// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {SafeERC20} from "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {VerdictOracle} from "src/VerdictOracle.sol";
import {VerdictMarkets} from "src/VerdictMarkets.sol";
import {VerdictBurnVault} from "src/VerdictBurnVault.sol";
import {OracleAttestation} from "src/OracleAttestation.sol";
import {IIntake} from "src/interfaces/IIntake.sol";

contract ShopIMD is ERC20 {
    constructor() ERC20("Test IMD", "IMD") {}

    function mint(address to, uint256 amount) external {
        _mint(to, amount);
    }
}

contract ShopIntake is IIntake {
    using SafeERC20 for IERC20;

    uint256 public nonce;
    mapping(bytes32 => Callback) public callbacks;

    function request(bytes32, bytes calldata, Callback calldata callback, address asset, uint256 amount)
        external
        payable
        returns (bytes32 id)
    {
        IERC20(asset).safeTransferFrom(msg.sender, address(this), amount);
        id = keccak256(abi.encode(address(this), ++nonce));
        callbacks[id] = callback;
    }

    function deliver(bytes32 id, OracleAttestation.Attestation calldata a, bytes calldata signature)
        external
        returns (bool ok)
    {
        Callback memory cb = callbacks[id];
        (ok,) = cb.target.call{gas: 200_000}(abi.encodeWithSelector(cb.selector, id, a, signature));
    }
}

/// @notice Whoever proposes first picks among every answer anyone ever bought for the body.
/// The market's own paid answer (false) is discarded in favour of a sponsor-bought answer (true),
/// and a sponsor-bought escalation answer replaces a primary without any escalate() call.
contract AnswerShoppingTest is Test {
    uint256 internal constant SIGNER_KEY = 0x123456;
    uint256 internal constant PRICE = 0.5 ether;

    address internal creator = makeAddr("creator");
    address internal alice = makeAddr("alice");
    address internal bob = makeAddr("bob");
    address internal treasury = makeAddr("treasury");

    ShopIMD internal token;
    ShopIntake internal intake;
    VerdictOracle internal oracle;
    VerdictMarkets internal markets;
    bytes internal body = '{"v":1,"question":"primary"}';
    bytes internal escalationBody = '{"v":1,"question":"primary","panelSize":10}';
    uint256 internal attNonce;

    function setUp() public {
        vm.warp(1_800_000_000);
        vm.chainId(11155111);
        token = new ShopIMD();
        intake = new ShopIntake();
        oracle = new VerdictOracle(
            address(intake), address(token), vm.addr(SIGNER_KEY), bytes32("oracle.request@oracle-1"), PRICE, address(this), 0
        );
        VerdictBurnVault burn = new VerdictBurnVault();
        markets = new VerdictMarkets(
            address(oracle), address(token), treasury, address(burn), address(this), 100, 50, 50, 500 ether
        );
        markets.setCreatorAllowed(creator, true);
        address[4] memory users = [address(this), creator, alice, bob];
        for (uint256 i; i < users.length; i++) {
            token.mint(users[i], 1_000 ether);
            vm.startPrank(users[i]);
            token.approve(address(markets), type(uint256).max);
            token.approve(address(oracle), type(uint256).max);
            vm.stopPrank();
        }
    }

    function params() internal view returns (VerdictMarkets.Params memory p) {
        p.questionHash = keccak256("question");
        p.answerType = 0;
        p.dataChainId = 1;
        p.fromBlock = 100;
        p.toBlock = 200;
        p.minPanelSize = 5;
        p.minAgreed = 4;
        p.closeAt = uint64(block.timestamp + 1 hours);
        p.answerFrom = p.closeAt;
        p.answerUntil = p.answerFrom + 4 days;
        p.disputeWindow = 1 days;
        p.voidAfter = p.answerUntil + 1 hours;
        p.bounty = 2 * PRICE;
    }

    function attestation(uint256 id, bytes memory answer, uint16 panel)
        internal
        returns (OracleAttestation.Attestation memory a)
    {
        VerdictMarkets.Params memory p = markets.getMarket(id).params;
        a.requestId = keccak256(abi.encode("oracle request", ++attNonce));
        a.chainId = p.dataChainId;
        a.questionHash = p.questionHash;
        a.answerType = p.answerType;
        a.answer = answer;
        a.fromBlock = p.fromBlock;
        a.toBlock = p.toBlock;
        a.blockHash = keccak256("closing block");
        a.panelJobId = keccak256(abi.encode("panel", attNonce));
        a.panelSize = panel;
        a.quorum = 4;
        a.agreed = panel;
        a.issuedAt = uint64(block.timestamp);
        a.expiresAt = uint64(block.timestamp + 7 days);
    }

