@rev-net/core-v6 0.0.37 → 0.0.40

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (112) hide show
  1. package/CHANGELOG.md +2 -2
  2. package/README.md +6 -7
  3. package/foundry.toml +1 -1
  4. package/package.json +23 -16
  5. package/references/operations.md +1 -1
  6. package/references/runtime.md +1 -1
  7. package/script/Deploy.s.sol +12 -9
  8. package/src/REVDeployer.sol +69 -67
  9. package/src/REVHiddenTokens.sol +2 -2
  10. package/src/REVLoans.sol +26 -22
  11. package/src/REVOwner.sol +147 -29
  12. package/src/interfaces/IREVDeployer.sol +2 -1
  13. package/src/interfaces/IREVHiddenTokens.sol +4 -1
  14. package/src/interfaces/IREVOwner.sol +5 -0
  15. package/src/structs/REVAutoIssuance.sol +4 -2
  16. package/src/structs/REVConfig.sol +8 -5
  17. package/src/structs/REVDescription.sol +6 -5
  18. package/src/structs/REVLoan.sol +8 -5
  19. package/src/structs/REVStageConfig.sol +14 -16
  20. package/ADMINISTRATION.md +0 -73
  21. package/ARCHITECTURE.md +0 -116
  22. package/AUDIT_INSTRUCTIONS.md +0 -90
  23. package/RISKS.md +0 -107
  24. package/SKILLS.md +0 -46
  25. package/STYLE_GUIDE.md +0 -610
  26. package/USER_JOURNEYS.md +0 -195
  27. package/foundry.lock +0 -11
  28. package/slither-ci.config.json +0 -10
  29. package/sphinx.lock +0 -507
  30. package/test/REV.integrations.t.sol +0 -573
  31. package/test/REVAutoIssuanceFuzz.t.sol +0 -328
  32. package/test/REVDeployerRegressions.t.sol +0 -396
  33. package/test/REVInvincibility.t.sol +0 -1371
  34. package/test/REVInvincibilityHandler.sol +0 -387
  35. package/test/REVLifecycle.t.sol +0 -420
  36. package/test/REVLoans.invariants.t.sol +0 -724
  37. package/test/REVLoansAttacks.t.sol +0 -816
  38. package/test/REVLoansFeeRecovery.t.sol +0 -783
  39. package/test/REVLoansFindings.t.sol +0 -711
  40. package/test/REVLoansRegressions.t.sol +0 -364
  41. package/test/REVLoansSourceFeeRecovery.t.sol +0 -517
  42. package/test/REVLoansSourced.t.sol +0 -1839
  43. package/test/REVLoansUnSourced.t.sol +0 -409
  44. package/test/TestAuditFixVerification.t.sol +0 -675
  45. package/test/TestBurnHeldTokens.t.sol +0 -394
  46. package/test/TestCEIPattern.t.sol +0 -508
  47. package/test/TestCashOutCallerValidation.t.sol +0 -452
  48. package/test/TestConversionDocumentation.t.sol +0 -365
  49. package/test/TestCrossCurrencyReclaim.t.sol +0 -610
  50. package/test/TestCrossSourceReallocation.t.sol +0 -361
  51. package/test/TestERC2771MetaTx.t.sol +0 -585
  52. package/test/TestEmptyBuybackSpecs.t.sol +0 -300
  53. package/test/TestFlashLoanSurplus.t.sol +0 -365
  54. package/test/TestHiddenTokens.t.sol +0 -474
  55. package/test/TestHookArrayOOB.t.sol +0 -278
  56. package/test/TestLiquidationBehavior.t.sol +0 -398
  57. package/test/TestLoanSourceRotation.t.sol +0 -553
  58. package/test/TestLoansCashOutDelay.t.sol +0 -493
  59. package/test/TestLongTailEconomics.t.sol +0 -677
  60. package/test/TestLowFindings.t.sol +0 -677
  61. package/test/TestMixedFixes.t.sol +0 -593
  62. package/test/TestPermit2Signatures.t.sol +0 -683
  63. package/test/TestReallocationSandwich.t.sol +0 -412
  64. package/test/TestRevnetRegressions.t.sol +0 -350
  65. package/test/TestSplitWeightAdjustment.t.sol +0 -527
  66. package/test/TestSplitWeightE2E.t.sol +0 -605
  67. package/test/TestSplitWeightFork.t.sol +0 -855
  68. package/test/TestStageTransitionBorrowable.t.sol +0 -301
  69. package/test/TestSwapTerminalPermission.t.sol +0 -262
  70. package/test/TestTerminalEncodingInHash.t.sol +0 -326
  71. package/test/TestUint112Overflow.t.sol +0 -311
  72. package/test/TestZeroAmountLoanGuard.t.sol +0 -378
  73. package/test/TestZeroRepayment.t.sol +0 -354
  74. package/test/audit/CrossChainBuybackRouteMismatch.t.sol +0 -184
  75. package/test/audit/HiddenSupplyCashout.t.sol +0 -61
