// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {ImdUSD} from "src/ImdUSD.sol";
import {Parameters} from "src/Parameters.sol";
import {ParametersBase} from "src/ParametersBase.sol";
import {Pricer} from "src/Pricer.sol";
import {Treasury, ICoverable} from "src/Treasury.sol";
import {PositionNFT} from "src/PositionNFT.sol";
import {Ledger} from "src/Ledger.sol";
import {IPulse} from "src/LedgerBase.sol";
import {Redeemer} from "src/Redeemer.sol";
import {Liquidator} from "src/Liquidator.sol";
import {Migrator} from "src/Migrator.sol";
import {Join} from "src/Join.sol";
import {IFeed} from "src/interfaces/IFeed.sol";
import {Adjust} from "src/interfaces/IPositions.sol";

contract Tok is ERC20 {
    constructor() ERC20("wstETH", "wstETH") {}
    function mint(address to, uint256 a) external { _mint(to, a); }
}

contract Feed is IFeed {
    uint256 public value;
    uint64 public at;
    constructor(uint256 v) { set(v); }
    function set(uint256 v) public { value = v; at = uint64(block.timestamp); }
    function latestValue() external view returns (uint256, uint64) { return (value, at); }
    function isStale() external view returns (bool) { return value == 0 || block.timestamp - at > 1 hours; }
    function maxAge() external pure returns (uint256) { return 1 hours; }
}

/// @dev The yield source the Ledger harvests against (Config.yieldRate): a share rate, 1e18.
contract RateSrc {
    uint256 public rate = 1e18;
    function set(uint256 r) external { rate = r; }
}

/// @notice Liquidation health ignores the position's pending harvest. On a yield type (beta: WSTETH, mat 145%,
/// yieldFee 10%) the yield shares accrued since the last touch are still in the position; every touch harvests them
/// (collateral -Y, debt -0.9*Y*P), which RAISES the ratio when 0.9*mat > 1. `Ledger.healthy` and `liquidatePosition`
/// read `_debtOf` without harvesting, so a position that is healthy after its own pending harvest is liquidated with
/// the full 10% penalty. Expected: `liquidate` reverts Healthy (as it does once anyone calls `harvest` first).
contract ProofLiquidationIgnoresHarvest is Test {
    bytes32 constant WSTETH = "WSTETH";
    address governor = makeAddr("governor");
    address alice = makeAddr("alice");
    address keeper = makeAddr("keeper");

    ImdUSD usd;
    Parameters params;
    Pricer pricer;
    Treasury treasury;
    Ledger ledger;
    Liquidator liquidator;
    Tok wsteth;
    Feed feed;
    RateSrc rateSrc;
    Join join;

    function setUp() public {
        vm.warp(1_800_000_000);
        wsteth = new Tok();
        feed = new Feed(2000e18);
        rateSrc = new RateSrc();
        usd = new ImdUSD(address(this), 10_000_000e18);
        params = new Parameters(governor, address(this));
        pricer = new Pricer(params);
        treasury = new Treasury(governor, IERC20(address(usd)), address(this));
        PositionNFT nft = new PositionNFT(address(this));
        ledger = new Ledger(usd, params, pricer, address(treasury), address(this), IPulse(address(0)), nft);
        nft.bind(address(ledger));
        Redeemer redeemer = new Redeemer(ledger);
        liquidator = new Liquidator(ledger, pricer);
        ledger.wire(address(redeemer), address(liquidator));
        Migrator migrator = new Migrator(IERC20(address(new Tok())), usd, params);
        usd.wire(address(ledger), address(migrator), address(params));
        params.wire(address(ledger), address(usd));
        treasury.wire(ICoverable(address(ledger)));

        join = new Join(address(wsteth), address(this));
        join.wire(address(ledger));
        // BetaConfig WSTETH: mat 145%, chop 10%, cut 50%, chip 10%, rateFloor 1%, yieldFee 10%, skew 5%, dust 100.
        params.addGenesisIlk(
            WSTETH,
            ParametersBase.Config({
                token: address(wsteth),
                join: address(join),
                median: feed,
                spot: feed,
                nhi: IFeed(address(0)),
                yieldRate: address(rateSrc),
                pegAggregator: address(0),
                liveSpot: IFeed(address(0)),
                redeemable: true,
                auction: false
            }),
            ParametersBase.Risk({
                mat: 1.45e18, chop: 0.1e18, cut: 0.5e18, chip: 0.1e18, rateFloor: 0.01e18, yieldFee: 0.1e18,
                skew: 0.05e18, pegFloor: 0, line: 50_000e18, dust: 100e18, redeemFloor: 0.005e18, redeemDivisor: 2,
                redeemCap: 0
            })
        );
        params.seal();

        wsteth.mint(alice, 10e18);
        vm.prank(alice);
        wsteth.approve(address(ledger), type(uint256).max);
    }

    function test_healthyAfterPendingHarvestIsLiquidated() public {
        // Alice: 10 wstETH at $2,000, 13,700 imdUSD of debt: CR 146% > 145%.
        vm.prank(alice);
        uint256 id = ledger.open(WSTETH, 0, Adjust(10e18, 13_700e18, 0.01e18, 0, 0, false, type(uint256).max, address(0)));

        // A year later the share rate has grown 3% (wstETH's staking yield). Nobody touched the position.
        vm.warp(block.timestamp + 365 days);
        rateSrc.set(1.03e18);
        feed.set(1995e18); // the market dips 0.25%; the year of 1% interest (debt 13,837) did the rest

        // Pending harvest (what ANY touch would do): Y = 10 * 0.03 / 1.03 = 0.2913 shares off the collateral,
        // 0.9 * Y * 1995 = 523 imdUSD off the debt. Before it: 19,950 < 13,837 * 1.45 = 20,064 (unhealthy).
        // After it: 9.7087 * 1995 = 19,369 >= (13,837 - 523) * 1.45 = 19,305 (healthy).
        uint256 debt = ledger.debtOf(id);
        uint256 yieldShares = uint256(10e18) * uint256(0.03e18) / uint256(1.03e18);
        uint256 credit = yieldShares * 1995e18 / 1e18 * 0.9e18 / 1e18;
        bool healthyAfterHarvest = (10e18 - yieldShares) * 1995e18 / 1e18 >= (debt - credit) * 1.45e18 / 1e18;
        assertTrue(healthyAfterHarvest, "the position is healthy once its own yield is harvested");
        (bool okNow,) = ledger.healthy(id);
        assertFalse(okNow, "but the Ledger reads it unhealthy: the pending harvest is ignored");

