@rev-net/core-v6 0.0.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (92) hide show
  1. package/LICENSE +21 -0
  2. package/README.md +65 -0
  3. package/REVNET_SECURITY_CHECKLIST.md +164 -0
  4. package/SECURITY.md +68 -0
  5. package/SKILLS.md +166 -0
  6. package/deployments/revnet-core-v5/arbitrum/REVDeployer.json +2821 -0
  7. package/deployments/revnet-core-v5/arbitrum/REVLoans.json +2260 -0
  8. package/deployments/revnet-core-v5/arbitrum_sepolia/REVDeployer.json +2821 -0
  9. package/deployments/revnet-core-v5/arbitrum_sepolia/REVLoans.json +2260 -0
  10. package/deployments/revnet-core-v5/base/REVDeployer.json +2825 -0
  11. package/deployments/revnet-core-v5/base/REVLoans.json +2264 -0
  12. package/deployments/revnet-core-v5/base_sepolia/REVDeployer.json +2825 -0
  13. package/deployments/revnet-core-v5/base_sepolia/REVLoans.json +2264 -0
  14. package/deployments/revnet-core-v5/ethereum/REVDeployer.json +2825 -0
  15. package/deployments/revnet-core-v5/ethereum/REVLoans.json +2264 -0
  16. package/deployments/revnet-core-v5/optimism/REVDeployer.json +2821 -0
  17. package/deployments/revnet-core-v5/optimism/REVLoans.json +2260 -0
  18. package/deployments/revnet-core-v5/optimism_sepolia/REVDeployer.json +2825 -0
  19. package/deployments/revnet-core-v5/optimism_sepolia/REVLoans.json +2264 -0
  20. package/deployments/revnet-core-v5/sepolia/REVDeployer.json +2825 -0
  21. package/deployments/revnet-core-v5/sepolia/REVLoans.json +2264 -0
  22. package/docs/book.css +13 -0
  23. package/docs/book.toml +13 -0
  24. package/docs/solidity.min.js +74 -0
  25. package/docs/src/README.md +88 -0
  26. package/docs/src/SUMMARY.md +20 -0
  27. package/docs/src/src/README.md +7 -0
  28. package/docs/src/src/REVDeployer.sol/contract.REVDeployer.md +968 -0
  29. package/docs/src/src/REVLoans.sol/contract.REVLoans.md +1047 -0
  30. package/docs/src/src/interfaces/IREVDeployer.sol/interface.IREVDeployer.md +243 -0
  31. package/docs/src/src/interfaces/IREVLoans.sol/interface.IREVLoans.md +296 -0
  32. package/docs/src/src/interfaces/README.md +5 -0
  33. package/docs/src/src/structs/README.md +14 -0
  34. package/docs/src/src/structs/REVAutoIssuance.sol/struct.REVAutoIssuance.md +19 -0
  35. package/docs/src/src/structs/REVBuybackHookConfig.sol/struct.REVBuybackHookConfig.md +19 -0
  36. package/docs/src/src/structs/REVBuybackPoolConfig.sol/struct.REVBuybackPoolConfig.md +21 -0
  37. package/docs/src/src/structs/REVConfig.sol/struct.REVConfig.md +35 -0
  38. package/docs/src/src/structs/REVCroptopAllowedPost.sol/struct.REVCroptopAllowedPost.md +28 -0
  39. package/docs/src/src/structs/REVDeploy721TiersHookConfig.sol/struct.REVDeploy721TiersHookConfig.md +34 -0
  40. package/docs/src/src/structs/REVDescription.sol/struct.REVDescription.md +23 -0
  41. package/docs/src/src/structs/REVLoan.sol/struct.REVLoan.md +28 -0
  42. package/docs/src/src/structs/REVLoanSource.sol/struct.REVLoanSource.md +16 -0
  43. package/docs/src/src/structs/REVStageConfig.sol/struct.REVStageConfig.md +44 -0
  44. package/docs/src/src/structs/REVSuckerDeploymentConfig.sol/struct.REVSuckerDeploymentConfig.md +16 -0
  45. package/foundry.lock +11 -0
  46. package/foundry.toml +23 -0
  47. package/package.json +31 -0
