@rev-net/core-v6 0.0.72 → 0.0.74

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rev-net/core-v6",
-  "version": "0.0.72",
+  "version": "0.0.74",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -26,7 +26,7 @@
   "dependencies": {
     "@bananapus/721-hook-v6": "^0.0.55",
     "@bananapus/buyback-hook-v6": "^0.0.51",
-    "@bananapus/core-v6": "^0.0.60",
+    "@bananapus/core-v6": "^0.0.64",
     "@bananapus/ownable-v6": "^0.0.28",
     "@bananapus/permission-ids-v6": "^0.0.27",
     "@bananapus/router-terminal-v6": "^0.0.49",

package/references/operations.md

@@ -91,7 +91,7 @@ Use this file when you need revnet-specific risks, state reads, constants, or ex
 | Constant | Value | Purpose |
 |----------|-------|---------|
 | `CASH_OUT_DELAY` | 2,592,000 (30 days) | Prevents cross-chain liquidity arbitrage on new chain deployments |
-| `FEE` | 25 (of MAX_FEE=1000) | 2.5% cash-out fee paid to fee revnet |
+| `FEE` | 25 (of MAX_FEE=1000) | 2.5% cash-out fee paid to fee revnet for non-zero-tax ordinary cash-outs |
 | `DEFAULT_BUYBACK_POOL_FEE` | 10,000 | 1% Uniswap fee tier for default buyback pools |
 | `DEFAULT_BUYBACK_TWAP_WINDOW` | 2 days | TWAP observation window for buyback price |
 | `DEFAULT_BUYBACK_TICK_SPACING` | 200 | Tick spacing for default buyback V4 pools |
@@ -147,7 +147,7 @@ Use this file when you need revnet-specific risks, state reads, constants, or ex
 4. **Loan ID encoding.** `loanId = revnetId * 1_000_000_000_000 + loanNumber`. Each revnet supports ~1 trillion loans. Use `revnetIdOfLoanWith(loanId)` to decode.
 5. **uint112 truncation risk.** `REVLoan.amount` and `REVLoan.collateral` are `uint112`. Values above ~5.19e33 truncate silently.
 6. **Auto-issuance stage IDs.** Computed as `block.timestamp + i` during deployment. These match the Juicebox ruleset IDs because `JBRulesets` assigns IDs the same way (`latestId >= block.timestamp ? latestId + 1 : block.timestamp`), producing identical sequential IDs when all stages are queued in a single `deployFor()` call.
-7. **Cash-out fee stacking.** Cash outs incur both the Juicebox terminal fee (2.5%) and the revnet cash-out fee (2.5% to fee revnet). These compound. The 2.5% fee is deducted from the TOKEN AMOUNT being cashed out, not from the reclaim value. 2.5% of the tokens are redirected to the fee revnet, which then redeems them at the bonding curve independently. The net reclaim to the caller is based on 97.5% of the tokens, not 97.5% of the computed ETH value. This is by design.
+7. **Cash-out fee stacking.** Non-zero-tax ordinary cash-outs incur both the Juicebox terminal fee (2.5%) and the revnet cash-out fee (2.5% to fee revnet). These compound. The 2.5% revnet fee is deducted from the TOKEN AMOUNT being cashed out, not from the reclaim value. 2.5% of the tokens are redirected to the fee revnet, which then redeems them at the bonding curve independently. The net reclaim to the caller is based on 97.5% of the tokens, not 97.5% of the computed ETH value. Zero-tax ordinary cash-outs route through the buyback hook without adding the revnet fee hook, matching current code behavior. This is by design.
 8. **30-day cash-out delay.** Applied when deploying an existing revnet to a new chain where the first stage has already started. Prevents cross-chain liquidity arbitrage. Enforced in both `beforeCashOutRecordedWith` (direct cash outs) and `REVLoans.borrowFrom` / `borrowableAmountFrom` (loans). The delay is stored on REVOwner (`cashOutDelayOf(revnetId)`) and populated by REVDeployer during deployment via the bundled `initializeRevnet()` call. REVLoans imports IREVOwner (not IREVDeployer) to read it.
 9. **`cashOutTaxRate` cannot be MAX.** Must be strictly less than `MAX_CASH_OUT_TAX_RATE` (10,000). Revnets cannot fully disable cash outs.
 10. **Split operator is singular.** Only ONE address can be operator at a time. The operator can replace itself via `setOperatorOf` but cannot delegate or multi-sig.

