Kiln: Railnet Phase 1

$.compoundV3Market.totalSupply() - $.compoundV3Market.totalBorrow()

// SPDX-License-Identifier: BUSL-1.1// SPDX-FileCopyrightText: 2025 Kiln <[email protected]>////                      d8b  888                      888//                      Y8P  888                      888//                           888                      888//    888d888  8888b.   888  888  88888b.    .d88b.   888888//    888P"       "88b  888  888  888 "88b  d8P  Y8b  888//    888     .d888888  888  888  888  888  88888888  888//    888     888  888  888  888  888  888  Y8b.      Y88b.//    888     "Y888888  888  888  888  888   "Y8888    "Y888//pragma solidity >=0.8.33;
import {Test, console2} from "forge-std/Test.sol";
import {ICreateX} from "@createx/ICreateX.sol";import {IERC20} from "@openzeppelin-contracts/token/ERC20/IERC20.sol";
import {Asset, EstimationType, Query, Mode, State} from "src/steam/Query.sol";
import {ExternalAccessControl, IExternalAccessControl} from "src/common/ExternalAccessControl.sol";import {FreezablePausableBeacon} from "src/common/FreezablePausableBeacon.sol";import {CoreFactory} from "src/factories/CoreFactory.sol";import {CompoundV3VehicleFactory} from "src/factories/vehicles/CompoundV3VehicleFactory.sol";import {FeeManagerFactory} from "src/factories/vehicles/FeeManagerFactory.sol";import {Roles} from "src/libs/Roles.sol";import {FeeManager} from "src/vehicles/base/FeeManager.sol";import {IFeeManager} from "src/vehicles/base/interfaces/IFeeManager.sol";import {ModulesManager} from "src/vehicles/base/ModulesManager.sol";import {CompoundV3Vehicle} from "src/vehicles/compound_v3/CompoundV3Vehicle.sol";import {IComet} from "src/vehicles/compound_v3/interfaces/IComet.sol";
contract CompoundV3VehicleMinimalForkTest is Test {    address internal constant MAINNET_CREATEX = 0xba5Ed099633D3B313e4D5F7bdc1305d3c28ba5Ed;    address internal constant COMET_USDC_V3 = 0xc3d688B66703497DAA19211EEdff47f25384cdc3;    address internal constant USDC = 0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48;    address internal constant WETH = 0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2;    uint256 internal constant BLOCK_BEFORE_24524672 = 24_524_671;    address internal constant ABSORB_ABSORBER = 0x6905Cca5716Cc4FAe5692647F3b09A54F2754a87;    address internal constant ABSORBED_ACCOUNT = 0x26922eFd8491b61Ea21F101D075D4abd1d8a953e;    uint256 internal constant BOB_WETH_COLLATERAL = 200_000 ether;
    uint256 internal constant INITIAL_DEPOSIT = 100e6;    uint256 internal constant ALICE_DEPOSIT = 1_000e6;    uint256 internal constant BOB_DEPOSIT = 1e6;    uint256 internal constant DUST_DEPOSIT = 1;
    address internal ADMIN;    address internal DEPLOYER;    address internal ALICE;    address internal BOB;    address internal TREASURY;
    CompoundV3Vehicle internal vehicle;    CoreFactory internal coreFactory;    ExternalAccessControl internal accessControl;    CompoundV3VehicleFactory internal compoundV3Factory;
    function setUp() external {        vm.createSelectFork(vm.envString("MAINNET_RPC"));
        ADMIN = makeAddr("Admin");        DEPLOYER = makeAddr("Deployer");        ALICE = makeAddr("Alice");        BOB = makeAddr("Bob");        TREASURY = makeAddr("Treasury");
        _deployVehicleOnCurrentFork();    }
    function _deployVehicleOnCurrentFork() internal {        coreFactory = new CoreFactory(ICreateX(MAINNET_CREATEX));
        IExternalAccessControl.RoleAttribution[] memory initialRoles = new IExternalAccessControl.RoleAttribution[](1);        initialRoles[0] = IExternalAccessControl.RoleAttribution({role: Roles.FACTORY_SPAWN, account: DEPLOYER});        accessControl = new ExternalAccessControl(1 days, ADMIN, initialRoles);
        CompoundV3Vehicle implementation = new CompoundV3Vehicle();        FreezablePausableBeacon beacon = new FreezablePausableBeacon(address(implementation), accessControl);
        compoundV3Factory = new CompoundV3VehicleFactory(coreFactory, accessControl, beacon, 0);
        deal(USDC, DEPLOYER, 10_000e6);        vm.startPrank(DEPLOYER);        IERC20(USDC).approve(address(compoundV3Factory), type(uint256).max);
        vehicle = compoundV3Factory.spawn(            CompoundV3VehicleFactory.SpawnParams({                compoundV3Market: COMET_USDC_V3,                accessControl: ExternalAccessControl(address(0)),                feeManager: FeeManager(address(0)),                modulesManager: ModulesManager(address(0)),                querySalt: keccak256("bootstrap-query"),                deploymentSalt: keccak256("bootstrap-deployment"),                initialDepositSize: INITIAL_DEPOSIT,                initialExpectedSupply: 1            })        );        vm.stopPrank();
        assertEq(vehicle.asset(), USDC);        assertEq(IComet(COMET_USDC_V3).baseToken(), USDC);        assertTrue(vehicle.isEnabled());    }
    function test_absorb_can_make_max_redeem_optimistic1() external {        // "Start of block 24524672" corresponds to state at the end of block 24524671.        vm.createSelectFork(vm.envString("MAINNET_RPC"), BLOCK_BEFORE_24524672);        _deployVehicleOnCurrentFork();
        deal(USDC, ALICE, ALICE_DEPOSIT);
        uint256 aliceShares = _depositAndUnlock(vehicle, ALICE, ALICE_DEPOSIT, keccak256("alice-absorb-deposit"));        assertGt(aliceShares, 0);
        uint256 bobBorrowed = _borrowAvailableLiquidityAsBob();        assertGt(bobBorrowed, 0);
        uint256 cometUsdcCashBeforeAbsorb = IERC20(USDC).balanceOf(COMET_USDC_V3);        uint256 reportedLiquidityBeforeAbsorb = _reportedCometAvailableLiquidity();
