@bananapus/suckers-v6 0.0.39 → 0.0.41

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bananapus/suckers-v6",
-  "version": "0.0.39",
+  "version": "0.0.41",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -30,8 +30,8 @@
   },
   "dependencies": {
     "@arbitrum/nitro-contracts": "3.2.0",
-    "@bananapus/core-v6": "^0.0.44",
-    "@bananapus/permission-ids-v6": "^0.0.23",
+    "@bananapus/core-v6": "^0.0.48",
+    "@bananapus/permission-ids-v6": "^0.0.25",
     "@chainlink/contracts-ccip": "1.6.4",
     "@chainlink/local": "0.2.7",
     "@openzeppelin/contracts": "5.6.1",

package/src/JBSuckerRegistry.sol

@@ -497,6 +497,13 @@ contract JBSuckerRegistry is ERC2771Context, Ownable, JBPermissioned, IJBSuckerR
         // default peer symmetry assumption will not hold.
         salt = keccak256(abi.encode(sender, salt));
 
+        // Cache the project owner so the explicit-peer gate can check against the original authority, not a
+        // delegated operator. The default same-address peering invariant (peer == 0 or peer == address(this))
+        // does not need this stronger gate, but a non-symmetric explicit peer authorizes that arbitrary address
+        // to deliver outbox roots and mint project tokens — so it must require a permission strictly broader
+        // than ops automation's `DEPLOY_SUCKERS`.
+        address projectOwner = PROJECTS.ownerOf(projectId);
+
         // Iterate through the configurations and deploy the suckers.
         for (uint256 i; i < configurations.length;) {
             // Get the configuration being iterated over.
@@ -507,6 +514,18 @@ contract JBSuckerRegistry is ERC2771Context, Ownable, JBPermissioned, IJBSuckerR
                 revert JBSuckerRegistry_InvalidDeployer({deployer: configuration.deployer});
             }
 
+            // If the configuration specifies a non-symmetric explicit peer, require the additional
+            // `SET_SUCKER_PEER` permission. Default peering (peer == 0 or peer == bytes32 of address(this)) is
+            // unaffected. Without this gate, a delegated operator with only `DEPLOY_SUCKERS` could register an
+            // attacker peer and use the resulting sucker's mint authority to deliver fabricated outbox roots.
+            // forge-lint: disable-next-line(unsafe-typecast)
+            bytes32 selfPeer = bytes32(uint256(uint160(address(this))));
+            if (configuration.peer != bytes32(0) && configuration.peer != selfPeer) {
+                _requirePermissionFrom({
+                    account: projectOwner, projectId: projectId, permissionId: JBPermissionIds.SET_SUCKER_PEER
+                });
+            }
+
             // Create the sucker.
             IJBSucker sucker = configuration.deployer
             .createForSender({localProjectId: projectId, salt: salt, peer: configuration.peer});

package/src/JBSwapCCIPSucker.sol

@@ -91,8 +91,11 @@ contract JBSwapCCIPSucker is JBCCIPSucker, IUnlockCallback, IUniswapV3SwapCallba
     error JBSwapCCIPSucker_InvalidBridgeToken(address bridgeToken, address wrappedNativeToken);
     error JBSwapCCIPSucker_NoPendingSwap(address localToken, uint64 nonce, bool retrySwapLocked);
     error JBSwapCCIPSucker_OnlySelf(address caller, address expected);
+    error JBSwapCCIPSucker_PositiveRootWithoutDelivery(uint256 rootAmount);
     error JBSwapCCIPSucker_SwapFailed(address tokenIn, address tokenOut, uint256 amountIn);
     error JBSwapCCIPSucker_SwapPending(uint64 nonce);
+    error JBSwapCCIPSucker_UnexpectedDeliveredTokens(uint256 count);
+    error JBSwapCCIPSucker_WrongDeliveredToken(address delivered, address expected);
 
     //*********************************************************************//
     // ------------------------------ events ----------------------------- //
@@ -278,22 +281,50 @@ contract JBSwapCCIPSucker is JBCCIPSucker, IUnlockCallback, IUniswapV3SwapCallba
                 abi.decode(payload, (JBMessageRoot, uint256, uint256));
 
