@rev-net/core-v6 0.0.33 → 0.0.34

package/test/TestHiddenTokens.t.sol

@@ -171,6 +171,8 @@ contract TestHiddenTokens is TestBaseWorkflow {
 
         uint256 totalSupplyBefore = jbController().TOKENS().totalSupplyOf(REVNET_ID);
 
+        _allowHolderToHide(USER, REVNET_ID);
+
         // Hide half the tokens.
         uint256 hideCount = userTokens / 2;
         vm.prank(USER);
@@ -202,23 +204,23 @@ contract TestHiddenTokens is TestBaseWorkflow {
         uint256 userTokensBefore = jbController().TOKENS().totalBalanceOf(USER, REVNET_ID);
         uint256 totalSupplyBefore = jbController().TOKENS().totalSupplyOf(REVNET_ID);
 
+        _allowHolderToHide(USER, REVNET_ID);
+
         // Hide tokens.
         uint256 hideCount = userTokensBefore / 2;
         vm.prank(USER);
         HIDDEN_TOKENS.hideTokensOf(REVNET_ID, hideCount, USER);
 
-        // Reveal tokens to beneficiary.
+        // Reveal tokens back to USER.
         vm.prank(USER);
-        HIDDEN_TOKENS.revealTokensOf(REVNET_ID, hideCount, BENEFICIARY, USER);
+        HIDDEN_TOKENS.revealTokensOf(REVNET_ID, hideCount, USER);
 
         uint256 totalSupplyAfter = jbController().TOKENS().totalSupplyOf(REVNET_ID);
         assertEq(totalSupplyAfter, totalSupplyBefore, "Total supply should be restored");
         assertEq(HIDDEN_TOKENS.hiddenBalanceOf(USER, REVNET_ID), 0, "Hidden balance should be zero");
         assertEq(HIDDEN_TOKENS.totalHiddenOf(REVNET_ID), 0, "Total hidden should be zero");
         assertEq(
-            jbController().TOKENS().totalBalanceOf(BENEFICIARY, REVNET_ID),
-            hideCount,
-            "Beneficiary should receive tokens"
+            jbController().TOKENS().totalBalanceOf(USER, REVNET_ID), userTokensBefore, "User should receive tokens"
         );
     }
 
@@ -242,6 +244,8 @@ contract TestHiddenTokens is TestBaseWorkflow {
         uint256 userTokens = jbController().TOKENS().totalBalanceOf(USER, REVNET_ID);
         uint256 hideCount = userTokens / 4;
 
+        _allowHolderToHide(USER, REVNET_ID);
+
         // Hide some tokens.
         vm.prank(USER);
         HIDDEN_TOKENS.hideTokensOf(REVNET_ID, hideCount, USER);
@@ -253,7 +257,7 @@ contract TestHiddenTokens is TestBaseWorkflow {
                 REVHiddenTokens.REVHiddenTokens_InsufficientHiddenBalance.selector, hideCount, hideCount + 1
             )
         );
-        HIDDEN_TOKENS.revealTokensOf(REVNET_ID, hideCount + 1, USER, USER);
+        HIDDEN_TOKENS.revealTokensOf(REVNET_ID, hideCount + 1, USER);
     }
 
     // ──────────────────── Test: Hidden tokens inflate cash out rate
@@ -275,6 +279,8 @@ contract TestHiddenTokens is TestBaseWorkflow {
 
         uint256 userTokens = jbController().TOKENS().totalBalanceOf(USER, REVNET_ID);
 
+        _allowHolderToHide(USER, REVNET_ID);
+
         // Hide half the user's tokens.
         uint256 hideCount = userTokens / 2;
         vm.prank(USER);
@@ -305,6 +311,8 @@ contract TestHiddenTokens is TestBaseWorkflow {
 
         uint256 userTokens = jbController().TOKENS().totalBalanceOf(USER, REVNET_ID);
 
+        _allowHolderToHide(USER, REVNET_ID);
+
         vm.prank(USER);
         vm.expectEmit(true, false, false, true);
         emit IREVHiddenTokens.HideTokens(REVNET_ID, userTokens, USER, USER);
@@ -326,13 +334,43 @@ contract TestHiddenTokens is TestBaseWorkflow {
 
         uint256 userTokens = jbController().TOKENS().totalBalanceOf(USER, REVNET_ID);
 
