// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {MockIMD} from "src/MockIMD.sol";
import {ParameterizedVault} from "src/ParameterizedVault.sol";
import {Parameters} from "src/Parameters.sol";
import {Treasury} from "src/Treasury.sol";
import {ISwarmFeed} from "src/interfaces/ISwarmFeed.sol";
import {APPROVED_OPERATOR} from "src/DeploymentConfig.sol";

contract HaircutProofFeed is ISwarmFeed {
    uint256 private immutable value;
    uint256 public constant maxAge = 1 days;
    constructor(uint256 value_) { value = value_; }
    function latestValue() external view returns (uint256, uint64) { return (value, uint64(block.timestamp)); }
    function isStale() external pure returns (bool) { return false; }
}

contract HaircutEndpointsProof is Test {
    MockIMD private asset;
    HaircutProofFeed private price;
    ParameterizedVault private vault;
    Parameters private parameters;
    Treasury private treasury;

    function setUp() public {
        vm.warp(1_000_000);
        asset = new MockIMD();
        price = new HaircutProofFeed(1 ether);
        HaircutProofFeed health = new HaircutProofFeed(0.85 ether);
        HaircutProofFeed spot = new HaircutProofFeed(1 ether);
        vault = new ParameterizedVault(address(asset), address(0), address(0), address(price), address(health), address(spot));
        parameters = vault.parameters();
        treasury = vault.treasury();
        vm.prank(APPROVED_OPERATOR);
        asset.mint(address(treasury), 100 ether);
    }

    function test_zeroHaircutValuesAssetAtNothing() public {
        _list(0);
        assertEq(treasury.reserveValueUsd(), 0, "zero reserve factor must authorize no supply");
        assertEq(vault.workCeiling(), 0);
    }

    function test_tenThousandHaircutValuesAssetInFull() public {
        _list(10000);
        assertEq(treasury.reserveValueUsd(), 100 ether, "10000 reserve factor must count full value");
        assertEq(vault.workCeiling(), 100 ether);
    }

    function _list(uint256 factor) private {
        vm.prank(APPROVED_OPERATOR);
        parameters.proposeReserveAsset(asset, price, factor);
        vm.warp(parameters.pendingEta());
        parameters.applyPending();
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {MockIMD} from "src/MockIMD.sol";
import {CompToken} from "src/CompToken.sol";
import {MockWorkOracle} from "src/MockWorkOracle.sol";
import {ParameterizedVault} from "src/ParameterizedVault.sol";
import {Treasury} from "src/Treasury.sol";
import {ISwarmFeed} from "src/interfaces/ISwarmFeed.sol";
import {APPROVED_OPERATOR} from "src/DeploymentConfig.sol";

/// @dev Minimal controllable feed: fixed value, never stale.
contract ProofFeed is ISwarmFeed {
    uint256 public constant maxAge = 1 days;
    uint256 private value;
    uint64 private updatedAt;

    constructor(uint256 v) {
        value = v;
        updatedAt = uint64(block.timestamp);
    }

    function latestValue() external view returns (uint256, uint64) {
        return (value, updatedAt);
    }

    function isStale() external pure returns (bool) {
        return false;
    }
}

/// @dev A worker holding work rights and some transient IMD capital. Every step after the work
/// mint is wrapped in try/catch, so a fix that refuses any step of the round trip still lets the
/// test reach its assertion instead of reverting on the way there.
contract RoundTripWorker {
    ParameterizedVault public immutable vault;
    MockIMD public immutable imd;

    constructor(ParameterizedVault vault_, MockIMD imd_) {
        vault = vault_;
        imd = imd_;
    }

    function run(uint256 collateral, uint256 debt, uint256 work) external {
        imd.approve(address(vault), type(uint256).max);
        vault.depositCollateral(collateral);
        vault.mintCOMP(debt);
        try vault.mintFromWork(work) {} catch {}
        try vault.repayCOMP(debt) {} catch {}
        try vault.withdrawCollateral(collateral) {} catch {}
    }
}

contract WorkCeilingRoundTripTest is Test {
    MockIMD internal imd;
    ParameterizedVault internal vault;
    CompToken internal comp;
    MockWorkOracle internal oracle;
    Treasury internal treasury;
    ProofFeed internal price;
    RoundTripWorker internal worker;

    function setUp() public {
        vm.warp(1_000_000);
        imd = new MockIMD();
        price = new ProofFeed(1 ether); // 1 IMD = 1 COMP
        ProofFeed nhi = new ProofFeed(0.85 ether); // minCR 150
        ProofFeed spot = new ProofFeed(1 ether);
        vault = new ParameterizedVault(
            address(imd), address(0), address(0), address(price), address(nhi), address(spot)
        );
        comp = vault.compToken();
        oracle = MockWorkOracle(address(vault.oracle()));
        treasury = vault.treasury();
        worker = new RoundTripWorker(vault, imd);
        vm.startPrank(APPROVED_OPERATOR);
        imd.mint(address(worker), 150 ether);
        oracle.grantRights(address(worker), 25 ether);
        vm.stopPrank();
    }

    /// Backing invariant the design derives (docs/COMPUTE-BACKING-DESIGN.md s3): the assets the
    /// protocol holds (collateral in the vault at the accepted price plus the reserve) are worth
    /// at least the COMP in circulation, with the ratio term's surplus guaranteeing B >= 1.2 at an
    /// empty reserve. One transaction by a rights holder with transient capital breaks it to B = 0.
    function test_workMintSurvivesWithdrawalOfTheDebtThatBackedIt() public {
        assertEq(vault.workCeiling(), 0, "nothing backs work before the round trip");

        // deposit 150 IMD, mint 100 COMP (exactly minCR), mint 25 COMP of work against the
        // ratio term, repay the 100, withdraw the 150. All in one call.
        worker.run(150 ether, 100 ether, 25 ether);

        uint256 supply = comp.totalSupply();
        (uint256 priceNow,) = price.latestValue();
        uint256 collateralValue = imd.balanceOf(address(vault)) * priceNow / 1e18;
        uint256 backing = collateralValue + treasury.reserveValueUsd();

