// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {BMCIlluminatiPass} from "src/BMCIlluminatiPass.sol";
import {VRFV2PlusClient} from "@chainlink/contracts/src/v0.8/vrf/dev/libraries/VRFV2PlusClient.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {ERC20Burnable} from "@openzeppelin/contracts/token/ERC20/extensions/ERC20Burnable.sol";

contract StallBMC2 is ERC20, ERC20Burnable {
    constructor() ERC20("BMC Illuminati", "BMC") {}

    function mint(address to, uint256 amount) external {
        _mint(to, amount);
    }
}

/// @dev Models Chainlink VRF v2.5's documented behaviour: a request made while the subscription is
///      below its minimum balance stays pending for up to 24 hours and then expires, never delivered.
contract ExpiringCoordinator2 {
    uint256 public nextRequestId = 1000;
    mapping(uint256 => address) public consumerOf;
    mapping(uint256 => uint256) public requestedAt;
    mapping(uint256 => bool) public expired;

    function requestRandomWords(VRFV2PlusClient.RandomWordsRequest calldata) external returns (uint256 id) {
        id = nextRequestId++;
        consumerOf[id] = msg.sender;
        requestedAt[id] = block.timestamp;
    }

    function expireIfStale(uint256 id) external {
        if (block.timestamp >= requestedAt[id] + 24 hours) expired[id] = true;
    }

    function fulfill(uint256 id, uint256 word) external returns (bool ok) {
        require(consumerOf[id] != address(0), "unknown");
        if (expired[id]) return false; // Chainlink never delivers an expired request
        uint256[] memory words = new uint256[](1);
        words[0] = word;
        (ok,) = consumerOf[id].call(
            abi.encodeWithSignature("rawFulfillRandomWords(uint256,uint256[])", id, words)
        );
    }
}

contract MainPerTokenStallTest is Test {
    StallBMC2 bmc;
    ExpiringCoordinator2 coord;
    BMCIlluminatiPass pass;
    address alice = makeAddr("alice");
    address anyone = makeAddr("anyone");

    function setUp() public {
        vm.warp(1_800_000_000);
        bmc = new StallBMC2();
        coord = new ExpiringCoordinator2();
        pass = new BMCIlluminatiPass(address(this), address(bmc), address(coord));
        pass.setGenesisImagesCID("bafycid");
        pass.setVRFConfig(123, keccak256("lane"), 500_000, 3, true);
        bmc.mint(alice, 201_000_000 ether);
        vm.startPrank(alice);
        bmc.approve(address(pass), type(uint256).max);
        for (uint256 i; i < 40; ++i) pass.mintGenesis();
        vm.stopPrank();
    }

    /// @notice Token 41's single VRF request expires unfulfilled (subscription under its minimum
    ///         balance for 24h, per Chainlink docs). The 350,000 BMC are burned and the token can never
    ///         be revealed: no re-request exists. A fixed contract exposes a permissionless
    ///         `rerequestRandomness(uint256 tokenId)` usable after a timeout for a token still in
    ///         AwaitingRandomness; the first delivered word for the token wins.
    function test_ExpiredPerTokenRequestCanBeReissued() public {
        vm.prank(alice);
        (uint256 tokenId, uint256 first) = pass.mintMystery();
        assertEq(tokenId, 41);

        vm.warp(block.timestamp + 24 hours + 1);
        coord.expireIfStale(first);
        assertFalse(coord.fulfill(first, 1), "expired request must not deliver");
        assertEq(uint256(pass.revealStatusOf(41)), uint256(BMCIlluminatiPass.RevealStatus.AwaitingRandomness));

        vm.warp(block.timestamp + 7 days);
        vm.prank(anyone);
        (bool ok,) = address(pass).call(abi.encodeWithSignature("rerequestRandomness(uint256)", uint256(41)));
        assertTrue(ok, "no recovery path: token 41 is pending forever");

        uint256 second = coord.nextRequestId() - 1;
        assertTrue(second != first, "a fresh request id expected");
        assertTrue(coord.fulfill(second, 42), "second request must be delivered");
        assertEq(uint256(pass.revealStatusOf(41)), uint256(BMCIlluminatiPass.RevealStatus.Revealed));
        assertTrue(pass.tierOf(41) != BMCIlluminatiPass.Tier.Pending);
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {VRFCoordinatorV2_5Mock} from "@chainlink/contracts/src/v0.8/vrf/mocks/VRFCoordinatorV2_5Mock.sol";
import {SubscriptionAPI} from "@chainlink/contracts/src/v0.8/vrf/dev/SubscriptionAPI.sol";
import {BMCIlluminatiPass} from "src/BMCIlluminatiPass.sol";
import {MockBMC} from "test/mocks/MockBMC.sol";

