// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {ERC20Burnable} from "@openzeppelin/contracts/token/ERC20/extensions/ERC20Burnable.sol";
import {VRFV2PlusClient} from "@chainlink/contracts/src/v0.8/vrf/dev/libraries/VRFV2PlusClient.sol";
import {BMCIlluminatiPass} from "src/BMCIlluminatiPass.sol";

/// @dev 18-decimal token with OpenZeppelin ERC20Burnable.burnFrom, like the live BMC token.
contract ProofBMC is ERC20, ERC20Burnable {
    constructor() ERC20("BMC Illuminati", "BMC") {}

    function mint(address to, uint256 amount) external {
        _mint(to, amount);
    }
}

/// @dev Minimal VRF v2.5 coordinator stand-in. Like the real coordinator it accepts every request
///      (it does not check the key hash or the subscription balance) and lets the test decide
///      which requests are ever fulfilled. Fulfilment uses the request's own callback gas limit.
contract ProofCoordinator {
    uint256 public nextRequestId = 1;
    mapping(uint256 => address) public consumerOf;
    mapping(uint256 => uint32) public callbackGasOf;

    function requestRandomWords(VRFV2PlusClient.RandomWordsRequest calldata req) external returns (uint256 id) {
        id = nextRequestId++;
        consumerOf[id] = msg.sender;
        callbackGasOf[id] = req.callbackGasLimit;
    }

    function fulfill(uint256 requestId, uint256 word) external returns (bool ok) {
        uint256[] memory words = new uint256[](1);
        words[0] = word;
        (ok,) = consumerOf[requestId].call{gas: callbackGasOf[requestId]}(
            abi.encodeWithSignature("rawFulfillRandomWords(uint256,uint256[])", requestId, words)
        );
    }
}

/// @notice A single VRF request that is never fulfilled (Chainlink expires underfunded requests
///         after 24 hours; an unregistered key hash is never fulfilled at all) must not freeze the
///         reveal of every later token forever. Token 42's holder burned 350,000 BMC, its own random
///         word has been delivered and stored, yet `finalizeReveals` can never reach it because the
///         strict mint-order loop stops at token 41, which has no word and no recovery path.
contract HeadOfLineFreezeProof is Test {
    ProofBMC bmc;
    ProofCoordinator coordinator;
    BMCIlluminatiPass pass;

    address owner = makeAddr("owner");
    address alice = makeAddr("alice");
    address bob = makeAddr("bob");

    uint256 constant GENESIS_PRICE = 1_000_000e18;
    uint256 constant MYSTERY_PRICE = 350_000e18;

    function setUp() public {
        bmc = new ProofBMC();
        coordinator = new ProofCoordinator();
        pass = new BMCIlluminatiPass(owner, address(bmc), address(coordinator));
        vm.startPrank(owner);
        pass.setGenesisImagesCID("bafyproof");
        pass.setVRFConfig(1, keccak256("500 gwei lane"), 500_000, 3, true);
        vm.stopPrank();
        for (uint256 i = 0; i < 40; i++) {
            address who = address(uint160(0x9000 + i));
            bmc.mint(who, GENESIS_PRICE);
            vm.startPrank(who);
            bmc.approve(address(pass), GENESIS_PRICE);
            pass.mintGenesis();
            vm.stopPrank();
        }
        assertEq(pass.totalMinted(), 40);
    }

    function _mintMystery(address who) internal returns (uint256 id, uint256 requestId) {
        bmc.mint(who, MYSTERY_PRICE);
        vm.startPrank(who);
        bmc.approve(address(pass), MYSTERY_PRICE);
        (id, requestId) = pass.mintMystery();
        vm.stopPrank();
    }

    function test_TokenWithDeliveredRandomnessIsNotFrozenByEarlierDeadRequest() public {
        (uint256 id41, uint256 req41) = _mintMystery(alice);
        (uint256 id42, uint256 req42) = _mintMystery(bob);
        assertEq(id41, 41);
        assertEq(id42, 42);
        assertEq(bmc.balanceOf(bob), 0, "bob's 350,000 BMC were burned");

        // Request 41 is never fulfilled (expired after 24h with an underfunded subscription, or made
        // with a key hash the coordinator has no proving key for). Request 42 is fulfilled normally.
        assertTrue(req41 != req42);
        assertTrue(coordinator.fulfill(req42, uint256(keccak256("word for 42"))));
        assertEq(uint8(pass.revealStatusOf(42)), uint8(BMCIlluminatiPass.RevealStatus.RandomnessStored));

        // Well past Chainlink's 24-hour pending window: request 41 is dead for good.
        vm.warp(block.timestamp + 30 days);
        vm.roll(block.number + 216_000);

        // Anyone tries to finalize. Expected: token 42, whose randomness is on-chain, gets revealed
        // (or some recovery path exists). Actual: nothing can ever move; 42 is Pending forever.
        pass.finalizeReveals(10);
        assertTrue(
            pass.tierOf(42) != BMCIlluminatiPass.Tier.Pending,
            "token 42 paid 350,000 BMC and has stored randomness but is frozen behind dead request 41"
        );
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {ERC20Burnable} from "@openzeppelin/contracts/token/ERC20/extensions/ERC20Burnable.sol";
import {VRFV2PlusClient} from "@chainlink/contracts/src/v0.8/vrf/dev/libraries/VRFV2PlusClient.sol";
import {BMCIlluminatiPass} from "src/BMCIlluminatiPass.sol";

contract KeyBMC is ERC20, ERC20Burnable {
    constructor() ERC20("BMC Illuminati", "BMC") {}

    function mint(address to, uint256 amount) external {
        _mint(to, amount);
    }
}

