@rev-net/core-v6 0.0.1

package/test/REVAutoIssuanceFuzz.t.sol

@@ -0,0 +1,276 @@
+// SPDX-License-Identifier: MIT
+pragma solidity 0.8.23;
+
+import "forge-std/Test.sol";
+import /* {*} from */ "@bananapus/core-v6/test/helpers/TestBaseWorkflow.sol";
+import /* {*} from "@bananapus/721-hook-v6/src/JB721TiersHookDeployer.sol";
+import /* {*} from */ "./../src/REVDeployer.sol";
+import "@croptop/core-v6/src/CTPublisher.sol";
+import {MockBuybackDataHook} from "./mock/MockBuybackDataHook.sol";
+
+import "@bananapus/core-v6/script/helpers/CoreDeploymentLib.sol";
+import "@bananapus/721-hook-v6/script/helpers/Hook721DeploymentLib.sol";
+import "@bananapus/suckers-v6/script/helpers/SuckerDeploymentLib.sol";
+import "@croptop/core-v6/script/helpers/CroptopDeploymentLib.sol";
+import "@bananapus/swap-terminal-v6/script/helpers/SwapTerminalDeploymentLib.sol";
+
+import {JBConstants} from "@bananapus/core-v6/src/libraries/JBConstants.sol";
+import {JBAccountingContext} from "@bananapus/core-v6/src/structs/JBAccountingContext.sol";
+import {REVStageConfig, REVAutoIssuance} from "../src/structs/REVStageConfig.sol";
+import {REVDescription} from "../src/structs/REVDescription.sol";
+import {IREVLoans} from "./../src/interfaces/IREVLoans.sol";
+import {JBSuckerDeployerConfig} from "@bananapus/suckers-v6/src/structs/JBSuckerDeployerConfig.sol";
+import {JBSuckerRegistry} from "@bananapus/suckers-v6/src/JBSuckerRegistry.sol";
+import {JB721TiersHookDeployer} from "@bananapus/721-hook-v6/src/JB721TiersHookDeployer.sol";
+import {JB721TiersHook} from "@bananapus/721-hook-v6/src/JB721TiersHook.sol";
+import {JB721TiersHookStore} from "@bananapus/721-hook-v6/src/JB721TiersHookStore.sol";
+import {JBAddressRegistry} from "@bananapus/address-registry-v6/src/JBAddressRegistry.sol";
+import {IJBAddressRegistry} from "@bananapus/address-registry-v6/src/interfaces/IJBAddressRegistry.sol";
+
+/// @notice Fuzz tests for REVDeployer multi-stage auto-issuance.
+/// Tests stage ID computation consistency and multi-stage claiming behavior.
+/// Related to H-5: stage IDs use block.timestamp + i which may mismatch actual ruleset IDs.
+contract REVAutoIssuanceFuzz_Local is TestBaseWorkflow, JBTest {
+    bytes32 REV_DEPLOYER_SALT = "REVDeployer";
+
+    REVDeployer REV_DEPLOYER;
+    JB721TiersHook EXAMPLE_HOOK;
+    IJB721TiersHookDeployer HOOK_DEPLOYER;
+    IJB721TiersHookStore HOOK_STORE;
+    IJBAddressRegistry ADDRESS_REGISTRY;
+    IJBSuckerRegistry SUCKER_REGISTRY;
+    CTPublisher PUBLISHER;
+    MockBuybackDataHook MOCK_BUYBACK;
+
+    uint256 FEE_PROJECT_ID;
+    uint256 decimals = 18;
+    uint256 decimalMultiplier = 10 ** decimals;
+
+    address private constant TRUSTED_FORWARDER = 0xB2b5841DBeF766d4b521221732F9B618fCf34A87;
+
+    function setUp() public override {
+        super.setUp();
+
+        FEE_PROJECT_ID = jbProjects().createFor(multisig());
+
+        SUCKER_REGISTRY = new JBSuckerRegistry(jbDirectory(), jbPermissions(), multisig(), address(0));
+        HOOK_STORE = new JB721TiersHookStore();
+        EXAMPLE_HOOK = new JB721TiersHook(jbDirectory(), jbPermissions(), jbRulesets(), HOOK_STORE, multisig());
+        ADDRESS_REGISTRY = new JBAddressRegistry();
+        HOOK_DEPLOYER = new JB721TiersHookDeployer(EXAMPLE_HOOK, HOOK_STORE, ADDRESS_REGISTRY, multisig());
+        PUBLISHER = new CTPublisher(jbDirectory(), jbPermissions(), FEE_PROJECT_ID, multisig());
+        MOCK_BUYBACK = new MockBuybackDataHook();
+
+        REV_DEPLOYER = new REVDeployer{salt: REV_DEPLOYER_SALT}(
+            jbController(),
+            SUCKER_REGISTRY,
+            FEE_PROJECT_ID,
+            HOOK_DEPLOYER,
+            PUBLISHER,
+            IJBRulesetDataHook(address(MOCK_BUYBACK)),
+            makeAddr("loans"),
+            TRUSTED_FORWARDER
+        );
+
+        vm.prank(multisig());
+        jbProjects().approve(address(REV_DEPLOYER), FEE_PROJECT_ID);
+    }
+
+    /// @dev Deploy a revnet with N stages, each with auto-issuance.
