@rev-net/core-v6 0.0.4 → 0.0.6

package/test/TestEmptyBuybackSpecs.t.sol

@@ -0,0 +1,237 @@
+// SPDX-License-Identifier: MIT
+pragma solidity 0.8.26;
+
+import "forge-std/Test.sol";
+import /* {*} from */ "@bananapus/core-v6/test/helpers/TestBaseWorkflow.sol";
+import /* {*} from */ "./../src/REVDeployer.sol";
+import "@croptop/core-v6/src/CTPublisher.sol";
+import {MockBuybackDataHookMintPath} from "./mock/MockBuybackDataHookMintPath.sol";
+import {MockBuybackDataHook} from "./mock/MockBuybackDataHook.sol";
+import "@bananapus/core-v6/script/helpers/CoreDeploymentLib.sol";
+import "@bananapus/721-hook-v6/script/helpers/Hook721DeploymentLib.sol";
+import "@bananapus/suckers-v6/script/helpers/SuckerDeploymentLib.sol";
+import "@croptop/core-v6/script/helpers/CroptopDeploymentLib.sol";
+import "@bananapus/router-terminal-v6/script/helpers/RouterTerminalDeploymentLib.sol";
+import {JBConstants} from "@bananapus/core-v6/src/libraries/JBConstants.sol";
+import {JBAccountingContext} from "@bananapus/core-v6/src/structs/JBAccountingContext.sol";
+import {REVLoans} from "../src/REVLoans.sol";
+import {REVStageConfig, REVAutoIssuance} from "../src/structs/REVStageConfig.sol";
+import {REVLoanSource} from "../src/structs/REVLoanSource.sol";
+import {REVDescription} from "../src/structs/REVDescription.sol";
+import {IREVLoans} from "./../src/interfaces/IREVLoans.sol";
+import {JBSuckerDeployerConfig} from "@bananapus/suckers-v6/src/structs/JBSuckerDeployerConfig.sol";
+import {JBSuckerRegistry} from "@bananapus/suckers-v6/src/JBSuckerRegistry.sol";
+import {JB721TiersHookDeployer} from "@bananapus/721-hook-v6/src/JB721TiersHookDeployer.sol";
+import {JB721TiersHook} from "@bananapus/721-hook-v6/src/JB721TiersHook.sol";
+import {JB721TiersHookStore} from "@bananapus/721-hook-v6/src/JB721TiersHookStore.sol";
+import {JBAddressRegistry} from "@bananapus/address-registry-v6/src/JBAddressRegistry.sol";
+import {IJBAddressRegistry} from "@bananapus/address-registry-v6/src/interfaces/IJBAddressRegistry.sol";
+import {JBBeforePayRecordedContext} from "@bananapus/core-v6/src/structs/JBBeforePayRecordedContext.sol";
+import {JBPayHookSpecification} from "@bananapus/core-v6/src/structs/JBPayHookSpecification.sol";
+import {JBTokenAmount} from "@bananapus/core-v6/src/structs/JBTokenAmount.sol";
+
+/// @notice Regression tests for the empty buyback hook specifications fix.
+/// When JBBuybackHook determines minting is cheaper than swapping, it returns an empty
+/// hookSpecifications array. Before the fix, REVDeployer.beforePayRecordedWith would
+/// Panic(0x32) (array out-of-bounds) when accessing buybackHookSpecifications[0].
+contract TestEmptyBuybackSpecs is TestBaseWorkflow, JBTest {
+    bytes32 REV_DEPLOYER_SALT = "REVDeployer";
+
+    REVDeployer REV_DEPLOYER;
+    JB721TiersHook EXAMPLE_HOOK;
+    IJB721TiersHookDeployer HOOK_DEPLOYER;
+    IJB721TiersHookStore HOOK_STORE;
+    IJBAddressRegistry ADDRESS_REGISTRY;
+    IREVLoans LOANS_CONTRACT;
+    IJBSuckerRegistry SUCKER_REGISTRY;
+    CTPublisher PUBLISHER;
+    MockBuybackDataHookMintPath MOCK_BUYBACK_MINT_PATH;
+
+    uint256 FEE_PROJECT_ID;
+
+    address private constant TRUSTED_FORWARDER = 0xB2b5841DBeF766d4b521221732F9B618fCf34A87;
+    address USER = makeAddr("user");
+
+    function setUp() public override {
+        super.setUp();
+        FEE_PROJECT_ID = jbProjects().createFor(multisig());
+        SUCKER_REGISTRY = new JBSuckerRegistry(jbDirectory(), jbPermissions(), multisig(), address(0));
+        HOOK_STORE = new JB721TiersHookStore();
+        EXAMPLE_HOOK = new JB721TiersHook(jbDirectory(), jbPermissions(), jbRulesets(), HOOK_STORE, multisig());
