@rev-net/core-v6 0.0.16 → 0.0.18

package/ARCHITECTURE.md

@@ -76,6 +76,7 @@ Cash Out → REVDeployer.beforeCashOutRecordedWith()
 ### Loan Flow
 ```
 Borrower → REVLoans.borrowFrom()
+  → Enforce cash-out delay if set (cross-chain deployment protection)
   → Burn borrower's revnet tokens as collateral
   → Calculate borrow amount from bonding curve value of collateral
   → Pull funds from treasury via USE_ALLOWANCE

package/AUDIT_INSTRUCTIONS.md

@@ -93,6 +93,7 @@ User cashes out via terminal
 ```
 Borrower calls REVLoans.borrowFrom()
   -> Prerequisite: caller must have granted BURN_TOKENS permission to REVLoans via JBPermissions
+  -> Enforce cash-out delay: resolve deployer from ruleset dataHook, check cashOutDelayOf(revnetId)
   -> Validate: collateral > 0, terminal registered, prepaidFeePercent in range
   -> Generate loan ID: revnetId * 1T + loanNumber
   -> Create loan in storage
@@ -332,6 +333,7 @@ No prior formal audit with finding IDs has been conducted on this codebase. All
 | `REVDeployer_StagesRequired` | REVDeployer | `deployFor` / `launchChainsFor` called with empty `stageConfigurations` array |
 | `REVDeployer_StageTimesMustIncrease` | REVDeployer | Stage `startsAtOrAfter` timestamps are not strictly increasing |
 | `REVDeployer_Unauthorized` | REVDeployer | Caller is not the split operator (for operator-gated functions) or not the project owner (for `launchChainsFor`) |
+| `REVLoans_CashOutDelayNotFinished` | REVLoans | `borrowFrom` called during the 30-day cash-out delay period (cross-chain deployment protection) |
 | `REVLoans_CollateralExceedsLoan` | REVLoans | `reallocateCollateralFromLoan` called with `collateralCountToReturn > loan.collateral` |
 | `REVLoans_InvalidPrepaidFeePercent` | REVLoans | `prepaidFeePercent` outside `[MIN_PREPAID_FEE_PERCENT, MAX_PREPAID_FEE_PERCENT]` range (25-500) |
 | `REVLoans_InvalidTerminal` | REVLoans | Loan source references a terminal not registered in `JBDirectory` for the revnet |
@@ -353,7 +355,7 @@ No prior formal audit with finding IDs has been conducted on this codebase. All
 
 ## Compiler and Version Info
 
-- **Solidity**: ^0.8.26
+- **Solidity**: 0.8.28
 - **EVM target**: Cancun
 - **Optimizer**: via-IR, 100 runs
 - **Dependencies**: OpenZeppelin 5.x, PRBMath, Permit2, nana-core-v6, nana-721-hook-v6, nana-buyback-hook-v6, nana-suckers-v6

package/CHANGE_LOG.md

@@ -1,6 +1,6 @@
 # revnet-core-v6 Changelog (v5 -> v6)
 
-This document describes all changes between `revnet-core` (v5, Solidity 0.8.23) and `revnet-core-v6` (v6, Solidity ^0.8.26).
+This document describes all changes between `revnet-core` (v5, Solidity 0.8.23) and `revnet-core-v6` (v6, Solidity 0.8.28).
 
 ## Summary
 
@@ -108,6 +108,7 @@ The boolean semantics are **inverted**: v5 used opt-in flags (`splitOperatorCan*
 | `REVLoans` | `REVLoans_NothingToRepay()` |
 | `REVLoans` | `REVLoans_ZeroBorrowAmount()` |
 | `REVLoans` | `REVLoans_SourceMismatch()` |
+| `REVLoans` | `REVLoans_CashOutDelayNotFinished(uint256 cashOutDelay, uint256 blockTimestamp)` |
 | `REVLoans` | `REVLoans_LoanIdOverflow()` |
 
 ### 2.4 New Constants
@@ -129,6 +130,13 @@ The boolean semantics are **inverted**: v5 used opt-in flags (`splitOperatorCan*
 
 ## 3. Event Changes
 
+### 3.0 Indexer Notes
+
+For revnet-focused subgraphs:
+- both deployment flows now correlate to `deployFor` rather than a split `deployFor`/`deployWith721sFor` model;
+- revnet deployment entities should expect an associated 721 hook by default;
+- any entity that previously depended on caller-supplied buyback-hook config should be updated for the v6 auto-configured buyback path.
+
 ### 3.1 Added Events
 
