// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {PoolManager} from "@uniswap/v4-core/src/PoolManager.sol";
import {IPoolManager} from "@uniswap/v4-core/src/interfaces/IPoolManager.sol";
import {IHooks} from "@uniswap/v4-core/src/interfaces/IHooks.sol";
import {PoolKey} from "@uniswap/v4-core/src/types/PoolKey.sol";
import {PoolIdLibrary} from "@uniswap/v4-core/src/types/PoolId.sol";
import {Currency, CurrencyLibrary} from "@uniswap/v4-core/src/types/Currency.sol";
import {BalanceDelta} from "@uniswap/v4-core/src/types/BalanceDelta.sol";
import {SwapParams, ModifyLiquidityParams} from "@uniswap/v4-core/src/types/PoolOperation.sol";
import {TickMath} from "@uniswap/v4-core/src/libraries/TickMath.sol";
import {StateLibrary} from "@uniswap/v4-core/src/libraries/StateLibrary.sol";
import {PoolSwapTest} from "@uniswap/v4-core/src/test/PoolSwapTest.sol";
import {PoolModifyLiquidityTest} from "@uniswap/v4-core/src/test/PoolModifyLiquidityTest.sol";
import {LiquidityAmounts} from "@uniswap/v4-periphery/src/libraries/LiquidityAmounts.sol";
import {MockERC20} from "solmate/src/test/utils/mocks/MockERC20.sol";

import {LaunchToken} from "src/LaunchToken.sol";
import {AdamDistributor} from "src/AdamDistributor.sol";
import {AdamTreasury} from "src/AdamTreasury.sol";
import {AdamHook} from "src/AdamHook.sol";

/// @notice AdamHook charges exact-input buys (and exact-output sells) on the amount the trader *requested*,
/// in beforeSwap, before the pool has decided how much of it will actually fill. A trader who protects
/// themselves with a sqrtPriceLimit (or whose limit is reached because somebody moved the price first) pays
/// the full fee on ETH that never entered the pool. The afterSwap paths charge on the real delta, so the
/// four swap types are not charged the same way.
///
/// Fails on the current code: a 10 ETH exact-input buy capped at the price a 1 ETH buy reaches fills
/// 0.985 ETH and pays 0.15 ETH of fees (15.2%, not 1.5%). Passes once the hook either refuses the partial
/// fill or charges on what actually filled.
contract ProofHookPartialFillFeeTest is Test {
    using PoolIdLibrary for PoolKey;
    using StateLibrary for IPoolManager;

    uint160 constant FLAGS = 0x2000 | 0x80 | 0x40 | 0x8 | 0x4;
    int24 constant INITIAL_TICK = 177_240;
    int24 constant LOWER_TICK = 108_180;

    PoolManager poolManager;
    PoolSwapTest swapRouter;
    PoolModifyLiquidityTest lpRouter;
    LaunchToken adam;
    AdamDistributor distributor;
    AdamTreasury treasury;
    AdamHook hook;
    PoolKey key;

    receive() external payable {}

    function setUp() public {
        vm.warp(1_800_000_000);
        poolManager = new PoolManager(address(this));
        swapRouter = new PoolSwapTest(poolManager);
        lpRouter = new PoolModifyLiquidityTest(poolManager);
        adam = new LaunchToken();
        MockERC20 imd = new MockERC20("IMD", "IMD", 18);
        MockERC20 pnk = new MockERC20("PNKSTR", "PNKSTR", 18);
        distributor = new AdamDistributor(address(adam), address(imd), address(pnk), address(poolManager), address(0));
        treasury = new AdamTreasury(
            address(distributor),
            makeAddr("team"),
            address(poolManager),
            address(imd),
            10_000,
            200,
            address(0),
            0,
            address(pnk),
            0,
            60,
            address(0),
            1000,
            1 ether,
            300,
            600
        );

        bytes memory initCode = abi.encodePacked(
            type(AdamHook).creationCode, abi.encode(address(poolManager), address(adam), address(treasury), address(this))
        );
        bytes32 codeHash = keccak256(initCode);
        bytes32 salt;
        for (uint256 s;; ++s) {
            address predicted =
                address(uint160(uint256(keccak256(abi.encodePacked(bytes1(0xff), address(this), s, codeHash)))));
            if (uint160(predicted) & 0x3FFF == FLAGS) {
                salt = bytes32(s);
                break;
            }
        }
        hook = new AdamHook{salt: salt}(poolManager, address(adam), address(treasury), address(this));

        key = PoolKey({
            currency0: CurrencyLibrary.ADDRESS_ZERO,
            currency1: Currency.wrap(address(adam)),
            fee: 0,
            tickSpacing: 60,
            hooks: IHooks(address(hook))
        });
        uint160 sqrtP = TickMath.getSqrtPriceAtTick(INITIAL_TICK);
        poolManager.initialize(key, sqrtP);
        uint128 liquidity =
            LiquidityAmounts.getLiquidityForAmount1(TickMath.getSqrtPriceAtTick(LOWER_TICK), sqrtP, 1_000_000_000e18);
        adam.approve(address(lpRouter), type(uint256).max);
        lpRouter.modifyLiquidity(
            key,
            ModifyLiquidityParams({
                tickLower: LOWER_TICK, tickUpper: INITIAL_TICK, liquidityDelta: int256(uint256(liquidity)), salt: 0
            }),
            ""
        );
        adam.approve(address(swapRouter), type(uint256).max);
        vm.deal(address(this), 100 ether);
        // The hook takes its fee from the singleton before the buyer settles; mainnet's PoolManager holds tens
        // of thousands of ETH from other pools, so give this fresh one a float too.
        vm.deal(address(poolManager), 1_000 ether);
        // steady state: 1.5%
        vm.warp(block.timestamp + 30 minutes);
    }

    function _swap(bool zeroForOne, int256 amountSpecified, uint160 limit, uint256 value) internal returns (BalanceDelta) {
        return swapRouter.swap{value: value}(
            key,
            SwapParams({zeroForOne: zeroForOne, amountSpecified: amountSpecified, sqrtPriceLimitX96: limit}),
            PoolSwapTest.TestSettings({takeClaims: false, settleUsingBurn: false}),
            ""
        );
    }

    function test_exactInputBuyWithPriceLimitIsChargedOnlyOnWhatFilled() public {
        // Where does a 1 ETH buy leave the price?
        uint256 snap = vm.snapshotState();
        _swap(true, -1 ether, TickMath.MIN_SQRT_PRICE + 1, 1 ether);
        (uint160 sqrtAfterOneEth,,,) = IPoolManager(address(poolManager)).getSlot0(key.toId());
        vm.revertToState(snap);

        uint256 treasuryBefore = address(treasury).balance;
        uint256 poolBefore = address(poolManager).balance;

        // Ask for 10 ETH exact-in, but refuse to move the price further than a 1 ETH buy would.
        try this.swapExternal(true, -10 ether, sqrtAfterOneEth, 10 ether) returns (BalanceDelta) {
            uint256 filled = address(poolManager).balance - poolBefore; // ETH the pool actually took
            uint256 fee = address(treasury).balance - treasuryBefore;
            assertLt(filled, 2 ether, "test setup: the limit must cut the fill well below 10 ETH");
            assertLe(fee, (filled * 150) / 10_000 + 1, "fee charged on ETH that never entered the pool");
        } catch {
            // A hook that refuses partial fills on the beforeSwap-fee paths is an acceptable fix.
        }
    }

    function swapExternal(bool zeroForOne, int256 amountSpecified, uint160 limit, uint256 value)
        external
        returns (BalanceDelta)
    {
        return _swap(zeroForOne, amountSpecified, limit, value);
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {MockERC20} from "solmate/src/test/utils/mocks/MockERC20.sol";

import {LaunchToken} from "src/LaunchToken.sol";
import {AdamDistributor} from "src/AdamDistributor.sol";