  76. package/test/audit/LoanIdOverflowGuard.t.sol +0 -523
  77. package/test/audit/NemesisVerification.t.sol +0 -97
  78. package/test/audit/OperatorDelegation.t.sol +0 -356
  79. package/test/audit/PhantomSurplusTerminal.t.sol +0 -367
  80. package/test/audit/REVOwnerCurrencyMismatch.t.sol +0 -188
  81. package/test/audit/REVOwnerRemoteSurplusCurrencyMismatch.t.sol +0 -140
  82. package/test/audit/ReallocatePermission.t.sol +0 -363
  83. package/test/audit/RemoteLoanAccountingGap.t.sol +0 -74
  84. package/test/audit/SupportsInterfaceTest.t.sol +0 -51
  85. package/test/audit/TestFeeAllowanceLeak.t.sol +0 -197
  86. package/test/audit/TestLoansAndDeployerFixes.t.sol +0 -576
  87. package/test/fork/ForkTestBase.sol +0 -727
  88. package/test/fork/TestAutoIssuanceFork.t.sol +0 -148
  89. package/test/fork/TestCashOutFork.t.sol +0 -253
  90. package/test/fork/TestIssuanceDecayFork.t.sol +0 -158
  91. package/test/fork/TestLoanAdversarialFork.t.sol +0 -744
  92. package/test/fork/TestLoanBorrowFork.t.sol +0 -163
  93. package/test/fork/TestLoanCrossRulesetFork.t.sol +0 -308
  94. package/test/fork/TestLoanERC20Fork.t.sol +0 -459
  95. package/test/fork/TestLoanLiquidationFork.t.sol +0 -135
  96. package/test/fork/TestLoanReallocateFork.t.sol +0 -113
  97. package/test/fork/TestLoanRepayFork.t.sol +0 -188
  98. package/test/fork/TestLoanTransferFork.t.sol +0 -143
  99. package/test/fork/TestPermit2PaymentFork.t.sol +0 -300
  100. package/test/fork/TestSplitWeightFork.t.sol +0 -189
  101. package/test/helpers/MaliciousContracts.sol +0 -247
  102. package/test/helpers/REVEmpty721Config.sol +0 -45
  103. package/test/mock/MockBuybackCashOutRecorder.sol +0 -84
  104. package/test/mock/MockBuybackDataHook.sol +0 -112
  105. package/test/mock/MockBuybackDataHookMintPath.sol +0 -68
  106. package/test/mock/MockSuckerRegistry.sol +0 -17
  107. package/test/regression/TestBurnPermissionRequired.t.sol +0 -294
  108. package/test/regression/TestCashOutBuybackFeeLeak.t.sol +0 -232
  109. package/test/regression/TestCrossRevnetLiquidation.t.sol +0 -255
  110. package/test/regression/TestCumulativeLoanCounter.t.sol +0 -361
  111. package/test/regression/TestLiquidateGapHandling.t.sol +0 -394
  112. package/test/regression/TestZeroPriceFeed.t.sol +0 -422
@@ -1,294 +0,0 @@
1
- // SPDX-License-Identifier: MIT
2
- pragma solidity 0.8.28;
3
-
4
- // forge-lint: disable-next-line(unaliased-plain-import)
5
- import "forge-std/Test.sol";
6
- // forge-lint: disable-next-line(unaliased-plain-import)
7
- import /* {*} from */ "@bananapus/core-v6/test/helpers/TestBaseWorkflow.sol";
8
- // forge-lint: disable-next-line(unaliased-plain-import)
9
- import /* {*} from */ "./../../src/REVDeployer.sol";
10
- // forge-lint: disable-next-line(unaliased-plain-import)
11
- import "@croptop/core-v6/src/CTPublisher.sol";
12
- import {MockBuybackDataHook} from "./../mock/MockBuybackDataHook.sol";
13
- // forge-lint: disable-next-line(unaliased-plain-import)
14
- import "@bananapus/core-v6/script/helpers/CoreDeploymentLib.sol";
15
- // forge-lint: disable-next-line(unaliased-plain-import)
16
- import "@bananapus/721-hook-v6/script/helpers/Hook721DeploymentLib.sol";
17
- // forge-lint: disable-next-line(unaliased-plain-import)
18
- import "@bananapus/suckers-v6/script/helpers/SuckerDeploymentLib.sol";
19
- // forge-lint: disable-next-line(unaliased-plain-import)
20
- import "@croptop/core-v6/script/helpers/CroptopDeploymentLib.sol";
21
- // forge-lint: disable-next-line(unaliased-plain-import)
22
- import "@bananapus/router-terminal-v6/script/helpers/RouterTerminalDeploymentLib.sol";
23
- import {JBConstants} from "@bananapus/core-v6/src/libraries/JBConstants.sol";
24
- import {JBAccountingContext} from "@bananapus/core-v6/src/structs/JBAccountingContext.sol";
25
