@rev-net/core-v6 0.0.13 → 0.0.15

package/CHANGE_LOG.md

@@ -253,6 +253,7 @@ The following structs are identical between v5 and v6 (only `forge-lint` comment
 | **Deploy ordering** | v6 `_deploy721RevnetFor` deploys the revnet first via `_deployRevnetFor`, then deploys the 721 hook and sets split operator permissions. v5 deployed the 721 hook then called `_deployRevnetFor`. |
 | **Croptop `maximumSplitPercent`** | v6 passes the new `maximumSplitPercent` field from `REVCroptopAllowedPost` to `CTAllowedPost`. |
 | **Auto-initialized buyback pools** | During deployment, `_tryInitializeBuybackPoolFor` is called for every terminal token to set up Uniswap V4 buyback pools at a generic 1:1 `sqrtPriceX96`. Failures (e.g., pool already initialized) are silently caught via try-catch. |
+| **Feeless beneficiary cashout routing** | `beforeCashOutRecordedWith` now checks `context.beneficiaryIsFeeless` and skips the 2.5% revnet fee when the cashout is routed by a feeless address (e.g., the router terminal routing value between projects). v5 did not have this check. The cash out tax rate still applies -- only the protocol fee is waived. |
 
 ### 6.2 REVLoans
 
@@ -271,7 +272,11 @@ The following structs are identical between v5 and v6 (only `forge-lint` comment
 | **Liquidation cleanup** | v6 adds `delete _loanOf[loanId]` after burning a liquidated loan, clearing stale loan data for a gas refund. v5 did not clean up the loan data. |
 | **`_totalBorrowedFrom` decimal normalization** | v6 normalizes token amounts from the source's native decimals to the target decimals before currency conversion. v5 did not perform decimal normalization, which could cause mixed-decimal arithmetic errors for tokens with non-18 decimals (e.g., USDC with 6 decimals). |
 | **`_totalBorrowedFrom` zero-price safety** | v6 skips sources with a zero price to prevent division-by-zero panics that would DoS all loan operations. v5 did not handle this case. |
-| **`_determineSourceFeeAmount` boundary** | v6 uses `>=` for the liquidation check (`timeSinceLoanCreated >= LOAN_LIQUIDATION_DURATION`). v5 used `>`. This means v6 considers a loan expired exactly at the boundary, while v5 allowed one more second. |
+| **`_determineSourceFeeAmount` boundary fix** | An intermediate v6 revision used `>=` for the liquidation check, which created a 1-second window where neither repay nor liquidate could execute. This was fixed back to `>` (matching v5) so the exact boundary second is still repayable, while the liquidation path uses `<=`. |
+| **BURN_TOKENS permission prerequisite (NatSpec only)** | `borrowFrom` documents via a `@dev` NatSpec comment that callers must first grant `BURN_TOKENS` permission to the loans contract via `JBPermissions.setPermissionsFor()`. This is required because collateral posting burns the caller's tokens through the controller. However, there is no runtime `hasPermission` check in `borrowFrom` itself -- if the permission is missing, the transaction will revert later inside `JBController.burnTokensOf`. v5 did not document this requirement. |
+| **Cross-revnet liquidation guard** | `liquidateExpiredLoansFrom` now validates that `startingLoanId + count` does not exceed `_ONE_TRILLION`, preventing callers from overflowing into a different revnet's loan ID namespace via `_generateLoanId`. Reverts with `REVLoans_LoanIdOverflow()`. v5 did not have this bounds check. |
+| **Source fee try-catch hardening** | The source fee payment in `_adjust` is now wrapped in a try-catch block. If the source terminal's `pay` call reverts, the ERC-20 allowance is reclaimed and the fee amount is returned to the beneficiary instead of blocking the entire loan operation. v5 called `terminal.pay` directly without error handling. |
+| **Timestamp cast fix** | `borrowFrom` now casts `block.timestamp` to `uint48` when setting `loan.createdAt`, matching the `REVLoan.createdAt` field width. v5 used `uint40`, which would silently truncate timestamps after the year 36812. |
 | **`ReallocateCollateral` event typo fix** | v5 used `removedcollateralCount` (lowercase 'c'). v6 fixes it to `removedCollateralCount` (uppercase 'C'). |
 | **NatSpec documentation** | Extensive NatSpec added to all functions, views, and internal helpers. Flash loan safety analysis documented in `_borrowableAmountFrom`. |
 
