@rev-net/core-v6 0.0.57 → 0.0.61

package/src/REVLoans.sol

@@ -32,8 +32,8 @@ import {IPermit2} from "@uniswap/permit2/src/interfaces/IPermit2.sol";
 
 import {IREVLoans} from "./interfaces/IREVLoans.sol";
 import {IREVOwner} from "./interfaces/IREVOwner.sol";
+import {REVLoansSourceFees} from "./libraries/REVLoansSourceFees.sol";
 import {REVLoan} from "./structs/REVLoan.sol";
-import {REVLoanSource} from "./structs/REVLoanSource.sol";
 
 /// @notice Allows revnet token holders to borrow against their tokens instead of cashing out. The borrowable amount
 /// equals what a cash-out would return. Collateral tokens are burned on borrow and re-minted on repayment, keeping the
@@ -58,8 +58,8 @@ contract REVLoans is ERC721, ERC2771Context, JBPermissioned, Ownable, IREVLoans
 
     error REVLoans_CashOutDelayNotFinished(uint256 cashOutDelay, uint256 blockTimestamp);
     error REVLoans_CollateralExceedsLoan(uint256 collateralToReturn, uint256 loanCollateral);
+    error REVLoans_InvalidAccountingContext(uint256 revnetId, address token);
     error REVLoans_InvalidPrepaidFeePercent(uint256 prepaidFeePercent, uint256 min, uint256 max);
-    error REVLoans_InvalidTerminal(address terminal, uint256 revnetId);
     error REVLoans_LoanExpired(uint256 timeSinceLoanCreated, uint256 loanLiquidationDuration);
     error REVLoans_LoanIdOverflow(uint256 revnetId, uint256 loanNumber, uint256 maxLoanNumber);
     error REVLoans_LoanOwnerChanged(uint256 loanId, address expectedOwner, address actualOwner);
@@ -71,12 +71,12 @@ contract REVLoans is ERC721, ERC2771Context, JBPermissioned, Ownable, IREVLoans
     error REVLoans_OverflowAlert(uint256 value, uint256 limit);
     error REVLoans_PermitAllowanceNotEnough(uint256 allowanceAmount, uint256 requiredAmount);
     error REVLoans_ReallocatingMoreCollateralThanBorrowedAmountAllows(uint256 newBorrowAmount, uint256 loanAmount);
-    error REVLoans_SourceMismatch(
-        address expectedToken, address actualToken, address expectedTerminal, address actualTerminal
-    );
+    error REVLoans_ReentrantLoanAction();
+    error REVLoans_SourceMismatch(address expectedToken, address actualToken);
     error REVLoans_UnderMinBorrowAmount(uint256 minBorrowAmount, uint256 borrowAmount);
     error REVLoans_ZeroBorrowAmount(uint256 revnetId, uint256 collateralCount);
     error REVLoans_ZeroCollateralLoanIsInvalid(uint256 collateralCount);
+    error REVLoans_ZeroPrice(uint256 revnetId, uint256 pricingCurrency, uint256 unitCurrency);
 
     //*********************************************************************//
     // ------------------------- public constants ------------------------ //
@@ -108,15 +108,15 @@ contract REVLoans is ERC721, ERC2771Context, JBPermissioned, Ownable, IREVLoans
     // --------------- public immutable stored properties ---------------- //
     //*********************************************************************//
 
-    /// @notice The Permit2 contract used for token approvals and transfers.
-    IPermit2 public immutable override PERMIT2;
-
     /// @notice The controller of revnets that use this loans contract.
     IJBController public immutable override CONTROLLER;
 
     /// @notice The directory of terminals and controllers for revnets.
     IJBDirectory public immutable override DIRECTORY;
 
+    /// @notice The Permit2 contract used for token approvals and transfers.
+    IPermit2 public immutable override PERMIT2;
+
     /// @notice A contract that stores prices for each revnet.
     IJBPrices public immutable override PRICES;
 
@@ -126,62 +126,66 @@ contract REVLoans is ERC721, ERC2771Context, JBPermissioned, Ownable, IREVLoans
     /// @notice The sucker registry used to discover peer chain suckers for cross-chain awareness.
     IJBSuckerRegistry public immutable override SUCKER_REGISTRY;
 
+    /// @notice The canonical payout terminal that holds revnet treasury balances and sources all revnet loans.
+    IJBPayoutTerminal public immutable override TERMINAL;
+
     //*********************************************************************//
     // --------------------- public stored properties -------------------- //
     //*********************************************************************//
 
-    /// @notice An indication if a revnet currently has outstanding loans from the specified terminal in the specified
-    /// token.
-    /// @custom:param revnetId The ID of the revnet to check.
-    /// @custom:param terminal The terminal to check.
-    /// @custom:param token The token to check.
-    mapping(uint256 revnetId => mapping(IJBPayoutTerminal terminal => mapping(address token => bool)))
-        public
-        override isLoanSourceOf;
-
-    /// @notice The cumulative number of loans ever created for a revnet, used as a loan ID sequence counter.
-    /// @dev This counter only increments (on borrow, repay-with-new-loan, and reallocation) and never decrements.
-    /// It does NOT represent the number of currently active loans. Repaid and liquidated loans leave permanent gaps
-    /// in the ID sequence. Integrators should not use this to count active loans.
+    /// @notice An indication if a revnet currently has outstanding loans from the specified token source.
     /// @custom:param revnetId The ID of the revnet to check.
-    mapping(uint256 revnetId => uint256) public override totalLoansBorrowedFor;
+    /// @custom:param token The token source to check.
+    mapping(uint256 revnetId => mapping(address token => bool)) public override isLoanSourceOf;
 
     /// @notice The contract resolving each project ID to its ERC721 URI.
     IJBTokenUriResolver public override tokenUriResolver;
 