package/references/runtime.md

@@ -29,7 +29,7 @@ Deploy and manage Revnets -- autonomous, unowned Juicebox projects with staged i
 | Function | Permissions | What it does |
 |----------|------------|-------------|
 | `REVOwner.beforePayRecordedWith(context)` | Terminal callback | Calls the 721 hook first for split specs, then calls the buyback hook with a reduced amount context (payment minus split amount). Adjusts the returned weight proportionally for splits (`weight = mulDiv(weight, amount - splitAmount, amount)`) so the terminal only mints tokens for the amount entering the project. Assembles pay hook specs (721 hook specs first, then buyback spec). Reads `tiered721HookOf` from REVOwner storage. |
-| `REVOwner.beforeCashOutRecordedWith(context)` | Terminal callback | If sucker: returns full amount with 0 tax (fee exempt). Otherwise: calculates 2.5% fee, enforces 30-day cash-out delay (reads `cashOutDelayOf` from REVOwner storage), returns modified count + fee hook spec. |
+| `REVOwner.beforeCashOutRecordedWith(context)` | Terminal callback | If sucker: returns full amount with 0 tax (fee exempt). Otherwise: enforces the 30-day cash-out delay, routes zero-tax ordinary cash-outs through the buyback hook without a revnet fee, and only calculates the 2.5% revnet fee when `cashOutTaxRate != 0`. |
 | `REVOwner.afterCashOutRecordedWith(context)` | Permissionless | Cash-out hook callback. Receives fee amount and pays it to the fee revnet's terminal. Falls back to returning funds if fee payment fails. |
 | `REVOwner.hasMintPermissionFor(revnetId, ruleset, addr)` | View | Returns `true` for: loans contract, buyback hook, buyback hook delegates, or suckers. |
 | `REVOwner.cashOutDelayOf(revnetId)` | View | Returns the cash-out delay timestamp from REVOwner storage. Exposed for REVLoans compatibility (REVLoans imports IREVOwner for this). |

package/script/Deploy.s.sol

@@ -6,7 +6,6 @@ import {
     BuybackDeployment,
     BuybackDeploymentLib
 } from "@bananapus/buyback-hook-v6/script/helpers/BuybackDeploymentLib.sol";
-import {CoreDeployment, CoreDeploymentLib} from "@bananapus/core-v6/script/helpers/CoreDeploymentLib.sol";
 import {SuckerDeployment, SuckerDeploymentLib} from "@bananapus/suckers-v6/script/helpers/SuckerDeploymentLib.sol";
 import {
     RouterTerminalDeployment,
@@ -44,6 +43,7 @@ import {JB721InitTiersConfig} from "@bananapus/721-hook-v6/src/structs/JB721Init
 import {JB721TierConfig} from "@bananapus/721-hook-v6/src/structs/JB721TierConfig.sol";
 import {REVBaseline721HookConfig} from "../src/structs/REVBaseline721HookConfig.sol";
 import {REV721TiersHookFlags} from "../src/structs/REV721TiersHookFlags.sol";
+import {CoreDeployment, CoreDeploymentLib} from "./helpers/CoreDeploymentLib.sol";
 
 struct FeeProjectConfig {
     REVConfig configuration;
@@ -426,7 +426,7 @@ contract DeployScript is Script, Sphinx {
                 }
             }
             if (!_foundExisting) {
-                feeProjectId = core.projects.createFor(safeAddress());
+                feeProjectId = core.projects.createFor{value: core.projects.creationFee()}(safeAddress());
             }
         }
 

