// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {PoolManager} from "v4-core/src/PoolManager.sol";
import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
import {PoolKey} from "v4-core/src/types/PoolKey.sol";
import {BalanceDelta, BalanceDeltaLibrary} from "v4-core/src/types/BalanceDelta.sol";
import {TickMath} from "v4-core/src/libraries/TickMath.sol";
import {Hooks} from "v4-core/src/libraries/Hooks.sol";
import {PoolSwapTest} from "v4-core/src/test/PoolSwapTest.sol";
import {PoolModifyLiquidityTest} from "v4-core/src/test/PoolModifyLiquidityTest.sol";
import {HookMiner} from "v4-periphery/test/shared/HookMiner.sol";
import {Launcher} from "src/Launcher.sol";
import {Kiln} from "src/Kiln.sol";

contract ProofZTO {
    mapping(address => uint256) public balanceOf;
    mapping(address => mapping(address => uint256)) public allowance;

    function mint(address to, uint256 a) external {
        balanceOf[to] += a;
    }

    function approve(address s, uint256 a) external returns (bool) {
        allowance[msg.sender][s] = a;
        return true;
    }

    function transfer(address to, uint256 a) external returns (bool) {
        balanceOf[msg.sender] -= a;
        balanceOf[to] += a;
        return true;
    }

    function transferFrom(address f, address t, uint256 a) external returns (bool) {
        if (allowance[f][msg.sender] != type(uint256).max) allowance[f][msg.sender] -= a;
        balanceOf[f] -= a;
        balanceOf[t] += a;
        return true;
    }
}

contract ProofPepeo {
    mapping(uint256 => address) public ownerOf;
    mapping(address => uint256) public balanceOf;

    function mint(address to, uint256 id) external {
        ownerOf[id] = to;
        balanceOf[to] += 1;
    }

    function transferFrom(address f, address t, uint256 id) external {
        require(ownerOf[id] == f && msg.sender == f);
        ownerOf[id] = t;
        balanceOf[f] -= 1;
        balanceOf[t] += 1;
    }
}

/// @notice The Kiln cut must be kilnCut (1.30% for a wallet with no pieces) of the ZTO the pool actually moved.
///         When a ZTO-specified swap only partially fills, the current code charges 1.30% of the *specified*
///         amount instead, which can be a multiple of the ZTO actually swapped. A fix may either measure the cut
///         on the realised amount or reject partial fills; both make these tests pass.
contract KilnPartialFillProof is Test {
    using BalanceDeltaLibrary for BalanceDelta;

    uint160 internal constant FLAGS = Hooks.BEFORE_SWAP_FLAG | Hooks.AFTER_SWAP_FLAG
        | Hooks.BEFORE_SWAP_RETURNS_DELTA_FLAG | Hooks.AFTER_SWAP_RETURNS_DELTA_FLAG;
    int24 internal constant OPEN_TICK = 138_180;
    uint256 internal constant CUT_0 = 13_000;
    uint256 internal constant PIPS = 1_000_000;

    IPoolManager internal manager;
    ProofZTO internal zto;
    ProofPepeo internal pepeo;
    Launcher internal launcher;
    Kiln internal kiln;
    PoolKey internal key;
    PoolSwapTest internal swapRouter;
    PoolModifyLiquidityTest internal lpRouter;
    address internal lp = makeAddr("lp");
    address internal trader = makeAddr("trader");

    function setUp() public {
        manager = new PoolManager(address(this));
        zto = new ProofZTO();
        pepeo = new ProofPepeo();
        launcher = new Launcher(address(zto), address(pepeo), address(manager));
        swapRouter = new PoolSwapTest(manager);
        lpRouter = new PoolModifyLiquidityTest(manager);
        uint160 openPrice = TickMath.getSqrtPriceAtTick(OPEN_TICK);
        (, bytes32 salt) = HookMiner.find(
            address(launcher), FLAGS, type(Kiln).creationCode, abi.encode(address(zto), address(pepeo), address(manager))
        );
        launcher.open(salt, openPrice);
        kiln = launcher.kiln();
        key = kiln.poolKey();

        // ZTO-only range below the opening tick, modest size.
        zto.mint(lp, 1e27);
        vm.startPrank(lp);
        zto.approve(address(lpRouter), type(uint256).max);
        lpRouter.modifyLiquidity(
            key,
            IPoolManager.ModifyLiquidityParams({
                tickLower: OPEN_TICK - 6000, tickUpper: OPEN_TICK, liquidityDelta: 1e22, salt: bytes32(0)
            }),
            ""
        );
        vm.stopPrank();