+    function _deployMultiStageRevnet(uint256 numStages) internal returns (uint256 revnetId, uint256[] memory stageIds) {
+        require(numStages >= 1 && numStages <= 5, "1-5 stages");
+
+        JBAccountingContext[] memory tokensToAccept = new JBAccountingContext[](1);
+        tokensToAccept[0] = JBAccountingContext({
+            token: JBConstants.NATIVE_TOKEN, decimals: 18, currency: uint32(uint160(JBConstants.NATIVE_TOKEN))
+        });
+
+        JBTerminalConfig[] memory terminalConfigs = new JBTerminalConfig[](1);
+        terminalConfigs[0] = JBTerminalConfig({terminal: jbMultiTerminal(), accountingContextsToAccept: tokensToAccept});
+
+        REVStageConfig[] memory stages = new REVStageConfig[](numStages);
+        stageIds = new uint256[](numStages);
+
+        for (uint256 i; i < numStages; i++) {
+            REVAutoIssuance[] memory autoIssuances = new REVAutoIssuance[](1);
+            autoIssuances[0] = REVAutoIssuance({
+                chainId: uint32(block.chainid),
+                count: uint104((10_000 + i * 1000) * decimalMultiplier),
+                beneficiary: multisig()
+            });
+
+            JBSplit[] memory splits = new JBSplit[](1);
+            splits[0].beneficiary = payable(multisig());
+            splits[0].percent = 10_000;
+
+            uint40 startsAt;
+            if (i == 0) {
+                startsAt = uint40(block.timestamp);
+            } else {
+                startsAt = uint40(stages[i - 1].startsAtOrAfter + 180 days);
+            }
+
+            stages[i] = REVStageConfig({
+                startsAtOrAfter: startsAt,
+                autoIssuances: autoIssuances,
+                splitPercent: 2000,
+                splits: splits,
+                initialIssuance: uint112(1000 * decimalMultiplier),
+                issuanceCutFrequency: 90 days,
+                issuanceCutPercent: JBConstants.MAX_WEIGHT_CUT_PERCENT / 2,
+                cashOutTaxRate: 6000,
+                extraMetadata: 0
+            });
+
+            // Stage IDs are stored as block.timestamp + i.
+            stageIds[i] = block.timestamp + i;
+        }
+
+        REVConfig memory config = REVConfig({
+            description: REVDescription("TestRevnet", "TREV", "ipfs://test", bytes32(uint256(numStages))),
+            baseCurrency: uint32(uint160(JBConstants.NATIVE_TOKEN)),
+            splitOperator: multisig(),
+            stageConfigurations: stages
+        });
+
+        vm.prank(multisig());
+        revnetId = REV_DEPLOYER.deployFor({
+            revnetId: 0,
+            configuration: config,
+            terminalConfigurations: terminalConfigs,
+            suckerDeploymentConfiguration: REVSuckerDeploymentConfig({
+                deployerConfigurations: new JBSuckerDeployerConfig[](0),
+                salt: keccak256(abi.encodePacked("AUTOISSUE", numStages))
+            })
+        });
+    }
+
+    // ───────────────── Stage ID computation
+    // ─────────────────────
+
+    /// @notice Verify all auto-issuance storage keys match block.timestamp + i for 3 stages.
