// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {ERC721} from "@openzeppelin/contracts/token/ERC721/ERC721.sol";
import {LaunchToken} from "src/LaunchToken.sol";
import {PawnShop} from "src/PawnShop.sol";
import {LendingPool} from "src/LendingPool.sol";
import {LockDiscount} from "src/LockDiscount.sol";
import {CollateralVault} from "src/CollateralVault.sol";
import {OracleAttestation} from "src/OracleAttestation.sol";

contract WETHMock is ERC20 {
    constructor() ERC20("Wrapped Ether", "WETH") {}

    function deposit() external payable {
        _mint(msg.sender, msg.value);
    }

    function withdraw(uint256 amount) external {
        _burn(msg.sender, amount);
        (bool ok,) = msg.sender.call{value: amount}("");
        require(ok);
    }
}

/// @dev A collection whose issuer can move a seat without the holder's consent (revocation, migration, burn).
contract SeatMock is ERC721 {
    constructor() ERC721("Seat", "SEAT") {}

    function mint(address to, uint256 id) external {
        _mint(to, id);
    }

    function revoke(uint256 id) external {
        _update(address(0), id, address(0));
    }
}

/// @notice Fails on the current code: once the collection removed the token from the vault, neither repay
/// nor auction settlement can run, so the principal stays in totalBorrowed and the borrower's PAWN
/// commitment stays locked for ever. Passes once release() tolerates a missing token (or the shop has
/// another settlement path) so the loan can still close.
contract SeizedCollateralTest is Test {
    uint256 internal constant KEY = 0xA11CE;
    bytes32 internal constant QUESTION = keccak256("floor question");
    address internal owner = makeAddr("owner");
    address internal alice = makeAddr("borrower");
    address internal bob = makeAddr("lender");
    LaunchToken internal token;
    WETHMock internal weth;
    SeatMock internal nft;
    PawnShop internal shop;
    LendingPool internal pool;
    LockDiscount internal discount;

    function setUp() public {
        vm.chainId(1);
        vm.warp(1_800_000_000);
        vm.deal(alice, 100 ether);
        vm.deal(bob, 100 ether);
        token = new LaunchToken();
        weth = new WETHMock();
        shop = new PawnShop(owner, address(token), address(weth), vm.addr(KEY));
        pool = shop.lendingPool();
        discount = LockDiscount(shop.discountModule());
        SeatMock template = new SeatMock();
        vm.etch(shop.IDENTITY_COLLECTION(), address(template).code);
        nft = SeatMock(shop.IDENTITY_COLLECTION());
        vm.prank(owner);
        shop.setQuestionHashOnce(address(nft), QUESTION);
        _floor(1 ether);
        vm.prank(owner);
        shop.setNewLoansPaused(false);
        vm.prank(bob);
        pool.depositETH{value: 5 ether}(bob);
    }

    function test_loanStillClosesAfterCollectionRemovedTheToken() public {
        // Borrower locks tier-1 PAWN and pawns seat 1 for the 30-day term: principal 0.4 ETH.
        token.transfer(alice, 1_000_000 ether);
        nft.mint(alice, 1);
        vm.startPrank(alice);
        token.approve(address(discount), 1_000_000 ether);
        discount.lock(1_000_000 ether);
        nft.approve(address(shop), 1);
        uint256 id = shop.pawn(address(nft), 1, 0);
        vm.stopPrank();
        assertEq(pool.totalBorrowed(), 0.4 ether);
        assertEq(discount.committed(alice), 1_000_000 ether);

        // The collection issuer revokes the seat held by the vault (no vault or shop call involved).
        nft.revoke(1);

        // Expected: the borrower can still repay, the receivable clears and the PAWN commitment is released.
        // Actual: PawnShop.repay -> CollateralVault.release -> transferFrom reverts (ERC721NonexistentToken),
        // so the loan can never leave Active/Auction, totalBorrowed never decreases and 1,000,000 PAWN stay locked.
        shop.repay{value: 0.4 ether}(id);
        assertEq(pool.totalBorrowed(), 0, "principal should be settled");
        assertEq(discount.committed(alice), 0, "commitment should be released");
    }

    function test_auctionSettlementAlsoBlocked() public {
        nft.mint(alice, 2);
        vm.startPrank(alice);
        nft.approve(address(shop), 2);
        uint256 id = shop.pawn(address(nft), 2, 1);
        vm.stopPrank();
        nft.revoke(2);
        vm.warp(shop.getLoan(id).due + 3 days + 1);
        shop.startAuction(id);
        vm.warp(block.timestamp + 10 days);
        // Expected: the auction can settle (nothing to deliver, so the pool books the gap) and the receivable clears.
        // Actual: buyAuction reverts inside CollateralVault.release, so totalBorrowed stays at 0.4 ETH for ever.
        vm.deal(address(this), 1 ether);
        shop.buyAuction{value: 0.5 ether}(id, address(this));
        assertEq(pool.totalBorrowed(), 0, "principal should be settled");
    }