        address[] memory absorbAccounts = new address[](1);        absorbAccounts[0] = ABSORBED_ACCOUNT;
        bytes memory cometTotalSupply;        bytes memory cometTotalBorrow;
        (, cometTotalSupply) = COMET_USDC_V3.call(abi.encodeWithSignature("totalSupply()"));        (, cometTotalBorrow) = COMET_USDC_V3.call(abi.encodeWithSignature("totalBorrow()"));        console2.log("cometTotalSupply ", uint256(bytes32(cometTotalSupply)));        console2.log("cometTotalBorrow ", uint256(bytes32(cometTotalBorrow)));
        // MethodID 0xc3cecfd2: absorb(address,address[])        // (bool absorbSuccess,) =        //     COMET_USDC_V3.call(abi.encodeWithSelector(bytes4(0xc3cecfd2), ABSORB_ABSORBER, absorbAccounts));        // assertTrue(absorbSuccess);
        // (, cometTotalSupply) = COMET_USDC_V3.call(abi.encodeWithSignature("totalSupply()"));        // (, cometTotalBorrow) = COMET_USDC_V3.call(abi.encodeWithSignature("totalBorrow()"));        // console2.log("cometTotalSupply ", uint256(bytes32(cometTotalSupply)));        // console2.log("cometTotalBorrow ", uint256(bytes32(cometTotalBorrow)));
        // Asset[] memory maxRedeemAssets = vehicle.maxRedeem(ALICE); --> fails
        Query memory redeemQuery = Query({            owner: ALICE,            receiver: ALICE,            input: _singleAsset(address(vehicle), 1),            output: new Asset[](0),            mode: Mode.REDEEM,            salt: keccak256("alice-max-redeem-after-absorb"),            data: ""        });
        vm.startPrank(ALICE);        IERC20(address(vehicle)).approve(address(vehicle), 1);        vm.expectRevert();        vehicle.create(redeemQuery); // FAIL: panic: arithmetic underflow or overflow (0x11)        //   cometTotalSupply  381832487932364        //   cometTotalBorrow  381832487932375        vm.stopPrank();    }
    function _borrowAvailableLiquidityAsBob() internal returns (uint256 borrowedAssets) {        deal(WETH, BOB, BOB_WETH_COLLATERAL);
        vm.startPrank(BOB);        IERC20(WETH).approve(COMET_USDC_V3, BOB_WETH_COLLATERAL);        IComet(COMET_USDC_V3).supply(WETH, BOB_WETH_COLLATERAL);        vm.stopPrank();
        uint256 reportedLiquidity = _reportedCometAvailableLiquidity();        assertGt(reportedLiquidity, 1);
        // Target near-full utilization. If account constraints prevent full drain, find Bob's max.        uint256 borrowTarget = reportedLiquidity + 10; // ---> Here we want to exceed the supply rate        borrowedAssets = _findMaxBorrowableAsBob(borrowTarget);        assertGt(borrowedAssets, 0);
        bytes memory cometTotalSupply;        bytes memory cometTotalBorrow;
        (, cometTotalSupply) = COMET_USDC_V3.call(abi.encodeWithSignature("totalSupply()"));        (, cometTotalBorrow) = COMET_USDC_V3.call(abi.encodeWithSignature("totalBorrow()"));        console2.log("cometTotalSupply ", uint256(bytes32(cometTotalSupply)));        console2.log("cometTotalBorrow ", uint256(bytes32(cometTotalBorrow)));
        vm.prank(BOB);        IComet(COMET_USDC_V3).withdraw(USDC, borrowedAssets);
        (, cometTotalSupply) = COMET_USDC_V3.call(abi.encodeWithSignature("totalSupply()"));        (, cometTotalBorrow) = COMET_USDC_V3.call(abi.encodeWithSignature("totalBorrow()"));        console2.log("cometTotalSupply ", uint256(bytes32(cometTotalSupply)));        console2.log("cometTotalBorrow ", uint256(bytes32(cometTotalBorrow)));    }
    function _findMaxBorrowableAsBob(uint256 upperBound) internal returns (uint256 maxBorrow) {        uint256 low = 0;        uint256 high = upperBound;
        while (low < high) {            uint256 mid = low + (high - low + 1) / 2;            uint256 snap = vm.snapshotState();            vm.prank(BOB);            (bool success,) = COMET_USDC_V3.call(abi.encodeWithSelector(IComet.withdraw.selector, USDC, mid));            vm.revertToState(snap);
            if (success) {                low = mid;            } else {                high = mid - 1;            }        }
        return low;    }
    function _reportedCometAvailableLiquidity() internal view returns (uint256) {        uint256 totalSupply_ = IComet(COMET_USDC_V3).totalSupply();        uint256 totalBorrow_ = IComet(COMET_USDC_V3).totalBorrow();        return totalBorrow_ >= totalSupply_ ? 0 : totalSupply_ - totalBorrow_;    }
    function _singleAsset(address asset, uint256 value) internal pure returns (Asset[] memory assets) {        assets = new Asset[](1);        assets[0] = Asset({asset: asset, value: value});    }
    function _depositAndUnlock(CompoundV3Vehicle target, address owner, uint256 assets, bytes32 salt)        internal        returns (uint256 sharesReceived)    {        Asset[] memory input = _singleAsset(USDC, assets);        Query memory query = Query({            owner: owner,            receiver: owner,            input: input,            output: target.estimate(input, Mode.DEPOSIT, EstimationType.OUTPUT),            mode: Mode.DEPOSIT,            salt: salt,            data: ""        });
        vm.startPrank(owner);        IERC20(USDC).approve(address(target), assets);        State createState = target.create(query);        assertEq(uint256(createState), uint256(State.UNLOCKING));        (State unlockState, Asset[] memory unlockedAssets) = target.unlock(query);        vm.stopPrank();
        assertEq(uint256(unlockState), uint256(State.SETTLED));        assertEq(unlockedAssets.length, 1);        assertEq(unlockedAssets[0].asset, address(target));        sharesReceived = unlockedAssets[0].value;    }}