+    function test_stageIdComputation_3stages() external {
+        (uint256 revnetId, uint256[] memory stageIds) = _deployMultiStageRevnet(3);
+
+        // Verify storage keys.
+        for (uint256 i; i < 3; i++) {
+            uint256 storedAmount = REV_DEPLOYER.amountToAutoIssue(revnetId, stageIds[i], multisig());
+            uint256 expectedAmount = (10_000 + i * 1000) * decimalMultiplier;
+            assertEq(storedAmount, expectedAmount, string.concat("Stage ", vm.toString(i), " storage mismatch"));
+        }
+    }
+
+    // ───────────────── Multi-stage claiming
+    // ─────────────────────
+
+    /// @notice Deploy 3-stage revnet, advance time, claim auto-issuance from each stage.
+    function test_multiStage_allStagesClaimable() external {
+        (uint256 revnetId, uint256[] memory stageIds) = _deployMultiStageRevnet(3);
+
+        // Stage 0 starts at block.timestamp — immediately claimable.
+        REV_DEPLOYER.autoIssueFor(revnetId, stageIds[0], multisig());
+
+        uint256 stage0Amount = (10_000) * decimalMultiplier;
+        assertEq(
+            IJBToken(jbTokens().tokenOf(revnetId)).balanceOf(multisig()), stage0Amount, "Stage 0 auto-issuance claimed"
+        );
+
+        // Stage 1 starts at block.timestamp + 180 days.
+        vm.warp(block.timestamp + 180 days);
+        REV_DEPLOYER.autoIssueFor(revnetId, stageIds[1], multisig());
+
+        uint256 stage1Amount = (11_000) * decimalMultiplier;
+        assertEq(
+            IJBToken(jbTokens().tokenOf(revnetId)).balanceOf(multisig()),
+            stage0Amount + stage1Amount,
+            "Stage 1 auto-issuance claimed"
+        );
+
+        // Stage 2 starts at block.timestamp + 360 days.
+        vm.warp(block.timestamp + 180 days);
+        REV_DEPLOYER.autoIssueFor(revnetId, stageIds[2], multisig());
+
+        uint256 stage2Amount = (12_000) * decimalMultiplier;
+        assertEq(
+            IJBToken(jbTokens().tokenOf(revnetId)).balanceOf(multisig()),
+            stage0Amount + stage1Amount + stage2Amount,
+            "Stage 2 auto-issuance claimed"
+        );
+    }
+
+    // ───────────────── Wrong stageId reverts
+    // ─────────────────────
+
+    /// @notice Calling autoIssueFor with wrong stageId reverts with NothingToAutoIssue.
+    function test_stageIdMismatch_nothingToAutoIssue() external {
+        (uint256 revnetId,) = _deployMultiStageRevnet(1);
+
+        // Use a wrong stageId.
+        uint256 wrongStageId = block.timestamp + 999;
+
+        vm.expectRevert(REVDeployer.REVDeployer_NothingToAutoIssue.selector);
+        REV_DEPLOYER.autoIssueFor(revnetId, wrongStageId, multisig());
+    }
+
+    // ───────────────── Double claim prevented
+    // ─────────────────────
+
+    /// @notice Claiming once zeroes storage; second claim reverts.
+    function test_autoIssue_doubleClaimPrevented() external {
+        (uint256 revnetId, uint256[] memory stageIds) = _deployMultiStageRevnet(1);
+
+        // First claim succeeds.
+        REV_DEPLOYER.autoIssueFor(revnetId, stageIds[0], multisig());
+
+        // Storage should be zeroed.
+        assertEq(
+            REV_DEPLOYER.amountToAutoIssue(revnetId, stageIds[0], multisig()), 0, "Storage should be zeroed after claim"
+        );
+
+        // Second claim reverts.
