// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {PoolManager} from "v4-core/src/PoolManager.sol";
import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
import {IHooks} from "v4-core/src/interfaces/IHooks.sol";
import {PoolKey} from "v4-core/src/types/PoolKey.sol";
import {Currency, CurrencyLibrary} from "v4-core/src/types/Currency.sol";
import {FeeTreasury} from "src/FeeTreasury.sol";
import {StakingVault} from "src/StakingVault.sol";
import {Arena} from "src/Arena.sol";
import {PrismRiotToken} from "src/PrismRiotToken.sol";

/// @dev A `buyImd` against an ETH/IMD pool whose IMD side is exhausted fills nothing (spent 0, out 0), yet is
/// accepted as a purchase: the floor check `out < spent * floor / 1e18` is `0 < 0`, `purchased` flips to true
/// (freezing `setPrio` / `setSinks` for ever), `ImdBought(0, 0)` is emitted and the pool is left parked at
/// MIN_SQRT_PRICE + 1 so the next buy reverts `PriceLimitAlreadyExceeded`.
/// Expected: a swap that spends nothing and returns nothing is refused and `purchased` stays false.
contract BuyImdZeroFillTest is Test {
    uint160 constant SQRT_PRICE_1_1 = 79228162514264337593543950336;

    address owner = makeAddr("owner");
    address executor = makeAddr("executor");
    address hookStandIn = makeAddr("hook"); // `receive()` only checks the sender; any address can be bound
    address adapterStandIn = makeAddr("adapter");

    PoolManager manager;
    PrismRiotToken prio;
    PrismRiotToken imd;
    FeeTreasury treasury;
    StakingVault vault;
    Arena arena;

    function setUp() public {
        manager = new PoolManager(address(this));
        prio = new PrismRiotToken();
        imd = new PrismRiotToken();
        treasury = new FeeTreasury(IPoolManager(address(manager)), owner);
        vault = new StakingVault(owner, address(prio));
        arena = new Arena(owner, address(prio));

        // An initialized ETH/IMD pool (same fee / tick spacing as the plan's B7) with no IMD to sell.
        PoolKey memory imdKey = PoolKey({
            currency0: CurrencyLibrary.ADDRESS_ZERO,
            currency1: Currency.wrap(address(imd)),
            fee: 10_000,
            tickSpacing: 200,
            hooks: IHooks(address(0))
        });
        manager.initialize(imdKey, SQRT_PRICE_1_1);

        vm.startPrank(owner);
        treasury.bindHook(hookStandIn);
        treasury.setPrio(address(prio));
        treasury.setSinks(address(vault), address(arena), adapterStandIn);
        treasury.setImd(address(imd));
        treasury.setImdPool(10_000, 200, address(0));
        treasury.setPriceFloors(1e8 ether, 1e3 ether); // 1e8 PRIO per ETH, 1000 IMD per ETH
        treasury.setExecutor(executor);
        vm.stopPrank();

        // Fee income, then allocation: imdBudget = 30% of the post-reserve remainder (2.85 ETH here).
        vm.deal(hookStandIn, 10 ether);
        vm.prank(hookStandIn);
        (bool ok,) = address(treasury).call{value: 10 ether}("");
        require(ok, "income refused");
        treasury.allocate();
        assertGt(treasury.imdBudget(), 0.1 ether);
    }

    function test_zeroFillIsNotAPurchase() public {
        assertFalse(treasury.purchased());
        uint256 budgetBefore = treasury.imdBudget();

        // The operator (operator/operator.py cmd_buy) sends minOut = 0 and relies on the owner's floor. A zero
        // fill passes that floor, so the contract must refuse on its own: nothing was bought.
        vm.prank(executor);
        vm.expectRevert();
        treasury.buyImd(0.1 ether, 0);

        assertFalse(treasury.purchased(), "a zero fill must not freeze PRIO and the sinks");
        assertEq(treasury.imdBudget(), budgetBefore);
        assertEq(imd.balanceOf(adapterStandIn), 0);
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {PrismRiotToken} from "src/PrismRiotToken.sol";
import {Arena, IRoundOracle} from "src/Arena.sol";
import {OracleAdapter} from "src/OracleAdapter.sol";
import {OracleAttestation} from "src/OracleAttestation.sol";

/// @dev Reports roundCount() == 0 forever: what the owner points `OracleAdapter.setArena` at.
contract EmptyArenaStub {
    function roundCount() external pure returns (uint256) {
        return 0;
    }
}

/// @dev The adapter promises that a pin is immutable once the Arena has created its round, and the Arena
/// promises that nothing about an open round's result source can change. `setArena` is re-settable and
/// `_replaceable` trusts whatever it points at, so the owner can re-pin an OPEN round's question and signer
/// and settle it with an attestation signed by a key of their choosing.
contract RepinOpenRoundTest is Test {
    uint256 constant SIGNER_KEY = 0x59c6995e998f97a5a0044966f0945389dc9e86dae88c7a8412f4603b6b78690d;
    address constant SIGNER = 0x70997970C51812dc3A010C7d01b50e0d17dc79C8;
    bytes32 constant QUESTION = keccak256("round question");
    uint64 constant T0 = 1_800_000_000;

