@bannynet/core-v6 0.0.20 → 0.0.21

package/CHANGELOG.md

@@ -23,6 +23,8 @@ This file describes the verified change from `banny-retail-v5` to the current `b
 - `pricingContext()` consumption changed with the v6 721 hook and now uses the two-value return shape.
 - The resolver adds explicit `Banny721TokenUriResolver_ArrayLengthMismatch()` and `Banny721TokenUriResolver_BannyBodyNotBodyCategory()` errors.
 - Outfit and background handling now includes logic intended to preserve attachment state when a previously equipped asset cannot be returned cleanly.
+- (L-1) `_storeOutfitsWithRetained` now verifies that no two merged outfits share the same category after sorting. A retained outfit whose transfer failed could previously duplicate a category supplied in the new outfit set, leading to rendering artifacts. The new `Banny721TokenUriResolver_DuplicateCategory()` error prevents this.
+- Gas optimizations: all `for` loops use `unchecked { ++i; }` increments, `_sortOutfitsByCategory` pre-computes categories to avoid repeated external calls during sort comparisons, `_msgSender()` is cached once per entry point to avoid repeated ERC-2771 context reads, and the mannequin SVG style string is inlined to remove redundant `string.concat` overhead.
 
 ## Migration notes
 

package/RISKS.md

@@ -54,7 +54,7 @@ This file focuses on failure modes that can break NFT custody, let untrusted hoo
 - Every background held by this contract has a corresponding `_userOf[hook][backgroundId]` pointing to a valid banny body.
 - `outfitLockedUntil[hook][bannyBodyId]` is monotonically non-decreasing per banny body (lock can only be extended, never shortened).
 - After `decorateBannyWith`, all previously equipped outfits not in the new set are either transferred back to `_msgSender()` or retained in the attached list if the transfer failed.
-- `_attachedOutfitIdsOf[hook][bannyBodyId]` contains the outfitIds passed to the most recent `decorateBannyWith` call, plus any retained outfits whose return transfer failed. Category exclusivity is enforced on the merged set (retained + new outfits), not just the new outfit set alone.
+- `_attachedOutfitIdsOf[hook][bannyBodyId]` contains the outfitIds passed to the most recent `decorateBannyWith` call, plus any retained outfits whose return transfer failed. Category exclusivity is enforced on the merged set (retained + new outfits), not just the new outfit set alone. Additionally, duplicate categories in the merged set are rejected with `Banny721TokenUriResolver_DuplicateCategory()` to prevent retained outfits from silently duplicating a category supplied in the new set.
 - SVG content integrity: `keccak256(_svgContentOf[upc]) == svgHashOf[upc]` for all populated entries.
 - NFT custody balance: the number of outfit NFTs held by this contract (`IERC721(hook).balanceOf(address(this))`) equals the total number of outfits currently equipped across all banny bodies for that hook. Violations indicate phantom outfits (equipped in state but NFT lost via try-catch silent failure) or orphaned NFTs (held by contract but not tracked in `_wearerOf`).
 
@@ -66,7 +66,7 @@ This file focuses on failure modes that can break NFT custody, let untrusted hoo
 
 - **Backgrounds**: If returning the old background fails, the entire background change is aborted (`return` in `_decorateBannyWithBackground`). The old background stays attached and the new one is not equipped.
 - **Background removal**: If returning the background fails during removal (backgroundId=0), `_attachedBackgroundIdOf` is not cleared. The background stays attached.
-- **Outfits**: Failed-to-return outfits remain non-zero in the `previousOutfitIds` array. `_storeOutfitsWithRetained` appends them to the new outfit list, preserving their attachment record.
+- **Outfits**: Failed-to-return outfits remain non-zero in the `previousOutfitIds` array. `_storeOutfitsWithRetained` appends them to the new outfit list, preserving their attachment record. After merging, the resolver verifies no two outfits share the same category (reverts with `DuplicateCategory` if a retained outfit conflicts with a newly supplied one).
 
 This prevents NFT stranding — assets held by the resolver stay tracked and recoverable. Once the transfer issue is resolved (e.g., the owner contract implements `IERC721Receiver`), a subsequent `decorateBannyWith` call will successfully return the retained items.
 

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@bannynet/core-v6",
-  "version": "0.0.20",
+  "version": "0.0.21",
     "license": "MIT",
     "repository": {
         "type": "git",
@@ -20,18 +20,18 @@
         "artifacts": "source ./.env && npx sphinx artifacts --org-id 'ea165b21-7cdc-4d7b-be59-ecdd4c26bee4' --project-name 'banny-core-v6'"
     },
     "dependencies": {
-        "@bananapus/721-hook-v6": "^0.0.31",
-        "@bananapus/core-v6": "^0.0.31",
+        "@bananapus/721-hook-v6": "^0.0.32",
+        "@bananapus/core-v6": "^0.0.32",
         "@bananapus/permission-ids-v6": "^0.0.15",
-        "@bananapus/router-terminal-v6": "^0.0.25",
-        "@bananapus/suckers-v6": "^0.0.21",
-        "@croptop/core-v6": "^0.0.30",
+        "@bananapus/router-terminal-v6": "^0.0.26",
+        "@bananapus/suckers-v6": "^0.0.22",
+        "@croptop/core-v6": "^0.0.31",
         "@openzeppelin/contracts": "^5.6.1",
-        "@rev-net/core-v6": "^0.0.28",
+        "@rev-net/core-v6": "^0.0.29",
         "keccak": "^3.0.4"
     },
     "devDependencies": {
         "@bananapus/address-registry-v6": "^0.0.17",
-        "@sphinx-labs/plugins": "^0.33.2"
+        "@sphinx-labs/plugins": "^0.33.3"
     }
 }