    function _floor(uint256 price) internal {
        OracleAttestation.Attestation memory a;
        a.requestId = keccak256(abi.encode("req", price));
        a.chainId = 1;
        a.questionHash = QUESTION;
        a.answerType = 3;
        a.answer = abi.encode(price);
        a.figure = price;
        a.fromBlock = 100;
        a.toBlock = 200;
        a.blockHash = bytes32(uint256(7));
        a.panelJobId = keccak256("panel");
        a.panelSize = 5;
        a.quorum = 4;
        a.agreed = 4;
        a.issuedAt = uint64(block.timestamp);
        a.expiresAt = uint64(block.timestamp + 26 hours);
        (uint8 v, bytes32 r, bytes32 s) = vm.sign(KEY, shop.attestationDigest(a));
        shop.submitFloor(address(nft), a, abi.encodePacked(r, s, v));
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {LaunchToken} from "src/LaunchToken.sol";
import {PawnShop} from "src/PawnShop.sol";
import {LendingPool} from "src/LendingPool.sol";
import {OracleAttestation} from "src/OracleAttestation.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {ERC721} from "@openzeppelin/contracts/token/ERC721/ERC721.sol";

contract ProofWETH is ERC20 {
    constructor() ERC20("Wrapped Ether", "WETH") {}

    function deposit() external payable {
        _mint(msg.sender, msg.value);
    }

    function withdraw(uint256 amount) external {
        _burn(msg.sender, amount);
        (bool ok,) = msg.sender.call{value: amount}("");
        require(ok);
    }
}

contract ProofSeat is ERC721 {
    constructor() ERC721("Seat", "SEAT") {}

    function mint(address to, uint256 id) external {
        _mint(to, id);
    }
}

/// @notice A loss that is already certain when startAuction() runs is not recognised by
/// LendingPool.totalAssets(), so a lender who exits before buyAuction() leaves at face value and
/// the lenders who remain absorb the whole gap.
contract LossRecognitionProof is Test {
    uint256 internal constant KEY = 0xA11CE;
    bytes32 internal constant QUESTION = keccak256("floor question");
    address internal owner = makeAddr("owner");
    address internal borrower = makeAddr("borrower");
    address internal lenderA = makeAddr("lenderA");
    address internal lenderB = makeAddr("lenderB");
    address internal buyer = makeAddr("buyer");
    LaunchToken internal token;
    ProofWETH internal weth;
    ProofSeat internal nft;
    PawnShop internal shop;
    LendingPool internal pool;
    uint256 internal nonce;

    function setUp() public {
        vm.chainId(1);
        vm.warp(1_800_000_000);
        vm.deal(borrower, 10 ether);
        vm.deal(lenderA, 10 ether);
        vm.deal(lenderB, 10 ether);
        vm.deal(buyer, 10 ether);
        token = new LaunchToken();
        weth = new ProofWETH();
        shop = new PawnShop(owner, address(token), address(weth), vm.addr(KEY));
        pool = shop.lendingPool();
        ProofSeat template = new ProofSeat();
        vm.etch(shop.IDENTITY_COLLECTION(), address(template).code);
        nft = ProofSeat(shop.IDENTITY_COLLECTION());
        vm.prank(owner);
        shop.setQuestionHashOnce(address(nft), QUESTION);
        vm.prank(owner);
        shop.setNewLoansPaused(false);
    }

    function _floor(uint256 price) internal {
        OracleAttestation.Attestation memory a;
        a.requestId = keccak256(abi.encode("proof", ++nonce));
        a.chainId = 1;
        a.questionHash = QUESTION;
        a.answerType = 3;
        a.answer = abi.encode(price);
        a.panelSize = 5;
        a.quorum = 4;
        a.agreed = 4;
        a.issuedAt = uint64(vm.getBlockTimestamp());
        a.expiresAt = uint64(vm.getBlockTimestamp() + 26 hours);
        (uint8 v, bytes32 r, bytes32 s) = vm.sign(KEY, shop.attestationDigest(a));
        shop.submitFloor(address(nft), a, abi.encodePacked(r, s, v));
    }

    function test_certainAuctionLossIsSharedByAllLenders() public {
        // Two equal lenders.
        vm.prank(lenderA);
        pool.depositETH{value: 5 ether}(lenderA);
        vm.prank(lenderB);
        pool.depositETH{value: 5 ether}(lenderB);