-    /// @notice The total amount loaned out by a revnet from a specified terminal in a specified token.
+    /// @notice The total amount loaned out by a revnet from a specified token source.
     /// @custom:param revnetId The ID of the revnet to check.
-    /// @custom:param terminal The terminal to check.
-    /// @custom:param token The token to check.
-    mapping(uint256 revnetId => mapping(IJBPayoutTerminal terminal => mapping(address token => uint256)))
-        public
-        override totalBorrowedFrom;
+    /// @custom:param token The token source to check.
+    mapping(uint256 revnetId => mapping(address token => uint256)) public override totalBorrowedFrom;
 
     /// @notice The total amount of collateral supporting a revnet's loans.
     /// @custom:param revnetId The ID of the revnet to check.
     mapping(uint256 revnetId => uint256) public override totalCollateralOf;
 
+    /// @notice The cumulative number of loans ever created for a revnet, used as a loan ID sequence counter.
+    /// @dev This counter only increments (on borrow, repay-with-new-loan, and reallocation) and never decrements.
+    /// It does NOT represent the number of currently active loans. Repaid and liquidated loans leave permanent gaps
+    /// in the ID sequence. Integrators should not use this to count active loans.
+    /// @custom:param revnetId The ID of the revnet to check.
+    mapping(uint256 revnetId => uint256) public override totalLoansBorrowedFor;
+
     //*********************************************************************//
     // --------------------- internal stored properties ------------------ //
     //*********************************************************************//
 
-    /// @notice The sources of each revnet's loan.
-    /// @dev This array grows monotonically -- entries are appended when a new (terminal, token) pair is first used for
-    /// borrowing, but are never removed. The `isLoanSourceOf` mapping tracks whether a source has been registered.
-    /// Since the number of distinct (terminal, token) pairs per revnet is practically bounded (typically < 10),
-    /// the gas cost of iterating this array in `loanSourcesOf` remains manageable.
-    /// @custom:member revnetId The ID of the revnet to look up.
-    mapping(uint256 revnetId => REVLoanSource[]) internal _loanSourcesOf;
-
     /// @notice The loans.
     /// @custom:member The ID of the loan.
     mapping(uint256 loanId => REVLoan) internal _loanOf;
 
+    /// @notice The sources of each revnet's loan.
+    /// @dev This array grows monotonically -- entries are appended when a token is first used for borrowing, but are
+    /// never removed. The `isLoanSourceOf` mapping tracks whether a source has been registered. Since sources are
+    /// bounded to the revnet's accepted accounting contexts on the canonical multi terminal, iteration remains
+    /// manageable.
+    /// @custom:member revnetId The ID of the revnet to look up.
+    mapping(uint256 revnetId => address[]) internal _loanSourceTokensOf;
+
+    //*********************************************************************//
+    // ------------------- transient stored properties ------------------- //
+    //*********************************************************************//
+
+    /// @notice Whether a loan-changing entrypoint is currently executing.
+    bool transient _loanActionEntered;
+
     //*********************************************************************//
     // -------------------------- constructor ---------------------------- //
     //*********************************************************************//
 
     /// @param controller The controller that manages revnets using this loans contract.
+    /// @param terminal The canonical payout terminal that holds revnet treasury balances and sources loans.
     /// @param suckerRegistry The registry used to discover peer chain suckers for cross-chain supply/surplus awareness.
     /// @param revId The ID of the REV revnet that will receive the fees.
     /// @param owner The owner of the contract that can set the URI resolver.
@@ -189,6 +193,7 @@ contract REVLoans is ERC721, ERC2771Context, JBPermissioned, Ownable, IREVLoans
     /// @param trustedForwarder A trusted forwarder of transactions to this contract.
     constructor(
         IJBController controller,
+        IJBPayoutTerminal terminal,
         IJBSuckerRegistry suckerRegistry,
         uint256 revId,
         address owner,
@@ -202,12 +207,26 @@ contract REVLoans is ERC721, ERC2771Context, JBPermissioned, Ownable, IREVLoans
     {
         CONTROLLER = controller;
         DIRECTORY = controller.DIRECTORY();
+        TERMINAL = terminal;
         PRICES = controller.PRICES();
         REV_ID = revId;
         PERMIT2 = permit2;
         SUCKER_REGISTRY = suckerRegistry;
     }
 
+    //*********************************************************************//
+    // ---------------------------- modifiers ---------------------------- //
+    //*********************************************************************//
+
+    /// @notice Prevent nested loan-changing calls while an external callback is in progress.
+    modifier nonReentrantLoanAction() {
+        if (_loanActionEntered) revert REVLoans_ReentrantLoanAction();
+
+        _loanActionEntered = true;
+        _;
+        _loanActionEntered = false;
+    }
+
     //*********************************************************************//
     // ------------------------- external views -------------------------- //
     //*********************************************************************//
@@ -240,7 +259,7 @@ contract REVLoans is ERC721, ERC2771Context, JBPermissioned, Ownable, IREVLoans
             collateralCount: collateralCount,
             decimals: decimals,
             currency: currency,
-            terminals: _terminalsOf(revnetId),
+            multiTerminal: TERMINAL,
             currentStage: currentRuleset
         });
     }
@@ -251,12 +270,12 @@ contract REVLoans is ERC721, ERC2771Context, JBPermissioned, Ownable, IREVLoans
         return _loanOf[loanId];
     }
 
-    /// @notice The sources of each revnet's loan.
+    /// @notice The source tokens of each revnet's loans.
     /// @dev This array only grows -- sources are never removed. The number of distinct sources is practically bounded
-    /// by the number of unique (terminal, token) pairs used for borrowing, which is typically small.
+    /// by the number of accepted token accounting contexts, which is typically small.
     /// @param revnetId The ID of the revnet to look up.
-    function loanSourcesOf(uint256 revnetId) external view override returns (REVLoanSource[] memory) {
-        return _loanSourcesOf[revnetId];
+    function loanSourceTokensOf(uint256 revnetId) external view override returns (address[] memory) {
+        return _loanSourceTokensOf[revnetId];
     }
 
