@rev-net/core-v6 0.0.34 → 0.0.36

package/ARCHITECTURE.md

@@ -82,6 +82,18 @@ The repo does not replace core treasury accounting. Its critical economic logic
 - If you change borrowability, re-check cash-out-delay gating, omnichain surplus inputs, and local-surplus caps together.
 - If you change hook composition, re-check 721 split handling, buyback assumptions, and mint-permission flows.
 
+## Cross-Chain Configuration Hash
+
+`REVDeployer` produces an `encodedConfigurationHash` for each revnet that determines sucker deployment salts. This hash commits the revnet's identity across chains. It includes:
+
+- `baseCurrency`, `description.name`, `description.ticker`, `description.salt`
+- Terminal addresses (order-sensitive)
+- Stage parameters (timing, issuance, splits, tax rates, auto-issuances)
+
+Terminal addresses are included because they are deployed deterministically at the same address across chains. Accounting contexts (token addresses) are excluded because tokens like USDC legitimately differ per chain.
+
+This means a revnet can only expand to a new chain if it uses the exact same terminal contract it used on the host chain. Different terminal addresses produce a different hash, preventing accidental cross-chain mismatches in sucker deployments.
+
 ## Canonical Checks
 
 - cash-out-delay interaction with loans:
@@ -90,6 +102,8 @@ The repo does not replace core treasury accounting. Its critical economic logic
   `test/TestStageTransitionBorrowable.t.sol`
 - omnichain or phantom-surplus edge cases:
   `test/audit/CodexPhantomSurplusTerminal.t.sol`
+- terminal encoding in configuration hash:
+  `test/TestTerminalEncodingInHash.t.sol`
 
 ## Source Map
 

package/RISKS.md

@@ -86,4 +86,12 @@ The model assumes that attempts to inflate surplus through donations are not pro
 
 ### 8.5 Omnichain terminal expansion inherits remote-chain trust
 
-A project that expands to a new chain can register additional terminals on that chain. Because borrowability calculations aggregate surplus from all registered terminals across all chains, a compromised or misconfigured terminal on a remote chain can corrupt the project's surplus accounting globally. This is accepted because revnet terminals are set and fixed on deploy for the initial chain, but expansion to new chains inherently requires trust in the new chain's terminal infrastructure, bridge integrity, and deployment configuration. Project operators should treat each chain expansion as a trust-boundary decision.
+A project that expands to a new chain can register additional terminals on that chain. Because borrowability calculations aggregate surplus from all registered terminals across all chains, a compromised or misconfigured terminal on a remote chain can corrupt the project's surplus accounting globally. This is mitigated by including terminal addresses in the `encodedConfigurationHash` — cross-chain expansions via suckers must use the exact same terminal address as the host chain. Terminal addresses are deterministic across chains (same CREATE2 deployment), so this prevents expansions from silently using a different terminal. Project operators should still treat each chain expansion as a trust-boundary decision since bridge integrity and network assumptions remain outside protocol control.
+
+### 8.6 Cross-chain surplus staleness
+
+`REVLoans._borrowableAmountFrom` and `REVOwner.beforeCashOutRecordedWith` add `remoteSurplusOf()` and `remoteTotalSupplyOf()` to local values. These remote values update only when `toRemote()` is called on the peer chain -- no heartbeat or staleness check. Stale data can inflate per-token borrowable amounts when remote supply has grown since the last bridge message. Primary safeguard: borrowable is capped at `localSurplus` (REVLoans line 386-387), preventing extraction beyond what the local terminal holds.
+
+### 8.7 REVLoans CEI violation in `_adjust`
+
+In `REVLoans._adjust`, `totalCollateralOf[revnetId]` is incremented after external calls (`useAllowanceOf`, fee payment). A reentrant `borrowFrom` would see a lower `totalCollateralOf`. This is documented inline (lines 1128-1132) and requires an adversarial pay hook on the revnet's own terminal -- a trust-level configuration that is not realistic in standard deployments.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rev-net/core-v6",
-  "version": "0.0.34",
+  "version": "0.0.36",
   "license": "MIT",
   "repository": {
     "type": "git",

package/src/REVDeployer.sol

@@ -798,7 +798,7 @@ contract REVDeployer is ERC2771Context, IREVDeployer, IERC721Receiver {
         if (shouldDeployNewRevnet) {
             // If we're deploying a new revnet, launch a Juicebox project for it.
             // Sanity check that we deployed the `revnetId` that we expected to deploy.
-            // slither-disable-next-line reentrancy-benign,reentrancy-events
+            // slither-disable-next-line incorrect-equality,reentrancy-benign,reentrancy-events
             assert(
                 CONTROLLER.launchProjectFor({
                     owner: address(this),
@@ -956,10 +956,26 @@ contract REVDeployer is ERC2771Context, IREVDeployer, IERC721Receiver {
             configuration.description.salt
         );
 