@@ -294,8 +299,8 @@ Throughout the codebase, function calls were updated to use named argument synta
 
 | v5 | v6 | Notes |
 |----|----|-------|
-| `REVDeployer` | `REVDeployer` | Buyback hook architecture changed from per-revnet mapping to immutable registry. Loans changed from per-revnet to single immutable. Deploy functions consolidated. Every revnet gets a 721 hook. 721 permission flags inverted. `beforePayRecordedWith` rewritten for split-aware weight scaling. `burnHeldTokensOf` added. Split operator gains 3 new default permissions. |
-| `REVLoans` | `REVLoans` | Deployer dependency removed. Terminal validation replaces deployer ownership check. `numberOfLoansFor` renamed. `reallocateCollateralFromLoan` not payable. Source mismatch, zero borrow, and nothing-to-repay checks added. Liquidation loop uses `continue` instead of `break`. Stale loan data cleaned up on liquidation. Decimal normalization and zero-price safety in `_totalBorrowedFrom`. |
+| `REVDeployer` | `REVDeployer` | Buyback hook architecture changed from per-revnet mapping to immutable registry. Loans changed from per-revnet to single immutable. Deploy functions consolidated. Every revnet gets a 721 hook. 721 permission flags inverted. `beforePayRecordedWith` rewritten for split-aware weight scaling. `burnHeldTokensOf` added. Split operator gains 3 new default permissions (`SET_BUYBACK_HOOK`, `SET_ROUTER_TERMINAL`, `SET_TOKEN_METADATA`). Feeless beneficiary cashout routing skips fee for feeless addresses. |
+| `REVLoans` | `REVLoans` | Deployer dependency removed. Terminal validation replaces deployer ownership check. `numberOfLoansFor` renamed. `reallocateCollateralFromLoan` not payable. Source mismatch, zero borrow, and nothing-to-repay checks added. BURN_TOKENS permission requirement documented via NatSpec (no runtime check). Cross-revnet liquidation guard prevents loan ID namespace overflow. Liquidation loop uses `continue` instead of `break`. Stale loan data cleaned up on liquidation. Decimal normalization and zero-price safety in `_totalBorrowedFrom`. Source fee payment wrapped in try-catch. Timestamp cast fixed from `uint40` to `uint48`. |
 
 ### Structs
 

package/SKILLS.md

@@ -157,7 +157,7 @@ Deploy and manage Revnets -- autonomous, unowned Juicebox projects with staged i
 17. **Loan fee model.** Three layers: (1) REV protocol fee (1%) taken when funds pulled, (2) terminal fee (2.5%) charged by `useAllowanceOf`, (3) prepaid source fee (2.5%-50%, borrower-chosen) that buys an interest-free window. After the prepaid window, time-proportional source fee accrues linearly over the remaining 10-year loan duration.
 18. **Permit2 fallback.** `REVLoans` uses permit2 for ERC-20 transfers as a fallback when standard allowance is insufficient. Wrapped in try-catch.
 19. **39.16% cash-out tax crossover.** Below ~39% cash-out tax, cashing out is more capital-efficient than borrowing. Above ~39%, loans become more efficient because they preserve upside while providing liquidity. Based on CryptoEconLab academic research. Design implication: revnets intended for active token trading should consider this threshold when setting `cashOutTaxRate`.
-20. **REVDeployer always deploys a 721 hook** via `HOOK_DEPLOYER.deployHookFor` — even if `baseline721HookConfiguration` has empty tiers. This is correct by design: it lets the split operator add and sell NFTs later without migration. Non-revnet projects should follow the same pattern by using `JB721TiersHookProjectDeployer.launchProjectFor` (or `JBOmnichainDeployer.launch721ProjectFor`) instead of bare `launchProjectFor`.
+20. **REVDeployer always deploys a 721 hook** via `HOOK_DEPLOYER.deployHookFor` — even if `baseline721HookConfiguration` has empty tiers. This is correct by design: it lets the split operator add and sell NFTs later without migration. Non-revnet projects should follow the same pattern by using `JB721TiersHookProjectDeployer.launchProjectFor` (or `JBOmnichainDeployer.launchProjectFor`) instead of bare `launchProjectFor`.
 
 ### NATIVE_TOKEN Accounting on Non-ETH Chains
 

package/foundry.toml

@@ -14,6 +14,13 @@ runs = 1024
 depth = 100
 fail_on_revert = false
 
+[profile.ci.fuzz]
+runs = 256
+
+[profile.ci.invariant]
+runs = 64
+depth = 50
+
 [lint]
 lint_on_build = false
 