+        _allowHolderToHide(USER, REVNET_ID);
+
         vm.prank(USER);
         HIDDEN_TOKENS.hideTokensOf(REVNET_ID, userTokens, USER);
 
         vm.prank(USER);
         vm.expectEmit(true, false, false, true);
-        emit IREVHiddenTokens.RevealTokens(REVNET_ID, userTokens, BENEFICIARY, USER, USER);
-        HIDDEN_TOKENS.revealTokensOf(REVNET_ID, userTokens, BENEFICIARY, USER);
+        emit IREVHiddenTokens.RevealTokens(REVNET_ID, userTokens, USER, USER);
+        HIDDEN_TOKENS.revealTokensOf(REVNET_ID, userTokens, USER);
+    }
+
+    function test_setTokenHidingAllowedFor_allowsHolderToHide() public {
+        uint256 payAmount = 10e18;
+
+        vm.prank(USER);
+        jbMultiTerminal().pay{value: payAmount}({
+            projectId: REVNET_ID,
+            token: JBConstants.NATIVE_TOKEN,
+            amount: payAmount,
+            beneficiary: USER,
+            minReturnedTokens: 0,
+            memo: "",
+            metadata: ""
+        });
+
+        uint256 userTokens = jbController().TOKENS().totalBalanceOf(USER, REVNET_ID);
+        uint256 hideCount = userTokens / 2;
+
+        _allowHolderToHide(USER, REVNET_ID);
+
+        vm.prank(USER);
+        HIDDEN_TOKENS.hideTokensOf(REVNET_ID, hideCount, USER);
+
+        vm.prank(USER);
+        HIDDEN_TOKENS.revealTokensOf(REVNET_ID, hideCount, USER);
+
+        assertEq(jbController().TOKENS().totalBalanceOf(USER, REVNET_ID), userTokens, "User balance should be restored");
     }
 
     // ──────────────────── Internal helpers
@@ -351,6 +389,11 @@ contract TestHiddenTokens is TestBaseWorkflow {
         jbPermissions().setPermissionsFor(account, permissionsData);
     }
 
+    function _allowHolderToHide(address holder, uint256 revnetId) internal {
+        vm.prank(address(REV_DEPLOYER));
+        HIDDEN_TOKENS.setTokenHidingAllowedFor(revnetId, holder, true);
+    }
+
     function _deployFeeProject() internal {
         JBAccountingContext[] memory acc = new JBAccountingContext[](1);
         acc[0] = JBAccountingContext({