- import {JBSingleAllowance} from "@bananapus/core-v6/src/structs/JBSingleAllowance.sol";
26
- import {MockPriceFeed} from "@bananapus/core-v6/test/mock/MockPriceFeed.sol";
27
- import {MockERC20} from "@bananapus/core-v6/test/mock/MockERC20.sol";
28
- import {REVLoans} from "../../src/REVLoans.sol";
29
- import {REVLoan} from "../../src/structs/REVLoan.sol";
30
- import {REVStageConfig, REVAutoIssuance} from "../../src/structs/REVStageConfig.sol";
31
- import {REVLoanSource} from "../../src/structs/REVLoanSource.sol";
32
- import {REVDescription} from "../../src/structs/REVDescription.sol";
33
- import {JBSuckerDeployerConfig} from "@bananapus/suckers-v6/src/structs/JBSuckerDeployerConfig.sol";
34
- import {JBSuckerRegistry} from "@bananapus/suckers-v6/src/JBSuckerRegistry.sol";
35
- import {JB721TiersHookDeployer} from "@bananapus/721-hook-v6/src/JB721TiersHookDeployer.sol";
36
- import {JB721TiersHook} from "@bananapus/721-hook-v6/src/JB721TiersHook.sol";
37
- import {JB721TiersHookStore} from "@bananapus/721-hook-v6/src/JB721TiersHookStore.sol";
38
- import {JB721CheckpointsDeployer} from "@bananapus/721-hook-v6/src/JB721CheckpointsDeployer.sol";
39
- import {IJB721CheckpointsDeployer} from "@bananapus/721-hook-v6/src/interfaces/IJB721CheckpointsDeployer.sol";
40
- import {JBAddressRegistry} from "@bananapus/address-registry-v6/src/JBAddressRegistry.sol";
41
- import {IJBAddressRegistry} from "@bananapus/address-registry-v6/src/interfaces/IJBAddressRegistry.sol";
42
- import {REVEmpty721Config} from "../helpers/REVEmpty721Config.sol";
43
- import {JBPermissionIds} from "@bananapus/permission-ids-v6/src/JBPermissionIds.sol";
44
- import {JBPermissioned} from "@bananapus/core-v6/src/abstract/JBPermissioned.sol";
45
- import {REVOwner} from "../../src/REVOwner.sol";
46
- import {IREVDeployer} from "../../src/interfaces/IREVDeployer.sol";
47
- import {MockSuckerRegistry} from "../mock/MockSuckerRegistry.sol";
48
-
49
- /// @notice Validates that borrowFrom() reverts with a clear error when the caller hasn't granted BURN_TOKENS
50
- /// permission to the REVLoans contract.
51
- /// @dev Without this upfront check, the transaction would revert deep in JBController.burnTokensOf with a
52
- /// less informative JBPermissioned_Unauthorized error.
53
- contract TestBurnPermissionRequired is TestBaseWorkflow {
54
- // forge-lint: disable-next-line(mixed-case-variable)
55
- bytes32 REV_DEPLOYER_SALT = "REVDeployer";
56
-
57
- // forge-lint: disable-next-line(mixed-case-variable)
58
- REVDeployer REV_DEPLOYER;
59
- // forge-lint: disable-next-line(mixed-case-variable)
60
- REVOwner REV_OWNER;
61
- // forge-lint: disable-next-line(mixed-case-variable)
62
- JB721TiersHook EXAMPLE_HOOK;
63
- // forge-lint: disable-next-line(mixed-case-variable)
64
- IJB721TiersHookDeployer HOOK_DEPLOYER;
65
- // forge-lint: disable-next-line(mixed-case-variable)
66
- IJB721TiersHookStore HOOK_STORE;
67
- // forge-lint: disable-next-line(mixed-case-variable)
68
- IJBAddressRegistry ADDRESS_REGISTRY;
69
- // forge-lint: disable-next-line(mixed-case-variable)
70
- REVLoans LOANS_CONTRACT;
71
- // forge-lint: disable-next-line(mixed-case-variable)
72
- MockERC20 TOKEN;
73
- // forge-lint: disable-next-line(mixed-case-variable)
74
- IJBSuckerRegistry SUCKER_REGISTRY;
75
- // forge-lint: disable-next-line(mixed-case-variable)
76
- CTPublisher PUBLISHER;
77
- // forge-lint: disable-next-line(mixed-case-variable)
78
- MockBuybackDataHook MOCK_BUYBACK;
79
-
80
- // forge-lint: disable-next-line(mixed-case-variable)
81
- uint256 FEE_PROJECT_ID;
82
- // forge-lint: disable-next-line(mixed-case-variable)
83
- uint256 REVNET_ID;
84
-
85
- address user = makeAddr("user");
86
-
87
- address private constant TRUSTED_FORWARDER = 0xB2b5841DBeF766d4b521221732F9B618fCf34A87;
88
-
89
