@bananapus/suckers-v6 0.0.78 → 1.0.0

package/README.md

@@ -22,8 +22,8 @@ The codebase includes multiple bridge variants, but the canonical deployment and
 Suckers bridge a project by tracking claims in append-only Merkle trees:
 
 - users call `prepare` to burn tokens and create a bridge claim in the local outbox tree
-- anyone can relay the current root to the peer chain with `toRemote`
-- anyone can refresh or retry peer accounting with `syncAccountingData`
+- anyone can relay the current root to the peer chain with `toRemote`, which also gossips the project's per-source-chain accounting bundle
+- anyone can refresh or retry the accounting gossip bundle with `syncAccountingData`
 - claimants prove inclusion against the peer inbox tree to mint on the destination chain
 
 The base implementation is extended for multiple bridge families so the same project model can work across different networks.
@@ -46,7 +46,7 @@ Each sucker pair has three jobs:
 
 1. destroy or lock the local economic position into a claimable message
 2. recreate the remote position from a bridged Merkle root plus transported value
-3. keep the peer's aggregate accounting views fresh enough for cross-chain estimates
+3. keep a per-source-chain accounting store fresh enough for cross-chain estimates, gossiping every chain's record across the sucker mesh
 
 That means every bridge path has two trust surfaces:
 
@@ -66,8 +66,9 @@ That means every bridge path has two trust surfaces:
 - do not reason about suckers as if they were generic ERC-20 bridges
 - root ordering and message delivery semantics matter as much as proof format
 - token mapping is part of the economic invariant
-- peer contexts are merged only when they share both currency and decimals; same-currency contexts with different decimals are kept separate and valued independently at read time, never summed across precisions
-- `syncAccountingData` pays no registry `toRemoteFee`, but bridge-specific transport costs still apply and duplicate snapshots can still consume bridge/indexer resources
+- peer contexts are merged only when they share both currency and decimals; same-currency contexts with different decimals are kept separate and valued independently at read time, never summed across precisions — and this merge applies per source chain, since each chain's record is stored and folded on its own
+- accounting propagates as a gossip bundle: a sucker sends its own chain's record plus every peer-chain record the project knows (gathered through the registry), so one sync round from a hub propagates every chain's data to every spoke without a direct sucker between each pair
+- `syncAccountingData` pays no registry `toRemoteFee`, but bridge-specific transport costs still apply and duplicate bundles can still consume bridge/indexer resources
 - emergency and deprecation paths are part of normal operational safety
 
 ## Where state lives

package/foundry.toml

@@ -3,6 +3,8 @@ solc = '0.8.28'
 bytecode_hash = "none"
 evm_version = 'cancun'
 optimizer_runs = 200
+# The IR pipeline keeps the per-chain accounting suckers (Arbitrum, CCIP) under the EIP-170 runtime size limit.
+via_ir = true
 libs = ["node_modules", "lib"]
 fs_permissions = [{ access = "read-write", path = "./"}]
 # Archived, unused contracts (e.g. JBSwapCCIPSucker) and their tests live under `archive/` folders and are

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bananapus/suckers-v6",
-  "version": "0.0.78",
+  "version": "1.0.0",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -27,8 +27,8 @@
   },
   "dependencies": {
     "@arbitrum/nitro-contracts": "3.2.0",
-    "@bananapus/core-v6": "^0.0.87",
-    "@bananapus/permission-ids-v6": "^0.0.32",
+    "@bananapus/core-v6": "^1.0.0",
+    "@bananapus/permission-ids-v6": "^1.0.0",
     "@chainlink/contracts-ccip": "1.6.4",
     "@openzeppelin/contracts": "5.6.1",
     "@prb/math": "4.1.2",

package/references/entrypoints.md

@@ -51,12 +51,23 @@ A sucker bridges a Juicebox project's token economy between two chains. Cashed-o
 
