@rev-net/core-v6 0.0.37 → 0.0.39

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (107) hide show
  1. package/CHANGELOG.md +2 -2
  2. package/README.md +6 -7
  3. package/foundry.toml +1 -1
  4. package/package.json +23 -16
  5. package/references/operations.md +1 -1
  6. package/references/runtime.md +1 -1
  7. package/script/Deploy.s.sol +12 -9
  8. package/src/REVDeployer.sol +60 -65
  9. package/src/REVHiddenTokens.sol +2 -2
  10. package/src/REVLoans.sol +17 -10
  11. package/src/REVOwner.sol +121 -14
  12. package/src/interfaces/IREVDeployer.sol +2 -1
  13. package/src/interfaces/IREVHiddenTokens.sol +4 -1
  14. package/src/interfaces/IREVOwner.sol +5 -0
  15. package/ADMINISTRATION.md +0 -73
  16. package/ARCHITECTURE.md +0 -116
  17. package/AUDIT_INSTRUCTIONS.md +0 -90
  18. package/RISKS.md +0 -107
  19. package/SKILLS.md +0 -46
  20. package/STYLE_GUIDE.md +0 -610
  21. package/USER_JOURNEYS.md +0 -195
  22. package/foundry.lock +0 -11
  23. package/slither-ci.config.json +0 -10
  24. package/sphinx.lock +0 -507
  25. package/test/REV.integrations.t.sol +0 -573
  26. package/test/REVAutoIssuanceFuzz.t.sol +0 -328
  27. package/test/REVDeployerRegressions.t.sol +0 -396
  28. package/test/REVInvincibility.t.sol +0 -1371
  29. package/test/REVInvincibilityHandler.sol +0 -387
  30. package/test/REVLifecycle.t.sol +0 -420
  31. package/test/REVLoans.invariants.t.sol +0 -724
  32. package/test/REVLoansAttacks.t.sol +0 -816
  33. package/test/REVLoansFeeRecovery.t.sol +0 -783
  34. package/test/REVLoansFindings.t.sol +0 -711
  35. package/test/REVLoansRegressions.t.sol +0 -364
  36. package/test/REVLoansSourceFeeRecovery.t.sol +0 -517
  37. package/test/REVLoansSourced.t.sol +0 -1839
  38. package/test/REVLoansUnSourced.t.sol +0 -409
  39. package/test/TestAuditFixVerification.t.sol +0 -675
  40. package/test/TestBurnHeldTokens.t.sol +0 -394
  41. package/test/TestCEIPattern.t.sol +0 -508
  42. package/test/TestCashOutCallerValidation.t.sol +0 -452
  43. package/test/TestConversionDocumentation.t.sol +0 -365
  44. package/test/TestCrossCurrencyReclaim.t.sol +0 -610
  45. package/test/TestCrossSourceReallocation.t.sol +0 -361
  46. package/test/TestERC2771MetaTx.t.sol +0 -585
  47. package/test/TestEmptyBuybackSpecs.t.sol +0 -300
  48. package/test/TestFlashLoanSurplus.t.sol +0 -365
  49. package/test/TestHiddenTokens.t.sol +0 -474
  50. package/test/TestHookArrayOOB.t.sol +0 -278
  51. package/test/TestLiquidationBehavior.t.sol +0 -398
  52. package/test/TestLoanSourceRotation.t.sol +0 -553
  53. package/test/TestLoansCashOutDelay.t.sol +0 -493
  54. package/test/TestLongTailEconomics.t.sol +0 -677
  55. package/test/TestLowFindings.t.sol +0 -677
  56. package/test/TestMixedFixes.t.sol +0 -593
  57. package/test/TestPermit2Signatures.t.sol +0 -683
  58. package/test/TestReallocationSandwich.t.sol +0 -412
  59. package/test/TestRevnetRegressions.t.sol +0 -350
  60. package/test/TestSplitWeightAdjustment.t.sol +0 -527
  61. package/test/TestSplitWeightE2E.t.sol +0 -605
  62. package/test/TestSplitWeightFork.t.sol +0 -855
  63. package/test/TestStageTransitionBorrowable.t.sol +0 -301
  64. package/test/TestSwapTerminalPermission.t.sol +0 -262
  65. package/test/TestTerminalEncodingInHash.t.sol +0 -326
  66. package/test/TestUint112Overflow.t.sol +0 -311
  67. package/test/TestZeroAmountLoanGuard.t.sol +0 -378
  68. package/test/TestZeroRepayment.t.sol +0 -354
  69. package/test/audit/CrossChainBuybackRouteMismatch.t.sol +0 -184
  70. package/test/audit/HiddenSupplyCashout.t.sol +0 -61
  71. package/test/audit/LoanIdOverflowGuard.t.sol +0 -523
  72. package/test/audit/NemesisVerification.t.sol +0 -97
  73. package/test/audit/OperatorDelegation.t.sol +0 -356