/// @dev Models the mainnet VRFCoordinatorV2_5 behaviour that matters here: it exposes the proving
///      key registry (`s_provingKeys(bytes32) -> (bool exists, uint64 maxGas)`, verified on mainnet
///      at 0xD7f86b4b8Cae7D942340FF628F82735b7a20893a) but, per its source, "does not check whether
///      the keyHash is valid to save gas ... requests for invalid keyHashes will simply not be
///      fulfilled". Only the registered 500 gwei lane can ever be fulfilled.
contract KeyRegistryCoordinator {
    struct ProvingKey {
        bool exists;
        uint64 maxGas;
    }

    bytes32 public constant REGISTERED_KEY_HASH = 0x3fd2fec10d06ee8f65e7f2e95f5c56511359ece3f33960ad8a866ae24a8ff10b;
    mapping(bytes32 => ProvingKey) public s_provingKeys;
    uint256 public nextRequestId = 1;
    mapping(uint256 => bytes32) public keyHashOf;

    constructor() {
        s_provingKeys[REGISTERED_KEY_HASH] = ProvingKey({exists: true, maxGas: 500 gwei});
    }

    function requestRandomWords(VRFV2PlusClient.RandomWordsRequest calldata req) external returns (uint256 id) {
        // No key hash validation, exactly like the real coordinator.
        id = nextRequestId++;
        keyHashOf[id] = req.keyHash;
    }
}

/// @notice A key hash the coordinator has no proving key for is accepted by `setVRFConfig` and by
///         `requestRandomWords`, so `mintMystery` burns the minter's 350,000 BMC for a request that
///         no VRF node will ever fulfil. The pass contract can check `s_provingKeys(keyHash).exists`
///         (or otherwise refuse to burn) and does not. Passes once either the configuration call or
///         the mint rejects an unregistered key hash before burning.
contract UnregisteredKeyHashProof is Test {
    KeyBMC bmc;
    KeyRegistryCoordinator coordinator;
    BMCIlluminatiPass pass;

    address owner = makeAddr("owner");
    address alice = makeAddr("alice");

    uint256 constant GENESIS_PRICE = 1_000_000e18;
    uint256 constant MYSTERY_PRICE = 350_000e18;
    // One hex digit off the real 500 gwei lane hash: a plausible copy/paste or typo.
    bytes32 constant BOGUS_KEY_HASH = 0x3fd2fec10d06ee8f65e7f2e95f5c56511359ece3f33960ad8a866ae24a8ff10c;

    function setUp() public {
        bmc = new KeyBMC();
        coordinator = new KeyRegistryCoordinator();
        pass = new BMCIlluminatiPass(owner, address(bmc), address(coordinator));
        vm.prank(owner);
        pass.setGenesisImagesCID("bafyproof");
        for (uint256 i = 0; i < 40; i++) {
            address who = address(uint160(0x9000 + i));
            bmc.mint(who, GENESIS_PRICE);
            vm.startPrank(who);
            bmc.approve(address(pass), GENESIS_PRICE);
            pass.mintGenesis();
            vm.stopPrank();
        }
    }

    function test_UnregisteredKeyHashCannotBurnBMCForAnUnfulfillableRequest() public {
        (bool exists,) = coordinator.s_provingKeys(BOGUS_KEY_HASH);
        assertFalse(exists, "precondition: coordinator has no proving key for this hash");

        vm.prank(owner);
        (bool configured,) = address(pass).call(
            abi.encodeCall(pass.setVRFConfig, (1, BOGUS_KEY_HASH, 500_000, 3, true))
        );
        if (!configured) return; // fixed at configuration time: nothing to burn

        bmc.mint(alice, MYSTERY_PRICE);
        vm.startPrank(alice);
        bmc.approve(address(pass), MYSTERY_PRICE);
        (bool minted,) = address(pass).call(abi.encodeCall(pass.mintMystery, ()));
        vm.stopPrank();

        assertFalse(minted, "mint accepted with a key hash the coordinator will never fulfil");
        assertEq(bmc.balanceOf(alice), MYSTERY_PRICE, "350,000 BMC burned for a token that can never reveal");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import "forge-std/Test.sol";
import {BMCIlluminatiPass} from "src/BMCIlluminatiPass.sol";

contract BurnableToken {
    mapping(address => uint256) public balanceOf;
    mapping(address => mapping(address => uint256)) public allowance;
    uint256 public totalSupply;

    function decimals() external pure returns (uint8) {
        return 18;
    }

    function mint(address to, uint256 a) external {
        balanceOf[to] += a;
        totalSupply += a;
    }

    function approve(address s, uint256 a) external returns (bool) {
        allowance[msg.sender][s] = a;
        return true;
    }

    function burnFrom(address from, uint256 a) external {
        allowance[from][msg.sender] -= a;
        balanceOf[from] -= a;
        totalSupply -= a;
    }
}

interface IFulfill {
    function rawFulfillRandomWords(uint256, uint256[] calldata) external;
}

/// @dev Models the mainnet VRFCoordinatorV2_5 rules that matter: createSubscription is permissionless,
///      the sub owner may add ANY consumer, requestRandomWords checks sub + consumer but not balance,
///      fulfilment only happens for a funded subscription.
contract V25LikeCoordinator {
    struct Sub {
        address owner;
        uint256 nativeBalance;
    }

    struct Req {
        address consumer;
        uint256 subId;
    }

    bytes32 public constant LANE = 0x3fd2fec10d06ee8f65e7f2e95f5c56511359ece3f33960ad8a866ae24a8ff10b;
    mapping(uint256 => Sub) public subs;
    mapping(address => mapping(uint256 => bool)) public consumers;
    mapping(uint256 => Req) public reqs;
    uint256 nonce = 1;
    uint256 nextReq = 1;

    function s_provingKeys(bytes32 k) external pure returns (bool, uint64) {
        return (k == LANE, k == LANE ? 500 gwei : 0);
    }

    function createSubscription() external returns (uint256 id) {
        id = uint256(keccak256(abi.encode(msg.sender, nonce++)));
        subs[id].owner = msg.sender;
    }

    function addConsumer(uint256 id, address c) external {
        require(subs[id].owner == msg.sender, "only sub owner");
        consumers[c][id] = true;
    }

    function fundSubscriptionWithNative(uint256 id) external payable {
        subs[id].nativeBalance += msg.value;
    }

    struct RandomWordsRequest {
        bytes32 keyHash;
        uint256 subId;
        uint16 requestConfirmations;
        uint32 callbackGasLimit;
        uint32 numWords;
        bytes extraArgs;
    }

    function requestRandomWords(RandomWordsRequest calldata r) external returns (uint256 id) {
        require(subs[r.subId].owner != address(0), "InvalidSubscription");
        require(consumers[msg.sender][r.subId], "InvalidConsumer");
        id = nextReq++;
        reqs[id] = Req(msg.sender, r.subId);
    }