function onOperations(        uint256 currentTotalSupply,        uint256 currentTotalAssets,        uint8 assetDecimals,        uint8 sharesDecimals    ) external returns (uint256 feeSharesToMint) {

function _handleFeesBeforeOperation(uint256 totalSupply_, uint256 totalAssets_, Id qid) internal returns (uint256) {        // ...                    uint256 _feeSharesToMint =                _feeManager.onOperations(totalSupply_, totalAssets_, decimals(), _assetDecimals());
        // ...    }

// ============================================================================    // Decimals Confusion Tests    // ============================================================================
    /// @notice Demonstrates that swapping assetDecimals and sharesDecimals in previewOnOperations    ///         produces different fee share amounts, exposing the parameter ordering confusion    ///         between onOperations (sharesDecimals, assetDecimals) and previewOnOperations (assetDecimals, sharesDecimals).    function testPreviewOnOperationsDecimalsConfusion() public {        // Setup: 20% performance fee        IFeeManager.Fees memory _fees = IFeeManager.Fees({            performanceFeeBps: 2000,            managementFeeBps: 200, // 2% annually            depositFeeBps: 0,            redeemFeeBps: 0        });
        IFeeManager.Fees memory _maxFees = IFeeManager.Fees({            performanceFeeBps: 5000, managementFeeBps: 1000, depositFeeBps: 1000, redeemFeeBps: 1000        });
        IFeeManager.FeeRecipient[] memory _recipients = _createDefaultRecipients();        $feeManager = _deployFeeManager(_fees, _maxFees, _recipients);
        uint256 _initialAssets = 10e6; // 6-decimal asset (e.g. USDC)        uint256 _currentAssets = 11e6; // 100e6 profit        uint256 _totalSupply = 0; // 18-decimal shares
        // Set initial cache        vm.prank($mockVehicle);        $feeManager.onUpdate(_initialAssets);
        // Fast forward 1 year (so management fee also kicks in)        vm.warp(block.timestamp + 365 days);
        // Call 1: Correct ordering — assetDecimals=6, sharesDecimals=18        vm.prank($mockVehicle);        uint256 _feeSharesCorrect = $feeManager.previewOnOperations(_totalSupply, _currentAssets, 6, 18);
        // Call 2: Swapped ordering — assetDecimals=18, sharesDecimals=6 (the confusion)        vm.prank($mockVehicle);        uint256 _feeSharesSwapped = $feeManager.previewOnOperations(_totalSupply, _currentAssets, 18, 6);
        emit log_named_uint("Fee shares (assetDecimals=6, sharesDecimals=18)", _feeSharesCorrect);        emit log_named_uint("Fee shares (assetDecimals=18, sharesDecimals=6)", _feeSharesSwapped);        emit log_named_uint("Difference", _feeSharesCorrect > _feeSharesSwapped ? _feeSharesCorrect - _feeSharesSwapped : _feeSharesSwapped - _feeSharesCorrect);
        // These should differ if the decimals actually matter for the conversion        // This demonstrates the impact of the confusion        if (_feeSharesCorrect != _feeSharesSwapped) {            emit log("DECIMALS CONFUSION: different results when swapping assetDecimals and sharesDecimals");        } else {            emit log("No difference detected (same decimals or scaling cancels out)");        }    }