package/src/Banny721TokenUriResolver.sol

@@ -37,6 +37,7 @@ contract Banny721TokenUriResolver is
     error Banny721TokenUriResolver_CantAccelerateTheLock();
     error Banny721TokenUriResolver_ContentsAlreadyStored();
     error Banny721TokenUriResolver_ContentsMismatch();
+    error Banny721TokenUriResolver_DuplicateCategory();
     error Banny721TokenUriResolver_HashAlreadyStored();
     error Banny721TokenUriResolver_HashNotFound();
     error Banny721TokenUriResolver_HeadAlreadyAdded();
@@ -197,6 +198,7 @@ contract Banny721TokenUriResolver is
     //*********************************************************************//
 
     /// @notice Returns the SVG showing a dressed banny body in a background.
+    /// @param hook The hook storing the assets.
     /// @param tokenId The ID of the token to show. If the ID belongs to a banny body, it will be shown with its
     /// current outfits in its current background.
     /// @return tokenUri The URI representing the SVG.
@@ -250,18 +252,21 @@ contract Banny721TokenUriResolver is
 
             extraMetadata = '"outfitIds": [';
 
-            for (uint256 i; i < outfitIds.length; i++) {
+            for (uint256 i; i < outfitIds.length;) {
                 extraMetadata = string.concat(extraMetadata, outfitIds[i].toString());
 
                 // Add a comma if it's not the last outfit.
                 if (i < outfitIds.length - 1) {
                     extraMetadata = string.concat(extraMetadata, ",");
                 }
+                unchecked {
+                    ++i;
+                }
             }
 
             extraMetadata = string.concat(extraMetadata, "],");
 
-            for (uint256 i; i < outfitIds.length; i++) {
+            for (uint256 i; i < outfitIds.length;) {
                 JB721Tier memory outfitProduct = _productOfTokenId({hook: hook, tokenId: outfitIds[i]});
 
                 attributes = string.concat(
@@ -272,6 +277,9 @@ contract Banny721TokenUriResolver is
                     _productNameOf(outfitProduct.id),
                     '"},'
                 );
+                unchecked {
+                    ++i;
+                }
             }
 
             if (backgroundId != 0) {
@@ -352,7 +360,7 @@ contract Banny721TokenUriResolver is
     //*********************************************************************//
 
     /// @notice The assets currently attached to each banny body.
-    /// @custom:param hook The hook address of the collection.
+    /// @param hook The hook address of the collection.
     /// @param bannyBodyId The ID of the banny body shown with the associated assets.
     /// @return backgroundId The background attached to the banny body.
     /// @return outfitIds The outfits attached to the banny body.
@@ -378,7 +386,7 @@ contract Banny721TokenUriResolver is
         uint256 storedOutfitId;
 
         // Return the outfit's that are still being worn by the banny body.
-        for (uint256 i; i < storedOutfitIds.length; i++) {
+        for (uint256 i; i < storedOutfitIds.length;) {
             // Set the stored outfit ID being iterated on.
             storedOutfitId = storedOutfitIds[i];
 
@@ -386,6 +394,9 @@ contract Banny721TokenUriResolver is
             if (wearerOf({hook: hook, outfitId: storedOutfitId}) == bannyBodyId) {
                 outfitIds[numberOfIncludedOutfits++] = storedOutfitId;
             }
+            unchecked {
+                ++i;
+            }
         }
 
         // Resize the array to the actual number of included outfits (remove trailing zeros).
@@ -519,9 +530,12 @@ contract Banny721TokenUriResolver is
         // Keep a reference to the outfit IDs currently attached to a banny body.
         uint256[] memory attachedOutfitIds = _attachedOutfitIdsOf[hook][bannyBodyId];
 
-        for (uint256 i; i < attachedOutfitIds.length; i++) {
+        for (uint256 i; i < attachedOutfitIds.length;) {
             // If the outfit is still attached, return the banny body ID.
             if (attachedOutfitIds[i] == outfitId) return bannyBodyId;
+            unchecked {
+                ++i;
+            }
         }
 
         // If the outfit is no longer attached, return 0.
@@ -616,7 +630,9 @@ contract Banny721TokenUriResolver is
         if (IERC721(hook).ownerOf(upc) != _msgSender()) revert Banny721TokenUriResolver_UnauthorizedBannyBody();
     }
 
