@rev-net/core-v6 0.0.37 → 0.0.39

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (107) hide show
  1. package/CHANGELOG.md +2 -2
  2. package/README.md +6 -7
  3. package/foundry.toml +1 -1
  4. package/package.json +23 -16
  5. package/references/operations.md +1 -1
  6. package/references/runtime.md +1 -1
  7. package/script/Deploy.s.sol +12 -9
  8. package/src/REVDeployer.sol +60 -65
  9. package/src/REVHiddenTokens.sol +2 -2
  10. package/src/REVLoans.sol +17 -10
  11. package/src/REVOwner.sol +121 -14
  12. package/src/interfaces/IREVDeployer.sol +2 -1
  13. package/src/interfaces/IREVHiddenTokens.sol +4 -1
  14. package/src/interfaces/IREVOwner.sol +5 -0
  15. package/ADMINISTRATION.md +0 -73
  16. package/ARCHITECTURE.md +0 -116
  17. package/AUDIT_INSTRUCTIONS.md +0 -90
  18. package/RISKS.md +0 -107
  19. package/SKILLS.md +0 -46
  20. package/STYLE_GUIDE.md +0 -610
  21. package/USER_JOURNEYS.md +0 -195
  22. package/foundry.lock +0 -11
  23. package/slither-ci.config.json +0 -10
  24. package/sphinx.lock +0 -507
  25. package/test/REV.integrations.t.sol +0 -573
  26. package/test/REVAutoIssuanceFuzz.t.sol +0 -328
  27. package/test/REVDeployerRegressions.t.sol +0 -396
  28. package/test/REVInvincibility.t.sol +0 -1371
  29. package/test/REVInvincibilityHandler.sol +0 -387
  30. package/test/REVLifecycle.t.sol +0 -420
  31. package/test/REVLoans.invariants.t.sol +0 -724
  32. package/test/REVLoansAttacks.t.sol +0 -816
  33. package/test/REVLoansFeeRecovery.t.sol +0 -783
  34. package/test/REVLoansFindings.t.sol +0 -711
  35. package/test/REVLoansRegressions.t.sol +0 -364
  36. package/test/REVLoansSourceFeeRecovery.t.sol +0 -517
  37. package/test/REVLoansSourced.t.sol +0 -1839
  38. package/test/REVLoansUnSourced.t.sol +0 -409
  39. package/test/TestAuditFixVerification.t.sol +0 -675
  40. package/test/TestBurnHeldTokens.t.sol +0 -394
  41. package/test/TestCEIPattern.t.sol +0 -508
  42. package/test/TestCashOutCallerValidation.t.sol +0 -452
  43. package/test/TestConversionDocumentation.t.sol +0 -365
  44. package/test/TestCrossCurrencyReclaim.t.sol +0 -610
  45. package/test/TestCrossSourceReallocation.t.sol +0 -361
  46. package/test/TestERC2771MetaTx.t.sol +0 -585
  47. package/test/TestEmptyBuybackSpecs.t.sol +0 -300
  48. package/test/TestFlashLoanSurplus.t.sol +0 -365
  49. package/test/TestHiddenTokens.t.sol +0 -474
  50. package/test/TestHookArrayOOB.t.sol +0 -278
  51. package/test/TestLiquidationBehavior.t.sol +0 -398
  52. package/test/TestLoanSourceRotation.t.sol +0 -553
  53. package/test/TestLoansCashOutDelay.t.sol +0 -493
  54. package/test/TestLongTailEconomics.t.sol +0 -677
  55. package/test/TestLowFindings.t.sol +0 -677
  56. package/test/TestMixedFixes.t.sol +0 -593
  57. package/test/TestPermit2Signatures.t.sol +0 -683
  58. package/test/TestReallocationSandwich.t.sol +0 -412
  59. package/test/TestRevnetRegressions.t.sol +0 -350
  60. package/test/TestSplitWeightAdjustment.t.sol +0 -527
  61. package/test/TestSplitWeightE2E.t.sol +0 -605
  62. package/test/TestSplitWeightFork.t.sol +0 -855
  63. package/test/TestStageTransitionBorrowable.t.sol +0 -301
  64. package/test/TestSwapTerminalPermission.t.sol +0 -262
  65. package/test/TestTerminalEncodingInHash.t.sol +0 -326
  66. package/test/TestUint112Overflow.t.sol +0 -311
  67. package/test/TestZeroAmountLoanGuard.t.sol +0 -378
  68. package/test/TestZeroRepayment.t.sol +0 -354
  69. package/test/audit/CrossChainBuybackRouteMismatch.t.sol +0 -184
  70. package/test/audit/HiddenSupplyCashout.t.sol +0 -61
  71. package/test/audit/LoanIdOverflowGuard.t.sol +0 -523
  72. package/test/audit/NemesisVerification.t.sol +0 -97
  73. package/test/audit/OperatorDelegation.t.sol +0 -356
  74. package/test/audit/PhantomSurplusTerminal.t.sol +0 -367
  75. package/test/audit/REVOwnerCurrencyMismatch.t.sol +0 -188
  76. package/test/audit/REVOwnerRemoteSurplusCurrencyMismatch.t.sol +0 -140
  77. package/test/audit/ReallocatePermission.t.sol +0 -363
  78. package/test/audit/RemoteLoanAccountingGap.t.sol +0 -74
  79. package/test/audit/SupportsInterfaceTest.t.sol +0 -51
  80. package/test/audit/TestFeeAllowanceLeak.t.sol +0 -197
  81. package/test/audit/TestLoansAndDeployerFixes.t.sol +0 -576
  82. package/test/fork/ForkTestBase.sol +0 -727
  83. package/test/fork/TestAutoIssuanceFork.t.sol +0 -148
  84. package/test/fork/TestCashOutFork.t.sol +0 -253
  85. package/test/fork/TestIssuanceDecayFork.t.sol +0 -158
  86. package/test/fork/TestLoanAdversarialFork.t.sol +0 -744
  87. package/test/fork/TestLoanBorrowFork.t.sol +0 -163