        // A keeper liquidates it at once, with the 10% penalty: it pays the debt and takes collateral worth 110% of it.
        deal(address(usd), keeper, 20_000e18);
        vm.prank(keeper);
        usd.approve(address(ledger), type(uint256).max);
        vm.prank(keeper);
        // EXPECTED: Healthy() (the position is healthy at the protocol's own accounting). ACTUAL: liquidated.
        vm.expectRevert(Liquidator.Healthy.selector);
        liquidator.liquidate(id);
    }

    function test_sameStateAfterHarvestIsNotLiquidatable() public {
        vm.prank(alice);
        uint256 id = ledger.open(WSTETH, 0, Adjust(10e18, 13_700e18, 0.01e18, 0, 0, false, type(uint256).max, address(0)));
        vm.warp(block.timestamp + 365 days);
        rateSrc.set(1.03e18);
        feed.set(1995e18);
        uint256[] memory ids = new uint256[](1);
        ids[0] = id;
        ledger.harvest(WSTETH, ids); // anyone's harvest first: the same position, the same block
        (bool ok,) = ledger.healthy(id);
        assertTrue(ok, "healthy after the harvest");
        vm.expectRevert(Liquidator.Healthy.selector);
        liquidator.liquidate(id);
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {ImdUSD} from "src/ImdUSD.sol";
import {ParametersBase} from "src/ParametersBase.sol";
import {Parameters} from "src/Parameters.sol";
import {Pricer} from "src/Pricer.sol";
import {Treasury, ICoverable} from "src/Treasury.sol";
import {PositionNFT} from "src/PositionNFT.sol";
import {Ledger, IPulse} from "src/Ledger.sol";
import {LedgerBase} from "src/LedgerBase.sol";
import {Redeemer} from "src/Redeemer.sol";
import {Liquidator} from "src/Liquidator.sol";
import {Migrator} from "src/Migrator.sol";
import {Join} from "src/Join.sol";
import {IFeed} from "src/interfaces/IFeed.sol";
import {Adjust} from "src/interfaces/IPositions.sol";

contract PLToken is ERC20 {
    constructor() ERC20("WETH", "WETH") {}
    function mint(address to, uint256 a) external { _mint(to, a); }
}

contract PLFeed is IFeed {
    uint256 public value;
    uint64 public updatedAt;
    constructor(uint256 v) { value = v; updatedAt = uint64(block.timestamp); }
    function set(uint256 v) external { value = v; updatedAt = uint64(block.timestamp); }
    function latestValue() external view returns (uint256, uint64) { return (value, updatedAt); }
    function isStale() external view returns (bool) { return block.timestamp - updatedAt > 365 days; }
    function maxAge() external pure returns (uint256) { return 365 days; }
}

/// @dev Q3: the C2 rule says debt added inside the cooldown of a charged rate change pays RATE_COOLDOWN of interest at the
/// rate BEFORE that change ("a dust reopen followed by a top-up costs what one reopen does"). Two in-cooldown setRate
/// calls on a dust-sized debt overwrite `premiumRate` with the freely chosen intermediate rate, so the top-up pays the
/// premium at that rate (here 2%) instead of the original 10%.
contract ProofPremiumLaunder is Test {
    bytes32 constant ETH = "ETH";
    address governor = makeAddr("governor");
    address alice = makeAddr("alice");

    ImdUSD usd;
    Parameters params;
    Pricer pricer;
    Treasury treasury;
    Ledger ledger;
    PLToken weth;
    PLFeed feed;

    function setUp() public {
        vm.warp(1_800_000_000);
        weth = new PLToken();
        feed = new PLFeed(2000e18);
        PLToken v1 = new PLToken();

        usd = new ImdUSD(address(this), 10_000_000e18);
        params = new Parameters(governor, address(this));
        pricer = new Pricer(params);
        treasury = new Treasury(governor, IERC20(address(usd)), address(this));
        PositionNFT nft_ = new PositionNFT(address(this));
        ledger = new Ledger(usd, params, pricer, address(treasury), address(this), IPulse(address(0)), nft_);
        nft_.bind(address(ledger));
        Redeemer redeemer = new Redeemer(ledger);
        Liquidator liquidator = new Liquidator(ledger, pricer);
        ledger.wire(address(redeemer), address(liquidator));
        Migrator migrator = new Migrator(IERC20(address(v1)), usd, params);
        usd.wire(address(ledger), address(migrator), address(params));
        params.wire(address(ledger), address(usd));
        treasury.wire(ICoverable(address(ledger)));

        Join join = new Join(address(weth), address(this));
        join.wire(address(ledger));
        params.addGenesisIlk(
            ETH,
            ParametersBase.Config({
                token: address(weth), join: address(join), median: feed, spot: feed, nhi: IFeed(address(0)),
                yieldRate: address(0), pegAggregator: address(0), liveSpot: IFeed(address(0)), redeemable: true, auction: false
            }),
            ParametersBase.Risk({
                mat: 1.4e18, chop: 0.1e18, cut: 0.5e18, chip: 0.1e18, rateFloor: 0.01e18, yieldFee: 0, skew: 0.05e18,
                pegFloor: 0, line: 1_000_000e18, dust: 100e18, redeemFloor: 0.005e18, redeemDivisor: 2, redeemCap: 0
            })
        );
        params.seal();

        weth.mint(alice, 100e18);
        vm.startPrank(alice);
        weth.approve(address(ledger), type(uint256).max);
        vm.stopPrank();
    }

    function _premium(uint256 amount, uint256 rate) internal pure returns (uint256) {
        return (amount * rate * 7 days + 365 days * 1e18 - 1) / (365 days * 1e18);
    }

    function test_twoInCooldownRateChangesLaunderThePremiumRate() public {
        uint256 id = ledger.positionId(alice, ETH, 0);
        // Alice borrows 10,000 at 10%: lastRateChange = now, so a change inside 7 days is charged at 10%.
        vm.prank(alice);
        ledger.open(ETH, 0, Adjust(int256(100e18), int256(10_000e18), 0.10e18, 0, 0, false, type(uint256).max, address(0)));
        vm.warp(block.timestamp + 1 days);