        // Expected: COMP in circulation is covered by what the protocol holds.
        // Actual: 25 COMP outstanding, zero collateral, zero reserve, zero debt.
        assertGe(backing, supply, "work-minted COMP outlives the collateral that authorised it");
    }

    /// Same sequence, stated as the ceiling's own promise: whatever has been minted through the work
    /// channel is within what currently backs it.
    function test_totalWorkMintedStaysWithinWorkCeilingAfterRoundTrip() public {
        worker.run(150 ether, 100 ether, 25 ether);
        assertLe(vault.totalWorkMinted(), vault.workCeiling(), "totalWorkMinted exceeds workCeiling");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {MockIMD} from "src/MockIMD.sol";
import {CompToken} from "src/CompToken.sol";
import {MockWorkOracle} from "src/MockWorkOracle.sol";
import {ParameterizedVault} from "src/ParameterizedVault.sol";
import {ISwarmFeed} from "src/interfaces/ISwarmFeed.sol";
import {APPROVED_OPERATOR} from "src/DeploymentConfig.sol";

contract SettableFeed is ISwarmFeed {
    uint256 public constant maxAge = 1 days;
    uint256 private value;
    uint64 private updatedAt;

    constructor(uint256 v) {
        set(v);
    }

    function set(uint256 v) public {
        value = v;
        updatedAt = uint64(block.timestamp);
    }

    function latestValue() external view returns (uint256, uint64) {
        return (value, updatedAt);
    }

    function isStale() external pure returns (bool) {
        return false;
    }
}

/// @dev After a crash leaves a position with debt its collateral can no longer cover, that debt
/// stays in totalDebt and keeps authorising work minting at workRatioBps, although the surplus
/// collateral the ratio term is supposed to be backed by no longer exists.
contract BadDebtInflatesCeilingTest is Test {
    address internal constant BORROWER = address(0xBA);
    address internal constant LIQUIDATOR = address(0x11);
    address internal constant WORKER = address(0xCA);

    MockIMD internal imd;
    ParameterizedVault internal vault;
    CompToken internal comp;
    MockWorkOracle internal oracle;
    SettableFeed internal price;
    SettableFeed internal nhi;
    SettableFeed internal spot;

    function setUp() public {
        vm.warp(1_000_000);
        imd = new MockIMD();
        price = new SettableFeed(1 ether);
        nhi = new SettableFeed(0.85 ether);
        spot = new SettableFeed(1 ether);
        vault = new ParameterizedVault(
            address(imd), address(0), address(0), address(price), address(nhi), address(spot)
        );
        comp = vault.compToken();
        oracle = MockWorkOracle(address(vault.oracle()));
        vm.startPrank(APPROVED_OPERATOR);
        imd.mint(BORROWER, 150 ether);
        oracle.grantRights(WORKER, 100 ether);
        vm.stopPrank();
        vm.startPrank(BORROWER);
        imd.approve(address(vault), type(uint256).max);
        vault.depositCollateral(150 ether);
        vault.mintCOMP(100 ether);
        comp.transfer(LIQUIDATOR, 100 ether);
        vm.stopPrank();
    }

    function test_residualDebtWithoutCollateralStillAuthorisesWorkMinting() public {
        // IMD halves; NHI falls so grace is zero and the position is liquidatable at once.
        price.set(0.5 ether);
        spot.set(0.5 ether);
        nhi.set(0.6 ether);
        vm.prank(LIQUIDATOR);
        vault.markUnderwater(BORROWER);
        // The largest debt the collateral can pay out at 110%: 68 COMP seizes 149.6 IMD.
        vm.prank(LIQUIDATOR);
        vault.liquidate(BORROWER, 68 ether);

        (uint256 collateralLeft, uint256 debtLeft) = vault.positions(BORROWER);
        assertEq(collateralLeft, 0.4 ether);
        assertEq(debtLeft, 32 ether);
        assertEq(vault.totalDebt(), 32 ether);
        assertGt(vault.badDebtOf(BORROWER), 31 ether, "almost all of the residual is uncovered");

        // The ratio term is "backed by the surplus collateral every borrower posts above their
        // own debt". This borrower has 0.4 IMD (worth 0.2 COMP) against 32 COMP of debt, yet the
        // ceiling credits 25% of that debt as backing for new work minting.
        uint256 ceiling = vault.workCeiling();
        uint256 coveredDebt = vault.totalDebt() - vault.badDebtOf(BORROWER);
        assertLe(
            ceiling,
            coveredDebt * vault.workRatioBps() / 10_000,
            "ceiling credits debt whose collateral is gone"
        );
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {MockIMD} from "src/MockIMD.sol";
import {CompToken} from "src/CompToken.sol";
import {MockWorkOracle} from "src/MockWorkOracle.sol";
import {ParameterizedVault} from "src/ParameterizedVault.sol";
import {CDPVault} from "src/CDPVault.sol";
import {Parameters} from "src/Parameters.sol";
import {Treasury} from "src/Treasury.sol";
import {ISwarmFeed} from "src/interfaces/ISwarmFeed.sol";
import {APPROVED_OPERATOR, CHAINLINK_ETH_USD} from "src/DeploymentConfig.sol";

/// @dev Offline stand-in for a SwarmFeed: value and staleness under test control.
contract ProofFeed is ISwarmFeed {
    uint256 public constant maxAge = 1 days;
    uint256 private value;
    uint64 private updatedAt;

    constructor(uint256 initial) {
        set(initial);
    }

    function set(uint256 next) public {
        value = next;
        updatedAt = uint64(block.timestamp);
    }

    function latestValue() external view returns (uint256, uint64) {
        return (value, updatedAt);
    }

    function isStale() external pure returns (bool) {
        return false;
    }
}

/// @dev Minimal Chainlink-shaped aggregator etched at CHAINLINK_ETH_USD.
contract ProofAggregator {
    int256 public answer;
    uint256 public updatedAt;

    function set(int256 answer_, uint256 updatedAt_) external {
        answer = answer_;
        updatedAt = updatedAt_;
    }

    function decimals() external pure returns (uint8) {
        return 8;
    }

    function latestRoundData() external view returns (uint80, int256, uint256, uint256, uint80) {
        return (1, answer, updatedAt, updatedAt, 1);
    }
}