+        ADDRESS_REGISTRY = new JBAddressRegistry();
+        HOOK_DEPLOYER = new JB721TiersHookDeployer(EXAMPLE_HOOK, HOOK_STORE, ADDRESS_REGISTRY, multisig());
+        PUBLISHER = new CTPublisher(jbDirectory(), jbPermissions(), FEE_PROJECT_ID, multisig());
+        MOCK_BUYBACK_MINT_PATH = new MockBuybackDataHookMintPath();
+        LOANS_CONTRACT = new REVLoans({
+            controller: jbController(),
+            projects: jbProjects(),
+            revId: FEE_PROJECT_ID,
+            owner: address(this),
+            permit2: permit2(),
+            trustedForwarder: TRUSTED_FORWARDER
+        });
+        REV_DEPLOYER = new REVDeployer{salt: REV_DEPLOYER_SALT}(
+            jbController(),
+            SUCKER_REGISTRY,
+            FEE_PROJECT_ID,
+            HOOK_DEPLOYER,
+            PUBLISHER,
+            IJBRulesetDataHook(address(MOCK_BUYBACK_MINT_PATH)),
+            address(LOANS_CONTRACT),
+            TRUSTED_FORWARDER
+        );
+        vm.prank(multisig());
+        jbProjects().approve(address(REV_DEPLOYER), FEE_PROJECT_ID);
+    }
+
+    function _buildMinimalConfig()
+        internal
+        view
+        returns (REVConfig memory cfg, JBTerminalConfig[] memory tc, REVSuckerDeploymentConfig memory sdc)
+    {
+        JBAccountingContext[] memory acc = new JBAccountingContext[](1);
+        acc[0] = JBAccountingContext({
+            token: JBConstants.NATIVE_TOKEN, decimals: 18, currency: uint32(uint160(JBConstants.NATIVE_TOKEN))
+        });
+        tc = new JBTerminalConfig[](1);
+        tc[0] = JBTerminalConfig({terminal: jbMultiTerminal(), accountingContextsToAccept: acc});
+
+        REVStageConfig[] memory stages = new REVStageConfig[](1);
+        JBSplit[] memory splits = new JBSplit[](1);
+        splits[0].beneficiary = payable(multisig());
+        splits[0].percent = 10_000;
+        stages[0] = REVStageConfig({
+            startsAtOrAfter: uint40(block.timestamp),
+            autoIssuances: new REVAutoIssuance[](0),
+            splitPercent: 0,
+            splits: splits,
+            initialIssuance: uint112(1000e18),
+            issuanceCutFrequency: 0,
+            issuanceCutPercent: 0,
+            cashOutTaxRate: 5000,
+            extraMetadata: 0
+        });
+
+        cfg = REVConfig({
+            description: REVDescription("Test", "TST", "ipfs://test", "TEST_SALT"),
+            baseCurrency: uint32(uint160(JBConstants.NATIVE_TOKEN)),
+            splitOperator: multisig(),
+            stageConfigurations: stages
+        });
+
+        sdc = REVSuckerDeploymentConfig({
+            deployerConfigurations: new JBSuckerDeployerConfig[](0), salt: keccak256(abi.encodePacked("TEST"))
+        });
+    }
+
+    function _deployFeeAndRevnet() internal returns (uint256 revnetId) {
+        (REVConfig memory feeCfg, JBTerminalConfig[] memory feeTc, REVSuckerDeploymentConfig memory feeSdc) =
+            _buildMinimalConfig();
+
+        vm.prank(multisig());
+        REV_DEPLOYER.deployFor({
+            revnetId: FEE_PROJECT_ID,
+            configuration: feeCfg,
+            terminalConfigurations: feeTc,
+            suckerDeploymentConfiguration: feeSdc
+        });
+
+        (REVConfig memory cfg, JBTerminalConfig[] memory tc, REVSuckerDeploymentConfig memory sdc) =
+            _buildMinimalConfig();
+        cfg.description = REVDescription("Test2", "TS2", "ipfs://test2", "TEST_SALT_2");
+
+        revnetId = REV_DEPLOYER.deployFor({
+            revnetId: 0, configuration: cfg, terminalConfigurations: tc, suckerDeploymentConfiguration: sdc
+        });
+    }
+
+    /// @notice REGRESSION: Payment to revnet must succeed when buyback hook returns empty specs (mint path).