+    /// @notice The length of the context suffix appended by a trusted forwarder.
     /// @dev ERC-2771 specifies the context as being a single address (20 bytes).
+    /// @return The suffix length in bytes.
     function _contextSuffixLength() internal view virtual override(ERC2771Context, Context) returns (uint256) {
         return super._contextSuffixLength();
     }
@@ -625,6 +641,11 @@ contract Banny721TokenUriResolver is
     // Metadata strings (name, description, external_url) are set by the contract owner, not by users.
     // No JSON escaping is applied — the owner is trusted to provide valid values. On-chain JSON is consumed
     // by off-chain indexers and UIs, not rendered in a browser context where XSS would apply.
+    /// @param tokenId The ID of the token.
+    /// @param product The tier product for the token.
+    /// @param extraMetadata Additional JSON metadata fields to include.
+    /// @param imageContents The base64-encoded SVG image contents.
+    /// @return The fully encoded data URI string.
     function _encodeTokenUri(
         uint256 tokenId,
         JB721Tier memory product,
@@ -753,8 +774,11 @@ contract Banny721TokenUriResolver is
     /// @param array The array to search in.
     /// @return found True if the value was found.
     function _isInArray(uint256 value, uint256[] memory array) internal pure returns (bool found) {
-        for (uint256 i; i < array.length; i++) {
+        for (uint256 i; i < array.length;) {
             if (array[i] == value) return true;
+            unchecked {
+                ++i;
+            }
         }
     }
 
@@ -772,23 +796,8 @@ contract Banny721TokenUriResolver is
     /// @notice The SVG contents for a mannequin banny.
     /// @return contents The SVG contents of the mannequin banny.
     function _mannequinBannySvg() internal view returns (string memory) {
-        string memory fillNoneString = string.concat("{fill:none;}");
         return string.concat(
-            "<style>.o{fill:#808080;}.b1",
-            fillNoneString,
-            ".b2",
-            fillNoneString,
-            ".b3",
-            fillNoneString,
-            ".b4",
-            fillNoneString,
-            ".a1",
-            fillNoneString,
-            ".a2",
-            fillNoneString,
-            ".a3",
-            fillNoneString,
-            "</style>",
+            "<style>.o{fill:#808080;}.b1{fill:none;}.b2{fill:none;}.b3{fill:none;}.b4{fill:none;}.a1{fill:none;}.a2{fill:none;}.a3{fill:none;}</style>",
             BANNY_BODY
         );
     }
@@ -834,7 +843,7 @@ contract Banny721TokenUriResolver is
 
         // For each outfit, add the SVG layer if it's owned by the same owner as the banny body being dressed.
         // Loop once more to make sure all default outfits are added.
-        for (uint256 i; i < numberOfOutfits + 1; i++) {
+        for (uint256 i; i < numberOfOutfits + 1;) {
             // Keep a reference to the outfit ID being iterated on.
             uint256 outfitId;
 
@@ -903,6 +912,9 @@ contract Banny721TokenUriResolver is
             if (outfitId != 0 && category != _NECKLACE_CATEGORY) {
                 contents = string.concat(contents, _svgOf({hook: hook, upc: upc}));
             }
+            unchecked {
+                ++i;
+            }
         }
     }
 
@@ -949,33 +961,41 @@ contract Banny721TokenUriResolver is
     /// @param hook The 721 hook whose tier categories determine sort order.
     /// @param outfitIds The outfit token IDs to sort in-place by ascending category.
     function _sortOutfitsByCategory(address hook, uint256[] memory outfitIds) internal view {
-        // Treat each element after index 0 as the next value to insert into the already-sorted prefix.
-        for (uint256 i = 1; i < outfitIds.length; i++) {
-            // Cache the current outfit ID so we can shift larger-category entries to the right around it.
+        // Cache array length and skip sorting when fewer than 2 elements.
+        uint256 length = outfitIds.length;
+        if (length < 2) return;
+
+        // Pre-compute all categories to avoid repeated external STATICCALL during sort comparisons.
+        uint256[] memory categories = new uint256[](length);
+        for (uint256 i; i < length;) {
+            categories[i] = _productOfTokenId({hook: hook, tokenId: outfitIds[i]}).category;
+            unchecked {
+                ++i;
+            }
+        }
+
+        // Insertion sort using cached categories.
+        for (uint256 i = 1; i < length;) {
+            // Cache the current element so it can be inserted into the correct sorted position.
             uint256 outfitId = outfitIds[i];
-            // Look up the current outfit's category once and compare against earlier entries while inserting it.
-            uint256 category = _productOfTokenId({hook: hook, tokenId: outfitId}).category;
-            // Walk backward through the sorted prefix until the insertion point is found.
+            uint256 category = categories[i];
             uint256 j = i;
 
