Source – Alkane 2:88003 — SUBFROST Explorer

docs/TEST_LIST.md17,202 B

# FIRE Token System — Test Checklist
## Core Mechanics
- [x] Stake LP → receive NFT + wLP
- [x] wLP fungible (single token for all positions)
- [x] wLP amount = deposit amount (1:1 with LP)
- [x] NFT stores checkpoint, weight, lock_end
- [x] ClaimRewards with NFT → FIRE (Synthetix accumulator)
- [x] Unstake requires NFT + matching wLP
- [x] Unstake without wLP → rejected
- [x] Unstake returns LP + FIRE
## Expiry (halving boundary)
- [x] Expiry = next halving boundary (or explicit at init)
- [x] Stake after expiry → rejected
- [x] Lock duration cannot exceed expiry
- [x] FIRE accrual capped at expiry (global accumulator capped)
- [x] RedeemExpired: wLP → LP after expiry (no NFT needed)
- [x] Final claim: NFT consumed after expiry, weight removed
## Dilution / Fairness
- [x] New staker dilutes future rewards (not past)
- [x] Per-block rate equal for equal weight at same moment
- [x] Checkpoint protects past rewards when new staker enters
- [x] Staker A claims, staker B enters, A claims again — rewards correct
- [x] Early staker > late staker per-LP (solo period advantage)
## Lock Multipliers
- [x] No lock (0) → multiplier 1.0x
- [x] 1 week (1050 blk) → 1.25x
- [x] 1 month (4375 blk) → 1.5x
- [x] 3 months (13125 blk) → 2.0x
- [x] 6 months (26250 blk) → 2.5x
- [x] 1 year (52500 blk) → 3.0x
- [x] Lock = 0 → can unstake immediately
- [x] Lock > 0 → cannot unstake before lock_end
- [x] Lock = 0 and lock > 0 both earn FIRE
- [x] Lock expired → can unstake normally
- [x] Multiplier affects weighted_stake → more FIRE per block
## Split / Merge
- [x] Stake returns NFT only (no wLP)
- [x] Split(NFT) → NFT + wLP (wLP = deposit_amount, minted)
- [x] Split already-split position → rejected
- [x] Merge(NFT + wLP) → NFT (full position restored, wLP burned)
- [x] Merge non-split position → rejected
- [x] Merge with insufficient wLP → rejected
- [x] Merge with excess wLP → excess returned
- [x] Unstake non-split position → LP + FIRE
- [x] Unstake split position without wLP → rejected
- [x] Unstake split position with wLP → LP + FIRE
- [x] Unstake split position with excess wLP → excess returned
- [x] Split → NFT holder can only ClaimRewards
- [x] wLP supply = 0 after all burns
- [x] RedeemExpired after split: wLP → LP
- [x] Final FIRE claim after expiry with split position
## wLP Supply Invariant
- [x] wLP mint ONLY via Split (fire-staking = vault)
- [x] wLP burn via Merge / Unstake(split) / RedeemExpired
- [x] wLP total supply ≤ LP held by staking contract
- [x] Unstake non-split does not create or burn wLP
- [x] Two Splits from different positions → wLP supply = sum of deposits
- [ ] Revert returns all incoming (wLP not lost on error) — ALKANES runtime level
## wLP Market Scenarios
- [x] Sell wLP: holder loses LP claim, keeps NFT FIRE stream
- [x] Buy wLP + someone else's NFT → unstake works (wLP fungible)
- [x] wLP holder without NFT → wait expiry → RedeemExpired
- [x] NFT holder without wLP → cannot unstake
- [x] NFT holder after expiry without wLP → final FIRE claim
## Edge Cases
- [x] Stake 0 LP → rejected
- [x] Stake with wrong LP token → rejected
- [x] Double unstake (same NFT) → rejected
- [x] ClaimRewards with 0 pending → no-op, NFT returned
- [x] RedeemExpired before expiry → rejected
- [x] RedeemExpired with 0 wLP → rejected
- [x] Multiple stakes → multiple NFTs, one wLP pool
