@rev-net/core-v6 0.0.72 → 0.0.73

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rev-net/core-v6",
-  "version": "0.0.72",
+  "version": "0.0.73",
   "license": "MIT",
   "repository": {
     "type": "git",

package/references/operations.md

@@ -91,7 +91,7 @@ Use this file when you need revnet-specific risks, state reads, constants, or ex
 | Constant | Value | Purpose |
 |----------|-------|---------|
 | `CASH_OUT_DELAY` | 2,592,000 (30 days) | Prevents cross-chain liquidity arbitrage on new chain deployments |
-| `FEE` | 25 (of MAX_FEE=1000) | 2.5% cash-out fee paid to fee revnet |
+| `FEE` | 25 (of MAX_FEE=1000) | 2.5% cash-out fee paid to fee revnet for non-zero-tax ordinary cash-outs |
 | `DEFAULT_BUYBACK_POOL_FEE` | 10,000 | 1% Uniswap fee tier for default buyback pools |
 | `DEFAULT_BUYBACK_TWAP_WINDOW` | 2 days | TWAP observation window for buyback price |
 | `DEFAULT_BUYBACK_TICK_SPACING` | 200 | Tick spacing for default buyback V4 pools |
@@ -147,7 +147,7 @@ Use this file when you need revnet-specific risks, state reads, constants, or ex
 4. **Loan ID encoding.** `loanId = revnetId * 1_000_000_000_000 + loanNumber`. Each revnet supports ~1 trillion loans. Use `revnetIdOfLoanWith(loanId)` to decode.
 5. **uint112 truncation risk.** `REVLoan.amount` and `REVLoan.collateral` are `uint112`. Values above ~5.19e33 truncate silently.
 6. **Auto-issuance stage IDs.** Computed as `block.timestamp + i` during deployment. These match the Juicebox ruleset IDs because `JBRulesets` assigns IDs the same way (`latestId >= block.timestamp ? latestId + 1 : block.timestamp`), producing identical sequential IDs when all stages are queued in a single `deployFor()` call.
-7. **Cash-out fee stacking.** Cash outs incur both the Juicebox terminal fee (2.5%) and the revnet cash-out fee (2.5% to fee revnet). These compound. The 2.5% fee is deducted from the TOKEN AMOUNT being cashed out, not from the reclaim value. 2.5% of the tokens are redirected to the fee revnet, which then redeems them at the bonding curve independently. The net reclaim to the caller is based on 97.5% of the tokens, not 97.5% of the computed ETH value. This is by design.
+7. **Cash-out fee stacking.** Non-zero-tax ordinary cash-outs incur both the Juicebox terminal fee (2.5%) and the revnet cash-out fee (2.5% to fee revnet). These compound. The 2.5% revnet fee is deducted from the TOKEN AMOUNT being cashed out, not from the reclaim value. 2.5% of the tokens are redirected to the fee revnet, which then redeems them at the bonding curve independently. The net reclaim to the caller is based on 97.5% of the tokens, not 97.5% of the computed ETH value. Zero-tax ordinary cash-outs route through the buyback hook without adding the revnet fee hook, matching current code behavior. This is by design.
 8. **30-day cash-out delay.** Applied when deploying an existing revnet to a new chain where the first stage has already started. Prevents cross-chain liquidity arbitrage. Enforced in both `beforeCashOutRecordedWith` (direct cash outs) and `REVLoans.borrowFrom` / `borrowableAmountFrom` (loans). The delay is stored on REVOwner (`cashOutDelayOf(revnetId)`) and populated by REVDeployer during deployment via the bundled `initializeRevnet()` call. REVLoans imports IREVOwner (not IREVDeployer) to read it.
 9. **`cashOutTaxRate` cannot be MAX.** Must be strictly less than `MAX_CASH_OUT_TAX_RATE` (10,000). Revnets cannot fully disable cash outs.
 10. **Split operator is singular.** Only ONE address can be operator at a time. The operator can replace itself via `setOperatorOf` but cannot delegate or multi-sig.