+    /// Before the fix, this would Panic(0x32) due to accessing buybackHookSpecifications[0] on an empty array.
+    function test_payRevnet_emptyBuybackSpecs_succeeds() public {
+        uint256 revnetId = _deployFeeAndRevnet();
+
+        vm.deal(USER, 1 ether);
+        vm.prank(USER);
+        jbMultiTerminal().pay{value: 1 ether}({
+            projectId: revnetId,
+            token: JBConstants.NATIVE_TOKEN,
+            amount: 1 ether,
+            beneficiary: USER,
+            minReturnedTokens: 0,
+            memo: "payment with mint path buyback",
+            metadata: ""
+        });
+
+        uint256 balance = jbTokens().totalBalanceOf(USER, revnetId);
+        assertGt(balance, 0, "Should have received tokens when buyback hook takes mint path");
+    }
+
+    /// @notice Payment with various amounts should work when buyback hook returns empty specs.
+    function test_payRevnet_emptyBuybackSpecs_variousAmounts(uint96 amount) public {
+        vm.assume(amount > 0.001 ether && amount < 100 ether);
+        uint256 revnetId = _deployFeeAndRevnet();
+
+        vm.deal(USER, amount);
+        vm.prank(USER);
+        jbMultiTerminal().pay{value: amount}({
+            projectId: revnetId,
+            token: JBConstants.NATIVE_TOKEN,
+            amount: amount,
+            beneficiary: USER,
+            minReturnedTokens: 0,
+            memo: "",
+            metadata: ""
+        });
+
+        uint256 balance = jbTokens().totalBalanceOf(USER, revnetId);
+        assertGt(balance, 0, "Should have received tokens for any valid amount");
+    }
+
+    /// @notice Multiple sequential payments should work with empty buyback specs.
+    function test_payRevnet_emptyBuybackSpecs_multiplePayments() public {
+        uint256 revnetId = _deployFeeAndRevnet();
+
+        for (uint256 i; i < 5; i++) {
+            address payer = makeAddr(string(abi.encodePacked("payer", i)));
+            vm.deal(payer, 1 ether);
+            vm.prank(payer);
+            jbMultiTerminal().pay{value: 1 ether}({
+                projectId: revnetId,
+                token: JBConstants.NATIVE_TOKEN,
+                amount: 1 ether,
+                beneficiary: payer,
+                minReturnedTokens: 0,
+                memo: "",
+                metadata: ""
+            });
+            assertGt(jbTokens().totalBalanceOf(payer, revnetId), 0, "Each payer should receive tokens");
+        }
+    }
+
+    /// @notice Verify beforePayRecordedWith returns empty hookSpecifications when buyback returns empty.
+    function test_beforePayRecordedWith_emptyBuybackSpecs_returnsEmptyArray() public {
+        uint256 revnetId = _deployFeeAndRevnet();
+
+        JBBeforePayRecordedContext memory context = JBBeforePayRecordedContext({
+            terminal: address(jbMultiTerminal()),
+            payer: USER,
+            amount: JBTokenAmount({
+                token: JBConstants.NATIVE_TOKEN,
+                value: 1 ether,
+                decimals: 18,
+                currency: uint32(uint160(JBConstants.NATIVE_TOKEN))
+            }),
+            projectId: revnetId,
+            rulesetId: 0,
+            beneficiary: USER,
+            weight: 1000e18,
+            reservedPercent: 0,
+            metadata: ""
+        });
+
+        (uint256 weight, JBPayHookSpecification[] memory specs) = REV_DEPLOYER.beforePayRecordedWith(context);
+
+        assertEq(weight, context.weight, "Weight should pass through from buyback hook");
+        assertEq(specs.length, 0, "Should return empty specs when buyback hook returns empty and no 721 hook");
+    }
+}