package/script/helpers/CoreDeploymentLib.sol

@@ -0,0 +1,172 @@
+// SPDX-License-Identifier: MIT
+pragma solidity 0.8.28;
+
+import {stdJson} from "forge-std/Script.sol";
+import {Vm} from "forge-std/Vm.sol";
+
+import {JBController} from "@bananapus/core-v6/src/JBController.sol";
+import {JBDirectory} from "@bananapus/core-v6/src/JBDirectory.sol";
+import {JBFeelessAddresses} from "@bananapus/core-v6/src/JBFeelessAddresses.sol";
+import {JBFundAccessLimits} from "@bananapus/core-v6/src/JBFundAccessLimits.sol";
+import {JBMultiTerminal} from "@bananapus/core-v6/src/JBMultiTerminal.sol";
+import {JBPermissions} from "@bananapus/core-v6/src/JBPermissions.sol";
+import {JBPrices} from "@bananapus/core-v6/src/JBPrices.sol";
+import {JBProjects} from "@bananapus/core-v6/src/JBProjects.sol";
+import {JBRulesets} from "@bananapus/core-v6/src/JBRulesets.sol";
+import {JBSplits} from "@bananapus/core-v6/src/JBSplits.sol";
+import {JBTerminalStore} from "@bananapus/core-v6/src/JBTerminalStore.sol";
+import {JBTokens} from "@bananapus/core-v6/src/JBTokens.sol";
+
+import {SphinxConstants, NetworkInfo} from "@sphinx-labs/contracts/contracts/foundry/SphinxConstants.sol";
+
+struct CoreDeployment {
+    JBPermissions permissions;
+    JBProjects projects;
+    JBDirectory directory;
+    JBSplits splits;
+    JBRulesets rulesets;
+    JBController controller;
+    JBMultiTerminal terminal;
+    JBTerminalStore terminalStore;
+    JBPrices prices;
+    JBFeelessAddresses feeless;
+    JBFundAccessLimits fundAccess;
+    JBTokens tokens;
+    address trustedForwarder;
+}
+
+library CoreDeploymentLib {
+    address internal constant VM_ADDRESS = address(uint160(uint256(keccak256("hevm cheat code"))));
+    // forge-lint: disable-next-line(screaming-snake-case-const)
+    Vm internal constant vm = Vm(VM_ADDRESS);
+    string internal constant PROJECT_NAME = "nana-core-v6";
+
+    function getDeployment(string memory path) internal returns (CoreDeployment memory deployment) {
+        uint256 chainId = block.chainid;
+
+        SphinxConstants sphinxConstants = new SphinxConstants();
+        NetworkInfo[] memory networks = sphinxConstants.getNetworkInfoArray();
+
+        for (uint256 i; i < networks.length; i++) {
+            if (networks[i].chainId == chainId) return getDeployment({path: path, networkName: networks[i].name});
+        }
+
+        revert("ChainID is not (currently) supported by Sphinx.");
+    }
+
+    function getDeployment(
+        string memory path,
+        string memory networkName
+    )
+        internal
+        returns (CoreDeployment memory deployment)
+    {
+        deployment.permissions = JBPermissions(
+            _getDeploymentAddress({
+                path: path, projectName: PROJECT_NAME, networkName: networkName, contractName: "JBPermissions"
+            })
+        );
+
+        deployment.projects = JBProjects(
+            _getDeploymentAddress({
+                path: path, projectName: PROJECT_NAME, networkName: networkName, contractName: "JBProjects"
+            })
+        );
+
+        deployment.directory = JBDirectory(
+            _getDeploymentAddress({
+                path: path, projectName: PROJECT_NAME, networkName: networkName, contractName: "JBDirectory"
+            })
+        );
+
+        deployment.splits = JBSplits(
+            _getDeploymentAddress({
+                path: path, projectName: PROJECT_NAME, networkName: networkName, contractName: "JBSplits"
+            })
+        );
+
+        deployment.rulesets = JBRulesets(
+            _getDeploymentAddress({
+                path: path, projectName: PROJECT_NAME, networkName: networkName, contractName: "JBRulesets"
+            })
+        );
+
+        deployment.controller = JBController(
+            _tryGetDeploymentAddress({
+                path: path, projectName: PROJECT_NAME, networkName: networkName, contractName: "JBController"
+            })
+        );
+
+        deployment.terminal = JBMultiTerminal(
+            _getDeploymentAddress({
+                path: path, projectName: PROJECT_NAME, networkName: networkName, contractName: "JBMultiTerminal"
+            })
+        );
+
+        deployment.terminalStore = JBTerminalStore(
+            _getDeploymentAddress({
+                path: path, projectName: PROJECT_NAME, networkName: networkName, contractName: "JBTerminalStore"
+            })
+        );
+
+        deployment.prices = JBPrices(
+            _getDeploymentAddress({
+                path: path, projectName: PROJECT_NAME, networkName: networkName, contractName: "JBPrices"
+            })
+        );
+
+        deployment.feeless = JBFeelessAddresses(
+            _getDeploymentAddress({
+                path: path, projectName: PROJECT_NAME, networkName: networkName, contractName: "JBFeelessAddresses"
+            })
+        );
+
+        deployment.fundAccess = JBFundAccessLimits(
+            _getDeploymentAddress({
+                path: path, projectName: PROJECT_NAME, networkName: networkName, contractName: "JBFundAccessLimits"
+            })
+        );
+
+        deployment.tokens = JBTokens(
+            _getDeploymentAddress({
+                path: path, projectName: PROJECT_NAME, networkName: networkName, contractName: "JBTokens"
+            })
+        );
+
+        deployment.trustedForwarder = _getDeploymentAddress({
+            path: path, projectName: PROJECT_NAME, networkName: networkName, contractName: "ERC2771Forwarder"
+        });
+    }
+
+    function _getDeploymentAddress(
+        string memory path,
+        string memory projectName,
+        string memory networkName,
+        string memory contractName
+    )
+        internal
+        view
+        returns (address)
+    {
+        string memory deploymentJson =
+        // forge-lint: disable-next-line(unsafe-cheatcode)
+        vm.readFile(string.concat(path, projectName, "/", networkName, "/", contractName, ".json"));
+        return stdJson.readAddress({json: deploymentJson, key: ".address"});
+    }
+
+    function _tryGetDeploymentAddress(
+        string memory path,
+        string memory projectName,
+        string memory networkName,
+        string memory contractName
+    )
+        internal
+        returns (address)
+    {
+        string memory filePath = string.concat(path, projectName, "/", networkName, "/", contractName, ".json");
+        // forge-lint: disable-next-line(unsafe-cheatcode)
+        if (!vm.exists(filePath)) return address(0);
+        // forge-lint: disable-next-line(unsafe-cheatcode)
+        return stdJson.readAddress({json: vm.readFile(filePath), key: ".address"});
+    }
+}

