// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {PoolManager} from "v4-core/src/PoolManager.sol";
import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
import {IHooks} from "v4-core/src/interfaces/IHooks.sol";
import {PoolKey} from "v4-core/src/types/PoolKey.sol";
import {Currency, CurrencyLibrary} from "v4-core/src/types/Currency.sol";
import {ModifyLiquidityParams} from "v4-core/src/types/PoolOperation.sol";
import {TickMath} from "v4-core/src/libraries/TickMath.sol";
import {FullMath} from "v4-core/src/libraries/FullMath.sol";
import {FixedPoint96} from "v4-core/src/libraries/FixedPoint96.sol";
import {PoolModifyLiquidityTest} from "v4-core/src/test/PoolModifyLiquidityTest.sol";

import {KingToken} from "src/KingToken.sol";
import {KingHook} from "src/KingHook.sol";
import {KingRouter} from "src/KingRouter.sol";
import {HookFlags} from "src/HookFlags.sol";
import {IKingHook} from "src/interfaces/IKingHook.sol";

/// @notice The take-and-dump defence (income of the first 5 minutes is forfeited when the king ends
/// his own reign) is bypassed by the king buying the throne from himself: `_onBuy` ends the sitting
/// reign with `EndReason.Dethroned`, which vests the income, without checking `buyer != king`.
contract SelfTakeoverVestsTest is Test {
    uint160 internal constant INITIAL_SQRT_PRICE = 792281625142643375935439503360000;
    int24 internal constant LP_UPPER = 184200;
    int24 internal constant LP_LOWER = -887220;
    uint256 internal constant LP_SUPPLY = 900_000_000 ether;

    PoolManager internal manager;
    KingToken internal token;
    KingHook internal hook;
    KingRouter internal router;
    PoolModifyLiquidityTest internal lpRouter;
    PoolKey internal key;

    address internal alice = makeAddr("alice");
    address internal carol = makeAddr("carol");

    receive() external payable {}

    function setUp() public {
        vm.warp(1_800_000_000);
        manager = new PoolManager(address(this));
        token = new KingToken();
        bytes memory creationCode =
            abi.encodePacked(type(KingHook).creationCode, abi.encode(IPoolManager(address(manager)), address(token)));
        (address predicted, bytes32 salt) =
            HookFlags.mine(address(this), HookFlags.KING_HOOK_FLAGS, creationCode, 500_000);
        hook = new KingHook{salt: salt}(IPoolManager(address(manager)), address(token));
        require(address(hook) == predicted, "hook address mismatch");
        router = hook.router();
        lpRouter = new PoolModifyLiquidityTest(IPoolManager(address(manager)));

        key = PoolKey({
            currency0: CurrencyLibrary.ADDRESS_ZERO,
            currency1: Currency.wrap(address(token)),
            fee: 3000,
            tickSpacing: 60,
            hooks: IHooks(address(hook))
        });
        manager.initialize(key, INITIAL_SQRT_PRICE);

        uint160 sqrtA = TickMath.getSqrtPriceAtTick(LP_LOWER);
        uint160 sqrtB = TickMath.getSqrtPriceAtTick(LP_UPPER);
        uint128 liquidity = uint128(FullMath.mulDiv(LP_SUPPLY, FixedPoint96.Q96, sqrtB - sqrtA));
        token.approve(address(lpRouter), type(uint256).max);
        lpRouter.modifyLiquidity(
            key,
            ModifyLiquidityParams({
                tickLower: LP_LOWER, tickUpper: LP_UPPER, liquidityDelta: int256(uint256(liquidity)), salt: 0
            }),
            ""
        );

        vm.deal(alice, 100 ether);
        vm.deal(carol, 100 ether);
    }

    function test_selfTakeoverVestsIncomeInsideTheVestingWindow() public {
        // Fill the throne pool during the anti-snipe window (25% fee), then open the game.
        vm.prank(carol);
        router.buyExactIn{value: 10 ether}(0, false, block.timestamp);
        vm.warp(hook.gameStart());
        assertGt(hook.pool(), 1 ether, "pool funded");

        // 1. Take the throne at the floor.
        vm.prank(alice);
        uint256 firstTokens = router.buyExactIn{value: 0.01 ether}(0, true, block.timestamp);
        assertEq(hook.king(), alice);

        // 2. Sit well inside the 5-minute vesting window.
        vm.warp(block.timestamp + 4 minutes);
        uint256 earned = hook.kingReignEarnings();
        assertGt(earned, 0, "income accrued");
        assertEq(hook.unclaimedIncome(alice), 0, "still vesting: nothing claimable");

        // 3. Buy the throne from herself at the current price (<= 0.012 ETH): the sitting reign is
        //    closed as `Dethroned`, which vests the income to alice.
        uint256 price = hook.currentThronePrice();
        assertLe(price, 0.012 ether);
        vm.prank(alice);
        uint256 secondTokens = router.buyExactIn{value: price}(0, true, block.timestamp);
        assertEq(hook.king(), alice);
        assertEq(hook.reignCount(), 2);

        // 4. Dump everything through the router at once: the (fresh) second reign ends `Sold`.
        vm.startPrank(alice);
        token.approve(address(router), type(uint256).max);
        router.sellExactIn(firstTokens + secondTokens, 0, block.timestamp);
        vm.stopPrank();
        assertEq(hook.king(), address(0), "throne empty, alice holds no KING");
        assertEq(token.balanceOf(alice), 0);

        // Alice ended her own reign four minutes after taking it and holds nothing. The documented
        // rule says that income is forfeited to the pool. It was vested instead.
        assertEq(hook.getReign(0).forfeited, earned, "first reign's income must be forfeited");
        assertEq(hook.unclaimedIncome(alice), 0, "a king who exits inside the vesting window earns nothing");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {PoolManager} from "v4-core/src/PoolManager.sol";
import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
import {IHooks} from "v4-core/src/interfaces/IHooks.sol";
import {PoolKey} from "v4-core/src/types/PoolKey.sol";
import {Currency, CurrencyLibrary} from "v4-core/src/types/Currency.sol";
import {ModifyLiquidityParams} from "v4-core/src/types/PoolOperation.sol";
import {TickMath} from "v4-core/src/libraries/TickMath.sol";
import {FullMath} from "v4-core/src/libraries/FullMath.sol";
import {FixedPoint96} from "v4-core/src/libraries/FixedPoint96.sol";
import {PoolModifyLiquidityTest} from "v4-core/src/test/PoolModifyLiquidityTest.sol";

import {KingToken} from "src/KingToken.sol";
import {KingHook} from "src/KingHook.sol";
import {KingRouter} from "src/KingRouter.sol";
import {HookFlags} from "src/HookFlags.sol";
import {IKingHook} from "src/interfaces/IKingHook.sol";

/// @notice `claim()` (and `_accrue()` generally) vests and pays the king's income before anyone
/// checks the holding rule. A king who moved every KING out right after the takeover is paid the
/// full five minutes of income by his own `claim()` as long as nobody swapped or called `dethrone()`
/// in between, although the documented rule says a king who lets his balance drop inside the
/// vesting window forfeits that income.
contract ClaimIgnoresHoldingTest is Test {
    uint160 internal constant INITIAL_SQRT_PRICE = 792281625142643375935439503360000;
    int24 internal constant LP_UPPER = 184200;
    int24 internal constant LP_LOWER = -887220;
    uint256 internal constant LP_SUPPLY = 900_000_000 ether;