/// @notice The work ceiling's reserve term is in USD while the vault's debt unit is the primary feed's
/// unit (wei of ETH per IMD, per the pinned PriceFeed question). The same 1000 IMD is worth 1 COMP
/// of collateral to the vault but authorises 2000 COMP of work minting as reserve.
contract CeilingUnitMismatchTest is Test {
    address internal constant BORROWER = address(0xB0);
    address internal constant WORKER = address(0xC0);

    MockIMD internal imd;
    ProofFeed internal primary;
    ProofFeed internal spot;
    ProofFeed internal health;
    ParameterizedVault internal vault;
    MockWorkOracle internal oracle;
    Parameters internal parameters;
    Treasury internal treasury;
    ProofAggregator internal ethUsd;

    // 0.001 ETH per IMD in the vault's unit; ETH at $2000 -> $2 per IMD in the Treasury's unit.
    uint256 internal constant IMD_ETH = 1e15;
    int256 internal constant ETH_USD = 2000e8;

    function setUp() public {
        vm.warp(1_000_000);
        imd = new MockIMD();
        primary = new ProofFeed(IMD_ETH);
        spot = new ProofFeed(IMD_ETH);
        health = new ProofFeed(0.85e18);
        vault = new ParameterizedVault(
            address(imd), address(0), address(0), address(primary), address(health), address(spot)
        );
        oracle = MockWorkOracle(address(vault.oracle()));
        parameters = vault.parameters();
        treasury = vault.treasury();

        ProofAggregator impl = new ProofAggregator();
        vm.etch(CHAINLINK_ETH_USD, address(impl).code);
        ethUsd = ProofAggregator(CHAINLINK_ETH_USD);
        ethUsd.set(ETH_USD, block.timestamp);

        // List IMD as a reserve asset priced by the vault's own UsdPriceFeed, full value.
        ISwarmFeed usdFeed = ISwarmFeed(address(vault.usdPriceFeed()));
        vm.prank(APPROVED_OPERATOR);
        parameters.proposeReserveAsset(IERC20(address(imd)), usdFeed, 10_000);
        vm.warp(parameters.pendingEta());
        parameters.applyPending();
        primary.set(IMD_ETH);
        spot.set(IMD_ETH);
        health.set(0.85e18);
        ethUsd.set(ETH_USD, block.timestamp);

        vm.startPrank(APPROVED_OPERATOR);
        imd.mint(address(treasury), 1000 ether);
        imd.mint(BORROWER, 1000 ether);
        oracle.grantRights(WORKER, type(uint128).max);
        vm.stopPrank();
    }

    function test_reserveTermAuthorisesMoreWorkThanTheVaultValuesTheSameCollateralAt() public {
        // The vault's own valuation of 1000 IMD: collateral * price / 1e18 = 1 COMP at 100% CR.
        uint256 vaultUnitValue = 1000 ether * IMD_ETH / 1e18;
        assertEq(vaultUnitValue, 1e18);

        // A borrower posting the identical 1000 IMD can mint at most 1 / 1.5 COMP against it.
        vm.startPrank(BORROWER);
        imd.approve(address(vault), 1000 ether);
        vault.depositCollateral(1000 ether);
        vm.expectRevert(CDPVault.UnsafeCollateralRatio.selector);
        vault.mintCOMP(vaultUnitValue);
        vault.mintCOMP(vaultUnitValue * 100 / 150);
        vm.stopPrank();

        // The reserve holding the same 1000 IMD may authorise at most what it is worth in the
        // vault's own unit, plus the ratio term on the borrower's debt (0.666 COMP * 25%).
        uint256 ratioTerm = vault.totalDebt() * vault.workRatioBps() / 10_000;
        assertLe(vault.workCeiling(), vaultUnitValue + ratioTerm, "reserve term exceeds its value in the vault's unit");

        // And a work mint past that bound must be refused.
        vm.prank(WORKER);
        vm.expectRevert(CDPVault.WorkCeilingReached.selector);
        vault.mintFromWork(vaultUnitValue + ratioTerm + 1);
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {MockIMD} from "src/MockIMD.sol";
import {CompToken} from "src/CompToken.sol";
import {MockWorkOracle} from "src/MockWorkOracle.sol";
import {ParameterizedVault} from "src/ParameterizedVault.sol";
import {CDPVault} from "src/CDPVault.sol";
import {ISwarmFeed} from "src/interfaces/ISwarmFeed.sol";
import {APPROVED_OPERATOR} from "src/DeploymentConfig.sol";

/// @dev Offline stand-in for a SwarmFeed: value under test control, never stale.
contract ProofFeed is ISwarmFeed {
    uint256 public constant maxAge = 1 days;
    uint256 private value;
    uint64 private updatedAt;

    constructor(uint256 initial) {
        set(initial);
    }

    function set(uint256 next) public {
        value = next;
        updatedAt = uint64(block.timestamp);
    }

    function latestValue() external view returns (uint256, uint64) {
        return (value, updatedAt);
    }

    function isStale() external pure returns (bool) {
        return false;
    }
}

/// @notice workCeiling's ratio term is totalDebt * workRatioBps / 10000, and totalDebt still counts
/// the principal of a position whose collateral was fully seized. That principal has no collateral
/// behind it (it is recorded in totalBadDebt), yet it authorises new work minting.
contract CeilingCountsBadDebtTest is Test {
    address internal constant BORROWER = address(0xB0);
    address internal constant LIQUIDATOR = address(0xC0);
    address internal constant WORKER = address(0xD0);

