@rev-net/core-v6 0.0.37 → 0.0.40

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (112) hide show
  1. package/CHANGELOG.md +2 -2
  2. package/README.md +6 -7
  3. package/foundry.toml +1 -1
  4. package/package.json +23 -16
  5. package/references/operations.md +1 -1
  6. package/references/runtime.md +1 -1
  7. package/script/Deploy.s.sol +12 -9
  8. package/src/REVDeployer.sol +69 -67
  9. package/src/REVHiddenTokens.sol +2 -2
  10. package/src/REVLoans.sol +26 -22
  11. package/src/REVOwner.sol +147 -29
  12. package/src/interfaces/IREVDeployer.sol +2 -1
  13. package/src/interfaces/IREVHiddenTokens.sol +4 -1
  14. package/src/interfaces/IREVOwner.sol +5 -0
  15. package/src/structs/REVAutoIssuance.sol +4 -2
  16. package/src/structs/REVConfig.sol +8 -5
  17. package/src/structs/REVDescription.sol +6 -5
  18. package/src/structs/REVLoan.sol +8 -5
  19. package/src/structs/REVStageConfig.sol +14 -16
  20. package/ADMINISTRATION.md +0 -73
  21. package/ARCHITECTURE.md +0 -116
  22. package/AUDIT_INSTRUCTIONS.md +0 -90
  23. package/RISKS.md +0 -107
  24. package/SKILLS.md +0 -46
  25. package/STYLE_GUIDE.md +0 -610
  26. package/USER_JOURNEYS.md +0 -195
  27. package/foundry.lock +0 -11
  28. package/slither-ci.config.json +0 -10
  29. package/sphinx.lock +0 -507
  30. package/test/REV.integrations.t.sol +0 -573
  31. package/test/REVAutoIssuanceFuzz.t.sol +0 -328
  32. package/test/REVDeployerRegressions.t.sol +0 -396
  33. package/test/REVInvincibility.t.sol +0 -1371
  34. package/test/REVInvincibilityHandler.sol +0 -387
  35. package/test/REVLifecycle.t.sol +0 -420
  36. package/test/REVLoans.invariants.t.sol +0 -724
  37. package/test/REVLoansAttacks.t.sol +0 -816
  38. package/test/REVLoansFeeRecovery.t.sol +0 -783
  39. package/test/REVLoansFindings.t.sol +0 -711
  40. package/test/REVLoansRegressions.t.sol +0 -364
  41. package/test/REVLoansSourceFeeRecovery.t.sol +0 -517
  42. package/test/REVLoansSourced.t.sol +0 -1839
  43. package/test/REVLoansUnSourced.t.sol +0 -409
  44. package/test/TestAuditFixVerification.t.sol +0 -675
  45. package/test/TestBurnHeldTokens.t.sol +0 -394
  46. package/test/TestCEIPattern.t.sol +0 -508
  47. package/test/TestCashOutCallerValidation.t.sol +0 -452
  48. package/test/TestConversionDocumentation.t.sol +0 -365
  49. package/test/TestCrossCurrencyReclaim.t.sol +0 -610
  50. package/test/TestCrossSourceReallocation.t.sol +0 -361
  51. package/test/TestERC2771MetaTx.t.sol +0 -585
  52. package/test/TestEmptyBuybackSpecs.t.sol +0 -300
  53. package/test/TestFlashLoanSurplus.t.sol +0 -365
  54. package/test/TestHiddenTokens.t.sol +0 -474
  55. package/test/TestHookArrayOOB.t.sol +0 -278
  56. package/test/TestLiquidationBehavior.t.sol +0 -398
  57. package/test/TestLoanSourceRotation.t.sol +0 -553
  58. package/test/TestLoansCashOutDelay.t.sol +0 -493
  59. package/test/TestLongTailEconomics.t.sol +0 -677
  60. package/test/TestLowFindings.t.sol +0 -677
  61. package/test/TestMixedFixes.t.sol +0 -593
  62. package/test/TestPermit2Signatures.t.sol +0 -683
  63. package/test/TestReallocationSandwich.t.sol +0 -412
  64. package/test/TestRevnetRegressions.t.sol +0 -350
  65. package/test/TestSplitWeightAdjustment.t.sol +0 -527
  66. package/test/TestSplitWeightE2E.t.sol +0 -605
  67. package/test/TestSplitWeightFork.t.sol +0 -855
  68. package/test/TestStageTransitionBorrowable.t.sol +0 -301
  69. package/test/TestSwapTerminalPermission.t.sol +0 -262
  70. package/test/TestTerminalEncodingInHash.t.sol +0 -326
  71. package/test/TestUint112Overflow.t.sol +0 -311
  72. package/test/TestZeroAmountLoanGuard.t.sol +0 -378
  73. package/test/TestZeroRepayment.t.sol +0 -354
  74. package/test/audit/CrossChainBuybackRouteMismatch.t.sol +0 -184
  75. package/test/audit/HiddenSupplyCashout.t.sol +0 -61
  76. package/test/audit/LoanIdOverflowGuard.t.sol +0 -523
  77. package/test/audit/NemesisVerification.t.sol +0 -97
  78. package/test/audit/OperatorDelegation.t.sol +0 -356
  79. package/test/audit/PhantomSurplusTerminal.t.sol +0 -367
  80. package/test/audit/REVOwnerCurrencyMismatch.t.sol +0 -188
  81. package/test/audit/REVOwnerRemoteSurplusCurrencyMismatch.t.sol +0 -140
  82. package/test/audit/ReallocatePermission.t.sol +0 -363
  83. package/test/audit/RemoteLoanAccountingGap.t.sol +0 -74
  84. package/test/audit/SupportsInterfaceTest.t.sol +0 -51
  85. package/test/audit/TestFeeAllowanceLeak.t.sol +0 -197
  86. package/test/audit/TestLoansAndDeployerFixes.t.sol +0 -576
  87. package/test/fork/ForkTestBase.sol +0 -727
  88. package/test/fork/TestAutoIssuanceFork.t.sol +0 -148
  89. package/test/fork/TestCashOutFork.t.sol +0 -253
  90. package/test/fork/TestIssuanceDecayFork.t.sol +0 -158