             address localToken = _toAddress(root.token);
+            uint64 nonce = root.remoteRoot.nonce;
+            uint256 leafTotal = root.amount;
             uint256 localAmount;
             bool swapFailed;
+            // Cache the single delivered entry once so subsequent branches reuse it without re-indexing
+            // calldata. `deliveredAmount > 0` later implies a delivery was present.
+            address deliveredToken;
+            uint256 deliveredAmount;
+            {
+                // Send-side guarantees: at most one entry in `destTokenAmounts` (length 0 for zero-value
+                // batches, length 1 for value-bearing batches), and when present the delivered token is
+                // `BRIDGE_TOKEN`. Refuse anything that deviates so a peer compromise or a malformed CCIP
+                // delivery cannot register positive root accounting against zero or wrong-token backing.
+                uint256 deliveryCount = any2EvmMessage.destTokenAmounts.length;
+                if (deliveryCount > 1) {
+                    revert JBSwapCCIPSucker_UnexpectedDeliveredTokens(deliveryCount);
+                }
+                if (deliveryCount == 0) {
+                    if (leafTotal > 0) revert JBSwapCCIPSucker_PositiveRootWithoutDelivery(leafTotal);
+                } else {
+                    Client.EVMTokenAmount calldata delivered = any2EvmMessage.destTokenAmounts[0];
+                    deliveredToken = delivered.token;
+                    deliveredAmount = delivered.amount;
+                    if (deliveredToken != address(BRIDGE_TOKEN)) {
+                        revert JBSwapCCIPSucker_WrongDeliveredToken({
+                            delivered: deliveredToken, expected: address(BRIDGE_TOKEN)
+                        });
+                    }
+                }
+            }
 
-            if (any2EvmMessage.destTokenAmounts.length == 1) {
-                Client.EVMTokenAmount memory tokenAmount = any2EvmMessage.destTokenAmounts[0];
-
-                if (localToken == address(BRIDGE_TOKEN) || localToken == tokenAmount.token) {
+            // After the validation block above, `deliveredToken != address(0)` iff a delivery was present,
+            // because the invariants ensure it equals `BRIDGE_TOKEN` (a non-zero ERC-20) whenever there is one.
+            if (deliveredToken != address(0)) {
+                if (localToken == address(BRIDGE_TOKEN) || localToken == deliveredToken) {
                     // No swap needed — bridge token IS the local token.
-                    localAmount = tokenAmount.amount;
+                    localAmount = deliveredAmount;
                 } else {
                     // Swap bridge token -> local token via best V3/V4 pool.
                     // Wrapped in try-catch so a swap failure doesn't revert the entire CCIP message
                     // (which would leave tokens stuck in the OffRamp). On failure, bridge tokens are
                     // stored for later retry via `retrySwap` (written below, after nonce validation).
                     try this.executeSwapExternal({
-                        tokenIn: tokenAmount.token, tokenOut: localToken, amount: tokenAmount.amount
+                        tokenIn: deliveredToken, tokenOut: localToken, amount: deliveredAmount
                     }) returns (
                         uint256 swapped
                     ) {
@@ -321,28 +352,23 @@ contract JBSwapCCIPSucker is JBCCIPSucker, IUnlockCallback, IUniswapV3SwapCallba
             // Detect "already seen" without extra storage: a nonce has been processed if it has
             // either a batch range (batchEnd > 0) or a conversion rate / pending swap recorded.
             if (
-                _batchEndOf[localToken][root.remoteRoot.nonce] == 0
-                    && _conversionRateOf[localToken][root.remoteRoot.nonce].leafTotal == 0
-                    && pendingSwapOf[localToken][root.remoteRoot.nonce].leafTotal == 0
+                _batchEndOf[localToken][nonce] == 0 && _conversionRateOf[localToken][nonce].leafTotal == 0
+                    && pendingSwapOf[localToken][nonce].leafTotal == 0
             ) {
                 // Record the batch range so _findNonceForLeafIndex can resolve leaf ownership
                 // independently of nonce ordering. Each nonce is self-describing: [start, end).
                 if (batchEnd > 0) {
-                    _batchStartOf[localToken][root.remoteRoot.nonce] = batchStart;
-                    _batchEndOf[localToken][root.remoteRoot.nonce] = batchEnd;
-                    if (root.remoteRoot.nonce > _highestReceivedNonce[localToken]) {
-                        _highestReceivedNonce[localToken] = root.remoteRoot.nonce;
+                    _batchStartOf[localToken][nonce] = batchStart;
+                    _batchEndOf[localToken][nonce] = batchEnd;
+                    if (nonce > _highestReceivedNonce[localToken]) {
+                        _highestReceivedNonce[localToken] = nonce;
                     }
                 }
 
                 // Store pendingSwapOf for failed swaps now that nonce is validated.
                 if (swapFailed) {
-                    Client.EVMTokenAmount memory failedTokenAmount = any2EvmMessage.destTokenAmounts[0];
-                    pendingSwapOf[localToken][root.remoteRoot.nonce] = PendingSwap({
-                        bridgeToken: failedTokenAmount.token,
-                        bridgeAmount: failedTokenAmount.amount,
-                        leafTotal: root.amount
-                    });
+                    pendingSwapOf[localToken][nonce] =
+                        PendingSwap({bridgeToken: deliveredToken, bridgeAmount: deliveredAmount, leafTotal: leafTotal});
                 }
 
