@bananapus/suckers-v6 0.0.13 → 0.0.15

package/script/helpers/SuckerDeploymentLib.sol

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity 0.8.26;
+pragma solidity 0.8.28;
 
 import {stdJson} from "forge-std/Script.sol";
 import {Vm} from "forge-std/Vm.sol";
@@ -50,12 +50,12 @@ library SuckerDeploymentLib {
         // Is deployed on all (supported) chains.
         deployment.registry = IJBSuckerRegistry(
             _getDeploymentAddress({
-                path: path, projectName: "nana-suckers-v5", networkName: networkName, contractName: "JBSuckerRegistry"
+                path: path, projectName: "nana-suckers-v6", networkName: networkName, contractName: "JBSuckerRegistry"
             })
         );
 
         bytes32 _network = keccak256(abi.encodePacked(networkName));
-        bool _isMainnet = _network == keccak256("ethereum") || _network == keccak256("sepolia");
+        bool _isMainnet = _network == keccak256("ethereum") || _network == keccak256("ethereum_sepolia");
         bool _isOP = _network == keccak256("optimism") || _network == keccak256("optimism_sepolia");
         bool _isBase = _network == keccak256("base") || _network == keccak256("base_sepolia");
         bool _isArb = _network == keccak256("arbitrum") || _network == keccak256("arbitrum_sepolia");
@@ -64,7 +64,7 @@ library SuckerDeploymentLib {
             deployment.optimismDeployer = IJBSuckerDeployer(
                 _getDeploymentAddress({
                     path: path,
-                    projectName: "nana-suckers-v5",
+                    projectName: "nana-suckers-v6",
                     networkName: networkName,
                     contractName: "JBOptimismSuckerDeployer"
                 })
@@ -75,7 +75,7 @@ library SuckerDeploymentLib {
             deployment.baseDeployer = IJBSuckerDeployer(
                 _getDeploymentAddress({
                     path: path,
-                    projectName: "nana-suckers-v5",
+                    projectName: "nana-suckers-v6",
                     networkName: networkName,
                     contractName: "JBBaseSuckerDeployer"
                 })
@@ -86,7 +86,7 @@ library SuckerDeploymentLib {
             deployment.arbitrumDeployer = IJBSuckerDeployer(
                 _getDeploymentAddress({
                     path: path,
-                    projectName: "nana-suckers-v5",
+                    projectName: "nana-suckers-v6",
                     networkName: networkName,
                     contractName: "JBArbitrumSuckerDeployer"
                 })

package/src/JBArbitrumSucker.sol

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity 0.8.26;
+pragma solidity 0.8.28;
 
 import {IBridge} from "@arbitrum/nitro-contracts/src/bridge/IBridge.sol";
 import {IInbox} from "@arbitrum/nitro-contracts/src/bridge/IInbox.sol";
@@ -154,25 +154,34 @@ contract JBArbitrumSucker is JBSucker, IJBArbitrumSucker {
         internal
         override
     {
-        // Bridge expects to be paid
-        if (transportPayment == 0 && LAYER == JBLayer.L1) revert JBSucker_ExpectedMsgValue();
-
         // Build the calldata that will be send to the peer. This will call `JBSucker.fromRemote` on the remote peer.
         bytes memory data = abi.encodeCall(JBSucker.fromRemote, (message));
 
         // Depending on which layer we are on, send the call to the other layer.
         // slither-disable-start out-of-order-retryable
         if (LAYER == JBLayer.L1) {
+            // L1→L2 requires transport payment for retryable tickets.
+            if (transportPayment == 0) revert JBSucker_ExpectedMsgValue();
             _toL2({
                 token: token, transportPayment: transportPayment, amount: amount, data: data, remoteToken: remoteToken
             });
         } else {
+            // L2→L1 via ArbSys is free — reject any transport payment.
+            if (transportPayment != 0) revert JBSucker_UnexpectedMsgValue(transportPayment);
             _toL1({token: token, amount: amount, data: data, remoteToken: remoteToken});
         }
         // slither-disable-end out-of-order-retryable
     }
 