+        // Include terminal addresses in the hash so cross-chain expansions must use the same terminals.
+        // Terminal addresses are deterministic across chains. Accounting contexts are excluded because
+        // token addresses (e.g. USDC) legitimately differ per chain.
+        for (uint256 i; i < terminalConfigurations.length;) {
+            encodedConfiguration = abi.encode(encodedConfiguration, terminalConfigurations[i].terminal);
+            unchecked {
+                ++i;
+            }
+        }
+
         // Initialize fund access limit groups for the loan contract.
         JBFundAccessLimitGroup[] memory fundAccessLimitGroups =
             _makeLoanFundAccessLimits({terminalConfigurations: terminalConfigurations});
 
+        // Track the previous stage's effective start time for ordering validation.
+        // When stage 0 uses `startsAtOrAfter == 0`, the effective value is `block.timestamp`.
+        // Subsequent stages must be validated against this normalized value, not the raw calldata,
+        // so that cross-chain deployments can reproduce the same encoded configuration hash.
+        uint256 previousStageStart;
+
         // Iterate through each stage to set up its ruleset.
         for (uint256 i; i < configuration.stageConfigurations.length;) {
             // Set the stage being iterated on.
@@ -971,12 +987,19 @@ contract REVDeployer is ERC2771Context, IREVDeployer, IERC721Receiver {
                 revert REVDeployer_MustHaveSplits();
             }
 
+            // Compute the effective start time for this stage.
+            uint256 effectiveStart = (i == 0 && stageConfiguration.startsAtOrAfter == 0)
+                ? block.timestamp
+                : stageConfiguration.startsAtOrAfter;
+
             // If the stage's start time is not after the previous stage's start time, revert.
-            if (i > 0 && stageConfiguration.startsAtOrAfter <= configuration.stageConfigurations[i - 1].startsAtOrAfter)
-            {
+            if (i > 0 && effectiveStart <= previousStageStart) {
                 revert REVDeployer_StageTimesMustIncrease();
             }
 
+            // Store for the next iteration's ordering check.
+            previousStageStart = effectiveStart;
+
             // Make sure the revnet doesn't prevent cashouts all together.
             if (stageConfiguration.cashOutTaxRate >= JBConstants.MAX_CASH_OUT_TAX_RATE) {
                 revert REVDeployer_CashOutsCantBeTurnedOffCompletely(
@@ -994,13 +1017,9 @@ contract REVDeployer is ERC2771Context, IREVDeployer, IERC721Receiver {
             // Add the stage's properties to the byte-encoded configuration.
             encodedConfiguration = abi.encode(
                 encodedConfiguration,
-                // If no start time is provided for the first stage, use the current block's timestamp.
-                // In the future, revnets deployed on other networks can match this revnet's encoded stage by specifying
-                // the
-                // same start time.
-                (i == 0 && stageConfiguration.startsAtOrAfter == 0)
-                    ? block.timestamp
-                    : stageConfiguration.startsAtOrAfter,
+                // Use the effective start time (normalized from 0 to block.timestamp for the first stage).
+                // Cross-chain deployments reproduce the hash by specifying the origin chain's timestamp.
+                effectiveStart,
                 stageConfiguration.splitPercent,
                 stageConfiguration.initialIssuance,
                 stageConfiguration.issuanceCutFrequency,

package/src/REVLoans.sol

@@ -543,17 +543,18 @@ contract REVLoans is ERC721, ERC2771Context, JBPermissioned, Ownable, IREVLoans
             // Get a reference to the token being iterated on.
             REVLoanSource storage source = sources[i];
 
-            // Get a reference to the accounting context for the source.
-            // slither-disable-next-line calls-loop
-            JBAccountingContext memory accountingContext =
-                source.terminal.accountingContextForTokenOf({projectId: revnetId, token: source.token});
-
             // Get a reference to the amount of tokens loaned out.
             uint256 tokensLoaned = totalBorrowedFrom[revnetId][source.terminal][source.token];
 