  91. package/test/fork/TestLoanAdversarialFork.t.sol +0 -744
  92. package/test/fork/TestLoanBorrowFork.t.sol +0 -163
  93. package/test/fork/TestLoanCrossRulesetFork.t.sol +0 -308
  94. package/test/fork/TestLoanERC20Fork.t.sol +0 -459
  95. package/test/fork/TestLoanLiquidationFork.t.sol +0 -135
  96. package/test/fork/TestLoanReallocateFork.t.sol +0 -113
  97. package/test/fork/TestLoanRepayFork.t.sol +0 -188
  98. package/test/fork/TestLoanTransferFork.t.sol +0 -143
  99. package/test/fork/TestPermit2PaymentFork.t.sol +0 -300
  100. package/test/fork/TestSplitWeightFork.t.sol +0 -189
  101. package/test/helpers/MaliciousContracts.sol +0 -247
  102. package/test/helpers/REVEmpty721Config.sol +0 -45
  103. package/test/mock/MockBuybackCashOutRecorder.sol +0 -84
  104. package/test/mock/MockBuybackDataHook.sol +0 -112
  105. package/test/mock/MockBuybackDataHookMintPath.sol +0 -68
  106. package/test/mock/MockSuckerRegistry.sol +0 -17
  107. package/test/regression/TestBurnPermissionRequired.t.sol +0 -294
  108. package/test/regression/TestCashOutBuybackFeeLeak.t.sol +0 -232
  109. package/test/regression/TestCrossRevnetLiquidation.t.sol +0 -255
  110. package/test/regression/TestCumulativeLoanCounter.t.sol +0 -361
  111. package/test/regression/TestLiquidateGapHandling.t.sol +0 -394
  112. package/test/regression/TestZeroPriceFeed.t.sol +0 -422
@@ -1,300 +0,0 @@
1
- // SPDX-License-Identifier: MIT
2
- pragma solidity 0.8.28;
3
-
4
- // forge-lint: disable-next-line(unaliased-plain-import)
5
- import "forge-std/Test.sol";
6
- // forge-lint: disable-next-line(unaliased-plain-import)
7
- import /* {*} from */ "@bananapus/core-v6/test/helpers/TestBaseWorkflow.sol";
8
- // forge-lint: disable-next-line(unaliased-plain-import)
9
- import /* {*} from */ "./../src/REVDeployer.sol";
10
- // forge-lint: disable-next-line(unaliased-plain-import)
11
- import "@croptop/core-v6/src/CTPublisher.sol";
12
- import {MockBuybackDataHookMintPath} from "./mock/MockBuybackDataHookMintPath.sol";
13
- // forge-lint: disable-next-line(unaliased-plain-import)
14
- import "@bananapus/core-v6/script/helpers/CoreDeploymentLib.sol";
15
- // forge-lint: disable-next-line(unaliased-plain-import)
16
- import "@bananapus/721-hook-v6/script/helpers/Hook721DeploymentLib.sol";
17
- // forge-lint: disable-next-line(unaliased-plain-import)
18
- import "@bananapus/suckers-v6/script/helpers/SuckerDeploymentLib.sol";
19
- // forge-lint: disable-next-line(unaliased-plain-import)
20
- import "@croptop/core-v6/script/helpers/CroptopDeploymentLib.sol";
21
- // forge-lint: disable-next-line(unaliased-plain-import)
22
- import "@bananapus/router-terminal-v6/script/helpers/RouterTerminalDeploymentLib.sol";
23
- import {JBConstants} from "@bananapus/core-v6/src/libraries/JBConstants.sol";
24
- import {JBAccountingContext} from "@bananapus/core-v6/src/structs/JBAccountingContext.sol";
25
- import {REVLoans} from "../src/REVLoans.sol";
26
- import {REVStageConfig, REVAutoIssuance} from "../src/structs/REVStageConfig.sol";
27
- import {REVDescription} from "../src/structs/REVDescription.sol";
28
- import {IREVLoans} from "./../src/interfaces/IREVLoans.sol";
29
- import {JBSuckerDeployerConfig} from "@bananapus/suckers-v6/src/structs/JBSuckerDeployerConfig.sol";
30
- import {JBSuckerRegistry} from "@bananapus/suckers-v6/src/JBSuckerRegistry.sol";
31
- import {JB721TiersHookDeployer} from "@bananapus/721-hook-v6/src/JB721TiersHookDeployer.sol";
32
- import {JB721TiersHook} from "@bananapus/721-hook-v6/src/JB721TiersHook.sol";
33
- import {JB721TiersHookStore} from "@bananapus/721-hook-v6/src/JB721TiersHookStore.sol";
34
- import {JB721CheckpointsDeployer} from "@bananapus/721-hook-v6/src/JB721CheckpointsDeployer.sol";
35
- import {IJB721CheckpointsDeployer} from "@bananapus/721-hook-v6/src/interfaces/IJB721CheckpointsDeployer.sol";
36
- import {JBAddressRegistry} from "@bananapus/address-registry-v6/src/JBAddressRegistry.sol";
37
- import {IJBAddressRegistry} from "@bananapus/address-registry-v6/src/interfaces/IJBAddressRegistry.sol";
38
- import {JBBeforePayRecordedContext} from "@bananapus/core-v6/src/structs/JBBeforePayRecordedContext.sol";
39
- import {JBPayHookSpecification} from "@bananapus/core-v6/src/structs/JBPayHookSpecification.sol";
40
- import {JBTokenAmount} from "@bananapus/core-v6/src/structs/JBTokenAmount.sol";
41
- import {REVEmpty721Config} from "./helpers/REVEmpty721Config.sol";
42
- import {REVOwner} from "../src/REVOwner.sol";
43
- import {IREVDeployer} from "../src/interfaces/IREVDeployer.sol";
44
- import {MockSuckerRegistry} from "./mock/MockSuckerRegistry.sol";
45
-
46
- /// @notice Regression tests for the empty buyback hook specifications fix.
