// SPDX-License-Identifier: MIT
// OpenZeppelin Contracts (last updated v4.9.0) (utils/Address.sol)

pragma solidity ^0.8.1;

/**
 * @dev Collection of functions related to the address type
 */
library Address {
    /**
     * @dev Returns true if `account` is a contract.
     *
     * [IMPORTANT]
     * ====
     * It is unsafe to assume that an address for which this function returns
     * false is an externally-owned account (EOA) and not a contract.
     *
     * Among others, `isContract` will return false for the following
     * types of addresses:
     *
     *  - an externally-owned account
     *  - a contract in construction
     *  - an address where a contract will be created
     *  - an address where a contract lived, but was destroyed
     *
     * Furthermore, `isContract` will also return true if the target contract within
     * the same transaction is already scheduled for destruction by `SELFDESTRUCT`,
     * which only has an effect at the end of a transaction.
     * ====
     *
     * [IMPORTANT]
     * ====
     * You shouldn't rely on `isContract` to protect against flash loan attacks!
     *
     * Preventing calls from contracts is highly discouraged. It breaks composability, breaks support for smart wallets
     * like Gnosis Safe, and does not provide security since it can be circumvented by calling from a contract
     * constructor.
     * ====
     */
    function isContract(address account) internal view returns (bool) {
        // This method relies on extcodesize/address.code.length, which returns 0
        // for contracts in construction, since the code is only stored at the end
        // of the constructor execution.

        return account.code.length > 0;
    }

    /**
     * @dev Replacement for Solidity's `transfer`: sends `amount` wei to
     * `recipient`, forwarding all available gas and reverting on errors.
     *
     * https://eips.ethereum.org/EIPS/eip-1884[EIP1884] increases the gas cost
     * of certain opcodes, possibly making contracts go over the 2300 gas limit
     * imposed by `transfer`, making them unable to receive funds via
     * `transfer`. {sendValue} removes this limitation.
     *
     * https://consensys.net/diligence/blog/2019/09/stop-using-soliditys-transfer-now/[Learn more].
     *
     * IMPORTANT: because control is transferred to `recipient`, care must be
     * taken to not create reentrancy vulnerabilities. Consider using
     * {ReentrancyGuard} or the
     * https://solidity.readthedocs.io/en/v0.8.0/security-considerations.html#use-the-checks-effects-interactions-pattern[checks-effects-interactions pattern].
     */
    function sendValue(address payable recipient, uint256 amount) internal {
        require(address(this).balance >= amount, "Address: insufficient balance");

        (bool success, ) = recipient.call{value: amount}("");
        require(success, "Address: unable to send value, recipient may have reverted");
    }

    /**
     * @dev Performs a Solidity function call using a low level `call`. A
     * plain `call` is an unsafe replacement for a function call: use this
     * function instead.
     *
     * If `target` reverts with a revert reason, it is bubbled up by this
     * function (like regular Solidity function calls).
     *
     * Returns the raw returned data. To convert to the expected return value,
     * use https://solidity.readthedocs.io/en/latest/units-and-global-variables.html?highlight=abi.decode#abi-encoding-and-decoding-functions[`abi.decode`].
     *
     * Requirements:
     *
     * - `target` must be a contract.
     * - calling `target` with `data` must not revert.
     *
     * _Available since v3.1._
     */
    function functionCall(address target, bytes memory data) internal returns (bytes memory) {
        return functionCallWithValue(target, data, 0, "Address: low-level call failed");
    }

    /**
     * @dev Same as {xref-Address-functionCall-address-bytes-}[`functionCall`], but with
     * `errorMessage` as a fallback revert reason when `target` reverts.
     *
     * _Available since v3.1._
     */
    function functionCall(
        address target,
        bytes memory data,
        string memory errorMessage
    ) internal returns (bytes memory) {
        return functionCallWithValue(target, data, 0, errorMessage);
    }

    /**
     * @dev Same as {xref-Address-functionCall-address-bytes-}[`functionCall`],
     * but also transferring `value` wei to `target`.
     *
     * Requirements:
     *
     * - the calling contract must have an ETH balance of at least `value`.
     * - the called Solidity function must be `payable`.
     *
     * _Available since v3.1._
     */
    function functionCallWithValue(address target, bytes memory data, uint256 value) internal returns (bytes memory) {
        return functionCallWithValue(target, data, value, "Address: low-level call with value failed");
    }

    /**
     * @dev Same as {xref-Address-functionCallWithValue-address-bytes-uint256-}[`functionCallWithValue`], but
     * with `errorMessage` as a fallback revert reason when `target` reverts.
     *
     * _Available since v3.1._
     */
    function functionCallWithValue(
        address target,
        bytes memory data,
        uint256 value,
        string memory errorMessage
    ) internal returns (bytes memory) {
        require(address(this).balance >= value, "Address: insufficient balance for call");
        (bool success, bytes memory returndata) = target.call{value: value}(data);
        return verifyCallResultFromTarget(target, success, returndata, errorMessage);
    }

    /**
     * @dev Same as {xref-Address-functionCall-address-bytes-}[`functionCall`],
     * but performing a static call.
     *
     * _Available since v3.3._
     */
    function functionStaticCall(address target, bytes memory data) internal view returns (bytes memory) {
        return functionStaticCall(target, data, "Address: low-level static call failed");
    }

    /**
     * @dev Same as {xref-Address-functionCall-address-bytes-string-}[`functionCall`],
     * but performing a static call.
     *
     * _Available since v3.3._
     */
    function functionStaticCall(
        address target,
        bytes memory data,
        string memory errorMessage
    ) internal view returns (bytes memory) {
        (bool success, bytes memory returndata) = target.staticcall(data);
        return verifyCallResultFromTarget(target, success, returndata, errorMessage);
    }

    /**
     * @dev Same as {xref-Address-functionCall-address-bytes-}[`functionCall`],
     * but performing a delegate call.
     *
     * _Available since v3.4._
     */
    function functionDelegateCall(address target, bytes memory data) internal returns (bytes memory) {
        return functionDelegateCall(target, data, "Address: low-level delegate call failed");
    }

    /**
     * @dev Same as {xref-Address-functionCall-address-bytes-string-}[`functionCall`],
     * but performing a delegate call.
     *
     * _Available since v3.4._
     */
    function functionDelegateCall(
        address target,
        bytes memory data,
        string memory errorMessage
    ) internal returns (bytes memory) {
        (bool success, bytes memory returndata) = target.delegatecall(data);
        return verifyCallResultFromTarget(target, success, returndata, errorMessage);
    }

    /**
     * @dev Tool to verify that a low level call to smart-contract was successful, and revert (either by bubbling
     * the revert reason or using the provided one) in case of unsuccessful call or if target was not a contract.
     *
     * _Available since v4.8._
     */
    function verifyCallResultFromTarget(
        address target,
        bool success,
        bytes memory returndata,
        string memory errorMessage
    ) internal view returns (bytes memory) {
        if (success) {
            if (returndata.length == 0) {
                // only check isContract if the call was successful and the return data is empty
                // otherwise we already know that it was a contract
                require(isContract(target), "Address: call to non-contract");
            }
            return returndata;
        } else {
            _revert(returndata, errorMessage);
        }
    }

    /**
     * @dev Tool to verify that a low level call was successful, and revert if it wasn't, either by bubbling the
     * revert reason or using the provided one.
     *
     * _Available since v4.3._
     */
    function verifyCallResult(
        bool success,
        bytes memory returndata,
        string memory errorMessage
    ) internal pure returns (bytes memory) {
        if (success) {
            return returndata;
        } else {
            _revert(returndata, errorMessage);
        }
    }

    function _revert(bytes memory returndata, string memory errorMessage) private pure {
        // Look for revert reason and bubble it up if present
        if (returndata.length > 0) {
            // The easiest way to bubble the revert reason is using memory via assembly
            /// @solidity memory-safe-assembly
            assembly {
                let returndata_size := mload(returndata)
                revert(add(32, returndata), returndata_size)
            }
        } else {
            revert(errorMessage);
        }
    }
}

// SPDX-License-Identifier: GPL-3.0-or-later
pragma solidity ^0.8.19;

// Taken from: Pendle finance v2

/// @notice Parameters for controlling the approximation process
/// @dev The approximation process is a binary search algorithm that finds the value that satisfies the provided function `f`.
/// By default, NapierPool defines swap formula in terms of Principal token (Base Pool LP token). To swap a given amount of Underlying token,
/// it's necessary to run an approximation algorithm to find the corresponding amount of Principal token to swap in/out
/// because computing inverse of the swap function is very hard.
/// The approximation algorithm will run as follows:
/// Let f(x) be the function that calculates difference between the desired value and the computed value for a given x (the amount of Base pool LP token to swap in/out)
/// The algorithm will find the value x that satisfies f(x) ~= ε, where ε is the relative error tolerance.
/// for a given range [a, b],
/// ```
///     mid = (a + b) / 2
///     error_mid = f(mid)
///     if error_mid <= eps
///         return mid
///     if error_mid > 0
///         a = mid
///     else
///         b = mid
/// ```
/// The algorithm will run for `maxIteration` times, or until the relative error tolerance `eps` is satisfied.
/// @param guessMin The lower bound of the guess range
/// @param guessMax The upper bound of the guess range
/// @param maxIteration The maximum number of iterations to run the approximation algorithm
/// @param eps The maximum relative error tolerance (in 18 decimals) between the desired value and the computed value. 0.1% = 1e15 (1e18/1000)
struct ApproxParams {
    uint256 guessMin;
    uint256 guessMax;
    uint256 maxIteration;
    uint256 eps;
}

// SPDX-License-Identifier: GPL-3.0-or-later
pragma solidity ^0.8.19;

import {IERC20} from "@openzeppelin/contracts@4.9.3/token/ERC20/IERC20.sol";
import {ITranche} from "@napier/v1-tranche/src/interfaces/ITranche.sol";

enum CallbackType {
    SwapPtForUnderlying,
    SwapUnderlyingForPt,
    SwapYtForUnderlying,
    SwapUnderlyingForYt,
    AddLiquidityPts,
    AddLiquidityOnePt,
    AddLiquidityOneUnderlying
}

library CallbackDataTypes {
    function getCallbackType(bytes calldata data) internal pure returns (CallbackType callbackType) {
        // Read the first 32 bytes of the calldata
        assembly {
            callbackType := calldataload(data.offset)
        }
    }

    struct AddLiquidityData {
        address payer;
        address underlying;
        address basePool;
    }

    struct SwapPtForUnderlyingData {
        address payer;
        IERC20 pt;
    }

    struct SwapUnderlyingForPtData {
        address payer;
        uint256 underlyingInMax;
    }

    struct SwapYtForUnderlyingData {
        address payer;
        ITranche pt;
        uint256 ytIn;
        address recipient;
        uint256 underlyingOutMin;
    }

    struct SwapUnderlyingForYtData {
        address payer;
        ITranche pt;
        IERC20 yt;
        address recipient;
        uint256 underlyingDeposit;
        uint256 maxUnderlyingPull;
    }
}

// SPDX-License-Identifier: MIT
pragma solidity >=0.8.19;

import "./Errors.sol" as CastingErrors;
import { MAX_UINT128, MAX_UINT40 } from "../Common.sol";
import { uMAX_SD1x18 } from "../sd1x18/Constants.sol";
import { SD1x18 } from "../sd1x18/ValueType.sol";
import { uMAX_SD59x18 } from "../sd59x18/Constants.sol";
import { SD59x18 } from "../sd59x18/ValueType.sol";
import { uMAX_UD2x18 } from "../ud2x18/Constants.sol";
import { UD2x18 } from "../ud2x18/ValueType.sol";
import { UD60x18 } from "./ValueType.sol";

/// @notice Casts a UD60x18 number into SD1x18.
/// @dev Requirements:
/// - x must be less than or equal to `uMAX_SD1x18`.
function intoSD1x18(UD60x18 x) pure returns (SD1x18 result) {
    uint256 xUint = UD60x18.unwrap(x);
    if (xUint > uint256(int256(uMAX_SD1x18))) {
        revert CastingErrors.PRBMath_UD60x18_IntoSD1x18_Overflow(x);
    }
    result = SD1x18.wrap(int64(uint64(xUint)));
}

/// @notice Casts a UD60x18 number into UD2x18.
/// @dev Requirements:
/// - x must be less than or equal to `uMAX_UD2x18`.
function intoUD2x18(UD60x18 x) pure returns (UD2x18 result) {
    uint256 xUint = UD60x18.unwrap(x);
    if (xUint > uMAX_UD2x18) {
        revert CastingErrors.PRBMath_UD60x18_IntoUD2x18_Overflow(x);
    }
    result = UD2x18.wrap(uint64(xUint));
}

/// @notice Casts a UD60x18 number into SD59x18.
/// @dev Requirements:
/// - x must be less than or equal to `uMAX_SD59x18`.
function intoSD59x18(UD60x18 x) pure returns (SD59x18 result) {
    uint256 xUint = UD60x18.unwrap(x);
    if (xUint > uint256(uMAX_SD59x18)) {
        revert CastingErrors.PRBMath_UD60x18_IntoSD59x18_Overflow(x);
    }
    result = SD59x18.wrap(int256(xUint));
}

/// @notice Casts a UD60x18 number into uint128.
/// @dev This is basically an alias for {unwrap}.
function intoUint256(UD60x18 x) pure returns (uint256 result) {
    result = UD60x18.unwrap(x);
}

/// @notice Casts a UD60x18 number into uint128.
/// @dev Requirements:
/// - x must be less than or equal to `MAX_UINT128`.
function intoUint128(UD60x18 x) pure returns (uint128 result) {
    uint256 xUint = UD60x18.unwrap(x);
    if (xUint > MAX_UINT128) {
        revert CastingErrors.PRBMath_UD60x18_IntoUint128_Overflow(x);
    }
    result = uint128(xUint);
}

/// @notice Casts a UD60x18 number into uint40.
/// @dev Requirements:
/// - x must be less than or equal to `MAX_UINT40`.
function intoUint40(UD60x18 x) pure returns (uint40 result) {
    uint256 xUint = UD60x18.unwrap(x);
    if (xUint > MAX_UINT40) {
        revert CastingErrors.PRBMath_UD60x18_IntoUint40_Overflow(x);
    }
    result = uint40(xUint);
}

/// @notice Alias for {wrap}.
function ud(uint256 x) pure returns (UD60x18 result) {
    result = UD60x18.wrap(x);
}

/// @notice Alias for {wrap}.
function ud60x18(uint256 x) pure returns (UD60x18 result) {
    result = UD60x18.wrap(x);
}

/// @notice Unwraps a UD60x18 number into uint256.
function unwrap(UD60x18 x) pure returns (uint256 result) {
    result = UD60x18.unwrap(x);
}

/// @notice Wraps a uint256 number into the UD60x18 value type.
function wrap(uint256 x) pure returns (UD60x18 result) {
    result = UD60x18.wrap(x);
}

// SPDX-License-Identifier: MIT
pragma solidity >=0.8.19;

// Common.sol
//
// Common mathematical functions needed by both SD59x18 and UD60x18. Note that these global functions do not
// always operate with SD59x18 and UD60x18 numbers.

/*//////////////////////////////////////////////////////////////////////////
                                CUSTOM ERRORS
//////////////////////////////////////////////////////////////////////////*/

/// @notice Thrown when the resultant value in {mulDiv} overflows uint256.
error PRBMath_MulDiv_Overflow(uint256 x, uint256 y, uint256 denominator);

/// @notice Thrown when the resultant value in {mulDiv18} overflows uint256.
error PRBMath_MulDiv18_Overflow(uint256 x, uint256 y);

/// @notice Thrown when one of the inputs passed to {mulDivSigned} is `type(int256).min`.
error PRBMath_MulDivSigned_InputTooSmall();

/// @notice Thrown when the resultant value in {mulDivSigned} overflows int256.
error PRBMath_MulDivSigned_Overflow(int256 x, int256 y);

/*//////////////////////////////////////////////////////////////////////////
                                    CONSTANTS
//////////////////////////////////////////////////////////////////////////*/

/// @dev The maximum value a uint128 number can have.
uint128 constant MAX_UINT128 = type(uint128).max;

/// @dev The maximum value a uint40 number can have.
uint40 constant MAX_UINT40 = type(uint40).max;

/// @dev The unit number, which the decimal precision of the fixed-point types.
uint256 constant UNIT = 1e18;

/// @dev The unit number inverted mod 2^256.
uint256 constant UNIT_INVERSE = 78156646155174841979727994598816262306175212592076161876661_508869554232690281;

/// @dev The the largest power of two that divides the decimal value of `UNIT`. The logarithm of this value is the least significant
/// bit in the binary representation of `UNIT`.
uint256 constant UNIT_LPOTD = 262144;

/*//////////////////////////////////////////////////////////////////////////
                                    FUNCTIONS
//////////////////////////////////////////////////////////////////////////*/

/// @notice Calculates the binary exponent of x using the binary fraction method.
/// @dev Has to use 192.64-bit fixed-point numbers. See https://ethereum.stackexchange.com/a/96594/24693.
/// @param x The exponent as an unsigned 192.64-bit fixed-point number.
/// @return result The result as an unsigned 60.18-decimal fixed-point number.
/// @custom:smtchecker abstract-function-nondet
function exp2(uint256 x) pure returns (uint256 result) {
    unchecked {
        // Start from 0.5 in the 192.64-bit fixed-point format.
        result = 0x800000000000000000000000000000000000000000000000;

        // The following logic multiplies the result by $\sqrt{2^{-i}}$ when the bit at position i is 1. Key points:
        //
        // 1. Intermediate results will not overflow, as the starting point is 2^191 and all magic factors are under 2^65.
        // 2. The rationale for organizing the if statements into groups of 8 is gas savings. If the result of performing
        // a bitwise AND operation between x and any value in the array [0x80; 0x40; 0x20; 0x10; 0x08; 0x04; 0x02; 0x01] is 1,
        // we know that `x & 0xFF` is also 1.
        if (x & 0xFF00000000000000 > 0) {
            if (x & 0x8000000000000000 > 0) {
                result = (result * 0x16A09E667F3BCC909) >> 64;
            }
            if (x & 0x4000000000000000 > 0) {
                result = (result * 0x1306FE0A31B7152DF) >> 64;
            }
            if (x & 0x2000000000000000 > 0) {
                result = (result * 0x1172B83C7D517ADCE) >> 64;
            }
            if (x & 0x1000000000000000 > 0) {
                result = (result * 0x10B5586CF9890F62A) >> 64;
            }
            if (x & 0x800000000000000 > 0) {
                result = (result * 0x1059B0D31585743AE) >> 64;
            }
            if (x & 0x400000000000000 > 0) {
                result = (result * 0x102C9A3E778060EE7) >> 64;
            }
            if (x & 0x200000000000000 > 0) {
                result = (result * 0x10163DA9FB33356D8) >> 64;
            }
            if (x & 0x100000000000000 > 0) {
                result = (result * 0x100B1AFA5ABCBED61) >> 64;
            }
        }

        if (x & 0xFF000000000000 > 0) {
            if (x & 0x80000000000000 > 0) {
                result = (result * 0x10058C86DA1C09EA2) >> 64;
            }
            if (x & 0x40000000000000 > 0) {
                result = (result * 0x1002C605E2E8CEC50) >> 64;
            }
            if (x & 0x20000000000000 > 0) {
                result = (result * 0x100162F3904051FA1) >> 64;
            }
            if (x & 0x10000000000000 > 0) {
                result = (result * 0x1000B175EFFDC76BA) >> 64;
            }
            if (x & 0x8000000000000 > 0) {
                result = (result * 0x100058BA01FB9F96D) >> 64;
            }
            if (x & 0x4000000000000 > 0) {
                result = (result * 0x10002C5CC37DA9492) >> 64;
            }
            if (x & 0x2000000000000 > 0) {
                result = (result * 0x1000162E525EE0547) >> 64;
            }
            if (x & 0x1000000000000 > 0) {
                result = (result * 0x10000B17255775C04) >> 64;
            }
        }

        if (x & 0xFF0000000000 > 0) {
            if (x & 0x800000000000 > 0) {
                result = (result * 0x1000058B91B5BC9AE) >> 64;
            }
            if (x & 0x400000000000 > 0) {
                result = (result * 0x100002C5C89D5EC6D) >> 64;
            }
            if (x & 0x200000000000 > 0) {
                result = (result * 0x10000162E43F4F831) >> 64;
            }
            if (x & 0x100000000000 > 0) {
                result = (result * 0x100000B1721BCFC9A) >> 64;
            }
            if (x & 0x80000000000 > 0) {
                result = (result * 0x10000058B90CF1E6E) >> 64;
            }
            if (x & 0x40000000000 > 0) {
                result = (result * 0x1000002C5C863B73F) >> 64;
            }
            if (x & 0x20000000000 > 0) {
                result = (result * 0x100000162E430E5A2) >> 64;
            }
            if (x & 0x10000000000 > 0) {
                result = (result * 0x1000000B172183551) >> 64;
            }
        }