package/test/audit/CodexCrossChainBuybackRouteMismatch.t.sol

@@ -0,0 +1,184 @@
+// SPDX-License-Identifier: MIT
+pragma solidity 0.8.28;
+
+import "forge-std/Test.sol";
+import "@bananapus/core-v6/test/helpers/TestBaseWorkflow.sol";
+import {IJBBuybackHookRegistry} from "@bananapus/buyback-hook-v6/src/interfaces/IJBBuybackHookRegistry.sol";
+import {IJBCashOutHook} from "@bananapus/core-v6/src/interfaces/IJBCashOutHook.sol";
+import {IJBRulesetDataHook} from "@bananapus/core-v6/src/interfaces/IJBRulesetDataHook.sol";
+import {JBConstants} from "@bananapus/core-v6/src/libraries/JBConstants.sol";
+import {JBCashOuts} from "@bananapus/core-v6/src/libraries/JBCashOuts.sol";
+import {JBBeforeCashOutRecordedContext} from "@bananapus/core-v6/src/structs/JBBeforeCashOutRecordedContext.sol";
+import {JBCashOutHookSpecification} from "@bananapus/core-v6/src/structs/JBCashOutHookSpecification.sol";
+import {JBBeforePayRecordedContext} from "@bananapus/core-v6/src/structs/JBBeforePayRecordedContext.sol";
+import {JBPayHookSpecification} from "@bananapus/core-v6/src/structs/JBPayHookSpecification.sol";
+import {JBTokenAmount} from "@bananapus/core-v6/src/structs/JBTokenAmount.sol";
+import {JBRuleset} from "@bananapus/core-v6/src/structs/JBRuleset.sol";
+import {IJBSuckerRegistry} from "@bananapus/suckers-v6/src/interfaces/IJBSuckerRegistry.sol";
+import {IERC165} from "@openzeppelin/contracts/utils/introspection/IERC165.sol";
+import {PoolKey} from "@uniswap/v4-core/src/types/PoolKey.sol";
+
+import {REVOwner} from "../../src/REVOwner.sol";
+
+contract ConfigurableSuckerRegistry {
+    uint256 public remoteSupply;
+    uint256 public remoteSurplus;
+
+    function setRemoteTotals(uint256 supply, uint256 surplus) external {
+        remoteSupply = supply;
+        remoteSurplus = surplus;
+    }
+
+    function isSuckerOf(uint256, address) external pure returns (bool) {
+        return false;
+    }
+
+    function remoteTotalSupplyOf(uint256) external view returns (uint256) {
+        return remoteSupply;
+    }
+
+    function remoteSurplusOf(uint256, uint256, uint256) external view returns (uint256) {
+        return remoteSurplus;
+    }
+}
+
+contract ThresholdBuybackRegistry is IJBRulesetDataHook {
+    uint256 public immutable minimumSwapAmountOut;
+
+    constructor(uint256 minAmountOut) {
+        minimumSwapAmountOut = minAmountOut;
+    }
+
+    function beforeCashOutRecordedWith(JBBeforeCashOutRecordedContext calldata context)
+        external
+        view
+        returns (
+            uint256 cashOutTaxRate,
+            uint256 cashOutCount,
+            uint256 totalSupply,
+            uint256 effectiveSurplusValue,
+            JBCashOutHookSpecification[] memory hookSpecifications
+        )
+    {
+        uint256 directCashOutAmount = JBCashOuts.cashOutFrom({
+            surplus: context.surplus.value,
+            cashOutCount: context.cashOutCount,
+            totalSupply: context.totalSupply,
+            cashOutTaxRate: context.cashOutTaxRate
+        });
+
+        hookSpecifications = new JBCashOutHookSpecification[](1);
+        hookSpecifications[0] = JBCashOutHookSpecification({
+            hook: IJBCashOutHook(address(this)),
+            noop: directCashOutAmount >= minimumSwapAmountOut,
+            amount: 0,
+            metadata: ""
+        });
+
+        cashOutTaxRate =
+            directCashOutAmount >= minimumSwapAmountOut ? context.cashOutTaxRate : JBConstants.MAX_CASH_OUT_TAX_RATE;
+        cashOutCount = context.cashOutCount;
+        totalSupply = context.totalSupply;
+        effectiveSurplusValue = 0;
+    }
+
+    function beforePayRecordedWith(JBBeforePayRecordedContext calldata context)
+        external
+        pure
+        returns (uint256 weight, JBPayHookSpecification[] memory hookSpecifications)
+    {
+        weight = context.weight;
+        hookSpecifications = new JBPayHookSpecification[](0);
