@rev-net/core-v6 0.0.35 → 0.0.37

package/test/audit/NemesisVerification.t.sol

@@ -0,0 +1,97 @@
+// SPDX-License-Identifier: MIT
+pragma solidity 0.8.28;
+
+import {Test} from "forge-std/Test.sol";
+
+import {JBConstants} from "@bananapus/core-v6/src/libraries/JBConstants.sol";
+import {JBCashOuts} from "@bananapus/core-v6/src/libraries/JBCashOuts.sol";
+
+contract CodexNemesisVerificationTest is Test {
+    function testConfigurationHashDoesNotCommitSplitOperatorSplitsOrExtraMetadata() public pure {
+        bytes32 hashA = _revDeployerEncodedConfigurationHash();
+        bytes32 hashB = _revDeployerEncodedConfigurationHash();
+
+        assertEq(hashA, hashB, "actual REVDeployer hash collides");
+
+        bytes32 fullCommitmentA = keccak256(
+            abi.encode(hashA, address(0x1111), uint32(7000), address(0xAAAA), uint48(30 days), uint16(0x0004))
+        );
+        bytes32 fullCommitmentB = keccak256(
+            abi.encode(hashB, address(0x2222), uint32(7000), address(0xBBBB), uint48(90 days), uint16(0x0000))
+        );
+
+        assertNotEq(fullCommitmentA, fullCommitmentB, "omitted fields are economically distinct");
+    }
+
+    function testRemoteLoanStateOmissionOverstatesCrossChainCashOutValue() public pure {
+        uint256 localSupply = 100 ether;
+        uint256 localSurplus = 100 ether;
+        uint256 remoteVisibleSupply = 1 ether;
+        uint256 remoteVisibleSurplus = 1 ether;
+        uint256 omittedRemoteLoanCollateral = 99 ether;
+        uint256 omittedRemoteLoanDebt = 99 ether;
+        uint256 cashOutCount = 100 ether;
+        uint256 cashOutTaxRate = 1000;
+
+        uint256 current = JBCashOuts.cashOutFrom({
+            surplus: localSurplus + remoteVisibleSurplus,
+            cashOutCount: cashOutCount,
+            totalSupply: localSupply + remoteVisibleSupply,
+            cashOutTaxRate: cashOutTaxRate
+        });
+
+        uint256 withRemoteLoans = JBCashOuts.cashOutFrom({
+            surplus: localSurplus + remoteVisibleSurplus + omittedRemoteLoanDebt,
+            cashOutCount: cashOutCount,
+            totalSupply: localSupply + remoteVisibleSupply + omittedRemoteLoanCollateral,
+            cashOutTaxRate: cashOutTaxRate
+        });
+
+        assertGt(current, withRemoteLoans, "omitting remote loan state should not increase cash-out value");
+        assertGt(current - withRemoteLoans, 4 ether, "drift is material");
+    }
+
+    function testRemoteLoanStateOmissionCanHitFullSupplyBranch() public pure {
+        uint256 localSupply = 100 ether;
+        uint256 localSurplus = 100 ether;
+        uint256 omittedRemoteLoanCollateral = 100 ether;
+        uint256 omittedRemoteLoanDebt = 100 ether;
+        uint256 cashOutCount = 100 ether;
+        uint256 cashOutTaxRate = 1000;
+
+        uint256 current = JBCashOuts.cashOutFrom({
+            surplus: localSurplus, cashOutCount: cashOutCount, totalSupply: localSupply, cashOutTaxRate: cashOutTaxRate
+        });
+
+        uint256 withRemoteLoans = JBCashOuts.cashOutFrom({
+            surplus: localSurplus + omittedRemoteLoanDebt,
+            cashOutCount: cashOutCount,
+            totalSupply: localSupply + omittedRemoteLoanCollateral,
+            cashOutTaxRate: cashOutTaxRate
+        });
+
+        assertEq(current, localSurplus, "current path enters full-supply branch");
