// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {PoolManager} from "v4-core/src/PoolManager.sol";
import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
import {IHooks} from "v4-core/src/interfaces/IHooks.sol";
import {Hooks} from "v4-core/src/libraries/Hooks.sol";
import {TickMath} from "v4-core/src/libraries/TickMath.sol";
import {PoolKey} from "v4-core/src/types/PoolKey.sol";
import {Currency, CurrencyLibrary} from "v4-core/src/types/Currency.sol";
import {ModifyLiquidityParams, SwapParams} from "v4-core/src/types/PoolOperation.sol";
import {BalanceDelta} from "v4-core/src/types/BalanceDelta.sol";
import {PoolSwapTest} from "v4-core/src/test/PoolSwapTest.sol";
import {PoolModifyLiquidityTest} from "v4-core/src/test/PoolModifyLiquidityTest.sol";
import {PrismRiotToken} from "src/PrismRiotToken.sol";
import {TreasuryFeeHook} from "src/TreasuryFeeHook.sol";
import {FeeTreasury} from "src/FeeTreasury.sol";

/// @dev ETH-specified swaps (buy exact ETH in, sell exact ETH out) have their 0.5% fixed in beforeSwap on
/// the *requested* amount. When the pool fills only part of it (price limit or liquidity exhausted) the
/// swapper still pays 0.5% of the full request: far more than 0.5% of the ETH leg the pool exchanged, and
/// on a sell the swapper can end up paying ETH net. README "Quote tick limits" promises the opposite.
contract HookPartialFillTest is Test {
    uint160 constant SQRT_PRICE_1_1 = 79228162514264337593543950336;
    uint24 constant POOL_FEE = 12500;
    int24 constant TICK_SPACING = 60;
    uint160 constant HOOK_FLAGS = Hooks.BEFORE_INITIALIZE_FLAG | Hooks.BEFORE_SWAP_FLAG | Hooks.AFTER_SWAP_FLAG
        | Hooks.BEFORE_SWAP_RETURNS_DELTA_FLAG | Hooks.AFTER_SWAP_RETURNS_DELTA_FLAG;

    address owner = makeAddr("owner");
    address factory = makeAddr("factory");
    address trader = makeAddr("trader");

    PoolManager manager;
    PrismRiotToken token;
    TreasuryFeeHook hook;
    FeeTreasury treasury;
    PoolSwapTest swapRouter;
    PoolModifyLiquidityTest lpRouter;
    PoolKey key;

    function setUp() public {
        manager = new PoolManager(address(this));
        vm.prank(factory);
        token = new PrismRiotToken();
        address at = address((uint160(uint256(keccak256("hook"))) & ~uint160(0x3FFF)) | HOOK_FLAGS);
        bytes memory creation = abi.encodePacked(
            type(TreasuryFeeHook).creationCode,
            abi.encode(IPoolManager(address(manager)), address(token), factory, owner)
        );
        vm.etch(at, creation);
        (bool ok, bytes memory runtime) = at.call("");
        require(ok, "hook constructor reverted");
        vm.etch(at, runtime);
        hook = TreasuryFeeHook(payable(at));
        treasury = new FeeTreasury(IPoolManager(address(manager)), owner);
        vm.startPrank(owner);
        hook.bindTreasury(payable(address(treasury)));
        treasury.bindHook(address(hook));
        vm.stopPrank();
        swapRouter = new PoolSwapTest(IPoolManager(address(manager)));
        lpRouter = new PoolModifyLiquidityTest(IPoolManager(address(manager)));
        key = PoolKey({
            currency0: CurrencyLibrary.ADDRESS_ZERO,
            currency1: Currency.wrap(address(token)),
            fee: POOL_FEE,
            tickSpacing: TICK_SPACING,
            hooks: IHooks(address(hook))
        });
        vm.prank(factory);
        manager.initialize(key, SQRT_PRICE_1_1);

        // A thin pool: liquidity only in [-60, +60] around 1:1, both sides.
        vm.startPrank(factory);
        token.approve(address(lpRouter), type(uint256).max);
        vm.deal(factory, 1_000 ether);
        lpRouter.modifyLiquidity{value: 10 ether}(
            key, ModifyLiquidityParams(-60, 60, int256(1e21), bytes32(0)), ""
        );
        vm.stopPrank();

        vm.deal(trader, 1_000 ether);
        vm.prank(factory);
        token.transfer(trader, 10_000_000 ether);
        vm.prank(trader);
        token.approve(address(swapRouter), type(uint256).max);
    }

    function swap(bool zeroForOne, int256 amountSpecified, uint160 limit, uint256 value)
        internal
        returns (BalanceDelta d)
    {
        vm.prank(trader);
        d = swapRouter.swap{value: value}(
            key,
            SwapParams({zeroForOne: zeroForOne, amountSpecified: amountSpecified, sqrtPriceLimitX96: limit}),
            PoolSwapTest.TestSettings(false, false),
            ""
        );
    }

    /// Buy with exact 100 ETH in: liquidity ends at tick -60, so the pool exchanges ~3 ETH, but the
    /// hook charged 0.5% of 100 ETH. README: "a partially filled swap pays 0.5% of the partial leg".
    function test_buyExactInput_partialFill_feeExceedsHalfPercentOfLeg() public {
        uint256 grossIn = 100 ether;
        BalanceDelta d = swap(true, -int256(grossIn), TickMath.MIN_SQRT_PRICE + 1, grossIn);
        uint256 paid = uint256(uint128(-d.amount0()));
        uint256 fee = treasury.totalIncome();
        uint256 leg = paid - fee;
        assertLt(leg, 10 ether, "the pool filled only a small part of the request");
        // What the brief and README promise: 0.5% of the ETH leg actually exchanged, rounded up.
        assertLe(fee, hook.feeOnLeg(leg), "fee must be 0.5% of the partial leg");
    }

    /// Sell with exact 100 ETH out: the pool can only pay ~3 ETH before tick +60, yet the hook asked for
    /// 100 ETH * 50 / 9950 ~ 0.5025 ETH of it. The seller still receives at most the pool's ETH minus
    /// the full fee, i.e. an effective fee far above 0.5%.
    function test_sellExactOutput_partialFill_feeExceedsHalfPercentOfLeg() public {
        uint256 wantOut = 100 ether;
        BalanceDelta d = swap(false, int256(wantOut), TickMath.MAX_SQRT_PRICE - 1, 0);
        int128 a0 = d.amount0();
        uint256 fee = treasury.totalIncome();
        assertGt(fee, 0);
        // The pool's ETH leg is what the swapper received plus the fee (when the swapper received ETH).
        uint256 received = a0 > 0 ? uint256(uint128(a0)) : 0;
        uint256 leg = received + fee;
        assertLe(fee, hook.feeOnLeg(leg), "fee must be 0.5% of the partial leg");
    }

    /// Sell with exact 1000 ETH out when the pool can pay ~3 ETH: the pool pays 2.995 ETH, the hook keeps
    /// 5.025 ETH (0.5% of the 1000 asked), so the seller's ETH delta is -2.03 ETH: the seller pays ETH
    /// *and* PRIO. (Without ETH attached the router cannot settle and the sell reverts outright.)
    function test_sellExactOutput_partialFill_sellerPaysEthNet() public {
        uint256 wantOut = 1_000 ether;
        uint256 prioBefore = token.balanceOf(trader);
        BalanceDelta d = swap(false, int256(wantOut), TickMath.MAX_SQRT_PRICE - 1, 10 ether);
        assertLt(token.balanceOf(trader), prioBefore, "PRIO was sold");
        assertGe(d.amount0(), 0, "a seller must never pay ETH");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {PrismRiotToken} from "src/PrismRiotToken.sol";
import {StakingVault} from "src/StakingVault.sol";

/// @dev Rewards that stream while `totalStaked == 0` are credited to nobody, stay counted in `rewardsOwed`
/// and can never be claimed, re-streamed or recovered: PRIO bought with fee income is locked forever.
contract VaultStrandedTest is Test {
    PrismRiotToken token;
    StakingVault vault;
    address owner = makeAddr("owner");
    address funder = makeAddr("funder");
    address alice = makeAddr("alice");

    function setUp() public {
        vm.warp(1_800_000_000);
        token = new PrismRiotToken();
        vault = new StakingVault(owner, address(token));
        vm.prank(owner);
        vault.setRewardFunder(funder);
        token.transfer(funder, 10_000 ether);
        token.transfer(alice, 1_000 ether);
        vm.prank(funder);
        token.approve(address(vault), type(uint256).max);
        vm.prank(alice);
        token.approve(address(vault), type(uint256).max);
    }

    /// The treasury funds 3000 PRIO over 30 days before anyone stakes (the launch order: fees come in,
    /// the executor buys PRIO, stakers arrive later). Alice stakes after 15 days and is the only staker
    /// for the rest of the period: she earns ~1500, the other ~1500 are stranded in the vault.
    function test_rewardsDuringZeroStakeAreStrandedForever() public {
        vm.prank(funder);
        vault.notifyReward(3_000 ether);
        skip(15 days);
        vm.prank(alice);
        vault.stake(100 ether);
        skip(30 days);
        vm.prank(alice);
        vault.exit();
        // Nobody holds a stake, nobody has an unclaimed reward, the stream is over.
        assertEq(vault.totalStaked(), 0);
        assertEq(vault.earned(alice), 0);
        assertGe(block.timestamp, vault.periodFinish());
        uint256 locked = token.balanceOf(address(vault));
        // Expected: every funded reward is either distributed or still distributable. Actual: ~1500 PRIO
        // sit in the vault, counted as owed, with no path that will ever pay or re-stream them.
        assertLt(locked, 1 ether, "funded rewards are stranded in the vault");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {PoolManager} from "v4-core/src/PoolManager.sol";
import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
import {IHooks} from "v4-core/src/interfaces/IHooks.sol";
import {Hooks} from "v4-core/src/libraries/Hooks.sol";
import {TickMath} from "v4-core/src/libraries/TickMath.sol";
import {PoolKey} from "v4-core/src/types/PoolKey.sol";
import {PoolIdLibrary} from "v4-core/src/types/PoolId.sol";
import {StateLibrary} from "v4-core/src/libraries/StateLibrary.sol";
import {Currency, CurrencyLibrary} from "v4-core/src/types/Currency.sol";
import {ModifyLiquidityParams, SwapParams} from "v4-core/src/types/PoolOperation.sol";
import {PoolSwapTest} from "v4-core/src/test/PoolSwapTest.sol";
import {PoolModifyLiquidityTest} from "v4-core/src/test/PoolModifyLiquidityTest.sol";
import {PrismRiotToken} from "src/PrismRiotToken.sol";
import {TreasuryFeeHook} from "src/TreasuryFeeHook.sol";
import {FeeTreasury} from "src/FeeTreasury.sol";
import {StakingVault} from "src/StakingVault.sol";
import {Arena} from "src/Arena.sol";