    PrismRiotToken token;
    Arena arena;
    OracleAdapter adapter;
    address owner = makeAddr("owner");
    address alice = makeAddr("alice");
    address bob = makeAddr("bob");
    uint256 rogueKey;
    address rogueSigner;

    function setUp() public {
        vm.warp(T0);
        (rogueSigner, rogueKey) = makeAddrAndKey("rogue");
        token = new PrismRiotToken();
        arena = new Arena(owner, address(token));
        adapter = new OracleAdapter(owner, SIGNER);
        vm.startPrank(owner);
        arena.setOracle(IRoundOracle(address(adapter)));
        adapter.setArena(address(arena));
        vm.stopPrank();
        token.transfer(alice, 1_000 ether);
        token.transfer(bob, 1_000 ether);
        vm.prank(alice);
        token.approve(address(arena), 102 ether);
        vm.prank(bob);
        token.approve(address(arena), 102 ether);
        token.approve(address(arena), type(uint256).max);
        arena.fundPrizes(1_000 ether);
    }

    function attestation(uint256 answer, bytes32 question, uint64 issuedAt)
        internal
        view
        returns (OracleAttestation.Attestation memory a)
    {
        a = OracleAttestation.Attestation({
            requestId: keccak256(abi.encode("req", answer, question)),
            chainId: 1,
            questionHash: question,
            answerType: OracleAttestation.ANSWER_UINT256,
            answer: abi.encode(answer),
            figure: 0,
            fromBlock: 1,
            toBlock: 2,
            blockHash: bytes32(uint256(1)),
            panelJobId: keccak256("job"),
            panelSize: 5,
            quorum: 4,
            agreed: 5,
            issuedAt: issuedAt,
            expiresAt: uint64(block.timestamp + 1 days)
        });
    }

    function sign(uint256 key, OracleAttestation.Attestation memory a) internal view returns (bytes memory) {
        (uint8 v, bytes32 r, bytes32 s) = vm.sign(key, adapter.attestationDigest(a));
        return abi.encodePacked(r, s, v);
    }

    function test_openRoundPinCannotBeReplacedThroughSetArena() public {
        uint64 commitDeadline = uint64(block.timestamp + 1 hours);
        vm.startPrank(owner);
        adapter.pinQuestion(1, QUESTION, 1, 5, 4, commitDeadline, "");
        uint256 id = arena.createRound(
            Arena.Mode.FactionDuel, 2, commitDeadline, commitDeadline + 1 hours, commitDeadline + 2 hours, 300 ether, 0, 0
        );
        vm.stopPrank();
        assertEq(id, 1);

        // Alice picks 2, Bob picks 1; both reveal.
        bytes32 saltA = keccak256("a");
        bytes32 saltB = keccak256("b");
        bytes32 cA = arena.commitmentOf(id, alice, 2, saltA);
        bytes32 cB = arena.commitmentOf(id, bob, 1, saltB);
        vm.prank(alice);
        arena.enter(id, cA);
        vm.prank(bob);
        arena.enter(id, cB);
        skip(1 hours);
        vm.prank(alice);
        arena.reveal(id, 2, saltA);
        vm.prank(bob);
        arena.reveal(id, 1, saltB);
        skip(1 hours);

        // The owner tries to change the open round's result source: rotate the signer to a key they hold,
        // point the adapter at a contract that reports no rounds, and re-pin round 1.
        bytes32 rogueQuestion = keccak256("rogue question");
        vm.startPrank(owner);
        adapter.setSigner(rogueSigner);
        (bool arenaSwapped,) =
            address(adapter).call(abi.encodeCall(OracleAdapter.setArena, (address(new EmptyArenaStub()))));
        (bool repinned,) = address(adapter).call(
            abi.encodeCall(OracleAdapter.pinQuestion, (id, rogueQuestion, 1, 5, 4, commitDeadline, ""))
        );
        vm.stopPrank();
        arenaSwapped; // whether this step is refused or the re-pin is, the pin must survive

        // Expected: the pin the round opened with is untouched.
        assertFalse(repinned, "a pin consumed by an open round must not be replaceable");
        assertEq(adapter.pinned(id).questionHash, QUESTION, "question hash changed on an open round");
        assertEq(adapter.pinned(id).signer, SIGNER, "signer changed on an open round");

        // Expected: an answer signed by the owner's key for the owner's question cannot settle the round.
        OracleAttestation.Attestation memory rogue = attestation(0, rogueQuestion, commitDeadline); // winning = 1
        bytes memory rogueSig = sign(rogueKey, rogue);
        vm.prank(owner);
        (bool settledByRogue,) =
            address(adapter).call(abi.encodeCall(OracleAdapter.submitAttestation, (id, rogue, rogueSig)));
        assertFalse(settledByRogue, "owner-signed answer accepted for an open round");
        assertFalse(adapter.resultOf(id).settled);

        // The real signer's answer still settles it (sanity: the honest path is intact).
        OracleAttestation.Attestation memory real = attestation(1, QUESTION, commitDeadline); // winning = 2
        bytes memory realSig = sign(SIGNER_KEY, real);
        vm.prank(owner);
        adapter.submitAttestation(id, real, realSig);
        arena.settle(id);
        assertEq(arena.payoutOf(id, alice), 400 ether);
        assertEq(arena.payoutOf(id, bob), 90 ether);
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {PrismRiotToken} from "src/PrismRiotToken.sol";
import {OracleAdapter} from "src/OracleAdapter.sol";