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@rev-net/core-v6",
-    "version": "0.0.13",
+    "version": "0.0.15",
     "license": "MIT",
     "repository": {
         "type": "git",
@@ -10,7 +10,6 @@
         "node": ">=20.0.0"
     },
     "scripts": {
-        "postinstall": "find node_modules -name '*.sol' -type f | xargs grep -l 'pragma solidity 0.8.23;' 2>/dev/null | xargs sed -i '' 's/pragma solidity 0.8.23;/pragma solidity 0.8.26;/g' 2>/dev/null || true",
         "test": "forge test",
         "coverage": "forge coverage --match-path \"./src/*.sol\" --report lcov --report summary",
         "deploy:mainnets": "source ./.env && export START_TIME=$(date +%s) && npx sphinx propose ./script/Deploy.s.sol --networks mainnets",
@@ -20,14 +19,14 @@
         "artifacts": "source ./.env && npx sphinx artifacts --org-id 'ea165b21-7cdc-4d7b-be59-ecdd4c26bee4' --project-name 'revnet-core-v6'"
     },
     "dependencies": {
-        "@bananapus/721-hook-v6": "^0.0.17",
-        "@bananapus/buyback-hook-v6": "^0.0.13",
-        "@bananapus/core-v6": "^0.0.17",
-        "@bananapus/ownable-v6": "^0.0.10",
+        "@bananapus/721-hook-v6": "^0.0.19",
+        "@bananapus/buyback-hook-v6": "^0.0.16",
+        "@bananapus/core-v6": "^0.0.24",
+        "@bananapus/ownable-v6": "^0.0.12",
         "@bananapus/permission-ids-v6": "^0.0.10",
-        "@bananapus/router-terminal-v6": "^0.0.13",
-        "@bananapus/suckers-v6": "^0.0.11",
-        "@croptop/core-v6": "^0.0.18",
+        "@bananapus/router-terminal-v6": "^0.0.16",
+        "@bananapus/suckers-v6": "^0.0.13",
+        "@croptop/core-v6": "^0.0.20",
         "@openzeppelin/contracts": "^5.6.1",
         "@uniswap/v4-core": "^1.0.2",
         "@uniswap/v4-periphery": "^1.0.3"

package/src/REVDeployer.sol

@@ -271,18 +271,19 @@ contract REVDeployer is ERC2771Context, IREVDeployer, IJBRulesetDataHook, IJBCas
         IJBTerminal feeTerminal = DIRECTORY.primaryTerminalOf({projectId: FEE_REVNET_ID, token: context.surplus.token});
 
         // If there's no cash out tax (100% cash out tax rate), if there's no fee terminal, or if the beneficiary is
-        // feeless (e.g. the router terminal routing value between projects), do not charge a fee.
+        // feeless (e.g. the router terminal routing value between projects), proxy directly to the buyback hook.
         if (context.cashOutTaxRate == 0 || address(feeTerminal) == address(0) || context.beneficiaryIsFeeless) {
-            return (context.cashOutTaxRate, context.cashOutCount, context.totalSupply, hookSpecifications);
+            // slither-disable-next-line unused-return
+            return BUYBACK_HOOK.beforeCashOutRecordedWith(context);
         }
 
-        // Get a reference to the number of tokens being used to pay the fee (out of the total being cashed out).
+        // Split the cashed-out tokens into a fee portion and a non-fee portion.
         // Micro cash outs (< 40 wei at 2.5% fee) round feeCashOutCount to zero, bypassing the fee.
         // Economically insignificant: the gas cost of the transaction far exceeds the bypassed fee. No fix needed.
         uint256 feeCashOutCount = mulDiv({x: context.cashOutCount, y: FEE, denominator: JBConstants.MAX_FEE});
         uint256 nonFeeCashOutCount = context.cashOutCount - feeCashOutCount;
 
-        // Keep a reference to the amount claimable with non-fee tokens.
+        // Calculate how much surplus the non-fee tokens can reclaim via the bonding curve.
         uint256 postFeeReclaimedAmount = JBCashOuts.cashOutFrom({
             surplus: context.surplus.value,
             cashOutCount: nonFeeCashOutCount,
@@ -290,7 +291,7 @@ contract REVDeployer is ERC2771Context, IREVDeployer, IJBRulesetDataHook, IJBCas
             cashOutTaxRate: context.cashOutTaxRate
         });
 
-        // Keep a reference to the fee amount after the reclaimed amount is subtracted.
+        // Calculate how much the fee tokens reclaim from the remaining surplus after the non-fee reclaim.
         uint256 feeAmount = JBCashOuts.cashOutFrom({
             surplus: context.surplus.value - postFeeReclaimedAmount,
             cashOutCount: feeCashOutCount,
@@ -298,15 +299,36 @@ contract REVDeployer is ERC2771Context, IREVDeployer, IJBRulesetDataHook, IJBCas
             cashOutTaxRate: context.cashOutTaxRate
         });
 
-        // Assemble a cash out hook specification to invoke `afterCashOutRecordedWith(…)` with, to process the fee.
-        hookSpecifications = new JBCashOutHookSpecification[](1);
-        hookSpecifications[0] = JBCashOutHookSpecification({
-            hook: IJBCashOutHook(address(this)), amount: feeAmount, metadata: abi.encode(feeTerminal)
+        // Build a context for the buyback hook using only the non-fee token count.
+        JBBeforeCashOutRecordedContext memory buybackHookContext = context;
+        buybackHookContext.cashOutCount = nonFeeCashOutCount;
+
+        // Let the buyback hook adjust the cash out parameters and optionally return a hook specification.
+        JBCashOutHookSpecification[] memory buybackHookSpecifications;
+        (cashOutTaxRate, cashOutCount, totalSupply, buybackHookSpecifications) =
+            BUYBACK_HOOK.beforeCashOutRecordedWith(buybackHookContext);
+
+        // If the fee rounds down to zero, return the buyback hook's response directly — no fee to process.
+        if (feeAmount == 0) return (cashOutTaxRate, cashOutCount, totalSupply, buybackHookSpecifications);
+
+        // Build a hook spec that routes the fee amount to this contract's `afterCashOutRecordedWith` for processing.
+        JBCashOutHookSpecification memory feeSpec = JBCashOutHookSpecification({
+            hook: IJBCashOutHook(address(this)), noop: false, amount: feeAmount, metadata: abi.encode(feeTerminal)
         });
 