/// @dev `FeeTreasury.buyPrio(ethIn, ...)` deducts `ethIn` from `prioBudget` but settles only what the pool
/// actually took (`owed`). When the pool fills the order partially, `ethIn - owed` stays in the contract
/// outside every budget line and no function can ever move it.
contract TreasuryStrandedTest is Test {
    using PoolIdLibrary for PoolKey;

    uint160 constant SQRT_PRICE_1_1 = 79228162514264337593543950336;
    uint160 constant HOOK_FLAGS = Hooks.BEFORE_INITIALIZE_FLAG | Hooks.BEFORE_SWAP_FLAG | Hooks.AFTER_SWAP_FLAG
        | Hooks.BEFORE_SWAP_RETURNS_DELTA_FLAG | Hooks.AFTER_SWAP_RETURNS_DELTA_FLAG;

    address owner = makeAddr("owner");
    address factory = makeAddr("factory");
    address trader = makeAddr("trader");
    address executor = makeAddr("executor");

    PoolManager manager;
    PrismRiotToken token;
    TreasuryFeeHook hook;
    FeeTreasury treasury;
    StakingVault vault;
    Arena arena;
    PoolSwapTest swapRouter;
    PoolModifyLiquidityTest lpRouter;
    PoolKey key;

    function setUp() public {
        manager = new PoolManager(address(this));
        vm.prank(factory);
        token = new PrismRiotToken();
        address at = address((uint160(uint256(keccak256("hook"))) & ~uint160(0x3FFF)) | HOOK_FLAGS);
        bytes memory creation = abi.encodePacked(
            type(TreasuryFeeHook).creationCode,
            abi.encode(IPoolManager(address(manager)), address(token), factory, owner)
        );
        vm.etch(at, creation);
        (bool ok, bytes memory runtime) = at.call("");
        require(ok, "hook constructor reverted");
        vm.etch(at, runtime);
        hook = TreasuryFeeHook(payable(at));
        treasury = new FeeTreasury(IPoolManager(address(manager)), owner);
        vault = new StakingVault(owner, address(token));
        arena = new Arena(owner, address(token));
        vm.startPrank(owner);
        hook.bindTreasury(payable(address(treasury)));
        treasury.bindHook(address(hook));
        treasury.setPrio(address(token));
        treasury.setSinks(address(vault), address(arena), makeAddr("adapter"));
        treasury.setExecutor(executor);
        vault.setRewardFunder(address(treasury));
        vm.stopPrank();
        swapRouter = new PoolSwapTest(IPoolManager(address(manager)));
        lpRouter = new PoolModifyLiquidityTest(IPoolManager(address(manager)));
        key = PoolKey({
            currency0: CurrencyLibrary.ADDRESS_ZERO,
            currency1: Currency.wrap(address(token)),
            fee: 12500,
            tickSpacing: 60,
            hooks: IHooks(address(hook))
        });
        vm.prank(factory);
        manager.initialize(key, SQRT_PRICE_1_1);
        // Launch liquidity: PRIO only, below the current price, over the full range.
        int24 minTick = TickMath.minUsableTick(60);
        vm.startPrank(factory);
        token.approve(address(lpRouter), type(uint256).max);
        lpRouter.modifyLiquidity(key, ModifyLiquidityParams(minTick, 0, int256(1e22), bytes32(0)), "");
        vm.stopPrank();
        // Earn fees: a buyer sends 100 ETH; the hook collects 0.5% as a claim (manager held no ETH).
        vm.deal(trader, 1_000 ether);
        vm.startPrank(trader);
        swapRouter.swap{value: 100 ether}(
            key,
            SwapParams({zeroForOne: true, amountSpecified: -100 ether, sqrtPriceLimitX96: TickMath.MIN_SQRT_PRICE + 1}),
            PoolSwapTest.TestSettings(false, false),
            ""
        );
        vm.stopPrank();
        hook.redeemClaims(hook.pendingClaims());
        treasury.allocate();
        // The LP withdraws the wide position and leaves only a thin PRIO-only range right below the price:
        // the state of a pool whose liquidity is mostly gone when the executor buys.
        (, int24 tick,,) = _slot0();
        int24 upper = tick >= 0 ? (tick / 60) * 60 : -((-tick + 59) / 60) * 60;
        vm.startPrank(factory);
        lpRouter.modifyLiquidity(key, ModifyLiquidityParams(minTick, 0, -int256(1e22), bytes32(0)), "");
        lpRouter.modifyLiquidity(key, ModifyLiquidityParams(upper - 60, upper, int256(1e19), bytes32(0)), "");
        vm.stopPrank();
    }

    function _slot0() internal view returns (uint160 sqrtPriceX96, int24 tick, uint24 pf, uint24 lpf) {
        return StateLibrary.getSlot0(IPoolManager(address(manager)), key.toId());
    }

    function tracked() internal view returns (uint256) {
        return treasury.unallocated() + treasury.reserve() + treasury.imdBudget() + treasury.prioBudget()
            + treasury.ownerBudget();
    }

    function test_partialFillStrandsEthOutsideEveryBudget() public {
        uint256 budget = treasury.prioBudget();
        assertGt(budget, 0.01 ether, "there is PRIO budget to spend");
        assertEq(address(treasury).balance, tracked(), "fully accounted before the buy");
        vm.prank(owner);
        treasury.setMaxSpendPerSwap(budget);
        vm.prank(executor);
        treasury.buyPrio(budget, 1);
        assertEq(treasury.prioBudget(), 0, "the whole budget line was consumed");
        // Expected: every wei the treasury holds is in some budget line. Actual: the unfilled part of the
        // spend is held by the contract with no line and no withdrawal path.
        assertEq(address(treasury).balance, tracked(), "ETH outside every budget is stranded");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {PrismRiotToken} from "src/PrismRiotToken.sol";
import {Arena, IRoundOracle} from "src/Arena.sol";
import {OracleAdapter, IIntake} from "src/OracleAdapter.sol";
import {OracleAttestation} from "src/OracleAttestation.sol";

contract Intake is IIntake {
    Callback public lastCallback;

    function priceOf(bytes32, address) external pure returns (uint256) {
        return 0.5 ether;
    }

    function request(bytes32, bytes calldata, Callback calldata callback, address asset, uint256 amount)
        external
        payable
        returns (bytes32 requestId)
    {
        IERC20(asset).transferFrom(msg.sender, address(this), amount);
        lastCallback = callback;
        requestId = keccak256("intake-1");
    }

    function deliver(bytes memory data) external returns (bool ok) {
        (ok,) = lastCallback.target.call{gas: 200_000}(abi.encodePacked(lastCallback.selector, data));
    }
}

/// @dev `OracleAdapter.request` has no lower time bound. The executor may buy the answer before the
/// round's commit deadline; an answer issued inside the 5-minute tolerance is accepted and stored, and
/// anyone can read it and enter the still-open round with the winning choice.
contract OracleEarlyAnswerTest is Test {
    uint256 constant SIGNER_KEY = 0x59c6995e998f97a5a0044966f0945389dc9e86dae88c7a8412f4603b6b78690d;
    address constant SIGNER = 0x70997970C51812dc3A010C7d01b50e0d17dc79C8;
    bytes32 constant QUESTION = keccak256("round question");
    uint64 constant T0 = 1_800_000_000;

    PrismRiotToken token;
    PrismRiotToken imd;
    Arena arena;
    OracleAdapter adapter;
    Intake intake;
    address owner = makeAddr("owner");
    address executor = makeAddr("executor");
    address alice = makeAddr("alice");
    address attacker = makeAddr("attacker");

    function setUp() public {
        vm.warp(T0);
        token = new PrismRiotToken();
        imd = new PrismRiotToken();
        arena = new Arena(owner, address(token));
        adapter = new OracleAdapter(owner, SIGNER);
        intake = new Intake();
        imd.transfer(address(adapter), 10 ether);
        vm.startPrank(owner);
        arena.setOracle(IRoundOracle(address(adapter)));
        adapter.setIntake(IIntake(address(intake)));
        adapter.setAction(keccak256("oracle.request"));
        adapter.setPayment(address(imd), 0.5 ether);
        adapter.setCallbackConfigured(true);
        adapter.setExecutor(executor);
        adapter.setBudget(10 ether);
        vm.stopPrank();
        token.transfer(alice, 1_000 ether);
        token.transfer(attacker, 1_000 ether);
        vm.prank(alice);
        token.approve(address(arena), type(uint256).max);
        vm.prank(attacker);
        token.approve(address(arena), type(uint256).max);
        token.approve(address(arena), type(uint256).max);
        arena.fundPrizes(1_000 ether);
    }

    function attestation(uint256 answer, uint64 issuedAt) internal pure returns (OracleAttestation.Attestation memory a) {
        a = OracleAttestation.Attestation({
            requestId: keccak256("req-1"),
            chainId: 1,
            questionHash: QUESTION,
            answerType: OracleAttestation.ANSWER_UINT256,
            answer: abi.encode(answer),
            figure: 0,
            fromBlock: 1,
            toBlock: 2,
            blockHash: bytes32(uint256(1)),
            panelJobId: keccak256("job-1"),
            panelSize: 5,
            quorum: 4,
            agreed: 5,
            issuedAt: issuedAt,
            expiresAt: issuedAt + 1 days
        });
    }

    function test_answerBoughtBeforeCommitDeadlineIsPublicWhileCommitsAreOpen() public {
        uint64 commitDeadline = T0 + 1 hours;
        vm.startPrank(owner);
        uint256 id = arena.createRound(
            Arena.Mode.VaultRaid, 4, commitDeadline, commitDeadline + 1 hours, commitDeadline + 2 hours, 1_000 ether, 0, bytes32(0)
        );
        adapter.pinQuestion(id, QUESTION, 1, 5, 4, commitDeadline, "");
        vm.stopPrank();

        // Alice commits honestly to vault 1 early in the window.
        bytes32 saltA = keccak256("alice");
        bytes32 cA = arena.commitmentOf(id, alice, 1, saltA);
        vm.prank(alice);
        arena.enter(id, cA);

        // The operator requests the answer 10 minutes before commits close. Expected: refused until the
        // commit boundary. Actual: accepted and paid.
        vm.warp(commitDeadline - 10 minutes);
        vm.prank(executor);
        adapter.request(id);

        // The panel answers 4 minutes before the deadline; within tolerance, so the adapter stores it.
        vm.warp(commitDeadline - 4 minutes);
        OracleAttestation.Attestation memory a = attestation(2, uint64(block.timestamp)); // winning choice 3
        (uint8 v, bytes32 r, bytes32 s) = vm.sign(SIGNER_KEY, adapter.attestationDigest(a));
        bool delivered = intake.deliver(abi.encode(keccak256("intake-1"), a, abi.encodePacked(r, s, v)));
        assertTrue(delivered);
        assertTrue(adapter.resultOf(id).settled, "the answer is on chain while commits are still open");