     //*********************************************************************//
@@ -331,7 +350,7 @@ contract REVLoans is ERC721, ERC2771Context, JBPermissioned, Ownable, IREVLoans
     /// @param collateralCount The amount of collateral to secure the loan with.
     /// @param decimals The decimals to use for the resulting fixed point value.
     /// @param currency The currency to denominate the resulting amount in.
-    /// @param terminals The terminals to borrow from.
+    /// @param multiTerminal The canonical multi terminal to borrow from.
     /// @param currentStage The pre-fetched current ruleset.
     /// @return borrowableAmount The amount that can be borrowed from the revnet.
     function _borrowableAmountFrom(
@@ -339,21 +358,27 @@ contract REVLoans is ERC721, ERC2771Context, JBPermissioned, Ownable, IREVLoans
         uint256 collateralCount,
         uint256 decimals,
         uint256 currency,
-        IJBTerminal[] memory terminals,
+        IJBTerminal multiTerminal,
         JBRuleset memory currentStage
     )
         internal
         view
         returns (uint256)
     {
-        // Get the surplus of all the revnet's terminals in terms of the native currency.
+        // Get the surplus of the revnet's canonical multi terminal in terms of the requested currency.
         uint256 totalSurplus = JBSurplus.currentSurplusOf({
-            projectId: revnetId, terminals: terminals, tokens: new address[](0), decimals: decimals, currency: currency
+            projectId: revnetId,
+            terminals: _singleTerminalArray(multiTerminal),
+            tokens: new address[](0),
+            decimals: decimals,
+            currency: currency
         });
 
         // Get the total amount the revnet currently has loaned out, in terms of the native currency with 18
         // decimals.
-        uint256 totalBorrowed = _totalBorrowedFrom({revnetId: revnetId, decimals: decimals, currency: currency});
+        uint256 totalBorrowed = _totalBorrowedFrom({
+            revnetId: revnetId, decimals: decimals, currency: currency, multiTerminal: multiTerminal
+        });
 
         // Get the total amount of tokens in circulation.
         uint256 totalSupply = CONTROLLER.totalTokenSupplyWithReservedTokensOf(revnetId);
@@ -361,8 +386,9 @@ contract REVLoans is ERC721, ERC2771Context, JBPermissioned, Ownable, IREVLoans
         // Get a reference to the collateral being used to secure loans.
         uint256 totalCollateral = totalCollateralOf[revnetId];
 
-        // Hidden tokens are intentionally excluded from borrowing math. Operators can hide tokens as a security
-        // handle without changing the fair loan market for visible token holders.
+        // Only live token supply is counted here, then loan collateral is added back because loans burn collateral
+        // while borrowers still have a repayable claim on it. Ordinary voluntary burns are not tracked as hidden
+        // supply in v6; they destroy the holder's claim and do not need to be added back.
         uint256 localSupply = totalSupply + totalCollateral;
 
         // The local surplus includes both the treasury surplus and the outstanding borrowed amounts.
@@ -411,19 +437,16 @@ contract REVLoans is ERC721, ERC2771Context, JBPermissioned, Ownable, IREVLoans
         // If there's no collateral, there's no loan.
         if (collateralCount == 0) return 0;
 
-        // Get a reference to the accounting context for the source.
-        JBAccountingContext memory accountingContext =
-            loan.source.terminal.accountingContextForTokenOf({projectId: revnetId, token: loan.source.token});
-
-        // Keep a reference to the revnet's terminals.
-        IJBTerminal[] memory terminals = _terminalsOf(revnetId);
+        // Keep a reference to the token's accounting context from the canonical treasury terminal.
+        JBAccountingContext memory context =
+            TERMINAL.accountingContextForTokenOf({projectId: revnetId, token: loan.sourceToken});
 
         return _borrowableAmountFrom({
             revnetId: revnetId,
             collateralCount: collateralCount,
-            decimals: accountingContext.decimals,
-            currency: accountingContext.currency,
-            terminals: terminals,
+            decimals: context.decimals,
+            currency: context.currency,
+            multiTerminal: TERMINAL,
             currentStage: currentRuleset
         });
     }
@@ -460,36 +483,17 @@ contract REVLoans is ERC721, ERC2771Context, JBPermissioned, Ownable, IREVLoans
     /// @param amount The amount to pay off.
     /// @return The source fee amount for the loan.
     function _determineSourceFeeAmount(REVLoan memory loan, uint256 amount) internal view returns (uint256) {
-        // Keep a reference to the time since the loan was created.
+        // Keep a reference to the loan age here because production uses the live block timestamp while formal proofs
+        // pass explicit elapsed-time values into the same source-fee library.
         uint256 timeSinceLoanCreated = block.timestamp - loan.createdAt;
 
-        // If the loan period has passed the prepaid time frame, take a fee.
-        if (timeSinceLoanCreated <= loan.prepaidDuration) return 0;
-
-        // If the loan period has passed the liquidation time frame, do not allow loan management.
-        // Uses `>` (not `>=`) so the exact boundary second is still repayable — the liquidation path
-        // uses `<=`, and matching `>=` here would create a 1-second window where neither path is available.
-        if (timeSinceLoanCreated > LOAN_LIQUIDATION_DURATION) {
-            revert REVLoans_LoanExpired({
-                timeSinceLoanCreated: timeSinceLoanCreated, loanLiquidationDuration: LOAN_LIQUIDATION_DURATION
-            });
-        }
-
-        // Get a reference to the amount prepaid for the full loan.
-        uint256 prepaid = JBFees.feeAmountFrom({amountBeforeFee: loan.amount, feePercent: loan.prepaidFeePercent});
-
-        // This source fee ramps with elapsed time.
-        uint256 fullSourceFeeAmount = JBFees.feeAmountFrom({
-            amountBeforeFee: loan.amount - prepaid,
-            feePercent: mulDiv({
-                x: timeSinceLoanCreated - loan.prepaidDuration,
-                y: JBConstants.MAX_FEE,
-                denominator: LOAN_LIQUIDATION_DURATION - loan.prepaidDuration
-            })
+        // Delegate the arithmetic so Halmos can prove the exact fee schedule without loading the full loan contract.
+        return REVLoansSourceFees.sourceFeeAmountFrom({
+            loan: loan,
+            amount: amount,
+            timeSinceLoanCreated: timeSinceLoanCreated,
+            loanLiquidationDuration: LOAN_LIQUIDATION_DURATION
         });
-
-        // Calculate the source fee amount for the amount being paid off.
-        return mulDiv({x: fullSourceFeeAmount, y: amount, denominator: loan.amount});
     }
 
