o2-tools 0.4.3-rc

//! Where the money actually goes.
//!
//! The suite proves a lot of arithmetic in isolation and a lot of single
//! payouts on chain, but several of the pool's corrections only ever ran with
//! their interesting term set to zero. Each test here drives one of those
//! terms to a nonzero value through a real session, so deleting the
//! correction makes a test fail rather than quietly moving somebody's money.

use super::*;
use crate::prop::{
    CollateralAdded,
    MarginWithdrawn,
    QuoteRepaidFromCollateral,
};

/// The fixture's session taken through a profitable round trip: draw, buy the
/// base, watch it rise by half, sell it back, return the draw. Leaves the
/// realised profit in CASH on the account with the draw cleared, the ledger
/// otherwise untouched, and the base price standing at 3.0.
async fn earn_realised_profit(fixture: &mut PropFixture) -> u64 {
    let quantity = 1_000_000_000u64;
    let cost = 2_000_000u64;
    let sale = 3_000_000u64;

    fixture
        .rest_order(cost, quantity, fixture.base_asset, quantity)
        .await;
    let draw = fixture.draw_call(cost);
    let buy = fixture.book_call(cost, quantity, fixture.collateral_asset, cost);
    fixture
        .call_account(vec![draw, buy, fixture.settle_book_call()], 2)
        .await
        .unwrap();

    fixture
        .publish_base_price(3_000_000_000_000_000_000u128)
        .await;
    fixture
        .rest_order(sale, quantity, fixture.collateral_asset, sale)
        .await;
    let sell = fixture.book_call(sale, quantity, fixture.base_asset, quantity);
    let give_back = fixture.pool_call(
        fn_selector!(return_quote()),
        cost,
        fixture.collateral_asset,
        None,
    );
    fixture
        .call_account(vec![sell, fixture.settle_book_call(), give_back], 2)
        .await
        .unwrap();

    let profit = sale - cost;
    assert_eq!(
        fixture.account_balance(fixture.collateral_asset).await,
        profit
    );
    assert_eq!(fixture.session().await.drawn_quote, 0);
    profit
}

/// Banks `amount` of the account's own cash as collateral. Self-funding, so
/// it is share-bearing and lands on `capitalised`.
fn capitalise_call(fixture: &PropFixture, amount: u64) -> CallContractArg {
    fixture.pool_call(
        fn_selector!(add_collateral(ContractId)),
        amount,
        fixture.collateral_asset,
        Some(call_data!(fixture.child_id)),
    )
}

// ---------------------------------------------------------------------------
// The `capitalised` half of the share correction.
// ---------------------------------------------------------------------------

/// Settlement measures profit as `basket − drawn`, with funded collateral
/// standing OUTSIDE that measure. Profit the user banks as collateral has
/// therefore crossed the boundary, and `profit_share_base` adds it back so the
/// platform is still paid for it.
///
/// Every settlement in the suite runs with `capitalised == 0` - the one test
/// that builds a capitalised balance nets it away to zero before closing - so
/// deleting the `+ capitalised` term silently forgives the platform's whole
/// share on every session that ever banked a profit, and nothing fails.
#[tokio::test]
async fn a_session_that_banked_its_profit_as_collateral_still_pays_the_share() {
    let mut fixture = PropFixture::new().await;

    let profit = earn_realised_profit(&mut fixture).await;

    let capitalise = capitalise_call(&fixture, profit);
    let response = fixture.call_account(vec![capitalise], 0).await.unwrap();
    let added = fixture
        .deployment
        .pool
        .log_decoder()
        .decode_logs_with_type::<CollateralAdded>(&response.tx_status.receipts)
        .unwrap();
    assert_eq!(added.len(), 1);
    assert_eq!(added[0].capitalised_total, profit);

    let banked = fixture.session().await;
    assert_eq!(banked.collateral, COLLATERAL + profit);
    assert_eq!(banked.capitalised, profit);
    assert_eq!(banked.decapitalised, 0);
    assert_eq!(
        fixture.account_balance(fixture.collateral_asset).await,
        0,
        "the profit is funded collateral now, not cash on the account"
    );