        if (x & 0xFF00000000 > 0) {
            if (x & 0x8000000000 > 0) {
                result = (result * 0x100000058B90C0B49) >> 64;
            }
            if (x & 0x4000000000 > 0) {
                result = (result * 0x10000002C5C8601CC) >> 64;
            }
            if (x & 0x2000000000 > 0) {
                result = (result * 0x1000000162E42FFF0) >> 64;
            }
            if (x & 0x1000000000 > 0) {
                result = (result * 0x10000000B17217FBB) >> 64;
            }
            if (x & 0x800000000 > 0) {
                result = (result * 0x1000000058B90BFCE) >> 64;
            }
            if (x & 0x400000000 > 0) {
                result = (result * 0x100000002C5C85FE3) >> 64;
            }
            if (x & 0x200000000 > 0) {
                result = (result * 0x10000000162E42FF1) >> 64;
            }
            if (x & 0x100000000 > 0) {
                result = (result * 0x100000000B17217F8) >> 64;
            }
        }

        if (x & 0xFF000000 > 0) {
            if (x & 0x80000000 > 0) {
                result = (result * 0x10000000058B90BFC) >> 64;
            }
            if (x & 0x40000000 > 0) {
                result = (result * 0x1000000002C5C85FE) >> 64;
            }
            if (x & 0x20000000 > 0) {
                result = (result * 0x100000000162E42FF) >> 64;
            }
            if (x & 0x10000000 > 0) {
                result = (result * 0x1000000000B17217F) >> 64;
            }
            if (x & 0x8000000 > 0) {
                result = (result * 0x100000000058B90C0) >> 64;
            }
            if (x & 0x4000000 > 0) {
                result = (result * 0x10000000002C5C860) >> 64;
            }
            if (x & 0x2000000 > 0) {
                result = (result * 0x1000000000162E430) >> 64;
            }
            if (x & 0x1000000 > 0) {
                result = (result * 0x10000000000B17218) >> 64;
            }
        }

        if (x & 0xFF0000 > 0) {
            if (x & 0x800000 > 0) {
                result = (result * 0x1000000000058B90C) >> 64;
            }
            if (x & 0x400000 > 0) {
                result = (result * 0x100000000002C5C86) >> 64;
            }
            if (x & 0x200000 > 0) {
                result = (result * 0x10000000000162E43) >> 64;
            }
            if (x & 0x100000 > 0) {
                result = (result * 0x100000000000B1721) >> 64;
            }
            if (x & 0x80000 > 0) {
                result = (result * 0x10000000000058B91) >> 64;
            }
            if (x & 0x40000 > 0) {
                result = (result * 0x1000000000002C5C8) >> 64;
            }
            if (x & 0x20000 > 0) {
                result = (result * 0x100000000000162E4) >> 64;
            }
            if (x & 0x10000 > 0) {
                result = (result * 0x1000000000000B172) >> 64;
            }
        }

        if (x & 0xFF00 > 0) {
            if (x & 0x8000 > 0) {
                result = (result * 0x100000000000058B9) >> 64;
            }
            if (x & 0x4000 > 0) {
                result = (result * 0x10000000000002C5D) >> 64;
            }
            if (x & 0x2000 > 0) {
                result = (result * 0x1000000000000162E) >> 64;
            }
            if (x & 0x1000 > 0) {
                result = (result * 0x10000000000000B17) >> 64;
            }
            if (x & 0x800 > 0) {
                result = (result * 0x1000000000000058C) >> 64;
            }
            if (x & 0x400 > 0) {
                result = (result * 0x100000000000002C6) >> 64;
            }
            if (x & 0x200 > 0) {
                result = (result * 0x10000000000000163) >> 64;
            }
            if (x & 0x100 > 0) {
                result = (result * 0x100000000000000B1) >> 64;
            }
        }

        if (x & 0xFF > 0) {
            if (x & 0x80 > 0) {
                result = (result * 0x10000000000000059) >> 64;
            }
            if (x & 0x40 > 0) {
                result = (result * 0x1000000000000002C) >> 64;
            }
            if (x & 0x20 > 0) {
                result = (result * 0x10000000000000016) >> 64;
            }
            if (x & 0x10 > 0) {
                result = (result * 0x1000000000000000B) >> 64;
            }
            if (x & 0x8 > 0) {
                result = (result * 0x10000000000000006) >> 64;
            }
            if (x & 0x4 > 0) {
                result = (result * 0x10000000000000003) >> 64;
            }
            if (x & 0x2 > 0) {
                result = (result * 0x10000000000000001) >> 64;
            }
            if (x & 0x1 > 0) {
                result = (result * 0x10000000000000001) >> 64;
            }
        }

        // In the code snippet below, two operations are executed simultaneously:
        //
        // 1. The result is multiplied by $(2^n + 1)$, where $2^n$ represents the integer part, and the additional 1
        // accounts for the initial guess of 0.5. This is achieved by subtracting from 191 instead of 192.
        // 2. The result is then converted to an unsigned 60.18-decimal fixed-point format.
        //
        // The underlying logic is based on the relationship $2^{191-ip} = 2^{ip} / 2^{191}$, where $ip$ denotes the,
        // integer part, $2^n$.
        result *= UNIT;
        result >>= (191 - (x >> 64));
    }
}

/// @notice Finds the zero-based index of the first 1 in the binary representation of x.
///
/// @dev See the note on "msb" in this Wikipedia article: https://en.wikipedia.org/wiki/Find_first_set
///
/// Each step in this implementation is equivalent to this high-level code:
///
/// ```solidity
/// if (x >= 2 ** 128) {
///     x >>= 128;
///     result += 128;
/// }
/// ```
///
/// Where 128 is replaced with each respective power of two factor. See the full high-level implementation here:
/// https://gist.github.com/PaulRBerg/f932f8693f2733e30c4d479e8e980948
///
/// The Yul instructions used below are:
///
/// - "gt" is "greater than"
/// - "or" is the OR bitwise operator
/// - "shl" is "shift left"
/// - "shr" is "shift right"
///
/// @param x The uint256 number for which to find the index of the most significant bit.
/// @return result The index of the most significant bit as a uint256.
/// @custom:smtchecker abstract-function-nondet
function msb(uint256 x) pure returns (uint256 result) {
    // 2^128
    assembly ("memory-safe") {
        let factor := shl(7, gt(x, 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF))
        x := shr(factor, x)
        result := or(result, factor)
    }
    // 2^64
    assembly ("memory-safe") {
        let factor := shl(6, gt(x, 0xFFFFFFFFFFFFFFFF))
        x := shr(factor, x)
        result := or(result, factor)
    }
    // 2^32
    assembly ("memory-safe") {
        let factor := shl(5, gt(x, 0xFFFFFFFF))
        x := shr(factor, x)
        result := or(result, factor)
    }
    // 2^16
    assembly ("memory-safe") {
        let factor := shl(4, gt(x, 0xFFFF))
        x := shr(factor, x)
        result := or(result, factor)
    }
    // 2^8
    assembly ("memory-safe") {
        let factor := shl(3, gt(x, 0xFF))
        x := shr(factor, x)
        result := or(result, factor)
    }
    // 2^4
    assembly ("memory-safe") {
        let factor := shl(2, gt(x, 0xF))
        x := shr(factor, x)
        result := or(result, factor)
    }
    // 2^2
    assembly ("memory-safe") {
        let factor := shl(1, gt(x, 0x3))
        x := shr(factor, x)
        result := or(result, factor)
    }
    // 2^1
    // No need to shift x any more.
    assembly ("memory-safe") {
        let factor := gt(x, 0x1)
        result := or(result, factor)
    }
}

/// @notice Calculates x*y÷denominator with 512-bit precision.
///
/// @dev Credits to Remco Bloemen under MIT license https://xn--2-umb.com/21/muldiv.
///
/// Notes:
/// - The result is rounded toward zero.
///
/// Requirements:
/// - The denominator must not be zero.
/// - The result must fit in uint256.
///
/// @param x The multiplicand as a uint256.
/// @param y The multiplier as a uint256.
/// @param denominator The divisor as a uint256.
/// @return result The result as a uint256.
/// @custom:smtchecker abstract-function-nondet
function mulDiv(uint256 x, uint256 y, uint256 denominator) pure returns (uint256 result) {
    // 512-bit multiply [prod1 prod0] = x * y. Compute the product mod 2^256 and mod 2^256 - 1, then use
    // use the Chinese Remainder Theorem to reconstruct the 512-bit result. The result is stored in two 256
    // variables such that product = prod1 * 2^256 + prod0.
    uint256 prod0; // Least significant 256 bits of the product
    uint256 prod1; // Most significant 256 bits of the product
    assembly ("memory-safe") {
        let mm := mulmod(x, y, not(0))
        prod0 := mul(x, y)
        prod1 := sub(sub(mm, prod0), lt(mm, prod0))
    }

    // Handle non-overflow cases, 256 by 256 division.
    if (prod1 == 0) {
        unchecked {
            return prod0 / denominator;
        }
    }

    // Make sure the result is less than 2^256. Also prevents denominator == 0.
    if (prod1 >= denominator) {
        revert PRBMath_MulDiv_Overflow(x, y, denominator);
    }

    ////////////////////////////////////////////////////////////////////////////
    // 512 by 256 division
    ////////////////////////////////////////////////////////////////////////////

    // Make division exact by subtracting the remainder from [prod1 prod0].
    uint256 remainder;
    assembly ("memory-safe") {
        // Compute remainder using the mulmod Yul instruction.
        remainder := mulmod(x, y, denominator)

        // Subtract 256 bit number from 512-bit number.
        prod1 := sub(prod1, gt(remainder, prod0))
        prod0 := sub(prod0, remainder)
    }

    unchecked {
        // Calculate the largest power of two divisor of the denominator using the unary operator ~. This operation cannot overflow
        // because the denominator cannot be zero at this point in the function execution. The result is always >= 1.
        // For more detail, see https://cs.stackexchange.com/q/138556/92363.
        uint256 lpotdod = denominator & (~denominator + 1);
        uint256 flippedLpotdod;

        assembly ("memory-safe") {
            // Factor powers of two out of denominator.
            denominator := div(denominator, lpotdod)

            // Divide [prod1 prod0] by lpotdod.
            prod0 := div(prod0, lpotdod)

            // Get the flipped value `2^256 / lpotdod`. If the `lpotdod` is zero, the flipped value is one.
            // `sub(0, lpotdod)` produces the two's complement version of `lpotdod`, which is equivalent to flipping all the bits.
            // However, `div` interprets this value as an unsigned value: https://ethereum.stackexchange.com/q/147168/24693
            flippedLpotdod := add(div(sub(0, lpotdod), lpotdod), 1)
        }

        // Shift in bits from prod1 into prod0.
        prod0 |= prod1 * flippedLpotdod;

        // Invert denominator mod 2^256. Now that denominator is an odd number, it has an inverse modulo 2^256 such
        // that denominator * inv = 1 mod 2^256. Compute the inverse by starting with a seed that is correct for
        // four bits. That is, denominator * inv = 1 mod 2^4.
        uint256 inverse = (3 * denominator) ^ 2;

        // Use the Newton-Raphson iteration to improve the precision. Thanks to Hensel's lifting lemma, this also works
        // in modular arithmetic, doubling the correct bits in each step.
        inverse *= 2 - denominator * inverse; // inverse mod 2^8
        inverse *= 2 - denominator * inverse; // inverse mod 2^16
        inverse *= 2 - denominator * inverse; // inverse mod 2^32
        inverse *= 2 - denominator * inverse; // inverse mod 2^64
        inverse *= 2 - denominator * inverse; // inverse mod 2^128
        inverse *= 2 - denominator * inverse; // inverse mod 2^256

        // Because the division is now exact we can divide by multiplying with the modular inverse of denominator.
        // This will give us the correct result modulo 2^256. Since the preconditions guarantee that the outcome is
        // less than 2^256, this is the final result. We don't need to compute the high bits of the result and prod1
        // is no longer required.
        result = prod0 * inverse;
    }
}

/// @notice Calculates x*y÷1e18 with 512-bit precision.
///
/// @dev A variant of {mulDiv} with constant folding, i.e. in which the denominator is hard coded to 1e18.
///
/// Notes:
/// - The body is purposely left uncommented; to understand how this works, see the documentation in {mulDiv}.
/// - The result is rounded toward zero.
/// - We take as an axiom that the result cannot be `MAX_UINT256` when x and y solve the following system of equations:
///
/// $$
/// \begin{cases}
///     x * y = MAX\_UINT256 * UNIT \\
///     (x * y) \% UNIT \geq \frac{UNIT}{2}
/// \end{cases}
/// $$
///
/// Requirements:
/// - Refer to the requirements in {mulDiv}.
/// - The result must fit in uint256.
///
/// @param x The multiplicand as an unsigned 60.18-decimal fixed-point number.
/// @param y The multiplier as an unsigned 60.18-decimal fixed-point number.
/// @return result The result as an unsigned 60.18-decimal fixed-point number.
/// @custom:smtchecker abstract-function-nondet
function mulDiv18(uint256 x, uint256 y) pure returns (uint256 result) {
    uint256 prod0;
    uint256 prod1;
    assembly ("memory-safe") {
        let mm := mulmod(x, y, not(0))
        prod0 := mul(x, y)
        prod1 := sub(sub(mm, prod0), lt(mm, prod0))
    }

    if (prod1 == 0) {
        unchecked {
            return prod0 / UNIT;
        }
    }

    if (prod1 >= UNIT) {
        revert PRBMath_MulDiv18_Overflow(x, y);
    }

    uint256 remainder;
    assembly ("memory-safe") {
        remainder := mulmod(x, y, UNIT)
        result :=
            mul(
                or(
                    div(sub(prod0, remainder), UNIT_LPOTD),
                    mul(sub(prod1, gt(remainder, prod0)), add(div(sub(0, UNIT_LPOTD), UNIT_LPOTD), 1))
                ),
                UNIT_INVERSE
            )
    }
}

/// @notice Calculates x*y÷denominator with 512-bit precision.
///
/// @dev This is an extension of {mulDiv} for signed numbers, which works by computing the signs and the absolute values separately.
///
/// Notes:
/// - The result is rounded toward zero.
///
/// Requirements:
/// - Refer to the requirements in {mulDiv}.
/// - None of the inputs can be `type(int256).min`.
/// - The result must fit in int256.
///
/// @param x The multiplicand as an int256.
/// @param y The multiplier as an int256.
/// @param denominator The divisor as an int256.
/// @return result The result as an int256.
/// @custom:smtchecker abstract-function-nondet
function mulDivSigned(int256 x, int256 y, int256 denominator) pure returns (int256 result) {
    if (x == type(int256).min || y == type(int256).min || denominator == type(int256).min) {
        revert PRBMath_MulDivSigned_InputTooSmall();
    }

    // Get hold of the absolute values of x, y and the denominator.
    uint256 xAbs;
    uint256 yAbs;
    uint256 dAbs;
    unchecked {
        xAbs = x < 0 ? uint256(-x) : uint256(x);
        yAbs = y < 0 ? uint256(-y) : uint256(y);
        dAbs = denominator < 0 ? uint256(-denominator) : uint256(denominator);
    }

    // Compute the absolute value of x*y÷denominator. The result must fit in int256.
    uint256 resultAbs = mulDiv(xAbs, yAbs, dAbs);
    if (resultAbs > uint256(type(int256).max)) {
        revert PRBMath_MulDivSigned_Overflow(x, y);
    }

    // Get the signs of x, y and the denominator.
    uint256 sx;
    uint256 sy;
    uint256 sd;
    assembly ("memory-safe") {
        // "sgt" is the "signed greater than" assembly instruction and "sub(0,1)" is -1 in two's complement.
        sx := sgt(x, sub(0, 1))
        sy := sgt(y, sub(0, 1))
        sd := sgt(denominator, sub(0, 1))
    }

    // XOR over sx, sy and sd. What this does is to check whether there are 1 or 3 negative signs in the inputs.
    // If there are, the result should be negative. Otherwise, it should be positive.
    unchecked {
        result = sx ^ sy ^ sd == 0 ? -int256(resultAbs) : int256(resultAbs);
    }
}

/// @notice Calculates the square root of x using the Babylonian method.
///
/// @dev See https://en.wikipedia.org/wiki/Methods_of_computing_square_roots#Babylonian_method.
///
/// Notes:
/// - If x is not a perfect square, the result is rounded down.
/// - Credits to OpenZeppelin for the explanations in comments below.
///
/// @param x The uint256 number for which to calculate the square root.
/// @return result The result as a uint256.
/// @custom:smtchecker abstract-function-nondet
function sqrt(uint256 x) pure returns (uint256 result) {
    if (x == 0) {
        return 0;
    }

    // For our first guess, we calculate the biggest power of 2 which is smaller than the square root of x.
    //
    // We know that the "msb" (most significant bit) of x is a power of 2 such that we have:
    //
    // $$
    // msb(x) <= x <= 2*msb(x)$
    // $$
    //
    // We write $msb(x)$ as $2^k$, and we get:
    //
    // $$
    // k = log_2(x)
    // $$
    //
    // Thus, we can write the initial inequality as:
    //
    // $$
    // 2^{log_2(x)} <= x <= 2*2^{log_2(x)+1} \\
    // sqrt(2^k) <= sqrt(x) < sqrt(2^{k+1}) \\
    // 2^{k/2} <= sqrt(x) < 2^{(k+1)/2} <= 2^{(k/2)+1}
    // $$
    //
    // Consequently, $2^{log_2(x) /2} is a good first approximation of sqrt(x) with at least one correct bit.
    uint256 xAux = uint256(x);
    result = 1;
    if (xAux >= 2 ** 128) {
        xAux >>= 128;
        result <<= 64;
    }
    if (xAux >= 2 ** 64) {
        xAux >>= 64;
        result <<= 32;
    }
    if (xAux >= 2 ** 32) {
        xAux >>= 32;
        result <<= 16;
    }
    if (xAux >= 2 ** 16) {
        xAux >>= 16;
        result <<= 8;
    }
    if (xAux >= 2 ** 8) {
        xAux >>= 8;
        result <<= 4;
    }
    if (xAux >= 2 ** 4) {
        xAux >>= 4;
        result <<= 2;
    }
    if (xAux >= 2 ** 2) {
        result <<= 1;
    }

    // At this point, `result` is an estimation with at least one bit of precision. We know the true value has at
    // most 128 bits, since it is the square root of a uint256. Newton's method converges quadratically (precision
    // doubles at every iteration). We thus need at most 7 iteration to turn our partial result with one bit of
    // precision into the expected uint128 result.
    unchecked {
        result = (result + x / result) >> 1;
        result = (result + x / result) >> 1;
        result = (result + x / result) >> 1;
        result = (result + x / result) >> 1;
        result = (result + x / result) >> 1;
        result = (result + x / result) >> 1;
        result = (result + x / result) >> 1;

        // If x is not a perfect square, round the result toward zero.
        uint256 roundedResult = x / result;
        if (result >= roundedResult) {
            result = roundedResult;
        }
    }
}

// SPDX-License-Identifier: MIT
pragma solidity >=0.8.19;

import { SD59x18 } from "./ValueType.sol";

// NOTICE: the "u" prefix stands for "unwrapped".

