// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {PadToken} from "src/PadToken.sol";
import {PadGame} from "src/PadGame.sol";
import {PvPPad} from "src/PvPPad.sol";
import {PadLiquidity} from "src/PadLiquidity.sol";
import {KingOfThePad} from "src/KingOfThePad.sol";
import {IPoolManager, IUnlockCallback, PoolKey, IERC20Min} from "src/interfaces/Interfaces.sol";
import {IPoolManager as V4Manager} from "lib/v4-core/src/interfaces/IPoolManager.sol";
import {PoolKey as V4Key} from "lib/v4-core/src/types/PoolKey.sol";
import {BalanceDelta} from "lib/v4-core/src/types/BalanceDelta.sol";

/// @dev ArbSys stand-in (same shape as the project's MockArbSys; copied so this file is self-contained).
contract ArbSysStub {
    uint256 public number = 1000;

    function advance(uint256 n) external {
        number += n;
    }

    function arbBlockNumber() external view returns (uint256) {
        return number;
    }

    function arbBlockHash(uint256 n) external view returns (bytes32) {
        require(n < number && n + 256 >= number, "invalid block number");
        return keccak256(abi.encode("arb", n));
    }
}

/// @dev Donates fees into a real v4 pool so PadLiquidity has something to distribute.
contract Donor is IUnlockCallback {
    IPoolManager immutable pm;

    constructor(IPoolManager pm_) {
        pm = pm_;
    }

    receive() external payable {}

    function donate(PoolKey memory key, uint256 e) external {
        pm.unlock(abi.encode(key, e));
    }

    function unlockCallback(bytes calldata data) external returns (bytes memory) {
        (PoolKey memory key, uint256 e) = abi.decode(data, (PoolKey, uint256));
        V4Key memory vkey = abi.decode(abi.encode(key), (V4Key));
        V4Manager(address(pm)).donate(vkey, e, 0, "");
        pm.sync(address(0));
        pm.settle{value: e}();
        return "";
    }
}

/// @dev A former king. While `reject` is set every ETH push to it fails, so its fees become claimable
/// in PadLiquidity. Later it claims them and, inside PadLiquidity.claim (PadLiquidity is locked), bids
/// for the crown: takeCrown's pre-crown distribute reverts with "reentrancy", is swallowed, and the
/// sitting king is dethroned without the fees that accrued during its reign.
contract Thief {
    KingOfThePad immutable king;
    PadLiquidity immutable liq;
    bool public reject = true;
    uint256 public bidAmount;

    constructor(KingOfThePad king_, PadLiquidity liq_) {
        king = king_;
        liq = liq_;
    }

    function setReject(bool r) external {
        reject = r;
    }

    function bid(uint256 v) external {
        king.takeCrown{value: v}();
    }

    function attack(uint256 v) external {
        bidAmount = v;
        liq.claim();
    }

    receive() external payable {
        if (reject) revert("no");
        if (bidAmount != 0) {
            uint256 v = bidAmount;
            bidAmount = 0;
            king.takeCrown{value: v}();
        }
    }
}

contract CrownReentryTest is Test {
    address constant OWNER = 0x5b95A971B4583A5f011E9DA082acdD679b870D06;
    IPoolManager pm;
    PvPPad pad;
    PadLiquidity liq;
    KingOfThePad king;
    PadGame pvp;
    PadToken pvpToken;
    ArbSysStub arb;
    Donor donor;
    address[] players;