-        // Return the cash out rate and the number of revnet tokens to cash out, minus the tokens being used to pay the
-        // fee.
-        return (context.cashOutTaxRate, nonFeeCashOutCount, context.totalSupply, hookSpecifications);
+        // Compose the final hook specifications: buyback spec (if any) + fee spec.
+        if (buybackHookSpecifications.length > 0) {
+            // The buyback hook returned a spec — include it before the fee spec.
+            hookSpecifications = new JBCashOutHookSpecification[](2);
+            hookSpecifications[0] = buybackHookSpecifications[0];
+            hookSpecifications[1] = feeSpec;
+        } else {
+            // No buyback spec — only the fee spec.
+            hookSpecifications = new JBCashOutHookSpecification[](1);
+            hookSpecifications[0] = feeSpec;
+        }
+
+        return (cashOutTaxRate, cashOutCount, totalSupply, hookSpecifications);
     }
 
     /// @notice Before a revnet processes an incoming payment, determine the weight and pay hooks to use.

package/src/REVLoans.sol

@@ -339,11 +339,7 @@ contract REVLoans is ERC721, ERC2771Context, Ownable, IREVLoans {
 
         // Get the surplus of all the revnet's terminals in terms of the native currency.
         uint256 totalSurplus = JBSurplus.currentSurplusOf({
-            projectId: revnetId,
-            terminals: terminals,
-            accountingContexts: new JBAccountingContext[](0),
-            decimals: decimals,
-            currency: currency
+            projectId: revnetId, terminals: terminals, tokens: new address[](0), decimals: decimals, currency: currency
         });
 
         // Get the total amount the revnet currently has loaned out, in terms of the native currency with 18

package/test/REVDeployerRegressions.t.sol

@@ -138,7 +138,8 @@ contract REVDeployerRegressions is TestBaseWorkflow {
         assertEq(correctIndex, 0, "buyback hook should use index 0 when no tiered hook");
 
         // Write to the correct index (no revert)
-        specs[correctIndex] = JBPayHookSpecification({hook: IJBPayHook(address(0xbeef)), amount: 1 ether, metadata: ""});
+        specs[correctIndex] =
+            JBPayHookSpecification({hook: IJBPayHook(address(0xbeef)), noop: false, amount: 1 ether, metadata: ""});
     }
 
     /// @notice Verify both hooks present works fine (no OOB).
@@ -150,8 +151,10 @@ contract REVDeployerRegressions is TestBaseWorkflow {
         assertEq(arraySize, 2, "array should be size 2");
 
         JBPayHookSpecification[] memory specs = new JBPayHookSpecification[](arraySize);
-        specs[0] = JBPayHookSpecification({hook: IJBPayHook(address(0xdead)), amount: 1 ether, metadata: ""});
-        specs[1] = JBPayHookSpecification({hook: IJBPayHook(address(0xbeef)), amount: 2 ether, metadata: ""});
+        specs[0] =
+            JBPayHookSpecification({hook: IJBPayHook(address(0xdead)), noop: false, amount: 1 ether, metadata: ""});
+        specs[1] =
+            JBPayHookSpecification({hook: IJBPayHook(address(0xbeef)), noop: false, amount: 2 ether, metadata: ""});
     }
 
     //*********************************************************************//

package/test/REVInvincibility.t.sol

@@ -368,7 +368,8 @@ contract REVInvincibility_PropertyTests is TestBaseWorkflow {
 
         // Verify safe write
         JBPayHookSpecification[] memory specs = new JBPayHookSpecification[](arraySize);
-        specs[correctIndex] = JBPayHookSpecification({hook: IJBPayHook(address(0xbeef)), amount: 1 ether, metadata: ""});
+        specs[correctIndex] =
+            JBPayHookSpecification({hook: IJBPayHook(address(0xbeef)), noop: false, amount: 1 ether, metadata: ""});
     }
 
     /// @notice Reentrancy — _adjust calls terminal.pay() BEFORE writing loan state.
@@ -909,12 +910,8 @@ contract REVInvincibility_PropertyTests is TestBaseWorkflow {
         // Record fee project balance before cash-out
         uint256 feeBalanceBefore;
         {
-            JBAccountingContext[] memory feeCtx = new JBAccountingContext[](1);
-            feeCtx[0] = JBAccountingContext({
-                token: JBConstants.NATIVE_TOKEN, decimals: 18, currency: uint32(uint160(JBConstants.NATIVE_TOKEN))
-            });
             feeBalanceBefore = jbMultiTerminal()
-                .currentSurplusOf(FEE_PROJECT_ID, feeCtx, 18, uint32(uint160(JBConstants.NATIVE_TOKEN)));
+                .currentSurplusOf(FEE_PROJECT_ID, new address[](0), 18, uint32(uint160(JBConstants.NATIVE_TOKEN)));
         }
 