        // The honest price of dropping 10,000 of debt from 10% to 1% inside the cooldown: 7 days at 10%.
        uint256 honest = _premium(10_000e18, 0.10e18);

        // 1. Repay down to dust (free, no price needed).
        uint256 debt = ledger.debtOf(id);
        vm.prank(alice);
        ledger.adjust(id, Adjust(0, -int256(debt - 101e18), 0, 0, 0, false, type(uint256).max, address(0)));
        assertApproxEqAbs(ledger.debtOf(id), 101e18, 1);

        // 2. Two rate changes on the dust: 10% -> 2% (charged at 10% on 101) then 2% -> 1% (charged at 2% on ~101).
        vm.startPrank(alice);
        ledger.setRate(id, 0.02e18, 0, 0);
        ledger.setRate(id, 0.01e18, 0, 0);
        vm.stopPrank();
        LedgerBase.Position memory p = ledger.position(id);
        assertEq(p.rate, 0.01e18);
        uint256 dust = p.debt;
        uint256 paidSoFar = dust - 101e18; // the two tiny premiums (about 0.19 + 0.04 imdUSD)

        // 3. Top up the 9,900 back inside the cooldown.
        ledger.accrue(ETH);
        uint256 upfront = ledger.upfrontFeeFor(ETH, 9_899e18, 0.01e18);
        vm.prank(alice);
        ledger.adjust(id, Adjust(0, int256(9_899e18), 0, 0, 0, false, type(uint256).max, address(0)));
        uint256 topUpPremium = ledger.debtOf(id) - dust - 9_899e18 - upfront;

        emit log_named_uint("honest premium (7d at 10% on 10,000)", honest);
        emit log_named_uint("premiumRate after the two changes   ", p.premiumRate);
        emit log_named_uint("premium charged on the 9,899 top-up ", topUpPremium);
        emit log_named_uint("total premium paid over the sequence", topUpPremium + paidSoFar);

        // Documented rule (LedgerBase 125-127, Ledger 281-283): the top-up pays at the rate BEFORE the charged change (10%).
        // Actual: `premiumRate` is the freely chosen intermediate rate (2%), and the top-up pays about a fifth.
        assertEq(p.premiumRate, 0.10e18, "premiumRate should still be the rate the cooldown was entered at");
        assertGe(topUpPremium + paidSoFar, honest, "the sequence must cost at least one honest rate change");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {System} from "../utils/System.sol";
import {MockERC20, MockFeed} from "../utils/Mocks.sol";
import {ParametersBase} from "../../src/ParametersBase.sol";
import {Ledger} from "../../src/Ledger.sol";
import {LedgerBase} from "../../src/LedgerBase.sol";
import {Join} from "../../src/Join.sol";
import {IFeed} from "../../src/interfaces/IFeed.sol";
import {Adjust} from "../../src/interfaces/IPositions.sol";

/// @dev Permissions panel proofs: each test encodes the property the code's own NatSpec claims and fails on this commit.
contract ProofPermissionsTest is System {
    bytes32 constant ETH = "ETH";

    MockERC20 weth;
    MockERC20 v1;
    MockFeed feed;
    Join ethJoin;

    address alice = makeAddr("alice");
    address bob = makeAddr("bob");

    function setUp() public {
        vm.warp(1_800_000_000);
        weth = new MockERC20("WETH", 18);
        v1 = new MockERC20("imdUSDv1", 18);
        feed = new MockFeed(2000e18);
        _deploySystem(IERC20(address(v1)));
        ethJoin = _addIlk(ETH, address(weth), feed, feed, IFeed(address(0)), address(0), address(0), true, _risk(1.4e18, 1_000_000e18));
        params.setGenesisCap(ETH, 1500e18); // a borrow price ceiling below the market (Sky's capped OSM)
        params.seal();
        address[2] memory us = [alice, bob];
        for (uint256 i; i < 2; ++i) {
            weth.mint(us[i], 1000e18);
            vm.prank(us[i]);
            weth.approve(address(ledger), type(uint256).max);
        }
    }

    function _open(address u, uint256 salt, uint256 coll, uint256 debt, uint64 rate) internal returns (uint256 id) {
        vm.prank(u);
        id = ledger.open(ETH, salt, Adjust(int256(coll), int256(debt), rate, 0, 0, false, type(uint256).max, address(0)));
    }

    /// Pricer.sol:28-29 and ParametersBase.sol:196-197 say a CHARGED RATE CHANGE is measured at `borrow = min(low, cap)`.
    /// Ledger.setRate measures it at the uncapped `low` (Ledger.sol:168): with the cap binding, a borrow of 1 wei is
    /// refused (Unhealthy) while a charged rate change adds premium debt to the same position.
    function test_chargedRateChangeIgnoresBorrowCap() public {
        uint256 id = _open(alice, 0, 10e18, 10_000e18, 0.05e18); // CR at the cap (1500): 150%
        vm.prank(governor);
        params.lowerCap(ETH, 1300e18); // CR at the cap: 130% < mat 140%; at `low` (2000): 200%
        vm.prank(alice);
        vm.expectRevert(LedgerBase.Unhealthy.selector);
        ledger.adjust(id, Adjust(0, 1, 0, 0, 0, false, type(uint256).max, address(0)));
        uint256 before = ledger.debtOf(id);
        vm.prank(alice);
        vm.expectRevert(LedgerBase.Unhealthy.selector); // what the Pricer/Parameters NatSpec promises
        ledger.setRate(id, 0.06e18, 0, 0);
        assertEq(ledger.debtOf(id), before, "no premium debt added below the capped health line");
    }