     /// @notice Generate an ID for a loan given a revnet ID and a loan number within that revnet.
@@ -515,19 +519,20 @@ contract REVLoans is ERC721, ERC2771Context, JBPermissioned, Ownable, IREVLoans
         return ERC2771Context._msgSender();
     }
 
-    /// @notice Returns the terminals for a revnet. Consolidates ABI encode/decode to a single site.
-    /// @param revnetId The ID of the revnet.
-    /// @return The terminals registered for the revnet.
-    function _terminalsOf(uint256 revnetId) internal view returns (IJBTerminal[] memory) {
-        return DIRECTORY.terminalsOf(revnetId);
+    /// @notice Returns a single-terminal array for surplus calculations.
+    /// @param terminal The terminal to place in the array.
+    /// @return terminals The one-item terminal array.
+    function _singleTerminalArray(IJBTerminal terminal) internal pure returns (IJBTerminal[] memory terminals) {
+        terminals = new IJBTerminal[](1);
+        terminals[0] = terminal;
     }
 
     /// @notice The total borrowed amount from a revnet, aggregated across all loan sources.
     /// @dev Each source's `totalBorrowedFrom` is stored in the source token's native decimals (e.g. 6 for USDC,
     /// 18 for ETH). Before aggregation, each amount is normalized to the target `decimals` to prevent mixed-decimal
     /// arithmetic errors. For cross-currency sources, the normalized amount is then converted via the price feed.
-    /// @dev Inverse price feeds may truncate to zero at low decimal counts (e.g. a feed returning 1e21 at 6 decimals
-    /// inverts to mulDiv(1e6, 1e6, 1e21) = 0). Sources with a zero price are skipped to prevent division-by-zero.
+    /// @dev Cross-currency sources fail closed if the price is zero. Core `JBPrices` reverts before returning zero;
+    /// the local zero check below covers mocked or nonconforming price modules so a source is never silently ignored.
     /// @param revnetId The ID of the revnet to check.
     /// @param decimals The decimals to use for the resulting fixed point value.
     /// @param currency The currency to denominate the resulting value in.
@@ -535,7 +540,8 @@ contract REVLoans is ERC721, ERC2771Context, JBPermissioned, Ownable, IREVLoans
     function _totalBorrowedFrom(
         uint256 revnetId,
         uint256 decimals,
-        uint256 currency
+        uint256 currency,
+        IJBTerminal multiTerminal
     )
         internal
         view
@@ -543,50 +549,50 @@ contract REVLoans is ERC721, ERC2771Context, JBPermissioned, Ownable, IREVLoans
     {
         // Keep a reference to all sources being used to loaned out from this revnet.
         // Use storage ref to avoid bulk-copying the entire array to memory.
-        REVLoanSource[] storage sources = _loanSourcesOf[revnetId];
+        address[] storage sources = _loanSourceTokensOf[revnetId];
 
         // Iterate over all sources being used to loaned out.
         for (uint256 i; i < sources.length; i++) {
             // Get a reference to the token being iterated on.
-            REVLoanSource storage source = sources[i];
+            address sourceToken = sources[i];
 
             // Get a reference to the amount of tokens loaned out.
-            uint256 tokensLoaned = totalBorrowedFrom[revnetId][source.terminal][source.token];
+            uint256 tokensLoaned = totalBorrowedFrom[revnetId][sourceToken];
 
-            // Skip if no tokens are loaned from this source. Checked before the external call below to avoid
-            // reverting on stale sources whose terminals may no longer support this token.
+            // Skip if no tokens are loaned from this source.
             if (tokensLoaned == 0) continue;
 
-            // Get a reference to the accounting context for the source.
-            JBAccountingContext memory accountingContext =
-                source.terminal.accountingContextForTokenOf({projectId: revnetId, token: source.token});
+            // Get the current accounting context for the source token from the terminal being evaluated.
+            JBAccountingContext memory context =
+                multiTerminal.accountingContextForTokenOf({projectId: revnetId, token: sourceToken});
 
             // Normalize the token amount from the source's decimals to the target decimals.
             uint256 normalizedTokens;
-            if (accountingContext.decimals > decimals) {
-                normalizedTokens = tokensLoaned / (10 ** (accountingContext.decimals - decimals));
-            } else if (accountingContext.decimals < decimals) {
-                normalizedTokens = tokensLoaned * (10 ** (decimals - accountingContext.decimals));
+            if (context.decimals > decimals) {
+                normalizedTokens = tokensLoaned / (10 ** (context.decimals - decimals));
+            } else if (context.decimals < decimals) {
+                normalizedTokens = tokensLoaned * (10 ** (decimals - context.decimals));
             } else {
                 normalizedTokens = tokensLoaned;
             }
 
