@bananapus/suckers-v6 0.0.47 → 0.0.49

package/src/JBSwapCCIPSucker.sol

@@ -175,19 +175,15 @@ contract JBSwapCCIPSucker is JBCCIPSucker, IUnlockCallback, IUniswapV3SwapCallba
     /// @custom:param nonce The CCIP nonce identifying the batch.
     mapping(address token => mapping(uint64 nonce => ConversionRate)) internal _conversionRateOf;
 
-    /// @notice Highest nonce received so far per token. Used as upper bound for nonce iteration.
-    /// @custom:param token The local token address.
-    mapping(address token => uint64) internal _highestReceivedNonce;
-
     /// @notice Count of populated batch nonces per token. Appended exactly once per batch in
     /// `ccipReceive`, so it equals the number of received batches independent of CCIP ordering.
     /// @custom:param token The local token address.
     mapping(address token => uint64) internal _populatedNonceCount;
 
-    /// @notice Populated batch nonces per token, indexed by insertion order. Enables the
-    /// empty-midpoint fallback in `_findNonceForLeafIndex` to walk only the K populated nonces
-    /// (O(K) worst case) instead of the full [lo, hi] nonce span (O(N) worst case under sparse
-    /// adversarial patterns).
+    /// @notice Populated batch nonces per token, indexed by insertion order.
+    /// @dev `_findNonceForLeafIndex` walks this list directly. That bounds lookup by the number of
+    /// received batches, not by the highest nonce, so sparse or out-of-order CCIP delivery cannot
+    /// force the claim path to scan empty nonce slots.
     /// @custom:param token The local token address.
     /// @custom:param index The insertion index in [0, _populatedNonceCount[token]).
     mapping(address token => mapping(uint64 index => uint64 nonce)) internal _populatedNonceByIndex;
@@ -201,6 +197,10 @@ contract JBSwapCCIPSucker is JBCCIPSucker, IUnlockCallback, IUniswapV3SwapCallba
     // ------------------- transient stored properties ------------------- //
     //*********************************************************************//
 
+    /// @dev Reentrancy guard for the initial `ccipReceive` swap. Prevents claims from consuming newly received
+    /// swap output before the batch's conversion rate has been recorded.
+    bool transient _ccipReceiveSwapLocked;
+
     /// @notice Leaf index + 1 of the claim currently in progress (set by the `claim` override).
     /// @dev Transient storage — auto-resets to 0 each transaction, saving ~9,800 gas per claim vs SSTORE.
     /// Value 0 means no active claim (bypass scaling); non-zero means leafIndex = value - 1.
@@ -344,13 +344,16 @@ contract JBSwapCCIPSucker is JBCCIPSucker, IUnlockCallback, IUniswapV3SwapCallba
                     // Wrapped in try-catch so a swap failure doesn't revert the entire CCIP message
                     // (which would leave tokens stuck in the OffRamp). On failure, bridge tokens are
                     // stored for later retry via `retrySwap` (written below, after nonce validation).
+                    _ccipReceiveSwapLocked = true;
                     try this.executeSwapExternal({
                         tokenIn: deliveredToken, tokenOut: localToken, amount: deliveredAmount
                     }) returns (
                         uint256 swapped
                     ) {
+                        _ccipReceiveSwapLocked = false;
                         localAmount = swapped;
                     } catch {
+                        _ccipReceiveSwapLocked = false;
                         swapFailed = true;
                         // localAmount stays 0 — pendingSwapOf and conversion rate are written
                         // below, after fromRemote validates the nonce.
@@ -401,14 +404,6 @@ contract JBSwapCCIPSucker is JBCCIPSucker, IUnlockCallback, IUniswapV3SwapCallba
                     unchecked {
                         _populatedNonceCount[localToken] = priorCount + 1;
                     }
-
-                    // Track the highest nonce ever observed for this token. Read by
-                    // `_findNonceForLeafIndex` as the binary-search upper bound. Out-of-order
-                    // delivery keeps this monotonic — we only advance it when the new nonce is
-                    // strictly higher than the prior maximum.
-                    if (nonce > _highestReceivedNonce[localToken]) {
-                        _highestReceivedNonce[localToken] = nonce;
-                    }
                 }
 