diff --git a/src/vehicles/base/FeeManager.sol b/src/vehicles/base/FeeManager.solindex 3042b703..86420ead 100644--- a/src/vehicles/base/FeeManager.sol+++ b/src/vehicles/base/FeeManager.sol@@ -273,8 +273,8 @@ contract FeeManager is IFeeManager, Interceptor, ReentrancyGuardUpgradeable, Ext     function onOperations(         uint256 currentTotalSupply,         uint256 currentTotalAssets,-        uint8 assetDecimals,-        uint8 sharesDecimals+        uint8 sharesDecimals,+        uint8 assetDecimals     ) external returns (uint256 feeSharesToMint) {         (uint256 _managementFeeSharesToMint, uint256 _performanceFeeSharesToMint) =             _previewOnOperations(currentTotalSupply, currentTotalAssets, assetDecimals, sharesDecimals);@@ -302,8 +302,8 @@ contract FeeManager is IFeeManager, Interceptor, ReentrancyGuardUpgradeable, Ext     function previewOnOperations(         uint256 currentTotalSupply,         uint256 currentTotalAssets,-        uint8 assetDecimals,-        uint8 sharesDecimals+        uint8 sharesDecimals,+        uint8 assetDecimals     ) external view returns (uint256 feeSharesToMint) {         (uint256 _managementFeeSharesToMint, uint256 _performanceFeeSharesToMint) =             _previewOnOperations(currentTotalSupply, currentTotalAssets, assetDecimals, sharesDecimals);

forge test --match-contract "ERC4626VehicleCeilRoundingBugTest" --mt test_vehicle_estimateDepositInput_CeilRoundingBug -vv

// SPDX-License-Identifier: BUSL-1.1pragma solidity >=0.8.33;
import {Test} from "@forge-std/Test.sol";import {Math} from "@openzeppelin-contracts/utils/math/Math.sol";import {SharesLib} from "src/libs/Shares.sol";import {Query, Route, Mode, Asset, State, EstimationType} from "src/steam/Query.sol";import {ERC4626VehicleFactory} from "src/factories/vehicles/ERC4626VehicleFactory.sol";import {ERC4626Mock} from "test/vehicles/mocks/ERC4626Mock.sol";import {ERC20Mock} from "test/vehicles/mocks/ERC20Mock.sol";import {STEAMSingleAssetTester} from "test/test_utils/STEAM.SingleAsset.t.sol";import {Tester, TesterCommon, TesterTypes} from "test/test_utils/steam/utils/Tester.sol";import {ExternalAccessControl} from "src/common/ExternalAccessControl.sol";import {FeeManager} from "src/vehicles/base/FeeManager.sol";import {ModulesManager} from "src/vehicles/base/ModulesManager.sol";import {BaseVehicle} from "src/vehicles/base/BaseVehicle.sol";import {IERC20Metadata} from "@openzeppelin-contracts/token/ERC20/extensions/IERC20Metadata.sol";
/// @title PoC: SharesLib.convertToAssets Ceil rounding defeated by downscale truncation/// @notice When sharesDecimals(18) > assetDecimals(6), the floor division in///         downscaleAssets() negates the Ceil rounding from Math.mulDiv().///         This violates the invariant: convertToAssets(..., Ceil) >= convertToAssets(..., Floor)///         for the same inputs when the mathematical result is non-integer.//////         Affected production paths (all with USDC/USDT/WBTC underlying):///         - SingleAssetBaseVehicle._convertToAssets (estimate DEPOSIT+INPUT)///         - MultiVehicle._convertToAssets (estimate DEPOSIT+INPUT)///         - Conduit._convertConduitSharesToVehicleShares (estimate INPUT)