/// @dev Euler's number as an SD59x18 number.
SD59x18 constant E = SD59x18.wrap(2_718281828459045235);

/// @dev The maximum input permitted in {exp}.
int256 constant uEXP_MAX_INPUT = 133_084258667509499440;
SD59x18 constant EXP_MAX_INPUT = SD59x18.wrap(uEXP_MAX_INPUT);

/// @dev The maximum input permitted in {exp2}.
int256 constant uEXP2_MAX_INPUT = 192e18 - 1;
SD59x18 constant EXP2_MAX_INPUT = SD59x18.wrap(uEXP2_MAX_INPUT);

/// @dev Half the UNIT number.
int256 constant uHALF_UNIT = 0.5e18;
SD59x18 constant HALF_UNIT = SD59x18.wrap(uHALF_UNIT);

/// @dev $log_2(10)$ as an SD59x18 number.
int256 constant uLOG2_10 = 3_321928094887362347;
SD59x18 constant LOG2_10 = SD59x18.wrap(uLOG2_10);

/// @dev $log_2(e)$ as an SD59x18 number.
int256 constant uLOG2_E = 1_442695040888963407;
SD59x18 constant LOG2_E = SD59x18.wrap(uLOG2_E);

/// @dev The maximum value an SD59x18 number can have.
int256 constant uMAX_SD59x18 = 57896044618658097711785492504343953926634992332820282019728_792003956564819967;
SD59x18 constant MAX_SD59x18 = SD59x18.wrap(uMAX_SD59x18);

/// @dev The maximum whole value an SD59x18 number can have.
int256 constant uMAX_WHOLE_SD59x18 = 57896044618658097711785492504343953926634992332820282019728_000000000000000000;
SD59x18 constant MAX_WHOLE_SD59x18 = SD59x18.wrap(uMAX_WHOLE_SD59x18);

/// @dev The minimum value an SD59x18 number can have.
int256 constant uMIN_SD59x18 = -57896044618658097711785492504343953926634992332820282019728_792003956564819968;
SD59x18 constant MIN_SD59x18 = SD59x18.wrap(uMIN_SD59x18);

/// @dev The minimum whole value an SD59x18 number can have.
int256 constant uMIN_WHOLE_SD59x18 = -57896044618658097711785492504343953926634992332820282019728_000000000000000000;
SD59x18 constant MIN_WHOLE_SD59x18 = SD59x18.wrap(uMIN_WHOLE_SD59x18);

/// @dev PI as an SD59x18 number.
SD59x18 constant PI = SD59x18.wrap(3_141592653589793238);

/// @dev The unit number, which gives the decimal precision of SD59x18.
int256 constant uUNIT = 1e18;
SD59x18 constant UNIT = SD59x18.wrap(1e18);

/// @dev The unit number squared.
int256 constant uUNIT_SQUARED = 1e36;
SD59x18 constant UNIT_SQUARED = SD59x18.wrap(uUNIT_SQUARED);

/// @dev Zero as an SD59x18 number.
SD59x18 constant ZERO = SD59x18.wrap(0);

// SPDX-License-Identifier: MIT
// OpenZeppelin Contracts v4.4.1 (utils/Context.sol)

pragma solidity ^0.8.0;

/**
 * @dev Provides information about the current execution context, including the
 * sender of the transaction and its data. While these are generally available
 * via msg.sender and msg.data, they should not be accessed in such a direct
 * manner, since when dealing with meta-transactions the account sending and
 * paying for execution may not be the actual sender (as far as an application
 * is concerned).
 *
 * This contract is only required for intermediate, library-like contracts.
 */
abstract contract Context {
    function _msgSender() internal view virtual returns (address) {
        return msg.sender;
    }

    function _msgData() internal view virtual returns (bytes calldata) {
        return msg.data;
    }
}

// SPDX-License-Identifier: MIT
pragma solidity >=0.8.19;

import { uMAX_UD60x18, uUNIT } from "./Constants.sol";
import { PRBMath_UD60x18_Convert_Overflow } from "./Errors.sol";
import { UD60x18 } from "./ValueType.sol";

/// @notice Converts a UD60x18 number to a simple integer by dividing it by `UNIT`.
/// @dev The result is rounded toward zero.
/// @param x The UD60x18 number to convert.
/// @return result The same number in basic integer form.
function convert(UD60x18 x) pure returns (uint256 result) {
    result = UD60x18.unwrap(x) / uUNIT;
}

/// @notice Converts a simple integer to UD60x18 by multiplying it by `UNIT`.
///
/// @dev Requirements:
/// - x must be less than or equal to `MAX_UD60x18 / UNIT`.
///
/// @param x The basic integer to convert.
/// @param result The same number converted to UD60x18.
function convert(uint256 x) pure returns (UD60x18 result) {
    if (x > uMAX_UD60x18 / uUNIT) {
        revert PRBMath_UD60x18_Convert_Overflow(x);
    }
    unchecked {
        result = UD60x18.wrap(x * uUNIT);
    }
}

// SPDX-License-Identifier: MIT
// OpenZeppelin Contracts (last updated v4.9.0) (utils/Create2.sol)

pragma solidity ^0.8.0;

/**
 * @dev Helper to make usage of the `CREATE2` EVM opcode easier and safer.
 * `CREATE2` can be used to compute in advance the address where a smart
 * contract will be deployed, which allows for interesting new mechanisms known
 * as 'counterfactual interactions'.
 *
 * See the https://eips.ethereum.org/EIPS/eip-1014#motivation[EIP] for more
 * information.
 */
library Create2 {
    /**
     * @dev Deploys a contract using `CREATE2`. The address where the contract
     * will be deployed can be known in advance via {computeAddress}.
     *
     * The bytecode for a contract can be obtained from Solidity with
     * `type(contractName).creationCode`.
     *
     * Requirements:
     *
     * - `bytecode` must not be empty.
     * - `salt` must have not been used for `bytecode` already.
     * - the factory must have a balance of at least `amount`.
     * - if `amount` is non-zero, `bytecode` must have a `payable` constructor.
     */
    function deploy(uint256 amount, bytes32 salt, bytes memory bytecode) internal returns (address addr) {
        require(address(this).balance >= amount, "Create2: insufficient balance");
        require(bytecode.length != 0, "Create2: bytecode length is zero");
        /// @solidity memory-safe-assembly
        assembly {
            addr := create2(amount, add(bytecode, 0x20), mload(bytecode), salt)
        }
        require(addr != address(0), "Create2: Failed on deploy");
    }

    /**
     * @dev Returns the address where a contract will be stored if deployed via {deploy}. Any change in the
     * `bytecodeHash` or `salt` will result in a new destination address.
     */
    function computeAddress(bytes32 salt, bytes32 bytecodeHash) internal view returns (address) {
        return computeAddress(salt, bytecodeHash, address(this));
    }

    /**
     * @dev Returns the address where a contract will be stored if deployed via {deploy} from a contract located at
     * `deployer`. If `deployer` is this contract's address, returns the same value as {computeAddress}.
     */
    function computeAddress(bytes32 salt, bytes32 bytecodeHash, address deployer) internal pure returns (address addr) {
        /// @solidity memory-safe-assembly
        assembly {
            let ptr := mload(0x40) // Get free memory pointer

            // |                   | ↓ ptr ...  ↓ ptr + 0x0B (start) ...  ↓ ptr + 0x20 ...  ↓ ptr + 0x40 ...   |
            // |-------------------|---------------------------------------------------------------------------|
            // | bytecodeHash      |                                                        CCCCCCCCCCCCC...CC |
            // | salt              |                                      BBBBBBBBBBBBB...BB                   |
            // | deployer          | 000000...0000AAAAAAAAAAAAAAAAAAA...AA                                     |
            // | 0xFF              |            FF                                                             |
            // |-------------------|---------------------------------------------------------------------------|
            // | memory            | 000000...00FFAAAAAAAAAAAAAAAAAAA...AABBBBBBBBBBBBB...BBCCCCCCCCCCCCC...CC |
            // | keccak(start, 85) |            ↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑ |

            mstore(add(ptr, 0x40), bytecodeHash)
            mstore(add(ptr, 0x20), salt)
            mstore(ptr, deployer) // Right-aligned with 12 preceding garbage bytes
            let start := add(ptr, 0x0b) // The hashed data starts at the final garbage byte which we will set to 0xff
            mstore8(start, 0xff)
            addr := keccak256(start, 85)
        }
    }
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

// https://github.com/curvefi/tricrypto-ng/blob/0bc1191b6097c8854e4f09e385f6c2c79a5bb773/contracts/main/CurveTricryptoOptimizedWETH.vy

import {IERC20} from "@openzeppelin/contracts@4.9.3/token/ERC20/IERC20.sol";

interface CurveTricryptoOptimizedWETH is IERC20 {
    /// @notice Exchange using wrapped native token by default
    /// @param i Index value for the input coin
    /// @param j Index value for the output coin
    /// @param dx Amount of input coin being swapped in
    /// @param min_dy Minimum amount of output coin to receive
    /// @param use_eth True if the input coin is native token, False otherwise
    /// @param receiver Address to send the output coin to. Default is msg.sender
    /// @return uint256 Amount of tokens at index j received by the `receiver
    function exchange(uint256 i, uint256 j, uint256 dx, uint256 min_dy, bool use_eth, address receiver)
        external
        payable
        returns (uint256);

    /// @notice Exchange with callback method.
    /// @dev This method does not allow swapping in native token, but does allow
    /// swaps that transfer out native token from the pool.
    /// @dev Does not allow flashloans
    /// @dev One use-case is to reduce the number of redundant ERC20 token
    /// transfers in zaps.
    /// @param i Index value for the input coin
    /// @param j Index value for the output coin
    /// @param dx Amount of input coin being swapped in
    /// @param min_dy Minimum amount of output coin to receive
    /// @param use_eth True if output is native token, False otherwise
    /// @param sender Address to transfer input coin from
    /// @param receiver Address to send the output coin to
    /// @param cb Callback signature
    /// @return uint256 Amount of tokens at index j received by the `receiver`
    function exchange_extended(
        uint256 i,
        uint256 j,
        uint256 dx,
        uint256 min_dy,
        bool use_eth,
        address sender,
        address receiver,
        bytes32 cb
    ) external returns (uint256);

    /// @notice Adds liquidity into the pool.
    /// @param amounts Amounts of each coin to add.
    /// @param min_mint_amount Minimum amount of LP to mint.
    function add_liquidity(uint256[3] calldata amounts, uint256 min_mint_amount) external payable returns (uint256);

    /// @notice Adds liquidity into the pool.
    /// @param amounts Amounts of each coin to add.
    /// @param min_mint_amount Minimum amount of LP to mint.
    /// @return uint256 Amount of LP tokens received by the `receiver
    /// @param use_eth True if native token is being added to the pool.
    /// @param receiver Address to send the LP tokens to. Default is msg.sender
    function add_liquidity(uint256[3] calldata amounts, uint256 min_mint_amount, bool use_eth, address receiver)
        external
        payable
        returns (uint256);

    /// @notice This withdrawal method is very safe, does no complex math since
    ///         tokens are withdrawn in balanced proportions. No fees are charged.
    /// @param amount Amount of LP tokens to burn
    /// @param min_amounts Minimum amounts of tokens to withdraw
    /// @param use_eth Whether to withdraw ETH or not
    /// @param receiver Address to send the withdrawn tokens to
    /// @param claim_admin_fees If True, call self._claim_admin_fees(). Default is True.
    /// @return uint256[3] Amount of pool tokens received by the `receiver`
    function remove_liquidity(
        uint256 amount,
        uint256[3] calldata min_amounts,
        bool use_eth,
        address receiver,
        bool claim_admin_fees
    ) external returns (uint256[3] memory);

    /// @notice Withdraw liquidity in a single token.
    /// Involves fees (lower than swap fees).
    /// @dev This operation also involves an admin fee claim.
    /// @param token_amount Amount of LP tokens to burn
    /// @param i Index of the token to withdraw
    /// @param min_amount Minimum amount of token to withdraw.
    /// @param use_eth Whether to withdraw ETH or not
    /// @param receiver Address to send the withdrawn tokens to
    /// @return Amount of tokens at index i received by the `receiver`
    function remove_liquidity_one_coin(
        uint256 token_amount,
        uint256 i,
        uint256 min_amount,
        bool use_eth,
        address receiver
    ) external returns (uint256);

    ///////////////////////////////////////////////////////////
    // View methods
    ///////////////////////////////////////////////////////////

    /// @notice Returns the balance of the coin at index `i`
    function balances(uint256 i) external view returns (uint256);

    /// @notice Calculate LP tokens minted or to be burned for depositing or
    ///         removing `amounts` of coins
    /// @dev Includes fee.
    /// @param amounts Amounts of tokens being deposited or withdrawn
    /// @param deposit True if it is a deposit action, False if withdrawn.
    /// @return uint256 Amount of LP tokens deposited or withdrawn.
    function calc_token_amount(uint256[3] calldata amounts, bool deposit) external view returns (uint256);

    function get_dy(uint256 i, uint256 j, uint256 dx) external view returns (uint256);

    function get_dx(uint256 i, uint256 j, uint256 dy) external view returns (uint256);

    /// @notice Calculates the current price of the LP token with respect to the coin at the 0th index
    /// @dev This function should be implemented to return the LP price
    /// @return The current LP price as a uint256
    function lp_price() external view returns (uint256);

    /// @notice calculate the current virtual price of the pool's LP token (in 18 decimals)
    /// @dev Non read-reenrant.
    /// @dev https://docs.curve.fi/cryptoswap-exchange/tricrypto-ng/pools/tricrypto/?h=virtual#get_virtual_price
    function get_virtual_price() external view returns (uint256);

    /// @notice Returns the oracle price of the coin at index `k` with respect to the coin at index 0
    /// @dev The oracle is an exponential moving average, with a periodicity determined internally.
    ///      The aggregated prices are cached state prices (dy/dx) calculated AFTER the latest trade.
    /// @param k The index of the coin for which the oracle price is needed (k = 0 or 1)
    /// @return The oracle price of the coin at index `k` as a uint256
    function price_oracle(uint256 k) external view returns (uint256);

    /// @notice Calculates output tokens with fee
    /// @param token_amount LP Token amount to burn
    /// @param i token in which liquidity is withdrawn
    /// @return uint256 Amount of ith tokens received for burning token_amount LP tokens.
    function calc_withdraw_one_coin(uint256 token_amount, uint256 i) external view returns (uint256);

    function calc_token_fee(uint256[3] calldata amounts, uint256[3] calldata xp) external view returns (uint256);

    function fee_calc(uint256[3] calldata xp) external view returns (uint256);

    /// @notice Returns i-th coin address.
    /// @param i Index of the coin. i must be 0, 1 or 2.
    function coins(uint256 i) external view returns (address);

    /// @dev Returns the address of the factory that created the pool.
    /// @return address The factory address.
    function factory() external view returns (address);

    function D() external view returns (uint256);

    /// @dev Returns the cached virtual price of the pool.
    function virtual_price() external view returns (uint256);

    /// @dev Returns the current pool amplification parameter.
    /// @return uint256 The A parameter.
    function A() external view returns (uint256);

    /// @dev Returns the current pool gamma parameter.
    /// @return uint256 The gamma parameter.
    function gamma() external view returns (uint256);

    ///////////////////////////////////////////////////////////
    // Protected methods
    ///////////////////////////////////////////////////////////

    /// @notice Initialise Ramping A and gamma parameter values linearly.
    /// @dev Only accessible by factory admin, and only
    /// @param future_A The future A value.
    /// @param future_gamma The future gamma value.
    /// @param future_time The timestamp at which the ramping will end.
    function ramp_A_gamma(uint256 future_A, uint256 future_gamma, uint256 future_time) external;
}

// SPDX-License-Identifier: MIT
// OpenZeppelin Contracts (last updated v4.9.0) (token/ERC20/ERC20.sol)

pragma solidity ^0.8.0;

import "./IERC20.sol";
import "./extensions/IERC20Metadata.sol";
import "../../utils/Context.sol";

/**
 * @dev Implementation of the {IERC20} interface.
 *
 * This implementation is agnostic to the way tokens are created. This means
 * that a supply mechanism has to be added in a derived contract using {_mint}.
 * For a generic mechanism see {ERC20PresetMinterPauser}.
 *
 * TIP: For a detailed writeup see our guide
 * https://forum.openzeppelin.com/t/how-to-implement-erc20-supply-mechanisms/226[How
 * to implement supply mechanisms].
 *
 * The default value of {decimals} is 18. To change this, you should override
 * this function so it returns a different value.
 *
 * We have followed general OpenZeppelin Contracts guidelines: functions revert
 * instead returning `false` on failure. This behavior is nonetheless
 * conventional and does not conflict with the expectations of ERC20
 * applications.
 *
 * Additionally, an {Approval} event is emitted on calls to {transferFrom}.
 * This allows applications to reconstruct the allowance for all accounts just
 * by listening to said events. Other implementations of the EIP may not emit
 * these events, as it isn't required by the specification.
 *
 * Finally, the non-standard {decreaseAllowance} and {increaseAllowance}
 * functions have been added to mitigate the well-known issues around setting
 * allowances. See {IERC20-approve}.
 */
contract ERC20 is Context, IERC20, IERC20Metadata {
    mapping(address => uint256) private _balances;

    mapping(address => mapping(address => uint256)) private _allowances;

    uint256 private _totalSupply;

    string private _name;
    string private _symbol;

    /**
     * @dev Sets the values for {name} and {symbol}.
     *
     * All two of these values are immutable: they can only be set once during
     * construction.
     */
    constructor(string memory name_, string memory symbol_) {
        _name = name_;
        _symbol = symbol_;
    }

    /**
     * @dev Returns the name of the token.
     */
    function name() public view virtual override returns (string memory) {
        return _name;
    }

    /**
     * @dev Returns the symbol of the token, usually a shorter version of the
     * name.
     */
    function symbol() public view virtual override returns (string memory) {
        return _symbol;
    }

    /**
     * @dev Returns the number of decimals used to get its user representation.
     * For example, if `decimals` equals `2`, a balance of `505` tokens should
     * be displayed to a user as `5.05` (`505 / 10 ** 2`).
     *
     * Tokens usually opt for a value of 18, imitating the relationship between
     * Ether and Wei. This is the default value returned by this function, unless
     * it's overridden.
     *
     * NOTE: This information is only used for _display_ purposes: it in
     * no way affects any of the arithmetic of the contract, including
     * {IERC20-balanceOf} and {IERC20-transfer}.
     */
    function decimals() public view virtual override returns (uint8) {
        return 18;
    }

    /**
     * @dev See {IERC20-totalSupply}.
     */
    function totalSupply() public view virtual override returns (uint256) {
        return _totalSupply;
    }

    /**
     * @dev See {IERC20-balanceOf}.
     */
    function balanceOf(address account) public view virtual override returns (uint256) {
        return _balances[account];
    }

    /**
     * @dev See {IERC20-transfer}.
     *
     * Requirements:
     *
     * - `to` cannot be the zero address.
     * - the caller must have a balance of at least `amount`.
     */
    function transfer(address to, uint256 amount) public virtual override returns (bool) {
        address owner = _msgSender();
        _transfer(owner, to, amount);
        return true;
    }

    /**
     * @dev See {IERC20-allowance}.
     */
    function allowance(address owner, address spender) public view virtual override returns (uint256) {
        return _allowances[owner][spender];
    }

    /**
     * @dev See {IERC20-approve}.
     *
     * NOTE: If `amount` is the maximum `uint256`, the allowance is not updated on
     * `transferFrom`. This is semantically equivalent to an infinite approval.
     *
     * Requirements:
     *
     * - `spender` cannot be the zero address.
     */
    function approve(address spender, uint256 amount) public virtual override returns (bool) {
        address owner = _msgSender();
        _approve(owner, spender, amount);
        return true;
    }

    /**
     * @dev See {IERC20-transferFrom}.
     *
     * Emits an {Approval} event indicating the updated allowance. This is not
     * required by the EIP. See the note at the beginning of {ERC20}.
     *
     * NOTE: Does not update the allowance if the current allowance
     * is the maximum `uint256`.
     *
     * Requirements:
     *
     * - `from` and `to` cannot be the zero address.
     * - `from` must have a balance of at least `amount`.
     * - the caller must have allowance for ``from``'s tokens of at least
     * `amount`.
     */
    function transferFrom(address from, address to, uint256 amount) public virtual override returns (bool) {
        address spender = _msgSender();
        _spendAllowance(from, spender, amount);
        _transfer(from, to, amount);
        return true;
    }

    /**
     * @dev Atomically increases the allowance granted to `spender` by the caller.
     *
     * This is an alternative to {approve} that can be used as a mitigation for
     * problems described in {IERC20-approve}.
     *
     * Emits an {Approval} event indicating the updated allowance.
     *
     * Requirements:
     *
     * - `spender` cannot be the zero address.
     */
    function increaseAllowance(address spender, uint256 addedValue) public virtual returns (bool) {
        address owner = _msgSender();
        _approve(owner, spender, allowance(owner, spender) + addedValue);
        return true;
    }

    /**
     * @dev Atomically decreases the allowance granted to `spender` by the caller.
     *
     * This is an alternative to {approve} that can be used as a mitigation for
     * problems described in {IERC20-approve}.
     *
     * Emits an {Approval} event indicating the updated allowance.
     *
     * Requirements:
     *
     * - `spender` cannot be the zero address.
     * - `spender` must have allowance for the caller of at least
     * `subtractedValue`.
     */
    function decreaseAllowance(address spender, uint256 subtractedValue) public virtual returns (bool) {
        address owner = _msgSender();
        uint256 currentAllowance = allowance(owner, spender);
        require(currentAllowance >= subtractedValue, "ERC20: decreased allowance below zero");
        unchecked {
            _approve(owner, spender, currentAllowance - subtractedValue);
        }

        return true;
    }

    /**
     * @dev Moves `amount` of tokens from `from` to `to`.
     *
     * This internal function is equivalent to {transfer}, and can be used to
     * e.g. implement automatic token fees, slashing mechanisms, etc.
     *
     * Emits a {Transfer} event.
     *
     * Requirements:
     *
     * - `from` cannot be the zero address.
     * - `to` cannot be the zero address.
     * - `from` must have a balance of at least `amount`.
     */
    function _transfer(address from, address to, uint256 amount) internal virtual {
        require(from != address(0), "ERC20: transfer from the zero address");
        require(to != address(0), "ERC20: transfer to the zero address");

        _beforeTokenTransfer(from, to, amount);

        uint256 fromBalance = _balances[from];
        require(fromBalance >= amount, "ERC20: transfer amount exceeds balance");
        unchecked {
            _balances[from] = fromBalance - amount;
            // Overflow not possible: the sum of all balances is capped by totalSupply, and the sum is preserved by
            // decrementing then incrementing.
            _balances[to] += amount;
        }

        emit Transfer(from, to, amount);

        _afterTokenTransfer(from, to, amount);
    }

    /** @dev Creates `amount` tokens and assigns them to `account`, increasing
     * the total supply.
     *
     * Emits a {Transfer} event with `from` set to the zero address.
     *
     * Requirements:
     *
     * - `account` cannot be the zero address.
     */
    function _mint(address account, uint256 amount) internal virtual {
        require(account != address(0), "ERC20: mint to the zero address");