/// @dev `withdrawToken` refuses only the token that is `asset` at call time, and `setPayment` can move `asset`
/// at any time. So the IMD bought for agent work from the 30% allocation is withdrawable by the owner in
/// three calls, contrary to the "AssetNotWithdrawable" guarantee and the brief's economics.
contract WithdrawImdTest is Test {
    address owner = makeAddr("owner");
    address signer = makeAddr("signer");
    OracleAdapter adapter;
    PrismRiotToken imd;
    PrismRiotToken other;

    function setUp() public {
        adapter = new OracleAdapter(owner, signer);
        imd = new PrismRiotToken();
        other = new PrismRiotToken();
        vm.prank(owner);
        adapter.setPayment(address(imd), 0.5 ether);
        // IMD the treasury bought from fees and handed over for panel answers.
        imd.transfer(address(adapter), 5 ether);
    }

    function test_configuredImdCannotBeWithdrawnByRotatingTheAsset() public {
        vm.startPrank(owner);
        // Direct withdrawal is refused, as documented.
        vm.expectRevert(OracleAdapter.AssetNotWithdrawable.selector);
        adapter.withdrawToken(address(imd), owner, 5 ether);
        // Rotate the asset away, withdraw, rotate it back.
        (bool rotated,) = address(adapter).call(abi.encodeCall(OracleAdapter.setPayment, (address(other), 1)));
        (bool withdrawn,) =
            address(adapter).call(abi.encodeCall(OracleAdapter.withdrawToken, (address(imd), owner, 5 ether)));
        address(adapter).call(abi.encodeCall(OracleAdapter.setPayment, (address(imd), 0.5 ether)));
        vm.stopPrank();
        rotated;
        // Expected: the IMD bought for agent work stays in the adapter whatever the owner does.
        assertFalse(withdrawn, "IMD left the adapter through withdrawToken");
        assertEq(imd.balanceOf(address(adapter)), 5 ether, "IMD for panel answers was withdrawn");
        assertEq(imd.balanceOf(owner), 0);
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {Arena, IRoundOracle} from "src/Arena.sol";
import {OracleAdapter} from "src/OracleAdapter.sol";
import {PrismRiotToken} from "src/PrismRiotToken.sol";

/// @dev Any contract whose roundCount() is lower than an open round's id.
contract LowCounter {
    function roundCount() external pure returns (uint256) {
        return 0;
    }
}

/// @dev Fails on the current tree: after `setArena` is pointed at a contract with a lower `roundCount()`,
/// the question pinned for a round the real Arena has already created can be rewritten. Passes once the
/// adapter keeps a pin immutable after the round exists (for example `setArena` only while `arena` is
/// unset, or a pin marked consumed when the configured Arena's roundCount first reaches it).
contract PinReplaceProof is Test {
    address owner = makeAddr("owner");
    address signer = makeAddr("signer");
    PrismRiotToken prio;
    Arena arena;
    OracleAdapter adapter;
    bytes32 constant Q1 = keccak256("question for round 1");
    bytes32 constant Q2 = keccak256("another question");

    function setUp() public {
        vm.chainId(1);
        vm.warp(1_800_000_000);
        prio = new PrismRiotToken();
        arena = new Arena(owner, address(prio));
        adapter = new OracleAdapter(owner, signer);
        vm.startPrank(owner);
        arena.setOracle(IRoundOracle(address(adapter)));
        adapter.setArena(address(arena));
        vm.stopPrank();
    }

    function test_pinOfACreatedRoundStaysImmutableWhateverArenaIsConfigured() public {
        uint64 commit = uint64(block.timestamp + 1 hours);
        vm.startPrank(owner);
        adapter.pinQuestion(1, Q1, 1, 5, 4, commit, "body1");
        arena.createRound(Arena.Mode.VaultRaid, 3, commit, commit + 1 hours, commit + 2 hours, 0, 0, bytes32(0));
        assertEq(arena.roundCount(), 1);
        assertEq(arena.rounds(1).questionHash, Q1);
        // With the real Arena configured the pin is frozen, as documented.
        vm.expectRevert(abi.encodeWithSelector(OracleAdapter.AlreadyPinned.selector, 1));
        adapter.pinQuestion(1, Q2, 1, 5, 4, commit, "body2");
        // Re-point `arena` (ignore whether a fixed adapter refuses this) and try again: it must still be frozen.
        (bool repointed,) = address(adapter).call(abi.encodeCall(OracleAdapter.setArena, (address(new LowCounter()))));
        repointed; // a fixed adapter may refuse this; the pin must be frozen either way
        vm.expectRevert(abi.encodeWithSelector(OracleAdapter.AlreadyPinned.selector, 1));
        adapter.pinQuestion(1, Q2, 1, 5, 4, commit, "body2");
        vm.stopPrank();
        assertEq(adapter.pinned(1).questionHash, Q1, "the open round's question must not change");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {PoolManager} from "v4-core/src/PoolManager.sol";
import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
import {IHooks} from "v4-core/src/interfaces/IHooks.sol";
import {TickMath} from "v4-core/src/libraries/TickMath.sol";
import {PoolKey} from "v4-core/src/types/PoolKey.sol";
import {Currency, CurrencyLibrary} from "v4-core/src/types/Currency.sol";
import {ModifyLiquidityParams} from "v4-core/src/types/PoolOperation.sol";
import {PoolModifyLiquidityTest} from "v4-core/src/test/PoolModifyLiquidityTest.sol";
import {FeeTreasury} from "src/FeeTreasury.sol";
import {StakingVault} from "src/StakingVault.sol";
import {Arena} from "src/Arena.sol";
import {PrismRiotToken} from "src/PrismRiotToken.sol";