+    }
+
+    function hasMintPermissionFor(uint256, JBRuleset calldata, address) external pure returns (bool) {
+        return false;
+    }
+
+    function setPoolFor(uint256, PoolKey calldata, uint256, address) external pure {}
+
+    function setPoolFor(uint256, uint24, int24, uint256, address) external pure {}
+
+    function initializePoolFor(uint256, uint24, int24, uint256, address, uint160) external pure {}
+
+    function supportsInterface(bytes4 interfaceId) external pure returns (bool) {
+        return interfaceId == type(IJBRulesetDataHook).interfaceId || interfaceId == type(IERC165).interfaceId;
+    }
+}
+
+contract CodexCrossChainBuybackRouteMismatchTest is TestBaseWorkflow {
+    REVOwner internal ownerHook;
+    ConfigurableSuckerRegistry internal suckerRegistry;
+    ThresholdBuybackRegistry internal buybackRegistry;
+
+    function setUp() public override {
+        super.setUp();
+
+        suckerRegistry = new ConfigurableSuckerRegistry();
+        buybackRegistry = new ThresholdBuybackRegistry(50 ether);
+
+        ownerHook = new REVOwner(
+            IJBBuybackHookRegistry(address(buybackRegistry)),
+            jbDirectory(),
+            999_999,
+            IJBSuckerRegistry(address(suckerRegistry)),
+            address(0),
+            address(0)
+        );
+    }
+
+    function test_buybackRouteUsesOmnichainContextForRouting() public {
+        suckerRegistry.setRemoteTotals(0, 900 ether);
+
+        JBBeforeCashOutRecordedContext memory context = JBBeforeCashOutRecordedContext({
+            terminal: address(jbMultiTerminal()),
+            holder: address(0xBEEF),
+            projectId: 1,
+            rulesetId: 0,
+            cashOutCount: 100,
+            totalSupply: 1000,
+            surplus: JBTokenAmount({
+                token: JBConstants.NATIVE_TOKEN,
+                value: 100 ether,
+                decimals: 18,
+                currency: uint32(uint160(JBConstants.NATIVE_TOKEN))
+            }),
+            useTotalSurplus: true,
+            cashOutTaxRate: 0,
+            beneficiaryIsFeeless: false,
+            metadata: ""
+        });
+
+        uint256 localDirectCashOut = JBCashOuts.cashOutFrom({
+            surplus: context.surplus.value,
+            cashOutCount: context.cashOutCount,
+            totalSupply: context.totalSupply,
+            cashOutTaxRate: context.cashOutTaxRate
+        });
+        uint256 omnichainDirectCashOut = JBCashOuts.cashOutFrom({
+            surplus: context.surplus.value + 900 ether,
+            cashOutCount: context.cashOutCount,
+            totalSupply: context.totalSupply,
+            cashOutTaxRate: context.cashOutTaxRate
+        });
+
+        assertLt(localDirectCashOut, 50 ether, "local route should prefer swap in the mock");
+        assertGe(omnichainDirectCashOut, 50 ether, "omnichain route should prefer direct reclaim");
+
+        (uint256 returnedTaxRate,, uint256 returnedSupply, uint256 returnedSurplus,) =
+            ownerHook.beforeCashOutRecordedWith(context);
+
+        // After the fix, REVOwner forwards the cross-chain-adjusted context to the buyback hook.
+        // The buyback hook now sees the full omnichain surplus (1000 ether) and correctly routes
+        // to direct reclaim (passthrough) instead of swap.
+        assertEq(returnedSupply, context.totalSupply, "owner returns cross-chain total supply");
+        assertEq(returnedSurplus, context.surplus.value + 900 ether, "owner returns cross-chain effective surplus");
+        // With omnichain context, the direct reclaim (100 ether) exceeds the threshold (50 ether),
+        // so the buyback hook chooses passthrough (returns the original cashOutTaxRate of 0).
+        assertEq(
+            returnedTaxRate,
+            context.cashOutTaxRate,
+            "routing correctly uses omnichain context - direct reclaim beats threshold"
+        );
+    }
+}