/// @notice Finding: a mystery mint irreversibly burns 350,000 BMC although the configured VRF
///         subscription holds zero balance, so the coordinator cannot pay for fulfilment and the
///         token stays "Pending" until a third party funds the subscription.
///         The test fails on the current code (mint is accepted) and passes once mintMystery
///         refuses to burn while the subscription cannot pay for a fulfilment.
contract EconUnfundedSubscriptionTest is Test {
    MockBMC bmc;
    VRFCoordinatorV2_5Mock coordinator;
    BMCIlluminatiPass pass;
    uint256 subId;

    address owner = makeAddr("owner");
    address subOwner = makeAddr("subscriptionOwner");
    address alice = makeAddr("alice");

    function setUp() public {
        bmc = new MockBMC();
        coordinator = new VRFCoordinatorV2_5Mock(0.1 ether, 1e9, 4e15);
        vm.prank(subOwner);
        subId = coordinator.createSubscription();
        pass = new BMCIlluminatiPass(owner, address(bmc), address(coordinator), subId, keccak256("lane"), 500_000, 3, false);
        vm.prank(subOwner);
        coordinator.addConsumer(subId, address(pass));
        for (uint256 i = 0; i < 40; i++) {
            address who = address(uint160(0x7000 + i));
            bmc.mint(who, 1_000_000e18);
            vm.startPrank(who);
            bmc.approve(address(pass), 1_000_000e18);
            pass.mintGenesis();
            vm.stopPrank();
        }
    }

    function test_MintIsRefusedWhileSubscriptionCannotPayForFulfilment() public {
        (uint96 linkBal, uint96 nativeBal,,,) = coordinator.getSubscription(subId);
        assertEq(linkBal, 0);
        assertEq(nativeBal, 0);

        bmc.mint(alice, 350_000e18);
        vm.startPrank(alice);
        bmc.approve(address(pass), 350_000e18);
        // Expected: the mint reverts and no BMC is burned while the subscription cannot pay.
        // Actual on current code: the mint succeeds, 350,000 BMC are destroyed, and the
        // coordinator's fulfilment reverts with InsufficientBalance.
        (bool ok, bytes memory ret) = address(pass).call(abi.encodeCall(pass.mintMystery, ()));
        vm.stopPrank();

        if (ok) {
            (uint256 id, uint256 req) = abi.decode(ret, (uint256, uint256));
            assertEq(bmc.balanceOf(alice), 0, "350k BMC irreversibly burned");
            assertEq(pass.totalBurned(), 40 * 1_000_000e18 + 350_000e18);
            vm.expectRevert(SubscriptionAPI.InsufficientBalance.selector);
            coordinator.fulfillRandomWords(req, address(pass));
            assertEq(uint8(pass.revealStatusOf(id)), uint8(BMCIlluminatiPass.RevealStatus.AwaitingRandomness));
            vm.warp(block.timestamp + 1 days);
            // The permissionless retry cannot help either: the subscription is still unfunded.
            pass.rerequestRandomness(id);
            assertEq(uint8(pass.revealStatusOf(id)), uint8(BMCIlluminatiPass.RevealStatus.AwaitingRandomness));
        }
        assertFalse(ok, "mint accepted with a subscription that cannot pay for fulfilment");
        assertEq(bmc.balanceOf(alice), 350_000e18, "no burn when reveal cannot be paid for");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {BMCIlluminatiPassCandidateV3 as V3} from "test/audit/fixtures/BMCIlluminatiPassCandidateV3.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {ERC20Burnable} from "@openzeppelin/contracts/token/ERC20/extensions/ERC20Burnable.sol";
import {VRFV2PlusClient} from "@chainlink/contracts/src/v0.8/vrf/dev/libraries/VRFV2PlusClient.sol";

contract ProofBMC is ERC20, ERC20Burnable {
    constructor() ERC20("BMC", "BMC") {}

    function mint(address to, uint256 amount) external {
        _mint(to, amount);
    }
}

/// Coordinator stand-in modelling the documented oracle behaviour: an underfunded request is
/// dropped by the node after 24h and is never fulfilled; a new request must be made.
contract DroppingCoordinator {
    uint256 public nextId = 1000;
    mapping(uint256 => address) public consumerOf;
    mapping(uint256 => uint256) public requestedAt;
    mapping(bytes32 => bool) public keyExists;

    function registerKey(bytes32 key) external {
        keyExists[key] = true;
    }

    function s_provingKeys(bytes32 key) external view returns (bool, uint64) {
        return (keyExists[key], 500 gwei);
    }

    function requestRandomWords(VRFV2PlusClient.RandomWordsRequest calldata) external returns (uint256 id) {
        id = nextId++;
        consumerOf[id] = msg.sender;
        requestedAt[id] = block.timestamp;
    }

    /// Returns false (no delivery) once the request is older than the oracle's 24h window.
    function fulfill(uint256 id, uint256 word) external returns (bool ok) {
        require(consumerOf[id] != address(0), "unknown");
        if (block.timestamp >= requestedAt[id] + 1 days) return false;
        uint256[] memory words = new uint256[](1);
        words[0] = word;
        (ok,) = consumerOf[id].call(abi.encodeWithSignature("rawFulfillRandomWords(uint256,uint256[])", id, words));
    }
}