+        vm.expectRevert(REVDeployer.REVDeployer_NothingToAutoIssue.selector);
+        REV_DEPLOYER.autoIssueFor(revnetId, stageIds[0], multisig());
+    }
+
+    // ───────────────── Stage not started
+    // ─────────────────────
+
+    /// @notice Calling autoIssueFor before stage start time reverts.
+    function test_stageNotStarted_reverts() external {
+        (uint256 revnetId, uint256[] memory stageIds) = _deployMultiStageRevnet(2);
+
+        // Stage 1 starts at block.timestamp + 180 days.
+        // Try to claim it now (before it starts).
+        vm.expectRevert(abi.encodeWithSelector(REVDeployer.REVDeployer_StageNotStarted.selector, stageIds[1]));
+        REV_DEPLOYER.autoIssueFor(revnetId, stageIds[1], multisig());
+    }
+
+    // ───────────────── H-5: Stage ID vs Ruleset ID comparison
+    // ─────────────────────
+
+    /// @notice H-5 EXPLORATION: Compare stored stageIds with actual ruleset IDs.
+    /// Stage IDs use block.timestamp + i during deployment.
+    /// If actual ruleset IDs differ (e.g., on cross-chain deployment), auto-issuance breaks.
+    function test_H5_stageId_vs_rulesetId_comparison() external {
+        (uint256 revnetId, uint256[] memory stageIds) = _deployMultiStageRevnet(3);
+
+        // Get the actual rulesets from the controller.
+        (JBRuleset memory currentRuleset,) = jbController().currentRulesetOf(revnetId);
+
+        // The first ruleset's ID should match stageIds[0] (both are block.timestamp).
+        assertEq(currentRuleset.id, stageIds[0], "First ruleset ID should match stage 0 ID (both block.timestamp)");
+
+        // For stage 1, the stored key is block.timestamp + 1.
+        // The actual ruleset ID depends on when JBRulesets creates it.
+        // If the ruleset hasn't started yet, getRulesetOf will use the queued ruleset.
+        // This is where H-5 manifests: the actual ID may differ from block.timestamp + 1.
+        uint256 stage1StoredKey = stageIds[1]; // block.timestamp + 1
+        uint256 storedAmount = REV_DEPLOYER.amountToAutoIssue(revnetId, stage1StoredKey, multisig());
+        assertGt(storedAmount, 0, "Auto-issuance stored at block.timestamp + 1");
+
+        // Check if the stored key actually corresponds to a valid ruleset.
+        // On the same chain/deployment tx, getRulesetOf(block.timestamp + 1) typically works
+        // because JBRulesets stores the queued ruleset with that ID.
+        // But on a different chain, block.timestamp would differ entirely.
+    }
+}

package/test/REVDeployerAuditRegressions.t.sol

@@ -0,0 +1,328 @@
+// SPDX-License-Identifier: MIT
+pragma solidity 0.8.23;
+
+import "forge-std/Test.sol";
+import /* {*} from */ "@bananapus/core-v6/test/helpers/TestBaseWorkflow.sol";
+import /* {*} from "@bananapus/721-hook-v6/src/JB721TiersHookDeployer.sol";
+import /* {*} from */ "./../src/REVDeployer.sol";
+import "@croptop/core-v6/src/CTPublisher.sol";
+import {MockBuybackDataHook} from "./mock/MockBuybackDataHook.sol";
+
+import "@bananapus/core-v6/script/helpers/CoreDeploymentLib.sol";
+import "@bananapus/721-hook-v6/script/helpers/Hook721DeploymentLib.sol";
+import "@bananapus/suckers-v6/script/helpers/SuckerDeploymentLib.sol";
+import "@croptop/core-v6/script/helpers/CroptopDeploymentLib.sol";
+import "@bananapus/swap-terminal-v6/script/helpers/SwapTerminalDeploymentLib.sol";
+
+import {JBConstants} from "@bananapus/core-v6/src/libraries/JBConstants.sol";
+import {JBAccountingContext} from "@bananapus/core-v6/src/structs/JBAccountingContext.sol";
+import {REVLoans} from "../src/REVLoans.sol";
+import {REVStageConfig, REVAutoIssuance} from "../src/structs/REVStageConfig.sol";
+import {REVDescription} from "../src/structs/REVDescription.sol";
+import {IREVLoans} from "./../src/interfaces/IREVLoans.sol";
+import {JBSuckerDeployerConfig} from "@bananapus/suckers-v6/src/structs/JBSuckerDeployerConfig.sol";
+import {JBSuckerRegistry} from "@bananapus/suckers-v6/src/JBSuckerRegistry.sol";
+import {JB721TiersHookDeployer} from "@bananapus/721-hook-v6/src/JB721TiersHookDeployer.sol";
+import {JB721TiersHook} from "@bananapus/721-hook-v6/src/JB721TiersHook.sol";
+import {JB721TiersHookStore} from "@bananapus/721-hook-v6/src/JB721TiersHookStore.sol";
+import {JBAddressRegistry} from "@bananapus/address-registry-v6/src/JBAddressRegistry.sol";
+import {IJBAddressRegistry} from "@bananapus/address-registry-v6/src/interfaces/IJBAddressRegistry.sol";
+
+/// @notice Audit regression tests for REVDeployer findings C-2, C-4, and H-5.