        // Floor 10 ETH, 7-day term: principal 4 ETH, fee 0.04 ETH.
        _floor(10 ether);
        nft.mint(borrower, 1);
        vm.startPrank(borrower);
        nft.approve(address(shop), 1);
        uint256 id = shop.pawn(address(nft), 1, 1);
        vm.stopPrank();
        uint256 principal = shop.getLoan(id).principal;
        assertEq(principal, 4 ether);

        // Oracle floor falls to 2 ETH; borrower defaults.
        vm.warp(vm.getBlockTimestamp() + 1);
        _floor(2 ether);
        vm.warp(shop.getLoan(id).due + 3 days + 1);
        shop.startAuction(id);

        // From here the auction can never return more than the captured floor.
        uint256 maxRecovery = shop.getLoan(id).auctionFloor;
        assertEq(shop.auctionPrice(id), maxRecovery);
        assertLt(maxRecovery, principal);
        uint256 certainLoss = principal - maxRecovery - pool.shortfallReserve();

        // The pool must already reflect the loss that is certain at this point.
        uint256 cash = weth.balanceOf(address(pool));
        uint256 recognised = cash + totalBorrowedOf(pool) - pool.shortfallReserve() - pool.unvestedDonations();
        assertLe(
            pool.totalAssets(),
            recognised - certainLoss,
            "totalAssets still carries a receivable that can no longer be collected"
        );

        // Consequence of not recognising it: lender A exits at face value, lender B absorbs everything.
        uint256 exitA = pool.maxWithdraw(lenderA);
        vm.prank(lenderA);
        pool.withdraw(exitA, lenderA, lenderA);
        vm.prank(buyer);
        shop.buyAuction{value: maxRecovery}(id, buyer);
        uint256 leftB = pool.maxWithdraw(lenderB);
        // Equal deposits must bear the 2 ETH gap equally: each keeps at least 4 ETH.
        assertGe(leftB, 4 ether, "remaining lender bears the whole auction gap");
    }

    function totalBorrowedOf(LendingPool p) internal view returns (uint256) {
        return p.totalBorrowed();
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {LaunchToken} from "src/LaunchToken.sol";
import {PawnShop} from "src/PawnShop.sol";
import {LendingPool} from "src/LendingPool.sol";
import {OracleAttestation} from "src/OracleAttestation.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {ERC721} from "@openzeppelin/contracts/token/ERC721/ERC721.sol";

contract ProofWETH is ERC20 {
    constructor() ERC20("Wrapped Ether", "WETH") {}

    function deposit() external payable {
        _mint(msg.sender, msg.value);
    }

    function withdraw(uint256 amount) external {
        _burn(msg.sender, amount);
        (bool ok,) = msg.sender.call{value: amount}("");
        require(ok);
    }
}

contract ProofSeat is ERC721 {
    constructor() ERC721("Seat", "SEAT") {}

    function mint(address to, uint256 id) external {
        _mint(to, id);
    }
}

/// @notice A loss that is already certain when startAuction() runs is not recognised by
/// LendingPool.totalAssets(), so a lender who exits before buyAuction() leaves at face value and
/// the lenders who remain absorb the whole gap.
contract LossRecognitionProof is Test {
    uint256 internal constant KEY = 0xA11CE;
    bytes32 internal constant QUESTION = keccak256("floor question");
    address internal owner = makeAddr("owner");
    address internal borrower = makeAddr("borrower");
    address internal lenderA = makeAddr("lenderA");
    address internal lenderB = makeAddr("lenderB");
    address internal buyer = makeAddr("buyer");
    LaunchToken internal token;
    ProofWETH internal weth;
    ProofSeat internal nft;
    PawnShop internal shop;
    LendingPool internal pool;
    uint256 internal nonce;

    function setUp() public {
        vm.chainId(1);
        vm.warp(1_800_000_000);
        vm.deal(borrower, 10 ether);
        vm.deal(lenderA, 10 ether);
        vm.deal(lenderB, 10 ether);
        vm.deal(buyer, 10 ether);
        token = new LaunchToken();
        weth = new ProofWETH();
        shop = new PawnShop(owner, address(token), address(weth), vm.addr(KEY));
        pool = shop.lendingPool();
        ProofSeat template = new ProofSeat();
        vm.etch(shop.IDENTITY_COLLECTION(), address(template).code);
        nft = ProofSeat(shop.IDENTITY_COLLECTION());
        vm.prank(owner);
        shop.setQuestionHashOnce(address(nft), QUESTION);
        vm.prank(owner);
        shop.setNewLoansPaused(false);
    }