    PoolManager internal manager;
    KingToken internal token;
    KingHook internal hook;
    KingRouter internal router;
    PoolModifyLiquidityTest internal lpRouter;
    PoolKey internal key;

    address internal alice = makeAddr("alice");
    address internal bob = makeAddr("bob");
    address internal carol = makeAddr("carol");

    receive() external payable {}

    function setUp() public {
        vm.warp(1_800_000_000);
        manager = new PoolManager(address(this));
        token = new KingToken();
        bytes memory creationCode =
            abi.encodePacked(type(KingHook).creationCode, abi.encode(IPoolManager(address(manager)), address(token)));
        (address predicted, bytes32 salt) =
            HookFlags.mine(address(this), HookFlags.KING_HOOK_FLAGS, creationCode, 500_000);
        hook = new KingHook{salt: salt}(IPoolManager(address(manager)), address(token));
        require(address(hook) == predicted, "hook address mismatch");
        router = hook.router();
        lpRouter = new PoolModifyLiquidityTest(IPoolManager(address(manager)));

        key = PoolKey({
            currency0: CurrencyLibrary.ADDRESS_ZERO,
            currency1: Currency.wrap(address(token)),
            fee: 3000,
            tickSpacing: 60,
            hooks: IHooks(address(hook))
        });
        manager.initialize(key, INITIAL_SQRT_PRICE);

        uint160 sqrtA = TickMath.getSqrtPriceAtTick(LP_LOWER);
        uint160 sqrtB = TickMath.getSqrtPriceAtTick(LP_UPPER);
        uint128 liquidity = uint128(FullMath.mulDiv(LP_SUPPLY, FixedPoint96.Q96, sqrtB - sqrtA));
        token.approve(address(lpRouter), type(uint256).max);
        lpRouter.modifyLiquidity(
            key,
            ModifyLiquidityParams({
                tickLower: LP_LOWER, tickUpper: LP_UPPER, liquidityDelta: int256(uint256(liquidity)), salt: 0
            }),
            ""
        );

        vm.deal(alice, 100 ether);
        vm.deal(carol, 100 ether);
    }

    function test_claimPaysAKingWhoHoldsNothing() public {
        vm.prank(carol);
        router.buyExactIn{value: 10 ether}(0, false, block.timestamp);
        vm.warp(hook.gameStart());

        // Take the throne at the floor and move every KING to another wallet in the same second.
        vm.prank(alice);
        uint256 required = router.buyExactIn{value: 0.01 ether}(0, true, block.timestamp);
        vm.prank(alice);
        token.transfer(bob, required);
        assertEq(token.balanceOf(alice), 0);
        assertLt(token.balanceOf(alice), hook.requiredBalance(), "the holding rule is already violated");

        // Nobody swaps and nobody calls dethrone() for five minutes.
        vm.warp(block.timestamp + 5 minutes);

        // The hook can see the violation in this very call (one balanceOf), so the king who let his
        // balance drop inside the vesting window must get nothing. Instead claim() vests and pays.
        uint256 before = alice.balance;
        vm.prank(alice);
        vm.expectRevert(IKingHook.NothingToClaim.selector);
        hook.claim();
        assertEq(alice.balance, before, "no payout to a king holding zero KING");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {PoolManager} from "v4-core/src/PoolManager.sol";
import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
import {IHooks} from "v4-core/src/interfaces/IHooks.sol";
import {PoolKey} from "v4-core/src/types/PoolKey.sol";
import {Currency, CurrencyLibrary} from "v4-core/src/types/Currency.sol";
import {ModifyLiquidityParams} from "v4-core/src/types/PoolOperation.sol";
import {TickMath} from "v4-core/src/libraries/TickMath.sol";
import {FullMath} from "v4-core/src/libraries/FullMath.sol";
import {FixedPoint96} from "v4-core/src/libraries/FixedPoint96.sol";
import {PoolModifyLiquidityTest} from "v4-core/src/test/PoolModifyLiquidityTest.sol";

import {KingToken} from "src/KingToken.sol";
import {KingHook} from "src/KingHook.sol";
import {KingRouter} from "src/KingRouter.sol";
import {HookFlags} from "src/HookFlags.sol";
import {IKingHook} from "src/interfaces/IKingHook.sol";

/// @notice The 5-minute income vesting is the project's defence against take-and-dump bots
/// ("a bot that exits by itself inside 5 minutes earns nothing"). `_endReign` pays the vesting
/// income out whenever the reason is `Dethroned`, and `_onBuy` reaches that branch for a buy by the
/// sitting king himself (or by any second wallet of the same operator). A bot therefore takes the
/// throne at the floor, re-takes it one block later at 1.2x, which vests the first block's income,
/// and dumps everything: it leaves within five minutes having been paid from the pool.
contract VestingBypassTest is Test {
    uint160 internal constant INITIAL_SQRT_PRICE = 792281625142643375935439503360000;
    int24 internal constant LP_UPPER = 184200;
    int24 internal constant LP_LOWER = -887220;
    uint256 internal constant LP_SUPPLY = 900_000_000 ether;
    uint256 constant FLOOR = 0.01 ether;

    PoolManager manager;
    KingToken token;
    KingHook hook;
    KingRouter router;
    PoolModifyLiquidityTest lpRouter;
    PoolKey key;

    address funder = makeAddr("funder");
    address bot = makeAddr("bot");
    address botB = makeAddr("botB");

    receive() external payable {}

    function setUp() public {
        vm.warp(1_800_000_000);
        manager = new PoolManager(address(this));
        token = new KingToken();
        bytes memory creationCode =
            abi.encodePacked(type(KingHook).creationCode, abi.encode(IPoolManager(address(manager)), address(token)));
        (address predicted, bytes32 salt) =
            HookFlags.mine(address(this), HookFlags.KING_HOOK_FLAGS, creationCode, 500_000);
        hook = new KingHook{salt: salt}(IPoolManager(address(manager)), address(token));
        require(address(hook) == predicted, "hook address mismatch");
        router = hook.router();
        lpRouter = new PoolModifyLiquidityTest(IPoolManager(address(manager)));

        key = PoolKey({
            currency0: CurrencyLibrary.ADDRESS_ZERO,
            currency1: Currency.wrap(address(token)),
            fee: 3000,
            tickSpacing: 60,
            hooks: IHooks(address(hook))
        });
        manager.initialize(key, INITIAL_SQRT_PRICE);

        uint160 sqrtA = TickMath.getSqrtPriceAtTick(LP_LOWER);
        uint160 sqrtB = TickMath.getSqrtPriceAtTick(LP_UPPER);
        uint128 liquidity = uint128(FullMath.mulDiv(LP_SUPPLY, FixedPoint96.Q96, sqrtB - sqrtA));
        token.approve(address(lpRouter), type(uint256).max);
        lpRouter.modifyLiquidity(
            key,
            ModifyLiquidityParams({
                tickLower: LP_LOWER, tickUpper: LP_UPPER, liquidityDelta: int256(uint256(liquidity)), salt: 0
            }),
            ""
        );

        vm.deal(funder, 1_000 ether);
        vm.deal(bot, 10 ether);
        vm.deal(botB, 10 ether);

        // Fill the throne pool during the anti-snipe window (25% fee), then open the game.
        vm.prank(funder);
        router.buyExactIn{value: 200 ether}(0, false, block.timestamp); // 50 ETH fee, 46 ETH to the pool
        vm.warp(hook.gameStart());
        assertEq(hook.pool(), 46 ether);
        assertEq(hook.king(), address(0));
    }

    function buy(address who, uint256 eth) internal returns (uint256 out) {
        vm.prank(who);
        out = router.buyExactIn{value: eth}(0, false, block.timestamp);
    }

    function dump(address who) internal returns (uint256 ethOut) {
        uint256 bal = token.balanceOf(who);
        vm.startPrank(who);
        token.approve(address(router), bal);
        ethOut = router.sellExactIn(bal, 0, block.timestamp);
        vm.stopPrank();
    }

    /// @dev Same wallet: take at the floor, re-take one block later, dump one block after that.
    /// Total time on the throne: 4 seconds. The README promises such a bot "earns nothing".
    function test_selfRetakeWithinFiveMinutesMustNotVestTheIncome() public {
        uint256 start = block.timestamp;
        buy(bot, FLOOR); // reign 0 at the floor
        assertEq(hook.king(), bot);

        vm.warp(start + 2); // one Base block
        uint256 firstBlockIncome = hook.kingReignEarnings();
        assertGt(firstBlockIncome, 0);
        assertEq(hook.unclaimedIncome(bot), 0, "still vesting");

        buy(bot, hook.currentThronePrice()); // 0.012 ETH: reign 0 ends as `Dethroned`, reign 1 starts
        assertEq(hook.king(), bot);
        assertEq(hook.reignCount(), 2);

        vm.warp(start + 4); // one more block
        dump(bot); // reign 1 ends by the bot's own sell; only reign 1's one block is forfeited
        assertEq(hook.king(), address(0));
        assertLt(block.timestamp - start, 5 minutes);