/// @dev After the first purchase PRIO and the sinks are frozen (setPrio/setSinks revert AlreadySet) so the
/// 30% PRIO and 30% IMD allocations "can never be redirected once money has flowed" (FeeTreasury notice).
/// The IMD token is not frozen: setImd(anything) still succeeds, so the IMD line can be pointed at any token
/// and any pool after money has flowed. Fails on the current code; passes once setImd is frozen like setPrio.
contract ProofA_ImdFreezeTest is Test {
    uint160 constant SQRT_PRICE_1_1 = 79228162514264337593543950336;

    address owner = makeAddr("owner");
    address executor = makeAddr("executor");
    address fakeHook = makeAddr("hook"); // FeeTreasury.receive only checks msg.sender == hook
    address adapterAddr = makeAddr("adapter");

    PoolManager manager;
    PoolModifyLiquidityTest lpRouter;
    PrismRiotToken prio;
    PrismRiotToken imd;
    FeeTreasury treasury;
    StakingVault vault;
    Arena arena;

    receive() external payable {}

    function setUp() public {
        vm.warp(1_800_000_000);
        manager = new PoolManager(address(this));
        lpRouter = new PoolModifyLiquidityTest(IPoolManager(address(manager)));
        prio = new PrismRiotToken();
        imd = new PrismRiotToken();
        treasury = new FeeTreasury(IPoolManager(address(manager)), owner);
        vault = new StakingVault(owner, address(prio));
        arena = new Arena(owner, address(prio));
        vm.startPrank(owner);
        treasury.bindHook(fakeHook);
        treasury.setPrio(address(prio));
        treasury.setSinks(address(vault), address(arena), adapterAddr);
        treasury.setExecutor(executor);
        treasury.setPriceFloors(1, 1);
        vault.setRewardFunder(address(treasury));
        vm.stopPrank();
        // 10 ETH of fee income, allocated: 30% of it is the IMD budget.
        vm.deal(fakeHook, 100 ether);
        vm.prank(fakeHook);
        (bool ok,) = address(treasury).call{value: 10 ether}("");
        require(ok);
        treasury.allocate();
        // An ETH/IMD pool with liquidity, no hook.
        PoolKey memory key = PoolKey({
            currency0: CurrencyLibrary.ADDRESS_ZERO,
            currency1: Currency.wrap(address(imd)),
            fee: 3000,
            tickSpacing: 60,
            hooks: IHooks(address(0))
        });
        manager.initialize(key, SQRT_PRICE_1_1);
        imd.approve(address(lpRouter), type(uint256).max);
        vm.deal(address(this), 1_000 ether);
        lpRouter.modifyLiquidity{value: 200 ether}(
            key, ModifyLiquidityParams(TickMath.minUsableTick(60), TickMath.maxUsableTick(60), 100 ether, bytes32(0)), ""
        );
    }

    function test_imdTokenIsFrozenAfterFirstPurchaseLikePrio() public {
        vm.startPrank(owner);
        treasury.setImd(address(imd));
        treasury.setImdPool(3000, 60, address(0));
        vm.stopPrank();
        vm.prank(executor);
        uint256 out = treasury.buyImd(0.1 ether, 1);
        assertGt(out, 0);
        assertTrue(treasury.purchased(), "money has flowed");

        // PRIO and the sinks are frozen, as documented.
        vm.prank(owner);
        vm.expectRevert(FeeTreasury.AlreadySet.selector);
        treasury.setPrio(address(imd));
        vm.prank(owner);
        vm.expectRevert(FeeTreasury.AlreadySet.selector);
        treasury.setSinks(address(vault), address(arena), owner);

        // The IMD line must be frozen the same way. Today this call succeeds and the next buyImd, after a
        // setImdPool for the owner's coin, spends the IMD budget on that coin.
        PrismRiotToken ownerCoin = new PrismRiotToken();
        vm.prank(owner);
        vm.expectRevert(FeeTreasury.AlreadySet.selector);
        treasury.setImd(address(ownerCoin));
        assertEq(address(treasury.imd()), address(imd), "the IMD destination did not move");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {OracleAdapter} from "src/OracleAdapter.sol";
import {PrismRiotToken} from "src/PrismRiotToken.sol";

/// @dev OracleAdapter.withdrawToken promises that the IMD bought from fees for agent work "cannot be
/// withdrawn: it is spent only on panel answers". The check is `token == asset` at call time, and `asset`
/// is re-settable, so two owner calls (setPayment to another token, then withdrawToken) take the IMD out.
/// Fails on the current code; passes once a token that has ever been the payment asset stays locked.
contract ProofB_AdapterWithdrawTest is Test {
    address owner = makeAddr("owner");
    address constant SIGNER = 0x70997970C51812dc3A010C7d01b50e0d17dc79C8;

    function test_imdBoughtForAgentWorkCannotBeWithdrawnAfterAssetSwitch() public {
        PrismRiotToken imd = new PrismRiotToken();
        PrismRiotToken other = new PrismRiotToken();
        OracleAdapter adapter = new OracleAdapter(owner, SIGNER);
        vm.prank(owner);
        adapter.setPayment(address(imd), 0.5 ether);
        // IMD the treasury bought from fees for panel answers (FeeTreasury.buyImd sends it here).
        imd.transfer(address(adapter), 10 ether);
        vm.prank(owner);
        vm.expectRevert(OracleAdapter.AssetNotWithdrawable.selector);
        adapter.withdrawToken(address(imd), owner, 10 ether);
        // Point `asset` elsewhere, then withdraw the same IMD.
        vm.prank(owner);
        adapter.setPayment(address(other), 1);
        vm.prank(owner);
        vm.expectRevert(OracleAdapter.AssetNotWithdrawable.selector); // expected; today 10 IMD go to the owner
        adapter.withdrawToken(address(imd), owner, 10 ether);
        assertEq(imd.balanceOf(address(adapter)), 10 ether, "IMD bought for agent work stays for agent work");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {PrismRiotToken} from "src/PrismRiotToken.sol";
import {Arena, IRoundOracle} from "src/Arena.sol";
import {OracleAdapter} from "src/OracleAdapter.sol";
import {OracleAttestation} from "src/OracleAttestation.sol";