    function _floor(uint256 price) internal {
        OracleAttestation.Attestation memory a;
        a.requestId = keccak256(abi.encode("proof", ++nonce));
        a.chainId = 1;
        a.questionHash = QUESTION;
        a.answerType = 3;
        a.answer = abi.encode(price);
        a.panelSize = 5;
        a.quorum = 4;
        a.agreed = 4;
        a.issuedAt = uint64(vm.getBlockTimestamp());
        a.expiresAt = uint64(vm.getBlockTimestamp() + 26 hours);
        (uint8 v, bytes32 r, bytes32 s) = vm.sign(KEY, shop.attestationDigest(a));
        shop.submitFloor(address(nft), a, abi.encodePacked(r, s, v));
    }

    function test_certainAuctionLossIsSharedByAllLenders() public {
        // Two equal lenders.
        vm.prank(lenderA);
        pool.depositETH{value: 5 ether}(lenderA);
        vm.prank(lenderB);
        pool.depositETH{value: 5 ether}(lenderB);

        // Floor 10 ETH, 7-day term: principal 4 ETH, fee 0.04 ETH.
        _floor(10 ether);
        nft.mint(borrower, 1);
        vm.startPrank(borrower);
        nft.approve(address(shop), 1);
        uint256 id = shop.pawn(address(nft), 1, 1);
        vm.stopPrank();
        uint256 principal = shop.getLoan(id).principal;
        assertEq(principal, 4 ether);

        // Oracle floor falls to 2 ETH; borrower defaults.
        vm.warp(vm.getBlockTimestamp() + 1);
        _floor(2 ether);
        vm.warp(shop.getLoan(id).due + 3 days + 1);
        shop.startAuction(id);

        // From here the auction can never return more than the captured floor.
        uint256 maxRecovery = shop.getLoan(id).auctionFloor;
        assertEq(shop.auctionPrice(id), maxRecovery);
        assertLt(maxRecovery, principal);
        uint256 certainLoss = principal - maxRecovery - pool.shortfallReserve();

        // The pool must already reflect the loss that is certain at this point.
        uint256 cash = weth.balanceOf(address(pool));
        uint256 recognised = cash + totalBorrowedOf(pool) - pool.shortfallReserve() - pool.unvestedDonations();
        assertLe(
            pool.totalAssets(),
            recognised - certainLoss,
            "totalAssets still carries a receivable that can no longer be collected"
        );

        // Consequence of not recognising it: lender A exits at face value, lender B absorbs everything.
        uint256 exitA = pool.maxWithdraw(lenderA);
        vm.prank(lenderA);
        pool.withdraw(exitA, lenderA, lenderA);
        vm.prank(buyer);
        shop.buyAuction{value: maxRecovery}(id, buyer);
        uint256 leftB = pool.maxWithdraw(lenderB);
        // Equal deposits must bear the 2 ETH gap equally: each keeps at least 4 ETH.
        assertGe(leftB, 4 ether, "remaining lender bears the whole auction gap");
    }

    function totalBorrowedOf(LendingPool p) internal view returns (uint256) {
        return p.totalBorrowed();
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {ERC721} from "@openzeppelin/contracts/token/ERC721/ERC721.sol";
import {LaunchToken} from "src/LaunchToken.sol";
import {PawnShop} from "src/PawnShop.sol";
import {LendingPool} from "src/LendingPool.sol";
import {LockDiscount} from "src/LockDiscount.sol";
import {CollateralVault} from "src/CollateralVault.sol";
import {OracleAttestation} from "src/OracleAttestation.sol";

contract WETHMock is ERC20 {
    constructor() ERC20("Wrapped Ether", "WETH") {}

    function deposit() external payable {
        _mint(msg.sender, msg.value);
    }

    function withdraw(uint256 amount) external {
        _burn(msg.sender, amount);
        (bool ok,) = msg.sender.call{value: amount}("");
        require(ok);
    }
}

/// @dev A collection whose issuer can move a seat without the holder's consent (revocation, migration, burn).
contract SeatMock is ERC721 {
    constructor() ERC721("Seat", "SEAT") {}

    function mint(address to, uint256 id) external {
        _mint(to, id);
    }

    function revoke(uint256 id) external {
        _update(address(0), id, address(0));
    }
}