/// @notice Rewards that arrive while nobody is staked are parked in `unallocated` and handed in full to
/// whoever is staked at the next `notifyReward`. `notifyReward` is callable by anyone with 1 wei of a reward
/// token, so a holder of 1 wei ADAM can stake, trigger the fold, and exit in one transaction, taking every
/// reward earned before the first stake (at launch: the whole anti-snipe window's fees).
///
/// Fails on the current code: the attacker receives 100% of 100e18 IMD for 1 wei ADAM + 1 wei IMD.
/// Passes once pre-stake rewards can no longer be claimed atomically by a dust staker.
contract ProofDistributorUnallocatedCaptureTest is Test {
    LaunchToken adam;
    MockERC20 imd;
    MockERC20 pnkstr;
    AdamDistributor dist;
    address attacker = makeAddr("attacker");

    function setUp() public {
        adam = new LaunchToken();
        imd = new MockERC20("IMD", "IMD", 18);
        pnkstr = new MockERC20("PNKSTR", "PNKSTR", 18);
        dist = new AdamDistributor(address(adam), address(imd), address(pnkstr), makeAddr("poolManager"), address(0));
        imd.mint(address(this), 1e30);
        imd.approve(address(dist), type(uint256).max);
    }

    function test_dustStakerCannotTakePreStakeRewardsAtomically() public {
        // Treasury pushes launch-window rewards while nobody has staked yet.
        dist.notifyReward(address(imd), 100e18);
        assertEq(dist.unallocated(address(imd)), 100e18);
        assertEq(dist.totalStaked(), 0);

        // Attacker holds 1 wei ADAM and 1 wei IMD.
        adam.transfer(attacker, 1);
        imd.mint(attacker, 1);

        vm.startPrank(attacker);
        adam.approve(address(dist), 1);
        imd.approve(address(dist), 1);
        dist.stake(1);
        // Trigger the fold of `unallocated` while being the only staker.
        try dist.notifyReward(address(imd), 1) {} catch {}
        dist.exit();
        vm.stopPrank();

        // The attacker, holding one wei of a 1e27 supply, must not walk away with the pre-stake rewards.
        assertLe(imd.balanceOf(attacker), 1e18, "dust staker captured the pre-stake rewards");
        assertEq(adam.balanceOf(attacker), 1, "stake returned");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";

import {LaunchToken} from "src/LaunchToken.sol";
import {AdamDistributor} from "src/AdamDistributor.sol";

/// @dev Minimal mintable ERC-20 standing in for IMD / PNKSTR (no external dependencies).
contract RewardToken {
    string public name;
    string public symbol;
    uint8 public constant decimals = 18;
    uint256 public totalSupply;
    mapping(address => uint256) public balanceOf;
    mapping(address => mapping(address => uint256)) public allowance;

    constructor(string memory n) {
        name = n;
        symbol = n;
    }

    function mint(address to, uint256 amount) external {
        totalSupply += amount;
        balanceOf[to] += amount;
    }

    function approve(address spender, uint256 amount) external returns (bool) {
        allowance[msg.sender][spender] = amount;
        return true;
    }

    function transfer(address to, uint256 amount) external returns (bool) {
        balanceOf[msg.sender] -= amount;
        balanceOf[to] += amount;
        return true;
    }

    function transferFrom(address from, address to, uint256 amount) external returns (bool) {
        uint256 a = allowance[from][msg.sender];
        if (a != type(uint256).max) allowance[from][msg.sender] = a - amount;
        balanceOf[from] -= amount;
        balanceOf[to] += amount;
        return true;
    }
}

/// @notice Rewards that arrive while nobody is staked are parked in `unallocated` and then handed, in full,
/// to whoever is staked at the moment of the next `notifyReward`. Both `notifyReward` and `stake` are
/// permissionless, so a 1 wei staker can take the whole launch-period pot with a 1 wei notify.
///
/// Fails on the current code: the attacker ends up with the entire 1,000 IMD pot although they hold one wei
/// of a 1e27 supply. Passes once the unallocated pot is no longer released to an arbitrarily small stake
/// (e.g. only folded in once a minimum total stake exists, or streamed instead of dumped).
contract UnallocatedCaptureTest is Test {
    LaunchToken internal adam;
    RewardToken internal imd;
    RewardToken internal pnkstr;
    AdamDistributor internal dist;

    address internal treasury = makeAddr("treasury");
    address internal attacker = makeAddr("attacker");
    address internal alice = makeAddr("alice");

    uint256 internal constant POT = 1_000e18;

    function setUp() public {
        adam = new LaunchToken();
        imd = new RewardToken("IMD");
        pnkstr = new RewardToken("PNKSTR");
        dist = new AdamDistributor(address(adam), address(imd), address(pnkstr), makeAddr("poolManager"), address(0));

        // Launch period: the treasury's process() has already bought POT of IMD and pushed it while nobody
        // was staked (this is exactly what the project's own test_processSplitsTenNinetyAndBuysBothTokens shows).
        imd.mint(treasury, POT);
        vm.startPrank(treasury);
        imd.approve(address(dist), POT);
        dist.notifyReward(address(imd), POT);
        vm.stopPrank();
        assertEq(dist.unallocated(address(imd)), POT);

        // Alice is a real holder with 1% of the supply; the attacker holds one wei of ADAM and one wei of IMD.
        adam.transfer(alice, 10_000_000e18);
        adam.transfer(attacker, 1);
        imd.mint(attacker, 1);
    }

    function test_oneWeiStakerCannotTakeTheWholeUnallocatedPot() public {
        // Attacker: stake 1 wei, then notify 1 wei to trigger the fold-in while they are the only staker.
        vm.startPrank(attacker);
        adam.approve(address(dist), 1);
        dist.stake(1);
        imd.approve(address(dist), 1);
        dist.notifyReward(address(imd), 1);
        vm.stopPrank();

        // Alice stakes right after, in the same block.
        vm.startPrank(alice);
        adam.approve(address(dist), 10_000_000e18);
        dist.stake(10_000_000e18);
        vm.stopPrank();

        uint256 attackerEarned = dist.earned(attacker, address(imd));
        uint256 aliceEarned = dist.earned(alice, address(imd));

        // Expected: a 1 wei stake out of 1e25 staked is entitled to (essentially) nothing of the pot.
        // Actual on current code: attackerEarned == POT + 1, aliceEarned == 0.
        assertLt(attackerEarned, POT / 100, "1 wei staker captured the launch-period pot");
        assertGt(aliceEarned + dist.unallocated(address(imd)), POT / 2, "pot is gone for the real holders");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";

import {LaunchToken} from "src/LaunchToken.sol";
import {AdamDistributor} from "src/AdamDistributor.sol";

contract RewardToken is ERC20 {
    constructor() ERC20("R", "R") {
        _mint(msg.sender, 1e30);
    }
}

/// @notice Rewards that arrive while nobody is staked are parked in `unallocated` and folded into the next
/// distribution. `notifyReward` is permissionless and accepts 1 wei, so whoever stakes first can trigger that
/// fold-in alone, with a 1 wei stake, and claim the whole backlog. Expected: a 1 wei staker cannot take a
/// backlog it did not earn. Actual: it takes all of it.
contract UnallocatedSweepTest is Test {
    LaunchToken internal adam;
    RewardToken internal imd;
    RewardToken internal pnkstr;
    AdamDistributor internal dist;

    address internal attacker = makeAddr("attacker");
    address internal holder = makeAddr("holder");
    address internal poolManager = makeAddr("poolManager");

    function setUp() public {
        adam = new LaunchToken();
        imd = new RewardToken();
        pnkstr = new RewardToken();
        dist = new AdamDistributor(address(adam), address(imd), address(pnkstr), poolManager, address(0));