        // Expected by the documented defence: a bot that left by itself inside five minutes has no
        // claimable income. Actual: the first block's income was vested by the self-takeover.
        assertEq(hook.pendingIncome(bot), 0, "self-exit inside the vesting window must forfeit all income");
        assertEq(hook.unclaimedIncome(bot), 0, "self-exit inside the vesting window must forfeit all income");
    }

    /// @dev Two wallets of one operator alternate: identical economics, no `buyer == king` to detect.
    function test_twoWalletRelayWithinFiveMinutesMustNotVestTheIncome() public {
        uint256 start = block.timestamp;
        buy(bot, FLOOR);
        vm.warp(start + 2);
        buy(botB, hook.currentThronePrice()); // bot's reign ends `Dethroned`; its income vests
        vm.warp(start + 4);
        dump(bot);
        dump(botB); // botB's reign ends by its own sell
        assertEq(hook.king(), address(0));
        assertLt(block.timestamp - start, 5 minutes);

        assertEq(hook.pendingIncome(bot) + hook.pendingIncome(botB), 0, "the relay must not extract vested income");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test, console2} from "forge-std/Test.sol";
import {PoolManager} from "v4-core/src/PoolManager.sol";
import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
import {IHooks} from "v4-core/src/interfaces/IHooks.sol";
import {PoolKey} from "v4-core/src/types/PoolKey.sol";
import {Currency, CurrencyLibrary} from "v4-core/src/types/Currency.sol";
import {ModifyLiquidityParams} from "v4-core/src/types/PoolOperation.sol";
import {TickMath} from "v4-core/src/libraries/TickMath.sol";
import {FullMath} from "v4-core/src/libraries/FullMath.sol";
import {FixedPoint96} from "v4-core/src/libraries/FixedPoint96.sol";
import {PoolModifyLiquidityTest} from "v4-core/src/test/PoolModifyLiquidityTest.sol";

import {KingToken} from "src/KingToken.sol";
import {KingHook} from "src/KingHook.sol";
import {KingRouter} from "src/KingRouter.sol";
import {HookFlags} from "src/HookFlags.sol";

/// @notice `KingRouter.sellExactIn` pulls `kingIn` from the seller before the swap and assumes the
/// pool consumes all of it. The launch pool holds ETH only from earlier buys; a sell of KING that
/// did not come out of the pool (the 10% of supply kept outside the launch liquidity) can exceed
/// that ETH, the price reaches the top of the launch range where liquidity is zero and v4 fills
/// the swap partially. The router settles only the consumed part and leaves the rest of the
/// seller's KING in its own balance, where the next `sellExactOut` caller sweeps it as "leftover".
contract PartialSellTest is Test {
    uint160 internal constant INITIAL_SQRT_PRICE = 792281625142643375935439503360000;
    int24 internal constant LP_UPPER = 184200;
    int24 internal constant LP_LOWER = -887220;
    uint256 internal constant LP_SUPPLY = 900_000_000 ether;

    PoolManager manager;
    KingToken token;
    KingHook hook;
    KingRouter router;
    PoolModifyLiquidityTest lpRouter;
    PoolKey key;

    address alice = makeAddr("alice");
    address contributor = makeAddr("contributor");
    address sweeper = makeAddr("sweeper");

    receive() external payable {}

    function setUp() public {
        vm.warp(1_800_000_000);
        manager = new PoolManager(address(this));
        token = new KingToken();
        bytes memory creationCode =
            abi.encodePacked(type(KingHook).creationCode, abi.encode(IPoolManager(address(manager)), address(token)));
        (address predicted, bytes32 salt) =
            HookFlags.mine(address(this), HookFlags.KING_HOOK_FLAGS, creationCode, 500_000);
        hook = new KingHook{salt: salt}(IPoolManager(address(manager)), address(token));
        require(address(hook) == predicted, "hook address mismatch");
        router = hook.router();
        lpRouter = new PoolModifyLiquidityTest(IPoolManager(address(manager)));

        key = PoolKey({
            currency0: CurrencyLibrary.ADDRESS_ZERO,
            currency1: Currency.wrap(address(token)),
            fee: 3000,
            tickSpacing: 60,
            hooks: IHooks(address(hook))
        });
        manager.initialize(key, INITIAL_SQRT_PRICE);

        uint160 sqrtA = TickMath.getSqrtPriceAtTick(LP_LOWER);
        uint160 sqrtB = TickMath.getSqrtPriceAtTick(LP_UPPER);
        uint128 liquidity = uint128(FullMath.mulDiv(LP_SUPPLY, FixedPoint96.Q96, sqrtB - sqrtA));
        token.approve(address(lpRouter), type(uint256).max);
        lpRouter.modifyLiquidity(
            key,
            ModifyLiquidityParams({
                tickLower: LP_LOWER, tickUpper: LP_UPPER, liquidityDelta: int256(uint256(liquidity)), salt: 0
            }),
            ""
        );

        // The 10% of supply outside the launch liquidity: a wallet that did not buy from the pool.
        token.transfer(contributor, 100_000_000 ether - 1_000 ether);
        token.transfer(sweeper, 1_000 ether);
        vm.deal(alice, 10 ether);
        vm.warp(hook.gameStart());
    }

    function test_exactInputSellThatPartiallyFillsLeavesTheSellersKingInTheRouter() public {
        // The pool's ETH side is what buyers put in: alice buys 1 ETH (0.975 ETH reaches the pool).
        vm.prank(alice);
        router.buyExactIn{value: 1 ether}(0, false, block.timestamp);
        uint256 poolEth = address(manager).balance - manager.balanceOf(address(hook), 0);
        assertLt(poolEth, 1 ether);

        // The contributor sells 100M KING, worth about 1 ETH at the launch price: more ETH than the
        // pool holds. v4 stops at the top of the launch range (zero liquidity above it).
        uint256 kingIn = token.balanceOf(contributor);
        vm.startPrank(contributor);
        token.approve(address(router), kingIn);
        uint256 ethOut = router.sellExactIn(kingIn, 0, block.timestamp);
        vm.stopPrank();

        uint256 stuck = token.balanceOf(address(router));
        console2.log("ETH received by the seller", ethOut);
        console2.log("KING pulled from the seller", kingIn);
        console2.log("KING left inside the router", stuck);

        // Expected: the seller either gets a full fill or keeps every KING the pool did not take.
        // Actual: `kingIn` left the seller, only the consumed part reached the pool, the rest sits
        // in the router with no path back to the seller.
        assertEq(token.balanceOf(contributor), 0, "the router pulled everything up front");
        assertEq(stuck, 0, "KING the pool did not consume must be returned to the seller");
    }

    function test_theNextSellExactOutCallerSweepsTheStrandedKing() public {
        vm.prank(alice);
        router.buyExactIn{value: 1 ether}(0, false, block.timestamp);
        uint256 kingIn = token.balanceOf(contributor);
        vm.startPrank(contributor);
        token.approve(address(router), kingIn);
        router.sellExactIn(kingIn, 0, block.timestamp);
        vm.stopPrank();
        uint256 stuck = token.balanceOf(address(router));
        assertGt(stuck, 0, "precondition: KING stranded in the router");