    function setUp() public {
        vm.warp(1_800_000_000);
        ArbSysStub impl = new ArbSysStub();
        vm.etch(address(0x64), address(impl).code);
        arb = ArbSysStub(address(0x64));
        pm = IPoolManager(deployCode("PoolManager.sol:PoolManager", abi.encode(OWNER)));
        PadToken t = new PadToken();
        PadGame g = new PadGame();
        pad = new PvPPad(OWNER, address(t), address(g));
        liq = new PadLiquidity(address(pm), address(pad));
        king = new KingOfThePad(address(pad), address(liq), OWNER);
        donor = new Donor(pm);
        vm.deal(address(donor), 10 ether);
        for (uint256 i; i < 12; ++i) {
            address p = address(uint160(0xA000 + i));
            players.push(p);
            vm.deal(p, 10 ether);
        }
        // open the pad with a mined salt
        bytes32 h = liq.hookInitCodeHash();
        bytes memory buf = abi.encodePacked(bytes1(0xff), address(liq), bytes32(0), h);
        bytes32 salt;
        for (uint256 i; i < 300_000; ++i) {
            uint256 a;
            assembly ("memory-safe") {
                mstore(add(buf, 53), i)
                a := and(keccak256(add(buf, 32), 85), 0xffffffffffffffffffffffffffffffffffffffff)
            }
            if (a & 0x3FFF == 0x2000) {
                salt = bytes32(i);
                break;
            }
        }
        vm.prank(OWNER);
        pad.openPad(salt);
        pvp = PadGame(pad.gameOf(1));
        pvpToken = PadToken(pad.tokenOf(1));
        // play genesis out and graduate it
        for (uint256 i; i < 4; ++i) {
            vm.prank(players[i]);
            pvp.enter{value: 0.001 ether}();
        }
        advance(10 minutes);
        pvp.draw(32);
        arb.advance(4);
        while (!pvp.drawComplete()) pvp.draw(32);
        for (uint256 r; r < 3; ++r) {
            for (uint256 i; i < 4; ++i) {
                if (pvp.ended()) break;
                vm.prank(players[i]);
                pvp.roll{value: 0.002 ether}();
            }
            advance(61);
        }
        while (!pvp.ended()) advance(60);
        advance(5);
        pvp.poke();
        if (!pvp.finalized()) pvp.finalize();
        if (!pvp.graduated()) pvp.graduate();
        assertTrue(pad.genesisGraduated());
    }

    function advance(uint256 secs) internal {
        vm.warp(vm.getBlockTimestamp() + secs);
        arb.advance(secs * 4);
    }

    function test_outgoingKingCannotBeSkippedByReenteringFromLiquidityClaim() public {
        Thief thief = new Thief(king, liq);
        vm.deal(address(thief), 1 ether);
        // 1. thief is king; a fee push to it fails, so its fees become claimable in PadLiquidity
        thief.bid(0.01 ether);
        donor.donate(liq.poolKey(address(pvpToken)), 0.1 ether);
        liq.distribute(1);
        assertGt(liq.claimable(address(thief)), 0, "fees parked as claimable");
        // 2. an honest bidder takes the crown and fees accrue during its reign
        vm.warp(king.challengeOpensAt());
        vm.prank(players[9]);
        king.takeCrown{value: 0.011 ether}();
        donor.donate(liq.poolKey(address(pvpToken)), 0.2 ether);
        vm.warp(king.challengeOpensAt());
        // 3. thief claims and re-enters takeCrown while PadLiquidity is locked
        thief.setReject(false);
        uint256 before = players[9].balance;
        thief.attack(0.0121 ether);
        if (king.king() == address(thief)) {
            // CHANGE 2: the outgoing king must be paid its accrued pool fees before being dethroned
            assertGe(
                players[9].balance - before,
                0.011 ether + 0.2 ether - 1e12,
                "outgoing king dethroned without the fees accrued during its reign"
            );
        }
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {PadToken} from "src/PadToken.sol";
import {PadGame} from "src/PadGame.sol";
import {PvPPad} from "src/PvPPad.sol";
import {PadLiquidity} from "src/PadLiquidity.sol";
import {KingOfThePad} from "src/KingOfThePad.sol";
import {IPoolManager, IUnlockCallback, PoolKey, SwapParams} from "src/interfaces/Interfaces.sol";
import {PoolManager} from "lib/v4-core/src/PoolManager.sol";

contract ArbSysStub {
    uint256 public number = 1000;

    function advance(uint256 n) external {
        number += n;
    }

    function arbBlockNumber() external view returns (uint256) {
        return number;
    }

    function arbBlockHash(uint256 n) external view returns (bytes32) {
        require(n < number && n + 256 >= number, "invalid block number");
        return keccak256(abi.encode("arb", n));
    }
}

/// @dev Sells tokens for ETH on the real v4 pool (no price limit: dump everything).
contract SellRouter is IUnlockCallback {
    IPoolManager immutable pm;

    constructor(IPoolManager pm_) {
        pm = pm_;
    }

    receive() external payable {}

    function sell(PoolKey memory key, uint256 tokens) external returns (uint256 ethOut) {
        return abi.decode(pm.unlock(abi.encode(key, tokens)), (uint256));
    }

    function unlockCallback(bytes calldata data) external returns (bytes memory) {
        (PoolKey memory key, uint256 tokens) = abi.decode(data, (PoolKey, uint256));
        int256 d = pm.swap(
            key, SwapParams(false, -int256(tokens), 1461446703485210103287273052203988822378723970341), ""
        );
        int128 a0 = int128(d >> 128);
        int128 a1 = int128(d);
        pm.sync(key.currency1);
        require(PadToken(key.currency1).transfer(address(pm), uint256(uint128(-a1))));
        pm.settle();
        uint256 out = uint256(uint128(a0));
        pm.take(address(0), address(this), out);
        return abi.encode(out);
    }
}

contract SybilCaptureTest is Test {
    address constant OWNER = 0x5b95A971B4583A5f011E9DA082acdD679b870D06;
    address constant ARB = address(0x64);