47
- /// When JBBuybackHook determines minting is cheaper than swapping, it returns an empty
48
- /// hookSpecifications array. Before the fix, REVDeployer.beforePayRecordedWith would
49
- /// Panic(0x32) (array out-of-bounds) when accessing buybackHookSpecifications[0].
50
- contract TestEmptyBuybackSpecs is TestBaseWorkflow {
51
- // forge-lint: disable-next-line(mixed-case-variable)
52
- bytes32 REV_DEPLOYER_SALT = "REVDeployer";
53
-
54
- // forge-lint: disable-next-line(mixed-case-variable)
55
- REVDeployer REV_DEPLOYER;
56
- // forge-lint: disable-next-line(mixed-case-variable)
57
- REVOwner REV_OWNER;
58
- // forge-lint: disable-next-line(mixed-case-variable)
59
- JB721TiersHook EXAMPLE_HOOK;
60
- // forge-lint: disable-next-line(mixed-case-variable)
61
- IJB721TiersHookDeployer HOOK_DEPLOYER;
62
- // forge-lint: disable-next-line(mixed-case-variable)
63
- IJB721TiersHookStore HOOK_STORE;
64
- // forge-lint: disable-next-line(mixed-case-variable)
65
- IJBAddressRegistry ADDRESS_REGISTRY;
66
- // forge-lint: disable-next-line(mixed-case-variable)
67
- IREVLoans LOANS_CONTRACT;
68
- // forge-lint: disable-next-line(mixed-case-variable)
69
- IJBSuckerRegistry SUCKER_REGISTRY;
70
- // forge-lint: disable-next-line(mixed-case-variable)
71
- CTPublisher PUBLISHER;
72
- // forge-lint: disable-next-line(mixed-case-variable)
73
- MockBuybackDataHookMintPath MOCK_BUYBACK_MINT_PATH;
74
-
75
- // forge-lint: disable-next-line(mixed-case-variable)
76
- uint256 FEE_PROJECT_ID;
77
-
78
- address private constant TRUSTED_FORWARDER = 0xB2b5841DBeF766d4b521221732F9B618fCf34A87;
79
- // forge-lint: disable-next-line(mixed-case-variable)
80
- address USER = makeAddr("user");
81
-
82
- function setUp() public override {
83
- super.setUp();
84
- FEE_PROJECT_ID = jbProjects().createFor(multisig());
85
- SUCKER_REGISTRY = new JBSuckerRegistry(jbDirectory(), jbPermissions(), multisig(), address(0));
86
- HOOK_STORE = new JB721TiersHookStore();
87
- EXAMPLE_HOOK = new JB721TiersHook(
88
- jbDirectory(),
89
- jbPermissions(),
90
- jbPrices(),
91
- jbRulesets(),
92
- HOOK_STORE,
93
- jbSplits(),
94
- IJB721CheckpointsDeployer(address(new JB721CheckpointsDeployer())),
95
- multisig()
96
- );
97
- ADDRESS_REGISTRY = new JBAddressRegistry();
98
- HOOK_DEPLOYER = new JB721TiersHookDeployer(EXAMPLE_HOOK, HOOK_STORE, ADDRESS_REGISTRY, multisig());
99
- PUBLISHER = new CTPublisher(jbDirectory(), jbPermissions(), FEE_PROJECT_ID, multisig());
100
- MOCK_BUYBACK_MINT_PATH = new MockBuybackDataHookMintPath();
101
- LOANS_CONTRACT = new REVLoans({
102
- controller: jbController(),
103
- suckerRegistry: IJBSuckerRegistry(address(new MockSuckerRegistry())),
104
- revId: FEE_PROJECT_ID,
105
- owner: address(this),
106
- permit2: permit2(),
107
- trustedForwarder: TRUSTED_FORWARDER
108
- });
109
- REV_OWNER = new REVOwner(
110
- IJBBuybackHookRegistry(address(MOCK_BUYBACK_MINT_PATH)),
111
- jbDirectory(),
112
- FEE_PROJECT_ID,
113
- SUCKER_REGISTRY,
114
- address(LOANS_CONTRACT),
115
- address(0)
116
- );
117
-
118
- REV_DEPLOYER = new REVDeployer{salt: REV_DEPLOYER_SALT}(
119
- jbController(),
120
- SUCKER_REGISTRY,
121
- FEE_PROJECT_ID,
122
- HOOK_DEPLOYER,
123
- PUBLISHER,
124
- IJBBuybackHookRegistry(address(MOCK_BUYBACK_MINT_PATH)),
125
- address(LOANS_CONTRACT),
126
- TRUSTED_FORWARDER,
127
- address(REV_OWNER)
128
- );
129
-
130
- REV_OWNER.setDeployer(REV_DEPLOYER);
131
-
132
- vm.prank(multisig());
133
- jbProjects().approve(address(REV_DEPLOYER), FEE_PROJECT_ID);
134
- }
135
-
136
- function _buildMinimalConfig()
137
- internal
138
- view
139
- returns (REVConfig memory cfg, JBTerminalConfig[] memory tc, REVSuckerDeploymentConfig memory sdc)
140
- {
141
- JBAccountingContext[] memory acc = new JBAccountingContext[](1);
142
- acc[0] = JBAccountingContext({
143
- token: JBConstants.NATIVE_TOKEN, decimals: 18, currency: uint32(uint160(JBConstants.NATIVE_TOKEN))
144
- });
145
- tc = new JBTerminalConfig[](1);
146
- tc[0] = JBTerminalConfig({terminal: jbMultiTerminal(), accountingContextsToAccept: acc});
147
-
148
- REVStageConfig[] memory stages = new REVStageConfig[](1);
149
- JBSplit[] memory splits = new JBSplit[](1);
150
- splits[0].beneficiary = payable(multisig());
151
- splits[0].percent = 10_000;
152
- stages[0] = REVStageConfig({
153
- startsAtOrAfter: uint40(block.timestamp),
154
- autoIssuances: new REVAutoIssuance[](0),