  74. package/test/audit/PhantomSurplusTerminal.t.sol +0 -367
  75. package/test/audit/REVOwnerCurrencyMismatch.t.sol +0 -188
  76. package/test/audit/REVOwnerRemoteSurplusCurrencyMismatch.t.sol +0 -140
  77. package/test/audit/ReallocatePermission.t.sol +0 -363
  78. package/test/audit/RemoteLoanAccountingGap.t.sol +0 -74
  79. package/test/audit/SupportsInterfaceTest.t.sol +0 -51
  80. package/test/audit/TestFeeAllowanceLeak.t.sol +0 -197
  81. package/test/audit/TestLoansAndDeployerFixes.t.sol +0 -576
  82. package/test/fork/ForkTestBase.sol +0 -727
  83. package/test/fork/TestAutoIssuanceFork.t.sol +0 -148
  84. package/test/fork/TestCashOutFork.t.sol +0 -253
  85. package/test/fork/TestIssuanceDecayFork.t.sol +0 -158
  86. package/test/fork/TestLoanAdversarialFork.t.sol +0 -744
  87. package/test/fork/TestLoanBorrowFork.t.sol +0 -163
  88. package/test/fork/TestLoanCrossRulesetFork.t.sol +0 -308
  89. package/test/fork/TestLoanERC20Fork.t.sol +0 -459
  90. package/test/fork/TestLoanLiquidationFork.t.sol +0 -135
  91. package/test/fork/TestLoanReallocateFork.t.sol +0 -113
  92. package/test/fork/TestLoanRepayFork.t.sol +0 -188
  93. package/test/fork/TestLoanTransferFork.t.sol +0 -143
  94. package/test/fork/TestPermit2PaymentFork.t.sol +0 -300
  95. package/test/fork/TestSplitWeightFork.t.sol +0 -189
  96. package/test/helpers/MaliciousContracts.sol +0 -247
  97. package/test/helpers/REVEmpty721Config.sol +0 -45
  98. package/test/mock/MockBuybackCashOutRecorder.sol +0 -84
  99. package/test/mock/MockBuybackDataHook.sol +0 -112
  100. package/test/mock/MockBuybackDataHookMintPath.sol +0 -68
  101. package/test/mock/MockSuckerRegistry.sol +0 -17
  102. package/test/regression/TestBurnPermissionRequired.t.sol +0 -294
  103. package/test/regression/TestCashOutBuybackFeeLeak.t.sol +0 -232
  104. package/test/regression/TestCrossRevnetLiquidation.t.sol +0 -255
  105. package/test/regression/TestCumulativeLoanCounter.t.sol +0 -361
  106. package/test/regression/TestLiquidateGapHandling.t.sol +0 -394
  107. package/test/regression/TestZeroPriceFeed.t.sol +0 -422
@@ -1,294 +0,0 @@
1
- // SPDX-License-Identifier: MIT
2
- pragma solidity 0.8.28;
3
-
4
- // forge-lint: disable-next-line(unaliased-plain-import)
5
- import "forge-std/Test.sol";
6
- // forge-lint: disable-next-line(unaliased-plain-import)
7
- import /* {*} from */ "@bananapus/core-v6/test/helpers/TestBaseWorkflow.sol";
8
- // forge-lint: disable-next-line(unaliased-plain-import)
9
- import /* {*} from */ "./../../src/REVDeployer.sol";
10
- // forge-lint: disable-next-line(unaliased-plain-import)
11
- import "@croptop/core-v6/src/CTPublisher.sol";
12
- import {MockBuybackDataHook} from "./../mock/MockBuybackDataHook.sol";
13
- // forge-lint: disable-next-line(unaliased-plain-import)
14
- import "@bananapus/core-v6/script/helpers/CoreDeploymentLib.sol";
15
- // forge-lint: disable-next-line(unaliased-plain-import)
16
- import "@bananapus/721-hook-v6/script/helpers/Hook721DeploymentLib.sol";
17
- // forge-lint: disable-next-line(unaliased-plain-import)
18
- import "@bananapus/suckers-v6/script/helpers/SuckerDeploymentLib.sol";
19
- // forge-lint: disable-next-line(unaliased-plain-import)
20
- import "@croptop/core-v6/script/helpers/CroptopDeploymentLib.sol";
21
- // forge-lint: disable-next-line(unaliased-plain-import)
22
- import "@bananapus/router-terminal-v6/script/helpers/RouterTerminalDeploymentLib.sol";
23
- import {JBConstants} from "@bananapus/core-v6/src/libraries/JBConstants.sol";
24
- import {JBAccountingContext} from "@bananapus/core-v6/src/structs/JBAccountingContext.sol";
25
- import {JBSingleAllowance} from "@bananapus/core-v6/src/structs/JBSingleAllowance.sol";
26
- import {MockPriceFeed} from "@bananapus/core-v6/test/mock/MockPriceFeed.sol";