     /// @notice Bridge the `token` and data to the remote L1 chain.
+    /// @dev IMPORTANT — Arbitrum non-atomic bridging limitation:
+    /// For ERC-20 transfers, this function performs two independent operations: one for the token bridge
+    /// (via the L2 gateway router) and one for the `fromRemote` merkle root message (via `ArbSys.sendTxToL1`).
+    /// These are processed independently on L1, with no guaranteed ordering.
+    ///
+    /// `_handleClaim` calls `_addToBalance` which checks `amountToAddToBalanceOf` (derived from the contract's
+    /// actual token balance minus outbox balance). If the tokens have not arrived yet, this check will revert
+    /// with `JBSucker_InsufficientBalance`, preventing unbacked token minting.
     /// @param token The token to bridge.
     /// @param amount The amount of tokens to bridge.
     /// @param data The calldata to send to the remote chain. This calls `JBSucker.fromRemote` on the remote peer.
@@ -180,12 +189,6 @@ contract JBArbitrumSucker is JBSucker, IJBArbitrumSucker {
     function _toL1(address token, uint256 amount, bytes memory data, JBRemoteToken memory remoteToken) internal {
         uint256 nativeValue;
 
-        // Revert if there's a `msg.value`. Sending a message to L1 does not require any payment.
-        if (msg.value != 0) {
-            // slither-disable-next-line msg-value-loop
-            revert JBSucker_UnexpectedMsgValue(msg.value);
-        }
-
         // If the token is an ERC-20, bridge it to the peer.
         // If the amount is `0` then we do not need to bridge any ERC20.
         if (token != JBConstants.NATIVE_TOKEN && amount != 0) {
@@ -213,8 +216,8 @@ contract JBArbitrumSucker is JBSucker, IJBArbitrumSucker {
     /// @notice Bridge the `token` and data to the remote L2 chain.
     /// @dev IMPORTANT — Arbitrum non-atomic bridging limitation:
     /// For ERC-20 transfers, this function creates two independent retryable tickets: one for the token bridge
-    /// (via the gateway router, line ~245) and one for the `fromRemote` merkle root message (via the inbox,
-    /// line ~274). These tickets are redeemed independently on L2, with no guaranteed ordering.
+    /// (via the gateway router) and one for the `fromRemote` merkle root message (via the inbox).
+    /// These tickets are redeemed independently on L2, with no guaranteed ordering.
     ///
     /// `_handleClaim` calls `_addToBalance` which checks `amountToAddToBalanceOf` (derived from the contract's
     /// actual token balance minus outbox balance). If the tokens have not arrived yet, this check will revert

package/src/JBBaseSucker.sol

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity 0.8.26;
+pragma solidity 0.8.28;
 
 import {IJBDirectory} from "@bananapus/core-v6/src/interfaces/IJBDirectory.sol";
 import {IJBPermissions} from "@bananapus/core-v6/src/interfaces/IJBPermissions.sol";

package/src/JBCCIPSucker.sol

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity 0.8.26;
+pragma solidity 0.8.28;
 
 import {IJBDirectory} from "@bananapus/core-v6/src/interfaces/IJBDirectory.sol";
 import {IJBPermissions} from "@bananapus/core-v6/src/interfaces/IJBPermissions.sol";

package/src/JBCeloSucker.sol

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity 0.8.26;
+pragma solidity 0.8.28;
 
 import {IJBDirectory} from "@bananapus/core-v6/src/interfaces/IJBDirectory.sol";
 import {IJBPermissions} from "@bananapus/core-v6/src/interfaces/IJBPermissions.sol";

package/src/JBOptimismSucker.sol

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity 0.8.26;
+pragma solidity 0.8.28;
 
