// SPDX-License-Identifier: GPL-2.0-or-later
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {BaskVault} from "src/BaskVault.sol";

contract ScratchToken {
    uint8 public constant decimals = 18;
    mapping(address => uint256) public balanceOf;
    mapping(address => mapping(address => uint256)) public allowance;

    function mint(address to, uint256 v) external {
        balanceOf[to] += v;
    }

    function approve(address s, uint256 v) external returns (bool) {
        allowance[msg.sender][s] = v;
        return true;
    }

    function transfer(address to, uint256 v) external returns (bool) {
        balanceOf[msg.sender] -= v;
        balanceOf[to] += v;
        return true;
    }

    function transferFrom(address f, address to, uint256 v) external returns (bool) {
        allowance[f][msg.sender] -= v;
        balanceOf[f] -= v;
        balanceOf[to] += v;
        return true;
    }
}

contract ScratchFeed {
    uint8 public constant decimals = 8;
    int256 public answer;
    uint256 public updatedAt;

    constructor(int256 a) {
        answer = a;
        updatedAt = block.timestamp;
    }

    function set(int256 a, uint256 t) external {
        answer = a;
        updatedAt = t;
    }

    function latestRoundData() external view returns (uint80, int256, uint256, uint256, uint80) {
        return (1, answer, updatedAt, updatedAt, 1);
    }
}

/// Retired asset is excluded from deposit NAV but still paid pro rata by redeem.
/// A depositor arriving after a retirement captures part of the retired position
/// that existing holders paid for.
contract RetireDilutionTest is Test {
    address constant OWNER = 0x30B57ECf51D19ABcED7F6f70974e6fBb6f3b9Da3;
    address constant GUARDIAN = 0x5ed39AF86f2C00ad99913B5d727bD68f2A904B68;
    BaskVault vault;
    ScratchToken[3] tokens;
    ScratchFeed[3] feeds;
    address holder = makeAddr("holder");
    address attacker = makeAddr("attacker");

    function setUp() public {
        vm.warp(10 days);
        vault = new BaskVault(OWNER, GUARDIAN);
        for (uint256 i; i < 3; ++i) {
            tokens[i] = new ScratchToken();
            feeds[i] = new ScratchFeed(1e8); // $1 per whole token
            vm.prank(OWNER);
            vault.genesisList(address(tokens[i]), address(feeds[i]), address(0), address(0), 0);
            tokens[i].mint(holder, 1_000e18);
            tokens[i].mint(attacker, 1_000e18);
            vm.prank(holder);
            tokens[i].approve(address(vault), type(uint256).max);
            vm.prank(attacker);
            tokens[i].approve(address(vault), type(uint256).max);
        }
        vm.prank(OWNER);
        vault.finalizeGenesis();
    }

    function _refresh() internal {
        for (uint256 i; i < 3; ++i) feeds[i].set(1e8, block.timestamp);
    }

    function test_depositAfterRetireCapturesRetiredBacking() public {
        // Existing holder deposits 100 of each token: NAV $300.
        address[] memory ts = new address[](3);
        uint256[] memory amts = new uint256[](3);
        for (uint256 i; i < 3; ++i) {
            ts[i] = address(tokens[i]);
            amts[i] = 100e18;
        }
        vm.prank(holder);
        vault.deposit(ts, amts, holder, 0, block.timestamp);

        // Owner closes and retires token0 (still worth $1 off-chain, 100 units in vault).
        vm.prank(OWNER);
        vault.closeAsset(address(tokens[0]));
        BaskVault.ProposalData memory d;
        d.action = BaskVault.Action.Retire;
        d.token = address(tokens[0]);
        vm.prank(OWNER);
        uint256 id = vault.propose(d);
        vm.warp(block.timestamp + 2 days);
        _refresh();
        vm.prank(OWNER);
        try vault.executeProposal(id) {}
        catch {
            // A fix that refuses to retire a funded position closes the window; nothing to exploit.
            return;
        }

