// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {Imdex5} from "src/Imdex5.sol";
import {IPoolManager} from "src/Interfaces.sol";
import {MockERC20, MockIntake, MockPoolManager, MockRegistry} from "test/mocks/Mocks.sol";

/// @dev `_mintFirst` runs an exact-input swap with the pool's absolute price limit and then
/// ignores the `amountIn` the PoolManager actually consumed. When a pool cannot absorb the
/// whole equal part before reaching the limit (little liquidity), the unspent IMD stays in the
/// contract but is credited neither to `idleImd` nor to `feeImd`, so it is stranded forever.
/// Shares are still minted for the whole `rest`.
contract MintFirstStrandsImdTest is Test {
    uint256 constant COIN_RESERVE = 1_000_000e18;
    uint256 constant IMD_RESERVE = 10_000e18;

    Imdex5 index;
    MockERC20 imd;
    MockPoolManager pm;
    address alice = makeAddr("alice");
    address[] tokens;
    address[] hooks;

    function setUp() public {
        vm.warp(1_800_000_000);
        index = new Imdex5();
        imd = MockERC20(index.IMD());
        vm.etch(address(imd), address(new MockERC20()).code);
        pm = MockPoolManager(index.POOL_MANAGER());
        vm.etch(address(pm), address(new MockPoolManager()).code);
        vm.etch(address(index.REGISTRY_A()), address(new MockRegistry()).code);
        vm.etch(address(index.REGISTRY_B()), address(new MockRegistry()).code);
        vm.etch(index.INTAKE(), address(new MockIntake()).code);

        Imdex5.Coin[] memory coins = index.coins();
        for (uint256 i = 0; i < coins.length; ++i) {
            vm.etch(coins[i].token, address(new MockERC20()).code);
            tokens.push(coins[i].token);
            hooks.push(coins[i].hook);
            _setPool(coins[i].token, coins[i].hook, COIN_RESERVE, IMD_RESERVE);
        }
        imd.mint(alice, 10_000e18);
        vm.prank(alice);
        imd.approve(address(index), type(uint256).max);
    }

    function _key(address token, address hook_) internal view returns (IPoolManager.PoolKey memory) {
        (address c0, address c1) = address(imd) < token ? (address(imd), token) : (token, address(imd));
        return IPoolManager.PoolKey(c0, c1, index.POOL_FEE(), index.TICK_SPACING(), hook_);
    }

    function _setPool(address token, address hook_, uint256 coinReserve, uint256 imdReserve) internal {
        IPoolManager.PoolKey memory key = _key(token, hook_);
        (uint256 r0, uint256 r1) = key.currency0 == token ? (coinReserve, imdReserve) : (imdReserve, coinReserve);
        pm.setPool(key, r0, r1);
        MockERC20(token).mint(address(pm), coinReserve);
        imd.mint(address(pm), imdReserve);
    }

    /// @dev Coin 0's pool is nearly empty: it reaches the swap's absolute price limit after taking
    /// about 184 IMD, less than the 199 IMD equal part. The first mint must either revert or
    /// account for every IMD it pulled; today it does neither.
    function test_mintFirstAccountsForEveryImdPulled() public {
        _setPool(tokens[0], hooks[0], 100, 1);
        uint256[] memory minOut = new uint256[](5);
        vm.prank(alice);
        try index.mintFirst(1000e18, minOut) {}
        catch {
            // Refusing the partial fill is an acceptable behaviour too.
            return;
        }
        // The IMD the contract holds must equal what it accounts for (the README's invariant).
        assertEq(imd.balanceOf(address(index)), index.idleImd() + index.feeImd(), "IMD stranded outside accounting");
        // And shares must not exceed the IMD actually spent or credited for the holders.
        uint256 spent = 10_000e18 - imd.balanceOf(alice) - index.feeImd();
        assertLe(index.totalSupply(), spent);
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {Imdex5} from "src/Imdex5.sol";
import {IPoolManager, IUnlockCallback} from "src/Interfaces.sol";