- [x] Very small stake (1 unit LP) → works
- [ ] Very large stake (overflow check) — U256 protects, not regtest verified
## Emission Integrity
- [x] Solo staker: FIRE ≈ emission_rate × blocks
- [x] total_weighted_stake correctly increases/decreases
- [x] emission_rate = 850,000,000 (85/15 split)
- [x] Expiry value matches init param
- [x] Global accumulator capped at expiry
- [x] Halving: emission rate halved per epoch (epoch 0: 850M, epoch 1: 425M)
- [ ] Sum of all claimed FIRE ≤ emission_pool — mathematically guaranteed by pool check
- [x] Cross-epoch safety: expiry = boundary - 1, rate constant within contract
- [x] No reward miscalculation at halving boundary (separate contracts per epoch)
- [x] Factory passes sequential halving_epoch to each clone
## Post-Expiry Lifecycle
- [x] After expiry: all positions capped (FIRE stops)
- [x] Lazy settle: weight removed on claim/unstake after expiry
- [x] wLP redeem returns LP after expiry
- [x] Stake after expiry rejected
- [x] ClaimRewards after expiry non-split: FIRE + LP returned (auto-unstake)
- [x] ClaimRewards after expiry split: FIRE only, NFT consumed
- [x] Double claim after expiry: rejected
- [x] RedeemExpired after split claim: wLP → LP works
- [x] Unstake after consumed NFT: rejected
- [x] New contract for next epoch (re-stake flow)
- [x] "Forgotten" position: weight stays but FIRE capped
## View Functions
- [x] GetTotalStaked (12)
- [x] GetCurrentEpoch (14)
- [x] GetCurrentEmissionRate (15) — returns 850M
- [x] GetExpiry (16)
- [x] GetWlpToken (17)
- [x] PreviewClaim (18)
- [x] GetPositionTemplate (30)
- [x] GetPositionCount (31)
- [x] GetTotalLockedLp (33) — only ≥6mo locks
- [x] IsRegisteredChild (36)
- [x] All getters use CallResponse::forward
## Factory / Epoch Management
- [x] Initialize factory with all templates
- [x] CreateNextEpoch creates first epoch for current halving period
- [x] CreateNextEpoch creates sequential epochs
- [x] CreateNextEpoch limited to current_abs + 1 (prevents DoS)
- [x] Pre-create epoch: created before start_block
- [x] Stake before start_block → rejected
- [x] Stake at start_block → works
- [x] Epoch expiry = (abs_epoch+1)*duration - 1
- [x] Multiple epochs: each has own wLP, positions, accumulator
- [x] GetEpochCount returns correct count
- [x] GetEpochContract returns correct AlkaneId
- [x] GetCurrentEpochIndex checks block height (not just last created)
- [x] Factory is permissionless
- [x] Epoch transition: old expires, new accepts stakes, no gap
- [x] RegisterStaker: factory registers each clone with fire-token
- [x] FIRE minting works from factory-cloned staking contracts
- [x] Pre-created empty epoch doesn't affect oracle (unit test)
## Security / Attack Vectors
- [x] Flash stake: same-block stake+claim = 0 reward
- [x] Flash loan via AMM: same-block reward = 0
- [ ] Sandwich attack: tiny FIRE per LP near expiry — theoretical, impractical on Bitcoin 10-min blocks
- [x] Fake NFT (DIESEL as NFT) → rejected
- [x] Fake wLP (DIESEL as wLP) → rejected
- [x] wLP mint/burn only by staking contract
- [x] Overflow: U256 for intermediate calculations
- [x] lock_duration overflow: checked_add + u64::try_from (unit test)
- [x] check_epoch removed from staking (prevents halved-rate bug post-expiry)
- [x] Epoch creation limited to current + 1 (prevents DoS via unbounded loop)
- [x] Zero-FIRE bond rejected (prevents LP loss at extreme price)