// =============================================================================// PART 1: ERC4626 Vehicle end-to-end test// =============================================================================
contract ERC4626VehicleCeilRoundingBugTest is STEAMSingleAssetTester {    using Tester for Query;    using TesterCommon for TesterTypes.AssertBalance[];    using TesterCommon for TesterTypes.AssertAmount[];
    ERC4626Mock internal $underlyingAsset;
    function setUp() public virtual {        // Deploy USDC-like token (6 decimals) and ERC4626 vault        $asset = new ERC20Mock("USDC", "USDC", 6);        $underlyingAsset = new ERC4626Mock(address($asset), "Vault", "vUSDC", 12);
        // Deploy vehicle through factory (initial deposit = 1 USDC = 1e6)        ($vehicle,) = _deployERC4626Vehicle(            _deployCoreFactory(),            ERC4626VehicleFactory.SpawnParams({                vault: address($underlyingAsset),                accessControl: ExternalAccessControl(address(0)),                feeManager: FeeManager(address(0)),                modulesManager: ModulesManager(address(0)),                querySalt: keccak256("INITIAL_DEPOSIT_QUERY"),                deploymentSalt: keccak256("DEPLOYMENT_SALT"),                initialDepositSize: 1e6, // 1 USDC                initialExpectedSupply: 1e18            })        );
        vm.label(address($asset), "USDC");        vm.label(address($underlyingAsset), "vUSDC-vault");        vm.label(address($vehicle), "vehicle");    }
    /// @notice End-to-end PoC through the vehicle's estimate() function.    ///    ///   Setup:    ///     1. After setUp: totalSupply=1e18, totalAssets=1e6 (1:1 rate)    ///     2. Alice deposits 2 USDC → totalSupply=3e18, totalAssets=3e6    ///     3. Simulate loss: set vault USDC to 2e6 → totalSupply=3e18, totalAssets=2e6    ///    ///   Bug demonstration:    ///     estimate([{vehicle, 1e18}], DEPOSIT, INPUT) asks:    ///       "How many USDC do I need to deposit to get 1e18 shares?"    ///     Uses Ceil rounding (favor protocol: charge user more).    ///     math: 1e18 * 2e6 / 3e18 = 666_666.67 → Ceil = 666_667 USDC-wei    ///     But returns: 666_666 (same as Floor, user is undercharged by 1 USDC-wei)    function test_vehicle_estimateDepositInput_CeilRoundingBug() public {        address alice = makeAddr("alice");
        // Step 1: Verify initial state        assertEq($vehicle.totalSupply(), 1e18, "Initial totalSupply");        assertEq($vehicle.totalAssets(), 1e6, "Initial totalAssets");        assertEq($vehicle.decimals(), 18, "Vehicle shares = 18 decimals");        assertEq($asset.decimals(), 6, "USDC = 6 decimals");
        // Step 2: Alice deposits 2 USDC to get totalSupply=3e18        uint256 depositAmount = 2e6;        Query memory _depositQuery = _get_and_prepare_query(alice, alice, Mode.DEPOSIT, depositAmount);        vm.prank(alice);        $vehicle.create(_depositQuery);        vm.prank(alice);        $vehicle.unlock(_depositQuery);
        assertEq($vehicle.totalSupply(), 3e18, "totalSupply after deposit");        assertEq($vehicle.totalAssets(), 3e6, "totalAssets after deposit");
        // Step 3: Simulate a loss — reduce vault's USDC balance to 2e6        // This creates totalSupply=3e18, totalAssets=2e6 (non-trivial exchange rate)        deal(address($asset), address($underlyingAsset), 2e6);        assertEq($vehicle.totalAssets(), 2e6, "totalAssets after simulated loss");        assertEq($vehicle.totalSupply(), 3e18, "totalSupply unchanged");
        // Step 4: Estimate DEPOSIT+INPUT — "How many USDC for 1e18 shares?"        // This path uses Ceil rounding (SingleAssetBaseVehicle._convertToAssets with roundUp=true)        Asset[] memory depositSharesOutput = new Asset[](1);        depositSharesOutput[0] = Asset({asset: address($vehicle), value: 1e18});
        Asset[] memory assetsNeeded = $vehicle.estimate(depositSharesOutput, Mode.DEPOSIT, EstimationType.INPUT);
        // Mathematical result: 1e18 * 2e6 / 3e18 = 666_666.666... USDC-wei        // With Ceil: should be 666_667 (round up to charge user more, favor protocol)        // BUG: returns 666_666 (same as Floor, protocol is shortchanged)        assertEq(assetsNeeded[0].asset, address($asset), "Output asset is USDC");        assertEq(assetsNeeded[0].value, 666_666, "BUG: estimate returns 666_666 (should be 666_667)");
        // Verify Floor also returns 666_666 using SharesLib directly        uint256 floorResult = SharesLib.convertToAssets(            1e18, 18, 6, $vehicle.totalSupply(), $vehicle.totalAssets(), Math.Rounding.Floor        );        assertEq(floorResult, 666_666, "Floor = 666_666");
        // Ceil == Floor, violating the rounding invariant        assertEq(assetsNeeded[0].value, floorResult, "BUG: Ceil estimate == Floor");
        // Step 5: Actually deposit the estimated amount and verify shares received        // The estimate said 666_666 USDC buys 1e18 shares — let's test that claim.        address bob = makeAddr("bob");        uint256 estimatedCost = assetsNeeded[0].value; // 666_666
        uint256 bobSharesBefore = $vehicle.balanceOf(bob);        assertEq(bobSharesBefore, 0, "Bob starts with 0 shares");
        Query memory _bobDeposit = _get_and_prepare_query(bob, bob, Mode.DEPOSIT, estimatedCost);        vm.prank(bob);        $vehicle.create(_bobDeposit);        vm.prank(bob);        $vehicle.unlock(_bobDeposit);
        uint256 bobSharesAfter = $vehicle.balanceOf(bob);        uint256 actualSharesReceived = bobSharesAfter - bobSharesBefore;
        // Bob deposited exactly what the estimate said was needed for 1e18 shares,        // but received fewer: 999_999_000_000_000_000 instead of 1_000_000_000_000_000_000        // The shortfall is 1_000_000_000_000 (1e12) shares.        assertEq(actualSharesReceived, 999_999_000_000_000_000, "Actual shares received");        assertTrue(actualSharesReceived < 1e18, "BUG: Got fewer shares than the estimate promised");        assertEq(1e18 - actualSharesReceived, 1e12, "Shortfall = 1e12 shares");    }}