  48. package/remappings.txt +1 -0
  49. package/script/Deploy.s.sol +350 -0
  50. package/script/helpers/RevnetCoreDeploymentLib.sol +72 -0
  51. package/slither-ci.config.json +10 -0
  52. package/sphinx.lock +507 -0
  53. package/src/REVDeployer.sol +1257 -0
  54. package/src/REVLoans.sol +1333 -0
  55. package/src/interfaces/IREVDeployer.sol +198 -0
  56. package/src/interfaces/IREVLoans.sol +241 -0
  57. package/src/structs/REVAutoIssuance.sol +11 -0
  58. package/src/structs/REVConfig.sol +17 -0
  59. package/src/structs/REVCroptopAllowedPost.sol +20 -0
  60. package/src/structs/REVDeploy721TiersHookConfig.sol +25 -0
  61. package/src/structs/REVDescription.sol +14 -0
  62. package/src/structs/REVLoan.sol +19 -0
  63. package/src/structs/REVLoanSource.sol +11 -0
  64. package/src/structs/REVStageConfig.sol +34 -0
  65. package/src/structs/REVSuckerDeploymentConfig.sol +11 -0
  66. package/test/REV.integrations.t.sol +420 -0
  67. package/test/REVAutoIssuanceFuzz.t.sol +276 -0
  68. package/test/REVDeployerAuditRegressions.t.sol +328 -0
  69. package/test/REVInvincibility.t.sol +1275 -0
  70. package/test/REVInvincibilityHandler.sol +357 -0
  71. package/test/REVLifecycle.t.sol +364 -0
  72. package/test/REVLoans.invariants.t.sol +642 -0
  73. package/test/REVLoansAttacks.t.sol +739 -0
  74. package/test/REVLoansAuditRegressions.t.sol +314 -0
  75. package/test/REVLoansFeeRecovery.t.sol +704 -0
  76. package/test/REVLoansSourced.t.sol +1732 -0
  77. package/test/REVLoansUnSourced.t.sol +331 -0
  78. package/test/TestPR09_ConversionDocumentation.t.sol +304 -0
  79. package/test/TestPR10_LiquidationBehavior.t.sol +340 -0
  80. package/test/TestPR11_LowFindings.t.sol +571 -0
  81. package/test/TestPR12_FlashLoanSurplus.t.sol +305 -0
  82. package/test/TestPR13_CrossSourceReallocation.t.sol +302 -0
  83. package/test/TestPR15_CashOutCallerValidation.t.sol +320 -0
  84. package/test/TestPR16_ZeroRepayment.t.sol +297 -0
  85. package/test/TestPR21_Uint112Overflow.t.sol +251 -0
  86. package/test/TestPR22_HookArrayOOB.t.sol +221 -0
  87. package/test/TestPR26_BurnHeldTokens.t.sol +331 -0
  88. package/test/TestPR27_CEIPattern.t.sol +448 -0
  89. package/test/TestPR29_SwapTerminalPermission.t.sol +206 -0
  90. package/test/TestPR32_MixedFixes.t.sol +529 -0
  91. package/test/helpers/MaliciousContracts.sol +233 -0
  92. package/test/mock/MockBuybackDataHook.sol +61 -0
@@ -0,0 +1,357 @@
1
+ // SPDX-License-Identifier: MIT
2
+ pragma solidity 0.8.23;
3
+
4
+ import "forge-std/Test.sol";
5
+ import /* {*} from */ "@bananapus/core-v6/test/helpers/TestBaseWorkflow.sol";
6
+ import {JBConstants} from "@bananapus/core-v6/src/libraries/JBConstants.sol";
7
+ import {JBAccountingContext} from "@bananapus/core-v6/src/structs/JBAccountingContext.sol";
8
+ import {mulDiv} from "@prb/math/src/Common.sol";
9
+ import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
10
+
11
+ import {IREVLoans} from "../src/interfaces/IREVLoans.sol";
12
+ import {REVLoan} from "../src/structs/REVLoan.sol";
13
+ import {REVLoanSource} from "../src/structs/REVLoanSource.sol";
14
+
15
+ /// @title REVInvincibilityHandler
16
+ /// @notice Stateful fuzzing handler for the revnet + loans interaction surface.