    // Close with the balance still standing: this is the settlement the
    // `+ capitalised` term exists for.
    let platform_before = fixture
        .deployer
        .get_asset_balance(&fixture.collateral_asset)
        .await
        .unwrap();
    let parent_before = fixture
        .user
        .get_asset_balance(&fixture.collateral_asset)
        .await
        .unwrap();

    let closed = fixture.closed_event(&fixture.close_session().await);
    assert_eq!(closed.reason, SettlementReason::UserClose);
    assert_eq!(closed.bad_debt, 0);
    assert_eq!(
        closed.platform_total,
        profit / 10,
        "the share is charged on the profit even though it now reads as collateral"
    );
    assert_eq!(closed.user_net, COLLATERAL + profit - profit / 10);
    assert_eq!(
        closed.payout_platform,
        vec![(fixture.collateral_asset, profit / 10)]
    );

    // And the event is not the only witness: the coins really moved.
    assert_eq!(
        fixture
            .deployer
            .get_asset_balance(&fixture.collateral_asset)
            .await
            .unwrap()
            - platform_before,
        (profit / 10) as u128
    );
    assert_eq!(
        fixture
            .user
            .get_asset_balance(&fixture.collateral_asset)
            .await
            .unwrap()
            - parent_before,
        (COLLATERAL + profit - profit / 10) as u128
    );
}

/// The platform's claim is capped by the basket it is paid from, and the cap
/// is load-bearing in a way the arithmetic hides: `user_net` is computed as
/// `distributable − claim` on unsigned integers, so a claim that outran the
/// basket would not merely overpay - it would REVERT the close, and the
/// session could never be settled by anyone.
///
/// Reaching that state needs a session that owes a share on capitalised profit
/// while having spent almost all of its collateral on premiums, which no test
/// has ever built.
#[tokio::test]
async fn the_platforms_claim_can_never_outrun_the_basket_it_is_paid_from() {
    let mut fixture = PropFixture::new().await;

    let profit = earn_realised_profit(&mut fixture).await;
    let capitalise = capitalise_call(&fixture, profit);
    fixture.call_account(vec![capitalise], 0).await.unwrap();
    assert_eq!(fixture.session().await.collateral, 3_000_000);

    // Spend the collateral down to 6_000 on prolongation premiums. The
    // `ProlongAboveCollateral` bound permits this: 499 x 6_000 is 2_994_000,
    // strictly under the 3_000_000 funded.
    let burn = fixture.prolong_call(499);
    fixture.call_account(vec![burn], 1).await.unwrap();
    let starved = fixture.session().await;
    assert_eq!(starved.fees_accrued, 2_994_000);
    assert_eq!(starved.collateral, 3_000_000);

    // The share owed is 100_000; the basket left to pay it from is 6_000.
    let platform_before = fixture
        .deployer
        .get_asset_balance(&fixture.collateral_asset)
        .await
        .unwrap();
    let closed = fixture.closed_event(&fixture.close_session().await);
    assert_eq!(
        closed.platform_total, 6_000,
        "the claim is capped by what there is, not by what is owed"
    );
    assert_eq!(closed.user_net, 0);
    assert!(closed.payout_parent.is_empty());
    assert_eq!(closed.bad_debt, 0, "an unpayable share is not bad debt");
    assert_eq!(
        fixture
            .deployer
            .get_asset_balance(&fixture.collateral_asset)
            .await
            .unwrap()
            - platform_before,
        6_000
    );
}

/// Withdrawing capitalised profit is the ONE place `profit_share_bps` is
/// charged outside settlement, on cash leaving the pool leg. Every existing
/// test asserts `from_capitalised == 0`, so the branch that computes the
/// share, strikes the balance and pays the platform has never run on chain -
/// and no test has ever checked that the share actually REACHES the platform
/// rather than being computed, logged and stranded.
#[tokio::test]
async fn withdrawing_capitalised_profit_charges_the_share_once_and_pays_it() {
    let mut fixture = PropFixture::new().await;

    let profit = earn_realised_profit(&mut fixture).await;
    let capitalise = capitalise_call(&fixture, profit);
    fixture.call_account(vec![capitalise], 0).await.unwrap();

    let platform_before = fixture
        .deployer
        .get_asset_balance(&fixture.collateral_asset)
        .await
        .unwrap();
    let parent_before = fixture
        .user
        .get_asset_balance(&fixture.collateral_asset)
        .await
        .unwrap();