/// @dev Proof: a result stored on the adapter for a round id the Arena has not created yet can never be
/// undone, and that id can never be created afterwards. Round ids are sequential, so the Arena can never
/// open another round. The executor (a bounded hot-wallet role) can trigger it on its own with one relay
/// of a bought attestation, once a pin's `notBefore` has passed and the owner has not yet created the round.
///
/// Fails on the current code at "the owner can still open the pinned round". A fix that refuses to store a
/// result for an uncreated round, or that lets the owner replace such a pin (and its result) while the Arena
/// has not created the round, makes it pass: the executor's relay below is a low-level call whose outcome
/// is not asserted.
contract ProofUncreatedRoundResultBricksArena is Test {
    uint256 constant SIGNER_KEY = 0x59c6995e998f97a5a0044966f0945389dc9e86dae88c7a8412f4603b6b78690d;
    bytes32 constant QUESTION = keccak256("round 1 question");

    PrismRiotToken prio;
    Arena arena;
    OracleAdapter adapter;
    address owner = makeAddr("owner");
    address executor = makeAddr("executor");

    function setUp() public {
        vm.warp(1_800_000_000);
        prio = new PrismRiotToken();
        arena = new Arena(owner, address(prio));
        adapter = new OracleAdapter(owner, vm.addr(SIGNER_KEY));
        vm.startPrank(owner);
        arena.setOracle(IRoundOracle(address(adapter)));
        adapter.setArena(address(arena));
        adapter.setExecutor(executor);
        vm.stopPrank();
    }

    function test_resultForAnUncreatedRoundMustNotBrickRoundCreation() public {
        // The owner pins round 1 for a commit deadline one hour out, planning to create the round later.
        uint64 notBefore = uint64(block.timestamp + 1 hours);
        vm.prank(owner);
        adapter.pinQuestion(1, QUESTION, 1, 5, 4, notBefore, "");
        assertEq(arena.roundCount(), 0, "round 1 does not exist yet");

        // The boundary passes before the owner creates the round. The executor relays a bought attestation
        // for round 1 (the executor may relay any attestation; nothing checks that the round exists).
        vm.warp(notBefore);
        OracleAttestation.Attestation memory a = OracleAttestation.Attestation({
            requestId: keccak256("bought off chain"),
            chainId: 1,
            questionHash: QUESTION,
            answerType: OracleAttestation.ANSWER_UINT256,
            answer: abi.encode(uint256(2)),
            figure: 0,
            fromBlock: 1,
            toBlock: 2,
            blockHash: 0,
            panelJobId: 0,
            panelSize: 5,
            quorum: 4,
            agreed: 4,
            issuedAt: notBefore,
            expiresAt: notBefore + 1 days
        });
        (uint8 v, bytes32 r, bytes32 s) = vm.sign(SIGNER_KEY, adapter.attestationDigest(a));
        vm.prank(executor);
        (bool relayed,) = address(adapter).call(
            abi.encodeCall(OracleAdapter.submitAttestation, (1, a, abi.encodePacked(r, s, v)))
        );
        relayed; // a fixed adapter may refuse this; the property below is what matters

        // The owner must still be able to open round 1: either by re-pinning it for a new commit deadline
        // (the pin is for a round the Arena has not created, so the audit fix says it is replaceable) ...
        uint64 newDeadline = uint64(block.timestamp + 1 hours);
        vm.prank(owner);
        (bool repinned,) = address(adapter).call(
            abi.encodeCall(OracleAdapter.pinQuestion, (1, QUESTION, 1, 5, 4, newDeadline, ""))
        );
        // ... or by creating it against the pin as it stands.
        uint64 pinnedDeadline = adapter.pinned(1).notBefore;
        uint64 commitDeadline = repinned ? newDeadline : pinnedDeadline;
        bool creatable = block.timestamp < commitDeadline;
        if (creatable) {
            vm.prank(owner);
            (bool created,) = address(arena).call(
                abi.encodeCall(
                    Arena.createRound,
                    (
                        Arena.Mode.VaultRaid,
                        4,
                        commitDeadline,
                        commitDeadline + 1 hours,
                        commitDeadline + 2 hours,
                        0,
                        0,
                        bytes32(0)
                    )
                )
            );
            creatable = created;
        }
        assertTrue(creatable, "the owner can still open the pinned round");
        assertEq(arena.roundCount(), 1, "round 1 opened; the Arena is not stuck at round 0 forever");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {PrismRiotToken} from "src/PrismRiotToken.sol";
import {Arena, IRoundOracle} from "src/Arena.sol";
import {OracleAdapter} from "src/OracleAdapter.sol";
import {OracleAttestation} from "src/OracleAttestation.sol";

/// @dev Reports roundCount() == 0 forever: what the owner points `OracleAdapter.setArena` at.
contract EmptyArenaStub {
    function roundCount() external pure returns (uint256) {
        return 0;
    }
}