/// Fails on Candidate V3 as written: once the sole seed request is dropped, no caller can obtain a
/// replacement request and every mystery reveal is stranded while the BMC stays burned.
contract V3SoleRequestStallTest is Test {
    ProofBMC bmc;
    DroppingCoordinator coord;
    V3 pass;
    address buyer = makeAddr("buyer");
    bytes32 constant KEY = keccak256("lane");

    function setUp() public {
        vm.warp(1_800_000_000);
        bmc = new ProofBMC();
        coord = new DroppingCoordinator();
        coord.registerKey(KEY);
        pass = new V3(
            address(this), address(bmc), address(coord), uint64(block.timestamp + 7 days), 1, KEY, 150_000, 3, true, "cid"
        );
        bmc.mint(buyer, 40_350_000 ether);
        vm.startPrank(buyer);
        bmc.approve(address(pass), type(uint256).max);
        for (uint256 i; i < 40; ++i) pass.mintGenesis();
        pass.mintMystery();
        vm.stopPrank();
    }

    function test_DroppedSoleSeedRequestCanBeReplaced() public {
        vm.warp(pass.saleDeadline());
        uint256 first = pass.requestSeed();
        // Oracle drops the underfunded request after its 24h window.
        vm.warp(block.timestamp + 2 days);
        assertFalse(coord.fulfill(first, 1), "dropped request never delivers");
        assertFalse(pass.seedReceived());
        assertEq(pass.totalBurned(), 40_350_000 ether, "burn is irreversible");

        // Expected: some permissionless path yields a new request so reveals can complete.
        (bool ok, bytes memory ret) = address(pass).call(abi.encodeWithSignature("requestSeed()"));
        assertTrue(ok, "no way to obtain a replacement seed request: token 41 is pending forever");
        uint256 second = abi.decode(ret, (uint256));
        assertTrue(coord.fulfill(second, 7));
        assertEq(pass.finalizeReveals(1), 1);
        assertTrue(pass.tierOf(41) != V3.Tier.Pending);
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {BMCIlluminatiPassCandidateV3 as V3} from "test/audit/fixtures/BMCIlluminatiPassCandidateV3.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {ERC20Burnable} from "@openzeppelin/contracts/token/ERC20/extensions/ERC20Burnable.sol";
import {VRFV2PlusClient} from "@chainlink/contracts/src/v0.8/vrf/dev/libraries/VRFV2PlusClient.sol";

contract ProofBMC2 is ERC20, ERC20Burnable {
    constructor() ERC20("BMC", "BMC") {}

    function mint(address to, uint256 amount) external {
        _mint(to, amount);
    }
}

/// Coordinator stand-in with v2.5 semantics for the two failure modes: a cancelled subscription
/// reverts InvalidSubscription at request time; an unregistered proving key is reported by
/// s_provingKeys. Subscription 1 is cancelled after the sale; subscription 2 and key2 are valid.
contract RepairableCoordinator {
    error InvalidSubscription();

    uint256 public nextId = 1000;
    mapping(uint256 => bool) public subActive;
    mapping(bytes32 => bool) public keyExists;

    function setSub(uint256 id, bool active) external {
        subActive[id] = active;
    }

    function setKey(bytes32 key, bool exists) external {
        keyExists[key] = exists;
    }

    function s_provingKeys(bytes32 key) external view returns (bool, uint64) {
        return (keyExists[key], 500 gwei);
    }

    function requestRandomWords(VRFV2PlusClient.RandomWordsRequest calldata req) external returns (uint256 id) {
        if (!subActive[req.subId]) revert InvalidSubscription();
        id = nextId++;
    }
}

/// Fails on Candidate V3 as written: after buyers have burned BMC, the only subscription and lane
/// it can ever use are the constructor words. When that subscription is cancelled (or the lane
/// deregistered) there is no path to point future requests anywhere else, so reveals stall forever.
contract V3ImmutableLaneTest is Test {
    ProofBMC2 bmc;
    RepairableCoordinator coord;
    V3 pass;
    address owner = makeAddr("owner");
    address buyer = makeAddr("buyer");
    bytes32 constant KEY1 = keccak256("lane 1");
    bytes32 constant KEY2 = keccak256("lane 2");

    function setUp() public {
        vm.warp(1_800_000_000);
        bmc = new ProofBMC2();
        coord = new RepairableCoordinator();
        coord.setSub(1, true);
        coord.setKey(KEY1, true);
        pass = new V3(owner, address(bmc), address(coord), uint64(block.timestamp + 7 days), 1, KEY1, 150_000, 3, true, "cid");
        bmc.mint(buyer, 40_350_000 ether);
        vm.startPrank(buyer);
        bmc.approve(address(pass), type(uint256).max);
        for (uint256 i; i < 40; ++i) pass.mintGenesis();
        pass.mintMystery();
        vm.stopPrank();
    }

    function test_SubscriptionOrLaneCanBeRepairedBeforeSeedRequest() public {
        // Subscription 1 is cancelled and lane 1 deregistered after the burns; sub 2 / lane 2 are valid.
        coord.setSub(1, false);
        coord.setKey(KEY1, false);
        coord.setSub(2, true);
        coord.setKey(KEY2, true);
        vm.warp(pass.saleDeadline());
        vm.expectRevert();
        pass.requestSeed();
        assertEq(pass.totalBurned(), 40_350_000 ether, "burn is irreversible");

