// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {CrownRegistry} from "src/CrownRegistry.sol";
import {CrownToken} from "src/CrownToken.sol";
import {CrownChallengerToken} from "src/CrownChallengerToken.sol";

/// @notice The incumbent beneficiary occupies the only challenge slot the moment it opens, "wins" against zero
/// opposition, pays no slash, and leaves with a fresh 7-day MIN_REIGN that locks every real challenger out again.
contract SelfChallengeTest is Test {
    bytes32 constant CRWN = keccak256("CRWN");

    CrownRegistry registry;
    CrownToken king;
    address incumbent = makeAddr("incumbent");
    address rivalOpener = makeAddr("rivalOpener");

    function setUp() public {
        registry = new CrownRegistry();
        king = new CrownToken();
        registry.registerKing(CRWN, address(king), incumbent);
        vm.deal(incumbent, 1 ether);
        vm.deal(rivalOpener, 1 ether);
    }

    function test_incumbentSelfChallengeCannotResetReignForFreeAndLockOutRivals() public {
        // A real rival prepares a same-symbol token and waits for the minimum reign to pass.
        CrownChallengerToken rivalToken = new CrownChallengerToken(rivalOpener);
        // The incumbent's shadow token: another same-symbol ERC-20 it controls.
        CrownChallengerToken shadow = new CrownChallengerToken(incumbent);

        (,, uint64 reign0) = registry.king(CRWN);
        vm.warp(uint256(reign0) + registry.MIN_REIGN());

        // The incumbent takes the slot first (same block as the rival's attempt).
        vm.prank(incumbent);
        uint256 id = registry.openChallenge{value: 0.01 ether}(CRWN, address(shadow));
        vm.prank(incumbent);
        registry.stake{value: 0.04 ether}(id, CrownRegistry.Side.Challenger); // reaches QUORUM alone

        // The rival is shut out: one live challenge per ticker.
        vm.prank(rivalOpener);
        vm.expectRevert(CrownRegistry.ChallengeLive.selector);
        registry.openChallenge{value: 0.01 ether}(CRWN, address(rivalToken));

        vm.warp(block.timestamp + registry.STAKING_WINDOW() + registry.TIMELOCK());
        registry.finalize(id);

        // Nothing changed for anyone except the clock: same beneficiary, zero slash, full refund.
        (address kingToken, address beneficiary, uint64 reign1) = registry.king(CRWN);
        assertEq(kingToken, address(shadow));
        assertEq(beneficiary, incumbent, "the fee stream never moved");
        uint256 before = incumbent.balance;
        vm.prank(incumbent);
        registry.claim(id);
        assertEq(incumbent.balance - before, 0.05 ether, "the self-challenge cost nothing");

        // Expected: a ticker whose beneficiary did not change, against zero opposition, is still challengeable.
        // Actual: reignStartedAt was reset, so the rival is locked out for another MIN_REIGN.
        assertEq(reign1, reign0, "uncontested self-flip must not restart the minimum reign");
        vm.prank(rivalOpener);
        registry.openChallenge{value: 0.01 ether}(CRWN, address(rivalToken));
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {PoolManager} from "v4-core/src/PoolManager.sol";
import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
import {IHooks} from "v4-core/src/interfaces/IHooks.sol";
import {IUnlockCallback} from "v4-core/src/interfaces/callback/IUnlockCallback.sol";
import {PoolKey} from "v4-core/src/types/PoolKey.sol";
import {Currency} from "v4-core/src/types/Currency.sol";
import {BalanceDelta} from "v4-core/src/types/BalanceDelta.sol";
import {ModifyLiquidityParams, SwapParams} from "v4-core/src/types/PoolOperation.sol";
import {TickMath} from "v4-core/src/libraries/TickMath.sol";
import {CrownHook} from "src/CrownHook.sol";
import {CrownToken} from "src/CrownToken.sol";
import {HookFlags} from "src/HookFlags.sol";

/// @dev Minimal router: swaps or adds liquidity from its own balance and settles afterwards.
contract Router is IUnlockCallback {
    IPoolManager immutable manager;

    constructor(IPoolManager m) {
        manager = m;
    }

    function swap(PoolKey memory key, SwapParams memory p) external returns (BalanceDelta) {
        return abi.decode(manager.unlock(abi.encode(uint8(0), abi.encode(key, p))), (BalanceDelta));
    }

    function addLiquidity(PoolKey memory key, int24 lo, int24 hi, int256 liq) external returns (BalanceDelta) {
        return abi.decode(
            manager.unlock(abi.encode(uint8(1), abi.encode(key, ModifyLiquidityParams(lo, hi, liq, bytes32(0))))),
            (BalanceDelta)
        );
    }

    function unlockCallback(bytes calldata raw) external returns (bytes memory) {
        require(msg.sender == address(manager));
        (uint8 action, bytes memory data) = abi.decode(raw, (uint8, bytes));
        BalanceDelta delta;
        PoolKey memory key;
        if (action == 0) {
            SwapParams memory p;
            (key, p) = abi.decode(data, (PoolKey, SwapParams));
            delta = manager.swap(key, p, "");
        } else {
            ModifyLiquidityParams memory p;
            (key, p) = abi.decode(data, (PoolKey, ModifyLiquidityParams));
            (delta,) = manager.modifyLiquidity(key, p, "");
        }
        _settle(key.currency0, delta.amount0());
        _settle(key.currency1, delta.amount1());
        return abi.encode(delta);
    }

    function _settle(Currency c, int128 a) private {
        if (a < 0) {
            uint256 owed = uint256(uint128(-a));
            manager.sync(c);
            if (c.isAddressZero()) manager.settle{value: owed}();
            else {
                IERC20(Currency.unwrap(c)).transfer(address(manager), owed);
                manager.settle();
            }
        } else if (a > 0) {
            manager.take(c, address(this), uint256(uint128(a)));
        }
    }

    receive() external payable {}
}

/// @notice The beforeSwap path charges the cut on the amount the trader *asked* for, the afterSwap path on what the
/// pool *actually* moved. A partially filled exact-input buy pays 1% of the unfilled amount too.
contract PartialFillCutTest is Test {
    uint160 constant SQRT_PRICE_1_1 = 79228162514264337593543950336;
    bytes32 constant CRWN = keccak256("CRWN");

    address factory = makeAddr("factory");
    address payer = makeAddr("payer");
    PoolManager manager;
    CrownHook hook;
    CrownToken token;
    PoolKey key;
    Router lp;
    Router trader;

    function setUp() public {
        manager = new PoolManager(address(this));
        address at = address((uint160(0xC0FFEE) << 100) | HookFlags.CROWN_HOOK);
        deployCodeTo("CrownHook.sol:CrownHook", abi.encode(manager, factory, payer), at);
        hook = CrownHook(at);
        token = new CrownToken();
        key = PoolKey(Currency.wrap(address(0)), Currency.wrap(address(token)), 12_500, 60, IHooks(at));
        vm.prank(factory);
        manager.initialize(key, SQRT_PRICE_1_1);
        lp = new Router(manager);
        trader = new Router(manager);
        vm.deal(address(lp), 1_000_000 ether);
        vm.deal(address(trader), 1_000_000 ether);
        token.transfer(address(lp), 400_000_000 ether);
        token.transfer(address(trader), 400_000_000 ether);
        lp.addLiquidity(key, TickMath.minUsableTick(60), TickMath.maxUsableTick(60), 1_000 ether);
    }

    function test_exactInputBuy_partialFill_cutMatchesTheFilledAmount() public {
        // Ask to spend 100 ETH but stop one tick below the current price: only ~3 ETH can fill.
        uint160 limit = TickMath.getSqrtPriceAtTick(-60);
        uint256 before = payer.balance;
        BalanceDelta d = trader.swap(key, SwapParams(true, -100 ether, limit));
        uint256 cut = payer.balance - before;
        uint256 traderPaid = uint256(-int256(d.amount0()));
        uint256 filled = traderPaid - cut; // what the pool actually received
        assertLt(filled, 10 ether, "the fill was partial");
        // Expected: the cut is 1% of what was swapped. Actual: 1 ETH, 1% of the 100 ETH that was never traded.
        assertEq(cut, filled / 100, "cut charged on the unfilled amount");
    }

