@croptop/core-v6 0.0.22 → 0.0.23

package/CHANGE_LOG.md

@@ -103,6 +103,10 @@ Posts can now include a `splitPercent` and an array of `splits` (JBSplit[]) that
 
 ## 3. Event Changes
 
+Indexer note:
+- event names are stable, but embedded struct payloads changed ABI shape;
+- if your graph decodes `ConfigurePostingCriteria` or `Mint`, update the event-decoding schema for the new `maximumSplitPercent`, `splitPercent`, and `splits` fields.
+
 No event signatures were changed. Both versions emit the same two events:
 - `ConfigurePostingCriteria(address indexed hook, CTAllowedPost allowedPost, address caller)` — note that the `CTAllowedPost` struct gained a `maximumSplitPercent` field, which changes the ABI encoding of this event's data.
 - `Mint(uint256 indexed projectId, IJB721TiersHook indexed hook, address indexed nftBeneficiary, address feeBeneficiary, CTPost[] posts, uint256 postValue, uint256 txValue, address caller)` — note that the `CTPost` struct gained `splitPercent` and `splits` fields, which changes the ABI encoding of this event's data.

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@croptop/core-v6",
-    "version": "0.0.22",
+    "version": "0.0.23",
     "license": "MIT",
     "repository": {
         "type": "git",
@@ -16,18 +16,18 @@
         "artifacts": "source ./.env && npx sphinx artifacts --org-id 'ea165b21-7cdc-4d7b-be59-ecdd4c26bee4' --project-name 'croptop-core-v5'"
     },
     "dependencies": {
-        "@bananapus/721-hook-v6": "^0.0.21",
-        "@bananapus/address-registry-v6": "^0.0.15",
-        "@bananapus/buyback-hook-v6": "^0.0.19",
-        "@bananapus/core-v6": "^0.0.27",
-        "@bananapus/ownable-v6": "^0.0.14",
+        "@bananapus/721-hook-v6": "^0.0.22",
+        "@bananapus/address-registry-v6": "^0.0.16",
+        "@bananapus/buyback-hook-v6": "^0.0.22",
+        "@bananapus/core-v6": "^0.0.28",
+        "@bananapus/ownable-v6": "^0.0.15",
         "@bananapus/permission-ids-v6": "^0.0.14",
-        "@bananapus/router-terminal-v6": "^0.0.20",
-        "@bananapus/suckers-v6": "^0.0.16",
+        "@bananapus/router-terminal-v6": "^0.0.21",
+        "@bananapus/suckers-v6": "^0.0.18",
         "@openzeppelin/contracts": "^5.6.1"
     },
     "devDependencies": {
-        "@rev-net/core-v6": "^0.0.14",
+        "@rev-net/core-v6": "^0.0.17",
         "@sphinx-labs/plugins": "^0.33.1"
     }
 }

package/script/Deploy.s.sol

@@ -64,9 +64,28 @@ contract DeployScript is Script, Sphinx {
     }
 
     function deploy() public sphinx {
-        // If the fee project id is 0, then we want to deploy a new fee project.
+        // If the fee project id is 0, then we want to deploy a new fee project — but only if the publisher
+        // singleton doesn't already exist. Re-running with FEE_PROJECT_ID=0 would create a second fee project
+        // with different CREATE2 addresses, stranding the previous suite.
         if (FEE_PROJECT_ID == 0) {
-            FEE_PROJECT_ID = core.projects.createFor(safeAddress());
+            // Check if the publisher already exists by scanning existing project IDs.
+            uint256 _existingCount = core.projects.count();
+            bool _found;
+            for (uint256 _candidateId = 1; _candidateId <= _existingCount; _candidateId++) {
+                (, bool _exists) = _isDeployed({
+                    salt: PUBLISHER_SALT,
+                    creationCode: type(CTPublisher).creationCode,
+                    arguments: abi.encode(core.directory, core.permissions, _candidateId, TRUSTED_FORWARDER)
+                });
+                if (_exists) {
+                    FEE_PROJECT_ID = _candidateId;
+                    _found = true;
+                    break;
+                }
+            }
+            if (!_found) {
+                FEE_PROJECT_ID = core.projects.createFor(safeAddress());
+            }
         }
 