        // Trader with no pieces (tier 0, 1.30%).
        vm.deal(trader, 10_000 ether);
        zto.mint(trader, 1e30);
        vm.prank(trader);
        zto.approve(address(swapRouter), type(uint256).max);
    }

    function _swap(bool zeroForOne, int256 amountSpecified, uint256 value)
        internal
        returns (bool ok, BalanceDelta delta)
    {
        vm.prank(trader, trader);
        try swapRouter.swap{value: value}(
            key,
            IPoolManager.SwapParams({
                zeroForOne: zeroForOne,
                amountSpecified: amountSpecified,
                sqrtPriceLimitX96: zeroForOne ? TickMath.MIN_SQRT_PRICE + 1 : TickMath.MAX_SQRT_PRICE - 1
            }),
            PoolSwapTest.TestSettings({takeClaims: false, settleUsingBurn: false}),
            ""
        ) returns (BalanceDelta d) {
            return (true, d);
        } catch {
            return (false, BalanceDelta.wrap(0));
        }
    }

    function _abs(int128 x) internal pure returns (uint256) {
        return x < 0 ? uint256(uint128(-x)) : uint256(uint128(x));
    }

    /// Case 1: ZTO in, exact input, larger than the ETH the range holds. The pool consumes only part of the
    /// input; the cut must be at most 1.30% of the ZTO the pool consumed (plus 1 wei rounding).
    function test_case1_ztoInExactIn_partialFill_cutBoundedByRealisedInput() public {
        // Put 1 ETH into the range with a no-cut wallet.
        address whale = makeAddr("whale");
        for (uint256 i = 1; i <= 21; ++i) pepeo.mint(whale, i);
        vm.deal(whale, 10 ether);
        vm.prank(whale, whale);
        swapRouter.swap{value: 1 ether}(
            key,
            IPoolManager.SwapParams({
                zeroForOne: true, amountSpecified: -1 ether, sqrtPriceLimitX96: TickMath.MIN_SQRT_PRICE + 1
            }),
            PoolSwapTest.TestSettings({takeClaims: false, settleUsingBurn: false}),
            ""
        );
        assertEq(kiln.claims(), 0);

        uint256 claimsBefore = kiln.claims();
        (bool ok, BalanceDelta delta) = _swap(false, -int256(100_000_000e18), 0);
        if (!ok) return; // a fix that rejects partial fills is acceptable
        uint256 cut = kiln.claims() - claimsBefore;
        uint256 poolZtoIn = _abs(delta.amount1()) - cut; // ZTO the pool actually consumed
        assertLe(cut, poolZtoIn * CUT_0 / PIPS + 1, "cut exceeds 1.30% of the ZTO the pool consumed");
    }

    /// Case 4: ETH in, exact ZTO output, far larger than the ZTO the range holds. The pool delivers only part of
    /// the output; the cut must be at most 1.30% of the ZTO the pool delivered, and the trader must not end up
    /// paying ZTO on a swap that was supposed to deliver ZTO.
    function test_case4_ethInExactOut_partialFill_cutBoundedByRealisedOutput() public {
        uint256 poolZto = zto.balanceOf(address(manager));
        uint256 claimsBefore = kiln.claims();
        (bool ok, BalanceDelta delta) = _swap(true, int256(poolZto * 200), 5000 ether);
        if (!ok) return; // a fix that rejects partial fills is acceptable
        uint256 cut = kiln.claims() - claimsBefore;
        assertGe(delta.amount1(), 0, "trader paid ZTO on an exact-output ZTO swap");
        uint256 poolZtoOut = uint256(uint128(delta.amount1())) + cut; // ZTO the pool actually delivered
        assertLe(cut, poolZtoOut * CUT_0 / PIPS + 1, "cut exceeds 1.30% of the ZTO the pool delivered");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {PoolManager} from "v4-core/src/PoolManager.sol";
import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
import {IHooks} from "v4-core/src/interfaces/IHooks.sol";
import {PoolKey} from "v4-core/src/types/PoolKey.sol";
import {PoolId, PoolIdLibrary} from "v4-core/src/types/PoolId.sol";
import {Currency} from "v4-core/src/types/Currency.sol";
import {Hooks} from "v4-core/src/libraries/Hooks.sol";
import {TickMath} from "v4-core/src/libraries/TickMath.sol";
import {StateLibrary} from "v4-core/src/libraries/StateLibrary.sol";
import {Launcher} from "src/Launcher.sol";
import {Kiln} from "src/Kiln.sol";

contract DummyERC20 {
    function balanceOf(address) external pure returns (uint256) {
        return 0;
    }
}

contract DummyERC721 {
    function balanceOf(address) external pure returns (uint256) {
        return 0;
    }
}