    function test_exactOutputSell_partialFill_doesNotMakeTheSellerPayEth() public {
        // Ask for exactly 100 ETH out, stopping ten ticks above the current price: only ~0.5 ETH can be delivered.
        uint160 limit = TickMath.getSqrtPriceAtTick(10);
        uint256 before = payer.balance;
        BalanceDelta d = trader.swap(key, SwapParams(false, 100 ether, limit));
        uint256 cut = payer.balance - before;
        int256 received = int256(d.amount0());
        assertGt(received, 0, "seller of tokens must receive ETH, not pay it");
        assertEq(cut, (uint256(received) + cut) / 100, "cut charged on the undelivered amount");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {PoolManager} from "v4-core/src/PoolManager.sol";
import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
import {IHooks} from "v4-core/src/interfaces/IHooks.sol";
import {IUnlockCallback} from "v4-core/src/interfaces/callback/IUnlockCallback.sol";
import {PoolKey} from "v4-core/src/types/PoolKey.sol";
import {Currency} from "v4-core/src/types/Currency.sol";
import {BalanceDelta} from "v4-core/src/types/BalanceDelta.sol";
import {ModifyLiquidityParams, SwapParams} from "v4-core/src/types/PoolOperation.sol";
import {TickMath} from "v4-core/src/libraries/TickMath.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {CrownHook} from "src/CrownHook.sol";
import {CrownToken} from "src/CrownToken.sol";
import {HookFlags} from "src/HookFlags.sol";

/// @dev Minimal v4 router that lets the test choose amountSpecified and sqrtPriceLimitX96 freely.
contract LimitRouter is IUnlockCallback {
    IPoolManager public immutable manager;

    constructor(IPoolManager m) {
        manager = m;
    }

    function swap(PoolKey memory key, SwapParams memory p) external returns (BalanceDelta) {
        return abi.decode(manager.unlock(abi.encode(uint8(0), key, p, ModifyLiquidityParams(0, 0, 0, 0))), (BalanceDelta));
    }

    function addLiquidity(PoolKey memory key, int24 lo, int24 hi, int256 liq) external returns (BalanceDelta) {
        return abi.decode(
            manager.unlock(abi.encode(uint8(1), key, SwapParams(false, 0, 0), ModifyLiquidityParams(lo, hi, liq, 0))),
            (BalanceDelta)
        );
    }

    function unlockCallback(bytes calldata raw) external returns (bytes memory) {
        require(msg.sender == address(manager), "not manager");
        (uint8 action, PoolKey memory key, SwapParams memory sp, ModifyLiquidityParams memory mp) =
            abi.decode(raw, (uint8, PoolKey, SwapParams, ModifyLiquidityParams));
        BalanceDelta delta;
        if (action == 0) delta = manager.swap(key, sp, "");
        else (delta,) = manager.modifyLiquidity(key, mp, "");
        _settle(key.currency0, delta.amount0());
        _settle(key.currency1, delta.amount1());
        return abi.encode(delta);
    }

    function _settle(Currency c, int128 amount) private {
        if (amount < 0) {
            uint256 owed = uint256(uint128(-amount));
            manager.sync(c);
            if (c.isAddressZero()) manager.settle{value: owed}();
            else {
                IERC20(Currency.unwrap(c)).transfer(address(manager), owed);
                manager.settle();
            }
        } else if (amount > 0) {
            manager.take(c, address(this), uint256(uint128(amount)));
        }
    }

    receive() external payable {}
}

contract CrownCutBypassProofTest is Test {
    uint160 internal constant SQRT_PRICE_1_1 = 79228162514264337593543950336;
    bytes32 internal constant CRWN = keccak256("CRWN");
    Currency internal constant ETH = Currency.wrap(address(0));

    address internal factory = makeAddr("factory");
    address internal payer = makeAddr("payer");

    PoolManager internal manager;
    CrownHook internal hook;
    CrownToken internal token;
    PoolKey internal key;
    LimitRouter internal lp;
    LimitRouter internal trader;

    function setUp() public {
        manager = new PoolManager(address(this));
        address at = address((uint160(0xC0FFEE) << 100) | HookFlags.CROWN_HOOK);
        deployCodeTo("CrownHook.sol:CrownHook", abi.encode(manager, factory, payer), at);
        hook = CrownHook(at);
        token = new CrownToken();
        key = PoolKey(ETH, Currency.wrap(address(token)), 12_500, 60, IHooks(at));
        vm.prank(factory);
        manager.initialize(key, SQRT_PRICE_1_1);

        lp = new LimitRouter(manager);
        trader = new LimitRouter(manager);
        vm.deal(address(lp), 1_000_000 ether);
        vm.deal(address(trader), 1_000_000 ether);
        token.transfer(address(lp), 100_000_000 ether);
        token.transfer(address(trader), 100_000_000 ether);
        lp.addLiquidity(key, TickMath.minUsableTick(60), TickMath.maxUsableTick(60), 1_000 ether);
    }

    /// @dev Finding: an exact-input buy whose amountSpecified exceeds uint128.max pays no cut at all, although the
    /// pool executes a normal-sized trade bounded by the price limit. _crown() early-returns 0 on
    /// `amount > type(uint128).max`, so beforeSwap returns a zero delta and the beneficiary gets nothing.
    function test_oversizedAmountSpecified_skipsTheCut() public {
        uint256 beneficiaryBefore = payer.balance;
        uint160 limit = TickMath.getSqrtPriceAtTick(-60); // one spacing below the current price
        SwapParams memory p = SwapParams({
            zeroForOne: true,
            amountSpecified: -int256(uint256(type(uint128).max) + 1),
            sqrtPriceLimitX96: limit
        });

        uint256 ethBefore = address(trader).balance;
        try trader.swap(key, p) returns (BalanceDelta d) {
            uint256 ethIn = ethBefore - address(trader).balance;
            // the pool actually took a few ETH from the trader
            assertGt(ethIn, 1 ether, "a real trade executed");
            assertEq(uint256(-int256(d.amount0())), ethIn);
            // ...so the king must have been paid its 1% cut on it, as on any other buy
            uint256 paid = hook.crownPaid(CRWN, ETH)
                + (payer.balance - beneficiaryBefore)
                + manager.balanceOf(payer, 0);
            assertGt(paid, 0, "DEFECT: trade executed and the crown cut was skipped");
        } catch {
            // A fix may instead refuse the oversized amount; that is acceptable.
        }
    }

    /// @dev Companion: the same trade with amountSpecified = uint128.max (one wei less) IS charged, proving the
    /// price limit, not the amount, bounds what the pool consumes, and the only difference is the early return.
    function test_sameTradeOneWeiSmaller_isCharged() public {
        uint160 limit = TickMath.getSqrtPriceAtTick(-60);
        SwapParams memory p = SwapParams({
            zeroForOne: true,
            amountSpecified: -int256(uint256(type(uint128).max)),
            sqrtPriceLimitX96: limit
        });
        uint256 ethBefore = address(trader).balance;
        // the cut on uint128.max input is ~1.7e36 ETH; the manager cannot pay it, so a claim is minted and the
        // trader must fund it: settlement fails, the swap reverts, and no free trade happens.
        vm.expectRevert();
        trader.swap(key, p);
        assertEq(ethBefore, address(trader).balance);
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {PoolManager} from "v4-core/src/PoolManager.sol";
import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
import {IHooks} from "v4-core/src/interfaces/IHooks.sol";
import {IUnlockCallback} from "v4-core/src/interfaces/callback/IUnlockCallback.sol";
import {PoolKey} from "v4-core/src/types/PoolKey.sol";
import {Currency} from "v4-core/src/types/Currency.sol";
import {BalanceDelta} from "v4-core/src/types/BalanceDelta.sol";
import {ModifyLiquidityParams, SwapParams} from "v4-core/src/types/PoolOperation.sol";
import {TickMath} from "v4-core/src/libraries/TickMath.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {CrownHook} from "src/CrownHook.sol";
import {CrownToken} from "src/CrownToken.sol";
import {HookFlags} from "src/HookFlags.sol";