- [x] No double decrement of total_locked_lp (RedeemExpired doesn't decrement)
- [x] Oracle uses active_epoch_index for halving rate (not epoch_count)
- [x] Oracle immutable (no SetFactory)
- [x] Treasury immutable (no SetAuthorizedContract, bonding/redemption at init)
- [x] Redemption immutable (no SetFee/SetPaused/SetMinRedemption)
- [ ] Re-entrancy: state mutations before external calls — code review confirmed safe
## Bonding
- [x] Bond LP → receive bond position NFT
- [x] ClaimVested: partial vest returns proportional FIRE + NFT back
- [x] ClaimVested: full vest returns remaining FIRE
- [x] ClaimVested: 0 claimable → no-op, NFT returned
- [x] Vesting linear: 50% time = ~50% claimable (unit test)
- [x] LP sent to treasury on bond
- [x] FIRE minted from bonding emission pool (opcode 78)
- [x] Bond with wrong token → rejected
- [x] Bond when paused → rejected
- [x] Bond with 0 LP → rejected
- [x] Bond yields 0 FIRE → rejected (zero-fire bond prevention)
- [x] Fake bond NFT → rejected
- [ ] Bond position NFT transferable (new holder can claim)
- [x] Multiple bonds → multiple NFTs
## Bonding Auto-Halving
- [x] check_epoch() computes halving from (height - genesis) / HALVING_INTERVAL
- [x] Epoch 0: rate = 150M/block (85/15 split)
- [x] Epoch transition resets total_bonded_fire to 0 (unit test)
- [x] Rate halves: 150M → 75M → 37.5M (unit tests)
- [x] Skip multiple epochs correctly (unit test)
- [x] Cannot exploit old epoch capacity after transition (unit test)
- [x] check_epoch always called in bond() — no bypass (unit test)
- [x] Rate → 0 at epoch 28+ (unit test, 150M >> 28 = 0)
- [x] Genesis at mainnet height (946k) works (unit test)
- [x] total_bonded_lp accumulates across epochs, not reset (unit test)
- [x] Leftover capacity stays in fire-token pool, not lost (unit test)
## Bonding Rate Limit
- [x] Capacity = bonding_rate × elapsed_blocks - total_bonded
- [x] Bond exceeding capacity → rejected
- [x] ~1.5 FIRE/block at epoch 0 (150M units/block)
- [x] Capacity grows linearly (unit test)
- [x] Epoch 0 capacity = half of bonding pool (unit test)
- [x] Available capacity after bonds (unit test)
## Bonding Price Oracle
- [x] Price = max(locked_lp, 1 LP) × DECIMAL / annual_emission (staking-based)
- [x] Uses halving-adjusted emission rate (not epoch 0 constant)
- [x] Bootstrap: 0 locked LP → fallback 1 LP → price = 224 (at 850M rate)
- [x] Oracle reads factory → active staking epoch → total_locked_lp
- [x] RecordPurchase = no-op
- [x] GetPrice is stateless (staticcall safe)
- [x] Oracle works after epoch transitions
- [x] Only LP locked ≥ 6 months counts for total_locked_lp
- [x] Oracle price linear with locked LP (unit test)
- [x] Oracle price doubles each epoch (unit test)
- [x] Epoch 10: price ~1024x higher (unit test)
- [x] Emission zero (epoch 30+): returns u128::MAX (unit test)
- [x] Pre-created empty epoch ignored by oracle (unit test)
- [x] Oracle immutable after init (SetFactory removed)
## Bonding Economics
- [x] Floor price guard: bond_price = max(oracle_discounted, floor) — no premium
- [x] Bond-redeem cycle unprofitable: 60% loss (regtest, with staking emission dilution)
- [x] Bond-redeem solo bonder: exactly 1% loss (fee only, unit test)
- [x] Bond-redeem diluted by staking emission: >10% loss (unit test)
- [x] Bond-redeem proportional treasury: ~1% loss (unit test)
- [x] Treasury LP grows with each bond
