// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {IMDPot} from "src/IMDPot.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {
    IVRFCoordinatorV2Plus,
    IVRFConsumerV2Plus,
    VRFV2PlusClient
} from "src/interfaces/IVRFCoordinatorV2Plus.sol";

contract SnipeToken is ERC20 {
    constructor() ERC20("IMD", "IMD") {}

    function mint(address to, uint256 amount) external {
        _mint(to, amount);
    }
}

contract SnipeCoordinator is IVRFCoordinatorV2Plus {
    uint256 public nextRequestId = 1;
    mapping(uint256 => address) public consumerOf;

    function requestRandomWords(VRFV2PlusClient.RandomWordsRequest calldata) external returns (uint256 requestId) {
        requestId = nextRequestId++;
        consumerOf[requestId] = msg.sender;
    }

    function fulfill(uint256 requestId, uint256 word) external {
        uint256[] memory words = new uint256[](1);
        words[0] = word;
        IVRFConsumerV2Plus(consumerOf[requestId]).rawFulfillRandomWords(requestId, words);
    }
}

/// @notice A whale is the only genuine entrant. A sniper with three fresh addresses buys one ticket each just
///         before the timer ends. Because podium slots are drawn without replacement per participant, the
///         sniper's three dust tickets are guaranteed the 2nd and 3rd prizes (30% of the pool) for 0.3 IMD,
///         whatever random word Chainlink delivers. "Every ticket has equal chance" does not hold.
contract ThinRoundSnipingTest is Test {
    address internal constant OWNER = address(0xA11CE);
    IMDPot internal pot;
    SnipeToken internal token;
    SnipeCoordinator internal coordinator;

    address internal whale = makeAddr("whale");
    address internal sniper1 = makeAddr("sniper1");
    address internal sniper2 = makeAddr("sniper2");
    address internal sniper3 = makeAddr("sniper3");

    function setUp() public {
        vm.warp(1_800_000_000);
        token = new SnipeToken();
        coordinator = new SnipeCoordinator();
        pot = new IMDPot(OWNER);
        vm.startPrank(OWNER);
        pot.setToken(address(token));
        pot.setVrfConfig(address(coordinator), 1, keccak256("kh"), 750_000, 3, false);
        vm.stopPrank();
        _fund(whale, 200_000 ether);
        _fund(sniper1, 1 ether);
        _fund(sniper2, 1 ether);
        _fund(sniper3, 1 ether);
    }

    function _fund(address who, uint256 amount) internal {
        token.mint(who, amount);
        vm.prank(who);
        token.approve(address(pot), type(uint256).max);
    }

    /// @dev Whatever the random word, the sniper's 0.3 IMD stake collects 30% of a 100,000.3 IMD pool.
    ///      Fails on the current code for every word; passes once a slot can be won by any ticket.
    function test_dustEntrantsAreGuaranteedThirtyPercentOfWhalePool() public {
        uint256 word = uint256(keccak256("chainlink word"));
        vm.prank(whale);
        pot.buyTickets(1_000_000); // 100,000 IMD, 99.9997% of all tickets
        // Last-second entries: 1 ticket (0.1 IMD) from each sniper address.
        vm.warp(pot.getRound(1).endTime - 1);
        vm.prank(sniper1);
        pot.buyTickets(1);
        vm.prank(sniper2);
        pot.buyTickets(1);
        vm.prank(sniper3);
        pot.buyTickets(1);

        vm.warp(pot.getRound(1).endTime);
        pot.finalizeRound();
        coordinator.fulfill(1, word);

        uint256 pool = 1_000_003 * pot.ticketPrice();
        uint256 sniperPrize = pot.claimable(sniper1) + pot.claimable(sniper2) + pot.claimable(sniper3);

        // Expected under "every ticket has equal chance": the sniper holds 3 of 1,000,003 tickets, so the odds of
        // taking even one podium slot are about 3e-6. Actual: the sniper collects exactly 30% of the pool
        // (30,000.09 IMD for a 0.3 IMD stake) for every random word, because the whale is removed after slot 1.
        assertLt(sniperPrize, (pool * 30) / 100, "dust entrants always collect 30% of the pool");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {IMDPot} from "src/IMDPot.sol";
import {IVRFCoordinatorV2Plus, IVRFConsumerV2Plus, VRFV2PlusClient} from "src/interfaces/IVRFCoordinatorV2Plus.sol";

contract RerollToken is ERC20 {
    constructor() ERC20("IMD", "IMD") {}

    function mint(address to, uint256 amount) external {
        _mint(to, amount);
    }
}

