@bananapus/suckers-v6 0.0.40 → 0.0.42

package/foundry.toml

@@ -1,5 +1,6 @@
 [profile.default]
 solc = '0.8.28'
+bytecode_hash = "none"
 evm_version = 'cancun'
 optimizer_runs = 200
 libs = ["node_modules", "lib"]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bananapus/suckers-v6",
-  "version": "0.0.40",
+  "version": "0.0.42",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -30,7 +30,7 @@
   },
   "dependencies": {
     "@arbitrum/nitro-contracts": "3.2.0",
-    "@bananapus/core-v6": "^0.0.44",
+    "@bananapus/core-v6": "^0.0.48",
     "@bananapus/permission-ids-v6": "^0.0.25",
     "@chainlink/contracts-ccip": "1.6.4",
     "@chainlink/local": "0.2.7",

package/src/JBSwapCCIPSucker.sol

@@ -91,8 +91,11 @@ contract JBSwapCCIPSucker is JBCCIPSucker, IUnlockCallback, IUniswapV3SwapCallba
     error JBSwapCCIPSucker_InvalidBridgeToken(address bridgeToken, address wrappedNativeToken);
     error JBSwapCCIPSucker_NoPendingSwap(address localToken, uint64 nonce, bool retrySwapLocked);
     error JBSwapCCIPSucker_OnlySelf(address caller, address expected);
+    error JBSwapCCIPSucker_PositiveRootWithoutDelivery(uint256 rootAmount);
     error JBSwapCCIPSucker_SwapFailed(address tokenIn, address tokenOut, uint256 amountIn);
     error JBSwapCCIPSucker_SwapPending(uint64 nonce);
+    error JBSwapCCIPSucker_UnexpectedDeliveredTokens(uint256 count);
+    error JBSwapCCIPSucker_WrongDeliveredToken(address delivered, address expected);
 
     //*********************************************************************//
     // ------------------------------ events ----------------------------- //
@@ -278,22 +281,58 @@ contract JBSwapCCIPSucker is JBCCIPSucker, IUnlockCallback, IUniswapV3SwapCallba
                 abi.decode(payload, (JBMessageRoot, uint256, uint256));
 
             address localToken = _toAddress(root.token);
+            uint64 nonce = root.remoteRoot.nonce;
+            uint256 leafTotal = root.amount;
             uint256 localAmount;
             bool swapFailed;
+            // Cache the single delivered entry once so subsequent branches reuse it without re-indexing
+            // calldata. `deliveredAmount > 0` later implies a delivery was present.
+            address deliveredToken;
+            uint256 deliveredAmount;
+            {
+                // Send-side guarantees: at most one entry in `destTokenAmounts` (length 0 for zero-value
+                // batches, length 1 for value-bearing batches), and when present the delivered token is
+                // `BRIDGE_TOKEN`. Refuse anything that deviates so a peer compromise or a malformed CCIP
+                // delivery cannot register positive root accounting against zero or wrong-token backing.
+                uint256 deliveryCount = any2EvmMessage.destTokenAmounts.length;
+                if (deliveryCount > 1) {
+                    revert JBSwapCCIPSucker_UnexpectedDeliveredTokens(deliveryCount);
+                }
+                if (deliveryCount == 0) {
+                    if (leafTotal > 0) revert JBSwapCCIPSucker_PositiveRootWithoutDelivery(leafTotal);
+                } else {
+                    Client.EVMTokenAmount calldata delivered = any2EvmMessage.destTokenAmounts[0];
+                    deliveredToken = delivered.token;
+                    deliveredAmount = delivered.amount;
+                    if (deliveredToken != address(BRIDGE_TOKEN)) {
+                        revert JBSwapCCIPSucker_WrongDeliveredToken({
+                            delivered: deliveredToken, expected: address(BRIDGE_TOKEN)
+                        });
+                    }
+                    // Zero delivery alongside a positive root is structurally indistinguishable from
+                    // "no delivery + positive root" — both leave the local sucker with nothing to back
+                    // the leaves the root advertises. Reject so a peer cannot mint a claimable rate
+                    // that records `leafTotal=N, localTotal=0` and lets later claims withdraw against
+                    // unrelated balance.
+                    if (leafTotal > 0 && deliveredAmount == 0) {
+                        revert JBSwapCCIPSucker_PositiveRootWithoutDelivery(leafTotal);
+                    }
+                }
+            }
 
