BMC ILLUMINATI PASS #1356 — IMPLEMENTATION ONLY — FIX CRITICAL VRF SECURITY FINDINGS

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {BMCIlluminatiPass} from "src/BMCIlluminatiPass.sol";

/// @dev Minimal 18-decimal token with OpenZeppelin-style burnFrom semantics.
contract ProofBMC {
    string public name = "BMC Illuminati";
    string public symbol = "BMC";
    uint8 public constant decimals = 18;
    uint256 public totalSupply;
    mapping(address => uint256) public balanceOf;
    mapping(address => mapping(address => uint256)) public allowance;

    function mint(address to, uint256 amount) external {
        balanceOf[to] += amount;
        totalSupply += amount;
    }

    function approve(address spender, uint256 amount) external returns (bool) {
        allowance[msg.sender][spender] = amount;
        return true;
    }

    function burnFrom(address account, uint256 amount) external {
        uint256 a = allowance[account][msg.sender];
        require(a >= amount, "allowance");
        allowance[account][msg.sender] = a - amount;
        require(balanceOf[account] >= amount, "balance");
        balanceOf[account] -= amount;
        totalSupply -= amount;
    }
}

/// @dev Mirrors the mainnet VRFCoordinatorV2_5 behaviour that matters here: it exposes the
///      registered proving keys (`s_provingKeys` / `s_provingKeyHashes`) but, exactly like the
///      real contract ("Note we do not check whether the keyHash is valid to save gas. The
///      consequence for users is that they can send requests for invalid keyHashes which will
///      simply not be fulfilled."), `requestRandomWords` accepts any key hash.
contract ProofCoordinator {
    /// @dev Same field layout as Chainlink's VRFV2PlusClient.RandomWordsRequest, so the ABI selector matches.
    struct RandomWordsRequest {
        bytes32 keyHash;
        uint256 subId;
        uint16 requestConfirmations;
        uint32 callbackGasLimit;
        uint32 numWords;
        bytes extraArgs;
    }

    struct ProvingKey {
        bool exists;
        uint64 maxGas;
    }

    mapping(bytes32 => ProvingKey) public s_provingKeys;
    bytes32[] public s_provingKeyHashes;
    uint256 public nextRequestId = 1;
    mapping(uint256 => bytes32) public keyHashOfRequest;

    function registerProvingKey(bytes32 keyHash, uint64 maxGas) external {
        s_provingKeys[keyHash] = ProvingKey({exists: true, maxGas: maxGas});
        s_provingKeyHashes.push(keyHash);
    }

    function requestRandomWords(RandomWordsRequest calldata req) external returns (uint256 id) {
        id = nextRequestId++;
        keyHashOfRequest[id] = req.keyHash;
    }
}

/// @title Proof: BMC is burned for a VRF request made with an unregistered key hash.
/// @notice Fails on the current code: `mintMystery` burns 350,000 BMC and opens a request the
///         coordinator will never fulfil because nothing checks the configured key hash against
///         the coordinator's registered proving keys. Passes once the contract refuses to burn
///         (at configuration or at request time) when the key hash is not registered.
contract KeyHashNotValidatedProof is Test {
    ProofBMC bmc;
    ProofCoordinator coordinator;
    BMCIlluminatiPass pass;

    address owner = makeAddr("owner");
    address alice = makeAddr("alice");

    bytes32 constant REGISTERED_KEY_HASH = 0x3fd2fec10d06ee8f65e7f2e95f5c56511359ece3f33960ad8a866ae24a8ff10b;
    // One flipped nibble: a typo nobody will ever serve.
    bytes32 constant UNREGISTERED_KEY_HASH = 0x3fd2fec10d06ee8f65e7f2e95f5c56511359ece3f33960ad8a866ae24a8ff10c;

    function setUp() public {
        bmc = new ProofBMC();
        coordinator = new ProofCoordinator();
        coordinator.registerProvingKey(REGISTERED_KEY_HASH, 500 gwei);
        pass = new BMCIlluminatiPass(owner, address(bmc), address(coordinator));
        vm.prank(owner);
        pass.setGenesisImagesCID("bafybeiproofcid");
        for (uint256 i = 0; i < 40; i++) {
            address g = address(uint160(0x1000 + i));
            bmc.mint(g, 1_000_000e18);
            vm.startPrank(g);
            bmc.approve(address(pass), 1_000_000e18);
            pass.mintGenesis();
            vm.stopPrank();
        }
        assertEq(pass.totalMinted(), 40);
    }