-            while (j != 0) {
-                // Load the previous outfit that may need to move one slot to the right.
-                uint256 previousId = outfitIds[j - 1];
-                // Compare by category because canonical outfit ordering is category order, not token ID order.
-                uint256 previousCategory = _productOfTokenId({hook: hook, tokenId: previousId}).category;
-                // Stop once the previous category is already ordered before or equal to the current one.
-                if (previousCategory <= category) break;
-
-                // Shift the larger-category outfit right to make room for the current outfit.
-                outfitIds[j] = previousId;
+            // Shift larger-category entries right until the insertion point is found.
+            while (j != 0 && categories[j - 1] > category) {
+                outfitIds[j] = outfitIds[j - 1];
+                categories[j] = categories[j - 1];
                 unchecked {
-                    // Safe because the loop guard ensures `j` is non-zero before decrementing.
                     --j;
                 }
             }
 
-            // Write the cached outfit into the insertion point that preserves ascending category order.
+            // Place the cached element at its sorted position.
             outfitIds[j] = outfitId;
+            categories[j] = category;
+            unchecked {
+                ++i;
+            }
         }
     }
 
@@ -989,6 +1009,7 @@ contract Banny721TokenUriResolver is
     /// @notice The banny body and outfit SVG files.
     /// @param hook The 721 contract that the product belongs to.
     /// @param upc The universal product code of the product that the SVG contents represent.
+    /// @return The SVG content string, either from storage or decoded from IPFS.
     function _svgOf(address hook, uint256 upc) internal view returns (string memory) {
         // Keep a reference to the stored svg contents.
         string memory svgContents = _svgContentOf[upc];
@@ -1018,7 +1039,7 @@ contract Banny721TokenUriResolver is
         bool hasSuitPiece;
 
         // Scan every outfit and classify it into one of the two exclusive groups.
-        for (uint256 i; i < outfitIds.length; i++) {
+        for (uint256 i; i < outfitIds.length;) {
             // Look up the tier category for this outfit token.
             uint256 category = _productOfTokenId({hook: hook, tokenId: outfitIds[i]}).category;
 
@@ -1038,6 +1059,9 @@ contract Banny721TokenUriResolver is
                 // Individual top or bottom pieces that would conflict with a full SUIT.
                 hasSuitPiece = true;
             }
+            unchecked {
+                ++i;
+            }
         }
 
         // A full HEAD and individual head accessories cannot coexist — the head would hide the accessories.
@@ -1088,7 +1112,10 @@ contract Banny721TokenUriResolver is
         override
         nonReentrant
     {
-        _checkIfSenderIsOwner({hook: hook, upc: bannyBodyId});
+        // Cache the sender once to avoid repeated ERC-2771 context reads throughout the call chain.
+        address sender = _msgSender();
+
+        if (IERC721(hook).ownerOf(bannyBodyId) != sender) revert Banny721TokenUriResolver_UnauthorizedBannyBody();
 
         // Make sure the bannyBodyId belongs to a body-category tier.
         if (_productOfTokenId({hook: hook, tokenId: bannyBodyId}).category != _BODY_CATEGORY) {
@@ -1101,14 +1128,14 @@ contract Banny721TokenUriResolver is
         }
 
         emit DecorateBanny({
-            hook: hook, bannyBodyId: bannyBodyId, backgroundId: backgroundId, outfitIds: outfitIds, caller: _msgSender()
+            hook: hook, bannyBodyId: bannyBodyId, backgroundId: backgroundId, outfitIds: outfitIds, caller: sender
         });
 
         // Add the background.
-        _decorateBannyWithBackground({hook: hook, bannyBodyId: bannyBodyId, backgroundId: backgroundId});
+        _decorateBannyWithBackground({hook: hook, bannyBodyId: bannyBodyId, backgroundId: backgroundId, sender: sender});
 
         // Add the outfits.
-        _decorateBannyWithOutfits({hook: hook, bannyBodyId: bannyBodyId, outfitIds: outfitIds});
+        _decorateBannyWithOutfits({hook: hook, bannyBodyId: bannyBodyId, outfitIds: outfitIds, sender: sender});
     }
 
     /// @notice Locks a banny body ID so that it can't change its outfit for a period of time.
@@ -1131,6 +1158,7 @@ contract Banny721TokenUriResolver is
         outfitLockedUntil[hook][bannyBodyId] = newLockUntil;
     }
 
+    /// @notice Handles the receipt of an ERC-721 token, only accepting transfers initiated by this contract.
     /// @dev Make sure tokens can be received if the transaction was initiated by this contract.
     // NFTs sent via transferFrom (not safeTransferFrom) bypass onERC721Received and cannot be
     // tracked or recovered. This is an inherent ERC-721 limitation — the contract cannot prevent non-safe
@@ -1139,6 +1167,7 @@ contract Banny721TokenUriResolver is
     /// @param from The address that initiated the transfer.
     /// @param tokenId The ID of the token being transferred.
     /// @param data The data of the transfer.
+    /// @return The ERC-721 receiver selector.
     function onERC721Received(
         address operator,
         address from,
@@ -1190,13 +1219,17 @@ contract Banny721TokenUriResolver is
     function setProductNames(uint256[] memory upcs, string[] memory names) external override onlyOwner {
         if (upcs.length != names.length) revert Banny721TokenUriResolver_ArrayLengthMismatch();
 