    /// @dev What a Chainlink node does: fulfil only if the subscription can pay.
    function nodeFulfil(uint256 id, uint256 word) external returns (bool) {
        if (subs[reqs[id].subId].nativeBalance == 0) return false;
        uint256[] memory w = new uint256[](1);
        w[0] = word;
        IFulfill(reqs[id].consumer).rawFulfillRandomWords(id, w);
        return true;
    }
}

contract StrangerSubBlocksSeedTest is Test {
    BMCIlluminatiPass pass;
    BurnableToken bmc;
    V25LikeCoordinator vrf;
    uint256 projectSub;
    address projectOwner = address(0xA11CE);
    address minter = address(0xB0B);
    address griefer = address(0xBAD);

    function setUp() public {
        bmc = new BurnableToken();
        vrf = new V25LikeCoordinator();
        vm.prank(projectOwner);
        projectSub = vrf.createSubscription();
        pass = new BMCIlluminatiPass(projectOwner, address(bmc), address(vrf), projectSub);
        vm.prank(projectOwner);
        vrf.addConsumer(projectSub, address(pass));
        vm.deal(projectOwner, 1 ether);
        vm.prank(projectOwner);
        vrf.fundSubscriptionWithNative{value: 1 ether}(projectSub);

        bmc.mint(minter, 1_000_000_000e18);
        vm.startPrank(minter);
        bmc.approve(address(pass), type(uint256).max);
        for (uint256 i; i < 40; ++i) pass.mintGenesis();
        pass.mintMystery();
        vm.stopPrank();
        vm.warp(block.timestamp + 30 days); // sale closed by idle rule
    }

    function test_StrangerWithUnfundedSubKeepsSeedFromEverArriving() public {
        // Griefer: free subscription, never funded, lists the pass as consumer.
        vm.startPrank(griefer);
        uint256 junkSub = vrf.createSubscription();
        vrf.addConsumer(junkSub, address(pass));
        vm.stopPrank();

        for (uint256 round; round < 5; ++round) {
            // Griefer wins the race the moment a request becomes possible.
            vm.prank(griefer);
            uint256 dead = pass.requestSeedWith(junkSub, pass.KEY_HASH());
            assertFalse(vrf.nodeFulfil(dead, 123), "unfunded request never fulfilled");

            // The honest, funded request on the configured subscription is refused for 36 hours.
            vm.prank(projectOwner);
            (bool ok,) = address(pass).call(abi.encodeCall(BMCIlluminatiPass.requestSeed, ()));
            // Expected: a request on the funded configured subscription is always possible
            // when the outstanding one cannot be paid for. Actual: SeedRequestPending.
            assertTrue(ok, "honest funded seed request blocked by stranger's unfunded request");
            vm.warp(block.timestamp + 36 hours);
        }
        assertTrue(pass.seedSet());
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {ERC20Burnable} from "@openzeppelin/contracts/token/ERC20/extensions/ERC20Burnable.sol";
import {VRFV2PlusClient} from "@chainlink/contracts/src/v0.8/vrf/dev/libraries/VRFV2PlusClient.sol";
import {BMCIlluminatiPass} from "src/BMCIlluminatiPass.sol";

/// @dev 18-decimal token with OpenZeppelin burnFrom, like mainnet BMC.
contract GriefMockBMC is ERC20, ERC20Burnable {
    constructor() ERC20("BMC Illuminati", "BMC") {}

    function mint(address to, uint256 amount) external {
        _mint(to, amount);
    }
}

/// @dev Coordinator stand-in with the three mainnet VRFCoordinatorV2_5 properties that matter here:
///      1. `createSubscription` is permissionless and `addConsumer` is sub-owner only, so a stranger can
///         register the pass as a consumer of a subscription they own, without funding it;
///      2. `requestRandomWords` checks the consumer entry but not the subscription balance, and does not
///         validate the key hash;
///      3. a request from an unfunded subscription is never fulfilled (the node's fulfilment would revert
///         with InsufficientBalance), so `fulfill` refuses it here.
contract GriefMockCoordinator {
    bytes32 public constant REGISTERED_KEY_HASH = 0x3fd2fec10d06ee8f65e7f2e95f5c56511359ece3f33960ad8a866ae24a8ff10b;

    struct Req {
        address consumer;
        uint256 subId;
    }

    uint256 public nextSubId = 1;
    uint256 public nextRequestId = 1000;
    mapping(uint256 => address) public subOwner;
    mapping(uint256 => uint256) public subNativeBalance;
    mapping(uint256 => mapping(address => bool)) public isConsumer;
    mapping(uint256 => Req) public requests;

    function s_provingKeys(bytes32 keyHash) external pure returns (bool exists, uint64 maxGas) {
        if (keyHash == REGISTERED_KEY_HASH) return (true, 500 gwei);
        return (false, 0);
    }

    function createSubscription() external returns (uint256 subId) {
        subId = nextSubId++;
        subOwner[subId] = msg.sender;
    }

    function createSubscriptionWithId(uint256 subId) external {
        require(subOwner[subId] == address(0), "exists");
        subOwner[subId] = msg.sender;
    }

    function addConsumer(uint256 subId, address consumer) external {
        require(subOwner[subId] == msg.sender, "not sub owner");
        isConsumer[subId][consumer] = true;
    }

    function fundSubscriptionWithNative(uint256 subId) external payable {
        require(subOwner[subId] != address(0), "InvalidSubscription");
        subNativeBalance[subId] += msg.value;
    }

    function requestRandomWords(VRFV2PlusClient.RandomWordsRequest calldata req) external returns (uint256 id) {
        require(subOwner[req.subId] != address(0), "InvalidSubscription");
        require(isConsumer[req.subId][msg.sender], "InvalidConsumer");
        // No balance check and no key-hash check, like the mainnet coordinator.
        id = nextRequestId++;
        requests[id] = Req({consumer: msg.sender, subId: req.subId});
    }