+        assertEq(withRemoteLoans, 95 ether, "true omnichain curve should remain partial");
+        assertGt(current, withRemoteLoans, "full-supply branch overstates cash-out value");
+    }
+
+    function _revDeployerEncodedConfigurationHash() internal pure returns (bytes32) {
+        bytes memory encodedConfiguration = abi.encode(uint32(1), "REV", "REV", bytes32("codex-nemesis"));
+
+        encodedConfiguration = abi.encode(encodedConfiguration, address(0x1234));
+
+        encodedConfiguration = abi.encode(
+            encodedConfiguration,
+            uint48(1_740_089_444),
+            uint16(7000),
+            uint112(1_000_000 ether),
+            uint32(30 days),
+            uint32(0),
+            uint16(JBConstants.MAX_CASH_OUT_TAX_RATE / 2)
+        );
+
+        encodedConfiguration = abi.encode(encodedConfiguration, uint32(1), address(0xBEEF), uint104(100_000 ether));
+
+        return keccak256(encodedConfiguration);
+    }
+}

package/test/audit/REVOwnerCurrencyMismatch.t.sol

@@ -0,0 +1,188 @@
+// SPDX-License-Identifier: MIT
+pragma solidity 0.8.28;
+
+import "forge-std/Test.sol";
+import "@bananapus/core-v6/test/helpers/TestBaseWorkflow.sol";
+import {IJBBuybackHookRegistry} from "@bananapus/buyback-hook-v6/src/interfaces/IJBBuybackHookRegistry.sol";
+import {IJBRulesetDataHook} from "@bananapus/core-v6/src/interfaces/IJBRulesetDataHook.sol";
+import {JBBeforeCashOutRecordedContext} from "@bananapus/core-v6/src/structs/JBBeforeCashOutRecordedContext.sol";
+import {JBBeforePayRecordedContext} from "@bananapus/core-v6/src/structs/JBBeforePayRecordedContext.sol";
+import {JBCashOutHookSpecification} from "@bananapus/core-v6/src/structs/JBCashOutHookSpecification.sol";
+import {JBPayHookSpecification} from "@bananapus/core-v6/src/structs/JBPayHookSpecification.sol";
+import {JBTokenAmount} from "@bananapus/core-v6/src/structs/JBTokenAmount.sol";
+import {JBRuleset} from "@bananapus/core-v6/src/structs/JBRuleset.sol";
+import {JBConstants} from "@bananapus/core-v6/src/libraries/JBConstants.sol";
+import {IJBSuckerRegistry} from "@bananapus/suckers-v6/src/interfaces/IJBSuckerRegistry.sol";
+import {IERC165} from "@openzeppelin/contracts/utils/introspection/IERC165.sol";
+import {PoolKey} from "@uniswap/v4-core/src/types/PoolKey.sol";
+
+import {REVOwner} from "../../src/REVOwner.sol";
+
+/// @notice Mock sucker registry that returns configurable remote values.
+/// @dev All functions are view/pure to avoid StateChangeDuringStaticCall when called from
+/// REVOwner.beforeCashOutRecordedWith (which is a view function).
+contract MockSuckerRegistry {
+    uint256 public remoteSurplusToReturn;
+    uint256 public remoteSupplyToReturn;
+
+    function setRemoteValues(uint256 supply, uint256 surplus) external {
+        remoteSupplyToReturn = supply;
+        remoteSurplusToReturn = surplus;
+    }
+
+    function isSuckerOf(uint256, address) external pure returns (bool) {
+        return false;
+    }
+
+    function remoteTotalSupplyOf(uint256) external view returns (uint256) {
+        return remoteSupplyToReturn;
+    }
+
+    function remoteSurplusOf(uint256, uint256, uint256) external view returns (uint256) {
+        return remoteSurplusToReturn;
+    }
+}
+
+/// @notice Minimal echo buyback registry that passes through cash out context unchanged.