         // Cash out
@@ -935,12 +932,8 @@ contract REVInvincibility_PropertyTests is TestBaseWorkflow {
             // because both the terminal fee AND the revnet fee route to it
             uint256 feeBalanceAfter;
             {
-                JBAccountingContext[] memory feeCtx = new JBAccountingContext[](1);
-                feeCtx[0] = JBAccountingContext({
-                    token: JBConstants.NATIVE_TOKEN, decimals: 18, currency: uint32(uint160(JBConstants.NATIVE_TOKEN))
-                });
                 feeBalanceAfter = jbMultiTerminal()
-                    .currentSurplusOf(FEE_PROJECT_ID, feeCtx, 18, uint32(uint160(JBConstants.NATIVE_TOKEN)));
+                    .currentSurplusOf(FEE_PROJECT_ID, new address[](0), 18, uint32(uint160(JBConstants.NATIVE_TOKEN)));
             }
 
             // Fee project should have received fees from the cash-out
@@ -1206,13 +1199,8 @@ contract REVInvincibility_Invariants is StdInvariant, TestBaseWorkflow {
     function invariant_REV_1_surplusCoversLoans() public {
         uint256 totalBorrowed = LOANS_CONTRACT.totalBorrowedFrom(REVNET_ID, jbMultiTerminal(), JBConstants.NATIVE_TOKEN);
 
-        JBAccountingContext[] memory ctxArray = new JBAccountingContext[](1);
-        ctxArray[0] = JBAccountingContext({
-            token: JBConstants.NATIVE_TOKEN, decimals: 18, currency: uint32(uint160(JBConstants.NATIVE_TOKEN))
-        });
-
-        uint256 storeBalance =
-            jbMultiTerminal().currentSurplusOf(REVNET_ID, ctxArray, 18, uint32(uint160(JBConstants.NATIVE_TOKEN)));
+        uint256 storeBalance = jbMultiTerminal()
+            .currentSurplusOf(REVNET_ID, new address[](0), 18, uint32(uint160(JBConstants.NATIVE_TOKEN)));
 
         // Note: storeBalance is surplus (after payout limits), but the terminal holds at least this much
         // The total borrowed should not exceed what the terminal can cover

package/test/REVLoansAttacks.t.sol

@@ -42,6 +42,8 @@ import {JBAddressRegistry} from "@bananapus/address-registry-v6/src/JBAddressReg
 import {IJBAddressRegistry} from "@bananapus/address-registry-v6/src/interfaces/IJBAddressRegistry.sol";
 import {REVEmpty721Config} from "./helpers/REVEmpty721Config.sol";
 import {ERC165} from "@openzeppelin/contracts/utils/introspection/ERC165.sol";
+import {JBRuleset} from "@bananapus/core-v6/src/structs/JBRuleset.sol";
+import {JBPayHookSpecification} from "@bananapus/core-v6/src/structs/JBPayHookSpecification.sol";
 
 /// @notice A malicious terminal that re-enters REVLoans during fee payment in _adjust().
 /// @dev Reentrancy during pay() callback in _adjust.
@@ -128,17 +130,7 @@ contract ReentrantTerminal is ERC165, IJBPayoutTerminal {
         override
     {}
 
-    function currentSurplusOf(
-        uint256,
-        JBAccountingContext[] memory,
-        uint256,
-        uint256
-    )
-        external
-        pure
-        override
-        returns (uint256)
-    {
+    function currentSurplusOf(uint256, address[] calldata, uint256, uint256) external pure override returns (uint256) {
         return 0;
     }
 
@@ -168,6 +160,22 @@ contract ReentrantTerminal is ERC165, IJBPayoutTerminal {
         return 0;
     }
 
+    function previewPayFor(
+        uint256,
+        address,
+        uint256,
+        address,
+        bytes calldata
+    )
+        external
+        pure
+        override
+        returns (JBRuleset memory, uint256, uint256, JBPayHookSpecification[] memory)
+    {
+        JBRuleset memory ruleset;
+        return (ruleset, 0, 0, new JBPayHookSpecification[](0));
+    }
+
     function supportsInterface(bytes4 interfaceId) public view override(ERC165, IERC165) returns (bool) {
         return interfaceId == type(IJBTerminal).interfaceId || interfaceId == type(IJBPayoutTerminal).interfaceId
             || super.supportsInterface(interfaceId);

package/test/REVLoansFeeRecovery.t.sol

@@ -42,6 +42,8 @@ import {JB721TiersHookStore} from "@bananapus/721-hook-v6/src/JB721TiersHookStor
 import {JBAddressRegistry} from "@bananapus/address-registry-v6/src/JBAddressRegistry.sol";
 import {IJBAddressRegistry} from "@bananapus/address-registry-v6/src/interfaces/IJBAddressRegistry.sol";
 import {ERC165} from "@openzeppelin/contracts/utils/introspection/ERC165.sol";
+import {JBRuleset} from "@bananapus/core-v6/src/structs/JBRuleset.sol";
+import {JBPayHookSpecification} from "@bananapus/core-v6/src/structs/JBPayHookSpecification.sol";
 import {REVEmpty721Config} from "./helpers/REVEmpty721Config.sol";
 