function grantScopedRole(bytes32 role, address scope, address account)    public    virtual    onlyRole(getRoleAdmin(role))    notPublicScopedRole(role, scope){	if (role == DEFAULT_ADMIN_ROLE) {    	revert AccessControlEnforcedDefaultAdminRules();    }    _grantScopedRole(role, scope, account);}
function _grantScopedRole(bytes32 role, address scope, address account) internal virtual returns (bool) {    bytes32 _encodedRole = _encodeScopedRole(role, scope);    bool granted = _grantRole(_encodedRole, account);    if( granted ) {    	emit ScopedRoleGranted(role, scope, account, _msgSender());    }    return granted;}

{    Asset[] memory _max = query.mode == Mode.DEPOSIT        ? _maxDeposit(msg.sender, __totalSupply, __totalAssets)        : _maxRedeem(msg.sender, __totalSupply, __totalAssets);
    if (!AssetLib.assetsMatching(query.input, _max)) {        if (query.mode == Mode.DEPOSIT) {            revert ErrorLib.MaxDepositTooLow(query.input, _max);        } else {            revert ErrorLib.MaxRedeemTooLow(query.input, _max);        }    }}

/// @dev Warning: Wrong for `feeRecipient` because their supply shares increase is not taken into account.

function convertToAssets(    uint256 shares,    uint8 sharesDecimals,    uint8 assetDecimals,    uint256 totalSupply,    uint256 totalAssets,    Math.Rounding rounding) internal pure returns (uint256 assets) {
    if (totalSupply == 0) {        return scale(shares, sharesDecimals, assetDecimals);    }    return downscaleAssets(        Math.mulDiv(            upscaleShares(shares, sharesDecimals, assetDecimals),            upscaleAssets(totalAssets, sharesDecimals, assetDecimals),            upscaleShares(totalSupply, sharesDecimals, assetDecimals),            rounding        ),        sharesDecimals,        assetDecimals    );}
function convertToShares(    uint256 assets,    uint8 sharesDecimals,    uint8 assetDecimals,    uint256 totalSupply,    uint256 totalAssets,    Math.Rounding rounding) internal pure returns (uint256 shares) {    if (totalSupply == 0) {        return scale(assets, assetDecimals, sharesDecimals);    }    if (totalAssets == 0) {        revert ZeroTotalAssets();    }    return downscaleShares(        Math.mulDiv(            upscaleAssets(assets, sharesDecimals, assetDecimals),            upscaleShares(totalSupply, sharesDecimals, assetDecimals),            upscaleAssets(totalAssets, sharesDecimals, assetDecimals),            rounding        ),        sharesDecimals,        assetDecimals    );}