 import {IJBDirectory} from "@bananapus/core-v6/src/interfaces/IJBDirectory.sol";
 import {IJBPermissions} from "@bananapus/core-v6/src/interfaces/IJBPermissions.sol";

package/src/JBSucker.sol

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity 0.8.26;
+pragma solidity 0.8.28;
 
 import {JBPermissioned} from "@bananapus/core-v6/src/abstract/JBPermissioned.sol";
 import {IJBCashOutTerminal} from "@bananapus/core-v6/src/interfaces/IJBCashOutTerminal.sol";
@@ -466,9 +466,16 @@ abstract contract JBSucker is ERC2771Context, JBPermissioned, Initializable, ERC
     /// tree is append-only), but users will need regenerated proofs computed against the current root. This trade-off
     /// is accepted because enforcing sequential nonces could permanently block a token's inbox if a single message is
     /// delayed or lost by the bridge.
+    /// @dev Post-deprecation root acceptance: Roots are accepted in DEPRECATED state to prevent stranding tokens that
+    /// were sent before deprecation. Even though the mandatory `_maxMessagingDelay()` (14-day) buffer gives in-flight
+    /// messages time to arrive, accepting roots after deprecation provides a stronger guarantee that users can always
+    /// claim their bridged tokens. Double-spend is not a concern because `toRemote` is already disabled in
+    /// `SENDING_DISABLED` and `DEPRECATED` states, so no new outbound transfers can occur.
     /// @param root The merkle root, token, and amount being received.
     function fromRemote(JBMessageRoot calldata root) external payable {
         // Make sure that the message came from our peer.
+        // Safe to use _msgSender() here: bridge messengers never use ERC2771 meta-transactions,
+        // so this always resolves to msg.sender.
         if (!_isRemotePeer(_msgSender())) {
             revert JBSucker_NotPeer(_toBytes32(_msgSender()));
         }
@@ -495,11 +502,7 @@ abstract contract JBSucker is ERC2771Context, JBPermissioned, Initializable, ERC
         // If the received tree's nonce is greater than the current inbox tree's nonce, update the inbox tree.
         // We can't revert because this could be a native token transfer. If we reverted, we would lose the native
         // tokens.
-        //
-        // Deprecated suckers reject new roots to prevent double-spend: once deprecated, the project owner may have
-        // enabled the emergency hatch for local withdrawals. Accepting a new root after that could allow claiming
-        // on both chains. The emergency hatch provides recovery for any tokens stuck in this state.
-        if (root.remoteRoot.nonce > inbox.nonce && state() != JBSuckerState.DEPRECATED) {
+        if (root.remoteRoot.nonce > inbox.nonce) {
             inbox.nonce = root.remoteRoot.nonce;
             inbox.root = root.remoteRoot.root;
             emit NewInboxTreeRoot({
@@ -567,6 +570,12 @@ abstract contract JBSucker is ERC2771Context, JBPermissioned, Initializable, ERC
     /// @notice Prepare project tokens and the cash out amount backing them to be bridged to the remote chain.
     /// @dev This adds the tokens and funds to the outbox tree for the `token`. They will be bridged by the next call to
     /// `toRemote` for the same `token`.
+    /// @dev Reentrancy protection: This function has implicit reentrancy protection through `_pullBackingAssets`.
+    /// The `assert` in `_pullBackingAssets` verifies that the contract's token balance increased by exactly the
+    /// amount reported by the terminal's `cashOutTokensOf`. A reentrant `prepare()` call would trigger a nested
+    /// `cashOutTokensOf`, changing the contract's balance before the outer call's `assert` executes. The outer
+    /// `assert` would then fail because the balance delta no longer matches the reported `reclaimedAmount`.
+    /// Note: because `assert` is used (not `revert`), a failed reentrancy attempt will consume all remaining gas.
     /// @param projectTokenCount The number of project tokens to prepare for bridging.
     /// @param beneficiary The recipient on the remote chain (bytes32 for cross-VM compatibility).
     ///   For EVM peers: the EVM address left-padded to 32 bytes via `_toBytes32`.
@@ -664,6 +673,11 @@ abstract contract JBSucker is ERC2771Context, JBPermissioned, Initializable, ERC
     /// remote
     /// chain.
     /// @dev This sends the outbox root for the specified `token` to the remote chain.
+    /// @dev Fee payment failure handling: The registry fee payment uses a best-effort pattern (try/catch). If the
+    /// fee project's terminal doesn't exist or the `pay` call reverts, the fee is silently absorbed back into the
+    /// `transportPayment` instead of reverting the entire transaction. This is a deliberate design choice that favors
+    /// bridge availability over fee collection — a failed fee payment should never prevent users from bridging their
+    /// tokens. The fee amount is typically small relative to the bridged value, making the tradeoff acceptable.
     /// @param token The terminal token being bridged.
     function toRemote(address token) external payable override {
         JBRemoteToken memory remoteToken = _remoteTokenFor[token];
@@ -692,6 +706,7 @@ abstract contract JBSucker is ERC2771Context, JBPermissioned, Initializable, ERC
         // Best-effort: if the terminal doesn't exist or the pay call reverts, proceed without fee.
         IJBTerminal terminal = DIRECTORY.primaryTerminalOf({projectId: FEE_PROJECT_ID, token: JBConstants.NATIVE_TOKEN});
         if (address(terminal) != address(0)) {
+            // slither-disable-next-line unused-return
             try terminal.pay{value: _toRemoteFee}({
                 projectId: FEE_PROJECT_ID,
                 token: JBConstants.NATIVE_TOKEN,
@@ -700,7 +715,9 @@ abstract contract JBSucker is ERC2771Context, JBPermissioned, Initializable, ERC
                 minReturnedTokens: 0,
                 memo: "",
                 metadata: ""
-            }) {}
+            }) returns (
+                uint256
+            ) {}
             catch {
                 // Fee payment failed — proceed without fee, return it as transport payment.
                 transportPayment = msg.value;