             // If the currency matches, add the normalized amount directly.
-            if (accountingContext.currency == currency) {
+            if (context.currency == currency) {
                 borrowedAmount += normalizedTokens;
             } else {
-                // Otherwise, convert via the price feed.
+                // Otherwise, convert via the price feed. `JBPrices` itself rejects a zero price, but the explicit
+                // local check keeps the same fail-closed behavior if tests or future modules return 0 directly.
                 uint256 pricePerUnit = PRICES.pricePerUnitOf({
-                    projectId: revnetId,
-                    pricingCurrency: accountingContext.currency,
-                    unitCurrency: currency,
-                    decimals: decimals
+                    projectId: revnetId, pricingCurrency: context.currency, unitCurrency: currency, decimals: decimals
                 });
 
-                // If the price feed returns zero, skip this source to avoid a division-by-zero panic
-                // that would DoS all loan operations. This intentionally understates total debt for
-                // the affected source — an acceptable tradeoff vs. blocking every borrow/repay.
-                if (pricePerUnit == 0) continue;
+                // A zero denominator would either panic below or, if skipped, hide outstanding debt. Revert instead
+                // so misconfigured cross-currency sources cannot make borrowers appear safer than they are.
+                if (pricePerUnit == 0) {
+                    revert REVLoans_ZeroPrice({
+                        revnetId: revnetId, pricingCurrency: context.currency, unitCurrency: currency
+                    });
+                }
 
                 borrowedAmount += mulDiv({x: normalizedTokens, y: 10 ** decimals, denominator: pricePerUnit});
             }
@@ -606,9 +612,8 @@ contract REVLoans is ERC721, ERC2771Context, JBPermissioned, Ownable, IREVLoans
     /// @dev A delegated operator (with OPEN_LOAN permission) can set `beneficiary` to any address, directing borrowed
     /// funds away from the holder. Holders should only grant OPEN_LOAN to fully trusted operators.
     /// @param revnetId The ID of the revnet to borrow from.
-    /// @param source The source of the loan (terminal and token).
-    /// @param minBorrowAmount The minimum amount to borrow, denominated in the token of the source's accounting
-    /// context.
+    /// @param token The token to borrow from the revnet's canonical multi terminal.
+    /// @param minBorrowAmount The minimum amount to borrow, denominated in `token`.
     /// @param collateralCount The amount of tokens to use as collateral for the loan.
     /// @param beneficiary The address that will receive the borrowed funds and the tokens resulting from fee payments.
     /// @param prepaidFeePercent The fee percent to charge upfront. Prepaying a fee is cheaper than paying later.
@@ -616,7 +621,7 @@ contract REVLoans is ERC721, ERC2771Context, JBPermissioned, Ownable, IREVLoans
     /// @return loan The loan created.
     function borrowFrom(
         uint256 revnetId,
-        REVLoanSource calldata source,
+        address token,
         uint256 minBorrowAmount,
         uint256 collateralCount,
         address payable beneficiary,
@@ -625,6 +630,7 @@ contract REVLoans is ERC721, ERC2771Context, JBPermissioned, Ownable, IREVLoans
     )
         public
         override
+        nonReentrantLoanAction
         returns (uint256 loanId, REVLoan memory)
     {
         // Only the holder or a permissioned operator can open a loan on the holder's behalf.
@@ -633,7 +639,7 @@ contract REVLoans is ERC721, ERC2771Context, JBPermissioned, Ownable, IREVLoans
 
         return _borrowFrom({
             revnetId: revnetId,
-            source: source,
+            token: token,
             minBorrowAmount: minBorrowAmount,
             collateralCount: collateralCount,
             beneficiary: beneficiary,
@@ -655,7 +661,15 @@ contract REVLoans is ERC721, ERC2771Context, JBPermissioned, Ownable, IREVLoans
     /// @param revnetId The ID of the revnet to liquidate loans from.
     /// @param startingLoanId The loan number to start iterating from.
     /// @param count The number of loans to iterate over.
-    function liquidateExpiredLoansFrom(uint256 revnetId, uint256 startingLoanId, uint256 count) external override {
+    function liquidateExpiredLoansFrom(
+        uint256 revnetId,
+        uint256 startingLoanId,
+        uint256 count
+    )
+        external
+        override
+        nonReentrantLoanAction
+    {
         // Prevent cross-revnet accounting corruption: loan numbers must stay within the revnet's ID namespace.
         uint256 endLoanNumber = startingLoanId + count;
         if (endLoanNumber > _ONE_TRILLION) {
@@ -700,7 +714,7 @@ contract REVLoans is ERC721, ERC2771Context, JBPermissioned, Ownable, IREVLoans
 
             if (loan.amount > 0) {
                 // Decrement the amount loaned.
-                totalBorrowedFrom[revnetId][loan.source.terminal][loan.source.token] -= loan.amount;
+                totalBorrowedFrom[revnetId][loan.sourceToken] -= loan.amount;
             }
 
             emit Liquidate({loanId: loanId, revnetId: revnetId, loan: loan, caller: sender});
@@ -716,9 +730,8 @@ contract REVLoans is ERC721, ERC2771Context, JBPermissioned, Ownable, IREVLoans
     /// borrowed funds from the new loan away from the loan owner. Grant this permission only to trusted operators.
     /// @param loanId The ID of the loan to reallocate collateral from.
     /// @param collateralCountToTransfer The amount of collateral to transfer from the original loan.
-    /// @param source The source of the new loan (terminal and token). Must match the existing loan's source.
-    /// @param minBorrowAmount The minimum amount to borrow, denominated in the token of the source's accounting
-    /// context.
+    /// @param token The token of the new loan. Must match the existing loan's source token.
+    /// @param minBorrowAmount The minimum amount to borrow, denominated in `token`.
     /// @param collateralCountToAdd The amount of collateral to add to the new loan from your balance.
     /// @param beneficiary The address that will receive the borrowed funds and the tokens resulting from fee payments.
     /// @param prepaidFeePercent The fee percent to charge upfront for the new loan.
@@ -729,7 +742,7 @@ contract REVLoans is ERC721, ERC2771Context, JBPermissioned, Ownable, IREVLoans
     function reallocateCollateralFromLoan(
         uint256 loanId,
         uint256 collateralCountToTransfer,
-        REVLoanSource calldata source,
+        address token,
         uint256 minBorrowAmount,
         uint256 collateralCountToAdd,
         address payable beneficiary,
@@ -737,6 +750,7 @@ contract REVLoans is ERC721, ERC2771Context, JBPermissioned, Ownable, IREVLoans
     )
         external
         override
+        nonReentrantLoanAction
         returns (uint256 reallocatedLoanId, uint256 newLoanId, REVLoan memory reallocatedLoan, REVLoan memory newLoan)
     {
         // Keep a reference to the revnet ID of the loan being reallocated.
@@ -747,6 +761,14 @@ contract REVLoans is ERC721, ERC2771Context, JBPermissioned, Ownable, IREVLoans
         address loanOwner = _ownerOf(loanId);
         _requirePermissionFrom({account: loanOwner, projectId: revnetId, permissionId: JBPermissionIds.REALLOCATE_LOAN});
 