155
- splitPercent: 0,
156
- splits: splits,
157
- initialIssuance: uint112(1000e18),
158
- issuanceCutFrequency: 0,
159
- issuanceCutPercent: 0,
160
- cashOutTaxRate: 5000,
161
- extraMetadata: 0
162
- });
163
-
164
- cfg = REVConfig({
165
- // forge-lint: disable-next-line(named-struct-fields)
166
- description: REVDescription("Test", "TST", "ipfs://test", "TEST_SALT"),
167
- baseCurrency: uint32(uint160(JBConstants.NATIVE_TOKEN)),
168
- splitOperator: multisig(),
169
- stageConfigurations: stages
170
- });
171
-
172
- sdc = REVSuckerDeploymentConfig({
173
- deployerConfigurations: new JBSuckerDeployerConfig[](0), salt: keccak256(abi.encodePacked("TEST"))
174
- });
175
- }
176
-
177
- function _deployFeeAndRevnet() internal returns (uint256 revnetId) {
178
- (REVConfig memory feeCfg, JBTerminalConfig[] memory feeTc, REVSuckerDeploymentConfig memory feeSdc) =
179
- _buildMinimalConfig();
180
-
181
- vm.prank(multisig());
182
- REV_DEPLOYER.deployFor({
183
- revnetId: FEE_PROJECT_ID,
184
- configuration: feeCfg,
185
- terminalConfigurations: feeTc,
186
- suckerDeploymentConfiguration: feeSdc,
187
- tiered721HookConfiguration: REVEmpty721Config.empty721Config(uint32(uint160(JBConstants.NATIVE_TOKEN))),
188
- allowedPosts: REVEmpty721Config.emptyAllowedPosts()
189
- });
190
-
191
- (REVConfig memory cfg, JBTerminalConfig[] memory tc, REVSuckerDeploymentConfig memory sdc) =
192
- _buildMinimalConfig();
193
- // forge-lint: disable-next-line(named-struct-fields)
194
- cfg.description = REVDescription("Test2", "TS2", "ipfs://test2", "TEST_SALT_2");
195
-
196
- (revnetId,) = REV_DEPLOYER.deployFor({
197
- revnetId: 0,
198
- configuration: cfg,
199
- terminalConfigurations: tc,
200
- suckerDeploymentConfiguration: sdc,
201
- tiered721HookConfiguration: REVEmpty721Config.empty721Config(uint32(uint160(JBConstants.NATIVE_TOKEN))),
202
- allowedPosts: REVEmpty721Config.emptyAllowedPosts()
203
- });
204
- }
205
-
206
- /// @notice REGRESSION: Payment to revnet must succeed when buyback hook returns empty specs (mint path).
207
- /// Before the fix, this would Panic(0x32) due to accessing buybackHookSpecifications[0] on an empty array.
208
- function test_payRevnet_emptyBuybackSpecs_succeeds() public {
209
- uint256 revnetId = _deployFeeAndRevnet();
210
-
211
- vm.deal(USER, 1 ether);
212
- vm.prank(USER);
213
- jbMultiTerminal().pay{value: 1 ether}({
214
- projectId: revnetId,
215
- token: JBConstants.NATIVE_TOKEN,
216
- amount: 1 ether,
217
- beneficiary: USER,
218
- minReturnedTokens: 0,
219
- memo: "payment with mint path buyback",
220
- metadata: ""
221
- });
222
-
223
- uint256 balance = jbTokens().totalBalanceOf(USER, revnetId);
224
- assertGt(balance, 0, "Should have received tokens when buyback hook takes mint path");
225
- }
226
-
227
- /// @notice Payment with various amounts should work when buyback hook returns empty specs.
228
- function test_payRevnet_emptyBuybackSpecs_variousAmounts(uint96 amount) public {
229
- vm.assume(amount > 0.001 ether && amount < 100 ether);
230
- uint256 revnetId = _deployFeeAndRevnet();
231
-
232
- vm.deal(USER, amount);
233
- vm.prank(USER);
234
- jbMultiTerminal().pay{value: amount}({
235
- projectId: revnetId,
236
- token: JBConstants.NATIVE_TOKEN,
237
- amount: amount,
238
- beneficiary: USER,
239
- minReturnedTokens: 0,
240
- memo: "",
241
- metadata: ""
242
- });
243
-
244
- uint256 balance = jbTokens().totalBalanceOf(USER, revnetId);
245
- assertGt(balance, 0, "Should have received tokens for any valid amount");
246
- }
247
-
248
- /// @notice Multiple sequential payments should work with empty buyback specs.
249
- function test_payRevnet_emptyBuybackSpecs_multiplePayments() public {
250
- uint256 revnetId = _deployFeeAndRevnet();
251
-
252
- for (uint256 i; i < 5; i++) {
253
- address payer = makeAddr(string(abi.encodePacked("payer", i)));
254
- vm.deal(payer, 1 ether);
255
- vm.prank(payer);
256
- jbMultiTerminal().pay{value: 1 ether}({
257
- projectId: revnetId,
258
- token: JBConstants.NATIVE_TOKEN,
259
- amount: 1 ether,
260
- beneficiary: payer,
261
- minReturnedTokens: 0,
262
- memo: "",
263
- metadata: ""
264
- });
265
- assertGt(jbTokens().totalBalanceOf(payer, revnetId), 0, "Each payer should receive tokens");
266
- }
267
- }
268
-
269
- /// @notice Verify beforePayRecordedWith returns only the 721 hook spec when buyback returns empty.