        _beforeTokenTransfer(address(0), account, amount);

        _totalSupply += amount;
        unchecked {
            // Overflow not possible: balance + amount is at most totalSupply + amount, which is checked above.
            _balances[account] += amount;
        }
        emit Transfer(address(0), account, amount);

        _afterTokenTransfer(address(0), account, amount);
    }

    /**
     * @dev Destroys `amount` tokens from `account`, reducing the
     * total supply.
     *
     * Emits a {Transfer} event with `to` set to the zero address.
     *
     * Requirements:
     *
     * - `account` cannot be the zero address.
     * - `account` must have at least `amount` tokens.
     */
    function _burn(address account, uint256 amount) internal virtual {
        require(account != address(0), "ERC20: burn from the zero address");

        _beforeTokenTransfer(account, address(0), amount);

        uint256 accountBalance = _balances[account];
        require(accountBalance >= amount, "ERC20: burn amount exceeds balance");
        unchecked {
            _balances[account] = accountBalance - amount;
            // Overflow not possible: amount <= accountBalance <= totalSupply.
            _totalSupply -= amount;
        }

        emit Transfer(account, address(0), amount);

        _afterTokenTransfer(account, address(0), amount);
    }

    /**
     * @dev Sets `amount` as the allowance of `spender` over the `owner` s tokens.
     *
     * This internal function is equivalent to `approve`, and can be used to
     * e.g. set automatic allowances for certain subsystems, etc.
     *
     * Emits an {Approval} event.
     *
     * Requirements:
     *
     * - `owner` cannot be the zero address.
     * - `spender` cannot be the zero address.
     */
    function _approve(address owner, address spender, uint256 amount) internal virtual {
        require(owner != address(0), "ERC20: approve from the zero address");
        require(spender != address(0), "ERC20: approve to the zero address");

        _allowances[owner][spender] = amount;
        emit Approval(owner, spender, amount);
    }

    /**
     * @dev Updates `owner` s allowance for `spender` based on spent `amount`.
     *
     * Does not update the allowance amount in case of infinite allowance.
     * Revert if not enough allowance is available.
     *
     * Might emit an {Approval} event.
     */
    function _spendAllowance(address owner, address spender, uint256 amount) internal virtual {
        uint256 currentAllowance = allowance(owner, spender);
        if (currentAllowance != type(uint256).max) {
            require(currentAllowance >= amount, "ERC20: insufficient allowance");
            unchecked {
                _approve(owner, spender, currentAllowance - amount);
            }
        }
    }

    /**
     * @dev Hook that is called before any transfer of tokens. This includes
     * minting and burning.
     *
     * Calling conditions:
     *
     * - when `from` and `to` are both non-zero, `amount` of ``from``'s tokens
     * will be transferred to `to`.
     * - when `from` is zero, `amount` tokens will be minted for `to`.
     * - when `to` is zero, `amount` of ``from``'s tokens will be burned.
     * - `from` and `to` are never both zero.
     *
     * To learn more about hooks, head to xref:ROOT:extending-contracts.adoc#using-hooks[Using Hooks].
     */
    function _beforeTokenTransfer(address from, address to, uint256 amount) internal virtual {}

    /**
     * @dev Hook that is called after any transfer of tokens. This includes
     * minting and burning.
     *
     * Calling conditions:
     *
     * - when `from` and `to` are both non-zero, `amount` of ``from``'s tokens
     * has been transferred to `to`.
     * - when `from` is zero, `amount` tokens have been minted for `to`.
     * - when `to` is zero, `amount` of ``from``'s tokens have been burned.
     * - `from` and `to` are never both zero.
     *
     * To learn more about hooks, head to xref:ROOT:extending-contracts.adoc#using-hooks[Using Hooks].
     */
    function _afterTokenTransfer(address from, address to, uint256 amount) internal virtual {}
}

// SPDX-License-Identifier: MIT
pragma solidity >=0.8.19;

import { SD1x18 } from "./ValueType.sol";

/// @notice Thrown when trying to cast a SD1x18 number that doesn't fit in UD2x18.
error PRBMath_SD1x18_ToUD2x18_Underflow(SD1x18 x);

/// @notice Thrown when trying to cast a SD1x18 number that doesn't fit in UD60x18.
error PRBMath_SD1x18_ToUD60x18_Underflow(SD1x18 x);

/// @notice Thrown when trying to cast a SD1x18 number that doesn't fit in uint128.
error PRBMath_SD1x18_ToUint128_Underflow(SD1x18 x);

/// @notice Thrown when trying to cast a SD1x18 number that doesn't fit in uint256.
error PRBMath_SD1x18_ToUint256_Underflow(SD1x18 x);

/// @notice Thrown when trying to cast a SD1x18 number that doesn't fit in uint40.
error PRBMath_SD1x18_ToUint40_Overflow(SD1x18 x);

/// @notice Thrown when trying to cast a SD1x18 number that doesn't fit in uint40.
error PRBMath_SD1x18_ToUint40_Underflow(SD1x18 x);

// SPDX-License-Identifier: AGPL-3.0-only
/// @notice Taken from: https://github.com/transmissions11/solmate/blob/2001af43aedb46fdc2335d2a7714fb2dae7cfcd1/src/utils/FixedPointMathLib.sol

pragma solidity >=0.8.0;

/// @notice Arithmetic library with operations for fixed-point numbers.
/// @author Solmate (https://github.com/transmissions11/solmate/blob/main/src/utils/FixedPointMathLib.sol)
/// @author Inspired by USM (https://github.com/usmfum/USM/blob/master/contracts/WadMath.sol)
library FixedPointMathLib {
    /*//////////////////////////////////////////////////////////////
                    SIMPLIFIED FIXED POINT OPERATIONS
    //////////////////////////////////////////////////////////////*/

    uint256 internal constant MAX_UINT256 = 2 ** 256 - 1;

    uint256 internal constant WAD = 1e18; // The scalar of ETH and most ERC20s.

    function mulWadDown(uint256 x, uint256 y) internal pure returns (uint256) {
        return mulDivDown(x, y, WAD); // Equivalent to (x * y) / WAD rounded down.
    }

    function mulWadUp(uint256 x, uint256 y) internal pure returns (uint256) {
        return mulDivUp(x, y, WAD); // Equivalent to (x * y) / WAD rounded up.
    }

    function divWadDown(uint256 x, uint256 y) internal pure returns (uint256) {
        return mulDivDown(x, WAD, y); // Equivalent to (x * WAD) / y rounded down.
    }

    function divWadUp(uint256 x, uint256 y) internal pure returns (uint256) {
        return mulDivUp(x, WAD, y); // Equivalent to (x * WAD) / y rounded up.
    }

    /*//////////////////////////////////////////////////////////////
                    LOW LEVEL FIXED POINT OPERATIONS
    //////////////////////////////////////////////////////////////*/

    function mulDivDown(uint256 x, uint256 y, uint256 denominator) internal pure returns (uint256 z) {
        /// @solidity memory-safe-assembly
        assembly {
            // Equivalent to require(denominator != 0 && (y == 0 || x <= type(uint256).max / y))
            if iszero(mul(denominator, iszero(mul(y, gt(x, div(MAX_UINT256, y)))))) {
                revert(0, 0)
            }

            // Divide x * y by the denominator.
            z := div(mul(x, y), denominator)
        }
    }

    function mulDivUp(uint256 x, uint256 y, uint256 denominator) internal pure returns (uint256 z) {
        /// @solidity memory-safe-assembly
        assembly {
            // Equivalent to require(denominator != 0 && (y == 0 || x <= type(uint256).max / y))
            if iszero(mul(denominator, iszero(mul(y, gt(x, div(MAX_UINT256, y)))))) {
                revert(0, 0)
            }

            // If x * y modulo the denominator is strictly greater than 0,
            // 1 is added to round up the division of x * y by the denominator.
            z := add(gt(mod(mul(x, y), denominator), 0), div(mul(x, y), denominator))
        }
    }

    function rpow(uint256 x, uint256 n, uint256 scalar) internal pure returns (uint256 z) {
        /// @solidity memory-safe-assembly
        assembly {
            switch x
            case 0 {
                switch n
                case 0 {
                    // 0 ** 0 = 1
                    z := scalar
                }
                default {
                    // 0 ** n = 0
                    z := 0
                }
            }
            default {
                switch mod(n, 2)
                case 0 {
                    // If n is even, store scalar in z for now.
                    z := scalar
                }
                default {
                    // If n is odd, store x in z for now.
                    z := x
                }

                // Shifting right by 1 is like dividing by 2.
                let half := shr(1, scalar)

                for {
                    // Shift n right by 1 before looping to halve it.
                    n := shr(1, n)
                } n {
                    // Shift n right by 1 each iteration to halve it.
                    n := shr(1, n)
                } {
                    // Revert immediately if x ** 2 would overflow.
                    // Equivalent to iszero(eq(div(xx, x), x)) here.
                    if shr(128, x) {
                        revert(0, 0)
                    }

                    // Store x squared.
                    let xx := mul(x, x)

                    // Round to the nearest number.
                    let xxRound := add(xx, half)

                    // Revert if xx + half overflowed.
                    if lt(xxRound, xx) {
                        revert(0, 0)
                    }

                    // Set x to scaled xxRound.
                    x := div(xxRound, scalar)

                    // If n is even:
                    if mod(n, 2) {
                        // Compute z * x.
                        let zx := mul(z, x)

                        // If z * x overflowed:
                        if iszero(eq(div(zx, x), z)) {
                            // Revert if x is non-zero.
                            if iszero(iszero(x)) {
                                revert(0, 0)
                            }
                        }

                        // Round to the nearest number.
                        let zxRound := add(zx, half)

                        // Revert if zx + half overflowed.
                        if lt(zxRound, zx) {
                            revert(0, 0)
                        }

                        // Return properly scaled zxRound.
                        z := div(zxRound, scalar)
                    }
                }
            }
        }
    }

    /*//////////////////////////////////////////////////////////////
                        GENERAL NUMBER UTILITIES
    //////////////////////////////////////////////////////////////*/

    function sqrt(uint256 x) internal pure returns (uint256 z) {
        /// @solidity memory-safe-assembly
        assembly {
            let y := x // We start y at x, which will help us make our initial estimate.

            z := 181 // The "correct" value is 1, but this saves a multiplication later.

            // This segment is to get a reasonable initial estimate for the Babylonian method. With a bad
            // start, the correct # of bits increases ~linearly each iteration instead of ~quadratically.

            // We check y >= 2^(k + 8) but shift right by k bits
            // each branch to ensure that if x >= 256, then y >= 256.
            if iszero(lt(y, 0x10000000000000000000000000000000000)) {
                y := shr(128, y)
                z := shl(64, z)
            }
            if iszero(lt(y, 0x1000000000000000000)) {
                y := shr(64, y)
                z := shl(32, z)
            }
            if iszero(lt(y, 0x10000000000)) {
                y := shr(32, y)
                z := shl(16, z)
            }
            if iszero(lt(y, 0x1000000)) {
                y := shr(16, y)
                z := shl(8, z)
            }

            // Goal was to get z*z*y within a small factor of x. More iterations could
            // get y in a tighter range. Currently, we will have y in [256, 256*2^16).
            // We ensured y >= 256 so that the relative difference between y and y+1 is small.
            // That's not possible if x < 256 but we can just verify those cases exhaustively.

            // Now, z*z*y <= x < z*z*(y+1), and y <= 2^(16+8), and either y >= 256, or x < 256.
            // Correctness can be checked exhaustively for x < 256, so we assume y >= 256.
            // Then z*sqrt(y) is within sqrt(257)/sqrt(256) of sqrt(x), or about 20bps.

            // For s in the range [1/256, 256], the estimate f(s) = (181/1024) * (s+1) is in the range
            // (1/2.84 * sqrt(s), 2.84 * sqrt(s)), with largest error when s = 1 and when s = 256 or 1/256.

            // Since y is in [256, 256*2^16), let a = y/65536, so that a is in [1/256, 256). Then we can estimate
            // sqrt(y) using sqrt(65536) * 181/1024 * (a + 1) = 181/4 * (y + 65536)/65536 = 181 * (y + 65536)/2^18.

            // There is no overflow risk here since y < 2^136 after the first branch above.
            z := shr(18, mul(z, add(y, 65536))) // A mul() is saved from starting z at 181.

            // Given the worst case multiplicative error of 2.84 above, 7 iterations should be enough.
            z := shr(1, add(z, div(x, z)))
            z := shr(1, add(z, div(x, z)))
            z := shr(1, add(z, div(x, z)))
            z := shr(1, add(z, div(x, z)))
            z := shr(1, add(z, div(x, z)))
            z := shr(1, add(z, div(x, z)))
            z := shr(1, add(z, div(x, z)))

            // If x+1 is a perfect square, the Babylonian method cycles between
            // floor(sqrt(x)) and ceil(sqrt(x)). This statement ensures we return floor.
            // See: https://en.wikipedia.org/wiki/Integer_square_root#Using_only_integer_division
            // Since the ceil is rare, we save gas on the assignment and repeat division in the rare case.
            // If you don't care whether the floor or ceil square root is returned, you can remove this statement.
            z := sub(z, lt(div(x, z), z))
        }
    }

    function unsafeMod(uint256 x, uint256 y) internal pure returns (uint256 z) {
        /// @solidity memory-safe-assembly
        assembly {
            // Mod x by y. Note this will return
            // 0 instead of reverting if y is zero.
            z := mod(x, y)
        }
    }

    function unsafeDiv(uint256 x, uint256 y) internal pure returns (uint256 r) {
        /// @solidity memory-safe-assembly
        assembly {
            // Divide x by y. Note this will return
            // 0 instead of reverting if y is zero.
            r := div(x, y)
        }
    }

    function unsafeDivUp(uint256 x, uint256 y) internal pure returns (uint256 z) {
        /// @solidity memory-safe-assembly
        assembly {
            // Add 1 to x * y if x % y > 0. Note this will
            // return 0 instead of reverting if y is zero.
            z := add(gt(mod(x, y), 0), div(x, y))
        }
    }
}

// SPDX-License-Identifier: MIT
pragma solidity >=0.8.19;

import { wrap } from "./Casting.sol";
import { UD60x18 } from "./ValueType.sol";

/// @notice Implements the checked addition operation (+) in the UD60x18 type.
function add(UD60x18 x, UD60x18 y) pure returns (UD60x18 result) {
    result = wrap(x.unwrap() + y.unwrap());
}

/// @notice Implements the AND (&) bitwise operation in the UD60x18 type.
function and(UD60x18 x, uint256 bits) pure returns (UD60x18 result) {
    result = wrap(x.unwrap() & bits);
}

/// @notice Implements the AND (&) bitwise operation in the UD60x18 type.
function and2(UD60x18 x, UD60x18 y) pure returns (UD60x18 result) {
    result = wrap(x.unwrap() & y.unwrap());
}

/// @notice Implements the equal operation (==) in the UD60x18 type.
function eq(UD60x18 x, UD60x18 y) pure returns (bool result) {
    result = x.unwrap() == y.unwrap();
}

/// @notice Implements the greater than operation (>) in the UD60x18 type.
function gt(UD60x18 x, UD60x18 y) pure returns (bool result) {
    result = x.unwrap() > y.unwrap();
}

/// @notice Implements the greater than or equal to operation (>=) in the UD60x18 type.
function gte(UD60x18 x, UD60x18 y) pure returns (bool result) {
    result = x.unwrap() >= y.unwrap();
}

/// @notice Implements a zero comparison check function in the UD60x18 type.
function isZero(UD60x18 x) pure returns (bool result) {
    // This wouldn't work if x could be negative.
    result = x.unwrap() == 0;
}

/// @notice Implements the left shift operation (<<) in the UD60x18 type.
function lshift(UD60x18 x, uint256 bits) pure returns (UD60x18 result) {
    result = wrap(x.unwrap() << bits);
}

/// @notice Implements the lower than operation (<) in the UD60x18 type.
function lt(UD60x18 x, UD60x18 y) pure returns (bool result) {
    result = x.unwrap() < y.unwrap();
}

/// @notice Implements the lower than or equal to operation (<=) in the UD60x18 type.
function lte(UD60x18 x, UD60x18 y) pure returns (bool result) {
    result = x.unwrap() <= y.unwrap();
}

/// @notice Implements the checked modulo operation (%) in the UD60x18 type.
function mod(UD60x18 x, UD60x18 y) pure returns (UD60x18 result) {
    result = wrap(x.unwrap() % y.unwrap());
}

/// @notice Implements the not equal operation (!=) in the UD60x18 type.
function neq(UD60x18 x, UD60x18 y) pure returns (bool result) {
    result = x.unwrap() != y.unwrap();
}

/// @notice Implements the NOT (~) bitwise operation in the UD60x18 type.
function not(UD60x18 x) pure returns (UD60x18 result) {
    result = wrap(~x.unwrap());
}

/// @notice Implements the OR (|) bitwise operation in the UD60x18 type.
function or(UD60x18 x, UD60x18 y) pure returns (UD60x18 result) {
    result = wrap(x.unwrap() | y.unwrap());
}

/// @notice Implements the right shift operation (>>) in the UD60x18 type.
function rshift(UD60x18 x, uint256 bits) pure returns (UD60x18 result) {
    result = wrap(x.unwrap() >> bits);
}

/// @notice Implements the checked subtraction operation (-) in the UD60x18 type.
function sub(UD60x18 x, UD60x18 y) pure returns (UD60x18 result) {
    result = wrap(x.unwrap() - y.unwrap());
}

/// @notice Implements the unchecked addition operation (+) in the UD60x18 type.
function uncheckedAdd(UD60x18 x, UD60x18 y) pure returns (UD60x18 result) {
    unchecked {
        result = wrap(x.unwrap() + y.unwrap());
    }
}

/// @notice Implements the unchecked subtraction operation (-) in the UD60x18 type.
function uncheckedSub(UD60x18 x, UD60x18 y) pure returns (UD60x18 result) {
    unchecked {
        result = wrap(x.unwrap() - y.unwrap());
    }
}

/// @notice Implements the XOR (^) bitwise operation in the UD60x18 type.
function xor(UD60x18 x, UD60x18 y) pure returns (UD60x18 result) {
    result = wrap(x.unwrap() ^ y.unwrap());
}

// SPDX-License-Identifier: GPL-3.0-or-later
pragma solidity ^0.8.0;

interface IBaseAdapter {
    /* ============== MUTATIVE METHODS =============== */

    /// @notice update adapter's scale value and return it
    ///         Underlying decimals: `u`, Target decimals: `t`, Target conversion rate: 10^u / 10^t
    ///         => Scale = 10^(u-t) * 10^18 = 10^(u-t+18)
    ///         e.g. WstETH (t=18,u=18) price: 1.2 WETH => scale = 1.2*10^18
    ///              eUSDC (t=18,u=6) price: 1.01 USDC => scale = 1.01*10^(6-18+18) = 1.01*10^6
    /// @dev For interest-bearing token, such as cTokens, this is simply the conversion rate
    /// @dev For other Targets, such as AMM LP shares, specialized logic will be required
    /// @return scale in units of underlying token
    function scale() external view returns (uint256);

    /// @notice deposit Underlying in return for Target.
    function deposit(uint256 underlyingUsed) external returns (uint256 shares);

    /// @notice redeem Target and receive Underlying in return.
    /// @dev no funds should be left in the contract after this call
    ///      the caller must transfer Target to this contract before calling this function.
    /// @param to recipient of Underlying
    /// @return underlyingWithdrawn amount of Underlying returned
    /// @return sharesRedeemed amount of Target redeemed
    function prefundedRedeem(address to) external returns (uint256 underlyingWithdrawn, uint256 sharesRedeemed);

    /* =============== VIEW METHODS ================ */

    /// @notice return Underlying token address (eg USDC, DAI)
    /// @return Underlying address
    function underlying() external view returns (address);

    /// @notice return yield-bearing token address (eg cUSDC, wstETH, AMM LP shares)
    /// @return Target address (yield-bearing token)
    function target() external view returns (address);
}

// SPDX-License-Identifier: MIT
// OpenZeppelin Contracts (last updated v4.9.0) (token/ERC20/IERC20.sol)

pragma solidity ^0.8.0;

/**
 * @dev Interface of the ERC20 standard as defined in the EIP.
 */
interface IERC20 {
    /**
     * @dev Emitted when `value` tokens are moved from one account (`from`) to
     * another (`to`).
     *
     * Note that `value` may be zero.
     */
    event Transfer(address indexed from, address indexed to, uint256 value);

    /**
     * @dev Emitted when the allowance of a `spender` for an `owner` is set by
     * a call to {approve}. `value` is the new allowance.
     */
    event Approval(address indexed owner, address indexed spender, uint256 value);

    /**
     * @dev Returns the amount of tokens in existence.
     */
    function totalSupply() external view returns (uint256);

    /**
     * @dev Returns the amount of tokens owned by `account`.
     */
    function balanceOf(address account) external view returns (uint256);

    /**
     * @dev Moves `amount` tokens from the caller's account to `to`.
     *
     * Returns a boolean value indicating whether the operation succeeded.
     *
     * Emits a {Transfer} event.
     */
    function transfer(address to, uint256 amount) external returns (bool);