 See section 2.2 above.
@@ -245,7 +253,7 @@ The following structs are identical between v5 and v6 (only `forge-lint` comment
 
 | Change | Description |
 |--------|-------------|
-| **Solidity version** | Upgraded from `0.8.23` to `^0.8.26`. |
+| **Solidity version** | Upgraded from `0.8.23` to `0.8.28`. |
 | **Buyback hook architecture** | Per-revnet `buybackHookOf` mapping replaced with a single immutable `BUYBACK_HOOK` (`IJBBuybackHookRegistry`). Pools are auto-initialized for each terminal token during deployment via `_tryInitializeBuybackPoolFor`. |
 | **Loans architecture** | Per-revnet `loansOf` mapping replaced with a single immutable `LOANS` address. The deployer grants `USE_ALLOWANCE` permission to the loans contract for all revnets in the constructor (wildcard `revnetId=0`). |
 | **Constructor permissions** | v6 constructor grants three wildcard permissions: `MAP_SUCKER_TOKEN` to the sucker registry, `USE_ALLOWANCE` to the loans contract, and `SET_BUYBACK_POOL` to the buyback hook. v5 only granted `MAP_SUCKER_TOKEN`. |
@@ -270,7 +278,7 @@ The following structs are identical between v5 and v6 (only `forge-lint` comment
 
 | Change | Description |
 |--------|-------------|
-| **Solidity version** | Upgraded from `0.8.23` to `^0.8.26`. |
+| **Solidity version** | Upgraded from `0.8.23` to `0.8.28`. |
 | **Deployer dependency removed** | v5 stored `REVNETS` (`IREVDeployer`) and validated that the revnet was owned by the expected deployer via `RevnetsMismatch`. v6 does not reference the deployer at all. Validation now checks the terminal directly via `DIRECTORY.isTerminalOf`. |
 | **Constructor refactored** | v5 accepted `IREVDeployer revnets` and derived `CONTROLLER`, `DIRECTORY`, etc. from it. v6 accepts `IJBController controller` and `IJBProjects projects` directly. |
 | **Terminal validation** | `borrowFrom` now validates that the source terminal is registered in the directory for the revnet, reverting with `REVLoans_InvalidTerminal` if not. v5 validated deployer ownership instead. |
@@ -289,6 +297,7 @@ The following structs are identical between v5 and v6 (only `forge-lint` comment
 | **Source fee try-catch hardening** | The source fee payment in `_adjust` is now wrapped in a try-catch block. If the source terminal's `pay` call reverts, the ERC-20 allowance is reclaimed and the fee amount is returned to the beneficiary instead of blocking the entire loan operation. v5 called `terminal.pay` directly without error handling. |
 | **Timestamp cast fix** | `borrowFrom` now casts `block.timestamp` to `uint48` when setting `loan.createdAt`, matching the `REVLoan.createdAt` field width. v5 used `uint40`, which would silently truncate timestamps after the year 36812. |
 | **`ReallocateCollateral` event typo fix** | v5 used `removedcollateralCount` (lowercase 'c'). v6 fixes it to `removedCollateralCount` (uppercase 'C'). |
+| **Cash out delay enforced in loans** | `borrowFrom` now resolves the `REVDeployer` from the ruleset's `dataHook` and checks `cashOutDelayOf(revnetId)`. If the 30-day cross-chain deployment delay hasn't passed, `borrowFrom` reverts with `REVLoans_CashOutDelayNotFinished`. `borrowableAmountFrom` returns 0 during the delay so UIs reflect the restriction. v5 did not enforce the cash out delay in the loans contract. |
 | **NatSpec documentation** | Extensive NatSpec added to all functions, views, and internal helpers. Flash loan safety analysis documented in `_borrowableAmountFrom`. |
 
 ### 6.3 Named Arguments

package/RISKS.md

@@ -81,6 +81,10 @@ Read [ARCHITECTURE.md](./ARCHITECTURE.md) and [SKILLS.md](./SKILLS.md) for proto
 - **Source mismatch check.** `reallocateCollateralFromLoan` enforces that the new loan's source matches the existing loan's source (`source.token == existingSource.token && source.terminal == existingSource.terminal`). This prevents cross-source value extraction.
 - **MEV opportunity at stage boundaries.** If a borrower knows a stage transition will decrease `cashOutTaxRate`, they can wait until just after the transition and `reallocateCollateralFromLoan` to extract more borrowed funds from the same collateral. This is predictable and not preventable by design.
 