270
- function test_beforePayRecordedWith_emptyBuybackSpecs_returnsOnly721Hook() public {
271
- uint256 revnetId = _deployFeeAndRevnet();
272
-
273
- JBBeforePayRecordedContext memory context = JBBeforePayRecordedContext({
274
- terminal: address(jbMultiTerminal()),
275
- payer: USER,
276
- amount: JBTokenAmount({
277
- token: JBConstants.NATIVE_TOKEN,
278
- value: 1 ether,
279
- decimals: 18,
280
- currency: uint32(uint160(JBConstants.NATIVE_TOKEN))
281
- }),
282
- projectId: revnetId,
283
- rulesetId: 0,
284
- beneficiary: USER,
285
- weight: 1000e18,
286
- reservedPercent: 0,
287
- metadata: ""
288
- });
289
-
290
- (uint256 weight, JBPayHookSpecification[] memory specs) = REV_OWNER.beforePayRecordedWith(context);
291
-
292
- assertEq(weight, context.weight, "Weight should pass through from buyback hook");
293
- assertEq(specs.length, 1, "Should return only the 721 hook spec when buyback hook returns empty");
294
- assertEq(
295
- address(specs[0].hook),
296
- address(REV_OWNER.tiered721HookOf(revnetId)),
297
- "Spec hook should be the revnet's 721 hook"
298
- );
299
- }
300
- }
@@ -1,365 +0,0 @@
1
- // SPDX-License-Identifier: MIT
2
- pragma solidity 0.8.28;
3
-
4
- // forge-lint: disable-next-line(unaliased-plain-import)
5
- import "forge-std/Test.sol";
6
- // forge-lint: disable-next-line(unaliased-plain-import)
7
- import /* {*} from */ "@bananapus/core-v6/test/helpers/TestBaseWorkflow.sol";
8
- // import /* {*} from "@bananapus/721-hook-v6/src/JB721TiersHookDeployer.sol";
9
- // forge-lint: disable-next-line(unaliased-plain-import)
10
- import /* {*} from */ "./../src/REVDeployer.sol";
11
- // forge-lint: disable-next-line(unaliased-plain-import)
12
- import "@croptop/core-v6/src/CTPublisher.sol";
13
- import {MockBuybackDataHook} from "./mock/MockBuybackDataHook.sol";
14
- import {REVEmpty721Config} from "./helpers/REVEmpty721Config.sol";
15
- // forge-lint: disable-next-line(unaliased-plain-import)
16
- import "@bananapus/core-v6/script/helpers/CoreDeploymentLib.sol";
17
- // forge-lint: disable-next-line(unaliased-plain-import)
18
- import "@bananapus/721-hook-v6/script/helpers/Hook721DeploymentLib.sol";
19
- // forge-lint: disable-next-line(unaliased-plain-import)
20
- import "@bananapus/suckers-v6/script/helpers/SuckerDeploymentLib.sol";
21
- // forge-lint: disable-next-line(unaliased-plain-import)
22
- import "@croptop/core-v6/script/helpers/CroptopDeploymentLib.sol";
23
- // forge-lint: disable-next-line(unaliased-plain-import)
24
- import "@bananapus/router-terminal-v6/script/helpers/RouterTerminalDeploymentLib.sol";
25
- import {JBConstants} from "@bananapus/core-v6/src/libraries/JBConstants.sol";
26
- import {JBAccountingContext} from "@bananapus/core-v6/src/structs/JBAccountingContext.sol";
27
- import {MockPriceFeed} from "@bananapus/core-v6/test/mock/MockPriceFeed.sol";
28
- import {MockERC20} from "@bananapus/core-v6/test/mock/MockERC20.sol";
29
- import {REVLoans} from "../src/REVLoans.sol";
30
- import {REVStageConfig, REVAutoIssuance} from "../src/structs/REVStageConfig.sol";
31
- import {REVLoanSource} from "../src/structs/REVLoanSource.sol";
32
- import {REVDescription} from "../src/structs/REVDescription.sol";
33
- import {IREVLoans} from "./../src/interfaces/IREVLoans.sol";
34
- import {JBSuckerDeployerConfig} from "@bananapus/suckers-v6/src/structs/JBSuckerDeployerConfig.sol";
35
- import {JBSuckerRegistry} from "@bananapus/suckers-v6/src/JBSuckerRegistry.sol";
36
- import {JB721TiersHookDeployer} from "@bananapus/721-hook-v6/src/JB721TiersHookDeployer.sol";
37
- import {JB721TiersHook} from "@bananapus/721-hook-v6/src/JB721TiersHook.sol";
38
- import {JB721TiersHookStore} from "@bananapus/721-hook-v6/src/JB721TiersHookStore.sol";
39
- import {JB721CheckpointsDeployer} from "@bananapus/721-hook-v6/src/JB721CheckpointsDeployer.sol";
40
- import {IJB721CheckpointsDeployer} from "@bananapus/721-hook-v6/src/interfaces/IJB721CheckpointsDeployer.sol";
41
- import {JBAddressRegistry} from "@bananapus/address-registry-v6/src/JBAddressRegistry.sol";
42
- import {IJBAddressRegistry} from "@bananapus/address-registry-v6/src/interfaces/IJBAddressRegistry.sol";
43
- import {REVOwner} from "../src/REVOwner.sol";
44
- import {IREVDeployer} from "../src/interfaces/IREVDeployer.sol";
45
- import {MockSuckerRegistry} from "./mock/MockSuckerRegistry.sol";
46
-
47
- /// @notice Tests showing that flash loan surplus manipulation is economically unprofitable.