    /**
     * @dev Returns the remaining number of tokens that `spender` will be
     * allowed to spend on behalf of `owner` through {transferFrom}. This is
     * zero by default.
     *
     * This value changes when {approve} or {transferFrom} are called.
     */
    function allowance(address owner, address spender) external view returns (uint256);

    /**
     * @dev Sets `amount` as the allowance of `spender` over the caller's tokens.
     *
     * Returns a boolean value indicating whether the operation succeeded.
     *
     * IMPORTANT: Beware that changing an allowance with this method brings the risk
     * that someone may use both the old and the new allowance by unfortunate
     * transaction ordering. One possible solution to mitigate this race
     * condition is to first reduce the spender's allowance to 0 and set the
     * desired value afterwards:
     * https://github.com/ethereum/EIPs/issues/20#issuecomment-263524729
     *
     * Emits an {Approval} event.
     */
    function approve(address spender, uint256 amount) external returns (bool);

    /**
     * @dev Moves `amount` tokens from `from` to `to` using the
     * allowance mechanism. `amount` is then deducted from the caller's
     * allowance.
     *
     * Returns a boolean value indicating whether the operation succeeded.
     *
     * Emits a {Transfer} event.
     */
    function transferFrom(address from, address to, uint256 amount) external returns (bool);
}

// SPDX-License-Identifier: MIT
// OpenZeppelin Contracts v4.4.1 (token/ERC20/extensions/IERC20Metadata.sol)

pragma solidity ^0.8.0;

import "../IERC20.sol";

/**
 * @dev Interface for the optional metadata functions from the ERC20 standard.
 *
 * _Available since v4.1._
 */
interface IERC20Metadata is IERC20 {
    /**
     * @dev Returns the name of the token.
     */
    function name() external view returns (string memory);

    /**
     * @dev Returns the symbol of the token.
     */
    function symbol() external view returns (string memory);

    /**
     * @dev Returns the decimals places of the token.
     */
    function decimals() external view returns (uint8);
}

// SPDX-License-Identifier: MIT
// OpenZeppelin Contracts (last updated v4.9.0) (token/ERC20/extensions/IERC20Permit.sol)

pragma solidity ^0.8.0;

/**
 * @dev Interface of the ERC20 Permit extension allowing approvals to be made via signatures, as defined in
 * https://eips.ethereum.org/EIPS/eip-2612[EIP-2612].
 *
 * Adds the {permit} method, which can be used to change an account's ERC20 allowance (see {IERC20-allowance}) by
 * presenting a message signed by the account. By not relying on {IERC20-approve}, the token holder account doesn't
 * need to send a transaction, and thus is not required to hold Ether at all.
 */
interface IERC20Permit {
    /**
     * @dev Sets `value` as the allowance of `spender` over ``owner``'s tokens,
     * given ``owner``'s signed approval.
     *
     * IMPORTANT: The same issues {IERC20-approve} has related to transaction
     * ordering also apply here.
     *
     * Emits an {Approval} event.
     *
     * Requirements:
     *
     * - `spender` cannot be the zero address.
     * - `deadline` must be a timestamp in the future.
     * - `v`, `r` and `s` must be a valid `secp256k1` signature from `owner`
     * over the EIP712-formatted function arguments.
     * - the signature must use ``owner``'s current nonce (see {nonces}).
     *
     * For more information on the signature format, see the
     * https://eips.ethereum.org/EIPS/eip-2612#specification[relevant EIP
     * section].
     */
    function permit(
        address owner,
        address spender,
        uint256 value,
        uint256 deadline,
        uint8 v,
        bytes32 r,
        bytes32 s
    ) external;

    /**
     * @dev Returns the current nonce for `owner`. This value must be
     * included whenever a signature is generated for {permit}.
     *
     * Every successful call to {permit} increases ``owner``'s nonce by one. This
     * prevents a signature from being used multiple times.
     */
    function nonces(address owner) external view returns (uint256);

    /**
     * @dev Returns the domain separator used in the encoding of the signature for {permit}, as defined by {EIP712}.
     */
    // solhint-disable-next-line func-name-mixedcase
    function DOMAIN_SEPARATOR() external view returns (bytes32);
}

// SPDX-License-Identifier: GPL-3.0-or-later
pragma solidity ^0.8.0;

import {IERC20} from "@openzeppelin/contracts@4.9.3/token/ERC20/IERC20.sol";

/// @notice Principal tokens (zero-coupon tokens) are redeemable for a single underlying EIP-20 token at a future timestamp.
///         https://eips.ethereum.org/EIPS/eip-5095
interface IERC5095 is IERC20 {
    event Redeem(address indexed from, address indexed to, uint256 underlyingAmount);

    /// @dev Asset that is returned on redemption.
    function underlying() external view returns (address underlyingAddress);

    /// @dev Unix time at which redemption of fyToken for underlying are possible
    function maturity() external view returns (uint256 timestamp);

    /// @dev Converts a specified amount of principal to underlying
    function convertToUnderlying(uint256 principalAmount) external view returns (uint256 underlyingAmount);

    /// @dev Converts a specified amount of underlying to principal
    function convertToPrincipal(uint256 underlyingAmount) external view returns (uint256 principalAmount);

    /// @dev Gives the maximum amount an address holder can redeem in terms of the principal
    function maxRedeem(address holder) external view returns (uint256 maxPrincipalAmount);

    /// @dev Gives the amount in terms of underlying that the princiapl amount can be redeemed for plus accrual
    function previewRedeem(uint256 principalAmount) external view returns (uint256 underlyingAmount);

    /// @dev Burn fyToken after maturity for an amount of principal.
    function redeem(uint256 principalAmount, address to, address from) external returns (uint256 underlyingAmount);

    /// @dev Gives the maximum amount an address holder can withdraw in terms of the underlying
    function maxWithdraw(address holder) external view returns (uint256 maxUnderlyingAmount);

    /// @dev Gives the amount in terms of principal that the underlying amount can be withdrawn for plus accrual
    function previewWithdraw(uint256 underlyingAmount) external view returns (uint256 principalAmount);

    /// @dev Burn fyToken after maturity for an amount of underlying.
    function withdraw(uint256 underlyingAmount, address to, address from) external returns (uint256 principalAmount);
}

// SPDX-License-Identifier: GPL-3.0-or-later
pragma solidity ^0.8.0;

interface INapierMintCallback {
    /**
     * @notice Callback function to handle the add liquidity.
     * @param underlyingDelta The change in underlying.
     * @param baseLptDelta The change in Base pool LP token.
     * @param data Additional data passed to the callback. Can be used to pass context-specific information.
     */
    function mintCallback(uint256 underlyingDelta, uint256 baseLptDelta, bytes calldata data) external;
}

// SPDX-License-Identifier: GPL-3.0-or-later
pragma solidity ^0.8.0;

import {IERC20} from "@openzeppelin/contracts@4.9.3/token/ERC20/IERC20.sol";
import {CurveTricryptoOptimizedWETH} from "./external/CurveTricryptoOptimizedWETH.sol";

import {PoolState} from "../libs/PoolMath.sol";

interface INapierPool {
    event Mint(address indexed receiver, uint256 liquidity, uint256 underlyingUsed, uint256 baseLptUsed);

    event Burn(address indexed receiver, uint256 liquidity, uint256 underlyingOut, uint256 baseLptOut);

    event Swap(
        address indexed caller,
        address indexed receiver,
        int256 netUnderlying,
        uint256 index,
        int256 netPt,
        uint256 swapFee,
        uint256 protocolFee
    );

    event SwapBaseLpt(
        address indexed caller,
        address indexed receiver,
        int256 netUnderlying,
        int256 netBaseLpt,
        uint256 swapFee,
        uint256 protocolFee
    );

    event UpdateLnImpliedRate(uint256 lnImpliedRate);

    /**
     * @notice Add liquidity to the pool with Underlying and base lp token.
     * Caller have to transfer tokens to this contract before calling this function.
     * @param underlyingInDesired The desired amount of underlying asset to add.
     * @param baseLptInDesired The desired amount of base lp token to add.
     * @param recipient The recipient of the liquidity tokens.
     * @param data Additional data for callback.
     * @return The amount of liquidity tokens received.
     */
    function addLiquidity(uint256 underlyingInDesired, uint256 baseLptInDesired, address recipient, bytes memory data)
        external
        returns (uint256);

    /**
     * @notice Remove liquidity from the pool.
     * Caller have to transfer Lp token to this contract before calling this function.
     * @param recipient The recipient of the assets.
     * @return The amounts of base lp token and underlying asset received.
     */
    function removeLiquidity(address recipient) external returns (uint256, uint256);

    /**
     * @notice Swap exact amount of PT for Underlying asset.
     * It supports flash swap by specifying the callback data.
     * Flash swap enables user to receive Underlying asset before paying PT.
     * If the pool contract received enough PT after the callback, the swap is successful. Otherwise, the swap is reverted.
     * @param index The index of the PT.
     * @param ptIn The amount of PT to swap.
     * @param recipient The recipient of the swapped underlying asset.
     * @param data Additional data for the flash swap.
     * @return The amount of underlying asset received.
     */
    function swapPtForUnderlying(uint256 index, uint256 ptIn, address recipient, bytes calldata data)
        external
        returns (uint256);

    /**
     * @notice Swap Underlying asset for exact amount of PT.
     * It supports flash swap by specifying the callback data.
     * It enables user to receive PT before paying Underlying asset.
     * if the pool contract received enough Underlying asset after the callback, the swap is successful. Otherwise, the swap is reverted.
     * @param index The index of the PT.
     * @param ptOut The desired amount of PT to receive.
     * @param recipient The recipient of the PT.
     * @param data Additional data for the flash swap.
     * @return The amount of PT received.
     */
    function swapUnderlyingForPt(uint256 index, uint256 ptOut, address recipient, bytes calldata data)
        external
        returns (uint256);

    /**
     * @notice Swap Underlying asset for exact amount of Base LP token.
     * @param baseLpOut The desired amount of Base LP token to receive.
     * @param recipient The recipient of the Base LP token.
     */
    function swapUnderlyingForExactBaseLpToken(uint256 baseLpOut, address recipient) external returns (uint256);

    /**
     * @notice Swap exact amount of Base LP token for Underlying asset.
     * @param recipient The recipient of the Underlying asset.
     */
    function swapExactBaseLpTokenForUnderlying(uint256 baseLptIn, address recipient) external returns (uint256);

    /**
     * @notice Maturity of the pool, in unix timestamp.
     * @dev Maturity is same as the maturity of Principal Token in the pool.
     */
    function maturity() external view returns (uint256);

    function totalUnderlying() external view returns (uint128);

    function totalBaseLpt() external view returns (uint128);

    function getAssets() external view returns (address, address);

    /**
     * @notice State of the pool.
     * @dev This function is not expected to be called on-chain.
     */
    function readState() external view returns (PoolState memory);

    function tricrypto() external view returns (CurveTricryptoOptimizedWETH);

    function principalTokens() external view returns (IERC20[3] memory);

    function lastLnImpliedRate() external view returns (uint256);
}

// SPDX-License-Identifier: GPL-3.0-or-later
pragma solidity ^0.8.0;

import {ApproxParams} from "./ApproxParams.sol";

/// @title Napier Router Interface
/// @dev Interface for the Router contract
/// @notice Router contract for interacting with Napier Yield Metapool and Base pool.
interface INapierRouter {
    ////////////////////////////////////////////////////////////////
    // PT-Underlying swap functions
    ////////////////////////////////////////////////////////////////

    /// @notice Swap exact amount of Principal Token (PT) for Underlying.
    /// @param pool The address of the pool.
    /// @param index The index of the PT.
    /// @param ptInDesired The amount of PT to swap.
    /// @param underlyingOutMin The minimum amount of underlying asset to receive.
    /// @param recipient The recipient of the swapped underlying asset.
    /// @param deadline The deadline for the swap.
    /// @return The amount of underlying asset received.
    function swapPtForUnderlying(
        address pool,
        uint256 index,
        uint256 ptInDesired,
        uint256 underlyingOutMin,
        address recipient,
        uint256 deadline
    ) external returns (uint256);

    /// @notice Swap underlying asset for exact amount of Principal Token (PT).
    /// @dev This function pulls underlying asset from msg.sender on callback because we don't know the exact amount of underlying asset to pull before the swap.
    /// @param pool The address of the pool.
    /// @param index The index of the PT.
    /// @param ptOutDesired The amount of PT to receive.
    /// @param underlyingInMax The maximum amount of underlying asset to spend.
    /// @param recipient The recipient of the PT token.
    /// @param deadline The deadline for the swap.
    /// @return The amount of PT token received.
    function swapUnderlyingForPt(
        address pool,
        uint256 index,
        uint256 ptOutDesired,
        uint256 underlyingInMax,
        address recipient,
        uint256 deadline
    ) external payable returns (uint256);

    ////////////////////////////////////////////////////////////////
    // YT-Underlying swap functions
    ////////////////////////////////////////////////////////////////

    /// @notice Variant of `swapUnderlyingForYt` with `ApproxParams` as an additional parameter.
    function swapUnderlyingForYt(
        address pool,
        uint256 index,
        uint256 ytOutDesired,
        uint256 underlyingInMax,
        address recipient,
        uint256 deadline,
        ApproxParams calldata approx
    ) external payable returns (uint256);

    /**
     * @notice Swap exact amount of Underlying for YT.
     * @param pool The address of the pool.
     * @param index The index of the YT.
     * @param ytOutDesired The amount of YT to receive.
     * @param underlyingInMax The maximum amount of underlying asset to spend.
     * @param recipient The recipient of the YT.
     * @param deadline The deadline for the swap.
     * @return The amount of YT received.
     */
    function swapUnderlyingForYt(
        address pool,
        uint256 index,
        uint256 ytOutDesired,
        uint256 underlyingInMax,
        address recipient,
        uint256 deadline
    ) external payable returns (uint256);

    /**
     * @notice Swap exact amount of YT for Underlying.
     * @param pool The address of the pool.
     * @param index The index of the YT.
     * @param ytIn The amount of YT to swap.
     * @param underlyingOutMin The minimum amount of underlying asset to receive.
     * @param recipient The recipient of the underlying asset.
     * @param deadline The deadline for the swap.
     * @return The amount of underlying asset received.
     */
    function swapYtForUnderlying(
        address pool,
        uint256 index,
        uint256 ytIn,
        uint256 underlyingOutMin,
        address recipient,
        uint256 deadline
    ) external returns (uint256);

    ////////////////////////////////////////////////////////////////
    // Liquidity-related functions
    ////////////////////////////////////////////////////////////////

    /// @notice Add liquidity to NapierPool and Curve Tricrypto pool.
    /// @param pool The address of the pool.
    /// @param underlyingIn The amount of underlying asset to deposit.
    /// @param ptsIn The amounts of PTs to deposit.
    /// @param minLiquidity The minimum amount of liquidity tokens to receive.
    /// @param recipient The recipient of the liquidity tokens.
    /// @param deadline The deadline for adding liquidity.
    /// @return The amount of liquidity tokens received.
    function addLiquidity(
        address pool,
        uint256 underlyingIn,
        uint256[3] calldata ptsIn,
        uint256 minLiquidity,
        address recipient,
        uint256 deadline
    ) external payable returns (uint256);

    /// @notice Add liquidity to the pool using a single Principal Token.
    /// @dev Swap some amount of PT for underlying asset so that the user can deposit tokens proportionally to the reserves.
    /// @param pool The address of the pool.
    /// @param index The index of the PT.
    /// @param amountIn The amount of PT to deposit.
    /// @param minLiquidity The minimum amount of liquidity tokens to receive.
    /// @param recipient The recipient of the liquidity tokens.
    /// @param deadline The deadline for adding liquidity.
    /// @param baseLpTokenSwap The estimated baseLpt amount to swap with underlying tokens.
    /// @return The amount of liquidity tokens received.
    function addLiquidityOnePt(
        address pool,
        uint256 index,
        uint256 amountIn,
        uint256 minLiquidity,
        address recipient,
        uint256 deadline,
        uint256 baseLpTokenSwap
    ) external returns (uint256);

    /// @notice Add liquidity to the pool using a single underlying asset.
    /// @dev Swap some underlying asset for Base pool token so that the user can deposit tokens proportionally to the reserves.
    /// @param pool The address of the pool.
    /// @param underlyingIn The amount of underlying asset to deposit.
    /// @param minLiquidity The minimum amount of liquidity tokens to receive.
    /// @param recipient The recipient of the liquidity tokens.
    /// @param deadline The deadline for adding liquidity.
    /// @param baseLpTokenSwap The estimated baseLpt amount to get from underlying tokens.
    /// @return The amount of liquidity tokens received.
    function addLiquidityOneUnderlying(
        address pool,
        uint256 underlyingIn,
        uint256 minLiquidity,
        address recipient,
        uint256 deadline,
        uint256 baseLpTokenSwap
    ) external returns (uint256);

    /// @notice Add liquidity to NapierPool with one underlying asset.
    /// @notice Caller must approve the router to spend underlying asset prior to calling this method.
    /// @dev Caller must specify the amount of underlying asset to be spent to issue PT and YT using off-chain calculation.
    /// @param pool The address of the pool.
    /// @param index The index of the issued PT / YT.
    /// @param underlyingIn The amount of underlying asset to deposit.
    /// @param minLiquidity The minimum amount of liquidity tokens to receive.
    /// @param recipient The recipient of the liquidity tokens.
    /// @param deadline The deadline for adding liquidity.
    /// @param underlyingDeposit The estimated underlying amount spent to issue PT and YT.
    /// @return The amount of liquidity tokens received.
    function addLiquidityOneUnderlyingKeepYt(
        address pool,
        uint256 index,
        uint256 underlyingIn,
        uint256 minLiquidity,
        uint256 ytOutMin,
        address recipient,
        uint256 deadline,
        uint256 underlyingDeposit
    ) external returns (uint256);

    /// @notice Remove liquidity from NapierPool and Curve Tricrypto pool.
    /// @param pool The address of the pool.
    /// @param liquidity The amount of liquidity tokens to burn.
    /// @param underlyingOutMin The minimum amount of underlying asset to receive.
    /// @param ptsOutMin The minimum amounts of PTs to receive.
    /// @param recipient The recipient of the PTs and underlying asset.
    /// @param deadline The deadline for removing liquidity.
    /// @return The amounts of PTs and underlying asset received.
    function removeLiquidity(
        address pool,
        uint256 liquidity,
        uint256 underlyingOutMin,
        uint256[3] calldata ptsOutMin,
        address recipient,
        uint256 deadline
    ) external returns (uint256, uint256[3] memory);

    /**
     * @notice Remove liquidity from the metapool and receive a single underlying asset.
     * @param pool The address of the pool.
     * @param index The index of PT to be withdrawn when removing liquidity from Base pool. Ignored if maturity has not passed.
     * @param liquidity The amount of liquidity tokens to remove.
     * @param underlyingOutMin The minimum amount of underlying asset to receive.
     * @param recipient The recipient of the underlying asset.
     * @param deadline The deadline for removing liquidity.
     * @return The amount of underlying asset received by `recipient`.
     */
    function removeLiquidityOneUnderlying(
        address pool,
        uint256 index,
        uint256 liquidity,
        uint256 underlyingOutMin,
        address recipient,
        uint256 deadline
    ) external returns (uint256);

    /**
     * @notice Remove liquidity from the metapool and receive a single PT.
     * @param pool The address of the pool.
     * @param index The index of the PT.
     * @param liquidity The amount of liquidity tokens to remove.
     * @param ptOutMin The minimum amount of PT to receive.
     * @param recipient The recipient of the PT.
     * @param deadline The deadline for removing liquidity.
     * @param baseLpTokenSwap The estimated baseLpt amount to swap with underlying tokens.
     * @return The amount of PT received by `recipient`.
     */
    function removeLiquidityOnePt(
        address pool,
        uint256 index,
        uint256 liquidity,
        uint256 ptOutMin,
        address recipient,
        uint256 deadline,
        uint256 baseLpTokenSwap
    ) external returns (uint256);
}

// SPDX-License-Identifier: GPL-3.0-or-later
pragma solidity ^0.8.0;

interface INapierSwapCallback {
    /**
     * @notice Callback function to handle the token swap.
     * @param underlyingDelta The change in underlying after the swap.
     * @param ptDelta The change in Principal token after the swap.
     * @param data Additional data passed to the callback. Can be used to pass context-specific information.
     */
    function swapCallback(int256 underlyingDelta, int256 ptDelta, bytes calldata data) external;
}

// SPDX-License-Identifier: GPL-3.0-or-later
pragma solidity ^0.8.0;

interface IPoolFactory {
    event Deployed(address indexed basePool, address indexed underlying, address indexed pool);
    event AuthorizedCallbackReceiver(address indexed callback);
    event RevokedCallbackReceiver(address indexed callback);

    struct PoolAssets {
        address basePool;
        address underlying;
        address[3] principalTokens;
    }

    struct PoolConfig {
        int256 initialAnchor;
        uint256 scalarRoot;
        uint80 lnFeeRateRoot;
        uint8 protocolFeePercent;
        address feeRecipient;
    }

    struct InitArgs {
        PoolAssets assets;
        PoolConfig configs;
    }

    /// @notice Deploy a new NapierPool contract.
    /// @dev Only the factory owner can call this function.
    /// @param basePool Base pool contract
    /// @param underlying underlying asset
    function deploy(address basePool, address underlying, PoolConfig calldata poolConfig) external returns (address);