/// @dev Plain ERC-20 used for IMD and every coin.
contract ScratchToken {
    mapping(address => uint256) public balanceOf;
    mapping(address => mapping(address => uint256)) public allowance;

    function mint(address to, uint256 amount) external {
        balanceOf[to] += amount;
    }

    function approve(address spender, uint256 amount) external returns (bool) {
        allowance[msg.sender][spender] = amount;
        return true;
    }

    function transfer(address to, uint256 amount) external returns (bool) {
        balanceOf[msg.sender] -= amount;
        balanceOf[to] += amount;
        return true;
    }

    function transferFrom(address from, address to, uint256 amount) external returns (bool) {
        allowance[from][msg.sender] -= amount;
        balanceOf[from] -= amount;
        balanceOf[to] += amount;
        return true;
    }
}

/// @dev A PoolManager stand-in with a fixed price of 100 coin per IMD and Uniswap's 1.25% fee
/// floor: an exact-input swap first strips the fee (`amountIn * 987500 / 1e6`, which is 0 for a
/// one-wei input, exactly as Uniswap v4's SwapMath does), then pays 100 coin per remaining IMD.
/// The whole specified input is consumed, as the real manager does (the dust is the LP fee).
contract ScratchPoolManager {
    address constant IMD = 0xD34a99Bc0f67aE1bbd63C660e6d0b0dd03E263B7;
    bool public unlocked;

    function unlock(bytes calldata data) external returns (bytes memory result) {
        require(!unlocked, "AlreadyUnlocked");
        unlocked = true;
        result = IUnlockCallback(msg.sender).unlockCallback(data);
        unlocked = false;
    }

    function swap(IPoolManager.PoolKey memory key, IPoolManager.SwapParams memory params, bytes calldata)
        external
        returns (int256)
    {
        require(unlocked, "ManagerLocked");
        require(params.amountSpecified != 0, "SwapAmountCannotBeZero");
        address inCur = params.zeroForOne ? key.currency0 : key.currency1;
        uint256 amountIn;
        uint256 amountOut;
        if (params.amountSpecified < 0) {
            amountIn = uint256(-params.amountSpecified);
            uint256 lessFee = amountIn * 987_500 / 1_000_000;
            amountOut = inCur == IMD ? lessFee * 100 : lessFee / 100;
        } else {
            amountOut = uint256(params.amountSpecified);
            uint256 raw = inCur == IMD ? (amountOut + 99) / 100 : amountOut * 100;
            amountIn = (raw * 1_000_000 + 987_499) / 987_500;
        }
        int256 a0 = params.zeroForOne ? -int256(amountIn) : int256(amountOut);
        int256 a1 = params.zeroForOne ? int256(amountOut) : -int256(amountIn);
        return int256((uint256(a0) << 128) | uint256(uint128(int128(a1))));
    }

    function sync(address) external {}

    function settle() external payable returns (uint256) {
        return 0;
    }

    function take(address currency, address to, uint256 amount) external {
        ScratchToken(currency).mint(to, amount);
    }

    function extsload(bytes32) external pure returns (bytes32) {
        return bytes32(uint256(2 ** 96));
    }
}

/// @notice A six-wei first mint leaves `totalSupply = 5` with every `held` and `idleImd` at zero;
/// from then on `mint` charges nothing, so shares are issued for free and the index can never
/// take value again (every mint buys `held * f = 0` of everything).
contract FreeMintTest is Test {
    Imdex5 index;
    ScratchToken imd;
    address attacker = makeAddr("attacker");
    address bob = makeAddr("bob");