    function test_mintMysteryMustNotBurnForUnregisteredKeyHash() public {
        (bool exists,) = coordinator.s_provingKeys(UNREGISTERED_KEY_HASH);
        assertFalse(exists, "precondition: key hash is not registered");

        vm.prank(owner);
        try pass.setVRFConfig(1, UNREGISTERED_KEY_HASH, 500_000, 3, true) {}
        catch {
            // Rejecting the unregistered key hash at configuration time is an acceptable fix.
            return;
        }

        bmc.mint(alice, 350_000e18);
        uint256 balanceBefore = bmc.balanceOf(alice);
        uint256 supplyBefore = bmc.totalSupply();

        vm.startPrank(alice);
        bmc.approve(address(pass), 350_000e18);
        (bool ok,) = address(pass).call(abi.encodeCall(BMCIlluminatiPass.mintMystery, ()));
        vm.stopPrank();

        // Expected: the mint reverts because no VRF node serves this key hash, so the request
        // can never be fulfilled. Actual (current code): the mint succeeds, 350,000 BMC are gone
        // and token 41 is AwaitingRandomness forever.
        assertFalse(ok, "mintMystery must revert when the key hash is not registered on the coordinator");
        assertEq(bmc.balanceOf(alice), balanceBefore, "no BMC may be burned for an unfulfillable request");
        assertEq(bmc.totalSupply(), supplyBefore, "supply must be unchanged");
        assertEq(pass.totalMinted(), 40, "no pending token may be minted");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {BMCIlluminatiPass} from "src/BMCIlluminatiPass.sol";

interface IRawFulfill {
    function rawFulfillRandomWords(uint256 requestId, uint256[] calldata randomWords) external;
}

/// @dev Minimal 18-decimal token with OpenZeppelin-style burnFrom semantics.
contract ProofBMC2 {
    uint8 public constant decimals = 18;
    uint256 public totalSupply;
    mapping(address => uint256) public balanceOf;
    mapping(address => mapping(address => uint256)) public allowance;

    function mint(address to, uint256 amount) external {
        balanceOf[to] += amount;
        totalSupply += amount;
    }

    function approve(address spender, uint256 amount) external returns (bool) {
        allowance[msg.sender][spender] = amount;
        return true;
    }

    function burnFrom(address account, uint256 amount) external {
        uint256 a = allowance[account][msg.sender];
        require(a >= amount, "allowance");
        allowance[account][msg.sender] = a - amount;
        require(balanceOf[account] >= amount, "balance");
        balanceOf[account] -= amount;
        totalSupply -= amount;
    }
}

/// @dev Coordinator stand-in: records requests, the test decides which ones are ever fulfilled.
contract ProofCoordinator2 {
    /// @dev Same field layout as Chainlink's VRFV2PlusClient.RandomWordsRequest, so the ABI selector matches.
    struct RandomWordsRequest {
        bytes32 keyHash;
        uint256 subId;
        uint16 requestConfirmations;
        uint32 callbackGasLimit;
        uint32 numWords;
        bytes extraArgs;
    }

    uint256 public nextRequestId = 1;
    mapping(uint256 => address) public consumerOf;
    mapping(uint256 => uint32) public gasOf;

    function requestRandomWords(RandomWordsRequest calldata req) external returns (uint256 id) {
        id = nextRequestId++;
        consumerOf[id] = msg.sender;
        gasOf[id] = req.callbackGasLimit;
    }

    function fulfill(uint256 requestId, uint256 word) external returns (bool ok) {
        uint256[] memory words = new uint256[](1);
        words[0] = word;
        (ok,) = consumerOf[requestId].call{gas: gasOf[requestId]}(
            abi.encodeCall(IRawFulfill.rawFulfillRandomWords, (requestId, words))
        );
    }
}