-        for (uint256 i; i < upcs.length; i++) {
+        address sender = _msgSender();
+        for (uint256 i; i < upcs.length;) {
             uint256 upc = upcs[i];
             string memory name = names[i];
 
             _customProductNameOf[upc] = name;
 
-            emit SetProductName({upc: upc, name: name, caller: _msgSender()});
+            emit SetProductName({upc: upc, name: name, caller: sender});
+            unchecked {
+                ++i;
+            }
         }
     }
 
@@ -1206,7 +1239,8 @@ contract Banny721TokenUriResolver is
     function setSvgContentsOf(uint256[] memory upcs, string[] calldata svgContents) external override {
         if (upcs.length != svgContents.length) revert Banny721TokenUriResolver_ArrayLengthMismatch();
 
-        for (uint256 i; i < upcs.length; i++) {
+        address sender = _msgSender();
+        for (uint256 i; i < upcs.length;) {
             uint256 upc = upcs[i];
             string memory svgContent = svgContents[i];
 
@@ -1225,7 +1259,10 @@ contract Banny721TokenUriResolver is
             // Store the svg contents.
             _svgContentOf[upc] = svgContent;
 
-            emit SetSvgContent({upc: upc, svgContent: svgContent, caller: _msgSender()});
+            emit SetSvgContent({upc: upc, svgContent: svgContent, caller: sender});
+            unchecked {
+                ++i;
+            }
         }
     }
 
@@ -1236,7 +1273,8 @@ contract Banny721TokenUriResolver is
     function setSvgHashesOf(uint256[] memory upcs, bytes32[] memory svgHashes) external override onlyOwner {
         if (upcs.length != svgHashes.length) revert Banny721TokenUriResolver_ArrayLengthMismatch();
 
-        for (uint256 i; i < upcs.length; i++) {
+        address sender = _msgSender();
+        for (uint256 i; i < upcs.length;) {
             uint256 upc = upcs[i];
             bytes32 svgHash = svgHashes[i];
 
@@ -1246,7 +1284,10 @@ contract Banny721TokenUriResolver is
             // Store the svg contents.
             svgHashOf[upc] = svgHash;
 
-            emit SetSvgHash({upc: upc, svgHash: svgHash, caller: _msgSender()});
+            emit SetSvgHash({upc: upc, svgHash: svgHash, caller: sender});
+            unchecked {
+                ++i;
+            }
         }
     }
 
@@ -1258,7 +1299,15 @@ contract Banny721TokenUriResolver is
     /// @param hook The hook storing the assets.
     /// @param bannyBodyId The ID of the banny body being dressed.
     /// @param backgroundId The ID of the background that'll be associated with the specified banny.
-    function _decorateBannyWithBackground(address hook, uint256 bannyBodyId, uint256 backgroundId) internal {
+    /// @param sender The cached msg sender.
+    function _decorateBannyWithBackground(
+        address hook,
+        uint256 bannyBodyId,
+        uint256 backgroundId,
+        address sender
+    )
+        internal
+    {
         // Keep a reference to the previous background attached.
         uint256 previousBackgroundId = _attachedBackgroundIdOf[hook][bannyBodyId];
 
@@ -1273,7 +1322,7 @@ contract Banny721TokenUriResolver is
                 address owner = IERC721(hook).ownerOf(backgroundId);
 
                 // Check if the call is being made by the background's owner, or the owner of a banny body using it.
-                if (_msgSender() != owner) {
+                if (sender != owner) {
                     // Get the banny body currently using this background.
                     uint256 userId = userOf({hook: hook, backgroundId: backgroundId});
 
@@ -1281,7 +1330,7 @@ contract Banny721TokenUriResolver is
                     if (userId == 0) revert Banny721TokenUriResolver_UnauthorizedBackground();
 
                     // If the background is used, the banny body's owner can also authorize its use.
-                    if (_msgSender() != IERC721(hook).ownerOf(userId)) {
+                    if (sender != IERC721(hook).ownerOf(userId)) {
                         revert Banny721TokenUriResolver_UnauthorizedBackground();
                     }
 
@@ -1300,9 +1349,8 @@ contract Banny721TokenUriResolver is
                 // Try to transfer the previous background back before updating state.
                 // If the transfer fails, the old background stays attached to prevent NFT stranding.
                 if (userOfPreviousBackground == bannyBodyId) {
-                    if (!_tryTransferFrom({
-                            hook: hook, from: address(this), to: _msgSender(), assetId: previousBackgroundId
-                        })) {
+                    if (!_tryTransferFrom({hook: hook, from: address(this), to: sender, assetId: previousBackgroundId}))
+                    {
                         // Transfer failed — skip the background change entirely so the old background
                         // remains tracked and recoverable. The new background is not equipped.
                         return;
@@ -1315,16 +1363,15 @@ contract Banny721TokenUriResolver is
 