        // Attacker deposits 200 of token1 and token2 ($200 at NAV $200 -> 50% of supply).
        address[] memory ts2 = new address[](2);
        uint256[] memory amts2 = new uint256[](2);
        ts2[0] = address(tokens[1]);
        ts2[1] = address(tokens[2]);
        amts2[0] = 100e18;
        amts2[1] = 100e18;
        vm.prank(attacker);
        uint256 shares = vault.deposit(ts2, amts2, attacker, 0, block.timestamp);

        // Attacker redeems immediately and receives a share of the retired token0.
        vm.prank(attacker);
        vault.redeem(shares, attacker, new uint256[](0), block.timestamp);

        // Every token is worth $1, so the attacker's combined balance is their dollar position.
        // Expected: a deposit-then-redeem round trip never returns more than was put in.
        // Actual: attacker leaves with 3050e18 (50e18 of token0 taken from the holder).
        uint256 total =
            tokens[0].balanceOf(attacker) + tokens[1].balanceOf(attacker) + tokens[2].balanceOf(attacker);
        assertLe(total, 3_000e18, "post-retirement depositor extracted retired backing from holders");
    }
}

// SPDX-License-Identifier: GPL-2.0-or-later
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {BaskVault} from "src/BaskVault.sol";

contract LeakToken {
    uint8 public constant decimals = 18;
    mapping(address => uint256) public balanceOf;
    mapping(address => mapping(address => uint256)) public allowance;

    function mint(address to, uint256 v) external {
        balanceOf[to] += v;
    }

    function approve(address s, uint256 v) external returns (bool) {
        allowance[msg.sender][s] = v;
        return true;
    }

    function transfer(address to, uint256 v) external returns (bool) {
        balanceOf[msg.sender] -= v;
        balanceOf[to] += v;
        return true;
    }

    function transferFrom(address f, address to, uint256 v) external returns (bool) {
        allowance[f][msg.sender] -= v;
        balanceOf[f] -= v;
        balanceOf[to] += v;
        return true;
    }
}

contract LeakFeed {
    uint8 public constant decimals = 8;
    int256 public answer;
    uint256 public updatedAt;

    constructor(int256 a) {
        answer = a;
        updatedAt = block.timestamp;
    }

    function set(int256 a, uint256 t) external {
        answer = a;
        updatedAt = t;
    }

    function latestRoundData() external view returns (uint80, int256, uint256, uint256, uint80) {
        return (1, answer, updatedAt, updatedAt, 1);
    }
}

/// Deposit values shares against a NAV that excludes retired assets, while redeem pays retired assets pro rata.
/// A depositor who enters after a retirement and leaves at once takes part of the retired asset from earlier holders.
contract RetiredAssetValueLeakTest is Test {
    address constant OWNER = 0x30B57ECf51D19ABcED7F6f70974e6fBb6f3b9Da3;
    address constant GUARDIAN = 0x5ed39AF86f2C00ad99913B5d727bD68f2A904B68;
    BaskVault vault;
    LeakToken[3] tokens;
    LeakFeed[3] feeds;
    address alice = makeAddr("alice");
    address attacker = makeAddr("attacker");

    function setUp() public {
        vm.warp(10 days);
        vault = new BaskVault(OWNER, GUARDIAN);
        for (uint256 i; i < 3; ++i) {
            tokens[i] = new LeakToken();
            feeds[i] = new LeakFeed(1e8);
            vm.prank(OWNER);
            vault.genesisList(address(tokens[i]), address(feeds[i]), address(0), address(0), 0);
        }
        vm.prank(OWNER);
        vault.finalizeGenesis();
    }

    function _refresh() internal {
        for (uint256 i; i < 3; ++i) {
            feeds[i].set(1e8, vm.getBlockTimestamp());
        }
    }

    function testLateDepositorTakesRetiredAssetFromEarlierHolders() public {
        // Alice funds the vault with 100 of each token ($300 NAV, 300e18 shares).
        address[] memory ts = new address[](3);
        uint256[] memory amts = new uint256[](3);
        for (uint256 i; i < 3; ++i) {
            ts[i] = address(tokens[i]);
            amts[i] = 100e18;
            tokens[i].mint(alice, 100e18);
            vm.prank(alice);
            tokens[i].approve(address(vault), 100e18);
        }
        vm.prank(alice);
        vault.deposit(ts, amts, alice, 0, vm.getBlockTimestamp());
        assertEq(vault.totalSupply(), 300e18);

