@rev-net/core-v6 0.0.36 → 0.0.39
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +2 -2
- package/README.md +6 -7
- package/foundry.toml +1 -1
- package/package.json +23 -16
- package/references/operations.md +1 -1
- package/references/runtime.md +1 -1
- package/script/Deploy.s.sol +12 -9
- package/src/REVDeployer.sol +60 -65
- package/src/REVHiddenTokens.sol +2 -2
- package/src/REVLoans.sol +134 -90
- package/src/REVOwner.sol +124 -17
- package/src/interfaces/IREVDeployer.sol +2 -1
- package/src/interfaces/IREVHiddenTokens.sol +4 -1
- package/src/interfaces/IREVOwner.sol +5 -0
- package/ADMINISTRATION.md +0 -73
- package/ARCHITECTURE.md +0 -116
- package/AUDIT_INSTRUCTIONS.md +0 -90
- package/RISKS.md +0 -97
- package/SKILLS.md +0 -46
- package/STYLE_GUIDE.md +0 -610
- package/USER_JOURNEYS.md +0 -195
- package/foundry.lock +0 -11
- package/slither-ci.config.json +0 -10
- package/sphinx.lock +0 -507
- package/test/REV.integrations.t.sol +0 -573
- package/test/REVAutoIssuanceFuzz.t.sol +0 -328
- package/test/REVDeployerRegressions.t.sol +0 -396
- package/test/REVInvincibility.t.sol +0 -1371
- package/test/REVInvincibilityHandler.sol +0 -387
- package/test/REVLifecycle.t.sol +0 -420
- package/test/REVLoans.invariants.t.sol +0 -724
- package/test/REVLoansAttacks.t.sol +0 -816
- package/test/REVLoansFeeRecovery.t.sol +0 -783
- package/test/REVLoansFindings.t.sol +0 -711
- package/test/REVLoansRegressions.t.sol +0 -364
- package/test/REVLoansSourceFeeRecovery.t.sol +0 -517
- package/test/REVLoansSourced.t.sol +0 -1839
- package/test/REVLoansUnSourced.t.sol +0 -409
- package/test/TestAuditFixVerification.t.sol +0 -675
- package/test/TestBurnHeldTokens.t.sol +0 -394
- package/test/TestCEIPattern.t.sol +0 -508
- package/test/TestCashOutCallerValidation.t.sol +0 -452
- package/test/TestConversionDocumentation.t.sol +0 -368
- package/test/TestCrossCurrencyReclaim.t.sol +0 -610
- package/test/TestCrossSourceReallocation.t.sol +0 -361
- package/test/TestERC2771MetaTx.t.sol +0 -585
- package/test/TestEmptyBuybackSpecs.t.sol +0 -300
- package/test/TestFlashLoanSurplus.t.sol +0 -365
- package/test/TestHiddenTokens.t.sol +0 -474
- package/test/TestHookArrayOOB.t.sol +0 -278
- package/test/TestLiquidationBehavior.t.sol +0 -398
- package/test/TestLoanSourceRotation.t.sol +0 -553
- package/test/TestLoansCashOutDelay.t.sol +0 -493
- package/test/TestLongTailEconomics.t.sol +0 -677
- package/test/TestLowFindings.t.sol +0 -677
- package/test/TestMixedFixes.t.sol +0 -593
- package/test/TestPermit2Signatures.t.sol +0 -683
- package/test/TestReallocationSandwich.t.sol +0 -412
- package/test/TestRevnetRegressions.t.sol +0 -350
- package/test/TestSplitWeightAdjustment.t.sol +0 -527
- package/test/TestSplitWeightE2E.t.sol +0 -605
- package/test/TestSplitWeightFork.t.sol +0 -855
- package/test/TestStageTransitionBorrowable.t.sol +0 -301
- package/test/TestSwapTerminalPermission.t.sol +0 -262
- package/test/TestTerminalEncodingInHash.t.sol +0 -326
- package/test/TestUint112Overflow.t.sol +0 -311
- package/test/TestZeroAmountLoanGuard.t.sol +0 -378
- package/test/TestZeroRepayment.t.sol +0 -354
- package/test/audit/CodexCrossChainBuybackRouteMismatch.t.sol +0 -184
- package/test/audit/CodexPhantomSurplusTerminal.t.sol +0 -367
- package/test/audit/CodexREVOwnerRemoteSurplusCurrencyMismatch.t.sol +0 -142
- package/test/audit/LoanIdOverflowGuard.t.sol +0 -523
- package/test/audit/NemesisOperatorDelegation.t.sol +0 -356
- package/test/audit/SupportsInterfaceTest.t.sol +0 -51
- package/test/audit/TestFeeAllowanceLeak.t.sol +0 -197
- package/test/audit/TestLoansAndDeployerFixes.t.sol +0 -576
- package/test/fork/ForkTestBase.sol +0 -727
- package/test/fork/TestAutoIssuanceFork.t.sol +0 -148
- package/test/fork/TestCashOutFork.t.sol +0 -253
- package/test/fork/TestIssuanceDecayFork.t.sol +0 -158
- package/test/fork/TestLoanBorrowFork.t.sol +0 -163
- package/test/fork/TestLoanCrossRulesetFork.t.sol +0 -308
- package/test/fork/TestLoanERC20Fork.t.sol +0 -465
- package/test/fork/TestLoanLiquidationFork.t.sol +0 -135
- package/test/fork/TestLoanReallocateFork.t.sol +0 -113
- package/test/fork/TestLoanRepayFork.t.sol +0 -188
- package/test/fork/TestLoanTransferFork.t.sol +0 -143
- package/test/fork/TestPermit2PaymentFork.t.sol +0 -300
- package/test/fork/TestSplitWeightFork.t.sol +0 -189
- package/test/helpers/MaliciousContracts.sol +0 -247
- package/test/helpers/REVEmpty721Config.sol +0 -45
- package/test/mock/MockBuybackCashOutRecorder.sol +0 -84
- package/test/mock/MockBuybackDataHook.sol +0 -112
- package/test/mock/MockBuybackDataHookMintPath.sol +0 -68
- package/test/mock/MockSuckerRegistry.sol +0 -17
- package/test/regression/TestBurnPermissionRequired.t.sol +0 -294
- package/test/regression/TestCashOutBuybackFeeLeak.t.sol +0 -232
- package/test/regression/TestCrossRevnetLiquidation.t.sol +0 -255
- package/test/regression/TestCumulativeLoanCounter.t.sol +0 -361
- package/test/regression/TestLiquidateGapHandling.t.sol +0 -394
- package/test/regression/TestZeroPriceFeed.t.sol +0 -422
|
@@ -1,300 +0,0 @@
|
|
|
1
|
-
// SPDX-License-Identifier: MIT
|
|
2
|
-
pragma solidity 0.8.28;
|
|
3
|
-
|
|
4
|
-
// forge-lint: disable-next-line(unaliased-plain-import)
|
|
5
|
-
import "forge-std/Test.sol";
|
|
6
|
-
// forge-lint: disable-next-line(unaliased-plain-import)
|
|
7
|
-