        // Somebody refills the ETH side, then anyone sells one wei of ETH exact-out and receives
        // the stranded KING as the router's "leftover" refund.
        vm.prank(alice);
        router.buyExactIn{value: 1 ether}(0, false, block.timestamp);
        vm.startPrank(sweeper);
        token.approve(address(router), 1_000 ether);
        router.sellExactOut(1, 1_000 ether, block.timestamp);
        vm.stopPrank();
        console2.log("sweeper KING after", token.balanceOf(sweeper));
        assertLe(token.balanceOf(sweeper), 1_000 ether, "a third party must not receive the seller's KING");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {PoolManager} from "v4-core/src/PoolManager.sol";
import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
import {IHooks} from "v4-core/src/interfaces/IHooks.sol";
import {PoolKey} from "v4-core/src/types/PoolKey.sol";
import {Currency, CurrencyLibrary} from "v4-core/src/types/Currency.sol";
import {ModifyLiquidityParams} from "v4-core/src/types/PoolOperation.sol";
import {TickMath} from "v4-core/src/libraries/TickMath.sol";
import {FullMath} from "v4-core/src/libraries/FullMath.sol";
import {FixedPoint96} from "v4-core/src/libraries/FixedPoint96.sol";
import {PoolModifyLiquidityTest} from "v4-core/src/test/PoolModifyLiquidityTest.sol";

import {KingToken} from "src/KingToken.sol";
import {KingHook} from "src/KingHook.sol";
import {KingRouter} from "src/KingRouter.sol";
import {HookFlags} from "src/HookFlags.sol";

/// @notice The 5-minute income vesting is the documented take-and-dump defence: "a bot that exits
/// by itself inside 5 minutes earns nothing" (README). `KingHook._onBuy` ends the sitting king's
/// reign as `EndReason.Dethroned` for ANY qualifying buy, including the king's own, and `_endReign`
/// grants the unvested income on `Dethroned`. A king therefore exits inside 5 minutes with the
/// income by re-taking his own throne and dumping the new reign in the same block.
contract VestingBypassProof is Test {
    uint160 constant INITIAL_SQRT_PRICE = 792281625142643375935439503360000;
    int24 constant LP_UPPER = 184200;
    int24 constant LP_LOWER = -887220;
    uint256 constant FLOOR = 0.01 ether;

    PoolManager manager;
    KingToken token;
    KingHook hook;
    KingRouter router;
    PoolKey key;

    address bot = makeAddr("bot");
    address carol = makeAddr("carol");

    receive() external payable {}

    function setUp() public {
        vm.warp(1_800_000_000);
        manager = new PoolManager(address(this));
        token = new KingToken();
        bytes memory creationCode =
            abi.encodePacked(type(KingHook).creationCode, abi.encode(IPoolManager(address(manager)), address(token)));
        (address predicted, bytes32 salt) =
            HookFlags.mine(address(this), HookFlags.KING_HOOK_FLAGS, creationCode, 500_000);
        hook = new KingHook{salt: salt}(IPoolManager(address(manager)), address(token));
        require(address(hook) == predicted, "hook address mismatch");
        router = hook.router();
        PoolModifyLiquidityTest lpRouter = new PoolModifyLiquidityTest(IPoolManager(address(manager)));

        key = PoolKey({
            currency0: CurrencyLibrary.ADDRESS_ZERO,
            currency1: Currency.wrap(address(token)),
            fee: 3000,
            tickSpacing: 60,
            hooks: IHooks(address(hook))
        });
        manager.initialize(key, INITIAL_SQRT_PRICE);

        // Launch liquidity: 90% of supply, KING only, below the current tick.
        uint160 sqrtA = TickMath.getSqrtPriceAtTick(LP_LOWER);
        uint160 sqrtB = TickMath.getSqrtPriceAtTick(LP_UPPER);
        uint128 liquidity = uint128(FullMath.mulDiv(900_000_000 ether, FixedPoint96.Q96, sqrtB - sqrtA));
        token.approve(address(lpRouter), type(uint256).max);
        lpRouter.modifyLiquidity(
            key,
            ModifyLiquidityParams({
                tickLower: LP_LOWER, tickUpper: LP_UPPER, liquidityDelta: int256(uint256(liquidity)), salt: 0
            }),
            ""
        );

        vm.deal(bot, 100 ether);
        vm.deal(carol, 100 ether);

        // Fund the throne pool during the anti-snipe window (25% fee: 2.3 ETH), then open the game.
        vm.prank(carol);
        router.buyExactIn{value: 10 ether}(0, false, block.timestamp);
        vm.warp(hook.gameStart());
    }

    function test_kingWhoExitsWithinFiveMinutesViaSelfTakeoverMustEarnNothing() public {
        // 1. Take the empty throne at the floor.
        vm.prank(bot);
        router.buyExactIn{value: FLOOR}(0, true, block.timestamp);
        assertEq(hook.king(), bot);
        uint256 start = block.timestamp;

        // 2. Hold one minute: income accrues but is still vesting.
        vm.warp(start + 60);
        assertEq(hook.unclaimedIncome(bot), 0, "nothing vested after one minute");

        // 3. Re-take your own throne at the current price (1.2x floor).
        uint256 price = hook.currentThronePrice();
        vm.prank(bot);
        router.buyExactIn{value: price}(0, true, block.timestamp);
        assertEq(hook.king(), bot);

        // 4. Dump everything in the same block. The throne is empty, back at the floor.
        uint256 held = token.balanceOf(bot);
        vm.startPrank(bot);
        token.approve(address(router), held);
        router.sellExactIn(held, 0, block.timestamp);
        vm.stopPrank();
        assertEq(hook.king(), address(0));
        assertEq(hook.currentThronePrice(), FLOOR);
        assertLt(block.timestamp - start, 5 minutes, "the whole exit happened inside the vesting window");

        // The documented rule: a king who ends his own reign before it vests forfeits the income.
        assertEq(hook.unclaimedIncome(bot), 0, "king exited by himself inside 5 minutes and kept the income");
        assertEq(hook.pendingIncome(bot), 0, "nothing may be credited to him");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {PoolManager} from "v4-core/src/PoolManager.sol";
import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
import {IHooks} from "v4-core/src/interfaces/IHooks.sol";
import {PoolKey} from "v4-core/src/types/PoolKey.sol";
import {Currency, CurrencyLibrary} from "v4-core/src/types/Currency.sol";
import {ModifyLiquidityParams} from "v4-core/src/types/PoolOperation.sol";
import {TickMath} from "v4-core/src/libraries/TickMath.sol";
import {FullMath} from "v4-core/src/libraries/FullMath.sol";
import {FixedPoint96} from "v4-core/src/libraries/FixedPoint96.sol";
import {PoolModifyLiquidityTest} from "v4-core/src/test/PoolModifyLiquidityTest.sol";

import {KingToken} from "src/KingToken.sol";
import {KingHook} from "src/KingHook.sol";
import {KingRouter} from "src/KingRouter.sol";
import {HookFlags} from "src/HookFlags.sol";
import {IKingHook} from "src/interfaces/IKingHook.sol";

/// @notice The income-vesting defence against take-and-dump can be bypassed: a king who re-takes
/// his own throne ends his reign with reason `Dethroned`, which vests the still-provisional income
/// unconditionally. He then sells one wei to empty the throne and claims the income he was supposed
/// to forfeit. README: "A bot that exits by itself inside 5 minutes earns nothing."
contract VestingBypassTest is Test {
    uint160 internal constant INITIAL_SQRT_PRICE = 792281625142643375935439503360000;
    int24 internal constant LP_UPPER = 184200;
    int24 internal constant LP_LOWER = -887220;
    uint256 internal constant FLOOR = 0.01 ether;