27
- import {MockERC20} from "@bananapus/core-v6/test/mock/MockERC20.sol";
28
- import {REVLoans} from "../../src/REVLoans.sol";
29
- import {REVLoan} from "../../src/structs/REVLoan.sol";
30
- import {REVStageConfig, REVAutoIssuance} from "../../src/structs/REVStageConfig.sol";
31
- import {REVLoanSource} from "../../src/structs/REVLoanSource.sol";
32
- import {REVDescription} from "../../src/structs/REVDescription.sol";
33
- import {JBSuckerDeployerConfig} from "@bananapus/suckers-v6/src/structs/JBSuckerDeployerConfig.sol";
34
- import {JBSuckerRegistry} from "@bananapus/suckers-v6/src/JBSuckerRegistry.sol";
35
- import {JB721TiersHookDeployer} from "@bananapus/721-hook-v6/src/JB721TiersHookDeployer.sol";
36
- import {JB721TiersHook} from "@bananapus/721-hook-v6/src/JB721TiersHook.sol";
37
- import {JB721TiersHookStore} from "@bananapus/721-hook-v6/src/JB721TiersHookStore.sol";
38
- import {JB721CheckpointsDeployer} from "@bananapus/721-hook-v6/src/JB721CheckpointsDeployer.sol";
39
- import {IJB721CheckpointsDeployer} from "@bananapus/721-hook-v6/src/interfaces/IJB721CheckpointsDeployer.sol";
40
- import {JBAddressRegistry} from "@bananapus/address-registry-v6/src/JBAddressRegistry.sol";
41
- import {IJBAddressRegistry} from "@bananapus/address-registry-v6/src/interfaces/IJBAddressRegistry.sol";
42
- import {REVEmpty721Config} from "../helpers/REVEmpty721Config.sol";
43
- import {JBPermissionIds} from "@bananapus/permission-ids-v6/src/JBPermissionIds.sol";
44
- import {JBPermissioned} from "@bananapus/core-v6/src/abstract/JBPermissioned.sol";
45
- import {REVOwner} from "../../src/REVOwner.sol";
46
- import {IREVDeployer} from "../../src/interfaces/IREVDeployer.sol";
47
- import {MockSuckerRegistry} from "../mock/MockSuckerRegistry.sol";
48
-
49
- /// @notice Validates that borrowFrom() reverts with a clear error when the caller hasn't granted BURN_TOKENS
50
- /// permission to the REVLoans contract.
51
- /// @dev Without this upfront check, the transaction would revert deep in JBController.burnTokensOf with a
52
- /// less informative JBPermissioned_Unauthorized error.
53
- contract TestBurnPermissionRequired is TestBaseWorkflow {
54
- // forge-lint: disable-next-line(mixed-case-variable)
55
- bytes32 REV_DEPLOYER_SALT = "REVDeployer";
56
-
57
- // forge-lint: disable-next-line(mixed-case-variable)
58
- REVDeployer REV_DEPLOYER;
59
- // forge-lint: disable-next-line(mixed-case-variable)
60
- REVOwner REV_OWNER;
61
- // forge-lint: disable-next-line(mixed-case-variable)
62
- JB721TiersHook EXAMPLE_HOOK;
63
- // forge-lint: disable-next-line(mixed-case-variable)
64
- IJB721TiersHookDeployer HOOK_DEPLOYER;
65
- // forge-lint: disable-next-line(mixed-case-variable)
66
- IJB721TiersHookStore HOOK_STORE;
67
- // forge-lint: disable-next-line(mixed-case-variable)
68
- IJBAddressRegistry ADDRESS_REGISTRY;
69
- // forge-lint: disable-next-line(mixed-case-variable)
70
- REVLoans LOANS_CONTRACT;
71
- // forge-lint: disable-next-line(mixed-case-variable)
72
- MockERC20 TOKEN;
73
- // forge-lint: disable-next-line(mixed-case-variable)
74
- IJBSuckerRegistry SUCKER_REGISTRY;
75
- // forge-lint: disable-next-line(mixed-case-variable)
76
- CTPublisher PUBLISHER;
77
- // forge-lint: disable-next-line(mixed-case-variable)
78
- MockBuybackDataHook MOCK_BUYBACK;
79
-
80
- // forge-lint: disable-next-line(mixed-case-variable)
81
- uint256 FEE_PROJECT_ID;
82
- // forge-lint: disable-next-line(mixed-case-variable)
83
- uint256 REVNET_ID;
84
-
85
- address user = makeAddr("user");
86
-
87
- address private constant TRUSTED_FORWARDER = 0xB2b5841DBeF766d4b521221732F9B618fCf34A87;
88
-
89
- function setUp() public override {
90
- super.setUp();
91
- FEE_PROJECT_ID = jbProjects().createFor(multisig());
