@croptop/core-v6 0.0.54 → 0.0.55

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@croptop/core-v6",
-  "version": "0.0.54",
+  "version": "0.0.55",
   "license": "MIT",
   "repository": {
     "type": "git",

package/src/CTDeployer.sol

@@ -241,6 +241,12 @@ contract CTDeployer is ERC2771Context, JBPermissioned, IJBRulesetDataHook, IERC7
         if (suckerDeploymentConfiguration.salt != bytes32(0)) {
             bytes32 suckerSalt = keccak256(abi.encode(suckerDeploymentConfiguration.salt, _msgSender()));
 
+            // A launch-time project is still owned by this deployer until the final NFT transfer, so check the
+            // intended owner before the registry sees `address(this)` as the current project owner.
+            _requireExplicitSuckerPeerPermissionFrom({
+                account: owner, projectId: projectId, suckerDeploymentConfiguration: suckerDeploymentConfiguration
+            });
+
             // Successful deployments are discoverable from the registry, and failures are reported without reverting
             // the project launch.
             try SUCKER_REGISTRY.deploySuckersFor({
@@ -282,7 +288,8 @@ contract CTDeployer is ERC2771Context, JBPermissioned, IJBRulesetDataHook, IERC7
     }
 
     /// @notice Deploy new suckers for an existing project.
-    /// @dev Only the juicebox's owner can deploy new suckers.
+    /// @dev Only the juicebox's owner or a `DEPLOY_SUCKERS` operator can deploy new suckers. Supplying an explicit
+    /// non-default peer also requires `SET_SUCKER_PEER`, matching the registry's direct-call rule.
     /// @param projectId The ID of the project to deploy suckers for.
     /// @param suckerDeploymentConfiguration The suckers to set up for the project.
     function deploySuckersFor(
@@ -292,11 +299,19 @@ contract CTDeployer is ERC2771Context, JBPermissioned, IJBRulesetDataHook, IERC7
         external
         returns (address[] memory suckers)
     {
+        // Resolve the project owner once because Juicebox permissions are checked against the owner's permission table.
         address owner = PROJECTS.ownerOf(projectId);
 
-        // First prove the external caller is allowed to request sucker deployment for the project owner.
+        // `DEPLOY_SUCKERS` authorizes this wrapper to ask the registry for new suckers, but it does not authorize
+        // choosing a non-default remote peer.
         _requirePermissionFrom({account: owner, projectId: projectId, permissionId: JBPermissionIds.DEPLOY_SUCKERS});
 
+        // Mirror the registry's explicit-peer gate against the original project authority before this wrapper becomes
+        // the registry caller.
+        _requireExplicitSuckerPeerPermissionFrom({
+            account: owner, projectId: projectId, suckerDeploymentConfiguration: suckerDeploymentConfiguration
+        });
+
         // Deploy the suckers. The sucker registry performs its own permission check against this forwarding helper,
         // so an unapproved CTDeployer fails at the downstream registry boundary without an extra preflight read here.
         suckers = SUCKER_REGISTRY.deploySuckersFor({
@@ -484,4 +499,41 @@ contract CTDeployer is ERC2771Context, JBPermissioned, IJBRulesetDataHook, IERC7
     function _msgSender() internal view override(ERC2771Context, Context) returns (address sender) {
         return ERC2771Context._msgSender();
     }
+
+    /// @notice Revert unless the caller may set explicit sucker peers for `projectId`.
+    /// @dev The registry enforces this against its direct caller. Since this deployer wraps the registry call, it must
+    /// mirror the check against the original caller so `DEPLOY_SUCKERS` alone cannot smuggle in arbitrary peers.
+    /// @param account The project owner account whose permission table is checked.
+    /// @param projectId The ID of the project to deploy suckers for.
+    /// @param suckerDeploymentConfiguration The sucker deployment configuration to inspect.
+    function _requireExplicitSuckerPeerPermissionFrom(
+        address account,
+        uint256 projectId,
+        CTSuckerDeploymentConfig calldata suckerDeploymentConfiguration
+    )
+        internal
+        view
+    {
+        // Scan every requested sucker configuration because a single explicit peer changes cross-chain authority.
+        for (uint256 i; i < suckerDeploymentConfiguration.deployerConfigurations.length;) {
+            // Cache the configured peer so the default/explicit branch is evaluated from the exact value sent onward.
+            bytes32 peer = suckerDeploymentConfiguration.deployerConfigurations[i].peer;
+
+            // `peer == 0` preserves the sucker's deterministic same-address peer behavior.
+            // Any nonzero peer is written directly into the new sucker and changes who can deliver remote roots.
+            if (peer != bytes32(0)) {
+                // Require the original project authority, not this wrapper, to authorize explicit remote peers.
+                _requirePermissionFrom({
+                    account: account, projectId: projectId, permissionId: JBPermissionIds.SET_SUCKER_PEER
+                });
+                // One explicit peer is enough to prove the caller needs the stronger permission.
+                return;
+            }
+
+            unchecked {
+                // Skip overflow checks because `i` is bounded by the calldata array length.
+                ++i;
+            }
+        }
+    }
 }