/// @dev Records requests; a test delivers any word for any recorded request, as the Chainlink node would.
contract RerollCoordinator is IVRFCoordinatorV2Plus {
    uint256 public nextRequestId = 1;
    mapping(uint256 => address) public consumerOf;

    function requestRandomWords(VRFV2PlusClient.RandomWordsRequest calldata) external returns (uint256 requestId) {
        requestId = nextRequestId++;
        consumerOf[requestId] = msg.sender;
    }

    function fulfill(uint256 requestId, uint256 word) external {
        uint256[] memory words = new uint256[](1);
        words[0] = word;
        IVRFConsumerV2Plus(consumerOf[requestId]).rawFulfillRandomWords(requestId, words);
    }
}

/// @notice A pending VRF fulfillment whose random word is already public (it sits in the mempool) can be voided
///         by any participant who front-runs it with `retryRandomness()` once an hour has passed since the request.
///         The draw is re-rolled; the participant repeats until the outcome suits them. The fix is to keep every
///         outstanding request of the round valid so the first fulfillment to land settles the round and a later
///         `retryRandomness()` adds a request instead of invalidating the previous one.
contract RetryRerollTest is Test {
    address internal constant OWNER = address(0xA11CE);
    RerollToken internal token;
    RerollCoordinator internal coordinator;
    IMDPot internal pot;

    address internal alice = makeAddr("alice");
    address internal bob = makeAddr("bob");

    function setUp() public {
        vm.warp(1_800_000_000);
        token = new RerollToken();
        coordinator = new RerollCoordinator();
        pot = new IMDPot(OWNER);
        vm.startPrank(OWNER);
        pot.setToken(address(token));
        pot.setVrfConfig(address(coordinator), 1, keccak256("lane"), 750_000, 3, false);
        vm.stopPrank();
        _fund(alice);
        _fund(bob);
    }

    function _fund(address who) internal {
        token.mint(who, 1_000 ether);
        vm.prank(who);
        token.approve(address(pot), type(uint256).max);
    }

    function _winnerFor(uint256 word, uint256 roundId) internal view returns (address) {
        // One draw over the live tree; mirrors IMDPot._selectWinners for the first slot.
        uint256 position = uint256(keccak256(abi.encode(word, uint256(0)))) % pot.totalWeight(roundId);
        uint256 aliceWeight = pot.weightOf(roundId, alice);
        return position < aliceWeight ? alice : bob;
    }

    function test_pendingFulfillmentCannotBeVoidedByRetry() public {
        vm.prank(alice);
        pot.buyTickets(1);
        vm.prank(bob);
        pot.buyTickets(1);
        uint256 roundId = pot.currentRoundId();
        vm.warp(pot.getRound(roundId).endTime);
        pot.finalizeRound();
        uint256 firstRequest = pot.getRound(roundId).vrfRequestId;

        // The node's fulfillment for `firstRequest` is delayed (gas lane ceiling / outage) for over an hour.
        vm.warp(block.timestamp + 1 hours);

        // Pick a word under which bob loses; bob sees it in the mempool and front-runs with retryRandomness().
        uint256 word = 7;
        while (_winnerFor(word, roundId) != alice) word++;
        vm.prank(bob);
        pot.retryRandomness();

        // The node's transaction lands next. The word was produced by a valid VRF proof for this round's request;
        // it must settle the round rather than be discarded.
        coordinator.fulfill(firstRequest, word);

        assertEq(
            uint8(pot.getRound(roundId).status),
            uint8(IMDPot.RoundStatus.Finalized),
            "a valid fulfillment for this round's own request was discarded: bob re-rolled the draw"
        );
        assertEq(pot.getRound(roundId).winners[0], alice, "the losing outcome bob tried to escape must stand");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {IMDPot} from "src/IMDPot.sol";
import {MockIMDToken} from "test/mocks/MockIMDToken.sol";
import {MockVRFCoordinator} from "test/mocks/MockVRFCoordinator.sol";