92
- SUCKER_REGISTRY = new JBSuckerRegistry(jbDirectory(), jbPermissions(), multisig(), address(0));
93
- HOOK_STORE = new JB721TiersHookStore();
94
- EXAMPLE_HOOK = new JB721TiersHook(
95
- jbDirectory(),
96
- jbPermissions(),
97
- jbPrices(),
98
- jbRulesets(),
99
- HOOK_STORE,
100
- jbSplits(),
101
- IJB721CheckpointsDeployer(address(new JB721CheckpointsDeployer())),
102
- multisig()
103
- );
104
- ADDRESS_REGISTRY = new JBAddressRegistry();
105
- HOOK_DEPLOYER = new JB721TiersHookDeployer(EXAMPLE_HOOK, HOOK_STORE, ADDRESS_REGISTRY, multisig());
106
- PUBLISHER = new CTPublisher(jbDirectory(), jbPermissions(), FEE_PROJECT_ID, multisig());
107
- MOCK_BUYBACK = new MockBuybackDataHook();
108
- TOKEN = new MockERC20("1/2 ETH", "1/2");
109
- MockPriceFeed priceFeed = new MockPriceFeed(1e21, 6);
110
- vm.prank(multisig());
111
- jbPrices()
112
- .addPriceFeedFor(0, uint32(uint160(address(TOKEN))), uint32(uint160(JBConstants.NATIVE_TOKEN)), priceFeed);
113
- LOANS_CONTRACT = new REVLoans({
114
- controller: jbController(),
115
- suckerRegistry: IJBSuckerRegistry(address(new MockSuckerRegistry())),
116
- revId: FEE_PROJECT_ID,
117
- owner: address(this),
118
- permit2: permit2(),
119
- trustedForwarder: TRUSTED_FORWARDER
120
- });
121
- REV_OWNER = new REVOwner(
122
- IJBBuybackHookRegistry(address(MOCK_BUYBACK)),
123
- jbDirectory(),
124
- FEE_PROJECT_ID,
125
- SUCKER_REGISTRY,
126
- address(LOANS_CONTRACT),
127
- address(0)
128
- );
129
-
130
- REV_DEPLOYER = new REVDeployer{salt: REV_DEPLOYER_SALT}(
131
- jbController(),
132
- SUCKER_REGISTRY,
133
- FEE_PROJECT_ID,
134
- HOOK_DEPLOYER,
135
- PUBLISHER,
136
- IJBBuybackHookRegistry(address(MOCK_BUYBACK)),
137
- address(LOANS_CONTRACT),
138
- TRUSTED_FORWARDER,
139
- address(REV_OWNER)
140
- );
141
-
142
- REV_OWNER.setDeployer(REV_DEPLOYER);
143
-
144
- vm.prank(multisig());
145
- jbProjects().approve(address(REV_DEPLOYER), FEE_PROJECT_ID);
146
- _deployFeeProject();
147
- _deployRevnet();
148
- vm.deal(user, 100e18);
149
- }
150
-
151
- function _deployFeeProject() internal {
152
- JBAccountingContext[] memory acc = new JBAccountingContext[](2);
153
- acc[0] = JBAccountingContext({
154
- token: JBConstants.NATIVE_TOKEN, decimals: 18, currency: uint32(uint160(JBConstants.NATIVE_TOKEN))
155
- });
156
- acc[1] = JBAccountingContext({token: address(TOKEN), decimals: 6, currency: uint32(uint160(address(TOKEN)))});
157
- JBTerminalConfig[] memory tc = new JBTerminalConfig[](1);
158
- tc[0] = JBTerminalConfig({terminal: jbMultiTerminal(), accountingContextsToAccept: acc});
159
- REVStageConfig[] memory stages = new REVStageConfig[](1);
160
- JBSplit[] memory splits = new JBSplit[](1);
161
- splits[0].beneficiary = payable(multisig());
162
- splits[0].percent = 10_000;
163
- REVAutoIssuance[] memory ai = new REVAutoIssuance[](1);
164
- ai[0] = REVAutoIssuance({chainId: uint32(block.chainid), count: uint104(70_000e18), beneficiary: multisig()});
165
- stages[0] = REVStageConfig({
166
- startsAtOrAfter: uint40(block.timestamp),
167
- autoIssuances: ai,
168
- splitPercent: 2000,
169
- splits: splits,
170
- initialIssuance: uint112(1000e18),
171
- issuanceCutFrequency: 90 days,
172
- issuanceCutPercent: JBConstants.MAX_WEIGHT_CUT_PERCENT / 2,
173
- cashOutTaxRate: 6000,
174
- extraMetadata: 0
175
- });
176
- REVConfig memory cfg = REVConfig({
177
- // forge-lint: disable-next-line(named-struct-fields)
178
- description: REVDescription("Revnet", "$REV", "ipfs://test", "REV_TOKEN"),
179
- baseCurrency: uint32(uint160(JBConstants.NATIVE_TOKEN)),
180
- splitOperator: multisig(),
181
- stageConfigurations: stages
182
- });
183
- vm.prank(multisig());
184
- REV_DEPLOYER.deployFor({
185
- revnetId: FEE_PROJECT_ID,
186
- configuration: cfg,
187