/// @dev The adapter promises that a pin is immutable once the Arena has created its round, and the Arena
/// promises that nothing about an open round's result source can change. `setArena` is re-settable and
/// `_replaceable` trusts whatever it points at, so the owner can re-pin an OPEN round's question and signer
/// and settle it with an attestation signed by a key of their choosing.
contract RepinOpenRoundTest is Test {
    uint256 constant SIGNER_KEY = 0x59c6995e998f97a5a0044966f0945389dc9e86dae88c7a8412f4603b6b78690d;
    address constant SIGNER = 0x70997970C51812dc3A010C7d01b50e0d17dc79C8;
    bytes32 constant QUESTION = keccak256("round question");
    uint64 constant T0 = 1_800_000_000;

    PrismRiotToken token;
    Arena arena;
    OracleAdapter adapter;
    address owner = makeAddr("owner");
    address alice = makeAddr("alice");
    address bob = makeAddr("bob");
    uint256 rogueKey;
    address rogueSigner;

    function setUp() public {
        vm.warp(T0);
        (rogueSigner, rogueKey) = makeAddrAndKey("rogue");
        token = new PrismRiotToken();
        arena = new Arena(owner, address(token));
        adapter = new OracleAdapter(owner, SIGNER);
        vm.startPrank(owner);
        arena.setOracle(IRoundOracle(address(adapter)));
        adapter.setArena(address(arena));
        vm.stopPrank();
        token.transfer(alice, 1_000 ether);
        token.transfer(bob, 1_000 ether);
        vm.prank(alice);
        token.approve(address(arena), 102 ether);
        vm.prank(bob);
        token.approve(address(arena), 102 ether);
        token.approve(address(arena), type(uint256).max);
        arena.fundPrizes(1_000 ether);
    }

    function attestation(uint256 answer, bytes32 question, uint64 issuedAt)
        internal
        view
        returns (OracleAttestation.Attestation memory a)
    {
        a = OracleAttestation.Attestation({
            requestId: keccak256(abi.encode("req", answer, question)),
            chainId: 1,
            questionHash: question,
            answerType: OracleAttestation.ANSWER_UINT256,
            answer: abi.encode(answer),
            figure: 0,
            fromBlock: 1,
            toBlock: 2,
            blockHash: bytes32(uint256(1)),
            panelJobId: keccak256("job"),
            panelSize: 5,
            quorum: 4,
            agreed: 5,
            issuedAt: issuedAt,
            expiresAt: uint64(block.timestamp + 1 days)
        });
    }

    function sign(uint256 key, OracleAttestation.Attestation memory a) internal view returns (bytes memory) {
        (uint8 v, bytes32 r, bytes32 s) = vm.sign(key, adapter.attestationDigest(a));
        return abi.encodePacked(r, s, v);
    }

    function test_openRoundPinCannotBeReplacedThroughSetArena() public {
        uint64 commitDeadline = uint64(block.timestamp + 1 hours);
        vm.startPrank(owner);
        adapter.pinQuestion(1, QUESTION, 1, 5, 4, commitDeadline, "");
        uint256 id = arena.createRound(
            Arena.Mode.FactionDuel, 2, commitDeadline, commitDeadline + 1 hours, commitDeadline + 2 hours, 300 ether, 0, 0
        );
        vm.stopPrank();
        assertEq(id, 1);

        // Alice picks 2, Bob picks 1; both reveal.
        bytes32 saltA = keccak256("a");
        bytes32 saltB = keccak256("b");
        bytes32 cA = arena.commitmentOf(id, alice, 2, saltA);
        bytes32 cB = arena.commitmentOf(id, bob, 1, saltB);
        vm.prank(alice);
        arena.enter(id, cA);
        vm.prank(bob);
        arena.enter(id, cB);
        skip(1 hours);
        vm.prank(alice);
        arena.reveal(id, 2, saltA);
        vm.prank(bob);
        arena.reveal(id, 1, saltB);
        skip(1 hours);

        // The owner tries to change the open round's result source: rotate the signer to a key they hold,
        // point the adapter at a contract that reports no rounds, and re-pin round 1.
        bytes32 rogueQuestion = keccak256("rogue question");
        vm.startPrank(owner);
        adapter.setSigner(rogueSigner);
        (bool arenaSwapped,) =
            address(adapter).call(abi.encodeCall(OracleAdapter.setArena, (address(new EmptyArenaStub()))));
        (bool repinned,) = address(adapter).call(
            abi.encodeCall(OracleAdapter.pinQuestion, (id, rogueQuestion, 1, 5, 4, commitDeadline, ""))
        );
        vm.stopPrank();
        arenaSwapped; // whether this step is refused or the re-pin is, the pin must survive

        // Expected: the pin the round opened with is untouched.
        assertFalse(repinned, "a pin consumed by an open round must not be replaceable");
        assertEq(adapter.pinned(id).questionHash, QUESTION, "question hash changed on an open round");
        assertEq(adapter.pinned(id).signer, SIGNER, "signer changed on an open round");

        // Expected: an answer signed by the owner's key for the owner's question cannot settle the round.
        OracleAttestation.Attestation memory rogue = attestation(0, rogueQuestion, commitDeadline); // winning = 1
        bytes memory rogueSig = sign(rogueKey, rogue);
        vm.prank(owner);
        (bool settledByRogue,) =
            address(adapter).call(abi.encodeCall(OracleAdapter.submitAttestation, (id, rogue, rogueSig)));
        assertFalse(settledByRogue, "owner-signed answer accepted for an open round");
        assertFalse(adapter.resultOf(id).settled);

