// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {DeskVault} from "src/DeskVault.sol";
import {StrategyRegistry} from "src/StrategyRegistry.sol";

/// @notice Shares are priced at cost while capital is out, so the realised result of a trade is paid to
/// whoever holds shares at the moment `returnCapital` lands. A depositor who enters in the same block,
/// immediately before the settlement, and leaves immediately after it takes a risk-free share of the
/// profit that belongs to the depositors who funded the trade.
contract SettlementSandwichTest is Test {
    StrategyRegistry registry;
    DeskVault vault;

    address strategy = makeAddr("strategy");
    address alice = makeAddr("alice");
    address bob = makeAddr("bob");

    function setUp() public {
        registry = new StrategyRegistry();
        vault = new DeskVault(strategy, address(registry));
        vm.deal(alice, 1_000 ether);
        vm.deal(bob, 1_000 ether);
        vm.deal(strategy, 0);
    }

    function test_sameBlockDepositAroundProfitableSettlementIsNotFree() public {
        // Alice funds the desk and bears the whole trade risk.
        vm.prank(alice);
        vault.deposit{value: 100 ether}();

        vm.prank(strategy);
        uint256 id = registry.propose(keccak256("long"));
        vm.prank(strategy);
        vault.allocate(id, 80 ether);

        // The trade returns 120 ETH: 40 ETH profit on 80 ETH principal.
        vm.deal(strategy, 120 ether);

        // Bob sees returnCapital{value: 120 ether} in the mempool and bundles deposit -> settle -> withdraw
        // into the same block. No block or time passes between the three calls.
        uint256 bobBefore = bob.balance;
        vm.prank(bob);
        (bool depositOk,) = address(vault).call{value: 100 ether}(abi.encodeWithSelector(DeskVault.deposit.selector));

        vm.prank(strategy);
        vault.returnCapital{value: 120 ether}(id);

        if (depositOk) {
            uint256 bobShares = vault.sharesOf(bob);
            vm.prank(bob);
            (bool withdrawOk,) =
                address(vault).call(abi.encodeWithSelector(DeskVault.withdraw.selector, bobShares, bob));
            withdrawOk; // a fix may lock fresh shares; the only claim here is that Bob cannot come out ahead.
        }

        // Expected: Bob, who never had capital at risk, cannot end the block with more ETH than he started
        // with. Actual on the current code: Bob ends with ~1,020 ETH, taking half of Alice's 40 ETH profit.
        assertLe(bob.balance, bobBefore, "same-block depositor extracted trade profit from existing holders");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {DeskVault} from "src/DeskVault.sol";
import {StrategyRegistry} from "src/StrategyRegistry.sol";

/// @notice Deposits are priced at cost NAV while a trade is open and `returnCapital` realises the whole
/// result at once, so a depositor who enters just before settlement and leaves just after captures the
/// profit that belonged to the depositors who funded the trade. No privilege is needed: deposit and
/// withdraw are permissionless and the strategy wallet's trades and pending settlement are public.
contract SettlementSandwichTest is Test {
    StrategyRegistry registry;
    DeskVault vault;

    address strategy = makeAddr("strategy");
    address alice = makeAddr("alice");
    address attacker = makeAddr("attacker");

    function setUp() public {
        registry = new StrategyRegistry();
        vault = new DeskVault(strategy, address(registry));
        vm.deal(alice, 100 ether);
        vm.deal(attacker, 900 ether);
        vm.deal(strategy, 0);
    }

    function test_sandwichingReturnCapitalYieldsNoRiskFreeProfit() public {
        // Alice funds the desk alone.
        vm.prank(alice);
        vault.deposit{value: 100 ether}();

        // The strategy wallet logs a decision and takes 80 ETH out to trade.
        vm.prank(strategy);
        uint256 id = registry.propose(keccak256("long"));
        vm.prank(strategy);
        vault.allocate(id, 80 ether);

        // The trade closes with a 20 ETH profit: the strategy wallet now holds 100 ETH to return.
        vm.deal(strategy, 100 ether);

        // Attacker, who put nothing at risk during the trade, deposits at the stale cost NAV (100 ETH)
        // in the same block, just before the settlement transaction.
        uint256 attackerBefore = attacker.balance;
        vm.prank(attacker);
        uint256 attackerShares = vault.deposit{value: 900 ether}();

        // Settlement realises the 20 ETH profit into NAV at once.
        vm.prank(strategy);
        vault.returnCapital{value: 100 ether}(id);