package/test/TestPR12_FlashLoanSurplus.t.sol

@@ -30,7 +30,7 @@ import {JB721TiersHookStore} from "@bananapus/721-hook-v6/src/JB721TiersHookStor
 import {JBAddressRegistry} from "@bananapus/address-registry-v6/src/JBAddressRegistry.sol";
 import {IJBAddressRegistry} from "@bananapus/address-registry-v6/src/interfaces/IJBAddressRegistry.sol";
 
-/// @notice Tests proving that flash loan surplus manipulation is economically unprofitable (PR #12).
+/// @notice Tests showing that flash loan surplus manipulation is economically unprofitable.
 contract TestPR12_FlashLoanSurplus is TestBaseWorkflow, JBTest {
     bytes32 REV_DEPLOYER_SALT = "REVDeployer";
     bytes32 ERC20_SALT = "REV_TOKEN";

package/test/TestPR16_ZeroRepayment.t.sol

@@ -227,7 +227,7 @@ contract TestPR16_ZeroRepayment is TestBaseWorkflow, JBTest {
 
         // Try to repay with collateralCountToReturn = 0 and some maxRepayBorrowAmount.
         // Since surplus was inflated, newBorrowAmount > loan.amount, which reverts with
-        // REVLoans_NewBorrowAmountGreaterThanLoanAmount. This proves zero-repayment is blocked.
+        // REVLoans_NewBorrowAmountGreaterThanLoanAmount. This shows zero-repayment is blocked.
         vm.prank(USER);
         vm.expectRevert(); // Will revert with either NothingToRepay or NewBorrowAmountGreaterThanLoanAmount
         LOANS_CONTRACT.repayLoan{value: 0}(

package/test/TestPR21_Uint112Overflow.t.sol

@@ -32,7 +32,7 @@ import {JBAddressRegistry} from "@bananapus/address-registry-v6/src/JBAddressReg
 import {IJBAddressRegistry} from "@bananapus/address-registry-v6/src/interfaces/IJBAddressRegistry.sol";
 
 /// @title TestPR21_Uint112Overflow
-/// @notice Tests for PR #21 — C-1 uint112 truncation fix in REVLoans._adjust()
+/// @notice Tests for uint112 truncation fix in REVLoans._adjust()
 contract TestPR21_Uint112Overflow is TestBaseWorkflow, JBTest {
     bytes32 REV_DEPLOYER_SALT = "REVDeployer";
     bytes32 ERC20_SALT = "REV_TOKEN";

package/test/TestPR22_HookArrayOOB.t.sol

@@ -32,7 +32,7 @@ import {JBTokenAmount} from "@bananapus/core-v6/src/structs/JBTokenAmount.sol";
 import {JBRuleset} from "@bananapus/core-v6/src/structs/JBRuleset.sol";
 
 /// @notice Tests for PR #22: fix/c2-hook-array-oob
-/// Verifies that the fix for the C-2 hook array out-of-bounds bug works correctly.
+/// Verifies that the fix for the hook array out-of-bounds bug works correctly.
 /// The bug: `hookSpecifications[1] = buybackHookSpecifications[0]` would revert with OOB
 /// when there is no tiered 721 hook (array size is 1, not 2).
 /// The fix: `hookSpecifications[usesTiered721Hook ? 1 : 0] = buybackHookSpecifications[0]`.

package/test/TestPR27_CEIPattern.t.sol

@@ -60,9 +60,9 @@ contract ReentrantBorrower {
 }
 
 /// @title TestPR27_CEIPattern
-/// @notice Tests for PR #27 — C-3 CEI pattern fix in REVLoans._adjust()
+/// @notice Tests for CEI pattern fix in REVLoans._adjust()
 ///
-/// SOURCE VERIFICATION (confirmed by reading _addTo/_removeFrom/_addCollateralTo/_returnCollateralFrom):
+/// Source context (_addTo/_removeFrom/_addCollateralTo/_returnCollateralFrom):
 ///   - _addTo(REVLoan memory, ..., uint256 addedBorrowAmount, ...) — memory copy, uses delta param
 ///   - _removeFrom(REVLoan memory, ..., uint256 repaidBorrowAmount) — memory copy, uses delta param
 ///   - _addCollateralTo(uint256 revnetId, uint256 amount) — no loan reference at all