+contract REVDeployerAuditRegressions_Local is TestBaseWorkflow, JBTest {
+    using JBRulesetMetadataResolver for JBRuleset;
+
+    bytes32 REV_DEPLOYER_SALT = "REVDeployer";
+    bytes32 ERC20_SALT = "REV_TOKEN";
+
+    REVDeployer REV_DEPLOYER;
+    JB721TiersHook EXAMPLE_HOOK;
+    IJB721TiersHookDeployer HOOK_DEPLOYER;
+    IJB721TiersHookStore HOOK_STORE;
+    IJBAddressRegistry ADDRESS_REGISTRY;
+    IREVLoans LOANS_CONTRACT;
+    IJBSuckerRegistry SUCKER_REGISTRY;
+    CTPublisher PUBLISHER;
+    MockBuybackDataHook MOCK_BUYBACK;
+
+    uint256 FEE_PROJECT_ID;
+
+    address private constant TRUSTED_FORWARDER = 0xB2b5841DBeF766d4b521221732F9B618fCf34A87;
+
+    function setUp() public override {
+        super.setUp();
+
+        FEE_PROJECT_ID = jbProjects().createFor(multisig());
+
+        SUCKER_REGISTRY = new JBSuckerRegistry(jbDirectory(), jbPermissions(), multisig(), address(0));
+        HOOK_STORE = new JB721TiersHookStore();
+        EXAMPLE_HOOK = new JB721TiersHook(jbDirectory(), jbPermissions(), jbRulesets(), HOOK_STORE, multisig());
+        ADDRESS_REGISTRY = new JBAddressRegistry();
+        HOOK_DEPLOYER = new JB721TiersHookDeployer(EXAMPLE_HOOK, HOOK_STORE, ADDRESS_REGISTRY, multisig());
+        PUBLISHER = new CTPublisher(jbDirectory(), jbPermissions(), FEE_PROJECT_ID, multisig());
+        MOCK_BUYBACK = new MockBuybackDataHook();
+
+        LOANS_CONTRACT = new REVLoans({
+            controller: jbController(),
+            projects: jbProjects(),
+            revId: FEE_PROJECT_ID,
+            owner: address(this),
+            permit2: permit2(),
+            trustedForwarder: TRUSTED_FORWARDER
+        });
+
+        REV_DEPLOYER = new REVDeployer{salt: REV_DEPLOYER_SALT}(
+            jbController(),
+            SUCKER_REGISTRY,
+            FEE_PROJECT_ID,
+            HOOK_DEPLOYER,
+            PUBLISHER,
+            IJBRulesetDataHook(address(MOCK_BUYBACK)),
+            address(LOANS_CONTRACT),
+            TRUSTED_FORWARDER
+        );
+
+        vm.prank(multisig());
+        jbProjects().approve(address(REV_DEPLOYER), FEE_PROJECT_ID);
+    }
+
+    //*********************************************************************//
+    // --- [C-2] REVDeployer.beforePayRecordedWith Array OOB Regression - //
+    //*********************************************************************//
+
+    /// @notice Tests that the C-2 array OOB pattern manifests when only buybackHook is present.