                 // Store pendingSwapOf for failed swaps now that nonce is validated.
@@ -529,7 +524,7 @@ contract JBSwapCCIPSucker is JBCCIPSucker, IUnlockCallback, IUniswapV3SwapCallba
     /// @param claimData The claim data containing the leaf and proof.
     function claim(JBClaim calldata claimData) public override {
         // Block claims during retrySwap to prevent zero-backed minting via reentrancy.
-        if (_retrySwapLocked) revert JBSwapCCIPSucker_SwapPending(0);
+        if (_retrySwapLocked || _ccipReceiveSwapLocked) revert JBSwapCCIPSucker_SwapPending(0);
         _currentClaimLeafIndex = claimData.leaf.index + 1;
         super.claim(claimData);
         // Clear stale transient context to prevent leaking into same-tx emergency exits.
@@ -573,7 +568,7 @@ contract JBSwapCCIPSucker is JBCCIPSucker, IUnlockCallback, IUniswapV3SwapCallba
     }
 
     /// @notice Override to swap local tokens into bridge tokens before CCIP bridging.
-    /// @dev Does NOT modify `sucker_message.amount` — keeps the original leaf-denomination total so the
+    /// @dev Does NOT modify `suckerMessage.amount` — keeps the original leaf-denomination total so the
     /// receiving chain can use it (along with the actual delivered amount) to compute the proportional
     /// scaling factor for individual claims.
     /// Delegates CCIP message construction to JBCCIPLib (via DELEGATECALL) to reduce bytecode.
@@ -582,7 +577,7 @@ contract JBSwapCCIPSucker is JBCCIPSucker, IUnlockCallback, IUniswapV3SwapCallba
     /// @param token The local token to bridge.
     /// @param amount The amount of local tokens to bridge.
     /// @param remoteToken The remote token configuration (including minGas).
-    /// @param sucker_message The merkle root message to send to the remote chain.
+    /// @param suckerMessage The merkle root message to send to the remote chain.
     // forge-lint: disable-next-line(mixed-case-function)
     function _sendRootOverAMB(
         uint256 transportPayment,
@@ -590,7 +585,7 @@ contract JBSwapCCIPSucker is JBCCIPSucker, IUnlockCallback, IUniswapV3SwapCallba
         address token,
         uint256 amount,
         JBRemoteToken memory remoteToken,
-        JBMessageRoot memory sucker_message
+        JBMessageRoot memory suckerMessage
     )
         internal
         override
@@ -620,13 +615,13 @@ contract JBSwapCCIPSucker is JBCCIPSucker, IUnlockCallback, IUniswapV3SwapCallba
                 BRIDGE_TOKEN.forceApprove({spender: address(CCIP_ROUTER), value: bridgeAmount});
             }
 
-            // NOTE: sucker_message.amount stays as the original leaf-denomination total.
+            // NOTE: suckerMessage.amount stays as the original leaf-denomination total.
             // Encode batch range [batchStart, batchEnd) so the receiver can resolve leaf ownership
             // per-nonce without requiring contiguous nonce delivery.
             uint256 batchStart = _lastSentCount[token];
             uint256 batchEnd = index + 1;
             _lastSentCount[token] = batchEnd;
-            encodedPayload = abi.encode(_CCIP_MSG_TYPE_ROOT, abi.encode(sucker_message, batchStart, batchEnd));
+            encodedPayload = abi.encode(_CCIP_MSG_TYPE_ROOT, abi.encode(suckerMessage, batchStart, batchEnd));
         }
 
         {
@@ -703,94 +698,36 @@ contract JBSwapCCIPSucker is JBCCIPSucker, IUnlockCallback, IUniswapV3SwapCallba
     // ----------------------- internal views ---------------------------- //
     //*********************************************************************//
 