package/test/TestStageTransitionBorrowable.t.sol

@@ -0,0 +1,241 @@
+// SPDX-License-Identifier: MIT
+pragma solidity 0.8.26;
+
+import "forge-std/Test.sol";
+import /* {*} from */ "@bananapus/core-v6/test/helpers/TestBaseWorkflow.sol";
+import /* {*} from */ "./../src/REVDeployer.sol";
+import "@croptop/core-v6/src/CTPublisher.sol";
+import {MockBuybackDataHook} from "./mock/MockBuybackDataHook.sol";
+import "@bananapus/core-v6/script/helpers/CoreDeploymentLib.sol";
+import "@bananapus/721-hook-v6/script/helpers/Hook721DeploymentLib.sol";
+import "@bananapus/suckers-v6/script/helpers/SuckerDeploymentLib.sol";
+import "@croptop/core-v6/script/helpers/CroptopDeploymentLib.sol";
+import "@bananapus/router-terminal-v6/script/helpers/RouterTerminalDeploymentLib.sol";
+import {JBConstants} from "@bananapus/core-v6/src/libraries/JBConstants.sol";
+import {JBAccountingContext} from "@bananapus/core-v6/src/structs/JBAccountingContext.sol";
+import {REVLoans} from "../src/REVLoans.sol";
+import {REVStageConfig, REVAutoIssuance} from "../src/structs/REVStageConfig.sol";
+import {REVLoanSource} from "../src/structs/REVLoanSource.sol";
+import {REVDescription} from "../src/structs/REVDescription.sol";
+import {IREVLoans} from "./../src/interfaces/IREVLoans.sol";
+import {JBSuckerDeployerConfig} from "@bananapus/suckers-v6/src/structs/JBSuckerDeployerConfig.sol";
+import {JBSuckerRegistry} from "@bananapus/suckers-v6/src/JBSuckerRegistry.sol";
+import {JB721TiersHookDeployer} from "@bananapus/721-hook-v6/src/JB721TiersHookDeployer.sol";
+import {JB721TiersHook} from "@bananapus/721-hook-v6/src/JB721TiersHook.sol";
+import {JB721TiersHookStore} from "@bananapus/721-hook-v6/src/JB721TiersHookStore.sol";
+import {JBAddressRegistry} from "@bananapus/address-registry-v6/src/JBAddressRegistry.sol";
+import {IJBAddressRegistry} from "@bananapus/address-registry-v6/src/interfaces/IJBAddressRegistry.sol";
+
+/// @notice Documents and verifies that stage transitions change the borrowable amount for the same collateral.
+/// This is by design: loan value tracks the current bonding curve parameters (cashOutTaxRate),
+/// just as cash-out value does.
+contract TestStageTransitionBorrowable is TestBaseWorkflow, JBTest {
+    bytes32 REV_DEPLOYER_SALT = "REVDeployer";
+
+    REVDeployer REV_DEPLOYER;
+    JB721TiersHook EXAMPLE_HOOK;
+    IJB721TiersHookDeployer HOOK_DEPLOYER;
+    IJB721TiersHookStore HOOK_STORE;
+    IJBAddressRegistry ADDRESS_REGISTRY;
+    IREVLoans LOANS_CONTRACT;
+    IJBSuckerRegistry SUCKER_REGISTRY;
+    CTPublisher PUBLISHER;
+    MockBuybackDataHook MOCK_BUYBACK;
+
+    uint256 FEE_PROJECT_ID;
+    uint256 REVNET_ID;
+
+    address USER = makeAddr("user");
+
+    address private constant TRUSTED_FORWARDER = 0xB2b5841DBeF766d4b521221732F9B618fCf34A87;
+
+    /// @notice Stage 1 starts now with 60% cashOutTaxRate, stage 2 starts after 30 days with 20% cashOutTaxRate.
+    function _buildConfig()
+        internal
+        view
+        returns (REVConfig memory cfg, JBTerminalConfig[] memory tc, REVSuckerDeploymentConfig memory sdc)
+    {
+        JBAccountingContext[] memory acc = new JBAccountingContext[](1);
+        acc[0] = JBAccountingContext({
+            token: JBConstants.NATIVE_TOKEN, decimals: 18, currency: uint32(uint160(JBConstants.NATIVE_TOKEN))
+        });
+        tc = new JBTerminalConfig[](1);
+        tc[0] = JBTerminalConfig({terminal: jbMultiTerminal(), accountingContextsToAccept: acc});
+
+        REVStageConfig[] memory stages = new REVStageConfig[](2);
+        JBSplit[] memory splits = new JBSplit[](1);
+        splits[0].beneficiary = payable(multisig());
+        splits[0].percent = 10_000;
+
+        // Stage 1: high cashOutTaxRate (60%)