        // Attacker leaves immediately. A revert here (e.g. a holding period) is fine for this test:
        // what must not happen is the attacker walking away with more ETH than they brought.
        vm.prank(attacker);
        (bool ok,) = address(vault).call(abi.encodeCall(DeskVault.withdraw, (attackerShares, attacker)));
        ok;

        // Expected: a depositor who bore no trade risk cannot extract a risk-free profit from Alice's trade.
        // Actual on the current code: the attacker exits with about 918 ETH, 18 of Alice's 20 ETH profit.
        assertLe(attacker.balance, attackerBefore, "attacker extracted risk-free profit from the settlement");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {DeskVault} from "src/DeskVault.sol";
import {StrategyRegistry} from "src/StrategyRegistry.sol";

/// @notice While a trade is open, DeskVault prices shares with the deployed capital at cost. The strategy
/// wallet trades in public and settles through a mempool-visible `returnCapital{value: proceeds}`, so an
/// unprivileged actor who knows the trade's result can transact at the stale NAV:
///   - profit: deposit just before settlement, withdraw just after, and take part of the profit;
///   - loss:   withdraw the idle ETH just before settlement and leave the whole loss to the others.
/// Both tests fail on the current code and pass once deposits/withdrawals during an open trade no longer
/// transfer value from passive shareholders (for example: no deposits while capital is out, and
/// withdrawals during an open trade limited to the withdrawer's pro-rata share of idle ETH, or a
/// settle-then-pay queue).
contract SettlementSandwichTest is Test {
    StrategyRegistry registry;
    DeskVault vault;

    address strategy = makeAddr("strategy");
    address alice = makeAddr("alice");
    address bob = makeAddr("bob");
    address attacker = makeAddr("attacker");

    function setUp() public {
        registry = new StrategyRegistry();
        vault = new DeskVault(strategy, address(registry));
        vm.deal(alice, 100 ether);
        vm.deal(bob, 100 ether);
        vm.deal(attacker, 20 ether);
    }

    function _open(uint256 amount, string memory label) internal returns (uint256 id) {
        vm.prank(strategy);
        id = registry.propose(keccak256(bytes(label)));
        vm.prank(strategy);
        vault.allocate(id, amount);
    }

    /// Profit side: attacker deposits 20 ETH in front of a settlement that returns 120 ETH on 80 ETH
    /// principal, then withdraws everything right after. Alice funded the whole trade.
    function test_frontRunProfitableSettlementExtractsValue() public {
        vm.prank(alice);
        vault.deposit{value: 100 ether}();
        uint256 id = _open(80 ether, "win");

        // Trade is up 40 ETH; `returnCapital{value: 120 ether}(id)` is in the mempool.
        vm.deal(strategy, 120 ether);

        // Attacker front-runs it. A low-level call so a fix that refuses deposits during an open trade
        // simply gives the attacker no shares instead of breaking the test.
        vm.prank(attacker);
        (bool ok,) = address(vault).call{value: 20 ether}(abi.encodeWithSelector(DeskVault.deposit.selector));
        if (!ok) vm.deal(attacker, 20 ether); // deposit refused: attacker keeps their 20 ETH

        vm.prank(strategy);
        vault.returnCapital{value: 120 ether}(id);

        // Attacker back-runs: withdraws every share they hold.
        uint256 shares = vault.sharesOf(attacker);
        if (shares > 0) {
            vm.prank(attacker);
            vault.withdraw(shares, attacker);
        }

        // Attacker put in 20 ETH for one block and must not come out with more than 20 ETH.
        assertLe(attacker.balance, 20 ether, "attacker took part of Alice's profit");
        // Alice, who funded the whole trade, must be worth the full 140 ETH.
        assertGe(vault.convertToAssets(vault.sharesOf(alice)), 140 ether - 1e6, "Alice lost profit to the sandwich");
    }

    /// Loss side: Alice and Bob each deposit 100 ETH; 160 ETH go out and are lost. Bob sees the strategy
    /// wallet's balance hit zero (public) and withdraws before `returnCapital(id)` with zero value lands.
    function test_withdrawBeforeLossSettlementShiftsLossToOthers() public {
        vm.prank(alice);
        uint256 aliceShares = vault.deposit{value: 100 ether}();
        vm.prank(bob);
        uint256 bobShares = vault.deposit{value: 100 ether}();
        uint256 id = _open(160 ether, "lose");

        // Trade is a total loss. Before settlement NAV still counts the 160 ETH at cost.
        vm.deal(strategy, 0);