package/src/JBSuckerRegistry.sol

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity 0.8.26;
+pragma solidity 0.8.28;
 
 import {JBPermissioned} from "@bananapus/core-v6/src/abstract/JBPermissioned.sol";
 import {IJBDirectory} from "@bananapus/core-v6/src/interfaces/IJBDirectory.sol";

package/src/deployers/JBArbitrumSuckerDeployer.sol

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity 0.8.26;
+pragma solidity 0.8.28;
 
 import {IInbox} from "@arbitrum/nitro-contracts/src/bridge/IInbox.sol";
 import {IJBDirectory} from "@bananapus/core-v6/src/interfaces/IJBDirectory.sol";

package/src/deployers/JBBaseSuckerDeployer.sol

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity 0.8.26;
+pragma solidity 0.8.28;
 
 import {IJBDirectory} from "@bananapus/core-v6/src/interfaces/IJBDirectory.sol";
 import {IJBPermissions} from "@bananapus/core-v6/src/interfaces/IJBPermissions.sol";

package/src/deployers/JBCCIPSuckerDeployer.sol

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity 0.8.26;
+pragma solidity 0.8.28;
 
 import {IJBDirectory} from "@bananapus/core-v6/src/interfaces/IJBDirectory.sol";
 import {IJBPermissions} from "@bananapus/core-v6/src/interfaces/IJBPermissions.sol";

package/src/deployers/JBCeloSuckerDeployer.sol

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity 0.8.26;
+pragma solidity 0.8.28;
 
 import {IJBDirectory} from "@bananapus/core-v6/src/interfaces/IJBDirectory.sol";
 import {IJBPermissions} from "@bananapus/core-v6/src/interfaces/IJBPermissions.sol";

package/src/deployers/JBOptimismSuckerDeployer.sol

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity 0.8.26;
+pragma solidity 0.8.28;
 