-            // Skip if no tokens are loaned from this source.
+            // Skip if no tokens are loaned from this source. Checked before the external call below to avoid
+            // reverting on stale sources whose terminals may no longer support this token.
             if (tokensLoaned == 0) continue;
 
+            // Get a reference to the accounting context for the source.
+            // slither-disable-next-line calls-loop
+            JBAccountingContext memory accountingContext =
+                source.terminal.accountingContextForTokenOf({projectId: revnetId, token: source.token});
+
             // Normalize the token amount from the source's decimals to the target decimals.
             uint256 normalizedTokens;
             if (accountingContext.decimals > decimals) {
@@ -1225,6 +1226,14 @@ contract REVLoans is ERC721, ERC2771Context, JBPermissioned, Ownable, IREVLoans
         return 0;
     }
 
+    /// @notice Clears any token allowance granted by `_beforeTransferTo`.
+    /// @param to The address that was granted the allowance.
+    /// @param token The token whose allowance should be cleared.
+    function _afterTransferTo(address to, address token) internal {
+        if (token == JBConstants.NATIVE_TOKEN) return;
+        IERC20(token).forceApprove({spender: to, value: 0});
+    }
+
     /// @notice Reallocates collateral from a loan by making a new loan based on the original, with reduced collateral.
     /// @param loanId The ID of the loan to reallocate collateral from.
     /// @param revnetId The ID of the revnet the loan is from.
@@ -1334,6 +1343,8 @@ contract REVLoans is ERC721, ERC2771Context, JBPermissioned, Ownable, IREVLoans
             memo: "",
             metadata: bytes(abi.encodePacked(REV_ID))
         });
+
+        _afterTransferTo({to: address(loan.source.terminal), token: loan.source.token});
     }
 
     /// @notice Pays down a loan.
@@ -1532,6 +1543,7 @@ contract REVLoans is ERC721, ERC2771Context, JBPermissioned, Ownable, IREVLoans
             metadata: bytes(abi.encodePacked(metadataProjectId))
         }) {
             success = true;
+            _afterTransferTo({to: address(terminal), token: token});
         } catch (bytes memory) {
             if (token != JBConstants.NATIVE_TOKEN) {
                 IERC20(token).safeDecreaseAllowance({spender: address(terminal), requestedDecrease: amount});

package/src/REVOwner.sol

@@ -16,6 +16,7 @@ import {JBCashOutHookSpecification} from "@bananapus/core-v6/src/structs/JBCashO
 import {JBPayHookSpecification} from "@bananapus/core-v6/src/structs/JBPayHookSpecification.sol";
 import {JBRuleset} from "@bananapus/core-v6/src/structs/JBRuleset.sol";
 import {IJBSuckerRegistry} from "@bananapus/suckers-v6/src/interfaces/IJBSuckerRegistry.sol";
+import {IERC165} from "@openzeppelin/contracts/utils/introspection/IERC165.sol";
 import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
 import {SafeERC20} from "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";
 import {mulDiv} from "@prb/math/src/Common.sol";
@@ -458,7 +459,8 @@ contract REVOwner is IJBRulesetDataHook, IJBCashOutHook {
     /// @dev See `IERC165.supportsInterface`.
     /// @return A flag indicating if the provided interface ID is supported.
     function supportsInterface(bytes4 interfaceId) public view virtual override returns (bool) {
-        return interfaceId == type(IJBRulesetDataHook).interfaceId || interfaceId == type(IJBCashOutHook).interfaceId;
+        return interfaceId == type(IERC165).interfaceId || interfaceId == type(IJBRulesetDataHook).interfaceId
+            || interfaceId == type(IJBCashOutHook).interfaceId;
     }
 