        // Bob withdraws as much as the idle 40 ETH allows, at the stale NAV: shares worth 40 ETH.
        uint256 sharesFor40 = vault.convertToShares(40 ether);
        if (sharesFor40 > bobShares) sharesFor40 = bobShares;
        vm.prank(bob);
        (bool ok,) = address(vault).call(abi.encodeWithSelector(DeskVault.withdraw.selector, sharesFor40, bob));
        ok; // a fix may pay less or queue; what matters is the split below

        vm.prank(strategy);
        vault.returnCapital(id);

        uint256 bobTotal = bob.balance + vault.convertToAssets(vault.sharesOf(bob));
        uint256 aliceTotal = alice.balance + vault.convertToAssets(vault.sharesOf(alice));
        assertEq(vault.sharesOf(alice), aliceShares, "Alice never moved");

        // Both held equal shares through an identical loss; neither may end up more than dust ahead.
        assertApproxEqAbs(bobTotal, aliceTotal, 1e6, "Bob escaped the loss at Alice's expense");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {BenchmarkTracker} from "src/BenchmarkTracker.sol";
import {DeploymentConfig} from "src/DeploymentConfig.sol";
import {AggregatorV3Interface} from "src/interfaces/AggregatorV3Interface.sol";

contract Feed is AggregatorV3Interface {
    int256 public answer;
    uint256 public updatedAt;

    constructor(int256 a) {
        answer = a;
        updatedAt = block.timestamp;
    }

    function set(int256 a, uint256 t) external {
        answer = a;
        updatedAt = t;
    }

    function decimals() external pure returns (uint8) {
        return 8;
    }

    function description() external pure returns (string memory) {
        return "mock";
    }

    function latestRoundData() external view returns (uint80, int256, uint256, uint256, uint80) {
        return (1, answer, updatedAt, updatedAt, 1);
    }
}

/// @notice One stale feed must not erase the whole epoch. On mainnet the SPY-USD (24/5) feed went 80 hours
/// without an update over Labor Day weekend 2026 (aggregator round 480 - 42, updatedAt 1788825623), above
/// the 72-hour bound, while BTC/USD kept updating. In that state `snapshot()` reverts for the whole
/// 200-block window and the epoch's BTC point and coin flip are lost for good (the start blockhash
/// expires after 256 blocks). Fails on the current code; passes once a stale equity feed degrades only
/// the equity series (for example: record the epoch with the last good equity price or an "unavailable"
/// mark, and keep the BTC and flip entries).
contract StaleEquityFeedLosesEpochTest is Test {
    BenchmarkTracker tracker;
    Feed btc;
    Feed spy;

    function setUp() public {
        vm.warp(1_788_000_000);
        vm.roll(1_000_000);
        btc = new Feed(100_000e8);
        spy = new Feed(600e8);
        tracker = new BenchmarkTracker(address(btc), address(spy));
        // Epoch 0 is recorded normally.
        vm.roll(block.number + 1);
        tracker.snapshot();
    }

    function test_staleEquityFeedDoesNotLoseBtcAndFlipForTheEpoch() public {
        // Move to the start of epoch 1 (+1 block, inside the window).
        uint256 start = tracker.epochStartBlock(1);
        vm.roll(start + 1);
        vm.warp(block.timestamp + DeploymentConfig.EPOCH_BLOCKS * 12);

        // BTC/USD fresh; SPY-USD last updated 80 hours ago (holiday weekend, as observed on mainnet).
        btc.set(110_000e8, block.timestamp);
        spy.set(600e8, block.timestamp - 80 hours);

        // Try every block of the window, as a diligent snapshotter would.
        bool recorded;
        for (uint256 b = start + 1; b <= start + DeploymentConfig.SNAPSHOT_WINDOW; ++b) {
            vm.roll(b);
            vm.warp(block.timestamp + 12);
            (bool ok,) = address(tracker).call(abi.encodeWithSelector(BenchmarkTracker.snapshot.selector));
            if (ok) {
                recorded = true;
                break;
            }
        }

        assertTrue(recorded, "epoch 1 could not be recorded at all: BTC point and coin flip lost");
        BenchmarkTracker.Snapshot memory s = tracker.getSnapshot(1);
        assertEq(s.btcNav, 1.1e18, "BTC benchmark for the epoch must still be recorded");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {DeskVault} from "src/DeskVault.sol";
import {StrategyRegistry} from "src/StrategyRegistry.sol";