    /// LedgerBase.sol:164-166 and :320-321: while `unbacked()` is past the brake, "no new debt on any type". `_adjust`
    /// checks the brake on a borrow (Ledger.sol:301); `setRate`'s charged premium adds debt without it (Ledger.sol:159-166).
    function test_chargedRateChangeBypassesUnbackedBrake() public {
        uint256 a = _open(alice, 0, 10e18, 10_000e18, 0.05e18); // CR at the cap (1500): 150%
        uint256 b = _open(bob, 0, 100e18, 20_000e18, 0.05e18);
        feed.set(500e18); // alice: 10 ETH = 5,000 against ~10,010 of debt; bob stays at CR 250%
        vm.prank(bob);
        liquidator.liquidate(a); // bob pays 5,000, ~5,010 is booked bad debt; the Treasury covers only its ~29 of fees
        assertGt(ledger.unbacked(), usd.circulating() / 100, "braked");
        vm.prank(bob);
        vm.expectRevert(LedgerBase.Braked.selector);
        ledger.adjust(b, Adjust(0, 1, 0, 0, 0, false, type(uint256).max, address(0)));
        uint256 before = ledger.debtOf(b);
        vm.prank(bob);
        vm.expectRevert(LedgerBase.Braked.selector); // expected: Braked, as for any other new debt
        ledger.setRate(b, 0.06e18, 0, 0);
        assertEq(ledger.debtOf(b), before, "no new debt while braked");
    }

    /// LedgerBase.sol:126-127: "reopening at another rate inside the cooldown pays the premium (a flash mint cannot
    /// launder a rate drop)". It holds for the same id only: repay, withdraw, and reopen under a fresh salt pays the
    /// upfront fee at the type's average (the new rate itself when the type is otherwise empty), half the premium here.
    function test_freshSaltDropsRateBelowOldRatePremium() public {
        uint256 id0 = _open(alice, 0, 10e18, 10_000e18, 0.10e18);
        vm.prank(address(ledger));
        usd.mint(alice, 100e18); // covers the upfront fee so the repayment can clear the debt
        uint256 premium = (10_000e18 * uint256(0.10e18) * 7 days + 365 days * 1e18 - 1) / (365 days * 1e18);
        vm.startPrank(alice);
        ledger.repayFor(id0, type(uint256).max);
        ledger.adjust(id0, Adjust(-10e18, 0, 0, 0, 0, false, 0, address(0)));
        uint256 id1 = ledger.open(ETH, 1, Adjust(10e18, 10_000e18, 0.05e18, 0, 0, false, type(uint256).max, address(0)));
        vm.stopPrank();
        uint256 feePaid = ledger.debtOf(id1) - 10_000e18;
        emit log_named_uint("setRate premium (7d at 10%)", premium);
        emit log_named_uint("fresh-salt fee (7d at 5%)", feePaid);
        assertGe(feePaid, premium, "a rate drop costs at least 7 days at the old rate");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {System} from "../utils/System.sol";
import {MockERC20, MockFeed} from "../utils/Mocks.sol";
import {ParametersBase} from "../../src/ParametersBase.sol";
import {Ledger} from "../../src/Ledger.sol";
import {LedgerBase} from "../../src/LedgerBase.sol";
import {Join} from "../../src/Join.sol";
import {IFeed} from "../../src/interfaces/IFeed.sol";
import {Adjust} from "../../src/interfaces/IPositions.sol";

/// @dev Permissions panel proofs: each test encodes the property the code's own NatSpec claims and fails on this commit.
contract ProofPermissionsTest is System {
    bytes32 constant ETH = "ETH";

    MockERC20 weth;
    MockERC20 v1;
    MockFeed feed;
    Join ethJoin;

    address alice = makeAddr("alice");
    address bob = makeAddr("bob");

    function setUp() public {
        vm.warp(1_800_000_000);
        weth = new MockERC20("WETH", 18);
        v1 = new MockERC20("imdUSDv1", 18);
        feed = new MockFeed(2000e18);
        _deploySystem(IERC20(address(v1)));
        ethJoin = _addIlk(ETH, address(weth), feed, feed, IFeed(address(0)), address(0), address(0), true, _risk(1.4e18, 1_000_000e18));
        params.setGenesisCap(ETH, 1500e18); // a borrow price ceiling below the market (Sky's capped OSM)
        params.seal();
        address[2] memory us = [alice, bob];
        for (uint256 i; i < 2; ++i) {
            weth.mint(us[i], 1000e18);
            vm.prank(us[i]);
            weth.approve(address(ledger), type(uint256).max);
        }
    }

    function _open(address u, uint256 salt, uint256 coll, uint256 debt, uint64 rate) internal returns (uint256 id) {
        vm.prank(u);
        id = ledger.open(ETH, salt, Adjust(int256(coll), int256(debt), rate, 0, 0, false, type(uint256).max, address(0)));
    }

    /// Pricer.sol:28-29 and ParametersBase.sol:196-197 say a CHARGED RATE CHANGE is measured at `borrow = min(low, cap)`.
    /// Ledger.setRate measures it at the uncapped `low` (Ledger.sol:168): with the cap binding, a borrow of 1 wei is
    /// refused (Unhealthy) while a charged rate change adds premium debt to the same position.
    function test_chargedRateChangeIgnoresBorrowCap() public {
        uint256 id = _open(alice, 0, 10e18, 10_000e18, 0.05e18); // CR at the cap (1500): 150%
        vm.prank(governor);
        params.lowerCap(ETH, 1300e18); // CR at the cap: 130% < mat 140%; at `low` (2000): 200%
        vm.prank(alice);
        vm.expectRevert(LedgerBase.Unhealthy.selector);
        ledger.adjust(id, Adjust(0, 1, 0, 0, 0, false, type(uint256).max, address(0)));
        uint256 before = ledger.debtOf(id);
        vm.prank(alice);
        vm.expectRevert(LedgerBase.Unhealthy.selector); // what the Pricer/Parameters NatSpec promises
        ledger.setRate(id, 0.06e18, 0, 0);
        assertEq(ledger.debtOf(id), before, "no premium debt added below the capped health line");
    }