- function setUp() public override {
90
- super.setUp();
91
- FEE_PROJECT_ID = jbProjects().createFor(multisig());
92
- SUCKER_REGISTRY = new JBSuckerRegistry(jbDirectory(), jbPermissions(), multisig(), address(0));
93
- HOOK_STORE = new JB721TiersHookStore();
94
- EXAMPLE_HOOK = new JB721TiersHook(
95
- jbDirectory(),
96
- jbPermissions(),
97
- jbPrices(),
98
- jbRulesets(),
99
- HOOK_STORE,
100
- jbSplits(),
101
- IJB721CheckpointsDeployer(address(new JB721CheckpointsDeployer())),
102
- multisig()
103
- );
104
- ADDRESS_REGISTRY = new JBAddressRegistry();
105
- HOOK_DEPLOYER = new JB721TiersHookDeployer(EXAMPLE_HOOK, HOOK_STORE, ADDRESS_REGISTRY, multisig());
106
- PUBLISHER = new CTPublisher(jbDirectory(), jbPermissions(), FEE_PROJECT_ID, multisig());
107
- MOCK_BUYBACK = new MockBuybackDataHook();
108
- TOKEN = new MockERC20("1/2 ETH", "1/2");
109
- MockPriceFeed priceFeed = new MockPriceFeed(1e21, 6);
110
- vm.prank(multisig());
111
- jbPrices()
112
- .addPriceFeedFor(0, uint32(uint160(address(TOKEN))), uint32(uint160(JBConstants.NATIVE_TOKEN)), priceFeed);
113
- LOANS_CONTRACT = new REVLoans({
114
- controller: jbController(),
115
- suckerRegistry: IJBSuckerRegistry(address(new MockSuckerRegistry())),
116
- revId: FEE_PROJECT_ID,
117
- owner: address(this),
118
- permit2: permit2(),
119
- trustedForwarder: TRUSTED_FORWARDER
120
- });
121
- REV_OWNER = new REVOwner(
122
- IJBBuybackHookRegistry(address(MOCK_BUYBACK)),
123
- jbDirectory(),
124
- FEE_PROJECT_ID,
125
- SUCKER_REGISTRY,
126
- address(LOANS_CONTRACT),
127
- address(0)
128
- );
129
-
130
- REV_DEPLOYER = new REVDeployer{salt: REV_DEPLOYER_SALT}(
131
- jbController(),
132
- SUCKER_REGISTRY,
133
- FEE_PROJECT_ID,
134
- HOOK_DEPLOYER,
135
- PUBLISHER,
136
- IJBBuybackHookRegistry(address(MOCK_BUYBACK)),
137
- address(LOANS_CONTRACT),
138
- TRUSTED_FORWARDER,
139
- address(REV_OWNER)
140
- );
141
-
142
- REV_OWNER.setDeployer(REV_DEPLOYER);
143
-
144
- vm.prank(multisig());
145
- jbProjects().approve(address(REV_DEPLOYER), FEE_PROJECT_ID);
146
- _deployFeeProject();
147
- _deployRevnet();
148
- vm.deal(user, 100e18);
149
- }
150
-
151
- function _deployFeeProject() internal {
152
- JBAccountingContext[] memory acc = new JBAccountingContext[](2);
153
- acc[0] = JBAccountingContext({
154
- token: JBConstants.NATIVE_TOKEN, decimals: 18, currency: uint32(uint160(JBConstants.NATIVE_TOKEN))
155
- });
156
- acc[1] = JBAccountingContext({token: address(TOKEN), decimals: 6, currency: uint32(uint160(address(TOKEN)))});
157
- JBTerminalConfig[] memory tc = new JBTerminalConfig[](1);
158
- tc[0] = JBTerminalConfig({terminal: jbMultiTerminal(), accountingContextsToAccept: acc});
159
- REVStageConfig[] memory stages = new REVStageConfig[](1);
160
- JBSplit[] memory splits = new JBSplit[](1);
161
- splits[0].beneficiary = payable(multisig());
162
- splits[0].percent = 10_000;
163
- REVAutoIssuance[] memory ai = new REVAutoIssuance[](1);
164
- ai[0] = REVAutoIssuance({chainId: uint32(block.chainid), count: uint104(70_000e18), beneficiary: multisig()});
165
- stages[0] = REVStageConfig({
166
- startsAtOrAfter: uint40(block.timestamp),
167
- autoIssuances: ai,
168
- splitPercent: 2000,
169
- splits: splits,
170
- initialIssuance: uint112(1000e18),
171
- issuanceCutFrequency: 90 days,
172
- issuanceCutPercent: JBConstants.MAX_WEIGHT_CUT_PERCENT / 2,
173
- cashOutTaxRate: 6000,
174
- extraMetadata: 0
175
- });
176
- REVConfig memory cfg = REVConfig({
177
- // forge-lint: disable-next-line(named-struct-fields)
178
- description: REVDescription("Revnet", "$REV", "ipfs://test", "REV_TOKEN"),
179
- baseCurrency: uint32(uint160(JBConstants.NATIVE_TOKEN)),
180
- splitOperator: multisig(),
181
- stageConfigurations: stages
182
- });
183
- vm.prank(multisig());
184
- REV_DEPLOYER.deployFor({
185