+### Cross-chain cash-out delay enforcement
+
+- **Loans enforce the same 30-day cash-out delay as direct cash outs.** When a revnet is deployed to a new chain where its first stage has already started, `REVDeployer._setCashOutDelayIfNeeded()` sets a 30-day delay. `borrowFrom` resolves the deployer from the current ruleset's `dataHook` and checks `cashOutDelayOf(revnetId)`, reverting with `REVLoans_CashOutDelayNotFinished` if the delay hasn't passed. `borrowableAmountFrom` returns 0 during the delay. This prevents cross-chain arbitrage via the loan system (bridging tokens to a new chain and immediately borrowing against them before prices equilibrate).
+
 ### BURN_TOKENS permission prerequisite
 
 - **Borrowers must grant BURN_TOKENS permission before calling `borrowFrom`.** The loans contract burns the caller's tokens as collateral via `JBController.burnTokensOf`, which requires the caller to have granted `BURN_TOKENS` permission to the loans contract for the revnet's project ID. Without this, the transaction reverts deep in `JBController` with `JBPermissioned_Unauthorized`. The prerequisite is documented in `borrowFrom`'s NatSpec.

package/SKILLS.md

@@ -47,7 +47,7 @@ Deploy and manage Revnets -- autonomous, unowned Juicebox projects with staged i
 
 | Function | Permissions | What it does |
 |----------|------------|-------------|
-| `REVLoans.borrowFrom(revnetId, source, minBorrowAmount, collateralCount, beneficiary, prepaidFeePercent)` | Permissionless (caller must grant BURN_TOKENS to REVLoans) | Open a loan: burn collateral tokens, pull funds from revnet via `useAllowanceOf`, pay REV fee (1%) + terminal fee (2.5%), transfer remainder to beneficiary, mint loan NFT. |
+| `REVLoans.borrowFrom(revnetId, source, minBorrowAmount, collateralCount, beneficiary, prepaidFeePercent)` | Permissionless (caller must grant BURN_TOKENS to REVLoans) | Open a loan: enforce cash-out delay if set (cross-chain deployment protection), burn collateral tokens, pull funds from revnet via `useAllowanceOf`, pay REV fee (1%) + terminal fee (2.5%), transfer remainder to beneficiary, mint loan NFT. |
 | `REVLoans.repayLoan(loanId, maxRepayBorrowAmount, collateralCountToReturn, beneficiary, allowance)` | Loan NFT owner | Repay fully or partially. Returns funds to revnet via `addToBalanceOf`, re-mints collateral tokens, burns/replaces the loan NFT. Supports permit2 signatures. |
 | `REVLoans.reallocateCollateralFromLoan(loanId, collateralCountToTransfer, source, minBorrowAmount, collateralCountToAdd, beneficiary, prepaidFeePercent)` | Loan NFT owner | Refinance: remove excess collateral from an existing loan and open a new loan with the freed collateral. Burns original, mints two replacements. |
 | `REVLoans.liquidateExpiredLoansFrom(revnetId, startingLoanId, count)` | Permissionless | Clean up loans past the 10-year liquidation duration. Burns NFTs and decrements accounting totals. Collateral is permanently lost. |
@@ -57,7 +57,7 @@ Deploy and manage Revnets -- autonomous, unowned Juicebox projects with staged i
 
 | Function | What it does |
 |----------|-------------|
-| `REVLoans.borrowableAmountFrom(revnetId, collateralCount, decimals, currency)` | Calculate how much can be borrowed for a given collateral amount. Aggregates surplus from all terminals, applies bonding curve. |
+| `REVLoans.borrowableAmountFrom(revnetId, collateralCount, decimals, currency)` | Calculate how much can be borrowed for a given collateral amount. Returns 0 during the cash-out delay period. Aggregates surplus from all terminals, applies bonding curve. |
 | `REVLoans.determineSourceFeeAmount(loan, amount)` | Calculate the time-proportional source fee for a loan repayment. Zero during prepaid window, linear accrual after. |
 | `REVLoans.loanOf(loanId)` | Returns the full `REVLoan` struct for a loan. |
 | `REVLoans.loanSourcesOf(revnetId)` | Returns all `(terminal, token)` pairs used for loans by a revnet. |
@@ -139,6 +139,7 @@ Deploy and manage Revnets -- autonomous, unowned Juicebox projects with staged i
 