+        // If the caller is adding fresh holder collateral on top of the reallocated amount, they must also have
+        // OPEN_LOAN permission for the loan owner: that fresh collateral comes from the owner's project-token
+        // balance and would otherwise let a REALLOCATE_LOAN-only operator open a brand-new loan against the owner's
+        // tokens through this entry point, bypassing the OPEN_LOAN gate that `borrowFrom` enforces.
+        if (collateralCountToAdd != 0) {
+            _requirePermissionFrom({account: loanOwner, projectId: revnetId, permissionId: JBPermissionIds.OPEN_LOAN});
+        }
+
         // Make sure the loan hasn't expired.
         // forge-lint: disable-next-line(block-timestamp)
         if (block.timestamp - _loanOf[loanId].createdAt > LOAN_LIQUIDATION_DURATION) {
@@ -758,14 +780,9 @@ contract REVLoans is ERC721, ERC2771Context, JBPermissioned, Ownable, IREVLoans
 
         // Make sure the new loan's source matches the existing loan's source to prevent cross-source value extraction.
         {
-            REVLoanSource storage existingSource = _loanOf[loanId].source;
-            if (source.token != existingSource.token || source.terminal != existingSource.terminal) {
-                revert REVLoans_SourceMismatch({
-                    expectedToken: existingSource.token,
-                    actualToken: source.token,
-                    expectedTerminal: address(existingSource.terminal),
-                    actualTerminal: address(source.terminal)
-                });
+            address existingToken = _loanOf[loanId].sourceToken;
+            if (token != existingToken) {
+                revert REVLoans_SourceMismatch({expectedToken: existingToken, actualToken: token});
             }
         }
 
@@ -782,7 +799,7 @@ contract REVLoans is ERC721, ERC2771Context, JBPermissioned, Ownable, IREVLoans
         // permission above, and requiring OPEN_LOAN here would block operators with only REALLOCATE_LOAN.
         (newLoanId, newLoan) = _borrowFrom({
             revnetId: revnetId,
-            source: source,
+            token: token,
             minBorrowAmount: minBorrowAmount,
             collateralCount: collateralCountToTransfer + collateralCountToAdd,
             beneficiary: beneficiary,
@@ -812,6 +829,7 @@ contract REVLoans is ERC721, ERC2771Context, JBPermissioned, Ownable, IREVLoans
         external
         payable
         override
+        nonReentrantLoanAction
         returns (uint256 paidOffLoanId, REVLoan memory paidOffloan)
     {
         // Cache the sender to avoid repeated ERC2771 context reads.
@@ -883,7 +901,7 @@ contract REVLoans is ERC721, ERC2771Context, JBPermissioned, Ownable, IREVLoans
 
         // Accept the funds that'll be used to pay off loans.
         maxRepayBorrowAmount =
-            _acceptFundsFor({token: loan.source.token, amount: maxRepayBorrowAmount, allowance: allowance});
+            _acceptFundsFor({token: loan.sourceToken, amount: maxRepayBorrowAmount, allowance: allowance});
 
         // Re-check ownership: an ERC-777/ERC-1363 source token can reenter during the transfer above and transfer
         // the loan NFT to another account. Without this check, `_repayLoan` would burn the new owner's NFT while
@@ -903,7 +921,7 @@ contract REVLoans is ERC721, ERC2771Context, JBPermissioned, Ownable, IREVLoans
         }
 
         // Cache the source token before _repayLoan deletes the loan storage.
-        address sourceToken = loan.source.token;
+        address sourceToken = loan.sourceToken;
 
         (paidOffLoanId, paidOffloan) = _repayLoan({
             loanId: loanId,
@@ -1019,39 +1037,39 @@ contract REVLoans is ERC721, ERC2771Context, JBPermissioned, Ownable, IREVLoans
     )
         internal
     {
+        address sourceToken = loan.sourceToken;
+
         // Register the source if this is the first time its being used for this revnet.
-        // Note: Sources are only appended, never removed. Gas accumulation from iteration is bounded
-        // because the number of distinct (terminal, token) pairs per revnet is practically small (~5-20).
-        if (!isLoanSourceOf[revnetId][loan.source.terminal][loan.source.token]) {
-            isLoanSourceOf[revnetId][loan.source.terminal][loan.source.token] = true;
-            _loanSourcesOf[revnetId].push(REVLoanSource({token: loan.source.token, terminal: loan.source.terminal}));
+        // Note: Sources are only appended, never removed. Gas accumulation from iteration is bounded by the revnet's
+        // accepted accounting contexts.
+        if (!isLoanSourceOf[revnetId][sourceToken]) {
+            isLoanSourceOf[revnetId][sourceToken] = true;
+            _loanSourceTokensOf[revnetId].push(sourceToken);
         }
 