+contract EchoBuybackRegistry is IJBRulesetDataHook {
+    function beforeCashOutRecordedWith(JBBeforeCashOutRecordedContext calldata context)
+        external
+        pure
+        returns (
+            uint256 cashOutTaxRate,
+            uint256 cashOutCount,
+            uint256 totalSupply,
+            uint256 effectiveSurplusValue,
+            JBCashOutHookSpecification[] memory hookSpecifications
+        )
+    {
+        cashOutTaxRate = context.cashOutTaxRate;
+        cashOutCount = context.cashOutCount;
+        totalSupply = context.totalSupply;
+        effectiveSurplusValue = context.surplus.value;
+        hookSpecifications = new JBCashOutHookSpecification[](0);
+    }
+
+    function beforePayRecordedWith(JBBeforePayRecordedContext calldata context)
+        external
+        pure
+        returns (uint256 weight, JBPayHookSpecification[] memory hookSpecifications)
+    {
+        weight = context.weight;
+        hookSpecifications = new JBPayHookSpecification[](0);
+    }
+
+    function hasMintPermissionFor(uint256, JBRuleset calldata, address) external pure returns (bool) {
+        return false;
+    }
+
+    function setPoolFor(uint256, PoolKey calldata, uint256, address) external pure {}
+    function setPoolFor(uint256, uint24, int24, uint256, address) external pure {}
+    function initializePoolFor(uint256, uint24, int24, uint256, address, uint160) external pure {}
+
+    function supportsInterface(bytes4 interfaceId) external pure returns (bool) {
+        return interfaceId == type(IJBRulesetDataHook).interfaceId || interfaceId == type(IERC165).interfaceId;
+    }
+}
+
+/// @notice REVOwner.beforeCashOutRecordedWith should pass the surplus currency (not the token address) to
+/// remoteSurplusOf. @dev `currency: uint256(context.surplus.currency)` passes the correct currency value,
+/// not `uint256(uint160(context.surplus.token))` which would pass the token address (e.g. 61166 for NATIVE_TOKEN).
+contract REVOwnerCurrencyMismatchTest is TestBaseWorkflow {
+    REVOwner internal ownerHook;
+    MockSuckerRegistry internal suckerRegistry;
+    EchoBuybackRegistry internal buybackRegistry;
+
+    function setUp() public override {
+        super.setUp();
+
+        suckerRegistry = new MockSuckerRegistry();
+        buybackRegistry = new EchoBuybackRegistry();
+
+        ownerHook = new REVOwner(
+            IJBBuybackHookRegistry(address(buybackRegistry)),
+            jbDirectory(),
+            999_999, // fee revnet ID (won't be used in this test path)
+            IJBSuckerRegistry(address(suckerRegistry)),
+            address(0), // loans
+            address(0) // hidden tokens
+        );
+    }
+
+    /// @notice Verify that remoteSurplusOf is called with the context's currency, not the token address.
+    /// @dev NATIVE_TOKEN = 0x000000000000000000000000000000000000EEEe
+    ///      uint160(NATIVE_TOKEN) = 61166
+    ///      The correct currency for ETH is 1 (baseCurrency).
+    ///      Before the fix, 61166 was passed. After the fix, 1 is passed.
+    function test_remoteSurplusOf_receives_currency_not_token_address() public {
+        // Set up remote values so the registry returns something.
+        suckerRegistry.setRemoteValues(500 ether, 900 ether);
+
+        uint32 ethCurrency = 1; // ETH baseCurrency identifier
+
+        // Build a context where surplus.token = NATIVE_TOKEN and surplus.currency = 1 (ETH).
+        // These are intentionally different values to detect the bug.
+        JBBeforeCashOutRecordedContext memory context = JBBeforeCashOutRecordedContext({
+            terminal: address(jbMultiTerminal()),
+            holder: address(0xCAFE),
+            projectId: 1,
+            rulesetId: 0,
+            cashOutCount: 100 ether,
+            totalSupply: 1000 ether,
+            surplus: JBTokenAmount({
+                token: JBConstants.NATIVE_TOKEN, // 0xEEEe
+                value: 100 ether,
+                decimals: 18,
+                currency: ethCurrency // 1
+            }),
+            useTotalSurplus: true,
+            cashOutTaxRate: 0, // zero tax = feeless path (simpler, avoids needing fee terminal)
+            beneficiaryIsFeeless: false,
+            metadata: ""
+        });
+
+        // Use vm.expectCall to verify the exact parameters passed to remoteSurplusOf.
+        // After fix: currency should be 1 (ethCurrency), NOT 61166 (uint160(NATIVE_TOKEN)).
+        // This assertion will fail if the buggy code passes uint256(uint160(NATIVE_TOKEN)) = 61166.
