// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.26;

import { ISignatureTransfer } from "permit2/src/interfaces/ISignatureTransfer.sol";
import { SafeTransferLib } from "solady/src/utils/SafeTransferLib.sol";

import { IOracle } from "../interfaces/IOracle.sol";
import {
    CrossChainOrder,
    ISettlementContract,
    Input,
    Output,
    ResolvedCrossChainOrder
} from "../interfaces/ISettlementContract.sol";
import { OrderContext, OrderKey, OrderStatus, OutputDescription, ReactorInfo } from "../interfaces/Structs.sol";

import { FillerDataLib } from "../libs/FillerDataLib.sol";
import { IsContractLib } from "../libs/IsContractLib.sol";

import {
    CannotProveOrder,
    ChallengeDeadlinePassed,
    InitiateDeadlineAfterFill,
    InitiateDeadlinePassed,
    InvalidDeadlineOrder,
    InvalidSettlementAddress,
    MinOrderPurchaseDiscountTooLow,
    OnlyFiller,
    OrderAlreadyClaimed,
    OrderNotReadyForOptimisticPayout,
    OrderFinal,
    ProofPeriodHasNotPassed,
    PurchaseTimePassed,
    WrongChain,
    WrongOrderStatus
} from "../interfaces/Errors.sol";
import { ReactorPayments } from "./helpers/ReactorPayments.sol";
import { ResolverERC7683 } from "./helpers/ResolverERC7683.sol";
/**
 * @title Base Cross-chain intent Reactor
 * @notice Cross-chain intent resolver. Implements core logic that is shared between all
 * reactors like token collection, order interfaces, order resolution:
 * - Optimistic Payout: Orders are assumed to have been filled correctly by the solver if not disputed.
 * - Order Dispute: Orders can be disputed such that proof of fulfillment has to be made.
 * - Oracle Interaction: To provide the relevant proofs against order disputes.
 *
 * It is expected that proper order reactors implement:
 * - `_initiate`. To convert partially structured orders into order keys that describe fulfillment conditions.
 * - `_resolveKey`. Helper function to convert an order into an order key.
 * You can find more information about these in ./helpers/ResolverAbstractions.sol
 * @dev Important implementation quirks:
 * **Token Trust**
 * There is a lot of trust put into the tokens that interact with the contract. Not trust as in the tokens can
 * impact this contract but trust as in a faulty / malicious token may be able to break the order status flow
 * and prevent proper delivery of inputs (to solver) and return of collateral.
 * As a result, it is important that users are aware of the following usage restrictions:
 * 1. Don't use a pausable/blacklist token if there is a risk that one of the actors (user / solver)
 * being paused. This also applies from the user's perspective, if a pausable token is used for
 * collateral their inputs may not be returnable.
 * 2. All inputs have to be trusted by all parties. If one input is unable to be transferred, the whole lot
 * becomes stuck until the issue is resolved.
 * 3. Solvers should validate that they can fill the outputs otherwise their collateral may be at risk and it could
 * annoy users.
 */

abstract contract BaseReactor is ReactorPayments, ResolverERC7683 {
    bytes32 public constant VERSION_FLAGS = bytes32(uint256(1));

    /**
     * @notice An order has been initiated.
     */
    event OrderInitiated(bytes32 indexed orderHash, address indexed caller, bytes filler, OrderKey orderKey);

    /**
     * @notice An order has been proven and settled.
     */
    event OrderProven(bytes32 indexed orderHash, address indexed prover);

    /**
     * @notice An order has been optimistically resolved.
     */
    event OptimisticPayout(bytes32 indexed orderHash);

    /**
     * @notice An order has ben challenged.
     */
    event OrderChallenged(bytes32 indexed orderHash, address indexed disputer);

    /**
     * @notice A challenged order was not proven and enough time has passed
     * since it was challenged so it has been assumed no delivery was made.
     */
    event FraudAccepted(bytes32 indexed orderHash);

    /**
     * @notice An order has been purchased by someone else and the filler has changed.
     */
    event OrderPurchased(bytes32 indexed orderHash, address newFiller);

    /**
     * @notice The order purchase details have been modified by the filler.
     */
    event OrderPurchaseDetailsModified(bytes32 indexed orderHash, bytes fillerdata);

    /**
     * @notice New order has been broadcasted.
     */
    event OrderBroadcast(bytes32 indexed orderHash, CrossChainOrder order, bytes signature);

    /**
     * @notice Maps an orderkey hash to the relevant orderContext.
     */
    mapping(bytes32 orderKeyHash => OrderContext orderContext) internal _orders;

    constructor(address permit2, address owner) payable ReactorPayments(permit2, owner) { }

    //--- Expose Storage ---//

    function _orderKeyHash(
        OrderKey memory orderKey
    ) internal pure returns (bytes32 orderKeyHash) {
        return orderKeyHash = keccak256(abi.encode(orderKey));
    }

    function getOrderKeyHash(
        OrderKey calldata orderKey
    ) external pure returns (bytes32 orderKeyHash) {
        return orderKeyHash = _orderKeyHash(orderKey);
    }

    function getOrderContext(
        bytes32 orderKeyHash
    ) external view returns (OrderContext memory orderContext) {
        return orderContext = _orders[orderKeyHash];
    }

    function getOrderContext(
        OrderKey calldata orderKey
    ) external view returns (OrderContext memory orderContext) {
        return orderContext = _orders[_orderKeyHash(orderKey)];
    }

    //--- On-chain orderbook ---//

    /**
     * @notice Allows submitting order without an order server.
     * This can be used to bypass censorship or to make a on-chain transaction.
     * This contract is not sufficient and will allow invalid orders. It is expected that an off-chain entity will filter orders.
     */
    function broadcast(
        CrossChainOrder calldata order,
        bytes calldata signature
    ) external {
        // Check if this is the right contract.
        if (order.settlementContract != address(this)) revert InvalidSettlementAddress();
        // Check if the expected chain of the order is the rigtht one.
        if (order.originChainId != block.chainid) revert WrongChain(uint32(block.chainid), order.originChainId);

        // Check if initiate Deadline has passed.
        if (order.initiateDeadline < block.timestamp) revert InitiateDeadlinePassed();

        // The order initiation must be less than the fill deadline. Both of them cannot be the current time as well.
        // Fill deadline must be after initiate deadline. Otherwise the solver is prone to making a mistake.
        if (order.fillDeadline < order.initiateDeadline) revert InitiateDeadlineAfterFill();

        bytes32 orderHash = _orderKeyHash(_resolveKey(order, signature[0:0]));
        emit OrderBroadcast(orderHash, order, signature);
    }

    //--- Order Handling ---//

    /**
     * @notice Initiates a cross-chain order
     * @dev Called by the filler. Before calling, please check if someone else has already initiated.
     * The check if an order has already been initiated is late and may use a lot of gas.
     * When a filler initiates a transaction it is important that they do the following:
     * 1. Trust the reactor. Technically, anyone can deploy a reactor that takes these interfaces.
     * As the filler has to provide collateral, this collateral could be at risk.
     * 2. Verify that the deadlines provided in the order are sane. If proof - challenge is small
     * then it may impossible to prove thus free to challenge.
     * 3. Trust the oracles. Any oracles can be provided but they may not signal that the proof
     * is or isn't valid.
     * 4. Verify all inputs & outputs. If they contain a token the filler does not trust, do not claim the order.
     * It may cause a host of problem but most importantly: Inability to payout inputs & Inability to payout collateral.
     * 5. If fillDeadline == challengeDeadline && challengerCollateralAmount == 0, then the order REQUIRES a proof
     * and the user will be set as the default challenger.
     * @param order The CrossChainOrder definition
     * @param signature The end user signature for the order
     * @param fillerData Any filler-defined data required by the settler
     */
    function initiate(
        CrossChainOrder calldata order,
        bytes calldata signature,
        bytes calldata fillerData
    ) external returns (OrderKey memory orderKey) {
        // Check if this is the right contract.
        if (order.settlementContract != address(this)) revert InvalidSettlementAddress();
        // Check if the expected chain of the order is the rigtht one.
        if (order.originChainId != block.chainid) revert WrongChain(uint32(block.chainid), order.originChainId);

        // Check if initiate Deadline has passed.
        if (order.initiateDeadline < block.timestamp) revert InitiateDeadlinePassed();

        // The order initiation must be less than the fill deadline. Both of them cannot be the current time as well.
        // Fill deadline must be after initiate deadline. Otherwise the solver is prone to making a mistake.
        if (order.fillDeadline < order.initiateDeadline) revert InitiateDeadlineAfterFill();

        // Notice that the 2 above checks also ensures that order.fillDeadline > block.timestamp since
        // block.timestamp <= order.initiateDeadline && order.initiateDeadline <= order.fillDeadline
        // => block.timestamp <= order.fillDeadline

        // Decode filler data.
        (
            address fillerAddress,
            uint32 orderPurchaseDeadline,
            uint16 orderPurchaseDiscount,
            bytes32 identifier,
            uint256 fillerDataPointer
        ) = FillerDataLib.decode(fillerData);

        // Permit2 & EIP-712 object variables.
        bytes32 witness; // Hash of our struct to be combined with permit2's struct hash.
        string memory witnessTypeString; // Type of our order struct (witness).
        uint256[] memory permittedAmounts; // The amounts the user signed (derived from order).

        // Initiate order.
        (orderKey, permittedAmounts, witness, witnessTypeString) = _initiate(order, fillerData[fillerDataPointer:]);

        // The proof deadline should be the last deadline and it must be after the challenge deadline.
        // The challenger should be able to challenge after the order is filled.
        ReactorInfo memory reactorInfo = orderKey.reactorContext;
        // Check if: order.fillDeadline <= rI.challengeDeadline && rI.challengeDeadline <= rI.proofDeadline.
        // That implies if: order.fillDeadline > rI.challengeDeadline || rI.challengeDeadline > rI.proofDeadline
        // then the deadlines are invalid.
        if (
            order.fillDeadline > reactorInfo.challengeDeadline
                || reactorInfo.challengeDeadline > reactorInfo.proofDeadline
        ) {
            revert InvalidDeadlineOrder();
        }

        // Check that the order hasn't been claimed yet. We will then set the order status
        // so other can't claim it. This acts as a local reentry check.
        bytes32 orderHash = _orderKeyHash(orderKey);
        OrderContext storage orderContext = _orders[orderHash];
        // If an order has been configured such that it is free to challenge and impossible at the same time
        // (free === orderKey.collateral.challengerCollateralAmount == 0) && ("impossible" === orderKey.proofDeadline == orderKey.challengeDeadline)
        // then it is assumed that the order should be required to be strictly verified. (default challenged)
        bool defaultChallenge = (reactorInfo.proofDeadline == reactorInfo.challengeDeadline) && (orderKey.collateral.challengerCollateralAmount == 0);
        if (defaultChallenge) orderContext.challenger = orderKey.swapper;
        // Ideally the above section was moved below the orderContext check but there is a stack too deep issue if done so.

        if (orderContext.status != OrderStatus.Unfilled) revert OrderAlreadyClaimed(orderContext.status);
        orderContext.status = defaultChallenge ? OrderStatus.Challenged : OrderStatus.Claimed; // Now this order cannot be claimed again.
        orderContext.fillerAddress = fillerAddress;
        orderContext.orderPurchaseDeadline = orderPurchaseDeadline;
        orderContext.orderPurchaseDiscount = orderPurchaseDiscount;
        // Identifier is in its own storage slot.
        if (identifier != bytes32(0)) orderContext.identifier = identifier;

        // Check if the collateral token is indeed a contract. SafeTransferLib does not revert on no code.
        // This is important, since a later deployed token can screw up the whole pipeline.
        IsContractLib.checkCodeSize(orderKey.collateral.collateralToken);
        // Collateral is collected from sender instead of fillerAddress.
        SafeTransferLib.safeTransferFrom(
            orderKey.collateral.collateralToken, msg.sender, address(this), orderKey.collateral.fillerCollateralAmount
        );

        // Collect input tokens from user.
        _collectTokensViaPermit2(
            orderKey, permittedAmounts, order.initiateDeadline, order.swapper, witness, witnessTypeString, signature
        );

        emit OrderInitiated(orderHash, msg.sender, fillerData, orderKey);
    }

    //--- Order Resolution Helpers ---//

    /**
     * @notice Prove that an order was filled. Requires that the order oracle exposes
     * a function, isProven(...), that returns true when called with the order details.
     * @dev If an order has configured some additional data that should be executed on
     * initiation, then this has to be provided here as executionData. If the executionData
     * is lost, then the filler should call `modifyOrderFillerdata` to set new executionData.
     * If you are calling this function from an external contract, beaware of re-entry
     * issues from a later execute. (configured of executionData).
     */
    function proveOrderFulfilment(OrderKey calldata orderKey, bytes calldata executionData) external {
        bytes32 orderHash = _orderKeyHash(orderKey);
        OrderContext storage orderContext = _orders[orderHash];

        OrderStatus status = orderContext.status;
        address fillerAddress = orderContext.fillerAddress;

        // Only allow processing if order status is either claimed or challenged.
        if (status != OrderStatus.Claimed && status != OrderStatus.Challenged) {
            revert WrongOrderStatus(orderContext.status);
        }