    function setUp() public {
        vm.warp(1_800_000_000);
        index = new Imdex5();
        imd = ScratchToken(index.IMD());
        vm.etch(address(imd), address(new ScratchToken()).code);
        vm.etch(index.POOL_MANAGER(), address(new ScratchPoolManager()).code);
        Imdex5.Coin[] memory coins = index.coins();
        for (uint256 i = 0; i < coins.length; ++i) {
            vm.etch(coins[i].token, address(new ScratchToken()).code);
        }
        imd.mint(attacker, 1e18);
        imd.mint(bob, 10_000e18);
        vm.prank(attacker);
        imd.approve(address(index), type(uint256).max);
        vm.prank(bob);
        imd.approve(address(index), type(uint256).max);
    }

    function test_sharesCannotBeMintedForNothing() public {
        // The attacker front-runs the first honest mint with six wei: fee 1, rest 5, part 1 per
        // coin. One wei of input is entirely swallowed by the pool fee, so every buy returns 0.
        vm.prank(attacker);
        (bool firstOk,) = address(index).call(abi.encodeCall(index.mintFirst, (6, new uint256[](5))));
        if (firstOk) {
            assertEq(index.totalSupply(), 5, "dust supply");
            Imdex5.Coin[] memory coins = index.coins();
            for (uint256 i = 0; i < coins.length; ++i) {
                assertEq(index.held(coins[i].token), 0, "nothing was bought");
            }
            assertEq(index.idleImd(), 0, "nothing idle");
        }

        // Bob now mints one million shares and pays nothing: no IMD is pulled (maxImdIn = 0).
        uint256 before = imd.balanceOf(bob);
        vm.prank(bob);
        (bool mintOk,) = address(index).call(abi.encodeCall(index.mint, (1_000_000e18, 0)));

        bool freeShares = mintOk && index.balanceOf(bob) == 1_000_000e18 && imd.balanceOf(bob) == before;
        assertFalse(freeShares, "shares were minted for zero IMD");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {Imdex5} from "src/Imdex5.sol";
import {IPoolManager, IUnlockCallback} from "src/Interfaces.sol";

/// @dev Plain ERC-20 used for IMD and every coin.
contract ScratchToken {
    mapping(address => uint256) public balanceOf;
    mapping(address => mapping(address => uint256)) public allowance;

    function mint(address to, uint256 amount) external {
        balanceOf[to] += amount;
    }

    function approve(address spender, uint256 amount) external returns (bool) {
        allowance[msg.sender][spender] = amount;
        return true;
    }

    function transfer(address to, uint256 amount) external returns (bool) {
        balanceOf[msg.sender] -= amount;
        balanceOf[to] += amount;
        return true;
    }

    function transferFrom(address from, address to, uint256 amount) external returns (bool) {
        allowance[from][msg.sender] -= amount;
        balanceOf[from] -= amount;
        balanceOf[to] += amount;
        return true;
    }
}

/// @dev A PoolManager stand-in whose pools run out of liquidity: an exact-input swap consumes at
/// most `maxFill` of the input (Uniswap v4 stops at the last tick and reports the real delta) and
/// pays 100 coin per IMD consumed. `settle` credits exactly what was transferred in, as the real
/// manager does; the unconsumed input simply stays with the caller.
contract ScratchPoolManager {
    address constant IMD = 0xD34a99Bc0f67aE1bbd63C660e6d0b0dd03E263B7;
    uint256 public constant maxFill = 10e18;
    bool public unlocked;
    address private synced;
    uint256 private syncedBalance;

    function unlock(bytes calldata data) external returns (bytes memory result) {
        require(!unlocked, "AlreadyUnlocked");
        unlocked = true;
        result = IUnlockCallback(msg.sender).unlockCallback(data);
        unlocked = false;
    }