17
+ /// @dev 10 operations with ghost variables tracking all value flows.
18
+ contract REVInvincibilityHandler is JBTest {
19
+ // =========================================================================
20
+ // Ghost variables
21
+ // =========================================================================
22
+ uint256 public COLLATERAL_SUM;
23
+ uint256 public COLLATERAL_RETURNED;
24
+ uint256 public BORROWED_SUM;
25
+ uint256 public REPAID_SUM;
26
+ uint256 public PAID_IN_SUM;
27
+ uint256 public CASHED_OUT_SUM;
28
+ uint256 public ADDED_TO_BALANCE_SUM;
29
+
30
+ // Per-operation call counts
31
+ uint256 public callCount_payAndBorrow;
32
+ uint256 public callCount_repayLoan;
33
+ uint256 public callCount_reallocateCollateral;
34
+ uint256 public callCount_liquidateLoans;
35
+ uint256 public callCount_advanceTime;
36
+ uint256 public callCount_payInto;
37
+ uint256 public callCount_cashOut;
38
+ uint256 public callCount_addToBalance;
39
+ uint256 public callCount_sendReservedTokens;
40
+ uint256 public callCount_changeStage;
41
+
42
+ // Fee project tracking
43
+ uint256 public feeProjectBalanceAtStart;
44
+
45
+ // =========================================================================
46
+ // Dependencies
47
+ // =========================================================================
48
+ IJBMultiTerminal public TERMINAL;
49
+ IREVLoans public LOANS;
50
+ IJBPermissions public PERMS;
51
+ IJBTokens public TOKENS;
52
+ IJBController public CTRL;
53
+ uint256 public REVNET_ID;
54
+ uint256 public FEE_PROJECT_ID;
55
+ address public USER;
56
+
57
+ // Stage boundaries (for changeStage)
58
+ uint256 public stage1Start;
59
+ uint256 public stage2Start;
60
+
61
+ constructor(
62
+ IJBMultiTerminal terminal,
63
+ IREVLoans loans,
64
+ IJBPermissions permissions,
65
+ IJBTokens tokens,
66
+ IJBController controller,
67
+ uint256 revnetId,
68
+ uint256 feeProjectId,
69
+ address user,
70
+ uint256 _stage1Start,
71
+ uint256 _stage2Start
72
+ ) {
73
+ TERMINAL = terminal;
74
+ LOANS = loans;
75
+ PERMS = permissions;
76
+ TOKENS = tokens;
77
+ CTRL = controller;
78
+ REVNET_ID = revnetId;
79
+ FEE_PROJECT_ID = feeProjectId;
80
+ USER = user;
81
+ stage1Start = _stage1Start;
82
+ stage2Start = _stage2Start;
83
+ }
84
+
85
+ modifier useActor() {
86
+ vm.startPrank(USER);
87
+ _;
88
+ vm.stopPrank();
89
+ }
90
+
91
+ // =========================================================================
92
+ // Operation 1: payAndBorrow — pay ETH, borrow against tokens
93
+ // =========================================================================
94
+ function payAndBorrow(uint256 seed) public useActor {
95
+ uint256 payAmount = bound(seed, 0.1 ether, 5 ether);
96
+ uint256 prepaidFee = bound(seed >> 8, 25, 500);
97
+
98
+ vm.deal(USER, payAmount);
99
+
100
+ uint256 receivedTokens = TERMINAL.pay{value: payAmount}(REVNET_ID, JBConstants.NATIVE_TOKEN, 0, USER, 0, "", "");
101
+
102
+ if (receivedTokens == 0) return;
103
+
104
+ uint256 borrowable =
105
+ LOANS.borrowableAmountFrom(REVNET_ID, receivedTokens, 18, uint32(uint160(JBConstants.NATIVE_TOKEN)));
106
+
107
+ if (borrowable == 0) return;
108
+
109
+ // Mock permission
110
+ mockExpect(
111
+ address(PERMS),
112
+ abi.encodeCall(IJBPermissions.hasPermission, (address(LOANS), USER, REVNET_ID, 11, true, true)),