 /// @notice A terminal mock that always reverts on pay(), used to simulate fee payment failure.
@@ -87,17 +89,7 @@ contract RevertingFeeTerminal is ERC165, IJBPayoutTerminal {
         override
     {}
 
-    function currentSurplusOf(
-        uint256,
-        JBAccountingContext[] memory,
-        uint256,
-        uint256
-    )
-        external
-        pure
-        override
-        returns (uint256)
-    {
+    function currentSurplusOf(uint256, address[] calldata, uint256, uint256) external pure override returns (uint256) {
         return 0;
     }
 
@@ -127,6 +119,22 @@ contract RevertingFeeTerminal is ERC165, IJBPayoutTerminal {
         return 0;
     }
 
+    function previewPayFor(
+        uint256,
+        address,
+        uint256,
+        address,
+        bytes calldata
+    )
+        external
+        pure
+        override
+        returns (JBRuleset memory, uint256, uint256, JBPayHookSpecification[] memory)
+    {
+        JBRuleset memory ruleset;
+        return (ruleset, 0, 0, new JBPayHookSpecification[](0));
+    }
+
     function supportsInterface(bytes4 interfaceId) public view override(ERC165, IERC165) returns (bool) {
         return interfaceId == type(IJBTerminal).interfaceId || interfaceId == type(IJBPayoutTerminal).interfaceId
             || super.supportsInterface(interfaceId);

package/test/REVLoansFindings.t.sol

@@ -42,6 +42,8 @@ import {JB721TiersHook} from "@bananapus/721-hook-v6/src/JB721TiersHook.sol";
 import {JB721TiersHookStore} from "@bananapus/721-hook-v6/src/JB721TiersHookStore.sol";
 import {JBAddressRegistry} from "@bananapus/address-registry-v6/src/JBAddressRegistry.sol";
 import {IJBAddressRegistry} from "@bananapus/address-registry-v6/src/interfaces/IJBAddressRegistry.sol";
+import {JBRuleset} from "@bananapus/core-v6/src/structs/JBRuleset.sol";
+import {JBPayHookSpecification} from "@bananapus/core-v6/src/structs/JBPayHookSpecification.sol";
 import {REVEmpty721Config} from "./helpers/REVEmpty721Config.sol";
 
 /// @notice A fake terminal that returns garbage accounting contexts.
@@ -91,17 +93,7 @@ contract GarbageTerminal is ERC165, IJBPayoutTerminal {
         override
     {}
 
-    function currentSurplusOf(
-        uint256,
-        JBAccountingContext[] memory,
-        uint256,
-        uint256
-    )
-        external
-        pure
-        override
-        returns (uint256)
-    {
+    function currentSurplusOf(uint256, address[] calldata, uint256, uint256) external pure override returns (uint256) {
         return 0;
     }
 
@@ -130,6 +122,22 @@ contract GarbageTerminal is ERC165, IJBPayoutTerminal {
         return 0;
     }
 
+    function previewPayFor(
+        uint256,
+        address,
+        uint256,
+        address,
+        bytes calldata
+    )
+        external
+        pure
+        override
+        returns (JBRuleset memory, uint256, uint256, JBPayHookSpecification[] memory)
+    {
+        JBRuleset memory ruleset;
+        return (ruleset, 0, 0, new JBPayHookSpecification[](0));
+    }
+
     function supportsInterface(bytes4 interfaceId) public view override(ERC165, IERC165) returns (bool) {
         return interfaceId == type(IJBTerminal).interfaceId || interfaceId == type(IJBPayoutTerminal).interfaceId
             || super.supportsInterface(interfaceId);

package/test/REVLoansRegressions.t.sol

@@ -38,6 +38,8 @@ import {JB721TiersHookStore} from "@bananapus/721-hook-v6/src/JB721TiersHookStor
 import {JBAddressRegistry} from "@bananapus/address-registry-v6/src/JBAddressRegistry.sol";
 import {IJBAddressRegistry} from "@bananapus/address-registry-v6/src/interfaces/IJBAddressRegistry.sol";
 import {ERC165} from "@openzeppelin/contracts/utils/introspection/ERC165.sol";
+import {JBRuleset} from "@bananapus/core-v6/src/structs/JBRuleset.sol";
+import {JBPayHookSpecification} from "@bananapus/core-v6/src/structs/JBPayHookSpecification.sol";
 import {REVEmpty721Config} from "./helpers/REVEmpty721Config.sol";
 
