// SPDX-License-Identifier: MIT
// OpenZeppelin Contracts (last updated v5.0.0) (access/AccessControl.sol)

pragma solidity ^0.8.20;

import {IAccessControl} from "./IAccessControl.sol";
import {Context} from "../utils/Context.sol";
import {ERC165} from "../utils/introspection/ERC165.sol";

/**
 * @dev Contract module that allows children to implement role-based access
 * control mechanisms. This is a lightweight version that doesn't allow enumerating role
 * members except through off-chain means by accessing the contract event logs. Some
 * applications may benefit from on-chain enumerability, for those cases see
 * {AccessControlEnumerable}.
 *
 * Roles are referred to by their `bytes32` identifier. These should be exposed
 * in the external API and be unique. The best way to achieve this is by
 * using `public constant` hash digests:
 *
 * ```solidity
 * bytes32 public constant MY_ROLE = keccak256("MY_ROLE");
 * ```
 *
 * Roles can be used to represent a set of permissions. To restrict access to a
 * function call, use {hasRole}:
 *
 * ```solidity
 * function foo() public {
 *     require(hasRole(MY_ROLE, msg.sender));
 *     ...
 * }
 * ```
 *
 * Roles can be granted and revoked dynamically via the {grantRole} and
 * {revokeRole} functions. Each role has an associated admin role, and only
 * accounts that have a role's admin role can call {grantRole} and {revokeRole}.
 *
 * By default, the admin role for all roles is `DEFAULT_ADMIN_ROLE`, which means
 * that only accounts with this role will be able to grant or revoke other
 * roles. More complex role relationships can be created by using
 * {_setRoleAdmin}.
 *
 * WARNING: The `DEFAULT_ADMIN_ROLE` is also its own admin: it has permission to
 * grant and revoke this role. Extra precautions should be taken to secure
 * accounts that have been granted it. We recommend using {AccessControlDefaultAdminRules}
 * to enforce additional security measures for this role.
 */
abstract contract AccessControl is Context, IAccessControl, ERC165 {
    struct RoleData {
        mapping(address account => bool) hasRole;
        bytes32 adminRole;
    }

    mapping(bytes32 role => RoleData) private _roles;

    bytes32 public constant DEFAULT_ADMIN_ROLE = 0x00;

    /**
     * @dev Modifier that checks that an account has a specific role. Reverts
     * with an {AccessControlUnauthorizedAccount} error including the required role.
     */
    modifier onlyRole(bytes32 role) {
        _checkRole(role);
        _;
    }

    /**
     * @dev See {IERC165-supportsInterface}.
     */
    function supportsInterface(bytes4 interfaceId) public view virtual override returns (bool) {
        return interfaceId == type(IAccessControl).interfaceId || super.supportsInterface(interfaceId);
    }

    /**
     * @dev Returns `true` if `account` has been granted `role`.
     */
    function hasRole(bytes32 role, address account) public view virtual returns (bool) {
        return _roles[role].hasRole[account];
    }

    /**
     * @dev Reverts with an {AccessControlUnauthorizedAccount} error if `_msgSender()`
     * is missing `role`. Overriding this function changes the behavior of the {onlyRole} modifier.
     */
    function _checkRole(bytes32 role) internal view virtual {
        _checkRole(role, _msgSender());
    }

    /**
     * @dev Reverts with an {AccessControlUnauthorizedAccount} error if `account`
     * is missing `role`.
     */
    function _checkRole(bytes32 role, address account) internal view virtual {
        if (!hasRole(role, account)) {
            revert AccessControlUnauthorizedAccount(account, role);
        }
    }

    /**
     * @dev Returns the admin role that controls `role`. See {grantRole} and
     * {revokeRole}.
     *
     * To change a role's admin, use {_setRoleAdmin}.
     */
    function getRoleAdmin(bytes32 role) public view virtual returns (bytes32) {
        return _roles[role].adminRole;
    }

    /**
     * @dev Grants `role` to `account`.
     *
     * If `account` had not been already granted `role`, emits a {RoleGranted}
     * event.
     *
     * Requirements:
     *
     * - the caller must have ``role``'s admin role.
     *
     * May emit a {RoleGranted} event.
     */
    function grantRole(bytes32 role, address account) public virtual onlyRole(getRoleAdmin(role)) {
        _grantRole(role, account);
    }

    /**
     * @dev Revokes `role` from `account`.
     *
     * If `account` had been granted `role`, emits a {RoleRevoked} event.
     *
     * Requirements:
     *
     * - the caller must have ``role``'s admin role.
     *
     * May emit a {RoleRevoked} event.
     */
    function revokeRole(bytes32 role, address account) public virtual onlyRole(getRoleAdmin(role)) {
        _revokeRole(role, account);
    }

    /**
     * @dev Revokes `role` from the calling account.
     *
     * Roles are often managed via {grantRole} and {revokeRole}: this function's
     * purpose is to provide a mechanism for accounts to lose their privileges
     * if they are compromised (such as when a trusted device is misplaced).
     *
     * If the calling account had been revoked `role`, emits a {RoleRevoked}
     * event.
     *
     * Requirements:
     *
     * - the caller must be `callerConfirmation`.
     *
     * May emit a {RoleRevoked} event.
     */
    function renounceRole(bytes32 role, address callerConfirmation) public virtual {
        if (callerConfirmation != _msgSender()) {
            revert AccessControlBadConfirmation();
        }

        _revokeRole(role, callerConfirmation);
    }

    /**
     * @dev Sets `adminRole` as ``role``'s admin role.
     *
     * Emits a {RoleAdminChanged} event.
     */
    function _setRoleAdmin(bytes32 role, bytes32 adminRole) internal virtual {
        bytes32 previousAdminRole = getRoleAdmin(role);
        _roles[role].adminRole = adminRole;
        emit RoleAdminChanged(role, previousAdminRole, adminRole);
    }

    /**
     * @dev Attempts to grant `role` to `account` and returns a boolean indicating if `role` was granted.
     *
     * Internal function without access restriction.
     *
     * May emit a {RoleGranted} event.
     */
    function _grantRole(bytes32 role, address account) internal virtual returns (bool) {
        if (!hasRole(role, account)) {
            _roles[role].hasRole[account] = true;
            emit RoleGranted(role, account, _msgSender());
            return true;
        } else {
            return false;
        }
    }

    /**
     * @dev Attempts to revoke `role` to `account` and returns a boolean indicating if `role` was revoked.
     *
     * Internal function without access restriction.
     *
     * May emit a {RoleRevoked} event.
     */
    function _revokeRole(bytes32 role, address account) internal virtual returns (bool) {
        if (hasRole(role, account)) {
            _roles[role].hasRole[account] = false;
            emit RoleRevoked(role, account, _msgSender());
            return true;
        } else {
            return false;
        }
    }
}

// SPDX-License-Identifier: MIT
// OpenZeppelin Contracts (last updated v5.0.0) (access/AccessControl.sol)

pragma solidity ^0.8.20;

import {IAccessControl} from "@openzeppelin/contracts/access/IAccessControl.sol";
import {ContextUpgradeable} from "../utils/ContextUpgradeable.sol";
import {ERC165Upgradeable} from "../utils/introspection/ERC165Upgradeable.sol";
import {Initializable} from "../proxy/utils/Initializable.sol";

/**
 * @dev Contract module that allows children to implement role-based access
 * control mechanisms. This is a lightweight version that doesn't allow enumerating role
 * members except through off-chain means by accessing the contract event logs. Some
 * applications may benefit from on-chain enumerability, for those cases see
 * {AccessControlEnumerable}.
 *
 * Roles are referred to by their `bytes32` identifier. These should be exposed
 * in the external API and be unique. The best way to achieve this is by
 * using `public constant` hash digests:
 *
 * ```solidity
 * bytes32 public constant MY_ROLE = keccak256("MY_ROLE");
 * ```
 *
 * Roles can be used to represent a set of permissions. To restrict access to a
 * function call, use {hasRole}:
 *
 * ```solidity
 * function foo() public {
 *     require(hasRole(MY_ROLE, msg.sender));
 *     ...
 * }
 * ```
 *
 * Roles can be granted and revoked dynamically via the {grantRole} and
 * {revokeRole} functions. Each role has an associated admin role, and only
 * accounts that have a role's admin role can call {grantRole} and {revokeRole}.
 *
 * By default, the admin role for all roles is `DEFAULT_ADMIN_ROLE`, which means
 * that only accounts with this role will be able to grant or revoke other
 * roles. More complex role relationships can be created by using
 * {_setRoleAdmin}.
 *
 * WARNING: The `DEFAULT_ADMIN_ROLE` is also its own admin: it has permission to
 * grant and revoke this role. Extra precautions should be taken to secure
 * accounts that have been granted it. We recommend using {AccessControlDefaultAdminRules}
 * to enforce additional security measures for this role.
 */
abstract contract AccessControlUpgradeable is Initializable, ContextUpgradeable, IAccessControl, ERC165Upgradeable {
    struct RoleData {
        mapping(address account => bool) hasRole;
        bytes32 adminRole;
    }

    bytes32 public constant DEFAULT_ADMIN_ROLE = 0x00;


    /// @custom:storage-location erc7201:openzeppelin.storage.AccessControl
    struct AccessControlStorage {
        mapping(bytes32 role => RoleData) _roles;
    }

    // keccak256(abi.encode(uint256(keccak256("openzeppelin.storage.AccessControl")) - 1)) & ~bytes32(uint256(0xff))
    bytes32 private constant AccessControlStorageLocation = 0x02dd7bc7dec4dceedda775e58dd541e08a116c6c53815c0bd028192f7b626800;

    function _getAccessControlStorage() private pure returns (AccessControlStorage storage $) {
        assembly {
            $.slot := AccessControlStorageLocation
        }
    }

    /**
     * @dev Modifier that checks that an account has a specific role. Reverts
     * with an {AccessControlUnauthorizedAccount} error including the required role.
     */
    modifier onlyRole(bytes32 role) {
        _checkRole(role);
        _;
    }

    function __AccessControl_init() internal onlyInitializing {
    }

    function __AccessControl_init_unchained() internal onlyInitializing {
    }
    /**
     * @dev See {IERC165-supportsInterface}.
     */
    function supportsInterface(bytes4 interfaceId) public view virtual override returns (bool) {
        return interfaceId == type(IAccessControl).interfaceId || super.supportsInterface(interfaceId);
    }

    /**
     * @dev Returns `true` if `account` has been granted `role`.
     */
    function hasRole(bytes32 role, address account) public view virtual returns (bool) {
        AccessControlStorage storage $ = _getAccessControlStorage();
        return $._roles[role].hasRole[account];
    }

    /**
     * @dev Reverts with an {AccessControlUnauthorizedAccount} error if `_msgSender()`
     * is missing `role`. Overriding this function changes the behavior of the {onlyRole} modifier.
     */
    function _checkRole(bytes32 role) internal view virtual {
        _checkRole(role, _msgSender());
    }

    /**
     * @dev Reverts with an {AccessControlUnauthorizedAccount} error if `account`
     * is missing `role`.
     */
    function _checkRole(bytes32 role, address account) internal view virtual {
        if (!hasRole(role, account)) {
            revert AccessControlUnauthorizedAccount(account, role);
        }
    }

    /**
     * @dev Returns the admin role that controls `role`. See {grantRole} and
     * {revokeRole}.
     *
     * To change a role's admin, use {_setRoleAdmin}.
     */
    function getRoleAdmin(bytes32 role) public view virtual returns (bytes32) {
        AccessControlStorage storage $ = _getAccessControlStorage();
        return $._roles[role].adminRole;
    }

    /**
     * @dev Grants `role` to `account`.
     *
     * If `account` had not been already granted `role`, emits a {RoleGranted}
     * event.
     *
     * Requirements:
     *
     * - the caller must have ``role``'s admin role.
     *
     * May emit a {RoleGranted} event.
     */
    function grantRole(bytes32 role, address account) public virtual onlyRole(getRoleAdmin(role)) {
        _grantRole(role, account);
    }

    /**
     * @dev Revokes `role` from `account`.
     *
     * If `account` had been granted `role`, emits a {RoleRevoked} event.
     *
     * Requirements:
     *
     * - the caller must have ``role``'s admin role.
     *
     * May emit a {RoleRevoked} event.
     */
    function revokeRole(bytes32 role, address account) public virtual onlyRole(getRoleAdmin(role)) {
        _revokeRole(role, account);
    }

    /**
     * @dev Revokes `role` from the calling account.
     *
     * Roles are often managed via {grantRole} and {revokeRole}: this function's
     * purpose is to provide a mechanism for accounts to lose their privileges
     * if they are compromised (such as when a trusted device is misplaced).
     *
     * If the calling account had been revoked `role`, emits a {RoleRevoked}
     * event.
     *
     * Requirements:
     *
     * - the caller must be `callerConfirmation`.
     *
     * May emit a {RoleRevoked} event.
     */
    function renounceRole(bytes32 role, address callerConfirmation) public virtual {
        if (callerConfirmation != _msgSender()) {
            revert AccessControlBadConfirmation();
        }

        _revokeRole(role, callerConfirmation);
    }

    /**
     * @dev Sets `adminRole` as ``role``'s admin role.
     *
     * Emits a {RoleAdminChanged} event.
     */
    function _setRoleAdmin(bytes32 role, bytes32 adminRole) internal virtual {
        AccessControlStorage storage $ = _getAccessControlStorage();
        bytes32 previousAdminRole = getRoleAdmin(role);
        $._roles[role].adminRole = adminRole;
        emit RoleAdminChanged(role, previousAdminRole, adminRole);
    }

    /**
     * @dev Attempts to grant `role` to `account` and returns a boolean indicating if `role` was granted.
     *
     * Internal function without access restriction.
     *
     * May emit a {RoleGranted} event.
     */
    function _grantRole(bytes32 role, address account) internal virtual returns (bool) {
        AccessControlStorage storage $ = _getAccessControlStorage();
        if (!hasRole(role, account)) {
            $._roles[role].hasRole[account] = true;
            emit RoleGranted(role, account, _msgSender());
            return true;
        } else {
            return false;
        }
    }

    /**
     * @dev Attempts to revoke `role` to `account` and returns a boolean indicating if `role` was revoked.
     *
     * Internal function without access restriction.
     *
     * May emit a {RoleRevoked} event.
     */
    function _revokeRole(bytes32 role, address account) internal virtual returns (bool) {
        AccessControlStorage storage $ = _getAccessControlStorage();
        if (hasRole(role, account)) {
            $._roles[role].hasRole[account] = false;
            emit RoleRevoked(role, account, _msgSender());
            return true;
        } else {
            return false;
        }
    }
}

// SPDX-License-Identifier: MIT
// OpenZeppelin Contracts (last updated v5.0.0) (utils/Address.sol)

pragma solidity ^0.8.20;

/**
 * @dev Collection of functions related to the address type
 */
library Address {
    /**
     * @dev The ETH balance of the account is not enough to perform the operation.
     */
    error AddressInsufficientBalance(address account);

    /**
     * @dev There's no code at `target` (it is not a contract).
     */
    error AddressEmptyCode(address target);

    /**
     * @dev A call to an address target failed. The target may have reverted.
     */
    error FailedInnerCall();

    /**
     * @dev Replacement for Solidity's `transfer`: sends `amount` wei to
     * `recipient`, forwarding all available gas and reverting on errors.
     *
     * https://eips.ethereum.org/EIPS/eip-1884[EIP1884] increases the gas cost
     * of certain opcodes, possibly making contracts go over the 2300 gas limit
     * imposed by `transfer`, making them unable to receive funds via
     * `transfer`. {sendValue} removes this limitation.
     *
     * https://consensys.net/diligence/blog/2019/09/stop-using-soliditys-transfer-now/[Learn more].
     *
     * IMPORTANT: because control is transferred to `recipient`, care must be
     * taken to not create reentrancy vulnerabilities. Consider using
     * {ReentrancyGuard} or the
     * https://solidity.readthedocs.io/en/v0.8.20/security-considerations.html#use-the-checks-effects-interactions-pattern[checks-effects-interactions pattern].
     */
    function sendValue(address payable recipient, uint256 amount) internal {
        if (address(this).balance < amount) {
            revert AddressInsufficientBalance(address(this));
        }

        (bool success, ) = recipient.call{value: amount}("");
        if (!success) {
            revert FailedInnerCall();
        }
    }

    /**
     * @dev Performs a Solidity function call using a low level `call`. A
     * plain `call` is an unsafe replacement for a function call: use this
     * function instead.
     *
     * If `target` reverts with a revert reason or custom error, it is bubbled
     * up by this function (like regular Solidity function calls). However, if
     * the call reverted with no returned reason, this function reverts with a
     * {FailedInnerCall} error.
     *
     * Returns the raw returned data. To convert to the expected return value,
     * use https://solidity.readthedocs.io/en/latest/units-and-global-variables.html?highlight=abi.decode#abi-encoding-and-decoding-functions[`abi.decode`].
     *
     * Requirements:
     *
     * - `target` must be a contract.
     * - calling `target` with `data` must not revert.
     */
    function functionCall(address target, bytes memory data) internal returns (bytes memory) {
        return functionCallWithValue(target, data, 0);
    }

    /**
     * @dev Same as {xref-Address-functionCall-address-bytes-}[`functionCall`],
     * but also transferring `value` wei to `target`.
     *
     * Requirements:
     *
     * - the calling contract must have an ETH balance of at least `value`.
     * - the called Solidity function must be `payable`.
     */
    function functionCallWithValue(address target, bytes memory data, uint256 value) internal returns (bytes memory) {
        if (address(this).balance < value) {
            revert AddressInsufficientBalance(address(this));
        }
        (bool success, bytes memory returndata) = target.call{value: value}(data);
        return verifyCallResultFromTarget(target, success, returndata);
    }

    /**
     * @dev Same as {xref-Address-functionCall-address-bytes-}[`functionCall`],
     * but performing a static call.
     */
    function functionStaticCall(address target, bytes memory data) internal view returns (bytes memory) {
        (bool success, bytes memory returndata) = target.staticcall(data);
        return verifyCallResultFromTarget(target, success, returndata);
    }

    /**
     * @dev Same as {xref-Address-functionCall-address-bytes-}[`functionCall`],
     * but performing a delegate call.
     */
    function functionDelegateCall(address target, bytes memory data) internal returns (bytes memory) {
        (bool success, bytes memory returndata) = target.delegatecall(data);
        return verifyCallResultFromTarget(target, success, returndata);
    }

    /**
     * @dev Tool to verify that a low level call to smart-contract was successful, and reverts if the target
     * was not a contract or bubbling up the revert reason (falling back to {FailedInnerCall}) in case of an
     * unsuccessful call.
     */
    function verifyCallResultFromTarget(
        address target,
        bool success,
        bytes memory returndata
    ) internal view returns (bytes memory) {
        if (!success) {
            _revert(returndata);
        } else {
            // only check if target is a contract if the call was successful and the return data is empty
            // otherwise we already know that it was a contract
            if (returndata.length == 0 && target.code.length == 0) {
                revert AddressEmptyCode(target);
            }
            return returndata;
        }
    }

