        token = new LossyToken();
+        finalTerminal = new LossyFinalTerminal();
+
+        vm.prank(owner);
+        registry.setDefaultTerminal(IJBTerminal(address(finalTerminal)));
+
+        token.mint(payer, AMOUNT);
+        vm.prank(payer);
+        token.approve(address(router), type(uint256).max);
+
+        vm.mockCall(
+            address(tokens), abi.encodeCall(IJBTokens.projectIdOf, (IJBToken(address(token)))), abi.encode(uint256(0))
+        );
+        vm.mockCall(
+            address(directory),
+            abi.encodeCall(IJBDirectory.primaryTerminalOf, (PROJECT_ID, address(token))),
+            abi.encode(address(registry))
+        );
+    }
+
+    function test_routerSkipsFinalReceiptCheckWhenRegistryForwardsLossyToken() public {
+        vm.prank(payer);
+        uint256 minted = router.pay(PROJECT_ID, address(token), AMOUNT, payer, 0, "", "");
+
+        assertEq(token.balanceOf(address(registry)), 0, "registry should not retain leftovers");
+        assertEq(finalTerminal.lastNominalAmount(), 81e18, "registry forwards only what it received");
+        assertEq(finalTerminal.lastActualReceipt(), 72.9e18, "final terminal receives less on the second lossy hop");
+        assertEq(minted, 72.9e18, "call succeeds using the shrunken receipt");
+    }
+
+    function test_directRouterPathRevertsOnSameLossyToken() public {
+        vm.mockCall(
+            address(directory),
+            abi.encodeCall(IJBDirectory.primaryTerminalOf, (PROJECT_ID, address(token))),
+            abi.encode(address(finalTerminal))
+        );
+
+        vm.prank(payer);
+        vm.expectRevert(JBRouterTerminal.JBRouterTerminal_NonStandardTerminalToken.selector);
+        router.pay(PROJECT_ID, address(token), AMOUNT, payer, 0, "", "");
+    }
+}

package/test/fork/RouterTerminalFOTFork.t.sol

@@ -0,0 +1,363 @@
+// SPDX-License-Identifier: MIT
+pragma solidity 0.8.28;
+
+import {Test} from "forge-std/Test.sol";
+
+// JB core (deployed fresh within fork).
+import {JBPermissions} from "@bananapus/core-v6/src/JBPermissions.sol";
+import {JBProjects} from "@bananapus/core-v6/src/JBProjects.sol";
+import {JBDirectory} from "@bananapus/core-v6/src/JBDirectory.sol";
+import {JBRulesets} from "@bananapus/core-v6/src/JBRulesets.sol";
+import {JBTokens} from "@bananapus/core-v6/src/JBTokens.sol";
+import {JBERC20} from "@bananapus/core-v6/src/JBERC20.sol";
+import {JBSplits} from "@bananapus/core-v6/src/JBSplits.sol";
+import {JBPrices} from "@bananapus/core-v6/src/JBPrices.sol";
+import {JBController} from "@bananapus/core-v6/src/JBController.sol";
+import {JBFundAccessLimits} from "@bananapus/core-v6/src/JBFundAccessLimits.sol";
+import {JBFeelessAddresses} from "@bananapus/core-v6/src/JBFeelessAddresses.sol";
+import {JBTerminalStore} from "@bananapus/core-v6/src/JBTerminalStore.sol";
+import {JBMultiTerminal} from "@bananapus/core-v6/src/JBMultiTerminal.sol";
+import {JBConstants} from "@bananapus/core-v6/src/libraries/JBConstants.sol";
+import {JBAccountingContext} from "@bananapus/core-v6/src/structs/JBAccountingContext.sol";
+import {JBRulesetConfig} from "@bananapus/core-v6/src/structs/JBRulesetConfig.sol";
+import {JBRulesetMetadata} from "@bananapus/core-v6/src/structs/JBRulesetMetadata.sol";
+import {JBTerminalConfig} from "@bananapus/core-v6/src/structs/JBTerminalConfig.sol";
+import {JBSplitGroup} from "@bananapus/core-v6/src/structs/JBSplitGroup.sol";
+import {JBFundAccessLimitGroup} from "@bananapus/core-v6/src/structs/JBFundAccessLimitGroup.sol";
+import {IJBRulesetApprovalHook} from "@bananapus/core-v6/src/interfaces/IJBRulesetApprovalHook.sol";
+
+// Uniswap.
+import {IUniswapV3Factory} from "@uniswap/v3-core/contracts/interfaces/IUniswapV3Factory.sol";
+import {IPoolManager} from "@uniswap/v4-core/src/interfaces/IPoolManager.sol";
+import {IPermit2} from "@uniswap/permit2/src/interfaces/IPermit2.sol";
+
+// OpenZeppelin.