/// @dev Minimal v4 router that lets the test choose amountSpecified and sqrtPriceLimitX96 freely.
contract LimitRouter is IUnlockCallback {
    IPoolManager public immutable manager;

    constructor(IPoolManager m) {
        manager = m;
    }

    function swap(PoolKey memory key, SwapParams memory p) external returns (BalanceDelta) {
        return abi.decode(manager.unlock(abi.encode(uint8(0), key, p, ModifyLiquidityParams(0, 0, 0, 0))), (BalanceDelta));
    }

    function addLiquidity(PoolKey memory key, int24 lo, int24 hi, int256 liq) external returns (BalanceDelta) {
        return abi.decode(
            manager.unlock(abi.encode(uint8(1), key, SwapParams(false, 0, 0), ModifyLiquidityParams(lo, hi, liq, 0))),
            (BalanceDelta)
        );
    }

    function unlockCallback(bytes calldata raw) external returns (bytes memory) {
        require(msg.sender == address(manager), "not manager");
        (uint8 action, PoolKey memory key, SwapParams memory sp, ModifyLiquidityParams memory mp) =
            abi.decode(raw, (uint8, PoolKey, SwapParams, ModifyLiquidityParams));
        BalanceDelta delta;
        if (action == 0) delta = manager.swap(key, sp, "");
        else (delta,) = manager.modifyLiquidity(key, mp, "");
        _settle(key.currency0, delta.amount0());
        _settle(key.currency1, delta.amount1());
        return abi.encode(delta);
    }

    function _settle(Currency c, int128 amount) private {
        if (amount < 0) {
            uint256 owed = uint256(uint128(-amount));
            manager.sync(c);
            if (c.isAddressZero()) manager.settle{value: owed}();
            else {
                IERC20(Currency.unwrap(c)).transfer(address(manager), owed);
                manager.settle();
            }
        } else if (amount > 0) {
            manager.take(c, address(this), uint256(uint128(amount)));
        }
    }

    receive() external payable {}
}

contract CrownPartialFillProofTest is Test {
    uint160 internal constant SQRT_PRICE_1_1 = 79228162514264337593543950336;
    bytes32 internal constant CRWN = keccak256("CRWN");
    Currency internal constant ETH = Currency.wrap(address(0));

    address internal factory = makeAddr("factory");
    address internal payer = makeAddr("payer");

    PoolManager internal manager;
    CrownHook internal hook;
    CrownToken internal token;
    PoolKey internal key;
    LimitRouter internal lp;
    LimitRouter internal trader;

    function setUp() public {
        manager = new PoolManager(address(this));
        address at = address((uint160(0xC0FFEE) << 100) | HookFlags.CROWN_HOOK);
        deployCodeTo("CrownHook.sol:CrownHook", abi.encode(manager, factory, payer), at);
        hook = CrownHook(at);
        token = new CrownToken();
        key = PoolKey(ETH, Currency.wrap(address(token)), 12_500, 60, IHooks(at));
        vm.prank(factory);
        manager.initialize(key, SQRT_PRICE_1_1);

        lp = new LimitRouter(manager);
        trader = new LimitRouter(manager);
        vm.deal(address(lp), 1_000_000 ether);
        vm.deal(address(trader), 1_000_000 ether);
        token.transfer(address(lp), 100_000_000 ether);
        token.transfer(address(trader), 100_000_000 ether);
        lp.addLiquidity(key, TickMath.minUsableTick(60), TickMath.maxUsableTick(60), 1_000 ether);
    }

    /// @dev Exact-output sell: tokens in, exactly 100 ETH requested out, price limit ten ticks up. The pool can
    /// deliver only ~0.5 ETH before the limit, but beforeSwap already took a 1 ETH cut on the 100 ETH *requested*
    /// (CrownHook.sol:162-163). The swapper ends the swap paying ~0.506 CRWN AND ~0.5 ETH, receiving no ETH.
    /// On fixed code the swap either reverts (partial fill refused) or the swapper's ETH balance does not go down.
    function test_exactOutputSell_partialFill_mustNotChargeSwapperEth() public {
        uint160 limit = TickMath.getSqrtPriceAtTick(10);
        SwapParams memory p = SwapParams({zeroForOne: false, amountSpecified: 100 ether, sqrtPriceLimitX96: limit});
        uint256 ethBefore = address(trader).balance;
        try trader.swap(key, p) returns (BalanceDelta d) {
            emit log_named_int("amount0 (ETH) delta seen by swapper", d.amount0());
            emit log_named_uint("cut paid to king", hook.crownPaid(CRWN, ETH));
            assertGe(
                address(trader).balance,
                ethBefore,
                "DEFECT: swapper asked for ETH out and ended up paying ETH (cut charged on the unfilled request)"
            );
        } catch {
            // refusing the partial fill is an acceptable fix
        }
    }

    /// @dev Exact-input buy of 100 ETH limited to one tick: ~0.05 ETH executes but the 1 ETH cut on the 100 ETH
    /// specified is still charged, 20x the executed amount. Fixed code charges at most the cut on what executed
    /// (plus rounding) or refuses the partial fill.
    function test_exactInputBuy_partialFill_cutBoundedByExecutedAmount() public {
        uint160 limit = TickMath.getSqrtPriceAtTick(-1);
        SwapParams memory p = SwapParams({zeroForOne: true, amountSpecified: -100 ether, sqrtPriceLimitX96: limit});
        uint256 ethBefore = address(trader).balance;
        try trader.swap(key, p) {
            uint256 ethIn = ethBefore - address(trader).balance;
            uint256 cut = hook.crownPaid(CRWN, ETH);
            uint256 executed = ethIn - cut;
            emit log_named_uint("ETH actually swapped", executed);
            emit log_named_uint("cut", cut);
            assertLe(cut, executed * 500 / 10_000 + 1, "DEFECT: cut exceeds the maximum 5% of the executed input");
        } catch {}
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {PoolManager} from "v4-core/src/PoolManager.sol";
import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
import {IHooks} from "v4-core/src/interfaces/IHooks.sol";
import {IUnlockCallback} from "v4-core/src/interfaces/callback/IUnlockCallback.sol";
import {PoolKey} from "v4-core/src/types/PoolKey.sol";
import {Currency} from "v4-core/src/types/Currency.sol";
import {BalanceDelta} from "v4-core/src/types/BalanceDelta.sol";
import {ModifyLiquidityParams, SwapParams} from "v4-core/src/types/PoolOperation.sol";
import {TickMath} from "v4-core/src/libraries/TickMath.sol";
import {CrownHook} from "src/CrownHook.sol";
import {CrownRegistry} from "src/CrownRegistry.sol";
import {CrownToken} from "src/CrownToken.sol";
import {HookFlags} from "src/HookFlags.sol";