import /* {*} from */ "@bananapus/core-v6/test/helpers/TestBaseWorkflow.sol";
|
|
8
|
-
// forge-lint: disable-next-line(unaliased-plain-import)
|
|
9
|
-
import /* {*} from */ "./../src/REVDeployer.sol";
|
|
10
|
-
// forge-lint: disable-next-line(unaliased-plain-import)
|
|
11
|
-
import "@croptop/core-v6/src/CTPublisher.sol";
|
|
12
|
-
import {MockBuybackDataHookMintPath} from "./mock/MockBuybackDataHookMintPath.sol";
|
|
13
|
-
// forge-lint: disable-next-line(unaliased-plain-import)
|
|
14
|
-
import "@bananapus/core-v6/script/helpers/CoreDeploymentLib.sol";
|
|
15
|
-
// forge-lint: disable-next-line(unaliased-plain-import)
|
|
16
|
-
import "@bananapus/721-hook-v6/script/helpers/Hook721DeploymentLib.sol";
|
|
17
|
-
// forge-lint: disable-next-line(unaliased-plain-import)
|
|
18
|
-
import "@bananapus/suckers-v6/script/helpers/SuckerDeploymentLib.sol";
|
|
19
|
-
// forge-lint: disable-next-line(unaliased-plain-import)
|
|
20
|
-
import "@croptop/core-v6/script/helpers/CroptopDeploymentLib.sol";
|
|
21
|
-
// forge-lint: disable-next-line(unaliased-plain-import)
|
|
22
|
-
import "@bananapus/router-terminal-v6/script/helpers/RouterTerminalDeploymentLib.sol";
|
|
23
|
-
import {JBConstants} from "@bananapus/core-v6/src/libraries/JBConstants.sol";
|
|
24
|
-
import {JBAccountingContext} from "@bananapus/core-v6/src/structs/JBAccountingContext.sol";
|
|
25
|
-
import {REVLoans} from "../src/REVLoans.sol";
|
|
26
|
-
import {REVStageConfig, REVAutoIssuance} from "../src/structs/REVStageConfig.sol";
|
|
27
|
-
import {REVDescription} from "../src/structs/REVDescription.sol";
|
|
28
|
-
import {IREVLoans} from "./../src/interfaces/IREVLoans.sol";
|
|
29
|
-
import {JBSuckerDeployerConfig} from "@bananapus/suckers-v6/src/structs/JBSuckerDeployerConfig.sol";
|
|
30
|
-
import {JBSuckerRegistry} from "@bananapus/suckers-v6/src/JBSuckerRegistry.sol";
|
|
31
|
-
import {JB721TiersHookDeployer} from "@bananapus/721-hook-v6/src/JB721TiersHookDeployer.sol";
|
|
32
|
-
import {JB721TiersHook} from "@bananapus/721-hook-v6/src/JB721TiersHook.sol";
|
|
33
|
-
import {JB721TiersHookStore} from "@bananapus/721-hook-v6/src/JB721TiersHookStore.sol";
|
|
34
|
-
import {JB721CheckpointsDeployer} from "@bananapus/721-hook-v6/src/JB721CheckpointsDeployer.sol";
|
|
35
|
-
import {IJB721CheckpointsDeployer} from "@bananapus/721-hook-v6/src/interfaces/IJB721CheckpointsDeployer.sol";
|
|
36
|
-
import {JBAddressRegistry} from "@bananapus/address-registry-v6/src/JBAddressRegistry.sol";
|
|
37
|
-
import {IJBAddressRegistry} from "@bananapus/address-registry-v6/src/interfaces/IJBAddressRegistry.sol";
|
|
38
|
-
import {JBBeforePayRecordedContext} from "@bananapus/core-v6/src/structs/JBBeforePayRecordedContext.sol";
|
|
39
|
-
import {JBPayHookSpecification} from "@bananapus/core-v6/src/structs/JBPayHookSpecification.sol";
|
|
40
|
-
import {JBTokenAmount} from "@bananapus/core-v6/src/structs/JBTokenAmount.sol";
|
|
41
|
-
import {REVEmpty721Config} from "./helpers/REVEmpty721Config.sol";
|
|
42
|
-
import {REVOwner} from "../src/REVOwner.sol";
|
|
43
|
-
import {IREVDeployer} from "../src/interfaces/IREVDeployer.sol";
|
|
44
|
-
import {MockSuckerRegistry} from "./mock/MockSuckerRegistry.sol";
|
|
45
|
-
|
|
46
|
-
/// @notice Regression tests for the empty buyback hook specifications fix.
|
|
47
|
-
/// When JBBuybackHook determines minting is cheaper than swapping, it returns an empty
|
|
48
|
-
/// hookSpecifications array. Before the fix, REVDeployer.beforePayRecordedWith would
|
|
49
|
-
/// Panic(0x32) (array out-of-bounds) when accessing buybackHookSpecifications[0].
|
|
50
|
-
contract TestEmptyBuybackSpecs is TestBaseWorkflow {
|
|
51
|
-
// forge-lint: disable-next-line(mixed-case-variable)
|
|
52
|
-
bytes32 REV_DEPLOYER_SALT = "REVDeployer";
|
|
53
|
-
|
|
54
|
-
// forge-lint: disable-next-line(mixed-case-variable)
|
|
55
|
-
REVDeployer REV_DEPLOYER;
|
|
56
|
-
// forge-lint: disable-next-line(mixed-case-variable)
|
|
57
|
-
REVOwner REV_OWNER;
|
|
58
|
-
// forge-lint: disable-next-line(mixed-case-variable)
|
|
59
|
-
JB721TiersHook EXAMPLE_HOOK;
|
|
60
|
-
// forge-lint: disable-next-line(mixed-case-variable)
|
|
61
|
-
IJB721TiersHookDeployer HOOK_DEPLOYER;
|
|
62
|
-
// forge-lint: disable-next-line(mixed-case-variable)
|
|
63
|
-
IJB721TiersHookStore HOOK_STORE;
|
|
64
|
-
// forge-lint: disable-next-line(mixed-case-variable)
|
|
65
|
-
IJBAddressRegistry ADDRESS_REGISTRY;
|
|
66
|
-
// forge-lint: disable-next-line(mixed-case-variable)
|
|
67
|
-
IREVLoans LOANS_CONTRACT;
|
|
68
|
-
// forge-lint: disable-next-line(mixed-case-variable)
|
|
69
|
-
IJBSuckerRegistry SUCKER_REGISTRY;
|
|
70
|
-
// forge-lint: disable-next-line(mixed-case-variable)
|
|
71
|
-
CTPublisher PUBLISHER;
|
|
72
|
-
// forge-lint: disable-next-line(mixed-case-variable)
|
|
73
|
-
MockBuybackDataHookMintPath MOCK_BUYBACK_MINT_PATH;
|
|
74
|
-
|
|
75
|
-
// forge-lint: disable-next-line(mixed-case-variable)
|
|
76
|
-
uint256 FEE_PROJECT_ID;
|
|
77
|
-
|
|
78
|
-
address private constant TRUSTED_FORWARDER = 0xB2b5841DBeF766d4b521221732F9B618fCf34A87;
|
|
79
|
-
// forge-lint: disable-next-line(mixed-case-variable)
|
|
80
|
-
address USER = makeAddr("user");
|
|
81
|
-
|
|
82
|
-
function setUp() public override {
|
|
83
|
-
super.setUp();
|
|
84
|
-
FEE_PROJECT_ID = jbProjects().createFor(multisig());
