Implement SwapCounterHook: the smallest useful Uniswap v4 hook.

Mutant A (owner + owner-writable count + token sweep). In src/SwapCounterHook.sol, insert before the constructor:

address public owner = msg.sender;

function setCount(PoolId poolId, uint256 n) external {

    require(msg.sender == owner, "not owner");

    swapCount[poolId] = n;

}

function sweepToken(address erc20, address to, uint256 amount) external {

    require(msg.sender == owner, "not owner");

    (bool ok,) = erc20.call(abi.encodeWithSignature("transfer(address,uint256)", to, amount));

    require(ok);

}

Expected: at least one test fails (the contract now has a privileged address that can rewrite any pool's count and move any ERC20 the hook holds). Actual, observed with forge 1.7.1: forge test -> "18 tests passed, 0 failed"; all 10 SwapCounterHook tests PASS, including test_SwapsNeverTransferFundsToTheHook and test_RepeatedSwapsIncrementByExactlyOne.

Mutant B (upgradeability). Instead insert before the constructor:

address public impl;

address private immutable _admin = msg.sender;

function setImpl(address a) external { require(msg.sender == _admin); impl = a; }

fallback() external {

    address t = impl;

    assembly {

        calldatacopy(0, 0, calldatasize())

        let ok := delegatecall(gas(), t, 0, calldatasize(), 0, 0)

        returndatacopy(0, 0, returndatasize())

        switch ok case 0 { revert(0, returndatasize()) } default { return(0, returndatasize()) }

    }

}

Expected: at least one test fails (behaviour is now changeable after deployment). Actual: forge test -> "18 tests passed, 0 failed".

For contrast, mutants inside the counting logic are all caught: swapCount[key.toId()] += 2 fails 4 tests; returning (IHooks.afterSwap.selector, 1) fails testFuzz_AfterSwapAlwaysReturnsSelectorAndZeroDelta; skipping the increment when the BalanceDelta is zero fails the fuzz test and test_CountsAreIsolatedByPoolId; declaring beforeSwap: true fails test_HasOnlyAfterSwapPermission.

Both run against the harness pool that BaseHookTest.setUp already builds (native ETH / LaunchToken, fee 3000, whole supply as one position below START_TICK), added as tests in test/SwapCounterHook.t.sol.

(a) Dust buys deliver nothing and still count:

uint256 before = token.balanceOf(address(this));

for (uint256 i = 0; i < 10; ++i) {

    BalanceDelta d = swap(key, true, -1, ZERO_BYTES);   // 1 wei of ETH, exact input

    assertEq(d.amount0(), -1);

    assertEq(d.amount1(), 0);

}

// observed: token.balanceOf(address(this)) - before == 0

// observed: counter().getSwapCount(key.toId()) == 10, for 10 wei total

Expected if the count meant completed swaps: 0. Actual: 10.

(b) An account with no ETH and no token increments the count while moving nothing:

address pauper = address(0xDEAD);        // balance 0, token balance 0

vm.prank(pauper);

BalanceDelta d = swap(key, false, -1, ZERO_BYTES);   // sell into the empty range above START_TICK

// observed: d.amount0() == 0 and d.amount1() == 0 -- nothing was exchanged, no fee paid

// observed: token.balanceOf(pauper) == 0 and pauper.balance == 0

// observed: counter().getSwapCount(key.toId()) == 1

Expected if the count meant completed swaps: 0. Actual: 1. (A second identical call reverts with PriceLimitAlreadyExceeded, so (b) is one free increment per price position, while (a) repeats without limit.)

Verified in a scratch copy of the repo (repository itself unmodified), forge 1.7.1:

(a) ERC20/ERC20 at the manifest's fee tier -- currently untested, passes:

PoolKey memory k = PoolKey({currency0: c0, currency1: c1, fee: 10_000, tickSpacing: 200, hooks: IHooks(address(hook))});

manager.initialize(k, TickMath.getSqrtPriceAtTick(0));

modifyLiquidityRouter.modifyLiquidity(k, ModifyLiquidityParams({tickLower: -6000, tickUpper: 6000, liquidityDelta: 1e21, salt: 0}), ZERO_BYTES);

swapRouter.swap(k, SwapParams({zeroForOne: true, amountSpecified: -1e18, sqrtPriceLimitX96: TickMath.MIN_SQRT_PRICE + 1}), PoolSwapTest.TestSettings({takeClaims: false, settleUsingBurn: false}), ZERO_BYTES);

assertEq(counter().getSwapCount(k.toId()), 1);   // observed: 1

(b) A real sell through the PoolManager -- currently untested, passes:

swap(key, true, -1 ether, ZERO_BYTES);                        // buy first, count == 1

swap(key, false, -int256(token.balanceOf(address(this)) / 2), ZERO_BYTES);

assertEq(counter().getSwapCount(key.toId()), 2);   // observed: 2, delta (+497248887111271211, -490008422659696891087123)