 ### `JBAccountingSnapshot` (argument to `fromRemoteAccounting`)
 
+A cross-chain accounting gossip bundle: the sending chain's own record plus every peer-chain record it currently holds.
+
 | Field | Type | Meaning |
 |-------|------|---------|
 | `version` | `uint8` | Message format version. Must match `MESSAGE_VERSION`. |
-| `sourceTotalSupply` | `uint256` | Source-chain project-token supply, including reserved tokens. |
-| `sourceContexts` | `JBSourceContext[]` | Raw source-chain surplus and balance contexts, un-valued. |
-| `sourceTimestamp` | `uint256` | Monotonic freshness key used to reject stale accounting updates. |
+| `accounts` | `JBChainAccounting[]` | One accounting record per source chain known to the sender (its own chain plus forwarded peers), each carrying its origin chain id and freshness key. The receiver stores the freshest record per source chain. |
+
+The same `JBChainAccounting[] accounts` bundle is also carried by the root message `JBMessageRoot` (alongside `token`, `amount`, and `remoteRoot`), so a `toRemote` send propagates accounting too.
+
+### `JBChainAccounting` (one source chain's record in a bundle)
+
+| Field | Type | Meaning |
+|-------|------|---------|
+| `chainId` | `uint256` | The source chain this record describes. A receiver ignores a record for its own chain or chain 0. |
+| `totalSupply` | `uint256` | Source-chain project-token supply, including reserved tokens. |
+| `contexts` | `JBSourceContext[]` | Raw source-chain surplus and balance contexts, un-valued (in the source chain's own token addresses and decimals). |
+| `timestamp` | `uint256` | Monotonic source-chain freshness key, gated independently per source chain. |
 
 ## Key functions
 
@@ -66,8 +77,8 @@ A sucker bridges a Juicebox project's token economy between two chains. Cashed-o
 |----------|--------------|
 | `prepare(uint256 projectTokenCount, bytes32 beneficiary, uint256 minTokensReclaimed, address token, bytes32 metadata)` | Cash out `projectTokenCount` project tokens into `token` and insert a leaf for `beneficiary` into the outbox tree for bridging. `minTokensReclaimed` bounds slippage; `metadata` is an opaque attribution payload carried in the leaf hash (`bytes32(0)` for a plain bridge). |
 | `toRemote(address token) payable` | Send the current outbox tree root and bridged assets for `token` to the remote peer through the chain-specific transport. `payable` to fund the transport message and the registry's `toRemoteFee`. |
-| `syncAccountingData() payable` | Send the latest total supply, surplus, and balance snapshot without sending an outbox root or paying the registry `toRemoteFee`. Can be retried with unchanged accounting data; `payable` only funds bridge transport. |
-| `fromRemoteAccounting(JBAccountingSnapshot calldata snapshot)` | Authenticated receive path for accounting-only snapshots. Updates peer accounting if the snapshot is fresher, without touching any token-local inbox root. |
+| `syncAccountingData() payable` | Send the cross-chain accounting gossip bundle — this chain's own record plus every peer-chain record it holds (gathered across the project's suckers via the registry, minus the destination) — without sending an outbox root or paying the registry `toRemoteFee`. Can be retried with unchanged data; `payable` only funds bridge transport. |
+| `fromRemoteAccounting(JBAccountingSnapshot calldata snapshot)` | Authenticated receive path for an accounting-only gossip bundle. Stores the freshest record per source chain, without touching any token-local inbox root. |
 | `claim(JBClaim calldata claimData)` | Claim bridged project tokens for the leaf's beneficiary by proving inclusion against the inbox root. |
 | `claim(JBClaim[] calldata claims)` | Claim multiple leaves in one call. Each leaf is routed through an external `this.claim` sub-call, so one failing leaf emits `ClaimFailed` and is reverted in isolation while the rest of the batch proceeds; the failed leaf stays claimable later. |
 | `mapToken(JBTokenMapping calldata map) payable` | Map a single local token to a remote token for bridging. Mappings are immutable once the outbox tree has entries (can only be disabled, not remapped). Requires `MAP_SUCKER_TOKEN` permission (initial mappings are applied at deploy under `DEPLOY_SUCKERS`). |
@@ -97,8 +108,12 @@ A sucker bridges a Juicebox project's token economy between two chains. Cashed-o
 | `outboxOf(address token)` | The outbox merkle tree (`JBOutboxTree`) for a token. |
 | `amountToAddToBalanceOf(address token)` | Tokens received from bridging that are waiting to be added to the project's terminal balance. |
 | `executedLeafHashOf(address token, uint256 index)` | The committed leaf hash at `(token, index)`, or `bytes32(0)` if unexecuted. Beneficiary contracts re-derive this to authenticate a settlement that a front-runner's direct `claim` already executed. |
-| `peerChainTotalSupply()` | The last-known peer-chain total token supply (used by data hooks to compute effective cross-chain supply). |
-| `peerChainContextsOf()` | Per-context raw surplus and balance from the latest peer snapshot, with chain ID and freshness key. Un-valued (each context in its own currency/decimals). |
+| `peerChainIds(bool includeVirtual)` | The peer chains this sucker reports accounting for: its directly-connected peer, plus — when `includeVirtual` is true — every chain learned about through gossip. The registry aggregates the `includeVirtual: true` set. |
+| `peerChainAccountsOf()` | The raw, un-valued `JBChainAccounting[]` record this sucker holds for every known peer chain. The registry reads this to gather a project's cross-chain knowledge and re-gossip it. |
+| `peerChainContextsOf(uint256 chainId)` | Per-context surplus and balance for one peer chain, resolved to local currencies and folded at read time. Un-valued; returned with the chain's freshness key. |
+| `peerChainTotalSupplyOf(uint256 chainId)` | The last-known total token supply on one peer chain (the registry sums these to compute effective cross-chain supply). |
+| `peerChainTotalSupplyValue(uint256 chainId)` | One peer chain's total supply bundled with its chain id and freshness key (`JBPeerChainValue`). |
+| `snapshotTimestampOf(uint256 chainId)` | The freshness key of the latest accepted record for one peer chain. |
 | `retainedToRemoteFeeOf(address account)` | ETH owed to `account` from a failed `toRemote` fee payment. |
 | `retainedTransportPaymentRefundOf(address account)` | ETH owed to `account` from a failed transport-payment refund. |
 