package/references/runtime.md

@@ -29,7 +29,7 @@ Deploy and manage Revnets -- autonomous, unowned Juicebox projects with staged i
 | Function | Permissions | What it does |
 |----------|------------|-------------|
 | `REVOwner.beforePayRecordedWith(context)` | Terminal callback | Calls the 721 hook first for split specs, then calls the buyback hook with a reduced amount context (payment minus split amount). Adjusts the returned weight proportionally for splits (`weight = mulDiv(weight, amount - splitAmount, amount)`) so the terminal only mints tokens for the amount entering the project. Assembles pay hook specs (721 hook specs first, then buyback spec). Reads `tiered721HookOf` from REVOwner storage. |
-| `REVOwner.beforeCashOutRecordedWith(context)` | Terminal callback | If sucker: returns full amount with 0 tax (fee exempt). Otherwise: calculates 2.5% fee, enforces 30-day cash-out delay (reads `cashOutDelayOf` from REVOwner storage), returns modified count + fee hook spec. |
+| `REVOwner.beforeCashOutRecordedWith(context)` | Terminal callback | If sucker: returns full amount with 0 tax (fee exempt). Otherwise: enforces the 30-day cash-out delay, routes zero-tax ordinary cash-outs through the buyback hook without a revnet fee, and only calculates the 2.5% revnet fee when `cashOutTaxRate != 0`. |
 | `REVOwner.afterCashOutRecordedWith(context)` | Permissionless | Cash-out hook callback. Receives fee amount and pays it to the fee revnet's terminal. Falls back to returning funds if fee payment fails. |
 | `REVOwner.hasMintPermissionFor(revnetId, ruleset, addr)` | View | Returns `true` for: loans contract, buyback hook, buyback hook delegates, or suckers. |
 | `REVOwner.cashOutDelayOf(revnetId)` | View | Returns the cash-out delay timestamp from REVOwner storage. Exposed for REVLoans compatibility (REVLoans imports IREVOwner for this). |

package/src/REVDeployer.sol

@@ -24,6 +24,7 @@ import {JBRulesetConfig} from "@bananapus/core-v6/src/structs/JBRulesetConfig.so
 import {JBRulesetMetadata} from "@bananapus/core-v6/src/structs/JBRulesetMetadata.sol";
 import {JBSplitGroup} from "@bananapus/core-v6/src/structs/JBSplitGroup.sol";
 import {JBTerminalConfig} from "@bananapus/core-v6/src/structs/JBTerminalConfig.sol";
+import {JBOwnable} from "@bananapus/ownable-v6/src/JBOwnable.sol";
 import {JBPermissionIds} from "@bananapus/permission-ids-v6/src/JBPermissionIds.sol";
 import {IJBSuckerRegistry} from "@bananapus/suckers-v6/src/interfaces/IJBSuckerRegistry.sol";
 import {CTPublisher} from "@croptop/core-v6/src/CTPublisher.sol";
@@ -345,6 +346,27 @@ contract REVDeployer is ERC2771Context, IREVDeployer, IERC721Receiver {
         }
     }
 
+    /// @notice Calculate a Uniswap V4 sqrt price, returning zero if the ratio is out of range.
+    /// @param numerator The numerator of the raw token price ratio.
+    /// @param denominator The denominator of the raw token price ratio.
+    /// @return sqrtPriceX96 The encoded sqrt price, or zero when it cannot be represented.
+    function _sqrtPriceX96From(uint256 numerator, uint256 denominator) internal pure returns (uint160 sqrtPriceX96) {
+        // Q192 is the fixed-point scale Uniswap uses before taking the square root.
+        uint256 q192 = 1 << 192;
+
+        // `mulDiv` reverts if `numerator * Q192 / denominator` exceeds uint256.
+        uint256 maxRatio = type(uint256).max / q192;
+
+        // Cap the numerator at a conservative bound that keeps the scaled ratio representable.
+        uint256 maxNumerator = denominator > type(uint256).max / maxRatio ? type(uint256).max : maxRatio * denominator;
+
+        // A zero denominator is invalid, and an out-of-range numerator means this pool price should be skipped.
+        if (denominator == 0 || numerator > maxNumerator) return 0;
+
+        // The bounded ratio fits in uint256, and its square root always fits in uint160.
+        sqrtPriceX96 = uint160(sqrt(mulDiv({x: numerator, y: q192, denominator: denominator})));
+    }
+
     /// @notice Try to initialize a Uniswap V4 buyback pool for a terminal token at its fair issuance price.
     /// @dev Called after the ERC-20 token is deployed so the pool can be initialized in the PoolManager.
     /// Computes `sqrtPriceX96` from `initialIssuance` so the pool starts at the same price as the bonding curve.
@@ -406,13 +428,15 @@ contract REVDeployer is ERC2771Context, IREVDeployer, IERC721Receiver {
                 sqrtPriceX96 = uint160(1 << 96);
             } else if (normalizedTerminalToken < projectToken) {
                 // token0 = terminal, token1 = project → price = adjustedIssuance / terminalTokenUnit
-                sqrtPriceX96 =
-                    uint160(sqrt(mulDiv({x: adjustedInitialIssuance, y: 1 << 192, denominator: terminalTokenUnit})));
+                sqrtPriceX96 = _sqrtPriceX96From({numerator: adjustedInitialIssuance, denominator: terminalTokenUnit});
             } else {
                 // token0 = project, token1 = terminal → price = terminalTokenUnit / adjustedIssuance
-                sqrtPriceX96 =
-                    uint160(sqrt(mulDiv({x: terminalTokenUnit, y: 1 << 192, denominator: adjustedInitialIssuance})));
+                sqrtPriceX96 = _sqrtPriceX96From({numerator: terminalTokenUnit, denominator: adjustedInitialIssuance});
             }
+
+            // Some extreme cross-currency prices are outside Uniswap's usable sqrt-price range. In those cases,
+            // leave the pool uninitialized instead of reverting the whole revnet deployment.
+            if (sqrtPriceX96 == 0) return;
         }
 