    PoolManager manager;
    KingToken token;
    KingHook hook;
    KingRouter router;
    PoolModifyLiquidityTest lpRouter;
    PoolKey key;

    address bot = makeAddr("bot");
    address carol = makeAddr("carol");

    receive() external payable {}

    function setUp() public {
        vm.warp(1_800_000_000);
        manager = new PoolManager(address(this));
        token = new KingToken();
        bytes memory creationCode =
            abi.encodePacked(type(KingHook).creationCode, abi.encode(IPoolManager(address(manager)), address(token)));
        (, bytes32 salt) = HookFlags.mine(address(this), HookFlags.KING_HOOK_FLAGS, creationCode, 500_000);
        hook = new KingHook{salt: salt}(IPoolManager(address(manager)), address(token));
        router = hook.router();
        lpRouter = new PoolModifyLiquidityTest(IPoolManager(address(manager)));
        key = PoolKey({
            currency0: CurrencyLibrary.ADDRESS_ZERO,
            currency1: Currency.wrap(address(token)),
            fee: 3000,
            tickSpacing: 60,
            hooks: IHooks(address(hook))
        });
        manager.initialize(key, INITIAL_SQRT_PRICE);
        uint160 sqrtA = TickMath.getSqrtPriceAtTick(LP_LOWER);
        uint160 sqrtB = TickMath.getSqrtPriceAtTick(LP_UPPER);
        uint128 liquidity = uint128(FullMath.mulDiv(900_000_000 ether, FixedPoint96.Q96, sqrtB - sqrtA));
        token.approve(address(lpRouter), type(uint256).max);
        lpRouter.modifyLiquidity(
            key, ModifyLiquidityParams({tickLower: LP_LOWER, tickUpper: LP_UPPER, liquidityDelta: int256(uint256(liquidity)), salt: 0}), ""
        );
        vm.deal(bot, 100 ether);
        vm.deal(carol, 100 ether);

        // Fund the throne pool during the anti-snipe period (25% fee), then open the game.
        vm.prank(carol);
        router.buyExactIn{value: 10 ether}(0, false, block.timestamp);
        vm.warp(hook.gameStart());
        assertEq(hook.pool(), 2.3 ether);
    }

    function test_selfRetakeAndSellWithinFiveMinutesKeepsTheIncome() public {
        // 1. The bot takes the empty throne at the floor.
        vm.prank(bot);
        router.buyExactIn{value: FLOOR}(0, false, block.timestamp);
        assertEq(hook.king(), bot);

        // 2. One Base block later it has earned income that is still vesting (not claimable).
        vm.warp(block.timestamp + 2);
        uint256 skimmed = hook.kingReignEarnings();
        assertGt(skimmed, 0);
        assertEq(hook.unclaimedIncome(bot), 0, "still vesting");

        // 3. The bot re-takes its own throne at the current price (1.2x the floor). The old reign
        //    ends with reason Dethroned and its income vests at once.
        uint256 price = hook.currentThronePrice();
        assertLe(price, (FLOOR * 12) / 10);
        vm.prank(bot);
        router.buyExactIn{value: price}(0, false, block.timestamp);
        assertEq(hook.king(), bot);
        assertEq(hook.reignCount(), 2);

        // 4. The bot sells one wei through the router: the second reign ends, the throne is empty
        //    again at the floor, and nothing is forfeited because the second reign is seconds old.
        vm.startPrank(bot);
        token.approve(address(router), 1);
        router.sellExactIn(1, 0, block.timestamp);
        vm.stopPrank();
        assertEq(hook.king(), address(0));
        assertEq(hook.currentThronePrice(), FLOOR);

        // The documented guarantee: a king who ends his own reign inside five minutes earns nothing.
        // Less than ten seconds passed since the first takeover, and the bot ended both reigns itself.
        assertLt(block.timestamp - hook.getReign(0).start, 5 minutes);
        assertEq(hook.unclaimedIncome(bot), 0, "income of a self-ended reign under 5 minutes must be forfeited");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {PoolManager} from "v4-core/src/PoolManager.sol";
import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
import {IHooks} from "v4-core/src/interfaces/IHooks.sol";
import {PoolKey} from "v4-core/src/types/PoolKey.sol";
import {Currency, CurrencyLibrary} from "v4-core/src/types/Currency.sol";
import {ModifyLiquidityParams} from "v4-core/src/types/PoolOperation.sol";
import {TickMath} from "v4-core/src/libraries/TickMath.sol";
import {FullMath} from "v4-core/src/libraries/FullMath.sol";
import {FixedPoint96} from "v4-core/src/libraries/FixedPoint96.sol";
import {PoolModifyLiquidityTest} from "v4-core/src/test/PoolModifyLiquidityTest.sol";

import {KingToken} from "src/KingToken.sol";
import {KingHook} from "src/KingHook.sol";
import {KingRouter} from "src/KingRouter.sol";
import {HookFlags} from "src/HookFlags.sol";

/// @notice Proof: `KingRouter.sellExactIn` keeps the KING a partially filled sell did not consume.
/// The seller loses it and the next `sellExactOut` caller receives it as "leftover".
/// Fails on the current code; passes once the router refunds the unconsumed input.
contract ProofRouterStrandsKing is Test {
    uint160 constant INITIAL_SQRT_PRICE = 792281625142643375935439503360000;

    PoolManager manager;
    KingToken token;
    KingHook hook;
    KingRouter router;
    PoolKey key;
    address alice = makeAddr("alice");
    address whale = makeAddr("whale"); // holds KING that never came out of the pool (the launch's 10%)
    address carol = makeAddr("carol");

    receive() external payable {}

    function setUp() public {
        vm.warp(1_800_000_000);
        manager = new PoolManager(address(this));
        token = new KingToken();
        bytes memory creationCode =
            abi.encodePacked(type(KingHook).creationCode, abi.encode(IPoolManager(address(manager)), address(token)));
        (, bytes32 salt) = HookFlags.mine(address(this), HookFlags.KING_HOOK_FLAGS, creationCode, 500_000);
        hook = new KingHook{salt: salt}(IPoolManager(address(manager)), address(token));
        router = hook.router();
        key = PoolKey(CurrencyLibrary.ADDRESS_ZERO, Currency.wrap(address(token)), 3000, 60, IHooks(address(hook)));
        manager.initialize(key, INITIAL_SQRT_PRICE);

        PoolModifyLiquidityTest lp = new PoolModifyLiquidityTest(IPoolManager(address(manager)));
        uint160 sqrtA = TickMath.getSqrtPriceAtTick(-887220);
        uint160 sqrtB = TickMath.getSqrtPriceAtTick(184200);
        uint128 liquidity = uint128(FullMath.mulDiv(900_000_000 ether, FixedPoint96.Q96, sqrtB - sqrtA));
        token.approve(address(lp), type(uint256).max);
        lp.modifyLiquidity(key, ModifyLiquidityParams(-887220, 184200, int256(uint256(liquidity)), 0), "");

        token.transfer(whale, 100_000_000 ether);
        vm.deal(alice, 10 ether);
        vm.deal(carol, 10 ether);
    }

    function test_sellExactInRefundsWhatThePoolDidNotConsume() public {
        // The curve holds 0.75 ETH after alice's buy: far less than 80M KING is worth.
        vm.prank(alice);
        router.buyExactIn{value: 1 ether}(0, false, block.timestamp);

        vm.startPrank(whale);
        token.approve(address(router), 80_000_000 ether);
        uint256 ethOut = router.sellExactIn(80_000_000 ether, 0, block.timestamp);
        vm.stopPrank();
        assertGt(ethOut, 0);

        // Expected: the swap consumed only part of the 80M; the rest is back with the seller.
        // Actual: ~10.86M KING sit in the router and the whale holds exactly 20M.
        assertEq(token.balanceOf(address(router)), 0, "the router kept the unconsumed KING");
        assertGt(token.balanceOf(whale), 20_000_000 ether, "the seller lost the unconsumed KING");
    }

    function test_nextExactOutputSellerSweepsTheStrandedKing() public {
        vm.prank(alice);
        router.buyExactIn{value: 1 ether}(0, false, block.timestamp);
        vm.startPrank(whale);
        token.approve(address(router), 80_000_000 ether);
        router.sellExactIn(80_000_000 ether, 0, block.timestamp);
        vm.stopPrank();