  88. package/test/fork/TestLoanCrossRulesetFork.t.sol +0 -308
  89. package/test/fork/TestLoanERC20Fork.t.sol +0 -459
  90. package/test/fork/TestLoanLiquidationFork.t.sol +0 -135
  91. package/test/fork/TestLoanReallocateFork.t.sol +0 -113
  92. package/test/fork/TestLoanRepayFork.t.sol +0 -188
  93. package/test/fork/TestLoanTransferFork.t.sol +0 -143
  94. package/test/fork/TestPermit2PaymentFork.t.sol +0 -300
  95. package/test/fork/TestSplitWeightFork.t.sol +0 -189
  96. package/test/helpers/MaliciousContracts.sol +0 -247
  97. package/test/helpers/REVEmpty721Config.sol +0 -45
  98. package/test/mock/MockBuybackCashOutRecorder.sol +0 -84
  99. package/test/mock/MockBuybackDataHook.sol +0 -112
  100. package/test/mock/MockBuybackDataHookMintPath.sol +0 -68
  101. package/test/mock/MockSuckerRegistry.sol +0 -17
  102. package/test/regression/TestBurnPermissionRequired.t.sol +0 -294
  103. package/test/regression/TestCashOutBuybackFeeLeak.t.sol +0 -232
  104. package/test/regression/TestCrossRevnetLiquidation.t.sol +0 -255
  105. package/test/regression/TestCumulativeLoanCounter.t.sol +0 -361
  106. package/test/regression/TestLiquidateGapHandling.t.sol +0 -394
  107. package/test/regression/TestZeroPriceFeed.t.sol +0 -422
@@ -1,300 +0,0 @@
1
- // SPDX-License-Identifier: MIT
2
- pragma solidity 0.8.28;
3
-
4
- // forge-lint: disable-next-line(unaliased-plain-import)
5
- import "forge-std/Test.sol";
6
- // forge-lint: disable-next-line(unaliased-plain-import)
7
- import /* {*} from */ "@bananapus/core-v6/test/helpers/TestBaseWorkflow.sol";
8
- // forge-lint: disable-next-line(unaliased-plain-import)
9
- import /* {*} from */ "./../src/REVDeployer.sol";
10
- // forge-lint: disable-next-line(unaliased-plain-import)
11
- import "@croptop/core-v6/src/CTPublisher.sol";
12
- import {MockBuybackDataHookMintPath} from "./mock/MockBuybackDataHookMintPath.sol";
13
- // forge-lint: disable-next-line(unaliased-plain-import)
14
- import "@bananapus/core-v6/script/helpers/CoreDeploymentLib.sol";
15
- // forge-lint: disable-next-line(unaliased-plain-import)
16
- import "@bananapus/721-hook-v6/script/helpers/Hook721DeploymentLib.sol";
17
- // forge-lint: disable-next-line(unaliased-plain-import)
18
- import "@bananapus/suckers-v6/script/helpers/SuckerDeploymentLib.sol";
19
- // forge-lint: disable-next-line(unaliased-plain-import)
20
- import "@croptop/core-v6/script/helpers/CroptopDeploymentLib.sol";
21
- // forge-lint: disable-next-line(unaliased-plain-import)
22
- import "@bananapus/router-terminal-v6/script/helpers/RouterTerminalDeploymentLib.sol";
23
- import {JBConstants} from "@bananapus/core-v6/src/libraries/JBConstants.sol";
24
- import {JBAccountingContext} from "@bananapus/core-v6/src/structs/JBAccountingContext.sol";
25
- import {REVLoans} from "../src/REVLoans.sol";
26
- import {REVStageConfig, REVAutoIssuance} from "../src/structs/REVStageConfig.sol";
27
- import {REVDescription} from "../src/structs/REVDescription.sol";
28
- import {IREVLoans} from "./../src/interfaces/IREVLoans.sol";
29
- import {JBSuckerDeployerConfig} from "@bananapus/suckers-v6/src/structs/JBSuckerDeployerConfig.sol";
30
- import {JBSuckerRegistry} from "@bananapus/suckers-v6/src/JBSuckerRegistry.sol";
31
- import {JB721TiersHookDeployer} from "@bananapus/721-hook-v6/src/JB721TiersHookDeployer.sol";
32
- import {JB721TiersHook} from "@bananapus/721-hook-v6/src/JB721TiersHook.sol";
33
- import {JB721TiersHookStore} from "@bananapus/721-hook-v6/src/JB721TiersHookStore.sol";
34
- import {JB721CheckpointsDeployer} from "@bananapus/721-hook-v6/src/JB721CheckpointsDeployer.sol";
35
- import {IJB721CheckpointsDeployer} from "@bananapus/721-hook-v6/src/interfaces/IJB721CheckpointsDeployer.sol";
36
- import {JBAddressRegistry} from "@bananapus/address-registry-v6/src/JBAddressRegistry.sol";
37
- import {IJBAddressRegistry} from "@bananapus/address-registry-v6/src/interfaces/IJBAddressRegistry.sol";
38
- import {JBBeforePayRecordedContext} from "@bananapus/core-v6/src/structs/JBBeforePayRecordedContext.sol";
39
- import {JBPayHookSpecification} from "@bananapus/core-v6/src/structs/JBPayHookSpecification.sol";
40
- import {JBTokenAmount} from "@bananapus/core-v6/src/structs/JBTokenAmount.sol";
41
- import {REVEmpty721Config} from "./helpers/REVEmpty721Config.sol";
42
- import {REVOwner} from "../src/REVOwner.sol";
43
- import {IREVDeployer} from "../src/interfaces/IREVDeployer.sol";
44
- import {MockSuckerRegistry} from "./mock/MockSuckerRegistry.sol";
45
-
46
- /// @notice Regression tests for the empty buyback hook specifications fix.