/// @notice Launcher.open() can be blocked by anyone who initializes the ETH/ZTO pool with the predicted Kiln
///         address as hook before open() runs. The Kiln has no initialize flags, so the PoolManager never calls
///         the (not yet existing) hook and the pre-initialization succeeds; open() then reverts with
///         PoolAlreadyInitialized for that salt. Fails on the current code; passes once open() tolerates an
///         already-initialized pool (or otherwise cannot be blocked by a front-runner).
contract OpenFrontRunTest is Test {
    using PoolIdLibrary for PoolKey;
    using StateLibrary for IPoolManager;

    uint160 internal constant FLAGS = Hooks.BEFORE_SWAP_FLAG | Hooks.AFTER_SWAP_FLAG
        | Hooks.BEFORE_SWAP_RETURNS_DELTA_FLAG | Hooks.AFTER_SWAP_RETURNS_DELTA_FLAG;

    IPoolManager internal manager;
    address internal zto;
    address internal pepeo;
    Launcher internal launcher;
    address internal attacker = makeAddr("attacker");
    address internal deployer = makeAddr("deployer");

    function setUp() public {
        manager = new PoolManager(address(this));
        zto = address(new DummyERC20());
        pepeo = address(new DummyERC721());
        launcher = new Launcher(zto, pepeo, address(manager));
    }

    function _mineSalt() internal view returns (bytes32 salt, address predicted) {
        for (uint256 s;; ++s) {
            predicted = launcher.kilnAddress(bytes32(s));
            if (uint160(predicted) & Hooks.ALL_HOOK_MASK == FLAGS) return (bytes32(s), predicted);
        }
    }

    function test_openIsBlockedByPreInitializedPool() public {
        // The deployer mines a salt off-chain and broadcasts open(salt, price). The attacker sees the salt in the
        // mempool, derives the Kiln address (initCodeHash() and kilnAddress() are public) and initializes the pool
        // first, at a price of their choosing.
        (bytes32 salt, address predicted) = _mineSalt();
        PoolKey memory key = PoolKey({
            currency0: Currency.wrap(address(0)),
            currency1: Currency.wrap(zto),
            fee: 2000,
            tickSpacing: 60,
            hooks: IHooks(predicted)
        });
        uint160 attackerPrice = TickMath.getSqrtPriceAtTick(-200_000);
        vm.prank(attacker);
        manager.initialize(key, attackerPrice); // succeeds: no code at `predicted`, no initialize hook flags
        assertEq(predicted.code.length, 0, "hook does not exist yet");

        // The deployer's open() must still succeed: the Kiln is deployed at the mined address, the pool exists
        // with the Kiln as its hook, and the Launcher records it. On the current code this reverts with
        // Pool.PoolAlreadyInitialized, so the deployer's salt is burned and every retry can be griefed the same way.
        uint160 openPrice = TickMath.getSqrtPriceAtTick(138_180);
        vm.prank(deployer);
        (address kilnAddr,) = launcher.open(salt, openPrice);

        assertEq(kilnAddr, predicted, "kiln at the mined address");
        assertEq(address(launcher.kiln()), predicted, "launcher records the kiln");
        (uint160 sqrtPriceX96,,, uint24 lpFee) = manager.getSlot0(key.toId());
        assertGt(sqrtPriceX96, 0, "pool exists");
        assertEq(lpFee, 2000);
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";

import {PoolManager} from "v4-core/src/PoolManager.sol";
import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
import {IHooks} from "v4-core/src/interfaces/IHooks.sol";
import {PoolKey} from "v4-core/src/types/PoolKey.sol";
import {PoolId, PoolIdLibrary} from "v4-core/src/types/PoolId.sol";
import {Currency} from "v4-core/src/types/Currency.sol";
import {TickMath} from "v4-core/src/libraries/TickMath.sol";
import {Hooks} from "v4-core/src/libraries/Hooks.sol";
import {StateLibrary} from "v4-core/src/libraries/StateLibrary.sol";
import {HookMiner} from "v4-periphery/test/shared/HookMiner.sol";