/// @dev Router that settles after the action, with a caller-chosen price limit.
contract LimitSwapper is IUnlockCallback {
    IPoolManager public immutable manager;

    constructor(IPoolManager m) {
        manager = m;
    }

    function swap(PoolKey memory key, bool zeroForOne, int256 amountSpecified, uint160 limit)
        external
        returns (BalanceDelta)
    {
        return abi.decode(manager.unlock(abi.encode(uint8(0), key, SwapParams(zeroForOne, amountSpecified, limit))), (BalanceDelta));
    }

    function modifyLiquidity(PoolKey memory key, int24 lo, int24 hi, int256 liq) external returns (BalanceDelta) {
        return abi.decode(
            manager.unlock(abi.encode(uint8(1), key, SwapParams(false, 0, 0), lo, hi, liq)), (BalanceDelta)
        );
    }

    function unlockCallback(bytes calldata raw) external returns (bytes memory) {
        require(msg.sender == address(manager), "not manager");
        uint8 action = abi.decode(raw[:32], (uint8));
        BalanceDelta delta;
        PoolKey memory key;
        if (action == 0) {
            SwapParams memory p;
            (, key, p) = abi.decode(raw, (uint8, PoolKey, SwapParams));
            delta = manager.swap(key, p, "");
        } else {
            int24 lo;
            int24 hi;
            int256 liq;
            (, key,, lo, hi, liq) = abi.decode(raw, (uint8, PoolKey, SwapParams, int24, int24, int256));
            (delta,) = manager.modifyLiquidity(key, ModifyLiquidityParams(lo, hi, liq, 0), "");
        }
        _settle(key.currency0, delta.amount0());
        _settle(key.currency1, delta.amount1());
        return abi.encode(delta);
    }

    function _settle(Currency c, int128 amount) private {
        if (amount < 0) {
            uint256 owed = uint256(uint128(-amount));
            manager.sync(c);
            if (c.isAddressZero()) manager.settle{value: owed}();
            else {
                IERC20(Currency.unwrap(c)).transfer(address(manager), owed);
                manager.settle();
            }
        } else if (amount > 0) {
            manager.take(c, address(this), uint256(uint128(amount)));
        }
    }

    receive() external payable {}
}

contract PartialFillTest is Test {
    uint160 constant SQRT_1_1 = 79228162514264337593543950336;
    bytes32 constant CRWN = keccak256("CRWN");
    address factory = makeAddr("factory");
    address payer = makeAddr("payer");

    PoolManager manager;
    CrownHook hook;
    CrownToken token;
    PoolKey key;
    LimitSwapper lp;
    LimitSwapper trader;

    function setUp() public {
        manager = new PoolManager(address(this));
        address at = address((uint160(0xC0FFEE) << 100) | HookFlags.CROWN_HOOK);
        deployCodeTo("CrownHook.sol:CrownHook", abi.encode(manager, factory, payer), at);
        hook = CrownHook(at);
        token = new CrownToken();
        key = PoolKey(Currency.wrap(address(0)), Currency.wrap(address(token)), 12_500, 60, IHooks(at));
        vm.prank(factory);
        manager.initialize(key, SQRT_1_1);
        lp = new LimitSwapper(manager);
        trader = new LimitSwapper(manager);
        vm.deal(address(lp), 1_000_000 ether);
        vm.deal(address(trader), 1_000_000 ether);
        token.transfer(address(lp), 400_000_000 ether);
        token.transfer(address(trader), 400_000_000 ether);
        lp.modifyLiquidity(key, TickMath.minUsableTick(60), TickMath.maxUsableTick(60), 1_000 ether);
    }

    /// Exact-input buy stopped early by a price limit: the hook charges 1% of the 100 ETH asked, not of what the pool took.
    function test_exactInputBuy_partialFill_cutOnRequestedNotExecuted() public {
        uint256 before = payer.balance;
        uint160 limit = uint160(uint256(SQRT_1_1) * 999 / 1000);
        BalanceDelta d = trader.swap(key, true, -100 ether, limit);
        uint256 cut = payer.balance - before;
        uint256 paidTotal = uint256(-int256(d.amount0()));
        uint256 consumed = paidTotal - cut;
        emit log_named_uint("consumed by pool (wei)", consumed);
        emit log_named_uint("cut (wei)", cut);
        // What a 1% cut on the executed amount would be, versus what was charged.
        assertLe(cut, consumed / 100 + 1, "cut should be ~1% of executed input");
    }

    /// Exact-output sell stopped early: the hook takes 1% of the 100 ETH requested before the pool produces ~0.5 ETH,
    /// so the seller's ETH delta is negative: it pays tokens AND ETH and receives nothing.
    function test_exactOutputSell_partialFill_sellerPaysEth() public {
        uint256 beforePayer = payer.balance;
        uint256 beforeTrader = address(trader).balance;
        // ~0.5 ETH of output before the limit is hit
        uint160 limit = uint160(uint256(SQRT_1_1) * 10005 / 10000);
        BalanceDelta d = trader.swap(key, false, int256(100 ether), limit);
        emit log_named_int("trader amount0 (ETH delta)", d.amount0());
        emit log_named_int("trader amount1 (token delta)", d.amount1());
        emit log_named_uint("cut paid to king", payer.balance - beforePayer);
        assertGe(address(trader).balance, beforeTrader, "a seller of tokens must not end up paying ETH");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {PoolManager} from "v4-core/src/PoolManager.sol";
import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
import {IHooks} from "v4-core/src/interfaces/IHooks.sol";
import {IUnlockCallback} from "v4-core/src/interfaces/callback/IUnlockCallback.sol";
import {PoolKey} from "v4-core/src/types/PoolKey.sol";
import {Currency} from "v4-core/src/types/Currency.sol";
import {BalanceDelta} from "v4-core/src/types/BalanceDelta.sol";
import {ModifyLiquidityParams, SwapParams} from "v4-core/src/types/PoolOperation.sol";
import {TickMath} from "v4-core/src/libraries/TickMath.sol";
import {CrownHook} from "src/CrownHook.sol";
import {CrownRegistry} from "src/CrownRegistry.sol";
import {CrownToken} from "src/CrownToken.sol";
import {HookFlags} from "src/HookFlags.sol";

contract Rival is ERC20 {
    constructor() ERC20("Crown Demo", "CRWN") {
        _mint(msg.sender, 1e24);
    }
}

/// @dev A king beneficiary that, while being paid, resets the manager's synced currency. sync() is callable by anyone
/// at any time and changes neither the hook's delta nor the nonzero-delta count, so payCrown's checks pass.
contract SyncResetter {
    IPoolManager immutable manager;

    constructor(IPoolManager m) {
        manager = m;
    }

    receive() external payable {
        manager.sync(Currency.wrap(address(0)));
    }
}

/// @dev Router that pays its ERC-20 input up front: sync, transfer, swap, settle (all inside one unlock).
contract PrepaySeller is IUnlockCallback {
    IPoolManager public immutable manager;

    constructor(IPoolManager m) {
        manager = m;
    }

    function sell(PoolKey memory key, uint256 amountIn) external returns (BalanceDelta) {
        return abi.decode(manager.unlock(abi.encode(key, amountIn)), (BalanceDelta));
    }

    function unlockCallback(bytes calldata raw) external returns (bytes memory) {
        require(msg.sender == address(manager), "not manager");
        (PoolKey memory key, uint256 amountIn) = abi.decode(raw, (PoolKey, uint256));
        manager.sync(key.currency1);
        IERC20(Currency.unwrap(key.currency1)).transfer(address(manager), amountIn);
        BalanceDelta d = manager.swap(key, SwapParams(false, -int256(amountIn), TickMath.MAX_SQRT_PRICE - 1), "");
        manager.settle();
        if (d.amount0() > 0) manager.take(key.currency0, address(this), uint256(uint128(d.amount0())));
        return abi.encode(d);
    }

    receive() external payable {}
}

contract LpRouter is IUnlockCallback {
    IPoolManager public immutable manager;

    constructor(IPoolManager m) {
        manager = m;
    }

    function add(PoolKey memory key, int256 liq) external {
        manager.unlock(abi.encode(key, liq));
    }

    function unlockCallback(bytes calldata raw) external returns (bytes memory) {
        (PoolKey memory key, int256 liq) = abi.decode(raw, (PoolKey, int256));
        (BalanceDelta d,) = manager.modifyLiquidity(
            key, ModifyLiquidityParams(TickMath.minUsableTick(60), TickMath.maxUsableTick(60), liq, 0), ""
        );
        manager.sync(key.currency0);
        manager.settle{value: uint256(uint128(-d.amount0()))}();
        manager.sync(key.currency1);
        IERC20(Currency.unwrap(key.currency1)).transfer(address(manager), uint256(uint128(-d.amount1())));
        manager.settle();
        return "";
    }

    receive() external payable {}
}

contract SyncGriefTest is Test {
    uint160 constant SQRT_1_1 = 79228162514264337593543950336;
    bytes32 constant CRWN = keccak256("CRWN");
    address factory = makeAddr("factory");
    address payer = makeAddr("payer");