/// @notice Fails on the current code: a round with 2048 one-ticket participants cannot be settled when the owner
///         configures the contract's own minimum callback gas limit. The round is then stuck in Drawing until it is
///         cancelled 24 hours after its end. Passes once settlement fits in MIN_CALLBACK_GAS_LIMIT (either by
///         raising the floor or by making settlement cheaper).
contract ProofCallbackGasFloorTest is Test {
    address internal constant OWNER = address(0xA11CE);
    IMDPot internal pot;
    MockIMDToken internal token;
    MockVRFCoordinator internal coordinator;

    function setUp() public {
        vm.warp(1_800_000_000);
        token = new MockIMDToken(18);
        coordinator = new MockVRFCoordinator();
        pot = new IMDPot(OWNER);
        vm.startPrank(OWNER);
        pot.setToken(address(token));
        pot.setVrfConfig(address(coordinator), 1, keccak256("kh"), pot.MIN_CALLBACK_GAS_LIMIT(), 3, false);
        vm.stopPrank();
    }

    function test_settlementFitsInMinimumCallbackGasWith2048Participants() public {
        for (uint256 i; i < 2048; ++i) {
            address p = address(uint160(0x10000 + i));
            token.mint(p, 1 ether);
            vm.prank(p);
            token.approve(address(pot), type(uint256).max);
            vm.prank(p);
            pot.buyTickets(1);
        }
        vm.warp(pot.getRound(1).endTime);
        pot.finalizeRound();
        uint256 req = pot.getRound(1).vrfRequestId;
        bool ok = coordinator.fulfillWithGas(req, uint256(keccak256("w")), pot.MIN_CALLBACK_GAS_LIMIT());
        assertTrue(ok, "settlement must fit in MIN_CALLBACK_GAS_LIMIT");
        assertEq(uint8(pot.getRound(1).status), uint8(IMDPot.RoundStatus.Finalized), "round stuck in Drawing");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {IMDPot} from "src/IMDPot.sol";
import {IVRFCoordinatorV2Plus, IVRFConsumerV2Plus, VRFV2PlusClient} from "src/interfaces/IVRFCoordinatorV2Plus.sol";

contract ProofToken {
    mapping(address => uint256) public balanceOf;
    mapping(address => mapping(address => uint256)) public allowance;

    function decimals() external pure returns (uint8) {
        return 18;
    }

    function mint(address to, uint256 amount) external {
        balanceOf[to] += amount;
    }

    function approve(address spender, uint256 amount) external returns (bool) {
        allowance[msg.sender][spender] = amount;
        return true;
    }

    function transfer(address to, uint256 amount) external returns (bool) {
        balanceOf[msg.sender] -= amount;
        balanceOf[to] += amount;
        return true;
    }

    function transferFrom(address from, address to, uint256 amount) external returns (bool) {
        allowance[from][msg.sender] -= amount;
        balanceOf[from] -= amount;
        balanceOf[to] += amount;
        return true;
    }
}

contract ProofCoordinator is IVRFCoordinatorV2Plus {
    uint256 public nextId = 1;
    mapping(uint256 => address) public consumerOf;

    function requestRandomWords(VRFV2PlusClient.RandomWordsRequest calldata) external returns (uint256 id) {
        id = nextId++;
        consumerOf[id] = msg.sender;
    }

    /// @dev Delivers a verified word for a request this coordinator accepted, as Chainlink would.
    function fulfill(uint256 id, uint256 word) external {
        uint256[] memory words = new uint256[](1);
        words[0] = word;
        IVRFConsumerV2Plus(consumerOf[id]).rawFulfillRandomWords(id, words);
    }
}

/// @notice Once a VRF request is outstanding, the word the coordinator delivers for it must settle the round.
///         Today any caller who sees the fulfillment transaction in the mempool can front-run it with
///         `retryRandomness()` (1 h after the request) or `cancelRound()` (24 h after the round end) and the
///         observed word is then ignored: an unfavourable draw is discarded and re-rolled or refunded.
contract RetryRerollProofTest is Test {
    address internal constant OWNER = address(0xA11CE0);
    IMDPot internal pot;
    ProofToken internal token;
    ProofCoordinator internal coordinator;
    address internal attacker = address(0xBAD);
    address internal bob = address(0xB0B);
    address internal carol = address(0xCA201);