- terminalConfigurations: tc,
188
- suckerDeploymentConfiguration: REVSuckerDeploymentConfig({
189
- deployerConfigurations: new JBSuckerDeployerConfig[](0), salt: keccak256("FEE")
190
- }),
191
- tiered721HookConfiguration: REVEmpty721Config.empty721Config(uint32(uint160(JBConstants.NATIVE_TOKEN))),
192
- allowedPosts: REVEmpty721Config.emptyAllowedPosts()
193
- });
194
- }
195
-
196
- function _deployRevnet() internal {
197
- JBAccountingContext[] memory acc = new JBAccountingContext[](2);
198
- acc[0] = JBAccountingContext({
199
- token: JBConstants.NATIVE_TOKEN, decimals: 18, currency: uint32(uint160(JBConstants.NATIVE_TOKEN))
200
- });
201
- acc[1] = JBAccountingContext({token: address(TOKEN), decimals: 6, currency: uint32(uint160(address(TOKEN)))});
202
- JBTerminalConfig[] memory tc = new JBTerminalConfig[](1);
203
- tc[0] = JBTerminalConfig({terminal: jbMultiTerminal(), accountingContextsToAccept: acc});
204
- REVStageConfig[] memory stages = new REVStageConfig[](1);
205
- JBSplit[] memory splits = new JBSplit[](1);
206
- splits[0].beneficiary = payable(multisig());
207
- splits[0].percent = 10_000;
208
- REVAutoIssuance[] memory ai = new REVAutoIssuance[](1);
209
- ai[0] = REVAutoIssuance({chainId: uint32(block.chainid), count: uint104(70_000e18), beneficiary: multisig()});
210
- stages[0] = REVStageConfig({
211
- startsAtOrAfter: uint40(block.timestamp),
212
- autoIssuances: ai,
213
- splitPercent: 2000,
214
- splits: splits,
215
- initialIssuance: uint112(1000e18),
216
- issuanceCutFrequency: 90 days,
217
- issuanceCutPercent: JBConstants.MAX_WEIGHT_CUT_PERCENT / 2,
218
- cashOutTaxRate: 6000,
219
- extraMetadata: 0
220
- });
221
- REVConfig memory cfg = REVConfig({
222
- // forge-lint: disable-next-line(named-struct-fields)
223
- description: REVDescription("NANA", "$NANA", "ipfs://test2", "NANA_TOKEN"),
224
- baseCurrency: uint32(uint160(JBConstants.NATIVE_TOKEN)),
225
- splitOperator: multisig(),
226
- stageConfigurations: stages
227
- });
228
- (REVNET_ID,) = REV_DEPLOYER.deployFor({
229
- revnetId: 0,
230
- configuration: cfg,
231
- terminalConfigurations: tc,
232
- suckerDeploymentConfiguration: REVSuckerDeploymentConfig({
233
- deployerConfigurations: new JBSuckerDeployerConfig[](0), salt: keccak256("NANA")
234
- }),
235
- tiered721HookConfiguration: REVEmpty721Config.empty721Config(uint32(uint160(JBConstants.NATIVE_TOKEN))),
236
- allowedPosts: REVEmpty721Config.emptyAllowedPosts()
237
- });
238
- }
239
-
240
- /// @notice borrowFrom should revert when the caller hasn't granted BURN_TOKENS permission.
241
- /// @dev The controller enforces this with JBPermissioned_Unauthorized when burnTokensOf is called.
242
- function test_borrowFrom_revertsWithoutBurnPermission() public {
243
- // Pay into the revnet to get tokens.
244
- vm.prank(user);
245
- uint256 tokenCount =
246
- jbMultiTerminal().pay{value: 5e18}(REVNET_ID, JBConstants.NATIVE_TOKEN, 5e18, user, 0, "", "");
247
- require(tokenCount > 0, "Should have received tokens");
248
-
249
- // Attempt to borrow WITHOUT granting BURN_TOKENS permission → should revert.
250
- REVLoanSource memory source = REVLoanSource({token: JBConstants.NATIVE_TOKEN, terminal: jbMultiTerminal()});
251
- vm.prank(user);
252
- vm.expectRevert(
253
- abi.encodeWithSelector(
254
- JBPermissioned.JBPermissioned_Unauthorized.selector,
255
- user, // account (the token holder)
256
- address(LOANS_CONTRACT), // sender (the contract trying to burn)
257
- REVNET_ID, // projectId
258
- JBPermissionIds.BURN_TOKENS // permissionId
259
- )
260
- );
261
- LOANS_CONTRACT.borrowFrom(REVNET_ID, source, 0, tokenCount, payable(user), 25, user);
262
- }
263
-
264
- /// @notice borrowFrom should succeed when the caller has granted BURN_TOKENS permission.