    PoolManager manager;
    CrownHook hook;
    CrownRegistry registry;
    CrownToken token;
    PoolKey key;

    function setUp() public {
        manager = new PoolManager(address(this));
        address at = address((uint160(0xC0FFEE) << 100) | HookFlags.CROWN_HOOK);
        deployCodeTo("CrownHook.sol:CrownHook", abi.encode(manager, factory, payer), at);
        hook = CrownHook(at);
        registry = hook.registry();
        token = new CrownToken();
        key = PoolKey(Currency.wrap(address(0)), Currency.wrap(address(token)), 12_500, 60, IHooks(at));
        vm.prank(factory);
        manager.initialize(key, SQRT_1_1);
        LpRouter lp = new LpRouter(manager);
        vm.deal(address(lp), 10_000 ether);
        token.transfer(address(lp), 10_000 ether);
        lp.add(key, 1_000 ether);
    }

    function _crownHostile() internal {
        // the hostile party wins CRWN with a rival token; its beneficiary is a contract
        SyncResetter hostile = new SyncResetter(manager);
        vm.warp(block.timestamp + 7 days);
        Rival rival = new Rival();
        vm.deal(address(hostile), 1 ether);
        vm.prank(address(hostile));
        uint256 id = registry.openChallenge{value: 0.01 ether}(CRWN, address(rival));
        vm.prank(address(hostile));
        registry.stake{value: 0.05 ether}(id, CrownRegistry.Side.Challenger);
        vm.warp(block.timestamp + 96 hours);
        registry.finalize(id);
        assertEq(registry.beneficiaryOf(CRWN), address(hostile));
    }

    function test_prepayRouterSell_worksWithHonestKing() public {
        PrepaySeller r = new PrepaySeller(manager);
        token.transfer(address(r), 10 ether);
        BalanceDelta d = r.sell(key, 1 ether);
        assertGt(d.amount0(), 0);
    }

    function test_prepayRouterSell_blockedByHostileKing() public {
        _crownHostile();
        PrepaySeller r = new PrepaySeller(manager);
        token.transfer(address(r), 10 ether);
        // the hook promises never to block a swap; the king's beneficiary makes this router's unlock revert
        r.sell(key, 1 ether);
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {CrownRegistry} from "src/CrownRegistry.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";

contract SymToken is ERC20 {
    constructor(string memory s) ERC20("Crown Demo", s) {}
}

/// @notice The incumbent beneficiary monopolises the single challenge slot of its ticker at zero cost: it opens a
/// challenge against itself with a throwaway same-symbol token and stakes to quorum on the challenger side. Honest
/// challengers are refused (ChallengeLive) for the whole 4-day challenge; the self-challenge then "wins", the
/// beneficiary is unchanged, the reign clock restarts (7 more days of ReignTooShort) and the incumbent's full stake
/// is refunded. Repeated every 7 days, this holds the crown for gas only. The brief guarantees that anyone can
/// challenge a king once it has reigned 7 days; this test asserts that guarantee against a self-challenging king.
/// The incumbent's own calls are made low-level so that a fix refusing them does not break the test.
contract SelfChallengeLockoutTest is Test {
    bytes32 constant TICKER = keccak256("CRWN");
    CrownRegistry registry;
    address incumbent = makeAddr("incumbent");
    address honest = makeAddr("honest");
    SymToken kingToken;
    SymToken honestToken;

    function setUp() public {
        vm.warp(1_700_000_000);
        registry = new CrownRegistry();
        kingToken = new SymToken("CRWN");
        honestToken = new SymToken("CRWN");
        registry.registerKing(TICKER, address(kingToken), incumbent);
        vm.deal(incumbent, 1 ether);
        vm.deal(honest, 1 ether);
        vm.warp(block.timestamp + 7 days);
    }

    /// @dev The incumbent opens a challenge against its own crown with a fresh throwaway token and stakes to quorum.
    function selfChallenge() internal returns (bool opened, uint256 id) {
        vm.startPrank(incumbent);
        SymToken dummy = new SymToken("CRWN");
        bytes memory ret;
        (opened, ret) = address(registry).call{value: 0.01 ether}(
            abi.encodeCall(CrownRegistry.openChallenge, (TICKER, address(dummy)))
        );
        if (opened) {
            id = abi.decode(ret, (uint256));
            address(registry).call{value: 0.04 ether}(abi.encodeCall(CrownRegistry.stake, (id, CrownRegistry.Side.Challenger)));
        }
        vm.stopPrank();
    }

    function test_honestChallengerCanChallengeDespiteIncumbentSelfChallenge() public {
        uint256 incumbentBefore = incumbent.balance;

        // Cycle 1: self-challenge, let it resolve.
        (bool opened, uint256 id) = selfChallenge();
        vm.warp(block.timestamp + 96 hours);
        if (opened) {
            registry.finalize(id);
            // On the current code the self-challenge wins: same beneficiary, reign clock reset, full refund.
            assertEq(registry.beneficiaryOf(TICKER), incumbent, "beneficiary unchanged");
            vm.prank(incumbent);
            registry.claim(id);
            assertEq(incumbent.balance, incumbentBefore, "lockout cost nothing");
            assertEq(registry.TREASURY().balance, 0, "treasury earned nothing");
        }

        // Cycle 2: at the first eligible second the incumbent self-challenges again, ahead of the honest challenger.
        vm.warp(block.timestamp + 7 days);
        selfChallenge();

        // Brief: a king is challengeable by anyone once it has reigned 7 days. This wallet has held the crown for
        // 11 days and no outside challenge has ever been resolved against it. This call must succeed.
        vm.prank(honest);
        registry.openChallenge{value: 0.01 ether}(TICKER, address(honestToken));
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {PoolManager} from "v4-core/src/PoolManager.sol";
import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
import {IHooks} from "v4-core/src/interfaces/IHooks.sol";
import {IUnlockCallback} from "v4-core/src/interfaces/callback/IUnlockCallback.sol";
import {PoolKey} from "v4-core/src/types/PoolKey.sol";
import {Currency} from "v4-core/src/types/Currency.sol";
import {BalanceDelta} from "v4-core/src/types/BalanceDelta.sol";
import {ModifyLiquidityParams, SwapParams} from "v4-core/src/types/PoolOperation.sol";
import {TickMath} from "v4-core/src/libraries/TickMath.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {CrownHook} from "src/CrownHook.sol";
import {CrownToken} from "src/CrownToken.sol";
import {HookFlags} from "src/HookFlags.sol";