/// @title Proof: one request that is never fulfilled freezes every later reveal forever.
/// @notice Fails on the current code: token 42's randomness is delivered, but because token 41's
///         request is never served (unregistered key hash, node-side request expiry, subscription
///         problems) `finalizeReveals` can never advance past 41 and there is no timeout, re-request
///         or recovery path. Passes once the protocol can make progress without the lost request.
contract LostRequestBlocksRevealsProof is Test {
    ProofBMC2 bmc;
    ProofCoordinator2 coordinator;
    BMCIlluminatiPass pass;

    address owner = makeAddr("owner");
    address alice = makeAddr("alice");
    address bob = makeAddr("bob");

    function setUp() public {
        bmc = new ProofBMC2();
        coordinator = new ProofCoordinator2();
        pass = new BMCIlluminatiPass(owner, address(bmc), address(coordinator));
        vm.startPrank(owner);
        pass.setGenesisImagesCID("bafybeiproofcid");
        pass.setVRFConfig(1, keccak256("500 gwei"), 500_000, 3, true);
        vm.stopPrank();
        for (uint256 i = 0; i < 40; i++) {
            address g = address(uint160(0x1000 + i));
            bmc.mint(g, 1_000_000e18);
            vm.startPrank(g);
            bmc.approve(address(pass), 1_000_000e18);
            pass.mintGenesis();
            vm.stopPrank();
        }
    }

    function _mintMystery(address who) internal returns (uint256 id, uint256 req) {
        bmc.mint(who, 350_000e18);
        vm.startPrank(who);
        bmc.approve(address(pass), 350_000e18);
        (id, req) = pass.mintMystery();
        vm.stopPrank();
    }

    function test_laterTokenMustBeRevealableWhenEarlierRequestIsLost() public {
        (uint256 a, uint256 reqA) = _mintMystery(alice); // 41, its request is never fulfilled
        (uint256 b, uint256 reqB) = _mintMystery(bob); // 42, fulfilled normally
        assertEq(a, 41);
        assertEq(b, 42);
        assertTrue(reqA != reqB);

        assertTrue(coordinator.fulfill(reqB, 0xB0B), "delivery for 42 succeeds");
        assertEq(uint8(pass.revealStatusOf(b)), uint8(BMCIlluminatiPass.RevealStatus.RandomnessStored));

        // A month passes. Chainlink nodes have long stopped retrying request A. Anyone may try to
        // drive the reveal queue forward.
        vm.warp(block.timestamp + 30 days);
        vm.roll(block.number + 215_000);
        vm.prank(bob);
        pass.finalizeReveals(100);

        // Expected: bob's token, whose randomness exists on-chain, obtains an outcome. Actual:
        // revealedCount stays 0, token 42 stays Pending, and so does every token minted after it.
        assertEq(
            uint8(pass.revealStatusOf(b)),
            uint8(BMCIlluminatiPass.RevealStatus.Revealed),
            "token 42 is blocked forever behind the lost request for token 41"
        );
        assertTrue(pass.tierOf(b) != BMCIlluminatiPass.Tier.Pending, "token 42 never receives a tier");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {ERC20Burnable} from "@openzeppelin/contracts/token/ERC20/extensions/ERC20Burnable.sol";
import {VRFCoordinatorV2_5Mock} from "@chainlink/contracts/src/v0.8/vrf/mocks/VRFCoordinatorV2_5Mock.sol";
import {BMCIlluminatiPass} from "src/BMCIlluminatiPass.sol";

contract ScratchBMC is ERC20, ERC20Burnable {
    constructor() ERC20("BMC Illuminati", "BMC") {}

    function mint(address to, uint256 amount) external {
        _mint(to, amount);
    }
}

/// @dev Chainlink's own v2.5 mock plus the public proving-key registry of the real coordinator.
contract ScratchCoordinator is VRFCoordinatorV2_5Mock {
    struct ProvingKey {
        bool exists;
        uint64 maxGas;
    }

    mapping(bytes32 => ProvingKey) public s_provingKeys;

    constructor() VRFCoordinatorV2_5Mock(0.1 ether, 1e9, 4e15) {}

    function registerProvingKey(bytes32 keyHash, uint64 maxGas) external {
        s_provingKeys[keyHash] = ProvingKey({exists: true, maxGas: maxGas});
    }
}