        // An honest holder bought 10% of the supply at launch; the attacker holds a single wei of ADAM
        // and a single wei of each reward token.
        adam.transfer(holder, 100_000_000e18);
        adam.transfer(attacker, 1);
        imd.transfer(attacker, 1);
        pnkstr.transfer(attacker, 1);
    }

    function test_dustStakerSweepsRewardsAccruedWhileNobodyWasStaked() public {
        // Launch fees were processed before anyone staked: 1,000 IMD and 100,000 PNKSTR are parked.
        imd.approve(address(dist), type(uint256).max);
        pnkstr.approve(address(dist), type(uint256).max);
        dist.notifyReward(address(imd), 1_000e18);
        dist.notifyReward(address(pnkstr), 100_000e18);
        assertEq(dist.unallocated(address(imd)), 1_000e18);
        assertEq(dist.unallocated(address(pnkstr)), 100_000e18);

        // Attacker: stake 1 wei, notify 1 wei of each token (low-level so a permission fix does not revert the
        // test), then exit. No capital, three transactions.
        vm.startPrank(attacker);
        adam.approve(address(dist), 1);
        dist.stake(1);
        imd.approve(address(dist), 1);
        pnkstr.approve(address(dist), 1);
        (bool ok1,) = address(dist).call(abi.encodeCall(AdamDistributor.notifyReward, (address(imd), 1)));
        (bool ok2,) = address(dist).call(abi.encodeCall(AdamDistributor.notifyReward, (address(pnkstr), 1)));
        ok1;
        ok2;
        dist.exit();
        vm.stopPrank();

        // The honest holder stakes right after.
        vm.startPrank(holder);
        adam.approve(address(dist), type(uint256).max);
        dist.stake(100_000_000e18);
        vm.stopPrank();

        // A 1 wei staker must not walk away with a 1,000 IMD / 100,000 PNKSTR backlog.
        assertLt(imd.balanceOf(attacker), 1e18, "dust staker took the IMD backlog");
        assertLt(pnkstr.balanceOf(attacker), 1e18, "dust staker took the PNKSTR backlog");
        // ...and the backlog is still there for real stakers (parked or already credited to the holder).
        assertGe(
            dist.unallocated(address(imd)) + dist.earned(holder, address(imd)), 1_000e18 - 1e18, "IMD backlog lost"
        );
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {PoolManager} from "@uniswap/v4-core/src/PoolManager.sol";
import {IPoolManager} from "@uniswap/v4-core/src/interfaces/IPoolManager.sol";
import {IHooks} from "@uniswap/v4-core/src/interfaces/IHooks.sol";
import {PoolKey} from "@uniswap/v4-core/src/types/PoolKey.sol";
import {Currency, CurrencyLibrary} from "@uniswap/v4-core/src/types/Currency.sol";
import {BalanceDelta} from "@uniswap/v4-core/src/types/BalanceDelta.sol";
import {SwapParams, ModifyLiquidityParams} from "@uniswap/v4-core/src/types/PoolOperation.sol";
import {TickMath} from "@uniswap/v4-core/src/libraries/TickMath.sol";
import {PoolSwapTest} from "@uniswap/v4-core/src/test/PoolSwapTest.sol";
import {PoolModifyLiquidityTest} from "@uniswap/v4-core/src/test/PoolModifyLiquidityTest.sol";
import {LiquidityAmounts} from "@uniswap/v4-periphery/src/libraries/LiquidityAmounts.sol";

import {LaunchToken} from "src/LaunchToken.sol";
import {AdamHook} from "src/AdamHook.sol";
import {HookMiner} from "script/utils/HookMiner.sol";

/// @dev Treasury stand-in: only needs to receive the ETH fee.
contract FeeSink {
    receive() external payable {}
}

/// @notice AdamHook charges `feeBps` of the ETH the *user* pays on exact-input buys, but `feeBps` of the ETH the
/// *pool* charges on exact-output buys. Buying the same ADAM with an exact-output swap therefore costs less fee:
/// during anti-snipe (20%) the effective rate is 16.67% of the ETH paid; in steady state 1.478% instead of 1.5%.
/// The fee rate must be the same fraction of the ETH the buyer pays regardless of the swap type.
contract ProofFeeBasisTest is Test {
    uint256 internal constant BPS = 10_000;

    PoolManager internal poolManager;
    PoolSwapTest internal swapRouter;
    PoolModifyLiquidityTest internal lpRouter;
    LaunchToken internal adam;
    FeeSink internal treasury;
    AdamHook internal hook;
    PoolKey internal adamKey;
    address internal hookOwner = makeAddr("hookOwner");

    receive() external payable {}

    function setUp() public {
        vm.warp(1_800_000_000);
        poolManager = new PoolManager(address(this));
        swapRouter = new PoolSwapTest(poolManager);
        lpRouter = new PoolModifyLiquidityTest(poolManager);
        vm.deal(address(this), 1_000 ether);
        // The hook takes its ETH fee before the buyer settles; the mainnet PoolManager holds other pools' ETH.
        vm.deal(address(poolManager), 1_000 ether);

        adam = new LaunchToken();
        treasury = new FeeSink();
        uint160 flags = uint160(0x2000 | 0x80 | 0x40 | 0x8 | 0x4);
        bytes memory args = abi.encode(address(poolManager), address(adam), address(treasury), hookOwner);
        (address expected, bytes32 salt) = HookMiner.find(address(this), flags, type(AdamHook).creationCode, args);
        hook = new AdamHook{salt: salt}(poolManager, address(adam), address(treasury), hookOwner);
        require(address(hook) == expected, "hook address");

        adamKey = PoolKey({
            currency0: CurrencyLibrary.ADDRESS_ZERO,
            currency1: Currency.wrap(address(adam)),
            fee: 0,
            tickSpacing: 60,
            hooks: IHooks(address(hook))
        });
        int24 initialTick = 177_240;
        int24 lowerTick = 108_180;
        uint160 sqrtP = TickMath.getSqrtPriceAtTick(initialTick);
        vm.prank(hookOwner);
        poolManager.initialize(adamKey, sqrtP);
        uint128 liquidity =
            LiquidityAmounts.getLiquidityForAmount1(TickMath.getSqrtPriceAtTick(lowerTick), sqrtP, 1_000_000_000e18);
        adam.approve(address(lpRouter), type(uint256).max);
        lpRouter.modifyLiquidity(
            adamKey,
            ModifyLiquidityParams({
                tickLower: lowerTick, tickUpper: initialTick, liquidityDelta: int256(uint256(liquidity)), salt: 0
            }),
            ""
        );
        adam.approve(address(swapRouter), type(uint256).max);
    }

    function _swap(bool zeroForOne, int256 amountSpecified, uint256 value) internal returns (BalanceDelta) {
        return swapRouter.swap{value: value}(
            adamKey,
            SwapParams({
                zeroForOne: zeroForOne,
                amountSpecified: amountSpecified,
                sqrtPriceLimitX96: zeroForOne ? TickMath.MIN_SQRT_PRICE + 1 : TickMath.MAX_SQRT_PRICE - 1
            }),
            PoolSwapTest.TestSettings({takeClaims: false, settleUsingBurn: false}),
            ""
        );
    }