        // Immediately set order status to proven. This causes the previous line to fail.
        // This acts as a LOCAL reentry check.
        orderContext.status = OrderStatus.Proven;

        // The following call is a external call to an untrusted contract. As a result,
        // it is important that we protect this contract against reentry calls, even if read-only.
        if (!IOracle(orderKey.localOracle).isProven(orderKey.outputs, orderKey.reactorContext.fillDeadline)) {
            revert CannotProveOrder();
        }

        // Payout inputs.
        _deliverTokens(orderKey.inputs, fillerAddress, governanceFee);

        // Return collateral to the filler. Load the collateral details from the order.
        // (Filler provided collateral).
        address collateralToken = orderKey.collateral.collateralToken;
        uint256 fillerCollateralAmount = orderKey.collateral.fillerCollateralAmount;

        // If the order was challenged, then the challenger also provided collateral. All of this goes to the filler.
        // The below logic relies on the implementation constraint of:
        // orderContext.challenger != address(0) if status == OrderStatus.Challenged
        // This is valid since when `status = OrderStatus.Challenged` is set, right before the challenger's address is
        // also set.
        if (status == OrderStatus.Challenged) {
            // Add collateral amount. Both collaterals were paid in the same tokens.
            // This lets us do only a single transfer call.
            fillerCollateralAmount += orderKey.collateral.challengerCollateralAmount;
        }

        // Pay collateral tokens
        // No need to check if collateralToken is a deployed contract.
        // It has already been entered into our contract & we don't want this call to revert.
        SafeTransferLib.safeTransfer(collateralToken, fillerAddress, fillerCollateralAmount);

        bytes32 identifier = orderContext.identifier;
        if (identifier != bytes32(0)) FillerDataLib.execute(identifier, orderHash, executionData);

        emit OrderProven(orderHash, msg.sender);
    }

    /**
     * @notice Prove that an order was filled. Requires that the order oracle exposes
     * a function, isProven(...), that returns true when called with the order details.
     * @dev Anyone can call this but the payout goes to the filler of the order.
     * If you are calling this function from an external contract, beaware of re-entry
     * issues from a later execute. (configured of executionData).
     */
    function optimisticPayout(OrderKey calldata orderKey, bytes calldata executionData) external {
        bytes32 orderHash = _orderKeyHash(orderKey);
        OrderContext storage orderContext = _orders[orderHash];

        // Check if order is claimed:
        if (orderContext.status != OrderStatus.Claimed) revert WrongOrderStatus(orderContext.status);
        // If OrderStatus != Claimed then it must either be:
        // 1. One of the proved states => we already paid the inputs.
        // 2. Has been challenged (or substate of) => use `completeDispute(...)` or `proveOrderFulfilment(...)`
        // as a result, we shall only continue if orderContext.status == OrderStatus.Claimed.
        orderContext.status = OrderStatus.OptimiscallyFilled;

        // If time is post challenge deadline, then the order can only progress to optimistic payout.
        uint256 challengeDeadline = orderKey.reactorContext.challengeDeadline;
        if (block.timestamp <= challengeDeadline) {
            revert OrderNotReadyForOptimisticPayout(uint32(challengeDeadline));
        }

        address fillerAddress = orderContext.fillerAddress;

        // Pay input tokens to filler.
        _deliverTokens(orderKey.inputs, fillerAddress, governanceFee);

        // Get order collateral.
        address collateralToken = orderKey.collateral.collateralToken;
        uint256 fillerCollateralAmount = orderKey.collateral.fillerCollateralAmount;

        // Pay collateral tokens
        // collateralToken has already been entered so no need to check if
        // it is a valid token.
        SafeTransferLib.safeTransfer(collateralToken, fillerAddress, fillerCollateralAmount);

        bytes32 identifier = orderContext.identifier;
        if (identifier != bytes32(0)) FillerDataLib.execute(identifier, orderHash, executionData);

        emit OptimisticPayout(orderHash);
    }

    //--- Disputes ---//

    /**
     * @notice Disputes a claim. If a claimed order hasn't been delivered post the fill deadline
     * then the order should be challenged. This allows anyone to attempt to claim the collateral
     * the filler provided (at the risk of losing their own collateral).
     * @dev For challengers it is important to properly verify transactions:
     * 1. Local oracle. If the local oracle isn't trusted, the filler may be able
     * to toggle between is verified and not. This makes it possible for the filler to steal
     * the challenger's collateral
     * 2. Remote Oracle. Likewise for the local oracle, remote oracles may be controllable by
     * the filler.
     */
    function dispute(
        OrderKey calldata orderKey
    ) external {
        bytes32 orderKeyHash = _orderKeyHash(orderKey);
        OrderContext storage orderContext = _orders[orderKeyHash];

        // Check if order is claimed and hasn't been challenged:
        if (orderContext.status != OrderStatus.Claimed) revert WrongOrderStatus(orderContext.status);
        // If `orderContext.status != OrderStatus.Claimed` then there are 2 cases:
        // 1. The order hasn't been claimed.
        // 2. We are past the claim state (disputed, proven, etc).
        // As a result, checking if the order has been claimed is enough.

        // Check if challenge deadline hasn't been passed.
        if (uint256(orderKey.reactorContext.challengeDeadline) < block.timestamp) revert ChallengeDeadlinePassed();

        // Later logic relies on  orderContext.challenger != address(0) if orderContext.status = OrderStatus.Challenged.
        // As a result, it is important that this is the only place where these values are set so we can easily audit if
        // the above assertion is true.
        orderContext.challenger = msg.sender;
        orderContext.status = OrderStatus.Challenged;

        // Collect bond collateral.
        // CollateralToken has already been entered so no need to check if it is a valid token.
        SafeTransferLib.safeTransferFrom(
            orderKey.collateral.collateralToken,
            msg.sender,
            address(this),
            orderKey.collateral.challengerCollateralAmount
        );

        emit OrderChallenged(orderKeyHash, msg.sender);
    }

    /**
     * @notice Finalise the dispute.
     */
    function completeDispute(
        OrderKey calldata orderKey
    ) external {
        bytes32 orderKeyHash = _orderKeyHash(orderKey);
        OrderContext storage orderContext = _orders[orderKeyHash];

        // Check if proof deadline has passed. If this is the case (& the order hasn't been proven)
        // it has to be assumed that the order was not filled.
        uint256 proofDeadline = orderKey.reactorContext.proofDeadline;
        if (block.timestamp <= proofDeadline) {
            revert ProofPeriodHasNotPassed(uint32(proofDeadline));
        }

        // Check that the order is currently challenged. If is it currently challenged,
        // it implies that the fulfillment was not proven. Additionally, since the Challenge order status
        // only set together with the challenger address, it must hold that:
        // orderContext.status == OrderStatus.Challenged => orderContext.challenger != address(0).
        if (orderContext.status != OrderStatus.Challenged) revert WrongOrderStatus(orderContext.status);

        // Update the status of the order. This disallows local re-entries.
        // It is important that no external logic is made between the below & above line.
        orderContext.status = OrderStatus.Fraud;

        // Send the input tokens back to the user.
        _deliverTokens(orderKey.inputs, orderKey.swapper, 0);

        unchecked {
            // Divide the collateral between challenger and user. First, get order collateral.
            address collateralToken = orderKey.collateral.collateralToken;
            uint256 fillerCollateralAmount = orderKey.collateral.fillerCollateralAmount;
            uint256 challengerCollateralAmount = orderKey.collateral.challengerCollateralAmount;

            // Send partial collateral back to user
            uint256 swapperCollateralAmount = fillerCollateralAmount / 2;
            // We don't check if collateralToken is a token, since we don't
            // want this call to fail.
            SafeTransferLib.safeTransfer(collateralToken, orderKey.swapper, swapperCollateralAmount);

            // Send the rest to the wallet that called fraud. Similar to the above this should not fail.
            // A: We don't want this to fail.
            // B: If this overflows, it is better than if nothing happened.
            // C: fillerCollateralAmount - swapperCollateralAmount won't overflow as fillerCollateralAmount =
            // swapperCollateralAmount / 2 <= fillerCollateralAmount, = iff fillerCollateralAmount <= 1.
            SafeTransferLib.safeTransfer(
                collateralToken,
                orderContext.challenger,
                challengerCollateralAmount + fillerCollateralAmount - swapperCollateralAmount
            );
        }

        emit FraudAccepted(orderKeyHash);
    }

    //--- Order Purchase Helpers ---//

    /**
     * @notice This function is called from whoever wants to buy an order from a filler and gain a reward
     * @dev If you are buying a challenged order, ensure that you have sufficient time to prove the order or
     * your funds may be at risk.
     * Set newPurchaseDeadline in the past to disallow future takeovers.
     * When you purchase orders, make sure you take into account that you are paying the
     * entirety while you will get out the entirety MINUS any governance fee.
     * If you are calling this function from an external contract, beaware of re-entry
     * issues from a later execute. (configured of fillerData).
     * @param orderKey Claimed order to be purchased from the filler.
     * @param fillerData New filler data + potential execution data post-pended.
     * @param minDiscount The minimum discount the new filler is willing to buy at.
     * Should be set to disallow someone frontrunning this call and decreasing the discount.
     */
    function purchaseOrder(OrderKey calldata orderKey, bytes calldata fillerData, uint256 minDiscount) external {
        bytes32 orderKeyHash = _orderKeyHash(orderKey);
        OrderContext storage orderContext = _orders[orderKeyHash];

        {
            OrderStatus status = orderContext.status;

            // The order should have been claimed and not paid / proven / fraud proven (inputs should be intact)
            // for it to be purchased.
            if (status != OrderStatus.Claimed && status != OrderStatus.Challenged) {
                revert WrongOrderStatus(orderContext.status);
            }
        }

        // The order cannot be purchased after the max time specified to be sold at has passed
        if (orderContext.orderPurchaseDeadline < block.timestamp) {
            revert PurchaseTimePassed();
        }

        // Decode filler data.
        (
            address fillerAddress,
            uint32 orderPurchaseDeadline,
            uint16 orderPurchaseDiscount,
            bytes32 identifier,
            uint256 fillerDataPointer
        ) = FillerDataLib.decode(fillerData);

        // Load old storage variables.
        address oldFillerAddress = orderContext.fillerAddress;
        uint16 oldOrderPurchaseDiscount = orderContext.orderPurchaseDiscount;
        bytes32 oldIdentifier = orderContext.identifier;
        // Check if the discount is good. Remember that a larger number is a better discount.
        if (minDiscount > oldOrderPurchaseDiscount) {
            revert MinOrderPurchaseDiscountTooLow(minDiscount, oldOrderPurchaseDiscount);
        }

        // We can now update the storage with the new filler data.
        // This allows us to avoid reentry protecting this function.
        orderContext.fillerAddress = fillerAddress;
        orderContext.orderPurchaseDeadline = orderPurchaseDeadline;
        orderContext.orderPurchaseDiscount = orderPurchaseDiscount;
        orderContext.identifier = identifier;

        // We can now make external calls without allowing local reentries into this call.

        // Collateral is paid for in full.
        address collateralToken = orderKey.collateral.collateralToken;
        uint256 collateralAmount = orderKey.collateral.fillerCollateralAmount;
        // No need to check if collateral is valid, since it has already entered the contract.
        SafeTransferLib.safeTransferFrom(collateralToken, msg.sender, oldFillerAddress, collateralAmount);

        // Transfer the ERC20 tokens. This requires explicit approval for this contract for each token.
        // This is not done through permit.
        // This function assumes the collection is from msg.sender, as a result we don't need to specify that.
        _collectTokensFromMsgSender(orderKey.inputs, oldFillerAddress, oldOrderPurchaseDiscount);

        // Check if there is an identifier, if there is execute data.
        if (oldIdentifier != bytes32(0)) {
            FillerDataLib.execute(identifier, orderKeyHash, fillerData[fillerDataPointer:]);
        }

        emit OrderPurchased(orderKeyHash, msg.sender);
    }

    /**
     * @dev If some execution data is set that is invalid, this function needs to be used to modify
     * the execution data (identifier) such that the execution data passes.
     * The order cannot be modified if it is considered final.
     */
    function modifyOrderFillerdata(OrderKey calldata orderKey, bytes calldata fillerData) external {
        bytes32 orderKeyHash = _orderKeyHash(orderKey);
        OrderContext storage orderContext = _orders[orderKeyHash];

        // Check that the status isn't final.
        OrderStatus status = orderContext.status;
        if (
            status == OrderStatus.Fraud ||
            status == OrderStatus.OptimiscallyFilled ||
            status == OrderStatus.Proven
        ) revert OrderFinal();

        address currentFiller = orderContext.fillerAddress;

        // This line also disallows modifying non-claimed orders.
        if (currentFiller == address(0) || currentFiller != msg.sender) revert OnlyFiller();

        // Decode filler data.
        (
            address newFillerAddress,
            uint32 newOrderPurchaseDeadline,
            uint16 newOrderPurchaseDiscount,
            bytes32 newIdentifier,
        ) = FillerDataLib.decode(fillerData);