    function swap(IPoolManager.PoolKey memory key, IPoolManager.SwapParams memory params, bytes calldata)
        external
        returns (int256)
    {
        require(unlocked, "ManagerLocked");
        require(params.amountSpecified < 0, "exact input only");
        address inCur = params.zeroForOne ? key.currency0 : key.currency1;
        require(inCur == IMD, "buys only");
        uint256 amountIn = uint256(-params.amountSpecified);
        if (amountIn > maxFill) amountIn = maxFill;
        uint256 amountOut = amountIn * 100;
        int256 a0 = params.zeroForOne ? -int256(amountIn) : int256(amountOut);
        int256 a1 = params.zeroForOne ? int256(amountOut) : -int256(amountIn);
        return int256((uint256(a0) << 128) | uint256(uint128(int128(a1))));
    }

    function sync(address currency) external {
        synced = currency;
        syncedBalance = ScratchToken(currency).balanceOf(address(this));
    }

    function settle() external payable returns (uint256) {
        return ScratchToken(synced).balanceOf(address(this)) - syncedBalance;
    }

    function take(address currency, address to, uint256 amount) external {
        ScratchToken(currency).mint(to, amount);
    }

    function extsload(bytes32) external pure returns (bytes32) {
        return bytes32(uint256(2 ** 96));
    }
}

/// @notice `_mintFirst` ignores the swap's `amountIn`. When a pool fills only part of `part`, the
/// unspent IMD stays in the contract but is in neither `idleImd` nor `feeImd`, so no holder can
/// ever redeem it, while the minter still receives `rest` shares as if all of it had been spent.
contract StrandedImdTest is Test {
    Imdex5 index;
    ScratchToken imd;
    address alice = makeAddr("alice");

    function setUp() public {
        vm.warp(1_800_000_000);
        index = new Imdex5();
        imd = ScratchToken(index.IMD());
        vm.etch(address(imd), address(new ScratchToken()).code);
        vm.etch(index.POOL_MANAGER(), address(new ScratchPoolManager()).code);
        Imdex5.Coin[] memory coins = index.coins();
        for (uint256 i = 0; i < coins.length; ++i) {
            vm.etch(coins[i].token, address(new ScratchToken()).code);
        }
        imd.mint(alice, 10_000e18);
        vm.prank(alice);
        imd.approve(address(index), type(uint256).max);
    }

    function test_firstMintAccountsForEveryImdItHolds() public {
        // 100 IMD: fee 0.5, rest 99.5, part 19.9 per coin; each pool can only absorb 10 IMD.
        vm.prank(alice);
        (bool ok,) = address(index).call(abi.encodeCall(index.mintFirst, (100e18, new uint256[](5))));
        if (!ok) return; // a build that refuses a short fill also keeps the invariant

        uint256 balance = imd.balanceOf(address(index));
        uint256 accounted = index.idleImd() + index.feeImd();
        emit log_named_uint("IMD the contract holds", balance);
        emit log_named_uint("IMD the accounting owns", accounted);
        emit log_named_uint("shares minted", index.totalSupply());
        assertEq(balance, accounted, "IMD held but owned by nobody");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {Imdex5} from "src/Imdex5.sol";
import {IPoolManager, IUnlockCallback} from "src/Interfaces.sol";

/// @dev Minimal ERC-20.
contract Coin {
    mapping(address => uint256) public balanceOf;
    mapping(address => mapping(address => uint256)) public allowance;

    function mint(address to, uint256 a) external {
        balanceOf[to] += a;
    }

    function approve(address s, uint256 a) external returns (bool) {
        allowance[msg.sender][s] = a;
        return true;
    }

    function transfer(address to, uint256 a) external returns (bool) {
        balanceOf[msg.sender] -= a;
        balanceOf[to] += a;
        return true;
    }

    function transferFrom(address f, address t, uint256 a) external returns (bool) {
        allowance[f][msg.sender] -= a;
        balanceOf[f] -= a;
        balanceOf[t] += a;
        return true;
    }
}