        // Anyone reads it and enters with the winning choice before the deadline.
        uint8 winning = uint8(adapter.resultOf(id).answer % 4) + 1;
        bytes32 saltX = keccak256("attacker");
        bytes32 cX = arena.commitmentOf(id, attacker, winning, saltX);
        vm.prank(attacker);
        arena.enter(id, cX);

        vm.warp(commitDeadline + 1);
        vm.prank(alice);
        arena.reveal(id, 1, saltA);
        vm.prank(attacker);
        arena.reveal(id, winning, saltX);
        vm.warp(commitDeadline + 1 hours);
        arena.settle(id);
        vm.prank(attacker);
        arena.claim(id);
        // Expected: an answer cannot exist before the commit boundary, so the late entrant could not
        // know it. Actual: the attacker takes the whole 1000 PRIO prize.
        assertLt(token.balanceOf(attacker), 1_000 ether + 500 ether, "late entrant wins with a known answer");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {PrismRiotToken} from "src/PrismRiotToken.sol";
import {Arena, IRoundOracle} from "src/Arena.sol";

contract FixedOracle is IRoundOracle {
    uint256 public answer;

    constructor(uint256 answer_) {
        answer = answer_;
    }

    function resultOf(uint256) external view returns (Result memory r) {
        r.answer = answer;
        r.settled = true;
        r.issuedAt = uint64(block.timestamp);
    }

    function ISSUED_AT_TOLERANCE() external pure returns (uint64) {
        return 5 minutes;
    }
}

/// @dev The oracle a round settles against is read from `Arena.oracle` at settle time, not frozen in the
/// round. After every reveal is public the owner points `setOracle` at a contract returning the answer that
/// makes the owner's own wallet the winner, then settles. The round's rulesHash and deadlines were frozen;
/// the result source was not.
contract ArenaOracleSwapProof is Test {
    uint64 constant T0 = 1_800_000_000;

    PrismRiotToken token;
    Arena arena;
    address owner = makeAddr("owner");
    address alice = makeAddr("alice");
    address ownerWallet = makeAddr("ownerWallet");

    function setUp() public {
        vm.warp(T0);
        token = new PrismRiotToken();
        arena = new Arena(owner, address(token));
        address[2] memory players = [alice, ownerWallet];
        for (uint256 i; i < players.length; i++) {
            token.transfer(players[i], 1_000 ether);
            vm.prank(players[i]);
            token.approve(address(arena), 102 ether);
        }
        token.approve(address(arena), type(uint256).max);
        arena.fundPrizes(1_000 ether);
    }

    function test_ownerCannotPickTheWinnerAfterReveals() public {
        // The oracle bound when the round opens says answer 0 -> winning choice 1 (alice).
        FixedOracle honest = new FixedOracle(0);
        vm.prank(owner);
        arena.setOracle(IRoundOracle(address(honest)));
        uint64 commitDeadline = uint64(block.timestamp + 1 hours);
        vm.prank(owner);
        uint256 id = arena.createRound(
            Arena.Mode.FactionDuel, 2, commitDeadline, commitDeadline + 1 hours, commitDeadline + 2 hours, 500 ether, 0, keccak256("rules")
        );
        bytes32 salt = keccak256("s");
        bytes32 cAlice = arena.commitmentOf(id, alice, 1, salt);
        bytes32 cOwner = arena.commitmentOf(id, ownerWallet, 2, salt);
        vm.prank(alice);
        arena.enter(id, cAlice);
        vm.prank(ownerWallet);
        arena.enter(id, cOwner);
        vm.warp(commitDeadline);
        vm.prank(alice);
        arena.reveal(id, 1, salt);
        vm.prank(ownerWallet);
        arena.reveal(id, 2, salt);
        vm.warp(commitDeadline + 1 hours);

        // Every reveal is public. The owner swaps the result source for one that says answer 1 -> choice 2.
        FixedOracle rigged = new FixedOracle(1);
        vm.prank(owner);
        try arena.setOracle(IRoundOracle(address(rigged))) {} catch {}
        arena.settle(id);

        assertEq(arena.rounds(id).winningChoice, 1, "the round must settle against the oracle it opened with");
        assertEq(arena.payoutOf(id, alice), 100 ether + 500 ether, "alice won under the frozen rules");
        assertEq(arena.payoutOf(id, ownerWallet), 90 ether, "the owner's wallet was wrong");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {PoolManager} from "v4-core/src/PoolManager.sol";
import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
import {IHooks} from "v4-core/src/interfaces/IHooks.sol";
import {Hooks} from "v4-core/src/libraries/Hooks.sol";
import {TickMath} from "v4-core/src/libraries/TickMath.sol";
import {PoolKey} from "v4-core/src/types/PoolKey.sol";
import {Currency, CurrencyLibrary} from "v4-core/src/types/Currency.sol";
import {ModifyLiquidityParams, SwapParams} from "v4-core/src/types/PoolOperation.sol";
import {BalanceDelta} from "v4-core/src/types/BalanceDelta.sol";
import {PoolSwapTest} from "v4-core/src/test/PoolSwapTest.sol";
import {PoolModifyLiquidityTest} from "v4-core/src/test/PoolModifyLiquidityTest.sol";
import {PrismRiotToken} from "src/PrismRiotToken.sol";
import {TreasuryFeeHook} from "src/TreasuryFeeHook.sol";
import {FeeTreasury} from "src/FeeTreasury.sol";

/// @dev An ETH-specified swap that a price limit stops early pays 0.5% of the *specified* ETH, not of the
/// ETH leg the pool actually exchanged: beforeSwap quotes the fee on params.amountSpecified before the
/// pool runs. README "Quote tick limits" promises the partial leg.
contract HookPartialFillProof is Test {
    uint160 constant SQRT_PRICE_1_1 = 79228162514264337593543950336;
    uint24 constant POOL_FEE = 12500;
    int24 constant TICK_SPACING = 60;
    uint160 constant HOOK_FLAGS = Hooks.BEFORE_INITIALIZE_FLAG | Hooks.BEFORE_SWAP_FLAG | Hooks.AFTER_SWAP_FLAG
        | Hooks.BEFORE_SWAP_RETURNS_DELTA_FLAG | Hooks.AFTER_SWAP_RETURNS_DELTA_FLAG;

    address owner = makeAddr("owner");
    address factory = makeAddr("factory");
    address trader = makeAddr("trader");

    PoolManager manager;
    PrismRiotToken token;
    TreasuryFeeHook hook;
    FeeTreasury treasury;
    PoolSwapTest swapRouter;
    PoolModifyLiquidityTest lpRouter;
    PoolKey key;

    function setUp() public {
        manager = new PoolManager(address(this));
        vm.prank(factory);
        token = new PrismRiotToken();
        address at = address((uint160(uint256(keccak256("hook"))) & ~uint160(0x3FFF)) | HOOK_FLAGS);
        bytes memory creation = abi.encodePacked(
            type(TreasuryFeeHook).creationCode,
            abi.encode(IPoolManager(address(manager)), address(token), factory, owner)
        );
        vm.etch(at, creation);
        (bool ok, bytes memory runtime) = at.call("");
        require(ok, "hook constructor reverted");
        vm.etch(at, runtime);
        hook = TreasuryFeeHook(payable(at));
        treasury = new FeeTreasury(IPoolManager(address(manager)), owner);
        vm.startPrank(owner);
        hook.bindTreasury(payable(address(treasury)));
        treasury.bindHook(address(hook));
        vm.stopPrank();
        swapRouter = new PoolSwapTest(IPoolManager(address(manager)));
        lpRouter = new PoolModifyLiquidityTest(IPoolManager(address(manager)));
        key = PoolKey({
            currency0: CurrencyLibrary.ADDRESS_ZERO,
            currency1: Currency.wrap(address(token)),
            fee: POOL_FEE,
            tickSpacing: TICK_SPACING,
            hooks: IHooks(address(hook))
        });
        vm.prank(factory);
        manager.initialize(key, SQRT_PRICE_1_1);
        // Full-range liquidity, both sides.
        vm.startPrank(factory);
        token.approve(address(lpRouter), type(uint256).max);
        vm.deal(factory, 1_000_000 ether);
        lpRouter.modifyLiquidity{value: 100_000 ether}(
            key,
            ModifyLiquidityParams(
                TickMath.minUsableTick(TICK_SPACING), TickMath.maxUsableTick(TICK_SPACING), int256(10_000 ether), bytes32(0)
            ),
            ""
        );
        vm.stopPrank();
    }

    function test_partialFillBuyPaysFeeOnlyOnExchangedLeg() public {
        vm.deal(trader, 100 ether);
        uint256 grossIn = 10 ether;
        // Slippage protection one tick below the current price: the pool stops after a fraction of the input.
        uint160 limit = TickMath.getSqrtPriceAtTick(-1);
        vm.startPrank(trader);
        BalanceDelta d = swapRouter.swap{value: grossIn}(
            key,
            SwapParams({zeroForOne: true, amountSpecified: -int256(grossIn), sqrtPriceLimitX96: limit}),
            PoolSwapTest.TestSettings(false, false),
            ""
        );
        vm.stopPrank();
        uint256 ethPaid = uint256(uint128(-d.amount0()));
        uint256 feeCharged = hook.totalFeeCharged();
        uint256 poolLeg = ethPaid - feeCharged;
        assertLt(poolLeg, grossIn / 10, "the price limit left most of the input unswapped");
        // The brief and the README: 0.5% of the ETH the pool exchanged, rounded up to the next wei.
        assertLe(feeCharged, hook.feeOnLeg(poolLeg), "fee charged on ETH the pool never exchanged");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {PrismRiotToken} from "src/PrismRiotToken.sol";
import {Arena, IRoundOracle} from "src/Arena.sol";
import {OracleAdapter} from "src/OracleAdapter.sol";
import {OracleAttestation} from "src/OracleAttestation.sol";

/// @dev The adapter stores a result as soon as a signed attestation with issuedAt >= notBefore - 5 minutes
/// is relayed, and `submitAttestation` is permissionless. Nothing requires block.timestamp >= notBefore, so
/// the winning answer is readable on chain (ResultStored, resultOf) while the Arena still accepts entries.
contract EarlyResultProof is Test {
    uint256 constant SIGNER_KEY = 0x59c6995e998f97a5a0044966f0945389dc9e86dae88c7a8412f4603b6b78690d;
    address constant SIGNER = 0x70997970C51812dc3A010C7d01b50e0d17dc79C8;
    bytes32 constant QUESTION = keccak256("which vault holds the prism?");
    uint64 constant T0 = 1_800_000_000;