        // Carol buys a little so the pool can pay a tiny exact-output sell, then sells 1e12 wei
        // of ETH worth of KING and walks away with whatever the router was holding.
        vm.prank(carol);
        uint256 carolTokens = router.buyExactIn{value: 0.1 ether}(0, false, block.timestamp);
        vm.startPrank(carol);
        token.approve(address(router), carolTokens);
        uint256 kingIn = router.sellExactOut(1e12, carolTokens, block.timestamp);
        vm.stopPrank();
        // Expected: carol's balance fell by exactly what her sell consumed.
        // Actual: it rose by about 10.86M KING that belonged to the whale.
        assertEq(token.balanceOf(carol), carolTokens - kingIn, "carol received somebody else's KING");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {PoolManager} from "v4-core/src/PoolManager.sol";
import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
import {IHooks} from "v4-core/src/interfaces/IHooks.sol";
import {PoolKey} from "v4-core/src/types/PoolKey.sol";
import {Currency, CurrencyLibrary} from "v4-core/src/types/Currency.sol";
import {ModifyLiquidityParams, SwapParams} from "v4-core/src/types/PoolOperation.sol";
import {TickMath} from "v4-core/src/libraries/TickMath.sol";
import {FullMath} from "v4-core/src/libraries/FullMath.sol";
import {FixedPoint96} from "v4-core/src/libraries/FixedPoint96.sol";
import {PoolModifyLiquidityTest} from "v4-core/src/test/PoolModifyLiquidityTest.sol";
import {PoolSwapTest} from "v4-core/src/test/PoolSwapTest.sol";

import {KingToken} from "src/KingToken.sol";
import {KingHook} from "src/KingHook.sol";
import {KingRouter} from "src/KingRouter.sol";
import {HookFlags} from "src/HookFlags.sol";

/// @notice Proof: a king who sells every KING he holds through a router other than `KingRouter`
/// keeps the throne and keeps being paid 2% of the pool per hour until somebody else swaps or calls
/// `dethrone()`, and he can `claim()` that income himself while holding nothing. The brief: "Any sell
/// by the king through the pool dethrones him at once" and dethrone "stops his income at that moment".
/// Fails on the current code; passes once income accrued after the balance fell short is not credited
/// (and `claim()` does not pay it).
contract ProofExKingKeepsEarning is Test {
    uint160 constant INITIAL_SQRT_PRICE = 792281625142643375935439503360000;

    PoolManager manager;
    KingToken token;
    KingHook hook;
    KingRouter router;
    PoolSwapTest otherRouter;
    PoolKey key;
    address alice = makeAddr("alice");
    address carol = makeAddr("carol");

    receive() external payable {}

    function setUp() public {
        vm.warp(1_800_000_000);
        manager = new PoolManager(address(this));
        token = new KingToken();
        bytes memory creationCode =
            abi.encodePacked(type(KingHook).creationCode, abi.encode(IPoolManager(address(manager)), address(token)));
        (, bytes32 salt) = HookFlags.mine(address(this), HookFlags.KING_HOOK_FLAGS, creationCode, 500_000);
        hook = new KingHook{salt: salt}(IPoolManager(address(manager)), address(token));
        router = hook.router();
        otherRouter = new PoolSwapTest(IPoolManager(address(manager)));
        key = PoolKey(CurrencyLibrary.ADDRESS_ZERO, Currency.wrap(address(token)), 3000, 60, IHooks(address(hook)));
        manager.initialize(key, INITIAL_SQRT_PRICE);

        PoolModifyLiquidityTest lp = new PoolModifyLiquidityTest(IPoolManager(address(manager)));
        uint160 sqrtA = TickMath.getSqrtPriceAtTick(-887220);
        uint160 sqrtB = TickMath.getSqrtPriceAtTick(184200);
        uint128 liquidity = uint128(FullMath.mulDiv(900_000_000 ether, FixedPoint96.Q96, sqrtB - sqrtA));
        token.approve(address(lp), type(uint256).max);
        lp.modifyLiquidity(key, ModifyLiquidityParams(-887220, 184200, int256(uint256(liquidity)), 0), "");

        vm.deal(alice, 10 ether);
        vm.deal(carol, 100 ether);
    }

    function test_incomeStopsWhenTheKingSellsEverythingThroughAnotherRouter() public {
        // Fund the throne pool with 2.3 ETH during the anti-snipe window, then open the game.
        vm.prank(carol);
        router.buyExactIn{value: 10 ether}(0, false, block.timestamp);
        vm.warp(hook.gameStart());

        // Alice takes the throne at the floor and dumps every KING through a third-party router.
        vm.prank(alice);
        uint256 required = router.buyExactIn{value: 0.01 ether}(0, true, block.timestamp);
        assertEq(hook.king(), alice);
        vm.startPrank(alice);
        token.approve(address(otherRouter), required);
        otherRouter.swap(
            key,
            SwapParams(false, -int256(required), TickMath.MAX_SQRT_PRICE - 1),
            PoolSwapTest.TestSettings(false, false),
            ""
        );
        vm.stopPrank();
        assertEq(token.balanceOf(alice), 0, "alice holds no KING at all");
        assertLt(token.balanceOf(alice), hook.requiredBalance());

        // Six quiet hours later she claims. Expected: nothing (her income stopped when she sold).
        // Actual: about 0.26 ETH, 11.4% of the pool, paid to a wallet that holds zero KING.
        vm.warp(block.timestamp + 6 hours);
        uint256 before = alice.balance;
        vm.prank(alice);
        try hook.claim() {} catch {}
        assertEq(alice.balance - before, 0, "an ex-king holding nothing was paid from the pool");
        assertEq(hook.unclaimedIncome(alice), 0, "income kept accruing after the sell");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test, console2} from "forge-std/Test.sol";
import {PoolManager} from "v4-core/src/PoolManager.sol";
import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
import {IHooks} from "v4-core/src/interfaces/IHooks.sol";
import {PoolKey} from "v4-core/src/types/PoolKey.sol";
import {Currency, CurrencyLibrary} from "v4-core/src/types/Currency.sol";
import {ModifyLiquidityParams} from "v4-core/src/types/PoolOperation.sol";
import {TickMath} from "v4-core/src/libraries/TickMath.sol";
import {FullMath} from "v4-core/src/libraries/FullMath.sol";
import {FixedPoint96} from "v4-core/src/libraries/FixedPoint96.sol";
import {PoolModifyLiquidityTest} from "v4-core/src/test/PoolModifyLiquidityTest.sol";

import {KingToken} from "src/KingToken.sol";
import {KingHook} from "src/KingHook.sol";
import {KingRouter} from "src/KingRouter.sol";
import {HookFlags} from "src/HookFlags.sol";

/// @notice `KingRouter.sellExactIn` pulls `kingIn` from the seller before the swap and assumes the
/// pool consumes all of it. The launch pool holds ETH only from earlier buys; a sell of KING that
/// did not come out of the pool (the 10% of supply kept outside the launch liquidity) can exceed
/// that ETH, the price reaches the top of the launch range where liquidity is zero and v4 fills
/// the swap partially. The router settles only the consumed part and leaves the rest of the
/// seller's KING in its own balance, where the next `sellExactOut` caller sweeps it as "leftover".
contract PartialSellTest is Test {
    uint160 internal constant INITIAL_SQRT_PRICE = 792281625142643375935439503360000;
    int24 internal constant LP_UPPER = 184200;
    int24 internal constant LP_LOWER = -887220;
    uint256 internal constant LP_SUPPLY = 900_000_000 ether;