    /// @dev At launch (fee 20%): an exact-input buy of 1 ETH pays 0.2 ETH fee and receives X ADAM.
    /// An exact-output buy of the same X ADAM must also pay 20% of the ETH it spends, i.e. cost the same 1 ETH.
    function test_exactOutputBuyPaysSameFeeRateAsExactInput() public {
        assertEq(hook.currentFeeBps(), 2000, "anti-snipe fee at launch");

        uint256 snap = vm.snapshotState();
        uint256 tBefore = address(treasury).balance;
        BalanceDelta dIn = _swap(true, -int256(1 ether), 1 ether);
        uint256 adamOut = uint256(uint128(dIn.amount1()));
        uint256 feeIn = address(treasury).balance - tBefore;
        assertEq(feeIn, 0.2 ether, "exact-input: 20% of the ETH paid");
        vm.revertToState(snap);

        tBefore = address(treasury).balance;
        BalanceDelta dOut = _swap(true, int256(adamOut), 2 ether);
        uint256 ethPaid = uint256(uint128(-dOut.amount0()));
        uint256 feeOut = address(treasury).balance - tBefore;
        assertEq(uint256(uint128(dOut.amount1())), adamOut, "same ADAM received");

        // Current code: pool charges 0.8 ETH, fee = 20% * 0.8 = 0.16, buyer pays 0.96 ETH -> 16.67% effective.
        // Expected: fee is 20% of what the buyer pays -> 0.2 ETH fee, 1 ETH paid (tolerance for 1-wei rounding).
        assertApproxEqAbs((feeOut * BPS) / ethPaid, 2000, 1, "exact-output effective fee rate must be 20%");
        assertApproxEqAbs(ethPaid, 1 ether, 1e6, "same ADAM must cost the same ETH either way");
    }

    /// @dev Same asymmetry on sells: exact-input sell pays fee on the gross ETH the pool pays; exact-output sell
    /// pays fee on the net ETH the seller asked for, so it gives up less ADAM for the same net ETH.
    function test_exactOutputSellPaysSameFeeRateAsExactInput() public {
        vm.warp(uint256(hook.launchTimestamp()) + hook.DECAY_DURATION());
        _swap(true, -int256(5 ether), 5 ether);
        uint256 adamBal = adam.balanceOf(address(this));

        uint256 snap = vm.snapshotState();
        uint256 tBefore = address(treasury).balance;
        BalanceDelta dIn = _swap(false, -int256(adamBal / 2), 0);
        uint256 ethNet = uint256(uint128(dIn.amount0()));
        uint256 feeIn = address(treasury).balance - tBefore;
        assertEq(feeIn, ((ethNet + feeIn) * 150) / BPS, "exact-input sell: 1.5% of gross ETH out");
        vm.revertToState(snap);

        tBefore = address(treasury).balance;
        BalanceDelta dOut = _swap(false, int256(ethNet), 0);
        uint256 adamSold = uint256(uint128(-dOut.amount1()));
        uint256 feeOut = address(treasury).balance - tBefore;
        // Expected: fee is 1.5% of the gross ETH the pool pays (net + fee), as on the exact-input path.
        assertApproxEqAbs(feeOut, ((ethNet + feeOut) * 150) / BPS, 1, "exact-output sell fee must be 1.5% of gross");
        assertApproxEqRel(adamSold, adamBal / 2, 1e12, "same net ETH must cost the same ADAM either way");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {PoolManager} from "@uniswap/v4-core/src/PoolManager.sol";
import {IHooks} from "@uniswap/v4-core/src/interfaces/IHooks.sol";
import {PoolKey} from "@uniswap/v4-core/src/types/PoolKey.sol";
import {Currency, CurrencyLibrary} from "@uniswap/v4-core/src/types/Currency.sol";
import {BalanceDelta} from "@uniswap/v4-core/src/types/BalanceDelta.sol";
import {SwapParams, ModifyLiquidityParams} from "@uniswap/v4-core/src/types/PoolOperation.sol";
import {TickMath} from "@uniswap/v4-core/src/libraries/TickMath.sol";
import {PoolSwapTest} from "@uniswap/v4-core/src/test/PoolSwapTest.sol";
import {PoolModifyLiquidityTest} from "@uniswap/v4-core/src/test/PoolModifyLiquidityTest.sol";
import {LiquidityAmounts} from "@uniswap/v4-periphery/src/libraries/LiquidityAmounts.sol";
import {MockERC20} from "solmate/src/test/utils/mocks/MockERC20.sol";

import {LaunchToken} from "src/LaunchToken.sol";
import {AdamDistributor} from "src/AdamDistributor.sol";
import {AdamTreasury} from "src/AdamTreasury.sol";

/// @notice `quoteMinOut` reads the pool's spot price inside the same transaction as the swap, so the slippage
/// floor moves with whatever price an attacker set one call earlier. `process()` is permissionless, so the
/// attacker bundles: pump IMD -> process() -> dump. The treasury fills >35% below the pre-pump floor and the
/// "slippage cap" never fires. A fixed treasury must refuse (keep the ETH pending) or fill within `slippageBps`
/// of the price that prevailed before the attacker's front-run.
contract ProofSlippageTest is Test {
    uint256 internal constant BPS = 10_000;
    uint32 internal constant COOLDOWN = 10 minutes;

    PoolManager internal poolManager;
    PoolSwapTest internal swapRouter;
    PoolModifyLiquidityTest internal lpRouter;
    MockERC20 internal imd;
    MockERC20 internal pnkstr;
    PoolKey internal imdKey;
    PoolKey internal pnkstrKey;
    LaunchToken internal adam;
    AdamDistributor internal distributor;
    AdamTreasury internal treasury;
    address internal teamWallet = makeAddr("teamWallet");

    receive() external payable {}

    function setUp() public {
        vm.warp(1_800_000_000);
        poolManager = new PoolManager(address(this));
        swapRouter = new PoolSwapTest(poolManager);
        lpRouter = new PoolModifyLiquidityTest(poolManager);
        vm.deal(address(this), 10_000 ether);

        imd = new MockERC20("IMD", "IMD", 18);
        pnkstr = new MockERC20("PNKSTR", "PNKSTR", 18);
        imd.mint(address(this), 1e36);
        pnkstr.mint(address(this), 1e36);
        imd.approve(address(lpRouter), type(uint256).max);
        pnkstr.approve(address(lpRouter), type(uint256).max);
        imd.approve(address(swapRouter), type(uint256).max);

        imdKey = PoolKey({
            currency0: CurrencyLibrary.ADDRESS_ZERO,
            currency1: Currency.wrap(address(imd)),
            fee: 10_000,
            tickSpacing: 200,
            hooks: IHooks(address(0))
        });
        pnkstrKey = PoolKey({
            currency0: CurrencyLibrary.ADDRESS_ZERO,
            currency1: Currency.wrap(address(pnkstr)),
            fee: 0,
            tickSpacing: 60,
            hooks: IHooks(address(0))
        });
        _initAndSeed(imdKey, 54_000, -887_200, 887_200, 50 ether);
        _initAndSeed(pnkstrKey, 120_420, -887_220, 887_220, 200 ether);

        adam = new LaunchToken();
        distributor = new AdamDistributor(address(adam), address(imd), address(pnkstr), address(poolManager), address(0));
        treasury = new AdamTreasury(
            address(distributor),
            teamWallet,
            address(poolManager),
            address(imd),
            10_000,
            200,
            address(0),
            0,
            address(pnkstr),
            0,
            60,
            address(0),
            0,
            1 ether,
            300,
            COOLDOWN
        );
    }

    function _initAndSeed(PoolKey memory key, int24 tick, int24 lower, int24 upper, uint256 ethAmount) internal {
        uint160 sqrtP = TickMath.getSqrtPriceAtTick(tick);
        poolManager.initialize(key, sqrtP);
        uint128 liquidity = LiquidityAmounts.getLiquidityForAmounts(
            sqrtP, TickMath.getSqrtPriceAtTick(lower), TickMath.getSqrtPriceAtTick(upper), ethAmount, type(uint128).max
        );
        lpRouter.modifyLiquidity{value: ethAmount}(
            key,
            ModifyLiquidityParams({
                tickLower: lower, tickUpper: upper, liquidityDelta: int256(uint256(liquidity)), salt: 0
            }),
            ""
        );
    }

    function _swap(PoolKey memory key, bool zeroForOne, int256 amountSpecified, uint256 value)
        internal
        returns (BalanceDelta)
    {
        return swapRouter.swap{value: value}(
            key,
            SwapParams({
                zeroForOne: zeroForOne,
                amountSpecified: amountSpecified,
                sqrtPriceLimitX96: zeroForOne ? TickMath.MIN_SQRT_PRICE + 1 : TickMath.MAX_SQRT_PRICE - 1
            }),
            PoolSwapTest.TestSettings({takeClaims: false, settleUsingBurn: false}),
            ""
        );
    }

    function _fund(uint256 amount) internal {
        (bool ok,) = payable(address(treasury)).call{value: amount}("");
        require(ok);
    }

    function test_sandwichedProcessMustNotFillBelowPrePumpFloor() public {
        // An honest process() first, so any price reference a fixed treasury keeps is established at the fair price.
        _fund(1 ether);
        treasury.process();
        uint256 imdBefore = imd.balanceOf(address(distributor));
        vm.warp(block.timestamp + COOLDOWN);