                 // Transfer the new background to this contract if it's not already owned by this contract.
                 if (owner != address(this)) {
-                    _transferFrom({hook: hook, from: _msgSender(), to: address(this), assetId: backgroundId});
+                    _transferFrom({hook: hook, from: sender, to: address(this), assetId: backgroundId});
                 }
             } else {
                 // Try to transfer the previous background back before clearing state.
                 if (userOfPreviousBackground == bannyBodyId) {
                     // Only clear attachment state if the transfer succeeded. If it fails (e.g. recipient rejects
                     // ERC-721), the background stays attached so the owner can retry or recover.
-                    if (_tryTransferFrom({
-                            hook: hook, from: address(this), to: _msgSender(), assetId: previousBackgroundId
-                        })) {
+                    if (_tryTransferFrom({hook: hook, from: address(this), to: sender, assetId: previousBackgroundId}))
+                    {
                         _attachedBackgroundIdOf[hook][bannyBodyId] = 0;
                     }
                 } else {
@@ -1341,7 +1388,15 @@ contract Banny721TokenUriResolver is
     /// @param bannyBodyId The ID of the banny body being dressed.
     /// @param outfitIds The IDs of the outfits that'll be associated with the specified banny. Only one outfit per
     /// outfit category allowed at a time and they must be passed in order.
-    function _decorateBannyWithOutfits(address hook, uint256 bannyBodyId, uint256[] memory outfitIds) internal {
+    /// @param sender The cached msg sender.
+    function _decorateBannyWithOutfits(
+        address hook,
+        uint256 bannyBodyId,
+        uint256[] memory outfitIds,
+        address sender
+    )
+        internal
+    {
         // Keep track of certain outfits being used along the way to prevent conflicting outfits.
         bool hasHead;
         bool hasSuit;
@@ -1369,14 +1424,14 @@ contract Banny721TokenUriResolver is
 
         // Iterate through each outfit, transfering them in and adding them to the banny if needed, while transfering
         // out and removing old outfits no longer being worn.
-        for (uint256 i; i < outfitIds.length; i++) {
+        for (uint256 i; i < outfitIds.length;) {
             // Set the outfit ID being iterated on.
             uint256 outfitId = outfitIds[i];
 
             // Check if the call is being made either by the outfit's owner or the owner of the banny body currently
             // wearing it.
             // slither-disable-next-line calls-loop
-            if (_msgSender() != IERC721(hook).ownerOf(outfitId)) {
+            if (sender != IERC721(hook).ownerOf(outfitId)) {
                 // Get the banny body currently wearing this outfit.
                 uint256 wearerId = wearerOf({hook: hook, outfitId: outfitId});
 
@@ -1385,7 +1440,7 @@ contract Banny721TokenUriResolver is
 
                 // If the outfit is worn, the banny body's owner can also authorize its use.
                 // slither-disable-next-line calls-loop
-                if (_msgSender() != IERC721(hook).ownerOf(wearerId)) {
+                if (sender != IERC721(hook).ownerOf(wearerId)) {
                     revert Banny721TokenUriResolver_UnauthorizedOutfit();
                 }
 
@@ -1438,9 +1493,7 @@ contract Banny721TokenUriResolver is
                     // Use try-transfer: the previous outfit may have been burned or its tier removed.
                     // If transfer fails, zero is NOT written to previousOutfitIds — the entry is preserved
                     // so it can be retained in the attached list (preventing NFT stranding).
-                    if (_tryTransferFrom({
-                            hook: hook, from: address(this), to: _msgSender(), assetId: previousOutfitId
-                        })) {
+                    if (_tryTransferFrom({hook: hook, from: address(this), to: sender, assetId: previousOutfitId})) {
                         // Mark as successfully transferred so it won't be retained.
                         previousOutfitIds[previousOutfitIndex] = 0;
                     }
@@ -1468,12 +1521,15 @@ contract Banny721TokenUriResolver is
                 // Transfer the outfit to this contract.
                 // slither-disable-next-line reentrancy-no-eth,calls-loop
                 if (IERC721(hook).ownerOf(outfitId) != address(this)) {
-                    _transferFrom({hook: hook, from: _msgSender(), to: address(this), assetId: outfitId});
+                    _transferFrom({hook: hook, from: sender, to: address(this), assetId: outfitId});
                 }
             }
 
             // Keep a reference to the last outfit's category.
             lastAssetCategory = outfitProductCategory;
+            unchecked {
+                ++i;
+            }
         }
 