-    /// @notice Find the nonce whose batch contains the given leaf index.
-    /// @dev Binary search by nonce. Source-side `prepare()` appends batches in nonce order with each
-    /// new batch's `batchStart` equal to the previous batch's `batchEnd`, so across populated
-    /// destination slots `_batchStartOf` is strictly increasing in nonce — the populated subset is
-    /// monotonic even when CCIP delivery is out of order and leaves intermediate slots empty.
-    /// Binary search exploits that monotonicity for O(log N) lookup.
-    /// @dev Gap handling: when the midpoint slot is empty (CCIP out-of-order delivery or sparse
-    /// attacker writes), the fallback walks `_populatedNonceByIndex` — the list of every nonce
-    /// actually populated. That bounds the worst case at `O(K)` SLOADs, where `K` is the number
-    /// of received batches, regardless of how sparse the populated set is inside `[1, maxNonce]`.
-    /// The empty-slot scans that drove `O(N)` under the prior linear fallback are eliminated.
+    /// @notice Find the received nonce whose batch contains the given leaf index.
+    /// @dev Walks `_populatedNonceByIndex` instead of `[1, highestNonce]`. The populated list is the
+    /// only set that can contain a claimable batch, and it stays compact even when CCIP delivers
+    /// nonce 10 before nonce 2. This keeps lookup O(K) where K is received batches, avoids sparse
+    /// empty-slot scans, and keeps the deployable bytecode below the EIP-170 size limit.
     /// @param token The local token address.
     /// @param leafIndex The leaf index from the claim.
     /// @return The nonce of the batch containing this leaf, or 0 if no batches have been recorded.
     function _findNonceForLeafIndex(address token, uint256 leafIndex) internal view returns (uint64) {
-        // `_highestReceivedNonce` upper-bounds any populated slot for this token; zero means
-        // nothing has been received yet, so the leaf belongs to no batch.
-        uint64 maxNonce = _highestReceivedNonce[token];
-        if (maxNonce == 0) return 0;
-
-        // Nonce 0 is reserved by inbox initialization and never holds a batch, so search [1, max].
-        uint64 lo = 1;
-        uint64 hi = maxNonce;
-
-        // Wrap arithmetic in `unchecked` — `lo` and `hi` are always in `[1, maxNonce]` and the
-        // edge-guards (`mid == lo` / `mid == hi` breaks) prevent the only ways `mid - 1` or
-        // `mid + 1` could over/underflow. Skipping the compiler checks shaves enough bytecode to
-        // stay under EIP-170 without changing semantics.
+        // No populated batches for this token means there is no conversion rate to apply. Preserve
+        // nonce 0 as the "unbatched" sentinel used by `_addToBalance`'s non-claim path.
+        uint64 count = _populatedNonceCount[token];
+        if (count == 0) return 0;
+
+        // Walk only nonces that actually received a batch. The array is insertion-ordered, not
+        // sorted, because CCIP can deliver batches out of nonce order; each entry still points to a
+        // self-contained `[batchStart, batchEnd)` range written before the append.
         unchecked {
-            while (lo <= hi) {
-                uint64 mid = lo + (hi - lo) / 2;
-                // `batchEnd == 0` is the established sentinel for "no batch recorded" (see the
-                // write guard in `ccipReceive`); a real batch always has `batchEnd > batchStart`.
-                uint256 end = _batchEndOf[token][mid];
-
-                // Empty midpoint from out-of-order CCIP delivery (the sender minted a higher nonce
-                // than the inbox has yet received, leaving holes in `[1, maxNonce]`) or a sparse
-                // pattern an attacker assembled by inflating `_highestReceivedNonce` without
-                // populating intermediate slots. The earlier linear `[lo, hi]` scan walked every
-                // empty slot, so worst-case cost was `O(maxNonce)` SLOADs — that's the residual
-                // the audit flagged. Walk `_populatedNonceByIndex` instead: it's `K` entries (one
-                // per received batch) and contains exactly the slots a real batch can cover.
-                if (end == 0) {
-                    // Number of populated batch slots for this token — equal to the array length.
-                    // Maintained by `ccipReceive`'s append (one SSTORE per first-time receive).
-                    uint64 count = _populatedNonceCount[token];
-
-                    // Linear walk over the populated set. Bounded by `count`, not `maxNonce`, so
-                    // sparse adversarial patterns can't inflate this loop with empty slots.
-                    for (uint64 i; i < count; i++) {
-                        // Insertion-ordered nonce at index `i`. May be any value in `[1, maxNonce]`
-                        // because CCIP delivery is out-of-order; the array is not sorted by nonce.
-                        uint64 n = _populatedNonceByIndex[token][i];
-
-                        // Read end of this batch's leaf range. Always `> 0` here — we only push to
-                        // `_populatedNonceByIndex` after the corresponding `_batchEndOf` write.
-                        uint256 nEnd = _batchEndOf[token][n];
-
-                        // Coverage test: each batch's `[batchStart, batchEnd)` is non-overlapping
-                        // across populated nonces, so a hit is unique. The `[lo, hi]` window from
-                        // the binary search isn't applied — the binary-search invariant guarantees
-                        // the leaf can only live in a populated nonce, so an out-of-window match
-                        // would mean the binary search was already wrong; falling through to the
-                        // next iteration costs less than the extra two compares per iteration.
-                        if (leafIndex >= _batchStartOf[token][n] && leafIndex < nEnd) return n;
-                    }
-
-                    // No populated nonce contains `leafIndex` for this token. Break out of the
-                    // outer binary-search loop and fall through to the shared revert below.
-                    break;
-                }
+            for (uint64 i; i < count; i++) {
+                uint64 nonce = _populatedNonceByIndex[token][i];
+                uint256 end = _batchEndOf[token][nonce];
 