265
- function test_borrowFrom_succeedsWithBurnPermission() public {
266
- // Pay into the revnet to get tokens.
267
- vm.prank(user);
268
- uint256 tokenCount =
269
- jbMultiTerminal().pay{value: 5e18}(REVNET_ID, JBConstants.NATIVE_TOKEN, 5e18, user, 0, "", "");
270
- require(tokenCount > 0, "Should have received tokens");
271
-
272
- // Grant BURN_TOKENS permission to the loans contract via the real permissions system.
273
- uint8[] memory permissionIds = new uint8[](1);
274
- permissionIds[0] = JBPermissionIds.BURN_TOKENS;
275
- vm.prank(user);
276
- jbPermissions()
277
- .setPermissionsFor({
278
- account: user,
279
- permissionsData: JBPermissionsData({
280
- operator: address(LOANS_CONTRACT), projectId: uint64(REVNET_ID), permissionIds: permissionIds
281
- })
282
- });
283
-
284
- // Borrow should now succeed.
285
- REVLoanSource memory source = REVLoanSource({token: JBConstants.NATIVE_TOKEN, terminal: jbMultiTerminal()});
286
- vm.prank(user);
287
- (uint256 loanId, REVLoan memory loan) =
288
- LOANS_CONTRACT.borrowFrom(REVNET_ID, source, 0, tokenCount, payable(user), 25, user);
289
-
290
- assertTrue(loanId > 0, "Loan ID should be non-zero");
291
- assertTrue(loan.createdAt > 0, "Loan should be created");
292
- assertTrue(loan.amount > 0, "Loan amount should be non-zero");
293
- }
294
- }
@@ -1,232 +0,0 @@
1
- // SPDX-License-Identifier: MIT
2
- pragma solidity 0.8.28;
3
-
4
- // forge-lint: disable-next-line(unaliased-plain-import)
5
- import "forge-std/Test.sol";
6
- // forge-lint: disable-next-line(unaliased-plain-import)
7
- import /* {*} from */ "@bananapus/core-v6/test/helpers/TestBaseWorkflow.sol";
8
- // forge-lint: disable-next-line(unaliased-plain-import)
9
- import /* {*} from */ "../../src/REVDeployer.sol";
10
- // forge-lint: disable-next-line(unaliased-plain-import)
11
- import "@croptop/core-v6/src/CTPublisher.sol";
12
-
13
- import {JBConstants} from "@bananapus/core-v6/src/libraries/JBConstants.sol";
14
- import {JBAccountingContext} from "@bananapus/core-v6/src/structs/JBAccountingContext.sol";
15
- import {JBTerminalConfig} from "@bananapus/core-v6/src/structs/JBTerminalConfig.sol";
16
- import {JBSplit} from "@bananapus/core-v6/src/structs/JBSplit.sol";
17
- import {JBSuckerDeployerConfig} from "@bananapus/suckers-v6/src/structs/JBSuckerDeployerConfig.sol";
18
- import {JBBeforeCashOutRecordedContext} from "@bananapus/core-v6/src/structs/JBBeforeCashOutRecordedContext.sol";
19
- import {JBCashOutHookSpecification} from "@bananapus/core-v6/src/structs/JBCashOutHookSpecification.sol";
20
- import {JBTokenAmount} from "@bananapus/core-v6/src/structs/JBTokenAmount.sol";
21
- import {JB721TiersHook} from "@bananapus/721-hook-v6/src/JB721TiersHook.sol";
22
- import {JB721TiersHookDeployer} from "@bananapus/721-hook-v6/src/JB721TiersHookDeployer.sol";
23
- import {JB721TiersHookStore} from "@bananapus/721-hook-v6/src/JB721TiersHookStore.sol";
24
- import {JB721CheckpointsDeployer} from "@bananapus/721-hook-v6/src/JB721CheckpointsDeployer.sol";
25
- import {IJB721CheckpointsDeployer} from "@bananapus/721-hook-v6/src/interfaces/IJB721CheckpointsDeployer.sol";
26
- import {IJB721TiersHookDeployer} from "@bananapus/721-hook-v6/src/interfaces/IJB721TiersHookDeployer.sol";
27
- import "@bananapus/721-hook-v6/src/JB721CheckpointsDeployer.sol";
28
- import {IJB721CheckpointsDeployer} from "@bananapus/721-hook-v6/src/interfaces/IJB721CheckpointsDeployer.sol";
29
- import {JBAddressRegistry} from "@bananapus/address-registry-v6/src/JBAddressRegistry.sol";
30
- import {IJBAddressRegistry} from "@bananapus/address-registry-v6/src/interfaces/IJBAddressRegistry.sol";
31
- import {JBSuckerRegistry} from "@bananapus/suckers-v6/src/JBSuckerRegistry.sol";
32
- import {IJBBuybackHookRegistry} from "@bananapus/buyback-hook-v6/src/interfaces/IJBBuybackHookRegistry.sol";
33
-
34
- import {REVConfig} from "../../src/structs/REVConfig.sol";
35
- import {REVDescription} from "../../src/structs/REVDescription.sol";
36
- import {REVStageConfig} from "../../src/structs/REVStageConfig.sol";
37
- import {REVAutoIssuance} from "../../src/structs/REVAutoIssuance.sol";
38
- import {REVSuckerDeploymentConfig} from "../../src/structs/REVSuckerDeploymentConfig.sol";
39
- import {REVLoans} from "../../src/REVLoans.sol";
40
- import {REVEmpty721Config} from "../helpers/REVEmpty721Config.sol";
41
- import {MockBuybackCashOutRecorder} from "../mock/MockBuybackCashOutRecorder.sol";
42
- import {REVOwner} from "../../src/REVOwner.sol";
43
- import {IREVDeployer} from "../../src/interfaces/IREVDeployer.sol";
44
- import {MockSuckerRegistry} from "../mock/MockSuckerRegistry.sol";
45
-
46
- /// @title TestCashOutBuybackFeeLeak
47
- /// @notice Proves the buyback hook callback receives only the non-fee cashOutCount (not the full count).