+        stages[0] = REVStageConfig({
+            startsAtOrAfter: uint40(block.timestamp),
+            autoIssuances: new REVAutoIssuance[](0),
+            splitPercent: 0,
+            splits: splits,
+            initialIssuance: uint112(1000e18),
+            issuanceCutFrequency: 0,
+            issuanceCutPercent: 0,
+            cashOutTaxRate: 6000, // 60%
+            extraMetadata: 0
+        });
+
+        // Stage 2: low cashOutTaxRate (20%) — starts after 30 days
+        stages[1] = REVStageConfig({
+            startsAtOrAfter: uint40(block.timestamp + 30 days),
+            autoIssuances: new REVAutoIssuance[](0),
+            splitPercent: 0,
+            splits: splits,
+            initialIssuance: uint112(1000e18),
+            issuanceCutFrequency: 0,
+            issuanceCutPercent: 0,
+            cashOutTaxRate: 2000, // 20%
+            extraMetadata: 0
+        });
+
+        cfg = REVConfig({
+            description: REVDescription("StageTest", "STG", "ipfs://test", "STG_SALT"),
+            baseCurrency: uint32(uint160(JBConstants.NATIVE_TOKEN)),
+            splitOperator: multisig(),
+            stageConfigurations: stages
+        });
+
+        sdc = REVSuckerDeploymentConfig({
+            deployerConfigurations: new JBSuckerDeployerConfig[](0), salt: keccak256(abi.encodePacked("STG"))
+        });
+    }
+
+    function setUp() public override {
+        super.setUp();
+        FEE_PROJECT_ID = jbProjects().createFor(multisig());
+        SUCKER_REGISTRY = new JBSuckerRegistry(jbDirectory(), jbPermissions(), multisig(), address(0));
+        HOOK_STORE = new JB721TiersHookStore();
+        EXAMPLE_HOOK = new JB721TiersHook(jbDirectory(), jbPermissions(), jbRulesets(), HOOK_STORE, multisig());
+        ADDRESS_REGISTRY = new JBAddressRegistry();
+        HOOK_DEPLOYER = new JB721TiersHookDeployer(EXAMPLE_HOOK, HOOK_STORE, ADDRESS_REGISTRY, multisig());
+        PUBLISHER = new CTPublisher(jbDirectory(), jbPermissions(), FEE_PROJECT_ID, multisig());
+        MOCK_BUYBACK = new MockBuybackDataHook();
+        LOANS_CONTRACT = new REVLoans({
+            controller: jbController(),
+            projects: jbProjects(),
+            revId: FEE_PROJECT_ID,
+            owner: address(this),
+            permit2: permit2(),
+            trustedForwarder: TRUSTED_FORWARDER
+        });
+        REV_DEPLOYER = new REVDeployer{salt: REV_DEPLOYER_SALT}(
+            jbController(),
+            SUCKER_REGISTRY,
+            FEE_PROJECT_ID,
+            HOOK_DEPLOYER,
+            PUBLISHER,
+            IJBRulesetDataHook(address(MOCK_BUYBACK)),
+            address(LOANS_CONTRACT),
+            TRUSTED_FORWARDER
+        );
+        vm.prank(multisig());
+        jbProjects().approve(address(REV_DEPLOYER), FEE_PROJECT_ID);
+
+        // Deploy the fee project first.
+        (REVConfig memory feeCfg, JBTerminalConfig[] memory feeTc, REVSuckerDeploymentConfig memory feeSdc) =
+            _buildConfig();
+        vm.prank(multisig());
+        REV_DEPLOYER.deployFor({
+            revnetId: FEE_PROJECT_ID,
+            configuration: feeCfg,
+            terminalConfigurations: feeTc,
+            suckerDeploymentConfiguration: feeSdc
+        });
+
+        // Deploy the test revnet.
+        (REVConfig memory cfg, JBTerminalConfig[] memory tc, REVSuckerDeploymentConfig memory sdc) = _buildConfig();
+        cfg.description = REVDescription("StageTest2", "ST2", "ipfs://test2", "STG_SALT_2");
+        REVNET_ID = REV_DEPLOYER.deployFor({
+            revnetId: 0, configuration: cfg, terminalConfigurations: tc, suckerDeploymentConfiguration: sdc
+        });
+
+        vm.deal(USER, 100 ether);
+    }
+