        // Owner closes and retires token 2. Its 100 tokens stay in the vault, redeemable, but count 0 in NAV.
        vm.prank(OWNER);
        vault.closeAsset(address(tokens[2]));
        BaskVault.ProposalData memory d;
        d.action = BaskVault.Action.Retire;
        d.token = address(tokens[2]);
        vm.prank(OWNER);
        uint256 id = vault.propose(d);
        vm.warp(vm.getBlockTimestamp() + 2 days);
        _refresh();
        vm.prank(OWNER);
        vault.executeProposal(id);

        (,,, uint256 nav) = vault.previewDeposit(_one(address(tokens[0])), _amount(1e18));
        assertEq(nav, 200e18, "retired asset excluded from NAV");

        // Attacker deposits 200 of token 0 ($200) and receives 300e18 shares: half the supply.
        tokens[0].mint(attacker, 200e18);
        vm.prank(attacker);
        tokens[0].approve(address(vault), 200e18);
        vm.prank(attacker);
        uint256 shares = vault.deposit(_one(address(tokens[0])), _amount(200e18), attacker, 0, vm.getBlockTimestamp());
        assertEq(shares, 300e18);

        // Attacker redeems at once and is paid half of every managed asset, including the retired one.
        vm.prank(attacker);
        uint256[] memory legs = vault.redeem(shares, attacker, new uint256[](0), vm.getBlockTimestamp());
        assertEq(legs[2], 50e18, "half of the retired asset leaves with the attacker");

        uint256 usdOut = tokens[0].balanceOf(attacker) + tokens[1].balanceOf(attacker) + tokens[2].balanceOf(attacker);
        // Expected: a round trip through the vault should not be profitable at the expense of earlier holders.
        // Actual: the attacker put in $200 and leaves with $250 of tokens (150 + 50 + 50).
        assertLe(usdOut, 200e18, "deposit/redeem round trip extracts value from existing holders");
    }

    function _one(address t) internal pure returns (address[] memory a) {
        a = new address[](1);
        a[0] = t;
    }

    function _amount(uint256 v) internal pure returns (uint256[] memory a) {
        a = new uint256[](1);
        a[0] = v;
    }
}

// SPDX-License-Identifier: GPL-2.0-or-later
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {BaskVault} from "src/BaskVault.sol";

contract DilutionToken {
    uint8 public constant decimals = 18;
    mapping(address => uint256) public balanceOf;
    mapping(address => mapping(address => uint256)) public allowance;

    function mint(address to, uint256 v) external {
        balanceOf[to] += v;
    }

    function approve(address s, uint256 v) external returns (bool) {
        allowance[msg.sender][s] = v;
        return true;
    }

    function transfer(address to, uint256 v) external returns (bool) {
        balanceOf[msg.sender] -= v;
        balanceOf[to] += v;
        return true;
    }

    function transferFrom(address f, address to, uint256 v) external returns (bool) {
        allowance[f][msg.sender] -= v;
        balanceOf[f] -= v;
        balanceOf[to] += v;
        return true;
    }
}

contract DilutionFeed {
    uint8 public constant decimals = 8;
    int256 public answer;
    uint256 public updatedAt;

    constructor(int256 a) {
        answer = a;
        updatedAt = block.timestamp;
    }

    function set(int256 a, uint256 t) external {
        answer = a;
        updatedAt = t;
    }

    function latestRoundData() external view returns (uint80, int256, uint256, uint256, uint80) {
        return (1, answer, updatedAt, updatedAt, 1);
    }
}