        // Set new storage.
        if (newFillerAddress != currentFiller) orderContext.fillerAddress = newFillerAddress;
        orderContext.orderPurchaseDeadline = newOrderPurchaseDeadline;
        orderContext.orderPurchaseDiscount = newOrderPurchaseDiscount;
        orderContext.identifier = newIdentifier;

        emit OrderPurchaseDetailsModified(orderKeyHash, fillerData);
    }
}

// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.26;

import { Ownable } from "solady/src/auth/Ownable.sol";
import { SafeTransferLib } from "solady/src/utils/SafeTransferLib.sol";

import { IsContractLib } from "./IsContractLib.sol";

/**
 * @dev Required for inheritance linearization
 */
abstract contract ICanCollectGovernanceFee {
    function _calcFee(uint256 amount, uint256 fee) internal pure virtual returns (uint256 amountLessFee);

    function _calcFee(
        uint256 amount
    ) internal view virtual returns (uint256 amountLessFee);
}

/**
 * @title Extendable contract that allows an implementation to collect governance fees.
 */
abstract contract CanCollectGovernanceFee is Ownable, ICanCollectGovernanceFee {
    error GovernanceFeeTooHigh();
    error GovernanceFeeChangeNotReady();

    /**
     * @notice Governance fees has been distributed.
     */
    event GovernanceFeesDistributed(address indexed to, address[] tokens, uint256[] collectedAmounts);

    /**
     * @notice Governance fee will be changed shortly.
     */
    event NextGovernanceFee(uint64 nextGovernanceFee, uint64 nextGovernanceFeeTime);

    /**
     * @notice Governance fee changed. This fee is taken of the inputs.
     */
    event GovernanceFeeChanged(uint64 oldGovernanceFee, uint64 newGovernanceFee);

    uint64 public governanceFee = 0;
    uint64 public nextGovernanceFee = 0;
    uint64 public nextGovernanceFeeTime = type(uint64).max;
    uint64 constant GOVERNANCE_FEE_CHANGE_DELAY = 7 days;
    uint256 constant GOVERNANCE_FEE_DENOM = 10 ** 18;
    uint256 constant MAX_GOVERNANCE_FEE = 10 ** 18 * 0.1; // 10%

    constructor(
        address owner
    ) payable {
        _initializeOwner(owner);
    }

    /**
     * @notice Tokens collected by governance.
     * @dev Can be accessed through getGovernanceTokens.
     */
    mapping(address token => uint256 amount) internal _governanceTokens;

    /**
     * @notice Returns the amount of tokens collected by governance.
     * @dev View function for _governanceTokens storage slot.
     */
    function getGovernanceTokens(
        address token
    ) external view returns (uint256 amountTokens) {
        return amountTokens = _governanceTokens[token];
    }

    /**
     * @notice Subtract the governance fee from an amount AND store the fee as the difference.
     * @dev This function sets the subtracted governance fee as collected. If you just want to
     * get the amount less fee, use `_calcFee`.
     * Ideally this function wouldn't be called if the fee is 0. Regardless, this function
     * won't modify storage if the collected fee becomes 0.
     * @param token for fee to be set for. Only impacts storage not computation.
     * @param amount for fee to be taken of.
     * @param fee to take of amount and set for token. Fee is provided as a variable to
     * save gas when used in a loop. The fee is out of 10**18.
     * @return amountLessFee amount - fee.
     */
    function _collectGovernanceFee(
        address token,
        uint256 amount,
        uint256 fee
    ) internal returns (uint256 amountLessFee) {
        unchecked {
            // Get the governance share of the amountLessFee.
            uint256 governanceShare = _calcFee(amount, fee);

            // Compute the amount less fee.
            amountLessFee = amount - governanceShare; // amount >= governanceShare

            // Only set storage if the fee is not 0.
            if (governanceShare != 0) _governanceTokens[token] = _governanceTokens[token] + governanceShare;
        }
    }

    /**
     * @notice Overload of _collectGovernanceFee reading the governance fee.
     */
    function _collectGovernanceFee(address token, uint256 amount) internal returns (uint256 amountLessFee) {
        return amountLessFee = _collectGovernanceFee(token, amount, governanceFee);
    }

    /**
     * @notice Helper function to compute the fee.
     * @param amount To compute fee of.
     * @param fee Fee to subtract from amount. Is percentage and GOVERNANCE_FEE_DENOM based.
     * @return amountFee Fee
     */
    function _calcFee(uint256 amount, uint256 fee) internal pure override returns (uint256 amountFee) {
        unchecked {
            // Check if amount * fee overflows. If it does, don't take the fee.
            if (amount >= type(uint256).max / fee) return amountFee = 0;
            // The above check ensures that amount * fee < type(uint256).max.
            // amount >= amount * fee / GOVERNANCE_FEE_DENOM since fee < GOVERNANCE_FEE_DENOM
            return amountFee = amount * fee / GOVERNANCE_FEE_DENOM;
        }
    }

    /**
     * @notice Helper function to compute the fee.
     * The governanceFee is read from storage and passed to _calcFee(uint256,uint256)
     * @param amount To compute fee of.
     * @return amountFee Fee
     */
    function _calcFee(
        uint256 amount
    ) internal view override returns (uint256 amountFee) {
        return _calcFee(amount, governanceFee);
    }

    /**
     * @notice Sets a new governanceFee. Is immediately applied to orders initiated after this call.
     * @param _nextGovernanceFee New governance fee. Is bounded by MAX_GOVERNANCE_FEE.
     */
    function setGovernanceFee(
        uint64 _nextGovernanceFee
    ) external onlyOwner {
        if (_nextGovernanceFee > MAX_GOVERNANCE_FEE) revert GovernanceFeeTooHigh();
        nextGovernanceFee = _nextGovernanceFee;
        nextGovernanceFeeTime = uint64(block.timestamp) + GOVERNANCE_FEE_CHANGE_DELAY;

        emit NextGovernanceFee(nextGovernanceFee, nextGovernanceFeeTime);
    }

    /**
     * @notice Applies a scheduled governace fee change.
     */
    function applyGovernanceFee() external {
        if (block.timestamp < nextGovernanceFeeTime) revert GovernanceFeeChangeNotReady();
        uint64 oldGovernanceFee = governanceFee;
        governanceFee = nextGovernanceFee;

        emit GovernanceFeeChanged(oldGovernanceFee, nextGovernanceFee);
    }

    /**
     * @notice Distributes tokens allocated for governance.
     * @dev You cannot collect tokens for which the amount is 0.
     * Only the owner of the contract can call this, however, the owner can set another destination
     * as the target for the tokens. Pulls 100% of the collected tokens in the tokens list.
     * An example of a distribution mechanic would be requiring users to pay 1 Ether to call this function.
     * (from the owner contract). Once the fees are high enough someone would pay. This works kindof like
     * a dutch auction.
     * It may be important to check that collectedAmounts[i] > 0.
     * @param tokens List of tokens to collect governance fee from.
     * @param to Recipient of the tokens.
     * @return collectedAmounts Array of the collected governance tokens.
     */
    function distributeGovernanceTokens(
        address[] calldata tokens,
        address to
    ) external onlyOwner returns (uint256[] memory collectedAmounts) {
        unchecked {
            uint256 numTokens = tokens.length;
            collectedAmounts = new uint256[](numTokens);
            for (uint256 i = 0; i < numTokens; ++i) {
                address token = tokens[i];
                // Read the collected governance tokens and then set to 0 immediately.
                uint256 tokensToBeClaimed = _governanceTokens[token];
                _governanceTokens[token] = 0;

                collectedAmounts[i] = tokensToBeClaimed;
                // Since we have "collected" the fee, it is expected that this function will go through.
                // Regardless, if it calls a non-contract address it doesn't really matter.
                SafeTransferLib.safeTransfer(token, to, tokensToBeClaimed);
            }
        }

        emit GovernanceFeesDistributed(to, tokens, collectedAmounts);
    }
}

// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.26;

import { CrossChainOrder, Input } from "../../interfaces/ISettlementContract.sol";

import { OutputDescription } from "../../interfaces/Structs.sol";

import { CrossChainOrderType } from "./CrossChainOrderType.sol";

struct CatalystLimitOrderData {
    uint32 proofDeadline;
    uint32 challengeDeadline;
    address collateralToken;
    uint256 fillerCollateralAmount;
    uint256 challengerCollateralAmount;
    address localOracle;
    Input[] inputs;
    OutputDescription[] outputs;
}

/**
 * @notice Helper library for the Limit order type.
 */
library CrossChainLimitOrderType {
    bytes constant LIMIT_ORDER_DATA_TYPE = abi.encodePacked(
        LIMIT_ORDER_DATA_TYPE_ONLY, CrossChainOrderType.INPUT_TYPE_STUB, CrossChainOrderType.OUTPUT_TYPE_STUB
    );

    bytes constant LIMIT_ORDER_DATA_TYPE_ONLY = abi.encodePacked(
        "CatalystLimitOrderData(",
        "uint32 proofDeadline,",
        "uint32 challengeDeadline,",
        "address collateralToken,",
        "uint256 fillerCollateralAmount,",
        "uint256 challengerCollateralAmount,",
        "address localOracle,",
        "Input[] inputs,",
        "OutputDescription[] outputs",
        ")"
    );

    bytes constant LIMIT_CROSS_CHAIN_ORDER_TYPE = abi.encodePacked(
        CrossChainOrderType.CROSS_CHAIN_ORDER_TYPE_NO_DATA_STUB, "CatalystLimitOrderData orderData", ")"
    );

    string constant PERMIT2_LIMIT_ORDER_WITNESS_STRING_TYPE = string(
        abi.encodePacked(
            "CrossChainOrder witness)",
            LIMIT_ORDER_DATA_TYPE_ONLY,
            LIMIT_CROSS_CHAIN_ORDER_TYPE,
            CrossChainOrderType.INPUT_TYPE_STUB,
            CrossChainOrderType.OUTPUT_TYPE_STUB,
            CrossChainOrderType.TOKEN_PERMISSIONS_TYPE
        )
    );

    bytes32 constant LIMIT_ORDER_DATA_TYPE_HASH = keccak256(LIMIT_ORDER_DATA_TYPE);

    function decodeOrderData(
        bytes calldata orderBytes
    ) internal pure returns (CatalystLimitOrderData memory limitData) {
        return limitData = abi.decode(orderBytes, (CatalystLimitOrderData));
    }

    function hashOrderDataM(
        CatalystLimitOrderData memory orderData
    ) internal pure returns (bytes32) {
        return keccak256(
            bytes.concat(
                abi.encode(
                    LIMIT_ORDER_DATA_TYPE_HASH,
                    orderData.proofDeadline,
                    orderData.challengeDeadline,
                    orderData.collateralToken,
                    orderData.fillerCollateralAmount,
                    orderData.challengerCollateralAmount,
                    orderData.localOracle
                ),
                abi.encode(
                    CrossChainOrderType.hashInputs(orderData.inputs), CrossChainOrderType.hashOutputs(orderData.outputs)
                )
            )
        );
    }

    function crossOrderHash(
        CrossChainOrder calldata order,
        CatalystLimitOrderData memory limitOrderData
    ) internal pure returns (bytes32) {
        return keccak256(
            abi.encode(
                keccak256(abi.encodePacked(LIMIT_CROSS_CHAIN_ORDER_TYPE, LIMIT_ORDER_DATA_TYPE)),
                order.settlementContract,
                order.swapper,
                order.nonce,
                order.originChainId,
                order.initiateDeadline,
                order.fillDeadline,
                hashOrderDataM(limitOrderData)
            )
        );
    }
}

// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.26;

import { CrossChainOrder, Input } from "../../interfaces/ISettlementContract.sol";

import { OutputDescription } from "../../interfaces/Structs.sol";

library CrossChainOrderType {
    bytes constant CROSS_CHAIN_ORDER_TYPE_NO_DATA_STUB = abi.encodePacked(
        "CrossChainOrder(",
        "address settlementContract,",
        "address swapper,",
        "uint256 nonce,",
        "uint32 originChainId,",
        "uint32 initiateDeadline,",
        "uint32 fillDeadline,"
    );

    bytes constant INPUT_TYPE_STUB = abi.encodePacked("Input(", "address token,", "uint256 amount", ")");

    bytes constant OUTPUT_TYPE_STUB = abi.encodePacked(
        "OutputDescription(",
        "bytes32 remoteOracle,",
        "bytes32 token,",
        "uint256 amount,",
        "bytes32 recipient,",
        "uint32 chainId,",
        "bytes remoteCall",
        ")"
    );

    string constant TOKEN_PERMISSIONS_TYPE = "TokenPermissions(address token,uint256 amount)";

    function hashInput(
        Input memory input
    ) internal pure returns (bytes32) {
        return keccak256(abi.encode(keccak256(INPUT_TYPE_STUB), input.token, input.amount));
    }

    function hashOutput(
        OutputDescription memory output
    ) internal pure returns (bytes32) {
        return keccak256(
            abi.encode(
                keccak256(OUTPUT_TYPE_STUB),
                output.remoteOracle,
                output.token,
                output.amount,
                output.recipient,
                output.chainId,
                keccak256(output.remoteCall)
            )
        );
    }

    function hashInputs(
        Input[] memory inputs
    ) internal pure returns (bytes32) {
        unchecked {
            bytes memory currentHash = new bytes(32 * inputs.length);

            for (uint256 i = 0; i < inputs.length; ++i) {
                bytes32 inputHash = hashInput(inputs[i]);
                assembly {
                    mstore(add(add(currentHash, 0x20), mul(i, 0x20)), inputHash)
                }
            }
            return keccak256(currentHash);
        }
    }

    function hashOutputs(
        OutputDescription[] memory outputs
    ) internal pure returns (bytes32) {
        unchecked {
            bytes memory currentHash = new bytes(32 * outputs.length);

            for (uint256 i = 0; i < outputs.length; ++i) {
                bytes32 outputHash = hashOutput(outputs[i]);
                assembly {
                    mstore(add(add(currentHash, 0x20), mul(i, 0x20)), outputHash)
                }
            }
            return keccak256(currentHash);
        }
    }
}