    MockIMD internal imd;
    CompToken internal comp;
    ProofFeed internal primary;
    ProofFeed internal spot;
    ProofFeed internal health;
    ParameterizedVault internal vault;
    MockWorkOracle internal oracle;

    function setUp() public {
        vm.warp(1_000_000);
        imd = new MockIMD();
        primary = new ProofFeed(1e18);
        spot = new ProofFeed(1e18);
        health = new ProofFeed(0.85e18);
        vault = new ParameterizedVault(
            address(imd), address(0), address(0), address(primary), address(health), address(spot)
        );
        comp = vault.compToken();
        oracle = MockWorkOracle(address(vault.oracle()));
        vm.startPrank(APPROVED_OPERATOR);
        imd.mint(BORROWER, 150 ether);
        oracle.grantRights(WORKER, type(uint128).max);
        vm.stopPrank();
    }

    function test_fullySeizedPositionStillBacksWorkMinting() public {
        // 150 IMD at price 1 backs 100 COMP at exactly minCR 150.
        vm.startPrank(BORROWER);
        imd.approve(address(vault), 150 ether);
        vault.depositCollateral(150 ether);
        vault.mintCOMP(100 ether);
        comp.transfer(LIQUIDATOR, 100 ether);
        vm.stopPrank();
        assertEq(vault.workCeiling(), 25 ether);

        // Price halves: 150 IMD is now worth 75 COMP against 100 COMP of debt.
        primary.set(0.5e18);
        spot.set(0.5e18);
        vault.markUnderwater(BORROWER);
        vm.warp(block.timestamp + 6 hours);
        primary.set(0.5e18);
        spot.set(0.5e18);
        health.set(0.85e18);

        // Largest coverable repayment: floor(150e18 * 0.5e18 / 1.1e18). The 1 wei remainder is swept,
        // so the position drains to zero collateral with ~31.8 COMP of principal left.
        uint256 repay = uint256(150 ether) * 5e17 / 11e17;
        vm.prank(LIQUIDATOR);
        vault.liquidate(BORROWER, repay);

        (uint256 collateral, uint256 debt) = vault.positions(BORROWER);
        assertEq(collateral, 0, "position fully drained");
        assertGt(debt, 31 ether, "debt survives with nothing behind it");
        assertEq(vault.totalBadDebt(), debt, "and is recorded as bad debt");
        assertEq(vault.totalDebt(), debt, "the only outstanding principal is that bad debt");
        assertEq(vault.treasury().reserveValueUsd(), 0, "empty reserve");

        // Nothing backs any work minting now: no collateral surplus, no reserve.
        assertEq(vault.workCeiling(), 0, "ceiling counts unbacked principal as backing");
        vm.prank(WORKER);
        vm.expectRevert(CDPVault.WorkCeilingReached.selector);
        vault.mintFromWork(1 ether);
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {ISwarmFeed} from "src/interfaces/ISwarmFeed.sol";
import {MockIMD} from "src/MockIMD.sol";
import {CDPVault} from "src/CDPVault.sol";
import {MockWorkOracle} from "src/MockWorkOracle.sol";
import {ParameterizedVault} from "src/ParameterizedVault.sol";
import {APPROVED_OPERATOR} from "src/DeploymentConfig.sol";

contract ScratchFeed is ISwarmFeed {
    uint256 public constant maxAge = 1 days;
    uint256 private value;
    uint64 private updatedAt;

    constructor(uint256 v) {
        set(v);
    }

    function set(uint256 v) public {
        value = v;
        updatedAt = uint64(block.timestamp);
    }

    function latestValue() external view returns (uint256, uint64) {
        return (value, updatedAt);
    }

    function isStale() external pure returns (bool) {
        return false;
    }
}

/// @dev Residual debt of a drained position (collateral 0, recorded in totalBadDebt) still sits in
/// totalDebt and therefore still authorises work minting through the ratio term of workCeiling.
/// Fails on the current code; passes once workCeiling's ratio term excludes realised bad debt.
contract BadDebtCeilingTest is Test {
    address private constant BORROWER = address(0xB0B);
    address private constant KEEPER = address(0xCAFE);
    address private constant WORKER = address(0xCA);

    MockIMD private imd;
    ScratchFeed private price;
    ScratchFeed private nhi;
    ScratchFeed private spot;
    ParameterizedVault private vault;
    MockWorkOracle private oracle;

    function setUp() public {
        vm.warp(1_000_000);
        imd = new MockIMD();
        price = new ScratchFeed(1 ether);
        nhi = new ScratchFeed(0.85 ether);
        spot = new ScratchFeed(1 ether);
        vault = new ParameterizedVault(address(imd), address(0), address(0), address(price), address(nhi), address(spot));
        oracle = MockWorkOracle(address(vault.oracle()));
        vm.startPrank(APPROVED_OPERATOR);
        imd.mint(BORROWER, 200 ether);
        imd.mint(KEEPER, 1_000 ether);
        oracle.grantRights(WORKER, type(uint128).max);
        vm.stopPrank();
    }

    function test_realisedBadDebtDoesNotAuthoriseWorkMinting() public {
        // Borrower: 200 IMD, 100 COMP at price 1 (CR 200%, minCR 150 at NHI 0.85).
        vm.startPrank(BORROWER);
        imd.approve(address(vault), 200 ether);
        vault.depositCollateral(200 ether);
        vault.mintCOMP(100 ether);
        vm.stopPrank();

        // Keeper: 1000 IMD, 20 COMP of liquidity to liquidate with.
        vm.startPrank(KEEPER);
        imd.approve(address(vault), 1_000 ether);
        vault.depositCollateral(1_000 ether);
        vault.mintCOMP(20 ether);
        vm.stopPrank();

        // Crash to 0.1: the borrower's 200 IMD is worth 20 COMP against 100 of debt.
        price.set(0.1 ether);
        spot.set(0.1 ether);
        vault.markUnderwater(BORROWER);
        vm.warp(block.timestamp + 6 hours);
        price.set(0.1 ether);
        spot.set(0.1 ether);
        nhi.set(0.85 ether);