48
- /// Before the fix, the buyback hook reminted and sold `context.cashOutCount` tokens — more than REVDeployer
49
- /// intended. The fee portion was monetized through the pool sale AND the fee was also extracted from treasury.
50
- contract TestCashOutBuybackFeeLeak is TestBaseWorkflow {
51
- bytes32 private constant REV_DEPLOYER_SALT = "REVDeployer";
52
- bytes32 private constant ERC20_SALT = "REV_TOKEN";
53
- address private constant TRUSTED_FORWARDER = 0xB2b5841DBeF766d4b521221732F9B618fCf34A87;
54
-
55
- REVDeployer internal revDeployer;
56
- REVOwner internal revOwner;
57
- MockBuybackCashOutRecorder internal mockBuyback;
58
- JB721TiersHook internal exampleHook;
59
- IJB721TiersHookDeployer internal hookDeployer;
60
- IJBAddressRegistry internal addressRegistry;
61
- JB721TiersHookStore internal hookStore;
62
- JBSuckerRegistry internal suckerRegistry;
63
- CTPublisher internal publisher;
64
- REVLoans internal loans;
65
-
66
- uint256 internal feeProjectId;
67
- uint256 internal revnetId;
68
- address internal user = makeAddr("user");
69
-
70
- function setUp() public override {
71
- super.setUp();
72
-
73
- feeProjectId = jbProjects().createFor(multisig());
74
- suckerRegistry = new JBSuckerRegistry(jbDirectory(), jbPermissions(), multisig(), address(0));
75
- hookStore = new JB721TiersHookStore();
76
- exampleHook = new JB721TiersHook(
77
- jbDirectory(),
78
- jbPermissions(),
79
- jbPrices(),
80
- jbRulesets(),
81
- hookStore,
82
- jbSplits(),
83
- IJB721CheckpointsDeployer(address(new JB721CheckpointsDeployer())),
84
- multisig()
85
- );
86
- addressRegistry = new JBAddressRegistry();
87
- hookDeployer = new JB721TiersHookDeployer(exampleHook, hookStore, addressRegistry, multisig());
88
- publisher = new CTPublisher(jbDirectory(), jbPermissions(), feeProjectId, multisig());
89
- mockBuyback = new MockBuybackCashOutRecorder();
90
- loans = new REVLoans({
91
- controller: jbController(),
92
- suckerRegistry: IJBSuckerRegistry(address(new MockSuckerRegistry())),
93
- revId: feeProjectId,
94
- owner: address(this),
95
- permit2: permit2(),
96
- trustedForwarder: TRUSTED_FORWARDER
97
- });
98
-
99
- revOwner = new REVOwner(
100
- IJBBuybackHookRegistry(address(mockBuyback)),
101
- jbDirectory(),
102
- feeProjectId,
103
- IJBSuckerRegistry(address(suckerRegistry)),
104
- address(loans),
105
- address(0)
106
- );
107
-
108
- revDeployer = new REVDeployer{salt: REV_DEPLOYER_SALT}(
109
- jbController(),
110
- suckerRegistry,
111
- feeProjectId,
112
- hookDeployer,
113
- publisher,
114
- IJBBuybackHookRegistry(address(mockBuyback)),
115
- address(loans),
116
- TRUSTED_FORWARDER,
117
- address(revOwner)
118
- );
119
-
120
- revOwner.setDeployer(revDeployer);
121
-
122
- vm.prank(multisig());
123
- jbProjects().approve(address(revDeployer), feeProjectId);
124
-
125
- // Deploy fee project.
126
- vm.prank(multisig());
127
- _deployRevnet("Fee", "FEE", "ipfs://fee", "FEE_SALT", 6000, feeProjectId);
128
-
129
- // Deploy test revnet.