     //*********************************************************************//

package/test/TestTerminalEncodingInHash.t.sol

@@ -0,0 +1,326 @@
+// SPDX-License-Identifier: MIT
+pragma solidity 0.8.28;
+
+// forge-lint: disable-next-line(unaliased-plain-import)
+import "forge-std/Test.sol";
+// forge-lint: disable-next-line(unaliased-plain-import)
+import /* {*} from */ "@bananapus/core-v6/test/helpers/TestBaseWorkflow.sol";
+// forge-lint: disable-next-line(unaliased-plain-import)
+import /* {*} from */ "./../src/REVDeployer.sol";
+// forge-lint: disable-next-line(unaliased-plain-import)
+import "@croptop/core-v6/src/CTPublisher.sol";
+import {REVEmpty721Config} from "./helpers/REVEmpty721Config.sol";
+
+// forge-lint: disable-next-line(unaliased-plain-import)
+import "@bananapus/core-v6/script/helpers/CoreDeploymentLib.sol";
+// forge-lint: disable-next-line(unaliased-plain-import)
+import "@bananapus/721-hook-v6/script/helpers/Hook721DeploymentLib.sol";
+// forge-lint: disable-next-line(unaliased-plain-import)
+import "@bananapus/suckers-v6/script/helpers/SuckerDeploymentLib.sol";
+// forge-lint: disable-next-line(unaliased-plain-import)
+import "@croptop/core-v6/script/helpers/CroptopDeploymentLib.sol";
+// forge-lint: disable-next-line(unaliased-plain-import)
+import "@bananapus/router-terminal-v6/script/helpers/RouterTerminalDeploymentLib.sol";
+
+import {JBConstants} from "@bananapus/core-v6/src/libraries/JBConstants.sol";
+import {JBAccountingContext} from "@bananapus/core-v6/src/structs/JBAccountingContext.sol";
+import {REVLoans} from "../src/REVLoans.sol";
+import {REVStageConfig, REVAutoIssuance} from "../src/structs/REVStageConfig.sol";
+import {REVDescription} from "../src/structs/REVDescription.sol";
+import {IREVLoans} from "./../src/interfaces/IREVLoans.sol";
+import {JBSuckerDeployerConfig} from "@bananapus/suckers-v6/src/structs/JBSuckerDeployerConfig.sol";
+import {JBSuckerRegistry} from "@bananapus/suckers-v6/src/JBSuckerRegistry.sol";
+import {JB721TiersHookDeployer} from "@bananapus/721-hook-v6/src/JB721TiersHookDeployer.sol";
+import {JB721TiersHook} from "@bananapus/721-hook-v6/src/JB721TiersHook.sol";
+import {JB721TiersHookStore} from "@bananapus/721-hook-v6/src/JB721TiersHookStore.sol";
+import {JB721CheckpointsDeployer} from "@bananapus/721-hook-v6/src/JB721CheckpointsDeployer.sol";
+import {IJB721CheckpointsDeployer} from "@bananapus/721-hook-v6/src/interfaces/IJB721CheckpointsDeployer.sol";
+import {JBAddressRegistry} from "@bananapus/address-registry-v6/src/JBAddressRegistry.sol";
+import {IJBAddressRegistry} from "@bananapus/address-registry-v6/src/interfaces/IJBAddressRegistry.sol";
+import {REVOwner} from "../src/REVOwner.sol";
+import {IREVDeployer} from "../src/interfaces/IREVDeployer.sol";
+import {MockSuckerRegistry} from "./mock/MockSuckerRegistry.sol";
+import {MockBuybackDataHook} from "./mock/MockBuybackDataHook.sol";
+
+/// @notice Tests that terminal addresses are included in the encoded configuration hash.
+contract TestTerminalEncodingInHash is TestBaseWorkflow {
+    using JBRulesetMetadataResolver for JBRuleset;
+
+    // forge-lint: disable-next-line(mixed-case-variable)
+    bytes32 REV_DEPLOYER_SALT = "REVDeployer";
+
+    // forge-lint: disable-next-line(mixed-case-variable)
+    REVDeployer REV_DEPLOYER;
+    // forge-lint: disable-next-line(mixed-case-variable)
+    REVOwner REV_OWNER;
+    // forge-lint: disable-next-line(mixed-case-variable)
+    IJB721TiersHookDeployer HOOK_DEPLOYER;
+    // forge-lint: disable-next-line(mixed-case-variable)
+    IJB721TiersHookStore HOOK_STORE;
+    // forge-lint: disable-next-line(mixed-case-variable)
+    IJBAddressRegistry ADDRESS_REGISTRY;
+    // forge-lint: disable-next-line(mixed-case-variable)
+    IREVLoans LOANS_CONTRACT;
+    // forge-lint: disable-next-line(mixed-case-variable)
+    IJBSuckerRegistry SUCKER_REGISTRY;
+    // forge-lint: disable-next-line(mixed-case-variable)