@@ -116,7 +131,8 @@ A sucker bridges a Juicebox project's token economy between two chains. Cashed-o
 | `suckerPairsOf(uint256 projectId)` | The local/remote sucker pairs (`JBSuckersPair[]`) for a project. |
 | `isSuckerOf(uint256 projectId, address addr)` | Whether `addr` is a registry-deployed sucker for the project. |
 | `suckerDeployerIsAllowed(address deployer)` | Whether a deployer is on the allowlist. |
-| `remoteTotalSupplyOf(uint256 projectId)` | Combined peer-chain total supply across all remote chains (dedups same-peer suckers by freshest snapshot). |
-| `totalRemoteSurplusOf(uint256 projectId, uint256 currency, uint256 decimals)` | Combined peer-chain surplus valued into `currency`. Matching-currency contexts taken at par; missing cross-currency feed skips that sucker (conservative). |
+| `peerChainAccountsOf(uint256 projectId, uint256 exceptChainId)` | The freshest accounting record per source chain across all of a project's suckers, deduped and minus `exceptChainId` — the peer set a sucker forwards when re-gossiping. |
+| `remoteTotalSupplyOf(uint256 projectId)` | Combined peer-chain total supply across all remote chains (aggregates every (sucker, chain) pair, deduped per source chain by freshest record). |
+| `totalRemoteSurplusOf(uint256 projectId, uint256 currency, uint256 decimals)` | Combined peer-chain surplus valued into `currency`. Matching-currency contexts taken at par; a missing cross-currency feed skips that (sucker, chain) (conservative). |
 | `totalRemoteBalanceOf(uint256 projectId, uint256 currency, uint256 decimals)` | Combined peer-chain balance valued into `currency`, same valuation rules as above. |
 | `toRemoteFee()` / `MAX_TO_REMOTE_FEE()` | The current `toRemote` fee and its hardcoded ceiling. |

package/src/JBArbitrumSucker.sol

@@ -112,11 +112,13 @@ contract JBArbitrumSucker is JBSucker, IJBArbitrumSucker {
     }
 