 import {IJBDirectory} from "@bananapus/core-v6/src/interfaces/IJBDirectory.sol";
 import {IJBPermissions} from "@bananapus/core-v6/src/interfaces/IJBPermissions.sol";

package/src/deployers/JBSuckerDeployer.sol

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity 0.8.26;
+pragma solidity 0.8.28;
 
 import {JBPermissioned} from "@bananapus/core-v6/src/abstract/JBPermissioned.sol";
 import {IJBDirectory} from "@bananapus/core-v6/src/interfaces/IJBDirectory.sol";

package/src/libraries/CCIPHelper.sol

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity 0.8.26;
+pragma solidity 0.8.28;
 
 /// @notice CCIP chain-specific constants used across Juicebox sucker contracts.
 library CCIPHelper {

package/src/utils/MerkleLib.sol

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT OR Apache-2.0
-pragma solidity 0.8.26;
+pragma solidity 0.8.28;
 
 /**
  * @title MerkleLib

package/test/Fork.t.sol

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity 0.8.26;
+pragma solidity 0.8.28;
 
 import /* {*} from */ "@bananapus/core-v6/test/helpers/TestBaseWorkflow.sol";
 import {MockPriceFeed} from "@bananapus/core-v6/test/mock/MockPriceFeed.sol";

package/test/ForkArbitrum.t.sol

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity 0.8.26;
+pragma solidity 0.8.28;
 
 import /* {*} from */ "@bananapus/core-v6/test/helpers/TestBaseWorkflow.sol";
 import {IJBSucker} from "../src/interfaces/IJBSucker.sol";

package/test/ForkCelo.t.sol

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity 0.8.26;
+pragma solidity 0.8.28;
 
 import /* {*} from */ "@bananapus/core-v6/test/helpers/TestBaseWorkflow.sol";
 import {IJBSucker} from "../src/interfaces/IJBSucker.sol";

package/test/ForkClaim.t.sol

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity 0.8.26;
+pragma solidity 0.8.28;
 
 import /* {*} from */ "@bananapus/core-v6/test/helpers/TestBaseWorkflow.sol";
 import {MockPriceFeed} from "@bananapus/core-v6/test/mock/MockPriceFeed.sol";

package/test/ForkMainnet.t.sol

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity 0.8.26;
+pragma solidity 0.8.28;
 
 import /* {*} from */ "@bananapus/core-v6/test/helpers/TestBaseWorkflow.sol";
 import {IJBSucker} from "../src/interfaces/IJBSucker.sol";

package/test/ForkOPStack.t.sol

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity 0.8.26;
+pragma solidity 0.8.28;
 
 import /* {*} from */ "@bananapus/core-v6/test/helpers/TestBaseWorkflow.sol";
 import {IJBSucker} from "../src/interfaces/IJBSucker.sol";

package/test/SuckerDeepAttacks.t.sol

@@ -330,7 +330,7 @@ contract SuckerDeepAttacks is Test {
     }
 
     /// @notice fromRemote when DEPRECATED: should silently ignore even with valid higher nonce.
-    function test_fromRemote_deprecated_silentlyIgnored() public {
+    function test_fromRemote_deprecated_stillAccepts() public {
         // Set deprecation in the past so state=DEPRECATED.
         sucker.test_setDeprecatedAfter(block.timestamp - 1);
         assertEq(uint256(sucker.state()), uint256(JBSuckerState.DEPRECATED), "Should be DEPRECATED");
@@ -344,12 +344,13 @@ contract SuckerDeepAttacks is Test {
             remoteRoot: JBInboxTreeRoot({nonce: 2, root: bytes32(uint256(0xbbbb))})
         });
 
-        // Should NOT revert (native tokens would be lost), but should NOT update.
+        // Roots are accepted in DEPRECATED state to prevent stranding tokens that were sent
+        // before deprecation. Double-spend is not a concern because toRemote is already disabled.
         vm.prank(address(sucker));
         sucker.fromRemote(root);
 