    PrismRiotToken token;
    Arena arena;
    OracleAdapter adapter;
    address owner = makeAddr("owner");
    address alice = makeAddr("alice");
    address sniper = makeAddr("sniper");

    function setUp() public {
        vm.warp(T0);
        token = new PrismRiotToken();
        arena = new Arena(owner, address(token));
        adapter = new OracleAdapter(owner, SIGNER);
        vm.prank(owner);
        arena.setOracle(IRoundOracle(address(adapter)));
        address[2] memory players = [alice, sniper];
        for (uint256 i; i < players.length; i++) {
            token.transfer(players[i], 1_000 ether);
            vm.prank(players[i]);
            token.approve(address(arena), 102 ether);
        }
        token.approve(address(arena), type(uint256).max);
        arena.fundPrizes(1_000 ether);
    }

    function attestation(uint256 answer, uint64 issuedAt) internal pure returns (OracleAttestation.Attestation memory a) {
        a = OracleAttestation.Attestation({
            requestId: keccak256(abi.encode("round", answer, issuedAt)),
            chainId: 1,
            questionHash: QUESTION,
            answerType: OracleAttestation.ANSWER_UINT256,
            answer: abi.encode(answer),
            figure: 0,
            fromBlock: 100,
            toBlock: 200,
            blockHash: bytes32(uint256(7)),
            panelJobId: bytes32(uint256(9)),
            panelSize: 5,
            quorum: 4,
            agreed: 5,
            issuedAt: issuedAt,
            expiresAt: issuedAt + 1 days
        });
    }

    function sign(OracleAttestation.Attestation memory a) internal view returns (bytes memory) {
        (uint8 v, bytes32 r, bytes32 s) = vm.sign(SIGNER_KEY, adapter.attestationDigest(a));
        return abi.encodePacked(r, s, v);
    }

    function test_resultCannotBeVisibleBeforeCommitDeadline() public {
        uint64 commitDeadline = uint64(block.timestamp + 1 hours);
        vm.startPrank(owner);
        adapter.pinQuestion(1, QUESTION, 1, 5, 4, commitDeadline, "");
        uint256 id = arena.createRound(
            Arena.Mode.VaultRaid, 4, commitDeadline, commitDeadline + 1 hours, commitDeadline + 2 hours, 500 ether, 0, keccak256("rules")
        );
        vm.stopPrank();
        assertEq(id, 1);
        bytes32 salt = keccak256("s");
        bytes32 cAlice = arena.commitmentOf(id, alice, 1, salt);
        vm.prank(alice);
        arena.enter(id, cAlice);

        // Five minutes before commits close, the panel's signed answer (2 -> winning choice 3) is relayed.
        // On the current code it is accepted and stored: anyone can read it and enter with choice 3
        // (see the sniper flow in the finding). The adapter must not expose a result before notBefore.
        vm.warp(commitDeadline - 5 minutes);
        OracleAttestation.Attestation memory early = attestation(2, uint64(block.timestamp));
        try adapter.submitAttestation(id, early, sign(early)) {} catch {}
        assertFalse(adapter.resultOf(id).settled, "answer stored and readable while entries are still open");

        // The honest flow: the same answer relayed once commits are closed settles the round normally.
        vm.warp(commitDeadline);
        OracleAttestation.Attestation memory onTime = attestation(2, uint64(block.timestamp));
        adapter.submitAttestation(id, onTime, sign(onTime));
        vm.prank(alice);
        arena.reveal(id, 1, salt);
        vm.warp(commitDeadline + 1 hours);
        arena.settle(id);
        assertEq(arena.rounds(id).winningChoice, 3);
        assertEq(arena.payoutOf(id, alice), 90 ether);
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {PoolManager} from "v4-core/src/PoolManager.sol";
import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
import {IHooks} from "v4-core/src/interfaces/IHooks.sol";
import {Hooks} from "v4-core/src/libraries/Hooks.sol";
import {TickMath} from "v4-core/src/libraries/TickMath.sol";
import {PoolKey} from "v4-core/src/types/PoolKey.sol";
import {PoolIdLibrary} from "v4-core/src/types/PoolId.sol";
import {StateLibrary} from "v4-core/src/libraries/StateLibrary.sol";
import {Currency, CurrencyLibrary} from "v4-core/src/types/Currency.sol";
import {ModifyLiquidityParams, SwapParams} from "v4-core/src/types/PoolOperation.sol";
import {PoolSwapTest} from "v4-core/src/test/PoolSwapTest.sol";
import {PoolModifyLiquidityTest} from "v4-core/src/test/PoolModifyLiquidityTest.sol";
import {PrismRiotToken} from "src/PrismRiotToken.sol";
import {TreasuryFeeHook} from "src/TreasuryFeeHook.sol";
import {FeeTreasury} from "src/FeeTreasury.sol";
import {StakingVault} from "src/StakingVault.sol";
import {Arena} from "src/Arena.sol";

contract StrandedEthProof is Test {
    using PoolIdLibrary for PoolKey;
    using StateLibrary for PoolManager;
    uint160 constant SQRT_PRICE_1_1 = 79228162514264337593543950336;
    uint24 constant POOL_FEE = 12500;
    int24 constant TICK_SPACING = 60;
    uint160 constant HOOK_FLAGS = Hooks.BEFORE_INITIALIZE_FLAG | Hooks.BEFORE_SWAP_FLAG | Hooks.AFTER_SWAP_FLAG
        | Hooks.BEFORE_SWAP_RETURNS_DELTA_FLAG | Hooks.AFTER_SWAP_RETURNS_DELTA_FLAG;

    address owner = makeAddr("owner");
    address factory = makeAddr("factory");
    address trader = makeAddr("trader");
    address executor = makeAddr("executor");

    PoolManager manager;
    PrismRiotToken token;
    TreasuryFeeHook hook;
    FeeTreasury treasury;
    StakingVault vault;
    Arena arena;
    PoolSwapTest swapRouter;
    PoolModifyLiquidityTest lpRouter;
    PoolKey key;

    function setUp() public {
        manager = new PoolManager(address(this));
        vm.prank(factory);
        token = new PrismRiotToken();
        address at = address((uint160(uint256(keccak256("hook"))) & ~uint160(0x3FFF)) | HOOK_FLAGS);
        bytes memory creation = abi.encodePacked(
            type(TreasuryFeeHook).creationCode,
            abi.encode(IPoolManager(address(manager)), address(token), factory, owner)
        );
        vm.etch(at, creation);
        (bool ok, bytes memory runtime) = at.call("");
        require(ok, "hook constructor reverted");
        vm.etch(at, runtime);
        hook = TreasuryFeeHook(payable(at));
        treasury = new FeeTreasury(IPoolManager(address(manager)), owner);
        vault = new StakingVault(owner, address(token));
        arena = new Arena(owner, address(token));
        vm.startPrank(owner);
        hook.bindTreasury(payable(address(treasury)));
        treasury.bindHook(address(hook));
        treasury.setPrio(address(token));
        treasury.setSinks(address(vault), address(arena), makeAddr("adapter"));
        treasury.setExecutor(executor);
        vault.setRewardFunder(address(treasury));
        vm.stopPrank();
        swapRouter = new PoolSwapTest(IPoolManager(address(manager)));
        lpRouter = new PoolModifyLiquidityTest(IPoolManager(address(manager)));
        key = PoolKey({
            currency0: CurrencyLibrary.ADDRESS_ZERO,
            currency1: Currency.wrap(address(token)),
            fee: POOL_FEE,
            tickSpacing: TICK_SPACING,
            hooks: IHooks(address(hook))
        });
        vm.prank(factory);
        manager.initialize(key, SQRT_PRICE_1_1);
        vm.startPrank(factory);
        token.approve(address(lpRouter), type(uint256).max);
        vm.deal(factory, 1_000_000 ether);
        lpRouter.modifyLiquidity{value: 100_000 ether}(
            key,
            ModifyLiquidityParams(
                TickMath.minUsableTick(TICK_SPACING), TickMath.maxUsableTick(TICK_SPACING), int256(10_000 ether), bytes32(0)
            ),
            ""
        );
        vm.stopPrank();
    }

    function test_budgetDebitedForEthNeverSpent() public {
        // Income on deep liquidity: 100 ETH buy -> ~0.5 ETH fee -> ~0.135 ETH PRIO budget.
        vm.deal(trader, 100 ether);
        vm.startPrank(trader);
        swapRouter.swap{value: 100 ether}(
            key,
            SwapParams({zeroForOne: true, amountSpecified: -int256(100 ether), sqrtPriceLimitX96: TickMath.MIN_SQRT_PRICE + 1}),
            PoolSwapTest.TestSettings(false, false),
            ""
        );
        vm.stopPrank();
        // The LP pulls the deep position and leaves a thin PRIO-only slice (about 0.03 ETH of capacity).
        vm.startPrank(factory);
        lpRouter.modifyLiquidity(
            key,
            ModifyLiquidityParams(
                TickMath.minUsableTick(TICK_SPACING), TickMath.maxUsableTick(TICK_SPACING), -int256(10_000 ether), bytes32(0)
            ),
            ""
        );
        (, int24 tick,,) = manager.getSlot0(key.toId());
        int24 upper = (tick / TICK_SPACING) * TICK_SPACING - TICK_SPACING;
        lpRouter.modifyLiquidity(key, ModifyLiquidityParams(upper - 600, upper, int256(1 ether), bytes32(0)), "");
        vm.stopPrank();
        treasury.allocate();
        uint256 budget = treasury.prioBudget();
        assertGt(budget, 0);
        uint256 balBefore = address(treasury).balance;
        vm.prank(executor);
        treasury.buyPrio(budget, 0);
        uint256 spent = balBefore - address(treasury).balance;
        emit log_named_uint("budget debited", budget);
        emit log_named_uint("eth actually spent", spent);
        uint256 tracked = treasury.reserve() + treasury.imdBudget() + treasury.prioBudget() + treasury.ownerBudget()
            + treasury.unallocated();
        emit log_named_uint("untracked eth", address(treasury).balance - tracked);
        assertEq(address(treasury).balance, tracked, "ETH left the budgets without leaving the contract");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {PoolManager} from "v4-core/src/PoolManager.sol";
import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
import {IHooks} from "v4-core/src/interfaces/IHooks.sol";
import {Hooks} from "v4-core/src/libraries/Hooks.sol";
import {TickMath} from "v4-core/src/libraries/TickMath.sol";
import {StateLibrary} from "v4-core/src/libraries/StateLibrary.sol";
import {PoolKey} from "v4-core/src/types/PoolKey.sol";
import {PoolId} from "v4-core/src/types/PoolId.sol";
import {Currency, CurrencyLibrary} from "v4-core/src/types/Currency.sol";
import {ModifyLiquidityParams, SwapParams} from "v4-core/src/types/PoolOperation.sol";
import {BalanceDelta} from "v4-core/src/types/BalanceDelta.sol";
import {PoolSwapTest} from "v4-core/src/test/PoolSwapTest.sol";
import {PoolModifyLiquidityTest} from "v4-core/src/test/PoolModifyLiquidityTest.sol";
import {PrismRiotToken} from "src/PrismRiotToken.sol";
import {TreasuryFeeHook} from "src/TreasuryFeeHook.sol";
import {FeeTreasury} from "src/FeeTreasury.sol";

/// @notice The hook's `beforeSwap` paths (buy with exact ETH in, sell with exact ETH out) compute the
/// 0.5% fee from `params.amountSpecified`, the amount the swapper *asked* for, not from the ETH the
/// pool actually exchanged. A swap that stops at its `sqrtPriceLimitX96` (a partial fill) therefore
/// pays 0.5% of the requested amount, which can be many times 0.5% of the real ETH leg. The README
/// ("Quote tick limits") promises the opposite: "a partially filled swap pays 0.5% of the partial leg".
contract PartialFillFeeTest is Test {
    using StateLibrary for IPoolManager;

    uint160 constant SQRT_PRICE_1_1 = 79228162514264337593543950336;
    uint24 constant POOL_FEE = 12500;
    int24 constant TICK_SPACING = 60;
    uint160 constant HOOK_FLAGS = Hooks.BEFORE_INITIALIZE_FLAG | Hooks.BEFORE_SWAP_FLAG | Hooks.AFTER_SWAP_FLAG
        | Hooks.BEFORE_SWAP_RETURNS_DELTA_FLAG | Hooks.AFTER_SWAP_RETURNS_DELTA_FLAG;

    address owner = makeAddr("owner");
    address factory = makeAddr("factory");
    address trader = makeAddr("trader");