+    /// @dev REVDeployer line 258: hookSpecifications[1] = buybackHookSpecifications[0]
+    ///      always writes to index [1], even when the array has size 1 (no tiered721Hook).
+    function test_C2_arrayOOB_onlyBuybackHook() public pure {
+        // Simulate: usesTiered721Hook=false, usesBuybackHook=true
+        bool usesTiered721Hook = false;
+        bool usesBuybackHook = true;
+
+        uint256 arraySize = (usesTiered721Hook ? 1 : 0) + (usesBuybackHook ? 1 : 0);
+        assertEq(arraySize, 1, "array should be size 1");
+
+        JBPayHookSpecification[] memory specs = new JBPayHookSpecification[](arraySize);
+
+        // Index [0] is NOT written (usesTiered721Hook is false)
+        // Index [1] WOULD be written by the bug, but that's OOB
+        // Verify the pattern: writing to index 1 of a size-1 array should revert
+        bool wouldRevert = (!usesTiered721Hook && usesBuybackHook);
+        assertTrue(wouldRevert, "C-2: this combination triggers the OOB bug");
+
+        // Verify the safe index: the buyback hook should go at index 0 when no tiered hook
+        uint256 correctIndex = usesTiered721Hook ? 1 : 0;
+        assertEq(correctIndex, 0, "C-2 FIX: buyback hook should use index 0 when no tiered hook");
+
+        // Write to the correct index (no revert)
+        specs[correctIndex] = JBPayHookSpecification({hook: IJBPayHook(address(0xbeef)), amount: 1 ether, metadata: ""});
+    }
+
+    /// @notice Verify both hooks present works fine (no OOB).
+    function test_C2_noOOB_bothHooksPresent() public pure {
+        bool usesTiered721Hook = true;
+        bool usesBuybackHook = true;
+
+        uint256 arraySize = (usesTiered721Hook ? 1 : 0) + (usesBuybackHook ? 1 : 0);
+        assertEq(arraySize, 2, "array should be size 2");
+
+        JBPayHookSpecification[] memory specs = new JBPayHookSpecification[](arraySize);
+        specs[0] = JBPayHookSpecification({hook: IJBPayHook(address(0xdead)), amount: 1 ether, metadata: ""});
+        specs[1] = JBPayHookSpecification({hook: IJBPayHook(address(0xbeef)), amount: 2 ether, metadata: ""});
+    }
+
+    //*********************************************************************//
+    // --- [C-4] hasMintPermissionFor returns false for random addresses - //
+    //*********************************************************************//
+
+    /// @notice Tests that calling hasMintPermissionFor returns false for random addresses.
+    /// @dev With the buyback hook removed, hasMintPermissionFor should return false
+    ///      for addresses that are not the loans contract or a sucker.
+    function test_C4_hasMintPermissionFor_noBuybackHook() public {
+        // Deploy a revnet WITHOUT a buyback hook
+        JBAccountingContext[] memory accountingContextsToAccept = new JBAccountingContext[](1);
+        accountingContextsToAccept[0] = JBAccountingContext({
+            token: JBConstants.NATIVE_TOKEN, decimals: 18, currency: uint32(uint160(JBConstants.NATIVE_TOKEN))
+        });
+
+        JBTerminalConfig[] memory terminalConfigurations = new JBTerminalConfig[](1);
+        terminalConfigurations[0] =
+            JBTerminalConfig({terminal: jbMultiTerminal(), accountingContextsToAccept: accountingContextsToAccept});
+
+        REVStageConfig[] memory stageConfigurations = new REVStageConfig[](1);
+        JBSplit[] memory splits = new JBSplit[](1);
+        splits[0].beneficiary = payable(multisig());
+        splits[0].percent = 10_000;
+
+        stageConfigurations[0] = REVStageConfig({
+            startsAtOrAfter: uint40(block.timestamp),
+            autoIssuances: new REVAutoIssuance[](0),
+            splitPercent: 0,
+            splits: splits,
+            initialIssuance: uint112(1000e18),
+            issuanceCutFrequency: 0,
+            issuanceCutPercent: 0,
+            cashOutTaxRate: 5000,
+            extraMetadata: 0