48
- contract TestFlashLoanSurplus is TestBaseWorkflow {
49
- // forge-lint: disable-next-line(mixed-case-variable)
50
- bytes32 REV_DEPLOYER_SALT = "REVDeployer";
51
- // forge-lint: disable-next-line(mixed-case-variable)
52
- bytes32 ERC20_SALT = "REV_TOKEN";
53
-
54
- // forge-lint: disable-next-line(mixed-case-variable)
55
- REVDeployer REV_DEPLOYER;
56
- // forge-lint: disable-next-line(mixed-case-variable)
57
- REVOwner REV_OWNER;
58
- // forge-lint: disable-next-line(mixed-case-variable)
59
- JB721TiersHook EXAMPLE_HOOK;
60
- // forge-lint: disable-next-line(mixed-case-variable)
61
- IJB721TiersHookDeployer HOOK_DEPLOYER;
62
- // forge-lint: disable-next-line(mixed-case-variable)
63
- IJB721TiersHookStore HOOK_STORE;
64
- // forge-lint: disable-next-line(mixed-case-variable)
65
- IJBAddressRegistry ADDRESS_REGISTRY;
66
- // forge-lint: disable-next-line(mixed-case-variable)
67
- IREVLoans LOANS_CONTRACT;
68
- // forge-lint: disable-next-line(mixed-case-variable)
69
- MockERC20 TOKEN;
70
- // forge-lint: disable-next-line(mixed-case-variable)
71
- IJBSuckerRegistry SUCKER_REGISTRY;
72
- // forge-lint: disable-next-line(mixed-case-variable)
73
- CTPublisher PUBLISHER;
74
- // forge-lint: disable-next-line(mixed-case-variable)
75
- MockBuybackDataHook MOCK_BUYBACK;
76
-
77
- // forge-lint: disable-next-line(mixed-case-variable)
78
- uint256 FEE_PROJECT_ID;
79
- // forge-lint: disable-next-line(mixed-case-variable)
80
- uint256 REVNET_ID;
81
-
82
- // forge-lint: disable-next-line(mixed-case-variable)
83
- address USER = makeAddr("user");
84
- // forge-lint: disable-next-line(mixed-case-variable)
85
- address ATTACKER = makeAddr("attacker");
86
-
87
- address private constant TRUSTED_FORWARDER = 0xB2b5841DBeF766d4b521221732F9B618fCf34A87;
88
-
89
- function setUp() public override {
90
- super.setUp();
91
- FEE_PROJECT_ID = jbProjects().createFor(multisig());
92
- SUCKER_REGISTRY = new JBSuckerRegistry(jbDirectory(), jbPermissions(), multisig(), address(0));
93
- HOOK_STORE = new JB721TiersHookStore();
94
- EXAMPLE_HOOK = new JB721TiersHook(
95
- jbDirectory(),
96
- jbPermissions(),
97
- jbPrices(),
98
- jbRulesets(),
99
- HOOK_STORE,
100
- jbSplits(),
101
- IJB721CheckpointsDeployer(address(new JB721CheckpointsDeployer())),
102
- multisig()
103
- );
104
- ADDRESS_REGISTRY = new JBAddressRegistry();
105
- HOOK_DEPLOYER = new JB721TiersHookDeployer(EXAMPLE_HOOK, HOOK_STORE, ADDRESS_REGISTRY, multisig());
106
- PUBLISHER = new CTPublisher(jbDirectory(), jbPermissions(), FEE_PROJECT_ID, multisig());
107
- MOCK_BUYBACK = new MockBuybackDataHook();
108
- TOKEN = new MockERC20("1/2 ETH", "1/2");
109
- MockPriceFeed priceFeed = new MockPriceFeed(1e21, 6);
110
- vm.prank(multisig());
111
- jbPrices()
112
- .addPriceFeedFor(0, uint32(uint160(address(TOKEN))), uint32(uint160(JBConstants.NATIVE_TOKEN)), priceFeed);
113
- LOANS_CONTRACT = new REVLoans({
114
- controller: jbController(),
115
- suckerRegistry: IJBSuckerRegistry(address(new MockSuckerRegistry())),
116
- revId: FEE_PROJECT_ID,
117
- owner: address(this),
118
- permit2: permit2(),
119
- trustedForwarder: TRUSTED_FORWARDER
120
- });
121
- REV_OWNER = new REVOwner(
122
- IJBBuybackHookRegistry(address(MOCK_BUYBACK)),
123
- jbDirectory(),
124
- FEE_PROJECT_ID,
125
- SUCKER_REGISTRY,
126
- address(LOANS_CONTRACT),
127
- address(0)
128
- );
129
-
130
- REV_DEPLOYER = new REVDeployer{salt: REV_DEPLOYER_SALT}(
131
- jbController(),
132
- SUCKER_REGISTRY,
133
- FEE_PROJECT_ID,
134
- HOOK_DEPLOYER,
135
- PUBLISHER,
136
- IJBBuybackHookRegistry(address(MOCK_BUYBACK)),
137
- address(LOANS_CONTRACT),
138
- TRUSTED_FORWARDER,
139
- address(REV_OWNER)
140
- );
141
-
142
- REV_OWNER.setDeployer(REV_DEPLOYER);
143
-
144
- vm.prank(multisig());
145
- jbProjects().approve(address(REV_DEPLOYER), FEE_PROJECT_ID);
146
- _deployFeeProject();
147
- _deployRevnet();
148
- vm.deal(USER, 1000e18);
149
- vm.deal(ATTACKER, 1000e18);
150
- }
151
-
152
- function _deployFeeProject() internal {
153
- JBAccountingContext[] memory acc = new JBAccountingContext[](2);
154
- acc[0] = JBAccountingContext({
155
- token: JBConstants.NATIVE_TOKEN, decimals: 18, currency: uint32(uint160(JBConstants.NATIVE_TOKEN))
156
- });
157
- acc[1] = JBAccountingContext({token: address(TOKEN), decimals: 6, currency: uint32(uint160(address(TOKEN)))});
158
- JBTerminalConfig[] memory tc = new JBTerminalConfig[](1);
159
- tc[0] = JBTerminalConfig({terminal: jbMultiTerminal(), accountingContextsToAccept: acc});
160
- REVStageConfig[] memory stages = new REVStageConfig[](1);
161
- JBSplit[] memory splits = new JBSplit[](1);
162
- splits[0].beneficiary = payable(multisig());
163
- splits[0].percent = 10_000;
164