package/src/REVDeployer.sol

@@ -24,6 +24,7 @@ import {JBRulesetConfig} from "@bananapus/core-v6/src/structs/JBRulesetConfig.so
 import {JBRulesetMetadata} from "@bananapus/core-v6/src/structs/JBRulesetMetadata.sol";
 import {JBSplitGroup} from "@bananapus/core-v6/src/structs/JBSplitGroup.sol";
 import {JBTerminalConfig} from "@bananapus/core-v6/src/structs/JBTerminalConfig.sol";
+import {JBOwnable} from "@bananapus/ownable-v6/src/JBOwnable.sol";
 import {JBPermissionIds} from "@bananapus/permission-ids-v6/src/JBPermissionIds.sol";
 import {IJBSuckerRegistry} from "@bananapus/suckers-v6/src/interfaces/IJBSuckerRegistry.sol";
 import {CTPublisher} from "@croptop/core-v6/src/CTPublisher.sol";
@@ -63,6 +64,7 @@ contract REVDeployer is ERC2771Context, IREVDeployer, IERC721Receiver {
     error REVDeployer_AutoIssuanceBeneficiaryZeroAddress(uint256 stageIndex, uint256 autoIssuanceIndex);
     error REVDeployer_CashOutsCantBeTurnedOffCompletely(uint256 cashOutTaxRate, uint256 maxCashOutTaxRate);
     error REVDeployer_MustHaveSplits(uint256 stageIndex, uint256 splitPercent);
+    error REVDeployer_ProjectCreationFeeNotNeeded(uint256 revnetId, uint256 value);
     error REVDeployer_RulesetDoesNotAllowDeployingSuckers(uint256 revnetId);
     error REVDeployer_StagesRequired(uint256 stageCount);
     error REVDeployer_StageTimesMustIncrease(uint256 stageIndex, uint256 previousStageStart, uint256 effectiveStart);
@@ -345,6 +347,27 @@ contract REVDeployer is ERC2771Context, IREVDeployer, IERC721Receiver {
         }
     }
 