import {Launcher} from "src/Launcher.sol";
import {Kiln} from "src/Kiln.sol";

contract ProofZTO {
    string public constant name = "ZTO";
    string public constant symbol = "ZTO";
    uint8 public constant decimals = 18;
    mapping(address => uint256) public balanceOf;
    mapping(address => mapping(address => uint256)) public allowance;

    function approve(address s, uint256 a) external returns (bool) {
        allowance[msg.sender][s] = a;
        return true;
    }

    function transfer(address to, uint256 a) external returns (bool) {
        balanceOf[msg.sender] -= a;
        balanceOf[to] += a;
        return true;
    }

    function transferFrom(address f, address to, uint256 a) external returns (bool) {
        if (allowance[f][msg.sender] != type(uint256).max) allowance[f][msg.sender] -= a;
        balanceOf[f] -= a;
        balanceOf[to] += a;
        return true;
    }
}

contract ProofPepeo {
    mapping(uint256 => address) public ownerOf;
    mapping(address => uint256) public balanceOf;
}

/// @notice Launcher.open() is permissionless and its salt is public once the open() transaction is in the mempool.
///         PoolManager.initialize() makes no call to a hook whose address lacks the initialize bits, so anyone can
///         initialize the ETH/ZTO pool key for the predicted Kiln address BEFORE the Kiln exists. From then on
///         open(salt, ...) reverts with PoolAlreadyInitialized for that salt, forever, and the griefer can repeat
///         this for every new salt the deployer mines. Fails now; passes once open() tolerates a pre-initialized
///         pool (e.g. read slot0 and skip initialize when sqrtPriceX96 != 0) or otherwise cannot be blocked.
contract Proof1_OpenFrontRunTest is Test {
    using PoolIdLibrary for PoolKey;
    using StateLibrary for IPoolManager;

    uint160 internal constant FLAGS = Hooks.BEFORE_SWAP_FLAG | Hooks.AFTER_SWAP_FLAG
        | Hooks.BEFORE_SWAP_RETURNS_DELTA_FLAG | Hooks.AFTER_SWAP_RETURNS_DELTA_FLAG;

    function test_openCannotBeBlockedByPreInitializingThePoolKey() public {
        IPoolManager manager = new PoolManager(address(this));
        ProofZTO zto = new ProofZTO();
        ProofPepeo pepeo = new ProofPepeo();
        Launcher launcher = new Launcher(address(zto), address(pepeo), address(manager));
        uint160 openPrice = TickMath.getSqrtPriceAtTick(138_180);

        // The deployer mines a salt and broadcasts open(salt, openPrice).
        (address predicted, bytes32 salt) = HookMiner.find(
            address(launcher), FLAGS, type(Kiln).creationCode, abi.encode(address(zto), address(pepeo), address(manager))
        );
        assertEq(predicted.code.length, 0, "Kiln does not exist yet");

        // A griefer sees it in the mempool and initializes the exact pool key first. No hook call happens because
        // the predicted address has no initialize permission bits.
        PoolKey memory key = PoolKey({
            currency0: Currency.wrap(address(0)),
            currency1: Currency.wrap(address(zto)),
            fee: 2000,
            tickSpacing: 60,
            hooks: IHooks(predicted)
        });
        vm.prank(makeAddr("griefer"));
        manager.initialize(key, TickMath.getSqrtPriceAtTick(0));