-                // Each batch covers [batchStart, batchEnd). Across populated nonces these ranges
-                // are non-overlapping and strictly increasing, so the standard comparison applies.
-                uint256 start = _batchStartOf[token][mid];
-                if (leafIndex < start) {
-                    if (mid == lo) break; // Guard against `mid - 1` underflow at the lower edge.
-                    hi = mid - 1;
-                } else if (leafIndex >= end) {
-                    if (mid == hi) break; // Mirror guard at the upper edge.
-                    lo = mid + 1;
-                } else {
-                    return mid; // `start <= leafIndex < end`: leaf is inside this batch.
-                }
+                // Ranges are non-overlapping across populated nonces. The first hit is therefore
+                // the unique conversion-rate batch for this claim leaf.
+                if (leafIndex >= _batchStartOf[token][nonce] && leafIndex < end) return nonce;
             }
         }
 
-        // Window collapsed without a hit — surface the same error the legacy linear scan used.
+        // Batches exist for the token, but none cover this leaf index; surface the same error used
+        // before the compact populated-nonce index was introduced.
         revert JBSwapCCIPSucker_BatchNotReceived({nonce: 0});
     }
 }

package/src/deployers/JBSwapCCIPSuckerDeployer.sol

@@ -68,17 +68,17 @@ contract JBSwapCCIPSuckerDeployer is JBCCIPSuckerDeployer, IJBSwapCCIPSuckerDepl
     //*********************************************************************//
 