        // Expected: the owner (or a constrained operator role) can repoint future requests while no
        // seed has been received. V3 has no such function, so the seed can never be requested.
        vm.prank(owner);
        (bool ok,) = address(pass).call(
            abi.encodeWithSignature("setVRFConfig(uint256,bytes32,uint32,uint16,bool)", uint256(2), KEY2, uint32(150_000), uint16(3), true)
        );
        assertTrue(ok, "no way to replace a cancelled subscription or deregistered lane: reveals stall forever");
        uint256 req = pass.requestSeed();
        assertTrue(req != 0);
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {BMCIlluminatiPass} from "src/BMCIlluminatiPass.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {ERC20Burnable} from "@openzeppelin/contracts/token/ERC20/extensions/ERC20Burnable.sol";
import {VRFV2PlusClient} from "@chainlink/contracts/src/v0.8/vrf/dev/libraries/VRFV2PlusClient.sol";

contract ProofBMC3 is ERC20, ERC20Burnable {
    constructor() ERC20("BMC", "BMC") {}

    function mint(address to, uint256 amount) external {
        _mint(to, amount);
    }
}

/// Models the live VRF v2.5 coordinator: requestRandomWords does not validate the key hash, and
/// s_provingKeys(key) reports whether a lane is registered (verified on a Mainnet fork at the latest
/// block: an arbitrary key hash is accepted from a registered, funded consumer).
contract LaneReportingCoordinator {
    uint256 public nextId = 1000;
    mapping(bytes32 => bool) public keyExists;
    mapping(uint256 => bytes32) public keyOfRequest;

    function setKey(bytes32 key, bool exists) external {
        keyExists[key] = exists;
    }

    function s_provingKeys(bytes32 key) external view returns (bool, uint64) {
        return (keyExists[key], 500 gwei);
    }

    function requestRandomWords(VRFV2PlusClient.RandomWordsRequest calldata req) external returns (uint256 id) {
        id = nextId++;
        keyOfRequest[id] = req.keyHash;
    }
}

/// Fails on the production contract as written: a mystery mint on an unregistered gas lane burns
/// 350,000 BMC and opens a request no oracle will ever serve. Passes once the contract refuses to
/// accept a burn against a lane the coordinator does not know (checked on first use or at
/// configuration time), so the buyer keeps their BMC instead of holding a stranded pending token.
contract UnregisteredLaneBurnTest is Test {
    ProofBMC3 bmc;
    LaneReportingCoordinator coord;
    address buyer = makeAddr("buyer");
    bytes32 constant GOOD = keccak256("registered lane");
    bytes32 constant BAD = keccak256("typo lane");

    function setUp() public {
        bmc = new ProofBMC3();
        coord = new LaneReportingCoordinator();
        coord.setKey(GOOD, true);
        bmc.mint(buyer, 40_350_000 ether);
    }

    function _phase1(BMCIlluminatiPass pass) internal {
        vm.startPrank(buyer);
        bmc.approve(address(pass), type(uint256).max);
        for (uint256 i; i < 40; ++i) pass.mintGenesis();
        vm.stopPrank();
    }

    function test_MysteryMintOnUnregisteredLaneDoesNotBurn() public {
        BMCIlluminatiPass pass;
        try new BMCIlluminatiPass(address(this), address(bmc), address(coord), 1, BAD, 500_000, 3, true) returns (
            BMCIlluminatiPass p
        ) {
            pass = p;
        } catch {
            // A fix that validates the lane at configuration time also satisfies this test.
            return;
        }
        _phase1(pass);
        uint256 supply = bmc.totalSupply();
        uint256 balance = bmc.balanceOf(buyer);
        vm.prank(buyer);
        (bool ok,) = address(pass).call(abi.encodeWithSignature("mintMystery()"));
        assertFalse(ok, "mystery mint on an unregistered gas lane must not burn BMC");
        assertEq(bmc.totalSupply(), supply, "no BMC destroyed");
        assertEq(bmc.balanceOf(buyer), balance, "buyer keeps BMC");
        assertEq(pass.totalMinted(), 40, "no stranded pending token");
    }

    function test_MysteryMintOnRegisteredLaneStillWorks() public {
        BMCIlluminatiPass pass = new BMCIlluminatiPass(address(this), address(bmc), address(coord), 1, GOOD, 500_000, 3, true);
        _phase1(pass);
        vm.prank(buyer);
        (uint256 id, uint256 req) = pass.mintMystery();
        assertEq(id, 41);
        assertEq(coord.keyOfRequest(req), GOOD);
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
// The requested src/experimental contract is absent from this accepted checkout.
// This is the preserved production-contract fixture, bytecode-identical to upstream V3.
import {BMCIlluminatiPassCandidateV3 as V3} from "test/audit/fixtures/BMCIlluminatiPassCandidateV3.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {ERC20Burnable} from "@openzeppelin/contracts/token/ERC20/extensions/ERC20Burnable.sol";
import {VRFV2PlusClient} from "@chainlink/contracts/src/v0.8/vrf/dev/libraries/VRFV2PlusClient.sol";

contract LostSeedBMC is ERC20, ERC20Burnable {
    constructor(address buyer) ERC20("Proof BMC", "BMC") { _mint(buyer, 40_350_000 ether); }
}