|
|
85
|
-
SUCKER_REGISTRY = new JBSuckerRegistry(jbDirectory(), jbPermissions(), multisig(), address(0));
|
|
86
|
-
HOOK_STORE = new JB721TiersHookStore();
|
|
87
|
-
EXAMPLE_HOOK = new JB721TiersHook(
|
|
88
|
-
jbDirectory(),
|
|
89
|
-
jbPermissions(),
|
|
90
|
-
jbPrices(),
|
|
91
|
-
jbRulesets(),
|
|
92
|
-
HOOK_STORE,
|
|
93
|
-
jbSplits(),
|
|
94
|
-
IJB721CheckpointsDeployer(address(new JB721CheckpointsDeployer())),
|
|
95
|
-
multisig()
|
|
96
|
-
);
|
|
97
|
-
ADDRESS_REGISTRY = new JBAddressRegistry();
|
|
98
|
-
HOOK_DEPLOYER = new JB721TiersHookDeployer(EXAMPLE_HOOK, HOOK_STORE, ADDRESS_REGISTRY, multisig());
|
|
99
|
-
PUBLISHER = new CTPublisher(jbDirectory(), jbPermissions(), FEE_PROJECT_ID, multisig());
|
|
100
|
-
MOCK_BUYBACK_MINT_PATH = new MockBuybackDataHookMintPath();
|
|
101
|
-
LOANS_CONTRACT = new REVLoans({
|
|
102
|
-
controller: jbController(),
|
|
103
|
-
suckerRegistry: IJBSuckerRegistry(address(new MockSuckerRegistry())),
|
|
104
|
-
revId: FEE_PROJECT_ID,
|
|
105
|
-
owner: address(this),
|
|
106
|
-
permit2: permit2(),
|
|
107
|
-
trustedForwarder: TRUSTED_FORWARDER
|
|
108
|
-
});
|
|
109
|
-
REV_OWNER = new REVOwner(
|
|
110
|
-
IJBBuybackHookRegistry(address(MOCK_BUYBACK_MINT_PATH)),
|
|
111
|
-
jbDirectory(),
|
|
112
|
-
FEE_PROJECT_ID,
|
|
113
|
-
SUCKER_REGISTRY,
|
|
114
|
-
address(LOANS_CONTRACT),
|
|
115
|
-
address(0)
|
|
116
|
-
);
|
|
117
|
-
|
|
118
|
-
REV_DEPLOYER = new REVDeployer{salt: REV_DEPLOYER_SALT}(
|
|
119
|
-
jbController(),
|
|
120
|
-
SUCKER_REGISTRY,
|
|
121
|
-
FEE_PROJECT_ID,
|
|
122
|
-
HOOK_DEPLOYER,
|
|
123
|
-
PUBLISHER,
|
|
124
|
-
IJBBuybackHookRegistry(address(MOCK_BUYBACK_MINT_PATH)),
|
|
125
|
-
address(LOANS_CONTRACT),
|
|
126
|
-
TRUSTED_FORWARDER,
|
|
127
|
-
address(REV_OWNER)
|
|
128
|
-
);
|
|
129
|
-
|
|
130
|
-
REV_OWNER.setDeployer(REV_DEPLOYER);
|
|
131
|
-
|
|
132
|
-
vm.prank(multisig());
|
|
133
|
-
jbProjects().approve(address(REV_DEPLOYER), FEE_PROJECT_ID);
|
|
134
|
-
}
|
|
135
|
-
|
|
136
|
-
function _buildMinimalConfig()
|
|
137
|
-
internal
|
|
138
|
-
view
|
|
139
|
-
returns (REVConfig memory cfg, JBTerminalConfig[] memory tc, REVSuckerDeploymentConfig memory sdc)
|
|
140
|
-
{
|
|
141
|
-
JBAccountingContext[] memory acc = new JBAccountingContext[](1);
|
|
142
|
-
acc[0] = JBAccountingContext({
|
|
143
|
-
token: JBConstants.NATIVE_TOKEN, decimals: 18, currency: uint32(uint160(JBConstants.NATIVE_TOKEN))
|
|
144
|
-
});
|
|
145
|
-
tc = new JBTerminalConfig[](1);
|
|
146
|
-
tc[0] = JBTerminalConfig({terminal: jbMultiTerminal(), accountingContextsToAccept: acc});
|
|
147
|
-
|
|
148
|
-
REVStageConfig[] memory stages = new REVStageConfig[](1);
|
|
149
|
-
JBSplit[] memory splits = new JBSplit[](1);
|
|
150
|
-
splits[0].beneficiary = payable(multisig());
|
|
151
|
-
splits[0].percent = 10_000;
|
|
152
|
-
stages[0] = REVStageConfig({
|
|
153
|
-
startsAtOrAfter: uint40(block.timestamp),
|
|
154
|
-
autoIssuances: new REVAutoIssuance[](0),
|
|
155
|
-
splitPercent: 0,
|
|
156
|
-
splits: splits,
|
|
157
|
-
initialIssuance: uint112(1000e18),
|
|
158
|
-
issuanceCutFrequency: 0,
|
|
159
|
-
issuanceCutPercent: 0,
|
|
160
|
-
cashOutTaxRate: 5000,
|
|
161
|
-
extraMetadata: 0
|
|
162
|
-
});
|
|
163
|
-
|
|
164
|
-
cfg = REVConfig({
|
|
165
|
-
// forge-lint: disable-next-line(named-struct-fields)
|
|
166
|
-
description: REVDescription("Test", "TST", "ipfs://test", "TEST_SALT"),
|
|
167
|
-
baseCurrency: uint32(uint160(JBConstants.NATIVE_TOKEN)),
|
|
168
|
-
splitOperator: multisig(),
|
|
169
|
-
stageConfigurations: stages
|
|
170
|
-
});
|
|
171
|
-
|
|
172
|
-
sdc = REVSuckerDeploymentConfig({
|
|
173
|
-
deployerConfigurations: new JBSuckerDeployerConfig[](0), salt: keccak256(abi.encodePacked("TEST"))
|
|
174
|
-
});
|
|
175
|
-
}
|
|
176
|
-
|
|
177
|
-
function _deployFeeAndRevnet() internal returns (uint256 revnetId) {
|
|
178
|
-
(REVConfig memory feeCfg, JBTerminalConfig[] memory feeTc, REVSuckerDeploymentConfig memory feeSdc) =
|
|
179
|
-
_buildMinimalConfig();
|
|
180
|
-
|
|
181
|
-
vm.prank(multisig());
|
|
182
|
-
REV_DEPLOYER.deployFor({
|
|
183
|
-
revnetId: FEE_PROJECT_ID,
|
|
184
|
-
configuration: feeCfg,
|
|
185
|
-
terminalConfigurations: feeTc,
|
|
186
|
-
suckerDeploymentConfiguration: feeSdc,
|
|
187
|
-
tiered721HookConfiguration: REVEmpty721Config.empty721Config(uint32(uint160(JBConstants.NATIVE_TOKEN))),
|
|
188
|
-
allowedPosts: REVEmpty721Config.emptyAllowedPosts()
|
|
189
|
-
});
|
|
190
|
-
|
|
191
|
-
(REVConfig memory cfg, JBTerminalConfig[] memory tc, REVSuckerDeploymentConfig memory sdc) =
|
|
192
|
-
_buildMinimalConfig();
|
|
193
|
-
// forge-lint: disable-next-line(named-struct-fields)
|
|
194
|
-
cfg.description = REVDescription("Test2", "TS2", "ipfs://test2", "TEST_SALT_2");
|
|
195
|
-
|
|
196
|
-
(revnetId,) = REV_DEPLOYER.deployFor({
|
|
197
|
-
revnetId: 0,
|
|
198
|
-
configuration: cfg,
|
|
199
|
-
terminalConfigurations: tc,
|
|
200
|
-
suckerDeploymentConfiguration: sdc,
|
|
201
|
-
tiered721HookConfiguration: REVEmpty721Config.empty721Config(uint32(uint160(JBConstants.NATIVE_TOKEN))),
|
|
202
|
-
allowedPosts: REVEmpty721Config.emptyAllowedPosts()
|
|
203
|
-
});
|
|
204
|
-
}
|
|
205
|
-
|
|
206
|
-
/// @notice REGRESSION: Payment to revnet must succeed when buyback hook returns empty specs (mint path).