    // Take the banked profit back out. The account holds no cash, so the whole
    // withdrawal comes off the POOL leg - and the floor lands exactly on the
    // tier's entry ticket, which is what makes the amount withdrawable at all.
    let withdraw = fixture.pool_call(
        fn_selector!(withdraw(AssetId, u64)),
        0,
        AssetId::default(),
        Some(call_data!(fixture.collateral_asset, profit)),
    );
    let response = fixture.call_account(vec![withdraw], 2).await.unwrap();
    let events = fixture
        .deployment
        .pool
        .log_decoder()
        .decode_logs_with_type::<MarginWithdrawn>(&response.tx_status.receipts)
        .unwrap();
    assert_eq!(events.len(), 1);
    assert_eq!(events[0].from_account, 0);
    assert_eq!(events[0].from_pool, profit);
    assert_eq!(
        events[0].from_capitalised, profit,
        "the whole withdrawal is share-bearing profit"
    );
    assert_eq!(events[0].share_qty, profit / 10);
    assert_eq!(events[0].capitalised_total, 0);
    assert_eq!(events[0].new_collateral, COLLATERAL);

    assert_eq!(
        fixture
            .deployer
            .get_asset_balance(&fixture.collateral_asset)
            .await
            .unwrap()
            - platform_before,
        (profit / 10) as u128,
        "the share reaches the platform in the call that charges it"
    );
    assert_eq!(
        fixture
            .user
            .get_asset_balance(&fixture.collateral_asset)
            .await
            .unwrap()
            - parent_before,
        (profit - profit / 10) as u128
    );

    // Charged ONCE: the capitalised balance is spent, so the close that
    // follows takes nothing more.
    let closed = fixture.closed_event(&fixture.close_session().await);
    assert_eq!(
        closed.platform_total, 0,
        "settlement must not charge the same profit a second time"
    );
    assert_eq!(closed.user_net, COLLATERAL);
}

/// The mirror of the above, and the one `add_collateral` branch with no
/// coverage at all: principal that a netting moved OUT of funded collateral
/// coming back IN. The memo has to be cancelled in the same motion, or the
/// returning capital is labelled profit - taxed on the way out AND subtracted
/// again at settlement, where the base saturates at zero and the overcharge
/// can never be given back.
///
/// Every self top-up in the suite happens with an empty memo; every top-up
/// after a netting uses the OUTSIDE funder path, which skips this branch.
#[tokio::test]
async fn a_top_up_of_netted_principal_cancels_the_memo_instead_of_banking_it() {
    let mut fixture = PropFixture::new().await;

    // Draw, then net the draw straight off the collateral: no coins move, the
    // cash stays on the account as PRINCIPAL and the memo records it.
    let amount = 1_000_000u64;
    fixture
        .call_account(vec![fixture.draw_call(amount)], 1)
        .await
        .unwrap();
    let net = fixture.repay_from_collateral_call(amount);
    let response = fixture.call_account(vec![net], 0).await.unwrap();
    let netted = fixture
        .deployment
        .pool
        .log_decoder()
        .decode_logs_with_type::<QuoteRepaidFromCollateral>(&response.tx_status.receipts)
        .unwrap();
    assert_eq!(netted.len(), 1);
    assert_eq!(netted[0].from_capitalised, 0);
    assert_eq!(netted[0].decapitalised_total, amount);

    let after_netting = fixture.session().await;
    assert_eq!(after_netting.collateral, COLLATERAL - amount);
    assert_eq!(after_netting.decapitalised, amount);
    assert_eq!(
        fixture.account_balance(fixture.collateral_asset).await,
        amount
    );

    // Put the same coins back. They are the user's own capital returning, not
    // profit: the memo is struck and nothing is banked as share-bearing.
    let top_up = capitalise_call(&fixture, amount);
    let response = fixture.call_account(vec![top_up], 0).await.unwrap();
    let added = fixture
        .deployment
        .pool
        .log_decoder()
        .decode_logs_with_type::<CollateralAdded>(&response.tx_status.receipts)
        .unwrap();
    assert_eq!(added.len(), 1);
    assert_eq!(
        added[0].capitalised_total, 0,
        "returned principal is not profit"
    );

    let restored = fixture.session().await;
    assert_eq!(restored.collateral, COLLATERAL);
    assert_eq!(restored.capitalised, 0);
    assert_eq!(
        restored.decapitalised, 0,
        "the memo is cancelled, not left to subtract at settlement"
    );

    // Back exactly where it started, and the platform is owed nothing: the
    // user made no profit, whichever ledger you read.
    let closed = fixture.closed_event(&fixture.close_session().await);
    assert_eq!(closed.platform_total, 0);
    assert_eq!(closed.user_net, COLLATERAL);
    assert_eq!(closed.bad_debt, 0);
}

// ---------------------------------------------------------------------------
// The pool's own losses.
// ---------------------------------------------------------------------------