    function deliver(bytes32 rid, OracleAttestation.Attestation memory a) internal {
        (uint8 v, bytes32 r, bytes32 s) = vm.sign(SIGNER_KEY, oracle.attestationDigest(a));
        assertTrue(intake.deliver(rid, a, abi.encodePacked(r, s, v)), "delivery failed");
    }

    /// Market paid for one answer (false). Alice, who bet on true, buys her own answers directly
    /// at the oracle until one says true and proposes it first. Expected: only an answer the market
    /// paid for (one of its own asks) may be proposed. Actual: the sponsor-bought answer is accepted
    /// and the market finalizes on it.
    function test_firstProposerPicksAmongDivergentAnswers() public {
        vm.prank(creator);
        uint256 id = markets.createMarket(params(), body, escalationBody, "ipfs://m", 1);
        vm.prank(alice);
        markets.bet(id, 1, 100 ether, 0);
        vm.prank(bob);
        markets.bet(id, 0, 100 ether, 0);

        vm.warp(markets.getMarket(id).params.answerFrom);
        // The market's own paid ask answers "false".
        bytes32 marketRid = markets.resolve(id, body);
        OracleAttestation.Attestation memory marketAnswer = attestation(id, abi.encode(false), 5);
        deliver(marketRid, marketAnswer);

        // Alice buys a second panel for the same body; this one answers "true".
        vm.prank(alice);
        bytes32 aliceRid = oracle.request(body);
        OracleAttestation.Attestation memory aliceAnswer = attestation(id, abi.encode(true), 5);
        deliver(aliceRid, aliceAnswer);

        // Expected: an answer the market did not pay for is refused.
        vm.prank(alice);
        vm.expectRevert(VerdictMarkets.UnauthenticatedAnswer.selector);
        markets.propose(id, aliceAnswer);
    }

    /// A sponsor-bought escalation answer replaces the primary outcome although escalate() was
    /// never called and the market never spent a second ask. Expected: replacement requires the
    /// market's own escalation ask. Actual: accepted, escalated = true, asks still 1.
    function test_replacementWithoutEscalationAsk() public {
        vm.prank(creator);
        uint256 id = markets.createMarket(params(), body, escalationBody, "ipfs://m", 1);
        vm.prank(alice);
        markets.bet(id, 1, 100 ether, 0);
        vm.prank(bob);
        markets.bet(id, 0, 100 ether, 0);

        vm.warp(markets.getMarket(id).params.answerFrom);
        bytes32 marketRid = markets.resolve(id, body);
        OracleAttestation.Attestation memory primary = attestation(id, abi.encode(false), 5);
        deliver(marketRid, primary);
        markets.propose(id, primary);
        assertEq(markets.getMarket(id).outcome, 0);

        vm.prank(alice);
        bytes32 aliceRid = oracle.request(escalationBody);
        OracleAttestation.Attestation memory replacement = attestation(id, abi.encode(true), 10);
        deliver(aliceRid, replacement);

        vm.prank(alice);
        vm.expectRevert(VerdictMarkets.UnauthenticatedAnswer.selector);
        markets.propose(id, replacement);
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {VerdictOracle} from "src/VerdictOracle.sol";
import {VerdictMarkets} from "src/VerdictMarkets.sol";
import {VerdictBurnVault} from "src/VerdictBurnVault.sol";
import {OracleAttestation} from "src/OracleAttestation.sol";
import {IIntake} from "src/interfaces/IIntake.sol";

contract ProofIMD is ERC20 {
    constructor() ERC20("Test IMD", "IMD") {}

    function mint(address to, uint256 amount) external {
        _mint(to, amount);
    }
}

contract ProofIntake is IIntake {
    uint256 public nonce;
    mapping(bytes32 => Callback) public callbacks;

    function request(bytes32, bytes calldata, Callback calldata callback, address asset, uint256 amount)
        external
        payable
        returns (bytes32 id)
    {
        IERC20(asset).transferFrom(msg.sender, address(this), amount);
        id = keccak256(abi.encode(address(this), ++nonce));
        callbacks[id] = callback;
    }

    function deliver(bytes32 id, OracleAttestation.Attestation calldata a, bytes calldata signature)
        external
        returns (bool ok)
    {
        Callback memory cb = callbacks[id];
        (ok,) = cb.target.call{gas: 200_000}(abi.encodeWithSelector(cb.selector, id, a, signature));
    }
}