+    CTPublisher PUBLISHER;
+    // forge-lint: disable-next-line(mixed-case-variable)
+    MockBuybackDataHook MOCK_BUYBACK;
+
+    // forge-lint: disable-next-line(mixed-case-variable)
+    uint256 FEE_PROJECT_ID;
+
+    address private constant TRUSTED_FORWARDER = 0xB2b5841DBeF766d4b521221732F9B618fCf34A87;
+
+    function setUp() public override {
+        super.setUp();
+
+        FEE_PROJECT_ID = jbProjects().createFor(multisig());
+
+        SUCKER_REGISTRY = new JBSuckerRegistry(jbDirectory(), jbPermissions(), multisig(), address(0));
+        HOOK_STORE = new JB721TiersHookStore();
+        JB721TiersHook exampleHook = new JB721TiersHook(
+            jbDirectory(),
+            jbPermissions(),
+            jbPrices(),
+            jbRulesets(),
+            HOOK_STORE,
+            jbSplits(),
+            IJB721CheckpointsDeployer(address(new JB721CheckpointsDeployer())),
+            multisig()
+        );
+        ADDRESS_REGISTRY = new JBAddressRegistry();
+        HOOK_DEPLOYER = new JB721TiersHookDeployer(exampleHook, HOOK_STORE, ADDRESS_REGISTRY, multisig());
+        PUBLISHER = new CTPublisher(jbDirectory(), jbPermissions(), FEE_PROJECT_ID, multisig());
+        MOCK_BUYBACK = new MockBuybackDataHook();
+
+        LOANS_CONTRACT = new REVLoans({
+            controller: jbController(),
+            suckerRegistry: IJBSuckerRegistry(address(new MockSuckerRegistry())),
+            revId: FEE_PROJECT_ID,
+            owner: address(this),
+            permit2: permit2(),
+            trustedForwarder: TRUSTED_FORWARDER
+        });
+
+        REV_OWNER = new REVOwner(
+            IJBBuybackHookRegistry(address(MOCK_BUYBACK)),
+            jbDirectory(),
+            FEE_PROJECT_ID,
+            SUCKER_REGISTRY,
+            address(LOANS_CONTRACT),
+            address(0)
+        );
+
+        REV_DEPLOYER = new REVDeployer{salt: REV_DEPLOYER_SALT}(
+            jbController(),
+            SUCKER_REGISTRY,
+            FEE_PROJECT_ID,
+            HOOK_DEPLOYER,
+            PUBLISHER,
+            IJBBuybackHookRegistry(address(MOCK_BUYBACK)),
+            address(LOANS_CONTRACT),
+            TRUSTED_FORWARDER,
+            address(REV_OWNER)
+        );
+
+        REV_OWNER.setDeployer(REV_DEPLOYER);
+
+        vm.prank(multisig());
+        jbProjects().approve(address(REV_DEPLOYER), FEE_PROJECT_ID);
+
+        // Deploy fee project.
+        _deployFeeProject();
+    }
+
+    /// @notice Two revnets with identical base config but different terminals produce different hashes.
+    function test_differentTerminals_produceDifferentHashes() public {
+        // Deploy revnet A with the primary multi-terminal (same description salt for both).
+        (uint256 revnetA,) = REV_DEPLOYER.deployFor({
+            revnetId: 0,
+            configuration: _baseRevConfig("DIFF_TERM"),
+            terminalConfigurations: _terminalConfigs(jbMultiTerminal()),
+            suckerDeploymentConfiguration: REVSuckerDeploymentConfig({
+                deployerConfigurations: new JBSuckerDeployerConfig[](0), salt: keccak256("A")
+            }),
+            tiered721HookConfiguration: REVEmpty721Config.empty721Config(uint32(uint160(JBConstants.NATIVE_TOKEN))),
+            allowedPosts: REVEmpty721Config.emptyAllowedPosts()
+        });
+
+        // Deploy revnet B with the secondary multi-terminal (same config, only terminal differs).
+        (uint256 revnetB,) = REV_DEPLOYER.deployFor({
+            revnetId: 0,
+            configuration: _baseRevConfig("DIFF_TERM"),
+            terminalConfigurations: _terminalConfigs(jbMultiTerminal2()),
+            suckerDeploymentConfiguration: REVSuckerDeploymentConfig({
+                deployerConfigurations: new JBSuckerDeployerConfig[](0), salt: keccak256("B")
+            }),
+            tiered721HookConfiguration: REVEmpty721Config.empty721Config(uint32(uint160(JBConstants.NATIVE_TOKEN))),