+    /// @notice Calculate a Uniswap V4 sqrt price, returning zero if the ratio is out of range.
+    /// @param numerator The numerator of the raw token price ratio.
+    /// @param denominator The denominator of the raw token price ratio.
+    /// @return sqrtPriceX96 The encoded sqrt price, or zero when it cannot be represented.
+    function _sqrtPriceX96From(uint256 numerator, uint256 denominator) internal pure returns (uint160 sqrtPriceX96) {
+        // Q192 is the fixed-point scale Uniswap uses before taking the square root.
+        uint256 q192 = 1 << 192;
+
+        // `mulDiv` reverts if `numerator * Q192 / denominator` exceeds uint256.
+        uint256 maxRatio = type(uint256).max / q192;
+
+        // Cap the numerator at a conservative bound that keeps the scaled ratio representable.
+        uint256 maxNumerator = denominator > type(uint256).max / maxRatio ? type(uint256).max : maxRatio * denominator;
+
+        // A zero denominator is invalid, and an out-of-range numerator means this pool price should be skipped.
+        if (denominator == 0 || numerator > maxNumerator) return 0;
+
+        // The bounded ratio fits in uint256, and its square root always fits in uint160.
+        sqrtPriceX96 = uint160(sqrt(mulDiv({x: numerator, y: q192, denominator: denominator})));
+    }
+
     /// @notice Try to initialize a Uniswap V4 buyback pool for a terminal token at its fair issuance price.
     /// @dev Called after the ERC-20 token is deployed so the pool can be initialized in the PoolManager.
     /// Computes `sqrtPriceX96` from `initialIssuance` so the pool starts at the same price as the bonding curve.
@@ -406,13 +429,15 @@ contract REVDeployer is ERC2771Context, IREVDeployer, IERC721Receiver {
                 sqrtPriceX96 = uint160(1 << 96);
             } else if (normalizedTerminalToken < projectToken) {
                 // token0 = terminal, token1 = project → price = adjustedIssuance / terminalTokenUnit
-                sqrtPriceX96 =
-                    uint160(sqrt(mulDiv({x: adjustedInitialIssuance, y: 1 << 192, denominator: terminalTokenUnit})));
+                sqrtPriceX96 = _sqrtPriceX96From({numerator: adjustedInitialIssuance, denominator: terminalTokenUnit});
             } else {
                 // token0 = project, token1 = terminal → price = terminalTokenUnit / adjustedIssuance
-                sqrtPriceX96 =
-                    uint160(sqrt(mulDiv({x: terminalTokenUnit, y: 1 << 192, denominator: adjustedInitialIssuance})));
+                sqrtPriceX96 = _sqrtPriceX96From({numerator: terminalTokenUnit, denominator: adjustedInitialIssuance});
             }
+
+            // Some extreme cross-currency prices are outside Uniswap's usable sqrt-price range. In those cases,
+            // leave the pool uninitialized instead of reverting the whole revnet deployment.
+            if (sqrtPriceX96 == 0) return;
         }
 
         try BUYBACK_HOOK.initializePoolFor({
@@ -468,6 +493,7 @@ contract REVDeployer is ERC2771Context, IREVDeployer, IERC721Receiver {
         REVCroptopAllowedPost[] calldata allowedPosts
     )
         external
+        payable
         override
         returns (uint256, IJB721TiersHook hook)
     {
@@ -475,7 +501,11 @@ contract REVDeployer is ERC2771Context, IREVDeployer, IERC721Receiver {
         bool shouldDeployNewRevnet = revnetId == 0;
 
         // If the caller is deploying a new revnet, reserve its project ID before deriving hook/sucker config.
-        if (shouldDeployNewRevnet) revnetId = PROJECTS.createFor(address(this));
+        if (shouldDeployNewRevnet) {
+            revnetId = PROJECTS.createFor{value: msg.value}(address(this));
+        } else if (msg.value != 0) {
+            revert REVDeployer_ProjectCreationFeeNotNeeded({revnetId: revnetId, value: msg.value});
+        }
 