     /// @notice Configure the swap-specific constants. Can only be called once by the configurator.
-    /// @param _bridgeToken The ERC-20 token used for CCIP bridging.
-    /// @param _poolManager The Uniswap V4 PoolManager (can be address(0) if V4 unavailable).
-    /// @param _v3Factory The Uniswap V3 factory (can be address(0) if V3 unavailable).
-    /// @param _univ4Hook The V4 hook for pool discovery (optional, address(0) if none).
-    /// @param _wrappedNativeToken The ERC-20 wrapper address for the chain's native token (e.g. WETH on Ethereum).
+    /// @param newBridgeToken The ERC-20 token used for CCIP bridging.
+    /// @param newPoolManager The Uniswap V4 PoolManager (can be address(0) if V4 unavailable).
+    /// @param newV3Factory The Uniswap V3 factory (can be address(0) if V3 unavailable).
+    /// @param newUniv4Hook The V4 hook for pool discovery (optional, address(0) if none).
+    /// @param newWrappedNativeToken The ERC-20 wrapper address for the chain's native token (e.g. WETH on Ethereum).
     function setSwapConstants(
-        IERC20 _bridgeToken,
-        IPoolManager _poolManager,
-        IUniswapV3Factory _v3Factory,
-        address _univ4Hook,
-        address _wrappedNativeToken
+        IERC20 newBridgeToken,
+        IPoolManager newPoolManager,
+        IUniswapV3Factory newV3Factory,
+        address newUniv4Hook,
+        address newWrappedNativeToken
     )
         external
     {
@@ -93,23 +93,23 @@ contract JBSwapCCIPSuckerDeployer is JBCCIPSuckerDeployer, IJBSwapCCIPSuckerDepl
         }
 
         // Make sure the bridge token is not the zero address.
-        if (address(_bridgeToken) == address(0)) {
-            revert JBSwapCCIPSuckerDeployer_InvalidSwapConfig({bridgeToken: address(_bridgeToken)});
+        if (address(newBridgeToken) == address(0)) {
+            revert JBSwapCCIPSuckerDeployer_InvalidSwapConfig({bridgeToken: address(newBridgeToken)});
         }
 
         // Store the bridge token.
-        bridgeToken = _bridgeToken;
+        bridgeToken = newBridgeToken;
 
         // Store the Uniswap V4 pool manager.
-        poolManager = _poolManager;
+        poolManager = newPoolManager;
 
         // Store the Uniswap V3 factory.
-        v3Factory = _v3Factory;
+        v3Factory = newV3Factory;
 
         // Store the Uniswap V4 hook address.
-        univ4Hook = _univ4Hook;
+        univ4Hook = newUniv4Hook;
 
         // Store the wrapped native token address.
-        wrappedNativeToken = _wrappedNativeToken;
+        wrappedNativeToken = newWrappedNativeToken;
     }
 }

package/src/interfaces/IJBSucker.sol

@@ -128,12 +128,6 @@ interface IJBSucker is IERC165 {
     /// @return chainId The remote chain ID.
     function peerChainId() external view returns (uint256 chainId);
 
-    /// @notice The last known total token supply on the peer chain, updated each time a bridge message is received.
-    /// @dev Used by data hooks to compute `effectiveTotalSupply = localSupply + sum(peerChainTotalSupply)` across all
-    /// suckers, preventing cash out tax bypass on chains where a holder dominates the local supply.
-    /// @return The peer chain's total supply.
-    function peerChainTotalSupply() external view returns (uint256);
-
     /// @notice The aggregate peer chain balance, normalized to a desired currency and decimal precision using JBPrices.
     /// @dev The balance is stored as ETH-denominated (18 decimals) and converted to the requested currency/decimals
     /// using the local JBPrices oracle.
@@ -150,6 +144,12 @@ interface IJBSucker is IERC165 {
     /// @return A `JBDenominatedAmount` with the converted value.
     function peerChainSurplusOf(uint256 decimals, uint256 currency) external view returns (JBDenominatedAmount memory);
 
+    /// @notice The last known total token supply on the peer chain, updated each time a bridge message is received.
+    /// @dev Used by data hooks to compute `effectiveTotalSupply = localSupply + sum(peerChainTotalSupply)` across all
+    /// suckers, preventing cash out tax bypass on chains where a holder dominates the local supply.
+    /// @return The peer chain's total supply.
+    function peerChainTotalSupply() external view returns (uint256);
+
     /// @notice The ID of the project on the local chain that this sucker is associated with.
     /// @return The project ID.
     function projectId() external view returns (uint256);
@@ -159,6 +159,11 @@ interface IJBSucker is IERC165 {
     /// @return The remote token info.
     function remoteTokenFor(address token) external view returns (JBRemoteToken memory);
 