113
+ abi.encode(true)
114
+ );
115
+
116
+ REVLoanSource memory source = REVLoanSource({token: JBConstants.NATIVE_TOKEN, terminal: TERMINAL});
117
+ (, REVLoan memory loan) =
118
+ LOANS.borrowFrom(REVNET_ID, source, borrowable, receivedTokens, payable(USER), prepaidFee);
119
+
120
+ COLLATERAL_SUM += receivedTokens;
121
+ BORROWED_SUM += loan.amount;
122
+ PAID_IN_SUM += payAmount;
123
+ ++callCount_payAndBorrow;
124
+ }
125
+
126
+ // =========================================================================
127
+ // Operation 2: repayLoan — partially/fully repay a loan
128
+ // =========================================================================
129
+ function repayLoan(uint256 seed) public useActor {
130
+ if (callCount_payAndBorrow == 0) return;
131
+
132
+ uint256 percentToPayDown = bound(seed, 1000, 9999);
133
+ uint256 daysToWarp = bound(seed >> 16, 1, 90);
134
+ vm.warp(block.timestamp + daysToWarp * 1 days);
135
+
136
+ uint256 id = (REVNET_ID * 1_000_000_000_000) + callCount_payAndBorrow;
137
+
138
+ try IERC721(address(LOANS)).ownerOf(id) {}
139
+ catch {
140
+ return;
141
+ }
142
+
143
+ REVLoan memory latestLoan = LOANS.loanOf(id);
144
+ if (latestLoan.amount == 0) return;
145
+
146
+ uint256 collateralReturned = mulDiv(latestLoan.collateral, percentToPayDown, 10_000);
147
+ uint256 newCollateral = latestLoan.collateral - collateralReturned;
148
+ uint256 borrowableFromNewCollateral =
149
+ LOANS.borrowableAmountFrom(REVNET_ID, newCollateral, 18, uint32(uint160(JBConstants.NATIVE_TOKEN)));
150
+
151
+ if (borrowableFromNewCollateral > 0) borrowableFromNewCollateral -= 1;
152
+
153
+ uint256 amountDiff =
154
+ borrowableFromNewCollateral > latestLoan.amount ? 0 : latestLoan.amount - borrowableFromNewCollateral;
155
+
156
+ uint256 amountPaidDown = amountDiff;
157
+
158
+ {
159
+ uint256 timeSinceLoanCreated = block.timestamp - latestLoan.createdAt;
160
+ if (timeSinceLoanCreated > latestLoan.prepaidDuration) {
161
+ uint256 prepaidAmount =
162
+ JBFees.feeAmountFrom({amountBeforeFee: amountDiff, feePercent: latestLoan.prepaidFeePercent});
163
+ amountPaidDown += JBFees.feeAmountFrom({
164
+ amountBeforeFee: amountDiff - prepaidAmount,
165
+ feePercent: mulDiv(timeSinceLoanCreated, JBConstants.MAX_FEE, 3650 days)
166
+ });
167
+ }
168
+ }
169
+
170
+ JBSingleAllowance memory allowance;
171
+ vm.deal(USER, type(uint256).max);
172
+
173
+ try LOANS.repayLoan{value: amountPaidDown}(
174
+ id, amountPaidDown, collateralReturned, payable(USER), allowance
175
+ ) returns (
176
+ uint256, REVLoan memory adjustedLoan
177
+ ) {
178
+ COLLATERAL_RETURNED += collateralReturned;
179
+ COLLATERAL_SUM -= collateralReturned;
180
+ REPAID_SUM += (latestLoan.amount - adjustedLoan.amount);
181
+ if (BORROWED_SUM >= (latestLoan.amount - adjustedLoan.amount)) {
182
+ BORROWED_SUM -= (latestLoan.amount - adjustedLoan.amount);
183
+ }
184
+ ++callCount_repayLoan;
185
+ } catch {}
186
+ }
187
+
188
+ // =========================================================================
189
+ // Operation 3: reallocateCollateral — reallocate from existing loan
190
+ // =========================================================================
191
+ function reallocateCollateral(uint256 seed) public useActor {