    PoolManager manager;
    KingToken token;
    KingHook hook;
    KingRouter router;
    PoolModifyLiquidityTest lpRouter;
    PoolKey key;

    address alice = makeAddr("alice");
    address contributor = makeAddr("contributor");
    address sweeper = makeAddr("sweeper");

    receive() external payable {}

    function setUp() public {
        vm.warp(1_800_000_000);
        manager = new PoolManager(address(this));
        token = new KingToken();
        bytes memory creationCode =
            abi.encodePacked(type(KingHook).creationCode, abi.encode(IPoolManager(address(manager)), address(token)));
        (address predicted, bytes32 salt) =
            HookFlags.mine(address(this), HookFlags.KING_HOOK_FLAGS, creationCode, 500_000);
        hook = new KingHook{salt: salt}(IPoolManager(address(manager)), address(token));
        require(address(hook) == predicted, "hook address mismatch");
        router = hook.router();
        lpRouter = new PoolModifyLiquidityTest(IPoolManager(address(manager)));

        key = PoolKey({
            currency0: CurrencyLibrary.ADDRESS_ZERO,
            currency1: Currency.wrap(address(token)),
            fee: 3000,
            tickSpacing: 60,
            hooks: IHooks(address(hook))
        });
        manager.initialize(key, INITIAL_SQRT_PRICE);

        uint160 sqrtA = TickMath.getSqrtPriceAtTick(LP_LOWER);
        uint160 sqrtB = TickMath.getSqrtPriceAtTick(LP_UPPER);
        uint128 liquidity = uint128(FullMath.mulDiv(LP_SUPPLY, FixedPoint96.Q96, sqrtB - sqrtA));
        token.approve(address(lpRouter), type(uint256).max);
        lpRouter.modifyLiquidity(
            key,
            ModifyLiquidityParams({
                tickLower: LP_LOWER, tickUpper: LP_UPPER, liquidityDelta: int256(uint256(liquidity)), salt: 0
            }),
            ""
        );

        // The 10% of supply outside the launch liquidity: a wallet that did not buy from the pool.
        token.transfer(contributor, 100_000_000 ether - 1_000 ether);
        token.transfer(sweeper, 1_000 ether);
        vm.deal(alice, 10 ether);
        vm.warp(hook.gameStart());
    }

    function test_exactInputSellThatPartiallyFillsLeavesTheSellersKingInTheRouter() public {
        // The pool's ETH side is what buyers put in: alice buys 1 ETH (0.975 ETH reaches the pool).
        vm.prank(alice);
        router.buyExactIn{value: 1 ether}(0, false, block.timestamp);
        uint256 poolEth = address(manager).balance - manager.balanceOf(address(hook), 0);
        assertLt(poolEth, 1 ether);

        // The contributor sells 100M KING, worth about 1 ETH at the launch price: more ETH than the
        // pool holds. v4 stops at the top of the launch range (zero liquidity above it).
        uint256 kingIn = token.balanceOf(contributor);
        vm.startPrank(contributor);
        token.approve(address(router), kingIn);
        uint256 ethOut = router.sellExactIn(kingIn, 0, block.timestamp);
        vm.stopPrank();

        uint256 stuck = token.balanceOf(address(router));
        console2.log("ETH received by the seller", ethOut);
        console2.log("KING pulled from the seller", kingIn);
        console2.log("KING left inside the router", stuck);

        // Expected: the seller either gets a full fill or keeps every KING the pool did not take.
        // Actual: `kingIn` left the seller, only the consumed part reached the pool, the rest sits
        // in the router with no path back to the seller.
        assertEq(token.balanceOf(contributor), 0, "the router pulled everything up front");
        assertEq(stuck, 0, "KING the pool did not consume must be returned to the seller");
    }

    function test_theNextSellExactOutCallerSweepsTheStrandedKing() public {
        vm.prank(alice);
        router.buyExactIn{value: 1 ether}(0, false, block.timestamp);
        uint256 kingIn = token.balanceOf(contributor);
        vm.startPrank(contributor);
        token.approve(address(router), kingIn);
        router.sellExactIn(kingIn, 0, block.timestamp);
        vm.stopPrank();
        uint256 stuck = token.balanceOf(address(router));
        assertGt(stuck, 0, "precondition: KING stranded in the router");

        // Somebody refills the ETH side, then anyone sells one wei of ETH exact-out and receives
        // the stranded KING as the router's "leftover" refund.
        vm.prank(alice);
        router.buyExactIn{value: 1 ether}(0, false, block.timestamp);
        vm.startPrank(sweeper);
        token.approve(address(router), 1_000 ether);
        router.sellExactOut(1, 1_000 ether, block.timestamp);
        vm.stopPrank();
        console2.log("sweeper KING after", token.balanceOf(sweeper));
        assertLe(token.balanceOf(sweeper), 1_000 ether, "a third party must not receive the seller's KING");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {PoolManager} from "v4-core/src/PoolManager.sol";
import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
import {IHooks} from "v4-core/src/interfaces/IHooks.sol";
import {PoolKey} from "v4-core/src/types/PoolKey.sol";
import {Currency, CurrencyLibrary} from "v4-core/src/types/Currency.sol";
import {ModifyLiquidityParams} from "v4-core/src/types/PoolOperation.sol";
import {TickMath} from "v4-core/src/libraries/TickMath.sol";
import {FullMath} from "v4-core/src/libraries/FullMath.sol";
import {FixedPoint96} from "v4-core/src/libraries/FixedPoint96.sol";
import {PoolModifyLiquidityTest} from "v4-core/src/test/PoolModifyLiquidityTest.sol";

import {KingToken} from "src/KingToken.sol";
import {KingHook} from "src/KingHook.sol";
import {KingRouter} from "src/KingRouter.sol";
import {HookFlags} from "src/HookFlags.sol";
import {IKingHook} from "src/interfaces/IKingHook.sol";

/// @notice The 5-minute income vesting is the project's defence against take-and-dump bots
/// ("a bot that exits by itself inside 5 minutes earns nothing"). `_endReign` pays the vesting
/// income out whenever the reason is `Dethroned`, and `_onBuy` reaches that branch for a buy by the
/// sitting king himself (or by any second wallet of the same operator). A bot therefore takes the
/// throne at the floor, re-takes it one block later at 1.2x, which vests the first block's income,
/// and dumps everything: it leaves within five minutes having been paid from the pool.
contract VestingBypassTest is Test {
    uint160 internal constant INITIAL_SQRT_PRICE = 792281625142643375935439503360000;
    int24 internal constant LP_UPPER = 184200;
    int24 internal constant LP_LOWER = -887220;
    uint256 internal constant LP_SUPPLY = 900_000_000 ether;
    uint256 constant FLOOR = 0.01 ether;

    PoolManager manager;
    KingToken token;
    KingHook hook;
    KingRouter router;
    PoolModifyLiquidityTest lpRouter;
    PoolKey key;

    address funder = makeAddr("funder");
    address bot = makeAddr("bot");
    address botB = makeAddr("botB");

    receive() external payable {}

    function setUp() public {
        vm.warp(1_800_000_000);
        manager = new PoolManager(address(this));
        token = new KingToken();
        bytes memory creationCode =
            abi.encodePacked(type(KingHook).creationCode, abi.encode(IPoolManager(address(manager)), address(token)));
        (address predicted, bytes32 salt) =
            HookFlags.mine(address(this), HookFlags.KING_HOOK_FLAGS, creationCode, 500_000);
        hook = new KingHook{salt: salt}(IPoolManager(address(manager)), address(token));
        require(address(hook) == predicted, "hook address mismatch");
        router = hook.router();
        lpRouter = new PoolModifyLiquidityTest(IPoolManager(address(manager)));

        key = PoolKey({
            currency0: CurrencyLibrary.ADDRESS_ZERO,
            currency1: Currency.wrap(address(token)),
            fee: 3000,
            tickSpacing: 60,
            hooks: IHooks(address(hook))
        });
        manager.initialize(key, INITIAL_SQRT_PRICE);

        uint160 sqrtA = TickMath.getSqrtPriceAtTick(LP_LOWER);
        uint160 sqrtB = TickMath.getSqrtPriceAtTick(LP_UPPER);
        uint128 liquidity = uint128(FullMath.mulDiv(LP_SUPPLY, FixedPoint96.Q96, sqrtB - sqrtA));
        token.approve(address(lpRouter), type(uint256).max);
        lpRouter.modifyLiquidity(
            key,
            ModifyLiquidityParams({
                tickLower: LP_LOWER, tickUpper: LP_UPPER, liquidityDelta: int256(uint256(liquidity)), salt: 0
            }),
            ""
        );

        vm.deal(funder, 1_000 ether);
        vm.deal(bot, 10 ether);
        vm.deal(botB, 10 ether);