+    /// @notice The freshness key of the latest accepted peer-chain economic snapshot.
+    /// @dev Higher values are fresher. The key is source-chain monotonic, not a value magnitude.
+    /// @return The latest peer-chain snapshot freshness key.
+    function snapshotTimestamp() external view returns (uint256);
+
     /// @notice The current deprecation state of this sucker.
     /// @return The sucker state.
     function state() external view returns (JBSuckerState);

package/src/interfaces/IJBSuckerRegistry.sol

@@ -77,13 +77,15 @@ interface IJBSuckerRegistry {
     function suckersOf(uint256 projectId) external view returns (address[] memory);
 
     /// @notice The cumulative total supply across all remote peer chains for a project.
-    /// @dev Sums `peerChainTotalSupply` from each active sucker. Silently skips suckers that revert.
+    /// @dev Dedupes same-peer active suckers by freshest snapshot, then sums peer-chain values. Silently skips suckers
+    /// that revert.
     /// @param projectId The ID of the project.
     /// @return totalSupply The combined peer chain total supply.
     function remoteTotalSupplyOf(uint256 projectId) external view returns (uint256 totalSupply);
 
     /// @notice The cumulative balance across all remote peer chains for a project, denominated in a given currency.
-    /// @dev Sums `peerChainBalanceOf` from each active sucker. Silently skips suckers that revert.
+    /// @dev Dedupes same-peer active suckers by freshest snapshot, then sums peer-chain values. Silently skips suckers
+    /// that revert.
     /// @param projectId The ID of the project.
     /// @param decimals The decimal precision for the returned value.
     /// @param currency The currency to normalize to.
@@ -98,7 +100,8 @@ interface IJBSuckerRegistry {
         returns (uint256 balance);
 
     /// @notice The cumulative surplus across all remote peer chains for a project, denominated in a given currency.
-    /// @dev Sums `peerChainSurplusOf` from each active sucker. Silently skips suckers that revert.
+    /// @dev Dedupes same-peer active suckers by freshest snapshot, then sums peer-chain values. Silently skips suckers
+    /// that revert.
     /// @param projectId The ID of the project.
     /// @param decimals The decimal precision for the returned value.
     /// @param currency The currency to normalize to.

package/src/interfaces/IL1ArbitrumGateway.sol

@@ -4,18 +4,18 @@ pragma solidity ^0.8.0;
 /// @notice Interface for Arbitrum L1 gateways to query the exact calldata they construct for retryable tickets.
 interface IL1ArbitrumGateway {
     /// @notice Returns the calldata that the gateway will submit as a retryable ticket to the Inbox.
-    /// @param _token The L1 token address.
-    /// @param _from The sender on L1.
-    /// @param _to The recipient on L2.
-    /// @param _amount The amount of tokens to bridge.
-    /// @param _data Additional data (forwarded to the L2 gateway).
+    /// @param token The L1 token address.
+    /// @param from The sender on L1.
+    /// @param to The recipient on L2.
+    /// @param amount The amount of tokens to bridge.
+    /// @param data Additional data (forwarded to the L2 gateway).
     /// @return The ABI-encoded calldata for `finalizeInboundTransfer` on the L2 gateway.
     function getOutboundCalldata(
-        address _token,
-        address _from,
-        address _to,
-        uint256 _amount,
-        bytes calldata _data
+        address token,
+        address from,
+        address to,
+        uint256 amount,
+        bytes calldata data
     )
         external
         view

package/src/libraries/CCIPHelper.sol

@@ -133,6 +133,70 @@ library CCIPHelper {
     /// @notice The wrapped native token address for Tempo mod chain.
     address public constant TEMPO_MOD_WETH = 0xbb2D3310E4232085d432A2e04b2Ac09c46F634E4;
 