    PoolManager manager;
    PrismRiotToken token;
    TreasuryFeeHook hook;
    FeeTreasury treasury;
    PoolSwapTest swapRouter;
    PoolModifyLiquidityTest lpRouter;
    PoolKey key;

    function setUp() public {
        manager = new PoolManager(address(this));
        vm.prank(factory);
        token = new PrismRiotToken();
        address at = address((uint160(uint256(keccak256("hook"))) & ~uint160(0x3FFF)) | HOOK_FLAGS);
        bytes memory creation = abi.encodePacked(
            type(TreasuryFeeHook).creationCode,
            abi.encode(IPoolManager(address(manager)), address(token), factory, owner)
        );
        vm.etch(at, creation);
        (bool ok, bytes memory runtime) = at.call("");
        require(ok, "hook constructor reverted");
        vm.etch(at, runtime);
        hook = TreasuryFeeHook(payable(at));
        treasury = new FeeTreasury(IPoolManager(address(manager)), owner);
        vm.startPrank(owner);
        hook.bindTreasury(payable(address(treasury)));
        treasury.bindHook(address(hook));
        treasury.setPrio(address(token));
        vm.stopPrank();
        swapRouter = new PoolSwapTest(IPoolManager(address(manager)));
        lpRouter = new PoolModifyLiquidityTest(IPoolManager(address(manager)));
        key = PoolKey({
            currency0: CurrencyLibrary.ADDRESS_ZERO,
            currency1: Currency.wrap(address(token)),
            fee: POOL_FEE,
            tickSpacing: TICK_SPACING,
            hooks: IHooks(address(hook))
        });
        vm.prank(factory);
        manager.initialize(key, SQRT_PRICE_1_1);

        // Full-range liquidity on both sides.
        vm.startPrank(factory);
        token.approve(address(lpRouter), type(uint256).max);
        vm.deal(factory, 1_000_000 ether);
        lpRouter.modifyLiquidity{value: 100_000 ether}(
            key,
            ModifyLiquidityParams(
                TickMath.minUsableTick(TICK_SPACING), TickMath.maxUsableTick(TICK_SPACING), int256(10_000 ether), 0
            ),
            ""
        );
        vm.stopPrank();

        vm.deal(trader, 1_000 ether);
        vm.prank(factory);
        token.transfer(trader, 10_000_000 ether);
        vm.prank(trader);
        token.approve(address(swapRouter), type(uint256).max);
    }

    function swap(bool zeroForOne, int256 amountSpecified, uint160 limit, uint256 value)
        internal
        returns (BalanceDelta d)
    {
        vm.prank(trader);
        d = swapRouter.swap{value: value}(
            key, SwapParams(zeroForOne, amountSpecified, limit), PoolSwapTest.TestSettings(false, false), ""
        );
    }

    /// @dev Buy with 10 ETH exact input but a price limit 0.001% below the current price: the pool
    /// exchanges only ~0.1 ETH, yet the hook keeps ceil(10e18 * 50 / 10050) ~ 0.0498 ETH, about 50% of
    /// the real leg instead of 0.5%.
    function test_buyExactInput_partialFill_feeIsNotHalfPercentOfTheLeg() public {
        // Sanity: an ordinary full fill works on this code.
        swap(true, -1 ether, TickMath.MIN_SQRT_PRICE + 1, 1 ether);
        uint256 chargedBefore = hook.totalFeeCharged();

        (uint160 sqrtPrice,,,) = IPoolManager(address(manager)).getSlot0(key.toId());
        uint160 limit = sqrtPrice - sqrtPrice / 100_000;
        uint256 grossIn = 10 ether;
        uint256 ethBefore = trader.balance;

        try this.doSwap(true, -int256(grossIn), limit, grossIn) returns (BalanceDelta d) {
            uint256 paid = ethBefore - trader.balance;
            assertEq(paid, uint256(uint128(-d.amount0())), "router charges the swapper the whole delta");
            uint256 fee = hook.totalFeeCharged() - chargedBefore;
            uint256 leg = paid - fee; // the ETH the pool itself exchanged
            assertLt(leg, grossIn / 10, "the fill was partial");
            // What the hook documents: 0.5% of the ETH leg the pool exchanged, rounded up.
            assertEq(fee, hook.feeOnLeg(leg), "fee must be 0.5% of the partial ETH leg, not of the requested input");
        } catch {
            // A hook that refuses partial fills instead of over-charging them is an acceptable repair.
        }
    }

    /// @dev Sell for 10 ETH exact output with a price limit just above the current price: the pool can
    /// pay out only part of it, the swapper receives far less than 10 ETH, and the hook still keeps
    /// ceil(10e18 * 50 / 9950) ~ 0.0503 ETH computed on the full 10 ETH.
    function test_sellExactOutput_partialFill_feeIsNotHalfPercentOfTheLeg() public {
        swap(false, int256(1 ether), TickMath.MAX_SQRT_PRICE - 1, 0);
        uint256 chargedBefore = hook.totalFeeCharged();

        (uint160 sqrtPrice,,,) = IPoolManager(address(manager)).getSlot0(key.toId());
        uint160 limit = sqrtPrice + sqrtPrice / 100_000;
        uint256 wantOut = 10 ether;
        uint256 ethBefore = trader.balance;

        try this.doSwap(false, int256(wantOut), limit, 0) returns (BalanceDelta d) {
            uint256 received = trader.balance - ethBefore;
            assertEq(received, uint256(uint128(d.amount0())));
            uint256 fee = hook.totalFeeCharged() - chargedBefore;
            uint256 leg = received + fee; // the ETH the pool itself paid out
            assertLt(received, wantOut / 10, "the fill was partial");
            assertEq(fee, hook.feeOnLeg(leg), "fee must be 0.5% of the partial ETH leg, not of the requested output");
        } catch {
            // Refusing the partial fill is an acceptable repair.
        }
    }

    function doSwap(bool zeroForOne, int256 amountSpecified, uint160 limit, uint256 value)
        external
        returns (BalanceDelta)
    {
        require(msg.sender == address(this));
        return swap(zeroForOne, amountSpecified, limit, value);
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {PoolManager} from "v4-core/src/PoolManager.sol";
import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
import {IHooks} from "v4-core/src/interfaces/IHooks.sol";
import {Hooks} from "v4-core/src/libraries/Hooks.sol";
import {TickMath} from "v4-core/src/libraries/TickMath.sol";
import {PoolKey} from "v4-core/src/types/PoolKey.sol";
import {Currency, CurrencyLibrary} from "v4-core/src/types/Currency.sol";
import {ModifyLiquidityParams, SwapParams} from "v4-core/src/types/PoolOperation.sol";
import {BalanceDelta} from "v4-core/src/types/BalanceDelta.sol";
import {PoolSwapTest} from "v4-core/src/test/PoolSwapTest.sol";
import {PoolModifyLiquidityTest} from "v4-core/src/test/PoolModifyLiquidityTest.sol";
import {PrismRiotToken} from "src/PrismRiotToken.sol";
import {TreasuryFeeHook} from "src/TreasuryFeeHook.sol";
import {FeeTreasury} from "src/FeeTreasury.sol";
import {StakingVault} from "src/StakingVault.sol";
import {Arena} from "src/Arena.sol";

/// @notice `FeeTreasury.buyPrio` debits `prioBudget` by the full `ethIn` before the swap, but
/// `unlockCallback` settles only `owed`, the ETH the pool actually took. When the hooked pool cannot
/// absorb `ethIn` (liquidity exhausted, the swap stops at MIN_SQRT_PRICE + 1), `owed < ethIn` and the
/// difference stays in the treasury without belonging to any budget line: no function can ever move it.
contract TreasuryStrandedTest is Test {
    uint160 constant SQRT_PRICE_1_1 = 79228162514264337593543950336;
    uint24 constant POOL_FEE = 12500;
    int24 constant TICK_SPACING = 60;
    uint160 constant HOOK_FLAGS = Hooks.BEFORE_INITIALIZE_FLAG | Hooks.BEFORE_SWAP_FLAG | Hooks.AFTER_SWAP_FLAG
        | Hooks.BEFORE_SWAP_RETURNS_DELTA_FLAG | Hooks.AFTER_SWAP_RETURNS_DELTA_FLAG;

    address owner = makeAddr("owner");
    address factory = makeAddr("factory");
    address trader = makeAddr("trader");
    address executor = makeAddr("executor");

    PoolManager manager;
    PrismRiotToken token;
    TreasuryFeeHook hook;
    FeeTreasury treasury;
    StakingVault vault;
    Arena arena;
    PoolSwapTest swapRouter;
    PoolModifyLiquidityTest lpRouter;
    PoolKey key;

    function setUp() public {
        manager = new PoolManager(address(this));
        vm.prank(factory);
        token = new PrismRiotToken();
        address at = address((uint160(uint256(keccak256("hook"))) & ~uint160(0x3FFF)) | HOOK_FLAGS);
        bytes memory creation = abi.encodePacked(
            type(TreasuryFeeHook).creationCode,
            abi.encode(IPoolManager(address(manager)), address(token), factory, owner)
        );
        vm.etch(at, creation);
        (bool ok, bytes memory runtime) = at.call("");
        require(ok, "hook constructor reverted");
        vm.etch(at, runtime);
        hook = TreasuryFeeHook(payable(at));
        treasury = new FeeTreasury(IPoolManager(address(manager)), owner);
        vault = new StakingVault(owner, address(token));
        arena = new Arena(owner, address(token));
        vm.startPrank(owner);
        hook.bindTreasury(payable(address(treasury)));
        treasury.bindHook(address(hook));
        treasury.setPrio(address(token));
        treasury.setSinks(address(vault), address(arena), makeAddr("adapter"));
        treasury.setExecutor(executor);
        vault.setRewardFunder(address(treasury));
        vm.stopPrank();
        swapRouter = new PoolSwapTest(IPoolManager(address(manager)));
        lpRouter = new PoolModifyLiquidityTest(IPoolManager(address(manager)));
        key = PoolKey({
            currency0: CurrencyLibrary.ADDRESS_ZERO,
            currency1: Currency.wrap(address(token)),
            fee: POOL_FEE,
            tickSpacing: TICK_SPACING,
            hooks: IHooks(address(hook))
        });
        vm.prank(factory);
        manager.initialize(key, SQRT_PRICE_1_1);