192
+ if (callCount_payAndBorrow == 0) return;
193
+
194
+ uint256 collateralPercentToTransfer = bound(seed, 1, 5000);
195
+ uint256 payAmount = bound(seed >> 8, 1 ether, 10 ether);
196
+ uint256 prepaidFee = bound(seed >> 16, 25, 500);
197
+
198
+ uint256 id = (REVNET_ID * 1_000_000_000_000) + callCount_payAndBorrow;
199
+
200
+ try IERC721(address(LOANS)).ownerOf(id) {}
201
+ catch {
202
+ return;
203
+ }
204
+
205
+ REVLoan memory latestLoan = LOANS.loanOf(id);
206
+ if (latestLoan.amount == 0) return;
207
+
208
+ vm.deal(USER, payAmount);
209
+ uint256 collateralToAdd =
210
+ TERMINAL.pay{value: payAmount}(REVNET_ID, JBConstants.NATIVE_TOKEN, 0, USER, 0, "", "");
211
+
212
+ uint256 collateralToTransfer = mulDiv(latestLoan.collateral, collateralPercentToTransfer, 10_000);
213
+ if (collateralToTransfer == 0) return;
214
+
215
+ uint256 newBorrowable = LOANS.borrowableAmountFrom(
216
+ REVNET_ID, collateralToTransfer + collateralToAdd, 18, uint32(uint160(JBConstants.NATIVE_TOKEN))
217
+ );
218
+
219
+ // Mock permission
220
+ mockExpect(
221
+ address(PERMS),
222
+ abi.encodeCall(IJBPermissions.hasPermission, (address(LOANS), USER, REVNET_ID, 11, true, true)),
223
+ abi.encode(true)
224
+ );
225
+
226
+ try LOANS.reallocateCollateralFromLoan(
227
+ id,
228
+ collateralToTransfer,
229
+ REVLoanSource({token: JBConstants.NATIVE_TOKEN, terminal: TERMINAL}),
230
+ newBorrowable,
231
+ collateralToAdd,
232
+ payable(USER),
233
+ prepaidFee
234
+ ) returns (
235
+ uint256, uint256, REVLoan memory, REVLoan memory newLoan
236
+ ) {
237
+ COLLATERAL_SUM += collateralToAdd;
238
+ BORROWED_SUM += newLoan.amount;
239
+ PAID_IN_SUM += payAmount;
240
+ ++callCount_reallocateCollateral;
241
+ } catch {}
242
+ }
243
+
244
+ // =========================================================================
245
+ // Operation 4: liquidateLoans — attempt liquidation
246
+ // =========================================================================
247
+ function liquidateLoans(uint256 seed) public {
248
+ if (callCount_payAndBorrow == 0) return;
249
+
250
+ uint256 count = bound(seed, 1, 5);
251
+ uint256 startingLoanId = (REVNET_ID * 1_000_000_000_000) + 1;
252
+
253
+ try LOANS.liquidateExpiredLoansFrom(REVNET_ID, startingLoanId, count) {} catch {}
254
+
255
+ ++callCount_liquidateLoans;
256
+ }
257
+
258
+ // =========================================================================
259
+ // Operation 5: advanceTime — warp 1 hour to 30 days
260
+ // =========================================================================
261
+ function advanceTime(uint256 seed) public {
262
+ uint256 hoursToWarp = bound(seed, 1, 720); // 1 hour to 30 days
263
+ vm.warp(block.timestamp + hoursToWarp * 1 hours);
264
+ ++callCount_advanceTime;
265
+ }
266
+
267
+ // =========================================================================
268
+ // Operation 6: payInto — pay without borrowing
269
+ // =========================================================================
270
+ function payInto(uint256 seed) public useActor {
271
+ uint256 payAmount = bound(seed, 0.01 ether, 2 ether);
272
+ vm.deal(USER, payAmount);
273
+
274
+ TERMINAL.pay{value: payAmount}(REVNET_ID, JBConstants.NATIVE_TOKEN, payAmount, USER, 0, "", "");
275