+            allowedPosts: REVEmpty721Config.emptyAllowedPosts()
+        });
+
+        bytes32 hashA = REV_DEPLOYER.hashedEncodedConfigurationOf(revnetA);
+        bytes32 hashB = REV_DEPLOYER.hashedEncodedConfigurationOf(revnetB);
+
+        assertNotEq(hashA, hashB, "Different terminals must produce different configuration hashes");
+    }
+
+    /// @notice The hash includes the terminal address — verify by computing it off-chain.
+    function test_hashIncludesTerminalAddress() public {
+        // Deploy a revnet.
+        (uint256 revnetId,) = REV_DEPLOYER.deployFor({
+            revnetId: 0,
+            configuration: _baseRevConfig("VERIFY"),
+            terminalConfigurations: _terminalConfigs(jbMultiTerminal()),
+            suckerDeploymentConfiguration: REVSuckerDeploymentConfig({
+                deployerConfigurations: new JBSuckerDeployerConfig[](0), salt: keccak256("VERIFY")
+            }),
+            tiered721HookConfiguration: REVEmpty721Config.empty721Config(uint32(uint160(JBConstants.NATIVE_TOKEN))),
+            allowedPosts: REVEmpty721Config.emptyAllowedPosts()
+        });
+
+        // Recompute the expected hash manually.
+        bytes memory encodedConfiguration = abi.encode(
+            uint32(uint160(JBConstants.NATIVE_TOKEN)), // baseCurrency
+            "Terminal Test", // name
+            "TERM", // ticker
+            bytes32("VERIFY") // salt
+        );
+        // Terminal address encoding.
+        encodedConfiguration = abi.encode(encodedConfiguration, jbMultiTerminal());
+        // Stage encoding.
+        encodedConfiguration = abi.encode(
+            encodedConfiguration,
+            block.timestamp, // startsAtOrAfter
+            uint256(0), // splitPercent
+            uint112(1000e18), // initialIssuance
+            uint256(0), // issuanceCutFrequency
+            uint256(0), // issuanceCutPercent
+            uint256(5000) // cashOutTaxRate
+        );
+        bytes32 expectedHash = keccak256(encodedConfiguration);
+
+        assertEq(
+            REV_DEPLOYER.hashedEncodedConfigurationOf(revnetId),
+            expectedHash,
+            "On-chain hash must match off-chain computation including terminal address"
+        );
+    }
+
+    /// @notice Terminal ordering matters — [A, B] != [B, A].
+    function test_terminalOrder_affectsHash() public {
+        // Deploy revnet with terminals in order [main, alt].
+        JBTerminalConfig[] memory tcAB = new JBTerminalConfig[](2);
+        JBAccountingContext[] memory acc = new JBAccountingContext[](1);
+        acc[0] = JBAccountingContext({
+            token: JBConstants.NATIVE_TOKEN, decimals: 18, currency: uint32(uint160(JBConstants.NATIVE_TOKEN))
+        });
+        tcAB[0] = JBTerminalConfig({terminal: jbMultiTerminal(), accountingContextsToAccept: acc});
+        tcAB[1] = JBTerminalConfig({terminal: jbMultiTerminal2(), accountingContextsToAccept: acc});
+
+        (uint256 revnetAB,) = REV_DEPLOYER.deployFor({
+            revnetId: 0,
+            configuration: _baseRevConfig("ORDER"),
+            terminalConfigurations: tcAB,
+            suckerDeploymentConfiguration: REVSuckerDeploymentConfig({
+                deployerConfigurations: new JBSuckerDeployerConfig[](0), salt: keccak256("AB")
+            }),
+            tiered721HookConfiguration: REVEmpty721Config.empty721Config(uint32(uint160(JBConstants.NATIVE_TOKEN))),
+            allowedPosts: REVEmpty721Config.emptyAllowedPosts()
+        });
+
+        // Deploy revnet with terminals in order [alt, main].
+        JBTerminalConfig[] memory tcBA = new JBTerminalConfig[](2);
+        tcBA[0] = JBTerminalConfig({terminal: jbMultiTerminal2(), accountingContextsToAccept: acc});
+        tcBA[1] = JBTerminalConfig({terminal: jbMultiTerminal(), accountingContextsToAccept: acc});
+
+        (uint256 revnetBA,) = REV_DEPLOYER.deployFor({
+            revnetId: 0,
+            configuration: _baseRevConfig("ORDER"),