        // 2.3 ETH of fees arrive: cap 2.222 ETH -> exactly 1 ETH per leg.
        _fund(2.3 ether);
        uint256 floorFair = treasury.quoteMinOut(0, 1 ether);

        // Attacker, in one bundle: pump IMD with 20 ETH (pool depth 50 ETH), call process(), dump.
        uint256 attackerEthBefore = address(this).balance;
        uint256 attackerImdBefore = imd.balanceOf(address(this));
        _swap(imdKey, true, -int256(20 ether), 20 ether);
        treasury.process();
        uint256 bought = imd.balanceOf(address(distributor)) - imdBefore;
        _swap(imdKey, false, -int256(imd.balanceOf(address(this)) - attackerImdBefore), 0);
        int256 attackerProfit = int256(address(this).balance) - int256(attackerEthBefore);

        emit log_named_uint("pre-pump minOut for 1 ETH", floorFair);
        emit log_named_uint("IMD actually bought for 1 ETH", bought);
        emit log_named_int("attacker net ETH", attackerProfit);

        // Expected (fixed): either the leg is refused and its ETH stays pending, or it fills within 3% of the
        // pre-pump price. Actual (current code): the leg fills ~40% below that floor and the attacker nets ~0.14 ETH.
        bool refused = treasury.leg(0).pending == 1 ether && bought == 0;
        bool filledFairly = bought >= floorFair;
        assertTrue(refused || filledFairly, "slippage floor followed the attacker's spot price");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {PoolManager} from "@uniswap/v4-core/src/PoolManager.sol";
import {IPoolManager} from "@uniswap/v4-core/src/interfaces/IPoolManager.sol";
import {IHooks} from "@uniswap/v4-core/src/interfaces/IHooks.sol";
import {PoolKey} from "@uniswap/v4-core/src/types/PoolKey.sol";
import {Currency, CurrencyLibrary} from "@uniswap/v4-core/src/types/Currency.sol";
import {SwapParams, ModifyLiquidityParams} from "@uniswap/v4-core/src/types/PoolOperation.sol";
import {TickMath} from "@uniswap/v4-core/src/libraries/TickMath.sol";
import {PoolSwapTest} from "@uniswap/v4-core/src/test/PoolSwapTest.sol";
import {PoolModifyLiquidityTest} from "@uniswap/v4-core/src/test/PoolModifyLiquidityTest.sol";
import {LiquidityAmounts} from "@uniswap/v4-periphery/src/libraries/LiquidityAmounts.sol";
import {MockERC20} from "solmate/src/test/utils/mocks/MockERC20.sol";

import {LaunchToken} from "src/LaunchToken.sol";
import {AdamDistributor} from "src/AdamDistributor.sol";
import {AdamTreasury} from "src/AdamTreasury.sol";

/// @notice Proof for: AdamTreasury.quoteMinOut anchors the slippage floor to the pool's *current* spot price,
/// which the caller of process() can move in the same transaction. The configured 3% tolerance therefore
/// bounds nothing: after a 100 ETH pump the treasury accepts ~44% of the pre-pump output.
///
/// Expected (a floor that is independent of same-block price manipulation, or a refusal): either the IMD
/// leg refuses to buy, or the distributor receives at least the floor quoted *before* the manipulation.
/// Actual: the leg buys at the manipulated price and the distributor receives far less than that floor.
contract ProofSpotAnchoredMinOut is Test {
    PoolManager internal pm;
    PoolSwapTest internal router;
    PoolModifyLiquidityTest internal lp;
    MockERC20 internal imd;
    MockERC20 internal pnkstr;
    PoolKey internal imdKey;
    PoolKey internal pnkKey;
    AdamDistributor internal dist;
    AdamTreasury internal treasury;

    receive() external payable {}

    function setUp() public {
        pm = new PoolManager(address(this));
        router = new PoolSwapTest(pm);
        lp = new PoolModifyLiquidityTest(pm);
        imd = new MockERC20("IMD", "IMD", 18);
        pnkstr = new MockERC20("PNKSTR", "PNKSTR", 18);
        imd.mint(address(this), 1e36);
        pnkstr.mint(address(this), 1e36);
        imd.approve(address(lp), type(uint256).max);
        pnkstr.approve(address(lp), type(uint256).max);
        imd.approve(address(router), type(uint256).max);
        vm.deal(address(this), 10_000 ether);

        imdKey = PoolKey(CurrencyLibrary.ADDRESS_ZERO, Currency.wrap(address(imd)), 10_000, 200, IHooks(address(0)));
        pnkKey = PoolKey(CurrencyLibrary.ADDRESS_ZERO, Currency.wrap(address(pnkstr)), 0, 60, IHooks(address(0)));
        _initAndSeed(imdKey, 54_000, -887_200, 887_200, 200 ether);
        _initAndSeed(pnkKey, 120_420, -887_220, 887_220, 200 ether);

        LaunchToken adam = new LaunchToken();
        dist = new AdamDistributor(address(adam), address(imd), address(pnkstr), address(pm), address(0));
        treasury = new AdamTreasury(
            address(dist),
            makeAddr("team"),
            address(pm),
            address(imd),
            10_000,
            200,
            address(0),
            0,
            address(pnkstr),
            0,
            60,
            address(0),
            0,
            1 ether, // maxEthPerBuy
            300, // slippageBps: 3%
            0 // cooldown
        );
    }

    function _initAndSeed(PoolKey memory key, int24 tick, int24 lower, int24 upper, uint256 ethAmount) internal {
        uint160 sqrtP = TickMath.getSqrtPriceAtTick(tick);
        pm.initialize(key, sqrtP);
        uint128 liquidity = LiquidityAmounts.getLiquidityForAmounts(
            sqrtP, TickMath.getSqrtPriceAtTick(lower), TickMath.getSqrtPriceAtTick(upper), ethAmount, type(uint128).max
        );
        lp.modifyLiquidity{value: ethAmount}(
            key, ModifyLiquidityParams(lower, upper, int256(uint256(liquidity)), 0), ""
        );
    }

    function _swap(PoolKey memory key, bool zeroForOne, int256 amount, uint256 value) internal {
        router.swap{value: value}(
            key,
            SwapParams(zeroForOne, amount, zeroForOne ? TickMath.MIN_SQRT_PRICE + 1 : TickMath.MAX_SQRT_PRICE - 1),
            PoolSwapTest.TestSettings(false, false),
            ""
        );
    }

    function test_slippageFloorDoesNotSurviveSameBlockPriceManipulation() public {
        (bool ok,) = payable(address(treasury)).call{value: 1 ether}("");
        require(ok);
        // The floor the treasury itself computes for its 0.45 ETH IMD buy, before anyone touches the pool.
        uint256 floorBeforeManipulation = treasury.quoteMinOut(0, 0.45 ether);