/// Retiring an asset zeroes it in deposit NAV while redeem still pays it pro rata.
/// A depositor after retirement buys shares priced without the retired holdings and
/// immediately redeems a slice of them, at the expense of existing holders.
contract RetiredDilutionTest is Test {
    address constant OWNER = 0x30B57ECf51D19ABcED7F6f70974e6fBb6f3b9Da3;
    address constant GUARDIAN = 0x5ed39AF86f2C00ad99913B5d727bD68f2A904B68;
    BaskVault vault;
    DilutionToken[3] tokens;
    DilutionFeed[3] feeds;
    address alice = makeAddr("alice");
    address bob = makeAddr("bob");

    function setUp() public {
        vm.warp(10 days);
        vault = new BaskVault(OWNER, GUARDIAN);
        for (uint256 i; i < 3; ++i) {
            tokens[i] = new DilutionToken();
            feeds[i] = new DilutionFeed(1e8); // $1 per whole token
            vm.prank(OWNER);
            vault.genesisList(address(tokens[i]), address(feeds[i]), address(0), address(0), 0);
            tokens[i].mint(alice, 1_000e18);
            tokens[i].mint(bob, 1_000e18);
            vm.prank(alice);
            tokens[i].approve(address(vault), type(uint256).max);
            vm.prank(bob);
            tokens[i].approve(address(vault), type(uint256).max);
        }
        vm.prank(OWNER);
        vault.finalizeGenesis();
    }

    function _refresh() internal {
        for (uint256 i; i < 3; ++i) {
            feeds[i].set(1e8, block.timestamp);
        }
    }

    function testDepositAfterRetireExtractsRetiredHoldings() public {
        // Alice funds the basket: 100 of each token, $300 NAV, 300e18 shares.
        address[] memory ts = new address[](3);
        uint256[] memory amts = new uint256[](3);
        for (uint256 i; i < 3; ++i) {
            ts[i] = address(tokens[i]);
            amts[i] = 100e18;
        }
        vm.prank(alice);
        vault.deposit(ts, amts, alice, 0, block.timestamp);
        assertEq(vault.totalSupply(), 300e18);

        // Owner closes token0 and retires it (2-day proposal). Token0 still holds $100 of value.
        vm.prank(OWNER);
        vault.closeAsset(address(tokens[0]));
        BaskVault.ProposalData memory d;
        d.action = BaskVault.Action.Retire;
        d.token = address(tokens[0]);
        vm.prank(OWNER);
        uint256 id = vault.propose(d);
        vm.warp(block.timestamp + 2 days);
        _refresh();
        vm.prank(OWNER);
        vault.executeProposal(id);
        assertTrue(vault.asset(address(tokens[0])).retired);
        assertEq(vault.managed(address(tokens[0])), 100e18);

        // Bob deposits $300 of token1. NAV excludes the retired asset, so NAV = $200.
        address[] memory one = new address[](1);
        one[0] = address(tokens[1]);
        uint256[] memory amt = new uint256[](1);
        amt[0] = 300e18;
        vm.prank(bob);
        uint256 shares = vault.deposit(one, amt, bob, 0, block.timestamp);

        // Bob redeems everything in the same block and receives a slice of every asset, including the retired one.
        vm.prank(bob);
        uint256[] memory legs = vault.redeem(shares, bob, new uint256[](0), block.timestamp);
        uint256 bobOut = legs[0] + legs[1] + legs[2]; // all tokens are $1, so this is Bob's USD value out
        emit log_named_uint("bob token0 (retired) received", legs[0]);
        emit log_named_uint("bob value in  ($)", 300e18);
        emit log_named_uint("bob value out ($)", bobOut);