+            terminalConfigurations: tcBA,
+            suckerDeploymentConfiguration: REVSuckerDeploymentConfig({
+                deployerConfigurations: new JBSuckerDeployerConfig[](0), salt: keccak256("BA")
+            }),
+            tiered721HookConfiguration: REVEmpty721Config.empty721Config(uint32(uint160(JBConstants.NATIVE_TOKEN))),
+            allowedPosts: REVEmpty721Config.emptyAllowedPosts()
+        });
+
+        bytes32 hashAB = REV_DEPLOYER.hashedEncodedConfigurationOf(revnetAB);
+        bytes32 hashBA = REV_DEPLOYER.hashedEncodedConfigurationOf(revnetBA);
+
+        assertNotEq(hashAB, hashBA, "Terminal order must affect the configuration hash");
+    }
+
+    // ─── Helpers
+    // ───────────────────────────────────────────────────────────────
+    // //
+
+    function _baseRevConfig(bytes32 salt) internal view returns (REVConfig memory) {
+        REVStageConfig[] memory stages = new REVStageConfig[](1);
+        stages[0] = REVStageConfig({
+            startsAtOrAfter: uint48(block.timestamp),
+            autoIssuances: new REVAutoIssuance[](0),
+            splitPercent: 0,
+            splits: new JBSplit[](0),
+            initialIssuance: uint112(1000e18),
+            issuanceCutFrequency: 0,
+            issuanceCutPercent: 0,
+            cashOutTaxRate: 5000,
+            extraMetadata: 0
+        });
+        return REVConfig({
+            description: REVDescription("Terminal Test", "TERM", "", salt),
+            baseCurrency: uint32(uint160(JBConstants.NATIVE_TOKEN)),
+            splitOperator: multisig(),
+            stageConfigurations: stages
+        });
+    }
+
+    function _terminalConfigs(IJBMultiTerminal terminal) internal pure returns (JBTerminalConfig[] memory tc) {
+        JBAccountingContext[] memory acc = new JBAccountingContext[](1);
+        acc[0] = JBAccountingContext({
+            token: JBConstants.NATIVE_TOKEN, decimals: 18, currency: uint32(uint160(JBConstants.NATIVE_TOKEN))
+        });
+        tc = new JBTerminalConfig[](1);
+        tc[0] = JBTerminalConfig({terminal: terminal, accountingContextsToAccept: acc});
+    }
+
+    function _deployFeeProject() internal {
+        JBAccountingContext[] memory acc = new JBAccountingContext[](1);
+        acc[0] = JBAccountingContext({
+            token: JBConstants.NATIVE_TOKEN, decimals: 18, currency: uint32(uint160(JBConstants.NATIVE_TOKEN))
+        });
+        JBTerminalConfig[] memory tc = new JBTerminalConfig[](1);
+        tc[0] = JBTerminalConfig({terminal: jbMultiTerminal(), accountingContextsToAccept: acc});
+        REVStageConfig[] memory stages = new REVStageConfig[](1);
+        stages[0] = REVStageConfig({
+            startsAtOrAfter: uint48(block.timestamp),
+            autoIssuances: new REVAutoIssuance[](0),
+            splitPercent: 0,
+            splits: new JBSplit[](0),
+            initialIssuance: uint112(1000e18),
+            issuanceCutFrequency: 0,
+            issuanceCutPercent: 0,
+            cashOutTaxRate: 0,
+            extraMetadata: 0
+        });
+        REVConfig memory feeConfig = REVConfig({
+            description: REVDescription("Fee Project", "FEE", "", bytes32("FEE")),
+            baseCurrency: uint32(uint160(JBConstants.NATIVE_TOKEN)),
+            splitOperator: multisig(),
+            stageConfigurations: stages
+        });
+        vm.prank(multisig());
+        REV_DEPLOYER.deployFor({
+            revnetId: FEE_PROJECT_ID,
+            configuration: feeConfig,
+            terminalConfigurations: tc,
+            suckerDeploymentConfiguration: REVSuckerDeploymentConfig({
+                deployerConfigurations: new JBSuckerDeployerConfig[](0), salt: keccak256("FEE")
+            }),
+            tiered721HookConfiguration: REVEmpty721Config.empty721Config(uint32(uint160(JBConstants.NATIVE_TOKEN))),
+            allowedPosts: REVEmpty721Config.emptyAllowedPosts()
+        });
+    }
+}