-        // Increment the amount of the token borrowed from the revnet from the terminal.
-        totalBorrowedFrom[revnetId][loan.source.terminal][loan.source.token] += addedBorrowAmount;
+        // Increment the amount of the token borrowed from the revnet.
+        totalBorrowedFrom[revnetId][sourceToken] += addedBorrowAmount;
 
         uint256 netAmountPaidOut;
         {
-            // Get a reference to the accounting context for the source.
-            JBAccountingContext memory accountingContext =
-                loan.source.terminal.accountingContextForTokenOf({projectId: revnetId, token: loan.source.token});
+            JBAccountingContext memory context =
+                TERMINAL.accountingContextForTokenOf({projectId: revnetId, token: sourceToken});
 
             // Pull the amount to be loaned out of the revnet. This will incure the protocol fee.
-            netAmountPaidOut = loan.source.terminal
-                .useAllowanceOf({
-                    projectId: revnetId,
-                    token: loan.source.token,
-                    amount: addedBorrowAmount,
-                    currency: accountingContext.currency,
-                    minTokensPaidOut: 0,
-                    beneficiary: payable(address(this)),
-                    feeBeneficiary: beneficiary,
-                    memo: ""
-                });
+            netAmountPaidOut = TERMINAL.useAllowanceOf({
+                projectId: revnetId,
+                token: sourceToken,
+                amount: addedBorrowAmount,
+                currency: context.currency,
+                minTokensPaidOut: 0,
+                beneficiary: payable(address(this)),
+                feeBeneficiary: beneficiary,
+                memo: ""
+            });
         }
 
         // Keep a reference to the fee terminal.
-        IJBTerminal feeTerminal = DIRECTORY.primaryTerminalOf({projectId: REV_ID, token: loan.source.token});
+        IJBTerminal feeTerminal = DIRECTORY.primaryTerminalOf({projectId: REV_ID, token: sourceToken});
 
         // Get the amount of additional fee to take for REV.
         uint256 revFeeAmount = address(feeTerminal) == address(0)
@@ -1063,7 +1081,7 @@ contract REVLoans is ERC721, ERC2771Context, JBPermissioned, Ownable, IREVLoans
             if (!_tryPayFee({
                     terminal: feeTerminal,
                     projectId: REV_ID,
-                    token: loan.source.token,
+                    token: sourceToken,
                     amount: revFeeAmount,
                     beneficiary: beneficiary,
                     metadataProjectId: revnetId
@@ -1079,17 +1097,15 @@ contract REVLoans is ERC721, ERC2771Context, JBPermissioned, Ownable, IREVLoans
         _transferFrom({
             from: address(this),
             to: beneficiary,
-            token: loan.source.token,
+            token: sourceToken,
             amount: netAmountPaidOut - revFeeAmount - sourceFeeAmount
         });
     }
 
     /// @notice Adjust a loan -- pay it back, add more, or return excess collateral.
-    /// @dev CEI ordering note: `totalCollateralOf` is not incremented until `_addCollateralTo` executes,
-    /// which happens after the external calls in `_addTo` (useAllowanceOf, fee payment, transfer). A reentrant
-    /// `borrowFrom` during those calls would see a lower `totalCollateralOf`, potentially passing collateral
-    /// checks that should fail. Practically infeasible — requires an adversarial pay hook on the revnet's own
-    /// terminal that calls back into `borrowFrom`, which is not a realistic deployment configuration.
+    /// @dev `borrowFrom`, `reallocateCollateralFromLoan`, and `repayLoan` hold a transient lock across this function.
+    /// External terminal, token, and beneficiary callbacks may observe in-progress loan state, but they cannot nest
+    /// another loan-changing action before aggregate collateral and borrowed accounting have finished updating.
     /// @param loan The loan to adjust.
     /// @param revnetId The ID of the revnet the loan is in.
     /// @param newBorrowAmount The new amount of the loan, denominated in the token of the source's accounting
@@ -1110,8 +1126,7 @@ contract REVLoans is ERC721, ERC2771Context, JBPermissioned, Ownable, IREVLoans
         internal
     {
         // Cache frequently-read storage fields to avoid repeated SLOAD.
-        address sourceToken = loan.source.token;
-        IJBPayoutTerminal sourceTerminal = loan.source.terminal;
+        address sourceToken = loan.sourceToken;
 
         // Snapshot deltas from current state before writing.
         uint256 addedBorrowAmount = newBorrowAmount > loan.amount ? newBorrowAmount - loan.amount : 0;
@@ -1160,7 +1175,7 @@ contract REVLoans is ERC721, ERC2771Context, JBPermissioned, Ownable, IREVLoans
         // Try to pay the source fee. If it fails, transfer the amount to the beneficiary instead.
         if (sourceFeeAmount > 0) {
             if (!_tryPayFee({
-                    terminal: IJBTerminal(address(sourceTerminal)),
+                    terminal: TERMINAL,
                     projectId: revnetId,
                     token: sourceToken,
                     amount: sourceFeeAmount,
@@ -1197,7 +1212,7 @@ contract REVLoans is ERC721, ERC2771Context, JBPermissioned, Ownable, IREVLoans
     /// @dev Called by `borrowFrom` (after its own permission check) and by `reallocateCollateralFromLoan`
     /// (which only requires REALLOCATE_LOAN permission).
     /// @param revnetId The ID of the revnet to borrow from.
-    /// @param source The source of the loan (terminal and token).
+    /// @param token The token to borrow.
     /// @param minBorrowAmount The minimum amount to borrow.
     /// @param collateralCount The amount of tokens to use as collateral for the loan.
     /// @param beneficiary The address that will receive the borrowed funds and fee payment tokens.
@@ -1207,7 +1222,7 @@ contract REVLoans is ERC721, ERC2771Context, JBPermissioned, Ownable, IREVLoans
     /// @return loan The loan created.
     function _borrowFrom(
         uint256 revnetId,
-        REVLoanSource calldata source,
+        address token,
         uint256 minBorrowAmount,
         uint256 collateralCount,
         address payable beneficiary,
@@ -1220,10 +1235,14 @@ contract REVLoans is ERC721, ERC2771Context, JBPermissioned, Ownable, IREVLoans
         // A loan needs to have collateral.
         if (collateralCount == 0) revert REVLoans_ZeroCollateralLoanIsInvalid({collateralCount: collateralCount});
 