    function setUp() public {
        vm.warp(1_800_000_000);
        token = new ProofToken();
        coordinator = new ProofCoordinator();
        pot = new IMDPot(OWNER);
        vm.startPrank(OWNER);
        pot.setToken(address(token));
        pot.setVrfConfig(address(coordinator), 1, keccak256("kh"), 750_000, 3, false);
        vm.stopPrank();
        address[3] memory players = [attacker, bob, carol];
        for (uint256 i; i < 3; ++i) {
            token.mint(players[i], 100 ether);
            vm.prank(players[i]);
            token.approve(address(pot), type(uint256).max);
            vm.prank(players[i]);
            pot.buyTickets(10);
        }
    }

    function test_observedWordCannotBeDiscardedByRetry() public {
        vm.warp(pot.getRound(1).endTime);
        pot.finalizeRound();
        uint256 requestId = pot.getRound(1).vrfRequestId;

        // Fulfillment is delayed past VRF_RETRY_DELAY (congestion, or an underfunded subscription the owner tops
        // up). The coordinator's fulfillment for `requestId` is now in the mempool; the attacker reads the word,
        // sees they lose, and front-runs it.
        vm.warp(block.timestamp + pot.VRF_RETRY_DELAY());
        vm.prank(attacker);
        try pot.retryRandomness() {} catch {}

        uint256 observedWord = 42;
        coordinator.fulfill(requestId, observedWord);

        IMDPot.Round memory round = pot.getRound(1);
        assertEq(uint8(round.status), uint8(IMDPot.RoundStatus.Finalized), "observed word was discarded");
        assertEq(round.randomWord, observedWord, "round settled with a re-rolled word");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {IMDPot} from "src/IMDPot.sol";
import {IVRFCoordinatorV2Plus, IVRFConsumerV2Plus, VRFV2PlusClient} from "src/interfaces/IVRFCoordinatorV2Plus.sol";

contract ProofToken {
    mapping(address => uint256) public balanceOf;
    mapping(address => mapping(address => uint256)) public allowance;

    function decimals() external pure returns (uint8) {
        return 18;
    }

    function mint(address to, uint256 amount) external {
        balanceOf[to] += amount;
    }

    function approve(address spender, uint256 amount) external returns (bool) {
        allowance[msg.sender][spender] = amount;
        return true;
    }

    function transfer(address to, uint256 amount) external returns (bool) {
        balanceOf[msg.sender] -= amount;
        balanceOf[to] += amount;
        return true;
    }

    function transferFrom(address from, address to, uint256 amount) external returns (bool) {
        allowance[from][msg.sender] -= amount;
        balanceOf[from] -= amount;
        balanceOf[to] += amount;
        return true;
    }
}

contract ProofCoordinator is IVRFCoordinatorV2Plus {
    uint256 public nextId = 1;
    mapping(uint256 => address) public consumerOf;

    function requestRandomWords(VRFV2PlusClient.RandomWordsRequest calldata) external returns (uint256 id) {
        id = nextId++;
        consumerOf[id] = msg.sender;
    }

    /// @dev Delivers a verified word for a request this coordinator accepted, as Chainlink would.
    function fulfill(uint256 id, uint256 word) external {
        uint256[] memory words = new uint256[](1);
        words[0] = word;
        IVRFConsumerV2Plus(consumerOf[id]).rawFulfillRandomWords(id, words);
    }
}

/// @notice Once a VRF request is outstanding, the word the coordinator delivers for it must settle the round.
///         Today any caller who sees the fulfillment transaction in the mempool can front-run it with
///         `retryRandomness()` (1 h after the request) or `cancelRound()` (24 h after the round end) and the
///         observed word is then ignored: an unfavourable draw is discarded and re-rolled or refunded.
contract CancelAbortProofTest is Test {
    address internal constant OWNER = address(0xA11CE0);
    IMDPot internal pot;
    ProofToken internal token;
    ProofCoordinator internal coordinator;
    address internal attacker = address(0xBAD);
    address internal bob = address(0xB0B);
    address internal carol = address(0xCA201);