/// @dev Finding: an escalation asked shortly before answerUntil yields an answer issued after answerUntil,
/// which propose() rejects, so the paid escalation can never replace the primary outcome.
contract EscalationTimingProof is Test {
    uint256 internal constant SIGNER_KEY = 0x123456;
    uint256 internal constant PRICE = 0.5 ether;
    bytes32 internal constant QUESTION = keccak256("precisely defined question");
    address internal creator = makeAddr("creator");
    address internal alice = makeAddr("alice");
    address internal bob = makeAddr("bob");
    ProofIMD internal token;
    ProofIntake internal intake;
    VerdictOracle internal oracle;
    VerdictMarkets internal markets;
    bytes internal body = '{"v":1,"question":"primary"}';
    bytes internal escalationBody = '{"v":1,"question":"primary","panelSize":10}';
    uint256 internal attNonce;

    function setUp() public {
        vm.warp(1_800_000_000);
        vm.chainId(11155111);
        token = new ProofIMD();
        intake = new ProofIntake();
        oracle = new VerdictOracle(
            address(intake), address(token), vm.addr(SIGNER_KEY), bytes32("oracle.request@oracle-1"), PRICE, address(this), 0
        );
        VerdictBurnVault burn = new VerdictBurnVault();
        markets = new VerdictMarkets(
            address(oracle), address(token), makeAddr("treasury"), address(burn), address(this), 100, 50, 50, 500 ether
        );
        markets.setCreatorAllowed(creator, true);
        address[3] memory users = [creator, alice, bob];
        for (uint256 i; i < users.length; i++) {
            token.mint(users[i], 1_000 ether);
            vm.prank(users[i]);
            token.approve(address(markets), type(uint256).max);
        }
    }

    function params() internal view returns (VerdictMarkets.Params memory p) {
        p.questionHash = QUESTION;
        p.answerType = 0;
        p.dataChainId = 1;
        p.fromBlock = 100;
        p.toBlock = 200;
        p.minPanelSize = 5;
        p.minAgreed = 4;
        p.closeAt = uint64(block.timestamp + 1 hours);
        p.answerFrom = p.closeAt;
        p.answerUntil = p.answerFrom + 4 days;
        p.disputeWindow = 1 days;
        p.voidAfter = p.answerUntil + 1 hours;
        p.bounty = 2 * PRICE;
    }

    function attestation(VerdictMarkets.Params memory p, bytes memory answer, uint16 panel, uint64 issuedAt)
        internal
        returns (OracleAttestation.Attestation memory a)
    {
        a.requestId = keccak256(abi.encode("oracle request", ++attNonce));
        a.chainId = p.dataChainId;
        a.questionHash = p.questionHash;
        a.answerType = p.answerType;
        a.answer = answer;
        a.fromBlock = p.fromBlock;
        a.toBlock = p.toBlock;
        a.blockHash = keccak256("closing block");
        a.panelJobId = keccak256(abi.encode("panel", attNonce));
        a.panelSize = panel;
        a.quorum = 4;
        a.agreed = panel;
        a.issuedAt = issuedAt;
        a.expiresAt = issuedAt + 7 days;
    }

    function deliver(bytes32 requestId, OracleAttestation.Attestation memory a) internal {
        (uint8 v, bytes32 r, bytes32 s) = vm.sign(SIGNER_KEY, oracle.attestationDigest(a));
        assertTrue(intake.deliver(requestId, a, abi.encodePacked(r, s, v)), "callback failed");
    }