package/test/audit/NemesisOperatorDelegation.t.sol

@@ -148,32 +148,82 @@ contract NemesisOperatorDelegationTest is TestBaseWorkflow {
         );
     }
 
-    function test_revealTokensOperatorCanRedirectHiddenTokens() public {
+    function test_hiddenTokensOperatorCanAllowHolderToHideOwnTokens() public {
         uint256 userTokens = _payUserIntoRevnet(10e18);
         uint256 hiddenCount = userTokens / 2;
 
         _grantPermission(USER, REVNET_ID, address(HIDDEN_TOKENS), JBPermissionIds.BURN_TOKENS);
-        _grantPermission(USER, REVNET_ID, OPERATOR, JBPermissionIds.REVEAL_TOKENS);
+        _allowHolderToHide(USER);
 
         vm.prank(USER);
         HIDDEN_TOKENS.hideTokensOf(REVNET_ID, hiddenCount, USER);
 
-        vm.prank(OPERATOR);
-        HIDDEN_TOKENS.revealTokensOf(REVNET_ID, hiddenCount, OPERATOR, USER);
+        vm.prank(USER);
+        HIDDEN_TOKENS.revealTokensOf(REVNET_ID, hiddenCount, USER);
 
         assertEq(HIDDEN_TOKENS.hiddenBalanceOf(USER, REVNET_ID), 0, "holder hidden balance was consumed");
         assertEq(
-            jbController().TOKENS().totalBalanceOf(OPERATOR, REVNET_ID),
-            hiddenCount,
-            "operator receives the holder's revealed tokens"
+            jbController().TOKENS().totalBalanceOf(USER, REVNET_ID),
+            userTokens,
+            "holder gets their own revealed tokens back"
         );
+    }
+
+    function test_hiddenTokensPermissionedOperatorCanHideOwnTokens() public {
+        vm.deal(OPERATOR, 10e18);
+        vm.prank(OPERATOR);
+        uint256 operatorTokens = jbMultiTerminal().pay{value: 10e18}({
+            projectId: REVNET_ID,
+            token: JBConstants.NATIVE_TOKEN,
+            amount: 10e18,
+            beneficiary: OPERATOR,
+            minReturnedTokens: 0,
+            memo: "",
+            metadata: ""
+        });
+        uint256 hiddenCount = operatorTokens / 2;
+
+        _grantPermission(OPERATOR, REVNET_ID, address(HIDDEN_TOKENS), JBPermissionIds.BURN_TOKENS);
+        _grantOperatorHidePermission(OPERATOR);
+
+        vm.prank(OPERATOR);
+        HIDDEN_TOKENS.hideTokensOf(REVNET_ID, hiddenCount, OPERATOR);
+
+        assertEq(HIDDEN_TOKENS.hiddenBalanceOf(OPERATOR, REVNET_ID), hiddenCount, "operator hidden balance was updated");
         assertEq(
-            jbController().TOKENS().totalBalanceOf(USER, REVNET_ID),
-            userTokens - hiddenCount,
-            "holder does not get the revealed tokens back"
+            jbController().TOKENS().totalBalanceOf(OPERATOR, REVNET_ID),
+            operatorTokens - hiddenCount,
+            "operator's visible balance was reduced"
         );
     }
 
+    function test_hiddenTokensDelegateCannotHideAnotherHoldersTokens() public {
+        uint256 userTokens = _payUserIntoRevnet(10e18);
+
+        _grantPermission(USER, REVNET_ID, address(HIDDEN_TOKENS), JBPermissionIds.BURN_TOKENS);
+        _allowHolderToHide(USER);
+
+        vm.prank(OPERATOR);
+        vm.expectRevert(
+            abi.encodeWithSelector(REVHiddenTokens.REVHiddenTokens_Unauthorized.selector, REVNET_ID, OPERATOR)
+        );
+        HIDDEN_TOKENS.hideTokensOf(REVNET_ID, userTokens / 2, USER);
+    }
+
+    function test_hiddenTokensOperatorCanDisallowHolder() public {
+        uint256 userTokens = _payUserIntoRevnet(10e18);
+
+        _grantPermission(USER, REVNET_ID, address(HIDDEN_TOKENS), JBPermissionIds.BURN_TOKENS);
+        _allowHolderToHide(USER);
+
+        vm.prank(address(REV_DEPLOYER));
+        HIDDEN_TOKENS.setTokenHidingAllowedFor(REVNET_ID, USER, false);
+
+        vm.prank(USER);
+        vm.expectRevert(abi.encodeWithSelector(REVHiddenTokens.REVHiddenTokens_Unauthorized.selector, REVNET_ID, USER));
+        HIDDEN_TOKENS.hideTokensOf(REVNET_ID, userTokens / 2, USER);
+    }
+
     function _grantPermission(address account, uint256 revnetId, address operator, uint8 permissionId) internal {
         uint8[] memory permissionIds = new uint8[](1);
         permissionIds[0] = permissionId;
@@ -200,6 +250,23 @@ contract NemesisOperatorDelegationTest is TestBaseWorkflow {
         assertGt(tokenCount, 0, "payment should mint revnet tokens");
     }
 
+    function _allowHolderToHide(address holder) internal {
+        vm.prank(address(REV_DEPLOYER));
+        HIDDEN_TOKENS.setTokenHidingAllowedFor(REVNET_ID, holder, true);
+    }
+
+    function _grantOperatorHidePermission(address operator) internal {
+        uint8[] memory permissionIds = new uint8[](1);
+        permissionIds[0] = JBPermissionIds.HIDE_TOKENS;
+
+        vm.prank(address(REV_DEPLOYER));
+        jbPermissions()
+            .setPermissionsFor(
+                address(REV_DEPLOYER),
+                JBPermissionsData({operator: operator, projectId: uint56(REVNET_ID), permissionIds: permissionIds})
+            );
+    }
+
     function _deployFeeProject() internal {
         JBAccountingContext[] memory acc = new JBAccountingContext[](1);
         acc[0] = JBAccountingContext({