- revnetId: FEE_PROJECT_ID,
186
- configuration: cfg,
187
- terminalConfigurations: tc,
188
- suckerDeploymentConfiguration: REVSuckerDeploymentConfig({
189
- deployerConfigurations: new JBSuckerDeployerConfig[](0), salt: keccak256("FEE")
190
- }),
191
- tiered721HookConfiguration: REVEmpty721Config.empty721Config(uint32(uint160(JBConstants.NATIVE_TOKEN))),
192
- allowedPosts: REVEmpty721Config.emptyAllowedPosts()
193
- });
194
- }
195
-
196
- function _deployRevnet() internal {
197
- JBAccountingContext[] memory acc = new JBAccountingContext[](2);
198
- acc[0] = JBAccountingContext({
199
- token: JBConstants.NATIVE_TOKEN, decimals: 18, currency: uint32(uint160(JBConstants.NATIVE_TOKEN))
200
- });
201
- acc[1] = JBAccountingContext({token: address(TOKEN), decimals: 6, currency: uint32(uint160(address(TOKEN)))});
202
- JBTerminalConfig[] memory tc = new JBTerminalConfig[](1);
203
- tc[0] = JBTerminalConfig({terminal: jbMultiTerminal(), accountingContextsToAccept: acc});
204
- REVStageConfig[] memory stages = new REVStageConfig[](1);
205
- JBSplit[] memory splits = new JBSplit[](1);
206
- splits[0].beneficiary = payable(multisig());
207
- splits[0].percent = 10_000;
208
- REVAutoIssuance[] memory ai = new REVAutoIssuance[](1);
209
- ai[0] = REVAutoIssuance({chainId: uint32(block.chainid), count: uint104(70_000e18), beneficiary: multisig()});
210
- stages[0] = REVStageConfig({
211
- startsAtOrAfter: uint40(block.timestamp),
212
- autoIssuances: ai,
213
- splitPercent: 2000,
214
- splits: splits,
215
- initialIssuance: uint112(1000e18),
216
- issuanceCutFrequency: 90 days,
217
- issuanceCutPercent: JBConstants.MAX_WEIGHT_CUT_PERCENT / 2,
218
- cashOutTaxRate: 6000,
219
- extraMetadata: 0
220
- });
221
- REVConfig memory cfg = REVConfig({
222
- // forge-lint: disable-next-line(named-struct-fields)
223
- description: REVDescription("NANA", "$NANA", "ipfs://test2", "NANA_TOKEN"),
224
- baseCurrency: uint32(uint160(JBConstants.NATIVE_TOKEN)),
225
- splitOperator: multisig(),
226
- stageConfigurations: stages
227
- });
228
- (REVNET_ID,) = REV_DEPLOYER.deployFor({
229
- revnetId: 0,
230
- configuration: cfg,
231
- terminalConfigurations: tc,
232
- suckerDeploymentConfiguration: REVSuckerDeploymentConfig({
233
- deployerConfigurations: new JBSuckerDeployerConfig[](0), salt: keccak256("NANA")
234
- }),
235
- tiered721HookConfiguration: REVEmpty721Config.empty721Config(uint32(uint160(JBConstants.NATIVE_TOKEN))),
236
- allowedPosts: REVEmpty721Config.emptyAllowedPosts()
237
- });
238
- }
239
-
240
- /// @notice borrowFrom should revert when the caller hasn't granted BURN_TOKENS permission.
241
- /// @dev The controller enforces this with JBPermissioned_Unauthorized when burnTokensOf is called.
242
- function test_borrowFrom_revertsWithoutBurnPermission() public {
243
- // Pay into the revnet to get tokens.
244
- vm.prank(user);
245
- uint256 tokenCount =
246
- jbMultiTerminal().pay{value: 5e18}(REVNET_ID, JBConstants.NATIVE_TOKEN, 5e18, user, 0, "", "");
247
- require(tokenCount > 0, "Should have received tokens");
248
-
249
- // Attempt to borrow WITHOUT granting BURN_TOKENS permission → should revert.
250
- REVLoanSource memory source = REVLoanSource({token: JBConstants.NATIVE_TOKEN, terminal: jbMultiTerminal()});
251
- vm.prank(user);
252
- vm.expectRevert(
253
- abi.encodeWithSelector(
254
- JBPermissioned.JBPermissioned_Unauthorized.selector,
255
- user, // account (the token holder)
256
- address(LOANS_CONTRACT), // sender (the contract trying to burn)
257
- REVNET_ID, // projectId
258
- JBPermissionIds.BURN_TOKENS // permissionId
259
- )
260
- );
261
- LOANS_CONTRACT.borrowFrom(REVNET_ID, source, 0, tokenCount, payable(user), 25, user);
262
- }
263
-
264
- /// @notice borrowFrom should succeed when the caller has granted BURN_TOKENS permission.