/// @dev A PoolManager stand-in: every pool is a constant-product pool in which the coin is
/// expensive (1 coin unit costs 1e4 IMD units), so a 1-wei IMD swap returns 0 coin, exactly as a
/// real Uniswap v4 pool does when its 1.25% fee rounds a 1-wei input up to 1 wei of fee.
contract ExpensivePoolManager {
    uint256 constant COIN_R = 1e18;
    uint256 constant IMD_R = 1e22;
    address immutable imd;
    mapping(address => int256) delta;
    address synced;
    uint256 syncedBal;

    constructor(address imd_) {
        imd = imd_;
    }

    function unlock(bytes calldata data) external returns (bytes memory r) {
        r = IUnlockCallback(msg.sender).unlockCallback(data);
    }

    function swap(IPoolManager.PoolKey memory key, IPoolManager.SwapParams memory p, bytes calldata)
        external
        returns (int256)
    {
        require(p.amountSpecified < 0, "exact in only here");
        uint256 amountIn = uint256(-p.amountSpecified);
        address inCur = p.zeroForOne ? key.currency0 : key.currency1;
        require(inCur == imd, "buys only");
        uint256 amountOut = COIN_R * amountIn / (IMD_R + amountIn); // 0 for tiny inputs
        delta[inCur] -= int256(amountIn);
        int256 a0 = p.zeroForOne ? -int256(amountIn) : int256(amountOut);
        int256 a1 = p.zeroForOne ? int256(amountOut) : -int256(amountIn);
        return int256((uint256(a0) << 128) | uint256(uint128(int128(a1))));
    }

    function sync(address c) external {
        synced = c;
        syncedBal = Coin(c).balanceOf(address(this));
    }

    function settle() external payable returns (uint256 paid) {
        paid = Coin(synced).balanceOf(address(this)) - syncedBal;
        delta[synced] += int256(paid);
    }

    function take(address c, address to, uint256 a) external {
        Coin(c).transfer(to, a);
    }

    function extsload(bytes32) external pure returns (bytes32) {
        return bytes32(0);
    }
}

/// @title A 6-wei first mint followed by a free mint bricks the index
/// @notice Expected: `mint` never issues shares for nothing; or `mintFirst` refuses to leave the
/// index with no holdings. Actual: after `mintFirst(6)` every holding is 0 and `idleImd` is 0, so
/// `mint(1e30, 0)` costs 0 and succeeds; from then on no IMD can ever enter the holders'
/// accounting (`mintFirst` reverts `NotFirstMint`, `mint` buys nothing), so the index is dead for
/// as long as the attacker keeps one share.
contract FreeMintProofTest is Test {
    Imdex5 index;
    Coin imd;
    address attacker = makeAddr("attacker");
    address victim = makeAddr("victim");

    function setUp() public {
        index = new Imdex5();
        imd = Coin(index.IMD());
        vm.etch(address(imd), address(new Coin()).code);
        vm.etch(index.POOL_MANAGER(), address(new ExpensivePoolManager(address(imd))).code);
        // the immutable `imd` lives in code; the etched copy was built with the right address
        Imdex5.Coin[] memory coins = index.coins();
        for (uint256 i = 0; i < coins.length; ++i) {
            vm.etch(coins[i].token, address(new Coin()).code);
            Coin(coins[i].token).mint(index.POOL_MANAGER(), 1e30);
        }
        imd.mint(attacker, 1e18);
        imd.mint(victim, 1_000e18);
        vm.prank(attacker);
        imd.approve(address(index), type(uint256).max);
        vm.prank(victim);
        imd.approve(address(index), type(uint256).max);
    }

    function test_sixWeiFirstMintThenFreeMintBricksTheIndex() public {
        // 6 wei in: fee = 1, rest = 5, one wei per coin, every buy returns 0 coin
        vm.prank(attacker);
        index.mintFirst(6, new uint256[](5));
        assertEq(index.totalSupply(), 5);
        assertEq(index.idleImd(), 0);
        Imdex5.Coin[] memory coins = index.coins();
        for (uint256 i = 0; i < coins.length; ++i) {
            assertEq(index.held(coins[i].token), 0);
        }