        // The real signer's answer still settles it (sanity: the honest path is intact).
        OracleAttestation.Attestation memory real = attestation(1, QUESTION, commitDeadline); // winning = 2
        bytes memory realSig = sign(SIGNER_KEY, real);
        vm.prank(owner);
        adapter.submitAttestation(id, real, realSig);
        arena.settle(id);
        assertEq(arena.payoutOf(id, alice), 400 ether);
        assertEq(arena.payoutOf(id, bob), 90 ether);
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {PrismRiotToken} from "src/PrismRiotToken.sol";
import {Arena, IRoundOracle} from "src/Arena.sol";
import {OracleAdapter} from "src/OracleAdapter.sol";
import {OracleAttestation} from "src/OracleAttestation.sol";

/// @dev Proof: a result stored on the adapter for a round id the Arena has not created yet can never be
/// undone, and that id can never be created afterwards. Round ids are sequential, so the Arena can never
/// open another round. The executor (a bounded hot-wallet role) can trigger it on its own with one relay
/// of a bought attestation, once a pin's `notBefore` has passed and the owner has not yet created the round.
///
/// Fails on the current code at "the owner can still open the pinned round". A fix that refuses to store a
/// result for an uncreated round, or that lets the owner replace such a pin (and its result) while the Arena
/// has not created the round, makes it pass: the executor's relay below is a low-level call whose outcome
/// is not asserted.
contract ProofUncreatedRoundResultBricksArena is Test {
    uint256 constant SIGNER_KEY = 0x59c6995e998f97a5a0044966f0945389dc9e86dae88c7a8412f4603b6b78690d;
    bytes32 constant QUESTION = keccak256("round 1 question");

    PrismRiotToken prio;
    Arena arena;
    OracleAdapter adapter;
    address owner = makeAddr("owner");
    address executor = makeAddr("executor");

    function setUp() public {
        vm.warp(1_800_000_000);
        prio = new PrismRiotToken();
        arena = new Arena(owner, address(prio));
        adapter = new OracleAdapter(owner, vm.addr(SIGNER_KEY));
        vm.startPrank(owner);
        arena.setOracle(IRoundOracle(address(adapter)));
        adapter.setArena(address(arena));
        adapter.setExecutor(executor);
        vm.stopPrank();
    }

    function test_resultForAnUncreatedRoundMustNotBrickRoundCreation() public {
        // The owner pins round 1 for a commit deadline one hour out, planning to create the round later.
        uint64 notBefore = uint64(block.timestamp + 1 hours);
        vm.prank(owner);
        adapter.pinQuestion(1, QUESTION, 1, 5, 4, notBefore, "");
        assertEq(arena.roundCount(), 0, "round 1 does not exist yet");

        // The boundary passes before the owner creates the round. The executor relays a bought attestation
        // for round 1 (the executor may relay any attestation; nothing checks that the round exists).
        vm.warp(notBefore);
        OracleAttestation.Attestation memory a = OracleAttestation.Attestation({
            requestId: keccak256("bought off chain"),
            chainId: 1,
            questionHash: QUESTION,
            answerType: OracleAttestation.ANSWER_UINT256,
            answer: abi.encode(uint256(2)),
            figure: 0,
            fromBlock: 1,
            toBlock: 2,
            blockHash: 0,
            panelJobId: 0,
            panelSize: 5,
            quorum: 4,
            agreed: 4,
            issuedAt: notBefore,
            expiresAt: notBefore + 1 days
        });
        (uint8 v, bytes32 r, bytes32 s) = vm.sign(SIGNER_KEY, adapter.attestationDigest(a));
        vm.prank(executor);
        (bool relayed,) = address(adapter).call(
            abi.encodeCall(OracleAdapter.submitAttestation, (1, a, abi.encodePacked(r, s, v)))
        );
        relayed; // a fixed adapter may refuse this; the property below is what matters

        // The owner must still be able to open round 1: either by re-pinning it for a new commit deadline
        // (the pin is for a round the Arena has not created, so the audit fix says it is replaceable) ...
        uint64 newDeadline = uint64(block.timestamp + 1 hours);
        vm.prank(owner);
        (bool repinned,) = address(adapter).call(
            abi.encodeCall(OracleAdapter.pinQuestion, (1, QUESTION, 1, 5, 4, newDeadline, ""))
        );
        // ... or by creating it against the pin as it stands.
        uint64 pinnedDeadline = adapter.pinned(1).notBefore;
        uint64 commitDeadline = repinned ? newDeadline : pinnedDeadline;
        bool creatable = block.timestamp < commitDeadline;
        if (creatable) {
            vm.prank(owner);
            (bool created,) = address(arena).call(
                abi.encodeCall(
                    Arena.createRound,
                    (
                        Arena.Mode.VaultRaid,
                        4,
                        commitDeadline,
                        commitDeadline + 1 hours,
                        commitDeadline + 2 hours,
                        0,
                        0,
                        bytes32(0)
                    )
                )
            );
            creatable = created;
        }
        assertTrue(creatable, "the owner can still open the pinned round");
        assertEq(arena.roundCount(), 1, "round 1 opened; the Arena is not stuck at round 0 forever");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {PrismRiotToken} from "src/PrismRiotToken.sol";
import {OracleAdapter} from "src/OracleAdapter.sol";