/// @dev Minimal v4 router that lets the test choose amountSpecified and sqrtPriceLimitX96 freely.
contract LimitRouter is IUnlockCallback {
    IPoolManager public immutable manager;

    constructor(IPoolManager m) {
        manager = m;
    }

    function swap(PoolKey memory key, SwapParams memory p) external returns (BalanceDelta) {
        return abi.decode(manager.unlock(abi.encode(uint8(0), key, p, ModifyLiquidityParams(0, 0, 0, 0))), (BalanceDelta));
    }

    function addLiquidity(PoolKey memory key, int24 lo, int24 hi, int256 liq) external returns (BalanceDelta) {
        return abi.decode(
            manager.unlock(abi.encode(uint8(1), key, SwapParams(false, 0, 0), ModifyLiquidityParams(lo, hi, liq, 0))),
            (BalanceDelta)
        );
    }

    function unlockCallback(bytes calldata raw) external returns (bytes memory) {
        require(msg.sender == address(manager), "not manager");
        (uint8 action, PoolKey memory key, SwapParams memory sp, ModifyLiquidityParams memory mp) =
            abi.decode(raw, (uint8, PoolKey, SwapParams, ModifyLiquidityParams));
        BalanceDelta delta;
        if (action == 0) delta = manager.swap(key, sp, "");
        else (delta,) = manager.modifyLiquidity(key, mp, "");
        _settle(key.currency0, delta.amount0());
        _settle(key.currency1, delta.amount1());
        return abi.encode(delta);
    }

    function _settle(Currency c, int128 amount) private {
        if (amount < 0) {
            uint256 owed = uint256(uint128(-amount));
            manager.sync(c);
            if (c.isAddressZero()) manager.settle{value: owed}();
            else {
                IERC20(Currency.unwrap(c)).transfer(address(manager), owed);
                manager.settle();
            }
        } else if (amount > 0) {
            manager.take(c, address(this), uint256(uint128(amount)));
        }
    }

    receive() external payable {}
}

contract CrownCutBypassProofTest is Test {
    uint160 internal constant SQRT_PRICE_1_1 = 79228162514264337593543950336;
    bytes32 internal constant CRWN = keccak256("CRWN");
    Currency internal constant ETH = Currency.wrap(address(0));

    address internal factory = makeAddr("factory");
    address internal payer = makeAddr("payer");

    PoolManager internal manager;
    CrownHook internal hook;
    CrownToken internal token;
    PoolKey internal key;
    LimitRouter internal lp;
    LimitRouter internal trader;

    function setUp() public {
        manager = new PoolManager(address(this));
        address at = address((uint160(0xC0FFEE) << 100) | HookFlags.CROWN_HOOK);
        deployCodeTo("CrownHook.sol:CrownHook", abi.encode(manager, factory, payer), at);
        hook = CrownHook(at);
        token = new CrownToken();
        key = PoolKey(ETH, Currency.wrap(address(token)), 12_500, 60, IHooks(at));
        vm.prank(factory);
        manager.initialize(key, SQRT_PRICE_1_1);

        lp = new LimitRouter(manager);
        trader = new LimitRouter(manager);
        vm.deal(address(lp), 1_000_000 ether);
        vm.deal(address(trader), 1_000_000 ether);
        token.transfer(address(lp), 100_000_000 ether);
        token.transfer(address(trader), 100_000_000 ether);
        lp.addLiquidity(key, TickMath.minUsableTick(60), TickMath.maxUsableTick(60), 1_000 ether);
    }

    /// @dev Finding: an exact-input buy whose amountSpecified exceeds uint128.max pays no cut at all, although the
    /// pool executes a normal-sized trade bounded by the price limit. _crown() early-returns 0 on
    /// `amount > type(uint128).max`, so beforeSwap returns a zero delta and the beneficiary gets nothing.
    function test_oversizedAmountSpecified_skipsTheCut() public {
        uint256 beneficiaryBefore = payer.balance;
        uint160 limit = TickMath.getSqrtPriceAtTick(-60); // one spacing below the current price
        SwapParams memory p = SwapParams({
            zeroForOne: true,
            amountSpecified: -int256(uint256(type(uint128).max) + 1),
            sqrtPriceLimitX96: limit
        });

        uint256 ethBefore = address(trader).balance;
        try trader.swap(key, p) returns (BalanceDelta d) {
            uint256 ethIn = ethBefore - address(trader).balance;
            // the pool actually took a few ETH from the trader
            assertGt(ethIn, 1 ether, "a real trade executed");
            assertEq(uint256(-int256(d.amount0())), ethIn);
            // ...so the king must have been paid its 1% cut on it, as on any other buy
            uint256 paid = hook.crownPaid(CRWN, ETH)
                + (payer.balance - beneficiaryBefore)
                + manager.balanceOf(payer, 0);
            assertGt(paid, 0, "DEFECT: trade executed and the crown cut was skipped");
        } catch {
            // A fix may instead refuse the oversized amount; that is acceptable.
        }
    }

    /// @dev Companion: the same trade with amountSpecified = uint128.max (one wei less) IS charged, proving the
    /// price limit, not the amount, bounds what the pool consumes, and the only difference is the early return.
    function test_sameTradeOneWeiSmaller_isCharged() public {
        uint160 limit = TickMath.getSqrtPriceAtTick(-60);
        SwapParams memory p = SwapParams({
            zeroForOne: true,
            amountSpecified: -int256(uint256(type(uint128).max)),
            sqrtPriceLimitX96: limit
        });
        uint256 ethBefore = address(trader).balance;
        // the cut on uint128.max input is ~1.7e36 ETH; the manager cannot pay it, so a claim is minted and the
        // trader must fund it: settlement fails, the swap reverts, and no free trade happens.
        vm.expectRevert();
        trader.swap(key, p);
        assertEq(ethBefore, address(trader).balance);
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {PoolManager} from "v4-core/src/PoolManager.sol";
import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
import {IHooks} from "v4-core/src/interfaces/IHooks.sol";
import {IUnlockCallback} from "v4-core/src/interfaces/callback/IUnlockCallback.sol";
import {PoolKey} from "v4-core/src/types/PoolKey.sol";
import {Currency} from "v4-core/src/types/Currency.sol";
import {BalanceDelta} from "v4-core/src/types/BalanceDelta.sol";
import {ModifyLiquidityParams, SwapParams} from "v4-core/src/types/PoolOperation.sol";
import {TickMath} from "v4-core/src/libraries/TickMath.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {CrownHook} from "src/CrownHook.sol";
import {CrownToken} from "src/CrownToken.sol";
import {HookFlags} from "src/HookFlags.sol";

/// @dev Minimal v4 router that lets the test choose amountSpecified and sqrtPriceLimitX96 freely.
contract LimitRouter is IUnlockCallback {
    IPoolManager public immutable manager;

    constructor(IPoolManager m) {
        manager = m;
    }

    function swap(PoolKey memory key, SwapParams memory p) external returns (BalanceDelta) {
        return abi.decode(manager.unlock(abi.encode(uint8(0), key, p, ModifyLiquidityParams(0, 0, 0, 0))), (BalanceDelta));
    }

    function addLiquidity(PoolKey memory key, int24 lo, int24 hi, int256 liq) external returns (BalanceDelta) {
        return abi.decode(
            manager.unlock(abi.encode(uint8(1), key, SwapParams(false, 0, 0), ModifyLiquidityParams(lo, hi, liq, 0))),
            (BalanceDelta)
        );
    }

    function unlockCallback(bytes calldata raw) external returns (bytes memory) {
        require(msg.sender == address(manager), "not manager");
        (uint8 action, PoolKey memory key, SwapParams memory sp, ModifyLiquidityParams memory mp) =
            abi.decode(raw, (uint8, PoolKey, SwapParams, ModifyLiquidityParams));
        BalanceDelta delta;
        if (action == 0) delta = manager.swap(key, sp, "");
        else (delta,) = manager.modifyLiquidity(key, mp, "");
        _settle(key.currency0, delta.amount0());
        _settle(key.currency1, delta.amount1());
        return abi.encode(delta);
    }

    function _settle(Currency c, int128 amount) private {
        if (amount < 0) {
            uint256 owed = uint256(uint128(-amount));
            manager.sync(c);
            if (c.isAddressZero()) manager.settle{value: owed}();
            else {
                IERC20(Currency.unwrap(c)).transfer(address(manager), owed);
                manager.settle();
            }
        } else if (amount > 0) {
            manager.take(c, address(this), uint256(uint128(amount)));
        }
    }

    receive() external payable {}
}

contract CrownPartialFillProofTest is Test {
    uint160 internal constant SQRT_PRICE_1_1 = 79228162514264337593543950336;
    bytes32 internal constant CRWN = keccak256("CRWN");
    Currency internal constant ETH = Currency.wrap(address(0));

    address internal factory = makeAddr("factory");
    address internal payer = makeAddr("payer");