        // The deployer's open() must still succeed: deploy the Kiln at the mined address and report the pool.
        (address kilnAddr, PoolId poolId) = launcher.open(salt, openPrice);
        assertEq(kilnAddr, predicted, "Kiln deployed at the mined address");
        assertEq(address(launcher.kiln()), predicted, "launcher records the Kiln");
        assertEq(PoolId.unwrap(poolId), PoolId.unwrap(key.toId()), "pool id");
        (uint160 sqrtPriceX96,,, uint24 lpFee) = manager.getSlot0(poolId);
        assertGt(sqrtPriceX96, 0, "pool initialized");
        assertEq(lpFee, 2000);
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {PoolManager} from "v4-core/src/PoolManager.sol";
import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
import {PoolKey} from "v4-core/src/types/PoolKey.sol";
import {BalanceDelta, BalanceDeltaLibrary} from "v4-core/src/types/BalanceDelta.sol";
import {TickMath} from "v4-core/src/libraries/TickMath.sol";
import {Hooks} from "v4-core/src/libraries/Hooks.sol";
import {PoolSwapTest} from "v4-core/src/test/PoolSwapTest.sol";
import {PoolModifyLiquidityTest} from "v4-core/src/test/PoolModifyLiquidityTest.sol";
import {HookMiner} from "v4-periphery/test/shared/HookMiner.sol";
import {Launcher} from "src/Launcher.sol";
import {Kiln} from "src/Kiln.sol";

contract ProofZTO {
    mapping(address => uint256) public balanceOf;
    mapping(address => mapping(address => uint256)) public allowance;

    function mint(address to, uint256 a) external {
        balanceOf[to] += a;
    }

    function approve(address s, uint256 a) external returns (bool) {
        allowance[msg.sender][s] = a;
        return true;
    }

    function transfer(address to, uint256 a) external returns (bool) {
        balanceOf[msg.sender] -= a;
        balanceOf[to] += a;
        return true;
    }

    function transferFrom(address f, address t, uint256 a) external returns (bool) {
        if (allowance[f][msg.sender] != type(uint256).max) allowance[f][msg.sender] -= a;
        balanceOf[f] -= a;
        balanceOf[t] += a;
        return true;
    }
}

contract ProofPepeo {
    mapping(uint256 => address) public ownerOf;
    mapping(address => uint256) public balanceOf;

    function mint(address to, uint256 id) external {
        ownerOf[id] = to;
        balanceOf[to] += 1;
    }

    function transferFrom(address f, address t, uint256 id) external {
        require(ownerOf[id] == f && msg.sender == f);
        ownerOf[id] = t;
        balanceOf[f] -= 1;
        balanceOf[t] += 1;
    }
}

/// @notice The Kiln cut must be kilnCut (1.30% for a wallet with no pieces) of the ZTO the pool actually moved.
///         When a ZTO-specified swap only partially fills, the current code charges 1.30% of the *specified*
///         amount instead, which can be a multiple of the ZTO actually swapped. A fix may either measure the cut
///         on the realised amount or reject partial fills; both make these tests pass.
contract KilnPartialFillProof is Test {
    using BalanceDeltaLibrary for BalanceDelta;

    uint160 internal constant FLAGS = Hooks.BEFORE_SWAP_FLAG | Hooks.AFTER_SWAP_FLAG
        | Hooks.BEFORE_SWAP_RETURNS_DELTA_FLAG | Hooks.AFTER_SWAP_RETURNS_DELTA_FLAG;
    int24 internal constant OPEN_TICK = 138_180;
    uint256 internal constant CUT_0 = 13_000;
    uint256 internal constant PIPS = 1_000_000;

    IPoolManager internal manager;
    ProofZTO internal zto;
    ProofPepeo internal pepeo;
    Launcher internal launcher;
    Kiln internal kiln;
    PoolKey internal key;
    PoolSwapTest internal swapRouter;
    PoolModifyLiquidityTest internal lpRouter;
    address internal lp = makeAddr("lp");
    address internal trader = makeAddr("trader");

    function setUp() public {
        manager = new PoolManager(address(this));
        zto = new ProofZTO();
        pepeo = new ProofPepeo();
        launcher = new Launcher(address(zto), address(pepeo), address(manager));
        swapRouter = new PoolSwapTest(manager);
        lpRouter = new PoolModifyLiquidityTest(manager);
        uint160 openPrice = TickMath.getSqrtPriceAtTick(OPEN_TICK);
        (, bytes32 salt) = HookMiner.find(
            address(launcher), FLAGS, type(Kiln).creationCode, abi.encode(address(zto), address(pepeo), address(manager))
        );
        launcher.open(salt, openPrice);
        kiln = launcher.kiln();
        key = kiln.poolKey();

        // ZTO-only range below the opening tick, modest size.
        zto.mint(lp, 1e27);
        vm.startPrank(lp);
        zto.approve(address(lpRouter), type(uint256).max);
        lpRouter.modifyLiquidity(
            key,
            IPoolManager.ModifyLiquidityParams({
                tickLower: OPEN_TICK - 6000, tickUpper: OPEN_TICK, liquidityDelta: 1e22, salt: bytes32(0)
            }),
            ""
        );
        vm.stopPrank();