+import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
+
+// Router terminal.
+import {JBRouterTerminal} from "../../src/JBRouterTerminal.sol";
+import {IWETH9} from "../../src/interfaces/IWETH9.sol";
+
+// ──────────────────────────────────────────────────────────────────────────────
+// Mock: Fee-on-transfer ERC20 (burns a percentage per transfer).
+// ──────────────────────────────────────────────────────────────────────────────
+
+contract MockFoTToken {
+    string public name = "FeeOnTransfer";
+    string public symbol = "FOT";
+    uint8 public decimals = 18;
+    uint256 public totalSupply;
+
+    mapping(address => uint256) public balanceOf;
+    mapping(address => mapping(address => uint256)) public allowance;
+
+    /// @notice Fee deducted per transfer (in basis points, e.g. 100 = 1%).
+    uint256 public immutable feePercent;
+
+    constructor(uint256 _feePercent) {
+        feePercent = _feePercent;
+    }
+
+    function mint(address to, uint256 amount) external {
+        balanceOf[to] += amount;
+        totalSupply += amount;
+    }
+
+    function approve(address spender, uint256 amount) external returns (bool) {
+        allowance[msg.sender][spender] = amount;
+        return true;
+    }
+
+    function transfer(address to, uint256 amount) external returns (bool) {
+        balanceOf[msg.sender] -= amount;
+        uint256 fee = (amount * feePercent) / 10_000;
+        uint256 received = amount - fee;
+        balanceOf[to] += received;
+        totalSupply -= fee; // fee is burned
+        emit Transfer(msg.sender, to, received);
+        if (fee > 0) emit Transfer(msg.sender, address(0), fee);
+        return true;
+    }
+
+    function transferFrom(address from, address to, uint256 amount) external returns (bool) {
+        allowance[from][msg.sender] -= amount;
+        balanceOf[from] -= amount;
+        uint256 fee = (amount * feePercent) / 10_000;
+        uint256 received = amount - fee;
+        balanceOf[to] += received;
+        totalSupply -= fee; // fee is burned
+        emit Transfer(from, to, received);
+        if (fee > 0) emit Transfer(from, address(0), fee);
+        return true;
+    }
+
+    event Transfer(address indexed from, address indexed to, uint256 value);
+}
+
+/// @notice Fork test: fee-on-transfer token through the router terminal.
+/// @dev Verifies that the receipt enforcement correctly detects and rejects FOT tokens,
+///      preventing accounting mismatches between the router and the destination terminal.
+///
+///      The router's `_acceptFundsFor` uses balance-delta to capture the actual received amount
+///      (handles the first transfer fee). However, the second transfer (router → terminal) also
+///      incurs a fee, causing `_enforceStandardTerminalReceipt` to revert with
+///      `JBRouterTerminal_NonStandardTerminalToken`.
+///
+///      This is the correct defensive behavior — FOT tokens are not supported by design.
+contract RouterTerminalFOTForkTest is Test {
+    uint256 constant BLOCK_NUMBER = 21_700_000;
+
+    IWETH9 constant WETH = IWETH9(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2);
+    IUniswapV3Factory constant V3_FACTORY = IUniswapV3Factory(0x1F98431c8aD98523631AE4a59f267346ea31F984);
+    IPermit2 constant PERMIT2 = IPermit2(0x000000000022D473030F116dDEE9F6B43aC78BA3);
+    IPoolManager constant V4_POOL_MANAGER = IPoolManager(0x000000000004444c5dc75cB358380D2e3dE08A90);
+
+    address multisig = address(0xBEEF);
+    address payer = makeAddr("payer");
+    address trustedForwarder = address(0);
+
+    JBPermissions jbPermissions;
+    JBProjects jbProjects;
+    JBDirectory jbDirectory;
+    JBRulesets jbRulesets;
+    JBTokens jbTokens;
+    JBSplits jbSplits;
+    JBPrices jbPrices;
+    JBFundAccessLimits jbFundAccessLimits;
+    JBFeelessAddresses jbFeelessAddresses;
+    JBController jbController;
+    JBTerminalStore jbTerminalStore;
+    JBMultiTerminal jbMultiTerminal;
+    JBRouterTerminal routerTerminal;
+
+    MockFoTToken fotToken;
+    uint256 feeProjectId;
+    uint256 fotProjectId;
+
+    function setUp() public {
+        vm.createSelectFork("ethereum", BLOCK_NUMBER);
+
+        _deployJbCore();
+
+        routerTerminal = new JBRouterTerminal({
+            directory: jbDirectory,
+            tokens: jbTokens,
+            permit2: PERMIT2,
+            weth: WETH,
+            factory: V3_FACTORY,
+            poolManager: V4_POOL_MANAGER,
+            buybackHook: address(0),
+            univ4Hook: address(0),
+            trustedForwarder: trustedForwarder
+        });
+
+        // Deploy mock FOT token (1% fee per transfer).