+    /// @notice BY DESIGN: Borrowable amount increases when transitioning to a stage with lower cashOutTaxRate.
+    /// This documents that loan value tracks the current bonding curve, just as cash-out value does.
+    /// @dev The bonding curve only applies a tax discount when cashOutCount < totalSupply,
+    /// so we need multiple payers to see the effect.
+    function test_borrowableAmount_increasesWhenCashOutTaxRateDecreases() public {
+        // Two payers so the bonding curve tax rate has a visible effect (count < supply).
+        address otherPayer = makeAddr("otherPayer");
+        vm.deal(otherPayer, 10 ether);
+        vm.prank(otherPayer);
+        jbMultiTerminal().pay{value: 10 ether}({
+            projectId: REVNET_ID,
+            token: JBConstants.NATIVE_TOKEN,
+            amount: 10 ether,
+            beneficiary: otherPayer,
+            minReturnedTokens: 0,
+            memo: "",
+            metadata: ""
+        });
+
+        vm.prank(USER);
+        uint256 tokens = jbMultiTerminal().pay{value: 10 ether}({
+            projectId: REVNET_ID,
+            token: JBConstants.NATIVE_TOKEN,
+            amount: 10 ether,
+            beneficiary: USER,
+            minReturnedTokens: 0,
+            memo: "",
+            metadata: ""
+        });
+        assertGt(tokens, 0, "Should receive tokens");
+
+        // Check borrowable amount during stage 1 (60% cashOutTaxRate).
+        uint256 borrowableStage1 =
+            LOANS_CONTRACT.borrowableAmountFrom(REVNET_ID, tokens, 18, uint32(uint160(JBConstants.NATIVE_TOKEN)));
+        assertGt(borrowableStage1, 0, "Borrowable amount should be positive in stage 1");
+
+        // Warp to stage 2 (20% cashOutTaxRate).
+        vm.warp(block.timestamp + 31 days);
+
+        // Check borrowable amount during stage 2.
+        uint256 borrowableStage2 =
+            LOANS_CONTRACT.borrowableAmountFrom(REVNET_ID, tokens, 18, uint32(uint160(JBConstants.NATIVE_TOKEN)));
+
+        // Borrowable amount should be HIGHER with a lower cashOutTaxRate — by design.
+        assertGt(borrowableStage2, borrowableStage1, "Borrowable amount should increase with lower cashOutTaxRate");
+    }
+
+    /// @notice Verifies that the bonding curve formula applies the tax rate correctly when count < supply.
+    function test_borrowableAmount_taxRateReducesPartialCashOut() public {
+        // Two payers so USER holds a fraction of total supply.
+        address otherPayer = makeAddr("otherPayer");
+        vm.deal(otherPayer, 10 ether);
+        vm.prank(otherPayer);
+        jbMultiTerminal().pay{value: 10 ether}({
+            projectId: REVNET_ID,
+            token: JBConstants.NATIVE_TOKEN,
+            amount: 10 ether,
+            beneficiary: otherPayer,
+            minReturnedTokens: 0,
+            memo: "",
+            metadata: ""
+        });
+
+        vm.prank(USER);
+        uint256 tokens = jbMultiTerminal().pay{value: 10 ether}({
+            projectId: REVNET_ID,
+            token: JBConstants.NATIVE_TOKEN,
+            amount: 10 ether,
+            beneficiary: USER,
+            minReturnedTokens: 0,
+            memo: "",
+            metadata: ""
+        });
+
+        // With 60% tax rate and ~50% of supply, borrowable should be meaningfully less than pro-rata share.
+        uint256 borrowable =
+            LOANS_CONTRACT.borrowableAmountFrom(REVNET_ID, tokens, 18, uint32(uint160(JBConstants.NATIVE_TOKEN)));
+        assertGt(borrowable, 0, "Borrowable amount should be positive");
+        // Pro-rata share would be ~10 ether (half of 20 ether surplus). With 60% tax, it should be less.
+        assertLt(borrowable, 10 ether, "Borrowable should be less than pro-rata share due to tax rate");
+    }
+}