    /**
     * @dev Tool to verify that a low level call was successful, and reverts if it wasn't, either by bubbling the
     * revert reason or with a default {FailedInnerCall} error.
     */
    function verifyCallResult(bool success, bytes memory returndata) internal pure returns (bytes memory) {
        if (!success) {
            _revert(returndata);
        } else {
            return returndata;
        }
    }

    /**
     * @dev Reverts with returndata if present. Otherwise reverts with {FailedInnerCall}.
     */
    function _revert(bytes memory returndata) private pure {
        // Look for revert reason and bubble it up if present
        if (returndata.length > 0) {
            // The easiest way to bubble the revert reason is using memory via assembly
            /// @solidity memory-safe-assembly
            assembly {
                let returndata_size := mload(returndata)
                revert(add(32, returndata), returndata_size)
            }
        } else {
            revert FailedInnerCall();
        }
    }
}

// SPDX-License-Identifier: LZBL-1.2

pragma solidity ^0.8.20;

library AddressCast {
    error AddressCast_InvalidSizeForAddress();
    error AddressCast_InvalidAddress();

    function toBytes32(bytes calldata _addressBytes) internal pure returns (bytes32 result) {
        if (_addressBytes.length > 32) revert AddressCast_InvalidAddress();
        result = bytes32(_addressBytes);
        unchecked {
            uint256 offset = 32 - _addressBytes.length;
            result = result >> (offset * 8);
        }
    }

    function toBytes32(address _address) internal pure returns (bytes32 result) {
        result = bytes32(uint256(uint160(_address)));
    }

    function toBytes(bytes32 _addressBytes32, uint256 _size) internal pure returns (bytes memory result) {
        if (_size == 0 || _size > 32) revert AddressCast_InvalidSizeForAddress();
        result = new bytes(_size);
        unchecked {
            uint256 offset = 256 - _size * 8;
            assembly {
                mstore(add(result, 32), shl(offset, _addressBytes32))
            }
        }
    }

    function toAddress(bytes32 _addressBytes32) internal pure returns (address result) {
        result = address(uint160(uint256(_addressBytes32)));
    }

    function toAddress(bytes calldata _addressBytes) internal pure returns (address result) {
        if (_addressBytes.length != 20) revert AddressCast_InvalidAddress();
        result = address(bytes20(_addressBytes));
    }
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

// solhint-disable-next-line interface-starts-with-i
interface AggregatorV3Interface {
  function decimals() external view returns (uint8);

  function description() external view returns (string memory);

  function version() external view returns (uint256);

  function getRoundData(
    uint80 _roundId
  ) external view returns (uint80 roundId, int256 answer, uint256 startedAt, uint256 updatedAt, uint80 answeredInRound);

  function latestRoundData()
    external
    view
    returns (uint80 roundId, int256 answer, uint256 startedAt, uint256 updatedAt, uint80 answeredInRound);
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.26;

import {Pool} from "./Pool.sol";
import {PoolFactory} from "./PoolFactory.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {SafeERC20} from "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";
import {Initializable} from "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol";
import {UUPSUpgradeable} from "@openzeppelin/contracts-upgradeable/proxy/utils/UUPSUpgradeable.sol";
import {PausableUpgradeable} from "@openzeppelin/contracts-upgradeable/utils/PausableUpgradeable.sol";

contract Auction is Initializable, UUPSUpgradeable, PausableUpgradeable {
  using SafeERC20 for IERC20;

  // Pool contract
  address public pool;

  // Auction beneficiary
  address public beneficiary;

  // Auction buy and sell tokens
  address public buyCouponToken;
  address public sellReserveToken;

  // Auction end time and total buy amount
  uint256 public endTime;
  uint256 public totalBuyCouponAmount;
  uint256 public poolSaleLimit;

  // Pending refunds
  mapping(address => uint256) public pendingRefunds; // user => amount

  enum State {
    BIDDING,
    SUCCEEDED,
    FAILED_UNDERSOLD,
    FAILED_POOL_SALE_LIMIT
  }

  State public state;

  struct Bid {
    address bidder;
    uint256 buyReserveAmount;
    uint256 sellCouponAmount;
    uint256 nextBidIndex;
    uint256 prevBidIndex;
    bool claimed;
  }

  mapping(uint256 => Bid) public bids; // Mapping to store all bids by their index
  uint256 public bidCount;
  uint256 public lastBidIndex;
  uint256 public highestBidIndex; // The index of the highest bid in the sorted list
  uint256 public maxBids;
  uint256 public lowestBidIndex; // New variable to track the lowest bid
  uint256 public currentCouponAmount; // Aggregated buy amount (coupon) for the auction
  uint256 public totalSellReserveAmount; // Aggregated sell amount (reserve) for the auction

  event AuctionEnded(State state, uint256 totalSellReserveAmount, uint256 totalBuyCouponAmount);
  event FailedAuctionBidRefundClaimed(uint256 indexed bidIndex, address indexed bidder, uint256 sellCouponAmount);
  event LosingBidRefundClaimed(address indexed bidder, uint256 sellCouponAmount);
  event BidClaimed(uint256 indexed bidIndex, address indexed bidder, uint256 sellCouponAmount);
  event BidPlaced(uint256 indexed bidIndex, address indexed bidder, uint256 buyReserveAmount, uint256 sellCouponAmount);
  event BidRemoved(
    uint256 indexed bidIndex, address indexed bidder, uint256 buyReserveAmount, uint256 sellCouponAmount
  );
  event BidReduced(
    uint256 indexed bidIndex, address indexed bidder, uint256 buyReserveAmount, uint256 sellCouponAmount
  );
  event BidRefundAllocated(address indexed bidder, uint256 couponAmount);

  error AccessDenied();
  error AuctionFailed();
  error NothingToClaim();
  error AlreadyClaimed();
  error AuctionHasEnded();
  error BidAmountTooLow();
  error BidAmountTooHigh();
  error InvalidSellAmount();
  error AuctionStillOngoing();
  error AuctionAlreadyEnded();
  error AuctionSucceededOrOngoing();

  uint256 public constant MAX_BID_AMOUNT = 1e50;

  /// @custom:oz-upgrades-unsafe-allow constructor
  constructor() {
    _disableInitializers();
  }

  /**
   * @dev Initializes the Auction contract.
   * @param _buyCouponToken The address of the buy token (coupon).
   * @param _sellReserveToken The address of the sell token (reserve).
   * @param _totalBuyCouponAmount The total amount of buy tokens (coupon) for the auction.
   * @param _endTime The end time of the auction.
   * @param _maxBids The maximum number of bids allowed in the auction.
   * @param _beneficiary The address of the auction beneficiary.
   * @param _poolSaleLimit The percentage threshold auctions should respect when selling reserves
   * (e.g. 95 = 95%).
   */
  function initialize(
    address _pool,
    address _buyCouponToken,
    address _sellReserveToken,
    uint256 _totalBuyCouponAmount,
    uint256 _endTime,
    uint256 _maxBids,
    address _beneficiary,
    uint256 _poolSaleLimit
  ) public initializer {
    __UUPSUpgradeable_init();

    buyCouponToken = _buyCouponToken; // coupon
    sellReserveToken = _sellReserveToken; // reserve
    totalBuyCouponAmount = _totalBuyCouponAmount; // coupon amount
    endTime = _endTime;
    maxBids = _maxBids;
    pool = _pool;
    poolSaleLimit = _poolSaleLimit;

    if (_beneficiary == address(0)) beneficiary = msg.sender;
    else beneficiary = _beneficiary;
  }

  /**
   * @dev Places a bid on a portion of the pool.
   * @param buyReserveAmount The amount of buy tokens (reserve) to bid.
   * @param sellCouponAmount The amount of sell tokens (coupon) to bid.
   * @return The index of the bid.
   */
  function bid(uint256 buyReserveAmount, uint256 sellCouponAmount)
    external
    auctionActive
    whenNotPaused
    returns (uint256)
  {
    if (sellCouponAmount == 0 || sellCouponAmount > totalBuyCouponAmount) revert InvalidSellAmount();
    if (sellCouponAmount % slotSize() != 0) revert InvalidSellAmount();
    if (buyReserveAmount == 0) revert BidAmountTooLow();
    if (buyReserveAmount > MAX_BID_AMOUNT) revert BidAmountTooHigh();

    // Transfer buy tokens to contract
    IERC20(buyCouponToken).safeTransferFrom(msg.sender, address(this), sellCouponAmount);

    Bid memory newBid = Bid({
      bidder: msg.sender,
      buyReserveAmount: buyReserveAmount,
      sellCouponAmount: sellCouponAmount,
      nextBidIndex: 0, // Default to 0, which indicates the end of the list
      prevBidIndex: 0, // Default to 0, which indicates the start of the list
      claimed: false
    });

    lastBidIndex++; // Avoids 0 index
    uint256 newBidIndex = lastBidIndex;
    bids[newBidIndex] = newBid;
    bidCount++;

    // Insert the new bid into the sorted linked list
    insertSortedBid(newBidIndex);
    currentCouponAmount += sellCouponAmount;
    totalSellReserveAmount += buyReserveAmount;

    if (bidCount > maxBids) {
      if (lowestBidIndex == newBidIndex) revert BidAmountTooLow();
      _removeBid(lowestBidIndex);
    }

    // Remove and refund out of range bids
    removeExcessBids();

    // Check if the new bid is still on the map after removeBids
    if (bids[newBidIndex].bidder == address(0)) revert BidAmountTooLow();

    emit BidPlaced(newBidIndex, msg.sender, buyReserveAmount, sellCouponAmount);

    return newBidIndex;
  }

  /**
   * @dev Inserts the bid into the linked list based on the price (buyAmount/sellAmount) in
   * descending order, then by sellAmount.
   * @param newBidIndex The index of the bid to insert.
   */
  function insertSortedBid(uint256 newBidIndex) internal {
    Bid storage newBid = bids[newBidIndex];
    uint256 newSellCouponAmount = newBid.sellCouponAmount;
    uint256 newBuyReserveAmount = newBid.buyReserveAmount;
    uint256 leftSide;
    uint256 rightSide;

    if (highestBidIndex == 0) {
      // First bid being inserted
      highestBidIndex = newBidIndex;
      lowestBidIndex = newBidIndex;
    } else {
      uint256 currentBidIndex = highestBidIndex;
      uint256 previousBidIndex = 0;

      // Traverse the linked list to find the correct spot for the new bid
      while (currentBidIndex != 0) {
        // Cache the current bid's data into local variables
        Bid storage currentBid = bids[currentBidIndex];
        uint256 currentSellCouponAmount = currentBid.sellCouponAmount;
        uint256 currentBuyReserveAmount = currentBid.buyReserveAmount;
        uint256 currentNextBidIndex = currentBid.nextBidIndex;

        // Compare prices without division by cross-multiplying (it's more gas efficient)
        leftSide = newSellCouponAmount * currentBuyReserveAmount;
        rightSide = currentSellCouponAmount * newBuyReserveAmount;

        if (leftSide > rightSide || (leftSide == rightSide && newSellCouponAmount > currentSellCouponAmount)) break;

        previousBidIndex = currentBidIndex;
        currentBidIndex = currentNextBidIndex;
      }

      if (previousBidIndex == 0) {
        // New bid is the highest bid
        newBid.nextBidIndex = highestBidIndex;
        bids[highestBidIndex].prevBidIndex = newBidIndex;
        highestBidIndex = newBidIndex;
      } else {
        // Insert bid in the middle or at the end
        newBid.nextBidIndex = currentBidIndex;
        newBid.prevBidIndex = previousBidIndex;
        bids[previousBidIndex].nextBidIndex = newBidIndex;
        if (currentBidIndex != 0) bids[currentBidIndex].prevBidIndex = newBidIndex;
      }

      // If the new bid is inserted at the end, update the lowest bid index
      if (currentBidIndex == 0) lowestBidIndex = newBidIndex;
    }

    // Cache the lowest bid's data into local variables
    Bid storage lowestBid = bids[lowestBidIndex];
    uint256 lowestSellCouponAmount = lowestBid.sellCouponAmount;
    uint256 lowestBuyReserveAmount = lowestBid.buyReserveAmount;

    // Compare prices without division by cross-multiplying (it's more gas efficient)
    leftSide = newSellCouponAmount * lowestBuyReserveAmount;
    rightSide = lowestSellCouponAmount * newBuyReserveAmount;

    if (leftSide < rightSide || (leftSide == rightSide && newSellCouponAmount < lowestSellCouponAmount)) {
      lowestBidIndex = newBidIndex;
    }
  }

  /**
   * @dev Removes excess bids from the auction.
   */
  function removeExcessBids() internal {
    if (currentCouponAmount <= totalBuyCouponAmount) return;

    uint256 amountToRemove = currentCouponAmount - totalBuyCouponAmount;
    uint256 currentIndex = lowestBidIndex;

    while (currentIndex != 0 && amountToRemove != 0) {
      // Cache the current bid's data into local variables
      Bid storage currentBid = bids[currentIndex];
      uint256 sellCouponAmount = currentBid.sellCouponAmount;
      uint256 prevIndex = currentBid.prevBidIndex;

      if (amountToRemove >= sellCouponAmount) {
        // Subtract the sellAmount from amountToRemove
        amountToRemove -= sellCouponAmount;

        // Remove the bid
        _removeBid(currentIndex);

        // Move to the previous bid (higher price)
        currentIndex = prevIndex;
      } else {
        // Calculate the proportion of sellAmount being removed
        uint256 proportion = (amountToRemove * 1e18) / sellCouponAmount;

        // Reduce the current bid's amounts
        currentBid.sellCouponAmount = sellCouponAmount - amountToRemove;
        currentCouponAmount -= amountToRemove;

        uint256 reserveReduction = ((currentBid.buyReserveAmount * proportion) / 1e18);
        currentBid.buyReserveAmount = currentBid.buyReserveAmount - reserveReduction;
        totalSellReserveAmount -= reserveReduction;

        // Refund the proportional sellAmount
        pendingRefunds[currentBid.bidder] += amountToRemove;

        amountToRemove = 0;
        emit BidRefundAllocated(currentBid.bidder, amountToRemove);
        emit BidReduced(currentIndex, currentBid.bidder, currentBid.buyReserveAmount, currentBid.sellCouponAmount);
      }
    }
  }

  /**
   * @dev Removes a bid from the linked list.
   * @param bidIndex The index of the bid to remove.
   */
  function _removeBid(uint256 bidIndex) internal {
    Bid storage bidToRemove = bids[bidIndex];
    uint256 nextIndex = bidToRemove.nextBidIndex;
    uint256 prevIndex = bidToRemove.prevBidIndex;

    // Update linked list pointers
    if (prevIndex == 0) {
      // Removing the highest bid
      highestBidIndex = nextIndex;
    } else {
      bids[prevIndex].nextBidIndex = nextIndex;
    }

    if (nextIndex == 0) {
      // Removing the lowest bid
      lowestBidIndex = prevIndex;
    } else {
      bids[nextIndex].prevBidIndex = prevIndex;
    }

    address bidder = bidToRemove.bidder;
    uint256 buyReserveAmount = bidToRemove.buyReserveAmount;
    uint256 sellCouponAmount = bidToRemove.sellCouponAmount;
    currentCouponAmount -= sellCouponAmount;
    totalSellReserveAmount -= buyReserveAmount;

    // Refund the buy tokens for the removed bid
    pendingRefunds[bidder] += sellCouponAmount;

    emit BidRefundAllocated(bidder, sellCouponAmount);
    emit BidRemoved(bidIndex, bidder, buyReserveAmount, sellCouponAmount);

    delete bids[bidIndex];
    bidCount--;
  }

  /**
   * @dev Ends the auction and transfers the reserve to the auction.
   */
  function endAuction() external auctionExpired whenNotPaused {
    if (state != State.BIDDING) revert AuctionAlreadyEnded();

    if (currentCouponAmount < totalBuyCouponAmount) {
      state = State.FAILED_UNDERSOLD;
      Pool(pool).zeroLastSharesPerToken();
    } else if (totalSellReserveAmount >= (IERC20(sellReserveToken).balanceOf(pool) * poolSaleLimit) / 100) {
      state = State.FAILED_POOL_SALE_LIMIT;
      Pool(pool).zeroLastSharesPerToken();
    } else {
      state = State.SUCCEEDED;
      Pool(pool).transferReserveToAuction(totalSellReserveAmount);
      IERC20(buyCouponToken).safeTransfer(beneficiary, totalBuyCouponAmount);
    }

    emit AuctionEnded(state, totalSellReserveAmount, totalBuyCouponAmount);
  }

  /**
   * @dev Claims the tokens for a winning bid.
   * @param bidIndex The index of the bid to claim.
   */
  function claimBid(uint256 bidIndex) external auctionExpired auctionSucceeded whenNotPaused {
    Bid storage bidInfo = bids[bidIndex];
    if (bidInfo.bidder != msg.sender) revert NothingToClaim();
    if (bidInfo.claimed) revert AlreadyClaimed();

    bidInfo.claimed = true;
    IERC20(sellReserveToken).safeTransfer(bidInfo.bidder, bidInfo.buyReserveAmount);

    emit BidClaimed(bidIndex, bidInfo.bidder, bidInfo.buyReserveAmount);
  }

  function claimRefund(uint256 bidIndex) external auctionExpired auctionFailed whenNotPaused {
    Bid storage bidInfo = bids[bidIndex];
    if (bidInfo.bidder != msg.sender) revert NothingToClaim();
    if (bidInfo.claimed) revert AlreadyClaimed();

    bidInfo.claimed = true;
    IERC20(buyCouponToken).safeTransfer(bidInfo.bidder, bidInfo.sellCouponAmount);

    emit FailedAuctionBidRefundClaimed(bidIndex, bidInfo.bidder, bidInfo.sellCouponAmount);
  }

  function claimRefund() external whenNotPaused {
    uint256 amountToClaim = pendingRefunds[msg.sender];
    if (amountToClaim == 0) revert NothingToClaim();

    pendingRefunds[msg.sender] = 0;
    IERC20(buyCouponToken).safeTransfer(msg.sender, amountToClaim);

    emit LosingBidRefundClaimed(msg.sender, amountToClaim);
  }

  /**
   * @dev Returns the size of a bid slot.
   * @return uint256 The size of a bid slot.
   */
  function slotSize() public view returns (uint256) {
    return totalBuyCouponAmount / maxBids;
  }

  /**
   * @dev Modifier to check if the auction is still active.
   */
  modifier auctionActive() {
    if (block.timestamp >= endTime) revert AuctionHasEnded();
    _;
  }

  /**
   * @dev Modifier to check if the auction has expired.
   */
  modifier auctionExpired() {
    if (block.timestamp < endTime) revert AuctionStillOngoing();
    _;
  }

  /**
   * @dev Modifier to check if the auction succeeded.
   */
  modifier auctionSucceeded() {
    if (state != State.SUCCEEDED) revert AuctionFailed();
    _;
  }

  modifier auctionFailed() {
    if (state == State.SUCCEEDED || state == State.BIDDING) revert AuctionSucceededOrOngoing();
    _;
  }

  /**
   * @dev Modifier to check if the caller has the specified role.
   * @param role The role to check for.
   */
  modifier onlyRole(bytes32 role) {
    if (!PoolFactory(Pool(pool).poolFactory()).hasRole(role, msg.sender)) revert AccessDenied();
    _;
  }

  function pause() external onlyRole(PoolFactory(Pool(pool).poolFactory()).SECURITY_COUNCIL_ROLE()) {
    _pause();
  }

  function unpause() external onlyRole(PoolFactory(Pool(pool).poolFactory()).SECURITY_COUNCIL_ROLE()) {
    _unpause();
  }