         try BUYBACK_HOOK.initializePoolFor({
@@ -528,6 +552,9 @@ contract REVDeployer is ERC2771Context, IREVDeployer, IERC721Receiver {
             });
         }
 
+        // Scope the hook's permissions to REVOwner, where the operator permissions are granted.
+        JBOwnable(address(hook)).transferOwnership(OWNER);
+
         // Grant the operator all 721 permissions (no prevent* flags for default config).
         ownerInit.extraOperatorPermissionIds = new uint256[](4);
         ownerInit.extraOperatorPermissionIds[0] = JBPermissionIds.ADJUST_721_TIERS;
@@ -630,6 +657,9 @@ contract REVDeployer is ERC2771Context, IREVDeployer, IERC721Receiver {
             salt: keccak256(abi.encode(tiered721HookConfiguration.salt, encodedConfigurationHash, _msgSender()))
         });
 
+        // Scope the hook's permissions to REVOwner, where the operator permissions are granted.
+        JBOwnable(address(hook)).transferOwnership(OWNER);
+
         // Build the 721 permission additions based on the deployer's `preventOperator*` flags.
         {
             uint256 extraCount;

package/src/REVLoans.sol

@@ -4,6 +4,7 @@ pragma solidity 0.8.28;
 import {JBPermissioned} from "@bananapus/core-v6/src/abstract/JBPermissioned.sol";
 import {IJBController} from "@bananapus/core-v6/src/interfaces/IJBController.sol";
 import {IJBDirectory} from "@bananapus/core-v6/src/interfaces/IJBDirectory.sol";
+import {IJBMultiTerminal} from "@bananapus/core-v6/src/interfaces/IJBMultiTerminal.sol";
 import {IJBPayoutTerminal} from "@bananapus/core-v6/src/interfaces/IJBPayoutTerminal.sol";
 import {IJBPermissioned} from "@bananapus/core-v6/src/interfaces/IJBPermissioned.sol";
 import {IJBPrices} from "@bananapus/core-v6/src/interfaces/IJBPrices.sol";
@@ -58,6 +59,7 @@ contract REVLoans is ERC721, ERC2771Context, JBPermissioned, Ownable, IREVLoans
 