// SPDX-License-Identifier: MIT
pragma solidity >=0.8.0;

import { OrderContext, OrderStatus } from "../interfaces/Structs.sol";

error CannotProveOrder(); // 0x5276f999
error ChallengeDeadlinePassed(); // 0x9b741c77
error CodeSize0(); // 0xfbc1d8e2
error FailedValidation(); // 0xbba6fbc6
error FillDeadlineFarInFuture(); // 0x9dcd54b9
error FillDeadlineInPast(); // 0x8cddc02b
error InitiateDeadlineAfterFill(); // 0xc0bf59b1
error InitiateDeadlinePassed(); // 0x606ef7f5
error InvalidDeadlineOrder(); // 0x2494cf80
error InvalidSettlementAddress(); // 0x78c8b5df
error LengthsDoesNotMatch(uint256, uint256); // 0x7fb23044
error MinOrderPurchaseDiscountTooLow(uint256 minimum, uint256 configured); // 0xf8e451f1
error OnlyFiller(); // 0x422d60ed
error OrderAlreadyClaimed(OrderStatus orderStatus); // 0x87d33f7e
error OrderNotReadyForOptimisticPayout(uint32 time); // 0xe9deeb4d
error OrderFinal(); // 0xad7bd3e1
error ProofPeriodHasNotPassed(uint32 time); // 0x39bd19f3
error PurchaseTimePassed(); // 0xf8e451f1
error WrongChain(uint32 expected, uint32 actual); // 0x264363e1
error WrongOrderStatus(OrderStatus actual); // 0x858c6fe3
error WrongRemoteOracle(bytes32 addressThis, bytes32 expected); // 0xe57d7773

// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.26;

import { ISignatureTransfer } from "permit2/src/interfaces/ISignatureTransfer.sol";

import { ICrossCatsCallback } from "../interfaces/ICrossCatsCallback.sol";

import { Input } from "../interfaces/ISettlementContract.sol";
import { OrderKey } from "../interfaces/Structs.sol";

/**
 * @notice Decodes fillerdata.
 */
library FillerDataLib {
    error NotImplemented(bytes1 version);
    error IdentifierMismatch();

    /**
     * @notice Decode generic filler data.
     */
    function decode(
        bytes calldata fillerData
    )
        internal
        view
        returns (
            address fillerAddress,
            uint32 orderPurchaseDeadline,
            uint16 orderPurchaseDiscount,
            bytes32 identifier,
            uint256 pointer
        )
    {
        if (fillerData.length == 0) {
            return (msg.sender, 0, 0, bytes32(0), 0);
        }
        // fillerData.length >= 1
        bytes1 version = fillerData[0];
        if (version == 0x00) {
            return (msg.sender, 0, 0, bytes32(0), 1);
        }
        if (version == VERSION_1) {
            (fillerAddress, orderPurchaseDeadline, orderPurchaseDiscount) = _decode1(fillerData);
            return (fillerAddress, orderPurchaseDeadline, orderPurchaseDiscount, bytes32(0), V1_ORDER_DISCOUNT_END);
        }
        if (version == VERSION_2) {
            (fillerAddress, orderPurchaseDeadline, orderPurchaseDiscount, identifier) = _decode2(fillerData);
            return (fillerAddress, orderPurchaseDeadline, orderPurchaseDiscount, identifier, V2_CALLDATA_HASH_END);
        }
        revert NotImplemented(version);
    }

    /**
     * @notice Execute filler data. Specifically for fillerData version 2,
     * execution data can be set as required after releasing the inputs to the filler.
     * @param identifier Hash of the executionData that has to be provided. Is stored as
     * bytes32 to avoid storing a lot of calldata.
     * @param orderKeyHash Hash of the order key. Is provided to the callback incase they want to recover
     * some information from the storage or related. (we only 0 the fillerAddress).
     * @param executionData Execution data with the destination encoded in the first 20 bytes.
     */
    function execute(bytes32 identifier, bytes32 orderKeyHash, bytes calldata executionData) internal {
        if (identifier != keccak256(executionData)) revert IdentifierMismatch();

        address toCall = address(bytes20(executionData[0:20]));
        bytes calldata dataToCall = executionData[20:];

        // Importantly, notice that an order cannot be purchased if this call reverts.
        ICrossCatsCallback(toCall).inputsFilled(orderKeyHash, dataToCall);
    }

    //--- Version 1 ---/
    bytes1 private constant VERSION_1 = 0x01;
    uint256 private constant V1_ADDRESS_START = 1;
    uint256 private constant V1_ADDRESS_END = 21;
    uint256 private constant V1_ORDER_PURCHASE_DEADLINE_START = V1_ADDRESS_END;
    uint256 private constant V1_ORDER_PURCHASE_DEADLINE_END = 25;
    uint256 private constant V1_ORDER_DISCOUNT_START = V1_ORDER_PURCHASE_DEADLINE_END;
    uint256 private constant V1_ORDER_DISCOUNT_END = 27;

    function _decode1(
        bytes calldata fillerData
    ) private pure returns (address fillerAddress, uint32 orderPurchaseDeadline, uint16 orderPurchaseDiscount) {
        fillerAddress = address(uint160(bytes20(fillerData[V1_ADDRESS_START:V1_ADDRESS_END])));
        orderPurchaseDeadline =
            uint32(bytes4(fillerData[V1_ORDER_PURCHASE_DEADLINE_START:V1_ORDER_PURCHASE_DEADLINE_END]));
        orderPurchaseDiscount = uint16(bytes2(fillerData[V1_ORDER_DISCOUNT_START:V1_ORDER_DISCOUNT_END]));
    }

    function _encode1(
        address fillerAddress,
        uint32 orderPurchaseDeadline,
        uint16 orderPurchaseDiscount
    ) internal pure returns (bytes memory fillerData) {
        return bytes.concat(
            VERSION_1, bytes20(fillerAddress), bytes4(orderPurchaseDeadline), bytes2(orderPurchaseDiscount)
        );
    }

    //--- Version 2 ---/
    bytes1 private constant VERSION_2 = 0x02;
    uint256 private constant V2_ADDRESS_START = 1;
    uint256 private constant V2_ADDRESS_END = 21;
    uint256 private constant V2_ORDER_PURCHASE_DEADLINE_START = V2_ADDRESS_END;
    uint256 private constant V2_ORDER_PURCHASE_DEADLINE_END = 25;
    uint256 private constant V2_ORDER_DISCOUNT_START = V2_ORDER_PURCHASE_DEADLINE_END;
    uint256 private constant V2_ORDER_DISCOUNT_END = 27;
    uint256 private constant V2_CALLDATA_HASH_START = V2_ORDER_DISCOUNT_END;
    uint256 private constant V2_CALLDATA_HASH_END = 59;

    function _decode2(
        bytes calldata fillerData
    )
        private
        pure
        returns (address fillerAddress, uint32 orderPurchaseDeadline, uint16 orderPurchaseDiscount, bytes32 identifier)
    {
        fillerAddress = address(uint160(bytes20(fillerData[V2_ADDRESS_START:V2_ADDRESS_END])));
        orderPurchaseDeadline =
            uint32(bytes4(fillerData[V2_ORDER_PURCHASE_DEADLINE_START:V2_ORDER_PURCHASE_DEADLINE_END]));
        orderPurchaseDiscount = uint16(bytes2(fillerData[V2_ORDER_DISCOUNT_START:V2_ORDER_DISCOUNT_END]));
        identifier = bytes32(fillerData[V2_CALLDATA_HASH_START:V2_CALLDATA_HASH_END]);
    }

    function _encode2(
        address fillerAddress,
        uint32 orderPurchaseDeadline,
        uint16 orderPurchaseDiscount,
        bytes32 identifier
    ) internal pure returns (bytes memory fillerData) {
        return bytes.concat(
            VERSION_2, bytes20(fillerAddress), bytes4(orderPurchaseDeadline), bytes2(orderPurchaseDiscount), identifier
        );
    }
}

// SPDX-License-Identifier: MIT
pragma solidity >=0.8.0;

/**
 * @notice Implement callback handling for Cross cats payouts, both outputs and inputs.
 * @dev Callbacks are opt-in. If you opt-in, take care to not revert.
 * Funds are likely in danger if the calls revert. Please be careful.
 *
 * If you don't need this functionality, stay away.
 * To enable for outputs, set `remoteCall` to the calldata. recipient is called.
 * To enable for inputs, use fillerData version 2. You set a hash of the data.
 * The first 20 bytes of the data is called.
 */
interface ICrossCatsCallback {
    /**
     * @notice If configured, is called when the output is filled on the destination chain.
     * @dev If the transaction reverts, 1 million gas is provided.
     * If the transaction doesn't revert, only enough gas to execute the transaction is given + a buffer of 1/63'th.
     * The recipient is called.
     * If the call reverts, funds are still delivered to the recipient.
     * Please ensure that funds are safely handled on your side.
     */
    function outputFilled(bytes32 token, uint256 amount, bytes calldata executionData) external;

    /**
     * @notice If configured, is called when the input is sent to the filler.
     * May be called for under the following conditions:
     * - The inputs is purchased by someone else (/UW)
     * - The inputs are optimistically refunded.
     * - Output delivery was proven.
     *
     * You can use this function to add custom conditions to purchasing an order / uw.
     * If you revert, your order cannot be purchased.
     * @dev If this call reverts / uses a ton of gas, the data has to be modified (modifyOrderFillerdata)
     * This function can ONLY be called by the filler itself rather than anyone.
     * If the fillerAddress is unable to call modifyOrderFillerdata, take care to ensure the function
     * never reverts as otherwise the inputs are locked.
     *
     * executionData is never explicitly provided on chain, only a hash of it is. If this is not
     * publicly known, it can act as a kind of secret and people cannot call the main functions.
     * If you lose it you will have to call modifyOrderFillerdata which only the registered filler can.
     *
     * The address to call is the first 20 bytes of the data to execute.
     *
     * @param orderKeyHash Hash of the order key. Can be used for identification.
     * @param executionData Custom data that the filler asked to be provided with the call.
     */
    function inputsFilled(bytes32 orderKeyHash, bytes calldata executionData) external;
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

interface IEIP712 {
    function DOMAIN_SEPARATOR() external view returns (bytes32);
}

// SPDX-License-Identifier: MIT
pragma solidity >=0.8.0;

import { OutputDescription } from "./Structs.sol";

interface IOracle {
    function isProven(OutputDescription[] calldata outputs, uint32 fillDeadline) external view returns (bool proven);
}

// SPDX-License-Identifier: MIT
pragma solidity >=0.8.0;

import { OrderKey } from "./Structs.sol";

/// @title CrossChainOrder type
/// @notice Standard order struct to be signed by swappers, disseminated to fillers, and submitted to settlement
/// contracts
struct CrossChainOrder {
    /// @dev The contract address that the order is meant to be settled by.
    /// Fillers send this order to this contract address on the origin chain
    address settlementContract;
    /// @dev The address of the user who is initiating the swap,
    /// whose input tokens will be taken and escrowed
    address swapper;
    /// @dev Nonce to be used as replay protection for the order
    uint256 nonce;
    /// @dev The chainId of the origin chain
    uint32 originChainId;
    /// @dev The timestamp by which the order must be initiated
    uint32 initiateDeadline;
    /// @dev The timestamp by which the order must be filled on the destination chain
    uint32 fillDeadline;
    /// @dev Arbitrary implementation-specific data
    /// Can be used to define tokens, amounts, destination chains, fees, settlement parameters,
    /// or any other order-type specific information
    bytes orderData;
}

/// @title ResolvedCrossChainOrder type
/// @notice An implementation-generic representation of an order
/// @dev Defines all requirements for filling an order by unbundling the implementation-specific orderData.
/// @dev Intended to improve integration generalization by allowing fillers to compute the exact input and output
/// information of any order
struct ResolvedCrossChainOrder {
    /// @dev The contract address that the order is meant to be settled by.
    address settlementContract;
    /// @dev The address of the user who is initiating the swap
    address swapper;
    /// @dev Nonce to be used as replay protection for the order
    uint256 nonce;
    /// @dev The chainId of the origin chain
    uint32 originChainId;
    /// @dev The timestamp by which the order must be initiated
    uint32 initiateDeadline;
    /// @dev The timestamp by which the order must be filled on the destination chain(s)
    uint32 fillDeadline;
    /// @dev The inputs to be taken from the swapper as part of order initiation
    Input[] swapperInputs;
    /// @dev The outputs to be given to the swapper as part of order fulfillment
    Output[] swapperOutputs;
    /// @dev The outputs to be given to the filler as part of order settlement
    Output[] fillerOutputs;
}