+        });
+
+        REVConfig memory revnetConfiguration = REVConfig({
+            description: REVDescription("Test", "TST", "ipfs://test", "TEST_SALT"),
+            baseCurrency: uint32(uint160(JBConstants.NATIVE_TOKEN)),
+            splitOperator: multisig(),
+            stageConfigurations: stageConfigurations
+        });
+
+        vm.prank(multisig());
+        uint256 revnetId = REV_DEPLOYER.deployFor({
+            revnetId: FEE_PROJECT_ID,
+            configuration: revnetConfiguration,
+            terminalConfigurations: terminalConfigurations,
+            suckerDeploymentConfiguration: REVSuckerDeploymentConfig({
+                deployerConfigurations: new JBSuckerDeployerConfig[](0), salt: keccak256("C4_TEST")
+            })
+        });
+
+        // hasMintPermissionFor should return false for random addresses
+        address someRandomAddr = address(0x12345);
+
+        // Get the current ruleset for the call
+        JBRuleset memory currentRuleset = jbRulesets().currentOf(revnetId);
+
+        // With buyback hook removed, hasMintPermissionFor should return false
+        // for addresses that are not the loans contract or a sucker.
+        bool hasPerm = REV_DEPLOYER.hasMintPermissionFor(revnetId, currentRuleset, someRandomAddr);
+        assertFalse(hasPerm, "C-4: random address should not have mint permission");
+    }
+
+    //*********************************************************************//
+    // --- [H-5] Auto-Issuance Stage ID Mismatch ----------------------- //
+    //*********************************************************************//
+
+    /// @notice Tests that auto-issuance stage IDs are computed correctly for multi-stage revnets.
+    /// @dev H-5: The stage ID is computed as `block.timestamp + i` which only works if stages
+    ///      are deployed in a specific order at a specific time.
+    function test_H5_autoIssuanceStageIdMismatch() public {
+        JBAccountingContext[] memory accountingContextsToAccept = new JBAccountingContext[](1);
+        accountingContextsToAccept[0] = JBAccountingContext({
+            token: JBConstants.NATIVE_TOKEN, decimals: 18, currency: uint32(uint160(JBConstants.NATIVE_TOKEN))
+        });
+
+        JBTerminalConfig[] memory terminalConfigurations = new JBTerminalConfig[](1);
+        terminalConfigurations[0] =
+            JBTerminalConfig({terminal: jbMultiTerminal(), accountingContextsToAccept: accountingContextsToAccept});
+
+        JBSplit[] memory splits = new JBSplit[](1);
+        splits[0].beneficiary = payable(multisig());
+        splits[0].percent = 10_000;
+
+        uint8 decimals = 18;
+        uint256 decimalMultiplier = 10 ** decimals;
+
+        // Configure 3 stages with auto-issuance on stages 0 AND 1
+        REVStageConfig[] memory stageConfigurations = new REVStageConfig[](3);
+
+        // Stage 0: has auto-issuance
+        {
+            REVAutoIssuance[] memory issuanceConfs = new REVAutoIssuance[](1);
+            issuanceConfs[0] = REVAutoIssuance({
+                chainId: uint32(block.chainid), count: uint104(50_000 * decimalMultiplier), beneficiary: multisig()
+            });
+
+            stageConfigurations[0] = REVStageConfig({
+                startsAtOrAfter: uint40(block.timestamp),
+                autoIssuances: issuanceConfs,
+                splitPercent: 2000,
+                splits: splits,
+                initialIssuance: uint112(1000 * decimalMultiplier),
+                issuanceCutFrequency: 90 days,
+                issuanceCutPercent: JBConstants.MAX_WEIGHT_CUT_PERCENT / 2,
+                cashOutTaxRate: 6000,
+                extraMetadata: 0
+            });
+        }
+
+        // Stage 1: also has auto-issuance — this is where H-5 manifests
+        {
+            REVAutoIssuance[] memory issuanceConfs = new REVAutoIssuance[](1);
+            issuanceConfs[0] = REVAutoIssuance({