47
- /// When JBBuybackHook determines minting is cheaper than swapping, it returns an empty
48
- /// hookSpecifications array. Before the fix, REVDeployer.beforePayRecordedWith would
49
- /// Panic(0x32) (array out-of-bounds) when accessing buybackHookSpecifications[0].
50
- contract TestEmptyBuybackSpecs is TestBaseWorkflow {
51
- // forge-lint: disable-next-line(mixed-case-variable)
52
- bytes32 REV_DEPLOYER_SALT = "REVDeployer";
53
-
54
- // forge-lint: disable-next-line(mixed-case-variable)
55
- REVDeployer REV_DEPLOYER;
56
- // forge-lint: disable-next-line(mixed-case-variable)
57
- REVOwner REV_OWNER;
58
- // forge-lint: disable-next-line(mixed-case-variable)
59
- JB721TiersHook EXAMPLE_HOOK;
60
- // forge-lint: disable-next-line(mixed-case-variable)
61
- IJB721TiersHookDeployer HOOK_DEPLOYER;
62
- // forge-lint: disable-next-line(mixed-case-variable)
63
- IJB721TiersHookStore HOOK_STORE;
64
- // forge-lint: disable-next-line(mixed-case-variable)
65
- IJBAddressRegistry ADDRESS_REGISTRY;
66
- // forge-lint: disable-next-line(mixed-case-variable)
67
- IREVLoans LOANS_CONTRACT;
68
- // forge-lint: disable-next-line(mixed-case-variable)
69
- IJBSuckerRegistry SUCKER_REGISTRY;
70
- // forge-lint: disable-next-line(mixed-case-variable)
71
- CTPublisher PUBLISHER;
72
- // forge-lint: disable-next-line(mixed-case-variable)
73
- MockBuybackDataHookMintPath MOCK_BUYBACK_MINT_PATH;
74
-
75
- // forge-lint: disable-next-line(mixed-case-variable)
76
- uint256 FEE_PROJECT_ID;
77
-
78
- address private constant TRUSTED_FORWARDER = 0xB2b5841DBeF766d4b521221732F9B618fCf34A87;
79
- // forge-lint: disable-next-line(mixed-case-variable)
80
- address USER = makeAddr("user");
81
-
82
- function setUp() public override {
83
- super.setUp();
84
- FEE_PROJECT_ID = jbProjects().createFor(multisig());
85
- SUCKER_REGISTRY = new JBSuckerRegistry(jbDirectory(), jbPermissions(), multisig(), address(0));
86
- HOOK_STORE = new JB721TiersHookStore();
87
- EXAMPLE_HOOK = new JB721TiersHook(
88
- jbDirectory(),
89
- jbPermissions(),
90
- jbPrices(),
91
- jbRulesets(),
92
- HOOK_STORE,
93
- jbSplits(),
94
- IJB721CheckpointsDeployer(address(new JB721CheckpointsDeployer())),
95
- multisig()
96
- );
97
- ADDRESS_REGISTRY = new JBAddressRegistry();
98
- HOOK_DEPLOYER = new JB721TiersHookDeployer(EXAMPLE_HOOK, HOOK_STORE, ADDRESS_REGISTRY, multisig());
99
- PUBLISHER = new CTPublisher(jbDirectory(), jbPermissions(), FEE_PROJECT_ID, multisig());
100
- MOCK_BUYBACK_MINT_PATH = new MockBuybackDataHookMintPath();
101
- LOANS_CONTRACT = new REVLoans({
102
- controller: jbController(),
103
- suckerRegistry: IJBSuckerRegistry(address(new MockSuckerRegistry())),
104
- revId: FEE_PROJECT_ID,
105
- owner: address(this),
106
- permit2: permit2(),
107
- trustedForwarder: TRUSTED_FORWARDER
108
- });
109
- REV_OWNER = new REVOwner(
110
- IJBBuybackHookRegistry(address(MOCK_BUYBACK_MINT_PATH)),
111
- jbDirectory(),
112
- FEE_PROJECT_ID,
113
- SUCKER_REGISTRY,
114
- address(LOANS_CONTRACT),
115
- address(0)
116
- );
117
-
118
- REV_DEPLOYER = new REVDeployer{salt: REV_DEPLOYER_SALT}(
119
- jbController(),
120
- SUCKER_REGISTRY,
121
- FEE_PROJECT_ID,
122
- HOOK_DEPLOYER,
123
- PUBLISHER,
124
- IJBBuybackHookRegistry(address(MOCK_BUYBACK_MINT_PATH)),
125
- address(LOANS_CONTRACT),
126
- TRUSTED_FORWARDER,
127
- address(REV_OWNER)
128
- );
129
-
130
- REV_OWNER.setDeployer(REV_DEPLOYER);
131
-
132
- vm.prank(multisig());
133
- jbProjects().approve(address(REV_DEPLOYER), FEE_PROJECT_ID);
134
- }
135
-
136
- function _buildMinimalConfig()
137
- internal
138
- view
139
- returns (REVConfig memory cfg, JBTerminalConfig[] memory tc, REVSuckerDeploymentConfig memory sdc)
140
- {
141
- JBAccountingContext[] memory acc = new JBAccountingContext[](1);
142
- acc[0] = JBAccountingContext({
143
- token: JBConstants.NATIVE_TOKEN, decimals: 18, currency: uint32(uint160(JBConstants.NATIVE_TOKEN))
144
- });
145
- tc = new JBTerminalConfig[](1);
146
- tc[0] = JBTerminalConfig({terminal: jbMultiTerminal(), accountingContextsToAccept: acc});
147
-
148
- REVStageConfig[] memory stages = new REVStageConfig[](1);
149
- JBSplit[] memory splits = new JBSplit[](1);
150
- splits[0].beneficiary = payable(multisig());
151
- splits[0].percent = 10_000;
152
- stages[0] = REVStageConfig({
153
- startsAtOrAfter: uint40(block.timestamp),
154
- autoIssuances: new REVAutoIssuance[](0),