/// @notice Tokens sent by the swapper as inputs to the order
struct Input {
    /// @dev The address of the ERC20 token on the origin chain
    address token;
    /// @dev The amount of the token to be sent
    uint256 amount;
}

/// @notice Tokens that must be receive for a valid order fulfillment
struct Output {
    /// @dev The address of the ERC20 token on the destination chain
    /// @dev address(0) used as a sentinel for the native token
    bytes32 token; // ! CHANGED FROM ERC-7683. ABI.ENCODES THE SAME BUT NOT STORAGE
    /// @dev The amount of the token to be sent
    uint256 amount;
    /// @dev The address to receive the output tokens
    bytes32 recipient; // ! CHANGED FROM ERC-7683. ABI.ENCODES THE SAME BUT NOT STORAGE
    /// @dev The destination chain for this output
    uint32 chainId;
}

/// @title ISettlementContract
/// @notice Standard interface for settlement contracts
interface ISettlementContract {
    /// @notice Initiates the settlement of a cross-chain order
    /// @dev To be called by the filler
    /// @param order The CrossChainOrder definition
    /// @param signature The swapper's signature over the order
    /// @param fillerData Any filler-defined data required by the settler
    /// @return orderKey // ! Return type added that returns the resolved order key. This adds additional validation
    /// pathways if needed.
    function initiate(
        CrossChainOrder calldata order,
        bytes calldata signature,
        bytes calldata fillerData
    ) external returns (OrderKey memory orderKey);

    /// @notice Resolves a specific CrossChainOrder into a generic ResolvedCrossChainOrder
    /// @dev Intended to improve standardized integration of various order types and settlement contracts
    /// @param order The CrossChainOrder definition
    /// @param fillerData Any filler-defined data required by the settler
    /// @return ResolvedCrossChainOrder hydrated order data including the inputs and outputs of the order
    function resolve(
        CrossChainOrder calldata order,
        bytes calldata fillerData
    ) external view returns (ResolvedCrossChainOrder memory);
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

import {IEIP712} from "./IEIP712.sol";

/// @title SignatureTransfer
/// @notice Handles ERC20 token transfers through signature based actions
/// @dev Requires user's token approval on the Permit2 contract
interface ISignatureTransfer is IEIP712 {
    /// @notice Thrown when the requested amount for a transfer is larger than the permissioned amount
    /// @param maxAmount The maximum amount a spender can request to transfer
    error InvalidAmount(uint256 maxAmount);

    /// @notice Thrown when the number of tokens permissioned to a spender does not match the number of tokens being transferred
    /// @dev If the spender does not need to transfer the number of tokens permitted, the spender can request amount 0 to be transferred
    error LengthMismatch();

    /// @notice Emits an event when the owner successfully invalidates an unordered nonce.
    event UnorderedNonceInvalidation(address indexed owner, uint256 word, uint256 mask);

    /// @notice The token and amount details for a transfer signed in the permit transfer signature
    struct TokenPermissions {
        // ERC20 token address
        address token;
        // the maximum amount that can be spent
        uint256 amount;
    }

    /// @notice The signed permit message for a single token transfer
    struct PermitTransferFrom {
        TokenPermissions permitted;
        // a unique value for every token owner's signature to prevent signature replays
        uint256 nonce;
        // deadline on the permit signature
        uint256 deadline;
    }

    /// @notice Specifies the recipient address and amount for batched transfers.
    /// @dev Recipients and amounts correspond to the index of the signed token permissions array.
    /// @dev Reverts if the requested amount is greater than the permitted signed amount.
    struct SignatureTransferDetails {
        // recipient address
        address to;
        // spender requested amount
        uint256 requestedAmount;
    }

    /// @notice Used to reconstruct the signed permit message for multiple token transfers
    /// @dev Do not need to pass in spender address as it is required that it is msg.sender
    /// @dev Note that a user still signs over a spender address
    struct PermitBatchTransferFrom {
        // the tokens and corresponding amounts permitted for a transfer
        TokenPermissions[] permitted;
        // a unique value for every token owner's signature to prevent signature replays
        uint256 nonce;
        // deadline on the permit signature
        uint256 deadline;
    }

    /// @notice A map from token owner address and a caller specified word index to a bitmap. Used to set bits in the bitmap to prevent against signature replay protection
    /// @dev Uses unordered nonces so that permit messages do not need to be spent in a certain order
    /// @dev The mapping is indexed first by the token owner, then by an index specified in the nonce
    /// @dev It returns a uint256 bitmap
    /// @dev The index, or wordPosition is capped at type(uint248).max
    function nonceBitmap(address, uint256) external view returns (uint256);

    /// @notice Transfers a token using a signed permit message
    /// @dev Reverts if the requested amount is greater than the permitted signed amount
    /// @param permit The permit data signed over by the owner
    /// @param owner The owner of the tokens to transfer
    /// @param transferDetails The spender's requested transfer details for the permitted token
    /// @param signature The signature to verify
    function permitTransferFrom(
        PermitTransferFrom memory permit,
        SignatureTransferDetails calldata transferDetails,
        address owner,
        bytes calldata signature
    ) external;

    /// @notice Transfers a token using a signed permit message
    /// @notice Includes extra data provided by the caller to verify signature over
    /// @dev The witness type string must follow EIP712 ordering of nested structs and must include the TokenPermissions type definition
    /// @dev Reverts if the requested amount is greater than the permitted signed amount
    /// @param permit The permit data signed over by the owner
    /// @param owner The owner of the tokens to transfer
    /// @param transferDetails The spender's requested transfer details for the permitted token
    /// @param witness Extra data to include when checking the user signature
    /// @param witnessTypeString The EIP-712 type definition for remaining string stub of the typehash
    /// @param signature The signature to verify
    function permitWitnessTransferFrom(
        PermitTransferFrom memory permit,
        SignatureTransferDetails calldata transferDetails,
        address owner,
        bytes32 witness,
        string calldata witnessTypeString,
        bytes calldata signature
    ) external;

    /// @notice Transfers multiple tokens using a signed permit message
    /// @param permit The permit data signed over by the owner
    /// @param owner The owner of the tokens to transfer
    /// @param transferDetails Specifies the recipient and requested amount for the token transfer
    /// @param signature The signature to verify
    function permitTransferFrom(
        PermitBatchTransferFrom memory permit,
        SignatureTransferDetails[] calldata transferDetails,
        address owner,
        bytes calldata signature
    ) external;

    /// @notice Transfers multiple tokens using a signed permit message
    /// @dev The witness type string must follow EIP712 ordering of nested structs and must include the TokenPermissions type definition
    /// @notice Includes extra data provided by the caller to verify signature over
    /// @param permit The permit data signed over by the owner
    /// @param owner The owner of the tokens to transfer
    /// @param transferDetails Specifies the recipient and requested amount for the token transfer
    /// @param witness Extra data to include when checking the user signature
    /// @param witnessTypeString The EIP-712 type definition for remaining string stub of the typehash
    /// @param signature The signature to verify
    function permitWitnessTransferFrom(
        PermitBatchTransferFrom memory permit,
        SignatureTransferDetails[] calldata transferDetails,
        address owner,
        bytes32 witness,
        string calldata witnessTypeString,
        bytes calldata signature
    ) external;

    /// @notice Invalidates the bits specified in mask for the bitmap at the word position
    /// @dev The wordPos is maxed at type(uint248).max
    /// @param wordPos A number to index the nonceBitmap at
    /// @param mask A bitmap masked against msg.sender's current bitmap at the word position
    function invalidateUnorderedNonces(uint256 wordPos, uint256 mask) external;
}

// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.26;

import { CodeSize0 } from "../interfaces/Errors.sol";

library IsContractLib {
    /**
     * @notice Checks if an address has contract code. Reverts with custom error CodeSize0() if size == 0.
     * @dev The intended use of this function is in combination with safeTransferFrom.
     * Solady's safeTransferFrom does not check if a token exists. For some use cases this
     * is an issue since a call that worked earlier fails later in the flow if a token is
     * suddenly deployed to the address.
     * @param addr is the token contract address needs to be checked against.
     */
    function checkCodeSize(
        address addr
    ) internal view {
        uint256 size;
        assembly ("memory-safe") {
            size := extcodesize(addr)
        }
        if (size == 0) revert CodeSize0();
    }
}

    // SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.26;

import { CrossChainOrder, Input, ResolvedCrossChainOrder } from "../interfaces/ISettlementContract.sol";
import { Collateral, OrderKey, OutputDescription, ReactorInfo } from "../interfaces/Structs.sol";
import { CatalystLimitOrderData, CrossChainLimitOrderType } from "../libs/ordertypes/CrossChainLimitOrderType.sol";
import { CrossChainOrderType } from "../libs/ordertypes/CrossChainOrderType.sol";

import { BaseReactor } from "./BaseReactor.sol";

contract LimitOrderReactor is BaseReactor {
    constructor(address permit2, address owner) payable BaseReactor(permit2, owner) { }

    function _initiate(
        CrossChainOrder calldata order,
        bytes calldata /* fillerData */
    )
        internal
        pure
        override
        returns (
            OrderKey memory orderKey,
            uint256[] memory permittedAmounts,
            bytes32 witness,
            string memory witnessTypeString
        )
    {
        CatalystLimitOrderData memory limitOrderData = CrossChainLimitOrderType.decodeOrderData(order.orderData);

        // Set permitted inputs
        uint256 numInputs = limitOrderData.inputs.length;
        permittedAmounts = new uint256[](numInputs);
        for (uint256 i = 0; i < numInputs; ++i) {
            permittedAmounts[i] = limitOrderData.inputs[i].amount;
        }

        witness = CrossChainLimitOrderType.crossOrderHash(order, limitOrderData);
        witnessTypeString = CrossChainLimitOrderType.PERMIT2_LIMIT_ORDER_WITNESS_STRING_TYPE;

        // Set orderKey:
        orderKey = _resolveKey(order, limitOrderData);
    }

    function _resolveKey(
        CrossChainOrder calldata order,
        bytes calldata /* fillerData */
    ) internal pure override returns (OrderKey memory orderKey) {
        CatalystLimitOrderData memory limitData = CrossChainLimitOrderType.decodeOrderData(order.orderData);
        return _resolveKey(order, limitData);
    }

    function _resolveKey(
        CrossChainOrder calldata order,
        CatalystLimitOrderData memory limitData
    ) internal pure returns (OrderKey memory orderKey) {
        Input[] memory inputs = limitData.inputs;
        OutputDescription[] memory outputs = limitData.outputs;

        // Set orderKey:
        orderKey = OrderKey({
            reactorContext: ReactorInfo({
                reactor: order.settlementContract,
                // Order resolution times
                fillDeadline: order.fillDeadline,
                challengeDeadline: limitData.challengeDeadline,
                proofDeadline: limitData.proofDeadline
            }),
            swapper: order.swapper,
            nonce: uint96(order.nonce),
            collateral: Collateral({
                collateralToken: limitData.collateralToken,
                fillerCollateralAmount: limitData.fillerCollateralAmount,
                challengerCollateralAmount: limitData.challengerCollateralAmount
            }),
            originChainId: order.originChainId,
            // Proof Context
            localOracle: limitData.localOracle,
            inputs: inputs,
            outputs: outputs
        });
    }
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.4;

/// @notice Simple single owner authorization mixin.
/// @author Solady (https://github.com/vectorized/solady/blob/main/src/auth/Ownable.sol)
///
/// @dev Note:
/// This implementation does NOT auto-initialize the owner to `msg.sender`.
/// You MUST call the `_initializeOwner` in the constructor / initializer.
///
/// While the ownable portion follows
/// [EIP-173](https://eips.ethereum.org/EIPS/eip-173) for compatibility,
/// the nomenclature for the 2-step ownership handover may be unique to this codebase.
abstract contract Ownable {
    /*´:°•.°+.*•´.*:˚.°*.˚•´.°:°•.°•.*•´.*:˚.°*.˚•´.°:°•.°+.*•´.*:*/
    /*                       CUSTOM ERRORS                        */
    /*.•°:°.´+˚.*°.˚:*.´•*.+°.•°:´*.´•*.•°.•°:°.´:•˚°.*°.˚:*.´+°.•*/

    /// @dev The caller is not authorized to call the function.
    error Unauthorized();

    /// @dev The `newOwner` cannot be the zero address.
    error NewOwnerIsZeroAddress();

    /// @dev The `pendingOwner` does not have a valid handover request.
    error NoHandoverRequest();

    /// @dev Cannot double-initialize.
    error AlreadyInitialized();

    /*´:°•.°+.*•´.*:˚.°*.˚•´.°:°•.°•.*•´.*:˚.°*.˚•´.°:°•.°+.*•´.*:*/
    /*                           EVENTS                           */
    /*.•°:°.´+˚.*°.˚:*.´•*.+°.•°:´*.´•*.•°.•°:°.´:•˚°.*°.˚:*.´+°.•*/

    /// @dev The ownership is transferred from `oldOwner` to `newOwner`.
    /// This event is intentionally kept the same as OpenZeppelin's Ownable to be
    /// compatible with indexers and [EIP-173](https://eips.ethereum.org/EIPS/eip-173),
    /// despite it not being as lightweight as a single argument event.
    event OwnershipTransferred(address indexed oldOwner, address indexed newOwner);