        // A launch-style seed: PRIO only, in one bounded range just below the opening price.
        vm.startPrank(factory);
        token.approve(address(lpRouter), type(uint256).max);
        lpRouter.modifyLiquidity(key, ModifyLiquidityParams(-600, 0, int256(2e20), 0), "");
        vm.stopPrank();

        vm.deal(trader, 1_000 ether);
        vm.prank(factory);
        token.transfer(trader, 10_000_000 ether);
        vm.prank(trader);
        token.approve(address(swapRouter), type(uint256).max);
    }

    function swap(bool zeroForOne, int256 amountSpecified, uint256 value) internal returns (BalanceDelta d) {
        vm.prank(trader);
        d = swapRouter.swap{value: value}(
            key,
            SwapParams(
                zeroForOne, amountSpecified, zeroForOne ? TickMath.MIN_SQRT_PRICE + 1 : TickMath.MAX_SQRT_PRICE - 1
            ),
            PoolSwapTest.TestSettings(false, false),
            ""
        );
    }

    function accounted() internal view returns (uint256) {
        return treasury.reserve() + treasury.imdBudget() + treasury.prioBudget() + treasury.ownerBudget()
            + treasury.unallocated();
    }

    function test_buyPrio_partialFill_strandsEthOutsideEveryBudget() public {
        // A buyer drains the seeded range: the pool absorbs ~6 ETH of the 100 requested, the hook earns
        // its fee, and the treasury has income to allocate.
        swap(true, -100 ether, 100 ether);
        // The pool was PRIO-only, so the first fee was minted as a claim; redeem it now that the manager holds ETH.
        if (hook.pendingClaims() > 0) hook.redeemClaims(hook.pendingClaims());
        treasury.allocate();
        uint256 budget = treasury.prioBudget();
        assertGt(budget, 0.05 ether, "there is a PRIO budget to spend");
        assertEq(address(treasury).balance, accounted(), "every wei is on a budget line before the buy");

        // A small sell re-opens a little buy-side capacity: far less than the PRIO budget.
        swap(false, -int256(0.02 ether), 0);

        vm.prank(executor);
        try treasury.buyPrio(budget, 1) returns (uint256 out) {
            assertGt(out, 0);
            assertEq(treasury.prioBudget(), 0, "the whole budget line was debited");
            // Every wei the treasury holds must belong to a budget line (reserve, IMD, PRIO, owner or
            // unallocated income). Here `ethIn - owed` belongs to none and can never be withdrawn or spent.
            assertEq(address(treasury).balance, accounted(), "unspent ETH of a partial fill is stranded");
        } catch {
            // Refusing the partial fill (hook or treasury) is an acceptable repair: nothing is stranded.
            assertEq(address(treasury).balance, accounted());
        }
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {PrismRiotToken} from "src/PrismRiotToken.sol";
import {Arena, IRoundOracle} from "src/Arena.sol";
import {OracleAdapter} from "src/OracleAdapter.sol";
import {OracleAttestation} from "src/OracleAttestation.sol";

/// @notice `OracleAdapter._accept` stores a result whenever `issuedAt + 5 minutes >= notBefore`, and
/// `submitAttestation` is permissionless with no on-chain time gate. An attestation issued inside the
/// last five minutes of the commit window is therefore stored and readable through `resultOf` while
/// `Arena.enter` is still open, so a late entrant commits the winning choice with certainty.
contract EarlyResultTest is Test {
    uint256 constant SIGNER_KEY = 0x59c6995e998f97a5a0044966f0945389dc9e86dae88c7a8412f4603b6b78690d;
    address constant SIGNER = 0x70997970C51812dc3A010C7d01b50e0d17dc79C8;
    bytes32 constant QUESTION = keccak256("round question");
    uint64 constant T0 = 1_800_000_000;

    PrismRiotToken token;
    Arena arena;
    OracleAdapter adapter;
    address owner = makeAddr("owner");
    address alice = makeAddr("alice");
    address mallory = makeAddr("mallory");

    function setUp() public {
        vm.warp(T0);
        token = new PrismRiotToken();
        arena = new Arena(owner, address(token));
        adapter = new OracleAdapter(owner, SIGNER);
        vm.prank(owner);
        arena.setOracle(IRoundOracle(address(adapter)));
        token.transfer(alice, 1_000 ether);
        token.transfer(mallory, 1_000 ether);
        vm.prank(alice);
        token.approve(address(arena), type(uint256).max);
        vm.prank(mallory);
        token.approve(address(arena), type(uint256).max);
        token.approve(address(arena), type(uint256).max);
        arena.fundPrizes(1_000 ether);
    }

    function test_resultStoredBeforeCommitDeadline_letsLateEntrantWin() public {
        uint64 commitDeadline = T0 + 1 hours;
        vm.startPrank(owner);
        uint256 id = arena.createRound(
            Arena.Mode.VaultRaid, 4, commitDeadline, commitDeadline + 1 hours, commitDeadline + 2 hours, 300 ether, 0, 0
        );
        adapter.pinQuestion(id, QUESTION, 1, 5, 4, commitDeadline, "");
        vm.stopPrank();

        // An honest player commits early, to choice 1.
        bytes32 saltA = keccak256("alice");
        bytes32 commitA = arena.commitmentOf(id, alice, 1, saltA);
        vm.prank(alice);
        arena.enter(id, commitA);

        // Four minutes before commits close, a correctly signed attestation issued now (answer 6, so the
        // winning choice is 6 % 4 + 1 = 3) is relayed by anyone.
        vm.warp(commitDeadline - 4 minutes);
        OracleAttestation.Attestation memory a = OracleAttestation.Attestation({
            requestId: keccak256("req"),
            chainId: 1,
            questionHash: QUESTION,
            answerType: OracleAttestation.ANSWER_UINT256,
            answer: abi.encode(uint256(6)),
            figure: 0,
            fromBlock: 1,
            toBlock: 2,
            blockHash: bytes32(uint256(1)),
            panelJobId: keccak256("job"),
            panelSize: 5,
            quorum: 4,
            agreed: 5,
            issuedAt: uint64(block.timestamp),
            expiresAt: uint64(block.timestamp + 1 days)
        });
        (uint8 v, bytes32 r, bytes32 s) = vm.sign(SIGNER_KEY, adapter.attestationDigest(a));
        try adapter.submitAttestation(id, a, abi.encodePacked(r, s, v)) {}
        catch {
            // The repaired adapter refuses to store a result before the round's commit boundary.
            return;
        }

        // The answer is now public while commits are still open: the attacker reads it and enters.
        OracleAdapter.Result memory res = adapter.resultOf(id);
        assertTrue(res.settled);
        uint8 winning = uint8(res.answer % 4) + 1;
        bytes32 saltM = keccak256("mallory");
        bytes32 commitM = arena.commitmentOf(id, mallory, winning, saltM);
        vm.prank(mallory);
        arena.enter(id, commitM);

        vm.warp(commitDeadline);
        vm.prank(alice);
        arena.reveal(id, 1, saltA);
        vm.prank(mallory);
        arena.reveal(id, winning, saltM);
        vm.warp(commitDeadline + 1 hours);
        arena.settle(id);
        vm.prank(mallory);
        arena.claim(id);

        // Mallory risked nothing and took the whole prize. A commit-reveal game must never let an entry
        // be placed after the result is readable on chain.
        assertLe(token.balanceOf(mallory), 1_000 ether, "an entrant who saw the stored result must not profit");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {PoolManager} from "v4-core/src/PoolManager.sol";
import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
import {IHooks} from "v4-core/src/interfaces/IHooks.sol";
import {Hooks} from "v4-core/src/libraries/Hooks.sol";
import {TickMath} from "v4-core/src/libraries/TickMath.sol";
import {StateLibrary} from "v4-core/src/libraries/StateLibrary.sol";
import {PoolKey} from "v4-core/src/types/PoolKey.sol";
import {Currency, CurrencyLibrary} from "v4-core/src/types/Currency.sol";
import {ModifyLiquidityParams, SwapParams} from "v4-core/src/types/PoolOperation.sol";
import {PoolSwapTest} from "v4-core/src/test/PoolSwapTest.sol";
import {PoolModifyLiquidityTest} from "v4-core/src/test/PoolModifyLiquidityTest.sol";
import {PrismRiotToken} from "src/PrismRiotToken.sol";
import {TreasuryFeeHook} from "src/TreasuryFeeHook.sol";
import {FeeTreasury} from "src/FeeTreasury.sol";

/// @notice Finding: on the two ETH-specified shapes (buy exact input, sell exact output) the hook computes
/// its fee in beforeSwap from `params.amountSpecified`, the amount the swapper *asked* for. When the swap's
/// `sqrtPriceLimitX96` stops the fill early, the pool exchanges less ETH than asked, but the fee stays
/// 0.5% of the requested amount, so the effective rate on the executed ETH leg is far above 0.5%. The
/// README states "a partially filled swap pays 0.5% of the partial leg"; this test shows it does not.
/// Expected: fee == ceil(0.5% of the ETH the pool exchanged) (+1 wei rounding at most).
/// Actual: fee == 0.5% of the full requested amount, ~10x the executed leg's fee in this scenario.
contract ProofPartialFillOverchargeTest is Test {
    using StateLibrary for IPoolManager;

    uint160 constant SQRT_PRICE_1_1 = 79228162514264337593543950336;
    uint160 constant FLAGS = Hooks.BEFORE_INITIALIZE_FLAG | Hooks.BEFORE_SWAP_FLAG | Hooks.AFTER_SWAP_FLAG
        | Hooks.BEFORE_SWAP_RETURNS_DELTA_FLAG | Hooks.AFTER_SWAP_RETURNS_DELTA_FLAG;

    address owner = makeAddr("owner");
    address factory = makeAddr("factory");
    address trader = makeAddr("trader");

    PoolManager manager;
    PrismRiotToken token;
    TreasuryFeeHook hook;
    FeeTreasury treasury;
    PoolSwapTest swapRouter;
    PoolModifyLiquidityTest lpRouter;
    PoolKey key;

    function setUp() public {
        manager = new PoolManager(address(this));
        vm.prank(factory);
        token = new PrismRiotToken();
        address at = address((uint160(uint256(keccak256("hook"))) & ~uint160(0x3FFF)) | FLAGS);
        bytes memory creation = abi.encodePacked(
            type(TreasuryFeeHook).creationCode,
            abi.encode(IPoolManager(address(manager)), address(token), factory, owner)
        );
        vm.etch(at, creation);
        (bool ok, bytes memory runtime) = at.call("");
        require(ok, "hook constructor reverted");
        vm.etch(at, runtime);
        hook = TreasuryFeeHook(payable(at));
        treasury = new FeeTreasury(IPoolManager(address(manager)), owner);
        vm.startPrank(owner);
        hook.bindTreasury(payable(address(treasury)));
        treasury.bindHook(address(hook));
        vm.stopPrank();
        swapRouter = new PoolSwapTest(IPoolManager(address(manager)));
        lpRouter = new PoolModifyLiquidityTest(IPoolManager(address(manager)));
        key = PoolKey(CurrencyLibrary.ADDRESS_ZERO, Currency.wrap(address(token)), 12500, 60, IHooks(at));
        vm.prank(factory);
        manager.initialize(key, SQRT_PRICE_1_1);

        vm.startPrank(factory);
        vm.deal(factory, 1_000_000 ether);
        token.approve(address(lpRouter), type(uint256).max);
        lpRouter.modifyLiquidity{value: 100_000 ether}(
            key,
            ModifyLiquidityParams(TickMath.minUsableTick(60), TickMath.maxUsableTick(60), 10_000 ether, bytes32(0)),
            ""
        );
        token.transfer(trader, 1_000_000 ether);
        vm.stopPrank();
        vm.deal(trader, 1_000 ether);
    }