        // Largest coverable repayment: seized = d * 1.1e18 / 0.1e18 = 11 d <= 200e18; the 2 wei
        // remainder is swept, so the position drains to zero collateral with debt left over.
        uint256 d = uint256(200 ether) / 11;
        vm.prank(KEEPER);
        vault.liquidate(BORROWER, d);

        (uint256 collateral, uint256 residual) = vault.positions(BORROWER);
        assertEq(collateral, 0, "position drained");
        assertGt(residual, 80 ether, "residual debt with no collateral behind it");
        assertEq(vault.totalBadDebt(), residual, "the residual is recorded as realised bad debt");

        // Expected: only collateral-backed debt (the keeper's 20 COMP) feeds the ratio term, so the
        // ceiling is 5 COMP and the first wei past it is refused.
        // Actual: the drained residual is still in totalDebt, so ~20 more COMP of work is allowed.
        assertEq(vault.workCeiling(), 20 ether * 2_500 / 10_000, "bad debt must not back work minting");
        vm.prank(WORKER);
        vm.expectRevert(CDPVault.WorkCeilingReached.selector);
        vault.mintFromWork(5 ether + 1);
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {MockIMD} from "src/MockIMD.sol";
import {CompToken} from "src/CompToken.sol";
import {MockWorkOracle} from "src/MockWorkOracle.sol";
import {ParameterizedVault} from "src/ParameterizedVault.sol";
import {ISwarmFeed} from "src/interfaces/ISwarmFeed.sol";
import {APPROVED_OPERATOR, CHAINLINK_ETH_USD} from "src/DeploymentConfig.sol";

contract ScratchFeed is ISwarmFeed {
    uint256 public constant maxAge = 1 days;
    uint256 private value;
    uint64 private updatedAt;

    constructor(uint256 v) {
        setValue(v);
    }

    function setValue(uint256 v) public {
        value = v;
        updatedAt = uint64(block.timestamp);
    }

    function latestValue() external view returns (uint256, uint64) {
        return (value, updatedAt);
    }

    function isStale() external pure returns (bool) {
        return false;
    }
}

contract ScratchAggregator {
    function decimals() external pure returns (uint8) {
        return 8;
    }

    function latestRoundData() external view returns (uint80, int256, uint256, uint256, uint80) {
        return (1, 2000e8, block.timestamp, block.timestamp, 1);
    }
}

/// @dev The work ceiling's ratio term reads totalDebt at the moment of mintFromWork only. A rights
/// holder inflates totalDebt with a same-transaction borrow, mints work against the inflated figure,
/// repays and withdraws. Afterwards totalWorkMinted exceeds workCeiling with no collateral and no
/// reserve behind the minted COMP.
contract WorkCeilingTransientDebtTest is Test {
    address internal constant WORKER = address(0xCA);
    MockIMD internal imd;
    ParameterizedVault internal vault;
    CompToken internal comp;
    MockWorkOracle internal oracle;

    function setUp() public {
        vm.warp(1_000_000);
        imd = new MockIMD();
        ScratchFeed primary = new ScratchFeed(1 ether);
        ScratchFeed health = new ScratchFeed(0.85 ether);
        ScratchFeed spot = new ScratchFeed(1 ether);
        vault = new ParameterizedVault(
            address(imd), address(0), address(0), address(primary), address(health), address(spot)
        );
        comp = vault.compToken();
        oracle = MockWorkOracle(address(vault.oracle()));
        ScratchAggregator agg = new ScratchAggregator();
        vm.etch(CHAINLINK_ETH_USD, address(agg).code);
        vm.startPrank(APPROVED_OPERATOR);
        oracle.grantRights(WORKER, 1_000 ether);
        imd.mint(WORKER, 150 ether);
        vm.stopPrank();
    }

    function test_sameTransactionBorrowLiftsCeilingThenRepayLeavesWorkUnbacked() public {
        assertEq(vault.workCeiling(), 0, "empty reserve, no debt: nothing may be work-minted");

        vm.startPrank(WORKER);
        imd.approve(address(vault), 150 ether);
        vault.depositCollateral(150 ether);
        vault.mintCOMP(100 ether); // exactly minCR 150 at price 1e18
        assertEq(vault.workCeiling(), 25 ether);
        vault.mintFromWork(25 ether); // allowed: 0 + 25 <= 25
        vault.repayCOMP(100 ether); // zero seconds elapsed, zero fee
        vault.withdrawCollateral(150 ether);
        vm.stopPrank();

        assertEq(vault.totalDebt(), 0);
        assertEq(imd.balanceOf(address(vault)), 0, "no collateral left in the vault");
        assertEq(vault.treasury().reserveValueUsd(), 0, "no reserve");
        assertEq(comp.totalSupply(), 25 ether, "25 COMP outstanding, work-minted");
        assertEq(comp.balanceOf(WORKER), 25 ether);
        assertEq(imd.balanceOf(WORKER), 150 ether, "collateral fully returned");

        // The guarantee the increment exists to give: cumulative work minting never exceeds the
        // backing that exists. It fails: ceiling is 0, work minted is 25.
        assertLe(vault.totalWorkMinted(), vault.workCeiling(), "work minted exceeds what backs it");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {MockIMD} from "src/MockIMD.sol";
import {CompToken} from "src/CompToken.sol";
import {MockWorkOracle} from "src/MockWorkOracle.sol";
import {ParameterizedVault} from "src/ParameterizedVault.sol";
import {Parameters} from "src/Parameters.sol";
import {Treasury} from "src/Treasury.sol";
import {UsdPriceFeed} from "src/UsdPriceFeed.sol";
import {ISwarmFeed} from "src/interfaces/ISwarmFeed.sol";
import {APPROVED_OPERATOR, CHAINLINK_ETH_USD} from "src/DeploymentConfig.sol";

contract ScratchFeed4 is ISwarmFeed {
    uint256 public constant maxAge = 1 days;
    uint256 private value;
    uint64 private updatedAt;

    constructor(uint256 v) {
        setValue(v);
    }

    function setValue(uint256 v) public {
        value = v;
        updatedAt = uint64(block.timestamp);
    }

    function latestValue() external view returns (uint256, uint64) {
        return (value, updatedAt);
    }

    function isStale() external pure returns (bool) {
        return false;
    }
}

contract ScratchAggregator4 {
    function decimals() external pure returns (uint8) {
        return 8;
    }

    function latestRoundData() external view returns (uint80, int256, uint256, uint256, uint80) {
        return (1, 2000e8, block.timestamp, block.timestamp, 1);
    }
}