     /// @notice Helper to create the retryable ticket, avoiding stack-too-deep.
+    /// @param gasLimit The destination L2 gas to provision, scaled to the message's gossip bundle.
     function _createRetryableTicket(
         uint256 callTransportCost,
         uint256 nativeValue,
         uint256 maxSubmissionCost,
         uint256 maxFeePerGas,
+        uint256 gasLimit,
         bytes memory data
     )
         internal
@@ -128,7 +130,7 @@ contract JBArbitrumSucker is JBSucker, IJBArbitrumSucker {
             maxSubmissionCost: maxSubmissionCost,
             excessFeeRefundAddress: _msgSender(),
             callValueRefundAddress: peerAddress,
-            gasLimit: MESSENGER_BASE_GAS_LIMIT,
+            gasLimit: gasLimit,
             maxFeePerGas: maxFeePerGas,
             data: data
         });
@@ -158,7 +160,8 @@ contract JBArbitrumSucker is JBSucker, IJBArbitrumSucker {
                 transportPayment: transportPayment,
                 amount: 0,
                 data: data,
-                remoteToken: remoteToken
+                remoteToken: remoteToken,
+                gasLimit: _messagingGasLimit({accounts: snapshot.accounts})
             });
         } else {
             // L2→L1 via ArbSys is free — reject any transport payment.
@@ -191,7 +194,12 @@ contract JBArbitrumSucker is JBSucker, IJBArbitrumSucker {
             // L1→L2 requires transport payment for retryable tickets.
             if (transportPayment == 0) revert JBSucker_ExpectedMsgValue({msgValue: transportPayment});
             _toL2({
-                token: token, transportPayment: transportPayment, amount: amount, data: data, remoteToken: remoteToken
+                token: token,
+                transportPayment: transportPayment,
+                amount: amount,
+                data: data,
+                remoteToken: remoteToken,
+                gasLimit: _messagingGasLimit({accounts: message.accounts})
             });
         } else {
             // L2→L1 via ArbSys is free — reject any transport payment.
@@ -255,12 +263,14 @@ contract JBArbitrumSucker is JBSucker, IJBArbitrumSucker {
     /// @param token The token to bridge.
     /// @param amount The amount of tokens to bridge.
     /// @param data The calldata to send to the remote chain. This calls `JBSucker.fromRemote` on the remote peer.
+    /// @param gasLimit The destination L2 gas to provision, scaled to the message's gossip bundle.
     function _toL2(
         address token,
         uint256 transportPayment,
         uint256 amount,
         bytes memory data,
-        JBRemoteToken memory remoteToken
+        JBRemoteToken memory remoteToken,
+        uint256 gasLimit
     )
         internal
     {
@@ -273,8 +283,9 @@ contract JBArbitrumSucker is JBSucker, IJBArbitrumSucker {
             maxSubmissionCost =
                 ARBINBOX.calculateRetryableSubmissionFee({dataLength: data.length, baseFee: maxFeePerGas});
 
-            // Tracks the cost for the call to the remote peer.
-            callTransportCost = maxSubmissionCost + (MESSENGER_BASE_GAS_LIMIT * maxFeePerGas);
+            // Tracks the cost for the call to the remote peer. Scaled to the bundle so a larger mesh's accounting
+            // store does not run out of gas on the destination.
+            callTransportCost = maxSubmissionCost + (gasLimit * maxFeePerGas);
         }
 
         // If the token is an ERC-20, bridge it to the peer.
@@ -351,6 +362,7 @@ contract JBArbitrumSucker is JBSucker, IJBArbitrumSucker {
             nativeValue: nativeValue,
             maxSubmissionCost: maxSubmissionCost,
             maxFeePerGas: maxFeePerGas,
+            gasLimit: gasLimit,
             data: data
         });
     }

package/src/JBCCIPSucker.sol

@@ -25,6 +25,7 @@ import {JBCCIPLib} from "./libraries/JBCCIPLib.sol";
 
 // Local: structs (alphabetized)
 import {JBAccountingSnapshot} from "./structs/JBAccountingSnapshot.sol";
+import {JBChainAccounting} from "./structs/JBChainAccounting.sol";
 import {JBMessageRoot} from "./structs/JBMessageRoot.sol";
 import {JBRemoteToken} from "./structs/JBRemoteToken.sol";
 import {JBTokenMapping} from "./structs/JBTokenMapping.sol";
@@ -77,9 +78,6 @@ contract JBCCIPSucker is JBSucker, IAny2EVMMessageReceiver {
     /// @notice Message type prefix for root messages (fromRemote).
     uint8 internal constant _CCIP_MSG_TYPE_ROOT = 0;
 