    /// Escalation asked 10 minutes before answerUntil; the oracle answers 15 minutes later (issuedAt is
    /// answerUntil + 5 minutes), inside the 24 hour window escalate() extended. The replacement should be
    /// accepted; today propose() reverts InvalidAttestation and the market finalizes on the disputed outcome.
    function test_escalationAnswerIssuedInsideExtendedWindowReplacesPrimary() public {
        VerdictMarkets.Params memory p = params();
        vm.prank(creator);
        uint256 id = markets.createMarket(p, body, escalationBody, "", 0);
        vm.prank(alice);
        markets.bet(id, 1, 100 ether, 0);
        vm.prank(bob);
        markets.bet(id, 0, 100 ether, 0);

        // Primary answer "true" issued and delivered early in the ask window.
        vm.warp(p.answerFrom);
        bytes32 primaryId = markets.resolve(id, body);
        OracleAttestation.Attestation memory primary = attestation(p, abi.encode(true), 5, uint64(block.timestamp));
        deliver(primaryId, primary);

        // Alice (winner under "true") proposes it 10 minutes before answerUntil.
        vm.warp(p.answerUntil - 10 minutes);
        vm.prank(alice);
        markets.propose(id, primary);

        // Bob escalates at once, still before answerUntil; the window is extended by 24 hours "so the answer can arrive".
        vm.prank(bob);
        bytes32 escalationId = markets.escalate(id, escalationBody);
        assertEq(markets.getMarket(id).disputeEnds, block.timestamp + 24 hours);
        assertEq(markets.getMarket(id).oracleSpend, 2 * PRICE);

        // The oracle answers 15 minutes later with the larger panel: "false".
        vm.warp(block.timestamp + 15 minutes);
        OracleAttestation.Attestation memory escalation =
            attestation(p, abi.encode(false), 10, uint64(block.timestamp));
        deliver(escalationId, escalation);
        assertEq(oracle.answerOf(escalation), keccak256(escalationBody));
        assertLt(block.timestamp, markets.getMarket(id).disputeEnds);

        // Expected: the paid escalation answer replaces the primary outcome inside the extended window.
        vm.prank(bob);
        markets.propose(id, escalation);
        VerdictMarkets.Market memory m = markets.getMarket(id);
        assertTrue(m.escalated, "escalation answer must be usable inside the window it extended");
        assertEq(m.outcome, 0);
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {SafeERC20} from "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {VerdictOracle} from "src/VerdictOracle.sol";
import {VerdictMarkets} from "src/VerdictMarkets.sol";
import {VerdictBurnVault} from "src/VerdictBurnVault.sol";
import {OracleAttestation} from "src/OracleAttestation.sol";
import {IIntake} from "src/interfaces/IIntake.sol";

contract ShopIMD is ERC20 {
    constructor() ERC20("Test IMD", "IMD") {}

    function mint(address to, uint256 amount) external {
        _mint(to, amount);
    }
}

contract ShopIntake is IIntake {
    using SafeERC20 for IERC20;

    uint256 public nonce;
    mapping(bytes32 => Callback) public callbacks;

    function request(bytes32, bytes calldata, Callback calldata callback, address asset, uint256 amount)
        external
        payable
        returns (bytes32 id)
    {
        IERC20(asset).safeTransferFrom(msg.sender, address(this), amount);
        id = keccak256(abi.encode(address(this), ++nonce));
        callbacks[id] = callback;
    }

    function deliver(bytes32 id, OracleAttestation.Attestation calldata a, bytes calldata signature)
        external
        returns (bool ok)
    {
        Callback memory cb = callbacks[id];
        (ok,) = cb.target.call{gas: 200_000}(abi.encodeWithSelector(cb.selector, id, a, signature));
    }
}

/// @notice Whoever proposes first picks among every answer anyone ever bought for the body.
/// The market's own paid answer (false) is discarded in favour of a sponsor-bought answer (true),
/// and a sponsor-bought escalation answer replaces a primary without any escalate() call.
contract AnswerShoppingTest is Test {
    uint256 internal constant SIGNER_KEY = 0x123456;
    uint256 internal constant PRICE = 0.5 ether;

    address internal creator = makeAddr("creator");
    address internal alice = makeAddr("alice");
    address internal bob = makeAddr("bob");
    address internal treasury = makeAddr("treasury");