    ArbSysStub arb;
    IPoolManager pm;
    PvPPad pad;
    PadLiquidity liq;
    KingOfThePad king;
    PadGame pvp;
    SellRouter router;
    address player = address(0xA001);
    address whale = address(0xA002);

    function setUp() public {
        vm.warp(1_800_000_000);
        ArbSysStub impl = new ArbSysStub();
        vm.etch(ARB, address(impl).code);
        arb = ArbSysStub(ARB);
        pm = IPoolManager(address(new PoolManager(OWNER)));
        PadToken t = new PadToken();
        PadGame g = new PadGame();
        pad = new PvPPad(OWNER, address(t), address(g));
        liq = new PadLiquidity(address(pm), address(pad));
        king = new KingOfThePad(address(pad), address(liq), OWNER);
        router = new SellRouter(pm);
        vm.deal(player, 10 ether);
        vm.deal(whale, 10 ether);
        bytes32 salt = _mineSalt();
        vm.prank(OWNER);
        pad.openPad(salt);
        pvp = PadGame(pad.gameOf(1));
        vm.prank(player);
        pvp.enter{value: 0.001 ether}();
        vm.warp(block.timestamp + 10 minutes);
        pvp.draw(32);
        arb.advance(4);
        while (!pvp.drawComplete()) pvp.draw(32);
        vm.prank(player);
        pvp.roll{value: 0.002 ether}();
        arb.advance(4);
        vm.warp(block.timestamp + 11 minutes);
        pvp.finalize();
        pvp.graduate();
    }

    function test_soleBuyerRecoversMostCurveEthAndProfitsFromFundedPot() public {
        uint256 n = 40;
        address[] memory bots = new address[](n);
        uint256 spent;
        for (uint256 i; i < n; ++i) {
            bots[i] = address(uint160(0xB000 + i));
            vm.deal(bots[i], 1 ether);
        }
        uint256 id = pad.launch("Bot", "BOT", "");
        PadGame game = PadGame(pad.gameOf(id));
        PadToken token = PadToken(pad.tokenOf(id));
        for (uint256 i; i < n; ++i) {
            vm.prank(bots[i]);
            game.enter{value: 0.001 ether}();
            spent += 0.001 ether;
        }
        // the king funds live games: 2 ETH extra -> 1 ETH to the only live game (the bot launch)
        vm.prank(whale);
        king.takeCrown{value: 2 ether}();
        assertGe(game.fundedPot(), 1 ether, "funded pot");
        vm.warp(game.signupEnd());
        game.draw(32);
        arb.advance(4);
        while (!game.drawComplete()) game.draw(32);
        for (uint256 r; r < 49; ++r) {
            for (uint256 i; i < n; ++i) {
                if (game.ended()) break;
                vm.prank(bots[i]);
                game.roll{value: 0.002 ether}();
                spent += 0.002 ether;
            }
            vm.warp(vm.getBlockTimestamp() + 61);
            arb.advance(244);
        }
        uint256 curveEth = game.ethRaised();
        uint256 earned = game.rollPot();
        while (!game.ended()) {
            vm.warp(vm.getBlockTimestamp() + 60);
            arb.advance(240);
        }
        vm.warp(vm.getBlockTimestamp() + 5);
        arb.advance(20);
        uint256 balBefore;
        for (uint256 i; i < n; ++i) {
            balBefore += bots[i].balance;
        }
        game.resolvePending(10_000);
        if (!game.finalized()) {
            vm.prank(bots[0]);
            game.finalize();
        }
        if (!game.graduated()) game.graduate();
        uint256 potBack;
        for (uint256 i; i < n; ++i) {
            potBack += bots[i].balance - (balBefore / n == 0 ? 0 : 0);
        }
        potBack -= balBefore;
        // dump every token the bots bought into the real pool
        PoolKey memory key = liq.poolKey(address(token));
        uint256 dump;
        for (uint256 i; i < n; ++i) {
            uint256 b = token.balanceOf(bots[i]);
            vm.prank(bots[i]);
            token.transfer(address(router), b);
            dump += router.sell(key, b);
        }
        emit log_named_uint("rolls+entries spent (wei)", spent);
        emit log_named_uint("curve ETH (wei)", curveEth);
        emit log_named_uint("roll-earned pot (wei)", earned);
        emit log_named_uint("pot paid back to bots (wei)", potBack);
        emit log_named_uint("ETH from dumping tokens (wei)", dump);
        emit log_named_uint("dump as % of curve ETH", dump * 100 / curveEth);
        emit log_named_uint("living at end", game.livingAtEnd());
        uint256 back = potBack + dump;
        emit log_named_uint("total back (wei)", back);
        if (back > spent) emit log_named_uint("PROFIT (wei)", back - spent);
        else emit log_named_uint("LOSS (wei)", spent - back);
        // AUDIT #13 claims the dump recovers "about half" of the curve ETH and that capturing funded ETH
        // "costs more than it returns". Expected: back <= spent. Actual: a ~0.15 ETH profit on 1 ETH funded.
        assertLe(back, spent, "capturing funded ETH costs more than it returns");
    }