-    /// @notice Extra destination gas budgeted for each source accounting context carried in a CCIP message.
-    uint256 internal constant _CCIP_SOURCE_CONTEXT_GAS_LIMIT = 75_000;
-
     //*********************************************************************//
     // --------------- public immutable stored properties ---------------- //
     //*********************************************************************//
@@ -269,7 +267,7 @@ contract JBCCIPSucker is JBSucker, IAny2EVMMessageReceiver {
     {
         _sendCcipMessage({
             transportPayment: transportPayment,
-            gasLimit: _ccipGasLimitFor({sourceContextCount: snapshot.sourceContexts.length}),
+            gasLimit: _messagingGasLimit({accounts: snapshot.accounts}),
             encodedPayload: abi.encode(_CCIP_MSG_TYPE_ACCOUNTING, abi.encode(snapshot)),
             tokenAmounts: new Client.EVMTokenAmount[](0)
         });
@@ -343,7 +341,7 @@ contract JBCCIPSucker is JBSucker, IAny2EVMMessageReceiver {
         override
     {
         // Budget for the root receiver plus the accounting contexts carried in the root message.
-        uint256 gasLimit = _ccipGasLimitFor({sourceContextCount: suckerMessage.sourceContexts.length});
+        uint256 gasLimit = _messagingGasLimit({accounts: suckerMessage.accounts});
         Client.EVMTokenAmount[] memory tokenAmounts;
 
         if (amount != 0) {
@@ -369,13 +367,6 @@ contract JBCCIPSucker is JBSucker, IAny2EVMMessageReceiver {
     // ------------------------ internal views --------------------------- //
     //*********************************************************************//
 
-    /// @notice The CCIP destination gas limit for a message carrying `sourceContextCount` accounting contexts.
-    /// @param sourceContextCount The number of source accounting contexts in the message.
-    /// @return gasLimit The destination gas limit to ask CCIP to provide.
-    function _ccipGasLimitFor(uint256 sourceContextCount) internal pure returns (uint256 gasLimit) {
-        return MESSENGER_BASE_GAS_LIMIT + (sourceContextCount * _CCIP_SOURCE_CONTEXT_GAS_LIMIT);
-    }
-
     /// @notice Checks whether the given sender is a remote peer. Unused in this context.
     /// @param sender The address to check.
     /// @return _valid Whether the sender is a remote peer.

package/src/JBOptimismSucker.sol

@@ -7,6 +7,7 @@ import {IJBTokens} from "@bananapus/core-v6/src/interfaces/IJBTokens.sol";
 import {JBConstants} from "@bananapus/core-v6/src/libraries/JBConstants.sol";
 import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
 import {SafeERC20} from "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";
+import {SafeCast} from "@openzeppelin/contracts/utils/math/SafeCast.sol";
 
 import {JBSucker} from "./JBSucker.sol";
 import {JBOptimismSuckerDeployer} from "./deployers/JBOptimismSuckerDeployer.sol";
@@ -102,7 +103,8 @@ contract JBOptimismSucker is JBSucker, IJBOptimismSucker {
         OPMESSENGER.sendMessage({
             target: _toAddress(peer()),
             message: abi.encodeCall(JBSucker.fromRemoteAccounting, (snapshot)),
-            gasLimit: MESSENGER_BASE_GAS_LIMIT
+            // Scale the destination gas with the bundle so a larger mesh's accounting still stores in one relay.
+            gasLimit: SafeCast.toUint32(_messagingGasLimit({accounts: snapshot.accounts}))
         });
     }
 
@@ -160,7 +162,8 @@ contract JBOptimismSucker is JBSucker, IJBOptimismSucker {
         OPMESSENGER.sendMessage{value: nativeValue}({
             target: peerAddress,
             message: abi.encodeCall(JBSucker.fromRemote, (message)),
-            gasLimit: MESSENGER_BASE_GAS_LIMIT
+            // Scale the destination gas with the bundle so a larger mesh's accounting still stores in one relay.
+            gasLimit: SafeCast.toUint32(_messagingGasLimit({accounts: message.accounts}))
         });
     }
 }