        // Same transaction, any caller: pump IMD with 100 ETH against ~200 ETH of liquidity ...
        _swap(imdKey, true, -int256(100 ether), 100 ether);
        // ... then have the treasury buy. Its minOut is re-quoted from the pumped spot price.
        treasury.process();
        // (the attacker would now sell back; omitted, it does not change what the treasury received)

        uint256 received = imd.balanceOf(address(dist));
        bool refused = treasury.leg(0).pending == 0.45 ether && received == 0;
        assertTrue(
            refused || received >= floorBeforeManipulation,
            "treasury bought below its own pre-manipulation floor: slippage cap is anchored to a manipulable spot"
        );
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";

import {LaunchToken} from "src/LaunchToken.sol";
import {AdamDistributor} from "src/AdamDistributor.sol";

contract RewardToken is ERC20 {
    constructor() ERC20("R", "R") {
        _mint(msg.sender, 1e30);
    }
}

/// @notice Rewards that arrive while nobody is staked are parked in `unallocated` and folded into the next
/// distribution. `notifyReward` is permissionless and accepts 1 wei, so whoever stakes first can trigger that
/// fold-in alone, with a 1 wei stake, and claim the whole backlog. Expected: a 1 wei staker cannot take a
/// backlog it did not earn. Actual: it takes all of it.
contract UnallocatedSweepTest is Test {
    LaunchToken internal adam;
    RewardToken internal imd;
    RewardToken internal pnkstr;
    AdamDistributor internal dist;

    address internal attacker = makeAddr("attacker");
    address internal holder = makeAddr("holder");
    address internal poolManager = makeAddr("poolManager");

    function setUp() public {
        adam = new LaunchToken();
        imd = new RewardToken();
        pnkstr = new RewardToken();
        dist = new AdamDistributor(address(adam), address(imd), address(pnkstr), poolManager, address(0));

        // An honest holder bought 10% of the supply at launch; the attacker holds a single wei of ADAM
        // and a single wei of each reward token.
        adam.transfer(holder, 100_000_000e18);
        adam.transfer(attacker, 1);
        imd.transfer(attacker, 1);
        pnkstr.transfer(attacker, 1);
    }

    function test_dustStakerSweepsRewardsAccruedWhileNobodyWasStaked() public {
        // Launch fees were processed before anyone staked: 1,000 IMD and 100,000 PNKSTR are parked.
        imd.approve(address(dist), type(uint256).max);
        pnkstr.approve(address(dist), type(uint256).max);
        dist.notifyReward(address(imd), 1_000e18);
        dist.notifyReward(address(pnkstr), 100_000e18);
        assertEq(dist.unallocated(address(imd)), 1_000e18);
        assertEq(dist.unallocated(address(pnkstr)), 100_000e18);

        // Attacker: stake 1 wei, notify 1 wei of each token (low-level so a permission fix does not revert the
        // test), then exit. No capital, three transactions.
        vm.startPrank(attacker);
        adam.approve(address(dist), 1);
        dist.stake(1);
        imd.approve(address(dist), 1);
        pnkstr.approve(address(dist), 1);
        (bool ok1,) = address(dist).call(abi.encodeCall(AdamDistributor.notifyReward, (address(imd), 1)));
        (bool ok2,) = address(dist).call(abi.encodeCall(AdamDistributor.notifyReward, (address(pnkstr), 1)));
        ok1;
        ok2;
        dist.exit();
        vm.stopPrank();

        // The honest holder stakes right after.
        vm.startPrank(holder);
        adam.approve(address(dist), type(uint256).max);
        dist.stake(100_000_000e18);
        vm.stopPrank();

        // A 1 wei staker must not walk away with a 1,000 IMD / 100,000 PNKSTR backlog.
        assertLt(imd.balanceOf(attacker), 1e18, "dust staker took the IMD backlog");
        assertLt(pnkstr.balanceOf(attacker), 1e18, "dust staker took the PNKSTR backlog");
        // ...and the backlog is still there for real stakers (parked or already credited to the holder).
        assertGe(
            dist.unallocated(address(imd)) + dist.earned(holder, address(imd)), 1_000e18 - 1e18, "IMD backlog lost"
        );
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {PoolManager} from "@uniswap/v4-core/src/PoolManager.sol";
import {IPoolManager} from "@uniswap/v4-core/src/interfaces/IPoolManager.sol";
import {IHooks} from "@uniswap/v4-core/src/interfaces/IHooks.sol";
import {PoolKey} from "@uniswap/v4-core/src/types/PoolKey.sol";
import {Currency, CurrencyLibrary} from "@uniswap/v4-core/src/types/Currency.sol";
import {BalanceDelta} from "@uniswap/v4-core/src/types/BalanceDelta.sol";
import {SwapParams, ModifyLiquidityParams} from "@uniswap/v4-core/src/types/PoolOperation.sol";
import {TickMath} from "@uniswap/v4-core/src/libraries/TickMath.sol";
import {PoolSwapTest} from "@uniswap/v4-core/src/test/PoolSwapTest.sol";
import {PoolModifyLiquidityTest} from "@uniswap/v4-core/src/test/PoolModifyLiquidityTest.sol";
import {LiquidityAmounts} from "@uniswap/v4-periphery/src/libraries/LiquidityAmounts.sol";
import {MockERC20} from "solmate/src/test/utils/mocks/MockERC20.sol";

import {LaunchToken} from "src/LaunchToken.sol";
import {AdamDistributor} from "src/AdamDistributor.sol";
import {AdamTreasury} from "src/AdamTreasury.sol";

/// @notice AdamTreasury derives each buy's minimum output from the pool's slot0 inside the same transaction as the
/// swap, so the configured 3% tolerance is measured against whatever price the caller of the permissionless
/// `process()` set one call earlier. Local ETH/IMD pool with 50 ETH of full-range depth (1% fee):
/// pump 20 ETH -> process() -> dump. The IMD leg is marked successful although it received ~47% less IMD than
/// the floor quoted before the pump.
///
/// Fails on the current code. Passes once the leg either refuses (keeps its ETH pending) or fills within the
/// tolerance of a reference the same transaction cannot move (e.g. the price checkpointed at the previous
/// successful process()).
contract ProofTreasurySlippageFloorTest is Test {
    PoolManager pm;
    PoolSwapTest swapRouter;
    PoolModifyLiquidityTest lpRouter;
    MockERC20 imd;
    MockERC20 pnk;
    PoolKey imdKey;
    PoolKey pnkKey;
    AdamDistributor dist;
    AdamTreasury treasury;

    receive() external payable {}

    function setUp() public {
        vm.warp(1_800_000_000);
        pm = new PoolManager(address(this));
        swapRouter = new PoolSwapTest(pm);
        lpRouter = new PoolModifyLiquidityTest(pm);
        imd = new MockERC20("IMD", "IMD", 18);
        pnk = new MockERC20("PNKSTR", "PNKSTR", 18);
        imd.mint(address(this), 1e36);
        pnk.mint(address(this), 1e36);
        imd.approve(address(lpRouter), type(uint256).max);
        pnk.approve(address(lpRouter), type(uint256).max);
        imd.approve(address(swapRouter), type(uint256).max);
        vm.deal(address(this), 10_000 ether);

        imdKey = PoolKey({
            currency0: CurrencyLibrary.ADDRESS_ZERO,
            currency1: Currency.wrap(address(imd)),
            fee: 10_000,
            tickSpacing: 200,
            hooks: IHooks(address(0))
        });
        pnkKey = PoolKey({
            currency0: CurrencyLibrary.ADDRESS_ZERO,
            currency1: Currency.wrap(address(pnk)),
            fee: 0,
            tickSpacing: 60,
            hooks: IHooks(address(0))
        });
        _initAndSeed(imdKey, 54_000, -887_200, 887_200, 50 ether);
        _initAndSeed(pnkKey, 120_420, -887_220, 887_220, 200 ether);