    function _mineSalt() internal view returns (bytes32 salt) {
        bytes32 h = liq.hookInitCodeHash();
        for (uint256 i; i < 500_000; ++i) {
            address a = address(
                uint160(uint256(keccak256(abi.encodePacked(bytes1(0xff), address(liq), bytes32(i), h))))
            );
            if (uint160(a) & 0x3FFF == 0x2000) return bytes32(i);
        }
        revert("no salt");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {PadToken} from "src/PadToken.sol";
import {PadGame} from "src/PadGame.sol";
import {PvPPad} from "src/PvPPad.sol";
import {PadLiquidity} from "src/PadLiquidity.sol";
import {KingOfThePad} from "src/KingOfThePad.sol";
import {IPoolManager, IUnlockCallback, PoolKey, IERC20Min} from "src/interfaces/Interfaces.sol";
import {IPoolManager as V4Manager} from "lib/v4-core/src/interfaces/IPoolManager.sol";
import {PoolKey as V4Key} from "lib/v4-core/src/types/PoolKey.sol";
import {BalanceDelta} from "lib/v4-core/src/types/BalanceDelta.sol";

/// @dev ArbSys stand-in (same shape as the project's MockArbSys; copied so this file is self-contained).
contract ArbSysStub {
    uint256 public number = 1000;

    function advance(uint256 n) external {
        number += n;
    }

    function arbBlockNumber() external view returns (uint256) {
        return number;
    }

    function arbBlockHash(uint256 n) external view returns (bytes32) {
        require(n < number && n + 256 >= number, "invalid block number");
        return keccak256(abi.encode("arb", n));
    }
}

/// @dev Donates fees into a real v4 pool so PadLiquidity has something to distribute.
contract Donor is IUnlockCallback {
    IPoolManager immutable pm;

    constructor(IPoolManager pm_) {
        pm = pm_;
    }

    receive() external payable {}

    function donate(PoolKey memory key, uint256 e) external {
        pm.unlock(abi.encode(key, e));
    }

    function unlockCallback(bytes calldata data) external returns (bytes memory) {
        (PoolKey memory key, uint256 e) = abi.decode(data, (PoolKey, uint256));
        V4Key memory vkey = abi.decode(abi.encode(key), (V4Key));
        V4Manager(address(pm)).donate(vkey, e, 0, "");
        pm.sync(address(0));
        pm.settle{value: e}();
        return "";
    }
}

/// @dev A former king. While `reject` is set every ETH push to it fails, so its fees become claimable
/// in PadLiquidity. Later it claims them and, inside PadLiquidity.claim (PadLiquidity is locked), bids
/// for the crown: takeCrown's pre-crown distribute reverts with "reentrancy", is swallowed, and the
/// sitting king is dethroned without the fees that accrued during its reign.
contract Thief {
    KingOfThePad immutable king;
    PadLiquidity immutable liq;
    bool public reject = true;
    uint256 public bidAmount;

    constructor(KingOfThePad king_, PadLiquidity liq_) {
        king = king_;
        liq = liq_;
    }

    function setReject(bool r) external {
        reject = r;
    }

    function bid(uint256 v) external {
        king.takeCrown{value: v}();
    }

    function attack(uint256 v) external {
        bidAmount = v;
        liq.claim();
    }