+        fotToken = new MockFoTToken(100);
+
+        // Fee project.
+        feeProjectId = _launchProject(JBConstants.NATIVE_TOKEN, 18);
+
+        // Project that accepts the FOT token.
+        fotProjectId = _launchProject(address(fotToken), 18);
+
+        vm.label(address(fotToken), "FOT");
+        vm.label(address(routerTerminal), "RouterTerminal");
+        vm.label(address(jbMultiTerminal), "JBMultiTerminal");
+    }
+
+    // ═══════════════════════════════════════════════════════════════════════
+    // FOT: Direct forward (no swap) — router pays project that accepts FOT
+    // ═══════════════════════════════════════════════════════════════════════
+
+    /// @notice FOT direct forward reverts because the second transfer (router → terminal)
+    ///         loses tokens to the fee, causing a receipt mismatch.
+    ///
+    ///         Flow: payer sends 10,000 FOT → router receives 9,900 (1% fee) →
+    ///               router approves terminal for 9,900 → terminal pulls 9,900 from router →
+    ///               terminal receives 9,801 (1% fee) → receipt check: 9,801 != 9,900 → REVERT.
+    function test_fork_fotDirectForward_reverts() public {
+        uint256 amount = 10_000e18;
+        fotToken.mint(payer, amount);
+
+        vm.startPrank(payer);
+        fotToken.approve(address(routerTerminal), amount);
+
+        // Reverts with NonStandardTerminalToken because of receipt mismatch.
+        vm.expectRevert(JBRouterTerminal.JBRouterTerminal_NonStandardTerminalToken.selector);
+        routerTerminal.pay({
+            projectId: fotProjectId,
+            token: address(fotToken),
+            amount: amount,
+            beneficiary: payer,
+            minReturnedTokens: 0,
+            memo: "FOT direct forward",
+            metadata: ""
+        });
+        vm.stopPrank();
+    }
+
+    /// @notice FOT addToBalanceOf also reverts for the same receipt mismatch reason.
+    function test_fork_fotAddToBalance_reverts() public {
+        uint256 amount = 5000e18;
+        fotToken.mint(payer, amount);
+
+        vm.startPrank(payer);
+        fotToken.approve(address(routerTerminal), amount);
+
+        vm.expectRevert(JBRouterTerminal.JBRouterTerminal_NonStandardTerminalToken.selector);
+        routerTerminal.addToBalanceOf({
+            projectId: fotProjectId,
+            token: address(fotToken),
+            amount: amount,
+            shouldReturnHeldFees: false,
+            memo: "FOT add to balance",
+            metadata: ""
+        });
+        vm.stopPrank();
+    }
+
+    // ═══════════════════════════════════════════════════════════════════════
+    // Standard ERC20: Direct forward works (control test)
+    // ═══════════════════════════════════════════════════════════════════════
+
+    /// @notice Standard (non-FOT) ERC20 direct forward succeeds — proves the test
+    ///         infrastructure is correct and only FOT causes the revert.
+    function test_fork_standardDirectForward_succeeds() public {
+        uint256 amount = 1 ether;
+
+        vm.deal(payer, amount);
+        vm.prank(payer);
+        uint256 tokenCount = routerTerminal.pay{value: amount}({
+            projectId: feeProjectId,
+            token: JBConstants.NATIVE_TOKEN,
+            amount: amount,
+            beneficiary: payer,
+            minReturnedTokens: 0,
+            memo: "standard ETH direct forward",
+            metadata: ""
+        });
+
+        assertGt(tokenCount, 0, "standard token should mint");
+        assertEq(address(routerTerminal).balance, 0, "router should have no leftover ETH");
+    }
+
+    // ═══════════════════════════════════════════════════════════════════════
+    // FOT: ETH payment to FOT-accepting project (swap path)
+    // ═══════════════════════════════════════════════════════════════════════
+
+    /// @notice Paying ETH to a project that only accepts FOT reverts because
+    ///         no Uniswap pool exists for ETH/FOT.
+    /// @dev Bare expectRevert here: the specific error varies by route discovery path
+    ///      (NoPoolFound vs NoRouteFound) depending on internal resolver logic.
