@bananapus/suckers-v6 0.0.39 → 0.0.40

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bananapus/suckers-v6",
-  "version": "0.0.39",
+  "version": "0.0.40",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -31,7 +31,7 @@
   "dependencies": {
     "@arbitrum/nitro-contracts": "3.2.0",
     "@bananapus/core-v6": "^0.0.44",
-    "@bananapus/permission-ids-v6": "^0.0.23",
+    "@bananapus/permission-ids-v6": "^0.0.25",
     "@chainlink/contracts-ccip": "1.6.4",
     "@chainlink/local": "0.2.7",
     "@openzeppelin/contracts": "5.6.1",

package/src/JBSuckerRegistry.sol

@@ -497,6 +497,13 @@ contract JBSuckerRegistry is ERC2771Context, Ownable, JBPermissioned, IJBSuckerR
         // default peer symmetry assumption will not hold.
         salt = keccak256(abi.encode(sender, salt));
 
+        // Cache the project owner so the explicit-peer gate can check against the original authority, not a
+        // delegated operator. The default same-address peering invariant (peer == 0 or peer == address(this))
+        // does not need this stronger gate, but a non-symmetric explicit peer authorizes that arbitrary address
+        // to deliver outbox roots and mint project tokens — so it must require a permission strictly broader
+        // than ops automation's `DEPLOY_SUCKERS`.
+        address projectOwner = PROJECTS.ownerOf(projectId);
+
         // Iterate through the configurations and deploy the suckers.
         for (uint256 i; i < configurations.length;) {
             // Get the configuration being iterated over.
@@ -507,6 +514,18 @@ contract JBSuckerRegistry is ERC2771Context, Ownable, JBPermissioned, IJBSuckerR
                 revert JBSuckerRegistry_InvalidDeployer({deployer: configuration.deployer});
             }
 
+            // If the configuration specifies a non-symmetric explicit peer, require the additional
+            // `SET_SUCKER_PEER` permission. Default peering (peer == 0 or peer == bytes32 of address(this)) is
+            // unaffected. Without this gate, a delegated operator with only `DEPLOY_SUCKERS` could register an
+            // attacker peer and use the resulting sucker's mint authority to deliver fabricated outbox roots.
+            // forge-lint: disable-next-line(unsafe-typecast)
+            bytes32 selfPeer = bytes32(uint256(uint160(address(this))));
+            if (configuration.peer != bytes32(0) && configuration.peer != selfPeer) {
+                _requirePermissionFrom({
+                    account: projectOwner, projectId: projectId, permissionId: JBPermissionIds.SET_SUCKER_PEER
+                });
+            }
+
             // Create the sucker.
             IJBSucker sucker = configuration.deployer
             .createForSender({localProjectId: projectId, salt: salt, peer: configuration.peer});