        // shares minted beyond what was paid for: 1e30 shares for 0 IMD
        uint256 before = imd.balanceOf(attacker);
        vm.prank(attacker);
        index.mint(1e30, 0);
        uint256 paid = before - imd.balanceOf(attacker);
        assertEq(index.balanceOf(attacker), 1e30 + 5);

        // the victim can neither start the index nor put value in: their mint costs 0 and buys 0
        vm.prank(victim);
        vm.expectRevert(Imdex5.NotFirstMint.selector);
        index.mintFirst(1_000e18, new uint256[](5));
        uint256 victimBefore = imd.balanceOf(victim);
        vm.prank(victim);
        index.mint(1_000e18, 1_000e18);
        assertEq(imd.balanceOf(victim), victimBefore, "the victim's deposit went nowhere");
        for (uint256 i = 0; i < coins.length; ++i) {
            assertEq(index.held(coins[i].token), 0, "still nothing held");
        }
        assertEq(index.idleImd(), 0);

        // the defect: a mint that cost nothing issued shares. Fixed code reverts the free mint.
        assertGt(paid, 0, "mint issued 1e30 shares for 0 IMD");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {Imdex5} from "src/Imdex5.sol";
import {IPoolManager, IUnlockCallback} from "src/Interfaces.sol";

/// @dev Plain ERC-20 used for IMD and every coin.
contract ScratchToken {
    mapping(address => uint256) public balanceOf;
    mapping(address => mapping(address => uint256)) public allowance;

    function mint(address to, uint256 amount) external {
        balanceOf[to] += amount;
    }

    function approve(address spender, uint256 amount) external returns (bool) {
        allowance[msg.sender][spender] = amount;
        return true;
    }

    function transfer(address to, uint256 amount) external returns (bool) {
        balanceOf[msg.sender] -= amount;
        balanceOf[to] += amount;
        return true;
    }

    function transferFrom(address from, address to, uint256 amount) external returns (bool) {
        allowance[from][msg.sender] -= amount;
        balanceOf[from] -= amount;
        balanceOf[to] += amount;
        return true;
    }
}

/// @dev A PoolManager stand-in with a fixed price of 100 coin per IMD and Uniswap's 1.25% fee
/// floor: an exact-input swap first strips the fee (`amountIn * 987500 / 1e6`, which is 0 for a
/// one-wei input, exactly as Uniswap v4's SwapMath does), then pays 100 coin per remaining IMD.
/// The whole specified input is consumed, as the real manager does (the dust is the LP fee).
contract ScratchPoolManager {
    address constant IMD = 0xD34a99Bc0f67aE1bbd63C660e6d0b0dd03E263B7;
    bool public unlocked;

    function unlock(bytes calldata data) external returns (bytes memory result) {
        require(!unlocked, "AlreadyUnlocked");
        unlocked = true;
        result = IUnlockCallback(msg.sender).unlockCallback(data);
        unlocked = false;
    }

    function swap(IPoolManager.PoolKey memory key, IPoolManager.SwapParams memory params, bytes calldata)
        external
        returns (int256)
    {
        require(unlocked, "ManagerLocked");
        require(params.amountSpecified != 0, "SwapAmountCannotBeZero");
        address inCur = params.zeroForOne ? key.currency0 : key.currency1;
        uint256 amountIn;
        uint256 amountOut;
        if (params.amountSpecified < 0) {
            amountIn = uint256(-params.amountSpecified);
            uint256 lessFee = amountIn * 987_500 / 1_000_000;
            amountOut = inCur == IMD ? lessFee * 100 : lessFee / 100;
        } else {
            amountOut = uint256(params.amountSpecified);
            uint256 raw = inCur == IMD ? (amountOut + 99) / 100 : amountOut * 100;
            amountIn = (raw * 1_000_000 + 987_499) / 987_500;
        }
        int256 a0 = params.zeroForOne ? -int256(amountIn) : int256(amountOut);
        int256 a1 = params.zeroForOne ? int256(amountOut) : -int256(amountIn);
        return int256((uint256(a0) << 128) | uint256(uint128(int128(a1))));
    }

    function sync(address) external {}

    function settle() external payable returns (uint256) {
        return 0;
    }

    function take(address currency, address to, uint256 amount) external {
        ScratchToken(currency).mint(to, amount);
    }

    function extsload(bytes32) external pure returns (bytes32) {
        return bytes32(uint256(2 ** 96));
    }
}