-            if (any2EvmMessage.destTokenAmounts.length == 1) {
-                Client.EVMTokenAmount memory tokenAmount = any2EvmMessage.destTokenAmounts[0];
-
-                if (localToken == address(BRIDGE_TOKEN) || localToken == tokenAmount.token) {
+            // After the validation block above, `deliveredToken != address(0)` iff a delivery was present,
+            // because the invariants ensure it equals `BRIDGE_TOKEN` (a non-zero ERC-20) whenever there is one.
+            if (deliveredToken != address(0)) {
+                if (localToken == address(BRIDGE_TOKEN) || localToken == deliveredToken) {
                     // No swap needed — bridge token IS the local token.
-                    localAmount = tokenAmount.amount;
+                    localAmount = deliveredAmount;
                 } else {
                     // Swap bridge token -> local token via best V3/V4 pool.
                     // Wrapped in try-catch so a swap failure doesn't revert the entire CCIP message
                     // (which would leave tokens stuck in the OffRamp). On failure, bridge tokens are
                     // stored for later retry via `retrySwap` (written below, after nonce validation).
                     try this.executeSwapExternal({
-                        tokenIn: tokenAmount.token, tokenOut: localToken, amount: tokenAmount.amount
+                        tokenIn: deliveredToken, tokenOut: localToken, amount: deliveredAmount
                     }) returns (
                         uint256 swapped
                     ) {
@@ -321,28 +360,23 @@ contract JBSwapCCIPSucker is JBCCIPSucker, IUnlockCallback, IUniswapV3SwapCallba
             // Detect "already seen" without extra storage: a nonce has been processed if it has
             // either a batch range (batchEnd > 0) or a conversion rate / pending swap recorded.
             if (
-                _batchEndOf[localToken][root.remoteRoot.nonce] == 0
-                    && _conversionRateOf[localToken][root.remoteRoot.nonce].leafTotal == 0
-                    && pendingSwapOf[localToken][root.remoteRoot.nonce].leafTotal == 0
+                _batchEndOf[localToken][nonce] == 0 && _conversionRateOf[localToken][nonce].leafTotal == 0
+                    && pendingSwapOf[localToken][nonce].leafTotal == 0
             ) {
                 // Record the batch range so _findNonceForLeafIndex can resolve leaf ownership
                 // independently of nonce ordering. Each nonce is self-describing: [start, end).
                 if (batchEnd > 0) {
-                    _batchStartOf[localToken][root.remoteRoot.nonce] = batchStart;
-                    _batchEndOf[localToken][root.remoteRoot.nonce] = batchEnd;
-                    if (root.remoteRoot.nonce > _highestReceivedNonce[localToken]) {
-                        _highestReceivedNonce[localToken] = root.remoteRoot.nonce;
+                    _batchStartOf[localToken][nonce] = batchStart;
+                    _batchEndOf[localToken][nonce] = batchEnd;
+                    if (nonce > _highestReceivedNonce[localToken]) {
+                        _highestReceivedNonce[localToken] = nonce;
                     }
                 }
 
                 // Store pendingSwapOf for failed swaps now that nonce is validated.
                 if (swapFailed) {
-                    Client.EVMTokenAmount memory failedTokenAmount = any2EvmMessage.destTokenAmounts[0];
-                    pendingSwapOf[localToken][root.remoteRoot.nonce] = PendingSwap({
-                        bridgeToken: failedTokenAmount.token,
-                        bridgeAmount: failedTokenAmount.amount,
-                        leafTotal: root.amount
-                    });
+                    pendingSwapOf[localToken][nonce] =
+                        PendingSwap({bridgeToken: deliveredToken, bridgeAmount: deliveredAmount, leafTotal: leafTotal});
                 }
 
                 // Zero-output swap guard: When a swap succeeds but returns zero local tokens, the
@@ -354,25 +388,14 @@ contract JBSwapCCIPSucker is JBCCIPSucker, IUnlockCallback, IUniswapV3SwapCallba
                 // Route zero-output swaps into `pendingSwapOf` so the swap can be retried via
                 // `retrySwap` once pool conditions improve. Only store the conversion rate when
                 // the swap produced a positive local amount.
-                if (root.amount > 0 && !swapFailed) {
-                    if (localAmount == 0 && any2EvmMessage.destTokenAmounts.length == 1) {
-                        Client.EVMTokenAmount memory zeroSwapTokenAmount = any2EvmMessage.destTokenAmounts[0];
-                        // Only route to pending if there were actual bridge tokens delivered.
-                        // If bridgeAmount is also 0 (zero-value batch), store the conversion rate
-                        // normally — there is nothing to retry.
-                        if (zeroSwapTokenAmount.amount > 0) {
-                            pendingSwapOf[localToken][root.remoteRoot.nonce] = PendingSwap({
-                                bridgeToken: zeroSwapTokenAmount.token,
-                                bridgeAmount: zeroSwapTokenAmount.amount,
-                                leafTotal: root.amount
-                            });
-                        } else {
-                            _conversionRateOf[localToken][root.remoteRoot.nonce] =
-                                ConversionRate({leafTotal: root.amount, localTotal: 0});
-                        }
+                if (leafTotal > 0 && !swapFailed) {
+                    if (localAmount == 0 && deliveredAmount > 0) {
+                        pendingSwapOf[localToken][nonce] = PendingSwap({
+                            bridgeToken: deliveredToken, bridgeAmount: deliveredAmount, leafTotal: leafTotal
+                        });
                     } else {
-                        _conversionRateOf[localToken][root.remoteRoot.nonce] =
-                            ConversionRate({leafTotal: root.amount, localTotal: localAmount});
+                        _conversionRateOf[localToken][nonce] =
+                            ConversionRate({leafTotal: leafTotal, localTotal: localAmount});
                     }
                 }
             }