  /**
   * @dev Authorizes an upgrade to a new implementation.
   * Can only be called by the owner of the contract.
   * @param newImplementation Address of the new implementation
   */
  function _authorizeUpgrade(address newImplementation)
    internal
    override
    onlyRole(PoolFactory(Pool(pool).poolFactory()).GOV_ROLE())
  {}
}

// SPDX-License-Identifier: Unlicensed
pragma solidity ^0.8.26;

import {Pool} from "./Pool.sol";
import {IVault} from "@balancer/contracts/interfaces/contracts/vault/IVault.sol";
import {IAsset} from "@balancer/contracts/interfaces/contracts/vault/IAsset.sol";
import {SafeERC20} from "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";
import {ReentrancyGuard} from "@openzeppelin/contracts/utils/ReentrancyGuard.sol";
import {IBasePool} from "@balancer/contracts/interfaces/contracts/vault/IBasePool.sol";
import {IERC20 as BalancerIERC20} from "@balancer/contracts/interfaces/contracts/solidity-utils/openzeppelin/IERC20.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {WeightedPoolUserData} from "@balancer/contracts/interfaces/contracts/pool-weighted/WeightedPoolUserData.sol";
import {IWETH} from "./lib/IWETH.sol";

contract BalancerRouter is ReentrancyGuard {
  using SafeERC20 for IERC20;

  address constant ETH = 0xEeeeeEeeeEeEeeEeEeEeeEEEeeeeEeeeeeeeEEeE;
  IVault public immutable balancerVault;
  IWETH public immutable weth;

  event TokensRedeemed(
    address indexed plazaPool,
    address caller,
    address indexed onBehalfOf,
    Pool.TokenType tokenType,
    uint256 depositedAmount,
    uint256 redeemedAmount
  );

  error UnexpectedEth();

  constructor(address _balancerVault, address _weth) {
    balancerVault = IVault(_balancerVault);
    weth = IWETH(_weth);
  }

  function deposit(
    address plazaPool,
    address depositToken,
    uint256 amount,
    Pool.TokenType tokenType,
    uint256 minPlazaTokens
  ) external payable returns (uint256) {
    // Step 0: Check for ETH
    if (msg.value > 0) {
      if (depositToken != ETH) revert UnexpectedEth();
      weth.deposit{value: msg.value}();
      depositToken = address(weth);
      amount = msg.value;
    }

    // Step 1: Get Balancer Pool ID
    address blpToken = Pool(plazaPool).reserveToken();
    bytes32 poolId = IBasePool(blpToken).getPoolId();

    // Step 2: Get Balancer Pool Tokens
    (BalancerIERC20[] memory tokens,,) = balancerVault.getPoolTokens(poolId);
    IAsset[] memory assets = new IAsset[](tokens.length);
    for (uint256 i = 0; i < tokens.length; i++) {
      assets[i] = IAsset(address(tokens[i]));
    }

    // Step 3: Get Deposit Token Index
    uint256 depositTokenIndex;
    uint256[] memory amountsIn = new uint256[](tokens.length);
    for (uint256 i = 0; i < tokens.length; i++) {
      if (address(tokens[i]) == depositToken) {
        depositTokenIndex = i;
        break;
      }
    }
    amountsIn[depositTokenIndex] = amount;

    // Step 4: Get Amounts In Without BPT
    uint256[] memory amountsInWithoutBpt = new uint256[](amountsIn.length - 1);
    amountsInWithoutBpt[depositTokenIndex - 1] = amount;

    // Step 5: Format User Data
    bytes memory userData =
      abi.encode(WeightedPoolUserData.JoinKind.EXACT_TOKENS_IN_FOR_BPT_OUT, amountsInWithoutBpt, 0);

    // Step 6: Join Balancer and Plaza
    return
      joinBalancerAndPlaza(poolId, plazaPool, assets, amountsIn, userData, tokenType, minPlazaTokens, block.timestamp);
  }

  function joinBalancerAndPlaza(
    bytes32 balancerPoolId,
    address _plazaPool,
    IAsset[] memory assets,
    uint256[] memory maxAmountsIn,
    bytes memory userData,
    Pool.TokenType plazaTokenType,
    uint256 minPlazaTokens,
    uint256 deadline
  ) public nonReentrant returns (uint256) {
    // Step 1: Join Balancer Pool
    uint256 balancerPoolTokenReceived = joinBalancerPool(balancerPoolId, assets, maxAmountsIn, userData);

    // Step 2: Approve balancerPoolToken for Plaza Pool
    (address balancerPoolToken,) = balancerVault.getPool(balancerPoolId);
    IERC20(balancerPoolToken).safeIncreaseAllowance(_plazaPool, balancerPoolTokenReceived);

    // Step 3: Join Plaza Pool
    uint256 plazaTokens =
      Pool(_plazaPool).create(plazaTokenType, balancerPoolTokenReceived, minPlazaTokens, deadline, msg.sender);

    return plazaTokens;
  }

  function joinBalancerPool(
    bytes32 poolId,
    IAsset[] memory assets,
    uint256[] memory maxAmountsIn,
    bytes memory userData
  ) internal returns (uint256) {
    // Transfer assets from user to this contract
    for (uint256 i = 0; i < assets.length; i++) {
      uint256 amount = maxAmountsIn[i];
      if (amount == 0) continue;

      IERC20 token = IERC20(address(assets[i]));
      uint256 here = token.balanceOf(address(this));

      if (amount > here) token.safeTransferFrom(msg.sender, address(this), amount - here);
      token.safeIncreaseAllowance(address(balancerVault), amount);
    }

    IVault.JoinPoolRequest memory request = IVault.JoinPoolRequest({
      assets: assets,
      maxAmountsIn: maxAmountsIn,
      userData: userData,
      fromInternalBalance: false
    });

    // Join Balancer pool
    (address balancerPoolToken,) = balancerVault.getPool(poolId);
    uint256 balancerPoolTokenBalanceBefore = IERC20(balancerPoolToken).balanceOf(address(this));
    balancerVault.joinPool(poolId, address(this), address(this), request);

    // Send back any remaining assets to user
    for (uint256 i = 1; i < assets.length; i++) {
      // index 0 is the balancer pool token in ManagedPools
      uint256 assetBalance = IERC20(address(assets[i])).balanceOf(address(this));
      if (assetBalance > 0) IERC20(address(assets[i])).safeTransfer(msg.sender, assetBalance);
    }

    uint256 balancerPoolTokenBalanceAfter = IERC20(balancerPoolToken).balanceOf(address(this));

    return balancerPoolTokenBalanceAfter - balancerPoolTokenBalanceBefore;
  }

  function withdraw(
    address plazaPool,
    Pool.TokenType tokenType,
    uint256 amount,
    address withdrawToken,
    uint256 minAmount
  ) external {
    address blpToken = Pool(plazaPool).reserveToken();
    bytes32 poolId = IBasePool(blpToken).getPoolId();
    (BalancerIERC20[] memory tokens,,) = balancerVault.getPoolTokens(poolId);
    IAsset[] memory assets = new IAsset[](tokens.length);
    for (uint256 i = 0; i < tokens.length; i++) {
      address token = address(tokens[i]);
      if (token == address(weth) && withdrawToken == ETH) {
        assets[i] = IAsset(address(0)); // Passing in 0 in place of WETH address pays out ETH instead of WETH
        withdrawToken = address(weth); // Set withdrawToken to WETH for finding index in next loop
      } else {
        assets[i] = IAsset(address(tokens[i]));
      }
    }

    uint256 withdrawTokenIndex;
    uint256[] memory minAmountsOut = new uint256[](tokens.length);
    for (uint256 i = 0; i < tokens.length; i++) {
      if (address(tokens[i]) == withdrawToken) {
        withdrawTokenIndex = i;
        // element)
        break;
      }
    }

    minAmountsOut[withdrawTokenIndex] = minAmount;
    bytes memory userData =
      abi.encode(WeightedPoolUserData.ExitKind.EXACT_BPT_IN_FOR_ONE_TOKEN_OUT, 0, withdrawTokenIndex - 1); // userData
      // needs the index without the balancer pool token (which takes the first element)

    exitPlazaAndBalancer(poolId, plazaPool, assets, amount, minAmountsOut, userData, tokenType, 0);
  }

  function exitPlazaAndBalancer(
    bytes32 balancerPoolId,
    address _plazaPool,
    IAsset[] memory assets,
    uint256 plazaTokenAmount,
    uint256[] memory minAmountsOut,
    bytes memory userData,
    Pool.TokenType plazaTokenType,
    uint256 minbalancerPoolTokenOut
  ) public nonReentrant {
    // Step 1: Exit Plaza Pool
    uint256 balancerPoolTokenReceived =
      exitPlazaPool(plazaTokenType, _plazaPool, plazaTokenAmount, minbalancerPoolTokenOut);

    // Decode userData to get format and bptAmountIn
    uint256 exitKind;
    assembly {
      exitKind := mload(add(userData, 32))
    } // load first uint256, the exit kind

    bytes memory newUserData;
    if (exitKind == 0) {
      // EXACT_BPT_IN_FOR_ONE_TOKEN_OUT
      uint256 exitTokenIndex;
      (,, exitTokenIndex) = abi.decode(userData, (uint256, uint256, uint256));
      newUserData = abi.encode(uint256(0), balancerPoolTokenReceived, exitTokenIndex);
    } else if (exitKind == 1) {
      // EXACT_BPT_IN_FOR_TOKENS_OUT
      newUserData = abi.encode(uint256(1), balancerPoolTokenReceived);
    }

    // Step 2: Exit Balancer Pool
    exitBalancerPool(balancerPoolId, assets, minAmountsOut, newUserData, msg.sender);
  }

  function exitPlazaPool(
    Pool.TokenType tokenType,
    address _plazaPool,
    uint256 tokenAmount,
    uint256 minbalancerPoolTokenOut
  ) internal returns (uint256) {
    // Transfer Plaza tokens from user to this contract
    Pool plazaPool = Pool(_plazaPool);
    IERC20 plazaToken =
      tokenType == Pool.TokenType.BOND ? IERC20(address(plazaPool.bondToken())) : IERC20(address(plazaPool.lToken()));
    plazaToken.safeTransferFrom(msg.sender, address(this), tokenAmount);
    plazaToken.safeIncreaseAllowance(_plazaPool, tokenAmount);

    // Exit Plaza pool
    uint256 reservesRedeemedAmount = plazaPool.redeem(tokenType, tokenAmount, minbalancerPoolTokenOut);

    emit TokensRedeemed(_plazaPool, address(this), msg.sender, tokenType, tokenAmount, reservesRedeemedAmount);

    return reservesRedeemedAmount;
  }

  function exitBalancerPool(
    bytes32 poolId,
    IAsset[] memory assets,
    uint256[] memory minAmountsOut,
    bytes memory userData,
    address to
  ) internal {
    IVault.ExitPoolRequest memory request = IVault.ExitPoolRequest({
      assets: assets,
      minAmountsOut: minAmountsOut,
      userData: userData,
      toInternalBalance: false
    });

    balancerVault.exitPool(poolId, address(this), payable(to), request);
  }

  function swap(
    address _plazaPool,
    Pool.TokenType tokenType,
    uint256 tokenAmount,
    uint256 minAmountOut,
    uint256 deadline
  ) external nonReentrant returns (uint256) {
    // Step 1: Exit Plaza Pool
    uint256 balancerPoolTokenReceived = exitPlazaPool(tokenType, _plazaPool, tokenAmount, 0);

    // Step 2: Approve balancerPoolToken for Plaza Pool
    address balancerPoolToken = Pool(_plazaPool).reserveToken();
    IERC20(balancerPoolToken).safeIncreaseAllowance(_plazaPool, balancerPoolTokenReceived);

    // Step 3: Join Plaza Pool
    Pool.TokenType tokenTypeOut = tokenType == Pool.TokenType.BOND ? Pool.TokenType.LEVERAGE : Pool.TokenType.BOND;
    return Pool(_plazaPool).create(tokenTypeOut, balancerPoolTokenReceived, minAmountOut, deadline, msg.sender);
  }

  function simulateSwap(address _plazaPool, Pool.TokenType tokenType, uint256 tokenAmount)
    external
    view
    returns (uint256)
  {
    Pool plazaPool = Pool(_plazaPool);

    uint256 reservesRedeemedAmount = plazaPool.simulateRedeem(tokenType, tokenAmount);

    Pool.TokenType tokenTypeOut = tokenType == Pool.TokenType.BOND ? Pool.TokenType.LEVERAGE : Pool.TokenType.BOND;

    return plazaPool.simulateCreate(tokenTypeOut, reservesRedeemedAmount);
  }
}

// SPDX-License-Identifier: MIT
// OpenZeppelin Contracts (last updated v5.0.0) (proxy/beacon/BeaconProxy.sol)

pragma solidity ^0.8.20;

import {IBeacon} from "./IBeacon.sol";
import {Proxy} from "../Proxy.sol";
import {ERC1967Utils} from "../ERC1967/ERC1967Utils.sol";

/**
 * @dev This contract implements a proxy that gets the implementation address for each call from an {UpgradeableBeacon}.
 *
 * The beacon address can only be set once during construction, and cannot be changed afterwards. It is stored in an
 * immutable variable to avoid unnecessary storage reads, and also in the beacon storage slot specified by
 * https://eips.ethereum.org/EIPS/eip-1967[EIP1967] so that it can be accessed externally.
 *
 * CAUTION: Since the beacon address can never be changed, you must ensure that you either control the beacon, or trust
 * the beacon to not upgrade the implementation maliciously.
 *
 * IMPORTANT: Do not use the implementation logic to modify the beacon storage slot. Doing so would leave the proxy in
 * an inconsistent state where the beacon storage slot does not match the beacon address.
 */
contract BeaconProxy is Proxy {
    // An immutable address for the beacon to avoid unnecessary SLOADs before each delegate call.
    address private immutable _beacon;

    /**
     * @dev Initializes the proxy with `beacon`.
     *
     * If `data` is nonempty, it's used as data in a delegate call to the implementation returned by the beacon. This
     * will typically be an encoded function call, and allows initializing the storage of the proxy like a Solidity
     * constructor.
     *
     * Requirements:
     *
     * - `beacon` must be a contract with the interface {IBeacon}.
     * - If `data` is empty, `msg.value` must be zero.
     */
    constructor(address beacon, bytes memory data) payable {
        ERC1967Utils.upgradeBeaconToAndCall(beacon, data);
        _beacon = beacon;
    }

    /**
     * @dev Returns the current implementation address of the associated beacon.
     */
    function _implementation() internal view virtual override returns (address) {
        return IBeacon(_getBeacon()).implementation();
    }

    /**
     * @dev Returns the beacon.
     */
    function _getBeacon() internal view virtual returns (address) {
        return _beacon;
    }
}

// SPDX-License-Identifier: MIT

// modified from https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/utils/structs/BitMaps.sol
pragma solidity ^0.8.20;

type BitMap256 is uint256;

using BitMaps for BitMap256 global;

library BitMaps {
    /**
     * @dev Returns whether the bit at `index` is set.
     */
    function get(BitMap256 bitmap, uint8 index) internal pure returns (bool) {
        uint256 mask = 1 << index;
        return BitMap256.unwrap(bitmap) & mask != 0;
    }

    /**
     * @dev Sets the bit at `index`.
     */
    function set(BitMap256 bitmap, uint8 index) internal pure returns (BitMap256) {
        uint256 mask = 1 << index;
        return BitMap256.wrap(BitMap256.unwrap(bitmap) | mask);
    }
}

// SPDX-License-Identifier: GPL-2.0-or-later
pragma solidity ^0.8.26;

/**
 * @title BlockTimestamp
 * @dev Abstract contract providing a function to get the current block timestamp.
 */
abstract contract BlockTimestamp {
  /**
   * @notice Returns the current block timestamp
   * @return uint256 The current block timestamp
   */
  function _blockTimestamp() internal view virtual returns (uint256) {
    return block.timestamp;
  }
}

// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.26;

import {BondToken} from "../BondToken.sol";
import {PoolFactory} from "../PoolFactory.sol";
import {OwnableUpgradeable} from "@openzeppelin/contracts-upgradeable/access/OwnableUpgradeable.sol";
import {Initializable} from "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol";
import {UUPSUpgradeable} from "@openzeppelin/contracts-upgradeable/proxy/utils/UUPSUpgradeable.sol";
import {PausableUpgradeable} from "@openzeppelin/contracts-upgradeable/utils/PausableUpgradeable.sol";
import {OFTAdapterUpgradeable} from "@layerzerolabs/oft-evm-upgradeable/contracts/oft/OFTAdapterUpgradeable.sol";
import {EnforcedOptionParam} from "@layerzerolabs/oapp-evm/contracts/oapp/libs/OAppOptionsType3.sol";
import {IOAppCore} from "@layerzerolabs/oapp-evm/contracts/oapp/interfaces/IOAppCore.sol";
import {SendParam} from "@layerzerolabs/oft-evm/contracts/interfaces/IOFT.sol";
import {OptionsBuilder} from "@layerzerolabs/oapp-evm/contracts/oapp/libs/OptionsBuilder.sol";
import {MessagingReceipt, MessagingFee} from "@layerzerolabs/oapp-evm/contracts/oapp/OApp.sol";

contract BondBaseOftAdapter is
  Initializable,
  UUPSUpgradeable,
  OwnableUpgradeable,
  PausableUpgradeable,
  OFTAdapterUpgradeable
{
  using OptionsBuilder for bytes;

  uint128 public constant GAS_COST_LZ_RECEIVE = 100_000;
  uint128 public constant GAS_COST_LZ_COMPOSE = 200_000;

  mapping(uint32 => uint256) public remoteBalance;
  mapping(uint32 => uint256) public snapshotBalance;

  error OnlyCrossChainController();
  error OnlyPoolFactory();
  error OnlySecurityCouncil();

  event IncreasePeriodForRemote(uint32 indexed supportedLzEid, MessagingReceipt receipt);
  event ZeroLastSharesForRemote(uint32 indexed supportedLzEid, MessagingReceipt receipt);

  constructor(address _token, address _lzEndpoint) OFTAdapterUpgradeable(_token, _lzEndpoint) {
    _disableInitializers();
  }

  function initialize(address _owner) external initializer {
    __OFTAdapter_init(_owner);
    __Ownable_init(_owner);
  }

  function increasePeriodForRemote(uint256 sharesPerToken, uint32 _dstEid, address _remoteDistributor)
    external
    onlyCrossChainController
  {
    // snapshot the remote balance
    snapshotBalance[_dstEid] = remoteBalance[_dstEid];