/// Drives the fixture's session into a loss past its whole collateral and
/// liquidates it. Returns the bad debt the close booked.
async fn crash_a_maxed_long(fixture: &mut PropFixture) -> u64 {
    let quantity = 5_000_000_000u64;
    let cost = 2_000_000u64;
    let drawn = 10_000_000u64;

    fixture
        .publish_base_price(2_000_000_000_000_000_000u128)
        .await;
    fixture
        .rest_order(cost, quantity, fixture.base_asset, quantity)
        .await;
    let draw = fixture.draw_call(drawn);
    let buy = fixture.book_call(cost, quantity, fixture.collateral_asset, drawn);
    fixture
        .call_account(vec![draw, buy, fixture.settle_book_call()], 2)
        .await
        .unwrap();

    // A twentieth of what it cost: the position no longer covers the draw, let
    // alone the collateral behind it.
    fixture
        .publish_base_price(100_000_000_000_000_000u128)
        .await;
    assert!(fixture.is_liquidatable().await);

    let closed = fixture.closed_event(&fixture.liquidate().await);
    assert_eq!(closed.reason, SettlementReason::Liquidation);
    assert!(closed.bad_debt != 0, "the crash must outrun the collateral");
    closed.bad_debt
}

/// `bad_debt` is a RUNNING total - the pool's cumulative uncovered loss, which
/// is the number that decides whether the whole book is solvent. Every test
/// asserts it against a single close, so replacing the accumulator with a
/// plain write would leave the suite green while the counter silently reset on
/// every liquidation.
#[tokio::test]
async fn bad_debt_accumulates_across_the_sessions_that_caused_it() {
    let mut fixture = PropFixture::new().await;
    assert_eq!(fixture.bad_debt().await, 0);

    let first = crash_a_maxed_long(&mut fixture).await;
    assert_eq!(fixture.bad_debt().await, first);

    // The same account opens again and does the same thing. IDs are monotonic
    // and the ledger is fresh, but the pool's losses are not.
    fixture
        .account
        .methods()
        .start_session(TIER_ID, COLLATERAL, ProlongPeriod::SixHours)
        .call_params(CallParameters::new(
            COLLATERAL,
            fixture.collateral_asset,
            u64::MAX,
        ))
        .unwrap()
        .with_contract_ids(&[
            fixture.deployment.oracle_id,
            fixture.deployment.pool_id,
            fixture.deployment.registry_id,
        ])
        .with_variable_output_policy(VariableOutputPolicy::EstimateMinimum)
        .call()
        .await
        .unwrap();
    assert_eq!(fixture.session().await.session_id, 2);

    let second = crash_a_maxed_long(&mut fixture).await;
    assert_eq!(
        fixture.bad_debt().await,
        first + second,
        "the pool's cumulative loss is the sum of the losses that caused it"
    );
}

// ---------------------------------------------------------------------------
// Nothing is created, nothing is destroyed.
// ---------------------------------------------------------------------------

/// Every settlement test in the suite checks ONE counterparty: the parent's
/// cheque, or the platform's take, or the liquidator's basket, or the bad-debt
/// line. None of them proves the settlement is a redistribution rather than a
/// mint - a leg routed to the wrong payee, or counted twice, moves money
/// between two parties that no single-party assertion can see.
///
/// This closes the system. Six holders can move during a forced exit - the
/// pool, the account, the order book, the parent, the platform and the
/// liquidator - and their deltas must sum to zero for EVERY asset.
#[tokio::test]
async fn a_forced_exit_reconciles_every_counterparty_to_the_coin() {
    let mut fixture = PropFixture::new().await;

    // A liquidator distinct from the platform, or the two legs cannot be told
    // apart in the arithmetic.
    let liquidator = Identity::Address(fixture.outsider.address());
    fixture
        .deployment
        .pool
        .methods()
        .set_liquidator(liquidator)
        .call()
        .await
        .unwrap();

    // Draw more than the position costs: 2_000_000 buys the base, 1_000_000
    // rests in an unfilled order so the cleanup list has real work to do.
    let quantity = 1_000_000_000u64;
    let cost = 2_000_000u64;
    fixture
        .rest_order(cost, quantity, fixture.base_asset, quantity)
        .await;
    let draw = fixture.draw_call(3_000_000);
    let buy = fixture.book_call(cost, quantity, fixture.collateral_asset, cost);
    let park = fixture.book_call(
        1_000_000,
        1_000_000_000,
        fixture.collateral_asset,
        1_000_000,
    );
    fixture
        .call_account(vec![draw, buy, fixture.settle_book_call(), park], 2)
        .await
        .unwrap();
    assert_eq!(fixture.account_balance(fixture.base_asset).await, quantity);