155
- splitPercent: 0,
156
- splits: splits,
157
- initialIssuance: uint112(1000e18),
158
- issuanceCutFrequency: 0,
159
- issuanceCutPercent: 0,
160
- cashOutTaxRate: 5000,
161
- extraMetadata: 0
162
- });
163
-
164
- cfg = REVConfig({
165
- // forge-lint: disable-next-line(named-struct-fields)
166
- description: REVDescription("Test", "TST", "ipfs://test", "TEST_SALT"),
167
- baseCurrency: uint32(uint160(JBConstants.NATIVE_TOKEN)),
168
- splitOperator: multisig(),
169
- stageConfigurations: stages
170
- });
171
-
172
- sdc = REVSuckerDeploymentConfig({
173
- deployerConfigurations: new JBSuckerDeployerConfig[](0), salt: keccak256(abi.encodePacked("TEST"))
174
- });
175
- }
176
-
177
- function _deployFeeAndRevnet() internal returns (uint256 revnetId) {
178
- (REVConfig memory feeCfg, JBTerminalConfig[] memory feeTc, REVSuckerDeploymentConfig memory feeSdc) =
179
- _buildMinimalConfig();
180
-
181
- vm.prank(multisig());
182
- REV_DEPLOYER.deployFor({
183
- revnetId: FEE_PROJECT_ID,
184
- configuration: feeCfg,
185
- terminalConfigurations: feeTc,
186
- suckerDeploymentConfiguration: feeSdc,
187
- tiered721HookConfiguration: REVEmpty721Config.empty721Config(uint32(uint160(JBConstants.NATIVE_TOKEN))),
188
- allowedPosts: REVEmpty721Config.emptyAllowedPosts()
189
- });
190
-
191
- (REVConfig memory cfg, JBTerminalConfig[] memory tc, REVSuckerDeploymentConfig memory sdc) =
192
- _buildMinimalConfig();
193
- // forge-lint: disable-next-line(named-struct-fields)
194
- cfg.description = REVDescription("Test2", "TS2", "ipfs://test2", "TEST_SALT_2");
195
-
196
- (revnetId,) = REV_DEPLOYER.deployFor({
197
- revnetId: 0,
198
- configuration: cfg,
199
- terminalConfigurations: tc,
200
- suckerDeploymentConfiguration: sdc,
201
- tiered721HookConfiguration: REVEmpty721Config.empty721Config(uint32(uint160(JBConstants.NATIVE_TOKEN))),
202
- allowedPosts: REVEmpty721Config.emptyAllowedPosts()
203
- });
204
- }
205
-
206
- /// @notice REGRESSION: Payment to revnet must succeed when buyback hook returns empty specs (mint path).
207
- /// Before the fix, this would Panic(0x32) due to accessing buybackHookSpecifications[0] on an empty array.
208
- function test_payRevnet_emptyBuybackSpecs_succeeds() public {
209
- uint256 revnetId = _deployFeeAndRevnet();
210
-
211
- vm.deal(USER, 1 ether);
212
- vm.prank(USER);
213
- jbMultiTerminal().pay{value: 1 ether}({
214
- projectId: revnetId,
215
- token: JBConstants.NATIVE_TOKEN,
216
- amount: 1 ether,
217
- beneficiary: USER,
218
- minReturnedTokens: 0,
219
- memo: "payment with mint path buyback",
220
- metadata: ""
221
- });
222
-
223
- uint256 balance = jbTokens().totalBalanceOf(USER, revnetId);
224
- assertGt(balance, 0, "Should have received tokens when buyback hook takes mint path");
225
- }
226
-
227
- /// @notice Payment with various amounts should work when buyback hook returns empty specs.
228
- function test_payRevnet_emptyBuybackSpecs_variousAmounts(uint96 amount) public {
229
- vm.assume(amount > 0.001 ether && amount < 100 ether);
230
- uint256 revnetId = _deployFeeAndRevnet();
231
-
232
- vm.deal(USER, amount);
233
- vm.prank(USER);
234
- jbMultiTerminal().pay{value: amount}({
235
- projectId: revnetId,
236
- token: JBConstants.NATIVE_TOKEN,
237
- amount: amount,
238
- beneficiary: USER,
239
- minReturnedTokens: 0,
240
- memo: "",
241
- metadata: ""
242
- });
243
-
244
- uint256 balance = jbTokens().totalBalanceOf(USER, revnetId);
245
- assertGt(balance, 0, "Should have received tokens for any valid amount");
246
- }
247
-
248
- /// @notice Multiple sequential payments should work with empty buyback specs.
249
- function test_payRevnet_emptyBuybackSpecs_multiplePayments() public {
250
- uint256 revnetId = _deployFeeAndRevnet();
251
-
252
- for (uint256 i; i < 5; i++) {
253
- address payer = makeAddr(string(abi.encodePacked("payer", i)));
254
- vm.deal(payer, 1 ether);
255
- vm.prank(payer);
256
- jbMultiTerminal().pay{value: 1 ether}({
257
- projectId: revnetId,
258
- token: JBConstants.NATIVE_TOKEN,
259
- amount: 1 ether,
260
- beneficiary: payer,
261
- minReturnedTokens: 0,
262
- memo: "",
263
- metadata: ""
264
- });
265
- assertGt(jbTokens().totalBalanceOf(payer, revnetId), 0, "Each payer should receive tokens");
266
- }
267
- }
268
-
269
- /// @notice Verify beforePayRecordedWith returns only the 721 hook spec when buyback returns empty.