/// @notice While the seed is late (here: the subscription is a consumer but unfunded, which the
///         coordinator accepts), anyone can open one request per hour. When the subscription is
///         funded every open request becomes deliverable at once, and whoever orders the
///         fulfilments (VRF node, block builder, or anyone resubmitting a public proof) picks the
///         collection seed among all of them. The seed must have at most one deliverable candidate.
contract SeedSelectionTest is Test {
    ScratchBMC bmc;
    ScratchCoordinator coordinator;
    BMCIlluminatiPass pass;
    uint256 subId;
    bytes32 constant KEY_HASH = keccak256("lane");
    address attacker = makeAddr("attacker");
    address victim = makeAddr("victim");

    function setUp() public {
        vm.warp(1_800_000_000);
        bmc = new ScratchBMC();
        coordinator = new ScratchCoordinator();
        coordinator.registerProvingKey(KEY_HASH, 500 gwei);
        subId = coordinator.createSubscription();
        pass = new BMCIlluminatiPass(
            makeAddr("owner"), address(bmc), address(coordinator), subId, KEY_HASH, 500_000, 3, false,
            keccak256("digest"), 7 days
        );
        coordinator.addConsumer(subId, address(pass));
        for (uint256 i = 0; i < 40; i++) _mint(address(uint160(0x7000 + i)), true);
        for (uint256 i = 0; i < 30; i++) _mint(attacker, false); // tokens 41..70
        for (uint256 i = 0; i < 30; i++) _mint(victim, false); // tokens 71..100
    }

    function _mint(address who, bool genesis) internal {
        uint256 price = genesis ? 1_000_000e18 : 350_000e18;
        bmc.mint(who, price);
        vm.startPrank(who);
        bmc.approve(address(pass), price);
        if (genesis) pass.mintGenesis();
        else pass.mintMystery();
        vm.stopPrank();
    }

    function _attackerGenesis() internal view returns (uint256 n) {
        for (uint256 id = 41; id <= 70; id++) {
            if (pass.tierOf(id) == BMCIlluminatiPass.Tier.Genesis) n++;
        }
    }

    function test_SeedIsSelectableAmongOverlappingRequests() public {
        vm.warp(pass.SALE_DEADLINE());
        // Subscription unfunded: the coordinator accepts each request, none can be fulfilled yet.
        uint256[] memory reqs = new uint256[](24);
        uint256 opened;
        for (uint256 h = 0; h < 24; h++) {
            vm.prank(attacker);
            try pass.requestSeed() returns (uint256 id) {
                reqs[opened++] = id;
            } catch {}
            vm.warp(block.timestamp + 1 hours);
            vm.roll(block.number + 300);
        }
        coordinator.fundSubscription(subId, 1_000 ether);

        // Every open request is now deliverable; count how many distinct seeds the orderer can choose.
        uint256 candidates;
        uint256 best;
        uint256 firstOutcome = type(uint256).max;
        for (uint256 i = 0; i < opened; i++) {
            uint256 snap = vm.snapshotState();
            try coordinator.fulfillRandomWords(reqs[i], address(pass)) {
                if (pass.seedDelivered() && pass.seedRequestId() == reqs[i]) {
                    candidates++;
                    uint256 g = _attackerGenesis();
                    if (firstOutcome == type(uint256).max) firstOutcome = g;
                    if (g > best) best = g;
                }
            } catch {}
            vm.revertToState(snap);
        }
        emit log_named_uint("requests opened", opened);
        emit log_named_uint("deliverable candidate seeds", candidates);
        emit log_named_uint("attacker Genesis if first request wins", firstOutcome);
        emit log_named_uint("attacker Genesis with best chosen seed", best);
        assertLe(candidates, 1, "orderer can choose the collection seed among several VRF words");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {BMCIlluminatiPass} from "src/BMCIlluminatiPass.sol";

contract ScratchBMC {
    mapping(address => uint256) public balanceOf;
    mapping(address => mapping(address => uint256)) public allowance;
    uint256 public totalSupply;

    function decimals() external pure returns (uint8) {
        return 18;
    }

    function mint(address to, uint256 a) external {
        balanceOf[to] += a;
        totalSupply += a;
    }

    function approve(address s, uint256 a) external returns (bool) {
        allowance[msg.sender][s] = a;
        return true;
    }

    function burnFrom(address from, uint256 a) external {
        allowance[from][msg.sender] -= a;
        balanceOf[from] -= a;
        totalSupply -= a;
    }
}