    // send lz message to increase period on remote
    bytes memory _message = abi.encodeWithSelector(BondToken.increaseIndexedAssetPeriod.selector, sharesPerToken);
    MessagingReceipt memory receipt = _sendLzMessage(_dstEid, _remoteDistributor, _message);
    emit IncreasePeriodForRemote(_dstEid, receipt);
  }

  function zeroLastSharesForRemotes(uint32 _dstEid, address _remoteDistributor) external onlyCrossChainController {
    bytes memory _message = abi.encodeWithSelector(BondToken.zeroLastSharesPerToken.selector);
    MessagingReceipt memory receipt = _sendLzMessage(_dstEid, _remoteDistributor, _message);
    emit ZeroLastSharesForRemote(_dstEid, receipt);
  }

  function _sendLzMessage(uint32 _dstEid, address _remoteDistributor, bytes memory _message)
    internal
    returns (MessagingReceipt memory receipt)
  {
    bytes memory _extraOptions = OptionsBuilder.newOptions().addExecutorLzReceiveOption(GAS_COST_LZ_RECEIVE, 0)
      .addExecutorLzComposeOption(0, GAS_COST_LZ_COMPOSE, 0);

    // Send a message with dummy 0 value for tokens
    SendParam memory sendParam =
      SendParam(_dstEid, _addressToBytes32(_remoteDistributor), 0, 0, _extraOptions, _message, "");

    MessagingFee memory fee = _quote(_dstEid, _message, _extraOptions, false);

    // The gas cost sent in msg.values 10% higher than quoted. This is to account for additional payload length when
    // OFTCore appends msg.sender in _buildMsgAndOptions(). This is gated to having sendParam as calldata and not
    // memory, making using logic more convoluted than necessary. Instead, we simply pass an additional 10% factor,
    // where the extra is refunded back to the OFTAdapter. Actual extra cost is less than 1% of estimated
    (receipt,) =
      OFTAdapterUpgradeable(address(this)).send{value: fee.nativeFee * 110 / 100}(sendParam, fee, address(this));
    return receipt;
  }

  function _debit(address _from, uint256 _amountLD, uint256 _minAmountLD, uint32 _dstEid)
    internal
    override
    returns (uint256 amountSentLD, uint256 amountReceivedLD)
  {
    (amountSentLD,) = _debitView(_amountLD, _minAmountLD, _dstEid);
    remoteBalance[_dstEid] += amountSentLD;
    (amountSentLD, amountReceivedLD) = super._debit(_from, _amountLD, _minAmountLD, _dstEid);
  }

  function _credit(address _to, uint256 _amountLD, uint32 _srcEid) internal override returns (uint256 amountReceivedLD) {
    remoteBalance[_srcEid] -= _amountLD;
    amountReceivedLD = super._credit(_to, _amountLD, _srcEid);
  }

  function _payNative(uint256 _nativeFee) internal view override returns (uint256) {
    if (msg.value < _nativeFee) revert NotEnoughNative(msg.value);
    return msg.value;
  }

  function _addressToBytes32(address _addr) private pure returns (bytes32) {
    return bytes32(uint256(uint160(_addr)));
  }

  modifier onlyCrossChainController() {
    address crossChainController = address(BondToken(address(innerToken)).poolFactory().crossChainController());
    if (msg.sender != crossChainController) revert OnlyCrossChainController();
    _;
  }

  modifier onlyPoolFactory() {
    if (msg.sender != address(BondToken(address(innerToken)).poolFactory())) revert OnlyPoolFactory();
    _;
  }

  modifier onlySecurityCouncil() {
    PoolFactory poolFactory = BondToken(address(innerToken)).poolFactory();
    if (!poolFactory.hasRole(poolFactory.SECURITY_COUNCIL_ROLE(), msg.sender)) revert OnlySecurityCouncil();
    _;
  }

  function pause() external onlySecurityCouncil {
    _pause();
  }

  function unpause() external onlySecurityCouncil {
    _unpause();
  }

  function _authorizeUpgrade(address newImplementation) internal override onlyOwner {}

  receive() external payable {}
}

// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.26;

import {Decimals} from "./lib/Decimals.sol";
import {PoolFactory} from "./PoolFactory.sol";
import {Pool} from "./Pool.sol";
import {Auction} from "./Auction.sol";
import {Initializable} from "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol";
import {UUPSUpgradeable} from "@openzeppelin/contracts-upgradeable/proxy/utils/UUPSUpgradeable.sol";
import {PausableUpgradeable} from "@openzeppelin/contracts-upgradeable/utils/PausableUpgradeable.sol";
import {ERC20Upgradeable} from "@openzeppelin/contracts-upgradeable/token/ERC20/ERC20Upgradeable.sol";
import {AccessControlUpgradeable} from "@openzeppelin/contracts-upgradeable/access/AccessControlUpgradeable.sol";
import {ERC20PermitUpgradeable} from
  "@openzeppelin/contracts-upgradeable/token/ERC20/extensions/ERC20PermitUpgradeable.sol";

/**
 * @title BondToken
 * @dev This contract implements a bond token with upgradeable capabilities, access control, and
 * pausability.
 * It includes functionality for managing indexed user assets and global asset pools.
 */
contract BondToken is
  Initializable,
  ERC20Upgradeable,
  AccessControlUpgradeable,
  ERC20PermitUpgradeable,
  UUPSUpgradeable,
  PausableUpgradeable
{
  using Decimals for uint256;

  /**
   * @dev Struct to represent a pool's outstanding shares and shares per bond at a specific period
   * @param period The period of the pool amount
   * @param amount The total amount in the pool
   * @param sharesPerToken The number of shares per token (base 10000)
   */
  struct PoolAmount {
    uint256 period;
    uint256 amount;
    uint256 sharesPerToken;
  }

  /**
   * @dev Struct to represent the global asset pool, including the current period, shares per token,
   * and previous pool amounts.
   * @param currentPeriod The current period of the global pool
   * @param sharesPerToken The current number of shares per token (base 1e6)
   * @param previousPoolAmounts An array of previous pool amounts
   */
  struct IndexedGlobalAssetPool {
    uint256 currentPeriod;
    uint256 sharesPerToken;
    PoolAmount[] previousPoolAmounts;
  }

  /**
   * @dev Struct to represent a user's indexed assets, which are the user's shares
   * @param lastUpdatedPeriod The last GLOBAL period when the user's assets were updated, NOT the
   * user's last period accounted for
   * @param indexedAmountShares The user's indexed amount of shares, which does not include the last
   * indexed period's shares
   * @param lastIndexedPeriodShares The user's shares from the last indexed period. See
   * getIndexedUserAmount for why this is kept separate.
   */
  struct IndexedUserAssets {
    uint256 lastUpdatedPeriod;
    uint256 indexedAmountShares;
    uint256 lastIndexedPeriodBalance;
  }

  /// @dev The global asset pool
  IndexedGlobalAssetPool public globalPool;
  /// @dev Pool factory address
  PoolFactory public poolFactory;
  Pool public pool;

  /// @dev Mapping of user addresses to their indexed assets
  mapping(address => IndexedUserAssets) public userAssets;

  /// @dev The number of blocks before transfers are re-enabled after an auction start
  uint256 auctionStartTransfersPause;
  uint256 auctionStartBlock;

  /// @dev Role identifier for accounts with minting privileges
  bytes32 public constant MINTER_ROLE = keccak256("MINTER_ROLE");
  /// @dev Role identifier for accounts with governance privileges
  bytes32 public constant GOV_ROLE = keccak256("GOV_ROLE");
  /// @dev Role identifier for the distributor
  bytes32 public constant DISTRIBUTOR_ROLE = keccak256("DISTRIBUTOR_ROLE");

  /// @dev The number of decimals for shares
  uint8 public constant SHARES_DECIMALS = 6;

  /// @dev Error thrown when the caller is not the security council
  error CallerIsNotSecurityCouncil();
  /// @dev Error thrown when the caller is not the pool factory
  error CallerIsNotPoolFactory();
  /// @dev Error thrown when the caller is not the pool
  error CallerIsNotPool();
  /// @dev Error thrown when an auction has recently started
  error AuctionRecentlyStarted();

  /// @dev Emitted when the asset period is increased
  event IncreasedAssetPeriod(uint256 currentPeriod, uint256 sharesPerToken);
  /// @dev Emitted when a user's assets are updated
  event UpdatedUserAssets(address user, uint256 lastUpdatedPeriod, uint256 indexedAmountShares);

  /// @custom:oz-upgrades-unsafe-allow constructor
  constructor() {
    _disableInitializers();
  }

  /**
   * @dev Initializes the contract with a name, symbol, minter, governance address, distributor, and
   * initial shares per token.
   * @param name The name of the token
   * @param symbol The symbol of the token
   * @param minter The address that will have minting privileges
   * @param governance The address that will have governance privileges
   * @param sharesPerToken The initial number of shares per token
   */
  function initialize(
    string memory name,
    string memory symbol,
    address minter,
    address governance,
    address _poolFactory,
    uint256 sharesPerToken
  ) public initializer {
    __ERC20_init(name, symbol);
    __ERC20Permit_init(name);
    __UUPSUpgradeable_init();
    __Pausable_init();

    poolFactory = PoolFactory(_poolFactory);
    globalPool.sharesPerToken = sharesPerToken;

    _grantRole(MINTER_ROLE, minter);
    _grantRole(GOV_ROLE, governance);

    _setRoleAdmin(GOV_ROLE, GOV_ROLE);
    _setRoleAdmin(DISTRIBUTOR_ROLE, GOV_ROLE);
    _setRoleAdmin(MINTER_ROLE, MINTER_ROLE);

    auctionStartTransfersPause = 3;
  }

  /**
   * @dev Mints new tokens to the specified address.
   * @param to The address that will receive the minted tokens
   * @param amount The amount of tokens to mint
   * @notice Can only be called by addresses with the MINTER_ROLE.
   */
  function mint(address to, uint256 amount) public onlyRole(MINTER_ROLE) {
    _mint(to, amount);
  }

  /**
   * @dev Burns tokens from the specified account.
   * @param account The account from which tokens will be burned
   * @param amount The amount of tokens to burn
   * @notice Can only be called by addresses with the MINTER_ROLE.
   */
  function burn(address account, uint256 amount) public onlyRole(MINTER_ROLE) {
    _burn(account, amount);
  }

  /**
   * @dev Returns the previous pool amounts from the global pool.
   * @return An array of PoolAmount structs representing the previous pool amounts
   */
  function getPreviousPoolAmounts() external view returns (PoolAmount[] memory) {
    return globalPool.previousPoolAmounts;
  }

  /**
   * @dev Internal function to update user assets after a transfer. Also checks if an auction was recently started.
   * @param from The address tokens are transferred from
   * @param to The address tokens are transferred to
   * @param amount The amount of tokens transferred
   * @notice This function is called during token transfer and is paused when the contract is
   * paused.
   */
  function _update(address from, address to, uint256 amount) internal virtual override whenNotPaused {
    if (auctionStartBlock + auctionStartTransfersPause > block.number) revert AuctionRecentlyStarted();

    if (from != address(0)) updateIndexedUserAssets(from, balanceOf(from));

    if (to != address(0)) updateIndexedUserAssets(to, balanceOf(to));

    super._update(from, to, amount);
  }

  /**
   * @dev Updates the indexed user assets for a specific user.
   * @param user The address of the user
   * @param balance The current balance of the user
   * @notice This function updates the number of shares held by the user based on the current
   * period.
   */
  function updateIndexedUserAssets(address user, uint256 balance) internal {
    uint256 currentPeriod = globalPool.currentPeriod;
    (uint256 shares, uint256 lastIndexedPeriodBalance) = getIndexedUserAmount(user, balance, currentPeriod);

    userAssets[user].indexedAmountShares = shares;
    userAssets[user].lastUpdatedPeriod = currentPeriod;
    userAssets[user].lastIndexedPeriodBalance = lastIndexedPeriodBalance;

    emit UpdatedUserAssets(user, currentPeriod, shares);
  }

  function getIndexedUserAmount(address user) public view returns (uint256, uint256) {
    return getIndexedUserAmount(user, balanceOf(user), globalPool.currentPeriod);
  }

  /**
   * @dev Returns the indexed amount of shares for a specific user.
   * @param user The address of the user
   * @param balance The current balance of the user
   * @return The indexed amount of shares for the user
   * @notice This function calculates the number of shares based on the current period and the
   * previous pool amounts.
   * We separate the last indexed period shares from the total shares to account for ongoing
   * auctions.
   * Contracts calling this function should be aware that shares should not be paid out for bidding
   * auctions. We currently handle this in the Distributor by checking if the last auction is still active.
   * For RemoteDistributor, we simply track a nonce, which gets incremented on every USDC bridging, or sharesPerToken
   * reset to zero if auction fails.
   */
  function getIndexedUserAmount(address user, uint256 balance, uint256 currentPeriod)
    public
    view
    returns (uint256, uint256)
  {
    IndexedUserAssets memory userPool = userAssets[user];
    uint256 lastUpdatedPeriod = userPool.lastUpdatedPeriod;
    uint256 shares = userPool.indexedAmountShares;
    uint256 lastIndexedPeriodBalance = userPool.lastIndexedPeriodBalance;

    // No indexing if the last updated period is the current period
    if (currentPeriod == 0) return (0, 0);
    if (lastUpdatedPeriod == currentPeriod) return (shares, lastIndexedPeriodBalance);

    // loop through all previous periods except the last one being accounted for
    for (uint256 i = lastUpdatedPeriod; i < currentPeriod - 1; i++) {
      shares += (balance * globalPool.previousPoolAmounts[i].sharesPerToken).toBaseUnit(SHARES_DECIMALS);
    }

    // We need to backtrack to when the last time lastIndexedPeriodShares was recorded, and
    // confirm that the corresponding auction was successful in order to add the amount to the
    // 'normal' shares counter. This amount is not accounted for in the loop above.
    if (lastUpdatedPeriod > 0) {
      shares += (lastIndexedPeriodBalance * globalPool.previousPoolAmounts[lastUpdatedPeriod - 1].sharesPerToken)
        .toBaseUnit(SHARES_DECIMALS);
    }

    return (shares, balance);
  }

  /**
   * @dev Resets the indexed user assets for a specific user.
   * @param user The address of the user
   * @notice This function resets the last updated period and indexed amount of shares to zero.
   * Can only be called by addresses with the DISTRIBUTOR_ROLE and when the contract is not paused.
   */
  function resetIndexedUserAssets(address user, bool resetLastIndexedPeriodBalance)
    external
    onlyRole(DISTRIBUTOR_ROLE)
    whenNotPaused
  {
    userAssets[user].indexedAmountShares = 0;
    if (resetLastIndexedPeriodBalance) {
      userAssets[user].lastIndexedPeriodBalance = 0;
    } else {
      (, userAssets[user].lastIndexedPeriodBalance) =
        getIndexedUserAmount(user, balanceOf(user), globalPool.currentPeriod);
    }
    userAssets[user].lastUpdatedPeriod = globalPool.currentPeriod;
  }

  /**
   * @dev Increases the current period and updates the shares per token.
   * @param sharesPerToken The new number of shares per token
   * @notice Can only be called by addresses with the GOV_ROLE and when the contract is not paused.
   */
  function increaseIndexedAssetPeriod(uint256 sharesPerToken) public onlyRole(DISTRIBUTOR_ROLE) whenNotPaused {
    globalPool.previousPoolAmounts.push(
      PoolAmount({period: globalPool.currentPeriod, amount: totalSupply(), sharesPerToken: sharesPerToken})
    );
    globalPool.currentPeriod++;
    globalPool.sharesPerToken = sharesPerToken;

    emit IncreasedAssetPeriod(globalPool.currentPeriod, sharesPerToken);
  }

  /**
   * @dev Sets the shares per token for the last period to 0. Only called by the Pool when the
   * auction fails.
   * @notice Can only be called by addresses with the DISTRIBUTOR_ROLE and when the contract is not
   * paused.
   */
  function zeroLastSharesPerToken() external onlyRole(DISTRIBUTOR_ROLE) {
    globalPool.previousPoolAmounts[globalPool.currentPeriod - 1].sharesPerToken = 0;
  }

  /**
   * @dev Sets the auction start block. Only called by the Pool.
   * @param _auctionStartBlock The block number at which the auction started
   */
  function setAuctionStartBlock(uint256 _auctionStartBlock) external onlyPool {
    auctionStartBlock = _auctionStartBlock;
  }

  /**
   * @dev Sets the pool for the bond token. Only called by the pool factory, and only once during
   * Pool creation.
   * @param _pool The address of the pool
   */
  function setPool(address _pool) external {
    require(msg.sender == address(poolFactory), CallerIsNotPoolFactory());
    pool = Pool(_pool);
  }

  /**
   * @dev Sets the shares per token.
   * @param _sharesPerToken The new shares per token value.
   */
  function setSharesPerToken(uint256 _sharesPerToken) external onlyPool {
    globalPool.sharesPerToken = _sharesPerToken;
  }

  function setAuctionStartTransfersPause(uint256 _auctionStartTransfersPause) external onlyRole(GOV_ROLE) {
    auctionStartTransfersPause = _auctionStartTransfersPause;
  }

  /**
   * @dev Pauses all contract functions except for upgrades.
   * Requirements:
   * - the caller must have the `SECURITY_COUNCIL_ROLE` from the pool factory.
   */
  function pause() external onlySecurityCouncil {
    _pause();
  }

  /**
   * @dev Unpauses all contract functions.
   * Requirements:
   * - the caller must have the `SECURITY_COUNCIL_ROLE`.
   */
  function unpause() external onlySecurityCouncil {
    _unpause();
  }

  modifier onlySecurityCouncil() {
    if (!poolFactory.hasRole(poolFactory.SECURITY_COUNCIL_ROLE(), msg.sender)) revert CallerIsNotSecurityCouncil();
    _;
  }

  modifier onlyPool() {
    if (msg.sender != address(pool)) revert CallerIsNotPool();
    _;
  }

  /**
   * @dev Function that should revert when `msg.sender` is not authorized to upgrade the contract.
   * Called by
   * {upgradeTo} and {upgradeToAndCall}.
   * @param newImplementation Address of the new implementation contract
   * @notice Can only be called by addresses with the GOV_ROLE.
   */
  function _authorizeUpgrade(address newImplementation) internal override onlyRole(GOV_ROLE) {}
}

// SPDX-License-Identifier: Unlicense
/*
 * @title Solidity Bytes Arrays Utils
 * @author Gonçalo Sá <goncalo.sa@consensys.net>
 *
 * @dev Bytes tightly packed arrays utility library for ethereum contracts written in Solidity.
 *      The library lets you concatenate, slice and type cast bytes arrays both in memory and storage.
 */
pragma solidity >=0.8.0 <0.9.0;


library BytesLib {
    function concat(
        bytes memory _preBytes,
        bytes memory _postBytes
    )
        internal
        pure
        returns (bytes memory)
    {
        bytes memory tempBytes;

        assembly {
            // Get a location of some free memory and store it in tempBytes as
            // Solidity does for memory variables.
            tempBytes := mload(0x40)

            // Store the length of the first bytes array at the beginning of
            // the memory for tempBytes.
            let length := mload(_preBytes)
            mstore(tempBytes, length)

            // Maintain a memory counter for the current write location in the
            // temp bytes array by adding the 32 bytes for the array length to
            // the starting location.
            let mc := add(tempBytes, 0x20)
            // Stop copying when the memory counter reaches the length of the
            // first bytes array.
            let end := add(mc, length)

            for {
                // Initialize a copy counter to the start of the _preBytes data,
                // 32 bytes into its memory.
                let cc := add(_preBytes, 0x20)
            } lt(mc, end) {
                // Increase both counters by 32 bytes each iteration.
                mc := add(mc, 0x20)
                cc := add(cc, 0x20)
            } {
                // Write the _preBytes data into the tempBytes memory 32 bytes
                // at a time.
                mstore(mc, mload(cc))
            }