         // Remove and transfer out any remaining assets no longer being worn.
@@ -1484,13 +1540,13 @@ contract Banny721TokenUriResolver is
             // `_attachedOutfitIdsOf` hasnt been called yet, so the wearer should still be the banny body being
             // decorated.
             // Skip outfits that are being re-equipped in the new outfit set.
-            if (_isInArray(previousOutfitId, outfitIds)) {
+            if (_isInArray({value: previousOutfitId, array: outfitIds})) {
                 // This outfit is being re-equipped — mark as handled.
                 previousOutfitIds[previousOutfitIndex] = 0;
             } else if (wearerOf({hook: hook, outfitId: previousOutfitId}) == bannyBodyId) {
                 // Use try-transfer: the previous outfit may have been burned or its tier removed.
                 // If transfer fails, the entry stays non-zero and is retained (preventing NFT stranding).
-                if (_tryTransferFrom({hook: hook, from: address(this), to: _msgSender(), assetId: previousOutfitId})) {
+                if (_tryTransferFrom({hook: hook, from: address(this), to: sender, assetId: previousOutfitId})) {
                     previousOutfitIds[previousOutfitIndex] = 0;
                 }
             } else {
@@ -1530,8 +1586,11 @@ contract Banny721TokenUriResolver is
     {
         // Count how many previous outfits failed to transfer (non-zero entries remain).
         uint256 retainedCount;
-        for (uint256 i; i < previousOutfitIds.length; i++) {
+        for (uint256 i; i < previousOutfitIds.length;) {
             if (previousOutfitIds[i] != 0) retainedCount++;
+            unchecked {
+                ++i;
+            }
         }
 
         if (retainedCount == 0) {
@@ -1539,14 +1598,20 @@ contract Banny721TokenUriResolver is
         } else {
             // Merge new outfits with retained outfits that couldn't be transferred back.
             uint256[] memory mergedOutfitIds = new uint256[](outfitIds.length + retainedCount);
-            for (uint256 i; i < outfitIds.length; i++) {
+            for (uint256 i; i < outfitIds.length;) {
                 mergedOutfitIds[i] = outfitIds[i];
+                unchecked {
+                    ++i;
+                }
             }
             uint256 mergeIndex = outfitIds.length;
-            for (uint256 i; i < previousOutfitIds.length; i++) {
+            for (uint256 i; i < previousOutfitIds.length;) {
                 if (previousOutfitIds[i] != 0) {
                     mergedOutfitIds[mergeIndex++] = previousOutfitIds[i];
                 }
+                unchecked {
+                    ++i;
+                }
             }
 
             // Revalidate category exclusivity on the merged set. Retained outfits may conflict with the new outfits
@@ -1556,6 +1621,20 @@ contract Banny721TokenUriResolver is
             // caller-supplied set.
             _sortOutfitsByCategory({hook: hook, outfitIds: mergedOutfitIds});
 
+            // After sorting, verify no two outfits share the same category. A retained outfit whose transfer
+            // failed could duplicate a category supplied in the new outfit set.
+            for (uint256 i = 1; i < mergedOutfitIds.length;) {
+                if (
+                    _productOfTokenId({hook: hook, tokenId: mergedOutfitIds[i]}).category
+                        == _productOfTokenId({hook: hook, tokenId: mergedOutfitIds[i - 1]}).category
+                ) {
+                    revert Banny721TokenUriResolver_DuplicateCategory();
+                }
+                unchecked {
+                    ++i;
+                }
+            }
+
             // Persist the merged-and-sorted attachment list so later reads and redecorations see a stable order.
             _attachedOutfitIdsOf[hook][bannyBodyId] = mergedOutfitIds;
         }