/// @dev Like the real VRFCoordinatorV2_5: accepts a request without checking the subscription
///      balance and keeps it pending until a node fulfils it.
contract ScratchCoordinator {
    uint256 public nextId = 1;

    function s_provingKeys(bytes32) external pure returns (bool, uint64) {
        return (true, 500 gwei);
    }

    function requestRandomWords(bytes calldata) external pure returns (uint256) {
        revert("unused");
    }

    fallback(bytes calldata) external returns (bytes memory) {
        return abi.encode(nextId++);
    }

    function fulfil(BMCIlluminatiPass pass, uint256 id, uint256 word) external {
        uint256[] memory w = new uint256[](1);
        w[0] = word;
        pass.rawFulfillRandomWords(id, w);
    }
}

contract OverlapSeedChoiceTest is Test {
    ScratchBMC bmc;
    ScratchCoordinator coord;
    BMCIlluminatiPass pass;
    address attacker = makeAddr("attacker");

    function setUp() public {
        vm.warp(1_800_000_000);
        bmc = new ScratchBMC();
        coord = new ScratchCoordinator();
        pass = new BMCIlluminatiPass(
            address(this), address(bmc), address(coord), 1, keccak256("lane"), 500_000, 3, true, keccak256("d"), 7 days
        );
        for (uint256 i; i < 40; ++i) {
            address who = address(uint160(0x7000 + i));
            bmc.mint(who, 1_000_000e18);
            vm.startPrank(who);
            bmc.approve(address(pass), 1_000_000e18);
            pass.mintGenesis();
            vm.stopPrank();
        }
        bmc.mint(attacker, 350_000e18 * 20);
        vm.startPrank(attacker);
        bmc.approve(address(pass), type(uint256).max);
        for (uint256 i; i < 20; ++i) pass.mintMystery(); // tokens 41..60
        vm.stopPrank();
        vm.warp(block.timestamp + 7 days);
    }

    /// Request 1 is opened (e.g. subscription still unfunded, or gas above the 500 gwei lane), so no
    /// word arrives for an hour. Anyone may then open request 2 while request 1 is still live at the
    /// node. When both fulfilments are broadcast, whoever orders them (builder / searcher bundle)
    /// chooses which of the two words becomes the seed: the draw is no longer one fair VRF sample.
    function test_secondRequestWhileFirstStillLiveLetsOrderingPickSeed() public {
        uint256 req1 = pass.requestSeed();
        vm.warp(block.timestamp + 1 hours);

        // Show the choice exists: the two candidate words give the attacker different Genesis counts.
        uint256 w1 = uint256(keccak256("word-1"));
        uint256 w2 = uint256(keccak256("word-2"));
        uint256 snap = vm.snapshotState();
        vm.prank(attacker);
        uint256 req2 = pass.requestSeed();
        coord.fulfil(pass, req1, w1);
        coord.fulfil(pass, req2, w2);
        uint256 g1 = pass.mysteryGenesisRevealed();
        vm.revertToState(snap);
        vm.prank(attacker);
        req2 = pass.requestSeed();
        coord.fulfil(pass, req2, w2);
        coord.fulfil(pass, req1, w1);
        uint256 g2 = pass.mysteryGenesisRevealed();
        emit log_named_uint("attacker Genesis if req1 ordered first", g1);
        emit log_named_uint("attacker Genesis if req2 ordered first", g2);
        vm.revertToState(snap);

        // Fails today: a second, overlapping request is accepted 1 hour after the first, while the
        // first is still within the VRF node's retry/retention window and can still be fulfilled.
        vm.expectRevert();
        pass.requestSeed();
    }
}