+        vm.expectCall(
+            address(suckerRegistry), abi.encodeCall(suckerRegistry.remoteSurplusOf, (1, 18, uint256(ethCurrency)))
+        );
+
+        ownerHook.beforeCashOutRecordedWith(context);
+    }
+
+    /// @notice Verify that the remote surplus is actually included in the returned effectiveSurplusValue.
+    /// @dev This is a regression test: if the wrong currency is passed, the registry might return 0
+    ///      and the remote surplus would be silently dropped.
+    function test_remoteSurplus_included_in_effectiveSurplus() public {
+        suckerRegistry.setRemoteValues(500 ether, 900 ether);
+
+        uint32 ethCurrency = 1;
+
+        JBBeforeCashOutRecordedContext memory context = JBBeforeCashOutRecordedContext({
+            terminal: address(jbMultiTerminal()),
+            holder: address(0xCAFE),
+            projectId: 1,
+            rulesetId: 0,
+            cashOutCount: 100 ether,
+            totalSupply: 1000 ether,
+            surplus: JBTokenAmount({
+                token: JBConstants.NATIVE_TOKEN, value: 100 ether, decimals: 18, currency: ethCurrency
+            }),
+            useTotalSurplus: true,
+            cashOutTaxRate: 0,
+            beneficiaryIsFeeless: false,
+            metadata: ""
+        });
+
+        (,, uint256 returnedSupply, uint256 returnedSurplus,) = ownerHook.beforeCashOutRecordedWith(context);
+
+        // Remote supply should be added.
+        assertEq(returnedSupply, 1500 ether, "totalSupply should include remote supply");
+
+        // Remote surplus should be added (100 local + 900 remote = 1000).
+        assertEq(
+            returnedSurplus, 1000 ether, "effectiveSurplusValue should include remote surplus (100 local + 900 remote)"
+        );
+    }
+}

package/test/audit/REVOwnerRemoteSurplusCurrencyMismatch.t.sol

@@ -0,0 +1,140 @@
+// SPDX-License-Identifier: MIT
+pragma solidity 0.8.28;
+
+import "forge-std/Test.sol";
+import "@bananapus/core-v6/test/helpers/TestBaseWorkflow.sol";
+import {IJBBuybackHookRegistry} from "@bananapus/buyback-hook-v6/src/interfaces/IJBBuybackHookRegistry.sol";
+import {IJBCashOutHook} from "@bananapus/core-v6/src/interfaces/IJBCashOutHook.sol";
+import {IJBRulesetDataHook} from "@bananapus/core-v6/src/interfaces/IJBRulesetDataHook.sol";
+import {JBBeforeCashOutRecordedContext} from "@bananapus/core-v6/src/structs/JBBeforeCashOutRecordedContext.sol";
+import {JBBeforePayRecordedContext} from "@bananapus/core-v6/src/structs/JBBeforePayRecordedContext.sol";
+import {JBCashOutHookSpecification} from "@bananapus/core-v6/src/structs/JBCashOutHookSpecification.sol";
+import {JBPayHookSpecification} from "@bananapus/core-v6/src/structs/JBPayHookSpecification.sol";
+import {JBTokenAmount} from "@bananapus/core-v6/src/structs/JBTokenAmount.sol";
+import {JBRuleset} from "@bananapus/core-v6/src/structs/JBRuleset.sol";
+import {IJBSuckerRegistry} from "@bananapus/suckers-v6/src/interfaces/IJBSuckerRegistry.sol";
+import {IERC165} from "@openzeppelin/contracts/utils/introspection/IERC165.sol";
+import {PoolKey} from "@uniswap/v4-core/src/types/PoolKey.sol";
+
+import {REVOwner} from "../../src/REVOwner.sol";
+
+contract CurrencyAwareSuckerRegistry {
+    uint256 public expectedCurrency;
+    uint256 public remoteSupply;
+    uint256 public remoteSurplus;
+
+    function setRemoteValues(uint256 currency, uint256 supply, uint256 surplus) external {
+        expectedCurrency = currency;
+        remoteSupply = supply;
+        remoteSurplus = surplus;
+    }
+
+    function isSuckerOf(uint256, address) external pure returns (bool) {
+        return false;
+    }
+
+    function remoteTotalSupplyOf(uint256) external view returns (uint256) {
+        return remoteSupply;
+    }
+
+    function remoteSurplusOf(uint256, uint256, uint256 currency) external view returns (uint256) {