 | Error | When It Fires |
 |-------|---------------|
+| `REVLoans_CashOutDelayNotFinished(cashOutDelay, blockTimestamp)` | When borrowing during the 30-day cash-out delay period (cross-chain deployment protection). |
 | `REVLoans_CollateralExceedsLoan(collateralToReturn, loanCollateral)` | When trying to return more collateral than the loan holds. |
 | `REVLoans_InvalidPrepaidFeePercent(prepaidFeePercent, min, max)` | When `prepaidFeePercent` is outside the allowed range (2.5%--50%). |
 | `REVLoans_InvalidTerminal(terminal, revnetId)` | When the specified terminal is not registered for the revnet. |
@@ -212,8 +213,8 @@ Deploy and manage Revnets -- autonomous, unowned Juicebox projects with staged i
 4. **Loan ID encoding.** `loanId = revnetId * 1_000_000_000_000 + loanNumber`. Each revnet supports ~1 trillion loans. Use `revnetIdOfLoanWith(loanId)` to decode.
 5. **uint112 truncation risk.** `REVLoan.amount` and `REVLoan.collateral` are `uint112`. Values above ~5.19e33 truncate silently.
 6. **Auto-issuance stage IDs.** Computed as `block.timestamp + i` during deployment. These match the Juicebox ruleset IDs because `JBRulesets` assigns IDs the same way (`latestId >= block.timestamp ? latestId + 1 : block.timestamp`), producing identical sequential IDs when all stages are queued in a single `deployFor()` call.
-7. **Cash-out fee stacking.** Cash outs incur both the Juicebox terminal fee (2.5%) and the revnet cash-out fee (2.5% to fee revnet). These compound.
-8. **30-day cash-out delay.** Applied when deploying an existing revnet to a new chain where the first stage has already started. Prevents cross-chain liquidity arbitrage.
+7. **Cash-out fee stacking.** Cash outs incur both the Juicebox terminal fee (2.5%) and the revnet cash-out fee (2.5% to fee revnet). These compound. The 2.5% fee is deducted from the TOKEN AMOUNT being cashed out, not from the reclaim value. 2.5% of the tokens are redirected to the fee revnet, which then redeems them at the bonding curve independently. The net reclaim to the caller is based on 97.5% of the tokens, not 97.5% of the computed ETH value. This is by design.
+8. **30-day cash-out delay.** Applied when deploying an existing revnet to a new chain where the first stage has already started. Prevents cross-chain liquidity arbitrage. Enforced in both `beforeCashOutRecordedWith` (direct cash outs) and `REVLoans.borrowFrom` / `borrowableAmountFrom` (loans). The delay is resolved via the ruleset's `dataHook` (the REVDeployer) and `cashOutDelayOf(revnetId)`.
 9. **`cashOutTaxRate` cannot be MAX.** Must be strictly less than `MAX_CASH_OUT_TAX_RATE` (10,000). Revnets cannot fully disable cash outs.
 10. **Split operator is singular.** Only ONE address can be split operator at a time. The operator can replace itself via `setSplitOperatorOf` but cannot delegate or multi-sig.
 11. **NATIVE_TOKEN on non-ETH chains.** `JBConstants.NATIVE_TOKEN` on Celo means CELO, on Polygon means MATIC -- not ETH. Use ERC-20 WETH instead. The config matching hash does NOT catch terminal configuration differences.

package/STYLE_GUIDE.md

@@ -21,7 +21,7 @@ One contract/interface/struct/enum per file. Name the file after the type it con
 
 ```solidity
 // Contracts — pin to exact version
-pragma solidity ^0.8.26;
+pragma solidity 0.8.28;
 
 // Interfaces, structs, enums — caret for forward compatibility
 pragma solidity ^0.8.0;
@@ -326,7 +326,7 @@ Standard config across all repos:
 
 ```toml
 [profile.default]
-solc = '0.8.26'
+solc = '0.8.28'
 evm_version = 'cancun'
 optimizer_runs = 200
 libs = ["node_modules", "lib"]

package/USER_JOURNEYS.md

@@ -163,6 +163,7 @@ This is a standard Juicebox payment, but REVDeployer intervenes as the data hook
 **Prerequisites:**
 - Caller must hold `collateralCount` revnet ERC-20 tokens
 - Caller must grant `BURN_TOKENS` permission to the REVLoans contract for the revnet's project ID via `JBPermissions.setPermissionsFor()`. Without this, the transaction reverts in `JBController.burnTokensOf` with `JBPermissioned_Unauthorized`.
+- The revnet's cash-out delay must have passed (if one was set during cross-chain deployment). `borrowableAmountFrom` returns 0 and `borrowFrom` reverts with `REVLoans_CashOutDelayNotFinished` until the 30-day delay expires.
 