+    /// @notice Returns the LINK token address for a given chain ID.
+    /// @param chainId The EVM chain ID to look up.
+    /// @return link The LINK token address.
+    function linkOfChain(uint256 chainId) public pure returns (address link) {
+        if (chainId == ETH_ID) {
+            return ETH_LINK;
+        } else if (chainId == OP_ID) {
+            return OP_LINK;
+        } else if (chainId == ARB_ID) {
+            return ARB_LINK;
+        } else if (chainId == BASE_ID) {
+            return BASE_LINK;
+        } else if (chainId == ETH_SEP_ID) {
+            return ETH_SEP_LINK;
+        } else if (chainId == OP_SEP_ID) {
+            return OP_SEP_LINK;
+        } else if (chainId == ARB_SEP_ID) {
+            return ARB_SEP_LINK;
+        } else if (chainId == BASE_SEP_ID) {
+            return BASE_SEP_LINK;
+        } else if (chainId == TEMPO_ID) {
+            return TEMPO_LINK;
+        } else if (chainId == TEMPO_MOD_ID) {
+            return TEMPO_MOD_LINK;
+        } else {
+            revert CCIPHelper_UnsupportedChain({chainId: chainId});
+        }
+    }
+
+    /// @notice Returns the wrapped native token address for a given chain ID.
+    /// @param chainId The EVM chain ID to look up.
+    /// @return weth The wrapped native token address.
+    function wethOfChain(uint256 chainId) public pure returns (address weth) {
+        if (chainId == ETH_ID) {
+            return ETH_WETH;
+        } else if (chainId == OP_ID) {
+            return OP_WETH;
+        } else if (chainId == ARB_ID) {
+            return ARB_WETH;
+        } else if (chainId == POLY_ID) {
+            return POLY_WETH;
+        } else if (chainId == AVA_ID) {
+            return AVA_WETH;
+        } else if (chainId == BNB_ID) {
+            return BNB_WETH;
+        } else if (chainId == BASE_ID) {
+            return BASE_WETH;
+        } else if (chainId == ETH_SEP_ID) {
+            return ETH_SEP_WETH;
+        } else if (chainId == ARB_SEP_ID) {
+            return ARB_SEP_WETH;
+        } else if (chainId == OP_SEP_ID) {
+            return OP_SEP_WETH;
+        } else if (chainId == BASE_SEP_ID) {
+            return BASE_SEP_WETH;
+        } else if (chainId == TEMPO_ID) {
+            return TEMPO_WETH;
+        } else if (chainId == TEMPO_MOD_ID) {
+            return TEMPO_MOD_WETH;
+        } else {
+            revert CCIPHelper_UnsupportedChain({chainId: chainId});
+        }
+    }
+
     /// @notice Returns the CCIP router address for a given chain ID.
     /// @param chainId The EVM chain ID to look up.
     /// @return router The CCIP router address.
@@ -202,68 +266,4 @@ library CCIPHelper {
             revert CCIPHelper_UnsupportedChain({chainId: chainId});
         }
     }
-
-    /// @notice Returns the wrapped native token address for a given chain ID.
-    /// @param chainId The EVM chain ID to look up.
-    /// @return weth The wrapped native token address.
-    function wethOfChain(uint256 chainId) public pure returns (address weth) {
-        if (chainId == ETH_ID) {
-            return ETH_WETH;
-        } else if (chainId == OP_ID) {
-            return OP_WETH;
-        } else if (chainId == ARB_ID) {
-            return ARB_WETH;
-        } else if (chainId == POLY_ID) {
-            return POLY_WETH;
-        } else if (chainId == AVA_ID) {
-            return AVA_WETH;
-        } else if (chainId == BNB_ID) {
-            return BNB_WETH;
-        } else if (chainId == BASE_ID) {
-            return BASE_WETH;
-        } else if (chainId == ETH_SEP_ID) {
-            return ETH_SEP_WETH;
-        } else if (chainId == ARB_SEP_ID) {
-            return ARB_SEP_WETH;
-        } else if (chainId == OP_SEP_ID) {
-            return OP_SEP_WETH;
-        } else if (chainId == BASE_SEP_ID) {
-            return BASE_SEP_WETH;
-        } else if (chainId == TEMPO_ID) {
-            return TEMPO_WETH;
-        } else if (chainId == TEMPO_MOD_ID) {
-            return TEMPO_MOD_WETH;
-        } else {
-            revert CCIPHelper_UnsupportedChain({chainId: chainId});
-        }
-    }
-
-    /// @notice Returns the LINK token address for a given chain ID.
-    /// @param chainId The EVM chain ID to look up.
-    /// @return link The LINK token address.
-    function linkOfChain(uint256 chainId) public pure returns (address link) {
-        if (chainId == ETH_ID) {
-            return ETH_LINK;
-        } else if (chainId == OP_ID) {
-            return OP_LINK;
-        } else if (chainId == ARB_ID) {
-            return ARB_LINK;
-        } else if (chainId == BASE_ID) {
-            return BASE_LINK;
-        } else if (chainId == ETH_SEP_ID) {
-            return ETH_SEP_LINK;
-        } else if (chainId == OP_SEP_ID) {
-            return OP_SEP_LINK;
-        } else if (chainId == ARB_SEP_ID) {
-            return ARB_SEP_LINK;
-        } else if (chainId == BASE_SEP_ID) {
-            return BASE_SEP_LINK;
-        } else if (chainId == TEMPO_ID) {
-            return TEMPO_LINK;
-        } else if (chainId == TEMPO_MOD_ID) {
-            return TEMPO_MOD_LINK;
-        } else {
-            revert CCIPHelper_UnsupportedChain({chainId: chainId});
-        }
-    }
 }