 /// @notice A fake terminal that tracks whether useAllowanceOf was called.
@@ -92,17 +94,7 @@ contract FakeTerminal is ERC165, IJBPayoutTerminal {
         override
     {}
 
-    function currentSurplusOf(
-        uint256,
-        JBAccountingContext[] memory,
-        uint256,
-        uint256
-    )
-        external
-        pure
-        override
-        returns (uint256)
-    {
+    function currentSurplusOf(uint256, address[] calldata, uint256, uint256) external pure override returns (uint256) {
         return 0;
     }
 
@@ -131,6 +123,22 @@ contract FakeTerminal is ERC165, IJBPayoutTerminal {
         return 0;
     }
 
+    function previewPayFor(
+        uint256,
+        address,
+        uint256,
+        address,
+        bytes calldata
+    )
+        external
+        pure
+        override
+        returns (JBRuleset memory, uint256, uint256, JBPayHookSpecification[] memory)
+    {
+        JBRuleset memory ruleset;
+        return (ruleset, 0, 0, new JBPayHookSpecification[](0));
+    }
+
     function supportsInterface(bytes4 interfaceId) public view override(ERC165, IERC165) returns (bool) {
         return interfaceId == type(IJBTerminal).interfaceId || interfaceId == type(IJBPayoutTerminal).interfaceId
             || super.supportsInterface(interfaceId);

package/test/REVLoansSourced.t.sol

@@ -756,14 +756,6 @@ contract REVLoansSourcedTests is TestBaseWorkflow {
 
         uint256 balanceBefore = _balanceOf(token, USER);
 
-        // Ensure that the hook was called.
-        vm.expectCall(address(REV_DEPLOYER), abi.encode(REVDeployer.beforeCashOutRecordedWith.selector));
-
-        // It only adds itself as a `after` cashoutHook if there is a cashout tax rate.
-        if (cashOutTaxRate > 0) {
-            vm.expectCall(address(REV_DEPLOYER), abi.encode(REVDeployer.afterCashOutRecordedWith.selector));
-        }
-
         // Perform a cashout.
         vm.prank(USER);
         jbMultiTerminal().cashOutTokensOf(USER, revnetProjectId, tokensToCashout, token, 0, payable(USER), bytes(""));

package/test/TestCashOutCallerValidation.t.sol

@@ -22,8 +22,12 @@ import "@bananapus/suckers-v6/script/helpers/SuckerDeploymentLib.sol";
 import "@croptop/core-v6/script/helpers/CroptopDeploymentLib.sol";
 // forge-lint: disable-next-line(unaliased-plain-import)
 import "@bananapus/router-terminal-v6/script/helpers/RouterTerminalDeploymentLib.sol";
+import {JBCashOuts} from "@bananapus/core-v6/src/libraries/JBCashOuts.sol";
 import {JBConstants} from "@bananapus/core-v6/src/libraries/JBConstants.sol";
 import {JBAccountingContext} from "@bananapus/core-v6/src/structs/JBAccountingContext.sol";
+import {JBBeforeCashOutRecordedContext} from "@bananapus/core-v6/src/structs/JBBeforeCashOutRecordedContext.sol";
+import {JBCashOutHookSpecification} from "@bananapus/core-v6/src/structs/JBCashOutHookSpecification.sol";
+import {JBTokenAmount} from "@bananapus/core-v6/src/structs/JBTokenAmount.sol";
 import {MockERC20} from "@bananapus/core-v6/test/mock/MockERC20.sol";
 import {REVLoans} from "../src/REVLoans.sol";
 import {REVStageConfig, REVAutoIssuance} from "../src/structs/REVStageConfig.sol";
@@ -302,6 +306,76 @@ contract TestCashOutCallerValidation is TestBaseWorkflow {
         assertGt(feeBalanceAfter, feeBalanceBefore, "Fee project balance should increase from cash out fee");
     }
 