    function setUp() public {
        vm.warp(1_800_000_000);
        token = new ProofToken();
        coordinator = new ProofCoordinator();
        pot = new IMDPot(OWNER);
        vm.startPrank(OWNER);
        pot.setToken(address(token));
        pot.setVrfConfig(address(coordinator), 1, keccak256("kh"), 750_000, 3, false);
        vm.stopPrank();
        address[3] memory players = [attacker, bob, carol];
        for (uint256 i; i < 3; ++i) {
            token.mint(players[i], 100 ether);
            vm.prank(players[i]);
            token.approve(address(pot), type(uint256).max);
            vm.prank(players[i]);
            pot.buyTickets(10);
        }
    }

    function test_observedWordCannotBeDiscardedByCancel() public {
        // Nobody finalises for a day (quiet game). Then the attacker finalises, and when the coordinator's
        // fulfillment appears in the mempool with a losing word, front-runs it with cancelRound for a refund.
        vm.warp(uint256(pot.getRound(1).endTime) + pot.CANCEL_DELAY());
        vm.prank(attacker);
        pot.finalizeRound();
        uint256 requestId = pot.getRound(1).vrfRequestId;

        vm.prank(attacker);
        try pot.cancelRound() {} catch {}

        uint256 observedWord = 42;
        coordinator.fulfill(requestId, observedWord);

        IMDPot.Round memory round = pot.getRound(1);
        assertEq(uint8(round.status), uint8(IMDPot.RoundStatus.Finalized), "observed word was discarded");
        assertEq(round.randomWord, observedWord, "round settled with a different word");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {IMDPot} from "src/IMDPot.sol";
import {IVRFCoordinatorV2Plus, IVRFConsumerV2Plus, VRFV2PlusClient} from "src/interfaces/IVRFCoordinatorV2Plus.sol";

/// @dev Plain 18-decimal ERC-20 with no hooks: the cheapest possible game token.
contract PlainToken {
    string public name = "IMD";
    string public symbol = "IMD";
    uint8 public decimals = 18;
    uint256 public totalSupply;
    mapping(address => uint256) public balanceOf;
    mapping(address => mapping(address => uint256)) public allowance;

    function mint(address to, uint256 amount) external {
        totalSupply += amount;
        balanceOf[to] += amount;
    }

    function approve(address spender, uint256 amount) external returns (bool) {
        allowance[msg.sender][spender] = amount;
        return true;
    }

    function transfer(address to, uint256 amount) external returns (bool) {
        balanceOf[msg.sender] -= amount;
        balanceOf[to] += amount;
        return true;
    }

    function transferFrom(address from, address to, uint256 amount) external returns (bool) {
        uint256 current = allowance[from][msg.sender];
        if (current != type(uint256).max) allowance[from][msg.sender] = current - amount;
        balanceOf[from] -= amount;
        balanceOf[to] += amount;
        return true;
    }
}

/// @dev Minimal coordinator: records the request and delivers the word with exactly the callbackGasLimit
///      the consumer asked for, as Chainlink's coordinator does.
contract ProofCoordinator is IVRFCoordinatorV2Plus {
    uint256 public nextId = 1;
    mapping(uint256 => address) public consumer;
    mapping(uint256 => uint32) public gasLimit;

    function requestRandomWords(VRFV2PlusClient.RandomWordsRequest calldata req) external returns (uint256 id) {
        id = nextId++;
        consumer[id] = msg.sender;
        gasLimit[id] = req.callbackGasLimit;
    }

    function fulfill(uint256 id, uint256 word) external returns (bool ok) {
        uint256[] memory words = new uint256[](1);
        words[0] = word;
        (ok,) = consumer[id].call{gas: gasLimit[id]}(
            abi.encodeWithSelector(IVRFConsumerV2Plus.rawFulfillRandomWords.selector, id, words)
        );
    }
}

/// @notice A round with 2048 single-ticket participants must settle when the owner configured the smallest
///         callback gas limit the contract itself accepts (MIN_CALLBACK_GAS_LIMIT = 600_000). On the current
///         code the fulfillment runs out of gas: the round stays in Drawing, retryRandomness re-requests with
///         the same limit, setVrfConfig reverts with RoundNotIdle, and the only exit is cancelRound after 24h.
contract MinCallbackGasProof is Test {
    IMDPot pot;
    PlainToken token;
    ProofCoordinator coord;
    address owner = address(0xA11CE);