    /// LedgerBase.sol:164-166 and :320-321: while `unbacked()` is past the brake, "no new debt on any type". `_adjust`
    /// checks the brake on a borrow (Ledger.sol:301); `setRate`'s charged premium adds debt without it (Ledger.sol:159-166).
    function test_chargedRateChangeBypassesUnbackedBrake() public {
        uint256 a = _open(alice, 0, 10e18, 10_000e18, 0.05e18); // CR at the cap (1500): 150%
        uint256 b = _open(bob, 0, 100e18, 20_000e18, 0.05e18);
        feed.set(500e18); // alice: 10 ETH = 5,000 against ~10,010 of debt; bob stays at CR 250%
        vm.prank(bob);
        liquidator.liquidate(a); // bob pays 5,000, ~5,010 is booked bad debt; the Treasury covers only its ~29 of fees
        assertGt(ledger.unbacked(), usd.circulating() / 100, "braked");
        vm.prank(bob);
        vm.expectRevert(LedgerBase.Braked.selector);
        ledger.adjust(b, Adjust(0, 1, 0, 0, 0, false, type(uint256).max, address(0)));
        uint256 before = ledger.debtOf(b);
        vm.prank(bob);
        vm.expectRevert(LedgerBase.Braked.selector); // expected: Braked, as for any other new debt
        ledger.setRate(b, 0.06e18, 0, 0);
        assertEq(ledger.debtOf(b), before, "no new debt while braked");
    }

    /// LedgerBase.sol:126-127: "reopening at another rate inside the cooldown pays the premium (a flash mint cannot
    /// launder a rate drop)". It holds for the same id only: repay, withdraw, and reopen under a fresh salt pays the
    /// upfront fee at the type's average (the new rate itself when the type is otherwise empty), half the premium here.
    function test_freshSaltDropsRateBelowOldRatePremium() public {
        uint256 id0 = _open(alice, 0, 10e18, 10_000e18, 0.10e18);
        vm.prank(address(ledger));
        usd.mint(alice, 100e18); // covers the upfront fee so the repayment can clear the debt
        uint256 premium = (10_000e18 * uint256(0.10e18) * 7 days + 365 days * 1e18 - 1) / (365 days * 1e18);
        vm.startPrank(alice);
        ledger.repayFor(id0, type(uint256).max);
        ledger.adjust(id0, Adjust(-10e18, 0, 0, 0, 0, false, 0, address(0)));
        uint256 id1 = ledger.open(ETH, 1, Adjust(10e18, 10_000e18, 0.05e18, 0, 0, false, type(uint256).max, address(0)));
        vm.stopPrank();
        uint256 feePaid = ledger.debtOf(id1) - 10_000e18;
        emit log_named_uint("setRate premium (7d at 10%)", premium);
        emit log_named_uint("fresh-salt fee (7d at 5%)", feePaid);
        assertGe(feePaid, premium, "a rate drop costs at least 7 days at the old rate");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {ImdUSD} from "src/ImdUSD.sol";
import {ParametersBase} from "src/ParametersBase.sol";
import {Parameters} from "src/Parameters.sol";
import {Pricer} from "src/Pricer.sol";
import {Treasury, ICoverable} from "src/Treasury.sol";
import {PositionNFT} from "src/PositionNFT.sol";
import {Ledger, IPulse} from "src/Ledger.sol";
import {LedgerBase} from "src/LedgerBase.sol";
import {Redeemer} from "src/Redeemer.sol";
import {Liquidator} from "src/Liquidator.sol";
import {Migrator} from "src/Migrator.sol";
import {Join} from "src/Join.sol";
import {IFeed} from "src/interfaces/IFeed.sol";
import {Adjust} from "src/interfaces/IPositions.sol";

contract PLToken is ERC20 {
    constructor() ERC20("WETH", "WETH") {}
    function mint(address to, uint256 a) external { _mint(to, a); }
}

contract PLFeed is IFeed {
    uint256 public value;
    uint64 public updatedAt;
    constructor(uint256 v) { value = v; updatedAt = uint64(block.timestamp); }
    function set(uint256 v) external { value = v; updatedAt = uint64(block.timestamp); }
    function latestValue() external view returns (uint256, uint64) { return (value, updatedAt); }
    function isStale() external view returns (bool) { return block.timestamp - updatedAt > 365 days; }
    function maxAge() external pure returns (uint256) { return 365 days; }
}

/// @dev Q3: the C2 rule says debt added inside the cooldown of a charged rate change pays RATE_COOLDOWN of interest at the
/// rate BEFORE that change ("a dust reopen followed by a top-up costs what one reopen does"). Two in-cooldown setRate
/// calls on a dust-sized debt overwrite `premiumRate` with the freely chosen intermediate rate, so the top-up pays the
/// premium at that rate (here 2%) instead of the original 10%.
contract ProofPremiumLaunder is Test {
    bytes32 constant ETH = "ETH";
    address governor = makeAddr("governor");
    address alice = makeAddr("alice");

    ImdUSD usd;
    Parameters params;
    Pricer pricer;
    Treasury treasury;
    Ledger ledger;
    PLToken weth;
    PLFeed feed;

    function setUp() public {
        vm.warp(1_800_000_000);
        weth = new PLToken();
        feed = new PLFeed(2000e18);
        PLToken v1 = new PLToken();

        usd = new ImdUSD(address(this), 10_000_000e18);
        params = new Parameters(governor, address(this));
        pricer = new Pricer(params);
        treasury = new Treasury(governor, IERC20(address(usd)), address(this));
        PositionNFT nft_ = new PositionNFT(address(this));
        ledger = new Ledger(usd, params, pricer, address(treasury), address(this), IPulse(address(0)), nft_);
        nft_.bind(address(ledger));
        Redeemer redeemer = new Redeemer(ledger);
        Liquidator liquidator = new Liquidator(ledger, pricer);
        ledger.wire(address(redeemer), address(liquidator));
        Migrator migrator = new Migrator(IERC20(address(v1)), usd, params);
        usd.wire(address(ledger), address(migrator), address(params));
        params.wire(address(ledger), address(usd));
        treasury.wire(ICoverable(address(ledger)));