    /// @notice Authorize swap callback
    /// @dev Only the factory owner can call this function.
    /// @param callback Callback receiver
    function authorizeCallbackReceiver(address callback) external;

    /// @notice Revoke swap callback authorization
    /// @dev Only the factory owner can call this function.
    /// @param callback Callback receiver
    function revokeCallbackReceiver(address callback) external;

    function isCallbackReceiverAuthorized(address callback) external view returns (bool);

    /// @notice calculate the address of a tranche with CREATE2 using the adapter and maturity as salt
    function poolFor(address basePool, address underlying) external view returns (address);

    /// @param pool a pool address
    /// @dev returns the pool parameters used to deploy the pool
    /// this function doesn't revert even if the pool doesn't exist. It returns the default values in that case.
    /// @return the pool parameters
    function getPoolAssets(address pool) external view returns (PoolAssets memory);

    /// @notice Owner of this contract
    function owner() external view returns (address);

    function args() external view returns (InitArgs memory);

    function POOL_CREATION_HASH() external view returns (bytes32);
}

// SPDX-License-Identifier: GPL-3.0-or-later
pragma solidity ^0.8.0;

import {IERC5095} from "./IERC5095.sol";

/// @notice Tranche interface
/// @dev Tranche divides a yield-bearing token into two tokens: Principal and Yield tokens
///      Unspecific types: Simply avoiding dependencies on other interfaces from our interfaces
interface ITranche is IERC5095 {
    /* ==================== ERRORS ===================== */

    error TimestampBeforeMaturity();
    error TimestampAfterMaturity();
    error ProtectedToken();
    error Unauthorized();
    error OnlyYT();
    error ReentrancyGuarded();
    error ZeroAddress();
    error NoAccruedYield();

    /* ==================== EVENTS ===================== */

    /// @param adapter the address of the adapter
    /// @param maturity timestamp of maturity (seconds since Unix epoch)
    /// @param issuanceFee fee for issuing PT and YT
    event SeriesCreated(address indexed adapter, uint256 indexed maturity, uint256 issuanceFee);

    /// @param from the sender of the underlying token
    /// @param to the recipient of the PT and YT
    /// @param underlyingUsed the amount of underlying token used to issue PT and YT
    /// @param sharesUsed the amount of target token used to issue PT and YT (before deducting issuance fee)
    event Issue(address indexed from, address indexed to, uint256 underlyingUsed, uint256 sharesUsed);

    /// @param owner the address of the owner of the PT and YT (address that called collect())
    /// @param shares the amount of Target token collected
    event Collect(address indexed owner, uint256 shares);

    /// @param owner the address of the owner of the PT and YT
    /// @param to the recipient of the underlying token redeemed
    /// @param underlyingRedeemed the amount of underlying token redeemed
    event RedeemWithYT(address indexed owner, address indexed to, uint256 underlyingRedeemed);

    /* ==================== STRUCTS ===================== */

    /// @notice Series is a struct that contains all the information about a series.
    /// @param underlying the address of the underlying token
    /// @param target the address of the target token
    /// @param yt the address of the Yield Token
    /// @param adapter the address of the adapter
    /// @param mscale scale value at maturity
    /// @param maxscale max scale value from this series' lifetime
    /// @param issuanceFee fee for issuing PT and YT
    /// @param maturity timestamp of maturity (seconds since Unix epoch)
    struct Series {
        address underlying;
        address target;
        address yt;
        address adapter;
        uint256 mscale;
        uint256 maxscale;
        uint64 issuanceFee;
        uint64 maturity;
    }

    /// @notice GlobalScales is a struct that contains scale values that are used in multiple functions throughout the Tranche contract.
    /// @param mscale scale value at maturity. before maturity and settlement, this value is 0.
    /// @param maxscale max scale value from this series' lifetime.
    struct GlobalScales {
        uint128 mscale;
        uint128 maxscale;
    }

    /* ================== MUTATIVE METHODS =================== */

    /// @notice deposit an `underlyingAmount` of underlying token into the yield source, receiving PT and YT.
    ///         amount of PT and YT issued are the same.
    /// @param   to the address to receive PT and YT
    /// @param   underlyingAmount the amount of underlying token to deposit
    /// @return  principalAmount the amount of PT and YT issued
    function issue(address to, uint256 underlyingAmount) external returns (uint256 principalAmount);

    /// @notice redeem an `principalAmount` of PT and YT for underlying token.
    /// @param from the address to burn PT and YT from
    /// @param to the address to receive underlying token
    /// @param pyAmount the amount of PT and YT to redeem
    /// @return underlyingAmount the amount of underlying token redeemed
    function redeemWithYT(address from, address to, uint256 pyAmount) external returns (uint256 underlyingAmount);

    /// @notice collect interest for `msg.sender` and transfer accrued interest to `msg.sender`
    /// NOTE: if the maturity has passed, all the YT balance of `msg.sender` is burned.
    /// @dev anyone can call this function to collect interest for themselves
    /// @return collected collected interest in Underlying token
    function collect() external returns (uint256 collected);

    /* ================== PERMISSIONED METHODS =================== */

    /// @notice collect interest from the yield source and distribute it
    ///         every YT transfer, this function is triggered by the Yield Token contract.
    ///         only the Yield Token contract can call this function.
    ///         NOTE: YT is not burned in this function even if the maturity has passed.
    /// @param from address to transfer the Yield Token from. i.e. the user who collects the interest.
    /// @param to address to transfer the Yield Token to (MUST NOT be zero address, CAN be the same as `from`)
    /// @param value amount of Yield Token transferred to `to` (CAN be 0)
    function updateUnclaimedYield(address from, address to, uint256 value) external;

    /* ================== VIEW METHODS =================== */

    /// @notice get the address of Yield Token associated with this Tranche.
    function yieldToken() external view returns (address);

    /// @notice get Series struct
    function getSeries() external view returns (Series memory);

    /// @notice get an accrued yield that can be claimed by `account` (in unis of Target token)
    /// @dev this is reset to 0 when `account` claims the yield.
    /// @param account the address to check
    /// @return accruedInTarget
    function unclaimedYields(address account) external view returns (uint256 accruedInTarget);

    /// @notice get an accrued yield that can be claimed by `account` (in unis of Underlying token)
    /// @param account the address to check
    /// @return accruedInUnderlying accrued yield in underlying token
    function previewCollect(address account) external view returns (uint256 accruedInUnderlying);
}

// SPDX-License-Identifier: GPL-3.0-or-later
pragma solidity ^0.8.0;

import {IERC20} from "@openzeppelin/contracts@4.9.3/token/ERC20/IERC20.sol";

/// @notice WETH9 interface
interface IWETH9 is IERC20 {
    function deposit() external payable;

    function withdraw(uint256 wad) external;
}

// SPDX-License-Identifier: MIT
// OpenZeppelin Contracts (last updated v4.9.0) (utils/math/Math.sol)

pragma solidity ^0.8.0;

/**
 * @dev Standard math utilities missing in the Solidity language.
 */
library Math {
    enum Rounding {
        Down, // Toward negative infinity
        Up, // Toward infinity
        Zero // Toward zero
    }

    /**
     * @dev Returns the largest of two numbers.
     */
    function max(uint256 a, uint256 b) internal pure returns (uint256) {
        return a > b ? a : b;
    }

    /**
     * @dev Returns the smallest of two numbers.
     */
    function min(uint256 a, uint256 b) internal pure returns (uint256) {
        return a < b ? a : b;
    }

    /**
     * @dev Returns the average of two numbers. The result is rounded towards
     * zero.
     */
    function average(uint256 a, uint256 b) internal pure returns (uint256) {
        // (a + b) / 2 can overflow.
        return (a & b) + (a ^ b) / 2;
    }

    /**
     * @dev Returns the ceiling of the division of two numbers.
     *
     * This differs from standard division with `/` in that it rounds up instead
     * of rounding down.
     */
    function ceilDiv(uint256 a, uint256 b) internal pure returns (uint256) {
        // (a + b - 1) / b can overflow on addition, so we distribute.
        return a == 0 ? 0 : (a - 1) / b + 1;
    }

    /**
     * @notice Calculates floor(x * y / denominator) with full precision. Throws if result overflows a uint256 or denominator == 0
     * @dev Original credit to Remco Bloemen under MIT license (https://xn--2-umb.com/21/muldiv)
     * with further edits by Uniswap Labs also under MIT license.
     */
    function mulDiv(uint256 x, uint256 y, uint256 denominator) internal pure returns (uint256 result) {
        unchecked {
            // 512-bit multiply [prod1 prod0] = x * y. Compute the product mod 2^256 and mod 2^256 - 1, then use
            // use the Chinese Remainder Theorem to reconstruct the 512 bit result. The result is stored in two 256
            // variables such that product = prod1 * 2^256 + prod0.
            uint256 prod0; // Least significant 256 bits of the product
            uint256 prod1; // Most significant 256 bits of the product
            assembly {
                let mm := mulmod(x, y, not(0))
                prod0 := mul(x, y)
                prod1 := sub(sub(mm, prod0), lt(mm, prod0))
            }

            // Handle non-overflow cases, 256 by 256 division.
            if (prod1 == 0) {
                // Solidity will revert if denominator == 0, unlike the div opcode on its own.
                // The surrounding unchecked block does not change this fact.
                // See https://docs.soliditylang.org/en/latest/control-structures.html#checked-or-unchecked-arithmetic.
                return prod0 / denominator;
            }

            // Make sure the result is less than 2^256. Also prevents denominator == 0.
            require(denominator > prod1, "Math: mulDiv overflow");

            ///////////////////////////////////////////////
            // 512 by 256 division.
            ///////////////////////////////////////////////

            // Make division exact by subtracting the remainder from [prod1 prod0].
            uint256 remainder;
            assembly {
                // Compute remainder using mulmod.
                remainder := mulmod(x, y, denominator)

                // Subtract 256 bit number from 512 bit number.
                prod1 := sub(prod1, gt(remainder, prod0))
                prod0 := sub(prod0, remainder)
            }

            // Factor powers of two out of denominator and compute largest power of two divisor of denominator. Always >= 1.
            // See https://cs.stackexchange.com/q/138556/92363.

            // Does not overflow because the denominator cannot be zero at this stage in the function.
            uint256 twos = denominator & (~denominator + 1);
            assembly {
                // Divide denominator by twos.
                denominator := div(denominator, twos)

                // Divide [prod1 prod0] by twos.
                prod0 := div(prod0, twos)

                // Flip twos such that it is 2^256 / twos. If twos is zero, then it becomes one.
                twos := add(div(sub(0, twos), twos), 1)
            }

            // Shift in bits from prod1 into prod0.
            prod0 |= prod1 * twos;

            // Invert denominator mod 2^256. Now that denominator is an odd number, it has an inverse modulo 2^256 such
            // that denominator * inv = 1 mod 2^256. Compute the inverse by starting with a seed that is correct for
            // four bits. That is, denominator * inv = 1 mod 2^4.
            uint256 inverse = (3 * denominator) ^ 2;

            // Use the Newton-Raphson iteration to improve the precision. Thanks to Hensel's lifting lemma, this also works
            // in modular arithmetic, doubling the correct bits in each step.
            inverse *= 2 - denominator * inverse; // inverse mod 2^8
            inverse *= 2 - denominator * inverse; // inverse mod 2^16
            inverse *= 2 - denominator * inverse; // inverse mod 2^32
            inverse *= 2 - denominator * inverse; // inverse mod 2^64
            inverse *= 2 - denominator * inverse; // inverse mod 2^128
            inverse *= 2 - denominator * inverse; // inverse mod 2^256

            // Because the division is now exact we can divide by multiplying with the modular inverse of denominator.
            // This will give us the correct result modulo 2^256. Since the preconditions guarantee that the outcome is
            // less than 2^256, this is the final result. We don't need to compute the high bits of the result and prod1
            // is no longer required.
            result = prod0 * inverse;
            return result;
        }
    }

    /**
     * @notice Calculates x * y / denominator with full precision, following the selected rounding direction.
     */
    function mulDiv(uint256 x, uint256 y, uint256 denominator, Rounding rounding) internal pure returns (uint256) {
        uint256 result = mulDiv(x, y, denominator);
        if (rounding == Rounding.Up && mulmod(x, y, denominator) > 0) {
            result += 1;
        }
        return result;
    }

    /**
     * @dev Returns the square root of a number. If the number is not a perfect square, the value is rounded down.
     *
     * Inspired by Henry S. Warren, Jr.'s "Hacker's Delight" (Chapter 11).
     */
    function sqrt(uint256 a) internal pure returns (uint256) {
        if (a == 0) {
            return 0;
        }

        // For our first guess, we get the biggest power of 2 which is smaller than the square root of the target.
        //
        // We know that the "msb" (most significant bit) of our target number `a` is a power of 2 such that we have
        // `msb(a) <= a < 2*msb(a)`. This value can be written `msb(a)=2**k` with `k=log2(a)`.
        //
        // This can be rewritten `2**log2(a) <= a < 2**(log2(a) + 1)`
        // → `sqrt(2**k) <= sqrt(a) < sqrt(2**(k+1))`
        // → `2**(k/2) <= sqrt(a) < 2**((k+1)/2) <= 2**(k/2 + 1)`
        //
        // Consequently, `2**(log2(a) / 2)` is a good first approximation of `sqrt(a)` with at least 1 correct bit.
        uint256 result = 1 << (log2(a) >> 1);

        // At this point `result` is an estimation with one bit of precision. We know the true value is a uint128,
        // since it is the square root of a uint256. Newton's method converges quadratically (precision doubles at
        // every iteration). We thus need at most 7 iteration to turn our partial result with one bit of precision
        // into the expected uint128 result.
        unchecked {
            result = (result + a / result) >> 1;
            result = (result + a / result) >> 1;
            result = (result + a / result) >> 1;
            result = (result + a / result) >> 1;
            result = (result + a / result) >> 1;
            result = (result + a / result) >> 1;
            result = (result + a / result) >> 1;
            return min(result, a / result);
        }
    }

    /**
     * @notice Calculates sqrt(a), following the selected rounding direction.
     */
    function sqrt(uint256 a, Rounding rounding) internal pure returns (uint256) {
        unchecked {
            uint256 result = sqrt(a);
            return result + (rounding == Rounding.Up && result * result < a ? 1 : 0);
        }
    }

    /**
     * @dev Return the log in base 2, rounded down, of a positive value.
     * Returns 0 if given 0.
     */
    function log2(uint256 value) internal pure returns (uint256) {
        uint256 result = 0;
        unchecked {
            if (value >> 128 > 0) {
                value >>= 128;
                result += 128;
            }
            if (value >> 64 > 0) {
                value >>= 64;
                result += 64;
            }
            if (value >> 32 > 0) {
                value >>= 32;
                result += 32;
            }
            if (value >> 16 > 0) {
                value >>= 16;
                result += 16;
            }
            if (value >> 8 > 0) {
                value >>= 8;
                result += 8;
            }
            if (value >> 4 > 0) {
                value >>= 4;
                result += 4;
            }
            if (value >> 2 > 0) {
                value >>= 2;
                result += 2;
            }
            if (value >> 1 > 0) {
                result += 1;
            }
        }
        return result;
    }

    /**
     * @dev Return the log in base 2, following the selected rounding direction, of a positive value.
     * Returns 0 if given 0.
     */
    function log2(uint256 value, Rounding rounding) internal pure returns (uint256) {
        unchecked {
            uint256 result = log2(value);
            return result + (rounding == Rounding.Up && 1 << result < value ? 1 : 0);
        }
    }

    /**
     * @dev Return the log in base 10, rounded down, of a positive value.
     * Returns 0 if given 0.
     */
    function log10(uint256 value) internal pure returns (uint256) {
        uint256 result = 0;
        unchecked {
            if (value >= 10 ** 64) {
                value /= 10 ** 64;
                result += 64;
            }
            if (value >= 10 ** 32) {
                value /= 10 ** 32;
                result += 32;
            }
            if (value >= 10 ** 16) {
                value /= 10 ** 16;
                result += 16;
            }
            if (value >= 10 ** 8) {
                value /= 10 ** 8;
                result += 8;
            }
            if (value >= 10 ** 4) {
                value /= 10 ** 4;
                result += 4;
            }
            if (value >= 10 ** 2) {
                value /= 10 ** 2;
                result += 2;
            }
            if (value >= 10 ** 1) {
                result += 1;
            }
        }
        return result;
    }

    /**
     * @dev Return the log in base 10, following the selected rounding direction, of a positive value.
     * Returns 0 if given 0.
     */
    function log10(uint256 value, Rounding rounding) internal pure returns (uint256) {
        unchecked {
            uint256 result = log10(value);
            return result + (rounding == Rounding.Up && 10 ** result < value ? 1 : 0);
        }
    }

    /**
     * @dev Return the log in base 256, rounded down, of a positive value.
     * Returns 0 if given 0.
     *
     * Adding one to the result gives the number of pairs of hex symbols needed to represent `value` as a hex string.
     */
    function log256(uint256 value) internal pure returns (uint256) {
        uint256 result = 0;
        unchecked {
            if (value >> 128 > 0) {
                value >>= 128;
                result += 16;
            }
            if (value >> 64 > 0) {
                value >>= 64;
                result += 8;
            }
            if (value >> 32 > 0) {
                value >>= 32;
                result += 4;
            }
            if (value >> 16 > 0) {
                value >>= 16;
                result += 2;
            }
            if (value >> 8 > 0) {
                result += 1;
            }
        }
        return result;
    }

    /**
     * @dev Return the log in base 256, following the selected rounding direction, of a positive value.
     * Returns 0 if given 0.
     */
    function log256(uint256 value, Rounding rounding) internal pure returns (uint256) {
        unchecked {
            uint256 result = log256(value);
            return result + (rounding == Rounding.Up && 1 << (result << 3) < value ? 1 : 0);
        }
    }
}

// SPDX-License-Identifier: GPL-2.0-or-later
pragma solidity ^0.8.19;

/// @title Multicallable
/// @notice Enables calling multiple methods in a single call to the contract
/// @dev Forked from Uniswap v3 periphery: https://github.com/Uniswap/v3-periphery/blob/main/contracts/base/Multicallable.sol
/// @dev Apply `DELEGATECALL` with the current contract to each calldata in `data`,
/// and store the `abi.encode` formatted results of each `DELEGATECALL` into `results`.
/// If any of the `DELEGATECALL`s reverts, the entire context is reverted,
/// and the error is bubbled up.
///
// Combining Multicallable with msg.value can cause double spending issues.
/// (See: https://www.paradigm.xyz/2021/08/two-rights-might-make-a-wrong)
abstract contract Multicallable {
    function multicall(bytes[] calldata data) external payable returns (bytes[] memory results) {
        results = new bytes[](data.length);
        for (uint256 i = 0; i < data.length;) {
            (bool success, bytes memory returndata) = address(this).delegatecall(data[i]);

            if (!success) {
                // Bubble up the revert message.
                // https://github.com/dragonfly-xyz/useful-solidity-patterns/tree/main/patterns/error-handling
                // https://github.com/OpenZeppelin/openzeppelin-contracts/blob/36bf1e46fa811f0f07d38eb9cfbc69a955f300ce/contracts/utils/Address.sol#L151-L154
                assembly {
                    revert(
                        // Start of revert data bytes.
                        add(returndata, 0x20),
                        // Length of revert data.
                        mload(returndata)
                    )
                }
            }

            results[i] = returndata;

            unchecked {
                ++i;
            }
        }
    }
}

// SPDX-License-Identifier: GPL-3.0-or-later
pragma solidity ^0.8.19;

// external interfaces
import {IERC20} from "@openzeppelin/contracts@4.9.3/token/ERC20/IERC20.sol";
import {IWETH9} from "@napier/v1-tranche/src/interfaces/IWETH9.sol";
import {ITranche} from "@napier/v1-tranche/src/interfaces/ITranche.sol";
import {IBaseAdapter} from "@napier/v1-tranche/src/interfaces/IBaseAdapter.sol";
import {CurveTricryptoOptimizedWETH} from "./interfaces/external/CurveTricryptoOptimizedWETH.sol";
import {INapierPool} from "./interfaces/INapierPool.sol";
import {IPoolFactory} from "./interfaces/IPoolFactory.sol";
// implements
import {INapierRouter} from "./interfaces/INapierRouter.sol";
import {INapierMintCallback} from "./interfaces/INapierMintCallback.sol";
import {INapierSwapCallback} from "./interfaces/INapierSwapCallback.sol";

// libraries
import {SafeERC20} from "@openzeppelin/contracts@4.9.3/token/ERC20/utils/SafeERC20.sol";
import {CallbackDataTypes, CallbackType} from "./libs/CallbackDataTypes.sol";
import {PoolAddress} from "./libs/PoolAddress.sol";
import {ApproxParams} from "./interfaces/ApproxParams.sol";
import {TrancheMathHelper} from "./libs/TrancheMathHelper.sol";
import {Errors} from "./libs/Errors.sol";