package/test/helpers/MaliciousContracts.sol

@@ -11,7 +11,7 @@ import {IREVLoans} from "../../src/interfaces/IREVLoans.sol";
 import {REVLoanSource} from "../../src/structs/REVLoanSource.sol";
 
 /// @notice A terminal that reverts on both pay() and addToBalanceOf().
-/// @dev Used to prove H-2: if the fee terminal breaks, cash-outs brick because
+/// @dev If the fee terminal breaks, cash-outs brick because
 ///      afterCashOutRecordedWith's fallback addToBalanceOf also reverts.
 contract BrokenFeeTerminal is ERC165, IJBPayoutTerminal {
     bool public payReverts = true;
@@ -119,7 +119,7 @@ contract BrokenFeeTerminal is ERC165, IJBPayoutTerminal {
 }
 
 /// @notice A terminal that attempts to addToBalance + borrow in a single tx.
-/// @dev Used to prove M-11: flash loan surplus inflation via live surplus read.
+/// @dev Flash loan surplus inflation via live surplus read.
 contract SurplusInflator is ERC165, IJBPayoutTerminal {
     IREVLoans public loans;
     uint256 public revnetId;

package/test/mock/MockBuybackDataHookMintPath.sol

@@ -0,0 +1,61 @@
+// SPDX-License-Identifier: MIT
+pragma solidity 0.8.26;
+
+import {IJBRulesetDataHook} from "@bananapus/core-v6/src/interfaces/IJBRulesetDataHook.sol";
+import {IJBPayHook} from "@bananapus/core-v6/src/interfaces/IJBPayHook.sol";
+import {JBBeforePayRecordedContext} from "@bananapus/core-v6/src/structs/JBBeforePayRecordedContext.sol";
+import {JBBeforeCashOutRecordedContext} from "@bananapus/core-v6/src/structs/JBBeforeCashOutRecordedContext.sol";
+import {JBPayHookSpecification} from "@bananapus/core-v6/src/structs/JBPayHookSpecification.sol";
+import {JBCashOutHookSpecification} from "@bananapus/core-v6/src/structs/JBCashOutHookSpecification.sol";
+import {JBAfterPayRecordedContext} from "@bananapus/core-v6/src/structs/JBAfterPayRecordedContext.sol";
+import {JBRuleset} from "@bananapus/core-v6/src/structs/JBRuleset.sol";
+import {IUniswapV3Pool} from "@uniswap/v3-core/contracts/interfaces/IUniswapV3Pool.sol";
+import {IERC165} from "@openzeppelin/contracts/utils/introspection/IERC165.sol";
+
+/// @notice Mock buyback hook that simulates the "mint path" — returns EMPTY hookSpecifications.
+/// This is what the real JBBuybackHook does when direct minting is cheaper than swapping
+/// (i.e., tokenCountWithoutHook >= minimumSwapAmountOut).
+contract MockBuybackDataHookMintPath is IJBRulesetDataHook, IJBPayHook {
+    function beforePayRecordedWith(JBBeforePayRecordedContext calldata context)
+        external
+        view
+        override
+        returns (uint256 weight, JBPayHookSpecification[] memory hookSpecifications)
+    {
+        weight = context.weight;
+        // Return EMPTY hookSpecifications — simulating the mint path where no swap is needed.
+        hookSpecifications = new JBPayHookSpecification[](0);
+    }
+
+    function beforeCashOutRecordedWith(JBBeforeCashOutRecordedContext calldata context)
+        external
+        view
+        override
+        returns (
+            uint256 cashOutTaxRate,
+            uint256 cashOutCount,
+            uint256 totalSupply,
+            JBCashOutHookSpecification[] memory hookSpecifications
+        )
+    {
+        cashOutTaxRate = context.cashOutTaxRate;
+        cashOutCount = context.cashOutCount;
+        totalSupply = context.totalSupply;
+        hookSpecifications = new JBCashOutHookSpecification[](0);
+    }
+
+    function hasMintPermissionFor(uint256, JBRuleset calldata, address) external pure override returns (bool) {
+        return false;
+    }
+
+    function afterPayRecordedWith(JBAfterPayRecordedContext calldata) external payable override {}
+
+    function setPoolFor(uint256, uint24, uint256, address) external pure returns (IUniswapV3Pool) {
+        return IUniswapV3Pool(address(0));
+    }
+
+    function supportsInterface(bytes4 interfaceId) external pure override returns (bool) {
+        return interfaceId == type(IJBRulesetDataHook).interfaceId || interfaceId == type(IJBPayHook).interfaceId
+            || interfaceId == type(IERC165).interfaceId;
+    }
+}