    /// @dev The node only fulfils requests whose subscription can pay.
    function fulfill(uint256 requestId, uint256 word) external returns (bool ok) {
        Req memory r = requests[requestId];
        require(r.consumer != address(0), "unknown request");
        require(subNativeBalance[r.subId] > 0, "InsufficientBalance: node will not fulfil");
        uint256[] memory words = new uint256[](1);
        words[0] = word;
        (ok,) = r.consumer.call{gas: 500_000}(
            abi.encodeWithSignature("rawFulfillRandomWords(uint256,uint256[])", requestId, words)
        );
    }
}

/// @notice A stranger with an unfunded subscription can keep the configured, funded subscription from
///         ever requesting the seed: every `requestSeedWith` call arms the same 36-hour lock that
///         `requestSeed` is subject to, and the coordinator never fulfils the stranger's request.
contract RecoveryLockGriefTest is Test {
    GriefMockBMC bmc;
    GriefMockCoordinator vrf;
    BMCIlluminatiPass pass;

    address owner = makeAddr("owner");
    address subOwner = makeAddr("subOwner");
    address keeper = makeAddr("keeper");
    address attacker = makeAddr("attacker");
    address holder = makeAddr("holder");

    uint256 constant SUB_ID = 27852459484169864437638942739291618120641810244677084392617474192083559562985;
    bytes32 constant KEY_HASH = 0x3fd2fec10d06ee8f65e7f2e95f5c56511359ece3f33960ad8a866ae24a8ff10b;

    uint256 attackerSub;

    function setUp() public {
        vm.warp(1_760_000_000);
        bmc = new GriefMockBMC();
        vrf = new GriefMockCoordinator();
        pass = new BMCIlluminatiPass(owner, address(bmc), address(vrf), SUB_ID);

        // The configured subscription: created, lists the pass as consumer, funded with ETH.
        vm.startPrank(subOwner);
        vrf.createSubscriptionWithId(SUB_ID);
        vrf.addConsumer(SUB_ID, address(pass));
        vm.stopPrank();
        vm.deal(subOwner, 10 ether);
        vm.prank(subOwner);
        vrf.fundSubscriptionWithNative{value: 1 ether}(SUB_ID);

        // The attacker's subscription: created, lists the pass as consumer, never funded.
        vm.startPrank(attacker);
        attackerSub = vrf.createSubscription();
        vrf.addConsumer(attackerSub, address(pass));
        vm.stopPrank();

        // Sell the Genesis phase and one mystery token, then let the sale close by the idle rule.
        for (uint256 i = 0; i < 40; i++) {
            address who = address(uint160(0x1000 + i));
            bmc.mint(who, 1_000_000e18);
            vm.startPrank(who);
            bmc.approve(address(pass), 1_000_000e18);
            pass.mintGenesis();
            vm.stopPrank();
        }
        bmc.mint(holder, 350_000e18);
        vm.startPrank(holder);
        bmc.approve(address(pass), 350_000e18);
        pass.mintMystery();
        vm.stopPrank();
        vm.warp(block.timestamp + pass.SALE_IDLE_TIMEOUT());
        assertTrue(pass.saleClosed());
    }

    /// @dev The attacker's call is made through a raw call so that the test still compiles and passes if
    ///      the fix removes or restricts `requestSeedWith`; the assertion is only that the honest,
    ///      funded request is not refused.
    function _attackerRequests() internal {
        vm.prank(attacker);
        (bool ok,) =
            address(pass).call(abi.encodeWithSignature("requestSeedWith(uint256,bytes32)", attackerSub, KEY_HASH));
        ok; // ignored on purpose
    }

    function test_StrangerWithUnfundedSubscriptionCannotBlockConfiguredRequest() public {
        // Sale just closed. The attacker front-runs the keeper with a request the node will never fulfil.
        _attackerRequests();

        // Expected: the funded, configured subscription can still request the seed.
        // Actual on the current code: SeedRequestPending(retryAt) for the next 36 hours.
        vm.prank(keeper);
        uint256 id = pass.requestSeed();
        assertTrue(pass.isSeedRequest(id));
        assertTrue(vrf.fulfill(id, 777));
        assertTrue(pass.seedSet());
    }

    function test_StrangerCanRepeatTheLockEveryTimeout() public {
        _attackerRequests();
        // The keeper waits out the lock; at the first second it opens the attacker repeats the request.
        vm.warp(block.timestamp + pass.SEED_REQUEST_TIMEOUT());
        _attackerRequests();
        vm.warp(block.timestamp + pass.SEED_REQUEST_TIMEOUT());
        _attackerRequests();

        // Expected: the configured subscription is not shut out indefinitely at the cost of one call per 36 h.
        vm.prank(keeper);
        uint256 id = pass.requestSeed();
        assertTrue(vrf.fulfill(id, 777));
        assertTrue(pass.seedSet());
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {BMCIlluminatiPass} from "src/BMCIlluminatiPass.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {ERC20Burnable} from "@openzeppelin/contracts/token/ERC20/extensions/ERC20Burnable.sol";
import {VRFV2PlusClient} from "@chainlink/contracts/src/v0.8/vrf/dev/libraries/VRFV2PlusClient.sol";

contract ProofBMC is ERC20, ERC20Burnable {
    constructor() ERC20("BMC Illuminati", "BMC") {}

    function mint(address to, uint256 amount) external {
        _mint(to, amount);
    }
}

/// @dev Stand-in for the mainnet VRFCoordinatorV2_5: the proving-key registry exists, and a request is
///      accepted for any subscription that lists the caller as consumer, whatever its balance
///      (balance is only checked at fulfilment). Subscriptions are created permissionlessly.
contract ProofCoordinator {
    struct Sub {
        address owner;
        uint96 nativeBalance;
        mapping(address => bool) consumer;
    }

    uint256 public nextRequestId = 1;
    uint256 public nextSubId = 1;
    mapping(uint256 => Sub) internal subs;
    mapping(uint256 => uint256) public subOfRequest;

    function s_provingKeys(bytes32) external pure returns (bool exists, uint64 maxGas) {
        return (true, 500 gwei);
    }

    function createSubscription() external returns (uint256 subId) {
        subId = nextSubId++;
        subs[subId].owner = msg.sender;
    }