-        // Make sure the source terminal is registered in the directory for this revnet.
-        if (!DIRECTORY.isTerminalOf({projectId: revnetId, terminal: IJBTerminal(address(source.terminal))})) {
-            revert REVLoans_InvalidTerminal({terminal: address(source.terminal), revnetId: revnetId});
-        }
+        // Cache the current ruleset once — used by source validation, _cashOutDelayOf, and _borrowAmountFrom.
+        JBRuleset memory currentRuleset = _currentRulesetOf(revnetId);
+
+        // Make sure the token's accounting context exists on the canonical multi terminal for this revnet. An
+        // unaccepted token reads as an empty accounting context from the terminal store, which must not be treated as
+        // a valid zero-decimal/zero-currency loan source.
+        JBAccountingContext memory context = TERMINAL.accountingContextForTokenOf({projectId: revnetId, token: token});
+        if (context.token != token) revert REVLoans_InvalidAccountingContext({revnetId: revnetId, token: token});
 
         // Make sure the prepaid fee percent is between `MIN_PREPAID_FEE_PERCENT` and `MAX_PREPAID_FEE_PERCENT`. Meaning
         // an 16 year loan can be paid upfront with a
@@ -1234,9 +1253,6 @@ contract REVLoans is ERC721, ERC2771Context, JBPermissioned, Ownable, IREVLoans
             });
         }
 
-        // Cache the current ruleset once — used by both _cashOutDelayOf and _borrowAmountFrom.
-        JBRuleset memory currentRuleset = _currentRulesetOf(revnetId);
-
         // Enforce the cash out delay.
         {
             uint256 cashOutDelay = _cashOutDelayOf({revnetId: revnetId, currentRuleset: currentRuleset});
@@ -1253,7 +1269,7 @@ contract REVLoans is ERC721, ERC2771Context, JBPermissioned, Ownable, IREVLoans
         REVLoan storage loan = _loanOf[loanId];
 
         // Set the loan's values.
-        loan.source = source;
+        loan.sourceToken = token;
         loan.createdAt = uint48(block.timestamp);
         // forge-lint: disable-next-line(unsafe-typecast)
         loan.prepaidFeePercent = uint16(prepaidFeePercent);
@@ -1294,7 +1310,7 @@ contract REVLoans is ERC721, ERC2771Context, JBPermissioned, Ownable, IREVLoans
             loanId: loanId,
             revnetId: revnetId,
             loan: loan,
-            source: source,
+            token: token,
             borrowAmount: borrowAmount,
             collateralCount: collateralCount,
             sourceFeeAmount: sourceFeeAmount,
@@ -1375,7 +1391,7 @@ contract REVLoans is ERC721, ERC2771Context, JBPermissioned, Ownable, IREVLoans
         reallocatedLoan.createdAt = loan.createdAt;
         reallocatedLoan.prepaidFeePercent = loan.prepaidFeePercent;
         reallocatedLoan.prepaidDuration = loan.prepaidDuration;
-        reallocatedLoan.source = loan.source;
+        reallocatedLoan.sourceToken = loan.sourceToken;
 
         // Reduce the collateral of the reallocated loan.
         _adjust({
@@ -1411,25 +1427,25 @@ contract REVLoans is ERC721, ERC2771Context, JBPermissioned, Ownable, IREVLoans
     /// @param repaidBorrowAmount The amount to pay off, denominated in the token of the source's accounting
     /// context.
     function _removeFrom(REVLoan memory loan, uint256 revnetId, uint256 repaidBorrowAmount) internal {
-        // Decrement the total amount of a token being loaned out by the revnet from its terminal.
-        totalBorrowedFrom[revnetId][loan.source.terminal][loan.source.token] -= repaidBorrowAmount;
+        address sourceToken = loan.sourceToken;
+
+        // Decrement the total amount of a token being loaned out by the revnet.
+        totalBorrowedFrom[revnetId][sourceToken] -= repaidBorrowAmount;
 
         // Increase the allowance for the beneficiary.
-        uint256 payValue = _beforeTransferTo({
-            to: address(loan.source.terminal), token: loan.source.token, amount: repaidBorrowAmount
-        });
+        uint256 payValue = _beforeTransferTo({to: address(TERMINAL), token: sourceToken, amount: repaidBorrowAmount});
 
         // Add the loaned amount back to the revnet.
-        loan.source.terminal.addToBalanceOf{value: payValue}({
+        TERMINAL.addToBalanceOf{value: payValue}({
             projectId: revnetId,
-            token: loan.source.token,
+            token: sourceToken,
             amount: repaidBorrowAmount,
             shouldReturnHeldFees: false,
             memo: "",
             metadata: bytes(abi.encodePacked(REV_ID))
         });
 
-        _afterTransferTo({to: address(loan.source.terminal), token: loan.source.token});
+        _afterTransferTo({to: address(TERMINAL), token: sourceToken});
     }
 
     /// @notice Pay down a loan.
@@ -1506,7 +1522,7 @@ contract REVLoans is ERC721, ERC2771Context, JBPermissioned, Ownable, IREVLoans
             paidOffLoan.createdAt = loan.createdAt;
             paidOffLoan.prepaidFeePercent = loan.prepaidFeePercent;
             paidOffLoan.prepaidDuration = loan.prepaidDuration;
-            paidOffLoan.source = loan.source;
+            paidOffLoan.sourceToken = loan.sourceToken;
 
             // Mint the replacement loan to the loan owner FIRST so it exists before _adjust writes data.
             _mint({to: loanOwner, tokenId: paidOffLoanId});