    // Snapshot AFTER all trading, so the only movements left are settlement's.
    let provider = fixture.deployer.try_provider().unwrap().clone();
    let holders = [
        ("pool", fixture.deployment.pool_id),
        ("account", fixture.child_id),
        ("book", fixture.order_book.contract_id),
    ];
    let mut contract_before = Vec::new();
    for (_, id) in holders {
        contract_before.push((
            provider
                .get_contract_asset_balance(&id, &fixture.collateral_asset)
                .await
                .unwrap() as i128,
            provider
                .get_contract_asset_balance(&id, &fixture.base_asset)
                .await
                .unwrap() as i128,
        ));
    }
    let wallets = [
        ("parent", fixture.user.address()),
        ("platform", fixture.deployer.address()),
        ("liquidator", fixture.outsider.address()),
    ];
    let mut wallet_before = Vec::new();
    for (_, address) in wallets {
        wallet_before.push((
            provider
                .get_asset_balance(&address, &fixture.collateral_asset)
                .await
                .unwrap() as i128,
            provider
                .get_asset_balance(&address, &fixture.base_asset)
                .await
                .unwrap() as i128,
        ));
    }
    let bad_debt_before = fixture.bad_debt().await;

    // Expire it, handing the keeper the resting order to cancel.
    let cleanup = crate::prop::PropOrderBookCleanup {
        order_book: fixture.order_book.contract_id,
        order_ids: {
            let orders = fixture
                .order_book
                .order_book
                .methods()
                .get_orders_at_price(crate::order_book_deploy::Side::Buy, 1_000_000)
                .simulate(Execution::state_read_only())
                .await
                .unwrap()
                .value;
            orders
                .into_iter()
                .filter(|o| o.trader_id == Identity::ContractId(fixture.child_id))
                .map(|o| o.order_id)
                .collect()
        },
    };
    assert_eq!(
        cleanup.order_ids.len(),
        1,
        "the keeper has an order to cancel"
    );

    let session = fixture.session().await;
    let latest = provider.latest_block_time().await.unwrap().unwrap();
    let jump = session.expires_at.saturating_sub(latest.timestamp() as u64) + 1;
    provider
        .produce_blocks(
            1,
            Some(
                latest
                    .checked_add_signed(chrono::TimeDelta::seconds(jump as i64))
                    .unwrap(),
            ),
        )
        .await
        .unwrap();

    let response = fixture
        .deployment
        .pool
        .clone()
        .with_account(fixture.outsider.clone())
        .methods()
        .expire_session(fixture.child_id, vec![cleanup])
        .with_contracts(&[
            &fixture.account,
            &fixture.deployment.oracle,
            &fixture.order_book.order_book,
            &fixture.deployment.price_feed,
        ])
        .with_variable_output_policy(VariableOutputPolicy::EstimateMinimum)
        .call()
        .await
        .unwrap();
    let closed = fixture.closed_event(&response);
    assert_eq!(closed.reason, SettlementReason::Expiry);

    // Per asset: every holder's delta, summed, is zero. The settlement moved
    // money between these six and invented none.
    for (index, asset) in [fixture.collateral_asset, fixture.base_asset]
        .into_iter()
        .enumerate()
    {
        let mut total = 0i128;
        for (position, (name, id)) in holders.into_iter().enumerate() {
            let after = provider
                .get_contract_asset_balance(&id, &asset)
                .await
                .unwrap() as i128;
            let before = if index == 0 {
                contract_before[position].0
            } else {
                contract_before[position].1
            };
            let delta = after - before;
            println!("  {name}: {delta}");
            total += delta;
        }
        for (position, (name, address)) in wallets.into_iter().enumerate() {
            let after =
                provider.get_asset_balance(&address, &asset).await.unwrap() as i128;
            let before = if index == 0 {
                wallet_before[position].0
            } else {
                wallet_before[position].1
            };
            let delta = after - before;
            println!("  {name}: {delta}");
            total += delta;
        }
        assert_eq!(
            total, 0,
            "settlement redistributes; it must not create or destroy any asset"
        );
    }

    // The account is empty, the session is gone, and any loss the basket could
    // not cover is on the pool's own books rather than nowhere.
    assert_eq!(fixture.account_balance(fixture.collateral_asset).await, 0);
    assert_eq!(fixture.account_balance(fixture.base_asset).await, 0);
    assert_eq!(
        fixture.bad_debt().await - bad_debt_before,
        closed.bad_debt,
        "the running total moves by exactly what this close booked"
    );
}