+    /// @notice Revnet cash-out fees and buyback sell-side specs are composed together.
+    function test_beforeCashOutRecordedWith_proxiesIntoBuybackAndAppendsFeeSpec() public {
+        bytes memory buybackMetadata = abi.encode(uint256(123));
+        MOCK_BUYBACK.configureCashOutResult({
+            cashOutTaxRate: JBConstants.MAX_CASH_OUT_TAX_RATE,
+            cashOutCount: 0,
+            totalSupply: 0,
+            hookAmount: 0,
+            hookMetadata: buybackMetadata
+        });
+
+        JBBeforeCashOutRecordedContext memory context = JBBeforeCashOutRecordedContext({
+            terminal: address(jbMultiTerminal()),
+            holder: USER,
+            projectId: REVNET_ID,
+            rulesetId: 0,
+            cashOutCount: 1000,
+            totalSupply: 10_000,
+            surplus: JBTokenAmount({
+                token: JBConstants.NATIVE_TOKEN,
+                value: 100 ether,
+                decimals: 18,
+                currency: uint32(uint160(JBConstants.NATIVE_TOKEN))
+            }),
+            useTotalSurplus: true,
+            cashOutTaxRate: 3000,
+            beneficiaryIsFeeless: false,
+            metadata: ""
+        });
+
+        (
+            uint256 cashOutTaxRate,
+            uint256 cashOutCount,
+            uint256 totalSupply,
+            JBCashOutHookSpecification[] memory hookSpecifications
+        ) = REV_DEPLOYER.beforeCashOutRecordedWith(context);
+
+        uint256 feeCashOutCount = context.cashOutCount * REV_DEPLOYER.FEE() / JBConstants.MAX_FEE;
+        uint256 nonFeeCashOutCount = context.cashOutCount - feeCashOutCount;
+        uint256 postFeeReclaimedAmount = JBCashOuts.cashOutFrom({
+            surplus: context.surplus.value,
+            cashOutCount: nonFeeCashOutCount,
+            totalSupply: context.totalSupply,
+            cashOutTaxRate: context.cashOutTaxRate
+        });
+        uint256 feeAmount = JBCashOuts.cashOutFrom({
+            surplus: context.surplus.value - postFeeReclaimedAmount,
+            cashOutCount: feeCashOutCount,
+            totalSupply: context.totalSupply - nonFeeCashOutCount,
+            cashOutTaxRate: context.cashOutTaxRate
+        });
+
+        assertEq(cashOutTaxRate, JBConstants.MAX_CASH_OUT_TAX_RATE, "Buyback cash out tax rate should be forwarded");
+        assertEq(cashOutCount, nonFeeCashOutCount, "Buyback should receive the non-fee cash out count");
+        assertEq(totalSupply, context.totalSupply, "Total supply should pass through");
+        assertEq(hookSpecifications.length, 2, "Buyback spec and revnet fee spec should both be returned");
+
+        assertEq(address(hookSpecifications[0].hook), address(MOCK_BUYBACK), "First hook spec should come from buyback");
+        assertEq(hookSpecifications[0].amount, 0, "Buyback sell-side spec should preserve its forwarded amount");
+        assertEq(hookSpecifications[0].metadata, buybackMetadata, "Buyback metadata should be preserved");
+
+        assertEq(address(hookSpecifications[1].hook), address(REV_DEPLOYER), "Second hook spec should charge fee");
+        assertEq(hookSpecifications[1].amount, feeAmount, "Fee spec amount should match the revnet fee math");
+        assertEq(
+            hookSpecifications[1].metadata,
+            abi.encode(jbMultiTerminal()),
+            "Fee spec metadata should encode the fee terminal"
+        );
+    }
+
     /// @notice Test that afterCashOutRecordedWith has no access control — anyone can call it.
     /// A non-terminal caller would just be donating their own funds as fees.
     function test_nonTerminalCaller_justDonatesOwnFunds() public {

package/test/TestLowFindings.t.sol

@@ -627,7 +627,9 @@ contract TestLowFindings is TestBaseWorkflow {
         assertEq(borrowable, 0, "Borrowable amount for 1 wei of collateral should be 0");
 
         // Mock the BURN permission (permission ID 11) for the loans contract.
-        mockExpect(
+        // Use vm.mockCall only (not mockExpect which also adds vm.expectCall) because
+        // borrowFrom reverts with REVLoans_ZeroBorrowAmount before the permission check is reached.
+        vm.mockCall(
             address(jbPermissions()),
             abi.encodeCall(IJBPermissions.hasPermission, (address(LOANS_CONTRACT), USER, revnetId, 11, true, true)),
             abi.encode(true)

package/test/TestMixedFixes.t.sol

@@ -240,14 +240,16 @@ contract TestMixedFixes is TestBaseWorkflow {
 
         REVLoan memory loan = LOANS_CONTRACT.loanOf(loanId);
 
-        // Warp to exactly LOAN_LIQUIDATION_DURATION after creation
-        vm.warp(loan.createdAt + LOANS_CONTRACT.LOAN_LIQUIDATION_DURATION());
+        // Warp to one second past LOAN_LIQUIDATION_DURATION after creation.
+        // The contract uses `>` (not `>=`) so the exact boundary is still repayable;
+        // we need to exceed the boundary by 1 second to trigger the revert.
+        vm.warp(loan.createdAt + LOANS_CONTRACT.LOAN_LIQUIDATION_DURATION() + 1);
 
-        // With the >= fix, this should revert because timeSinceLoanCreated == LOAN_LIQUIDATION_DURATION
+        // timeSinceLoanCreated > LOAN_LIQUIDATION_DURATION → revert
         vm.expectRevert(
             abi.encodeWithSelector(
                 REVLoans.REVLoans_LoanExpired.selector,
-                LOANS_CONTRACT.LOAN_LIQUIDATION_DURATION(),
+                LOANS_CONTRACT.LOAN_LIQUIDATION_DURATION() + 1,
                 LOANS_CONTRACT.LOAN_LIQUIDATION_DURATION()
             )
         );