     error REVLoans_CashOutDelayNotFinished(uint256 cashOutDelay, uint256 blockTimestamp);
     error REVLoans_CollateralExceedsLoan(uint256 collateralToReturn, uint256 loanCollateral);
+    error REVLoans_FeeOnTransferSourceUnsupported(address token, uint256 expectedAmount, uint256 creditedAmount);
     error REVLoans_InvalidAccountingContext(uint256 revnetId, address token);
     error REVLoans_InvalidPrepaidFeePercent(uint256 prepaidFeePercent, uint256 min, uint256 max);
     error REVLoans_LoanExpired(uint256 timeSinceLoanCreated, uint256 loanLiquidationDuration);
@@ -682,11 +684,20 @@ contract REVLoans is ERC721, ERC2771Context, JBPermissioned, Ownable, IREVLoans
         override
         nonReentrantLoanAction
     {
-        // Prevent cross-revnet accounting corruption: loan numbers must stay within the revnet's ID namespace.
-        uint256 endLoanNumber = startingLoanId + count;
-        if (endLoanNumber > _ONE_TRILLION) {
+        // No loans are checked when count is zero.
+        if (count == 0) return;
+
+        // Prevent cross-revnet accounting corruption: every iterated loan number must stay within the revnet's ID
+        // namespace.
+        if (startingLoanId > _ONE_TRILLION) {
             revert REVLoans_LoanIdOverflow({
-                revnetId: revnetId, loanNumber: endLoanNumber, maxLoanNumber: _ONE_TRILLION
+                revnetId: revnetId, loanNumber: startingLoanId, maxLoanNumber: _ONE_TRILLION
+            });
+        }
+        uint256 maxCount = _ONE_TRILLION - startingLoanId + 1;
+        if (count > maxCount) {
+            revert REVLoans_LoanIdOverflow({
+                revnetId: revnetId, loanNumber: _ONE_TRILLION + 1, maxLoanNumber: _ONE_TRILLION
             });
         }
 
@@ -1196,6 +1207,12 @@ contract REVLoans is ERC721, ERC2771Context, JBPermissioned, Ownable, IREVLoans
 
         // INTERACTIONS: Execute external calls with pre-computed deltas.
 
+        // Burn newly added collateral before pulling source funds so fee-project token mints from the borrow cannot
+        // be used as same-transaction collateral.
+        if (addedCollateralCount > 0) {
+            _addCollateralTo({revnetId: revnetId, amount: addedCollateralCount, holder: holder});
+        }
+
         // Add to the loan if needed...
         if (addedBorrowAmount > 0) {
             _addTo({
@@ -1210,11 +1227,8 @@ contract REVLoans is ERC721, ERC2771Context, JBPermissioned, Ownable, IREVLoans
             _removeFrom({loan: loan, revnetId: revnetId, repaidBorrowAmount: repaidBorrowAmount});
         }
 
-        // Add collateral if needed...
-        if (addedCollateralCount > 0) {
-            _addCollateralTo({revnetId: revnetId, amount: addedCollateralCount, holder: holder});
-            // ... or return collateral if needed.
-        } else if (returnedCollateralCount > 0) {
+        // Return collateral if needed.
+        if (returnedCollateralCount > 0) {
             _returnCollateralFrom({
                 revnetId: revnetId, collateralCount: returnedCollateralCount, beneficiary: beneficiary
             });
@@ -1477,8 +1491,10 @@ contract REVLoans is ERC721, ERC2771Context, JBPermissioned, Ownable, IREVLoans
     function _removeFrom(REVLoan memory loan, uint256 revnetId, uint256 repaidBorrowAmount) internal {
         address sourceToken = loan.sourceToken;
 
-        // Decrement the total amount of a token being loaned out by the revnet.
-        totalBorrowedFrom[revnetId][sourceToken] -= repaidBorrowAmount;
+        IJBMultiTerminal terminal = IJBMultiTerminal(address(TERMINAL));
+
+        // Snapshot the credited terminal balance so fee-on-transfer source tokens cannot under-repay the revnet.
+        uint256 balanceBefore = terminal.STORE().balanceOf(address(TERMINAL), revnetId, sourceToken);
 
         // Increase the allowance for the beneficiary.
         uint256 payValue = _beforeTransferTo({to: address(TERMINAL), token: sourceToken, amount: repaidBorrowAmount});
@@ -1493,6 +1509,17 @@ contract REVLoans is ERC721, ERC2771Context, JBPermissioned, Ownable, IREVLoans
             metadata: bytes(abi.encodePacked(REV_ID))
         });
 