        LaunchToken adam = new LaunchToken();
        dist = new AdamDistributor(address(adam), address(imd), address(pnk), address(pm), address(0));
        treasury = new AdamTreasury(
            address(dist),
            makeAddr("team"),
            address(pm),
            address(imd),
            10_000,
            200,
            address(0),
            0,
            address(pnk),
            0,
            60,
            address(0),
            0,
            1 ether,
            300,
            600
        );

        // One honest process() first, so a fixed implementation has a reference price to anchor to.
        _fund(1 ether);
        treasury.process();
        vm.warp(block.timestamp + 600);
    }

    function _initAndSeed(PoolKey memory key, int24 tick, int24 lower, int24 upper, uint256 ethAmount) internal {
        uint160 sqrtP = TickMath.getSqrtPriceAtTick(tick);
        pm.initialize(key, sqrtP);
        uint128 liquidity = LiquidityAmounts.getLiquidityForAmounts(
            sqrtP, TickMath.getSqrtPriceAtTick(lower), TickMath.getSqrtPriceAtTick(upper), ethAmount, type(uint128).max
        );
        lpRouter.modifyLiquidity{value: ethAmount}(
            key,
            ModifyLiquidityParams({
                tickLower: lower, tickUpper: upper, liquidityDelta: int256(uint256(liquidity)), salt: 0
            }),
            ""
        );
    }

    function _fund(uint256 amount) internal {
        (bool ok,) = payable(address(treasury)).call{value: amount}("");
        require(ok);
    }

    function _swap(PoolKey memory key, bool zeroForOne, int256 amountSpecified, uint256 value)
        internal
        returns (BalanceDelta)
    {
        return swapRouter.swap{value: value}(
            key,
            SwapParams({
                zeroForOne: zeroForOne,
                amountSpecified: amountSpecified,
                sqrtPriceLimitX96: zeroForOne ? TickMath.MIN_SQRT_PRICE + 1 : TickMath.MAX_SQRT_PRICE - 1
            }),
            PoolSwapTest.TestSettings({takeClaims: false, settleUsingBurn: false}),
            ""
        );
    }

    function test_sandwichedProcessDoesNotFillFarBelowTheUnmanipulatedPrice() public {
        _fund(2.3 ether); // cap 2.222 ETH -> 1 ETH per leg
        uint256 fairFloor = treasury.quoteMinOut(0, 1 ether);
        uint256 distBefore = imd.balanceOf(address(dist));

        // Attacker, all in one transaction: pump the IMD pool, call process(), dump.
        BalanceDelta pump = _swap(imdKey, true, -20 ether, 20 ether);
        treasury.process();
        _swap(imdKey, false, -int256(uint256(uint128(pump.amount1()))), 0);

        uint256 received = imd.balanceOf(address(dist)) - distBefore;
        bool refused = treasury.leg(0).pending == 1 ether;
        emit log_named_uint("pre-pump floor for 1 ETH (IMD wei)", fairFloor);
        emit log_named_uint("IMD received by the distributor", received);
        emit log_named_uint("received as % of pre-pump floor", (received * 100) / fairFloor);
        emit log_named_int("attacker ETH delta (wei)", int256(address(this).balance) - int256(10_000 ether - 250 ether - 1 ether - 2.3 ether));
        assertTrue(
            refused || received >= (fairFloor * 97) / 100, "slippage floor followed the attacker's spot price"
        );
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {PoolManager} from "@uniswap/v4-core/src/PoolManager.sol";
import {IPoolManager} from "@uniswap/v4-core/src/interfaces/IPoolManager.sol";
import {IHooks} from "@uniswap/v4-core/src/interfaces/IHooks.sol";
import {PoolKey} from "@uniswap/v4-core/src/types/PoolKey.sol";
import {PoolIdLibrary} from "@uniswap/v4-core/src/types/PoolId.sol";
import {Currency, CurrencyLibrary} from "@uniswap/v4-core/src/types/Currency.sol";
import {BalanceDelta} from "@uniswap/v4-core/src/types/BalanceDelta.sol";
import {SwapParams, ModifyLiquidityParams} from "@uniswap/v4-core/src/types/PoolOperation.sol";
import {TickMath} from "@uniswap/v4-core/src/libraries/TickMath.sol";
import {StateLibrary} from "@uniswap/v4-core/src/libraries/StateLibrary.sol";
import {PoolSwapTest} from "@uniswap/v4-core/src/test/PoolSwapTest.sol";
import {PoolModifyLiquidityTest} from "@uniswap/v4-core/src/test/PoolModifyLiquidityTest.sol";
import {LiquidityAmounts} from "@uniswap/v4-periphery/src/libraries/LiquidityAmounts.sol";
import {MockERC20} from "solmate/src/test/utils/mocks/MockERC20.sol";

import {LaunchToken} from "src/LaunchToken.sol";
import {AdamDistributor} from "src/AdamDistributor.sol";
import {AdamTreasury} from "src/AdamTreasury.sol";
import {AdamHook} from "src/AdamHook.sol";

/// @notice AdamHook charges exact-input buys (and exact-output sells) on the amount the trader *requested*,
/// in beforeSwap, before the pool has decided how much of it will actually fill. A trader who protects
/// themselves with a sqrtPriceLimit (or whose limit is reached because somebody moved the price first) pays
/// the full fee on ETH that never entered the pool. The afterSwap paths charge on the real delta, so the
/// four swap types are not charged the same way.
///
/// Fails on the current code: a 10 ETH exact-input buy capped at the price a 1 ETH buy reaches fills
/// 0.985 ETH and pays 0.15 ETH of fees (15.2%, not 1.5%). Passes once the hook either refuses the partial
/// fill or charges on what actually filled.
contract ProofHookPartialFillFeeTest is Test {
    using PoolIdLibrary for PoolKey;
    using StateLibrary for IPoolManager;

    uint160 constant FLAGS = 0x2000 | 0x80 | 0x40 | 0x8 | 0x4;
    int24 constant INITIAL_TICK = 177_240;
    int24 constant LOWER_TICK = 108_180;

    PoolManager poolManager;
    PoolSwapTest swapRouter;
    PoolModifyLiquidityTest lpRouter;
    LaunchToken adam;
    AdamDistributor distributor;
    AdamTreasury treasury;
    AdamHook hook;
    PoolKey key;

    receive() external payable {}

    function setUp() public {
        vm.warp(1_800_000_000);
        poolManager = new PoolManager(address(this));
        swapRouter = new PoolSwapTest(poolManager);
        lpRouter = new PoolModifyLiquidityTest(poolManager);
        adam = new LaunchToken();
        MockERC20 imd = new MockERC20("IMD", "IMD", 18);
        MockERC20 pnk = new MockERC20("PNKSTR", "PNKSTR", 18);
        distributor = new AdamDistributor(address(adam), address(imd), address(pnk), address(poolManager), address(0));
        treasury = new AdamTreasury(
            address(distributor),
            makeAddr("team"),
            address(poolManager),
            address(imd),
            10_000,
            200,
            address(0),
            0,
            address(pnk),
            0,
            60,
            address(0),
            1000,
            1 ether,
            300,
            600
        );

        bytes memory initCode = abi.encodePacked(
            type(AdamHook).creationCode, abi.encode(address(poolManager), address(adam), address(treasury), address(this))
        );
        bytes32 codeHash = keccak256(initCode);
        bytes32 salt;
        for (uint256 s;; ++s) {
            address predicted =
                address(uint160(uint256(keccak256(abi.encodePacked(bytes1(0xff), address(this), s, codeHash)))));
            if (uint160(predicted) & 0x3FFF == FLAGS) {
                salt = bytes32(s);
                break;
            }
        }
        hook = new AdamHook{salt: salt}(poolManager, address(adam), address(treasury), address(this));