        // Fill the throne pool during the anti-snipe window (25% fee), then open the game.
        vm.prank(funder);
        router.buyExactIn{value: 200 ether}(0, false, block.timestamp); // 50 ETH fee, 46 ETH to the pool
        vm.warp(hook.gameStart());
        assertEq(hook.pool(), 46 ether);
        assertEq(hook.king(), address(0));
    }

    function buy(address who, uint256 eth) internal returns (uint256 out) {
        vm.prank(who);
        out = router.buyExactIn{value: eth}(0, false, block.timestamp);
    }

    function dump(address who) internal returns (uint256 ethOut) {
        uint256 bal = token.balanceOf(who);
        vm.startPrank(who);
        token.approve(address(router), bal);
        ethOut = router.sellExactIn(bal, 0, block.timestamp);
        vm.stopPrank();
    }

    /// @dev Same wallet: take at the floor, re-take one block later, dump one block after that.
    /// Total time on the throne: 4 seconds. The README promises such a bot "earns nothing".
    function test_selfRetakeWithinFiveMinutesMustNotVestTheIncome() public {
        uint256 start = block.timestamp;
        buy(bot, FLOOR); // reign 0 at the floor
        assertEq(hook.king(), bot);

        vm.warp(start + 2); // one Base block
        uint256 firstBlockIncome = hook.kingReignEarnings();
        assertGt(firstBlockIncome, 0);
        assertEq(hook.unclaimedIncome(bot), 0, "still vesting");

        buy(bot, hook.currentThronePrice()); // 0.012 ETH: reign 0 ends as `Dethroned`, reign 1 starts
        assertEq(hook.king(), bot);
        assertEq(hook.reignCount(), 2);

        vm.warp(start + 4); // one more block
        dump(bot); // reign 1 ends by the bot's own sell; only reign 1's one block is forfeited
        assertEq(hook.king(), address(0));
        assertLt(block.timestamp - start, 5 minutes);

        // Expected by the documented defence: a bot that left by itself inside five minutes has no
        // claimable income. Actual: the first block's income was vested by the self-takeover.
        assertEq(hook.pendingIncome(bot), 0, "self-exit inside the vesting window must forfeit all income");
        assertEq(hook.unclaimedIncome(bot), 0, "self-exit inside the vesting window must forfeit all income");
    }

    /// @dev Two wallets of one operator alternate: identical economics, no `buyer == king` to detect.
    function test_twoWalletRelayWithinFiveMinutesMustNotVestTheIncome() public {
        uint256 start = block.timestamp;
        buy(bot, FLOOR);
        vm.warp(start + 2);
        buy(botB, hook.currentThronePrice()); // bot's reign ends `Dethroned`; its income vests
        vm.warp(start + 4);
        dump(bot);
        dump(botB); // botB's reign ends by its own sell
        assertEq(hook.king(), address(0));
        assertLt(block.timestamp - start, 5 minutes);

        assertEq(hook.pendingIncome(bot) + hook.pendingIncome(botB), 0, "the relay must not extract vested income");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {PoolManager} from "v4-core/src/PoolManager.sol";
import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
import {IHooks} from "v4-core/src/interfaces/IHooks.sol";
import {PoolKey} from "v4-core/src/types/PoolKey.sol";
import {Currency, CurrencyLibrary} from "v4-core/src/types/Currency.sol";
import {ModifyLiquidityParams, SwapParams} from "v4-core/src/types/PoolOperation.sol";
import {TickMath} from "v4-core/src/libraries/TickMath.sol";
import {FullMath} from "v4-core/src/libraries/FullMath.sol";
import {FixedPoint96} from "v4-core/src/libraries/FixedPoint96.sol";
import {PoolModifyLiquidityTest} from "v4-core/src/test/PoolModifyLiquidityTest.sol";
import {PoolSwapTest} from "v4-core/src/test/PoolSwapTest.sol";

import {KingToken} from "src/KingToken.sol";
import {KingHook} from "src/KingHook.sol";
import {KingRouter} from "src/KingRouter.sol";
import {HookFlags} from "src/HookFlags.sol";

/// @notice Proof: a king who sells every KING he holds through a router other than `KingRouter`
/// keeps the throne and keeps being paid 2% of the pool per hour until somebody else swaps or calls
/// `dethrone()`, and he can `claim()` that income himself while holding nothing. The brief: "Any sell
/// by the king through the pool dethrones him at once" and dethrone "stops his income at that moment".
/// Fails on the current code; passes once income accrued after the balance fell short is not credited
/// (and `claim()` does not pay it).
contract ProofExKingKeepsEarning is Test {
    uint160 constant INITIAL_SQRT_PRICE = 792281625142643375935439503360000;

    PoolManager manager;
    KingToken token;
    KingHook hook;
    KingRouter router;
    PoolSwapTest otherRouter;
    PoolKey key;
    address alice = makeAddr("alice");
    address carol = makeAddr("carol");

    receive() external payable {}

    function setUp() public {
        vm.warp(1_800_000_000);
        manager = new PoolManager(address(this));
        token = new KingToken();
        bytes memory creationCode =
            abi.encodePacked(type(KingHook).creationCode, abi.encode(IPoolManager(address(manager)), address(token)));
        (, bytes32 salt) = HookFlags.mine(address(this), HookFlags.KING_HOOK_FLAGS, creationCode, 500_000);
        hook = new KingHook{salt: salt}(IPoolManager(address(manager)), address(token));
        router = hook.router();
        otherRouter = new PoolSwapTest(IPoolManager(address(manager)));
        key = PoolKey(CurrencyLibrary.ADDRESS_ZERO, Currency.wrap(address(token)), 3000, 60, IHooks(address(hook)));
        manager.initialize(key, INITIAL_SQRT_PRICE);

        PoolModifyLiquidityTest lp = new PoolModifyLiquidityTest(IPoolManager(address(manager)));
        uint160 sqrtA = TickMath.getSqrtPriceAtTick(-887220);
        uint160 sqrtB = TickMath.getSqrtPriceAtTick(184200);
        uint128 liquidity = uint128(FullMath.mulDiv(900_000_000 ether, FixedPoint96.Q96, sqrtB - sqrtA));
        token.approve(address(lp), type(uint256).max);
        lp.modifyLiquidity(key, ModifyLiquidityParams(-887220, 184200, int256(uint256(liquidity)), 0), "");

        vm.deal(alice, 10 ether);
        vm.deal(carol, 100 ether);
    }

    function test_incomeStopsWhenTheKingSellsEverythingThroughAnotherRouter() public {
        // Fund the throne pool with 2.3 ETH during the anti-snipe window, then open the game.
        vm.prank(carol);
        router.buyExactIn{value: 10 ether}(0, false, block.timestamp);
        vm.warp(hook.gameStart());

        // Alice takes the throne at the floor and dumps every KING through a third-party router.
        vm.prank(alice);
        uint256 required = router.buyExactIn{value: 0.01 ether}(0, true, block.timestamp);
        assertEq(hook.king(), alice);
        vm.startPrank(alice);
        token.approve(address(otherRouter), required);
        otherRouter.swap(
            key,
            SwapParams(false, -int256(required), TickMath.MAX_SQRT_PRICE - 1),
            PoolSwapTest.TestSettings(false, false),
            ""
        );
        vm.stopPrank();
        assertEq(token.balanceOf(alice), 0, "alice holds no KING at all");
        assertLt(token.balanceOf(alice), hook.requiredBalance());

        // Six quiet hours later she claims. Expected: nothing (her income stopped when she sold).
        // Actual: about 0.26 ETH, 11.4% of the pool, paid to a wallet that holds zero KING.
        vm.warp(block.timestamp + 6 hours);
        uint256 before = alice.balance;
        vm.prank(alice);
        try hook.claim() {} catch {}
        assertEq(alice.balance - before, 0, "an ex-king holding nothing was paid from the pool");
        assertEq(hook.unclaimedIncome(alice), 0, "income kept accruing after the sell");
    }
}