        // Trader with no pieces (tier 0, 1.30%).
        vm.deal(trader, 10_000 ether);
        zto.mint(trader, 1e30);
        vm.prank(trader);
        zto.approve(address(swapRouter), type(uint256).max);
    }

    function _swap(bool zeroForOne, int256 amountSpecified, uint256 value)
        internal
        returns (bool ok, BalanceDelta delta)
    {
        vm.prank(trader, trader);
        try swapRouter.swap{value: value}(
            key,
            IPoolManager.SwapParams({
                zeroForOne: zeroForOne,
                amountSpecified: amountSpecified,
                sqrtPriceLimitX96: zeroForOne ? TickMath.MIN_SQRT_PRICE + 1 : TickMath.MAX_SQRT_PRICE - 1
            }),
            PoolSwapTest.TestSettings({takeClaims: false, settleUsingBurn: false}),
            ""
        ) returns (BalanceDelta d) {
            return (true, d);
        } catch {
            return (false, BalanceDelta.wrap(0));
        }
    }

    function _abs(int128 x) internal pure returns (uint256) {
        return x < 0 ? uint256(uint128(-x)) : uint256(uint128(x));
    }

    /// Case 1: ZTO in, exact input, larger than the ETH the range holds. The pool consumes only part of the
    /// input; the cut must be at most 1.30% of the ZTO the pool consumed (plus 1 wei rounding).
    function test_case1_ztoInExactIn_partialFill_cutBoundedByRealisedInput() public {
        // Put 1 ETH into the range with a no-cut wallet.
        address whale = makeAddr("whale");
        for (uint256 i = 1; i <= 21; ++i) pepeo.mint(whale, i);
        vm.deal(whale, 10 ether);
        vm.prank(whale, whale);
        swapRouter.swap{value: 1 ether}(
            key,
            IPoolManager.SwapParams({
                zeroForOne: true, amountSpecified: -1 ether, sqrtPriceLimitX96: TickMath.MIN_SQRT_PRICE + 1
            }),
            PoolSwapTest.TestSettings({takeClaims: false, settleUsingBurn: false}),
            ""
        );
        assertEq(kiln.claims(), 0);

        uint256 claimsBefore = kiln.claims();
        (bool ok, BalanceDelta delta) = _swap(false, -int256(100_000_000e18), 0);
        if (!ok) return; // a fix that rejects partial fills is acceptable
        uint256 cut = kiln.claims() - claimsBefore;
        uint256 poolZtoIn = _abs(delta.amount1()) - cut; // ZTO the pool actually consumed
        assertLe(cut, poolZtoIn * CUT_0 / PIPS + 1, "cut exceeds 1.30% of the ZTO the pool consumed");
    }

    /// Case 4: ETH in, exact ZTO output, far larger than the ZTO the range holds. The pool delivers only part of
    /// the output; the cut must be at most 1.30% of the ZTO the pool delivered, and the trader must not end up
    /// paying ZTO on a swap that was supposed to deliver ZTO.
    function test_case4_ethInExactOut_partialFill_cutBoundedByRealisedOutput() public {
        uint256 poolZto = zto.balanceOf(address(manager));
        uint256 claimsBefore = kiln.claims();
        (bool ok, BalanceDelta delta) = _swap(true, int256(poolZto * 200), 5000 ether);
        if (!ok) return; // a fix that rejects partial fills is acceptable
        uint256 cut = kiln.claims() - claimsBefore;
        assertGe(delta.amount1(), 0, "trader paid ZTO on an exact-output ZTO swap");
        uint256 poolZtoOut = uint256(uint128(delta.amount1())) + cut; // ZTO the pool actually delivered
        assertLe(cut, poolZtoOut * CUT_0 / PIPS + 1, "cut exceeds 1.30% of the ZTO the pool delivered");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";

import {PoolManager} from "v4-core/src/PoolManager.sol";
import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
import {IHooks} from "v4-core/src/interfaces/IHooks.sol";
import {PoolKey} from "v4-core/src/types/PoolKey.sol";
import {PoolId, PoolIdLibrary} from "v4-core/src/types/PoolId.sol";
import {Currency} from "v4-core/src/types/Currency.sol";
import {TickMath} from "v4-core/src/libraries/TickMath.sol";
import {Hooks} from "v4-core/src/libraries/Hooks.sol";
import {StateLibrary} from "v4-core/src/libraries/StateLibrary.sol";
import {HookMiner} from "v4-periphery/test/shared/HookMiner.sol";