            // Add the length of _postBytes to the current length of tempBytes
            // and store it as the new length in the first 32 bytes of the
            // tempBytes memory.
            length := mload(_postBytes)
            mstore(tempBytes, add(length, mload(tempBytes)))

            // Move the memory counter back from a multiple of 0x20 to the
            // actual end of the _preBytes data.
            mc := end
            // Stop copying when the memory counter reaches the new combined
            // length of the arrays.
            end := add(mc, length)

            for {
                let cc := add(_postBytes, 0x20)
            } lt(mc, end) {
                mc := add(mc, 0x20)
                cc := add(cc, 0x20)
            } {
                mstore(mc, mload(cc))
            }

            // Update the free-memory pointer by padding our last write location
            // to 32 bytes: add 31 bytes to the end of tempBytes to move to the
            // next 32 byte block, then round down to the nearest multiple of
            // 32. If the sum of the length of the two arrays is zero then add
            // one before rounding down to leave a blank 32 bytes (the length block with 0).
            mstore(0x40, and(
              add(add(end, iszero(add(length, mload(_preBytes)))), 31),
              not(31) // Round down to the nearest 32 bytes.
            ))
        }

        return tempBytes;
    }

    function concatStorage(bytes storage _preBytes, bytes memory _postBytes) internal {
        assembly {
            // Read the first 32 bytes of _preBytes storage, which is the length
            // of the array. (We don't need to use the offset into the slot
            // because arrays use the entire slot.)
            let fslot := sload(_preBytes.slot)
            // Arrays of 31 bytes or less have an even value in their slot,
            // while longer arrays have an odd value. The actual length is
            // the slot divided by two for odd values, and the lowest order
            // byte divided by two for even values.
            // If the slot is even, bitwise and the slot with 255 and divide by
            // two to get the length. If the slot is odd, bitwise and the slot
            // with -1 and divide by two.
            let slength := div(and(fslot, sub(mul(0x100, iszero(and(fslot, 1))), 1)), 2)
            let mlength := mload(_postBytes)
            let newlength := add(slength, mlength)
            // slength can contain both the length and contents of the array
            // if length < 32 bytes so let's prepare for that
            // v. http://solidity.readthedocs.io/en/latest/miscellaneous.html#layout-of-state-variables-in-storage
            switch add(lt(slength, 32), lt(newlength, 32))
            case 2 {
                // Since the new array still fits in the slot, we just need to
                // update the contents of the slot.
                // uint256(bytes_storage) = uint256(bytes_storage) + uint256(bytes_memory) + new_length
                sstore(
                    _preBytes.slot,
                    // all the modifications to the slot are inside this
                    // next block
                    add(
                        // we can just add to the slot contents because the
                        // bytes we want to change are the LSBs
                        fslot,
                        add(
                            mul(
                                div(
                                    // load the bytes from memory
                                    mload(add(_postBytes, 0x20)),
                                    // zero all bytes to the right
                                    exp(0x100, sub(32, mlength))
                                ),
                                // and now shift left the number of bytes to
                                // leave space for the length in the slot
                                exp(0x100, sub(32, newlength))
                            ),
                            // increase length by the double of the memory
                            // bytes length
                            mul(mlength, 2)
                        )
                    )
                )
            }
            case 1 {
                // The stored value fits in the slot, but the combined value
                // will exceed it.
                // get the keccak hash to get the contents of the array
                mstore(0x0, _preBytes.slot)
                let sc := add(keccak256(0x0, 0x20), div(slength, 32))

                // save new length
                sstore(_preBytes.slot, add(mul(newlength, 2), 1))

                // The contents of the _postBytes array start 32 bytes into
                // the structure. Our first read should obtain the `submod`
                // bytes that can fit into the unused space in the last word
                // of the stored array. To get this, we read 32 bytes starting
                // from `submod`, so the data we read overlaps with the array
                // contents by `submod` bytes. Masking the lowest-order
                // `submod` bytes allows us to add that value directly to the
                // stored value.

                let submod := sub(32, slength)
                let mc := add(_postBytes, submod)
                let end := add(_postBytes, mlength)
                let mask := sub(exp(0x100, submod), 1)

                sstore(
                    sc,
                    add(
                        and(
                            fslot,
                            0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff00
                        ),
                        and(mload(mc), mask)
                    )
                )

                for {
                    mc := add(mc, 0x20)
                    sc := add(sc, 1)
                } lt(mc, end) {
                    sc := add(sc, 1)
                    mc := add(mc, 0x20)
                } {
                    sstore(sc, mload(mc))
                }

                mask := exp(0x100, sub(mc, end))

                sstore(sc, mul(div(mload(mc), mask), mask))
            }
            default {
                // get the keccak hash to get the contents of the array
                mstore(0x0, _preBytes.slot)
                // Start copying to the last used word of the stored array.
                let sc := add(keccak256(0x0, 0x20), div(slength, 32))

                // save new length
                sstore(_preBytes.slot, add(mul(newlength, 2), 1))

                // Copy over the first `submod` bytes of the new data as in
                // case 1 above.
                let slengthmod := mod(slength, 32)
                let mlengthmod := mod(mlength, 32)
                let submod := sub(32, slengthmod)
                let mc := add(_postBytes, submod)
                let end := add(_postBytes, mlength)
                let mask := sub(exp(0x100, submod), 1)

                sstore(sc, add(sload(sc), and(mload(mc), mask)))

                for {
                    sc := add(sc, 1)
                    mc := add(mc, 0x20)
                } lt(mc, end) {
                    sc := add(sc, 1)
                    mc := add(mc, 0x20)
                } {
                    sstore(sc, mload(mc))
                }

                mask := exp(0x100, sub(mc, end))

                sstore(sc, mul(div(mload(mc), mask), mask))
            }
        }
    }

    function slice(
        bytes memory _bytes,
        uint256 _start,
        uint256 _length
    )
        internal
        pure
        returns (bytes memory)
    {
        require(_length + 31 >= _length, "slice_overflow");
        require(_bytes.length >= _start + _length, "slice_outOfBounds");

        bytes memory tempBytes;

        assembly {
            switch iszero(_length)
            case 0 {
                // Get a location of some free memory and store it in tempBytes as
                // Solidity does for memory variables.
                tempBytes := mload(0x40)

                // The first word of the slice result is potentially a partial
                // word read from the original array. To read it, we calculate
                // the length of that partial word and start copying that many
                // bytes into the array. The first word we copy will start with
                // data we don't care about, but the last `lengthmod` bytes will
                // land at the beginning of the contents of the new array. When
                // we're done copying, we overwrite the full first word with
                // the actual length of the slice.
                let lengthmod := and(_length, 31)

                // The multiplication in the next line is necessary
                // because when slicing multiples of 32 bytes (lengthmod == 0)
                // the following copy loop was copying the origin's length
                // and then ending prematurely not copying everything it should.
                let mc := add(add(tempBytes, lengthmod), mul(0x20, iszero(lengthmod)))
                let end := add(mc, _length)

                for {
                    // The multiplication in the next line has the same exact purpose
                    // as the one above.
                    let cc := add(add(add(_bytes, lengthmod), mul(0x20, iszero(lengthmod))), _start)
                } lt(mc, end) {
                    mc := add(mc, 0x20)
                    cc := add(cc, 0x20)
                } {
                    mstore(mc, mload(cc))
                }

                mstore(tempBytes, _length)

                //update free-memory pointer
                //allocating the array padded to 32 bytes like the compiler does now
                mstore(0x40, and(add(mc, 31), not(31)))
            }
            //if we want a zero-length slice let's just return a zero-length array
            default {
                tempBytes := mload(0x40)
                //zero out the 32 bytes slice we are about to return
                //we need to do it because Solidity does not garbage collect
                mstore(tempBytes, 0)

                mstore(0x40, add(tempBytes, 0x20))
            }
        }

        return tempBytes;
    }

    function toAddress(bytes memory _bytes, uint256 _start) internal pure returns (address) {
        require(_bytes.length >= _start + 20, "toAddress_outOfBounds");
        address tempAddress;

        assembly {
            tempAddress := div(mload(add(add(_bytes, 0x20), _start)), 0x1000000000000000000000000)
        }

        return tempAddress;
    }

    function toUint8(bytes memory _bytes, uint256 _start) internal pure returns (uint8) {
        require(_bytes.length >= _start + 1 , "toUint8_outOfBounds");
        uint8 tempUint;

        assembly {
            tempUint := mload(add(add(_bytes, 0x1), _start))
        }

        return tempUint;
    }

    function toUint16(bytes memory _bytes, uint256 _start) internal pure returns (uint16) {
        require(_bytes.length >= _start + 2, "toUint16_outOfBounds");
        uint16 tempUint;

        assembly {
            tempUint := mload(add(add(_bytes, 0x2), _start))
        }

        return tempUint;
    }

    function toUint32(bytes memory _bytes, uint256 _start) internal pure returns (uint32) {
        require(_bytes.length >= _start + 4, "toUint32_outOfBounds");
        uint32 tempUint;

        assembly {
            tempUint := mload(add(add(_bytes, 0x4), _start))
        }

        return tempUint;
    }

    function toUint64(bytes memory _bytes, uint256 _start) internal pure returns (uint64) {
        require(_bytes.length >= _start + 8, "toUint64_outOfBounds");
        uint64 tempUint;

        assembly {
            tempUint := mload(add(add(_bytes, 0x8), _start))
        }

        return tempUint;
    }

    function toUint96(bytes memory _bytes, uint256 _start) internal pure returns (uint96) {
        require(_bytes.length >= _start + 12, "toUint96_outOfBounds");
        uint96 tempUint;

        assembly {
            tempUint := mload(add(add(_bytes, 0xc), _start))
        }

        return tempUint;
    }

    function toUint128(bytes memory _bytes, uint256 _start) internal pure returns (uint128) {
        require(_bytes.length >= _start + 16, "toUint128_outOfBounds");
        uint128 tempUint;

        assembly {
            tempUint := mload(add(add(_bytes, 0x10), _start))
        }

        return tempUint;
    }

    function toUint256(bytes memory _bytes, uint256 _start) internal pure returns (uint256) {
        require(_bytes.length >= _start + 32, "toUint256_outOfBounds");
        uint256 tempUint;

        assembly {
            tempUint := mload(add(add(_bytes, 0x20), _start))
        }

        return tempUint;
    }

    function toBytes32(bytes memory _bytes, uint256 _start) internal pure returns (bytes32) {
        require(_bytes.length >= _start + 32, "toBytes32_outOfBounds");
        bytes32 tempBytes32;

        assembly {
            tempBytes32 := mload(add(add(_bytes, 0x20), _start))
        }

        return tempBytes32;
    }

    function equal(bytes memory _preBytes, bytes memory _postBytes) internal pure returns (bool) {
        bool success = true;

        assembly {
            let length := mload(_preBytes)

            // if lengths don't match the arrays are not equal
            switch eq(length, mload(_postBytes))
            case 1 {
                // cb is a circuit breaker in the for loop since there's
                //  no said feature for inline assembly loops
                // cb = 1 - don't breaker
                // cb = 0 - break
                let cb := 1

                let mc := add(_preBytes, 0x20)
                let end := add(mc, length)

                for {
                    let cc := add(_postBytes, 0x20)
                // the next line is the loop condition:
                // while(uint256(mc < end) + cb == 2)
                } eq(add(lt(mc, end), cb), 2) {
                    mc := add(mc, 0x20)
                    cc := add(cc, 0x20)
                } {
                    // if any of these checks fails then arrays are not equal
                    if iszero(eq(mload(mc), mload(cc))) {
                        // unsuccess:
                        success := 0
                        cb := 0
                    }
                }
            }
            default {
                // unsuccess:
                success := 0
            }
        }

        return success;
    }

    function equal_nonAligned(bytes memory _preBytes, bytes memory _postBytes) internal pure returns (bool) {
        bool success = true;

        assembly {
            let length := mload(_preBytes)

            // if lengths don't match the arrays are not equal
            switch eq(length, mload(_postBytes))
            case 1 {
                // cb is a circuit breaker in the for loop since there's
                //  no said feature for inline assembly loops
                // cb = 1 - don't breaker
                // cb = 0 - break
                let cb := 1

                let endMinusWord := add(_preBytes, length)
                let mc := add(_preBytes, 0x20)
                let cc := add(_postBytes, 0x20)

                for {
                // the next line is the loop condition:
                // while(uint256(mc < endWord) + cb == 2)
                } eq(add(lt(mc, endMinusWord), cb), 2) {
                    mc := add(mc, 0x20)
                    cc := add(cc, 0x20)
                } {
                    // if any of these checks fails then arrays are not equal
                    if iszero(eq(mload(mc), mload(cc))) {
                        // unsuccess:
                        success := 0
                        cb := 0
                    }
                }

                // Only if still successful
                // For <1 word tail bytes
                if gt(success, 0) {
                    // Get the remainder of length/32
                    // length % 32 = AND(length, 32 - 1)
                    let numTailBytes := and(length, 0x1f)
                    let mcRem := mload(mc)
                    let ccRem := mload(cc)
                    for {
                        let i := 0
                    // the next line is the loop condition:
                    // while(uint256(i < numTailBytes) + cb == 2)
                    } eq(add(lt(i, numTailBytes), cb), 2) {
                        i := add(i, 1)
                    } {
                        if iszero(eq(byte(i, mcRem), byte(i, ccRem))) {
                            // unsuccess:
                            success := 0
                            cb := 0
                        }
                    }
                }
            }
            default {
                // unsuccess:
                success := 0
            }
        }

        return success;
    }

    function equalStorage(
        bytes storage _preBytes,
        bytes memory _postBytes
    )
        internal
        view
        returns (bool)
    {
        bool success = true;

        assembly {
            // we know _preBytes_offset is 0
            let fslot := sload(_preBytes.slot)
            // Decode the length of the stored array like in concatStorage().
            let slength := div(and(fslot, sub(mul(0x100, iszero(and(fslot, 1))), 1)), 2)
            let mlength := mload(_postBytes)

            // if lengths don't match the arrays are not equal
            switch eq(slength, mlength)
            case 1 {
                // slength can contain both the length and contents of the array
                // if length < 32 bytes so let's prepare for that
                // v. http://solidity.readthedocs.io/en/latest/miscellaneous.html#layout-of-state-variables-in-storage
                if iszero(iszero(slength)) {
                    switch lt(slength, 32)
                    case 1 {
                        // blank the last byte which is the length
                        fslot := mul(div(fslot, 0x100), 0x100)

                        if iszero(eq(fslot, mload(add(_postBytes, 0x20)))) {
                            // unsuccess:
                            success := 0
                        }
                    }
                    default {
                        // cb is a circuit breaker in the for loop since there's
                        //  no said feature for inline assembly loops
                        // cb = 1 - don't breaker
                        // cb = 0 - break
                        let cb := 1

                        // get the keccak hash to get the contents of the array
                        mstore(0x0, _preBytes.slot)
                        let sc := keccak256(0x0, 0x20)

                        let mc := add(_postBytes, 0x20)
                        let end := add(mc, mlength)

                        // the next line is the loop condition:
                        // while(uint256(mc < end) + cb == 2)
                        for {} eq(add(lt(mc, end), cb), 2) {
                            sc := add(sc, 1)
                            mc := add(mc, 0x20)
                        } {
                            if iszero(eq(sload(sc), mload(mc))) {
                                // unsuccess:
                                success := 0
                                cb := 0
                            }
                        }
                    }
                }
            }
            default {
                // unsuccess:
                success := 0
            }
        }

        return success;
    }
}

// SPDX-License-Identifier: LZBL-1.2

pragma solidity ^0.8.20;

library CalldataBytesLib {
    function toU8(bytes calldata _bytes, uint256 _start) internal pure returns (uint8) {
        return uint8(_bytes[_start]);
    }

    function toU16(bytes calldata _bytes, uint256 _start) internal pure returns (uint16) {
        unchecked {
            uint256 end = _start + 2;
            return uint16(bytes2(_bytes[_start:end]));
        }
    }

    function toU32(bytes calldata _bytes, uint256 _start) internal pure returns (uint32) {
        unchecked {
            uint256 end = _start + 4;
            return uint32(bytes4(_bytes[_start:end]));
        }
    }

    function toU64(bytes calldata _bytes, uint256 _start) internal pure returns (uint64) {
        unchecked {
            uint256 end = _start + 8;
            return uint64(bytes8(_bytes[_start:end]));
        }
    }

    function toU128(bytes calldata _bytes, uint256 _start) internal pure returns (uint128) {
        unchecked {
            uint256 end = _start + 16;
            return uint128(bytes16(_bytes[_start:end]));
        }
    }

    function toU256(bytes calldata _bytes, uint256 _start) internal pure returns (uint256) {
        unchecked {
            uint256 end = _start + 32;
            return uint256(bytes32(_bytes[_start:end]));
        }
    }

    function toAddr(bytes calldata _bytes, uint256 _start) internal pure returns (address) {
        unchecked {
            uint256 end = _start + 20;
            return address(bytes20(_bytes[_start:end]));
        }
    }

    function toB32(bytes calldata _bytes, uint256 _start) internal pure returns (bytes32) {
        unchecked {
            uint256 end = _start + 32;
            return bytes32(_bytes[_start:end]);
        }
    }
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

// End consumer library.
library Client {
  /// @dev RMN depends on this struct, if changing, please notify the RMN maintainers.
  struct EVMTokenAmount {
    address token; // token address on the local chain.
    uint256 amount; // Amount of tokens.
  }

  struct Any2EVMMessage {
    bytes32 messageId; // MessageId corresponding to ccipSend on source.
    uint64 sourceChainSelector; // Source chain selector.
    bytes sender; // abi.decode(sender) if coming from an EVM chain.
    bytes data; // payload sent in original message.
    EVMTokenAmount[] destTokenAmounts; // Tokens and their amounts in their destination chain representation.
  }

  // If extraArgs is empty bytes, the default is 200k gas limit.
  struct EVM2AnyMessage {
    bytes receiver; // abi.encode(receiver address) for dest EVM chains.
    bytes data; // Data payload.
    EVMTokenAmount[] tokenAmounts; // Token transfers.
    address feeToken; // Address of feeToken. address(0) means you will send msg.value.
    bytes extraArgs; // Populate this with _argsToBytes(EVMExtraArgsV2).
  }

  // Tag to indicate only a gas limit. Only usable for EVM as destination chain.
  bytes4 public constant EVM_EXTRA_ARGS_V1_TAG = 0x97a657c9;

  struct EVMExtraArgsV1 {
    uint256 gasLimit;
  }

  function _argsToBytes(
    EVMExtraArgsV1 memory extraArgs
  ) internal pure returns (bytes memory bts) {
    return abi.encodeWithSelector(EVM_EXTRA_ARGS_V1_TAG, extraArgs);
  }