265
- function test_borrowFrom_succeedsWithBurnPermission() public {
266
- // Pay into the revnet to get tokens.
267
- vm.prank(user);
268
- uint256 tokenCount =
269
- jbMultiTerminal().pay{value: 5e18}(REVNET_ID, JBConstants.NATIVE_TOKEN, 5e18, user, 0, "", "");
270
- require(tokenCount > 0, "Should have received tokens");
271
-
272
- // Grant BURN_TOKENS permission to the loans contract via the real permissions system.
273
- uint8[] memory permissionIds = new uint8[](1);
274
- permissionIds[0] = JBPermissionIds.BURN_TOKENS;
275
- vm.prank(user);
276
- jbPermissions()
277
- .setPermissionsFor({
278
- account: user,
279
- permissionsData: JBPermissionsData({
280
- operator: address(LOANS_CONTRACT), projectId: uint64(REVNET_ID), permissionIds: permissionIds
281
- })
282
- });
283
-
284
- // Borrow should now succeed.
285
- REVLoanSource memory source = REVLoanSource({token: JBConstants.NATIVE_TOKEN, terminal: jbMultiTerminal()});
286
- vm.prank(user);
287
- (uint256 loanId, REVLoan memory loan) =
288
- LOANS_CONTRACT.borrowFrom(REVNET_ID, source, 0, tokenCount, payable(user), 25, user);
289
-
290
- assertTrue(loanId > 0, "Loan ID should be non-zero");
291
- assertTrue(loan.createdAt > 0, "Loan should be created");
292
- assertTrue(loan.amount > 0, "Loan amount should be non-zero");
293
- }
294
- }
@@ -1,232 +0,0 @@
1
- // SPDX-License-Identifier: MIT
2
- pragma solidity 0.8.28;
3
-
4
- // forge-lint: disable-next-line(unaliased-plain-import)
5
- import "forge-std/Test.sol";
6
- // forge-lint: disable-next-line(unaliased-plain-import)
7
- import /* {*} from */ "@bananapus/core-v6/test/helpers/TestBaseWorkflow.sol";
8
- // forge-lint: disable-next-line(unaliased-plain-import)
9
- import /* {*} from */ "../../src/REVDeployer.sol";
10
- // forge-lint: disable-next-line(unaliased-plain-import)
11
- import "@croptop/core-v6/src/CTPublisher.sol";
12
-
13
- import {JBConstants} from "@bananapus/core-v6/src/libraries/JBConstants.sol";
14
- import {JBAccountingContext} from "@bananapus/core-v6/src/structs/JBAccountingContext.sol";
15
- import {JBTerminalConfig} from "@bananapus/core-v6/src/structs/JBTerminalConfig.sol";
16
- import {JBSplit} from "@bananapus/core-v6/src/structs/JBSplit.sol";
17
- import {JBSuckerDeployerConfig} from "@bananapus/suckers-v6/src/structs/JBSuckerDeployerConfig.sol";
18
- import {JBBeforeCashOutRecordedContext} from "@bananapus/core-v6/src/structs/JBBeforeCashOutRecordedContext.sol";
19
- import {JBCashOutHookSpecification} from "@bananapus/core-v6/src/structs/JBCashOutHookSpecification.sol";
20
- import {JBTokenAmount} from "@bananapus/core-v6/src/structs/JBTokenAmount.sol";
21
- import {JB721TiersHook} from "@bananapus/721-hook-v6/src/JB721TiersHook.sol";
22
- import {JB721TiersHookDeployer} from "@bananapus/721-hook-v6/src/JB721TiersHookDeployer.sol";
23
- import {JB721TiersHookStore} from "@bananapus/721-hook-v6/src/JB721TiersHookStore.sol";
24
- import {JB721CheckpointsDeployer} from "@bananapus/721-hook-v6/src/JB721CheckpointsDeployer.sol";
25
- import {IJB721CheckpointsDeployer} from "@bananapus/721-hook-v6/src/interfaces/IJB721CheckpointsDeployer.sol";
26
- import {IJB721TiersHookDeployer} from "@bananapus/721-hook-v6/src/interfaces/IJB721TiersHookDeployer.sol";
27
- import "@bananapus/721-hook-v6/src/JB721CheckpointsDeployer.sol";
28
- import {IJB721CheckpointsDeployer} from "@bananapus/721-hook-v6/src/interfaces/IJB721CheckpointsDeployer.sol";
29
- import {JBAddressRegistry} from "@bananapus/address-registry-v6/src/JBAddressRegistry.sol";
30
- import {IJBAddressRegistry} from "@bananapus/address-registry-v6/src/interfaces/IJBAddressRegistry.sol";
31
- import {JBSuckerRegistry} from "@bananapus/suckers-v6/src/JBSuckerRegistry.sol";
32
- import {IJBBuybackHookRegistry} from "@bananapus/buyback-hook-v6/src/interfaces/IJBBuybackHookRegistry.sol";
33
-
34
- import {REVConfig} from "../../src/structs/REVConfig.sol";
35
- import {REVDescription} from "../../src/structs/REVDescription.sol";
36
- import {REVStageConfig} from "../../src/structs/REVStageConfig.sol";
37
- import {REVAutoIssuance} from "../../src/structs/REVAutoIssuance.sol";
38
- import {REVSuckerDeploymentConfig} from "../../src/structs/REVSuckerDeploymentConfig.sol";
39
- import {REVLoans} from "../../src/REVLoans.sol";
40
- import {REVEmpty721Config} from "../helpers/REVEmpty721Config.sol";
41
- import {MockBuybackCashOutRecorder} from "../mock/MockBuybackCashOutRecorder.sol";
42
- import {REVOwner} from "../../src/REVOwner.sol";
43
- import {IREVDeployer} from "../../src/interfaces/IREVDeployer.sol";
44
- import {MockSuckerRegistry} from "../mock/MockSuckerRegistry.sol";
45
-
46
- /// @title TestCashOutBuybackFeeLeak
47
- /// @notice Proves the buyback hook callback receives only the non-fee cashOutCount (not the full count).