270
- function test_beforePayRecordedWith_emptyBuybackSpecs_returnsOnly721Hook() public {
271
- uint256 revnetId = _deployFeeAndRevnet();
272
-
273
- JBBeforePayRecordedContext memory context = JBBeforePayRecordedContext({
274
- terminal: address(jbMultiTerminal()),
275
- payer: USER,
276
- amount: JBTokenAmount({
277
- token: JBConstants.NATIVE_TOKEN,
278
- value: 1 ether,
279
- decimals: 18,
280
- currency: uint32(uint160(JBConstants.NATIVE_TOKEN))
281
- }),
282
- projectId: revnetId,
283
- rulesetId: 0,
284
- beneficiary: USER,
285
- weight: 1000e18,
286
- reservedPercent: 0,
287
- metadata: ""
288
- });
289
-
290
- (uint256 weight, JBPayHookSpecification[] memory specs) = REV_OWNER.beforePayRecordedWith(context);
291
-
292
- assertEq(weight, context.weight, "Weight should pass through from buyback hook");
293
- assertEq(specs.length, 1, "Should return only the 721 hook spec when buyback hook returns empty");
294
- assertEq(
295
- address(specs[0].hook),
296
- address(REV_OWNER.tiered721HookOf(revnetId)),
297
- "Spec hook should be the revnet's 721 hook"
298
- );
299
- }
300
- }
@@ -1,365 +0,0 @@
1
- // SPDX-License-Identifier: MIT
2
- pragma solidity 0.8.28;
3
-
4
- // forge-lint: disable-next-line(unaliased-plain-import)
5
- import "forge-std/Test.sol";
6
- // forge-lint: disable-next-line(unaliased-plain-import)
7
- import /* {*} from */ "@bananapus/core-v6/test/helpers/TestBaseWorkflow.sol";
8
- // import /* {*} from "@bananapus/721-hook-v6/src/JB721TiersHookDeployer.sol";
9
- // forge-lint: disable-next-line(unaliased-plain-import)
10
- import /* {*} from */ "./../src/REVDeployer.sol";
11
- // forge-lint: disable-next-line(unaliased-plain-import)
12
- import "@croptop/core-v6/src/CTPublisher.sol";
13
- import {MockBuybackDataHook} from "./mock/MockBuybackDataHook.sol";
14
- import {REVEmpty721Config} from "./helpers/REVEmpty721Config.sol";
15
- // forge-lint: disable-next-line(unaliased-plain-import)
16
- import "@bananapus/core-v6/script/helpers/CoreDeploymentLib.sol";
17
- // forge-lint: disable-next-line(unaliased-plain-import)
18
- import "@bananapus/721-hook-v6/script/helpers/Hook721DeploymentLib.sol";
19
- // forge-lint: disable-next-line(unaliased-plain-import)
20
- import "@bananapus/suckers-v6/script/helpers/SuckerDeploymentLib.sol";
21
- // forge-lint: disable-next-line(unaliased-plain-import)
22
- import "@croptop/core-v6/script/helpers/CroptopDeploymentLib.sol";
23
- // forge-lint: disable-next-line(unaliased-plain-import)
24
- import "@bananapus/router-terminal-v6/script/helpers/RouterTerminalDeploymentLib.sol";
25
- import {JBConstants} from "@bananapus/core-v6/src/libraries/JBConstants.sol";
26
- import {JBAccountingContext} from "@bananapus/core-v6/src/structs/JBAccountingContext.sol";
27
- import {MockPriceFeed} from "@bananapus/core-v6/test/mock/MockPriceFeed.sol";
28
- import {MockERC20} from "@bananapus/core-v6/test/mock/MockERC20.sol";
29
- import {REVLoans} from "../src/REVLoans.sol";
30
- import {REVStageConfig, REVAutoIssuance} from "../src/structs/REVStageConfig.sol";
31
- import {REVLoanSource} from "../src/structs/REVLoanSource.sol";
32
- import {REVDescription} from "../src/structs/REVDescription.sol";
33
- import {IREVLoans} from "./../src/interfaces/IREVLoans.sol";
34
- import {JBSuckerDeployerConfig} from "@bananapus/suckers-v6/src/structs/JBSuckerDeployerConfig.sol";
35
- import {JBSuckerRegistry} from "@bananapus/suckers-v6/src/JBSuckerRegistry.sol";
36
- import {JB721TiersHookDeployer} from "@bananapus/721-hook-v6/src/JB721TiersHookDeployer.sol";
37
- import {JB721TiersHook} from "@bananapus/721-hook-v6/src/JB721TiersHook.sol";
38
- import {JB721TiersHookStore} from "@bananapus/721-hook-v6/src/JB721TiersHookStore.sol";
39
- import {JB721CheckpointsDeployer} from "@bananapus/721-hook-v6/src/JB721CheckpointsDeployer.sol";
40
- import {IJB721CheckpointsDeployer} from "@bananapus/721-hook-v6/src/interfaces/IJB721CheckpointsDeployer.sol";
41
- import {JBAddressRegistry} from "@bananapus/address-registry-v6/src/JBAddressRegistry.sol";
42
- import {IJBAddressRegistry} from "@bananapus/address-registry-v6/src/interfaces/IJBAddressRegistry.sol";
43
- import {REVOwner} from "../src/REVOwner.sol";
44
- import {IREVDeployer} from "../src/interfaces/IREVDeployer.sol";
45
- import {MockSuckerRegistry} from "./mock/MockSuckerRegistry.sol";
46
-
47
- /// @notice Tests showing that flash loan surplus manipulation is economically unprofitable.