|
|
207
|
-
/// Before the fix, this would Panic(0x32) due to accessing buybackHookSpecifications[0] on an empty array.
|
|
208
|
-
function test_payRevnet_emptyBuybackSpecs_succeeds() public {
|
|
209
|
-
uint256 revnetId = _deployFeeAndRevnet();
|
|
210
|
-
|
|
211
|
-
vm.deal(USER, 1 ether);
|
|
212
|
-
vm.prank(USER);
|
|
213
|
-
jbMultiTerminal().pay{value: 1 ether}({
|
|
214
|
-
projectId: revnetId,
|
|
215
|
-
token: JBConstants.NATIVE_TOKEN,
|
|
216
|
-
amount: 1 ether,
|
|
217
|
-
beneficiary: USER,
|
|
218
|
-
minReturnedTokens: 0,
|
|
219
|
-
memo: "payment with mint path buyback",
|
|
220
|
-
metadata: ""
|
|
221
|
-
});
|
|
222
|
-
|
|
223
|
-
uint256 balance = jbTokens().totalBalanceOf(USER, revnetId);
|
|
224
|
-
assertGt(balance, 0, "Should have received tokens when buyback hook takes mint path");
|
|
225
|
-
}
|
|
226
|
-
|
|
227
|
-
/// @notice Payment with various amounts should work when buyback hook returns empty specs.
|
|
228
|
-
function test_payRevnet_emptyBuybackSpecs_variousAmounts(uint96 amount) public {
|
|
229
|
-
vm.assume(amount > 0.001 ether && amount < 100 ether);
|
|
230
|
-
uint256 revnetId = _deployFeeAndRevnet();
|
|
231
|
-
|
|
232
|
-
vm.deal(USER, amount);
|
|
233
|
-
vm.prank(USER);
|
|
234
|
-
jbMultiTerminal().pay{value: amount}({
|
|
235
|
-
projectId: revnetId,
|
|
236
|
-
token: JBConstants.NATIVE_TOKEN,
|
|
237
|
-
amount: amount,
|
|
238
|
-
beneficiary: USER,
|
|
239
|
-
minReturnedTokens: 0,
|
|
240
|
-
memo: "",
|
|
241
|
-
metadata: ""
|
|
242
|
-
});
|
|
243
|
-
|
|
244
|
-
uint256 balance = jbTokens().totalBalanceOf(USER, revnetId);
|
|
245
|
-
assertGt(balance, 0, "Should have received tokens for any valid amount");
|
|
246
|
-
}
|
|
247
|
-
|
|
248
|
-
/// @notice Multiple sequential payments should work with empty buyback specs.
|
|
249
|
-
function test_payRevnet_emptyBuybackSpecs_multiplePayments() public {
|
|
250
|
-
uint256 revnetId = _deployFeeAndRevnet();
|
|
251
|
-
|
|
252
|
-
for (uint256 i; i < 5; i++) {
|
|
253
|
-
address payer = makeAddr(string(abi.encodePacked("payer", i)));
|
|
254
|
-
vm.deal(payer, 1 ether);
|
|
255
|
-
vm.prank(payer);
|
|
256
|
-
jbMultiTerminal().pay{value: 1 ether}({
|
|
257
|
-
projectId: revnetId,
|
|
258
|
-
token: JBConstants.NATIVE_TOKEN,
|
|
259
|
-
amount: 1 ether,
|
|
260
|
-
beneficiary: payer,
|
|
261
|
-
minReturnedTokens: 0,
|
|
262
|
-
memo: "",
|
|
263
|
-
metadata: ""
|
|
264
|
-
});
|
|
265
|
-
assertGt(jbTokens().totalBalanceOf(payer, revnetId), 0, "Each payer should receive tokens");
|
|
266
|
-
}
|
|
267
|
-
}
|
|
268
|
-
|
|
269
|
-
/// @notice Verify beforePayRecordedWith returns only the 721 hook spec when buyback returns empty.