    receive() external payable {
        if (reject) revert("no");
        if (bidAmount != 0) {
            uint256 v = bidAmount;
            bidAmount = 0;
            king.takeCrown{value: v}();
        }
    }
}

contract CrownReentryTest is Test {
    address constant OWNER = 0x5b95A971B4583A5f011E9DA082acdD679b870D06;
    IPoolManager pm;
    PvPPad pad;
    PadLiquidity liq;
    KingOfThePad king;
    PadGame pvp;
    PadToken pvpToken;
    ArbSysStub arb;
    Donor donor;
    address[] players;

    function setUp() public {
        vm.warp(1_800_000_000);
        ArbSysStub impl = new ArbSysStub();
        vm.etch(address(0x64), address(impl).code);
        arb = ArbSysStub(address(0x64));
        pm = IPoolManager(deployCode("PoolManager.sol:PoolManager", abi.encode(OWNER)));
        PadToken t = new PadToken();
        PadGame g = new PadGame();
        pad = new PvPPad(OWNER, address(t), address(g));
        liq = new PadLiquidity(address(pm), address(pad));
        king = new KingOfThePad(address(pad), address(liq), OWNER);
        donor = new Donor(pm);
        vm.deal(address(donor), 10 ether);
        for (uint256 i; i < 12; ++i) {
            address p = address(uint160(0xA000 + i));
            players.push(p);
            vm.deal(p, 10 ether);
        }
        // open the pad with a mined salt
        bytes32 h = liq.hookInitCodeHash();
        bytes memory buf = abi.encodePacked(bytes1(0xff), address(liq), bytes32(0), h);
        bytes32 salt;
        for (uint256 i; i < 300_000; ++i) {
            uint256 a;
            assembly ("memory-safe") {
                mstore(add(buf, 53), i)
                a := and(keccak256(add(buf, 32), 85), 0xffffffffffffffffffffffffffffffffffffffff)
            }
            if (a & 0x3FFF == 0x2000) {
                salt = bytes32(i);
                break;
            }
        }
        vm.prank(OWNER);
        pad.openPad(salt);
        pvp = PadGame(pad.gameOf(1));
        pvpToken = PadToken(pad.tokenOf(1));
        // play genesis out and graduate it
        for (uint256 i; i < 4; ++i) {
            vm.prank(players[i]);
            pvp.enter{value: 0.001 ether}();
        }
        advance(10 minutes);
        pvp.draw(32);
        arb.advance(4);
        while (!pvp.drawComplete()) pvp.draw(32);
        for (uint256 r; r < 3; ++r) {
            for (uint256 i; i < 4; ++i) {
                if (pvp.ended()) break;
                vm.prank(players[i]);
                pvp.roll{value: 0.002 ether}();
            }
            advance(61);
        }
        while (!pvp.ended()) advance(60);
        advance(5);
        pvp.poke();
        if (!pvp.finalized()) pvp.finalize();
        if (!pvp.graduated()) pvp.graduate();
        assertTrue(pad.genesisGraduated());
    }

    function advance(uint256 secs) internal {
        vm.warp(vm.getBlockTimestamp() + secs);
        arb.advance(secs * 4);
    }

    function test_outgoingKingCannotBeSkippedByReenteringFromLiquidityClaim() public {
        Thief thief = new Thief(king, liq);
        vm.deal(address(thief), 1 ether);
        // 1. thief is king; a fee push to it fails, so its fees become claimable in PadLiquidity
        thief.bid(0.01 ether);
        donor.donate(liq.poolKey(address(pvpToken)), 0.1 ether);
        liq.distribute(1);
        assertGt(liq.claimable(address(thief)), 0, "fees parked as claimable");
        // 2. an honest bidder takes the crown and fees accrue during its reign
        vm.warp(king.challengeOpensAt());
        vm.prank(players[9]);
        king.takeCrown{value: 0.011 ether}();
        donor.donate(liq.poolKey(address(pvpToken)), 0.2 ether);
        vm.warp(king.challengeOpensAt());
        // 3. thief claims and re-enters takeCrown while PadLiquidity is locked
        thief.setReject(false);
        uint256 before = players[9].balance;
        thief.attack(0.0121 ether);
        if (king.king() == address(thief)) {
            // CHANGE 2: the outgoing king must be paid its accrued pool fees before being dethroned
            assertGe(
                players[9].balance - before,
                0.011 ether + 0.2 ether - 1e12,
                "outgoing king dethroned without the fees accrued during its reign"
            );
        }
    }
}