/// @dev Models the off-chain service abandoning one request. Expiry is NOT a rule in
/// Chainlink's on-chain coordinator. Fresh requests can still be served normally.
contract LostSeedCoordinator {
    uint256 public nextId = 1;
    mapping(uint256 => address) public consumer;
    mapping(uint256 => uint256) public requestedAt;
    mapping(uint256 => bool) public dropped;
    function s_provingKeys(bytes32) external pure returns (bool, uint64) { return (true, 500 gwei); }
    function requestRandomWords(VRFV2PlusClient.RandomWordsRequest calldata) external returns (uint256 id) {
        id = nextId++;
        consumer[id] = msg.sender;
        requestedAt[id] = block.timestamp;
    }
    function abandon(uint256 id) external {
        require(block.timestamp >= requestedAt[id] + 1 days, "before service expiry");
        dropped[id] = true;
    }
    function deliver(uint256 id) external {
        require(!dropped[id], "service abandoned request");
        uint256[] memory words = new uint256[](1);
        words[0] = 42;
        V3(consumer[id]).rawFulfillRandomWords(id, words);
    }
}

contract V3LostSeedProof is Test {
    function test_MysteryBuyerMustBeAbleToRecoverAnAbandonedSeedWithoutAnotherBurn() public {
        vm.warp(1_800_000_000);
        address buyer = makeAddr("lost-seed buyer");
        LostSeedBMC bmc = new LostSeedBMC(buyer);
        LostSeedCoordinator coordinator = new LostSeedCoordinator();
        V3 pass = new V3(address(this), address(bmc), address(coordinator), uint64(block.timestamp + 30 days),
            1, keccak256("registered proof lane"), 150_000, 3, true,
            "bafybeihfihwwpev4gkqjuqawgtptsv3ynzsokclo6odsolvoa65aqaac2u");
        vm.startPrank(buyer);
        bmc.approve(address(pass), 40_350_000 ether);
        for (uint256 i; i < 40; ++i) pass.mintGenesis();
        pass.mintMystery();
        vm.stopPrank();
        vm.warp(pass.saleDeadline());
        uint256 first = pass.requestSeed();
        vm.warp(block.timestamp + 8 days);
        coordinator.abandon(first);
        vm.expectRevert(bytes("service abandoned request"));
        coordinator.deliver(first);

        // EXPECTED: a timeout recovery path submits a fresh request; no extra BMC is burned.
        // ACTUAL V3: requestSeed reverts "seed already requested" forever.
        (bool ok, bytes memory data) = address(pass).call(abi.encodeCall(pass.requestSeed, ()));
        assertTrue(ok, "H-1: one lost seed request permanently strands paid mystery NFTs");
        uint256 retry = abi.decode(data, (uint256));
        assertTrue(retry != first);
        coordinator.deliver(retry);
        assertEq(pass.finalizeReveals(1), 1);
        assertEq(pass.pendingReveals(), 0);
        assertEq(pass.totalBurned(), 40_350_000 ether);
        assertEq(bmc.totalSupply(), 0);
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {BMCIlluminatiPassCandidateV3 as V3} from "test/audit/fixtures/BMCIlluminatiPassCandidateV3.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {ERC20Burnable} from "@openzeppelin/contracts/token/ERC20/extensions/ERC20Burnable.sol";
import {VRFV2PlusClient} from "@chainlink/contracts/src/v0.8/vrf/dev/libraries/VRFV2PlusClient.sol";

contract CancelledSubscriptionBMC is ERC20, ERC20Burnable {
    constructor(address buyer) ERC20("Proof BMC", "BMC") { _mint(buyer, 40_350_000 ether); }
}

/// @dev Models pre-request subscription cancellation/replacement. Chainlink subscriptions
/// can be canceled before a seed request exists; registering a new subscription cannot revive its ID.
contract CancelledSubscriptionCoordinator {
    uint256 public activeSubscription = 1;
    uint256 public nextId = 1;
    mapping(uint256 => address) public consumer;
    function s_provingKeys(bytes32) external pure returns (bool, uint64) { return (true, 500 gwei); }
    function replaceSubscription() external { activeSubscription = 2; }
    function requestRandomWords(VRFV2PlusClient.RandomWordsRequest calldata req) external returns (uint256 id) {
        require(req.subId == activeSubscription, "InvalidSubscription");
        id = nextId++;
        consumer[id] = msg.sender;
    }
    function deliver(uint256 id) external {
        uint256[] memory words = new uint256[](1);
        words[0] = 42;
        V3(consumer[id]).rawFulfillRandomWords(id, words);
    }
}

contract V3CancelledSubscriptionProof is Test {
    function test_OwnerCanRepairCancelledSubscriptionBeforeAnySeedWasRequested() public {
        vm.warp(1_800_000_000);
        address buyer = makeAddr("cancelled-subscription buyer");
        CancelledSubscriptionBMC bmc = new CancelledSubscriptionBMC(buyer);
        CancelledSubscriptionCoordinator coordinator = new CancelledSubscriptionCoordinator();
        bytes32 key = keccak256("registered proof lane");
        V3 pass = new V3(address(this), address(bmc), address(coordinator), uint64(block.timestamp + 30 days),
            1, key, 150_000, 3, true,
            "bafybeihfihwwpev4gkqjuqawgtptsv3ynzsokclo6odsolvoa65aqaac2u");
        vm.startPrank(buyer);
        bmc.approve(address(pass), 40_350_000 ether);
        for (uint256 i; i < 40; ++i) pass.mintGenesis();
        pass.mintMystery();
        vm.stopPrank();
        coordinator.replaceSubscription();
        vm.warp(pass.saleDeadline());
        vm.expectRevert(bytes("InvalidSubscription"));
        pass.requestSeed();
        assertEq(pass.seedRequestId(), 0);