/// @notice README / DeploymentConfig promise: capital out can never exceed MAX_ALLOCATION_BPS (80%) of
/// total assets, so at least 20% stays idle for withdrawals. The cap is only checked inside `allocate`,
/// against totalAssets that includes capital already out, so the strategy wallet can deposit its own
/// ETH to enlarge the cap, allocate, then withdraw the idle remainder: deployedCapital becomes 100% of
/// totalAssets and the idle balance 0, leaving the other depositor unable to withdraw a single wei.
contract AllocationCapBypassTest is Test {
    StrategyRegistry registry;
    DeskVault vault;
    address strategy = makeAddr("strategy");
    address alice = makeAddr("alice");

    function setUp() public {
        registry = new StrategyRegistry();
        vault = new DeskVault(strategy, address(registry));
        vm.deal(alice, 100 ether);
        vm.deal(strategy, 400 ether);
    }

    function test_deployedCapitalNeverExceedsCapOfTotalAssets() public {
        vm.prank(alice);
        uint256 aliceShares = vault.deposit{value: 100 ether}();

        vm.startPrank(strategy);
        uint256 id = registry.propose(keccak256("take it all"));
        vault.deposit{value: 400 ether}();
        // Cap = 80% of 500 = 400: the strategy's own deposit lifted the cap over Alice's whole balance.
        (bool allocOk,) = address(vault).call(abi.encodeCall(DeskVault.allocate, (id, 400 ether)));
        // Withdraw the idle 100 ETH, which is Alice's money, by burning shares worth exactly that.
        uint256 toBurn = vault.convertToShares(100 ether);
        while (vault.convertToAssets(toBurn) > address(vault).balance) toBurn -= 1;
        (bool withdrawOk,) = address(vault).call(abi.encodeCall(DeskVault.withdraw, (toBurn, strategy)));
        vm.stopPrank();
        allocOk;
        withdrawOk;

        uint256 total = vault.totalAssets();
        assertGt(total, 0);
        // Expected: deployedCapital <= 80% of totalAssets at all times. Actual on this code: 100%,
        // idle balance 0, and Alice (worth 100 ETH of shares) cannot withdraw anything.
        assertLe(vault.deployedCapital() * 10_000 / total, 8000, "capital out exceeds MAX_ALLOCATION_BPS of total assets");
        assertGt(address(vault).balance, 0, "no idle ETH left for depositors");
        uint256 minimal = 1e18; // one 1e18 share lot, worth ~1e15 wei at the starting NAV
        if (aliceShares >= minimal) {
            vm.prank(alice);
            vault.withdraw(minimal, alice);
        }
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {DeskVault} from "src/DeskVault.sol";
import {StrategyRegistry} from "src/StrategyRegistry.sol";

/// @notice Proof: shares are priced with capital out counted at cost, so the result of an open trade is
/// applied in one step by `returnCapital`. Whoever deposits just before that call and withdraws just
/// after takes a pro-rata cut of a profit earned with other people's money, with no time at risk.
contract SettlementSandwichProof is Test {
    StrategyRegistry registry;
    DeskVault vault;
    address strategy = makeAddr("strategy");
    address alice = makeAddr("alice");
    address attacker = makeAddr("attacker");

    function setUp() public {
        registry = new StrategyRegistry();
        vault = new DeskVault(strategy, address(registry));
    }

    function test_lateDepositorCannotCaptureProfitOfTradeTheyDidNotFund() public {
        // Alice funds the desk; the strategy wallet takes 80 ETH out on strategy 1.
        vm.deal(alice, 100 ether);
        vm.prank(alice);
        vault.deposit{value: 100 ether}();
        vm.startPrank(strategy);
        uint256 id = registry.propose(keccak256("trade"));
        vault.allocate(id, 80 ether);
        vm.stopPrank();

        // The trade made 40 ETH. The settlement transaction is visible before it lands.
        // Front-run: deposit at the stale, at-cost NAV.
        vm.deal(attacker, 900 ether);
        vm.prank(attacker);
        uint256 shares = vault.deposit{value: 900 ether}();

        // Settlement: 80 ETH principal comes back as 120 ETH.
        vm.deal(strategy, 120 ether);
        vm.prank(strategy);
        vault.returnCapital{value: 120 ether}(id);

        // Back-run: withdraw everything in the same block.
        vm.prank(attacker);
        try vault.withdraw(shares, attacker) {} catch {}