        key = PoolKey({
            currency0: CurrencyLibrary.ADDRESS_ZERO,
            currency1: Currency.wrap(address(adam)),
            fee: 0,
            tickSpacing: 60,
            hooks: IHooks(address(hook))
        });
        uint160 sqrtP = TickMath.getSqrtPriceAtTick(INITIAL_TICK);
        poolManager.initialize(key, sqrtP);
        uint128 liquidity =
            LiquidityAmounts.getLiquidityForAmount1(TickMath.getSqrtPriceAtTick(LOWER_TICK), sqrtP, 1_000_000_000e18);
        adam.approve(address(lpRouter), type(uint256).max);
        lpRouter.modifyLiquidity(
            key,
            ModifyLiquidityParams({
                tickLower: LOWER_TICK, tickUpper: INITIAL_TICK, liquidityDelta: int256(uint256(liquidity)), salt: 0
            }),
            ""
        );
        adam.approve(address(swapRouter), type(uint256).max);
        vm.deal(address(this), 100 ether);
        // The hook takes its fee from the singleton before the buyer settles; mainnet's PoolManager holds tens
        // of thousands of ETH from other pools, so give this fresh one a float too.
        vm.deal(address(poolManager), 1_000 ether);
        // steady state: 1.5%
        vm.warp(block.timestamp + 30 minutes);
    }

    function _swap(bool zeroForOne, int256 amountSpecified, uint160 limit, uint256 value) internal returns (BalanceDelta) {
        return swapRouter.swap{value: value}(
            key,
            SwapParams({zeroForOne: zeroForOne, amountSpecified: amountSpecified, sqrtPriceLimitX96: limit}),
            PoolSwapTest.TestSettings({takeClaims: false, settleUsingBurn: false}),
            ""
        );
    }

    function test_exactInputBuyWithPriceLimitIsChargedOnlyOnWhatFilled() public {
        // Where does a 1 ETH buy leave the price?
        uint256 snap = vm.snapshotState();
        _swap(true, -1 ether, TickMath.MIN_SQRT_PRICE + 1, 1 ether);
        (uint160 sqrtAfterOneEth,,,) = IPoolManager(address(poolManager)).getSlot0(key.toId());
        vm.revertToState(snap);

        uint256 treasuryBefore = address(treasury).balance;
        uint256 poolBefore = address(poolManager).balance;

        // Ask for 10 ETH exact-in, but refuse to move the price further than a 1 ETH buy would.
        try this.swapExternal(true, -10 ether, sqrtAfterOneEth, 10 ether) returns (BalanceDelta) {
            uint256 filled = address(poolManager).balance - poolBefore; // ETH the pool actually took
            uint256 fee = address(treasury).balance - treasuryBefore;
            assertLt(filled, 2 ether, "test setup: the limit must cut the fill well below 10 ETH");
            assertLe(fee, (filled * 150) / 10_000 + 1, "fee charged on ETH that never entered the pool");
        } catch {
            // A hook that refuses partial fills on the beforeSwap-fee paths is an acceptable fix.
        }
    }

    function swapExternal(bool zeroForOne, int256 amountSpecified, uint160 limit, uint256 value)
        external
        returns (BalanceDelta)
    {
        return _swap(zeroForOne, amountSpecified, limit, value);
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {LaunchToken} from "src/LaunchToken.sol";
import {AdamDistributor} from "src/AdamDistributor.sol";

/// @notice Reproduces the brief's unmet wallet-holder dividend requirement without a fork.
contract WalletEligibilityProof is Test {
    function test_unstakedHolderReceivesProRataRewards() public {
        LaunchToken adam = new LaunchToken();
        LaunchToken imd = new LaunchToken();
        LaunchToken pnk = new LaunchToken();
        AdamDistributor d = new AdamDistributor(address(adam), address(imd), address(pnk), address(0x9000), address(0));
        address alice = address(0xA11CE);
        adam.transfer(alice, adam.totalSupply());
        imd.approve(address(d), 100e18);
        pnk.approve(address(d), 200e18);
        d.notifyReward(address(imd), 100e18);
        d.notifyReward(address(pnk), 200e18);
        vm.prank(alice);
        d.claim();
        // Alice owns 100% of all eligible ADAM. No opt-in staking was required by the brief.
        assertApproxEqAbs(imd.balanceOf(alice), 100e18, 1, "wallet holder lost her IMD entitlement");
        assertApproxEqAbs(pnk.balanceOf(alice), 200e18, 1, "wallet holder lost her PNKSTR entitlement");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {LaunchToken} from "src/LaunchToken.sol";
import {AdamDistributor} from "src/AdamDistributor.sol";

contract ReviewWalletEligibility is Test {
    function test_walletHolderCanClaimProRataRewards() public {
        LaunchToken adam = new LaunchToken();
        LaunchToken imd = new LaunchToken();
        LaunchToken pnk = new LaunchToken();
        AdamDistributor distributor = new AdamDistributor(
            address(adam), address(imd), address(pnk), address(0x9000), address(0)
        );
        address alice = address(0xA11CE);
        adam.transfer(alice, adam.totalSupply());
        imd.approve(address(distributor), 100e18);
        pnk.approve(address(distributor), 200e18);
        distributor.notifyReward(address(imd), 100e18);
        distributor.notifyReward(address(pnk), 200e18);
        vm.prank(alice);
        distributor.claim();
        emit log_named_uint("Alice IMD", imd.balanceOf(alice));
        emit log_named_uint("Alice PNKSTR", pnk.balanceOf(alice));
        emit log_named_uint("Unallocated IMD", distributor.unallocated(address(imd)));
        assertApproxEqAbs(imd.balanceOf(alice), 100e18, 1, "wallet holder lost her IMD entitlement");
        assertApproxEqAbs(pnk.balanceOf(alice), 200e18, 1, "wallet holder lost her PNKSTR entitlement");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {LaunchToken} from "src/LaunchToken.sol";
import {AdamDistributor} from "src/AdamDistributor.sol";

contract WalletDividendProof is Test {
    function test_walletHolderReceivesDividendsAcrossTransfer() public {
        LaunchToken adam = new LaunchToken();
        // Plain fixed-supply ERC-20 stand-ins; reward metadata is irrelevant to this proof.
        LaunchToken imd = new LaunchToken();
        LaunchToken pnkstr = new LaunchToken();
        AdamDistributor distributor = new AdamDistributor(
            address(adam), address(imd), address(pnkstr), address(0x9000), address(0)
        );
        address alice = address(0xA11CE);
        address bob = address(0xB0B);
        uint256 supply = adam.totalSupply();
        adam.transfer(alice, supply);
        imd.approve(address(distributor), 200e18);
        pnkstr.approve(address(distributor), 400e18);

        distributor.notifyReward(address(imd), 100e18);
        distributor.notifyReward(address(pnkstr), 200e18);
        vm.prank(alice);
        adam.transfer(bob, supply);
        distributor.notifyReward(address(imd), 100e18);
        distributor.notifyReward(address(pnkstr), 200e18);

        vm.prank(alice);
        distributor.claim();
        vm.prank(bob);
        distributor.claim();
        assertApproxEqAbs(imd.balanceOf(alice), 100e18, 1, "past rewards belong to the original holder");
        assertApproxEqAbs(pnkstr.balanceOf(alice), 200e18, 1);
        assertApproxEqAbs(imd.balanceOf(bob), 100e18, 1, "future rewards follow the transferred balance");
        assertApproxEqAbs(pnkstr.balanceOf(bob), 200e18, 1);
    }
}