        // EXPECTED: owner repairs only future request parameters on the same coordinator.
        // ACTUAL: V3 has no operational repair function; burned BMC cannot be refunded.
        (bool ok,) = address(pass).call(abi.encodeWithSignature(
            "setVRFConfig(uint256,bytes32,uint32,uint16,bool)", uint256(2), key, uint32(150_000), uint16(3), true));
        assertTrue(ok, "H-2: canceled immutable subscription cannot be replaced after buyers burn");
        uint256 req = pass.requestSeed();
        coordinator.deliver(req);
        assertEq(pass.finalizeReveals(1), 1);
        assertEq(pass.pendingReveals(), 0);
        assertEq(pass.totalBurned(), 40_350_000 ether);
        assertEq(bmc.totalSupply(), 0);
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {BMCIlluminatiPassCandidateV3 as V3} from "test/audit/fixtures/BMCIlluminatiPassCandidateV3.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {ERC20Burnable} from "@openzeppelin/contracts/token/ERC20/extensions/ERC20Burnable.sol";
import {VRFV2PlusClient} from "@chainlink/contracts/src/v0.8/vrf/dev/libraries/VRFV2PlusClient.sol";

contract ProofBMC is ERC20, ERC20Burnable {
    constructor() ERC20("BMC", "BMC") {}

    function mint(address to, uint256 amount) external {
        _mint(to, amount);
    }
}

/// Coordinator stand-in modelling the documented oracle behaviour: an underfunded request is
/// dropped by the node after 24h and is never fulfilled; a new request must be made.
contract DroppingCoordinator {
    uint256 public nextId = 1000;
    mapping(uint256 => address) public consumerOf;
    mapping(uint256 => uint256) public requestedAt;
    mapping(bytes32 => bool) public keyExists;

    function registerKey(bytes32 key) external {
        keyExists[key] = true;
    }

    function s_provingKeys(bytes32 key) external view returns (bool, uint64) {
        return (keyExists[key], 500 gwei);
    }

    function requestRandomWords(VRFV2PlusClient.RandomWordsRequest calldata) external returns (uint256 id) {
        id = nextId++;
        consumerOf[id] = msg.sender;
        requestedAt[id] = block.timestamp;
    }

    /// Returns false (no delivery) once the request is older than the oracle's 24h window.
    function fulfill(uint256 id, uint256 word) external returns (bool ok) {
        require(consumerOf[id] != address(0), "unknown");
        if (block.timestamp >= requestedAt[id] + 1 days) return false;
        uint256[] memory words = new uint256[](1);
        words[0] = word;
        (ok,) = consumerOf[id].call(abi.encodeWithSignature("rawFulfillRandomWords(uint256,uint256[])", id, words));
    }
}

/// Fails on Candidate V3 as written: once the sole seed request is dropped, no caller can obtain a
/// replacement request and every mystery reveal is stranded while the BMC stays burned.
contract V3SoleRequestStallTest is Test {
    ProofBMC bmc;
    DroppingCoordinator coord;
    V3 pass;
    address buyer = makeAddr("buyer");
    bytes32 constant KEY = keccak256("lane");

    function setUp() public {
        vm.warp(1_800_000_000);
        bmc = new ProofBMC();
        coord = new DroppingCoordinator();
        coord.registerKey(KEY);
        pass = new V3(
            address(this), address(bmc), address(coord), uint64(block.timestamp + 7 days), 1, KEY, 150_000, 3, true, "cid"
        );
        bmc.mint(buyer, 40_350_000 ether);
        vm.startPrank(buyer);
        bmc.approve(address(pass), type(uint256).max);
        for (uint256 i; i < 40; ++i) pass.mintGenesis();
        pass.mintMystery();
        vm.stopPrank();
    }

    function test_DroppedSoleSeedRequestCanBeReplaced() public {
        vm.warp(pass.saleDeadline());
        uint256 first = pass.requestSeed();
        // Oracle drops the underfunded request after its 24h window.
        vm.warp(block.timestamp + 2 days);
        assertFalse(coord.fulfill(first, 1), "dropped request never delivers");
        assertFalse(pass.seedReceived());
        assertEq(pass.totalBurned(), 40_350_000 ether, "burn is irreversible");

        // Expected: some permissionless path yields a new request so reveals can complete.
        (bool ok, bytes memory ret) = address(pass).call(abi.encodeWithSignature("requestSeed()"));
        assertTrue(ok, "no way to obtain a replacement seed request: token 41 is pending forever");
        uint256 second = abi.decode(ret, (uint256));
        assertTrue(coord.fulfill(second, 7));
        assertEq(pass.finalizeReveals(1), 1);
        assertTrue(pass.tierOf(41) != V3.Tier.Pending);
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {BMCIlluminatiPassCandidateV3 as V3} from "test/audit/fixtures/BMCIlluminatiPassCandidateV3.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {ERC20Burnable} from "@openzeppelin/contracts/token/ERC20/extensions/ERC20Burnable.sol";
import {VRFV2PlusClient} from "@chainlink/contracts/src/v0.8/vrf/dev/libraries/VRFV2PlusClient.sol";

contract ProofBMC2 is ERC20, ERC20Burnable {
    constructor() ERC20("BMC", "BMC") {}

    function mint(address to, uint256 amount) external {
        _mint(to, amount);
    }
}