    /// @dev Test helper: register a subscription under a chosen id (on mainnet the coordinator derives
    ///      the id; this mock lets the test use the configured id directly).
    function createSubscriptionWithId(uint256 subId) external {
        require(subs[subId].owner == address(0), "exists");
        subs[subId].owner = msg.sender;
    }

    function addConsumer(uint256 subId, address consumer) external {
        require(subs[subId].owner == msg.sender, "not sub owner");
        subs[subId].consumer[consumer] = true;
    }

    function fundSubscriptionWithNative(uint256 subId) external payable {
        subs[subId].nativeBalance += uint96(msg.value);
    }

    function getSubscription(uint256 subId)
        external
        view
        returns (uint96 balance, uint96 nativeBalance, uint64 reqCount, address owner, address[] memory consumers)
    {
        Sub storage s = subs[subId];
        return (0, s.nativeBalance, 0, s.owner, consumers);
    }

    function requestRandomWords(VRFV2PlusClient.RandomWordsRequest calldata req) external returns (uint256 id) {
        require(subs[req.subId].owner != address(0), "InvalidSubscription");
        require(subs[req.subId].consumer[msg.sender], "InvalidConsumer");
        id = nextRequestId++;
        subOfRequest[id] = req.subId;
    }
}

/// @notice A stranger with an unfunded subscription can open the single 36-hour request window before
///         the configured subscription and block `requestSeed()` for 36 hours, repeatedly.
///         Fails on the current code (`requestSeed()` reverts with `SeedRequestPending`); passes once a
///         request from the configured subscription is no longer blocked by a foreign, unfunded one
///         (or once an unfunded foreign subscription is refused).
contract ForeignSubscriptionBlocksSeedTest is Test {
    ProofBMC bmc;
    ProofCoordinator vrf;
    BMCIlluminatiPass pass;

    uint256 constant SUB_ID = 27852459484169864437638942739291618120641810244677084392617474192083559562985;
    bytes32 constant KEY_HASH = 0x3fd2fec10d06ee8f65e7f2e95f5c56511359ece3f33960ad8a866ae24a8ff10b;

    address owner = makeAddr("owner");
    address alice = makeAddr("alice");
    address griefer = makeAddr("griefer");
    address keeper = makeAddr("keeper");

    uint256 grieferSub;

    function setUp() public {
        vm.warp(1_760_000_000);
        bmc = new ProofBMC();
        vrf = new ProofCoordinator();
        pass = new BMCIlluminatiPass(owner, address(bmc), address(vrf), SUB_ID);

        // The configured subscription: created by the project, pass added as consumer, funded.
        vm.startPrank(owner);
        vrf.createSubscriptionWithId(SUB_ID);
        vrf.addConsumer(SUB_ID, address(pass));
        vm.stopPrank();
        vm.deal(owner, 1 ether);
        vm.prank(owner);
        vrf.fundSubscriptionWithNative{value: 1 ether}(SUB_ID);
        (, uint96 configuredBalance,,,) = vrf.getSubscription(SUB_ID);
        assertEq(configuredBalance, 1 ether);

        // The griefer's subscription: created permissionlessly, pass added as consumer, never funded.
        vm.prank(griefer);
        grieferSub = vrf.createSubscription();
        vm.prank(griefer);
        vrf.addConsumer(grieferSub, address(pass));

        for (uint256 i = 0; i < 40; i++) {
            address who = address(uint160(0x1000 + i));
            bmc.mint(who, 1_000_000e18);
            vm.startPrank(who);
            bmc.approve(address(pass), 1_000_000e18);
            pass.mintGenesis();
            vm.stopPrank();
        }
        bmc.mint(alice, 350_000e18);
        vm.startPrank(alice);
        bmc.approve(address(pass), 350_000e18);
        pass.mintMystery();
        vm.stopPrank();

        vm.warp(block.timestamp + pass.SALE_IDLE_TIMEOUT());
        assertTrue(pass.saleClosed());
    }

    function test_ConfiguredSubscriptionRequestIsNotBlockedByUnfundedForeignRequest() public {
        // The griefer is first in the block the sale closes: a request from the unfunded subscription.
        // Whether the contract accepts or refuses it must not matter to the configured path.
        vm.prank(griefer);
        try pass.requestSeedWith(grieferSub, KEY_HASH) {} catch {}

        (, uint96 grieferBalance,,,) = vrf.getSubscription(grieferSub);
        assertEq(grieferBalance, 0, "griefer paid nothing into the subscription");

        // A keeper requests from the configured, funded subscription in the same block.
        // Current code: reverts SeedRequestPending(now + 36 hours).
        vm.prank(keeper);
        uint256 requestId = pass.requestSeed();
        assertEq(vrf.subOfRequest(requestId), SUB_ID, "request must come from the configured subscription");
        assertTrue(pass.isSeedRequest(requestId));
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {ERC20Burnable} from "@openzeppelin/contracts/token/ERC20/extensions/ERC20Burnable.sol";
import {VRFV2PlusClient} from "@chainlink/contracts/src/v0.8/vrf/dev/libraries/VRFV2PlusClient.sol";
import {BMCIlluminatiPass} from "src/BMCIlluminatiPass.sol";

contract ProofBMC is ERC20, ERC20Burnable {
    constructor() ERC20("BMC Illuminati", "BMC") {}

    function mint(address to, uint256 amount) external {
        _mint(to, amount);
    }
}

interface IRawFulfill {
    function rawFulfillRandomWords(uint256 requestId, uint256[] calldata randomWords) external;
}

/// @dev Models the mainnet VRFCoordinatorV2_5 behaviour that matters here: a request is accepted
///      from any subscription that lists the caller as consumer, whatever its balance, and is only
///      fulfilled (by the node) once the subscription can pay. Here subscription 1 is the funded one
///      the pass is configured with; subscription 2 belongs to the griefer and is never funded.
contract ProofCoordinator {
    bytes32 public constant REGISTERED_KEY_HASH = 0x3fd2fec10d06ee8f65e7f2e95f5c56511359ece3f33960ad8a866ae24a8ff10b;
    uint256 public nextRequestId = 1000;
    mapping(uint256 => address) public consumerOf;
    mapping(uint256 => uint256) public subOf;
    mapping(uint256 => bool) public fulfilled;

    function s_provingKeys(bytes32 keyHash) external pure returns (bool exists, uint64 maxGas) {
        return (keyHash == REGISTERED_KEY_HASH, 500 gwei);
    }

    function requestRandomWords(VRFV2PlusClient.RandomWordsRequest calldata req) external returns (uint256 id) {
        id = nextRequestId++;
        consumerOf[id] = msg.sender;
        subOf[id] = req.subId;
    }