  // Tag to indicate a gas limit (or dest chain equivalent processing units) and Out Of Order Execution. This tag is
  // available for multiple chain families. If there is no chain family specific tag, this is the default available
  // for a chain.
  // Note: not available for Solana VM based chains.
  bytes4 public constant GENERIC_EXTRA_ARGS_V2_TAG = 0x181dcf10;

  /// @param gasLimit: gas limit for the callback on the destination chain.
  /// @param allowOutOfOrderExecution: if true, it indicates that the message can be executed in any order relative to
  /// other messages from the same sender. This value's default varies by chain. On some chains, a particular value is
  /// enforced, meaning if the expected value is not set, the message request will revert.
  /// @dev Fully compatible with the previously existing EVMExtraArgsV2.
  struct GenericExtraArgsV2 {
    uint256 gasLimit;
    bool allowOutOfOrderExecution;
  }

  // Extra args tag for chains that use the Solana VM.
  bytes4 public constant SVM_EXTRA_ARGS_V1_TAG = 0x1f3b3aba;

  struct SVMExtraArgsV1 {
    uint32 computeUnits;
    uint64 accountIsWritableBitmap;
    bool allowOutOfOrderExecution;
    bytes32 tokenReceiver;
    bytes32[] accounts;
  }

  /// @dev The maximum number of accounts that can be passed in SVMExtraArgs.
  uint256 public constant SVM_EXTRA_ARGS_MAX_ACCOUNTS = 64;

  function _argsToBytes(
    GenericExtraArgsV2 memory extraArgs
  ) internal pure returns (bytes memory bts) {
    return abi.encodeWithSelector(GENERIC_EXTRA_ARGS_V2_TAG, extraArgs);
  }

  function _svmArgsToBytes(
    SVMExtraArgsV1 memory extraArgs
  ) internal pure returns (bytes memory bts) {
    return abi.encodeWithSelector(SVM_EXTRA_ARGS_V1_TAG, extraArgs);
  }
}

// SPDX-License-Identifier: MIT
// OpenZeppelin Contracts (last updated v5.0.1) (utils/Context.sol)

pragma solidity ^0.8.20;

/**
 * @dev Provides information about the current execution context, including the
 * sender of the transaction and its data. While these are generally available
 * via msg.sender and msg.data, they should not be accessed in such a direct
 * manner, since when dealing with meta-transactions the account sending and
 * paying for execution may not be the actual sender (as far as an application
 * is concerned).
 *
 * This contract is only required for intermediate, library-like contracts.
 */
abstract contract Context {
    function _msgSender() internal view virtual returns (address) {
        return msg.sender;
    }

    function _msgData() internal view virtual returns (bytes calldata) {
        return msg.data;
    }

    function _contextSuffixLength() internal view virtual returns (uint256) {
        return 0;
    }
}

// SPDX-License-Identifier: MIT
// OpenZeppelin Contracts (last updated v5.0.1) (utils/Context.sol)

pragma solidity ^0.8.20;
import {Initializable} from "../proxy/utils/Initializable.sol";

/**
 * @dev Provides information about the current execution context, including the
 * sender of the transaction and its data. While these are generally available
 * via msg.sender and msg.data, they should not be accessed in such a direct
 * manner, since when dealing with meta-transactions the account sending and
 * paying for execution may not be the actual sender (as far as an application
 * is concerned).
 *
 * This contract is only required for intermediate, library-like contracts.
 */
abstract contract ContextUpgradeable is Initializable {
    function __Context_init() internal onlyInitializing {
    }

    function __Context_init_unchained() internal onlyInitializing {
    }
    function _msgSender() internal view virtual returns (address) {
        return msg.sender;
    }

    function _msgData() internal view virtual returns (bytes calldata) {
        return msg.data;
    }

    function _contextSuffixLength() internal view virtual returns (uint256) {
        return 0;
    }
}

//SPDX-License-Identifier: Unlicense
pragma solidity ^0.8.0;

/**
  @title A library for deploying contracts EIP-3171 style.
  @author Agustin Aguilar <aa@horizon.io>
*/
library Create3 {
  error ErrorCreatingProxy();
  error ErrorCreatingContract();
  error TargetAlreadyExists();

  /**
    @notice The bytecode for a contract that proxies the creation of another contract
    @dev If this code is deployed using CREATE2 it can be used to decouple `creationCode` from the child contract address

  0x67363d3d37363d34f03d5260086018f3:
      0x00  0x67  0x67XXXXXXXXXXXXXXXX  PUSH8 bytecode  0x363d3d37363d34f0
      0x01  0x3d  0x3d                  RETURNDATASIZE  0 0x363d3d37363d34f0
      0x02  0x52  0x52                  MSTORE
      0x03  0x60  0x6008                PUSH1 08        8
      0x04  0x60  0x6018                PUSH1 18        24 8
      0x05  0xf3  0xf3                  RETURN

  0x363d3d37363d34f0:
      0x00  0x36  0x36                  CALLDATASIZE    cds
      0x01  0x3d  0x3d                  RETURNDATASIZE  0 cds
      0x02  0x3d  0x3d                  RETURNDATASIZE  0 0 cds
      0x03  0x37  0x37                  CALLDATACOPY
      0x04  0x36  0x36                  CALLDATASIZE    cds
      0x05  0x3d  0x3d                  RETURNDATASIZE  0 cds
      0x06  0x34  0x34                  CALLVALUE       val 0 cds
      0x07  0xf0  0xf0                  CREATE          addr
  */
  
  bytes internal constant PROXY_CHILD_BYTECODE = hex"67_36_3d_3d_37_36_3d_34_f0_3d_52_60_08_60_18_f3";

  //                        KECCAK256_PROXY_CHILD_BYTECODE = keccak256(PROXY_CHILD_BYTECODE);
  bytes32 internal constant KECCAK256_PROXY_CHILD_BYTECODE = 0x21c35dbe1b344a2488cf3321d6ce542f8e9f305544ff09e4993a62319a497c1f;

  /**
    @notice Returns the size of the code on a given address
    @param _addr Address that may or may not contain code
    @return size of the code on the given `_addr`
  */
  function codeSize(address _addr) internal view returns (uint256 size) {
    assembly { size := extcodesize(_addr) }
  }

  /**
    @notice Creates a new contract with given `_creationCode` and `_salt`
    @param _salt Salt of the contract creation, resulting address will be derivated from this value only
    @param _creationCode Creation code (constructor) of the contract to be deployed, this value doesn't affect the resulting address
    @return addr of the deployed contract, reverts on error
  */
  function create3(bytes32 _salt, bytes memory _creationCode) internal returns (address addr) {
    return create3(_salt, _creationCode, 0);
  }

  /**
    @notice Creates a new contract with given `_creationCode` and `_salt`
    @param _salt Salt of the contract creation, resulting address will be derivated from this value only
    @param _creationCode Creation code (constructor) of the contract to be deployed, this value doesn't affect the resulting address
    @param _value In WEI of ETH to be forwarded to child contract
    @return addr of the deployed contract, reverts on error
  */
  function create3(bytes32 _salt, bytes memory _creationCode, uint256 _value) internal returns (address addr) {
    // Creation code
    bytes memory creationCode = PROXY_CHILD_BYTECODE;

    // Get target final address
    addr = addressOf(_salt);
    if (codeSize(addr) != 0) revert TargetAlreadyExists();

    // Create CREATE2 proxy
    address proxy; assembly { proxy := create2(0, add(creationCode, 32), mload(creationCode), _salt)}
    if (proxy == address(0)) revert ErrorCreatingProxy();

    // Call proxy with final init code
    (bool success,) = proxy.call{ value: _value }(_creationCode);
    if (!success || codeSize(addr) == 0) revert ErrorCreatingContract();
  }

  /**
    @notice Computes the resulting address of a contract deployed using address(this) and the given `_salt`
    @param _salt Salt of the contract creation, resulting address will be derivated from this value only
    @return addr of the deployed contract, reverts on error

    @dev The address creation formula is: keccak256(rlp([keccak256(0xff ++ address(this) ++ _salt ++ keccak256(childBytecode))[12:], 0x01]))
  */
  function addressOf(bytes32 _salt) internal view returns (address) {
    address proxy = address(
      uint160(
        uint256(
          keccak256(
            abi.encodePacked(
              hex'ff',
              address(this),
              _salt,
              KECCAK256_PROXY_CHILD_BYTECODE
            )
          )
        )
      )
    );

    return address(
      uint160(
        uint256(
          keccak256(
            abi.encodePacked(
              hex"d6_94",
              proxy,
              hex"01"
            )
          )
        )
      )
    );
  }
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

import {Pool} from "../Pool.sol";
import {PoolFactory} from "../PoolFactory.sol";
import {BondToken} from "../BondToken.sol";
import {Decimals} from "../lib/Decimals.sol";
import {BondBaseOftAdapter} from "./BondBaseOftAdapter.sol";
import {Initializable} from "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol";
import {UUPSUpgradeable} from "@openzeppelin/contracts-upgradeable/proxy/utils/UUPSUpgradeable.sol";
import {PausableUpgradeable} from "@openzeppelin/contracts-upgradeable/utils/PausableUpgradeable.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {EnforcedOptionParam} from "@layerzerolabs/oapp-evm/contracts/oapp/libs/OAppOptionsType3.sol";
import {IRouterClient} from "@chainlink/contracts/src/v0.8/ccip/interfaces/IRouterClient.sol";
import {Client} from "@chainlink/contracts/src/v0.8/ccip/libraries/Client.sol";

contract CrossChainController is Initializable, UUPSUpgradeable, PausableUpgradeable {
  using Decimals for uint256;

  uint256 private constant CCIP_DESTINATION_GAS_LIMIT = 150_000;

  struct PoolCrossChainConfig {
    address bondOftAdapter;
    uint256[] supportedChainIds;
    mapping(uint256 => address) remoteDistributors;
  }

  PoolFactory public poolFactory;
  IERC20 private usdc;
  IRouterClient private ccipRouter;

  /// @dev Mapping to store pool cross chain configs
  mapping(address => PoolCrossChainConfig) public poolCrossChainConfigs;
  mapping(uint256 => uint32) public chainIdToLzEid;
  mapping(uint256 => uint64) public chainIdToCcipChainSelector;

  error OnlyGovernance();
  error AddOftAdapterFirst();
  error OnlyPool();
  error OnlyPoolOrGovernance();
  error NotEnoughBridgingFees(uint256 available, uint256 required);

  event CrossChainSupportAdded(
    address indexed pool, address bondOftAdapter, uint256 chainId, uint32 lzEid, address remoteDistributor
  );

  event CrossChainSupportExtended(address indexed pool, uint256 chainId, uint32 lzEid, address remoteDistributor);
  event CrossChainSupportRemoved(address indexed pool, uint256 chainId);
  event AllCrossChainSupportRemoved(address indexed pool);
  event UsdcSentToRemoteDistributor(bytes32 messageId, uint256 chainId, address remoteDistributor, uint256 usdcAmount);
  /// @custom:oz-upgrades-unsafe-allow constructor

  constructor() {
    _disableInitializers();
  }

  function initialize(address _poolFactory, address _usdc, address _ccipRouter) external initializer {
    poolFactory = PoolFactory(_poolFactory);
    usdc = IERC20(_usdc);
    ccipRouter = IRouterClient(_ccipRouter);
  }

  function increaseIndexedAssetPeriodForRemotes(uint256 sharesPerToken) external {
    address pool = msg.sender;
    if (!_isValidPool(pool)) revert OnlyPool();

    PoolCrossChainConfig storage config = poolCrossChainConfigs[pool];
    if (config.bondOftAdapter == address(0)) return; // Not configured for cross-chain

    // For each supported chain, send the message
    uint256[] memory supportedChains = config.supportedChainIds;
    for (uint256 i = 0; i < supportedChains.length; i++) {
      uint256 chainId = supportedChains[i];
      BondBaseOftAdapter(payable(config.bondOftAdapter)).increasePeriodForRemote(
        sharesPerToken, chainIdToLzEid[chainId], config.remoteDistributors[chainId]
      );
    }
  }

  function zeroLastSharesPerTokenForRemotes() external {
    address pool = msg.sender;
    if (!_isValidPool(pool)) revert OnlyPool();

    PoolCrossChainConfig storage config = poolCrossChainConfigs[pool];
    if (config.bondOftAdapter == address(0)) return; // Not configured for cross-chain

    // For each supported chain, send the message
    uint256[] memory supportedChains = config.supportedChainIds;
    for (uint256 i = 0; i < supportedChains.length; i++) {
      uint256 chainId = supportedChains[i];
      BondBaseOftAdapter(payable(config.bondOftAdapter)).zeroLastSharesForRemotes(
        chainIdToLzEid[chainId], config.remoteDistributors[chainId]
      );
    }
  }

  /**
   * @dev Pool will send USDC first, and then call this function with a low level call. This means that if it fails,
   * usdc is temporarily stuck here. We allow this to be called by governance for retry
   */
  function sendUsdcToRemoteDistributors(address pool) external {
    if (!_isValidPool(msg.sender) && !poolFactory.hasRole(poolFactory.GOV_ROLE(), _msgSender())) {
      revert OnlyPoolOrGovernance();
    }

    PoolCrossChainConfig storage config = poolCrossChainConfigs[pool];
    if (config.bondOftAdapter == address(0)) return; // Not configured for cross-chain

    // For each supported chain, send USDC via CCIP
    uint256[] memory supportedChains = config.supportedChainIds;
    for (uint256 i = 0; i < supportedChains.length; i++) {
      uint256 chainId = supportedChains[i];
      uint64 destinationChainSelector = chainIdToCcipChainSelector[chainId];
      address remoteDistributor = config.remoteDistributors[chainId];

      // Calculate USDC amount for this chain
      uint256 usdcAmount = _getUsdcAmountForChain(pool, chainId);
      if (usdcAmount == 0) continue; // Skip if no USDC to send

      Client.EVM2AnyMessage memory message = _buildCCIPMessage(remoteDistributor, usdcAmount);
      uint256 fees = ccipRouter.getFee(destinationChainSelector, message);
      if (fees > address(this).balance) revert NotEnoughBridgingFees(address(this).balance, fees);

      // Approve and send
      usdc.approve(address(ccipRouter), usdcAmount);
      bytes32 messageId = ccipRouter.ccipSend(destinationChainSelector, message);

      emit UsdcSentToRemoteDistributor(messageId, chainId, remoteDistributor, usdcAmount);
    }
  }

  function addCrossChainSupport(
    address _pool,
    address _bondOftAdapter,
    uint256 _supportedChainId,
    uint32 _supportedLzEid,
    uint64 _supportedCcipChainSelector,
    address _remoteDistributor
  ) external onlyGovernance {
    PoolCrossChainConfig storage config = poolCrossChainConfigs[_pool];

    config.bondOftAdapter = _bondOftAdapter;

    config.supportedChainIds.push(_supportedChainId);
    config.remoteDistributors[_supportedChainId] = _remoteDistributor;

    // Map chain IDs to third party mappings for chains
    chainIdToLzEid[_supportedChainId] = _supportedLzEid;
    chainIdToCcipChainSelector[_supportedChainId] = _supportedCcipChainSelector;

    emit CrossChainSupportAdded(_pool, _bondOftAdapter, _supportedChainId, _supportedLzEid, _remoteDistributor);
  }

  function extendCrossChainSupport(
    address _pool,
    uint256 _supportedChainId,
    uint32 _supportedLzEid,
    uint64 _supportedCcipChainSelector,
    address _remoteDistributor
  ) external onlyGovernance {
    PoolCrossChainConfig storage config = poolCrossChainConfigs[_pool];
    if (config.bondOftAdapter == address(0)) revert AddOftAdapterFirst();

    // Add the chain ID and remote distributor
    config.supportedChainIds.push(_supportedChainId);
    config.remoteDistributors[_supportedChainId] = _remoteDistributor;

    // Map chain IDs to third party mappings for chains
    chainIdToLzEid[_supportedChainId] = _supportedLzEid;
    chainIdToCcipChainSelector[_supportedChainId] = _supportedCcipChainSelector;

    emit CrossChainSupportExtended(_pool, _supportedChainId, _supportedLzEid, _remoteDistributor);
  }

  function removeCrossChainSupport(address _pool, uint256 _supportedChainId) external onlyGovernance {
    PoolCrossChainConfig storage config = poolCrossChainConfigs[_pool];

    // Remove the chain ID from the array
    uint256[] storage chainIds = config.supportedChainIds;
    for (uint256 i = 0; i < chainIds.length; i++) {
      if (chainIds[i] == _supportedChainId) {
        chainIds[i] = chainIds[chainIds.length - 1];
        chainIds.pop();
        break;
      }
    }

    // Clear the remote distributor mapping for this chain
    delete config.remoteDistributors[_supportedChainId];

    // Clear the chain ID mappings
    delete chainIdToLzEid[_supportedChainId];
    delete chainIdToCcipChainSelector[_supportedChainId];

    emit CrossChainSupportRemoved(_pool, _supportedChainId);
  }

  function removeAllCrossChainSupport(address _pool) external onlyGovernance {
    PoolCrossChainConfig storage config = poolCrossChainConfigs[_pool];

    // Clear chain ID mappings and remote distributors
    for (uint256 i = 0; i < config.supportedChainIds.length; i++) {
      uint256 chainId = config.supportedChainIds[i];
      delete config.remoteDistributors[chainId];
      delete chainIdToLzEid[chainId];
      delete chainIdToCcipChainSelector[chainId];
    }

    // Clear the array and addresses
    delete config.supportedChainIds;
    delete config.bondOftAdapter;

    emit AllCrossChainSupportRemoved(_pool);
  }

  function getSupportedChains(address _pool) external view returns (uint256[] memory) {
    return poolCrossChainConfigs[_pool].supportedChainIds;
  }

  function getRemoteDistributionAmountForPool(address _pool) external view returns (uint256) {
    uint256[] memory supportedChains = poolCrossChainConfigs[_pool].supportedChainIds;
    uint256 totalAmount = 0;
    for (uint256 i = 0; i < supportedChains.length; i++) {
      totalAmount += _getUsdcAmountForChain(_pool, supportedChains[i]);
    }
    return totalAmount;
  }

  function _getUsdcAmountForChain(address _pool, uint256 _chainId) internal view returns (uint256) {
    // Get remote balance from the BondBaseOftAdapter
    PoolCrossChainConfig storage config = poolCrossChainConfigs[_pool];
    uint32 lzEid = chainIdToLzEid[_chainId];

    BondToken bondToken = Pool(_pool).bondToken();
    BondToken.PoolAmount[] memory previousPoolAmounts = bondToken.getPreviousPoolAmounts();
    uint256 sharesPerToken = previousPoolAmounts[previousPoolAmounts.length - 1].sharesPerToken;

    // Get snapshot balance
    uint256 snapshotBalance = BondBaseOftAdapter(payable(config.bondOftAdapter)).snapshotBalance(lzEid);

    uint256 amount = (sharesPerToken * snapshotBalance).normalizeAmount(
      bondToken.decimals() + bondToken.SHARES_DECIMALS(), bondToken.SHARES_DECIMALS()
    );