- REVAutoIssuance[] memory ai = new REVAutoIssuance[](1);
165
- ai[0] = REVAutoIssuance({chainId: uint32(block.chainid), count: uint104(70_000e18), beneficiary: multisig()});
166
- stages[0] = REVStageConfig({
167
- startsAtOrAfter: uint40(block.timestamp),
168
- autoIssuances: ai,
169
- splitPercent: 2000,
170
- splits: splits,
171
- initialIssuance: uint112(1000e18),
172
- issuanceCutFrequency: 90 days,
173
- issuanceCutPercent: JBConstants.MAX_WEIGHT_CUT_PERCENT / 2,
174
- cashOutTaxRate: 6000,
175
- extraMetadata: 0
176
- });
177
- REVConfig memory cfg = REVConfig({
178
- // forge-lint: disable-next-line(named-struct-fields)
179
- description: REVDescription("Revnet", "$REV", "ipfs://test", "REV_TOKEN"),
180
- baseCurrency: uint32(uint160(JBConstants.NATIVE_TOKEN)),
181
- splitOperator: multisig(),
182
- stageConfigurations: stages
183
- });
184
- vm.prank(multisig());
185
- REV_DEPLOYER.deployFor({
186
- revnetId: FEE_PROJECT_ID,
187
- configuration: cfg,
188
- terminalConfigurations: tc,
189
- suckerDeploymentConfiguration: REVSuckerDeploymentConfig({
190
- deployerConfigurations: new JBSuckerDeployerConfig[](0), salt: keccak256("FEE")
191
- }),
192
- tiered721HookConfiguration: REVEmpty721Config.empty721Config(uint32(uint160(JBConstants.NATIVE_TOKEN))),
193
- allowedPosts: REVEmpty721Config.emptyAllowedPosts()
194
- });
195
- }
196
-
197
- function _deployRevnet() internal {
198
- JBAccountingContext[] memory acc = new JBAccountingContext[](2);
199
- acc[0] = JBAccountingContext({
200
- token: JBConstants.NATIVE_TOKEN, decimals: 18, currency: uint32(uint160(JBConstants.NATIVE_TOKEN))
201
- });
202
- acc[1] = JBAccountingContext({token: address(TOKEN), decimals: 6, currency: uint32(uint160(address(TOKEN)))});
203
- JBTerminalConfig[] memory tc = new JBTerminalConfig[](1);
204
- tc[0] = JBTerminalConfig({terminal: jbMultiTerminal(), accountingContextsToAccept: acc});
205
- REVStageConfig[] memory stages = new REVStageConfig[](1);
206
- JBSplit[] memory splits = new JBSplit[](1);
207
- splits[0].beneficiary = payable(multisig());
208
- splits[0].percent = 10_000;
209
- REVAutoIssuance[] memory ai = new REVAutoIssuance[](1);
210
- ai[0] = REVAutoIssuance({chainId: uint32(block.chainid), count: uint104(70_000e18), beneficiary: multisig()});
211
- stages[0] = REVStageConfig({
212
- startsAtOrAfter: uint40(block.timestamp),
213
- autoIssuances: ai,
214
- splitPercent: 2000,
215
- splits: splits,
216
- initialIssuance: uint112(1000e18),
217
- issuanceCutFrequency: 90 days,
218
- issuanceCutPercent: JBConstants.MAX_WEIGHT_CUT_PERCENT / 2,
219
- cashOutTaxRate: 6000,
220
- extraMetadata: 0
221
- });
222
- REVLoanSource[] memory ls = new REVLoanSource[](1);
223
- ls[0] = REVLoanSource({token: JBConstants.NATIVE_TOKEN, terminal: jbMultiTerminal()});
224
- REVConfig memory cfg = REVConfig({
225
- // forge-lint: disable-next-line(named-struct-fields)
226
- description: REVDescription("NANA", "$NANA", "ipfs://test2", "NANA_TOKEN"),
227
- baseCurrency: uint32(uint160(JBConstants.NATIVE_TOKEN)),
228
- splitOperator: multisig(),
229
- stageConfigurations: stages
230
- });
231
- (REVNET_ID,) = REV_DEPLOYER.deployFor({
232
- revnetId: 0,
233
- configuration: cfg,
234
- terminalConfigurations: tc,
235
- suckerDeploymentConfiguration: REVSuckerDeploymentConfig({
236
- deployerConfigurations: new JBSuckerDeployerConfig[](0), salt: keccak256("NANA")
237
- }),
238
- tiered721HookConfiguration: REVEmpty721Config.empty721Config(uint32(uint160(JBConstants.NATIVE_TOKEN))),
239
- allowedPosts: REVEmpty721Config.emptyAllowedPosts()
240
- });
241
- }
242
-
243
- function _setupLoan(
244
- address user,
245
- uint256 ethAmount,
246
- uint256 prepaidFee
247
- )
248
- internal
249
- returns (uint256 loanId, uint256 tokenCount, uint256 borrowAmount)
250
- {
251
- vm.prank(user);
252
- tokenCount =
253
- jbMultiTerminal().pay{value: ethAmount}(REVNET_ID, JBConstants.NATIVE_TOKEN, ethAmount, user, 0, "", "");
254
- borrowAmount =
255
- LOANS_CONTRACT.borrowableAmountFrom(REVNET_ID, tokenCount, 18, uint32(uint160(JBConstants.NATIVE_TOKEN)));
256
- if (borrowAmount == 0) return (0, tokenCount, 0);
257
- mockExpect(
258
- address(jbPermissions()),
259
- abi.encodeCall(IJBPermissions.hasPermission, (address(LOANS_CONTRACT), user, REVNET_ID, 11, true, true)),
260
- abi.encode(true)
261
- );
262
- REVLoanSource memory source = REVLoanSource({token: JBConstants.NATIVE_TOKEN, terminal: jbMultiTerminal()});
263
- vm.prank(user);
264
- (loanId,) = LOANS_CONTRACT.borrowFrom(REVNET_ID, source, 0, tokenCount, payable(user), prepaidFee, user);
265
- }
266
-
267
- /// @notice Donate ETH via addToBalanceOf, then borrow. The donation costs more than the extra borrowable amount.