        // Alice's remaining claim: managed of every asset, all priced at $1.
        uint256 aliceValue =
            vault.managed(address(tokens[0])) + vault.managed(address(tokens[1])) + vault.managed(address(tokens[2]));
        emit log_named_uint("alice value before ($)", 300e18);
        emit log_named_uint("alice value after  ($)", aliceValue);

        // Expected: a depositor cannot take out more than they put in through a deposit/redeem round trip.
        assertLe(bobOut, 300e18, "depositor extracted value from existing holders via retired asset");
        assertGe(aliceValue, 300e18, "existing holder lost value to a round-trip depositor");
    }
}

// SPDX-License-Identifier: GPL-2.0-or-later
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {BaskVault} from "src/BaskVault.sol";

contract ProofToken {
    uint8 public constant decimals = 18;
    mapping(address => uint256) public balanceOf;
    mapping(address => mapping(address => uint256)) public allowance;

    function mint(address to, uint256 v) external {
        balanceOf[to] += v;
    }

    function approve(address s, uint256 v) external returns (bool) {
        allowance[msg.sender][s] = v;
        return true;
    }

    function transfer(address to, uint256 v) external returns (bool) {
        balanceOf[msg.sender] -= v;
        balanceOf[to] += v;
        return true;
    }

    function transferFrom(address f, address to, uint256 v) external returns (bool) {
        allowance[f][msg.sender] -= v;
        balanceOf[f] -= v;
        balanceOf[to] += v;
        return true;
    }
}

contract ProofFeed {
    uint8 public constant decimals = 8;
    int256 public answer = 1e8;
    uint256 public updatedAt = block.timestamp;

    function touch() external {
        updatedAt = block.timestamp;
    }

    function latestRoundData() external view returns (uint80, int256, uint256, uint256, uint80) {
        return (1, answer, updatedAt, updatedAt, 1);
    }
}

/// Retiring an asset zeroes it in NAV while redeem still pays it out pro rata.
/// A depositor arriving after the retirement is priced on the remaining NAV only,
/// then redeems a share of the retired backing as well: value flows from existing
/// holders to the new depositor.
contract RetiredNavTest is Test {
    address constant OWNER = 0x30B57ECf51D19ABcED7F6f70974e6fBb6f3b9Da3;
    address constant GUARDIAN = 0x5ed39AF86f2C00ad99913B5d727bD68f2A904B68;
    BaskVault vault;
    ProofToken[3] tokens;
    ProofFeed[3] feeds;
    address alice = makeAddr("alice");
    address bob = makeAddr("bob");

    function setUp() public {
        vm.warp(10 days);
        vault = new BaskVault(OWNER, GUARDIAN);
        for (uint256 i; i < 3; ++i) {
            tokens[i] = new ProofToken();
            feeds[i] = new ProofFeed();
            vm.prank(OWNER);
            vault.genesisList(address(tokens[i]), address(feeds[i]), address(0), address(0), 0);
            tokens[i].mint(alice, 1_000e18);
            tokens[i].mint(bob, 1_000e18);
            vm.prank(alice);
            tokens[i].approve(address(vault), type(uint256).max);
            vm.prank(bob);
            tokens[i].approve(address(vault), type(uint256).max);
        }
        vm.prank(OWNER);
        vault.finalizeGenesis();
    }

    function _refresh() internal {
        for (uint256 i; i < 3; ++i) {
            feeds[i].touch();
        }
    }

    function testPostRetirementDepositorExtractsRetiredBacking() public {
        // Alice deposits 100 token0 + 100 token1, both worth $1: NAV $200, supply 200e18.
        address[] memory ts = new address[](2);
        uint256[] memory amts = new uint256[](2);
        ts[0] = address(tokens[0]);
        ts[1] = address(tokens[1]);
        amts[0] = 100e18;
        amts[1] = 100e18;
        vm.prank(alice);
        vault.deposit(ts, amts, alice, 0, block.timestamp);
        assertEq(vault.totalSupply(), 200e18);