+        uint256 creditedAmount = terminal.STORE().balanceOf(address(TERMINAL), revnetId, sourceToken) - balanceBefore;
+
+        if (creditedAmount != repaidBorrowAmount) {
+            revert REVLoans_FeeOnTransferSourceUnsupported({
+                token: sourceToken, expectedAmount: repaidBorrowAmount, creditedAmount: creditedAmount
+            });
+        }
+
+        // Decrement the total amount of a token being loaned out by the revnet.
+        totalBorrowedFrom[revnetId][sourceToken] -= repaidBorrowAmount;
+
         _afterTransferTo({to: address(TERMINAL), token: sourceToken});
     }
 

package/src/REVOwner.sol

@@ -41,8 +41,8 @@ import {REVOwnerRevnetInit} from "./structs/REVOwnerRevnetInit.sol";
 /// @notice The runtime hook for all revnets — set as every revnet's `dataHook` in ruleset metadata. At pay time, it
 /// coordinates the 721 hook (NFT tier minting) with the buyback hook (secondary market swap routing) and scales weight
 /// for split deductions. At cash-out time, it aggregates cross-chain total supply and surplus (including outstanding
-/// loan debt and collateral), grants suckers 0% tax, splits a 2.5% fee from non-sucker cash outs, and routes fee
-/// proceeds to the fee revnet via `afterCashOutRecordedWith`.
+/// loan debt and collateral), grants suckers 0% tax, splits a 2.5% fee from non-sucker cash outs with a non-zero
+/// cash-out tax, and routes fee proceeds to the fee revnet via `afterCashOutRecordedWith`.
 /// @dev Separated from `REVDeployer` to stay within the EIP-170 contract size limit. Also implements
 /// `IJBPeerChainAdjustedAccounts` to expose loan state to peer-chain supply/surplus snapshots.
 contract REVOwner is IREVOwner, IJBRulesetDataHook, IJBCashOutHook, IJBPeerChainAdjustedAccounts, IERC721Receiver {
@@ -167,12 +167,12 @@ contract REVOwner is IREVOwner, IJBRulesetDataHook, IJBCashOutHook, IJBPeerChain
 
     /// @notice Called before a cash out is recorded. Suckers get 0% tax (bridged tokens redeem at face value). For
     /// regular holders, aggregates cross-chain total supply and surplus (including outstanding loan debt/collateral),
-    /// splits a 2.5% fee from the cashed-out token count, computes bonding curve reclaims for both the holder's portion
-    /// and the fee portion, then delegates to the buyback hook for potential swap routing.
-    /// @dev Part of `IJBRulesetDataHook`. REVOwner is intentionally not registered as a feeless address — the
-    /// protocol
-    /// fee (2.5%) applies on top of the rev fee. The fee hook spec amount sent to `afterCashOutRecordedWith` will have
-    /// the protocol fee deducted by the terminal before reaching this contract.
+    /// splits a 2.5% fee from the cashed-out token count when cash-out tax is non-zero, computes bonding curve
+    /// reclaims for both the holder's portion and the fee portion, then delegates to the buyback hook for potential
+    /// swap routing.
+    /// @dev Part of `IJBRulesetDataHook`. In the non-zero-tax fee path, REVOwner is intentionally not registered as a
+    /// feeless address — the protocol fee (2.5%) applies on top of the rev fee. The fee hook spec amount sent to
+    /// `afterCashOutRecordedWith` will have the protocol fee deducted by the terminal before reaching this contract.
     /// @param context Standard Juicebox cash out context. See `JBBeforeCashOutRecordedContext`.
     /// @return cashOutTaxRate The cash out tax rate, which influences the amount of terminal tokens reclaimed.
     /// @return cashOutCount The number of revnet tokens to cash out.
@@ -232,9 +232,9 @@ contract REVOwner is IREVOwner, IJBRulesetDataHook, IJBCashOutHook, IJBPeerChain
             });
         }
 
-        // If there's no cash out tax (100% cash out tax rate), if there's no fee terminal, or if the beneficiary is
-        // feeless (e.g. the router terminal routing value between projects), proxy to the buyback hook with our
-        // totalSupply and effectiveSurplusValue.
+        // If there's no cash out tax, if there's no fee terminal, or if the beneficiary is feeless (e.g. the router
+        // terminal routing value between projects), proxy to the buyback hook with our totalSupply and
+        // effectiveSurplusValue. Zero-tax ordinary cash-outs do not add the revnet fee hook.
         if (context.cashOutTaxRate == 0 || address(feeTerminal) == address(0) || context.beneficiaryIsFeeless) {
             // Build a modified context with cross-chain-adjusted values so the buyback hook sees the global state
             // for its swap-vs-passthrough routing decision.