/// @dev The vault prices collateral, debt and liquidation payouts with the IMD/ETH primary feed, so one
/// COMP of debt is one ETH of IMD in every solvency check. The ceiling's reserve term prices the same
/// IMD in USD through UsdPriceFeed. One IMD in the Treasury therefore authorises ETH/USD times more
/// COMP than the vault's own pricing says that IMD is worth.
contract ReserveUnitMismatchTest is Test {
    address internal constant WORKER = address(0xCA);
    MockIMD internal imd;
    ParameterizedVault internal vault;
    Parameters internal parameters;
    Treasury internal treasury;
    MockWorkOracle internal oracle;
    CompToken internal comp;
    ScratchFeed4 internal primary;

    function setUp() public {
        vm.warp(1_000_000);
        imd = new MockIMD();
        primary = new ScratchFeed4(1e13); // 0.00001 ETH per IMD, 1e18-scaled
        ScratchFeed4 health = new ScratchFeed4(0.85 ether);
        ScratchFeed4 spot = new ScratchFeed4(1e13);
        vault = new ParameterizedVault(
            address(imd), address(0), address(0), address(primary), address(health), address(spot)
        );
        parameters = vault.parameters();
        treasury = vault.treasury();
        oracle = MockWorkOracle(address(vault.oracle()));
        comp = vault.compToken();
        ScratchAggregator4 agg = new ScratchAggregator4();
        vm.etch(CHAINLINK_ETH_USD, address(agg).code);
        vm.startPrank(APPROVED_OPERATOR);
        oracle.grantRights(WORKER, 1_000 ether);
        imd.mint(address(treasury), 1 ether); // the protocol's reserve: one IMD
        parameters.proposeReserveAsset(IERC20(address(imd)), vault.usdPriceFeed(), 10_000);
        vm.stopPrank();
        vm.warp(parameters.pendingEta());
        parameters.applyPending();
        primary.setValue(1e13);
        spot.setValue(1e13);
    }

    function test_reserveImdAuthorisesMoreCompThanTheVaultSaysItIsWorth() public {
        // What the vault itself says one IMD is worth, in the unit it denominates debt in.
        (uint256 price,) = primary.latestValue();
        uint256 imdValueInVaultUnits = 1 ether * price / 1e18; // 1e13 wei of COMP
        uint256 ceiling = vault.workCeiling(); // 2e16 wei of COMP: 2000x more

        // Work-mint everything the reserve authorises, then see what the same COMP buys from the vault.
        vm.prank(WORKER);
        vault.mintFromWork(ceiling);
        assertEq(comp.balanceOf(WORKER), ceiling);
        // Liquidation would pay 110% of this in IMD at the primary price: 2200 IMD for the reserve's 1.
        uint256 payoutIfLiquidated = ceiling * 1.1e18 / price;
        assertGt(payoutIfLiquidated, 2_000 ether);

        assertLe(ceiling, imdValueInVaultUnits, "reserve term is in a unit 2000x larger than the debt it backs");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {MockIMD} from "src/MockIMD.sol";
import {CompToken} from "src/CompToken.sol";
import {MockWorkOracle} from "src/MockWorkOracle.sol";
import {ParameterizedVault} from "src/ParameterizedVault.sol";
import {CDPVault} from "src/CDPVault.sol";
import {Parameters} from "src/Parameters.sol";
import {Treasury} from "src/Treasury.sol";
import {ISwarmFeed} from "src/interfaces/ISwarmFeed.sol";
import {APPROVED_OPERATOR, CHAINLINK_ETH_USD} from "src/DeploymentConfig.sol";

/// @dev Offline stand-in for a SwarmFeed: value and staleness under test control.
contract ProofFeed is ISwarmFeed {
    uint256 public constant maxAge = 1 days;
    uint256 private value;
    uint64 private updatedAt;

    constructor(uint256 initial) {
        set(initial);
    }

    function set(uint256 next) public {
        value = next;
        updatedAt = uint64(block.timestamp);
    }

    function latestValue() external view returns (uint256, uint64) {
        return (value, updatedAt);
    }

    function isStale() external pure returns (bool) {
        return false;
    }
}

/// @dev Minimal Chainlink-shaped aggregator etched at CHAINLINK_ETH_USD.
contract ProofAggregator {
    int256 public answer;
    uint256 public updatedAt;

    function set(int256 answer_, uint256 updatedAt_) external {
        answer = answer_;
        updatedAt = updatedAt_;
    }

    function decimals() external pure returns (uint8) {
        return 8;
    }

    function latestRoundData() external view returns (uint80, int256, uint256, uint256, uint80) {
        return (1, answer, updatedAt, updatedAt, 1);
    }
}

/// @notice The work ceiling's reserve term is in USD while the vault's debt unit is the primary feed's
/// unit (wei of ETH per IMD, per the pinned PriceFeed question). The same 1000 IMD is worth 1 COMP
/// of collateral to the vault but authorises 2000 COMP of work minting as reserve.
contract CeilingUnitMismatchTest is Test {
    address internal constant BORROWER = address(0xB0);
    address internal constant WORKER = address(0xC0);

    MockIMD internal imd;
    ProofFeed internal primary;
    ProofFeed internal spot;
    ProofFeed internal health;
    ParameterizedVault internal vault;
    MockWorkOracle internal oracle;
    Parameters internal parameters;
    Treasury internal treasury;
    ProofAggregator internal ethUsd;