// inherits
import {ReentrancyGuard} from "@openzeppelin/contracts@4.9.3/security/ReentrancyGuard.sol";
import {PeripheryImmutableState} from "./base/PeripheryImmutableState.sol";
import {PeripheryPayments} from "./base/PeripheryPayments.sol";
import {Multicallable} from "./base/Multicallable.sol";

/// @notice Router for Napier pools
/// @dev This contract provides a single entry point for Napier pools. Accepts native ETH.
/// @dev Multicallable is used to batch multiple operations. E.g. Swap Principal Tokens for WETH and unwrap WETH to ETH with a single transaction.
/// See each function for more details.
contract NapierRouter is
    INapierRouter,
    INapierSwapCallback,
    INapierMintCallback,
    PeripheryPayments,
    ReentrancyGuard,
    Multicallable
{
    using SafeERC20 for IERC20;
    using SafeERC20 for ITranche;

    /// @notice Napier Pool Factory
    /// @dev pool passed as functions parameter must be deployed by this factory
    IPoolFactory public immutable factory;

    bytes32 internal immutable POOL_CREATION_HASH;

    /// @notice If the transaction is too old, revert.
    /// @param deadline Transaction deadline in unix timestamp
    modifier checkDeadline(uint256 deadline) {
        if (block.timestamp > deadline) revert Errors.RouterTransactionTooOld();
        _;
    }

    constructor(IPoolFactory _factory, IWETH9 _WETH9) PeripheryImmutableState(_WETH9) {
        factory = _factory;
        POOL_CREATION_HASH = _factory.POOL_CREATION_HASH();
    }

    /// @dev Revert if `msg.sender` is not a Napier pool.
    function _verifyCallback(address basePool, address underlying) internal view {
        if (
            PoolAddress.computeAddress(basePool, underlying, POOL_CREATION_HASH, address(factory))
                != INapierPool(msg.sender)
        ) revert Errors.RouterCallbackNotNapierPool();
    }

    function mintCallback(uint256 underlyingDelta, uint256 baseLptDelta, bytes calldata data) external override {
        // `data` is encoded as follows:
        // [0x00: 0x20] CallbackType (uint8)
        // [0x20:  ~  ] Custom data (based on CallbackType)
        CallbackDataTypes.AddLiquidityData memory params = abi.decode(data[0x20:], (CallbackDataTypes.AddLiquidityData));
        _verifyCallback(params.basePool, params.underlying);

        // In all addLiquidity functions of router, underlying tokens are saved in payer and baseLpTokens are saved in router.
        // So in this callback function, we don't need to get CallbackTypes.
        // If this contract holds enough ETH, wrap it. Otherwise, transfer from the caller.
        _pay(params.underlying, params.payer, msg.sender, underlyingDelta);
        IERC20(params.basePool).safeTransfer(msg.sender, baseLptDelta);
    }

    function swapCallback(int256 underlyingDelta, int256 ptDelta, bytes calldata data) external override {
        // `data` is encoded as follows:
        // [0x00: 0x20] CallbackType (uint8)
        // [0x20: 0x40] Underlying (address)
        // [0x40: 0x60] BasePool (address)
        // [0x60:  ~  ] Custom data (based on CallbackType)
        (address underlying, address basePool) = abi.decode(data[0x20:0x60], (address, address));
        _verifyCallback(basePool, underlying);

        CallbackType _type = CallbackDataTypes.getCallbackType(data);

        if (_type == CallbackType.SwapPtForUnderlying) {
            CallbackDataTypes.SwapPtForUnderlyingData memory params =
                abi.decode(data[0x60:], (CallbackDataTypes.SwapPtForUnderlyingData));
            params.pt.safeTransferFrom(params.payer, msg.sender, uint256(-ptDelta));
        } else if (_type == CallbackType.SwapUnderlyingForPt) {
            // Decode callback data
            CallbackDataTypes.SwapUnderlyingForPtData memory params =
                abi.decode(data[0x60:], (CallbackDataTypes.SwapUnderlyingForPtData));

            // Check slippage. Revert if exceeded max underlying in
            if (uint256(-underlyingDelta) > params.underlyingInMax) revert Errors.RouterExceededLimitUnderlyingIn();
            _pay(underlying, params.payer, msg.sender, uint256(-underlyingDelta));
        } else if (_type == CallbackType.SwapYtForUnderlying) {
            // Decode callback data
            CallbackDataTypes.SwapYtForUnderlyingData memory params =
                abi.decode(data[0x60:], (CallbackDataTypes.SwapYtForUnderlyingData));

            uint256 uRepay = uint256(-underlyingDelta); // unsafe cast is okay because always negative in this branch
            uint256 pyRedeem; // amount of PT (YT) to be redeemed
            // Assign the minimum amount of (ytIn, ptDelta) to `pyRedeem`
            if (params.ytIn >= uint256(ptDelta)) {
                // If the actual amount of PT received is less than the requested amount, use the actual amount
                pyRedeem = uint256(ptDelta);
            } else {
                pyRedeem = params.ytIn;
                // Surplus of `ptDelta` - `params.ytIn` should be refunded to the payer
                // no underflow because of the if statement above
                IERC20(params.pt).safeTransfer(params.payer, uint256(ptDelta) - params.ytIn); // non-zero
            }

            // Transfer YT from caller to this contract
            IERC20(params.pt.yieldToken()).safeTransferFrom(params.payer, address(this), pyRedeem);

            // Optimistically redeem any amount of PT and YT for underlying
            // Later, we will check if the amount of underlying redeemed is enough to cover the underlying to be repaid
            uint256 uRedeemed = params.pt.redeemWithYT({
                pyAmount: pyRedeem,
                to: address(this),
                from: address(this) // At this point, the YT is already in this contract
            });
            if (uRedeemed < uRepay) revert Errors.RouterInsufficientUnderlyingRepay();
            // Check slippage
            uint256 underlyingToRecipient = uRedeemed - uRepay; // no underflow because of the if statement above
            if (underlyingToRecipient < params.underlyingOutMin) revert Errors.RouterInsufficientUnderlyingOut();

            // Repay underlying to Napier pool and transfer the rest to recipient
            IERC20(underlying).safeTransfer(msg.sender, uRepay);
            IERC20(underlying).safeTransfer(params.recipient, underlyingToRecipient);
        } else if (_type == CallbackType.SwapUnderlyingForYt) {
            // Decode callback data
            CallbackDataTypes.SwapUnderlyingForYtData memory params =
                abi.decode(data[0x60:], (CallbackDataTypes.SwapUnderlyingForYtData));

            uint256 uReceived = uint256(underlyingDelta); // unsafe cast is okay because always positive in this branch.
            uint256 pyDesired = uint256(-ptDelta); // principal token to be repaid and yield token to be issued

            // Pull underlying from payer.
            // Economically, it's almost unlikely that the payer doesn't need to pay underlying asset.
            // But if the above case happens, it would be reverted.
            if (params.underlyingDeposit <= uReceived) revert Errors.RouterNonSituationSwapUnderlyingForYt();
            uint256 uPull = params.underlyingDeposit - uReceived;
            if (uPull > params.maxUnderlyingPull) revert Errors.RouterExceededLimitUnderlyingIn();
            _pay(underlying, params.payer, address(this), uPull);

            IERC20(underlying).forceApprove(address(params.pt), params.underlyingDeposit);
            uint256 pyIssued = params.pt.issue({to: address(this), underlyingAmount: params.underlyingDeposit});

            // Repay the PT to Napier pool
            if (pyIssued < pyDesired) revert Errors.RouterInsufficientPtRepay();
            params.pt.safeTransfer(msg.sender, pyDesired);
            // Transfer the remaining PT to payer
            params.pt.safeTransfer(params.payer, pyIssued - pyDesired);
            // Transfer the YT to recipient
            params.yt.safeTransfer(params.recipient, pyIssued);
        }
    }

    /// @inheritdoc INapierRouter
    /// @notice Swap exact amount of Principal Token (PT) for Underlying.
    /// @notice Caller must approve the router to spend PTs prior to calling this method.
    /// @notice Revert if the pool is not deployed by the factory set in the constructor.
    /// @notice Revert if maturity has passed for the pool.
    /// @notice Revert if deadline has passed.
    /// @notice Revert if the amount of underlying asset received is less than the minimum amount specified.
    /// @param pool The address of the pool.
    /// @param index The index of the PT. (0, 1, 2)
    /// @param ptInDesired The amount of PT to swap.
    /// @param underlyingOutMin The minimum amount of underlying asset to receive.
    /// @param recipient The recipient of the swapped underlying asset.
    /// @param deadline The deadline for the swap.
    /// @return The amount of underlying asset received.
    function swapPtForUnderlying(
        address pool,
        uint256 index,
        uint256 ptInDesired,
        uint256 underlyingOutMin,
        address recipient,
        uint256 deadline
    ) external override nonReentrant checkDeadline(deadline) returns (uint256) {
        // dev: Optimistically call to the `pool` provided by the untrusted caller.
        // And then verify the pool using CREATE2.
        (address underlying, address basePool) = INapierPool(pool).getAssets();

        // if `pool` doesn't matched, it would be reverted.
        if (INapierPool(pool) != PoolAddress.computeAddress(basePool, underlying, POOL_CREATION_HASH, address(factory)))
        {
            revert Errors.RouterPoolNotFound();
        }

        address pt = address(INapierPool(pool).principalTokens()[index]);

        // Abi encode callback data to be used in swapCallback
        bytes memory data = new bytes(0xa0);

        uint256 callbackType = uint256(CallbackType.SwapPtForUnderlying);
        assembly {
            // Equivanlent to:
            // data = abi.encode(CallbackType.SwapUnderlyingForPt, underlying, basePool, CallbackDataTypes.SwapUnderlyingForPtData({payer: msg.sender, underlyingInMax: underlyingInMax}))
            mstore(add(data, 0x20), callbackType)
            mstore(add(data, 0x40), underlying)
            mstore(add(data, 0x60), basePool)
            mstore(add(data, 0x80), caller()) // dev: Ensure 'payer' is always 'msg.sender' to prevent allowance theft on callback.
            mstore(add(data, 0xa0), pt)
        }
        uint256 underlyingOut = INapierPool(pool).swapPtForUnderlying(index, ptInDesired, recipient, data);
        if (underlyingOut < underlyingOutMin) revert Errors.RouterInsufficientUnderlyingOut();

        return underlyingOut;
    }

    /// @inheritdoc INapierRouter
    /// @notice Swap underlying for PT.
    /// @notice Caller must approve the router to spend underlying asset prior to calling this method.
    /// @dev If caller calls with ether, the ether will be wrapped to WETH9.
    /// Note: the remaining ether is NOT returned automatically. Caller must call refundETH to get the remaining ether back.
    /// @dev Revert conditions are the same as swapPtForUnderlying.
    /// @param pool The address of the pool.
    /// @param index The index of the PT.
    /// @param ptOutDesired The amount of PT to receive.
    /// @param underlyingInMax The maximum amount of underlying asset to spend.
    /// @param recipient The recipient of the PT.
    /// @param deadline The deadline for the swap.
    /// @return The amount of underlying asset spent.
    function swapUnderlyingForPt(
        address pool,
        uint256 index,
        uint256 ptOutDesired,
        uint256 underlyingInMax,
        address recipient,
        uint256 deadline
    ) external payable override nonReentrant checkDeadline(deadline) returns (uint256) {
        // dev: Optimistically call to the `pool` provided by the untrusted caller.
        // And then verify the pool using CREATE2.
        (address underlying, address basePool) = INapierPool(pool).getAssets();

        // if `pool` doesn't matched, it would be reverted.
        if (INapierPool(pool) != PoolAddress.computeAddress(basePool, underlying, POOL_CREATION_HASH, address(factory)))
        {
            revert Errors.RouterPoolNotFound();
        }

        IERC20 pt = INapierPool(pool).principalTokens()[index];

        // Abi encode callback data to be used in swapCallback
        bytes memory data = new bytes(0xa0);
        {
            uint256 callbackType = uint256(CallbackType.SwapUnderlyingForPt);
            assembly {
                // Equivanlent to:
                // data = abi.encode(CallbackType.SwapUnderlyingForPt, underlying, basePool, CallbackDataTypes.SwapUnderlyingForPtData({payer: msg.sender, underlyingInMax: underlyingInMax}))
                mstore(add(data, 0x20), callbackType)
                mstore(add(data, 0x40), underlying)
                mstore(add(data, 0x60), basePool)
                mstore(add(data, 0x80), caller()) // dev: Ensure 'payer' is always 'msg.sender' to prevent allowance theft on callback.
                mstore(add(data, 0xa0), underlyingInMax)
            }
        }

        uint256 prevBalance = pt.balanceOf(address(this));
        uint256 underlyingUsed = INapierPool(pool).swapUnderlyingForPt(
            index,
            ptOutDesired,
            address(this), // this contract will receive principal token from pool
            data
        );

        pt.safeTransfer(recipient, pt.balanceOf(address(this)) - prevBalance);
        return underlyingUsed;
    }

    /// @inheritdoc INapierRouter
    /// @notice Swap underlying asset for YT.
    /// @dev Under the hood, Router receives underlying asset from `pool` with flash swap and issues PT and YT.
    /// After that, pay back the PT to `pool` and transfer the issued YT to `recipient`.
    /// @param pool The address of the pool.
    /// @param index The index of principal token / yield token.
    /// @param ytOutDesired The amount of YT to receive. (at least `ytOutDesired` amount of PT and YT should be issued)
    /// @param underlyingInMax The maximum amount of underlying asset to spend.
    /// @param recipient The recipient of the YT.
    /// @param deadline The deadline for the swap.
    /// @return The amount of underlying asset recipient spent.
    function swapUnderlyingForYt(
        address pool,
        uint256 index,
        uint256 ytOutDesired,
        uint256 underlyingInMax,
        address recipient,
        uint256 deadline
    ) external payable returns (uint256) {
        // `swapUnderlyingForYt` with default approx parameters
        return swapUnderlyingForYt(
            pool, index, ytOutDesired, underlyingInMax, recipient, deadline, ApproxParams(0, 0, 0, 0)
        );
    }

    /// @inheritdoc INapierRouter
    /// @param approx Approximation parameters for the calculation.
    /// - `guessMin`: The minimum guess for the approximation. Underlying needed to issue PT and YT.
    /// - `guessMax`: The maximum guess for the approximation. Underlying needed to issue PT and YT.
    /// - `eps`: The maximum relative error for the approximation.
    /// - `maxIteration`: The maximum number of iterations for the approximation.
    function swapUnderlyingForYt(
        address pool,
        uint256 index,
        uint256 ytOutDesired,
        uint256 underlyingInMax,
        address recipient,
        uint256 deadline,
        ApproxParams memory approx
    ) public payable override nonReentrant checkDeadline(deadline) returns (uint256) {
        // dev: Optimistically call to the `pool` provided by the untrusted caller.
        // And then verify the pool using CREATE2.
        (address underlying, address basePool) = INapierPool(pool).getAssets();

        // if `pool` doesn't matched, it would be reverted.
        if (INapierPool(pool) != PoolAddress.computeAddress(basePool, underlying, POOL_CREATION_HASH, address(factory)))
        {
            revert Errors.RouterPoolNotFound();
        }

        ITranche pt = ITranche(address(INapierPool(pool).principalTokens()[index]));

        // Compute underlying asset to be deposited to Tranche
        // Binary search is used to find the exact amount of underlying needed to issue PT and YT
        uint256 uDeposit = TrancheMathHelper.getApproxUnderlyingNeededByYt(pt, ytOutDesired, approx);

        // Abi encode callback data to be used in swapCallback
        bytes memory data = new bytes(0x120);
        {
            uint256 callbackType = uint256(CallbackType.SwapUnderlyingForYt);
            address yt = pt.yieldToken();
            assembly {
                // Equivanlent to:
                // abi.encode(CallbackType.SwapUnderlyingForYt, underlying, basePool, CallbackDataTypes.SwapUnderlyingForYtData({pt: pt, yt: yt, payer: msg.sender, recipient: recipient, underlyingDeposit: uDeposit, maxUnderlyingPull: underlyingInMax}))
                mstore(add(data, 0x20), callbackType)
                mstore(add(data, 0x40), underlying)
                mstore(add(data, 0x60), basePool)
                mstore(add(data, 0x80), caller()) // dev: Ensure 'payer' is always 'msg.sender' to prevent allowance theft on callback.
                mstore(add(data, 0xa0), pt)
                mstore(add(data, 0xc0), yt)
                mstore(add(data, 0xe0), recipient)
                mstore(add(data, 0x100), uDeposit)
                mstore(add(data, 0x120), underlyingInMax)
            }
        }
        uint256 received = INapierPool(pool).swapPtForUnderlying(
            index,
            ytOutDesired, // ptInDesired
            address(this), // this contract will receive underlying token from pool
            data
        );

        // Underlying pulled = underlying deposited - underlying received from swap
        return uDeposit - received;
    }

    /// @inheritdoc INapierRouter
    /// @notice Swap YT for underlying asset.
    /// @dev Under the hood, Router receives principal token from `pool` with flash swap and redeem it with YT for underlying asset.
    /// After that, pay back the underlying asset to `pool` and transfer the remaining underlying asset to `recipient`.
    /// @param pool The address of the pool.
    /// @param index The index of the YT.
    /// @param ytIn The amount of YT to swap.
    /// @param underlyingOutMin The minimum amount of underlying asset to receive.
    /// @param recipient The recipient of the underlying asset.
    /// @param deadline The deadline for the swap.
    /// @return The amount of underlying asset recipient received.
    function swapYtForUnderlying(
        address pool,
        uint256 index,
        uint256 ytIn,
        uint256 underlyingOutMin,
        address recipient,
        uint256 deadline
    ) external override nonReentrant checkDeadline(deadline) returns (uint256) {
        // dev: Optimistically call to the `pool` provided by the untrusted caller.
        // And then verify the pool using CREATE2.
        (address underlying, address basePool) = INapierPool(pool).getAssets();

        // if `pool` doesn't matched, it would be reverted.
        if (INapierPool(pool) != PoolAddress.computeAddress(basePool, underlying, POOL_CREATION_HASH, address(factory)))
        {
            revert Errors.RouterPoolNotFound();
        }

        ITranche pt = ITranche(address(INapierPool(pool).principalTokens()[index]));

        uint256 prevBalance = IERC20(underlying).balanceOf(recipient);

        // Abi encode callback data to be used in swapCallback
        bytes memory data = new bytes(0x100);
        uint256 callbackType = uint256(CallbackType.SwapYtForUnderlying);
        assembly {
            // Equivanlent to:
            // data = abi.encode(CallbackType.SwapYtForUnderlying, underlying, basePool, CallbackDataTypes.SwapYtForUnderlyingData({pt: pt, payer: msg.sender, ytIn: ytIn, recipient: recipient, underlyingOutMin: underlyingOutMin}))
            mstore(add(data, 0x20), callbackType)
            mstore(add(data, 0x40), underlying)
            mstore(add(data, 0x60), basePool)
            mstore(add(data, 0x80), caller()) // dev: Ensure 'payer' is always 'msg.sender' to prevent allowance theft on callback.
            mstore(add(data, 0xa0), pt)
            mstore(add(data, 0xc0), ytIn)
            mstore(add(data, 0xe0), recipient)
            mstore(add(data, 0x100), underlyingOutMin)
        }
        // Note: swap for PT approximate equal to `ytIn`
        INapierPool(pool).swapUnderlyingForPt(
            index,
            ytIn, // ptOutDesired
            address(this), // this contract will receive principal token from pool
            data
        );

        // Underlying received = balance after swap - balance before swap
        return IERC20(underlying).balanceOf(recipient) - prevBalance;
    }

    /// @inheritdoc INapierRouter
    /// @notice Caller must approve the router to spend underlying asset and PTs prior to calling this method.
    /// @notice Revert if the pool is not deployed by the factory set in the constructor
    /// @notice Revert if maturity has passed for the pool
    /// @notice Revert if deadline has passed
    /// @notice Revert if the amount of liquidity tokens received is less than the minimum amount specified
    /// @notice It will refund the remaining tokens (Native ETH or Base LP token) to the caller if any.
    /// @param pool The address of the pool.
    /// @param underlyingIn The amount of underlying asset to deposit.
    /// @param ptsIn The amounts of PTs to deposit. Can be zero but at least one must be non-zero. Otherwise, revert in the Curve pool.
    /// @param minLiquidity The minimum amount of liquidity tokens to receive.
    /// @param recipient The recipient of the liquidity tokens.
    /// @param deadline The deadline for adding liquidity.
    /// @return The amount of liquidity tokens received.
    function addLiquidity(
        address pool,
        uint256 underlyingIn,
        uint256[3] calldata ptsIn,
        uint256 minLiquidity,
        address recipient,
        uint256 deadline
    ) external payable override nonReentrant checkDeadline(deadline) returns (uint256) {
        // dev: Optimistically call to the `pool` provided by the untrusted caller.
        // And then verify the pool using CREATE2.
        (address underlying, address basePool) = INapierPool(pool).getAssets();