package/src/libraries/JBCCIPLib.sol

@@ -133,10 +133,15 @@ library JBCCIPLib {
             SafeERC20.forceApprove({token: IERC20(feeToken), spender: router, value: totalApproval});
 
             ICCIPRouter(router).ccipSend({destinationChainSelector: chainSel, message: message});
+
+            _clearTokenAmountApprovals({router: router, tokenAmounts: tokenAmounts});
+            SafeERC20.forceApprove({token: IERC20(feeToken), spender: router, value: 0});
         } else {
             // Native ETH fee path.
             ICCIPRouter(router).ccipSend{value: fees}({destinationChainSelector: chainSel, message: message});
 
+            _clearTokenAmountApprovals({router: router, tokenAmounts: tokenAmounts});
+
             // Calculate the excess transport payment to refund.
             refundAmount = transportPayment - fees;
 
@@ -189,4 +194,17 @@ library JBCCIPLib {
         // ABI-decode the type and payload from the raw data.
         (messageType, payload) = abi.decode(data, (uint8, bytes));
     }
+
+    //*********************************************************************//
+    // ----------------------- private helpers --------------------------- //
+    //*********************************************************************//
+
+    /// @notice Clear token approvals granted to the CCIP router for the current message.
+    /// @param router The CCIP router whose allowances should be revoked.
+    /// @param tokenAmounts The bridged token amounts approved for this message.
+    function _clearTokenAmountApprovals(address router, Client.EVMTokenAmount[] memory tokenAmounts) private {
+        for (uint256 i; i < tokenAmounts.length; i++) {
+            SafeERC20.forceApprove({token: IERC20(tokenAmounts[i].token), spender: router, value: 0});
+        }
+    }
 }

package/src/libraries/JBRelayBeneficiary.sol

@@ -35,7 +35,7 @@ library JBRelayBeneficiary {
         returns (address effectiveBeneficiary)
     {
         // Only trust relay metadata when the payer is a registered sucker for this project.
-        if (!registry.isSuckerOf(projectId, payer)) {
+        if (!registry.isSuckerOf({projectId: projectId, addr: payer})) {
             return beneficiary;
         }