    // 0.001 ETH per IMD in the vault's unit; ETH at $2000 -> $2 per IMD in the Treasury's unit.
    uint256 internal constant IMD_ETH = 1e15;
    int256 internal constant ETH_USD = 2000e8;

    function setUp() public {
        vm.warp(1_000_000);
        imd = new MockIMD();
        primary = new ProofFeed(IMD_ETH);
        spot = new ProofFeed(IMD_ETH);
        health = new ProofFeed(0.85e18);
        vault = new ParameterizedVault(
            address(imd), address(0), address(0), address(primary), address(health), address(spot)
        );
        oracle = MockWorkOracle(address(vault.oracle()));
        parameters = vault.parameters();
        treasury = vault.treasury();

        ProofAggregator impl = new ProofAggregator();
        vm.etch(CHAINLINK_ETH_USD, address(impl).code);
        ethUsd = ProofAggregator(CHAINLINK_ETH_USD);
        ethUsd.set(ETH_USD, block.timestamp);

        // List IMD as a reserve asset priced by the vault's own UsdPriceFeed, full value.
        ISwarmFeed usdFeed = ISwarmFeed(address(vault.usdPriceFeed()));
        vm.prank(APPROVED_OPERATOR);
        parameters.proposeReserveAsset(IERC20(address(imd)), usdFeed, 10_000);
        vm.warp(parameters.pendingEta());
        parameters.applyPending();
        primary.set(IMD_ETH);
        spot.set(IMD_ETH);
        health.set(0.85e18);
        ethUsd.set(ETH_USD, block.timestamp);

        vm.startPrank(APPROVED_OPERATOR);
        imd.mint(address(treasury), 1000 ether);
        imd.mint(BORROWER, 1000 ether);
        oracle.grantRights(WORKER, type(uint128).max);
        vm.stopPrank();
    }

    function test_reserveTermAuthorisesMoreWorkThanTheVaultValuesTheSameCollateralAt() public {
        // The vault's own valuation of 1000 IMD: collateral * price / 1e18 = 1 COMP at 100% CR.
        uint256 vaultUnitValue = 1000 ether * IMD_ETH / 1e18;
        assertEq(vaultUnitValue, 1e18);

        // A borrower posting the identical 1000 IMD can mint at most 1 / 1.5 COMP against it.
        vm.startPrank(BORROWER);
        imd.approve(address(vault), 1000 ether);
        vault.depositCollateral(1000 ether);
        vm.expectRevert(CDPVault.UnsafeCollateralRatio.selector);
        vault.mintCOMP(vaultUnitValue);
        vault.mintCOMP(vaultUnitValue * 100 / 150);
        vm.stopPrank();

        // The reserve holding the same 1000 IMD may authorise at most what it is worth in the
        // vault's own unit, plus the ratio term on the borrower's debt (0.666 COMP * 25%).
        uint256 ratioTerm = vault.totalDebt() * vault.workRatioBps() / 10_000;
        assertLe(vault.workCeiling(), vaultUnitValue + ratioTerm, "reserve term exceeds its value in the vault's unit");

        // And a work mint past that bound must be refused.
        vm.prank(WORKER);
        vm.expectRevert(CDPVault.WorkCeilingReached.selector);
        vault.mintFromWork(vaultUnitValue + ratioTerm + 1);
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {MockIMD} from "src/MockIMD.sol";
import {CompToken} from "src/CompToken.sol";
import {MockWorkOracle} from "src/MockWorkOracle.sol";
import {ParameterizedVault} from "src/ParameterizedVault.sol";
import {Treasury} from "src/Treasury.sol";
import {ISwarmFeed} from "src/interfaces/ISwarmFeed.sol";
import {APPROVED_OPERATOR} from "src/DeploymentConfig.sol";

/// @dev Minimal controllable feed: fixed value, never stale.
contract ProofFeed is ISwarmFeed {
    uint256 public constant maxAge = 1 days;
    uint256 private value;
    uint64 private updatedAt;

    constructor(uint256 v) {
        value = v;
        updatedAt = uint64(block.timestamp);
    }

    function latestValue() external view returns (uint256, uint64) {
        return (value, updatedAt);
    }

    function isStale() external pure returns (bool) {
        return false;
    }
}

/// @dev A worker holding work rights and some transient IMD capital. Every step after the work
/// mint is wrapped in try/catch, so a fix that refuses any step of the round trip still lets the
/// test reach its assertion instead of reverting on the way there.
contract RoundTripWorker {
    ParameterizedVault public immutable vault;
    MockIMD public immutable imd;

    constructor(ParameterizedVault vault_, MockIMD imd_) {
        vault = vault_;
        imd = imd_;
    }

    function run(uint256 collateral, uint256 debt, uint256 work) external {
        imd.approve(address(vault), type(uint256).max);
        vault.depositCollateral(collateral);
        vault.mintCOMP(debt);
        try vault.mintFromWork(work) {} catch {}
        try vault.repayCOMP(debt) {} catch {}
        try vault.withdrawCollateral(collateral) {} catch {}
    }
}

contract WorkCeilingRoundTripTest is Test {
    MockIMD internal imd;
    ParameterizedVault internal vault;
    CompToken internal comp;
    MockWorkOracle internal oracle;
    Treasury internal treasury;
    ProofFeed internal price;
    RoundTripWorker internal worker;

    function setUp() public {
        vm.warp(1_000_000);
        imd = new MockIMD();
        price = new ProofFeed(1 ether); // 1 IMD = 1 COMP
        ProofFeed nhi = new ProofFeed(0.85 ether); // minCR 150
        ProofFeed spot = new ProofFeed(1 ether);
        vault = new ParameterizedVault(
            address(imd), address(0), address(0), address(price), address(nhi), address(spot)
        );
        comp = vault.compToken();
        oracle = MockWorkOracle(address(vault.oracle()));
        treasury = vault.treasury();
        worker = new RoundTripWorker(vault, imd);
        vm.startPrank(APPROVED_OPERATOR);
        imd.mint(address(worker), 150 ether);
        oracle.grantRights(address(worker), 25 ether);
        vm.stopPrank();
    }