48
- contract TestFlashLoanSurplus is TestBaseWorkflow {
49
- // forge-lint: disable-next-line(mixed-case-variable)
50
- bytes32 REV_DEPLOYER_SALT = "REVDeployer";
51
- // forge-lint: disable-next-line(mixed-case-variable)
52
- bytes32 ERC20_SALT = "REV_TOKEN";
53
-
54
- // forge-lint: disable-next-line(mixed-case-variable)
55
- REVDeployer REV_DEPLOYER;
56
- // forge-lint: disable-next-line(mixed-case-variable)
57
- REVOwner REV_OWNER;
58
- // forge-lint: disable-next-line(mixed-case-variable)
59
- JB721TiersHook EXAMPLE_HOOK;
60
- // forge-lint: disable-next-line(mixed-case-variable)
61
- IJB721TiersHookDeployer HOOK_DEPLOYER;
62
- // forge-lint: disable-next-line(mixed-case-variable)
63
- IJB721TiersHookStore HOOK_STORE;
64
- // forge-lint: disable-next-line(mixed-case-variable)
65
- IJBAddressRegistry ADDRESS_REGISTRY;
66
- // forge-lint: disable-next-line(mixed-case-variable)
67
- IREVLoans LOANS_CONTRACT;
68
- // forge-lint: disable-next-line(mixed-case-variable)
69
- MockERC20 TOKEN;
70
- // forge-lint: disable-next-line(mixed-case-variable)
71
- IJBSuckerRegistry SUCKER_REGISTRY;
72
- // forge-lint: disable-next-line(mixed-case-variable)
73
- CTPublisher PUBLISHER;
74
- // forge-lint: disable-next-line(mixed-case-variable)
75
- MockBuybackDataHook MOCK_BUYBACK;
76
-
77
- // forge-lint: disable-next-line(mixed-case-variable)
78
- uint256 FEE_PROJECT_ID;
79
- // forge-lint: disable-next-line(mixed-case-variable)
80
- uint256 REVNET_ID;
81
-
82
- // forge-lint: disable-next-line(mixed-case-variable)
83
- address USER = makeAddr("user");
84
- // forge-lint: disable-next-line(mixed-case-variable)
85
- address ATTACKER = makeAddr("attacker");
86
-
87
- address private constant TRUSTED_FORWARDER = 0xB2b5841DBeF766d4b521221732F9B618fCf34A87;
88
-
89
- function setUp() public override {
90
- super.setUp();
91
- FEE_PROJECT_ID = jbProjects().createFor(multisig());
92
- SUCKER_REGISTRY = new JBSuckerRegistry(jbDirectory(), jbPermissions(), multisig(), address(0));
93
- HOOK_STORE = new JB721TiersHookStore();
94
- EXAMPLE_HOOK = new JB721TiersHook(
95
- jbDirectory(),
96
- jbPermissions(),
97
- jbPrices(),
98
- jbRulesets(),
99
- HOOK_STORE,
100
- jbSplits(),
101
- IJB721CheckpointsDeployer(address(new JB721CheckpointsDeployer())),
102
- multisig()
103
- );
104
- ADDRESS_REGISTRY = new JBAddressRegistry();
105
- HOOK_DEPLOYER = new JB721TiersHookDeployer(EXAMPLE_HOOK, HOOK_STORE, ADDRESS_REGISTRY, multisig());
106
- PUBLISHER = new CTPublisher(jbDirectory(), jbPermissions(), FEE_PROJECT_ID, multisig());
107
- MOCK_BUYBACK = new MockBuybackDataHook();
108
- TOKEN = new MockERC20("1/2 ETH", "1/2");
109
- MockPriceFeed priceFeed = new MockPriceFeed(1e21, 6);
110
- vm.prank(multisig());
111
- jbPrices()
112
- .addPriceFeedFor(0, uint32(uint160(address(TOKEN))), uint32(uint160(JBConstants.NATIVE_TOKEN)), priceFeed);
113
- LOANS_CONTRACT = new REVLoans({
114
- controller: jbController(),
115
- suckerRegistry: IJBSuckerRegistry(address(new MockSuckerRegistry())),
116
- revId: FEE_PROJECT_ID,
117
- owner: address(this),
118
- permit2: permit2(),
119
- trustedForwarder: TRUSTED_FORWARDER
120
- });
121
- REV_OWNER = new REVOwner(
122
- IJBBuybackHookRegistry(address(MOCK_BUYBACK)),
123
- jbDirectory(),
124
- FEE_PROJECT_ID,
125
- SUCKER_REGISTRY,
126
- address(LOANS_CONTRACT),
127
- address(0)
128
- );
129
-
130
- REV_DEPLOYER = new REVDeployer{salt: REV_DEPLOYER_SALT}(
131
- jbController(),
132
- SUCKER_REGISTRY,
133
- FEE_PROJECT_ID,
134
- HOOK_DEPLOYER,
135
- PUBLISHER,
136
- IJBBuybackHookRegistry(address(MOCK_BUYBACK)),
137
- address(LOANS_CONTRACT),
138
- TRUSTED_FORWARDER,
139
- address(REV_OWNER)
140
- );
141
-
142
- REV_OWNER.setDeployer(REV_DEPLOYER);
143
-
144
- vm.prank(multisig());
145
- jbProjects().approve(address(REV_DEPLOYER), FEE_PROJECT_ID);
146
- _deployFeeProject();
147
- _deployRevnet();
148
- vm.deal(USER, 1000e18);
149
- vm.deal(ATTACKER, 1000e18);
150
- }
151
-
152
- function _deployFeeProject() internal {
153
- JBAccountingContext[] memory acc = new JBAccountingContext[](2);
154
- acc[0] = JBAccountingContext({
155
- token: JBConstants.NATIVE_TOKEN, decimals: 18, currency: uint32(uint160(JBConstants.NATIVE_TOKEN))
156
- });
157
- acc[1] = JBAccountingContext({token: address(TOKEN), decimals: 6, currency: uint32(uint160(address(TOKEN)))});
158
- JBTerminalConfig[] memory tc = new JBTerminalConfig[](1);
159
- tc[0] = JBTerminalConfig({terminal: jbMultiTerminal(), accountingContextsToAccept: acc});
160
- REVStageConfig[] memory stages = new REVStageConfig[](1);
161
- JBSplit[] memory splits = new JBSplit[](1);
162
- splits[0].beneficiary = payable(multisig());
163
- splits[0].percent = 10_000;
164