        Join join = new Join(address(weth), address(this));
        join.wire(address(ledger));
        params.addGenesisIlk(
            ETH,
            ParametersBase.Config({
                token: address(weth), join: address(join), median: feed, spot: feed, nhi: IFeed(address(0)),
                yieldRate: address(0), pegAggregator: address(0), liveSpot: IFeed(address(0)), redeemable: true, auction: false
            }),
            ParametersBase.Risk({
                mat: 1.4e18, chop: 0.1e18, cut: 0.5e18, chip: 0.1e18, rateFloor: 0.01e18, yieldFee: 0, skew: 0.05e18,
                pegFloor: 0, line: 1_000_000e18, dust: 100e18, redeemFloor: 0.005e18, redeemDivisor: 2, redeemCap: 0
            })
        );
        params.seal();

        weth.mint(alice, 100e18);
        vm.startPrank(alice);
        weth.approve(address(ledger), type(uint256).max);
        vm.stopPrank();
    }

    function _premium(uint256 amount, uint256 rate) internal pure returns (uint256) {
        return (amount * rate * 7 days + 365 days * 1e18 - 1) / (365 days * 1e18);
    }

    function test_twoInCooldownRateChangesLaunderThePremiumRate() public {
        uint256 id = ledger.positionId(alice, ETH, 0);
        // Alice borrows 10,000 at 10%: lastRateChange = now, so a change inside 7 days is charged at 10%.
        vm.prank(alice);
        ledger.open(ETH, 0, Adjust(int256(100e18), int256(10_000e18), 0.10e18, 0, 0, false, type(uint256).max, address(0)));
        vm.warp(block.timestamp + 1 days);

        // The honest price of dropping 10,000 of debt from 10% to 1% inside the cooldown: 7 days at 10%.
        uint256 honest = _premium(10_000e18, 0.10e18);

        // 1. Repay down to dust (free, no price needed).
        uint256 debt = ledger.debtOf(id);
        vm.prank(alice);
        ledger.adjust(id, Adjust(0, -int256(debt - 101e18), 0, 0, 0, false, type(uint256).max, address(0)));
        assertApproxEqAbs(ledger.debtOf(id), 101e18, 1);

        // 2. Two rate changes on the dust: 10% -> 2% (charged at 10% on 101) then 2% -> 1% (charged at 2% on ~101).
        vm.startPrank(alice);
        ledger.setRate(id, 0.02e18, 0, 0);
        ledger.setRate(id, 0.01e18, 0, 0);
        vm.stopPrank();
        LedgerBase.Position memory p = ledger.position(id);
        assertEq(p.rate, 0.01e18);
        uint256 dust = p.debt;
        uint256 paidSoFar = dust - 101e18; // the two tiny premiums (about 0.19 + 0.04 imdUSD)

        // 3. Top up the 9,900 back inside the cooldown.
        ledger.accrue(ETH);
        uint256 upfront = ledger.upfrontFeeFor(ETH, 9_899e18, 0.01e18);
        vm.prank(alice);
        ledger.adjust(id, Adjust(0, int256(9_899e18), 0, 0, 0, false, type(uint256).max, address(0)));
        uint256 topUpPremium = ledger.debtOf(id) - dust - 9_899e18 - upfront;

        emit log_named_uint("honest premium (7d at 10% on 10,000)", honest);
        emit log_named_uint("premiumRate after the two changes   ", p.premiumRate);
        emit log_named_uint("premium charged on the 9,899 top-up ", topUpPremium);
        emit log_named_uint("total premium paid over the sequence", topUpPremium + paidSoFar);

        // Documented rule (LedgerBase 125-127, Ledger 281-283): the top-up pays at the rate BEFORE the charged change (10%).
        // Actual: `premiumRate` is the freely chosen intermediate rate (2%), and the top-up pays about a fifth.
        assertEq(p.premiumRate, 0.10e18, "premiumRate should still be the rate the cooldown was entered at");
        assertGe(topUpPremium + paidSoFar, honest, "the sequence must cost at least one honest rate change");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {ImdUSD} from "src/ImdUSD.sol";
import {ParametersBase} from "src/ParametersBase.sol";
import {Parameters} from "src/Parameters.sol";
import {Pricer} from "src/Pricer.sol";
import {Treasury, ICoverable} from "src/Treasury.sol";
import {PositionNFT} from "src/PositionNFT.sol";
import {Ledger, IPulse} from "src/Ledger.sol";
import {LedgerBase} from "src/LedgerBase.sol";
import {Redeemer} from "src/Redeemer.sol";
import {Liquidator} from "src/Liquidator.sol";
import {Migrator} from "src/Migrator.sol";
import {Join} from "src/Join.sol";
import {IFeed} from "src/interfaces/IFeed.sol";
import {Adjust} from "src/interfaces/IPositions.sol";

contract SRToken is ERC20 {
    constructor() ERC20("WETH", "WETH") {}
    function mint(address to, uint256 a) external { _mint(to, a); }
}

contract SRFeed is IFeed {
    uint256 public value;
    uint64 public updatedAt;
    constructor(uint256 v) { value = v; updatedAt = uint64(block.timestamp); }
    function set(uint256 v) external { value = v; updatedAt = uint64(block.timestamp); }
    function latestValue() external view returns (uint256, uint64) { return (value, updatedAt); }
    function isStale() external view returns (bool) { return block.timestamp - updatedAt > 365 days; }
    function maxAge() external pure returns (uint256) { return 365 days; }
}

/// @dev setRate's charged premium is new debt (minted, added to s.debt and p.debt) but skips two checks every borrow runs in
/// Ledger._adjust: the borrow-price cap (`q.borrow`, Pricer NatSpec: "a charged rate change" is measured at min(low, cap))
/// and the unbacked-supply brake (`_checkBrake`, "no new debt on any type").
contract ProofSetRateChecks is Test {
    bytes32 constant ETH = "ETH";
    address governor = makeAddr("governor");
    address alice = makeAddr("alice");
    address bob = makeAddr("bob");