// SPDX-License-Identifier: BUSL-1.1pragma solidity >=0.8.33;
import {    STEAMSingleAssetTester,    IERC20Metadata,    AaveV3VehicleFactory,    Asset,    Query,    State,    Mode,    EstimationType,    ErrorLib,    IERC20,    Tester,    Route} from "test/vehicles/aave_v3/AaveV3Vehicle.t.sol";import {IPoolAddressesProvider} from "src/vehicles/aave_v3/interfaces/IPoolAddressesProvider.sol";import {IPoolDataProvider} from "src/vehicles/aave_v3/interfaces/IPoolDataProvider.sol";import {ForkUtils} from "test/test_utils/ForkUtils.sol";import {IExternalAccessControl, ExternalAccessControl} from "src/common/ExternalAccessControl.sol";import {FeeManager} from "src/vehicles/base/FeeManager.sol";import {ModulesManager} from "src/vehicles/base/ModulesManager.sol";import {Vm} from "@forge-std/Test.sol";import {CoreFactory, ICreateX} from "src/factories/CoreFactory.sol";import {Roles} from "src/libs/Roles.sol";import {AccessControlFactory} from "src/factories/common/AccessControlFactory.sol";import {ModulesManagerFactory} from "src/factories/vehicles/ModulesManagerFactory.sol";import {AaveV3MerklModule} from "src/vehicles/aave_v3/modules/AaveV3Merkl.mod.sol";import {SafeERC20} from "@openzeppelin-contracts/token/ERC20/utils/SafeERC20.sol";import {IDistributionCreator} from "src/vehicles/base/interfaces/IDistributionCreator.sol";import {BaseVehicleErrors} from "src/vehicles/base/abstracts/BaseVehicleErrors.sol";import 'forge-std/console.sol';
interface IAToken {    function balanceOf(address account) external view returns (uint256);    function scaledBalanceOf(address user) external view returns (uint256);}
interface IPool {    function deposit(address asset, uint256 amount, address onBehalfOf, uint16 referralCode) external;}
contract _SErosionStudySingleTest is STEAMSingleAssetTester, ForkUtils {    using Tester for Query;    using SafeERC20 for IERC20;
    address internal constant BURN_ADDRESS = address(0x000000000000000000000000000000000000dEaD);    address internal constant $USDC = 0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48;    address internal constant $DAI = 0x6B175474E89094C44Da98b954EedeAC495271d0F;    address internal constant $poolAddressesProvider = 0x2f39d218133AFaB8F2B819B1066c7E434Ad94E9e;    address internal constant $distributionCreator = 0x8BB4C975Ff3c250e0ceEA271728547f3802B36Fd;    address internal $pool;    address internal $poolDataProvider;    ExternalAccessControl internal $accessControl;    ModulesManager internal $modulesManager;    Vm.Wallet private $admin;    CoreFactory _coreFactory;    uint256 salt;
    function setUp() external {        _startFork("MAINNET");        $asset = IERC20Metadata($USDC);        $admin = vm.createWallet("admin");
        _coreFactory = _deployCoreFactory(ICreateX(0xba5Ed099633D3B313e4D5F7bdc1305d3c28ba5Ed));
        ExternalAccessControl.RoleAttribution[] memory _roles = new IExternalAccessControl.RoleAttribution[](5);        _roles[0] = IExternalAccessControl.RoleAttribution({role: Roles.EXEC, account: $admin.addr});        _roles[1] = IExternalAccessControl.RoleAttribution({role: Roles.MODULE_MANAGER, account: $admin.addr});        _roles[2] = IExternalAccessControl.RoleAttribution({role: Roles.CANCEL_MODULE, account: $admin.addr});        _roles[3] = IExternalAccessControl.RoleAttribution({role: Roles.UPDATE_TIMELOCK, account: $admin.addr});        _roles[4] = IExternalAccessControl.RoleAttribution({role: Roles.VEHICLE_ALLOW, account: $admin.addr});
        ($accessControl,) = _deployAccessControl(            _coreFactory,            AccessControlFactory.SpawnParams({                initialDelay: 0,                initialDefaultAdmin: makeAddr("access_control_admin"),                initialRoles: _roles,                deploymentSalt: keccak256("vehicle_access_control")            })        );
        ($modulesManager,) = _deployModulesManager(            _coreFactory,            ModulesManagerFactory.SpawnParams({                initialTimelock: 0, accessControl: $accessControl, deploymentSalt: "MODULES_MANAGER"            })        );
        ($vehicle,) = _deployAaveV3Vehicle(            _coreFactory,            AaveV3VehicleFactory.SpawnParams({                asset: address($asset),                poolAddressesProvider: $poolAddressesProvider,                accessControl: $accessControl,                feeManager: FeeManager(address(0)),                modulesManager: $modulesManager,                querySalt: keccak256("INITIAL_DEPOSIT_QUERY"),                deploymentSalt: keccak256("DEPLOYMENT_SALT"),                initialDepositSize: _unit(1),                initialExpectedSupply: 1e18            })        );
        vm.startPrank(makeAddr("access_control_admin"));        $accessControl.setRolePublic(Roles.VEHICLE_STEAM, true);        vm.stopPrank();
        $pool = IPoolAddressesProvider($poolAddressesProvider).getPool();        $poolDataProvider = IPoolAddressesProvider($poolAddressesProvider).getPoolDataProvider();        $multiDepositRangeMin = 4;        $multiDepositRangeMax = 16;