import {Launcher} from "src/Launcher.sol";
import {Kiln} from "src/Kiln.sol";

contract ProofZTO {
    string public constant name = "ZTO";
    string public constant symbol = "ZTO";
    uint8 public constant decimals = 18;
    mapping(address => uint256) public balanceOf;
    mapping(address => mapping(address => uint256)) public allowance;

    function approve(address s, uint256 a) external returns (bool) {
        allowance[msg.sender][s] = a;
        return true;
    }

    function transfer(address to, uint256 a) external returns (bool) {
        balanceOf[msg.sender] -= a;
        balanceOf[to] += a;
        return true;
    }

    function transferFrom(address f, address to, uint256 a) external returns (bool) {
        if (allowance[f][msg.sender] != type(uint256).max) allowance[f][msg.sender] -= a;
        balanceOf[f] -= a;
        balanceOf[to] += a;
        return true;
    }
}

contract ProofPepeo {
    mapping(uint256 => address) public ownerOf;
    mapping(address => uint256) public balanceOf;
}

/// @notice Launcher.open() is permissionless and its salt is public once the open() transaction is in the mempool.
///         PoolManager.initialize() makes no call to a hook whose address lacks the initialize bits, so anyone can
///         initialize the ETH/ZTO pool key for the predicted Kiln address BEFORE the Kiln exists. From then on
///         open(salt, ...) reverts with PoolAlreadyInitialized for that salt, forever, and the griefer can repeat
///         this for every new salt the deployer mines. Fails now; passes once open() tolerates a pre-initialized
///         pool (e.g. read slot0 and skip initialize when sqrtPriceX96 != 0) or otherwise cannot be blocked.
contract Proof1_OpenFrontRunTest is Test {
    using PoolIdLibrary for PoolKey;
    using StateLibrary for IPoolManager;

    uint160 internal constant FLAGS = Hooks.BEFORE_SWAP_FLAG | Hooks.AFTER_SWAP_FLAG
        | Hooks.BEFORE_SWAP_RETURNS_DELTA_FLAG | Hooks.AFTER_SWAP_RETURNS_DELTA_FLAG;

    function test_openCannotBeBlockedByPreInitializingThePoolKey() public {
        IPoolManager manager = new PoolManager(address(this));
        ProofZTO zto = new ProofZTO();
        ProofPepeo pepeo = new ProofPepeo();
        Launcher launcher = new Launcher(address(zto), address(pepeo), address(manager));
        uint160 openPrice = TickMath.getSqrtPriceAtTick(138_180);

        // The deployer mines a salt and broadcasts open(salt, openPrice).
        (address predicted, bytes32 salt) = HookMiner.find(
            address(launcher), FLAGS, type(Kiln).creationCode, abi.encode(address(zto), address(pepeo), address(manager))
        );
        assertEq(predicted.code.length, 0, "Kiln does not exist yet");

        // A griefer sees it in the mempool and initializes the exact pool key first. No hook call happens because
        // the predicted address has no initialize permission bits.
        PoolKey memory key = PoolKey({
            currency0: Currency.wrap(address(0)),
            currency1: Currency.wrap(address(zto)),
            fee: 2000,
            tickSpacing: 60,
            hooks: IHooks(predicted)
        });
        vm.prank(makeAddr("griefer"));
        manager.initialize(key, TickMath.getSqrtPriceAtTick(0));

        // The deployer's open() must still succeed: deploy the Kiln at the mined address and report the pool.
        (address kilnAddr, PoolId poolId) = launcher.open(salt, openPrice);
        assertEq(kilnAddr, predicted, "Kiln deployed at the mined address");
        assertEq(address(launcher.kiln()), predicted, "launcher records the Kiln");
        assertEq(PoolId.unwrap(poolId), PoolId.unwrap(key.toId()), "pool id");
        (uint160 sqrtPriceX96,,, uint24 lpFee) = manager.getSlot0(poolId);
        assertGt(sqrtPriceX96, 0, "pool initialized");
        assertEq(lpFee, 2000);
    }
}