    /// @dev The node only fulfils requests whose subscription can pay (subscription 1 here).
    function fulfillFundedRequests(uint256 word) external returns (uint256 delivered) {
        for (uint256 id = 1000; id < nextRequestId; id++) {
            if (fulfilled[id] || subOf[id] != 1) continue;
            fulfilled[id] = true;
            uint256[] memory words = new uint256[](1);
            words[0] = word;
            (bool ok,) = consumerOf[id].call{gas: 500_000}(
                abi.encodeCall(IRawFulfill.rawFulfillRandomWords, (id, words))
            );
            require(ok, "callback failed");
            delivered++;
        }
    }
}

/// @notice Finding: a stranger can reset the 36-hour seed timer with a request the coordinator will
///         never fulfil (from an unfunded subscription of their own that lists the pass as consumer),
///         blocking `requestSeed()` from the funded configured subscription, and can repeat it every
///         36 hours. Expected: a request charged to a foreign subscription must not block the
///         configured path (or must not be accepted while unfunded). Actual: `requestSeed()` reverts
///         with `SeedRequestPending` for 36 hours after every griefer request.
contract SeedTimerGriefingProof is Test {
    ProofBMC bmc;
    ProofCoordinator vrf;
    BMCIlluminatiPass pass;

    address owner = makeAddr("owner");
    address holder = makeAddr("holder");
    address griefer = makeAddr("griefer");
    uint256 constant CONFIGURED_SUB = 1;
    uint256 constant GRIEFER_SUB = 2;
    bytes32 constant KEY_HASH = 0x3fd2fec10d06ee8f65e7f2e95f5c56511359ece3f33960ad8a866ae24a8ff10b;

    function setUp() public {
        vm.warp(1_760_000_000);
        bmc = new ProofBMC();
        vrf = new ProofCoordinator();
        pass = new BMCIlluminatiPass(owner, address(bmc), address(vrf), CONFIGURED_SUB);
        for (uint256 i = 0; i < 40; i++) {
            address who = address(uint160(0x1000 + i));
            bmc.mint(who, 1_000_000e18);
            vm.startPrank(who);
            bmc.approve(address(pass), 1_000_000e18);
            pass.mintGenesis();
            vm.stopPrank();
        }
        bmc.mint(holder, 350_000e18);
        vm.startPrank(holder);
        bmc.approve(address(pass), 350_000e18);
        pass.mintMystery();
        vm.stopPrank();
        vm.warp(block.timestamp + pass.SALE_IDLE_TIMEOUT());
        assertTrue(pass.saleClosed());
    }

    /// @dev The griefer's request may be refused by a fixed contract; whether it is accepted or not,
    ///      the configured-subscription request must still go through.
    function _grieferRequests() internal {
        vm.prank(griefer);
        (bool ok,) = address(pass).call(abi.encodeCall(pass.requestSeedWith, (GRIEFER_SUB, KEY_HASH)));
        ok; // accepted on the current code; a fix may refuse it instead
    }

    function test_ForeignUnfundedRequestMustNotBlockTheConfiguredSubscription() public {
        _grieferRequests();
        // Same block, the holder asks for the seed from the funded, configured subscription.
        vm.prank(holder);
        uint256 req = pass.requestSeed();
        assertTrue(pass.isSeedRequest(req));
        // The node fulfils the funded request; the seed lands.
        assertEq(vrf.fulfillFundedRequests(42), 1);
        assertTrue(pass.seedSet());
        assertEq(pass.seed(), 42);
    }

    function test_GrieferCannotKeepTheSeedPendingAcrossCycles() public {
        bool holderEverSucceeded;
        // Three griefing cycles: the griefer front-runs the holder the moment the timer allows,
        // every 36 hours; the holder tries one hour later each time.
        for (uint256 cycle = 0; cycle < 3; cycle++) {
            _grieferRequests();
            vm.warp(block.timestamp + 1 hours);
            vm.prank(holder);
            (bool ok,) = address(pass).call(abi.encodeCall(pass.requestSeed, ()));
            holderEverSucceeded = holderEverSucceeded || ok;
            // The node never fulfils subscription 2; only a configured-subscription request lands.
            vrf.fulfillFundedRequests(7);
            vm.warp(block.timestamp + pass.SEED_REQUEST_TIMEOUT() - 1 hours);
        }
        assertTrue(holderEverSucceeded, "configured-subscription request blocked for 108 hours by foreign requests");
        assertTrue(pass.seedSet(), "seed never delivered");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {ERC20Burnable} from "@openzeppelin/contracts/token/ERC20/extensions/ERC20Burnable.sol";
import {VRFV2PlusClient} from "@chainlink/contracts/src/v0.8/vrf/dev/libraries/VRFV2PlusClient.sol";
import {BMCIlluminatiPass} from "src/BMCIlluminatiPass.sol";

/// @dev 18-decimal token with OpenZeppelin burnFrom, like the mainnet BMC token.
contract ProofBMC is ERC20, ERC20Burnable {
    constructor() ERC20("BMC Illuminati", "BMC") {}

    function mint(address to, uint256 amount) external {
        _mint(to, amount);
    }
}