130
- (revnetId,) = _deployRevnet("Revnet", "REV", "ipfs://rev", ERC20_SALT, 6000, 0);
131
- }
132
-
133
- /// @notice The invariant: buyback hook should only process the non-fee token count.
134
- /// This test FAILS before the fix (proving the bug) and PASSES after.
135
- function test_buybackHookReceivesOnlyNonFeeCount() external {
136
- // Fund the user and pay into the revnet.
137
- vm.deal(user, 10 ether);
138
- vm.prank(user);
139
- jbMultiTerminal().pay{value: 5 ether}({
140
- projectId: revnetId,
141
- token: JBConstants.NATIVE_TOKEN,
142
- amount: 5 ether,
143
- beneficiary: user,
144
- minReturnedTokens: 0,
145
- memo: "",
146
- metadata: ""
147
- });
148
-
149
- uint256 fullCashOutCount = jbTokens().totalBalanceOf(user, revnetId) / 2;
150
- assertGt(fullCashOutCount, 0, "user should have tokens");
151
-
152
- // The non-fee count: what the buyback hook SHOULD process.
153
- uint256 feeCashOutCount = fullCashOutCount * revDeployer.FEE() / JBConstants.MAX_FEE;
154
- uint256 expectedNonFeeCount = fullCashOutCount - feeCashOutCount;
155
-
156
- // Perform the cash out.
157
- vm.prank(user);
158
- jbMultiTerminal()
159
- .cashOutTokensOf({
160
- holder: user,
161
- projectId: revnetId,
162
- cashOutCount: fullCashOutCount,
163
- tokenToReclaim: JBConstants.NATIVE_TOKEN,
164
- minTokensReclaimed: 0,
165
- beneficiary: payable(user),
166
- metadata: ""
167
- });
168
-
169
- // THE INVARIANT: The buyback hook callback should receive nonFeeCashOutCount.
170
- // The real buyback hook remints `context.cashOutCount` tokens and sells them on the pool.
171
- // If it receives fullCashOutCount, it sells the fee portion too — the fee is bypassed.
172
- assertEq(
173
- mockBuyback.afterCashOutCount(),
174
- expectedNonFeeCount,
175
- "BUG: buyback hook received full count instead of non-fee count"
176
- );
177
- }
178
-
179
- function _deployRevnet(
180
- string memory name,
181
- string memory symbol,
182
- string memory projectUri,
183
- bytes32 salt,
184
- uint16 cashOutTaxRate,
185
- uint256 existingProjectId
186
- )
187
- internal
188
- returns (uint256 id, IJB721TiersHook hook)
189
- {
190
- JBAccountingContext[] memory accountingContextsToAccept = new JBAccountingContext[](1);
191
- accountingContextsToAccept[0] = JBAccountingContext({
192
- token: JBConstants.NATIVE_TOKEN, decimals: 18, currency: uint32(uint160(JBConstants.NATIVE_TOKEN))
193
- });
194
-
195
- JBTerminalConfig[] memory terminalConfigurations = new JBTerminalConfig[](1);
196
- terminalConfigurations[0] =
197
- JBTerminalConfig({terminal: jbMultiTerminal(), accountingContextsToAccept: accountingContextsToAccept});
198
-
199
- JBSplit[] memory splits = new JBSplit[](1);
200
- splits[0].beneficiary = payable(multisig());
201
- splits[0].percent = 10_000;
202
-
203
- REVStageConfig[] memory stageConfigurations = new REVStageConfig[](1);
204
- stageConfigurations[0] = REVStageConfig({
205
- startsAtOrAfter: uint40(block.timestamp),
206
- autoIssuances: new REVAutoIssuance[](0),
207
- splitPercent: 2000,
208
- splits: splits,
209
- initialIssuance: uint112(1000e18),
210
- issuanceCutFrequency: 90 days,
211
- issuanceCutPercent: JBConstants.MAX_WEIGHT_CUT_PERCENT / 2,
212
- cashOutTaxRate: cashOutTaxRate,
213
- extraMetadata: 0
214
- });
215
-
216
- return revDeployer.deployFor({
217
- revnetId: existingProjectId,
218
- configuration: REVConfig({
219
- description: REVDescription(name, symbol, projectUri, salt),
220
- baseCurrency: uint32(uint160(JBConstants.NATIVE_TOKEN)),
221
- splitOperator: multisig(),
222
- stageConfigurations: stageConfigurations
223
- }),
224
- terminalConfigurations: terminalConfigurations,
225
- suckerDeploymentConfiguration: REVSuckerDeploymentConfig({
226
- deployerConfigurations: new JBSuckerDeployerConfig[](0), salt: keccak256(abi.encodePacked(symbol))
227
- }),
228
- tiered721HookConfiguration: REVEmpty721Config.empty721Config(uint32(uint160(JBConstants.NATIVE_TOKEN))),
229
- allowedPosts: REVEmpty721Config.emptyAllowedPosts()
230
- });
231
- }
232
- }