 **Key parameters:**
 
@@ -181,6 +182,7 @@ This is a standard Juicebox payment, but REVDeployer intervenes as the data hook
    - `collateralCount > 0` (no zero-collateral loans)
    - `source.terminal` is registered for the revnet in the directory
    - `prepaidFeePercent` in range [25, 500]
+   - Cash-out delay has passed: resolves the `REVDeployer` from the current ruleset's `dataHook`, checks `cashOutDelayOf(revnetId)`. Reverts with `REVLoans_CashOutDelayNotFinished(cashOutDelay, block.timestamp)` if `cashOutDelay > block.timestamp`.
 2. **Loan ID generation:** `revnetId * 1_000_000_000_000 + (++totalLoansBorrowedFor[revnetId])`
 3. **Loan creation in storage:**
    - `source`, `createdAt = block.timestamp`, `prepaidFeePercent`, `prepaidDuration = mulDiv(prepaidFeePercent, 3650 days, 500)`
@@ -210,6 +212,7 @@ This is a standard Juicebox payment, but REVDeployer intervenes as the data hook
 - `prepaidDuration` at minimum (25): `25 * 3650 days / 500 = 182.5 days`. At maximum (500): `500 * 3650 days / 500 = 3650 days`.
 - Both the REV fee payment and the source fee payment failures are non-fatal. If either `feeTerminal.pay` or `source.terminal.pay` reverts, the fee amount is transferred to the beneficiary instead.
 - Loan NFT is minted to `_msgSender()`, not `beneficiary`. The caller owns the loan; the beneficiary receives the funds.
+- When a revnet deploys to a new chain with `startsAtOrAfter` in the past, `REVDeployer` sets a 30-day cash-out delay. Both `borrowFrom` and `borrowableAmountFrom` enforce this delay by resolving the deployer from the current ruleset's `dataHook` and checking `cashOutDelayOf`. This prevents cross-chain arbitrage via loans during the delay window.
 
 ---
 

package/foundry.toml

@@ -1,5 +1,5 @@
 [profile.default]
-solc = '0.8.26'
+solc = '0.8.28'
 evm_version = 'cancun'
 via_ir = true
 optimizer_runs = 100

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@rev-net/core-v6",
-    "version": "0.0.16",
+    "version": "0.0.18",
     "license": "MIT",
     "repository": {
         "type": "git",
@@ -19,14 +19,14 @@
         "artifacts": "source ./.env && npx sphinx artifacts --org-id 'ea165b21-7cdc-4d7b-be59-ecdd4c26bee4' --project-name 'revnet-core-v6'"
     },
     "dependencies": {
-        "@bananapus/721-hook-v6": "^0.0.20",
-        "@bananapus/buyback-hook-v6": "^0.0.19",
-        "@bananapus/core-v6": "^0.0.26",
-        "@bananapus/ownable-v6": "^0.0.13",
-        "@bananapus/permission-ids-v6": "^0.0.12",
-        "@bananapus/router-terminal-v6": "^0.0.19",
-        "@bananapus/suckers-v6": "^0.0.16",
-        "@croptop/core-v6": "^0.0.21",
+        "@bananapus/721-hook-v6": "^0.0.22",
+        "@bananapus/buyback-hook-v6": "^0.0.22",
+        "@bananapus/core-v6": "^0.0.28",
+        "@bananapus/ownable-v6": "^0.0.15",
+        "@bananapus/permission-ids-v6": "^0.0.14",
+        "@bananapus/router-terminal-v6": "^0.0.21",
+        "@bananapus/suckers-v6": "^0.0.18",
+        "@croptop/core-v6": "^0.0.23",
         "@openzeppelin/contracts": "^5.6.1",
         "@uniswap/v4-core": "^1.0.2",
         "@uniswap/v4-periphery": "^1.0.3"

package/script/Deploy.s.sol

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity ^0.8.26;
+pragma solidity 0.8.28;
 
 // forge-lint: disable-next-line(unaliased-plain-import)
 import "@bananapus/721-hook-v6/script/helpers/Hook721DeploymentLib.sol";
@@ -323,7 +323,6 @@ contract DeployScript is Script, Sphinx {
                     tiersConfig: JB721InitTiersConfig({
                         tiers: new JB721TierConfig[](0), currency: ETH_CURRENCY, decimals: 18
                     }),
-                    reserveBeneficiary: address(0),
                     flags: REV721TiersHookFlags({
                         noNewTiersWithReserves: false,
                         noNewTiersWithVotes: false,
@@ -459,21 +458,25 @@ contract DeployScript is Script, Sphinx {
                 trustedForwarder: TRUSTED_FORWARDER
             });
 
-        // Approve the basic deployer to configure the project.
-        core.projects.approve({to: address(_basicDeployer), tokenId: FEE_PROJECT_ID});
-
-        // Build the config.
-        FeeProjectConfig memory feeProjectConfig = getFeeProjectConfig();
-
-        // Configure the project.
-        _basicDeployer.deployFor({
-            revnetId: FEE_PROJECT_ID,
-            configuration: feeProjectConfig.configuration,
-            terminalConfigurations: feeProjectConfig.terminalConfigurations,
-            suckerDeploymentConfiguration: feeProjectConfig.suckerDeploymentConfiguration,
-            tiered721HookConfiguration: feeProjectConfig.tiered721HookConfiguration,
-            allowedPosts: feeProjectConfig.allowedPosts
-        });
+        // Only configure the fee project if singletons were freshly deployed. Re-running `deployFor` on an
+        // already-configured project would fail because the project is no longer blank.
+        if (!_singletonsExist) {
+            // Approve the basic deployer to configure the project.
+            core.projects.approve({to: address(_basicDeployer), tokenId: FEE_PROJECT_ID});
+
+            // Build the config.
+            FeeProjectConfig memory feeProjectConfig = getFeeProjectConfig();
+
+            // Configure the project.
+            _basicDeployer.deployFor({
+                revnetId: FEE_PROJECT_ID,
+                configuration: feeProjectConfig.configuration,
+                terminalConfigurations: feeProjectConfig.terminalConfigurations,
+                suckerDeploymentConfiguration: feeProjectConfig.suckerDeploymentConfiguration,
+                tiered721HookConfiguration: feeProjectConfig.tiered721HookConfiguration,
+                allowedPosts: feeProjectConfig.allowedPosts
+            });
+        }
     }
 