package/src/libraries/JBSwapPoolLib.sol

@@ -51,6 +51,7 @@ library JBSwapPoolLib {
     error JBSwapPoolLib_InsufficientTwapHistory(address pool, uint256 availableWindow, uint256 requiredWindow);
     error JBSwapPoolLib_NoLiquidity(address pool, PoolId poolId);
     error JBSwapPoolLib_NoPool(address tokenIn, address tokenOut);
+    error JBSwapPoolLib_PartialFill(uint256 consumed, uint256 requested);
     error JBSwapPoolLib_SlippageExceeded(uint256 amountOut, uint256 minAmountOut);
 
     //*********************************************************************//
@@ -132,6 +133,7 @@ library JBSwapPoolLib {
                     config: config,
                     key: v4Key,
                     normalizedTokenIn: normalizedIn,
+                    originalTokenIn: tokenIn,
                     amount: amount,
                     minAmountOut: minAmountOut
                 });
@@ -142,6 +144,7 @@ library JBSwapPoolLib {
                     key: v4Key,
                     normalizedTokenIn: normalizedIn,
                     normalizedTokenOut: normalizedOut,
+                    originalTokenIn: tokenIn,
                     amount: amount
                 });
             }
@@ -893,6 +896,7 @@ library JBSwapPoolLib {
         PoolKey memory key,
         address normalizedTokenIn,
         address normalizedTokenOut,
+        address originalTokenIn,
         uint256 amount
     )
         internal
@@ -909,7 +913,12 @@ library JBSwapPoolLib {
 
         // Execute the swap through the V4 PoolManager.
         amountOut = _executeV4Swap({
-            config: config, key: key, normalizedTokenIn: normalizedTokenIn, amount: amount, minAmountOut: minOut
+            config: config,
+            key: key,
+            normalizedTokenIn: normalizedTokenIn,
+            originalTokenIn: originalTokenIn,
+            amount: amount,
+            minAmountOut: minOut
         });
     }
 
@@ -981,6 +990,18 @@ library JBSwapPoolLib {
             data: abi.encode(originalTokenIn, normalizedTokenIn, normalizedTokenOut)
         });
 
+        // Reject partial fills: when the V3 pool's price limit is hit before the full input is
+        // consumed, the pool returns only the consumed portion of `amount` and the caller is left
+        // holding the unconsumed remainder. The sucker's accounting assumes the full bridge amount
+        // was either swapped or made retryable, so a silent partial fill strands input tokens and
+        // breaks cross-chain solvency. Revert so the caller can either retry with a smaller size
+        // or wait for liquidity to return.
+        // forge-lint: disable-next-line(unsafe-typecast)
+        uint256 consumedAmount = uint256(zeroForOne ? amount0 : amount1);
+        if (consumedAmount < amount) {
+            revert JBSwapPoolLib_PartialFill({consumed: consumedAmount, requested: amount});
+        }
+
         // Extract the output amount from the signed delta (negative = tokens received).
         amountOut = uint256(-(zeroForOne ? amount1 : amount0));
 
@@ -1001,6 +1022,7 @@ library JBSwapPoolLib {
         SwapConfig memory config,
         PoolKey memory key,
         address normalizedTokenIn,
+        address originalTokenIn,
         uint256 amount,
         uint256 minAmountOut
     )
@@ -1013,6 +1035,16 @@ library JBSwapPoolLib {
         // Determine swap direction based on currency ordering in the pool key.
         bool zeroForOne = Currency.unwrap(key.currency0) == v4In;
 
+        // Tell the unlock callback whether to consume any wrapped-native-token balance the caller may hold.
+        // The pool's input side is native iff the swap input came from the wrapped-native ERC-20 (not the
+        // NATIVE_TOKEN sentinel). If the caller's input was already native (NATIVE_TOKEN sentinel), the caller
+        // holds raw ETH for THIS swap; any wrapped balance it holds is for unrelated reasons (e.g., backing other
+        // claims) and must not be consumed here.
+        address callbackWrappedNativeToken;
+        if (v4In == address(0) && originalTokenIn != JBConstants.NATIVE_TOKEN) {
+            callbackWrappedNativeToken = config.wrappedNativeToken;
+        }
+
         // Build the encoded unlock data in a scoped block to avoid stack-too-deep.
         bytes memory unlockData;
         {
@@ -1027,7 +1059,7 @@ library JBSwapPoolLib {
             int256 exactInputAmount = -int256(amount);
 
             unlockData = abi.encode(
-                key, zeroForOne, exactInputAmount, sqrtPriceLimitX96, minAmountOut, config.wrappedNativeToken
+                key, zeroForOne, exactInputAmount, sqrtPriceLimitX96, minAmountOut, callbackWrappedNativeToken
             );
         }