        // Expected: the attacker funded none of the trade and is at most made whole.
        // Actual: attacker.balance == 936 ETH, i.e. 36 of Alice's 40 ETH profit.
        assertLe(attacker.balance, 900 ether, "late depositor walked away with the trade's profit");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {BenchmarkTracker} from "src/BenchmarkTracker.sol";
import {AggregatorV3Interface} from "src/interfaces/AggregatorV3Interface.sol";

contract Feed is AggregatorV3Interface {
    int256 public answer;
    uint256 public updatedAt;

    function set(int256 a) external {
        answer = a;
        updatedAt = block.timestamp;
    }

    function decimals() external pure returns (uint8) {
        return 8;
    }

    function description() external pure returns (string memory) {
        return "feed";
    }

    function latestRoundData() external view returns (uint80, int256, uint256, uint256, uint80) {
        return (1, answer, updatedAt, updatedAt, 1);
    }
}

/// @notice Proof: the contract and README say that when an epoch is not snapshotted its flip is lost and
/// "the flip benchmark then holds cash across the gap". The code instead applies the last recorded
/// epoch's flip to the whole price move up to the next snapshot, however many epochs were skipped.
contract FlipGapProof is Test {
    uint256 constant EPOCH = 7200;
    Feed btc;
    Feed spy;
    BenchmarkTracker tracker;
    uint256 start;

    function setUp() public {
        vm.roll(20_000_000);
        vm.warp(1_800_000_000);
        btc = new Feed();
        spy = new Feed();
        tracker = new BenchmarkTracker(address(btc), address(spy));
        start = block.number;
    }

    function _goto(uint256 epoch, int256 btcPrice, bool heads) internal {
        uint256 target = start + epoch * EPOCH + 1;
        vm.warp(1_800_000_000 + (target - start) * 12);
        vm.roll(target);
        vm.setBlockhash(target - 1, bytes32(uint256(heads ? 1 : 2)));
        btc.set(btcPrice);
        spy.set(700e8);
    }

    function test_flipHoldsCashAcrossAGapOfMissedEpochs() public {
        // Epoch 0 starts on heads (odd blockhash): the flip holds BTC for epoch 0.
        _goto(0, 100_000e8, true);
        tracker.snapshot();
        assertTrue(tracker.getSnapshot(0).heads);

        // Epochs 1..9 are never snapshotted: their flips are lost. BTC doubles somewhere in the gap.
        _goto(10, 200_000e8, false);
        tracker.snapshot();

        // Expected (README "holds cash across the gap", BenchmarkTracker @dev): the nine lost flips are
        // cash, so one heads flip cannot carry BTC exposure for ten epochs; flip NAV must not have
        // tracked the whole move. Actual: flipNav == 2e18, identical to hold-BTC.
        BenchmarkTracker.Snapshot memory s = tracker.getSnapshot(10);
        assertEq(s.btcNav, 2e18);
        assertLt(s.flipNav, s.btcNav, "flip benchmark held BTC across nine epochs it has no flip for");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {DeskVault} from "src/DeskVault.sol";
import {StrategyRegistry} from "src/StrategyRegistry.sol";

/// @notice Proof: MAX_ALLOCATION_BPS is documented as keeping 20% idle "so depositors can always
/// withdraw something" and the README says the strategy wallet "is trusted with up to 80% of total
/// assets". The cap is recomputed on what is left after every write-off, so allocate + zero-value
/// returnCapital in a loop moves out 80%, then 80% of the rest, and so on: all of it.
contract AllocationCapProof is Test {
    function test_strategyWalletCannotTakeMoreThanEightyPercentOfDeposits() public {
        StrategyRegistry registry = new StrategyRegistry();
        address strategy = makeAddr("strategy");
        DeskVault vault = new DeskVault(strategy, address(registry));
        address alice = makeAddr("alice");
        vm.deal(alice, 100 ether);
        vm.prank(alice);
        vault.deposit{value: 100 ether}();

        vm.startPrank(strategy);
        for (uint256 i; i < 30; ++i) {
            uint256 amount = vault.allocationHeadroom();
            if (amount == 0) break;
            uint256 id = registry.propose(keccak256(abi.encode(i)));
            vault.allocate(id, amount);
            vault.returnCapital{value: 0}(id);
        }
        vm.stopPrank();

        // Expected: at most 80 ETH ever leaves; at least 20 ETH stays for Alice.
        // Actual: strategy.balance > 99.999999 ETH and the vault holds dust, in one transaction's worth of calls.
        assertLe(strategy.balance, 80 ether, "strategy wallet took more than the documented 80%");
        assertGe(address(vault).balance, 20 ether, "idle reserve for withdrawals is gone");
    }
}