    function swapLimited(bool zeroForOne, int256 amountSpecified, uint160 limit, uint256 value) internal {
        vm.startPrank(trader);
        token.approve(address(swapRouter), type(uint256).max);
        swapRouter.swap{value: value}(
            key,
            SwapParams({zeroForOne: zeroForOne, amountSpecified: amountSpecified, sqrtPriceLimitX96: limit}),
            PoolSwapTest.TestSettings(false, false),
            ""
        );
        vm.stopPrank();
    }

    function test_buyExactInput_partialFill_feeFollowsExecutedLeg() public {
        (uint160 price,,,) = IPoolManager(address(manager)).getSlot0(key.toId());
        uint256 ethBefore = trader.balance;
        // Ask to spend 100 ETH but only allow the price to move 0.1%: the pool takes ~10 ETH.
        swapLimited(true, -100 ether, price - price / 1000, 100 ether);
        uint256 paid = ethBefore - trader.balance;
        uint256 fee = treasury.totalIncome();
        uint256 executedLeg = paid - fee;
        assertLt(executedLeg, 20 ether, "the fill was partial");
        // 0.5% of the executed ETH leg, rounded up, allowing the one-wei self-consistency rounding.
        assertLe(fee, hook.feeOnLeg(executedLeg) + 1, "fee must be 0.5% of the ETH the pool exchanged");
    }

    function test_sellExactOutput_partialFill_feeFollowsExecutedLeg() public {
        (uint160 price,,,) = IPoolManager(address(manager)).getSlot0(key.toId());
        uint256 ethBefore = trader.balance;
        // Ask for 100 ETH out but only allow the price to move 0.1%: the pool pays ~10 ETH.
        swapLimited(false, int256(100 ether), price + price / 1000, 0);
        uint256 received = trader.balance - ethBefore;
        uint256 fee = treasury.totalIncome();
        uint256 executedLeg = received + fee;
        assertLt(executedLeg, 20 ether, "the fill was partial");
        assertLe(fee, hook.feeOnLeg(executedLeg) + 1, "fee must be 0.5% of the ETH the pool exchanged");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {PrismRiotToken} from "src/PrismRiotToken.sol";
import {Arena, IRoundOracle} from "src/Arena.sol";
import {OracleAdapter} from "src/OracleAdapter.sol";

/// @dev An "oracle" the owner controls: it reports whatever answer the owner wants for any round.
contract OwnerOracle is IRoundOracle {
    uint256 public answer;

    function set(uint256 a) external {
        answer = a;
    }

    function resultOf(uint256) external view returns (Result memory r) {
        r.answer = answer;
        r.settled = true;
        r.issuedAt = uint64(block.timestamp);
    }

    function ISSUED_AT_TOLERANCE() external pure returns (uint64) {
        return 5 minutes;
    }
}

/// @notice Finding: `Arena.setOracle` has no restriction while rounds are open, so the result source of a
/// round that players have already paid into can be replaced after their commitments are in. The brief
/// freezes "rules, deadlines, maximum loss and funded prizes before entry" and says active rules cannot
/// change; the oracle that decides the winning choice is the most consequential of those rules.
/// Expected: a round settles only through the oracle it was created with (or setOracle is refused while
/// any round is open). Actual: the owner points the Arena at a contract of their own and settles the
/// open round with an answer of their choosing, taking the prize from the players who chose correctly.
contract ProofOracleSwapMidRoundTest is Test {
    address constant SIGNER = 0x70997970C51812dc3A010C7d01b50e0d17dc79C8;
    uint64 constant T0 = 1_800_000_000;

    PrismRiotToken token;
    Arena arena;
    OracleAdapter adapter;
    address owner = makeAddr("owner");
    address alice = makeAddr("alice");

    function setUp() public {
        vm.warp(T0);
        token = new PrismRiotToken();
        arena = new Arena(owner, address(token));
        adapter = new OracleAdapter(owner, SIGNER);
        vm.prank(owner);
        arena.setOracle(IRoundOracle(address(adapter)));
        token.approve(address(arena), 1_000 ether);
        arena.fundPrizes(1_000 ether);
        token.transfer(alice, 102 ether);
    }

    function test_openRoundCannotBeSettledByAnOracleInstalledAfterEntries() public {
        uint64 commitDeadline = T0 + 1 hours;
        vm.prank(owner);
        uint256 id = arena.createRound(
            Arena.Mode.FactionDuel, 2, commitDeadline, commitDeadline + 1 hours, commitDeadline + 2 hours, 500 ether, 0, 0
        );
        // Alice commits to faction 2 and reveals it.
        bytes32 salt = keccak256("salt");
        bytes32 c = arena.commitmentOf(id, alice, 2, salt);
        vm.startPrank(alice);
        token.approve(address(arena), 102 ether);
        arena.enter(id, c);
        vm.stopPrank();
        vm.warp(commitDeadline);
        vm.prank(alice);
        arena.reveal(id, 2, salt);
        vm.warp(commitDeadline + 1 hours);

        // The owner swaps the oracle under the open round and makes faction 1 win: alice loses 10 PRIO and
        // the 500 PRIO prize goes back to the pool the owner allocates.
        OwnerOracle mine = new OwnerOracle();
        mine.set(0); // 0 % 2 + 1 = 1
        vm.prank(owner);
        try arena.setOracle(IRoundOracle(address(mine))) {} catch {}
        try arena.settle(id) {} catch {}

        Arena.Round memory r = arena.rounds(id);
        assertTrue(
            r.state != Arena.RoundState.Settled || r.winningChoice == 0,
            "an open round was settled through an oracle installed after players had paid in"
        );
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {PoolManager} from "v4-core/src/PoolManager.sol";
import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
import {IHooks} from "v4-core/src/interfaces/IHooks.sol";
import {Hooks} from "v4-core/src/libraries/Hooks.sol";
import {TickMath} from "v4-core/src/libraries/TickMath.sol";
import {PoolKey} from "v4-core/src/types/PoolKey.sol";
import {Currency, CurrencyLibrary} from "v4-core/src/types/Currency.sol";
import {ModifyLiquidityParams, SwapParams} from "v4-core/src/types/PoolOperation.sol";
import {BalanceDelta} from "v4-core/src/types/BalanceDelta.sol";
import {PoolSwapTest} from "v4-core/src/test/PoolSwapTest.sol";
import {PoolModifyLiquidityTest} from "v4-core/src/test/PoolModifyLiquidityTest.sol";
import {PrismRiotToken} from "src/PrismRiotToken.sol";
import {TreasuryFeeHook} from "src/TreasuryFeeHook.sol";
import {FeeTreasury} from "src/FeeTreasury.sol";

/// @dev A swap that stops at the swapper's sqrtPriceLimitX96 (a partial fill, which v4 allows without
/// reverting) still pays the hook fee that beforeSwap computed on the *requested* ETH amount. The fee is then
/// far above 0.5% of the ETH the pool actually exchanged. Fails on the current code; passes once the fee
/// charged is 0.5% of the actual ETH leg (within 1 wei of rounding) on every swap shape.
contract PartialFillOverchargeTest is Test {
    uint160 constant SQRT_PRICE_1_1 = 79228162514264337593543950336;
    uint24 constant POOL_FEE = 12500;
    int24 constant TICK_SPACING = 60;
    uint160 constant HOOK_FLAGS = Hooks.BEFORE_INITIALIZE_FLAG | Hooks.BEFORE_SWAP_FLAG | Hooks.AFTER_SWAP_FLAG
        | Hooks.BEFORE_SWAP_RETURNS_DELTA_FLAG | Hooks.AFTER_SWAP_RETURNS_DELTA_FLAG;

    address owner = makeAddr("owner");
    address factory = makeAddr("factory");
    address trader = makeAddr("trader");

    PoolManager manager;
    PrismRiotToken token;
    TreasuryFeeHook hook;
    FeeTreasury treasury;
    PoolSwapTest swapRouter;
    PoolModifyLiquidityTest lpRouter;
    PoolKey key;

    function setUp() public {
        manager = new PoolManager(address(this));
        vm.prank(factory);
        token = new PrismRiotToken();
        address at = address((uint160(uint256(keccak256("hook"))) & ~uint160(0x3FFF)) | HOOK_FLAGS);
        bytes memory creation = abi.encodePacked(
            type(TreasuryFeeHook).creationCode, abi.encode(IPoolManager(address(manager)), address(token), factory, owner)
        );
        vm.etch(at, creation);
        (bool ok, bytes memory runtime) = at.call("");
        require(ok, "hook constructor reverted");
        vm.etch(at, runtime);
        hook = TreasuryFeeHook(payable(at));
        treasury = new FeeTreasury(IPoolManager(address(manager)), owner);
        vm.startPrank(owner);
        hook.bindTreasury(payable(address(treasury)));
        treasury.bindHook(address(hook));
        vm.stopPrank();
        swapRouter = new PoolSwapTest(IPoolManager(address(manager)));
        lpRouter = new PoolModifyLiquidityTest(IPoolManager(address(manager)));
        key = PoolKey(CurrencyLibrary.ADDRESS_ZERO, Currency.wrap(address(token)), POOL_FEE, TICK_SPACING, IHooks(at));
        vm.prank(factory);
        manager.initialize(key, SQRT_PRICE_1_1);

        vm.startPrank(factory);
        token.approve(address(lpRouter), type(uint256).max);
        vm.deal(factory, 1_000_000 ether);
        lpRouter.modifyLiquidity{value: 100_000 ether}(
            key,
            ModifyLiquidityParams(
                TickMath.minUsableTick(TICK_SPACING), TickMath.maxUsableTick(TICK_SPACING), 10_000 ether, bytes32(0)
            ),
            ""
        );
        token.transfer(trader, 10_000_000 ether);
        vm.stopPrank();
        vm.deal(trader, 1_000 ether);
    }

    function swapWithLimit(bool zeroForOne, int256 amountSpecified, uint160 limit, uint256 value)
        internal
        returns (BalanceDelta d)
    {
        vm.startPrank(trader);
        token.approve(address(swapRouter), type(uint256).max);
        d = swapRouter.swap{value: value}(
            key, SwapParams(zeroForOne, amountSpecified, limit), PoolSwapTest.TestSettings(false, false), ""
        );
        vm.stopPrank();
    }

    /// Buy with exact ETH input 100 ETH, price limit ~1% below spot: the pool takes only part of the input.
    function test_buyExactInput_partialFill_feeIsOnActualLeg() public {
        uint256 grossIn = 100 ether;
        uint160 limit = uint160((uint256(SQRT_PRICE_1_1) * 995) / 1000);
        BalanceDelta d = swapWithLimit(true, -int256(grossIn), limit, grossIn);
        uint256 paid = uint256(uint128(-d.amount0()));
        uint256 fee = treasury.totalIncome();
        uint256 leg = paid - fee;
        assertLt(paid, grossIn, "the swap was only partially filled");
        // The brief: 0.5% of the ETH the pool exchanged, rounded up. Allow 1 wei of rounding.
        assertLe(fee, hook.feeOnLeg(leg) + 1, "fee must be 0.5% of the actual ETH leg, not of the requested input");
    }