    /// @dev An ownership handover to `pendingOwner` has been requested.
    event OwnershipHandoverRequested(address indexed pendingOwner);

    /// @dev The ownership handover to `pendingOwner` has been canceled.
    event OwnershipHandoverCanceled(address indexed pendingOwner);

    /// @dev `keccak256(bytes("OwnershipTransferred(address,address)"))`.
    uint256 private constant _OWNERSHIP_TRANSFERRED_EVENT_SIGNATURE =
        0x8be0079c531659141344cd1fd0a4f28419497f9722a3daafe3b4186f6b6457e0;

    /// @dev `keccak256(bytes("OwnershipHandoverRequested(address)"))`.
    uint256 private constant _OWNERSHIP_HANDOVER_REQUESTED_EVENT_SIGNATURE =
        0xdbf36a107da19e49527a7176a1babf963b4b0ff8cde35ee35d6cd8f1f9ac7e1d;

    /// @dev `keccak256(bytes("OwnershipHandoverCanceled(address)"))`.
    uint256 private constant _OWNERSHIP_HANDOVER_CANCELED_EVENT_SIGNATURE =
        0xfa7b8eab7da67f412cc9575ed43464468f9bfbae89d1675917346ca6d8fe3c92;

    /*´:°•.°+.*•´.*:˚.°*.˚•´.°:°•.°•.*•´.*:˚.°*.˚•´.°:°•.°+.*•´.*:*/
    /*                          STORAGE                           */
    /*.•°:°.´+˚.*°.˚:*.´•*.+°.•°:´*.´•*.•°.•°:°.´:•˚°.*°.˚:*.´+°.•*/

    /// @dev The owner slot is given by:
    /// `bytes32(~uint256(uint32(bytes4(keccak256("_OWNER_SLOT_NOT")))))`.
    /// It is intentionally chosen to be a high value
    /// to avoid collision with lower slots.
    /// The choice of manual storage layout is to enable compatibility
    /// with both regular and upgradeable contracts.
    bytes32 internal constant _OWNER_SLOT =
        0xffffffffffffffffffffffffffffffffffffffffffffffffffffffff74873927;

    /// The ownership handover slot of `newOwner` is given by:
    /// ```
    ///     mstore(0x00, or(shl(96, user), _HANDOVER_SLOT_SEED))
    ///     let handoverSlot := keccak256(0x00, 0x20)
    /// ```
    /// It stores the expiry timestamp of the two-step ownership handover.
    uint256 private constant _HANDOVER_SLOT_SEED = 0x389a75e1;

    /*´:°•.°+.*•´.*:˚.°*.˚•´.°:°•.°•.*•´.*:˚.°*.˚•´.°:°•.°+.*•´.*:*/
    /*                     INTERNAL FUNCTIONS                     */
    /*.•°:°.´+˚.*°.˚:*.´•*.+°.•°:´*.´•*.•°.•°:°.´:•˚°.*°.˚:*.´+°.•*/

    /// @dev Override to return true to make `_initializeOwner` prevent double-initialization.
    function _guardInitializeOwner() internal pure virtual returns (bool guard) {}

    /// @dev Initializes the owner directly without authorization guard.
    /// This function must be called upon initialization,
    /// regardless of whether the contract is upgradeable or not.
    /// This is to enable generalization to both regular and upgradeable contracts,
    /// and to save gas in case the initial owner is not the caller.
    /// For performance reasons, this function will not check if there
    /// is an existing owner.
    function _initializeOwner(address newOwner) internal virtual {
        if (_guardInitializeOwner()) {
            /// @solidity memory-safe-assembly
            assembly {
                let ownerSlot := _OWNER_SLOT
                if sload(ownerSlot) {
                    mstore(0x00, 0x0dc149f0) // `AlreadyInitialized()`.
                    revert(0x1c, 0x04)
                }
                // Clean the upper 96 bits.
                newOwner := shr(96, shl(96, newOwner))
                // Store the new value.
                sstore(ownerSlot, or(newOwner, shl(255, iszero(newOwner))))
                // Emit the {OwnershipTransferred} event.
                log3(0, 0, _OWNERSHIP_TRANSFERRED_EVENT_SIGNATURE, 0, newOwner)
            }
        } else {
            /// @solidity memory-safe-assembly
            assembly {
                // Clean the upper 96 bits.
                newOwner := shr(96, shl(96, newOwner))
                // Store the new value.
                sstore(_OWNER_SLOT, newOwner)
                // Emit the {OwnershipTransferred} event.
                log3(0, 0, _OWNERSHIP_TRANSFERRED_EVENT_SIGNATURE, 0, newOwner)
            }
        }
    }

    /// @dev Sets the owner directly without authorization guard.
    function _setOwner(address newOwner) internal virtual {
        if (_guardInitializeOwner()) {
            /// @solidity memory-safe-assembly
            assembly {
                let ownerSlot := _OWNER_SLOT
                // Clean the upper 96 bits.
                newOwner := shr(96, shl(96, newOwner))
                // Emit the {OwnershipTransferred} event.
                log3(0, 0, _OWNERSHIP_TRANSFERRED_EVENT_SIGNATURE, sload(ownerSlot), newOwner)
                // Store the new value.
                sstore(ownerSlot, or(newOwner, shl(255, iszero(newOwner))))
            }
        } else {
            /// @solidity memory-safe-assembly
            assembly {
                let ownerSlot := _OWNER_SLOT
                // Clean the upper 96 bits.
                newOwner := shr(96, shl(96, newOwner))
                // Emit the {OwnershipTransferred} event.
                log3(0, 0, _OWNERSHIP_TRANSFERRED_EVENT_SIGNATURE, sload(ownerSlot), newOwner)
                // Store the new value.
                sstore(ownerSlot, newOwner)
            }
        }
    }

    /// @dev Throws if the sender is not the owner.
    function _checkOwner() internal view virtual {
        /// @solidity memory-safe-assembly
        assembly {
            // If the caller is not the stored owner, revert.
            if iszero(eq(caller(), sload(_OWNER_SLOT))) {
                mstore(0x00, 0x82b42900) // `Unauthorized()`.
                revert(0x1c, 0x04)
            }
        }
    }

    /// @dev Returns how long a two-step ownership handover is valid for in seconds.
    /// Override to return a different value if needed.
    /// Made internal to conserve bytecode. Wrap it in a public function if needed.
    function _ownershipHandoverValidFor() internal view virtual returns (uint64) {
        return 48 * 3600;
    }

    /*´:°•.°+.*•´.*:˚.°*.˚•´.°:°•.°•.*•´.*:˚.°*.˚•´.°:°•.°+.*•´.*:*/
    /*                  PUBLIC UPDATE FUNCTIONS                   */
    /*.•°:°.´+˚.*°.˚:*.´•*.+°.•°:´*.´•*.•°.•°:°.´:•˚°.*°.˚:*.´+°.•*/

    /// @dev Allows the owner to transfer the ownership to `newOwner`.
    function transferOwnership(address newOwner) public payable virtual onlyOwner {
        /// @solidity memory-safe-assembly
        assembly {
            if iszero(shl(96, newOwner)) {
                mstore(0x00, 0x7448fbae) // `NewOwnerIsZeroAddress()`.
                revert(0x1c, 0x04)
            }
        }
        _setOwner(newOwner);
    }

    /// @dev Allows the owner to renounce their ownership.
    function renounceOwnership() public payable virtual onlyOwner {
        _setOwner(address(0));
    }

    /// @dev Request a two-step ownership handover to the caller.
    /// The request will automatically expire in 48 hours (172800 seconds) by default.
    function requestOwnershipHandover() public payable virtual {
        unchecked {
            uint256 expires = block.timestamp + _ownershipHandoverValidFor();
            /// @solidity memory-safe-assembly
            assembly {
                // Compute and set the handover slot to `expires`.
                mstore(0x0c, _HANDOVER_SLOT_SEED)
                mstore(0x00, caller())
                sstore(keccak256(0x0c, 0x20), expires)
                // Emit the {OwnershipHandoverRequested} event.
                log2(0, 0, _OWNERSHIP_HANDOVER_REQUESTED_EVENT_SIGNATURE, caller())
            }
        }
    }

    /// @dev Cancels the two-step ownership handover to the caller, if any.
    function cancelOwnershipHandover() public payable virtual {
        /// @solidity memory-safe-assembly
        assembly {
            // Compute and set the handover slot to 0.
            mstore(0x0c, _HANDOVER_SLOT_SEED)
            mstore(0x00, caller())
            sstore(keccak256(0x0c, 0x20), 0)
            // Emit the {OwnershipHandoverCanceled} event.
            log2(0, 0, _OWNERSHIP_HANDOVER_CANCELED_EVENT_SIGNATURE, caller())
        }
    }

    /// @dev Allows the owner to complete the two-step ownership handover to `pendingOwner`.
    /// Reverts if there is no existing ownership handover requested by `pendingOwner`.
    function completeOwnershipHandover(address pendingOwner) public payable virtual onlyOwner {
        /// @solidity memory-safe-assembly
        assembly {
            // Compute and set the handover slot to 0.
            mstore(0x0c, _HANDOVER_SLOT_SEED)
            mstore(0x00, pendingOwner)
            let handoverSlot := keccak256(0x0c, 0x20)
            // If the handover does not exist, or has expired.
            if gt(timestamp(), sload(handoverSlot)) {
                mstore(0x00, 0x6f5e8818) // `NoHandoverRequest()`.
                revert(0x1c, 0x04)
            }
            // Set the handover slot to 0.
            sstore(handoverSlot, 0)
        }
        _setOwner(pendingOwner);
    }

    /*´:°•.°+.*•´.*:˚.°*.˚•´.°:°•.°•.*•´.*:˚.°*.˚•´.°:°•.°+.*•´.*:*/
    /*                   PUBLIC READ FUNCTIONS                    */
    /*.•°:°.´+˚.*°.˚:*.´•*.+°.•°:´*.´•*.•°.•°:°.´:•˚°.*°.˚:*.´+°.•*/

    /// @dev Returns the owner of the contract.
    function owner() public view virtual returns (address result) {
        /// @solidity memory-safe-assembly
        assembly {
            result := sload(_OWNER_SLOT)
        }
    }

    /// @dev Returns the expiry timestamp for the two-step ownership handover to `pendingOwner`.
    function ownershipHandoverExpiresAt(address pendingOwner)
        public
        view
        virtual
        returns (uint256 result)
    {
        /// @solidity memory-safe-assembly
        assembly {
            // Compute the handover slot.
            mstore(0x0c, _HANDOVER_SLOT_SEED)
            mstore(0x00, pendingOwner)
            // Load the handover slot.
            result := sload(keccak256(0x0c, 0x20))
        }
    }

    /*´:°•.°+.*•´.*:˚.°*.˚•´.°:°•.°•.*•´.*:˚.°*.˚•´.°:°•.°+.*•´.*:*/
    /*                         MODIFIERS                          */
    /*.•°:°.´+˚.*°.˚:*.´•*.+°.•°:´*.´•*.•°.•°:°.´:•˚°.*°.˚:*.´+°.•*/

    /// @dev Marks a function as only callable by the owner.
    modifier onlyOwner() virtual {
        _checkOwner();
        _;
    }
}

// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.26;

import { ISignatureTransfer } from "permit2/src/interfaces/ISignatureTransfer.sol";
import { IsContractLib } from "./IsContractLib.sol";

import { Input } from "../interfaces/ISettlementContract.sol";
import { OrderKey } from "../interfaces/Structs.sol";

/**
 * @notice Gets the Permit2 context for an orderkey
 */
library Permit2Lib {
    /**
     * @notice Converts an OrderKey into a PermitBatchTransferFrom
     */
    function toPermit(
        OrderKey memory order,
        uint256[] memory permittedAmounts,
        address to,
        uint32 deadline
    )
        internal
        view
        returns (
            ISignatureTransfer.PermitBatchTransferFrom memory permitBatch,
            ISignatureTransfer.SignatureTransferDetails[] memory transferDetails
        )
    {
        // Load the number of inputs. We need them to set the array size & convert each
        // input struct into a transferDetails struct.
        uint256 numInputs = order.inputs.length;
        ISignatureTransfer.TokenPermissions[] memory permitted = new ISignatureTransfer.TokenPermissions[](numInputs);
        transferDetails = new ISignatureTransfer.SignatureTransferDetails[](numInputs);

        // Iterate through each input.
        for (uint256 i; i < numInputs; ++i) {
            // Check if input tokens are contracts.
            IsContractLib.checkCodeSize(order.inputs[i].token);

            // Set the allowance. This is the explicit max allowed amount approved by the user.
            permitted[i] =
                ISignatureTransfer.TokenPermissions({ token: order.inputs[i].token, amount: permittedAmounts[i] });
            // Set our requested transfer. This has to be less than or equal to the allowance
            transferDetails[i] =
                ISignatureTransfer.SignatureTransferDetails({ to: to, requestedAmount: order.inputs[i].amount });
        }