-        assertEq(sucker.test_getInboxRoot(TOKEN), bytes32(uint256(0xaaaa)), "Root should NOT update when DEPRECATED");
-        assertEq(sucker.test_getInboxNonce(TOKEN), 1, "Nonce should remain 1 when DEPRECATED");
+        assertEq(sucker.test_getInboxRoot(TOKEN), bytes32(uint256(0xbbbb)), "Root SHOULD update even when DEPRECATED");
+        assertEq(sucker.test_getInboxNonce(TOKEN), 2, "Nonce should update to 2 even when DEPRECATED");
     }
 
     /// @notice fromRemote when SENDING_DISABLED: should still accept roots (only sending is disabled).

package/test/audit/ArbitrumL2ToRemoteFeeDoS.t.sol

@@ -0,0 +1,120 @@
+// SPDX-License-Identifier: MIT
+pragma solidity 0.8.28;
+
+import "forge-std/Test.sol";
+
+import {IJBDirectory} from "@bananapus/core-v6/src/interfaces/IJBDirectory.sol";
+import {IJBPermissions} from "@bananapus/core-v6/src/interfaces/IJBPermissions.sol";
+import {IJBTerminal} from "@bananapus/core-v6/src/interfaces/IJBTerminal.sol";
+import {IJBTokens} from "@bananapus/core-v6/src/interfaces/IJBTokens.sol";
+import {JBConstants} from "@bananapus/core-v6/src/libraries/JBConstants.sol";
+import {IInbox} from "@arbitrum/nitro-contracts/src/bridge/IInbox.sol";
+import {LibClone} from "solady/src/utils/LibClone.sol";
+
+import "../../src/JBArbitrumSucker.sol";
+import "../../src/deployers/JBArbitrumSuckerDeployer.sol";
+import "../../src/enums/JBLayer.sol";
+import "../../src/interfaces/IArbGatewayRouter.sol";
+import "../../src/interfaces/IJBSuckerRegistry.sol";
+import "../../src/structs/JBRemoteToken.sol";
+
+contract ArbitrumL2FeeHarness is JBArbitrumSucker {
+    constructor(
+        JBArbitrumSuckerDeployer deployer,
+        IJBDirectory directory,
+        IJBPermissions permissions,
+        IJBTokens tokens,
+        IJBSuckerRegistry registry
+    )
+        JBArbitrumSucker(deployer, directory, permissions, tokens, 1, registry, address(0))
+    {}
+
+    function seedOutbox(address token, bytes32 remoteToken) external {
+        _remoteTokenFor[token] =
+            JBRemoteToken({addr: remoteToken, enabled: true, emergencyHatch: false, minGas: 200_000});
+        _insertIntoTree({
+            projectTokenCount: 0,
+            token: token,
+            terminalTokenAmount: 0,
+            beneficiary: bytes32(uint256(uint160(address(0xBEEF))))
+        });
+    }
+}
+
+/// @title ArbitrumL2ToRemoteFeeDoSTest
+/// @notice Regression tests for the Arbitrum L2→L1 transportPayment fix.
+/// Before the fix, `_toL1` checked `msg.value != 0` instead of `transportPayment != 0`.
+/// When a non-zero registry fee existed, `msg.value` was non-zero even though all of it was
+/// consumed by the fee — causing `_toL1` to revert and making L2→L1 bridging impossible.
+/// The fix passes `transportPayment` (msg.value minus fee) into `_toL1`, so the check
+/// correctly passes when all value goes to the fee.
+contract ArbitrumL2ToRemoteFeeDoSTest is Test {
+    address internal constant DIRECTORY = address(0x1000);
+    address internal constant PERMISSIONS = address(0x2000);
+    address internal constant TOKENS = address(0x3000);
+    address internal constant REGISTRY = address(0x4000);
+    address internal constant TERMINAL = address(0x5000);