|
|
270
|
-
function test_beforePayRecordedWith_emptyBuybackSpecs_returnsOnly721Hook() public {
|
|
271
|
-
uint256 revnetId = _deployFeeAndRevnet();
|
|
272
|
-
|
|
273
|
-
JBBeforePayRecordedContext memory context = JBBeforePayRecordedContext({
|
|
274
|
-
terminal: address(jbMultiTerminal()),
|
|
275
|
-
payer: USER,
|
|
276
|
-
amount: JBTokenAmount({
|
|
277
|
-
token: JBConstants.NATIVE_TOKEN,
|
|
278
|
-
value: 1 ether,
|
|
279
|
-
decimals: 18,
|
|
280
|
-
currency: uint32(uint160(JBConstants.NATIVE_TOKEN))
|
|
281
|
-
}),
|
|
282
|
-
projectId: revnetId,
|
|
283
|
-
rulesetId: 0,
|
|
284
|
-
beneficiary: USER,
|
|
285
|
-
weight: 1000e18,
|
|
286
|
-
reservedPercent: 0,
|
|
287
|
-
metadata: ""
|
|
288
|
-
});
|
|
289
|
-
|
|
290
|
-
(uint256 weight, JBPayHookSpecification[] memory specs) = REV_OWNER.beforePayRecordedWith(context);
|
|
291
|
-
|
|
292
|
-
assertEq(weight, context.weight, "Weight should pass through from buyback hook");
|
|
293
|
-
assertEq(specs.length, 1, "Should return only the 721 hook spec when buyback hook returns empty");
|
|
294
|
-
assertEq(
|
|
295
|
-
address(specs[0].hook),
|
|
296
|
-
address(REV_OWNER.tiered721HookOf(revnetId)),
|
|
297
|
-
"Spec hook should be the revnet's 721 hook"
|
|
298
|
-
);
|
|
299
|
-
}
|
|
300
|
-
}
|
|
@@ -1,365 +0,0 @@
|
|
|
1
|
-
// SPDX-License-Identifier: MIT
|
|
2
|
-
pragma solidity 0.8.28;
|
|
3
|
-
|
|
4
|
-
// forge-lint: disable-next-line(unaliased-plain-import)
|
|
5
|
-
import "forge-std/Test.sol";
|
|
6
|
-
// forge-lint: disable-next-line(unaliased-plain-import)
|
|
7
|
-
import /* {*} from */ "@bananapus/core-v6/test/helpers/TestBaseWorkflow.sol";
|
|
8
|
-
// import /* {*} from "@bananapus/721-hook-v6/src/JB721TiersHookDeployer.sol";
|
|
9
|
-
// forge-lint: disable-next-line(unaliased-plain-import)
|
|
10
|
-
import /* {*} from */ "./../src/REVDeployer.sol";
|
|
11
|
-
// forge-lint: disable-next-line(unaliased-plain-import)
|
|
12
|
-
import "@croptop/core-v6/src/CTPublisher.sol";
|
|
13
|
-
import {MockBuybackDataHook} from "./mock/MockBuybackDataHook.sol";
|
|
14
|
-
import {REVEmpty721Config} from "./helpers/REVEmpty721Config.sol";
|
|
15
|
-
// forge-lint: disable-next-line(unaliased-plain-import)
|
|
16
|
-
import "@bananapus/core-v6/script/helpers/CoreDeploymentLib.sol";
|
|
17
|
-
// forge-lint: disable-next-line(unaliased-plain-import)
|
|
18
|
-
import "@bananapus/721-hook-v6/script/helpers/Hook721DeploymentLib.sol";
|
|
19
|
-
// forge-lint: disable-next-line(unaliased-plain-import)
|
|
20
|
-
import "@bananapus/suckers-v6/script/helpers/SuckerDeploymentLib.sol";
|
|
21
|
-
// forge-lint: disable-next-line(unaliased-plain-import)
|
|
22
|
-
import "@croptop/core-v6/script/helpers/CroptopDeploymentLib.sol";
|
|
23
|
-
// forge-lint: disable-next-line(unaliased-plain-import)
|
|
24
|
-
import "@bananapus/router-terminal-v6/script/helpers/RouterTerminalDeploymentLib.sol";
|
|
25
|
-
import {JBConstants} from "@bananapus/core-v6/src/libraries/JBConstants.sol";
|
|
26
|
-
import {JBAccountingContext} from "@bananapus/core-v6/src/structs/JBAccountingContext.sol";
|
|
27
|
-
import {MockPriceFeed} from "@bananapus/core-v6/test/mock/MockPriceFeed.sol";
|
|
28
|
-
import {MockERC20} from "@bananapus/core-v6/test/mock/MockERC20.sol";
|
|
29
|
-
import {REVLoans} from "../src/REVLoans.sol";
|
|
30
|
-
import {REVStageConfig, REVAutoIssuance} from "../src/structs/REVStageConfig.sol";
|
|
31
|
-
import {REVLoanSource} from "../src/structs/REVLoanSource.sol";
|
|
32
|
-
import {REVDescription} from "../src/structs/REVDescription.sol";
|
|
33
|
-
import {IREVLoans} from "./../src/interfaces/IREVLoans.sol";
|
|
34
|
-
import {JBSuckerDeployerConfig} from "@bananapus/suckers-v6/src/structs/JBSuckerDeployerConfig.sol";
|
|
35
|
-
import {JBSuckerRegistry} from "@bananapus/suckers-v6/src/JBSuckerRegistry.sol";
|
|
36
|
-
import {JB721TiersHookDeployer} from "@bananapus/721-hook-v6/src/JB721TiersHookDeployer.sol";
|
|
37
|
-
import {JB721TiersHook} from "@bananapus/721-hook-v6/src/JB721TiersHook.sol";
|
|
38
|
-
import {JB721TiersHookStore} from "@bananapus/721-hook-v6/src/JB721TiersHookStore.sol";
|
|
39
|
-
import {JB721CheckpointsDeployer} from "@bananapus/721-hook-v6/src/JB721CheckpointsDeployer.sol";
|
|
40
|
-
import {IJB721CheckpointsDeployer} from "@bananapus/721-hook-v6/src/interfaces/IJB721CheckpointsDeployer.sol";
|
|
41
|
-
import {JBAddressRegistry} from "@bananapus/address-registry-v6/src/JBAddressRegistry.sol";
|
|
42
|
-
import {IJBAddressRegistry} from "@bananapus/address-registry-v6/src/interfaces/IJBAddressRegistry.sol";
|
|
43
|
-
import {REVOwner} from "../src/REVOwner.sol";
|
|
44
|
-
import {IREVDeployer} from "../src/interfaces/IREVDeployer.sol";
|
|
45
|
-
import {MockSuckerRegistry} from "./mock/MockSuckerRegistry.sol";
|
|
46
|
-
|
|
47
|
-
/// @notice Tests showing that flash loan surplus manipulation is economically unprofitable.
|
|
48
|
-
contract TestFlashLoanSurplus is TestBaseWorkflow {
|
|
49
|
-
// forge-lint: disable-next-line(mixed-case-variable)
|
|
50
|
-
bytes32 REV_DEPLOYER_SALT = "REVDeployer";
|
|
51
|
-
// forge-lint: disable-next-line(mixed-case-variable)
|
|
52
|
-
bytes32 ERC20_SALT = "REV_TOKEN";
|