268
- function test_addToBalance_surplusInflation_unprofitable() public {
269
- // First, user pays to establish baseline tokens
270
- vm.prank(USER);
271
- uint256 userTokens =
272
- jbMultiTerminal().pay{value: 10e18}(REVNET_ID, JBConstants.NATIVE_TOKEN, 10e18, USER, 0, "", "");
273
-
274
- // Check borrowable amount before donation
275
- uint256 borrowableBefore =
276
- LOANS_CONTRACT.borrowableAmountFrom(REVNET_ID, userTokens, 18, uint32(uint160(JBConstants.NATIVE_TOKEN)));
277
-
278
- // Attacker donates 100 ETH to inflate surplus
279
- uint256 donationAmount = 100e18;
280
- vm.prank(ATTACKER);
281
- jbMultiTerminal().addToBalanceOf{value: donationAmount}(
282
- REVNET_ID, JBConstants.NATIVE_TOKEN, donationAmount, false, "", ""
283
- );
284
-
285
- // Check borrowable amount after donation
286
- uint256 borrowableAfter =
287
- LOANS_CONTRACT.borrowableAmountFrom(REVNET_ID, userTokens, 18, uint32(uint160(JBConstants.NATIVE_TOKEN)));
288
-
289
- // The gain in borrowable amount
290
- uint256 borrowableGain = borrowableAfter - borrowableBefore;
291
-
292
- // The donation cost (100 ETH) is always more than the extra borrowable amount gained.
293
- // Because borrowable = surplus * (collateralCount / totalSupply) * bonding_curve_factor,
294
- // and collateralCount < totalSupply, so gain < donation.
295
- assertGt(donationAmount, borrowableGain, "Donation should cost more than the extra borrowable amount gained");
296
- }
297
-
298
- /// @notice Pay into revnet (minting tokens). borrowable-per-existing-token should not increase because supply
299
- /// dilution offsets surplus increase.
300
- function test_pay_surplusInflation_neutral() public {
301
- // User pays to get tokens
302
- vm.prank(USER);
303
- uint256 userTokens =
304
- jbMultiTerminal().pay{value: 10e18}(REVNET_ID, JBConstants.NATIVE_TOKEN, 10e18, USER, 0, "", "");
305
-
306
- // Check borrowable-per-token for existing user's tokens
307
- uint256 borrowableBefore =
308
- LOANS_CONTRACT.borrowableAmountFrom(REVNET_ID, userTokens, 18, uint32(uint160(JBConstants.NATIVE_TOKEN)));
309
-
310
- // Someone else pays 100 ETH (this mints new tokens AND increases surplus)
311
- address payer = makeAddr("payer");
312
- vm.deal(payer, 100e18);
313
- vm.prank(payer);
314
- jbMultiTerminal().pay{value: 100e18}(REVNET_ID, JBConstants.NATIVE_TOKEN, 100e18, payer, 0, "", "");
315
-
316
- // Check borrowable for the SAME user tokens after the payment
317
- uint256 borrowableAfter =
318
- LOANS_CONTRACT.borrowableAmountFrom(REVNET_ID, userTokens, 18, uint32(uint160(JBConstants.NATIVE_TOKEN)));
319
-
320
- // With a non-zero cashOutTaxRate (concave bonding curve), paying in actually DECREASES
321
- // the per-token borrowable amount for existing holders due to dilution.
322
- // At minimum, it should not increase the per-token borrowable amount.
323
- assertLe(borrowableAfter, borrowableBefore, "Paying in should not increase per-token borrowable amount");
324
- }
325
-
326
- /// @notice Full attack simulation: donate, borrow max, verify net negative.
327
- function test_flashLoanSimulation_netNegative() public {
328
- // Attacker first buys tokens to have something to borrow against
329
- vm.prank(ATTACKER);
330
- uint256 attackerTokens =
331
- jbMultiTerminal().pay{value: 10e18}(REVNET_ID, JBConstants.NATIVE_TOKEN, 10e18, ATTACKER, 0, "", "");
332
-
333
- // Check borrowable before donation
334
- uint256 borrowableBefore = LOANS_CONTRACT.borrowableAmountFrom(
335
- REVNET_ID, attackerTokens, 18, uint32(uint160(JBConstants.NATIVE_TOKEN))
336
- );
337
-
338
- // Attacker donates 100 ETH to inflate surplus (simulating flash loan injection)
339
- uint256 donationAmount = 100e18;
340
- vm.prank(ATTACKER);
341
- jbMultiTerminal().addToBalanceOf{value: donationAmount}(
342
- REVNET_ID, JBConstants.NATIVE_TOKEN, donationAmount, false, "", ""
343
- );
344
-
345
- // Check borrowable after donation
346
- uint256 borrowableAfter = LOANS_CONTRACT.borrowableAmountFrom(
347
- REVNET_ID, attackerTokens, 18, uint32(uint160(JBConstants.NATIVE_TOKEN))
348
- );
349
-
350
- // Extra borrowable gained by the attacker through the donation
351
- uint256 extraBorrowable = borrowableAfter - borrowableBefore;
352
-
353
- // The attacker's net position:
354
- // - Lost: donationAmount (100 ETH, permanently donated — no recovery mechanism)
355
- // - Gained: extraBorrowable (the additional amount they can borrow)
356
- // Net = extraBorrowable - donationAmount, which should be negative
357
- assertGt(donationAmount, extraBorrowable, "Attack should be net negative: donation > extra borrowable");
358
-
359
- // Furthermore, the extra borrowable is strictly less than donation because
360
- // gain = donation * (collateral / totalSupply) * cashOutTaxRate_factor
361
- // and collateral < totalSupply, so the multiplier is always < 1
362
- // This means the attacker loses a significant fraction of their flash loan
363
- assertTrue(extraBorrowable < donationAmount, "Extra borrowable must be strictly less than donation");
364
- }
365
- }