/// @dev Stand-in for the mainnet VRF v2.5 coordinator, reproducing the three rules this finding
///      depends on (all taken from VRFCoordinatorV2_5 / SubscriptionAPI):
///        1. anyone can `createSubscription` and `addConsumer` any address to it;
///        2. `requestRandomWords` checks only that the caller is a consumer of the subscription and
///           that the subscription exists; the balance is checked at fulfilment, so a request from
///           an unfunded subscription is accepted and then sits pending (Chainlink drops it after
///           24 hours, never fulfilled);
///        3. `s_provingKeys(bytes32)` exposes the registered gas lanes.
contract ProofCoordinator {
    struct Sub {
        address owner;
        uint96 nativeBalance;
        mapping(address => bool) consumer;
    }

    uint256 public nextSubId = 1;
    uint256 public nextRequestId = 1;
    mapping(uint256 => Sub) internal subs;
    mapping(bytes32 => bool) public registeredLane;
    mapping(uint256 requestId => address consumer) public requestConsumer;
    mapping(uint256 requestId => uint256 subId) public requestSub;

    constructor(bytes32 lane) {
        registeredLane[lane] = true;
    }

    function s_provingKeys(bytes32 keyHash) external view returns (bool exists, uint64 maxGas) {
        return (registeredLane[keyHash], registeredLane[keyHash] ? 500 gwei : 0);
    }

    function createSubscription() external returns (uint256 subId) {
        subId = nextSubId++;
        subs[subId].owner = msg.sender;
    }

    function addConsumer(uint256 subId, address consumer) external {
        require(subs[subId].owner == msg.sender, "not sub owner");
        subs[subId].consumer[consumer] = true;
    }

    function fundSubscriptionWithNative(uint256 subId) external payable {
        subs[subId].nativeBalance += uint96(msg.value);
    }

    /// @dev Same ABI as the mainnet coordinator's `getSubscription`.
    function getSubscription(uint256 subId)
        external
        view
        returns (uint96 balance, uint96 nativeBalance, uint64 reqCount, address owner, address[] memory consumers)
    {
        return (0, subs[subId].nativeBalance, 0, subs[subId].owner, new address[](0));
    }

    function nativeBalanceOf(uint256 subId) external view returns (uint96) {
        return subs[subId].nativeBalance;
    }

    function requestRandomWords(VRFV2PlusClient.RandomWordsRequest calldata req) external returns (uint256 id) {
        require(subs[req.subId].owner != address(0), "InvalidSubscription");
        require(subs[req.subId].consumer[msg.sender], "InvalidConsumer");
        id = nextRequestId++;
        requestConsumer[id] = msg.sender;
        requestSub[id] = req.subId;
    }

    /// @dev A node only fulfils when the subscription can pay; an unfunded one is never fulfilled.
    function fulfill(uint256 requestId, uint256 word) external returns (bool ok) {
        require(subs[requestSub[requestId]].nativeBalance >= 0.01 ether, "InsufficientBalance");
        subs[requestSub[requestId]].nativeBalance -= 0.01 ether;
        uint256[] memory words = new uint256[](1);
        words[0] = word;
        (ok,) = requestConsumer[requestId].call{gas: 500_000}(
            abi.encodeWithSignature("rawFulfillRandomWords(uint256,uint256[])", requestId, words)
        );
    }
}

/// @notice Finding: a stranger can hold the reveal hostage for as long as they like by requesting
///         the seed from their own unfunded subscription (`requestSeedWith`) first in every 36-hour
///         window. The configured, funded subscription is then refused with `SeedRequestPending`
///         until the next window, where the stranger repeats. No ETH is ever spent by the attacker:
///         an unfunded request is accepted by the coordinator and never fulfilled.
///
///         Expected: a request that the configured subscription can pay for is not blocked by an
///         unfunded foreign request (either the foreign unfunded request is refused, or it does not
///         start the shared timeout for the configured path). Actual: `requestSeed()` reverts with
///         `SeedRequestPending` and the seed is delayed indefinitely at zero cost.
contract SeedRequestGriefingProofTest is Test {
    bytes32 constant KEY_HASH = 0x3fd2fec10d06ee8f65e7f2e95f5c56511359ece3f33960ad8a866ae24a8ff10b;

    ProofBMC bmc;
    ProofCoordinator vrf;
    BMCIlluminatiPass pass;
    uint256 subId;

    address owner = makeAddr("owner");
    address subOwner = makeAddr("subscriptionOwner");
    address attacker = makeAddr("attacker");
    address holder = makeAddr("holder");

    function setUp() public {
        vm.warp(1_760_000_000);
        bmc = new ProofBMC();
        vrf = new ProofCoordinator(KEY_HASH);
        vm.prank(subOwner);
        subId = vrf.createSubscription();
        pass = new BMCIlluminatiPass(owner, address(bmc), address(vrf), subId);
        vm.prank(subOwner);
        vrf.addConsumer(subId, address(pass));
        vm.deal(subOwner, 1 ether);
        vm.prank(subOwner);
        vrf.fundSubscriptionWithNative{value: 1 ether}(subId);

        for (uint256 i = 0; i < 40; i++) {
            address who = address(uint160(0x1000 + i));
            bmc.mint(who, 1_000_000e18);
            vm.startPrank(who);
            bmc.approve(address(pass), 1_000_000e18);
            pass.mintGenesis();
            vm.stopPrank();
        }
        bmc.mint(holder, 350_000e18);
        vm.startPrank(holder);
        bmc.approve(address(pass), 350_000e18);
        pass.mintMystery();
        vm.stopPrank();
        vm.warp(block.timestamp + pass.SALE_IDLE_TIMEOUT());
        assertTrue(pass.saleClosed());
    }

    function test_UnfundedForeignSubscriptionCannotBlockTheFundedConfiguredRequest() public {
        // Attacker: own subscription, pass added as consumer, never funded.
        vm.startPrank(attacker);
        uint256 attackerSub = vrf.createSubscription();
        vrf.addConsumer(attackerSub, address(pass));
        assertEq(vrf.nativeBalanceOf(attackerSub), 0);
        vm.stopPrank();

        // The attacker front-runs the honest request the moment the sale closes. Whether the fix
        // refuses this request or lets it through without blocking the configured path, the honest
        // request below must succeed in the same window.
        vm.prank(attacker);
        try pass.requestSeedWith(attackerSub, KEY_HASH) returns (uint256 req) {
            // Accepted by the coordinator, never fulfilled: the subscription cannot pay.
            vm.expectRevert(bytes("InsufficientBalance"));
            vrf.fulfill(req, 1);
        } catch {}