    // Return the snapshot amount
    return amount;
  }

  function _buildCCIPMessage(address _receiver, uint256 _usdcAmount)
    private
    view
    returns (Client.EVM2AnyMessage memory)
  {
    Client.EVMTokenAmount[] memory tokenAmounts;
    if (_usdcAmount == 0) {
      tokenAmounts = new Client.EVMTokenAmount[](0);
    } else {
      tokenAmounts = new Client.EVMTokenAmount[](1);
      tokenAmounts[0] = Client.EVMTokenAmount({token: address(usdc), amount: _usdcAmount});
    }

    return Client.EVM2AnyMessage({
      receiver: abi.encode(_receiver),
      data: bytes(""),
      tokenAmounts: tokenAmounts,
      extraArgs: Client._argsToBytes(Client.EVMExtraArgsV1({gasLimit: CCIP_DESTINATION_GAS_LIMIT})),
      feeToken: address(0)
    });
  }

  function _isValidPool(address _pool) internal view returns (bool) {
    uint256 numberOfPools = poolFactory.poolsLength();
    for (uint256 i = 0; i < numberOfPools; i++) {
      if (poolFactory.pools(i) == _pool) return true;
    }
    return false;
  }

  modifier onlyGovernance() {
    if (!poolFactory.hasRole(poolFactory.GOV_ROLE(), _msgSender())) revert OnlyGovernance();
    _;
  }

  function _authorizeUpgrade(address newImplementation) internal override onlyGovernance {}
}

// SPDX-License-Identifier: LZBL-1.2

pragma solidity ^0.8.20;

import { BytesLib } from "solidity-bytes-utils/contracts/BytesLib.sol";

import { BitMap256 } from "@layerzerolabs/lz-evm-protocol-v2/contracts/messagelib/libs/BitMaps.sol";
import { CalldataBytesLib } from "@layerzerolabs/lz-evm-protocol-v2/contracts/libs/CalldataBytesLib.sol";

library DVNOptions {
    using CalldataBytesLib for bytes;
    using BytesLib for bytes;

    uint8 internal constant WORKER_ID = 2;
    uint8 internal constant OPTION_TYPE_PRECRIME = 1;

    error DVN_InvalidDVNIdx();
    error DVN_InvalidDVNOptions(uint256 cursor);

    /// @dev group dvn options by its idx
    /// @param _options [dvn_id][dvn_option][dvn_id][dvn_option]...
    ///        dvn_option = [option_size][dvn_idx][option_type][option]
    ///        option_size = len(dvn_idx) + len(option_type) + len(option)
    ///        dvn_id: uint8, dvn_idx: uint8, option_size: uint16, option_type: uint8, option: bytes
    /// @return dvnOptions the grouped options, still share the same format of _options
    /// @return dvnIndices the dvn indices
    function groupDVNOptionsByIdx(
        bytes memory _options
    ) internal pure returns (bytes[] memory dvnOptions, uint8[] memory dvnIndices) {
        if (_options.length == 0) return (dvnOptions, dvnIndices);

        uint8 numDVNs = getNumDVNs(_options);

        // if there is only 1 dvn, we can just return the whole options
        if (numDVNs == 1) {
            dvnOptions = new bytes[](1);
            dvnOptions[0] = _options;

            dvnIndices = new uint8[](1);
            dvnIndices[0] = _options.toUint8(3); // dvn idx
            return (dvnOptions, dvnIndices);
        }

        // otherwise, we need to group the options by dvn_idx
        dvnIndices = new uint8[](numDVNs);
        dvnOptions = new bytes[](numDVNs);
        unchecked {
            uint256 cursor = 0;
            uint256 start = 0;
            uint8 lastDVNIdx = 255; // 255 is an invalid dvn_idx

            while (cursor < _options.length) {
                ++cursor; // skip worker_id

                // optionLength asserted in getNumDVNs (skip check)
                uint16 optionLength = _options.toUint16(cursor);
                cursor += 2;

                // dvnIdx asserted in getNumDVNs (skip check)
                uint8 dvnIdx = _options.toUint8(cursor);

                // dvnIdx must equal to the lastDVNIdx for the first option
                // so it is always skipped in the first option
                // this operation slices out options whenever the scan finds a different lastDVNIdx
                if (lastDVNIdx == 255) {
                    lastDVNIdx = dvnIdx;
                } else if (dvnIdx != lastDVNIdx) {
                    uint256 len = cursor - start - 3; // 3 is for worker_id and option_length
                    bytes memory opt = _options.slice(start, len);
                    _insertDVNOptions(dvnOptions, dvnIndices, lastDVNIdx, opt);

                    // reset the start and lastDVNIdx
                    start += len;
                    lastDVNIdx = dvnIdx;
                }

                cursor += optionLength;
            }

            // skip check the cursor here because the cursor is asserted in getNumDVNs
            // if we have reached the end of the options, we need to process the last dvn
            uint256 size = cursor - start;
            bytes memory op = _options.slice(start, size);
            _insertDVNOptions(dvnOptions, dvnIndices, lastDVNIdx, op);

            // revert dvnIndices to start from 0
            for (uint8 i = 0; i < numDVNs; ++i) {
                --dvnIndices[i];
            }
        }
    }

    function _insertDVNOptions(
        bytes[] memory _dvnOptions,
        uint8[] memory _dvnIndices,
        uint8 _dvnIdx,
        bytes memory _newOptions
    ) internal pure {
        // dvnIdx starts from 0 but default value of dvnIndices is 0,
        // so we tell if the slot is empty by adding 1 to dvnIdx
        if (_dvnIdx == 255) revert DVN_InvalidDVNIdx();
        uint8 dvnIdxAdj = _dvnIdx + 1;

        for (uint256 j = 0; j < _dvnIndices.length; ++j) {
            uint8 index = _dvnIndices[j];
            if (dvnIdxAdj == index) {
                _dvnOptions[j] = abi.encodePacked(_dvnOptions[j], _newOptions);
                break;
            } else if (index == 0) {
                // empty slot, that means it is the first time we see this dvn
                _dvnIndices[j] = dvnIdxAdj;
                _dvnOptions[j] = _newOptions;
                break;
            }
        }
    }

    /// @dev get the number of unique dvns
    /// @param _options the format is the same as groupDVNOptionsByIdx
    function getNumDVNs(bytes memory _options) internal pure returns (uint8 numDVNs) {
        uint256 cursor = 0;
        BitMap256 bitmap;

        // find number of unique dvn_idx
        unchecked {
            while (cursor < _options.length) {
                ++cursor; // skip worker_id

                uint16 optionLength = _options.toUint16(cursor);
                cursor += 2;
                if (optionLength < 2) revert DVN_InvalidDVNOptions(cursor); // at least 1 byte for dvn_idx and 1 byte for option_type

                uint8 dvnIdx = _options.toUint8(cursor);

                // if dvnIdx is not set, increment numDVNs
                // max num of dvns is 255, 255 is an invalid dvn_idx
                // The order of the dvnIdx is not required to be sequential, as enforcing the order may weaken
                // the composability of the options. e.g. if we refrain from enforcing the order, an OApp that has
                // already enforced certain options can append additional options to the end of the enforced
                // ones without restrictions.
                if (dvnIdx == 255) revert DVN_InvalidDVNIdx();
                if (!bitmap.get(dvnIdx)) {
                    ++numDVNs;
                    bitmap = bitmap.set(dvnIdx);
                }

                cursor += optionLength;
            }
        }
        if (cursor != _options.length) revert DVN_InvalidDVNOptions(cursor);
    }

    /// @dev decode the next dvn option from _options starting from the specified cursor
    /// @param _options the format is the same as groupDVNOptionsByIdx
    /// @param _cursor the cursor to start decoding
    /// @return optionType the type of the option
    /// @return option the option
    /// @return cursor the cursor to start decoding the next option
    function nextDVNOption(
        bytes calldata _options,
        uint256 _cursor
    ) internal pure returns (uint8 optionType, bytes calldata option, uint256 cursor) {
        unchecked {
            // skip worker id
            cursor = _cursor + 1;

            // read option size
            uint16 size = _options.toU16(cursor);
            cursor += 2;

            // read option type
            optionType = _options.toU8(cursor + 1); // skip dvn_idx

            // startCursor and endCursor are used to slice the option from _options
            uint256 startCursor = cursor + 2; // skip option type and dvn_idx
            uint256 endCursor = cursor + size;
            option = _options[startCursor:endCursor];
            cursor += size;
        }
    }
}

// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.26;

import {IERC20Metadata} from "@openzeppelin/contracts/token/ERC20/extensions/IERC20Metadata.sol";

library Decimals {
  /**
   * @dev Converts a token amount to its base unit representation.
   * @param amount The token amount.
   * @param decimals The number of decimals the token uses.
   * @return The base unit representation of the token amount.
   */
  function toBaseUnit(uint256 amount, uint8 decimals) internal pure returns (uint256) {
    return amount / (10 ** decimals);
  }

  /**
   * @dev Converts a base unit representation to a token amount.
   * @param baseUnitAmount The base unit representation of the token amount.
   * @param decimals The number of decimals the token uses.
   * @return The token amount.
   */
  function fromBaseUnit(uint256 baseUnitAmount, uint8 decimals) internal pure returns (uint256) {
    return baseUnitAmount * (10 ** decimals);
  }

  /**
   * @dev Normalizes a token amount to a common decimal base.
   * @param amount The token amount.
   * @param fromDecimals The number of decimals the token uses.
   * @param toDecimals The target number of decimals.
   * @return The normalized token amount.
   */
  function normalizeAmount(uint256 amount, uint8 fromDecimals, uint8 toDecimals) internal pure returns (uint256) {
    if (fromDecimals > toDecimals) return amount / (10 ** (fromDecimals - toDecimals));
    else if (fromDecimals < toDecimals) return amount * (10 ** (toDecimals - fromDecimals));
    else return amount;
  }

  /**
   * @dev Normalizes a token amount to a specified decimal base.
   * @param token The ERC20 token.
   * @param amount The token amount to normalize.
   * @param toDecimals The target number of decimals.
   * @return The normalized token amount.
   */
  function normalizeTokenAmount(uint256 amount, address token, uint8 toDecimals) internal view returns (uint256) {
    uint8 decimals = IERC20Metadata(token).decimals();
    return normalizeAmount(amount, decimals, toDecimals);
  }

  /**
   * @dev Adds two token amounts with different decimals.
   * @param amount1 The first token amount.
   * @param decimals1 The number of decimals for the first token.
   * @param amount2 The second token amount.
   * @param decimals2 The number of decimals for the second token.
   * @param resultDecimals The number of decimals for the result.
   * @return The sum of the two token amounts normalized to the result decimals.
   */
  function addAmounts(uint256 amount1, uint8 decimals1, uint256 amount2, uint8 decimals2, uint8 resultDecimals)
    internal
    pure
    returns (uint256)
  {
    uint256 normalizedAmount1 = normalizeAmount(amount1, decimals1, resultDecimals);
    uint256 normalizedAmount2 = normalizeAmount(amount2, decimals2, resultDecimals);
    return normalizedAmount1 + normalizedAmount2;
  }

  /**
   * @dev Subtracts two token amounts with different decimals.
   * @param amount1 The first token amount.
   * @param decimals1 The number of decimals for the first token.
   * @param amount2 The second token amount.
   * @param decimals2 The number of decimals for the second token.
   * @param resultDecimals The number of decimals for the result.
   * @return The difference of the two token amounts normalized to the result decimals.
   */
  function subtractAmounts(uint256 amount1, uint8 decimals1, uint256 amount2, uint8 decimals2, uint8 resultDecimals)
    internal
    pure
    returns (uint256)
  {
    uint256 normalizedAmount1 = normalizeAmount(amount1, decimals1, resultDecimals);
    uint256 normalizedAmount2 = normalizeAmount(amount2, decimals2, resultDecimals);
    return normalizedAmount1 - normalizedAmount2;
  }
}

// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.26;

import {Utils} from "../lib/Utils.sol";
import {Auction} from "../Auction.sol";
import {BondToken} from "../BondToken.sol";
import {Distributor} from "../Distributor.sol";
import {LeverageToken} from "../LeverageToken.sol";
import {PoolFactory} from "../PoolFactory.sol";
import {Create3} from "@create3/contracts/Create3.sol";
import {BeaconProxy} from "@openzeppelin/contracts/proxy/beacon/BeaconProxy.sol";

/**
 * @title Deployer
 * @dev Contract for deploying BondToken and LeverageToken instances
 */
contract Deployer {
  bytes32 public bondSalt;
  bytes32 public leverageSalt;
  bytes32 public distributorSalt;
  PoolFactory public poolFactory;

  error CallerIsNotPoolFactory();
  error CallerIsNotSecurityCouncil();
  error PoolFactoryAlreadySet();

  constructor() {
    // Initial salt values (can be anything)
    bondSalt = "BOND_SALT";
    leverageSalt = "LEVERAGE_SALT";
    distributorSalt = "DISTRIBUTOR_SALT";
  }

  /**
   * @dev Deploys a new BondToken contract
   * @param bondBeacon The address of the beacon for the BondToken
   * @param minter The address with minting privileges
   * @param governance The address with governance privileges
   * @param sharesPerToken The initial number of shares per token
   * @return address of the deployed BondToken contract
   */
  function deployBondToken(
    address bondBeacon,
    string memory name,
    string memory symbol,
    address minter,
    address governance,
    address,
    uint256 sharesPerToken
  ) external onlyPoolFactory returns (address) {
    bytes memory initData =
      abi.encodeCall(BondToken.initialize, (name, symbol, minter, governance, address(poolFactory), sharesPerToken));

    address addr =
      Create3.create3(bondSalt, abi.encodePacked(type(BeaconProxy).creationCode, abi.encode(bondBeacon, initData)));

    bondSalt = bytes32(uint256(uint256(bondSalt) + 1)); // Increment salt for next deployment

    return addr;
  }

  /**
   * @dev Deploys a new LeverageToken contract
   * @param minter The address with minting privileges
   * @param governance The address with governance privileges
   * @return address of the deployed LeverageToken contract
   */
  function deployLeverageToken(
    address leverageBeacon,
    string memory name,
    string memory symbol,
    address minter,
    address governance,
    address
  ) external onlyPoolFactory returns (address) {
    bytes memory initData =
      abi.encodeCall(LeverageToken.initialize, (name, symbol, minter, governance, address(poolFactory)));

    address addr = Create3.create3(
      leverageSalt, abi.encodePacked(type(BeaconProxy).creationCode, abi.encode(leverageBeacon, initData))
    );

    leverageSalt = bytes32(uint256(uint256(leverageSalt) + 1)); // Increment salt for next deployment

    return addr;
  }

  function deployDistributor(address distributorBeacon, address pool, address)
    external
    onlyPoolFactory
    returns (address)
  {
    bytes memory initData = abi.encodeCall(Distributor.initialize, (pool, address(poolFactory)));

    address addr = Create3.create3(
      distributorSalt, abi.encodePacked(type(BeaconProxy).creationCode, abi.encode(distributorBeacon, initData))
    );

    distributorSalt = bytes32(uint256(uint256(distributorSalt) + 1)); // Increment salt for next deployment

    return addr;
  }

  /**
   * @dev Deploys a new DistributorIntegrationAdapter contract
   * @param distributorIntegrationAdapterBeacon The address of the beacon for the DistributorIntegrationAdapter
   * @param pool The address of the pool
   * @return address of the deployed DistributorIntegrationAdapter contract
   */
  function deployDistributorIntegrationAdapter(address distributorIntegrationAdapterBeacon, address pool)
    external
    returns (address)
  {
    return address(
      new BeaconProxy(
        address(distributorIntegrationAdapterBeacon),
        abi.encodeCall(Distributor.initialize, (pool, address(poolFactory)))
      )
    );
  }

  /**
   * @dev Deploys a new Auction contract
   * @param pool The address of the pool
   * @param couponToken The address of the coupon token
   * @param reserveToken The address of the reserve token
   * @param couponAmountToDistribute The amount of coupon tokens to distribute
   * @param endTime The end time of the auction
   * @param maxBids The maximum number of bids
   * @param beneficiary The address of the beneficiary
   * @param poolSaleLimit The sale limit of the pool
   * @return address of the deployed Auction contract
   */
  function deployAuction(
    address pool,
    address couponToken,
    address reserveToken,
    uint256 couponAmountToDistribute,
    uint256 endTime,
    uint256 maxBids,
    address beneficiary,
    uint256 poolSaleLimit
  ) external returns (address) {
    return Utils.deploy(
      address(new Auction()),
      abi.encodeWithSelector(
        Auction.initialize.selector,
        pool,
        couponToken,
        reserveToken,
        couponAmountToDistribute,
        endTime,
        maxBids,
        beneficiary,
        poolSaleLimit
      )
    );
  }

  /**
   * @dev Sets the pool factory. We leave the function open but ensure it can only be called once
   * (which would be done during deployment)
   * @param _poolFactory The address of the pool factory
   */
  function setPoolFactory(address _poolFactory) external {
    if (address(poolFactory) != address(0)) revert PoolFactoryAlreadySet();
    poolFactory = PoolFactory(_poolFactory);
  }

  function setSalts(bytes32 _bondSalt, bytes32 _leverageSalt, bytes32 _distributorSalt) external onlySecurityCouncil {
    bondSalt = _bondSalt;
    leverageSalt = _leverageSalt;
    distributorSalt = _distributorSalt;
  }

  function computeBondTokenAddress() external view returns (address) {
    return Create3.addressOf(bondSalt);
  }

  function computeLeverageTokenAddress() external view returns (address) {
    return Create3.addressOf(leverageSalt);
  }

  function computeDistributorAddress() external view returns (address) {
    return Create3.addressOf(distributorSalt);
  }

  function computeAddress(bytes32 salt) external view returns (address) {
    return Create3.addressOf(salt);
  }

  modifier onlyPoolFactory() {
    if (msg.sender != address(poolFactory)) revert CallerIsNotPoolFactory();
    _;
  }

  modifier onlySecurityCouncil() {
    if (!poolFactory.hasRole(poolFactory.SECURITY_COUNCIL_ROLE(), msg.sender)) revert CallerIsNotSecurityCouncil();
    _;
  }
}

// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.26;

import {Auction} from "./Auction.sol";
import {Pool} from "./Pool.sol";
import {BondToken} from "./BondToken.sol";
import {Decimals} from "./lib/Decimals.sol";
import {PoolFactory} from "../src/PoolFactory.sol";
import {ERC20Extensions} from "./lib/ERC20Extensions.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {SafeERC20} from "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";
import {Initializable} from "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol";
import {PausableUpgradeable} from "@openzeppelin/contracts-upgradeable/utils/PausableUpgradeable.sol";
import {AccessControlUpgradeable} from "@openzeppelin/contracts-upgradeable/access/AccessControlUpgradeable.sol";
import {ReentrancyGuardUpgradeable} from "@openzeppelin/contracts-upgradeable/utils/ReentrancyGuardUpgradeable.sol";

/**
 * @title Distributor
 * @dev This contract manages the distribution of coupon shares to users based on their bond token
 * balances.
 */
contract Distributor is Initializable, PausableUpgradeable, ReentrancyGuardUpgradeable {
  using SafeERC20 for IERC20;
  using ERC20Extensions for IERC20;
  using Decimals for uint256;

  /// @dev Pool factory address
  PoolFactory public poolFactory;
  /// @dev Pool address
  Pool public pool;
  /// @dev Coupon token total amount to be distributed
  uint256 public couponAmountToDistribute;