    function setUp() public {
        vm.warp(1_800_000_000);
        token = new PlainToken();
        coord = new ProofCoordinator();
        pot = new IMDPot(owner);
        vm.startPrank(owner);
        pot.setToken(address(token));
        pot.setVrfConfig(address(coord), 1, keccak256("k"), pot.MIN_CALLBACK_GAS_LIMIT(), 3, false);
        vm.stopPrank();
    }

    function test_settlementFitsMinimumCallbackGasWith2048Participants() public {
        uint256 n = 2048;
        for (uint256 i = 1; i <= n; ++i) {
            address p = address(uint160(0x10000 + i));
            token.mint(p, 1 ether);
            vm.startPrank(p);
            token.approve(address(pot), type(uint256).max);
            pot.buyTickets(1);
            vm.stopPrank();
        }
        vm.warp(block.timestamp + 15 minutes);
        pot.finalizeRound();
        uint256 reqId = pot.getRound(1).vrfRequestId;

        bool ok = coord.fulfill(reqId, 12345);

        assertTrue(ok, "settlement ran out of the minimum accepted callback gas");
        assertEq(uint8(pot.getRound(1).status), uint8(IMDPot.RoundStatus.Finalized), "round stuck in Drawing");
        assertEq(pot.currentRoundId(), 2, "next round did not open");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {IMDPot} from "src/IMDPot.sol";
import {IVRFCoordinatorV2Plus, IVRFConsumerV2Plus, VRFV2PlusClient} from "src/interfaces/IVRFCoordinatorV2Plus.sol";

contract RerollToken is ERC20 {
    constructor() ERC20("IMD", "IMD") {}

    function mint(address to, uint256 amount) external {
        _mint(to, amount);
    }
}

/// @dev Records requests; a test delivers any word for any recorded request, as the Chainlink node would.
contract RerollCoordinator is IVRFCoordinatorV2Plus {
    uint256 public nextRequestId = 1;
    mapping(uint256 => address) public consumerOf;

    function requestRandomWords(VRFV2PlusClient.RandomWordsRequest calldata) external returns (uint256 requestId) {
        requestId = nextRequestId++;
        consumerOf[requestId] = msg.sender;
    }

    function fulfill(uint256 requestId, uint256 word) external {
        uint256[] memory words = new uint256[](1);
        words[0] = word;
        IVRFConsumerV2Plus(consumerOf[requestId]).rawFulfillRandomWords(requestId, words);
    }
}

/// @notice A pending VRF fulfillment whose random word is already public (it sits in the mempool) can be voided
///         by any participant who front-runs it with `retryRandomness()` once an hour has passed since the request.
///         The draw is re-rolled; the participant repeats until the outcome suits them. The fix is to keep every
///         outstanding request of the round valid so the first fulfillment to land settles the round and a later
///         `retryRandomness()` adds a request instead of invalidating the previous one.
contract RetryRerollTest is Test {
    address internal constant OWNER = address(0xA11CE);
    RerollToken internal token;
    RerollCoordinator internal coordinator;
    IMDPot internal pot;

    address internal alice = makeAddr("alice");
    address internal bob = makeAddr("bob");

    function setUp() public {
        vm.warp(1_800_000_000);
        token = new RerollToken();
        coordinator = new RerollCoordinator();
        pot = new IMDPot(OWNER);
        vm.startPrank(OWNER);
        pot.setToken(address(token));
        pot.setVrfConfig(address(coordinator), 1, keccak256("lane"), 750_000, 3, false);
        vm.stopPrank();
        _fund(alice);
        _fund(bob);
    }

    function _fund(address who) internal {
        token.mint(who, 1_000 ether);
        vm.prank(who);
        token.approve(address(pot), type(uint256).max);
    }

    function _winnerFor(uint256 word, uint256 roundId) internal view returns (address) {
        // One draw over the live tree; mirrors IMDPot._selectWinners for the first slot.
        uint256 position = uint256(keccak256(abi.encode(word, uint256(0)))) % pot.totalWeight(roundId);
        uint256 aliceWeight = pot.weightOf(roundId, alice);
        return position < aliceWeight ? alice : bob;
    }

    function test_pendingFulfillmentCannotBeVoidedByRetry() public {
        vm.prank(alice);
        pot.buyTickets(1);
        vm.prank(bob);
        pot.buyTickets(1);
        uint256 roundId = pot.currentRoundId();
        vm.warp(pot.getRound(roundId).endTime);
        pot.finalizeRound();
        uint256 firstRequest = pot.getRound(roundId).vrfRequestId;