/// @notice Fails on the current code: once the collection removed the token from the vault, neither repay
/// nor auction settlement can run, so the principal stays in totalBorrowed and the borrower's PAWN
/// commitment stays locked for ever. Passes once release() tolerates a missing token (or the shop has
/// another settlement path) so the loan can still close.
contract SeizedCollateralTest is Test {
    uint256 internal constant KEY = 0xA11CE;
    bytes32 internal constant QUESTION = keccak256("floor question");
    address internal owner = makeAddr("owner");
    address internal alice = makeAddr("borrower");
    address internal bob = makeAddr("lender");
    LaunchToken internal token;
    WETHMock internal weth;
    SeatMock internal nft;
    PawnShop internal shop;
    LendingPool internal pool;
    LockDiscount internal discount;

    function setUp() public {
        vm.chainId(1);
        vm.warp(1_800_000_000);
        vm.deal(alice, 100 ether);
        vm.deal(bob, 100 ether);
        token = new LaunchToken();
        weth = new WETHMock();
        shop = new PawnShop(owner, address(token), address(weth), vm.addr(KEY));
        pool = shop.lendingPool();
        discount = LockDiscount(shop.discountModule());
        SeatMock template = new SeatMock();
        vm.etch(shop.IDENTITY_COLLECTION(), address(template).code);
        nft = SeatMock(shop.IDENTITY_COLLECTION());
        vm.prank(owner);
        shop.setQuestionHashOnce(address(nft), QUESTION);
        _floor(1 ether);
        vm.prank(owner);
        shop.setNewLoansPaused(false);
        vm.prank(bob);
        pool.depositETH{value: 5 ether}(bob);
    }

    function test_loanStillClosesAfterCollectionRemovedTheToken() public {
        // Borrower locks tier-1 PAWN and pawns seat 1 for the 30-day term: principal 0.4 ETH.
        token.transfer(alice, 1_000_000 ether);
        nft.mint(alice, 1);
        vm.startPrank(alice);
        token.approve(address(discount), 1_000_000 ether);
        discount.lock(1_000_000 ether);
        nft.approve(address(shop), 1);
        uint256 id = shop.pawn(address(nft), 1, 0);
        vm.stopPrank();
        assertEq(pool.totalBorrowed(), 0.4 ether);
        assertEq(discount.committed(alice), 1_000_000 ether);

        // The collection issuer revokes the seat held by the vault (no vault or shop call involved).
        nft.revoke(1);

        // Expected: the borrower can still repay, the receivable clears and the PAWN commitment is released.
        // Actual: PawnShop.repay -> CollateralVault.release -> transferFrom reverts (ERC721NonexistentToken),
        // so the loan can never leave Active/Auction, totalBorrowed never decreases and 1,000,000 PAWN stay locked.
        shop.repay{value: 0.4 ether}(id);
        assertEq(pool.totalBorrowed(), 0, "principal should be settled");
        assertEq(discount.committed(alice), 0, "commitment should be released");
    }

    function test_auctionSettlementAlsoBlocked() public {
        nft.mint(alice, 2);
        vm.startPrank(alice);
        nft.approve(address(shop), 2);
        uint256 id = shop.pawn(address(nft), 2, 1);
        vm.stopPrank();
        nft.revoke(2);
        vm.warp(shop.getLoan(id).due + 3 days + 1);
        shop.startAuction(id);
        vm.warp(block.timestamp + 10 days);
        // Expected: the auction can settle (nothing to deliver, so the pool books the gap) and the receivable clears.
        // Actual: buyAuction reverts inside CollateralVault.release, so totalBorrowed stays at 0.4 ETH for ever.
        vm.deal(address(this), 1 ether);
        shop.buyAuction{value: 0.5 ether}(id, address(this));
        assertEq(pool.totalBorrowed(), 0, "principal should be settled");
    }

    function _floor(uint256 price) internal {
        OracleAttestation.Attestation memory a;
        a.requestId = keccak256(abi.encode("req", price));
        a.chainId = 1;
        a.questionHash = QUESTION;
        a.answerType = 3;
        a.answer = abi.encode(price);
        a.figure = price;
        a.fromBlock = 100;
        a.toBlock = 200;
        a.blockHash = bytes32(uint256(7));
        a.panelJobId = keccak256("panel");
        a.panelSize = 5;
        a.quorum = 4;
        a.agreed = 4;
        a.issuedAt = uint64(block.timestamp);
        a.expiresAt = uint64(block.timestamp + 26 hours);
        (uint8 v, bytes32 r, bytes32 s) = vm.sign(KEY, shop.attestationDigest(a));
        shop.submitFloor(address(nft), a, abi.encodePacked(r, s, v));
    }
}