        // Always use a batch transfer from. This allows us to easily standardize
        // token collections for multiple inputs.
        permitBatch =
            ISignatureTransfer.PermitBatchTransferFrom({ permitted: permitted, nonce: order.nonce, deadline: deadline });
    }

    function inputsToPermittedAmounts(
        Input[] memory inputs
    ) internal pure returns (uint256[] memory permittedAmounts) {
        uint256 numInputs = inputs.length;
        permittedAmounts = new uint256[](numInputs);
        for (uint256 i = 0; i < numInputs; ++i) {
            permittedAmounts[i] = inputs[i].amount;
        }
    }
}

// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.26;

import { CrossChainOrder, ISettlementContract, Input, Output } from "../../interfaces/ISettlementContract.sol";
import { OrderKey } from "../../interfaces/Structs.sol";

/**
 * @dev Override for implementation
 */
abstract contract ReactorAbstractions is ISettlementContract {
    /**
     * @notice Reactor Order implementations needs to implement this function to initiate their orders.
     * Return an orderKey with the relevant information to solve for.
     * @dev This function shouldn't check if the signature is correct but instead return information
     * to be used by _collectTokensViaPermit2 to verify the order (through PERMIT2).
     */
    function _initiate(
        CrossChainOrder calldata order,
        bytes calldata fillerData
    )
        internal
        virtual
        returns (
            OrderKey memory orderKey,
            uint256[] memory permittedAmounts,
            bytes32 witness,
            string memory witnessTypeString
        );

    /**
     * @notice Logic function for resolveKey(...).
     * @dev Order implementations of this reactor are required to implement this function.
     */
    function _resolveKey(
        CrossChainOrder calldata order,
        bytes calldata fillerData
    ) internal view virtual returns (OrderKey memory);
}

// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.26;

import { ISignatureTransfer } from "permit2/src/interfaces/ISignatureTransfer.sol";
import { SafeTransferLib } from "solady/src/utils/SafeTransferLib.sol";

import { Input } from "../../interfaces/ISettlementContract.sol";
import { OrderContext, OrderKey } from "../../interfaces/Structs.sol";

import { CanCollectGovernanceFee } from "../../libs/CanCollectGovernanceFee.sol";
import { Permit2Lib } from "../../libs/Permit2Lib.sol";

/**
 * @notice Reactor Payment Handler.
 * Handles sending batches of tokens in and out of the reactor.
 */
abstract contract ReactorPayments is CanCollectGovernanceFee {
    using Permit2Lib for OrderKey;

    ISignatureTransfer public immutable PERMIT2;

    constructor(address permit2, address owner) payable CanCollectGovernanceFee(owner) {
        PERMIT2 = ISignatureTransfer(permit2);
    }

    /**
     * @notice Multi purpose order flow function that converts an order into a permit2
     * structure and provides relevant token flow protections:
     * - Orders the collection of tokens. This includes checking if the user has enough & approval.
     * - Verification of the signature for the order. This ensures the user has accepted the order conditions.
     * - Spend nonces. Disallow the same order from being claimed twice.
     */
    function _collectTokensViaPermit2(
        OrderKey memory orderKey,
        uint256[] memory permittedAmounts,
        uint32 permitDeadline,
        address owner,
        bytes32 witness,
        string memory witnessTypeString,
        bytes calldata signature
    ) internal virtual {
        (
            ISignatureTransfer.PermitBatchTransferFrom memory permitBatch,
            ISignatureTransfer.SignatureTransferDetails[] memory transferDetails
        ) = orderKey.toPermit(permittedAmounts, address(this), permitDeadline);

        PERMIT2.permitWitnessTransferFrom(permitBatch, transferDetails, owner, witness, witnessTypeString, signature);
    }

    /**
     * @notice Collects tokens without permit2.
     * @dev Can only be used to collect tokens from msg.sender.
     * If inputs[i].amount * discount overflows the amount is set to inputs[i].amount.
     * This function does not verify whether the provided token addresses are actual token contracts
     * @param inputs Tokens to collect from msg.sender.
     * @param to Destination address for the collected tokens. To collect to this contract, set address(this).
     */
    function _collectTokensFromMsgSender(Input[] calldata inputs, address to, uint16 discount) internal virtual {
        address from = msg.sender;
        uint256 numInputs = inputs.length;
        unchecked {
            for (uint256 i = 0; i < numInputs; ++i) {
                Input calldata input = inputs[i];
                address token = input.token;
                uint256 amount = input.amount;
                // If discount == 0, then set amount to amount.
                // If the discount subtraction overflows, also set the amount to amount.
                // Otherwise, compute the discount as: amount - (amount * uint256(discount)) / uint256(type(uint16).max)
                amount = (discount != 0 && amount < type(uint256).max / uint256(discount))
                    ? amount - (amount * uint256(discount)) / uint256(type(uint16).max)
                    : amount;
                SafeTransferLib.safeTransferFrom(token, from, to, amount);
            }
        }
    }

    /**
     * @notice Sends a list of inputs to the target address.
     * @dev This function can be used for paying the filler or refunding the user in case of disputes.
     * @param inputs List of inputs that are to be paid.
     * @param to Destination address.
     */
    function _deliverTokens(Input[] calldata inputs, address to, uint256 fee) internal virtual {
        // Read governance fee.
        uint256 numInputs = inputs.length;
        for (uint256 i; i < numInputs; ++i) {
            Input calldata input = inputs[i];
            address token = input.token;
            // Collect governance fee. Importantly, this also sets the value as collected.
            uint256 amount = input.amount;
            amount = fee == 0 ? amount : _collectGovernanceFee(token, amount, fee);
            // We don't need to check if token is deployed since we
            // got here. Reverting here would also freeze collateral.
            SafeTransferLib.safeTransfer(token, to, amount);
        }
    }
}

// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.26;

import { CrossChainOrder, Input, Output, ResolvedCrossChainOrder } from "../../interfaces/ISettlementContract.sol";
import { OrderKey, OutputDescription } from "../../interfaces/Structs.sol";

import { FillerDataLib } from "../../libs/FillerDataLib.sol";

import { ICanCollectGovernanceFee } from "../../libs/CanCollectGovernanceFee.sol";

import { ReactorAbstractions } from "./ReactorAbstractions.sol";

/**
 * @notice Resolves OrderKeys for ERC7683 compatible ResolvedCrossChainOrders.
 */
abstract contract ResolverERC7683 is ICanCollectGovernanceFee, ReactorAbstractions {
    /**
     * @notice Resolves a specific CrossChainOrder into a Catalyst specific OrderKey.
     * @dev This provides a more precise description of the cost of the order compared to the generic resolve(...).
     * @param order CrossChainOrder to resolve.
     * @param fillerData Any filler-defined data required by the settler
     * @return orderKey The full description of the order, including the inputs and outputs of the order
     */
    function resolveKey(
        CrossChainOrder calldata order,
        bytes calldata fillerData
    ) external view returns (OrderKey memory orderKey) {
        return orderKey = _resolveKey(order, fillerData);
    }

    /**
     * @notice Resolves an order into an ERC-7683 compatible order struct.
     * By default relies on _resolveKey to convert OrderKey into a ResolvedCrossChainOrder
     * @dev Can be overwritten if there isn't a translation of an orderKey into resolvedOrder.
     * @param order CrossChainOrder to resolve.
     * @param  fillerData Any filler-defined data required by the settler
     * @return resolvedOrder ERC-7683 compatible order description, including the inputs and outputs of the order
     */
    function _resolve(
        CrossChainOrder calldata order,
        bytes calldata fillerData
    ) internal view virtual returns (ResolvedCrossChainOrder memory resolvedOrder) {
        OrderKey memory orderKey = _resolveKey(order, fillerData);
        (address fillerAddress,,,,) = FillerDataLib.decode(fillerData);

        // Inputs can be taken directly from the orderKey.
        Input[] memory swapperInputs = orderKey.inputs;
        // Likewise for outputs.

        uint256 numOutputs = orderKey.outputs.length;
        Output[] memory swapperOutputs = new Output[](numOutputs);
        for (uint256 i = 0; i < numOutputs; ++i) {
            OutputDescription memory catalystOutput = orderKey.outputs[i];
            swapperOutputs[i] = Output({
                token: catalystOutput.token,
                amount: catalystOutput.amount,
                recipient: catalystOutput.recipient,
                chainId: catalystOutput.chainId
            });
        }

        // fillerOutputs are of the Output type and as a result, we can't just
        // load swapperInputs into fillerOutputs. As a result, we need to parse
        // the individual inputs and make a new struct.
        uint256 numInputs = swapperInputs.length;
        Output[] memory fillerOutputs = new Output[](numInputs);
        Output memory fillerOutput;
        unchecked {
            for (uint256 i; i < numInputs; ++i) {
                Input memory input = swapperInputs[i];
                fillerOutput = Output({
                    token: bytes32(uint256(uint160(input.token))),
                    amount: input.amount - _calcFee(input.amount),
                    recipient: bytes32(uint256(uint160(fillerAddress))),
                    chainId: uint32(block.chainid)
                });
                fillerOutputs[i] = fillerOutput;
            }
        }

        // Lastly, complete the ResolvedCrossChainOrder struct.
        resolvedOrder = ResolvedCrossChainOrder({
            settlementContract: order.settlementContract,
            swapper: order.swapper,
            nonce: order.nonce,
            originChainId: order.originChainId,
            initiateDeadline: order.initiateDeadline,
            fillDeadline: order.fillDeadline,
            swapperInputs: swapperInputs,
            swapperOutputs: swapperOutputs,
            fillerOutputs: fillerOutputs
        });
    }

    /**
     * @notice ERC-7683: Resolves a specific CrossChainOrder into a generic ResolvedCrossChainOrder
     * @dev Intended to improve standardized integration of various order types and settlement contracts
     * @param order CrossChainOrder to resolve.
     * @param fillerData Any filler-defined data required by the settler
     * @return resolvedOrder ERC-7683 compatible order description, including the inputs and outputs of the order
     */
    function resolve(
        CrossChainOrder calldata order,
        bytes calldata fillerData
    ) external view returns (ResolvedCrossChainOrder memory resolvedOrder) {
        return _resolve(order, fillerData);
    }
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.4;

/// @notice Safe ETH and ERC20 transfer library that gracefully handles missing return values.
/// @author Solady (https://github.com/vectorized/solady/blob/main/src/utils/SafeTransferLib.sol)
/// @author Modified from Solmate (https://github.com/transmissions11/solmate/blob/main/src/utils/SafeTransferLib.sol)
/// @author Permit2 operations from (https://github.com/Uniswap/permit2/blob/main/src/libraries/Permit2Lib.sol)
///
/// @dev Note:
/// - For ETH transfers, please use `forceSafeTransferETH` for DoS protection.
/// - For ERC20s, this implementation won't check that a token has code,
///   responsibility is delegated to the caller.
library SafeTransferLib {
    /*´:°•.°+.*•´.*:˚.°*.˚•´.°:°•.°•.*•´.*:˚.°*.˚•´.°:°•.°+.*•´.*:*/
    /*                       CUSTOM ERRORS                        */
    /*.•°:°.´+˚.*°.˚:*.´•*.+°.•°:´*.´•*.•°.•°:°.´:•˚°.*°.˚:*.´+°.•*/

    /// @dev The ETH transfer has failed.
    error ETHTransferFailed();

    /// @dev The ERC20 `transferFrom` has failed.
    error TransferFromFailed();

    /// @dev The ERC20 `transfer` has failed.
    error TransferFailed();

    /// @dev The ERC20 `approve` has failed.
    error ApproveFailed();

    /// @dev The Permit2 operation has failed.
    error Permit2Failed();

    /// @dev The Permit2 amount must be less than `2**160 - 1`.
    error Permit2AmountOverflow();

    /*´:°•.°+.*•´.*:˚.°*.˚•´.°:°•.°•.*•´.*:˚.°*.˚•´.°:°•.°+.*•´.*:*/
    /*                         CONSTANTS                          */
    /*.•°:°.´+˚.*°.˚:*.´•*.+°.•°:´*.´•*.•°.•°:°.´:•˚°.*°.˚:*.´+°.•*/

    /// @dev Suggested gas stipend for contract receiving ETH that disallows any storage writes.
    uint256 internal constant GAS_STIPEND_NO_STORAGE_WRITES = 2300;

    /// @dev Suggested gas stipend for contract receiving ETH to perform a few
    /// storage reads and writes, but low enough to prevent griefing.
    uint256 internal constant GAS_STIPEND_NO_GRIEF = 100000;

    /// @dev The unique EIP-712 domain domain separator for the DAI token contract.
    bytes32 internal constant DAI_DOMAIN_SEPARATOR =
        0xdbb8cf42e1ecb028be3f3dbc922e1d878b963f411dc388ced501601c60f7c6f7;

    /// @dev The address for the WETH9 contract on Ethereum mainnet.
    address internal constant WETH9 = 0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2;

    /// @dev The canonical Permit2 address.
    /// [Github](https://github.com/Uniswap/permit2)
    /// [Etherscan](https://etherscan.io/address/0x000000000022D473030F116dDEE9F6B43aC78BA3)
    address internal constant PERMIT2 = 0x000000000022D473030F116dDEE9F6B43aC78BA3;

    /*´:°•.°+.*•´.*:˚.°*.˚•´.°:°•.°•.*•´.*:˚.°*.˚•´.°:°•.°+.*•´.*:*/
    /*                       ETH OPERATIONS                       */
    /*.•°:°.´+˚.*°.˚:*.´•*.+°.•°:´*.´•*.•°.•°:°.´:•˚°.*°.˚:*.´+°.•*/

    // If the ETH transfer MUST succeed with a reasonable gas budget, use the force variants.
    //
    // The regular variants:
    // - Forwards all remaining gas to the target.
    // - Reverts if the target reverts.
    // - Reverts if the current contract has insufficient balance.
    //
    // The force variants:
    // - Forwards with an optional gas stipend
    //   (defaults to `GAS_STIPEND_NO_GRIEF`, which is sufficient for most cases).
    // - If the target reverts, or if the gas stipend is exhausted,
    //   creates a temporary contract to force send the ETH via `SELFDESTRUCT`.
    //   Future compatible with `SENDALL`: https://eips.ethereum.org/EIPS/eip-4758.
    // - Reverts if the current contract has insufficient balance.
    //
    // The try variants:
    // - Forwards with a mandatory gas stipend.
    // - Instead of reverting, returns whether the transfer succeeded.