    ShopIMD internal token;
    ShopIntake internal intake;
    VerdictOracle internal oracle;
    VerdictMarkets internal markets;
    bytes internal body = '{"v":1,"question":"primary"}';
    bytes internal escalationBody = '{"v":1,"question":"primary","panelSize":10}';
    uint256 internal attNonce;

    function setUp() public {
        vm.warp(1_800_000_000);
        vm.chainId(11155111);
        token = new ShopIMD();
        intake = new ShopIntake();
        oracle = new VerdictOracle(
            address(intake), address(token), vm.addr(SIGNER_KEY), bytes32("oracle.request@oracle-1"), PRICE, address(this), 0
        );
        VerdictBurnVault burn = new VerdictBurnVault();
        markets = new VerdictMarkets(
            address(oracle), address(token), treasury, address(burn), address(this), 100, 50, 50, 500 ether
        );
        markets.setCreatorAllowed(creator, true);
        address[4] memory users = [address(this), creator, alice, bob];
        for (uint256 i; i < users.length; i++) {
            token.mint(users[i], 1_000 ether);
            vm.startPrank(users[i]);
            token.approve(address(markets), type(uint256).max);
            token.approve(address(oracle), type(uint256).max);
            vm.stopPrank();
        }
    }

    function params() internal view returns (VerdictMarkets.Params memory p) {
        p.questionHash = keccak256("question");
        p.answerType = 0;
        p.dataChainId = 1;
        p.fromBlock = 100;
        p.toBlock = 200;
        p.minPanelSize = 5;
        p.minAgreed = 4;
        p.closeAt = uint64(block.timestamp + 1 hours);
        p.answerFrom = p.closeAt;
        p.answerUntil = p.answerFrom + 4 days;
        p.disputeWindow = 1 days;
        p.voidAfter = p.answerUntil + 1 hours;
        p.bounty = 2 * PRICE;
    }

    function attestation(uint256 id, bytes memory answer, uint16 panel)
        internal
        returns (OracleAttestation.Attestation memory a)
    {
        VerdictMarkets.Params memory p = markets.getMarket(id).params;
        a.requestId = keccak256(abi.encode("oracle request", ++attNonce));
        a.chainId = p.dataChainId;
        a.questionHash = p.questionHash;
        a.answerType = p.answerType;
        a.answer = answer;
        a.fromBlock = p.fromBlock;
        a.toBlock = p.toBlock;
        a.blockHash = keccak256("closing block");
        a.panelJobId = keccak256(abi.encode("panel", attNonce));
        a.panelSize = panel;
        a.quorum = 4;
        a.agreed = panel;
        a.issuedAt = uint64(block.timestamp);
        a.expiresAt = uint64(block.timestamp + 7 days);
    }

    function deliver(bytes32 rid, OracleAttestation.Attestation memory a) internal {
        (uint8 v, bytes32 r, bytes32 s) = vm.sign(SIGNER_KEY, oracle.attestationDigest(a));
        assertTrue(intake.deliver(rid, a, abi.encodePacked(r, s, v)), "delivery failed");
    }

    /// Market paid for one answer (false). Alice, who bet on true, buys her own answers directly
    /// at the oracle until one says true and proposes it first. Expected: only an answer the market
    /// paid for (one of its own asks) may be proposed. Actual: the sponsor-bought answer is accepted
    /// and the market finalizes on it.
    function test_firstProposerPicksAmongDivergentAnswers() public {
        vm.prank(creator);
        uint256 id = markets.createMarket(params(), body, escalationBody, "ipfs://m", 1);
        vm.prank(alice);
        markets.bet(id, 1, 100 ether, 0);
        vm.prank(bob);
        markets.bet(id, 0, 100 ether, 0);

        vm.warp(markets.getMarket(id).params.answerFrom);
        // The market's own paid ask answers "false".
        bytes32 marketRid = markets.resolve(id, body);
        OracleAttestation.Attestation memory marketAnswer = attestation(id, abi.encode(false), 5);
        deliver(marketRid, marketAnswer);

        // Alice buys a second panel for the same body; this one answers "true".
        vm.prank(alice);
        bytes32 aliceRid = oracle.request(body);
        OracleAttestation.Attestation memory aliceAnswer = attestation(id, abi.encode(true), 5);
        deliver(aliceRid, aliceAnswer);

        // Expected: an answer the market did not pay for is refused.
        vm.prank(alice);
        vm.expectRevert(VerdictMarkets.UnauthenticatedAnswer.selector);
        markets.propose(id, aliceAnswer);
    }