     /// @notice Check whether a contract has already been deployed at its deterministic address.

package/script/helpers/RevnetCoreDeploymentLib.sol

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity ^0.8.26;
+pragma solidity 0.8.28;
 
 import {stdJson} from "forge-std/Script.sol";
 import {Vm} from "forge-std/Vm.sol";

package/src/REVDeployer.sol

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity ^0.8.26;
+pragma solidity 0.8.28;
 
 import {IJB721TiersHook} from "@bananapus/721-hook-v6/src/interfaces/IJB721TiersHook.sol";
 import {IJB721TiersHookDeployer} from "@bananapus/721-hook-v6/src/interfaces/IJB721TiersHookDeployer.sol";
@@ -282,6 +282,9 @@ contract REVDeployer is ERC2771Context, IREVDeployer, IJBRulesetDataHook, IJBCas
         }
 
         // Split the cashed-out tokens into a fee portion and a non-fee portion.
+        // The fee is applied to TOKEN COUNT (2.5% of tokens), not to value. The fee revnet receives the bonding-curve
+        // reclaim of its 2.5% token share regardless of whether the remaining 97.5% routes through a buyback pool at
+        // a better price. This is by design.
         // Micro cash outs (< 40 wei at 2.5% fee) round feeCashOutCount to zero, bypassing the fee.
         // Economically insignificant: the gas cost of the transaction far exceeds the bypassed fee. No fix needed.
         uint256 feeCashOutCount = mulDiv({x: context.cashOutCount, y: FEE, denominator: JBConstants.MAX_FEE});
@@ -608,6 +611,7 @@ contract REVDeployer is ERC2771Context, IREVDeployer, IJBRulesetDataHook, IJBCas
             sqrtPriceX96 = uint160(1 << 96);
         } else {
             address normalizedTerminalToken = terminalToken == JBConstants.NATIVE_TOKEN ? address(0) : terminalToken;
+            // slither-disable-next-line calls-loop
             address projectToken = address(CONTROLLER.TOKENS().tokenOf(revnetId));
 
             if (projectToken == address(0) || projectToken == normalizedTerminalToken) {
@@ -955,7 +959,6 @@ contract REVDeployer is ERC2771Context, IREVDeployer, IJBRulesetDataHook, IJBCas
                 tokenUriResolver: tiered721HookConfiguration.baseline721HookConfiguration.tokenUriResolver,
                 contractUri: tiered721HookConfiguration.baseline721HookConfiguration.contractUri,
                 tiersConfig: tiered721HookConfiguration.baseline721HookConfiguration.tiersConfig,
-                reserveBeneficiary: tiered721HookConfiguration.baseline721HookConfiguration.reserveBeneficiary,
                 flags: JB721TiersHookFlags({
                     noNewTiersWithReserves: tiered721HookConfiguration.baseline721HookConfiguration.flags
                     .noNewTiersWithReserves,

package/src/REVLoans.sol

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity ^0.8.26;
+pragma solidity 0.8.28;
 
 import {Ownable} from "@openzeppelin/contracts/access/Ownable.sol";
 import {ERC2771Context} from "@openzeppelin/contracts/metatx/ERC2771Context.sol";
@@ -27,6 +27,7 @@ import {JBAccountingContext} from "@bananapus/core-v6/src/structs/JBAccountingCo
 import {JBRuleset} from "@bananapus/core-v6/src/structs/JBRuleset.sol";
 import {JBSingleAllowance} from "@bananapus/core-v6/src/structs/JBSingleAllowance.sol";
 
+import {IREVDeployer} from "./interfaces/IREVDeployer.sol";
 import {IREVLoans} from "./interfaces/IREVLoans.sol";
 import {REVLoan} from "./structs/REVLoan.sol";
 import {REVLoanSource} from "./structs/REVLoanSource.sol";
@@ -55,6 +56,7 @@ contract REVLoans is ERC721, ERC2771Context, Ownable, IREVLoans {
     // --------------------------- custom errors ------------------------- //
     //*********************************************************************//
 