        // The node's fulfillment for `firstRequest` is delayed (gas lane ceiling / outage) for over an hour.
        vm.warp(block.timestamp + 1 hours);

        // Pick a word under which bob loses; bob sees it in the mempool and front-runs with retryRandomness().
        uint256 word = 7;
        while (_winnerFor(word, roundId) != alice) word++;
        vm.prank(bob);
        pot.retryRandomness();

        // The node's transaction lands next. The word was produced by a valid VRF proof for this round's request;
        // it must settle the round rather than be discarded.
        coordinator.fulfill(firstRequest, word);

        assertEq(
            uint8(pot.getRound(roundId).status),
            uint8(IMDPot.RoundStatus.Finalized),
            "a valid fulfillment for this round's own request was discarded: bob re-rolled the draw"
        );
        assertEq(pot.getRound(roundId).winners[0], alice, "the losing outcome bob tried to escape must stand");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {IMDPot} from "src/IMDPot.sol";
import {IVRFCoordinatorV2Plus, IVRFConsumerV2Plus, VRFV2PlusClient} from "src/interfaces/IVRFCoordinatorV2Plus.sol";

contract ProofToken {
    mapping(address => uint256) public balanceOf;
    mapping(address => mapping(address => uint256)) public allowance;

    function decimals() external pure returns (uint8) {
        return 18;
    }

    function mint(address to, uint256 amount) external {
        balanceOf[to] += amount;
    }

    function approve(address spender, uint256 amount) external returns (bool) {
        allowance[msg.sender][spender] = amount;
        return true;
    }

    function transfer(address to, uint256 amount) external returns (bool) {
        balanceOf[msg.sender] -= amount;
        balanceOf[to] += amount;
        return true;
    }

    function transferFrom(address from, address to, uint256 amount) external returns (bool) {
        allowance[from][msg.sender] -= amount;
        balanceOf[from] -= amount;
        balanceOf[to] += amount;
        return true;
    }
}

contract ProofCoordinator is IVRFCoordinatorV2Plus {
    uint256 public nextId = 1;
    mapping(uint256 => address) public consumerOf;

    function requestRandomWords(VRFV2PlusClient.RandomWordsRequest calldata) external returns (uint256 id) {
        id = nextId++;
        consumerOf[id] = msg.sender;
    }

    /// @dev Delivers a verified word for a request this coordinator accepted, as Chainlink would.
    function fulfill(uint256 id, uint256 word) external {
        uint256[] memory words = new uint256[](1);
        words[0] = word;
        IVRFConsumerV2Plus(consumerOf[id]).rawFulfillRandomWords(id, words);
    }
}

/// @notice Once a VRF request is outstanding, the word the coordinator delivers for it must settle the round.
///         Today any caller who sees the fulfillment transaction in the mempool can front-run it with
///         `retryRandomness()` (1 h after the request) or `cancelRound()` (24 h after the round end) and the
///         observed word is then ignored: an unfavourable draw is discarded and re-rolled or refunded.
contract CancelAbortProofTest is Test {
    address internal constant OWNER = address(0xA11CE0);
    IMDPot internal pot;
    ProofToken internal token;
    ProofCoordinator internal coordinator;
    address internal attacker = address(0xBAD);
    address internal bob = address(0xB0B);
    address internal carol = address(0xCA201);

    function setUp() public {
        vm.warp(1_800_000_000);
        token = new ProofToken();
        coordinator = new ProofCoordinator();
        pot = new IMDPot(OWNER);
        vm.startPrank(OWNER);
        pot.setToken(address(token));
        pot.setVrfConfig(address(coordinator), 1, keccak256("kh"), 750_000, 3, false);
        vm.stopPrank();
        address[3] memory players = [attacker, bob, carol];
        for (uint256 i; i < 3; ++i) {
            token.mint(players[i], 100 ether);
            vm.prank(players[i]);
            token.approve(address(pot), type(uint256).max);
            vm.prank(players[i]);
            pot.buyTickets(10);
        }
    }

    function test_observedWordCannotBeDiscardedByCancel() public {
        // Nobody finalises for a day (quiet game). Then the attacker finalises, and when the coordinator's
        // fulfillment appears in the mempool with a losing word, front-runs it with cancelRound for a refund.
        vm.warp(uint256(pot.getRound(1).endTime) + pot.CANCEL_DELAY());
        vm.prank(attacker);
        pot.finalizeRound();
        uint256 requestId = pot.getRound(1).vrfRequestId;

        vm.prank(attacker);
        try pot.cancelRound() {} catch {}

        uint256 observedWord = 42;
        coordinator.fulfill(requestId, observedWord);