/// @dev `withdrawToken` refuses only the token that is `asset` at call time, and `setPayment` can move `asset`
/// at any time. So the IMD bought for agent work from the 30% allocation is withdrawable by the owner in
/// three calls, contrary to the "AssetNotWithdrawable" guarantee and the brief's economics.
contract WithdrawImdTest is Test {
    address owner = makeAddr("owner");
    address signer = makeAddr("signer");
    OracleAdapter adapter;
    PrismRiotToken imd;
    PrismRiotToken other;

    function setUp() public {
        adapter = new OracleAdapter(owner, signer);
        imd = new PrismRiotToken();
        other = new PrismRiotToken();
        vm.prank(owner);
        adapter.setPayment(address(imd), 0.5 ether);
        // IMD the treasury bought from fees and handed over for panel answers.
        imd.transfer(address(adapter), 5 ether);
    }

    function test_configuredImdCannotBeWithdrawnByRotatingTheAsset() public {
        vm.startPrank(owner);
        // Direct withdrawal is refused, as documented.
        vm.expectRevert(OracleAdapter.AssetNotWithdrawable.selector);
        adapter.withdrawToken(address(imd), owner, 5 ether);
        // Rotate the asset away, withdraw, rotate it back.
        (bool rotated,) = address(adapter).call(abi.encodeCall(OracleAdapter.setPayment, (address(other), 1)));
        (bool withdrawn,) =
            address(adapter).call(abi.encodeCall(OracleAdapter.withdrawToken, (address(imd), owner, 5 ether)));
        address(adapter).call(abi.encodeCall(OracleAdapter.setPayment, (address(imd), 0.5 ether)));
        vm.stopPrank();
        rotated;
        // Expected: the IMD bought for agent work stays in the adapter whatever the owner does.
        assertFalse(withdrawn, "IMD left the adapter through withdrawToken");
        assertEq(imd.balanceOf(address(adapter)), 5 ether, "IMD for panel answers was withdrawn");
        assertEq(imd.balanceOf(owner), 0);
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {PoolManager} from "v4-core/src/PoolManager.sol";
import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
import {IHooks} from "v4-core/src/interfaces/IHooks.sol";
import {PoolKey} from "v4-core/src/types/PoolKey.sol";
import {Currency, CurrencyLibrary} from "v4-core/src/types/Currency.sol";
import {FeeTreasury} from "src/FeeTreasury.sol";
import {StakingVault} from "src/StakingVault.sol";
import {Arena} from "src/Arena.sol";
import {PrismRiotToken} from "src/PrismRiotToken.sol";

/// @dev A `buyImd` against an ETH/IMD pool whose IMD side is exhausted fills nothing (spent 0, out 0), yet is
/// accepted as a purchase: the floor check `out < spent * floor / 1e18` is `0 < 0`, `purchased` flips to true
/// (freezing `setPrio` / `setSinks` for ever), `ImdBought(0, 0)` is emitted and the pool is left parked at
/// MIN_SQRT_PRICE + 1 so the next buy reverts `PriceLimitAlreadyExceeded`.
/// Expected: a swap that spends nothing and returns nothing is refused and `purchased` stays false.
contract BuyImdZeroFillTest is Test {
    uint160 constant SQRT_PRICE_1_1 = 79228162514264337593543950336;

    address owner = makeAddr("owner");
    address executor = makeAddr("executor");
    address hookStandIn = makeAddr("hook"); // `receive()` only checks the sender; any address can be bound
    address adapterStandIn = makeAddr("adapter");

    PoolManager manager;
    PrismRiotToken prio;
    PrismRiotToken imd;
    FeeTreasury treasury;
    StakingVault vault;
    Arena arena;

    function setUp() public {
        manager = new PoolManager(address(this));
        prio = new PrismRiotToken();
        imd = new PrismRiotToken();
        treasury = new FeeTreasury(IPoolManager(address(manager)), owner);
        vault = new StakingVault(owner, address(prio));
        arena = new Arena(owner, address(prio));

        // An initialized ETH/IMD pool (same fee / tick spacing as the plan's B7) with no IMD to sell.
        PoolKey memory imdKey = PoolKey({
            currency0: CurrencyLibrary.ADDRESS_ZERO,
            currency1: Currency.wrap(address(imd)),
            fee: 10_000,
            tickSpacing: 200,
            hooks: IHooks(address(0))
        });
        manager.initialize(imdKey, SQRT_PRICE_1_1);

        vm.startPrank(owner);
        treasury.bindHook(hookStandIn);
        treasury.setPrio(address(prio));
        treasury.setSinks(address(vault), address(arena), adapterStandIn);
        treasury.setImd(address(imd));
        treasury.setImdPool(10_000, 200, address(0));
        treasury.setPriceFloors(1e8 ether, 1e3 ether); // 1e8 PRIO per ETH, 1000 IMD per ETH
        treasury.setExecutor(executor);
        vm.stopPrank();

        // Fee income, then allocation: imdBudget = 30% of the post-reserve remainder (2.85 ETH here).
        vm.deal(hookStandIn, 10 ether);
        vm.prank(hookStandIn);
        (bool ok,) = address(treasury).call{value: 10 ether}("");
        require(ok, "income refused");
        treasury.allocate();
        assertGt(treasury.imdBudget(), 0.1 ether);
    }

    function test_zeroFillIsNotAPurchase() public {
        assertFalse(treasury.purchased());
        uint256 budgetBefore = treasury.imdBudget();

        // The operator (operator/operator.py cmd_buy) sends minOut = 0 and relies on the owner's floor. A zero
        // fill passes that floor, so the contract must refuse on its own: nothing was bought.
        vm.prank(executor);
        vm.expectRevert();
        treasury.buyImd(0.1 ether, 0);

        assertFalse(treasury.purchased(), "a zero fill must not freeze PRIO and the sinks");
        assertEq(treasury.imdBudget(), budgetBefore);
        assertEq(imd.balanceOf(adapterStandIn), 0);
    }
}