- [x] floor_price = treasury_LP / FIRE_supply (invariant under redemption)
- [x] Redemption fee 1% stays in treasury (floor increases)
- [x] Bond at floor accretive — floor never decreases (unit test)
- [x] Bond-redeem cycle unprofitable at 20% discount (unit test)
## Bonding Vesting Across Epochs
- [x] Vesting spans halving boundary correctly (unit test)
- [x] Vesting entirely in next epoch (bond near boundary, unit test)
- [x] check_epoch reset doesn't affect vesting (unit test)
- [x] Multiple bonds from different epochs vest independently (unit test)
- [x] Bond before halving gets epoch 0 price (unit test)
- [x] Bond after halving gets halved price (unit test)
- [x] Partial claims across boundary sum to total (unit test)
## Redemption
- [x] Redeem FIRE → proportional LP from treasury minus 1% fee
- [x] Fee LP returned to treasury via Deposit
- [x] Burn FIRE after treasury call (correct order)
- [x] Redeem with 0 FIRE → rejected
- [x] Redeem below min_redemption → rejected
- [x] Partial redeem: change returned
- [x] floor_price unchanged after redemption without fee (unit test)
- [x] floor_price increases with fee (unit test)
- [x] Redemption immutable (no admin opcodes)
## Upgradeable Proxy Architecture
- [x] Proxy impl IDs don't collide with public IDs (unit test)
- [x] Proxy→impl ID mapping consistent (0x100 offset, unit test)
- [x] Proxy opcodes correct: 32767=init, 32766=upgrade, 36863=forward (unit test)
- [x] Beacon clone opcode: forward (36863) not GetName (99) — prevents pre-init fallback crash (unit test)
- [x] All singletons deploy behind upgradeable proxy (deploy-proxied.sh regtest ✓)
- [x] All singleton view functions work through proxy (regtest ✓)
- [x] All singleton init functions work through proxy (regtest ✓)
- [x] Staking beacon stores correct impl (regtest ✓)
- [x] Epoch 0 clone created via beacon-proxy template (regtest ✓)
- [x] Staking clone views work through beacon proxy (EmissionRate, Expiry — regtest ✓)
- [x] Upgrade singleton via auth token (bonding 4:259 → 4:600, state preserved — regtest ✓)
- [x] Upgrade beacon → all clones use new impl (beacon 4:519 → 4:601, clone 2:8 rate/expiry preserved — regtest ✓)
- [x] Upgrade WITHOUT auth token → rejected "Auth token is not in incoming alkanes" (regtest ✓)
- [x] Upgrade with WRONG auth token → rejected (bonding auth for beacon — regtest ✓)
- [ ] Auth token transfer → new holder can upgrade — not yet regtest verified
## Token Return / Change Safety
- [x] Exact consumption: no change returned (unit test)
- [x] Partial consumption: LP change returned (unit test)
- [x] All non-matching tokens forwarded (unit test)
- [x] No tokens stuck across 3+ token types (unit test)
- [x] Zero consumption: all forwarded (unit test)
- [x] Overconsumption: saturating sub (unit test)
- [x] Treasury deposit() returns non-LP to caller (code ✓, regtest ✓)
- [x] Stake with extra auth token → auth returned, only LP consumed (regtest ✓)
- [x] Bond lp_to_bond < incoming → LP change returned (regtest ✓)
- [x] All 10 user-facing handlers verified: return excess (audit ✓)
## Target Position Selection
- [x] {0,0} finds first registered (unit test)
- [x] Specific ID selects exact match (unit test)
- [x] Rejects unregistered target (unit test)
- [x] Rejects target not in incoming (unit test)
- [x] Skips zero-value transfers (unit test)
## Test Counts (live)
| Suite | Count | Notes |
|---|---|---|