|
53
|
-
|
|
54
|
-
// forge-lint: disable-next-line(mixed-case-variable)
|
|
55
|
-
REVDeployer REV_DEPLOYER;
|
|
56
|
-
// forge-lint: disable-next-line(mixed-case-variable)
|
|
57
|
-
REVOwner REV_OWNER;
|
|
58
|
-
// forge-lint: disable-next-line(mixed-case-variable)
|
|
59
|
-
JB721TiersHook EXAMPLE_HOOK;
|
|
60
|
-
// forge-lint: disable-next-line(mixed-case-variable)
|
|
61
|
-
IJB721TiersHookDeployer HOOK_DEPLOYER;
|
|
62
|
-
// forge-lint: disable-next-line(mixed-case-variable)
|
|
63
|
-
IJB721TiersHookStore HOOK_STORE;
|
|
64
|
-
// forge-lint: disable-next-line(mixed-case-variable)
|
|
65
|
-
IJBAddressRegistry ADDRESS_REGISTRY;
|
|
66
|
-
// forge-lint: disable-next-line(mixed-case-variable)
|
|
67
|
-
IREVLoans LOANS_CONTRACT;
|
|
68
|
-
// forge-lint: disable-next-line(mixed-case-variable)
|
|
69
|
-
MockERC20 TOKEN;
|
|
70
|
-
// forge-lint: disable-next-line(mixed-case-variable)
|
|
71
|
-
IJBSuckerRegistry SUCKER_REGISTRY;
|
|
72
|
-
// forge-lint: disable-next-line(mixed-case-variable)
|
|
73
|
-
CTPublisher PUBLISHER;
|
|
74
|
-
// forge-lint: disable-next-line(mixed-case-variable)
|
|
75
|
-
MockBuybackDataHook MOCK_BUYBACK;
|
|
76
|
-
|
|
77
|
-
// forge-lint: disable-next-line(mixed-case-variable)
|
|
78
|
-
uint256 FEE_PROJECT_ID;
|
|
79
|
-
// forge-lint: disable-next-line(mixed-case-variable)
|
|
80
|
-
uint256 REVNET_ID;
|
|
81
|
-
|
|
82
|
-
// forge-lint: disable-next-line(mixed-case-variable)
|
|
83
|
-
address USER = makeAddr("user");
|
|
84
|
-
// forge-lint: disable-next-line(mixed-case-variable)
|
|
85
|
-
address ATTACKER = makeAddr("attacker");
|
|
86
|
-
|
|
87
|
-
address private constant TRUSTED_FORWARDER = 0xB2b5841DBeF766d4b521221732F9B618fCf34A87;
|
|
88
|
-
|
|
89
|
-
function setUp() public override {
|
|
90
|
-
super.setUp();
|
|
91
|
-
FEE_PROJECT_ID = jbProjects().createFor(multisig());
|
|
92
|
-
SUCKER_REGISTRY = new JBSuckerRegistry(jbDirectory(), jbPermissions(), multisig(), address(0));
|
|
93
|
-
HOOK_STORE = new JB721TiersHookStore();
|
|
94
|
-
EXAMPLE_HOOK = new JB721TiersHook(
|
|
95
|
-
jbDirectory(),
|
|
96
|
-
jbPermissions(),
|
|
97
|
-
jbPrices(),
|
|
98
|
-
jbRulesets(),
|
|
99
|
-
HOOK_STORE,
|
|
100
|
-
jbSplits(),
|
|
101
|
-
IJB721CheckpointsDeployer(address(new JB721CheckpointsDeployer())),
|
|
102
|
-
multisig()
|
|
103
|
-
);
|
|
104
|
-
ADDRESS_REGISTRY = new JBAddressRegistry();
|
|
105
|
-
HOOK_DEPLOYER = new JB721TiersHookDeployer(EXAMPLE_HOOK, HOOK_STORE, ADDRESS_REGISTRY, multisig());
|
|
106
|
-
PUBLISHER = new CTPublisher(jbDirectory(), jbPermissions(), FEE_PROJECT_ID, multisig());
|
|
107
|
-
MOCK_BUYBACK = new MockBuybackDataHook();
|
|
108
|
-
TOKEN = new MockERC20("1/2 ETH", "1/2");
|
|
109
|
-
MockPriceFeed priceFeed = new MockPriceFeed(1e21, 6);
|
|
110
|
-
vm.prank(multisig());
|
|
111
|
-
jbPrices()
|
|
112
|
-
.addPriceFeedFor(0, uint32(uint160(address(TOKEN))), uint32(uint160(JBConstants.NATIVE_TOKEN)), priceFeed);
|
|
113
|
-
LOANS_CONTRACT = new REVLoans({
|
|
114
|
-
controller: jbController(),
|
|
115
|
-
suckerRegistry: IJBSuckerRegistry(address(new MockSuckerRegistry())),
|
|
116
|
-
revId: FEE_PROJECT_ID,
|
|
117
|
-
owner: address(this),
|
|
118
|
-
permit2: permit2(),
|
|
119
|
-
trustedForwarder: TRUSTED_FORWARDER
|
|
120
|
-
});
|
|
121
|
-
REV_OWNER = new REVOwner(
|
|
122
|
-
IJBBuybackHookRegistry(address(MOCK_BUYBACK)),
|
|
123
|
-
jbDirectory(),
|
|
124
|
-
FEE_PROJECT_ID,
|
|
125
|
-
SUCKER_REGISTRY,
|
|
126
|
-
address(LOANS_CONTRACT),
|
|
127
|
-
address(0)
|
|
128
|
-
);
|
|
129
|
-
|
|
130
|
-
REV_DEPLOYER = new REVDeployer{salt: REV_DEPLOYER_SALT}(
|
|
131
|
-
jbController(),
|
|
132
|
-
SUCKER_REGISTRY,
|
|
133
|
-
FEE_PROJECT_ID,
|
|
134
|
-
HOOK_DEPLOYER,
|
|
135
|
-
PUBLISHER,
|
|
136
|
-
IJBBuybackHookRegistry(address(MOCK_BUYBACK)),
|
|
137
|
-
address(LOANS_CONTRACT),
|
|
138
|
-
TRUSTED_FORWARDER,
|
|
139
|
-
address(REV_OWNER)
|
|
140
|
-
);
|
|
141
|
-
|
|
142
|
-
REV_OWNER.setDeployer(REV_DEPLOYER);
|
|
143
|
-
|
|
144
|
-
vm.prank(multisig());
|
|
145
|
-
jbProjects().approve(address(REV_DEPLOYER), FEE_PROJECT_ID);
|
|
146
|
-
_deployFeeProject();
|
|
147
|
-
_deployRevnet();
|
|
148
|
-
vm.deal(USER, 1000e18);
|
|
149
|
-
vm.deal(ATTACKER, 1000e18);
|
|
150
|
-
}
|
|
151
|
-
|
|
152
|
-
function _deployFeeProject() internal {
|
|
153
|
-
JBAccountingContext[] memory acc = new JBAccountingContext[](2);
|
|
154
|
-
acc[0] = JBAccountingContext({
|
|
155
|
-
token: JBConstants.NATIVE_TOKEN, decimals: 18, currency: uint32(uint160(JBConstants.NATIVE_TOKEN))
|
|
156
|
-
});
|
|
157
|
-
acc[1] = JBAccountingContext({token: address(TOKEN), decimals: 6, currency: uint32(uint160(address(TOKEN)))});
|
|
158
|
-
JBTerminalConfig[] memory tc = new JBTerminalConfig[](1);
|
|
159
|
-
tc[0] = JBTerminalConfig({terminal: jbMultiTerminal(), accountingContextsToAccept: acc});
|
|
160
|
-
REVStageConfig[] memory stages = new REVStageConfig[](1);
|
|
161
|
-
JBSplit[] memory splits = new JBSplit[](1);
|
|
162
|
-
splits[0].beneficiary = payable(multisig());
|
|
163
|
-
splits[0].percent = 10_000;
|
|
164
|
-
REVAutoIssuance[] memory ai = new REVAutoIssuance[](1);
|
|
165
|
-