48
- /// Before the fix, the buyback hook reminted and sold `context.cashOutCount` tokens — more than REVDeployer
49
- /// intended. The fee portion was monetized through the pool sale AND the fee was also extracted from treasury.
50
- contract TestCashOutBuybackFeeLeak is TestBaseWorkflow {
51
- bytes32 private constant REV_DEPLOYER_SALT = "REVDeployer";
52
- bytes32 private constant ERC20_SALT = "REV_TOKEN";
53
- address private constant TRUSTED_FORWARDER = 0xB2b5841DBeF766d4b521221732F9B618fCf34A87;
54
-
55
- REVDeployer internal revDeployer;
56
- REVOwner internal revOwner;
57
- MockBuybackCashOutRecorder internal mockBuyback;
58
- JB721TiersHook internal exampleHook;
59
- IJB721TiersHookDeployer internal hookDeployer;
60
- IJBAddressRegistry internal addressRegistry;
61
- JB721TiersHookStore internal hookStore;
62
- JBSuckerRegistry internal suckerRegistry;
63
- CTPublisher internal publisher;
64
- REVLoans internal loans;
65
-
66
- uint256 internal feeProjectId;
67
- uint256 internal revnetId;
68
- address internal user = makeAddr("user");
69
-
70
- function setUp() public override {
71
- super.setUp();
72
-
73
- feeProjectId = jbProjects().createFor(multisig());
74
- suckerRegistry = new JBSuckerRegistry(jbDirectory(), jbPermissions(), multisig(), address(0));
75
- hookStore = new JB721TiersHookStore();
76
- exampleHook = new JB721TiersHook(
77
- jbDirectory(),
78
- jbPermissions(),
79
- jbPrices(),
80
- jbRulesets(),
81
- hookStore,
82
- jbSplits(),
83
- IJB721CheckpointsDeployer(address(new JB721CheckpointsDeployer())),
84
- multisig()
85
- );
86
- addressRegistry = new JBAddressRegistry();
87
- hookDeployer = new JB721TiersHookDeployer(exampleHook, hookStore, addressRegistry, multisig());
88
- publisher = new CTPublisher(jbDirectory(), jbPermissions(), feeProjectId, multisig());
89
- mockBuyback = new MockBuybackCashOutRecorder();
90
- loans = new REVLoans({
91
- controller: jbController(),
92
- suckerRegistry: IJBSuckerRegistry(address(new MockSuckerRegistry())),
93
- revId: feeProjectId,
94
- owner: address(this),
95
- permit2: permit2(),
96
- trustedForwarder: TRUSTED_FORWARDER
97
- });
98
-
99
- revOwner = new REVOwner(
100
- IJBBuybackHookRegistry(address(mockBuyback)),
101
- jbDirectory(),
102
- feeProjectId,
103
- IJBSuckerRegistry(address(suckerRegistry)),
104
- address(loans),
105
- address(0)
106
- );
107
-
108
- revDeployer = new REVDeployer{salt: REV_DEPLOYER_SALT}(
109
- jbController(),
110
- suckerRegistry,
111
- feeProjectId,
112
- hookDeployer,
113
- publisher,
114
- IJBBuybackHookRegistry(address(mockBuyback)),
115
- address(loans),
116
- TRUSTED_FORWARDER,
117
- address(revOwner)
118
- );
119
-
120
- revOwner.setDeployer(revDeployer);
121
-
122
- vm.prank(multisig());
123
- jbProjects().approve(address(revDeployer), feeProjectId);
124
-
125
- // Deploy fee project.
126
- vm.prank(multisig());
127
- _deployRevnet("Fee", "FEE", "ipfs://fee", "FEE_SALT", 6000, feeProjectId);
128
-
129
- // Deploy test revnet.