| `fire-support` unit tests (native) | **159** | math: vesting, multipliers, emission, redemption, target_position |
| `fire-constants` unit tests (native) | **7** | static constants + sequential ID checks |
| WASM integration tests | **39** | run via `CC=clang cargo test --target wasm32-unknown-unknown` |
| **Total automated** | **205** | all green |
### WASM test categories (full list in `src/tests/`)
- **Baseline FIRE deploy** (15): legacy smoke tests + lock multipliers + AMM setup
- **Master auth + upgradeable** (13): mint/authenticate/forward/fake-auth/double-init
- `fire_master_auth_test.rs`
- **Proxied deployment harness** (3): full 6-proxy deploy + view delegation
- `fire_foundation_proxied.rs`
- **Integration flows** (8): TIER 1/2/3 — upgrade roundtrip, stake/claim/unstake, bond/claim_vested, redemption, epoch transition, halving rate validation
- `fire_staking_flow_test.rs`
### Regtest end-to-end (manual / scripted)
Verified on live regtest with `DEVNET=1 ./scripts/deploy-proxied.sh`:
- [x] Full proxied deploy succeeds (all 6 proxies + 2 beacons + master auth)
- [x] Master auth NFT survives all 6 business inits (1 unit stable)
- [x] Stake → claim → unstake roundtrip (math matches 8.5 FIRE/block × elapsed)
- [x] Bond → claim_vested cross-epoch (vesting independent of staking epochs)
- [x] Redemption: burn FIRE → proportional LP with 1% fee
- [x] Epoch 0 → epoch 1 transition: emission halved exactly (4.25 FIRE/block)
- [x] **Position-token beacon upgrade**: deploy v2 impl → upgrade beacon →
existing NFT instantly uses new logic, state preserved
- [x] Stake in expired epoch rejected with clear error, alkanes refunded
- [x] No funds leaked across epoch boundaries
### Deploy verification (`test-upgrade.sh`, `test-state.sh`)
Verified on live regtest after `deploy-proxied.sh` AND `deploy-mainnet.sh
(NETWORK=regtest ALLOW_REGTEST=1)` runs:
- [x] CREATECHILD spawns extract dynamic 2:N IDs from `create_alkane` trace events
- [x] All 8 upgradeables (6 proxies + 2 beacons) initialize via CREATECHILD path
- [x] No-auth upgrade rejected (auth check fires on upgrade opcode 32766)
- [x] Upgrade roundtrip on each of 6 proxies: `GetName` returns original → "FIRE-AUTH" → original
- [x] Upgrade roundtrip on each of 2 beacons: opcode 32765 returns orig impl → dummy → orig
- [x] State preserved after roundtrip: LP token, FIRE token, beacon impls unchanged
- [x] Shared beacon-proxy template at 4:520 spawns both epoch staking-clones AND
position NFTs — same bytecode, different beacon in init args
- [x] Factory init accepts `staking_template = position_template = 520` (dedup verified)
- [x] `.deploy-ids.env` exported with 8 dynamic IDs for downstream tooling
## Remaining Unchecked (Low Priority)
- [ ] Revert returns all incoming (ALKANES runtime level, not contract logic)
- [ ] Very large stake overflow (U256 protects, not regtest verified)
- [ ] Sum of claimed FIRE ≤ emission_pool (mathematically guaranteed by pool check)
- [ ] Sandwich attack (theoretical, impractical on Bitcoin 10-min blocks)
- [ ] Re-entrancy code review (confirmed safe by audit — mutations before calls)
- [ ] Bond position NFT transferable (architecture supports, not regtest verified)
- [ ] `cargo fmt --check` clean (open formatting diff)
- [ ] `cargo clippy -D warnings` clean (1 warning at fire-support:46)
- [ ] `cargo audit` / `cargo deny` (tools not installed)

Verified Source