    /// A sponsor-bought escalation answer replaces the primary outcome although escalate() was
    /// never called and the market never spent a second ask. Expected: replacement requires the
    /// market's own escalation ask. Actual: accepted, escalated = true, asks still 1.
    function test_replacementWithoutEscalationAsk() public {
        vm.prank(creator);
        uint256 id = markets.createMarket(params(), body, escalationBody, "ipfs://m", 1);
        vm.prank(alice);
        markets.bet(id, 1, 100 ether, 0);
        vm.prank(bob);
        markets.bet(id, 0, 100 ether, 0);

        vm.warp(markets.getMarket(id).params.answerFrom);
        bytes32 marketRid = markets.resolve(id, body);
        OracleAttestation.Attestation memory primary = attestation(id, abi.encode(false), 5);
        deliver(marketRid, primary);
        markets.propose(id, primary);
        assertEq(markets.getMarket(id).outcome, 0);

        vm.prank(alice);
        bytes32 aliceRid = oracle.request(escalationBody);
        OracleAttestation.Attestation memory replacement = attestation(id, abi.encode(true), 10);
        deliver(aliceRid, replacement);

        vm.prank(alice);
        vm.expectRevert(VerdictMarkets.UnauthenticatedAnswer.selector);
        markets.propose(id, replacement);
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {VerdictOracle} from "src/VerdictOracle.sol";
import {VerdictMarkets} from "src/VerdictMarkets.sol";
import {VerdictBurnVault} from "src/VerdictBurnVault.sol";
import {OracleAttestation} from "src/OracleAttestation.sol";
import {IIntake} from "src/interfaces/IIntake.sol";

contract ProofIMD is ERC20 {
    constructor() ERC20("Test IMD", "IMD") {}

    function mint(address to, uint256 amount) external {
        _mint(to, amount);
    }
}

contract ProofIntake is IIntake {
    uint256 public nonce;
    mapping(bytes32 => Callback) public callbacks;

    function request(bytes32, bytes calldata, Callback calldata callback, address asset, uint256 amount)
        external
        payable
        returns (bytes32 id)
    {
        IERC20(asset).transferFrom(msg.sender, address(this), amount);
        id = keccak256(abi.encode(address(this), ++nonce));
        callbacks[id] = callback;
    }

    function deliver(bytes32 id, OracleAttestation.Attestation calldata a, bytes calldata signature)
        external
        returns (bool ok)
    {
        Callback memory cb = callbacks[id];
        (ok,) = cb.target.call{gas: 200_000}(abi.encodeWithSelector(cb.selector, id, a, signature));
    }
}

/// @dev Finding: an escalation asked shortly before answerUntil yields an answer issued after answerUntil,
/// which propose() rejects, so the paid escalation can never replace the primary outcome.
contract EscalationTimingProof is Test {
    uint256 internal constant SIGNER_KEY = 0x123456;
    uint256 internal constant PRICE = 0.5 ether;
    bytes32 internal constant QUESTION = keccak256("precisely defined question");
    address internal creator = makeAddr("creator");
    address internal alice = makeAddr("alice");
    address internal bob = makeAddr("bob");
    ProofIMD internal token;
    ProofIntake internal intake;
    VerdictOracle internal oracle;
    VerdictMarkets internal markets;
    bytes internal body = '{"v":1,"question":"primary"}';
    bytes internal escalationBody = '{"v":1,"question":"primary","panelSize":10}';
    uint256 internal attNonce;

    function setUp() public {
        vm.warp(1_800_000_000);
        vm.chainId(11155111);
        token = new ProofIMD();
        intake = new ProofIntake();
        oracle = new VerdictOracle(
            address(intake), address(token), vm.addr(SIGNER_KEY), bytes32("oracle.request@oracle-1"), PRICE, address(this), 0
        );
        VerdictBurnVault burn = new VerdictBurnVault();
        markets = new VerdictMarkets(
            address(oracle), address(token), makeAddr("treasury"), address(burn), address(this), 100, 50, 50, 500 ether
        );
        markets.setCreatorAllowed(creator, true);
        address[3] memory users = [creator, alice, bob];
        for (uint256 i; i < users.length; i++) {
            token.mint(users[i], 1_000 ether);
            vm.prank(users[i]);
            token.approve(address(markets), type(uint256).max);
        }
    }