    /// Sell with exact ETH output 50 ETH, price limit ~1% above spot: the pool pays out only part of it.
    function test_sellExactOutput_partialFill_feeIsOnActualLeg() public {
        uint256 wantOut = 50 ether;
        uint160 limit = uint160((uint256(SQRT_PRICE_1_1) * 1005) / 1000);
        uint256 before = trader.balance;
        BalanceDelta d = swapWithLimit(false, int256(wantOut), limit, 0);
        uint256 received = trader.balance - before;
        uint256 fee = treasury.totalIncome();
        uint256 leg = received + fee;
        assertLt(uint256(uint128(d.amount0())), wantOut, "the swap was only partially filled");
        assertLe(fee, hook.feeOnLeg(leg) + 1, "fee must be 0.5% of the actual ETH leg, not of the requested output");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {PrismRiotToken} from "src/PrismRiotToken.sol";
import {StakingVault} from "src/StakingVault.sol";

/// @dev Rewards stream by wall clock whether or not anyone is staked. With `totalStaked == 0` the
/// `rewardPerToken` accumulator does not move, so every wei streamed in that window belongs to nobody,
/// stays counted in `rewardsOwed` forever and has no recovery path. Fails now; passes once streaming
/// pauses while nothing is staked, or the unearned part is re-queued or recoverable by the funder.
contract StakingStrandedTest is Test {
    PrismRiotToken token;
    StakingVault vault;
    address owner = makeAddr("owner");
    address funder = makeAddr("funder");
    address alice = makeAddr("alice");

    function setUp() public {
        token = new PrismRiotToken();
        vault = new StakingVault(owner, address(token));
        vm.prank(owner);
        vault.setRewardFunder(funder);
        token.transfer(alice, 1_000 ether);
        token.transfer(funder, 10_000 ether);
        vm.prank(alice);
        token.approve(address(vault), type(uint256).max);
        vm.prank(funder);
        token.approve(address(vault), type(uint256).max);
    }

    function test_rewardsStreamedWithNoStakersAreLostForever() public {
        // The treasury's first PRIO purchase funds the vault before anyone has staked.
        vm.prank(funder);
        vault.notifyReward(3_000 ether);
        skip(15 days); // half the stream passes with totalStaked == 0

        vm.prank(alice);
        vault.stake(100 ether);
        skip(30 days); // well past periodFinish
        vm.prank(alice);
        vault.exit();

        uint256 paid = token.balanceOf(alice) - 1_000 ether;
        uint256 stranded = token.balanceOf(address(vault)); // nothing is staked any more
        // Every funded reward must be claimable by someone or recoverable; nothing may be stranded
        // (allow dust from fixed-point rounding).
        assertLe(stranded, 1e9, "half the funded rewards are stranded with no stakers and no recovery path");
        assertGe(paid, 3_000 ether - 1e9);
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {PrismRiotToken} from "src/PrismRiotToken.sol";
import {Arena, IRoundOracle} from "src/Arena.sol";
import {OracleAdapter} from "src/OracleAdapter.sol";
import {OracleAttestation} from "src/OracleAttestation.sol";

/// @dev The adapter stores a result as soon as `issuedAt + 5 min >= notBefore`, with no check that the
/// commit deadline has passed on chain. An attestation issued 5 minutes before the commit deadline is
/// accepted at once, the answer is public in `resultOf`, and anyone still inside the commit window
/// enters the winning choice. Fails now; passes once a result cannot be stored (or read as settled)
/// before the round's commit deadline.
contract EarlyResultLeakTest is Test {
    uint256 constant SIGNER_KEY = 0x59c6995e998f97a5a0044966f0945389dc9e86dae88c7a8412f4603b6b78690d;
    address constant SIGNER = 0x70997970C51812dc3A010C7d01b50e0d17dc79C8;
    bytes32 constant QUESTION = keccak256("round question");

    PrismRiotToken token;
    Arena arena;
    OracleAdapter adapter;
    address owner = makeAddr("owner");
    address honest = makeAddr("honest");
    address sniper = makeAddr("sniper");

    function setUp() public {
        vm.warp(1_800_000_000);
        token = new PrismRiotToken();
        arena = new Arena(owner, address(token));
        adapter = new OracleAdapter(owner, SIGNER);
        vm.prank(owner);
        arena.setOracle(IRoundOracle(address(adapter)));
        token.transfer(honest, 1_000 ether);
        token.transfer(sniper, 1_000 ether);
        vm.prank(honest);
        token.approve(address(arena), 102 ether);
        vm.prank(sniper);
        token.approve(address(arena), 102 ether);
        token.approve(address(arena), 1_000 ether);
        arena.fundPrizes(1_000 ether);
    }

    function test_resultStoredBeforeCommitDeadlineIsReadable() public {
        uint64 commitDeadline = uint64(block.timestamp + 1 hours);
        vm.startPrank(owner);
        uint256 id = arena.createRound(
            Arena.Mode.VaultRaid, 4, commitDeadline, commitDeadline + 1 hours, commitDeadline + 2 hours, 300 ether, 0, 0
        );
        adapter.pinQuestion(id, QUESTION, 1, 5, 4, commitDeadline, "");
        vm.stopPrank();

        bytes32 cH = arena.commitmentOf(id, honest, 1, keccak256("h"));
        vm.prank(honest);
        arena.enter(id, cH);

        // Five minutes before commits close, an attestation issued at exactly commitDeadline - 5 min arrives.
        vm.warp(commitDeadline - 5 minutes);
        OracleAttestation.Attestation memory a = OracleAttestation.Attestation({
            requestId: keccak256("req"),
            chainId: 1,
            questionHash: QUESTION,
            answerType: OracleAttestation.ANSWER_UINT256,
            answer: abi.encode(uint256(6)), // 6 % 4 + 1 = 3
            figure: 0,
            fromBlock: 1,
            toBlock: 2,
            blockHash: bytes32(uint256(1)),
            panelJobId: keccak256("job"),
            panelSize: 5,
            quorum: 4,
            agreed: 5,
            issuedAt: commitDeadline - 5 minutes,
            expiresAt: uint64(block.timestamp + 1 days)
        });
        (uint8 v, bytes32 r, bytes32 s) = vm.sign(SIGNER_KEY, adapter.attestationDigest(a));
        try adapter.submitAttestation(id, a, abi.encodePacked(r, s, v)) {} catch {}

        // Before the commit deadline no round result may be visible as settled.
        assertFalse(adapter.resultOf(id).settled, "result readable before the commit deadline");

        // What the sniper does with it on the current code: read the answer and enter the winning choice.
        uint8 winning = uint8(adapter.resultOf(id).answer % 4) + 1;
        bytes32 cS = arena.commitmentOf(id, sniper, winning, keccak256("s"));
        vm.prank(sniper);
        arena.enter(id, cS);
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {PrismRiotToken} from "src/PrismRiotToken.sol";
import {Arena, IRoundOracle} from "src/Arena.sol";
import {OracleAdapter} from "src/OracleAdapter.sol";
import {OracleAttestation} from "src/OracleAttestation.sol";

/// @dev A round whose verified result is already stored can still be cancelled once the 72-hour grace has
/// passed: `cancel` never looks at the oracle. A losing player calls `cancel` and gets 102 PRIO back
/// instead of 90, and the winner's prize share disappears. Fails now; passes once `cancel` refuses a
/// round that has a settled oracle result.
contract ArenaCancelResolvedTest is Test {
    uint256 constant SIGNER_KEY = 0x59c6995e998f97a5a0044966f0945389dc9e86dae88c7a8412f4603b6b78690d;
    address constant SIGNER = 0x70997970C51812dc3A010C7d01b50e0d17dc79C8;
    bytes32 constant QUESTION = keccak256("round question");

    PrismRiotToken token;
    Arena arena;
    OracleAdapter adapter;
    address owner = makeAddr("owner");
    address alice = makeAddr("alice");
    address bob = makeAddr("bob");

    function setUp() public {
        vm.warp(1_800_000_000);
        token = new PrismRiotToken();
        arena = new Arena(owner, address(token));
        adapter = new OracleAdapter(owner, SIGNER);
        vm.prank(owner);
        arena.setOracle(IRoundOracle(address(adapter)));
        token.transfer(alice, 1_000 ether);
        token.transfer(bob, 1_000 ether);
        vm.prank(alice);
        token.approve(address(arena), 102 ether);
        vm.prank(bob);
        token.approve(address(arena), 102 ether);
        token.approve(address(arena), 1_000 ether);
        arena.fundPrizes(1_000 ether);
    }

    function test_loserCancelsRoundThatHasAResult() public {
        uint64 commitDeadline = uint64(block.timestamp + 1 hours);
        vm.startPrank(owner);
        uint256 id = arena.createRound(
            Arena.Mode.FactionDuel, 2, commitDeadline, commitDeadline + 1 hours, commitDeadline + 2 hours, 300 ether, 0, 0
        );
        adapter.pinQuestion(id, QUESTION, 1, 5, 4, commitDeadline, "");
        vm.stopPrank();

        bytes32 saltA = keccak256("a");
        bytes32 saltB = keccak256("b");
        bytes32 cA = arena.commitmentOf(id, alice, 2, saltA); // will be correct
        bytes32 cB = arena.commitmentOf(id, bob, 1, saltB); // will be wrong
        vm.prank(alice);
        arena.enter(id, cA);
        vm.prank(bob);
        arena.enter(id, cB);
        skip(1 hours);
        vm.prank(alice);
        arena.reveal(id, 2, saltA);
        vm.prank(bob);
        arena.reveal(id, 1, saltB);

        // The panel answers late: 72 hours after the result deadline (T0+3h), but the result is valid and stored.
        skip(2 hours + 72 hours);
        OracleAttestation.Attestation memory a = OracleAttestation.Attestation({
            requestId: keccak256("req"),
            chainId: 1,
            questionHash: QUESTION,
            answerType: OracleAttestation.ANSWER_UINT256,
            answer: abi.encode(uint256(1)), // 1 % 2 + 1 = 2: alice correct
            figure: 0,
            fromBlock: 1,
            toBlock: 2,
            blockHash: bytes32(uint256(1)),
            panelJobId: keccak256("job"),
            panelSize: 5,
            quorum: 4,
            agreed: 5,
            issuedAt: uint64(block.timestamp),
            expiresAt: uint64(block.timestamp + 1 days)
        });
        (uint8 v, bytes32 r, bytes32 s) = vm.sign(SIGNER_KEY, adapter.attestationDigest(a));
        adapter.submitAttestation(id, a, abi.encodePacked(r, s, v));
        assertTrue(adapter.resultOf(id).settled, "a verified result exists for the round");

        // Bob, the loser, cancels before anyone settles. With a result on file this must be refused.
        vm.prank(bob);
        try arena.cancel(id) {} catch {}
        // The round must still be settleable: a round with a verified result is not "unresolved".
        arena.settle(id);
        assertEq(arena.payoutOf(id, alice), 400 ether, "winner keeps escrow plus the full prize");
        assertEq(arena.payoutOf(id, bob), 90 ether, "loser gets 90, not a 102 refund");
    }
}