130
- (revnetId,) = _deployRevnet("Revnet", "REV", "ipfs://rev", ERC20_SALT, 6000, 0);
131
- }
132
-
133
- /// @notice The invariant: buyback hook should only process the non-fee token count.
134
- /// This test FAILS before the fix (proving the bug) and PASSES after.
135
- function test_buybackHookReceivesOnlyNonFeeCount() external {
136
- // Fund the user and pay into the revnet.
137
- vm.deal(user, 10 ether);
138
- vm.prank(user);
139
- jbMultiTerminal().pay{value: 5 ether}({
140
- projectId: revnetId,
141
- token: JBConstants.NATIVE_TOKEN,
142
- amount: 5 ether,
143
- beneficiary: user,
144
- minReturnedTokens: 0,
145
- memo: "",
146
- metadata: ""
147
- });
148
-
149
- uint256 fullCashOutCount = jbTokens().totalBalanceOf(user, revnetId) / 2;
150
- assertGt(fullCashOutCount, 0, "user should have tokens");
151
-
152
- // The non-fee count: what the buyback hook SHOULD process.
153
- uint256 feeCashOutCount = fullCashOutCount * revDeployer.FEE() / JBConstants.MAX_FEE;
154
- uint256 expectedNonFeeCount = fullCashOutCount - feeCashOutCount;
155
-
156
- // Perform the cash out.
157
- vm.prank(user);
158
- jbMultiTerminal()
159
- .cashOutTokensOf({
160
- holder: user,
161
- projectId: revnetId,
162
- cashOutCount: fullCashOutCount,
163
- tokenToReclaim: JBConstants.NATIVE_TOKEN,
164
- minTokensReclaimed: 0,
165
- beneficiary: payable(user),
166
- metadata: ""
167
- });
168
-
169
- // THE INVARIANT: The buyback hook callback should receive nonFeeCashOutCount.
170
- // The real buyback hook remints `context.cashOutCount` tokens and sells them on the pool.
171
- // If it receives fullCashOutCount, it sells the fee portion too — the fee is bypassed.
172
- assertEq(
173
- mockBuyback.afterCashOutCount(),
174
- expectedNonFeeCount,
175
- "BUG: buyback hook received full count instead of non-fee count"
176
- );
177
- }
178
-
179
- function _deployRevnet(
180
- string memory name,
181
- string memory symbol,
182
- string memory projectUri,
183
- bytes32 salt,
184
- uint16 cashOutTaxRate,
185
- uint256 existingProjectId
186
- )
187
- internal
188
- returns (uint256 id, IJB721TiersHook hook)
189
- {
190
- JBAccountingContext[] memory accountingContextsToAccept = new JBAccountingContext[](1);
191
- accountingContextsToAccept[0] = JBAccountingContext({
192
- token: JBConstants.NATIVE_TOKEN, decimals: 18, currency: uint32(uint160(JBConstants.NATIVE_TOKEN))
193
- });
194
-
195
- JBTerminalConfig[] memory terminalConfigurations = new JBTerminalConfig[](1);
196
- terminalConfigurations[0] =
197
- JBTerminalConfig({terminal: jbMultiTerminal(), accountingContextsToAccept: accountingContextsToAccept});
198
-
199
- JBSplit[] memory splits = new JBSplit[](1);
200
- splits[0].beneficiary = payable(multisig());
201
- splits[0].percent = 10_000;
202
-
203
- REVStageConfig[] memory stageConfigurations = new REVStageConfig[](1);
204
- stageConfigurations[0] = REVStageConfig({
205
- startsAtOrAfter: uint40(block.timestamp),
206
- autoIssuances: new REVAutoIssuance[](0),
207
- splitPercent: 2000,
208
- splits: splits,
209
- initialIssuance: uint112(1000e18),
210
- issuanceCutFrequency: 90 days,
211
- issuanceCutPercent: JBConstants.MAX_WEIGHT_CUT_PERCENT / 2,
212
- cashOutTaxRate: cashOutTaxRate,
213
- extraMetadata: 0
214
- });
215
-
216
- return revDeployer.deployFor({
217
- revnetId: existingProjectId,
218
- configuration: REVConfig({
219
- description: REVDescription(name, symbol, projectUri, salt),
220
- baseCurrency: uint32(uint160(JBConstants.NATIVE_TOKEN)),
221
- splitOperator: multisig(),
222
- stageConfigurations: stageConfigurations
223
- }),
224
- terminalConfigurations: terminalConfigurations,
225
- suckerDeploymentConfiguration: REVSuckerDeploymentConfig({
226
- deployerConfigurations: new JBSuckerDeployerConfig[](0), salt: keccak256(abi.encodePacked(symbol))
227
- }),
228
- tiered721HookConfiguration: REVEmpty721Config.empty721Config(uint32(uint160(JBConstants.NATIVE_TOKEN))),
229
- allowedPosts: REVEmpty721Config.emptyAllowedPosts()
230
- });
231
- }
232
- }