    function params() internal view returns (VerdictMarkets.Params memory p) {
        p.questionHash = QUESTION;
        p.answerType = 0;
        p.dataChainId = 1;
        p.fromBlock = 100;
        p.toBlock = 200;
        p.minPanelSize = 5;
        p.minAgreed = 4;
        p.closeAt = uint64(block.timestamp + 1 hours);
        p.answerFrom = p.closeAt;
        p.answerUntil = p.answerFrom + 4 days;
        p.disputeWindow = 1 days;
        p.voidAfter = p.answerUntil + 1 hours;
        p.bounty = 2 * PRICE;
    }

    function attestation(VerdictMarkets.Params memory p, bytes memory answer, uint16 panel, uint64 issuedAt)
        internal
        returns (OracleAttestation.Attestation memory a)
    {
        a.requestId = keccak256(abi.encode("oracle request", ++attNonce));
        a.chainId = p.dataChainId;
        a.questionHash = p.questionHash;
        a.answerType = p.answerType;
        a.answer = answer;
        a.fromBlock = p.fromBlock;
        a.toBlock = p.toBlock;
        a.blockHash = keccak256("closing block");
        a.panelJobId = keccak256(abi.encode("panel", attNonce));
        a.panelSize = panel;
        a.quorum = 4;
        a.agreed = panel;
        a.issuedAt = issuedAt;
        a.expiresAt = issuedAt + 7 days;
    }

    function deliver(bytes32 requestId, OracleAttestation.Attestation memory a) internal {
        (uint8 v, bytes32 r, bytes32 s) = vm.sign(SIGNER_KEY, oracle.attestationDigest(a));
        assertTrue(intake.deliver(requestId, a, abi.encodePacked(r, s, v)), "callback failed");
    }

    /// Escalation asked 10 minutes before answerUntil; the oracle answers 15 minutes later (issuedAt is
    /// answerUntil + 5 minutes), inside the 24 hour window escalate() extended. The replacement should be
    /// accepted; today propose() reverts InvalidAttestation and the market finalizes on the disputed outcome.
    function test_escalationAnswerIssuedInsideExtendedWindowReplacesPrimary() public {
        VerdictMarkets.Params memory p = params();
        vm.prank(creator);
        uint256 id = markets.createMarket(p, body, escalationBody, "", 0);
        vm.prank(alice);
        markets.bet(id, 1, 100 ether, 0);
        vm.prank(bob);
        markets.bet(id, 0, 100 ether, 0);

        // Primary answer "true" issued and delivered early in the ask window.
        vm.warp(p.answerFrom);
        bytes32 primaryId = markets.resolve(id, body);
        OracleAttestation.Attestation memory primary = attestation(p, abi.encode(true), 5, uint64(block.timestamp));
        deliver(primaryId, primary);

        // Alice (winner under "true") proposes it 10 minutes before answerUntil.
        vm.warp(p.answerUntil - 10 minutes);
        vm.prank(alice);
        markets.propose(id, primary);

        // Bob escalates at once, still before answerUntil; the window is extended by 24 hours "so the answer can arrive".
        vm.prank(bob);
        bytes32 escalationId = markets.escalate(id, escalationBody);
        assertEq(markets.getMarket(id).disputeEnds, block.timestamp + 24 hours);
        assertEq(markets.getMarket(id).oracleSpend, 2 * PRICE);

        // The oracle answers 15 minutes later with the larger panel: "false".
        vm.warp(block.timestamp + 15 minutes);
        OracleAttestation.Attestation memory escalation =
            attestation(p, abi.encode(false), 10, uint64(block.timestamp));
        deliver(escalationId, escalation);
        assertEq(oracle.answerOf(escalation), keccak256(escalationBody));
        assertLt(block.timestamp, markets.getMarket(id).disputeEnds);

        // Expected: the paid escalation answer replaces the primary outcome inside the extended window.
        vm.prank(bob);
        markets.propose(id, escalation);
        VerdictMarkets.Market memory m = markets.getMarket(id);
        assertTrue(m.escalated, "escalation answer must be usable inside the window it extended");
        assertEq(m.outcome, 0);
    }
}