+
276
+ PAID_IN_SUM += payAmount;
277
+ ++callCount_payInto;
278
+ }
279
+
280
+ // =========================================================================
281
+ // Operation 7: cashOut — cash out held tokens
282
+ // =========================================================================
283
+ function cashOut(uint256 seed) public useActor {
284
+ IJBToken token = TOKENS.tokenOf(REVNET_ID);
285
+ uint256 balance = token.balanceOf(USER);
286
+ if (balance == 0) return;
287
+
288
+ uint256 cashOutCount = bound(seed, 1, balance);
289
+
290
+ // Need to advance past the 30-day cash out delay
291
+ // (only if not already past it)
292
+ try TERMINAL.cashOutTokensOf({
293
+ holder: USER,
294
+ projectId: REVNET_ID,
295
+ cashOutCount: cashOutCount,
296
+ tokenToReclaim: JBConstants.NATIVE_TOKEN,
297
+ minTokensReclaimed: 0,
298
+ beneficiary: payable(USER),
299
+ metadata: ""
300
+ }) returns (
301
+ uint256 reclaimAmount
302
+ ) {
303
+ CASHED_OUT_SUM += reclaimAmount;
304
+ ++callCount_cashOut;
305
+ } catch {}
306
+ }
307
+
308
+ // =========================================================================
309
+ // Operation 8: addToBalance — donate to treasury (no mint)
310
+ // =========================================================================
311
+ function addToBalance(uint256 seed) public {
312
+ uint256 amount = bound(seed, 0.01 ether, 1 ether);
313
+ vm.deal(address(this), amount);
314
+
315
+ TERMINAL.addToBalanceOf{value: amount}(REVNET_ID, JBConstants.NATIVE_TOKEN, amount, false, "", "");
316
+
317
+ ADDED_TO_BALANCE_SUM += amount;
318
+ ++callCount_addToBalance;
319
+ }
320
+
321
+ // =========================================================================
322
+ // Operation 9: sendReservedTokens — trigger reserved distribution
323
+ // =========================================================================
324
+ function sendReservedTokens(uint256) public {
325
+ try CTRL.sendReservedTokensToSplitsOf(REVNET_ID) {} catch {}
326
+ ++callCount_sendReservedTokens;
327
+ }
328
+
329
+ // =========================================================================
330
+ // Operation 10: changeStage — warp to next stage boundary
331
+ // =========================================================================
332
+ function changeStage(uint256 seed) public {
333
+ uint256 target = bound(seed, 0, 2);
334
+
335
+ if (target == 0 && block.timestamp < stage1Start) {
336
+ vm.warp(stage1Start + 1);
337
+ } else if (target == 1 && block.timestamp < stage2Start) {
338
+ vm.warp(stage2Start + 1);
339
+ } else {
340
+ // Just advance a bit
341
+ vm.warp(block.timestamp + 30 days);
342
+ }
343
+
344
+ ++callCount_changeStage;
345
+ }
346
+
347
+ // =========================================================================
348
+ // Helpers
349
+ // =========================================================================
350
+ function totalOperations() public view returns (uint256) {
351
+ return callCount_payAndBorrow + callCount_repayLoan + callCount_reallocateCollateral + callCount_liquidateLoans
352
+ + callCount_advanceTime + callCount_payInto + callCount_cashOut + callCount_addToBalance
353
+ + callCount_sendReservedTokens + callCount_changeStage;
354
+ }
355
+
356
+ receive() external payable {}
357
+ }