/// @notice A six-wei first mint leaves `totalSupply = 5` with every `held` and `idleImd` at zero;
/// from then on `mint` charges nothing, so shares are issued for free and the index can never
/// take value again (every mint buys `held * f = 0` of everything).
contract FreeMintTest is Test {
    Imdex5 index;
    ScratchToken imd;
    address attacker = makeAddr("attacker");
    address bob = makeAddr("bob");

    function setUp() public {
        vm.warp(1_800_000_000);
        index = new Imdex5();
        imd = ScratchToken(index.IMD());
        vm.etch(address(imd), address(new ScratchToken()).code);
        vm.etch(index.POOL_MANAGER(), address(new ScratchPoolManager()).code);
        Imdex5.Coin[] memory coins = index.coins();
        for (uint256 i = 0; i < coins.length; ++i) {
            vm.etch(coins[i].token, address(new ScratchToken()).code);
        }
        imd.mint(attacker, 1e18);
        imd.mint(bob, 10_000e18);
        vm.prank(attacker);
        imd.approve(address(index), type(uint256).max);
        vm.prank(bob);
        imd.approve(address(index), type(uint256).max);
    }

    function test_sharesCannotBeMintedForNothing() public {
        // The attacker front-runs the first honest mint with six wei: fee 1, rest 5, part 1 per
        // coin. One wei of input is entirely swallowed by the pool fee, so every buy returns 0.
        vm.prank(attacker);
        (bool firstOk,) = address(index).call(abi.encodeCall(index.mintFirst, (6, new uint256[](5))));
        if (firstOk) {
            assertEq(index.totalSupply(), 5, "dust supply");
            Imdex5.Coin[] memory coins = index.coins();
            for (uint256 i = 0; i < coins.length; ++i) {
                assertEq(index.held(coins[i].token), 0, "nothing was bought");
            }
            assertEq(index.idleImd(), 0, "nothing idle");
        }

        // Bob now mints one million shares and pays nothing: no IMD is pulled (maxImdIn = 0).
        uint256 before = imd.balanceOf(bob);
        vm.prank(bob);
        (bool mintOk,) = address(index).call(abi.encodeCall(index.mint, (1_000_000e18, 0)));

        bool freeShares = mintOk && index.balanceOf(bob) == 1_000_000e18 && imd.balanceOf(bob) == before;
        assertFalse(freeShares, "shares were minted for zero IMD");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {Imdex5} from "src/Imdex5.sol";
import {IPoolManager, IUnlockCallback} from "src/Interfaces.sol";

/// @dev Plain ERC-20 used for IMD and every coin.
contract ScratchToken {
    mapping(address => uint256) public balanceOf;
    mapping(address => mapping(address => uint256)) public allowance;

    function mint(address to, uint256 amount) external {
        balanceOf[to] += amount;
    }

    function approve(address spender, uint256 amount) external returns (bool) {
        allowance[msg.sender][spender] = amount;
        return true;
    }

    function transfer(address to, uint256 amount) external returns (bool) {
        balanceOf[msg.sender] -= amount;
        balanceOf[to] += amount;
        return true;
    }

    function transferFrom(address from, address to, uint256 amount) external returns (bool) {
        allowance[from][msg.sender] -= amount;
        balanceOf[from] -= amount;
        balanceOf[to] += amount;
        return true;
    }
}