+    error REVLoans_CashOutDelayNotFinished(uint256 cashOutDelay, uint256 blockTimestamp);
     error REVLoans_CollateralExceedsLoan(uint256 collateralToReturn, uint256 loanCollateral);
     error REVLoans_InvalidPrepaidFeePercent(uint256 prepaidFeePercent, uint256 min, uint256 max);
     error REVLoans_InvalidTerminal(address terminal, uint256 revnetId);
@@ -225,6 +227,22 @@ contract REVLoans is ERC721, ERC2771Context, Ownable, IREVLoans {
         view
         returns (uint256)
     {
+        // Get the current ruleset to resolve the deployer from its data hook.
+        // slither-disable-next-line unused-return
+        (JBRuleset memory currentRuleset,) = CONTROLLER.currentRulesetOf(revnetId);
+
+        // The ruleset's data hook is the REVDeployer that configured this revnet.
+        address deployer = currentRuleset.dataHook();
+
+        // Only check the delay if a deployer is set.
+        if (deployer != address(0)) {
+            // Get the timestamp after which cash outs (and loans) are allowed.
+            uint256 cashOutDelay = IREVDeployer(deployer).cashOutDelayOf(revnetId);
+
+            // If the delay hasn't passed yet, no amount is borrowable.
+            if (cashOutDelay > block.timestamp) return 0;
+        }
+
         return _borrowableAmountFrom({
             revnetId: revnetId,
             collateralCount: collateralCount,
@@ -580,6 +598,24 @@ contract REVLoans is ERC721, ERC2771Context, Ownable, IREVLoans {
             );
         }
 
+        // Get the current ruleset to resolve the deployer from its data hook.
+        // slither-disable-next-line unused-return
+        (JBRuleset memory currentRuleset,) = CONTROLLER.currentRulesetOf(revnetId);
+
+        // The ruleset's data hook is the REVDeployer that configured this revnet.
+        address deployer = currentRuleset.dataHook();
+
+        // Only check the delay if a deployer is set.
+        if (deployer != address(0)) {
+            // Get the timestamp after which cash outs (and loans) are allowed.
+            uint256 cashOutDelay = IREVDeployer(deployer).cashOutDelayOf(revnetId);
+
+            // Revert if the delay hasn't passed yet.
+            if (cashOutDelay > block.timestamp) {
+                revert REVLoans_CashOutDelayNotFinished(cashOutDelay, block.timestamp);
+            }
+        }
+
         // Prevent the loan number from exceeding the ID namespace for this revnet.
         if (totalLoansBorrowedFor[revnetId] >= _ONE_TRILLION) revert REVLoans_LoanIdOverflow();
 

package/src/structs/REVBaseline721HookConfig.sol

@@ -12,7 +12,6 @@ import {REV721TiersHookFlags} from "./REV721TiersHookFlags.sol";
 /// @custom:member tokenUriResolver The token URI resolver for the NFT collection.
 /// @custom:member contractUri The contract URI for the NFT collection.
 /// @custom:member tiersConfig The tier configuration for the NFT collection.
-/// @custom:member reserveBeneficiary The default reserve beneficiary for the NFT collection.
 /// @custom:member flags A set of flags that configure the 721 hook. Omits `issueTokensForSplits` since revnets
 /// always force it to `false`.
 // forge-lint: disable-next-line(pascal-case-struct)
@@ -23,6 +22,5 @@ struct REVBaseline721HookConfig {
     IJB721TokenUriResolver tokenUriResolver;
     string contractUri;
     JB721InitTiersConfig tiersConfig;
-    address reserveBeneficiary;
     REV721TiersHookFlags flags;
 }

package/test/REV.integrations.t.sol

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity ^0.8.26;
+pragma solidity 0.8.28;
 
 // forge-lint: disable-next-line(unaliased-plain-import)
 import "forge-std/Test.sol";

package/test/REVAutoIssuanceFuzz.t.sol

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity ^0.8.26;
+pragma solidity 0.8.28;
 
 // forge-lint: disable-next-line(unaliased-plain-import)
 import "forge-std/Test.sol";

package/test/REVDeployerRegressions.t.sol

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity ^0.8.26;
+pragma solidity 0.8.28;
 
 // forge-lint: disable-next-line(unaliased-plain-import)
 import "forge-std/Test.sol";

package/test/REVInvincibility.t.sol

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity ^0.8.26;
+pragma solidity 0.8.28;
 
 // forge-lint: disable-next-line(unaliased-plain-import)
 import "forge-std/Test.sol";

package/test/REVInvincibilityHandler.sol

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity ^0.8.26;
+pragma solidity 0.8.28;
 
 // forge-lint: disable-next-line(unaliased-plain-import)
 import "forge-std/Test.sol";

package/test/REVLifecycle.t.sol

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity ^0.8.26;
+pragma solidity 0.8.28;
 