        vm.startPrank($admin.addr);        IDistributionCreator($distributionCreator).acceptConditions();        vm.stopPrank();    }
    enum ProofType {        LOSS,        EARN    }
    function testStudyEarn(uint256 initialDeposit, uint256 split) public {        initialDeposit = bound(initialDeposit, _unit(1), _unit(1_000_000));        split = bound(split, 1, 1000);        execTest(ProofType.EARN, 10, initialDeposit, split);    }
    function testStudyLoss(uint256 initialDeposit, uint256 split) public {        initialDeposit = bound(initialDeposit, _unit(1), _unit(1_000_000));        split = bound(split, 1, 1000);        execTest(ProofType.LOSS, 10, initialDeposit, split);    }
    function execTest(ProofType proofType, uint256 threshold, uint256 initialDeposit, uint256 split) public {        address es = makeAddr("existingSupplier");        _deposit(es, _unit(1));
        address u1 = makeAddr("u1");
        (uint256 aTokenScaledBalanceStart, uint256 aTokenBalanceStart) = fetchVehicleBalances(address($asset));        uint256 vShareDeposit = _deposit(u1, initialDeposit);        uint256 u1Shares = $vehicle.balanceOf(u1);        uint256 redeemAmount = u1Shares / split;                for( uint256 i = 0; i < split; i++ ) {            (uint256 aTokenScaledBalanceBeforeRedeem, uint256 aTokenBalanceBeforeRedeem) = fetchVehicleBalances(address($asset));            if( i == split - 1) redeemAmount = $vehicle.balanceOf(u1);            uint256 tokenWithdrawn = _redeem(u1, redeemAmount);            (uint256 aTokenScaledBalanceAfterRedeem, uint256 aTokenBalanceAfterRedeem) = fetchVehicleBalances(address($asset));            console.log('v token burned.  ', aTokenScaledBalanceBeforeRedeem-aTokenScaledBalanceAfterRedeem);            console.log('u token burned.  ', redeemAmount);            console.log('v token withdrawn', aTokenBalanceBeforeRedeem-aTokenBalanceAfterRedeem);            console.log('u token withdrawn', tokenWithdrawn);                    }        (uint256 aTokenScaledBalanceEnd, uint256 aTokenBalanceEnd) = fetchVehicleBalances(address($asset));
        console.log('vb ini', aTokenBalanceStart);        console.log('vb end', aTokenBalanceEnd);        console.log('ub ini', initialDeposit);        console.log('ub end', IERC20(address($asset)).balanceOf(u1));
        // how much has changed the existing suppliers balance in value?        console.log('es value', estimateUserBalance(es));
        if( aTokenBalanceEnd > aTokenBalanceStart ) {            // Vehicle is EARNING            console.log('v EARN', aTokenBalanceEnd-aTokenBalanceStart);            console.log('u LOSS', initialDeposit-IERC20(address($asset)).balanceOf(u1));            if( proofType == ProofType.EARN ) assertLt(aTokenBalanceEnd-aTokenBalanceStart, threshold);        } else if ( aTokenBalanceEnd < aTokenBalanceStart ) {            // Vehicle is LOSING            console.log('v LOSS', aTokenBalanceStart-aTokenBalanceEnd);            console.log('u LOSS', initialDeposit-IERC20(address($asset)).balanceOf(u1));            if( proofType == ProofType.LOSS ) assertLt(aTokenBalanceStart-aTokenBalanceEnd, threshold);        } else {            // no-loss-earn scenario        }    }
    function estimateUserBalance(address user) public returns (uint256) {        uint256 userVehicleBalance = $vehicle.balanceOf(user);        if(userVehicleBalance == 0) return 0;        Asset[] memory assets = new Asset[](1);        assets[0] = Asset({asset: address($vehicle), value: userVehicleBalance});        Asset[] memory output = $vehicle.estimate(assets, Mode.REDEEM, EstimationType.OUTPUT);        return output[0].value;    }
    function _deposit(address user, uint256 amount) public returns (uint256 output) {        // uint256 _depositAmount = _unit(amount);        uint256 _depositAmount = amount;        deal(address($asset), user, _depositAmount);        vm.startPrank(user);        IERC20(address($asset)).approve(address($vehicle), _depositAmount);        Asset[] memory _depositAssets = new Asset[](1);        _depositAssets[0] = Asset({asset: address($asset), value: _depositAmount});        Asset[] memory _depositOutput = new Asset[](1);        _depositOutput[0] = Asset({asset: address($vehicle), value: 0});        Query memory _query = Query({            owner: user,            receiver: user,            input: _depositAssets,            mode: Mode.DEPOSIT,            salt: bytes32(salt++),            output: _depositOutput,            data: ""        });        $vehicle.create(_query);        (State newState, Asset[] memory assets) = $vehicle.unlock(_query);        vm.stopPrank();
        return assets[0].value;    }
    function _redeem(address user, uint256 amount) public returns (uint256 output) {        Asset[] memory _assets = new Asset[](1);        _assets[0] = Asset({asset: address($vehicle), value: amount});        Asset[] memory _output = new Asset[](1);        _output[0] = Asset({asset: address($asset), value: 0});        Query memory _query = Query({            owner: user,             receiver: user,             input: _assets,             mode: Mode.REDEEM,             salt: bytes32(salt++),             output: _output,             data: ""        });
        vm.startPrank(user);        $vehicle.create(_query);        (State newState, Asset[] memory assets) = $vehicle.unlock(_query);        vm.stopPrank();
        return assets[0].value;    }
    function fetchVehicleBalances(address underlying) public returns (uint256, uint256) {        (address _aToken,,) = IPoolDataProvider($poolDataProvider).getReserveTokensAddresses(underlying);        uint256 aTokenScaledBalance = IAToken(_aToken).scaledBalanceOf(address($vehicle));        uint256 aTokenBalance = IAToken(_aToken).balanceOf(address($vehicle));        return (aTokenScaledBalance, aTokenBalance);    }    }