    PoolManager internal manager;
    CrownHook internal hook;
    CrownToken internal token;
    PoolKey internal key;
    LimitRouter internal lp;
    LimitRouter internal trader;

    function setUp() public {
        manager = new PoolManager(address(this));
        address at = address((uint160(0xC0FFEE) << 100) | HookFlags.CROWN_HOOK);
        deployCodeTo("CrownHook.sol:CrownHook", abi.encode(manager, factory, payer), at);
        hook = CrownHook(at);
        token = new CrownToken();
        key = PoolKey(ETH, Currency.wrap(address(token)), 12_500, 60, IHooks(at));
        vm.prank(factory);
        manager.initialize(key, SQRT_PRICE_1_1);

        lp = new LimitRouter(manager);
        trader = new LimitRouter(manager);
        vm.deal(address(lp), 1_000_000 ether);
        vm.deal(address(trader), 1_000_000 ether);
        token.transfer(address(lp), 100_000_000 ether);
        token.transfer(address(trader), 100_000_000 ether);
        lp.addLiquidity(key, TickMath.minUsableTick(60), TickMath.maxUsableTick(60), 1_000 ether);
    }

    /// @dev Exact-output sell: tokens in, exactly 100 ETH requested out, price limit ten ticks up. The pool can
    /// deliver only ~0.5 ETH before the limit, but beforeSwap already took a 1 ETH cut on the 100 ETH *requested*
    /// (CrownHook.sol:162-163). The swapper ends the swap paying ~0.506 CRWN AND ~0.5 ETH, receiving no ETH.
    /// On fixed code the swap either reverts (partial fill refused) or the swapper's ETH balance does not go down.
    function test_exactOutputSell_partialFill_mustNotChargeSwapperEth() public {
        uint160 limit = TickMath.getSqrtPriceAtTick(10);
        SwapParams memory p = SwapParams({zeroForOne: false, amountSpecified: 100 ether, sqrtPriceLimitX96: limit});
        uint256 ethBefore = address(trader).balance;
        try trader.swap(key, p) returns (BalanceDelta d) {
            emit log_named_int("amount0 (ETH) delta seen by swapper", d.amount0());
            emit log_named_uint("cut paid to king", hook.crownPaid(CRWN, ETH));
            assertGe(
                address(trader).balance,
                ethBefore,
                "DEFECT: swapper asked for ETH out and ended up paying ETH (cut charged on the unfilled request)"
            );
        } catch {
            // refusing the partial fill is an acceptable fix
        }
    }

    /// @dev Exact-input buy of 100 ETH limited to one tick: ~0.05 ETH executes but the 1 ETH cut on the 100 ETH
    /// specified is still charged, 20x the executed amount. Fixed code charges at most the cut on what executed
    /// (plus rounding) or refuses the partial fill.
    function test_exactInputBuy_partialFill_cutBoundedByExecutedAmount() public {
        uint160 limit = TickMath.getSqrtPriceAtTick(-1);
        SwapParams memory p = SwapParams({zeroForOne: true, amountSpecified: -100 ether, sqrtPriceLimitX96: limit});
        uint256 ethBefore = address(trader).balance;
        try trader.swap(key, p) {
            uint256 ethIn = ethBefore - address(trader).balance;
            uint256 cut = hook.crownPaid(CRWN, ETH);
            uint256 executed = ethIn - cut;
            emit log_named_uint("ETH actually swapped", executed);
            emit log_named_uint("cut", cut);
            assertLe(cut, executed * 500 / 10_000 + 1, "DEFECT: cut exceeds the maximum 5% of the executed input");
        } catch {}
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {PoolManager} from "v4-core/src/PoolManager.sol";
import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
import {IHooks} from "v4-core/src/interfaces/IHooks.sol";
import {IUnlockCallback} from "v4-core/src/interfaces/callback/IUnlockCallback.sol";
import {PoolKey} from "v4-core/src/types/PoolKey.sol";
import {Currency} from "v4-core/src/types/Currency.sol";
import {BalanceDelta} from "v4-core/src/types/BalanceDelta.sol";
import {ModifyLiquidityParams, SwapParams} from "v4-core/src/types/PoolOperation.sol";
import {TickMath} from "v4-core/src/libraries/TickMath.sol";
import {CrownHook} from "src/CrownHook.sol";
import {CrownRegistry} from "src/CrownRegistry.sol";
import {CrownToken} from "src/CrownToken.sol";
import {HookFlags} from "src/HookFlags.sol";

contract Rival is ERC20 {
    constructor() ERC20("Crown Demo", "CRWN") {
        _mint(msg.sender, 1e24);
    }
}

/// @dev A king beneficiary that, while being paid, resets the manager's synced currency. sync() is callable by anyone
/// at any time and changes neither the hook's delta nor the nonzero-delta count, so payCrown's checks pass.
contract SyncResetter {
    IPoolManager immutable manager;

    constructor(IPoolManager m) {
        manager = m;
    }

    receive() external payable {
        manager.sync(Currency.wrap(address(0)));
    }
}

/// @dev Router that pays its ERC-20 input up front: sync, transfer, swap, settle (all inside one unlock).
contract PrepaySeller is IUnlockCallback {
    IPoolManager public immutable manager;

    constructor(IPoolManager m) {
        manager = m;
    }

    function sell(PoolKey memory key, uint256 amountIn) external returns (BalanceDelta) {
        return abi.decode(manager.unlock(abi.encode(key, amountIn)), (BalanceDelta));
    }

    function unlockCallback(bytes calldata raw) external returns (bytes memory) {
        require(msg.sender == address(manager), "not manager");
        (PoolKey memory key, uint256 amountIn) = abi.decode(raw, (PoolKey, uint256));
        manager.sync(key.currency1);
        IERC20(Currency.unwrap(key.currency1)).transfer(address(manager), amountIn);
        BalanceDelta d = manager.swap(key, SwapParams(false, -int256(amountIn), TickMath.MAX_SQRT_PRICE - 1), "");
        manager.settle();
        if (d.amount0() > 0) manager.take(key.currency0, address(this), uint256(uint128(d.amount0())));
        return abi.encode(d);
    }

    receive() external payable {}
}

contract LpRouter is IUnlockCallback {
    IPoolManager public immutable manager;

    constructor(IPoolManager m) {
        manager = m;
    }

    function add(PoolKey memory key, int256 liq) external {
        manager.unlock(abi.encode(key, liq));
    }

    function unlockCallback(bytes calldata raw) external returns (bytes memory) {
        (PoolKey memory key, int256 liq) = abi.decode(raw, (PoolKey, int256));
        (BalanceDelta d,) = manager.modifyLiquidity(
            key, ModifyLiquidityParams(TickMath.minUsableTick(60), TickMath.maxUsableTick(60), liq, 0), ""
        );
        manager.sync(key.currency0);
        manager.settle{value: uint256(uint128(-d.amount0()))}();
        manager.sync(key.currency1);
        IERC20(Currency.unwrap(key.currency1)).transfer(address(manager), uint256(uint128(-d.amount1())));
        manager.settle();
        return "";
    }

    receive() external payable {}
}

contract SyncGriefTest is Test {
    uint160 constant SQRT_1_1 = 79228162514264337593543950336;
    bytes32 constant CRWN = keccak256("CRWN");
    address factory = makeAddr("factory");
    address payer = makeAddr("payer");