    ImdUSD usd;
    Parameters params;
    Pricer pricer;
    Treasury treasury;
    Ledger ledger;
    Liquidator liquidator;
    SRToken weth;
    SRFeed feed;

    function setUp() public {
        vm.warp(1_800_000_000);
        weth = new SRToken();
        feed = new SRFeed(2000e18);
        usd = new ImdUSD(address(this), 10_000_000e18);
        params = new Parameters(governor, address(this));
        pricer = new Pricer(params);
        treasury = new Treasury(governor, IERC20(address(usd)), address(this));
        PositionNFT nft_ = new PositionNFT(address(this));
        ledger = new Ledger(usd, params, pricer, address(treasury), address(this), IPulse(address(0)), nft_);
        nft_.bind(address(ledger));
        Redeemer redeemer = new Redeemer(ledger);
        liquidator = new Liquidator(ledger, pricer);
        ledger.wire(address(redeemer), address(liquidator));
        Migrator migrator = new Migrator(IERC20(address(new SRToken())), usd, params);
        usd.wire(address(ledger), address(migrator), address(params));
        params.wire(address(ledger), address(usd));
        treasury.wire(ICoverable(address(ledger)));

        Join join = new Join(address(weth), address(this));
        join.wire(address(ledger));
        params.addGenesisIlk(
            ETH,
            ParametersBase.Config({
                token: address(weth), join: address(join), median: feed, spot: feed, nhi: IFeed(address(0)),
                yieldRate: address(0), pegAggregator: address(0), liveSpot: IFeed(address(0)), redeemable: true, auction: false
            }),
            ParametersBase.Risk({
                mat: 1.4e18, chop: 0.1e18, cut: 0.5e18, chip: 0.1e18, rateFloor: 0.01e18, yieldFee: 0, skew: 0.05e18,
                pegFloor: 0, line: 1_000_000e18, dust: 100e18, redeemFloor: 0.005e18, redeemDivisor: 2, redeemCap: 0
            })
        );
        params.setGenesisCap(ETH, 1500e18); // a borrow-price ceiling below the market (Sky's capped OSM)
        params.seal();

        address[2] memory us = [alice, bob];
        for (uint256 i; i < 2; ++i) {
            weth.mint(us[i], 1000e18);
            vm.startPrank(us[i]);
            weth.approve(address(ledger), type(uint256).max);
            usd.approve(address(ledger), type(uint256).max);
            vm.stopPrank();
        }
    }

    function _open(address u, uint256 salt, uint256 coll, uint256 debt, uint64 rate) internal returns (uint256 id) {
        vm.prank(u);
        id = ledger.open(ETH, salt, Adjust(int256(coll), int256(debt), rate, 0, 0, false, type(uint256).max, address(0)));
    }

    /// Pricer.sol:28-29 / ParametersBase.sol:196-197: a charged rate change is measured at `borrow = min(low, cap)`.
    /// Ledger.setRate measures it at the uncapped `low` (Ledger.sol:168).
    function test_chargedRateChangeIgnoresBorrowCap() public {
        uint256 id = _open(alice, 0, 10e18, 10_000e18, 0.05e18); // CR at the cap (1500): 150%
        vm.prank(governor);
        params.lowerCap(ETH, 1300e18); // CR at the cap: 130% < mat 140%; at `low` (2000): 200%
        vm.prank(alice);
        vm.expectRevert(LedgerBase.Unhealthy.selector);
        ledger.adjust(id, Adjust(0, 1, 0, 0, 0, false, type(uint256).max, address(0)));
        uint256 before = ledger.debtOf(id);
        vm.prank(alice);
        vm.expectRevert(LedgerBase.Unhealthy.selector); // what the Pricer / Parameters NatSpec promises
        ledger.setRate(id, 0.06e18, 0, 0);
        assertEq(ledger.debtOf(id), before, "no premium debt added below the capped health line");
    }

    /// LedgerBase.sol:164-166 / :320-321: while `unbacked()` is past the brake, "no new debt on any type". `_adjust` runs
    /// `_checkBrake()` on a borrow (Ledger.sol:301); setRate's charged premium is minted without it (Ledger.sol:159-166).
    function test_chargedRateChangeBypassesUnbackedBrake() public {
        uint256 a = _open(alice, 0, 10e18, 10_000e18, 0.05e18);
        uint256 b = _open(bob, 0, 100e18, 20_000e18, 0.05e18);
        feed.set(500e18); // alice: 10 ETH = 5,000 against ~10,010 of debt; bob stays at CR 250%
        vm.prank(bob);
        liquidator.liquidate(a); // bob pays 5,000; ~5,010 is booked bad debt; the Treasury covers only its fees
        assertGt(ledger.unbacked(), usd.circulating() / 100, "braked");
        vm.prank(bob);
        vm.expectPartialRevert(LedgerBase.Braked.selector);
        ledger.adjust(b, Adjust(0, 1, 0, 0, 0, false, type(uint256).max, address(0)));
        uint256 before = ledger.debtOf(b);
        uint256 supply = usd.totalSupply();
        vm.prank(bob);
        vm.expectPartialRevert(LedgerBase.Braked.selector); // expected: Braked, as for any other new debt
        ledger.setRate(b, 0.06e18, 0, 0);
        assertEq(ledger.debtOf(b), before, "no new debt while braked");
        assertEq(usd.totalSupply(), supply, "nothing minted while braked");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {ImdUSD} from "src/ImdUSD.sol";
import {ParametersBase} from "src/ParametersBase.sol";
import {Parameters} from "src/Parameters.sol";
import {Pricer} from "src/Pricer.sol";
import {Treasury, ICoverable} from "src/Treasury.sol";
import {PositionNFT} from "src/PositionNFT.sol";
import {Ledger, IPulse} from "src/Ledger.sol";
import {Redeemer} from "src/Redeemer.sol";
import {Liquidator} from "src/Liquidator.sol";
import {Migrator} from "src/Migrator.sol";
import {Join} from "src/Join.sol";
import {IFeed} from "src/interfaces/IFeed.sol";
import {Adjust} from "src/interfaces/IPositions.sol";

contract RVToken is ERC20 {
    constructor() ERC20("WETH", "WETH") {}
    function mint(address to, uint256 a) external { _mint(to, a); }
}

contract RVFeed is IFeed {
    uint256 public value;
    uint64 public updatedAt;
    constructor(uint256 v) { value = v; updatedAt = uint64(block.timestamp); }
    function set(uint256 v) external { value = v; updatedAt = uint64(block.timestamp); }
    function latestValue() external view returns (uint256, uint64) { return (value, updatedAt); }
    function isStale() external view returns (bool) { return block.timestamp - updatedAt > 365 days; }
    function maxAge() external pure returns (uint256) { return 365 days; }
}