         // Deploy the revnet with the specified tiered ERC-721 hook and croptop posting criteria.
         hook = _deploy721RevnetFor({
@@ -500,11 +530,16 @@ contract REVDeployer is ERC2771Context, IREVDeployer, IERC721Receiver {
         REVSuckerDeploymentConfig calldata suckerDeploymentConfiguration
     )
         external
+        payable
         override
         returns (uint256, IJB721TiersHook hook)
     {
         bool shouldDeployNewRevnet = revnetId == 0;
-        if (shouldDeployNewRevnet) revnetId = PROJECTS.createFor(address(this));
+        if (shouldDeployNewRevnet) {
+            revnetId = PROJECTS.createFor{value: msg.value}(address(this));
+        } else if (msg.value != 0) {
+            revert REVDeployer_ProjectCreationFeeNotNeeded({revnetId: revnetId, value: msg.value});
+        }
 
         // Deploy the revnet (project, rulesets, ERC-20, suckers, etc.).
         (bytes32 encodedConfigurationHash, REVOwnerRevnetInit memory ownerInit) = _deployRevnetFor({
@@ -528,6 +563,9 @@ contract REVDeployer is ERC2771Context, IREVDeployer, IERC721Receiver {
             });
         }
 
+        // Scope the hook's permissions to REVOwner, where the operator permissions are granted.
+        JBOwnable(address(hook)).transferOwnership(OWNER);
+
         // Grant the operator all 721 permissions (no prevent* flags for default config).
         ownerInit.extraOperatorPermissionIds = new uint256[](4);
         ownerInit.extraOperatorPermissionIds[0] = JBPermissionIds.ADJUST_721_TIERS;
@@ -630,6 +668,9 @@ contract REVDeployer is ERC2771Context, IREVDeployer, IERC721Receiver {
             salt: keccak256(abi.encode(tiered721HookConfiguration.salt, encodedConfigurationHash, _msgSender()))
         });
 
+        // Scope the hook's permissions to REVOwner, where the operator permissions are granted.
+        JBOwnable(address(hook)).transferOwnership(OWNER);
+
         // Build the 721 permission additions based on the deployer's `preventOperator*` flags.
         {
             uint256 extraCount;

package/src/REVLoans.sol

@@ -4,6 +4,7 @@ pragma solidity 0.8.28;
 import {JBPermissioned} from "@bananapus/core-v6/src/abstract/JBPermissioned.sol";
 import {IJBController} from "@bananapus/core-v6/src/interfaces/IJBController.sol";
 import {IJBDirectory} from "@bananapus/core-v6/src/interfaces/IJBDirectory.sol";
+import {IJBMultiTerminal} from "@bananapus/core-v6/src/interfaces/IJBMultiTerminal.sol";
 import {IJBPayoutTerminal} from "@bananapus/core-v6/src/interfaces/IJBPayoutTerminal.sol";
 import {IJBPermissioned} from "@bananapus/core-v6/src/interfaces/IJBPermissioned.sol";
 import {IJBPrices} from "@bananapus/core-v6/src/interfaces/IJBPrices.sol";
@@ -58,6 +59,7 @@ contract REVLoans is ERC721, ERC2771Context, JBPermissioned, Ownable, IREVLoans
 
     error REVLoans_CashOutDelayNotFinished(uint256 cashOutDelay, uint256 blockTimestamp);
     error REVLoans_CollateralExceedsLoan(uint256 collateralToReturn, uint256 loanCollateral);
+    error REVLoans_FeeOnTransferSourceUnsupported(address token, uint256 expectedAmount, uint256 creditedAmount);
     error REVLoans_InvalidAccountingContext(uint256 revnetId, address token);
     error REVLoans_InvalidPrepaidFeePercent(uint256 prepaidFeePercent, uint256 min, uint256 max);
     error REVLoans_LoanExpired(uint256 timeSinceLoanCreated, uint256 loanLiquidationDuration);
@@ -682,11 +684,20 @@ contract REVLoans is ERC721, ERC2771Context, JBPermissioned, Ownable, IREVLoans
         override
         nonReentrantLoanAction
     {
-        // Prevent cross-revnet accounting corruption: loan numbers must stay within the revnet's ID namespace.
-        uint256 endLoanNumber = startingLoanId + count;
-        if (endLoanNumber > _ONE_TRILLION) {
+        // No loans are checked when count is zero.
+        if (count == 0) return;
+
+        // Prevent cross-revnet accounting corruption: every iterated loan number must stay within the revnet's ID
+        // namespace.
+        if (startingLoanId > _ONE_TRILLION) {
             revert REVLoans_LoanIdOverflow({
-                revnetId: revnetId, loanNumber: endLoanNumber, maxLoanNumber: _ONE_TRILLION
+                revnetId: revnetId, loanNumber: startingLoanId, maxLoanNumber: _ONE_TRILLION
+            });
+        }
+        uint256 maxCount = _ONE_TRILLION - startingLoanId + 1;
+        if (count > maxCount) {
+            revert REVLoans_LoanIdOverflow({
+                revnetId: revnetId, loanNumber: _ONE_TRILLION + 1, maxLoanNumber: _ONE_TRILLION
             });
         }
 