    PoolManager manager;
    CrownHook hook;
    CrownRegistry registry;
    CrownToken token;
    PoolKey key;

    function setUp() public {
        manager = new PoolManager(address(this));
        address at = address((uint160(0xC0FFEE) << 100) | HookFlags.CROWN_HOOK);
        deployCodeTo("CrownHook.sol:CrownHook", abi.encode(manager, factory, payer), at);
        hook = CrownHook(at);
        registry = hook.registry();
        token = new CrownToken();
        key = PoolKey(Currency.wrap(address(0)), Currency.wrap(address(token)), 12_500, 60, IHooks(at));
        vm.prank(factory);
        manager.initialize(key, SQRT_1_1);
        LpRouter lp = new LpRouter(manager);
        vm.deal(address(lp), 10_000 ether);
        token.transfer(address(lp), 10_000 ether);
        lp.add(key, 1_000 ether);
    }

    function _crownHostile() internal {
        // the hostile party wins CRWN with a rival token; its beneficiary is a contract
        SyncResetter hostile = new SyncResetter(manager);
        vm.warp(block.timestamp + 7 days);
        Rival rival = new Rival();
        vm.deal(address(hostile), 1 ether);
        vm.prank(address(hostile));
        uint256 id = registry.openChallenge{value: 0.01 ether}(CRWN, address(rival));
        vm.prank(address(hostile));
        registry.stake{value: 0.05 ether}(id, CrownRegistry.Side.Challenger);
        vm.warp(block.timestamp + 96 hours);
        registry.finalize(id);
        assertEq(registry.beneficiaryOf(CRWN), address(hostile));
    }

    function test_prepayRouterSell_worksWithHonestKing() public {
        PrepaySeller r = new PrepaySeller(manager);
        token.transfer(address(r), 10 ether);
        BalanceDelta d = r.sell(key, 1 ether);
        assertGt(d.amount0(), 0);
    }

    function test_prepayRouterSell_blockedByHostileKing() public {
        _crownHostile();
        PrepaySeller r = new PrepaySeller(manager);
        token.transfer(address(r), 10 ether);
        // the hook promises never to block a swap; the king's beneficiary makes this router's unlock revert
        r.sell(key, 1 ether);
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {CrownRegistry} from "src/CrownRegistry.sol";

contract SymbolToken is ERC20 {
    constructor() ERC20("Crown Demo", "CRWN") {}
}

/// @dev The incumbent beneficiary challenges its own crown with a throwaway same-symbol token, stakes to quorum on
/// its own side, wins uncontested, keeps the beneficiary, has its whole stake refunded and gets a fresh 7-day
/// MIN_REIGN. An honest challenger is locked out by ChallengeLive during the 96 h and ReignTooShort after it.
/// Expected (brief): a king that has reigned 7 days is challengeable by anyone. The test passes once a fix either
/// refuses the self-challenge or stops an uncontested / same-beneficiary flip from restarting the reign clock.
contract SelfChallengeLockoutTest is Test {
    bytes32 constant CRWN = keccak256("CRWN");
    CrownRegistry registry;
    SymbolToken kingToken;
    SymbolToken shadow;
    SymbolToken honestToken;
    address incumbent = makeAddr("incumbent");
    address honest = makeAddr("honest");

    function setUp() public {
        registry = new CrownRegistry();
        kingToken = new SymbolToken();
        shadow = new SymbolToken();
        honestToken = new SymbolToken();
        registry.registerKing(CRWN, address(kingToken), incumbent);
        vm.deal(incumbent, 1 ether);
        vm.deal(honest, 1 ether);
    }

    function test_incumbentSelfChallenge_locksOutHonestChallengerForAnotherReign() public {
        vm.warp(block.timestamp + 7 days);
        uint256 incumbentBefore = incumbent.balance;

        // Incumbent challenges itself the second it becomes challengeable.
        vm.prank(incumbent);
        try registry.openChallenge{value: 0.01 ether}(CRWN, address(shadow)) returns (uint256 id) {
            vm.prank(incumbent);
            registry.stake{value: 0.04 ether}(id, CrownRegistry.Side.Challenger);

            // Honest challenger is locked out while the self-challenge is live.
            vm.prank(honest);
            vm.expectRevert(CrownRegistry.ChallengeLive.selector);
            registry.openChallenge{value: 0.01 ether}(CRWN, address(honestToken));

            vm.warp(block.timestamp + 96 hours);
            registry.finalize(id);
            (, address beneficiary,) = registry.king(CRWN);
            assertEq(beneficiary, incumbent, "beneficiary unchanged");

            vm.prank(incumbent);
            registry.claim(id);
            assertEq(incumbent.balance, incumbentBefore, "self-challenge cost the incumbent nothing");
        } catch {
            // A fix that refuses the self-challenge is acceptable.
        }

        // The king has reigned well over 7 days under the same beneficiary: an outsider must be able to challenge.
        vm.prank(honest);
        registry.openChallenge{value: 0.01 ether}(CRWN, address(honestToken));
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {CrownRegistry} from "src/CrownRegistry.sol";

contract SymbolToken is ERC20 {
    constructor() ERC20("Crown Demo", "CRWN") {}
}

/// @dev The incumbent challenges its own crown from a second wallet (SelfChallenge only checks the sitting
/// beneficiary) and defends the king side with 1 wei. kingStake != 0 so finalize restarts the reign clock, and the
/// 20% slash of 1 wei rounds to zero, so the incumbent recovers every wei. An honest challenger is then refused
/// ReignTooShort for another 7 days. Expected: a king that has reigned 7 days stays challengeable once the
/// incumbent's own throwaway challenge ends.
contract SelfChallengeSybilTest is Test {
    bytes32 constant CRWN = keccak256("CRWN");
    CrownRegistry registry;
    SymbolToken kingToken;
    SymbolToken shadow;
    SymbolToken honestToken;
    address incumbent = makeAddr("incumbent");
    address incumbentAlt = makeAddr("incumbentAlt");
    address honest = makeAddr("honest");

    function setUp() public {
        registry = new CrownRegistry();
        kingToken = new SymbolToken();
        shadow = new SymbolToken();
        honestToken = new SymbolToken();
        registry.registerKing(CRWN, address(kingToken), incumbent);
        vm.deal(incumbent, 1 ether);
        vm.deal(incumbentAlt, 1 ether);
        vm.deal(honest, 1 ether);
    }

    function test_selfChallengeFromSecondWallet_withOneWeiDefence_restartsReignForFree() public {
        vm.warp(block.timestamp + 7 days);
        uint256 before = incumbent.balance + incumbentAlt.balance;

        vm.prank(incumbentAlt);
        uint256 id = registry.openChallenge{value: 0.01 ether}(CRWN, address(shadow));
        vm.prank(incumbentAlt);
        registry.stake{value: 0.04 ether}(id, CrownRegistry.Side.Challenger);
        vm.prank(incumbent);
        registry.stake{value: 1}(id, CrownRegistry.Side.King);

        vm.warp(block.timestamp + 96 hours);
        registry.finalize(id);
        (, address beneficiary, uint64 reignStartedAt) = registry.king(CRWN);
        assertEq(beneficiary, incumbentAlt, "crown still with the incumbent's wallets");
        assertEq(reignStartedAt, block.timestamp, "reign clock restarted");

        vm.prank(incumbentAlt);
        registry.claim(id);
        vm.prank(incumbent);
        registry.claim(id);
        assertEq(incumbent.balance + incumbentAlt.balance, before, "cost the incumbent nothing");

        // The king has reigned over 7 days; the incumbent's throwaway challenge is over. An outsider must be able
        // to challenge now. Actual: ReignTooShort for another 7 days.
        vm.prank(honest);
        registry.openChallenge{value: 0.01 ether}(CRWN, address(honestToken));
    }
}