+    function test_fork_fotSwapPath_noPoolReverts() public {
+        uint256 amount = 1 ether;
+
+        vm.deal(payer, amount);
+        vm.prank(payer);
+        vm.expectRevert();
+        routerTerminal.pay{value: amount}({
+            projectId: fotProjectId,
+            token: JBConstants.NATIVE_TOKEN,
+            amount: amount,
+            beneficiary: payer,
+            minReturnedTokens: 0,
+            memo: "ETH to FOT project - no pool",
+            metadata: ""
+        });
+    }
+
+    // ═══════════════════════════════════════════════════════════════════════
+    // Internal helpers
+    // ═══════════════════════════════════════════════════════════════════════
+
+    function _deployJbCore() internal {
+        jbPermissions = new JBPermissions(trustedForwarder);
+        jbProjects = new JBProjects(multisig, address(0), trustedForwarder);
+        jbDirectory = new JBDirectory(jbPermissions, jbProjects, multisig);
+        JBERC20 jbErc20 = new JBERC20(jbPermissions, jbProjects);
+        jbTokens = new JBTokens(jbDirectory, jbErc20);
+        jbRulesets = new JBRulesets(jbDirectory);
+        jbPrices = new JBPrices(jbDirectory, jbPermissions, jbProjects, multisig, trustedForwarder);
+        jbSplits = new JBSplits(jbDirectory);
+        jbFundAccessLimits = new JBFundAccessLimits(jbDirectory);
+        jbFeelessAddresses = new JBFeelessAddresses(multisig);
+
+        jbController = new JBController(
+            jbDirectory,
+            jbFundAccessLimits,
+            jbPermissions,
+            jbPrices,
+            jbProjects,
+            jbRulesets,
+            jbSplits,
+            jbTokens,
+            address(0),
+            trustedForwarder
+        );
+
+        vm.prank(multisig);
+        jbDirectory.setIsAllowedToSetFirstController(address(jbController), true);
+
+        jbTerminalStore = new JBTerminalStore(jbDirectory, jbPrices, jbRulesets);
+
+        jbMultiTerminal = new JBMultiTerminal(
+            jbFeelessAddresses,
+            jbPermissions,
+            jbProjects,
+            jbSplits,
+            jbTerminalStore,
+            jbTokens,
+            PERMIT2,
+            trustedForwarder
+        );
+    }
+
+    function _launchProject(address acceptedToken, uint8 decimals) internal returns (uint256 projectId) {
+        JBRulesetMetadata memory metadata = JBRulesetMetadata({
+            reservedPercent: 0,
+            cashOutTaxRate: 0,
+            baseCurrency: uint32(uint160(acceptedToken)),
+            pausePay: false,
+            pauseCreditTransfers: false,
+            allowOwnerMinting: false,
+            allowSetCustomToken: false,
+            allowTerminalMigration: false,
+            allowSetTerminals: false,
+            allowSetController: false,
+            allowAddAccountingContext: false,
+            allowAddPriceFeed: false,
+            ownerMustSendPayouts: false,
+            holdFees: false,
+            useTotalSurplusForCashOuts: false,
+            useDataHookForPay: false,
+            useDataHookForCashOut: false,
+            dataHook: address(0),
+            metadata: 0
+        });
+
+        JBRulesetConfig[] memory rulesetConfigs = new JBRulesetConfig[](1);
+        rulesetConfigs[0].mustStartAtOrAfter = 0;
+        rulesetConfigs[0].duration = 0;
+        rulesetConfigs[0].weight = 1_000_000e18;
+        rulesetConfigs[0].weightCutPercent = 0;
+        rulesetConfigs[0].approvalHook = IJBRulesetApprovalHook(address(0));
+        rulesetConfigs[0].metadata = metadata;
+        rulesetConfigs[0].splitGroups = new JBSplitGroup[](0);
+        rulesetConfigs[0].fundAccessLimitGroups = new JBFundAccessLimitGroup[](0);
+
+        JBAccountingContext[] memory tokensToAccept = new JBAccountingContext[](1);
+        tokensToAccept[0] =
+            JBAccountingContext({token: acceptedToken, decimals: decimals, currency: uint32(uint160(acceptedToken))});
+
+        JBTerminalConfig[] memory terminalConfigs = new JBTerminalConfig[](1);
+        terminalConfigs[0] = JBTerminalConfig({terminal: jbMultiTerminal, accountingContextsToAccept: tokensToAccept});
+
+        projectId = jbController.launchProjectFor({
+            owner: multisig,
+            projectUri: "test-project",
+            rulesetConfigurations: rulesetConfigs,
+            terminalConfigurations: terminalConfigs,
+            memo: ""
+        });
+    }
+}