@@ -1196,6 +1207,12 @@ contract REVLoans is ERC721, ERC2771Context, JBPermissioned, Ownable, IREVLoans
 
         // INTERACTIONS: Execute external calls with pre-computed deltas.
 
+        // Burn newly added collateral before pulling source funds so fee-project token mints from the borrow cannot
+        // be used as same-transaction collateral.
+        if (addedCollateralCount > 0) {
+            _addCollateralTo({revnetId: revnetId, amount: addedCollateralCount, holder: holder});
+        }
+
         // Add to the loan if needed...
         if (addedBorrowAmount > 0) {
             _addTo({
@@ -1210,11 +1227,8 @@ contract REVLoans is ERC721, ERC2771Context, JBPermissioned, Ownable, IREVLoans
             _removeFrom({loan: loan, revnetId: revnetId, repaidBorrowAmount: repaidBorrowAmount});
         }
 
-        // Add collateral if needed...
-        if (addedCollateralCount > 0) {
-            _addCollateralTo({revnetId: revnetId, amount: addedCollateralCount, holder: holder});
-            // ... or return collateral if needed.
-        } else if (returnedCollateralCount > 0) {
+        // Return collateral if needed.
+        if (returnedCollateralCount > 0) {
             _returnCollateralFrom({
                 revnetId: revnetId, collateralCount: returnedCollateralCount, beneficiary: beneficiary
             });
@@ -1477,8 +1491,10 @@ contract REVLoans is ERC721, ERC2771Context, JBPermissioned, Ownable, IREVLoans
     function _removeFrom(REVLoan memory loan, uint256 revnetId, uint256 repaidBorrowAmount) internal {
         address sourceToken = loan.sourceToken;
 
-        // Decrement the total amount of a token being loaned out by the revnet.
-        totalBorrowedFrom[revnetId][sourceToken] -= repaidBorrowAmount;
+        IJBMultiTerminal terminal = IJBMultiTerminal(address(TERMINAL));
+
+        // Snapshot the credited terminal balance so fee-on-transfer source tokens cannot under-repay the revnet.
+        uint256 balanceBefore = terminal.STORE().balanceOf(address(TERMINAL), revnetId, sourceToken);
 
         // Increase the allowance for the beneficiary.
         uint256 payValue = _beforeTransferTo({to: address(TERMINAL), token: sourceToken, amount: repaidBorrowAmount});
@@ -1493,6 +1509,17 @@ contract REVLoans is ERC721, ERC2771Context, JBPermissioned, Ownable, IREVLoans
             metadata: bytes(abi.encodePacked(REV_ID))
         });
 
+        uint256 creditedAmount = terminal.STORE().balanceOf(address(TERMINAL), revnetId, sourceToken) - balanceBefore;
+
+        if (creditedAmount != repaidBorrowAmount) {
+            revert REVLoans_FeeOnTransferSourceUnsupported({
+                token: sourceToken, expectedAmount: repaidBorrowAmount, creditedAmount: creditedAmount
+            });
+        }
+
+        // Decrement the total amount of a token being loaned out by the revnet.
+        totalBorrowedFrom[revnetId][sourceToken] -= repaidBorrowAmount;
+
         _afterTransferTo({to: address(TERMINAL), token: sourceToken});
     }
 