  /// @dev Error thrown when there are not enough shares in the contract's balance
  error NotEnoughSharesBalance();
  /// @dev Error thrown when an unsupported pool is accessed
  error UnsupportedPool();
  /// @dev Error thrown when there are not enough shares allocated to distribute
  error NotEnoughSharesToDistribute();
  /// @dev Error thrown when there are not enough coupon tokens in the contract's balance
  error NotEnoughCouponBalance();
  /// @dev Error thrown when attempting to register an already registered pool
  error PoolAlreadyRegistered();
  /// @dev Error thrown when the pool has an invalid address
  error InvalidPoolAddress();
  /// @dev error thrown when the caller is not the pool
  error CallerIsNotPool();
  /// @dev error thrown when the caller does not have the required role
  error AccessDenied();
  /// @dev error thrown when user has no shares to claim
  error NothingToClaim();

  /// @dev Event emitted when a user claims their shares
  event ClaimedShares(address user, uint256 period, uint256 shares);

  /// @custom:oz-upgrades-unsafe-allow constructor
  constructor() {
    _disableInitializers();
  }

  /**
   * @dev Initializes the contract with the pool address and pool factory address.
   * This function is called once during deployment or upgrading to initialize state variables.
   * @param _pool Address of the pool.
   * @param _poolFactory Address of the pool factory.
   */
  function initialize(address _pool, address _poolFactory) public initializer {
    __ReentrancyGuard_init();
    __Pausable_init();

    pool = Pool(_pool);
    poolFactory = PoolFactory(_poolFactory);
  }

  /**
   * @dev Allows a user to claim their shares from a specific pool.
   * Calculates the number of shares based on the user's bond token balance and the shares per
   * token.
   * Transfers the calculated shares to the user's address.
   */
  function claim() external nonReentrant whenNotPaused {
    BondToken bondToken = Pool(pool).bondToken();
    address couponToken = Pool(pool).couponToken();

    if (address(bondToken) == address(0) || couponToken == address(0)) revert UnsupportedPool();

    (uint256 currentPeriod,) = bondToken.globalPool();
    uint256 balance = bondToken.balanceOf(msg.sender);
    (uint256 shares, uint256 lastIndexedPeriodBalance) =
      bondToken.getIndexedUserAmount(msg.sender, balance, currentPeriod);

    shares = shares.normalizeAmount(bondToken.decimals(), IERC20(couponToken).safeDecimals());

    bool isLastAuctionFinalized = !(Auction(pool.auctions(currentPeriod - 1)).state() == Auction.State.BIDDING);

    if (isLastAuctionFinalized) {
      BondToken.PoolAmount[] memory poolAmount = bondToken.getPreviousPoolAmounts();
      shares += (lastIndexedPeriodBalance * poolAmount[currentPeriod - 1].sharesPerToken).normalizeAmount(
        IERC20(bondToken).safeDecimals() + bondToken.SHARES_DECIMALS(), IERC20(couponToken).safeDecimals()
      );
    }
    if (shares == 0) revert NothingToClaim();

    if (IERC20(couponToken).balanceOf(address(this)) < shares) revert NotEnoughSharesBalance();

    // check if pool has enough *allocated* shares to distribute
    if (couponAmountToDistribute < shares) revert NotEnoughSharesToDistribute();

    // check if the distributor has enough shares tokens as the amount to distribute
    if (IERC20(couponToken).balanceOf(address(this)) < couponAmountToDistribute) revert NotEnoughSharesToDistribute();

    couponAmountToDistribute -= shares;
    bondToken.resetIndexedUserAssets(msg.sender, isLastAuctionFinalized);
    IERC20(couponToken).safeTransfer(msg.sender, shares);

    emit ClaimedShares(msg.sender, currentPeriod, shares);
  }

  /**
   * @dev Allocates shares to a pool.
   * @param _amountToDistribute Amount of shares to allocate.
   */
  function allocate(uint256 _amountToDistribute) external whenNotPaused {
    require(address(pool) == msg.sender, CallerIsNotPool());

    address couponToken = pool.couponToken();
    couponAmountToDistribute += _amountToDistribute;

    if (IERC20(couponToken).balanceOf(address(this)) < couponAmountToDistribute) revert NotEnoughCouponBalance();
  }

  /**
   * @dev Pauses the contract. Reverts any interaction except upgrade.
   */
  function pause() external onlyRole(poolFactory.SECURITY_COUNCIL_ROLE()) {
    _pause();
  }

  /**
   * @dev Unpauses the contract.
   */
  function unpause() external onlyRole(poolFactory.SECURITY_COUNCIL_ROLE()) {
    _unpause();
  }

  /**
   * @dev Modifier to check if the caller has the specified role.
   * @param role The role to check for.
   */
  modifier onlyRole(bytes32 role) {
    if (!poolFactory.hasRole(role, msg.sender)) revert AccessDenied();
    _;
  }
}

// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.26;

import {Pool} from "./Pool.sol";
import {Auction} from "./Auction.sol";
import {BondToken} from "./BondToken.sol";
import {Decimals} from "./lib/Decimals.sol";
import {PoolFactory} from "./PoolFactory.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {SafeERC20} from "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";
import {MerkleProof} from "@openzeppelin/contracts/utils/cryptography/MerkleProof.sol";
import {Initializable} from "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol";
import {PausableUpgradeable} from "@openzeppelin/contracts-upgradeable/utils/PausableUpgradeable.sol";
import {ReentrancyGuardUpgradeable} from "@openzeppelin/contracts-upgradeable/utils/ReentrancyGuardUpgradeable.sol";

contract DistributorAdapter is Initializable, PausableUpgradeable, ReentrancyGuardUpgradeable {
  using SafeERC20 for IERC20;
  using Decimals for uint256;

  struct MerkleRootData {
    bytes32 merkleRoot;
    string ipfsHash;
  }

  // State variables
  PoolFactory public poolFactory;
  Pool public pool;
  mapping(uint256 => MerkleRootData[]) public submittedRoots;
  mapping(uint256 => MerkleRootData) public selectedRoots;
  mapping(address => mapping(uint256 => bool)) public hasClaimed; // user => period => claimed
  address[] public integratingContracts;

  // Events
  event MerkleRootSubmitted(address indexed submitter, uint256 indexed period, bytes32 merkleRoot, string ipfsHash);
  event MerkleRootSelected(uint256 indexed period, bytes32 merkleRoot, string ipfsHash);
  event IntegratingContractAdded(address indexed contractAddress, uint256 indexed period);
  event IntegratingContractRemoved(address indexed contractAddress, uint256 indexed period);
  event Claimed(address indexed user, uint256 indexed period, uint256 amount);

  // Errors
  error InvalidMerkleProof();
  error AlreadyClaimed();
  error AccessDenied();
  error InvalidPeriod();
  error NotEnoughBalance();
  error CallerIsNotPool();
  error AddressNotFound();
  error NotInBiddingPhase();
  error InvalidRootIndex();
  error RootAlreadySelected();
  error RootNotActive();
  error AuctionNotFinalized();
  error NoCouponsYet();

  /// @custom:oz-upgrades-unsafe-allow constructor
  constructor() {
    _disableInitializers();
  }

  function initialize(address _pool, address _poolFactory) public initializer {
    __ReentrancyGuard_init();
    __Pausable_init();

    pool = Pool(_pool);
    poolFactory = PoolFactory(_poolFactory);
  }

  /**
   * @dev Submit a merkle root for the latest completed period, where bond holders are incentivized to do so during the
   * bidding phase of the corresponding auction.
   * @param _merkleRoot The merkle root
   * @param _ipfsHash The ipfs hash containing full merkle tree
   */
  function submitMerkleRoot(bytes32 _merkleRoot, string calldata _ipfsHash) external whenNotPaused {
    // Posting lists only makes sense during bidding phase, so we enforce this
    uint256 currentPeriod = _currentPeriod();
    if (currentPeriod == 0) revert NoCouponsYet();

    uint256 lastPeriod = currentPeriod - 1;
    if (Auction(pool.auctions(lastPeriod)).state() != Auction.State.BIDDING) revert NotInBiddingPhase();

    submittedRoots[lastPeriod].push(MerkleRootData({merkleRoot: _merkleRoot, ipfsHash: _ipfsHash}));

    emit MerkleRootSubmitted(msg.sender, lastPeriod, _merkleRoot, _ipfsHash);
  }

  function selectMerkleRoot(uint256 rootIndex) external onlyGov whenNotPaused {
    uint256 lastPeriod = _currentPeriod() - 1;
    if (rootIndex >= submittedRoots[lastPeriod].length) revert InvalidRootIndex();

    MerkleRootData memory selectedRoot = submittedRoots[lastPeriod][rootIndex];
    selectedRoots[lastPeriod] = selectedRoot;

    emit MerkleRootSelected(lastPeriod, selectedRoot.merkleRoot, selectedRoot.ipfsHash);
  }

  function addIntegratingContract(address _address) external onlyGov {
    integratingContracts.push(_address);
    emit IntegratingContractAdded(_address, _currentPeriod());
  }

  function removeIntegratingContract(address _address) external onlyGov {
    for (uint256 i = 0; i < integratingContracts.length; i++) {
      if (integratingContracts[i] == _address) {
        integratingContracts[i] = integratingContracts[integratingContracts.length - 1];
        integratingContracts.pop();
        emit IntegratingContractRemoved(_address, _currentPeriod());
        return;
      }
    }
    revert AddressNotFound();
  }

  function claim(uint256 period, uint256 amount, bytes32[] calldata merkleProof)
    external
    nonReentrant
    whenNotPaused
    lastAuctionFinalized(period)
  {
    if (hasClaimed[msg.sender][period]) revert AlreadyClaimed();

    // Double hash as per OpenZeppelin guidelines
    bytes32 leaf = keccak256(bytes.concat(keccak256(abi.encode(msg.sender, amount))));
    if (!MerkleProof.verify(merkleProof, selectedRoots[period].merkleRoot, leaf)) revert InvalidMerkleProof();

    if (IERC20(pool.couponToken()).balanceOf(address(this)) < amount) revert NotEnoughBalance();

    hasClaimed[msg.sender][period] = true;
    IERC20(pool.couponToken()).safeTransfer(msg.sender, amount);

    emit Claimed(msg.sender, amount, period);
  }

  function getDistributionAmount() external view returns (uint256 totalAmount) {
    BondToken bondToken = pool.bondToken();
    uint256 lastPeriod = _currentPeriod() - 1;

    for (uint256 i = 0; i < integratingContracts.length; i++) {
      address addr = integratingContracts[i];
      (, uint256 lastIndexedPeriodBalance) =
        bondToken.getIndexedUserAmount(addr, bondToken.balanceOf(addr), _currentPeriod());

      if (lastIndexedPeriodBalance > 0) {
        BondToken.PoolAmount[] memory poolAmount = bondToken.getPreviousPoolAmounts();
        totalAmount += (lastIndexedPeriodBalance * poolAmount[lastPeriod].sharesPerToken).normalizeAmount(
          bondToken.decimals() + bondToken.SHARES_DECIMALS(), bondToken.SHARES_DECIMALS()
        );
      }
    }
  }

  function _currentPeriod() internal view returns (uint256 currentPeriod) {
    (currentPeriod,) = pool.bondToken().globalPool();
  }

  function pause() external {
    if (!poolFactory.hasRole(poolFactory.SECURITY_COUNCIL_ROLE(), msg.sender)) revert AccessDenied();
    _pause();
  }

  function unpause() external {
    if (!poolFactory.hasRole(poolFactory.SECURITY_COUNCIL_ROLE(), msg.sender)) revert AccessDenied();
    _unpause();
  }

  modifier onlyGov() {
    if (!poolFactory.hasRole(poolFactory.GOV_ROLE(), msg.sender)) revert AccessDenied();
    _;
  }

  modifier lastAuctionFinalized(uint256 period) {
    uint256 currentPeriod = _currentPeriod();
    if (currentPeriod == 0) revert NoCouponsYet();

    uint256 lastPeriod = currentPeriod - 1;
    // If the period is the last period, we need to check if the auction is in bidding phase. Prior auctions are
    // guaranteed to be finalized
    if (period == lastPeriod && Auction(pool.auctions(lastPeriod)).state() == Auction.State.BIDDING) {
      revert AuctionNotFinalized();
    }
    _;
  }
}

// SPDX-License-Identifier: MIT
// OpenZeppelin Contracts (last updated v5.0.0) (utils/cryptography/ECDSA.sol)

pragma solidity ^0.8.20;

/**
 * @dev Elliptic Curve Digital Signature Algorithm (ECDSA) operations.
 *
 * These functions can be used to verify that a message was signed by the holder
 * of the private keys of a given address.
 */
library ECDSA {
    enum RecoverError {
        NoError,
        InvalidSignature,
        InvalidSignatureLength,
        InvalidSignatureS
    }

    /**
     * @dev The signature derives the `address(0)`.
     */
    error ECDSAInvalidSignature();

    /**
     * @dev The signature has an invalid length.
     */
    error ECDSAInvalidSignatureLength(uint256 length);

    /**
     * @dev The signature has an S value that is in the upper half order.
     */
    error ECDSAInvalidSignatureS(bytes32 s);

    /**
     * @dev Returns the address that signed a hashed message (`hash`) with `signature` or an error. This will not
     * return address(0) without also returning an error description. Errors are documented using an enum (error type)
     * and a bytes32 providing additional information about the error.
     *
     * If no error is returned, then the address can be used for verification purposes.
     *
     * The `ecrecover` EVM precompile allows for malleable (non-unique) signatures:
     * this function rejects them by requiring the `s` value to be in the lower
     * half order, and the `v` value to be either 27 or 28.
     *
     * IMPORTANT: `hash` _must_ be the result of a hash operation for the
     * verification to be secure: it is possible to craft signatures that
     * recover to arbitrary addresses for non-hashed data. A safe way to ensure
     * this is by receiving a hash of the original message (which may otherwise
     * be too long), and then calling {MessageHashUtils-toEthSignedMessageHash} on it.
     *
     * Documentation for signature generation:
     * - with https://web3js.readthedocs.io/en/v1.3.4/web3-eth-accounts.html#sign[Web3.js]
     * - with https://docs.ethers.io/v5/api/signer/#Signer-signMessage[ethers]
     */
    function tryRecover(bytes32 hash, bytes memory signature) internal pure returns (address, RecoverError, bytes32) {
        if (signature.length == 65) {
            bytes32 r;
            bytes32 s;
            uint8 v;
            // ecrecover takes the signature parameters, and the only way to get them
            // currently is to use assembly.
            /// @solidity memory-safe-assembly
            assembly {
                r := mload(add(signature, 0x20))
                s := mload(add(signature, 0x40))
                v := byte(0, mload(add(signature, 0x60)))
            }
            return tryRecover(hash, v, r, s);
        } else {
            return (address(0), RecoverError.InvalidSignatureLength, bytes32(signature.length));
        }
    }

    /**
     * @dev Returns the address that signed a hashed message (`hash`) with
     * `signature`. This address can then be used for verification purposes.
     *
     * The `ecrecover` EVM precompile allows for malleable (non-unique) signatures:
     * this function rejects them by requiring the `s` value to be in the lower
     * half order, and the `v` value to be either 27 or 28.
     *
     * IMPORTANT: `hash` _must_ be the result of a hash operation for the
     * verification to be secure: it is possible to craft signatures that
     * recover to arbitrary addresses for non-hashed data. A safe way to ensure
     * this is by receiving a hash of the original message (which may otherwise
     * be too long), and then calling {MessageHashUtils-toEthSignedMessageHash} on it.
     */
    function recover(bytes32 hash, bytes memory signature) internal pure returns (address) {
        (address recovered, RecoverError error, bytes32 errorArg) = tryRecover(hash, signature);
        _throwError(error, errorArg);
        return recovered;
    }

    /**
     * @dev Overload of {ECDSA-tryRecover} that receives the `r` and `vs` short-signature fields separately.
     *
     * See https://eips.ethereum.org/EIPS/eip-2098[EIP-2098 short signatures]
     */
    function tryRecover(bytes32 hash, bytes32 r, bytes32 vs) internal pure returns (address, RecoverError, bytes32) {
        unchecked {
            bytes32 s = vs & bytes32(0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff);
            // We do not check for an overflow here since the shift operation results in 0 or 1.
            uint8 v = uint8((uint256(vs) >> 255) + 27);
            return tryRecover(hash, v, r, s);
        }
    }

    /**
     * @dev Overload of {ECDSA-recover} that receives the `r and `vs` short-signature fields separately.
     */
    function recover(bytes32 hash, bytes32 r, bytes32 vs) internal pure returns (address) {
        (address recovered, RecoverError error, bytes32 errorArg) = tryRecover(hash, r, vs);
        _throwError(error, errorArg);
        return recovered;
    }

    /**
     * @dev Overload of {ECDSA-tryRecover} that receives the `v`,
     * `r` and `s` signature fields separately.
     */
    function tryRecover(
        bytes32 hash,
        uint8 v,
        bytes32 r,
        bytes32 s
    ) internal pure returns (address, RecoverError, bytes32) {
        // EIP-2 still allows signature malleability for ecrecover(). Remove this possibility and make the signature
        // unique. Appendix F in the Ethereum Yellow paper (https://ethereum.github.io/yellowpaper/paper.pdf), defines
        // the valid range for s in (301): 0 < s < secp256k1n ÷ 2 + 1, and for v in (302): v ∈ {27, 28}. Most
        // signatures from current libraries generate a unique signature with an s-value in the lower half order.
        //
        // If your library generates malleable signatures, such as s-values in the upper range, calculate a new s-value
        // with 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141 - s1 and flip v from 27 to 28 or
        // vice versa. If your library also generates signatures with 0/1 for v instead 27/28, add 27 to v to accept
        // these malleable signatures as well.
        if (uint256(s) > 0x7FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF5D576E7357A4501DDFE92F46681B20A0) {
            return (address(0), RecoverError.InvalidSignatureS, s);
        }

        // If the signature is valid (and not malleable), return the signer address
        address signer = ecrecover(hash, v, r, s);
        if (signer == address(0)) {
            return (address(0), RecoverError.InvalidSignature, bytes32(0));
        }

        return (signer, RecoverError.NoError, bytes32(0));
    }

    /**
     * @dev Overload of {ECDSA-recover} that receives the `v`,
     * `r` and `s` signature fields separately.
     */
    function recover(bytes32 hash, uint8 v, bytes32 r, bytes32 s) internal pure returns (address) {
        (address recovered, RecoverError error, bytes32 errorArg) = tryRecover(hash, v, r, s);
        _throwError(error, errorArg);
        return recovered;
    }

    /**
     * @dev Optionally reverts with the corresponding custom error according to the `error` argument provided.
     */
    function _throwError(RecoverError error, bytes32 errorArg) private pure {
        if (error == RecoverError.NoError) {
            return; // no error: do nothing
        } else if (error == RecoverError.InvalidSignature) {
            revert ECDSAInvalidSignature();
        } else if (error == RecoverError.InvalidSignatureLength) {
            revert ECDSAInvalidSignatureLength(uint256(errorArg));
        } else if (error == RecoverError.InvalidSignatureS) {
            revert ECDSAInvalidSignatureS(errorArg);
        }
    }
}