        IMDPot.Round memory round = pot.getRound(1);
        assertEq(uint8(round.status), uint8(IMDPot.RoundStatus.Finalized), "observed word was discarded");
        assertEq(round.randomWord, observedWord, "round settled with a different word");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {IMDPot} from "src/IMDPot.sol";
import {IVRFCoordinatorV2Plus, IVRFConsumerV2Plus, VRFV2PlusClient} from "src/interfaces/IVRFCoordinatorV2Plus.sol";

/// @dev A standard OpenZeppelin 18-decimal ERC-20 (no hooks, no fees), as the $IMD token is assumed to be.
contract PlainToken is ERC20 {
    constructor() ERC20("IMD", "IMD") {}

    function mint(address to, uint256 amount) external {
        _mint(to, amount);
    }
}

/// @dev Records requests and delivers a word with exactly the configured callback gas, as the Chainlink
///      coordinator does (it forwards `callbackGasLimit` and treats a reverting callback as fulfilled).
contract BoundedGasCoordinator is IVRFCoordinatorV2Plus {
    uint256 public nextId = 1;
    mapping(uint256 => address) public consumerOf;
    mapping(uint256 => uint32) public gasOf;

    function requestRandomWords(VRFV2PlusClient.RandomWordsRequest calldata req) external returns (uint256 id) {
        id = nextId++;
        consumerOf[id] = msg.sender;
        gasOf[id] = req.callbackGasLimit;
    }

    function fulfill(uint256 id, uint256 word) external returns (bool ok) {
        uint256[] memory words = new uint256[](1);
        words[0] = word;
        (ok,) = consumerOf[id].call{gas: gasOf[id]}(
            abi.encodeWithSelector(IVRFConsumerV2Plus.rawFulfillRandomWords.selector, id, words)
        );
    }
}

/// @notice Fails on the current code: with the contract's own minimum callback gas limit (600_000), a round of
///         2048 one-ticket participants cannot be settled; the callback runs out of gas, the coordinator counts the
///         request as fulfilled and the round stays in Drawing until a 24-hour cancel. Passes once settlement is
///         guaranteed to fit in MIN_CALLBACK_GAS_LIMIT (raise the floor or make settlement cheaper).
contract GasFloorProofTest is Test {
    address internal constant OWNER = address(0xA11CE);
    IMDPot internal pot;
    PlainToken internal token;
    BoundedGasCoordinator internal coordinator;

    function setUp() public {
        vm.warp(1_800_000_000);
        token = new PlainToken();
        coordinator = new BoundedGasCoordinator();
        pot = new IMDPot(OWNER);
        vm.startPrank(OWNER);
        pot.setToken(address(token));
        pot.setVrfConfig(address(coordinator), 1, keccak256("kh"), pot.MIN_CALLBACK_GAS_LIMIT(), 3, false);
        vm.stopPrank();
    }

    function test_settlementFitsInMinimumCallbackGasWith2048Participants() public {
        for (uint256 i; i < 2048; ++i) {
            address p = address(uint160(0x10000 + i));
            token.mint(p, 1 ether);
            vm.prank(p);
            token.approve(address(pot), type(uint256).max);
            vm.prank(p);
            pot.buyTickets(1);
        }
        vm.warp(pot.getRound(1).endTime);
        pot.finalizeRound();
        uint256 req = pot.getRound(1).vrfRequestId;
        // Settlement cost depends on which leaves the word selects (Fenwick walk depth); this word draws
        // leaves whose removal needs ~613k gas with 2048 one-ticket participants.
        bool ok = coordinator.fulfill(req, 777);
        assertTrue(ok, "settlement ran out of the minimum accepted callback gas");
        assertEq(uint8(pot.getRound(1).status), uint8(IMDPot.RoundStatus.Finalized), "round stuck in Drawing");
    }
}