 // forge-lint: disable-next-line(unaliased-plain-import)
 import "forge-std/Test.sol";

package/test/REVLoans.invariants.t.sol

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity ^0.8.26;
+pragma solidity 0.8.28;
 
 // forge-lint: disable-next-line(unaliased-plain-import)
 import "forge-std/Test.sol";

package/test/REVLoansAttacks.t.sol

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity ^0.8.26;
+pragma solidity 0.8.28;
 
 // forge-lint: disable-next-line(unaliased-plain-import)
 import "forge-std/Test.sol";

package/test/REVLoansFeeRecovery.t.sol

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity ^0.8.26;
+pragma solidity 0.8.28;
 
 // forge-lint: disable-next-line(unaliased-plain-import)
 import "forge-std/Test.sol";

package/test/REVLoansFindings.t.sol

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity ^0.8.26;
+pragma solidity 0.8.28;
 
 // forge-lint: disable-next-line(unaliased-plain-import)
 import "forge-std/Test.sol";

package/test/REVLoansRegressions.t.sol

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity ^0.8.26;
+pragma solidity 0.8.28;
 
 // forge-lint: disable-next-line(unaliased-plain-import)
 import "forge-std/Test.sol";

package/test/REVLoansSourceFeeRecovery.t.sol

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity ^0.8.26;
+pragma solidity 0.8.28;
 
 // forge-lint: disable-next-line(unaliased-plain-import)
 import "forge-std/Test.sol";

package/test/REVLoansSourced.t.sol

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity ^0.8.26;
+pragma solidity 0.8.28;
 
 // forge-lint: disable-next-line(unaliased-plain-import)
 import "forge-std/Test.sol";

package/test/REVLoansUnSourced.t.sol

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity ^0.8.26;
+pragma solidity 0.8.28;
 
 // forge-lint: disable-next-line(unaliased-plain-import)
 import "forge-std/Test.sol";

package/test/TestBurnHeldTokens.t.sol

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity ^0.8.26;
+pragma solidity 0.8.28;
 
 // forge-lint: disable-next-line(unaliased-plain-import)
 import "forge-std/Test.sol";

package/test/TestCEIPattern.t.sol

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity ^0.8.26;
+pragma solidity 0.8.28;
 
 // forge-lint: disable-next-line(unaliased-plain-import)
 import "forge-std/Test.sol";

package/test/TestCashOutCallerValidation.t.sol

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity ^0.8.26;
+pragma solidity 0.8.28;
 
 // forge-lint: disable-next-line(unaliased-plain-import)
 import "forge-std/Test.sol";

package/test/TestConversionDocumentation.t.sol

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity ^0.8.26;
+pragma solidity 0.8.28;
 
 // forge-lint: disable-next-line(unaliased-plain-import)
 import "forge-std/Test.sol";

package/test/TestCrossCurrencyReclaim.t.sol

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity ^0.8.26;
+pragma solidity 0.8.28;
 
 // forge-lint: disable-next-line(unaliased-plain-import)
 import "forge-std/Test.sol";

package/test/TestCrossSourceReallocation.t.sol

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity ^0.8.26;
+pragma solidity 0.8.28;
 
 // forge-lint: disable-next-line(unaliased-plain-import)
 import "forge-std/Test.sol";

package/test/TestERC2771MetaTx.t.sol

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity ^0.8.26;
+pragma solidity 0.8.28;
 
 // forge-lint: disable-next-line(unaliased-plain-import)
 import "forge-std/Test.sol";

package/test/TestEmptyBuybackSpecs.t.sol

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity ^0.8.26;
+pragma solidity 0.8.28;
 
 // forge-lint: disable-next-line(unaliased-plain-import)
 import "forge-std/Test.sol";

package/test/TestFlashLoanSurplus.t.sol

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity ^0.8.26;
+pragma solidity 0.8.28;
 
 // forge-lint: disable-next-line(unaliased-plain-import)
 import "forge-std/Test.sol";

package/test/TestHookArrayOOB.t.sol

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity ^0.8.26;
+pragma solidity 0.8.28;
 
 // forge-lint: disable-next-line(unaliased-plain-import)
 import "forge-std/Test.sol";

package/test/TestLiquidationBehavior.t.sol

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity ^0.8.26;
+pragma solidity 0.8.28;
 
 // forge-lint: disable-next-line(unaliased-plain-import)
 import "forge-std/Test.sol";

package/test/TestLoanSourceRotation.t.sol

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity ^0.8.26;
+pragma solidity 0.8.28;
 
 // forge-lint: disable-next-line(unaliased-plain-import)
 import "forge-std/Test.sol";