        // The honest, funded, configured request must still be possible without waiting 36 hours.
        vm.prank(holder);
        uint256 honest = pass.requestSeed();
        assertEq(vrf.requestSub(honest), subId, "request belongs to the funded subscription");
        assertTrue(vrf.fulfill(honest, 12345), "funded subscription is fulfilled");
        assertTrue(pass.seedSet(), "seed delivered without waiting for the attacker's timeout");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {BMCIlluminatiPass} from "src/BMCIlluminatiPass.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {ERC20Burnable} from "@openzeppelin/contracts/token/ERC20/extensions/ERC20Burnable.sol";
import {VRFV2PlusClient} from "@chainlink/contracts/src/v0.8/vrf/dev/libraries/VRFV2PlusClient.sol";

contract ProofBMC is ERC20, ERC20Burnable {
    constructor() ERC20("BMC Illuminati", "BMC") {}

    function mint(address to, uint256 amount) external {
        _mint(to, amount);
    }
}

/// @dev Stand-in for the mainnet VRFCoordinatorV2_5: the proving-key registry exists, and a request is
///      accepted for any subscription that lists the caller as consumer, whatever its balance
///      (balance is only checked at fulfilment). Subscriptions are created permissionlessly.
contract ProofCoordinator {
    struct Sub {
        address owner;
        uint96 nativeBalance;
        mapping(address => bool) consumer;
    }

    uint256 public nextRequestId = 1;
    uint256 public nextSubId = 1;
    mapping(uint256 => Sub) internal subs;
    mapping(uint256 => uint256) public subOfRequest;

    function s_provingKeys(bytes32) external pure returns (bool exists, uint64 maxGas) {
        return (true, 500 gwei);
    }

    function createSubscription() external returns (uint256 subId) {
        subId = nextSubId++;
        subs[subId].owner = msg.sender;
    }

    /// @dev Test helper: register a subscription under a chosen id (on mainnet the coordinator derives
    ///      the id; this mock lets the test use the configured id directly).
    function createSubscriptionWithId(uint256 subId) external {
        require(subs[subId].owner == address(0), "exists");
        subs[subId].owner = msg.sender;
    }

    function addConsumer(uint256 subId, address consumer) external {
        require(subs[subId].owner == msg.sender, "not sub owner");
        subs[subId].consumer[consumer] = true;
    }

    function fundSubscriptionWithNative(uint256 subId) external payable {
        subs[subId].nativeBalance += uint96(msg.value);
    }

    function getSubscription(uint256 subId)
        external
        view
        returns (uint96 balance, uint96 nativeBalance, uint64 reqCount, address owner, address[] memory consumers)
    {
        Sub storage s = subs[subId];
        return (0, s.nativeBalance, 0, s.owner, consumers);
    }

    function requestRandomWords(VRFV2PlusClient.RandomWordsRequest calldata req) external returns (uint256 id) {
        require(subs[req.subId].owner != address(0), "InvalidSubscription");
        require(subs[req.subId].consumer[msg.sender], "InvalidConsumer");
        id = nextRequestId++;
        subOfRequest[id] = req.subId;
    }
}

/// @notice A stranger with an unfunded subscription can open the single 36-hour request window before
///         the configured subscription and block `requestSeed()` for 36 hours, repeatedly.
///         Fails on the current code (`requestSeed()` reverts with `SeedRequestPending`); passes once a
///         request from the configured subscription is no longer blocked by a foreign, unfunded one
///         (or once an unfunded foreign subscription is refused).
contract ForeignSubscriptionBlocksSeedTest is Test {
    ProofBMC bmc;
    ProofCoordinator vrf;
    BMCIlluminatiPass pass;

    uint256 constant SUB_ID = 27852459484169864437638942739291618120641810244677084392617474192083559562985;
    bytes32 constant KEY_HASH = 0x3fd2fec10d06ee8f65e7f2e95f5c56511359ece3f33960ad8a866ae24a8ff10b;

    address owner = makeAddr("owner");
    address alice = makeAddr("alice");
    address griefer = makeAddr("griefer");
    address keeper = makeAddr("keeper");

    uint256 grieferSub;

    function setUp() public {
        vm.warp(1_760_000_000);
        bmc = new ProofBMC();
        vrf = new ProofCoordinator();
        pass = new BMCIlluminatiPass(owner, address(bmc), address(vrf), SUB_ID);

        // The configured subscription: created by the project, pass added as consumer, funded.
        vm.startPrank(owner);
        vrf.createSubscriptionWithId(SUB_ID);
        vrf.addConsumer(SUB_ID, address(pass));
        vm.stopPrank();
        vm.deal(owner, 1 ether);
        vm.prank(owner);
        vrf.fundSubscriptionWithNative{value: 1 ether}(SUB_ID);
        (, uint96 configuredBalance,,,) = vrf.getSubscription(SUB_ID);
        assertEq(configuredBalance, 1 ether);

        // The griefer's subscription: created permissionlessly, pass added as consumer, never funded.
        vm.prank(griefer);
        grieferSub = vrf.createSubscription();
        vm.prank(griefer);
        vrf.addConsumer(grieferSub, address(pass));

        for (uint256 i = 0; i < 40; i++) {
            address who = address(uint160(0x1000 + i));
            bmc.mint(who, 1_000_000e18);
            vm.startPrank(who);
            bmc.approve(address(pass), 1_000_000e18);
            pass.mintGenesis();
            vm.stopPrank();
        }
        bmc.mint(alice, 350_000e18);
        vm.startPrank(alice);
        bmc.approve(address(pass), 350_000e18);
        pass.mintMystery();
        vm.stopPrank();

        vm.warp(block.timestamp + pass.SALE_IDLE_TIMEOUT());
        assertTrue(pass.saleClosed());
    }

    function test_ConfiguredSubscriptionRequestIsNotBlockedByUnfundedForeignRequest() public {
        // The griefer is first in the block the sale closes: a request from the unfunded subscription.
        // Whether the contract accepts or refuses it must not matter to the configured path.
        vm.prank(griefer);
        try pass.requestSeedWith(grieferSub, KEY_HASH) {} catch {}

        (, uint96 grieferBalance,,,) = vrf.getSubscription(grieferSub);
        assertEq(grieferBalance, 0, "griefer paid nothing into the subscription");

        // A keeper requests from the configured, funded subscription in the same block.
        // Current code: reverts SeedRequestPending(now + 36 hours).
        vm.prank(keeper);
        uint256 requestId = pass.requestSeed();
        assertEq(vrf.subOfRequest(requestId), SUB_ID, "request must come from the configured subscription");
        assertTrue(pass.isSeedRequest(requestId));
    }
}