ai[0] = REVAutoIssuance({chainId: uint32(block.chainid), count: uint104(70_000e18), beneficiary: multisig()});
|
|
166
|
-
stages[0] = REVStageConfig({
|
|
167
|
-
startsAtOrAfter: uint40(block.timestamp),
|
|
168
|
-
autoIssuances: ai,
|
|
169
|
-
splitPercent: 2000,
|
|
170
|
-
splits: splits,
|
|
171
|
-
initialIssuance: uint112(1000e18),
|
|
172
|
-
issuanceCutFrequency: 90 days,
|
|
173
|
-
issuanceCutPercent: JBConstants.MAX_WEIGHT_CUT_PERCENT / 2,
|
|
174
|
-
cashOutTaxRate: 6000,
|
|
175
|
-
extraMetadata: 0
|
|
176
|
-
});
|
|
177
|
-
REVConfig memory cfg = REVConfig({
|
|
178
|
-
// forge-lint: disable-next-line(named-struct-fields)
|
|
179
|
-
description: REVDescription("Revnet", "$REV", "ipfs://test", "REV_TOKEN"),
|
|
180
|
-
baseCurrency: uint32(uint160(JBConstants.NATIVE_TOKEN)),
|
|
181
|
-
splitOperator: multisig(),
|
|
182
|
-
stageConfigurations: stages
|
|
183
|
-
});
|
|
184
|
-
vm.prank(multisig());
|
|
185
|
-
REV_DEPLOYER.deployFor({
|
|
186
|
-
revnetId: FEE_PROJECT_ID,
|
|
187
|
-
configuration: cfg,
|
|
188
|
-
terminalConfigurations: tc,
|
|
189
|
-
suckerDeploymentConfiguration: REVSuckerDeploymentConfig({
|
|
190
|
-
deployerConfigurations: new JBSuckerDeployerConfig[](0), salt: keccak256("FEE")
|
|
191
|
-
}),
|
|
192
|
-
tiered721HookConfiguration: REVEmpty721Config.empty721Config(uint32(uint160(JBConstants.NATIVE_TOKEN))),
|
|
193
|
-
allowedPosts: REVEmpty721Config.emptyAllowedPosts()
|
|
194
|
-
});
|
|
195
|
-
}
|
|
196
|
-
|
|
197
|
-
function _deployRevnet() internal {
|
|
198
|
-
JBAccountingContext[] memory acc = new JBAccountingContext[](2);
|
|
199
|
-
acc[0] = JBAccountingContext({
|
|
200
|
-
token: JBConstants.NATIVE_TOKEN, decimals: 18, currency: uint32(uint160(JBConstants.NATIVE_TOKEN))
|
|
201
|
-
});
|
|
202
|
-
acc[1] = JBAccountingContext({token: address(TOKEN), decimals: 6, currency: uint32(uint160(address(TOKEN)))});
|
|
203
|
-
JBTerminalConfig[] memory tc = new JBTerminalConfig[](1);
|
|
204
|
-
tc[0] = JBTerminalConfig({terminal: jbMultiTerminal(), accountingContextsToAccept: acc});
|
|
205
|
-
REVStageConfig[] memory stages = new REVStageConfig[](1);
|
|
206
|
-
JBSplit[] memory splits = new JBSplit[](1);
|
|
207
|
-
splits[0].beneficiary = payable(multisig());
|
|
208
|
-
splits[0].percent = 10_000;
|
|
209
|
-
REVAutoIssuance[] memory ai = new REVAutoIssuance[](1);
|
|
210
|
-
ai[0] = REVAutoIssuance({chainId: uint32(block.chainid), count: uint104(70_000e18), beneficiary: multisig()});
|
|
211
|
-
stages[0] = REVStageConfig({
|
|
212
|
-
startsAtOrAfter: uint40(block.timestamp),
|
|
213
|
-
autoIssuances: ai,
|
|
214
|
-
splitPercent: 2000,
|
|
215
|
-
splits: splits,
|
|
216
|
-
initialIssuance: uint112(1000e18),
|
|
217
|
-
issuanceCutFrequency: 90 days,
|
|
218
|
-
issuanceCutPercent: JBConstants.MAX_WEIGHT_CUT_PERCENT / 2,
|
|
219
|
-
cashOutTaxRate: 6000,
|
|
220
|
-
extraMetadata: 0
|
|
221
|
-
});
|
|
222
|
-
REVLoanSource[] memory ls = new REVLoanSource[](1);
|
|
223
|
-
ls[0] = REVLoanSource({token: JBConstants.NATIVE_TOKEN, terminal: jbMultiTerminal()});
|
|
224
|
-
REVConfig memory cfg = REVConfig({
|
|
225
|
-
// forge-lint: disable-next-line(named-struct-fields)
|
|
226
|
-
description: REVDescription("NANA", "$NANA", "ipfs://test2", "NANA_TOKEN"),
|
|
227
|
-
baseCurrency: uint32(uint160(JBConstants.NATIVE_TOKEN)),
|
|
228
|
-
splitOperator: multisig(),
|
|
229
|
-
stageConfigurations: stages
|
|
230
|
-
});
|
|
231
|
-
(REVNET_ID,) = REV_DEPLOYER.deployFor({
|
|
232
|
-
revnetId: 0,
|
|
233
|
-
configuration: cfg,
|
|
234
|
-
terminalConfigurations: tc,
|
|
235
|
-
suckerDeploymentConfiguration: REVSuckerDeploymentConfig({
|
|
236
|
-
deployerConfigurations: new JBSuckerDeployerConfig[](0), salt: keccak256("NANA")
|
|
237
|
-
}),
|
|
238
|
-
tiered721HookConfiguration: REVEmpty721Config.empty721Config(uint32(uint160(JBConstants.NATIVE_TOKEN))),
|
|
239
|
-
allowedPosts: REVEmpty721Config.emptyAllowedPosts()
|
|
240
|
-
});
|
|
241
|
-
}
|
|
242
|
-
|
|
243
|
-
function _setupLoan(
|
|
244
|
-
address user,
|
|
245
|
-
uint256 ethAmount,
|
|
246
|
-
uint256 prepaidFee
|
|
247
|
-
)
|
|
248
|
-
internal
|
|
249
|
-
returns (uint256 loanId, uint256 tokenCount, uint256 borrowAmount)
|
|
250
|
-
{
|
|
251
|
-
vm.prank(user);
|
|
252
|
-
tokenCount =
|
|
253
|
-
jbMultiTerminal().pay{value: ethAmount}(REVNET_ID, JBConstants.NATIVE_TOKEN, ethAmount, user, 0, "", "");
|
|
254
|
-
borrowAmount =
|
|
255
|
-
LOANS_CONTRACT.borrowableAmountFrom(REVNET_ID, tokenCount, 18, uint32(uint160(JBConstants.NATIVE_TOKEN)));
|
|
256
|
-
if (borrowAmount == 0) return (0, tokenCount, 0);
|
|
257
|
-
mockExpect(
|
|
258
|
-
address(jbPermissions()),
|
|
259
|
-
abi.encodeCall(IJBPermissions.hasPermission, (address(LOANS_CONTRACT), user, REVNET_ID, 11, true, true)),
|
|
260
|
-
abi.encode(true)
|
|
261
|
-
);
|
|
262
|
-
REVLoanSource memory source = REVLoanSource({token: JBConstants.NATIVE_TOKEN, terminal: jbMultiTerminal()});
|
|
263
|
-
vm.prank(user);
|
|
264
|
-
(loanId,) = LOANS_CONTRACT.borrowFrom(REVNET_ID, source, 0, tokenCount, payable(user), prepaidFee, user);
|
|
265
|
-
}
|
|
266
|
-
|
|
267
|
-
/// @notice Donate ETH via addToBalanceOf, then borrow. The donation costs more than the extra borrowable amount.