+
+    ArbitrumL2FeeHarness internal sucker;
+
+    function setUp() public {
+        JBArbitrumSuckerDeployer deployer = new JBArbitrumSuckerDeployer({
+            directory: IJBDirectory(DIRECTORY),
+            permissions: IJBPermissions(PERMISSIONS),
+            tokens: IJBTokens(TOKENS),
+            configurator: address(this),
+            trustedForwarder: address(0)
+        });
+
+        deployer.setChainSpecificConstants({
+            layer: JBLayer.L2, inbox: IInbox(address(0)), gatewayRouter: IArbGatewayRouter(address(0xB0B))
+        });
+
+        ArbitrumL2FeeHarness singleton = new ArbitrumL2FeeHarness({
+            deployer: deployer,
+            directory: IJBDirectory(DIRECTORY),
+            permissions: IJBPermissions(PERMISSIONS),
+            tokens: IJBTokens(TOKENS),
+            registry: IJBSuckerRegistry(REGISTRY)
+        });
+
+        sucker = ArbitrumL2FeeHarness(payable(LibClone.cloneDeterministic(address(singleton), bytes32("arb_fee_dos"))));
+        sucker.initialize(1);
+        sucker.seedOutbox(JBConstants.NATIVE_TOKEN, bytes32(uint256(uint160(JBConstants.NATIVE_TOKEN))));
+
+        // Mock the registry fee and fee terminal.
+        vm.mockCall(REGISTRY, abi.encodeCall(IJBSuckerRegistry.toRemoteFee, ()), abi.encode(uint256(1)));
+        vm.mockCall(
+            DIRECTORY,
+            abi.encodeCall(IJBDirectory.primaryTerminalOf, (1, JBConstants.NATIVE_TOKEN)),
+            abi.encode(IJBTerminal(TERMINAL))
+        );
+        vm.mockCall(TERMINAL, abi.encodeWithSelector(IJBTerminal.pay.selector), abi.encode(uint256(0)));
+
+        // Mock ArbSys precompile at address(100) so sendTxToL1 succeeds.
+        vm.etch(address(100), hex"00");
+        vm.mockCall(address(100), abi.encodeWithSignature("sendTxToL1(address,bytes)"), abi.encode(uint256(0)));
+    }
+
+    /// @notice L2→L1 bridging succeeds when msg.value exactly covers the registry fee.
+    /// Before the fix, this reverted because _toL1 checked `msg.value != 0`.
+    /// After the fix, transportPayment = msg.value - fee = 0, so _toL1 passes.
+    function test_toRemoteSucceedsWhenMsgValueCoversFeeExactly() external {
+        // msg.value = 1, fee = 1 → transportPayment = 0 → _toL1 accepts
+        sucker.toRemote{value: 1}(JBConstants.NATIVE_TOKEN);
+    }
+
+    /// @notice L2→L1 bridging reverts when msg.value exceeds the fee (excess transportPayment).
+    /// Sending a message from L2→L1 via ArbSys.sendTxToL1 is free — any leftover transportPayment is invalid.
+    function test_toRemoteRevertsWhenExcessTransportPayment() external {
+        // msg.value = 2, fee = 1 → transportPayment = 1 → _toL1 reverts
+        vm.expectRevert(abi.encodeWithSelector(JBSucker.JBSucker_UnexpectedMsgValue.selector, 1));
+        sucker.toRemote{value: 2}(JBConstants.NATIVE_TOKEN);
+    }
+
+    /// @notice L2→L1 bridging reverts when msg.value is insufficient for the fee.
+    function test_toRemoteRevertsWhenMsgValueBelowFee() external {
+        vm.expectRevert(abi.encodeWithSelector(JBSucker.JBSucker_InsufficientMsgValue.selector, 0, 1));
+        sucker.toRemote{value: 0}(JBConstants.NATIVE_TOKEN);
+    }
+}