+        return currency == expectedCurrency ? remoteSurplus : 0;
+    }
+}
+
+contract EchoBuybackRegistry is IJBRulesetDataHook {
+    function beforeCashOutRecordedWith(JBBeforeCashOutRecordedContext calldata context)
+        external
+        pure
+        returns (
+            uint256 cashOutTaxRate,
+            uint256 cashOutCount,
+            uint256 totalSupply,
+            uint256 effectiveSurplusValue,
+            JBCashOutHookSpecification[] memory hookSpecifications
+        )
+    {
+        cashOutTaxRate = context.cashOutTaxRate;
+        cashOutCount = context.cashOutCount;
+        totalSupply = context.totalSupply;
+        effectiveSurplusValue = context.surplus.value;
+        hookSpecifications = new JBCashOutHookSpecification[](0);
+    }
+
+    function beforePayRecordedWith(JBBeforePayRecordedContext calldata context)
+        external
+        pure
+        returns (uint256 weight, JBPayHookSpecification[] memory hookSpecifications)
+    {
+        weight = context.weight;
+        hookSpecifications = new JBPayHookSpecification[](0);
+    }
+
+    function hasMintPermissionFor(uint256, JBRuleset calldata, address) external pure returns (bool) {
+        return false;
+    }
+
+    function setPoolFor(uint256, PoolKey calldata, uint256, address) external pure {}
+    function setPoolFor(uint256, uint24, int24, uint256, address) external pure {}
+    function initializePoolFor(uint256, uint24, int24, uint256, address, uint160) external pure {}
+
+    function supportsInterface(bytes4 interfaceId) external pure returns (bool) {
+        return interfaceId == type(IJBRulesetDataHook).interfaceId || interfaceId == type(IERC165).interfaceId;
+    }
+}
+
+contract REVOwnerRemoteSurplusCurrencyMismatchTest is TestBaseWorkflow {
+    REVOwner internal ownerHook;
+    CurrencyAwareSuckerRegistry internal suckerRegistry;
+    EchoBuybackRegistry internal buybackRegistry;
+
+    uint32 internal constant ETH_CURRENCY = 1;
+
+    function setUp() public override {
+        super.setUp();
+
+        suckerRegistry = new CurrencyAwareSuckerRegistry();
+        buybackRegistry = new EchoBuybackRegistry();
+
+        ownerHook = new REVOwner(
+            IJBBuybackHookRegistry(address(buybackRegistry)),
+            jbDirectory(),
+            999_999,
+            IJBSuckerRegistry(address(suckerRegistry)),
+            address(0),
+            address(0)
+        );
+    }
+
+    function test_beforeCashOutRecordedWith_usesTokenAddressInsteadOfCurrencyForRemoteSurplus() public {
+        suckerRegistry.setRemoteValues(ETH_CURRENCY, 500 ether, 900 ether);
+
+        address usdToken = address(0xBEEF);
+
+        JBBeforeCashOutRecordedContext memory context = JBBeforeCashOutRecordedContext({
+            terminal: address(jbMultiTerminal()),
+            holder: address(0xCAFE),
+            projectId: 1,
+            rulesetId: 0,
+            cashOutCount: 100 ether,
+            totalSupply: 1000 ether,
+            surplus: JBTokenAmount({token: usdToken, value: 100 ether, decimals: 18, currency: ETH_CURRENCY}),
+            useTotalSurplus: true,
+            cashOutTaxRate: 0,
+            beneficiaryIsFeeless: false,
+            metadata: ""
+        });
+
+        (,, uint256 returnedSupply, uint256 returnedSurplus,) = ownerHook.beforeCashOutRecordedWith(context);
+
+        assertEq(returnedSupply, 1500 ether, "remote supply should still be included");
+        // Remote surplus is correctly included (100 local + 900 remote = 1000) because the currency is passed to
+        // remoteSurplusOf.
+        assertEq(returnedSurplus, 1000 ether, "remote surplus should be included now that currency is passed correctly");
+        assertEq(
+            suckerRegistry.remoteSurplusOf(1, 18, ETH_CURRENCY),
+            900 ether,
+            "registry confirms surplus exists for the requested currency"
+        );
+    }
+}