        // if `pool` doesn't matched, it would be reverted.
        if (INapierPool(pool) != PoolAddress.computeAddress(basePool, underlying, POOL_CREATION_HASH, address(factory)))
        {
            revert Errors.RouterPoolNotFound();
        }

        IERC20[3] memory pts = INapierPool(pool).principalTokens();

        // Loop unrolling for gas optimization
        pts[0].safeTransferFrom(msg.sender, address(this), ptsIn[0]);
        pts[1].safeTransferFrom(msg.sender, address(this), ptsIn[1]);
        pts[2].safeTransferFrom(msg.sender, address(this), ptsIn[2]);
        // approve max to Tricrypto pool
        if (pts[0].allowance(address(this), basePool) < ptsIn[0]) pts[0].approve(basePool, type(uint256).max); // dev: Principal token will revert if failed to approve
        if (pts[1].allowance(address(this), basePool) < ptsIn[1]) pts[1].approve(basePool, type(uint256).max);
        if (pts[2].allowance(address(this), basePool) < ptsIn[2]) pts[2].approve(basePool, type(uint256).max);

        uint256 baseLptIn = CurveTricryptoOptimizedWETH(basePool).add_liquidity(ptsIn, 0);
        // Add liquidity to Napier pool
        uint256 liquidity = INapierPool(pool).addLiquidity(
            underlyingIn,
            baseLptIn,
            recipient,
            abi.encode(
                CallbackType.AddLiquidityPts,
                CallbackDataTypes.AddLiquidityData({payer: msg.sender, underlying: underlying, basePool: basePool})
            )
        );
        if (liquidity < minLiquidity) revert Errors.RouterInsufficientLpOut();

        // Sweep remaining tokens if any.
        uint256 bBalance = IERC20(basePool).balanceOf(address(this));
        if (bBalance > 0) IERC20(basePool).safeTransfer(msg.sender, bBalance);
        // If WETH or ERC20 tokens are used, the exact amount is pulled from the caller. So, no need to sweep.
        // If caller sent native ETH, make sure to send remaining ETH back to caller.
        if (address(this).balance > 0) _safeTransferETH(msg.sender, address(this).balance);

        return liquidity;
    }

    /// @inheritdoc INapierRouter
    /// @notice Add liquidity to Napier pool from one principal token proportionally as possible as it can.
    /// @notice Deadline should be tightly set.
    /// @notice Caller must approve the router to spend PT prior to calling this method.
    /// @dev Caller must specify the amount of base LP token to be swapped for underlying asset using off-chain calculation.
    /// @dev Remaining base LP token and underlying asset are swept to the caller if any.
    /// @param pool The address of the pool.
    /// @param index The index of the PT.
    /// @param amountIn The amount of PT to deposit.
    /// @param minLiquidity The minimum amount of liquidity tokens to receive.
    /// @param recipient The recipient of the liquidity tokens.
    /// @param deadline The deadline for adding liquidity.
    /// @param baseLpTokenSwap The estimated baseLpt amount to swap with underlying tokens.
    /// @return The amount of liquidity tokens received.
    function addLiquidityOnePt(
        address pool,
        uint256 index,
        uint256 amountIn,
        uint256 minLiquidity,
        address recipient,
        uint256 deadline,
        uint256 baseLpTokenSwap
    ) external override nonReentrant checkDeadline(deadline) returns (uint256) {
        // dev: Optimistically call to the `pool` provided by the untrusted caller.
        // And then verify the pool using CREATE2.
        (address underlying, address basePool) = INapierPool(pool).getAssets();

        // if `pool` doesn't matched, it would be reverted.
        if (INapierPool(pool) != PoolAddress.computeAddress(basePool, underlying, POOL_CREATION_HASH, address(factory)))
        {
            revert Errors.RouterPoolNotFound();
        }

        IERC20[3] memory pts = INapierPool(pool).principalTokens();
        pts[index].safeTransferFrom(msg.sender, address(this), amountIn);
        if (pts[index].allowance(address(this), basePool) < amountIn) pts[index].approve(basePool, type(uint256).max);

        uint256[3] memory ptsIn;
        ptsIn[index] = amountIn;
        uint256 baseLptIn = CurveTricryptoOptimizedWETH(basePool).add_liquidity(ptsIn, 0);
        IERC20(basePool).forceApprove(address(pool), baseLptIn);

        // Swap some base LP token for underlying
        uint256 underlyingIn = INapierPool(pool).swapExactBaseLpTokenForUnderlying(baseLpTokenSwap, address(this));

        // Add liquidity to Napier pool
        uint256 liquidity = INapierPool(pool).addLiquidity(
            underlyingIn,
            baseLptIn - baseLpTokenSwap,
            recipient,
            abi.encode(
                CallbackType.AddLiquidityOnePt,
                CallbackDataTypes.AddLiquidityData({
                    payer: address(this), // Router has already had both tokens at this point
                    underlying: underlying,
                    basePool: basePool
                })
            )
        );
        if (liquidity < minLiquidity) revert Errors.RouterInsufficientLpOut();

        // Sweep remaining tokens if any.
        uint256 bBalance = IERC20(basePool).balanceOf(address(this));
        if (bBalance > 0) IERC20(basePool).safeTransfer(msg.sender, bBalance);
        uint256 uBalance = IERC20(underlying).balanceOf(address(this));
        if (uBalance > 0) IERC20(underlying).safeTransfer(msg.sender, uBalance);

        return liquidity;
    }

    /// @inheritdoc INapierRouter
    /// @notice Add liquidity to NapierPool with one underlying asset.
    /// @notice Deadline should be tightly set.
    /// @notice Caller must approve the router to spend underlying asset prior to calling this method.
    /// @dev Under the hood, router swap some underlying asset for Base pool LP token.
    /// @dev Caller must specify the amount of base LP token to be swapped for underlying asset using off-chain calculation.
    /// @dev Remaining base LP token and underlying asset are swept to the caller if any.
    /// @param pool The address of the pool.
    /// @param underlyingIn The amount of underlying asset to deposit.
    /// @param minLiquidity The minimum amount of liquidity tokens to receive.
    /// @param recipient The recipient of the liquidity tokens.
    /// @param deadline The deadline for adding liquidity.
    /// @param baseLpTokenSwap The estimated baseLpTokenSwap amount to swap with underlying tokens.
    /// @return The amount of liquidity tokens received.
    function addLiquidityOneUnderlying(
        address pool,
        uint256 underlyingIn,
        uint256 minLiquidity,
        address recipient,
        uint256 deadline,
        uint256 baseLpTokenSwap
    ) external override nonReentrant checkDeadline(deadline) returns (uint256) {
        // dev: Optimistically call to the `pool` provided by the untrusted caller.
        // And then verify the pool using CREATE2.
        (address underlying, address basePool) = INapierPool(pool).getAssets();

        // if `pool` doesn't matched, it would be reverted.
        if (INapierPool(pool) != PoolAddress.computeAddress(basePool, underlying, POOL_CREATION_HASH, address(factory)))
        {
            revert Errors.RouterPoolNotFound();
        }

        IERC20(underlying).safeTransferFrom(msg.sender, address(this), underlyingIn);

        // Swap some underlying for baseLpt
        // At this point, Router doesn't know how much underlying is needed to get `baseLpTokenSwap` amount of base LP token.
        // So, Router just approve pool to spend all underlying asset and let pool to spend as much as it needs.
        // approve max
        if (IERC20(underlying).allowance(address(this), pool) < underlyingIn) {
            IERC20(underlying).forceApprove(pool, type(uint256).max);
        }
        uint256 uSpent = INapierPool(pool).swapUnderlyingForExactBaseLpToken(baseLpTokenSwap, address(this));

        // Add liquidity to Napier pool
        uint256 liquidity = INapierPool(pool).addLiquidity(
            underlyingIn - uSpent, // remaining underlying asset
            baseLpTokenSwap, // base LP token from swap
            recipient,
            abi.encode(
                CallbackType.AddLiquidityOneUnderlying,
                CallbackDataTypes.AddLiquidityData({
                    payer: address(this), // Router has already had both tokens at this point
                    underlying: underlying,
                    basePool: basePool
                })
            )
        );
        if (liquidity < minLiquidity) revert Errors.RouterInsufficientLpOut();

        // Sweep remaining tokens if any. WETH is not unwrapped.
        uint256 bBalance = IERC20(basePool).balanceOf(address(this));
        if (bBalance > 0) IERC20(basePool).safeTransfer(msg.sender, bBalance);
        uint256 uBalance = IERC20(underlying).balanceOf(address(this));
        if (uBalance > 0) IERC20(underlying).safeTransfer(msg.sender, uBalance);

        return liquidity;
    }

    /// @inheritdoc INapierRouter
    /// @notice Add liquidity to NapierPool with one underlying asset.
    /// @notice Deadline should be tightly set.
    /// @notice Caller must approve the router to spend underlying asset prior to calling this method.
    /// @dev Under the hood, router issues PT and YT with some of underlying asset and deposit the PT to Tricrypto pool.
    /// After that, router add liquidity to Napier pool with the remaining underlying asset and the minted base LP token.
    /// The caller will receive the issued YT and the remaining base LP token if any.
    /// @dev Caller must specify the amount of underlying asset to be spent to issue PT and YT using off-chain calculation.
    /// @param pool The address of the pool.
    /// @param index The index of the issued PT / YT.
    /// @param underlyingIn The amount of underlying asset to deposit.
    /// @param minLiquidity The minimum amount of liquidity tokens to receive.
    /// @param ytOutMin The minimum amount of YT to receive.
    /// @param recipient The recipient of the liquidity tokens.
    /// @param deadline The deadline for adding liquidity.
    /// @param underlyingDeposit The estimated underlying amount spent to issue PT and YT.
    /// @return The amount of liquidity tokens received.
    function addLiquidityOneUnderlyingKeepYt(
        address pool,
        uint256 index,
        uint256 underlyingIn,
        uint256 minLiquidity,
        uint256 ytOutMin,
        address recipient,
        uint256 deadline,
        uint256 underlyingDeposit
    ) external nonReentrant checkDeadline(deadline) returns (uint256) {
        // dev: Optimistically call to the `pool` provided by the untrusted caller.
        // And then verify the pool using CREATE2.
        (address underlying, address basePool) = INapierPool(pool).getAssets();

        // if `pool` doesn't matched, it would be reverted.
        if (INapierPool(pool) != PoolAddress.computeAddress(basePool, underlying, POOL_CREATION_HASH, address(factory)))
        {
            revert Errors.RouterPoolNotFound();
        }

        IERC20(underlying).safeTransferFrom(msg.sender, address(this), underlyingIn);

        uint256[3] memory amounts; // amounts of PTs to be added to Tricrypto pool
        // avoid stack too deep
        {
            // Issue principal token and yield token with some of the underlying asset.
            address pt = address(INapierPool(pool).principalTokens()[index]);
            if (IERC20(underlying).allowance(address(this), pt) < underlyingDeposit) {
                IERC20(underlying).forceApprove(pt, type(uint256).max);
            }
            uint256 pyIssued = ITranche(pt).issue({to: address(this), underlyingAmount: underlyingDeposit});
            if (pyIssued < ytOutMin) revert Errors.RouterInsufficientYtOut();

            // Send the remaining yield token to the caller.
            IERC20(ITranche(pt).yieldToken()).safeTransfer(msg.sender, pyIssued);

            // Deposit the issued principal token to Tricrypto.
            if (IERC20(pt).allowance(address(this), basePool) < pyIssued) {
                IERC20(pt).forceApprove(basePool, type(uint256).max);
            }
            amounts[index] = pyIssued;
        }
        uint256 baseLptIn = CurveTricryptoOptimizedWETH(basePool).add_liquidity(amounts, 0);

        // Add liquidity to Napier pool
        uint256 liquidity = INapierPool(pool).addLiquidity(
            underlyingIn - underlyingDeposit, // remaining underlying asset
            baseLptIn,
            recipient,
            abi.encode(
                CallbackType.AddLiquidityOneUnderlying,
                CallbackDataTypes.AddLiquidityData({
                    payer: address(this), // Router has already had both tokens at this point
                    underlying: underlying,
                    basePool: basePool
                })
            )
        );
        if (liquidity < minLiquidity) revert Errors.RouterInsufficientLpOut();

        // Sweep remaining tokens if any. WETH is not unwrapped.
        uint256 bBalance = IERC20(basePool).balanceOf(address(this));
        if (bBalance > 0) IERC20(basePool).safeTransfer(msg.sender, bBalance);
        uint256 uBalance = IERC20(underlying).balanceOf(address(this));
        if (uBalance > 0) IERC20(underlying).safeTransfer(msg.sender, uBalance);

        return liquidity;
    }

    /// @inheritdoc INapierRouter
    /// @notice Remove liquidity from NapierPool and Curve pool.
    /// @notice Caller must approve the router to spend liquidity tokens prior to calling this method.
    /// @dev Can withdraw liquidity even if maturity has passed.
    /// @dev Revert if the pool is not deployed by the factory set in the constructor.
    /// @dev Revert if deadline has passed.
    /// @dev Revert if the amount of underlying asset received is less than the minimum amount specified.
    /// @dev Revert if the amount of PTs received is less than the minimum amount specified.
    /// @param pool The address of the pool.
    /// @param liquidity The amount of liquidity tokens to burn.
    /// @param underlyingOutMin The minimum amount of underlying asset to receive.
    /// @param ptsOutMin The minimum amounts of PTs to receive.
    /// @param recipient The recipient of the PTs and underlying asset.
    /// @param deadline The deadline for removing liquidity.
    /// @return The amounts of PTs and underlying asset received.
    function removeLiquidity(
        address pool,
        uint256 liquidity,
        uint256 underlyingOutMin,
        uint256[3] calldata ptsOutMin,
        address recipient,
        uint256 deadline
    ) external override nonReentrant checkDeadline(deadline) returns (uint256, uint256[3] memory) {
        // dev: Optimistically call to the `pool` provided by the untrusted caller.
        // And then verify the pool using CREATE2.
        (address underlying, address basePool) = INapierPool(pool).getAssets();

        // if `pool` doesn't matched, it would be reverted.
        if (INapierPool(pool) != PoolAddress.computeAddress(basePool, underlying, POOL_CREATION_HASH, address(factory)))
        {
            revert Errors.RouterPoolNotFound();
        }

        IERC20(pool).safeTransferFrom(msg.sender, pool, liquidity);
        (uint256 underlyingOut, uint256 baseLptOut) = INapierPool(pool).removeLiquidity(address(this));

        // Check slippage for underlying
        if (underlyingOut < underlyingOutMin) revert Errors.RouterInsufficientUnderlyingOut();

        // Note: Curve Tricrypto Optimized WETH pool doesn't cause clear error messages
        // Curve pool would check slippage for principal tokens
        uint256[3] memory ptsOut = CurveTricryptoOptimizedWETH(basePool).remove_liquidity(
            baseLptOut,
            ptsOutMin, // min_amounts
            false,
            recipient,
            false
        );

        // Transfer underlying to recipient
        IERC20(underlying).safeTransfer(recipient, underlyingOut);

        return (underlyingOut, ptsOut);
    }

    /// @inheritdoc INapierRouter
    /// @notice Remove liquidity from NapierPool and Curve pool with one underlying asset.
    /// @notice Caller must approve the router to spend liquidity tokens prior to calling this method.
    /// @dev Can withdraw liquidity even if maturity has passed.
    /// @dev Revert conditions are the same as removeLiquidity.
    /// @param pool Address of the pool to remove liquidity from.
    /// @param index The index of PT to be withdrawn when removing liquidity from Base pool. Ignored if maturity has not passed.
    /// @param liquidity Liquidity to be removed from Napier pool.
    /// @param underlyingOutMin Minimum amount of underlying asset to receive.
    /// @param recipient Recipient of the underlying asset.
    /// @param deadline Deadline for removing liquidity. Revert if deadline has passed when the transaction is executed.
    function removeLiquidityOneUnderlying(
        address pool,
        uint256 index,
        uint256 liquidity,
        uint256 underlyingOutMin,
        address recipient,
        uint256 deadline
    ) external override nonReentrant checkDeadline(deadline) returns (uint256) {
        // dev: Optimistically call to the `pool` provided by the untrusted caller.
        // And then verify the pool using CREATE2.
        (address underlying, address basePool) = INapierPool(pool).getAssets();

        // if `pool` doesn't matched, it would be reverted.
        if (INapierPool(pool) != PoolAddress.computeAddress(basePool, underlying, POOL_CREATION_HASH, address(factory)))
        {
            revert Errors.RouterPoolNotFound();
        }

        IERC20[3] memory pts = INapierPool(pool).principalTokens();
        // Remove liquidity from Napier pool and get base LP token and underlying back
        IERC20(pool).safeTransferFrom(msg.sender, pool, liquidity);
        (uint256 underlyingOut, uint256 baseLptOut) = INapierPool(pool).removeLiquidity(address(this));

        // The withdrawn base LP token is exchanged for underlying in two different ways depending on the maturity.
        // If maturity has passed, redeem else swap for underlying.
        // 1. Swapping is used when maturity hasn't passed because redeeming is disabled before maturity.
        // 2. Redeeming is preferred because it doesn't cause slippage.
        if (block.timestamp < INapierPool(pool).maturity()) {
            // Swap base LP token for underlying
            // approve baseLptOut
            if (baseLptOut > IERC20(basePool).allowance(address(this), pool)) {
                IERC20(basePool).forceApprove(pool, type(uint256).max);
            }

            uint256 removed = INapierPool(pool).swapExactBaseLpTokenForUnderlying(baseLptOut, address(this));
            underlyingOut += removed;
        } else {
            // Withdraw the pt from base pool in return for base LP token
            // Allow unlimited slippage. Check slippage later
            uint256 ptWithdrawn = CurveTricryptoOptimizedWETH(basePool).remove_liquidity_one_coin(
                baseLptOut, index, 0, false, address(this)
            );
            // Redeem the pt for underlying
            uint256 redeemed = ITranche(address(pts[index])).redeem(ptWithdrawn, address(this), address(this));
            underlyingOut += redeemed;
        }

        // Check slippage
        if (underlyingOut < underlyingOutMin) revert Errors.RouterInsufficientUnderlyingOut();
        IERC20(underlying).safeTransfer(recipient, underlyingOut);

        return underlyingOut;
    }

    /// @notice Remove liquidity from the pool and receive a single PT.
    /// @notice Caller must approve the router to spend liquidity tokens prior to calling this method.
    /// @dev Revert conditions are the same as removeLiquidity.
    /// @dev Caller must specify the amount of base LP token to be swapped with underlying asset using off-chain calculation.
    /// @dev Remaining base LP token and underlying asset are swept to the caller if any.
    /// @param pool Address of the pool to remove liquidity from.
    /// @param index The index of PT.
    /// @param liquidity The amount of liquidity tokens to remove.
    /// @param ptOutMin The minimum amount of PT to receive.
    /// @param recipient The recipient of the PT.
    /// @param deadline Deadline for removing liquidity. Revert if deadline has passed when the transaction is executed.
    /// @param baseLpTokenSwap The estimated baseLpt amount to swap with underlying tokens.
    /// @return The amount of PT received.
    function removeLiquidityOnePt(
        address pool,
        uint256 index,
        uint256 liquidity,
        uint256 ptOutMin,
        address recipient,
        uint256 deadline,
        uint256 baseLpTokenSwap
    ) external override nonReentrant checkDeadline(deadline) returns (uint256) {
        // dev: Optimistically call to the `pool` provided by the untrusted caller.
        // And then verify the pool using CREATE2.
        (address underlying, address basePool) = INapierPool(pool).getAssets();

        // if `pool` doesn't matched, it would be reverted.
        if (INapierPool(pool) != PoolAddress.computeAddress(basePool, underlying, POOL_CREATION_HASH, address(factory)))
        {
            revert Errors.RouterPoolNotFound();
        }

        // Remove liquidity from Napier pool and get base LP token and underlying back
        IERC20(pool).safeTransferFrom(msg.sender, pool, liquidity);
        (uint256 underlyingIn, uint256 baseLptOut) = INapierPool(pool).removeLiquidity(address(this));

        // Swap underlying for baseLpt
        // At this point, we don't know how much actual underlying amount will be needed to swap.
        // `baseLpTokenSwap` should be set so that the actual underlying amount would be less than `underlyingIn` otherwise revert in the pool.
        IERC20(underlying).forceApprove(pool, underlyingIn);
        INapierPool(pool).swapUnderlyingForExactBaseLpToken(baseLpTokenSwap, address(this));

        // Withdraw liquidity in a one principal token
        uint256 ptWithdrawn = CurveTricryptoOptimizedWETH(basePool).remove_liquidity_one_coin(
            baseLptOut + baseLpTokenSwap, index, ptOutMin, false, recipient
        );

        // Sweep remaining tokens if any.
        uint256 bBalance = IERC20(basePool).balanceOf(address(this));
        if (bBalance > 0) IERC20(basePool).safeTransfer(msg.sender, bBalance);
        uint256 uBalance = IERC20(underlying).balanceOf(address(this));
        if (uBalance > 0) IERC20(underlying).safeTransfer(msg.sender, uBalance);

        return ptWithdrawn;
    }
}