- REVAutoIssuance[] memory ai = new REVAutoIssuance[](1);
165
- ai[0] = REVAutoIssuance({chainId: uint32(block.chainid), count: uint104(70_000e18), beneficiary: multisig()});
166
- stages[0] = REVStageConfig({
167
- startsAtOrAfter: uint40(block.timestamp),
168
- autoIssuances: ai,
169
- splitPercent: 2000,
170
- splits: splits,
171
- initialIssuance: uint112(1000e18),
172
- issuanceCutFrequency: 90 days,
173
- issuanceCutPercent: JBConstants.MAX_WEIGHT_CUT_PERCENT / 2,
174
- cashOutTaxRate: 6000,
175
- extraMetadata: 0
176
- });
177
- REVConfig memory cfg = REVConfig({
178
- // forge-lint: disable-next-line(named-struct-fields)
179
- description: REVDescription("Revnet", "$REV", "ipfs://test", "REV_TOKEN"),
180
- baseCurrency: uint32(uint160(JBConstants.NATIVE_TOKEN)),
181
- splitOperator: multisig(),
182
- stageConfigurations: stages
183
- });
184
- vm.prank(multisig());
185
- REV_DEPLOYER.deployFor({
186
- revnetId: FEE_PROJECT_ID,
187
- configuration: cfg,
188
- terminalConfigurations: tc,
189
- suckerDeploymentConfiguration: REVSuckerDeploymentConfig({
190
- deployerConfigurations: new JBSuckerDeployerConfig[](0), salt: keccak256("FEE")
191
- }),
192
- tiered721HookConfiguration: REVEmpty721Config.empty721Config(uint32(uint160(JBConstants.NATIVE_TOKEN))),
193
- allowedPosts: REVEmpty721Config.emptyAllowedPosts()
194
- });
195
- }
196
-
197
- function _deployRevnet() internal {
198
- JBAccountingContext[] memory acc = new JBAccountingContext[](2);
199
- acc[0] = JBAccountingContext({
200
- token: JBConstants.NATIVE_TOKEN, decimals: 18, currency: uint32(uint160(JBConstants.NATIVE_TOKEN))
201
- });
202
- acc[1] = JBAccountingContext({token: address(TOKEN), decimals: 6, currency: uint32(uint160(address(TOKEN)))});
203
- JBTerminalConfig[] memory tc = new JBTerminalConfig[](1);
204
- tc[0] = JBTerminalConfig({terminal: jbMultiTerminal(), accountingContextsToAccept: acc});
205
- REVStageConfig[] memory stages = new REVStageConfig[](1);
206
- JBSplit[] memory splits = new JBSplit[](1);
207
- splits[0].beneficiary = payable(multisig());
208
- splits[0].percent = 10_000;
209
- REVAutoIssuance[] memory ai = new REVAutoIssuance[](1);
210
- ai[0] = REVAutoIssuance({chainId: uint32(block.chainid), count: uint104(70_000e18), beneficiary: multisig()});
211
- stages[0] = REVStageConfig({
212
- startsAtOrAfter: uint40(block.timestamp),
213
- autoIssuances: ai,
214
- splitPercent: 2000,
215
- splits: splits,
216
- initialIssuance: uint112(1000e18),
217
- issuanceCutFrequency: 90 days,
218
- issuanceCutPercent: JBConstants.MAX_WEIGHT_CUT_PERCENT / 2,
219
- cashOutTaxRate: 6000,
220
- extraMetadata: 0
221
- });
222
- REVLoanSource[] memory ls = new REVLoanSource[](1);
223
- ls[0] = REVLoanSource({token: JBConstants.NATIVE_TOKEN, terminal: jbMultiTerminal()});
224
- REVConfig memory cfg = REVConfig({
225
- // forge-lint: disable-next-line(named-struct-fields)
226
- description: REVDescription("NANA", "$NANA", "ipfs://test2", "NANA_TOKEN"),
227
- baseCurrency: uint32(uint160(JBConstants.NATIVE_TOKEN)),
228
- splitOperator: multisig(),
229
- stageConfigurations: stages
230
- });
231
- (REVNET_ID,) = REV_DEPLOYER.deployFor({
232
- revnetId: 0,
233
- configuration: cfg,
234
- terminalConfigurations: tc,
235
- suckerDeploymentConfiguration: REVSuckerDeploymentConfig({
236
- deployerConfigurations: new JBSuckerDeployerConfig[](0), salt: keccak256("NANA")
237
- }),
238
- tiered721HookConfiguration: REVEmpty721Config.empty721Config(uint32(uint160(JBConstants.NATIVE_TOKEN))),
239
- allowedPosts: REVEmpty721Config.emptyAllowedPosts()
240
- });
241
- }
242
-
243
- function _setupLoan(
244
- address user,
245
- uint256 ethAmount,
246
- uint256 prepaidFee
247
- )
248
- internal
249
- returns (uint256 loanId, uint256 tokenCount, uint256 borrowAmount)
250
- {
251
- vm.prank(user);
252
- tokenCount =
253
- jbMultiTerminal().pay{value: ethAmount}(REVNET_ID, JBConstants.NATIVE_TOKEN, ethAmount, user, 0, "", "");
254
- borrowAmount =
255
- LOANS_CONTRACT.borrowableAmountFrom(REVNET_ID, tokenCount, 18, uint32(uint160(JBConstants.NATIVE_TOKEN)));
256
- if (borrowAmount == 0) return (0, tokenCount, 0);
257
- mockExpect(
258
- address(jbPermissions()),
259
- abi.encodeCall(IJBPermissions.hasPermission, (address(LOANS_CONTRACT), user, REVNET_ID, 11, true, true)),
260
- abi.encode(true)
261
- );
262
- REVLoanSource memory source = REVLoanSource({token: JBConstants.NATIVE_TOKEN, terminal: jbMultiTerminal()});
263
- vm.prank(user);
264
- (loanId,) = LOANS_CONTRACT.borrowFrom(REVNET_ID, source, 0, tokenCount, payable(user), prepaidFee, user);
265
- }
266
-
267
- /// @notice Donate ETH via addToBalanceOf, then borrow. The donation costs more than the extra borrowable amount.