    /// Backing invariant the design derives (docs/COMPUTE-BACKING-DESIGN.md s3): the assets the
    /// protocol holds (collateral in the vault at the accepted price plus the reserve) are worth
    /// at least the COMP in circulation, with the ratio term's surplus guaranteeing B >= 1.2 at an
    /// empty reserve. One transaction by a rights holder with transient capital breaks it to B = 0.
    function test_workMintSurvivesWithdrawalOfTheDebtThatBackedIt() public {
        assertEq(vault.workCeiling(), 0, "nothing backs work before the round trip");

        // deposit 150 IMD, mint 100 COMP (exactly minCR), mint 25 COMP of work against the
        // ratio term, repay the 100, withdraw the 150. All in one call.
        worker.run(150 ether, 100 ether, 25 ether);

        uint256 supply = comp.totalSupply();
        (uint256 priceNow,) = price.latestValue();
        uint256 collateralValue = imd.balanceOf(address(vault)) * priceNow / 1e18;
        uint256 backing = collateralValue + treasury.reserveValueUsd();

        // Expected: COMP in circulation is covered by what the protocol holds.
        // Actual: 25 COMP outstanding, zero collateral, zero reserve, zero debt.
        assertGe(backing, supply, "work-minted COMP outlives the collateral that authorised it");
    }

    /// Same sequence, stated as the ceiling's own promise: whatever has been minted through the work
    /// channel is within what currently backs it.
    function test_totalWorkMintedStaysWithinWorkCeilingAfterRoundTrip() public {
        worker.run(150 ether, 100 ether, 25 ether);
        assertLe(vault.totalWorkMinted(), vault.workCeiling(), "totalWorkMinted exceeds workCeiling");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {MockIMD} from "src/MockIMD.sol";
import {CompToken} from "src/CompToken.sol";
import {MockWorkOracle} from "src/MockWorkOracle.sol";
import {ParameterizedVault} from "src/ParameterizedVault.sol";
import {CDPVault} from "src/CDPVault.sol";
import {ISwarmFeed} from "src/interfaces/ISwarmFeed.sol";
import {APPROVED_OPERATOR} from "src/DeploymentConfig.sol";

/// @dev Offline stand-in for a SwarmFeed: value under test control, never stale.
contract ProofFeed is ISwarmFeed {
    uint256 public constant maxAge = 1 days;
    uint256 private value;
    uint64 private updatedAt;

    constructor(uint256 initial) {
        set(initial);
    }

    function set(uint256 next) public {
        value = next;
        updatedAt = uint64(block.timestamp);
    }

    function latestValue() external view returns (uint256, uint64) {
        return (value, updatedAt);
    }

    function isStale() external pure returns (bool) {
        return false;
    }
}

/// @notice workCeiling's ratio term is totalDebt * workRatioBps / 10000, and totalDebt still counts
/// the principal of a position whose collateral was fully seized. That principal has no collateral
/// behind it (it is recorded in totalBadDebt), yet it authorises new work minting.
contract CeilingCountsBadDebtTest is Test {
    address internal constant BORROWER = address(0xB0);
    address internal constant LIQUIDATOR = address(0xC0);
    address internal constant WORKER = address(0xD0);

    MockIMD internal imd;
    CompToken internal comp;
    ProofFeed internal primary;
    ProofFeed internal spot;
    ProofFeed internal health;
    ParameterizedVault internal vault;
    MockWorkOracle internal oracle;

    function setUp() public {
        vm.warp(1_000_000);
        imd = new MockIMD();
        primary = new ProofFeed(1e18);
        spot = new ProofFeed(1e18);
        health = new ProofFeed(0.85e18);
        vault = new ParameterizedVault(
            address(imd), address(0), address(0), address(primary), address(health), address(spot)
        );
        comp = vault.compToken();
        oracle = MockWorkOracle(address(vault.oracle()));
        vm.startPrank(APPROVED_OPERATOR);
        imd.mint(BORROWER, 150 ether);
        oracle.grantRights(WORKER, type(uint128).max);
        vm.stopPrank();
    }

    function test_fullySeizedPositionStillBacksWorkMinting() public {
        // 150 IMD at price 1 backs 100 COMP at exactly minCR 150.
        vm.startPrank(BORROWER);
        imd.approve(address(vault), 150 ether);
        vault.depositCollateral(150 ether);
        vault.mintCOMP(100 ether);
        comp.transfer(LIQUIDATOR, 100 ether);
        vm.stopPrank();
        assertEq(vault.workCeiling(), 25 ether);

        // Price halves: 150 IMD is now worth 75 COMP against 100 COMP of debt.
        primary.set(0.5e18);
        spot.set(0.5e18);
        vault.markUnderwater(BORROWER);
        vm.warp(block.timestamp + 6 hours);
        primary.set(0.5e18);
        spot.set(0.5e18);
        health.set(0.85e18);

        // Largest coverable repayment: floor(150e18 * 0.5e18 / 1.1e18). The 1 wei remainder is swept,
        // so the position drains to zero collateral with ~31.8 COMP of principal left.
        uint256 repay = uint256(150 ether) * 5e17 / 11e17;
        vm.prank(LIQUIDATOR);
        vault.liquidate(BORROWER, repay);

        (uint256 collateral, uint256 debt) = vault.positions(BORROWER);
        assertEq(collateral, 0, "position fully drained");
        assertGt(debt, 31 ether, "debt survives with nothing behind it");
        assertEq(vault.totalBadDebt(), debt, "and is recorded as bad debt");
        assertEq(vault.totalDebt(), debt, "the only outstanding principal is that bad debt");
        assertEq(vault.treasury().reserveValueUsd(), 0, "empty reserve");

        // Nothing backs any work minting now: no collateral surplus, no reserve.
        assertEq(vault.workCeiling(), 0, "ceiling counts unbacked principal as backing");
        vm.prank(WORKER);
        vm.expectRevert(CDPVault.WorkCeilingReached.selector);
        vault.mintFromWork(1 ether);
    }
}