|
|
268
|
-
function test_addToBalance_surplusInflation_unprofitable() public {
|
|
269
|
-
// First, user pays to establish baseline tokens
|
|
270
|
-
vm.prank(USER);
|
|
271
|
-
uint256 userTokens =
|
|
272
|
-
jbMultiTerminal().pay{value: 10e18}(REVNET_ID, JBConstants.NATIVE_TOKEN, 10e18, USER, 0, "", "");
|
|
273
|
-
|
|
274
|
-
// Check borrowable amount before donation
|
|
275
|
-
uint256 borrowableBefore =
|
|
276
|
-
LOANS_CONTRACT.borrowableAmountFrom(REVNET_ID, userTokens, 18, uint32(uint160(JBConstants.NATIVE_TOKEN)));
|
|
277
|
-
|
|
278
|
-
// Attacker donates 100 ETH to inflate surplus
|
|
279
|
-
uint256 donationAmount = 100e18;
|
|
280
|
-
vm.prank(ATTACKER);
|
|
281
|
-
jbMultiTerminal().addToBalanceOf{value: donationAmount}(
|
|
282
|
-
REVNET_ID, JBConstants.NATIVE_TOKEN, donationAmount, false, "", ""
|
|
283
|
-
);
|
|
284
|
-
|
|
285
|
-
// Check borrowable amount after donation
|
|
286
|
-
uint256 borrowableAfter =
|
|
287
|
-
LOANS_CONTRACT.borrowableAmountFrom(REVNET_ID, userTokens, 18, uint32(uint160(JBConstants.NATIVE_TOKEN)));
|
|
288
|
-
|
|
289
|
-
// The gain in borrowable amount
|
|
290
|
-
uint256 borrowableGain = borrowableAfter - borrowableBefore;
|
|
291
|
-
|
|
292
|
-
// The donation cost (100 ETH) is always more than the extra borrowable amount gained.
|
|
293
|
-
// Because borrowable = surplus * (collateralCount / totalSupply) * bonding_curve_factor,
|
|
294
|
-
// and collateralCount < totalSupply, so gain < donation.
|
|
295
|
-
assertGt(donationAmount, borrowableGain, "Donation should cost more than the extra borrowable amount gained");
|
|
296
|
-
}
|
|
297
|
-
|
|
298
|
-
/// @notice Pay into revnet (minting tokens). borrowable-per-existing-token should not increase because supply
|
|
299
|
-
/// dilution offsets surplus increase.
|
|
300
|
-
function test_pay_surplusInflation_neutral() public {
|
|
301
|
-
// User pays to get tokens
|
|
302
|
-
vm.prank(USER);
|
|
303
|
-
uint256 userTokens =
|
|
304
|
-
jbMultiTerminal().pay{value: 10e18}(REVNET_ID, JBConstants.NATIVE_TOKEN, 10e18, USER, 0, "", "");
|
|
305
|
-
|
|
306
|
-
// Check borrowable-per-token for existing user's tokens
|
|
307
|
-
uint256 borrowableBefore =
|
|
308
|
-
LOANS_CONTRACT.borrowableAmountFrom(REVNET_ID, userTokens, 18, uint32(uint160(JBConstants.NATIVE_TOKEN)));
|
|
309
|
-
|
|
310
|
-
// Someone else pays 100 ETH (this mints new tokens AND increases surplus)
|
|
311
|
-
address payer = makeAddr("payer");
|
|
312
|
-
vm.deal(payer, 100e18);
|
|
313
|
-
vm.prank(payer);
|
|
314
|
-
jbMultiTerminal().pay{value: 100e18}(REVNET_ID, JBConstants.NATIVE_TOKEN, 100e18, payer, 0, "", "");
|
|
315
|
-
|
|
316
|
-
// Check borrowable for the SAME user tokens after the payment
|
|
317
|
-
uint256 borrowableAfter =
|
|
318
|
-
LOANS_CONTRACT.borrowableAmountFrom(REVNET_ID, userTokens, 18, uint32(uint160(JBConstants.NATIVE_TOKEN)));
|
|
319
|
-
|
|
320
|
-
// With a non-zero cashOutTaxRate (concave bonding curve), paying in actually DECREASES
|
|
321
|
-
// the per-token borrowable amount for existing holders due to dilution.
|
|
322
|
-
// At minimum, it should not increase the per-token borrowable amount.
|
|
323
|
-
assertLe(borrowableAfter, borrowableBefore, "Paying in should not increase per-token borrowable amount");
|
|
324
|
-
}
|
|
325
|
-
|
|
326
|
-
/// @notice Full attack simulation: donate, borrow max, verify net negative.
|
|
327
|
-
function test_flashLoanSimulation_netNegative() public {
|
|
328
|
-
// Attacker first buys tokens to have something to borrow against
|
|
329
|
-
vm.prank(ATTACKER);
|
|
330
|
-
uint256 attackerTokens =
|
|
331
|
-
jbMultiTerminal().pay{value: 10e18}(REVNET_ID, JBConstants.NATIVE_TOKEN, 10e18, ATTACKER, 0, "", "");
|
|
332
|
-
|
|
333
|
-
// Check borrowable before donation
|
|
334
|
-
uint256 borrowableBefore = LOANS_CONTRACT.borrowableAmountFrom(
|
|
335
|
-
REVNET_ID, attackerTokens, 18, uint32(uint160(JBConstants.NATIVE_TOKEN))
|
|
336
|
-
);
|
|
337
|
-
|
|
338
|
-
// Attacker donates 100 ETH to inflate surplus (simulating flash loan injection)
|
|
339
|
-
uint256 donationAmount = 100e18;
|
|
340
|
-
vm.prank(ATTACKER);
|
|
341
|
-
jbMultiTerminal().addToBalanceOf{value: donationAmount}(
|
|
342
|
-
REVNET_ID, JBConstants.NATIVE_TOKEN, donationAmount, false, "", ""
|
|
343
|
-
);
|
|
344
|
-
|
|
345
|
-
// Check borrowable after donation
|
|
346
|
-
uint256 borrowableAfter = LOANS_CONTRACT.borrowableAmountFrom(
|
|
347
|
-
REVNET_ID, attackerTokens, 18, uint32(uint160(JBConstants.NATIVE_TOKEN))
|
|
348
|
-
);
|
|
349
|
-
|
|
350
|
-
// Extra borrowable gained by the attacker through the donation
|
|
351
|
-
uint256 extraBorrowable = borrowableAfter - borrowableBefore;
|
|
352
|
-
|
|
353
|
-
// The attacker's net position:
|
|
354
|
-
// - Lost: donationAmount (100 ETH, permanently donated — no recovery mechanism)
|
|
355
|
-
// - Gained: extraBorrowable (the additional amount they can borrow)
|
|
356
|
-
// Net = extraBorrowable - donationAmount, which should be negative
|
|
357
|
-
assertGt(donationAmount, extraBorrowable, "Attack should be net negative: donation > extra borrowable");
|
|
358
|
-
|
|
359
|
-
// Furthermore, the extra borrowable is strictly less than donation because
|
|
360
|
-
// gain = donation * (collateral / totalSupply) * cashOutTaxRate_factor
|
|
361
|
-
// and collateral < totalSupply, so the multiplier is always < 1
|
|
362
|
-
// This means the attacker loses a significant fraction of their flash loan
|
|
363
|
-
assertTrue(extraBorrowable < donationAmount, "Extra borrowable must be strictly less than donation");
|
|
364
|
-
}
|
|
365
|
-
}
|