268
- function test_addToBalance_surplusInflation_unprofitable() public {
269
- // First, user pays to establish baseline tokens
270
- vm.prank(USER);
271
- uint256 userTokens =
272
- jbMultiTerminal().pay{value: 10e18}(REVNET_ID, JBConstants.NATIVE_TOKEN, 10e18, USER, 0, "", "");
273
-
274
- // Check borrowable amount before donation
275
- uint256 borrowableBefore =
276
- LOANS_CONTRACT.borrowableAmountFrom(REVNET_ID, userTokens, 18, uint32(uint160(JBConstants.NATIVE_TOKEN)));
277
-
278
- // Attacker donates 100 ETH to inflate surplus
279
- uint256 donationAmount = 100e18;
280
- vm.prank(ATTACKER);
281
- jbMultiTerminal().addToBalanceOf{value: donationAmount}(
282
- REVNET_ID, JBConstants.NATIVE_TOKEN, donationAmount, false, "", ""
283
- );
284
-
285
- // Check borrowable amount after donation
286
- uint256 borrowableAfter =
287
- LOANS_CONTRACT.borrowableAmountFrom(REVNET_ID, userTokens, 18, uint32(uint160(JBConstants.NATIVE_TOKEN)));
288
-
289
- // The gain in borrowable amount
290
- uint256 borrowableGain = borrowableAfter - borrowableBefore;
291
-
292
- // The donation cost (100 ETH) is always more than the extra borrowable amount gained.
293
- // Because borrowable = surplus * (collateralCount / totalSupply) * bonding_curve_factor,
294
- // and collateralCount < totalSupply, so gain < donation.
295
- assertGt(donationAmount, borrowableGain, "Donation should cost more than the extra borrowable amount gained");
296
- }
297
-
298
- /// @notice Pay into revnet (minting tokens). borrowable-per-existing-token should not increase because supply
299
- /// dilution offsets surplus increase.
300
- function test_pay_surplusInflation_neutral() public {
301
- // User pays to get tokens
302
- vm.prank(USER);
303
- uint256 userTokens =
304
- jbMultiTerminal().pay{value: 10e18}(REVNET_ID, JBConstants.NATIVE_TOKEN, 10e18, USER, 0, "", "");
305
-
306
- // Check borrowable-per-token for existing user's tokens
307
- uint256 borrowableBefore =
308
- LOANS_CONTRACT.borrowableAmountFrom(REVNET_ID, userTokens, 18, uint32(uint160(JBConstants.NATIVE_TOKEN)));
309
-
310
- // Someone else pays 100 ETH (this mints new tokens AND increases surplus)
311
- address payer = makeAddr("payer");
312
- vm.deal(payer, 100e18);
313
- vm.prank(payer);
314
- jbMultiTerminal().pay{value: 100e18}(REVNET_ID, JBConstants.NATIVE_TOKEN, 100e18, payer, 0, "", "");
315
-
316
- // Check borrowable for the SAME user tokens after the payment
317
- uint256 borrowableAfter =
318
- LOANS_CONTRACT.borrowableAmountFrom(REVNET_ID, userTokens, 18, uint32(uint160(JBConstants.NATIVE_TOKEN)));
319
-
320
- // With a non-zero cashOutTaxRate (concave bonding curve), paying in actually DECREASES
321
- // the per-token borrowable amount for existing holders due to dilution.
322
- // At minimum, it should not increase the per-token borrowable amount.
323
- assertLe(borrowableAfter, borrowableBefore, "Paying in should not increase per-token borrowable amount");
324
- }
325
-
326
- /// @notice Full attack simulation: donate, borrow max, verify net negative.
327
- function test_flashLoanSimulation_netNegative() public {
328
- // Attacker first buys tokens to have something to borrow against
329
- vm.prank(ATTACKER);
330
- uint256 attackerTokens =
331
- jbMultiTerminal().pay{value: 10e18}(REVNET_ID, JBConstants.NATIVE_TOKEN, 10e18, ATTACKER, 0, "", "");
332
-
333
- // Check borrowable before donation
334
- uint256 borrowableBefore = LOANS_CONTRACT.borrowableAmountFrom(
335
- REVNET_ID, attackerTokens, 18, uint32(uint160(JBConstants.NATIVE_TOKEN))
336
- );
337
-
338
- // Attacker donates 100 ETH to inflate surplus (simulating flash loan injection)
339
- uint256 donationAmount = 100e18;
340
- vm.prank(ATTACKER);
341
- jbMultiTerminal().addToBalanceOf{value: donationAmount}(
342
- REVNET_ID, JBConstants.NATIVE_TOKEN, donationAmount, false, "", ""
343
- );
344
-
345
- // Check borrowable after donation
346
- uint256 borrowableAfter = LOANS_CONTRACT.borrowableAmountFrom(
347
- REVNET_ID, attackerTokens, 18, uint32(uint160(JBConstants.NATIVE_TOKEN))
348
- );
349
-
350
- // Extra borrowable gained by the attacker through the donation
351
- uint256 extraBorrowable = borrowableAfter - borrowableBefore;
352
-
353
- // The attacker's net position:
354
- // - Lost: donationAmount (100 ETH, permanently donated — no recovery mechanism)
355
- // - Gained: extraBorrowable (the additional amount they can borrow)
356
- // Net = extraBorrowable - donationAmount, which should be negative
357
- assertGt(donationAmount, extraBorrowable, "Attack should be net negative: donation > extra borrowable");
358
-
359
- // Furthermore, the extra borrowable is strictly less than donation because
360
- // gain = donation * (collateral / totalSupply) * cashOutTaxRate_factor
361
- // and collateral < totalSupply, so the multiplier is always < 1
362
- // This means the attacker loses a significant fraction of their flash loan
363
- assertTrue(extraBorrowable < donationAmount, "Extra borrowable must be strictly less than donation");
364
- }
365
- }