        // Owner closes token0 and retires it through the timelock. token0 still transfers and is still worth $1.
        vm.prank(OWNER);
        vault.closeAsset(address(tokens[0]));
        BaskVault.ProposalData memory d;
        d.action = BaskVault.Action.Retire;
        d.token = address(tokens[0]);
        vm.prank(OWNER);
        uint256 id = vault.propose(d);
        vm.warp(block.timestamp + 2 days);
        _refresh();
        vm.prank(OWNER);
        vault.executeProposal(id);

        // Bob deposits $100 of token1. NAV now counts only token1 ($100), so Bob is minted 200e18 shares: half the vault.
        address[] memory one = new address[](1);
        uint256[] memory oneAmt = new uint256[](1);
        one[0] = address(tokens[1]);
        oneAmt[0] = 100e18;
        vm.prank(bob);
        uint256 shares = vault.deposit(one, oneAmt, bob, 0, block.timestamp);
        assertEq(shares, 200e18);

        // Bob redeems immediately and receives half of token0 as well as half of token1.
        uint256 t0Before = tokens[0].balanceOf(bob);
        uint256 t1Before = tokens[1].balanceOf(bob);
        vm.prank(bob);
        vault.redeem(shares, bob, new uint256[](0), block.timestamp);
        uint256 got0 = tokens[0].balanceOf(bob) - t0Before;
        uint256 got1 = tokens[1].balanceOf(bob) - t1Before;

        // Bob paid $100 and must not take out more than $100 of backing. Currently he takes $150 ($50 of it is Alice's token0).
        assertLe(got0 + got1, 100e18, "post-retirement depositor extracted retired backing from existing holders");
    }
}

// SPDX-License-Identifier: GPL-2.0-or-later
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {BaskVault} from "src/BaskVault.sol";

contract PlainToken {
    uint8 public constant decimals = 18;
    mapping(address => uint256) public balanceOf;
    mapping(address => mapping(address => uint256)) public allowance;

    function mint(address to, uint256 v) external {
        balanceOf[to] += v;
    }

    function approve(address s, uint256 v) external returns (bool) {
        allowance[msg.sender][s] = v;
        return true;
    }

    function transfer(address to, uint256 v) external returns (bool) {
        balanceOf[msg.sender] -= v;
        balanceOf[to] += v;
        return true;
    }

    function transferFrom(address f, address to, uint256 v) external returns (bool) {
        allowance[f][msg.sender] -= v;
        balanceOf[f] -= v;
        balanceOf[to] += v;
        return true;
    }
}

contract PlainFeed {
    uint8 public constant decimals = 8;
    int256 public answer;
    uint256 public updatedAt;

    constructor(int256 a) {
        answer = a;
        updatedAt = block.timestamp;
    }

    function set(int256 a, uint256 t) external {
        answer = a;
        updatedAt = t;
    }

    function latestRoundData() external view returns (uint80, int256, uint256, uint256, uint80) {
        return (1, answer, updatedAt, updatedAt, 1);
    }
}

/// A retired asset is excluded from the NAV that prices new shares (_depositContext skips
/// `retired`), but redeem pays every asset with managed > 0, retired or not. A depositor who
/// enters after retirement is therefore sold shares without paying for the retired holdings
/// and redeems a pro-rata slice of them at once, at the expense of the holders present at
/// retirement. This test passes under any of the fix routes: valuing the retired position in
/// deposit NAV, excluding it from redeem for post-retirement shares, refusing retirement
/// while managed > 0, or refusing deposits while a retired asset still holds managed > 0.
contract RetiredAssetDilutionTest is Test {
    address constant OWNER = 0x30B57ECf51D19ABcED7F6f70974e6fBb6f3b9Da3;
    address constant GUARDIAN = 0x5ed39AF86f2C00ad99913B5d727bD68f2A904B68;
    BaskVault vault;
    PlainToken[3] tokens;
    PlainFeed[3] feeds;
    address alice = makeAddr("alice");
    address bob = makeAddr("bob");