+                chainId: uint32(block.chainid), count: uint104(30_000 * decimalMultiplier), beneficiary: multisig()
+            });
+
+            stageConfigurations[1] = REVStageConfig({
+                startsAtOrAfter: uint40(stageConfigurations[0].startsAtOrAfter + 365 days),
+                autoIssuances: issuanceConfs,
+                splitPercent: 1000,
+                splits: splits,
+                initialIssuance: 0, // inherit
+                issuanceCutFrequency: 180 days,
+                issuanceCutPercent: JBConstants.MAX_WEIGHT_CUT_PERCENT / 2,
+                cashOutTaxRate: 3000,
+                extraMetadata: 0
+            });
+        }
+
+        // Stage 2: no auto-issuance
+        stageConfigurations[2] = REVStageConfig({
+            startsAtOrAfter: uint40(stageConfigurations[1].startsAtOrAfter + (5 * 365 days)),
+            autoIssuances: new REVAutoIssuance[](0),
+            splitPercent: 0,
+            splits: splits,
+            initialIssuance: 1,
+            issuanceCutFrequency: 0,
+            issuanceCutPercent: 0,
+            cashOutTaxRate: 500,
+            extraMetadata: 0
+        });
+
+        REVConfig memory revnetConfiguration = REVConfig({
+            description: REVDescription("H5Test", "H5T", "ipfs://h5test", "H5_TOKEN"),
+            baseCurrency: uint32(uint160(JBConstants.NATIVE_TOKEN)),
+            splitOperator: multisig(),
+            stageConfigurations: stageConfigurations
+        });
+
+        vm.prank(multisig());
+        uint256 revnetId = REV_DEPLOYER.deployFor({
+            revnetId: 0,
+            configuration: revnetConfiguration,
+            terminalConfigurations: terminalConfigurations,
+            suckerDeploymentConfiguration: REVSuckerDeploymentConfig({
+                deployerConfigurations: new JBSuckerDeployerConfig[](0), salt: keccak256("H5_TEST")
+            })
+        });
+
+        // Verify the revnet was deployed
+        assertGt(revnetId, 0, "revnet should be deployed");
+
+        // The H-5 bug: auto-issuance for stage 1 is stored at key (block.timestamp + 1),
+        // but the actual ruleset ID for stage 1 is the timestamp when that stage's ruleset
+        // was queued. These may not match.
+        // We verify the auto-issuance amounts are stored and can be queried.
+        uint256 stage0Amount = REV_DEPLOYER.amountToAutoIssue(revnetId, block.timestamp, multisig());
+
+        // Stage 0 auto-issuance should be stored at block.timestamp
+        assertEq(stage0Amount, 50_000 * decimalMultiplier, "Stage 0 auto-issuance should be stored at block.timestamp");
+
+        // Stage 1 auto-issuance is stored at (block.timestamp + 1) per H-5
+        uint256 stage1Amount = REV_DEPLOYER.amountToAutoIssue(revnetId, block.timestamp + 1, multisig());
+        assertEq(
+            stage1Amount,
+            30_000 * decimalMultiplier,
+            "H-5: Stage 1 auto-issuance stored at block.timestamp + 1 (may not match ruleset ID)"
+        );
+
+        // Now check the actual ruleset IDs to demonstrate the mismatch
+        JBRuleset[] memory rulesets = jbRulesets().allOf(revnetId, 0, 3);
+        if (rulesets.length >= 2) {
+            uint256 actualStage1RulesetId = rulesets[1].id;
+
+            // The H-5 mismatch: the storage key (block.timestamp + 1) likely != the actual ruleset ID
+            // If they don't match, auto-issuance tokens for stage 1 become unclaimable
+            if (actualStage1RulesetId != block.timestamp + 1) {
+                // Verify the amount at the ACTUAL ruleset ID is 0 (the mismatch)
+                uint256 amountAtActualId = REV_DEPLOYER.amountToAutoIssue(revnetId, actualStage1RulesetId, multisig());
+                assertEq(amountAtActualId, 0, "H-5 CONFIRMED: auto-issuance at actual ruleset ID is 0 (mismatch)");
+            }
+        }
+    }
+}