/// @dev A PoolManager stand-in whose pools run out of liquidity: an exact-input swap consumes at
/// most `maxFill` of the input (Uniswap v4 stops at the last tick and reports the real delta) and
/// pays 100 coin per IMD consumed. `settle` credits exactly what was transferred in, as the real
/// manager does; the unconsumed input simply stays with the caller.
contract ScratchPoolManager {
    address constant IMD = 0xD34a99Bc0f67aE1bbd63C660e6d0b0dd03E263B7;
    uint256 public constant maxFill = 10e18;
    bool public unlocked;
    address private synced;
    uint256 private syncedBalance;

    function unlock(bytes calldata data) external returns (bytes memory result) {
        require(!unlocked, "AlreadyUnlocked");
        unlocked = true;
        result = IUnlockCallback(msg.sender).unlockCallback(data);
        unlocked = false;
    }

    function swap(IPoolManager.PoolKey memory key, IPoolManager.SwapParams memory params, bytes calldata)
        external
        returns (int256)
    {
        require(unlocked, "ManagerLocked");
        require(params.amountSpecified < 0, "exact input only");
        address inCur = params.zeroForOne ? key.currency0 : key.currency1;
        require(inCur == IMD, "buys only");
        uint256 amountIn = uint256(-params.amountSpecified);
        if (amountIn > maxFill) amountIn = maxFill;
        uint256 amountOut = amountIn * 100;
        int256 a0 = params.zeroForOne ? -int256(amountIn) : int256(amountOut);
        int256 a1 = params.zeroForOne ? int256(amountOut) : -int256(amountIn);
        return int256((uint256(a0) << 128) | uint256(uint128(int128(a1))));
    }

    function sync(address currency) external {
        synced = currency;
        syncedBalance = ScratchToken(currency).balanceOf(address(this));
    }

    function settle() external payable returns (uint256) {
        return ScratchToken(synced).balanceOf(address(this)) - syncedBalance;
    }

    function take(address currency, address to, uint256 amount) external {
        ScratchToken(currency).mint(to, amount);
    }

    function extsload(bytes32) external pure returns (bytes32) {
        return bytes32(uint256(2 ** 96));
    }
}

/// @notice `_mintFirst` ignores the swap's `amountIn`. When a pool fills only part of `part`, the
/// unspent IMD stays in the contract but is in neither `idleImd` nor `feeImd`, so no holder can
/// ever redeem it, while the minter still receives `rest` shares as if all of it had been spent.
contract StrandedImdTest is Test {
    Imdex5 index;
    ScratchToken imd;
    address alice = makeAddr("alice");

    function setUp() public {
        vm.warp(1_800_000_000);
        index = new Imdex5();
        imd = ScratchToken(index.IMD());
        vm.etch(address(imd), address(new ScratchToken()).code);
        vm.etch(index.POOL_MANAGER(), address(new ScratchPoolManager()).code);
        Imdex5.Coin[] memory coins = index.coins();
        for (uint256 i = 0; i < coins.length; ++i) {
            vm.etch(coins[i].token, address(new ScratchToken()).code);
        }
        imd.mint(alice, 10_000e18);
        vm.prank(alice);
        imd.approve(address(index), type(uint256).max);
    }

    function test_firstMintAccountsForEveryImdItHolds() public {
        // 100 IMD: fee 0.5, rest 99.5, part 19.9 per coin; each pool can only absorb 10 IMD.
        vm.prank(alice);
        (bool ok,) = address(index).call(abi.encodeCall(index.mintFirst, (100e18, new uint256[](5))));
        if (!ok) return; // a build that refuses a short fill also keeps the invariant

        uint256 balance = imd.balanceOf(address(index));
        uint256 accounted = index.idleImd() + index.feeImd();
        emit log_named_uint("IMD the contract holds", balance);
        emit log_named_uint("IMD the accounting owns", accounted);
        emit log_named_uint("shares minted", index.totalSupply());
        assertEq(balance, accounted, "IMD held but owned by nobody");
    }
}