/// Coordinator stand-in with v2.5 semantics for the two failure modes: a cancelled subscription
/// reverts InvalidSubscription at request time; an unregistered proving key is reported by
/// s_provingKeys. Subscription 1 is cancelled after the sale; subscription 2 and key2 are valid.
contract RepairableCoordinator {
    error InvalidSubscription();

    uint256 public nextId = 1000;
    mapping(uint256 => bool) public subActive;
    mapping(bytes32 => bool) public keyExists;

    function setSub(uint256 id, bool active) external {
        subActive[id] = active;
    }

    function setKey(bytes32 key, bool exists) external {
        keyExists[key] = exists;
    }

    function s_provingKeys(bytes32 key) external view returns (bool, uint64) {
        return (keyExists[key], 500 gwei);
    }

    function requestRandomWords(VRFV2PlusClient.RandomWordsRequest calldata req) external returns (uint256 id) {
        if (!subActive[req.subId]) revert InvalidSubscription();
        id = nextId++;
    }
}

/// Fails on Candidate V3 as written: after buyers have burned BMC, the only subscription and lane
/// it can ever use are the constructor words. When that subscription is cancelled (or the lane
/// deregistered) there is no path to point future requests anywhere else, so reveals stall forever.
contract V3ImmutableLaneTest is Test {
    ProofBMC2 bmc;
    RepairableCoordinator coord;
    V3 pass;
    address owner = makeAddr("owner");
    address buyer = makeAddr("buyer");
    bytes32 constant KEY1 = keccak256("lane 1");
    bytes32 constant KEY2 = keccak256("lane 2");

    function setUp() public {
        vm.warp(1_800_000_000);
        bmc = new ProofBMC2();
        coord = new RepairableCoordinator();
        coord.setSub(1, true);
        coord.setKey(KEY1, true);
        pass = new V3(owner, address(bmc), address(coord), uint64(block.timestamp + 7 days), 1, KEY1, 150_000, 3, true, "cid");
        bmc.mint(buyer, 40_350_000 ether);
        vm.startPrank(buyer);
        bmc.approve(address(pass), type(uint256).max);
        for (uint256 i; i < 40; ++i) pass.mintGenesis();
        pass.mintMystery();
        vm.stopPrank();
    }

    function test_SubscriptionOrLaneCanBeRepairedBeforeSeedRequest() public {
        // Subscription 1 is cancelled and lane 1 deregistered after the burns; sub 2 / lane 2 are valid.
        coord.setSub(1, false);
        coord.setKey(KEY1, false);
        coord.setSub(2, true);
        coord.setKey(KEY2, true);
        vm.warp(pass.saleDeadline());
        vm.expectRevert();
        pass.requestSeed();
        assertEq(pass.totalBurned(), 40_350_000 ether, "burn is irreversible");

        // Expected: the owner (or a constrained operator role) can repoint future requests while no
        // seed has been received. V3 has no such function, so the seed can never be requested.
        vm.prank(owner);
        (bool ok,) = address(pass).call(
            abi.encodeWithSignature("setVRFConfig(uint256,bytes32,uint32,uint16,bool)", uint256(2), KEY2, uint32(150_000), uint16(3), true)
        );
        assertTrue(ok, "no way to replace a cancelled subscription or deregistered lane: reveals stall forever");
        uint256 req = pass.requestSeed();
        assertTrue(req != 0);
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
// The requested src/experimental contract is absent from this accepted checkout.
// This is the preserved production-contract fixture, bytecode-identical to upstream V3.
import {BMCIlluminatiPassCandidateV3 as V3} from "test/audit/fixtures/BMCIlluminatiPassCandidateV3.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {ERC20Burnable} from "@openzeppelin/contracts/token/ERC20/extensions/ERC20Burnable.sol";
import {VRFV2PlusClient} from "@chainlink/contracts/src/v0.8/vrf/dev/libraries/VRFV2PlusClient.sol";

contract LostSeedBMC is ERC20, ERC20Burnable {
    constructor(address buyer) ERC20("Proof BMC", "BMC") { _mint(buyer, 40_350_000 ether); }
}

/// @dev Models the off-chain service abandoning one request. Expiry is NOT a rule in
/// Chainlink's on-chain coordinator. Fresh requests can still be served normally.
contract LostSeedCoordinator {
    uint256 public nextId = 1;
    mapping(uint256 => address) public consumer;
    mapping(uint256 => uint256) public requestedAt;
    mapping(uint256 => bool) public dropped;
    function s_provingKeys(bytes32) external pure returns (bool, uint64) { return (true, 500 gwei); }
    function requestRandomWords(VRFV2PlusClient.RandomWordsRequest calldata) external returns (uint256 id) {
        id = nextId++;
        consumer[id] = msg.sender;
        requestedAt[id] = block.timestamp;
    }
    function abandon(uint256 id) external {
        require(block.timestamp >= requestedAt[id] + 1 days, "before service expiry");
        dropped[id] = true;
    }
    function deliver(uint256 id) external {
        require(!dropped[id], "service abandoned request");
        uint256[] memory words = new uint256[](1);
        words[0] = 42;
        V3(consumer[id]).rawFulfillRandomWords(id, words);
    }
}