/// @dev Q4: `Parameters.riskVersion` is the NEWEST version, pending or not, and `liqRisk(ilk, newest)` returns it with no
/// bindAt check. Ledger._adjust / setRate write it into `p.version` on any borrow or withdrawal, so a position touched
/// during the 7-day grace is liquidated at the pending (harsher) mat and chop at once, while an untouched twin keeps the
/// old version until `bindAt`.
contract ProofRiskVersionRebind is Test {
    bytes32 constant ETH = "ETH";
    address governor = makeAddr("governor");
    address alice = makeAddr("alice");
    address bob = makeAddr("bob");
    address keeper = makeAddr("keeper");

    ImdUSD usd;
    Parameters params;
    Pricer pricer;
    Treasury treasury;
    Ledger ledger;
    Liquidator liquidator;
    RVToken weth;
    RVFeed feed;

    function _risk(uint64 mat, uint64 chop) internal pure returns (ParametersBase.Risk memory) {
        return ParametersBase.Risk({
            mat: mat, chop: chop, cut: 0.5e18, chip: 0.1e18, rateFloor: 0.01e18, yieldFee: 0, skew: 0.05e18,
            pegFloor: 0, line: 1_000_000e18, dust: 100e18, redeemFloor: 0.005e18, redeemDivisor: 2, redeemCap: 0
        });
    }

    function setUp() public {
        vm.warp(1_800_000_000);
        weth = new RVToken();
        feed = new RVFeed(2000e18);
        usd = new ImdUSD(address(this), 10_000_000e18);
        params = new Parameters(governor, address(this));
        pricer = new Pricer(params);
        treasury = new Treasury(governor, IERC20(address(usd)), address(this));
        PositionNFT nft_ = new PositionNFT(address(this));
        ledger = new Ledger(usd, params, pricer, address(treasury), address(this), IPulse(address(0)), nft_);
        nft_.bind(address(ledger));
        Redeemer redeemer = new Redeemer(ledger);
        liquidator = new Liquidator(ledger, pricer);
        ledger.wire(address(redeemer), address(liquidator));
        Migrator migrator = new Migrator(IERC20(address(new RVToken())), usd, params);
        usd.wire(address(ledger), address(migrator), address(params));
        params.wire(address(ledger), address(usd));
        treasury.wire(ICoverable(address(ledger)));
        Join join = new Join(address(weth), address(this));
        join.wire(address(ledger));
        params.addGenesisIlk(
            ETH,
            ParametersBase.Config({
                token: address(weth), join: address(join), median: feed, spot: feed, nhi: IFeed(address(0)),
                yieldRate: address(0), pegAggregator: address(0), liveSpot: IFeed(address(0)), redeemable: true, auction: false
            }),
            _risk(1.4e18, 0.1e18)
        );
        params.seal();
        address[2] memory us = [alice, bob];
        for (uint256 i; i < 2; ++i) {
            weth.mint(us[i], 1000e18);
            vm.startPrank(us[i]);
            weth.approve(address(ledger), type(uint256).max);
            usd.approve(address(ledger), type(uint256).max);
            vm.stopPrank();
        }
        deal(address(usd), keeper, 100_000e18);
        vm.prank(keeper);
        usd.approve(address(ledger), type(uint256).max);
    }

    function _open(address u, uint256 coll, uint256 debt) internal returns (uint256 id) {
        vm.prank(u);
        id = ledger.open(ETH, 0, Adjust(int256(coll), int256(debt), 0.05e18, 0, 0, false, type(uint256).max, address(0)));
    }

    function test_deRiskingAdjustBindsToPendingVersionBeforeItsGrace() public {
        uint256 a = _open(alice, 10e18, 13_000e18); // CR 153.8% under version 0 (mat 140%)
        uint256 b = _open(bob, 10e18, 13_000e18); // identical twin, never touched

        // Governance raises mat 140% -> 160%: version 1 pushed with bindAt = now + 7 days.
        uint8 kind = params.SET_RISK();
        vm.prank(governor);
        params.propose(abi.encode(kind, ETH, _risk(1.6e18, 0.1e18)));
        vm.warp(block.timestamp + 48 hours);
        params.applyPending();
        feed.set(2000e18);
        assertEq(params.riskVersion(ETH), 1);

        // Alice repays half and withdraws 40% of her collateral: ratio UP (153.8% -> 184.6%), passes the health check.
        vm.prank(alice);
        ledger.adjust(a, Adjust(-4e18, -6_500e18, 0, 0, 0, false, 0, address(0)));

        // Price falls 15%. Alice: 6 x 1700 = 10,200 / ~6,501 = 156.9%: healthy at 140%, unhealthy at 160%.
        feed.set(1700e18);
        (bool okB,) = ledger.healthy(b); // Bob: 17,000 / 13,000 = 130.8%: unhealthy either way (control: version 0 works)
        assertFalse(okB);
        (bool okA,) = ledger.healthy(a);
        (uint256 matA,) = params.liqRisk(ETH, ledger.position(a).version);
        emit log_named_uint("alice.version", ledger.position(a).version);
        emit log_named_uint("mat binding alice now", matA);
        // EXPECTED (ParametersBase.sol:300-303, README): version 1 binds nobody before its bindAt, so Alice is healthy
        // at 140% for the rest of the week. ACTUAL: she is on version 1 already and reads unhealthy at 160%.
        assertEq(ledger.position(a).version, 0, "bound to a version whose bindAt has not passed");
        assertTrue(okA, "healthy at the version in force (140%)");
        vm.prank(keeper);
        vm.expectRevert(Liquidator.Healthy.selector);
        liquidator.liquidate(a);
    }
}