    function setUp() public {
        vm.warp(10 days);
        vault = new BaskVault(OWNER, GUARDIAN);
        for (uint256 i; i < 3; ++i) {
            tokens[i] = new PlainToken();
            feeds[i] = new PlainFeed(1e8); // $1 per whole token
            vm.prank(OWNER);
            vault.genesisList(address(tokens[i]), address(feeds[i]), address(0), address(0), 0);
            tokens[i].mint(alice, 1_000e18);
            tokens[i].mint(bob, 1_000e18);
            vm.prank(alice);
            tokens[i].approve(address(vault), type(uint256).max);
            vm.prank(bob);
            tokens[i].approve(address(vault), type(uint256).max);
        }
        vm.prank(OWNER);
        vault.finalizeGenesis();
    }

    function _refresh() internal {
        for (uint256 i; i < 3; ++i) {
            feeds[i].set(1e8, block.timestamp);
        }
    }

    function testPostRetirementDepositorExtractsRetiredBacking() public {
        // Alice funds the basket: 100 of each $1 token -> NAV $300, supply 300e18.
        address[] memory ts = new address[](3);
        uint256[] memory amts = new uint256[](3);
        for (uint256 i; i < 3; ++i) {
            ts[i] = address(tokens[i]);
            amts[i] = 100e18;
        }
        vm.prank(alice);
        vault.deposit(ts, amts, alice, 0, block.timestamp);
        assertEq(vault.totalSupply(), 300e18);

        // Owner closes token0 and retires it through the 2-day proposal. token0 still transfers.
        vm.prank(OWNER);
        vault.closeAsset(address(tokens[0]));
        BaskVault.ProposalData memory d;
        d.action = BaskVault.Action.Retire;
        d.token = address(tokens[0]);
        vm.prank(OWNER);
        uint256 id = vault.propose(d);
        vm.warp(block.timestamp + 2 days);
        _refresh();
        vm.prank(OWNER);
        try vault.executeProposal(id) {} catch {
            // Fixed by refusing to retire an asset that still has managed > 0.
            return;
        }
        assertTrue(vault.asset(address(tokens[0])).retired);
        assertEq(vault.managed(address(tokens[0])), 100e18);

        // Bob deposits $300 of token1. Current code prices him against NAV $200 (token0 skipped).
        address[] memory one = new address[](1);
        one[0] = address(tokens[1]);
        uint256[] memory amt = new uint256[](1);
        amt[0] = 300e18;
        uint256 shares;
        vm.prank(bob);
        try vault.deposit(one, amt, bob, 0, block.timestamp) returns (uint256 s) {
            shares = s;
        } catch {
            // Fixed by refusing deposits while a retired asset still holds managed > 0.
            return;
        }

        // Bob redeems everything in the same block.
        vm.prank(bob);
        uint256[] memory legs = vault.redeem(shares, bob, new uint256[](0), block.timestamp);
        uint256 bobOut = legs[0] + legs[1] + legs[2]; // every token is $1
        uint256 aliceBacking =
            vault.managed(address(tokens[0])) + vault.managed(address(tokens[1])) + vault.managed(address(tokens[2]));
        emit log_named_uint("bob token0 (retired) received", legs[0]);
        emit log_named_uint("bob value in  ($)", 300e18);
        emit log_named_uint("bob value out ($)", bobOut);
        emit log_named_uint("alice backing before ($)", 300e18);
        emit log_named_uint("alice backing after  ($)", aliceBacking);

        // Expected: a same-block deposit/redeem round trip returns at most what was put in,
        // and existing holders keep their backing. Actual: bob gets $360 for $300 and alice's
        // backing falls from $300 to $240.
        assertLe(bobOut, 300e18, "post-retirement depositor extracted retired backing from existing holders");
        assertGe(aliceBacking, 300e18, "existing holder lost backing to a round-trip depositor");
    }
}