package/test/audit/DuplicateCategoryRetention.t.sol

@@ -0,0 +1,163 @@
+// SPDX-License-Identifier: MIT
+pragma solidity 0.8.28;
+
+import {Test} from "forge-std/Test.sol";
+import {JB721Tier} from "@bananapus/721-hook-v6/src/structs/JB721Tier.sol";
+import {JB721TierFlags} from "@bananapus/721-hook-v6/src/structs/JB721TierFlags.sol";
+import {IERC721Receiver} from "@openzeppelin/contracts/token/ERC721/IERC721Receiver.sol";
+
+import {Banny721TokenUriResolver} from "../../src/Banny721TokenUriResolver.sol";
+
+contract DuplicateCategoryMockHook {
+    mapping(uint256 tokenId => address) public ownerOf;
+    mapping(address owner => mapping(address operator => bool)) public isApprovedForAll;
+    address public immutable MOCK_STORE;
+
+    constructor(address store) {
+        MOCK_STORE = store;
+    }
+
+    function STORE() external view returns (address) {
+        return MOCK_STORE;
+    }
+
+    function setOwner(uint256 tokenId, address owner) external {
+        ownerOf[tokenId] = owner;
+    }
+
+    function setApprovalForAll(address operator, bool approved) external {
+        isApprovedForAll[msg.sender][operator] = approved;
+    }
+
+    function safeTransferFrom(address from, address to, uint256 tokenId) external {
+        require(
+            msg.sender == ownerOf[tokenId] || msg.sender == from || isApprovedForAll[from][msg.sender],
+            "MockHook: not authorized"
+        );
+        ownerOf[tokenId] = to;
+
+        if (to.code.length != 0) {
+            bytes4 retval = IERC721Receiver(to).onERC721Received(msg.sender, from, tokenId, "");
+            require(retval == IERC721Receiver.onERC721Received.selector, "MockHook: receiver rejected");
+        }
+    }
+
+    function pricingContext() external pure returns (uint256, uint256, uint256) {
+        return (1, 18, 0);
+    }
+
+    function baseURI() external pure returns (string memory) {
+        return "ipfs://";
+    }
+}
+
+contract DuplicateCategoryMockStore {
+    mapping(address hook => mapping(uint256 tokenId => JB721Tier)) public tiers;
+
+    function setTier(address hook, uint256 tokenId, JB721Tier memory tier) external {
+        tiers[hook][tokenId] = tier;
+    }
+
+    function tierOfTokenId(address hook, uint256 tokenId, bool) external view returns (JB721Tier memory) {
+        return tiers[hook][tokenId];
+    }
+
+    // forge-lint: disable-next-line(mixed-case-function)
+    function encodedTierIPFSUriOf(address, uint256) external pure returns (bytes32) {
+        return bytes32(0);
+    }
+
+    // forge-lint: disable-next-line(mixed-case-function)
+    function encodedIPFSUriOf(address, uint256) external pure returns (bytes32) {
+        return bytes32(0);
+    }
+}
+
+contract ERC721RejectingOwner {
+    function approveResolver(DuplicateCategoryMockHook hook, address resolver) external {
+        hook.setApprovalForAll(resolver, true);
+    }
+
+    function decorate(
+        Banny721TokenUriResolver resolver,
+        address hook,
+        uint256 bodyId,
+        uint256 backgroundId,
+        uint256[] memory outfitIds
+    )
+        external
+    {
+        resolver.decorateBannyWith(hook, bodyId, backgroundId, outfitIds);
+    }
+}
+
+contract DuplicateCategoryRetentionTest is Test {
+    Banny721TokenUriResolver resolver;
+    DuplicateCategoryMockHook hook;
+    DuplicateCategoryMockStore store;
+    ERC721RejectingOwner rejector;
+
+    uint256 internal constant BODY_TOKEN = 4_000_000_001;
+    uint256 internal constant NECKLACE_ONE = 10_000_000_001;
+    uint256 internal constant NECKLACE_TWO = 11_000_000_001;
+
+    function setUp() public {
+        store = new DuplicateCategoryMockStore();
+        hook = new DuplicateCategoryMockHook(address(store));
+        rejector = new ERC721RejectingOwner();
+
+        resolver = new Banny721TokenUriResolver(
+            "<path/>", "<necklace/>", "<mouth/>", "<eyes/>", "<alieneyes/>", address(this), address(0)
+        );
+
+        _setupTier(BODY_TOKEN, 4, 0);
+        _setupTier(NECKLACE_ONE, 10, 3);
+        _setupTier(NECKLACE_TWO, 11, 3);
+
+        hook.setOwner(BODY_TOKEN, address(rejector));
+        hook.setOwner(NECKLACE_ONE, address(rejector));
+        hook.setOwner(NECKLACE_TWO, address(rejector));
+        rejector.approveResolver(hook, address(resolver));
+    }
+
+    function test_retainedOutfitCanBypassOnePerCategoryInvariant() public {
+        uint256[] memory first = new uint256[](1);
+        first[0] = NECKLACE_ONE;
+        rejector.decorate(resolver, address(hook), BODY_TOKEN, 0, first);
+
+        uint256[] memory replacement = new uint256[](1);
+        replacement[0] = NECKLACE_TWO;
+
+        // After the L-1 fix, the duplicate category is detected and the call reverts.
+        vm.expectRevert(Banny721TokenUriResolver.Banny721TokenUriResolver_DuplicateCategory.selector);
+        rejector.decorate(resolver, address(hook), BODY_TOKEN, 0, replacement);
+    }
+
+    function _setupTier(uint256 tokenId, uint32 tierId, uint24 category) internal {
+        store.setTier(
+            address(hook),
+            tokenId,
+            JB721Tier({
+                id: tierId,
+                price: 0.01 ether,
+                remainingSupply: 100,
+                initialSupply: 100,
+                votingUnits: 0,
+                reserveFrequency: 0,
+                reserveBeneficiary: address(0),
+                encodedIPFSUri: bytes32(0),
+                category: category,
+                discountPercent: 0,
+                flags: JB721TierFlags({
+                    allowOwnerMint: false,
+                    transfersPausable: false,
+                    cantBeRemoved: false,
+                    cantIncreaseDiscountPercent: false,
+                    cantBuyWithCredits: false
+                }),
+                splitPercent: 0,
+                resolvedUri: ""
+            })
+        );
+    }
+}

package/test/audit/MigrationHelperVerificationBypass.t.sol

@@ -78,14 +78,14 @@ contract MigrationHelperHarness {
 }
 
 contract MockHook {
-    address internal immutable _store;
+    address internal immutable _STORE;
 
     constructor(address store) {
-        _store = store;
+        _STORE = store;
     }
 
     function STORE() external view returns (IJB721TiersHookStore) {
-        return IJB721TiersHookStore(_store);
+        return IJB721TiersHookStore(_STORE);
     }
 }