                 // Zero-output swap guard: When a swap succeeds but returns zero local tokens, the
@@ -354,25 +380,14 @@ contract JBSwapCCIPSucker is JBCCIPSucker, IUnlockCallback, IUniswapV3SwapCallba
                 // Route zero-output swaps into `pendingSwapOf` so the swap can be retried via
                 // `retrySwap` once pool conditions improve. Only store the conversion rate when
                 // the swap produced a positive local amount.
-                if (root.amount > 0 && !swapFailed) {
-                    if (localAmount == 0 && any2EvmMessage.destTokenAmounts.length == 1) {
-                        Client.EVMTokenAmount memory zeroSwapTokenAmount = any2EvmMessage.destTokenAmounts[0];
-                        // Only route to pending if there were actual bridge tokens delivered.
-                        // If bridgeAmount is also 0 (zero-value batch), store the conversion rate
-                        // normally — there is nothing to retry.
-                        if (zeroSwapTokenAmount.amount > 0) {
-                            pendingSwapOf[localToken][root.remoteRoot.nonce] = PendingSwap({
-                                bridgeToken: zeroSwapTokenAmount.token,
-                                bridgeAmount: zeroSwapTokenAmount.amount,
-                                leafTotal: root.amount
-                            });
-                        } else {
-                            _conversionRateOf[localToken][root.remoteRoot.nonce] =
-                                ConversionRate({leafTotal: root.amount, localTotal: 0});
-                        }
+                if (leafTotal > 0 && !swapFailed) {
+                    if (localAmount == 0 && deliveredAmount > 0) {
+                        pendingSwapOf[localToken][nonce] = PendingSwap({
+                            bridgeToken: deliveredToken, bridgeAmount: deliveredAmount, leafTotal: leafTotal
+                        });
                     } else {
-                        _conversionRateOf[localToken][root.remoteRoot.nonce] =
-                            ConversionRate({leafTotal: root.amount, localTotal: localAmount});
+                        _conversionRateOf[localToken][nonce] =
+                            ConversionRate({leafTotal: leafTotal, localTotal: localAmount});
                     }
                 }
             }

package/src/libraries/JBSwapPoolLib.sol

@@ -132,6 +132,7 @@ library JBSwapPoolLib {
                     config: config,
                     key: v4Key,
                     normalizedTokenIn: normalizedIn,
+                    originalTokenIn: tokenIn,
                     amount: amount,
                     minAmountOut: minAmountOut
                 });
@@ -142,6 +143,7 @@ library JBSwapPoolLib {
                     key: v4Key,
                     normalizedTokenIn: normalizedIn,
                     normalizedTokenOut: normalizedOut,
+                    originalTokenIn: tokenIn,
                     amount: amount
                 });
             }
@@ -893,6 +895,7 @@ library JBSwapPoolLib {
         PoolKey memory key,
         address normalizedTokenIn,
         address normalizedTokenOut,
+        address originalTokenIn,
         uint256 amount
     )
         internal
@@ -909,7 +912,12 @@ library JBSwapPoolLib {
 
         // Execute the swap through the V4 PoolManager.
         amountOut = _executeV4Swap({
-            config: config, key: key, normalizedTokenIn: normalizedTokenIn, amount: amount, minAmountOut: minOut
+            config: config,
+            key: key,
+            normalizedTokenIn: normalizedTokenIn,
+            originalTokenIn: originalTokenIn,
+            amount: amount,
+            minAmountOut: minOut
         });
     }
 
@@ -1001,6 +1009,7 @@ library JBSwapPoolLib {
         SwapConfig memory config,
         PoolKey memory key,
         address normalizedTokenIn,
+        address originalTokenIn,
         uint256 amount,
         uint256 minAmountOut
     )
@@ -1013,6 +1022,16 @@ library JBSwapPoolLib {
         // Determine swap direction based on currency ordering in the pool key.
         bool zeroForOne = Currency.unwrap(key.currency0) == v4In;
 
+        // Tell the unlock callback whether to consume any wrapped-native-token balance the caller may hold.
+        // The pool's input side is native iff the swap input came from the wrapped-native ERC-20 (not the
+        // NATIVE_TOKEN sentinel). If the caller's input was already native (NATIVE_TOKEN sentinel), the caller
+        // holds raw ETH for THIS swap; any wrapped balance it holds is for unrelated reasons (e.g., backing other
+        // claims) and must not be consumed here.
+        address callbackWrappedNativeToken;
+        if (v4In == address(0) && originalTokenIn != JBConstants.NATIVE_TOKEN) {
+            callbackWrappedNativeToken = config.wrappedNativeToken;
+        }
+
         // Build the encoded unlock data in a scoped block to avoid stack-too-deep.
         bytes memory unlockData;
         {
@@ -1027,7 +1046,7 @@ library JBSwapPoolLib {
             int256 exactInputAmount = -int256(amount);
 
             unlockData = abi.encode(
-                key, zeroForOne, exactInputAmount, sqrtPriceLimitX96, minAmountOut, config.wrappedNativeToken
+                key, zeroForOne, exactInputAmount, sqrtPriceLimitX96, minAmountOut, callbackWrappedNativeToken
             );
         }