contract V3LostSeedProof is Test {
    function test_MysteryBuyerMustBeAbleToRecoverAnAbandonedSeedWithoutAnotherBurn() public {
        vm.warp(1_800_000_000);
        address buyer = makeAddr("lost-seed buyer");
        LostSeedBMC bmc = new LostSeedBMC(buyer);
        LostSeedCoordinator coordinator = new LostSeedCoordinator();
        V3 pass = new V3(address(this), address(bmc), address(coordinator), uint64(block.timestamp + 30 days),
            1, keccak256("registered proof lane"), 150_000, 3, true,
            "bafybeihfihwwpev4gkqjuqawgtptsv3ynzsokclo6odsolvoa65aqaac2u");
        vm.startPrank(buyer);
        bmc.approve(address(pass), 40_350_000 ether);
        for (uint256 i; i < 40; ++i) pass.mintGenesis();
        pass.mintMystery();
        vm.stopPrank();
        vm.warp(pass.saleDeadline());
        uint256 first = pass.requestSeed();
        vm.warp(block.timestamp + 8 days);
        coordinator.abandon(first);
        vm.expectRevert(bytes("service abandoned request"));
        coordinator.deliver(first);

        // EXPECTED: a timeout recovery path submits a fresh request; no extra BMC is burned.
        // ACTUAL V3: requestSeed reverts "seed already requested" forever.
        (bool ok, bytes memory data) = address(pass).call(abi.encodeCall(pass.requestSeed, ()));
        assertTrue(ok, "H-1: one lost seed request permanently strands paid mystery NFTs");
        uint256 retry = abi.decode(data, (uint256));
        assertTrue(retry != first);
        coordinator.deliver(retry);
        assertEq(pass.finalizeReveals(1), 1);
        assertEq(pass.pendingReveals(), 0);
        assertEq(pass.totalBurned(), 40_350_000 ether);
        assertEq(bmc.totalSupply(), 0);
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {BMCIlluminatiPassCandidateV3 as V3} from "test/audit/fixtures/BMCIlluminatiPassCandidateV3.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {ERC20Burnable} from "@openzeppelin/contracts/token/ERC20/extensions/ERC20Burnable.sol";
import {VRFV2PlusClient} from "@chainlink/contracts/src/v0.8/vrf/dev/libraries/VRFV2PlusClient.sol";

contract CancelledSubscriptionBMC is ERC20, ERC20Burnable {
    constructor(address buyer) ERC20("Proof BMC", "BMC") { _mint(buyer, 40_350_000 ether); }
}

/// @dev Models pre-request subscription cancellation/replacement. Chainlink subscriptions
/// can be canceled before a seed request exists; registering a new subscription cannot revive its ID.
contract CancelledSubscriptionCoordinator {
    uint256 public activeSubscription = 1;
    uint256 public nextId = 1;
    mapping(uint256 => address) public consumer;
    function s_provingKeys(bytes32) external pure returns (bool, uint64) { return (true, 500 gwei); }
    function replaceSubscription() external { activeSubscription = 2; }
    function requestRandomWords(VRFV2PlusClient.RandomWordsRequest calldata req) external returns (uint256 id) {
        require(req.subId == activeSubscription, "InvalidSubscription");
        id = nextId++;
        consumer[id] = msg.sender;
    }
    function deliver(uint256 id) external {
        uint256[] memory words = new uint256[](1);
        words[0] = 42;
        V3(consumer[id]).rawFulfillRandomWords(id, words);
    }
}

contract V3CancelledSubscriptionProof is Test {
    function test_OwnerCanRepairCancelledSubscriptionBeforeAnySeedWasRequested() public {
        vm.warp(1_800_000_000);
        address buyer = makeAddr("cancelled-subscription buyer");
        CancelledSubscriptionBMC bmc = new CancelledSubscriptionBMC(buyer);
        CancelledSubscriptionCoordinator coordinator = new CancelledSubscriptionCoordinator();
        bytes32 key = keccak256("registered proof lane");
        V3 pass = new V3(address(this), address(bmc), address(coordinator), uint64(block.timestamp + 30 days),
            1, key, 150_000, 3, true,
            "bafybeihfihwwpev4gkqjuqawgtptsv3ynzsokclo6odsolvoa65aqaac2u");
        vm.startPrank(buyer);
        bmc.approve(address(pass), 40_350_000 ether);
        for (uint256 i; i < 40; ++i) pass.mintGenesis();
        pass.mintMystery();
        vm.stopPrank();
        coordinator.replaceSubscription();
        vm.warp(pass.saleDeadline());
        vm.expectRevert(bytes("InvalidSubscription"));
        pass.requestSeed();
        assertEq(pass.seedRequestId(), 0);

        // EXPECTED: owner repairs only future request parameters on the same coordinator.
        // ACTUAL: V3 has no operational repair function; burned BMC cannot be refunded.
        (bool ok,) = address(pass).call(abi.encodeWithSignature(
            "setVRFConfig(uint256,bytes32,uint32,uint16,bool)", uint256(2), key, uint32(150_000), uint16(3), true));
        assertTrue(ok, "H-2: canceled immutable subscription cannot be replaced after buyers burn");
        uint256 req = pass.requestSeed();
        coordinator.deliver(req);
        assertEq(pass.finalizeReveals(1), 1);
        assertEq(pass.pendingReveals(), 0);
        assertEq(pass.totalBurned(), 40_350_000 ether);
        assertEq(bmc.totalSupply(), 0);
    }
}