         CTPublisher publisher;

package/src/CTDeployer.sol

@@ -225,9 +225,12 @@ contract CTDeployer is ERC2771Context, JBPermissioned, IJBRulesetDataHook, IERC7
     //*********************************************************************//
 
     /// @notice Claim ownership of the collection.
-    /// @dev After calling this, the hook's owner becomes the project (resolved via PROJECTS.ownerOf). The project
-    /// owner must then grant CTPublisher the ADJUST_721_TIERS permission for the project so that mintFrom() continues
-    /// to work. Without this permission grant, all subsequent posts will revert. This cannot be done atomically here
+    /// @dev Two-step ownership transfer process:
+    ///   Step 1 (this function): Transfers hook ownership to the project via `transferOwnershipToProject()`.
+    ///     After this call, `hook.owner()` resolves dynamically through `PROJECTS.ownerOf(projectId)`.
+    ///   Step 2 (caller must do separately): The project owner grants CTPublisher the `ADJUST_721_TIERS` permission
+    ///     for the project so that `mintFrom()` continues to work.
+    /// Without the Step 2 permission grant, all subsequent posts will revert. This cannot be done atomically here
     /// because after transferring ownership to the project, this contract no longer has authority to set permissions
     /// on the project's behalf.
     /// @param hook The hook to claim ownership of.
@@ -283,7 +286,6 @@ contract CTDeployer is ERC2771Context, JBPermissioned, IJBRulesetDataHook, IERC7
                 tiersConfig: JB721InitTiersConfig({
                     tiers: new JB721TierConfig[](0), currency: JBCurrencyIds.ETH, decimals: 18
                 }),
-                reserveBeneficiary: address(0),
                 flags: JB721TiersHookFlags({
                     noNewTiersWithReserves: false,
                     noNewTiersWithVotes: false,
@@ -337,9 +339,10 @@ contract CTDeployer is ERC2771Context, JBPermissioned, IJBRulesetDataHook, IERC7
         PROJECTS.transferFrom({from: address(this), to: owner, tokenId: projectId});
 
         // Set permission for the project's owner to do all the NFT things.
-        // These permissions are granted from CTDeployer (address(this)), not from the project owner.
-        // Transferring the project NFT does not invalidate them because the permission account is CTDeployer,
-        // which remains the hook's owner regardless of who holds the project NFT.
+        // These permissions are granted from CTDeployer (address(this)) to the initial owner.
+        // The hook checks permissions against hook.owner(), which after claimCollectionOwnershipOf() resolves
+        // dynamically via PROJECTS.ownerOf(projectId). Before claiming, CTDeployer is the static hook owner,
+        // so these permissions allow the project owner to manage tiers through CTDeployer.
         uint8[] memory permissionIds = new uint8[](4);
         permissionIds[0] = JBPermissionIds.ADJUST_721_TIERS;
         permissionIds[1] = JBPermissionIds.SET_721_METADATA;

package/test/audit/{CodexFeeBeneficiaryReentrancy.t.sol → FeeBeneficiaryReentrancy.t.sol}

@@ -19,6 +19,7 @@ import {CTAllowedPost} from "../../src/structs/CTAllowedPost.sol";
 import {CTPost} from "../../src/structs/CTPost.sol";
 
 contract MockPermissions is IJBPermissions {
+    // forge-lint: disable-next-line(mixed-case-function)
     function WILDCARD_PROJECT_ID() external pure returns (uint256) {
         return 0;
     }
@@ -136,8 +137,11 @@ contract FeeTerminalRecorder {
 }
 
 contract ReentrantProjectTerminal {
+    // forge-lint: disable-next-line(screaming-snake-case-immutable)
     CTPublisher public immutable publisher;
+    // forge-lint: disable-next-line(screaming-snake-case-immutable)
     IJB721TiersHook public immutable hook;
+    // forge-lint: disable-next-line(screaming-snake-case-immutable)
     address public immutable attackerFeeBeneficiary;
     bool internal entered;
 
@@ -182,7 +186,7 @@ contract ReentrantProjectTerminal {
     receive() external payable {}
 }
 
-contract CodexFeeBeneficiaryReentrancyTest is Test {
+contract FeeBeneficiaryReentrancyTest is Test {
     MockPermissions permissions;
     MockDirectory directory;
     MockStore store;