package/src/REVOwner.sol

@@ -41,8 +41,8 @@ import {REVOwnerRevnetInit} from "./structs/REVOwnerRevnetInit.sol";
 /// @notice The runtime hook for all revnets — set as every revnet's `dataHook` in ruleset metadata. At pay time, it
 /// coordinates the 721 hook (NFT tier minting) with the buyback hook (secondary market swap routing) and scales weight
 /// for split deductions. At cash-out time, it aggregates cross-chain total supply and surplus (including outstanding
-/// loan debt and collateral), grants suckers 0% tax, splits a 2.5% fee from non-sucker cash outs, and routes fee
-/// proceeds to the fee revnet via `afterCashOutRecordedWith`.
+/// loan debt and collateral), grants suckers 0% tax, splits a 2.5% fee from non-sucker cash outs with a non-zero
+/// cash-out tax, and routes fee proceeds to the fee revnet via `afterCashOutRecordedWith`.
 /// @dev Separated from `REVDeployer` to stay within the EIP-170 contract size limit. Also implements
 /// `IJBPeerChainAdjustedAccounts` to expose loan state to peer-chain supply/surplus snapshots.
 contract REVOwner is IREVOwner, IJBRulesetDataHook, IJBCashOutHook, IJBPeerChainAdjustedAccounts, IERC721Receiver {
@@ -167,12 +167,12 @@ contract REVOwner is IREVOwner, IJBRulesetDataHook, IJBCashOutHook, IJBPeerChain
 
     /// @notice Called before a cash out is recorded. Suckers get 0% tax (bridged tokens redeem at face value). For
     /// regular holders, aggregates cross-chain total supply and surplus (including outstanding loan debt/collateral),
-    /// splits a 2.5% fee from the cashed-out token count, computes bonding curve reclaims for both the holder's portion
-    /// and the fee portion, then delegates to the buyback hook for potential swap routing.
-    /// @dev Part of `IJBRulesetDataHook`. REVOwner is intentionally not registered as a feeless address — the
-    /// protocol
-    /// fee (2.5%) applies on top of the rev fee. The fee hook spec amount sent to `afterCashOutRecordedWith` will have
-    /// the protocol fee deducted by the terminal before reaching this contract.
+    /// splits a 2.5% fee from the cashed-out token count when cash-out tax is non-zero, computes bonding curve
+    /// reclaims for both the holder's portion and the fee portion, then delegates to the buyback hook for potential
+    /// swap routing.
+    /// @dev Part of `IJBRulesetDataHook`. In the non-zero-tax fee path, REVOwner is intentionally not registered as a
+    /// feeless address — the protocol fee (2.5%) applies on top of the rev fee. The fee hook spec amount sent to
+    /// `afterCashOutRecordedWith` will have the protocol fee deducted by the terminal before reaching this contract.
     /// @param context Standard Juicebox cash out context. See `JBBeforeCashOutRecordedContext`.
     /// @return cashOutTaxRate The cash out tax rate, which influences the amount of terminal tokens reclaimed.
     /// @return cashOutCount The number of revnet tokens to cash out.
@@ -232,9 +232,9 @@ contract REVOwner is IREVOwner, IJBRulesetDataHook, IJBCashOutHook, IJBPeerChain
             });
         }
 
-        // If there's no cash out tax (100% cash out tax rate), if there's no fee terminal, or if the beneficiary is
-        // feeless (e.g. the router terminal routing value between projects), proxy to the buyback hook with our
-        // totalSupply and effectiveSurplusValue.
+        // If there's no cash out tax, if there's no fee terminal, or if the beneficiary is feeless (e.g. the router
+        // terminal routing value between projects), proxy to the buyback hook with our totalSupply and
+        // effectiveSurplusValue. Zero-tax ordinary cash-outs do not add the revnet fee hook.
         if (context.cashOutTaxRate == 0 || address(feeTerminal) == address(0) || context.beneficiaryIsFeeless) {
             // Build a modified context with cross-chain-adjusted values so the buyback hook sees the global state
             // for its swap-vs-passthrough routing decision.

package/src/interfaces/IREVDeployer.sol

@@ -156,6 +156,7 @@ interface IREVDeployer {
         REVCroptopAllowedPost[] memory allowedPosts
     )
         external
+        payable
         returns (uint256, IJB721TiersHook hook);
 
     /// @notice Deploy a revnet with a default empty tiered ERC-721 hook.
@@ -173,6 +174,7 @@ interface IREVDeployer {
         REVSuckerDeploymentConfig memory suckerDeploymentConfiguration
     )
         external
+        payable
         returns (uint256, IJB721TiersHook hook);
 
     /// @notice Deploy new suckers for an existing revnet.