    /// @dev Sends `amount` (in wei) ETH to `to`.
    function safeTransferETH(address to, uint256 amount) internal {
        /// @solidity memory-safe-assembly
        assembly {
            if iszero(call(gas(), to, amount, codesize(), 0x00, codesize(), 0x00)) {
                mstore(0x00, 0xb12d13eb) // `ETHTransferFailed()`.
                revert(0x1c, 0x04)
            }
        }
    }

    /// @dev Sends all the ETH in the current contract to `to`.
    function safeTransferAllETH(address to) internal {
        /// @solidity memory-safe-assembly
        assembly {
            // Transfer all the ETH and check if it succeeded or not.
            if iszero(call(gas(), to, selfbalance(), codesize(), 0x00, codesize(), 0x00)) {
                mstore(0x00, 0xb12d13eb) // `ETHTransferFailed()`.
                revert(0x1c, 0x04)
            }
        }
    }

    /// @dev Force sends `amount` (in wei) ETH to `to`, with a `gasStipend`.
    function forceSafeTransferETH(address to, uint256 amount, uint256 gasStipend) internal {
        /// @solidity memory-safe-assembly
        assembly {
            if lt(selfbalance(), amount) {
                mstore(0x00, 0xb12d13eb) // `ETHTransferFailed()`.
                revert(0x1c, 0x04)
            }
            if iszero(call(gasStipend, to, amount, codesize(), 0x00, codesize(), 0x00)) {
                mstore(0x00, to) // Store the address in scratch space.
                mstore8(0x0b, 0x73) // Opcode `PUSH20`.
                mstore8(0x20, 0xff) // Opcode `SELFDESTRUCT`.
                if iszero(create(amount, 0x0b, 0x16)) { revert(codesize(), codesize()) } // For gas estimation.
            }
        }
    }

    /// @dev Force sends all the ETH in the current contract to `to`, with a `gasStipend`.
    function forceSafeTransferAllETH(address to, uint256 gasStipend) internal {
        /// @solidity memory-safe-assembly
        assembly {
            if iszero(call(gasStipend, to, selfbalance(), codesize(), 0x00, codesize(), 0x00)) {
                mstore(0x00, to) // Store the address in scratch space.
                mstore8(0x0b, 0x73) // Opcode `PUSH20`.
                mstore8(0x20, 0xff) // Opcode `SELFDESTRUCT`.
                if iszero(create(selfbalance(), 0x0b, 0x16)) { revert(codesize(), codesize()) } // For gas estimation.
            }
        }
    }

    /// @dev Force sends `amount` (in wei) ETH to `to`, with `GAS_STIPEND_NO_GRIEF`.
    function forceSafeTransferETH(address to, uint256 amount) internal {
        /// @solidity memory-safe-assembly
        assembly {
            if lt(selfbalance(), amount) {
                mstore(0x00, 0xb12d13eb) // `ETHTransferFailed()`.
                revert(0x1c, 0x04)
            }
            if iszero(call(GAS_STIPEND_NO_GRIEF, to, amount, codesize(), 0x00, codesize(), 0x00)) {
                mstore(0x00, to) // Store the address in scratch space.
                mstore8(0x0b, 0x73) // Opcode `PUSH20`.
                mstore8(0x20, 0xff) // Opcode `SELFDESTRUCT`.
                if iszero(create(amount, 0x0b, 0x16)) { revert(codesize(), codesize()) } // For gas estimation.
            }
        }
    }

    /// @dev Force sends all the ETH in the current contract to `to`, with `GAS_STIPEND_NO_GRIEF`.
    function forceSafeTransferAllETH(address to) internal {
        /// @solidity memory-safe-assembly
        assembly {
            // forgefmt: disable-next-item
            if iszero(call(GAS_STIPEND_NO_GRIEF, to, selfbalance(), codesize(), 0x00, codesize(), 0x00)) {
                mstore(0x00, to) // Store the address in scratch space.
                mstore8(0x0b, 0x73) // Opcode `PUSH20`.
                mstore8(0x20, 0xff) // Opcode `SELFDESTRUCT`.
                if iszero(create(selfbalance(), 0x0b, 0x16)) { revert(codesize(), codesize()) } // For gas estimation.
            }
        }
    }

    /// @dev Sends `amount` (in wei) ETH to `to`, with a `gasStipend`.
    function trySafeTransferETH(address to, uint256 amount, uint256 gasStipend)
        internal
        returns (bool success)
    {
        /// @solidity memory-safe-assembly
        assembly {
            success := call(gasStipend, to, amount, codesize(), 0x00, codesize(), 0x00)
        }
    }

    /// @dev Sends all the ETH in the current contract to `to`, with a `gasStipend`.
    function trySafeTransferAllETH(address to, uint256 gasStipend)
        internal
        returns (bool success)
    {
        /// @solidity memory-safe-assembly
        assembly {
            success := call(gasStipend, to, selfbalance(), codesize(), 0x00, codesize(), 0x00)
        }
    }

    /*´:°•.°+.*•´.*:˚.°*.˚•´.°:°•.°•.*•´.*:˚.°*.˚•´.°:°•.°+.*•´.*:*/
    /*                      ERC20 OPERATIONS                      */
    /*.•°:°.´+˚.*°.˚:*.´•*.+°.•°:´*.´•*.•°.•°:°.´:•˚°.*°.˚:*.´+°.•*/

    /// @dev Sends `amount` of ERC20 `token` from `from` to `to`.
    /// Reverts upon failure.
    ///
    /// The `from` account must have at least `amount` approved for
    /// the current contract to manage.
    function safeTransferFrom(address token, address from, address to, uint256 amount) internal {
        /// @solidity memory-safe-assembly
        assembly {
            let m := mload(0x40) // Cache the free memory pointer.
            mstore(0x60, amount) // Store the `amount` argument.
            mstore(0x40, to) // Store the `to` argument.
            mstore(0x2c, shl(96, from)) // Store the `from` argument.
            mstore(0x0c, 0x23b872dd000000000000000000000000) // `transferFrom(address,address,uint256)`.
            // Perform the transfer, reverting upon failure.
            if iszero(
                and( // The arguments of `and` are evaluated from right to left.
                    or(eq(mload(0x00), 1), iszero(returndatasize())), // Returned 1 or nothing.
                    call(gas(), token, 0, 0x1c, 0x64, 0x00, 0x20)
                )
            ) {
                mstore(0x00, 0x7939f424) // `TransferFromFailed()`.
                revert(0x1c, 0x04)
            }
            mstore(0x60, 0) // Restore the zero slot to zero.
            mstore(0x40, m) // Restore the free memory pointer.
        }
    }

    /// @dev Sends `amount` of ERC20 `token` from `from` to `to`.
    ///
    /// The `from` account must have at least `amount` approved for the current contract to manage.
    function trySafeTransferFrom(address token, address from, address to, uint256 amount)
        internal
        returns (bool success)
    {
        /// @solidity memory-safe-assembly
        assembly {
            let m := mload(0x40) // Cache the free memory pointer.
            mstore(0x60, amount) // Store the `amount` argument.
            mstore(0x40, to) // Store the `to` argument.
            mstore(0x2c, shl(96, from)) // Store the `from` argument.
            mstore(0x0c, 0x23b872dd000000000000000000000000) // `transferFrom(address,address,uint256)`.
            success :=
                and( // The arguments of `and` are evaluated from right to left.
                    or(eq(mload(0x00), 1), iszero(returndatasize())), // Returned 1 or nothing.
                    call(gas(), token, 0, 0x1c, 0x64, 0x00, 0x20)
                )
            mstore(0x60, 0) // Restore the zero slot to zero.
            mstore(0x40, m) // Restore the free memory pointer.
        }
    }

    /// @dev Sends all of ERC20 `token` from `from` to `to`.
    /// Reverts upon failure.
    ///
    /// The `from` account must have their entire balance approved for the current contract to manage.
    function safeTransferAllFrom(address token, address from, address to)
        internal
        returns (uint256 amount)
    {
        /// @solidity memory-safe-assembly
        assembly {
            let m := mload(0x40) // Cache the free memory pointer.
            mstore(0x40, to) // Store the `to` argument.
            mstore(0x2c, shl(96, from)) // Store the `from` argument.
            mstore(0x0c, 0x70a08231000000000000000000000000) // `balanceOf(address)`.
            // Read the balance, reverting upon failure.
            if iszero(
                and( // The arguments of `and` are evaluated from right to left.
                    gt(returndatasize(), 0x1f), // At least 32 bytes returned.
                    staticcall(gas(), token, 0x1c, 0x24, 0x60, 0x20)
                )
            ) {
                mstore(0x00, 0x7939f424) // `TransferFromFailed()`.
                revert(0x1c, 0x04)
            }
            mstore(0x00, 0x23b872dd) // `transferFrom(address,address,uint256)`.
            amount := mload(0x60) // The `amount` is already at 0x60. We'll need to return it.
            // Perform the transfer, reverting upon failure.
            if iszero(
                and( // The arguments of `and` are evaluated from right to left.
                    or(eq(mload(0x00), 1), iszero(returndatasize())), // Returned 1 or nothing.
                    call(gas(), token, 0, 0x1c, 0x64, 0x00, 0x20)
                )
            ) {
                mstore(0x00, 0x7939f424) // `TransferFromFailed()`.
                revert(0x1c, 0x04)
            }
            mstore(0x60, 0) // Restore the zero slot to zero.
            mstore(0x40, m) // Restore the free memory pointer.
        }
    }

    /// @dev Sends `amount` of ERC20 `token` from the current contract to `to`.
    /// Reverts upon failure.
    function safeTransfer(address token, address to, uint256 amount) internal {
        /// @solidity memory-safe-assembly
        assembly {
            mstore(0x14, to) // Store the `to` argument.
            mstore(0x34, amount) // Store the `amount` argument.
            mstore(0x00, 0xa9059cbb000000000000000000000000) // `transfer(address,uint256)`.
            // Perform the transfer, reverting upon failure.
            if iszero(
                and( // The arguments of `and` are evaluated from right to left.
                    or(eq(mload(0x00), 1), iszero(returndatasize())), // Returned 1 or nothing.
                    call(gas(), token, 0, 0x10, 0x44, 0x00, 0x20)
                )
            ) {
                mstore(0x00, 0x90b8ec18) // `TransferFailed()`.
                revert(0x1c, 0x04)
            }
            mstore(0x34, 0) // Restore the part of the free memory pointer that was overwritten.
        }
    }

    /// @dev Sends all of ERC20 `token` from the current contract to `to`.
    /// Reverts upon failure.
    function safeTransferAll(address token, address to) internal returns (uint256 amount) {
        /// @solidity memory-safe-assembly
        assembly {
            mstore(0x00, 0x70a08231) // Store the function selector of `balanceOf(address)`.
            mstore(0x20, address()) // Store the address of the current contract.
            // Read the balance, reverting upon failure.
            if iszero(
                and( // The arguments of `and` are evaluated from right to left.
                    gt(returndatasize(), 0x1f), // At least 32 bytes returned.
                    staticcall(gas(), token, 0x1c, 0x24, 0x34, 0x20)
                )
            ) {
                mstore(0x00, 0x90b8ec18) // `TransferFailed()`.
                revert(0x1c, 0x04)
            }
            mstore(0x14, to) // Store the `to` argument.
            amount := mload(0x34) // The `amount` is already at 0x34. We'll need to return it.
            mstore(0x00, 0xa9059cbb000000000000000000000000) // `transfer(address,uint256)`.
            // Perform the transfer, reverting upon failure.
            if iszero(
                and( // The arguments of `and` are evaluated from right to left.
                    or(eq(mload(0x00), 1), iszero(returndatasize())), // Returned 1 or nothing.
                    call(gas(), token, 0, 0x10, 0x44, 0x00, 0x20)
                )
            ) {
                mstore(0x00, 0x90b8ec18) // `TransferFailed()`.
                revert(0x1c, 0x04)
            }
            mstore(0x34, 0) // Restore the part of the free memory pointer that was overwritten.
        }
    }

    /// @dev Sets `amount` of ERC20 `token` for `to` to manage on behalf of the current contract.
    /// Reverts upon failure.
    function safeApprove(address token, address to, uint256 amount) internal {
        /// @solidity memory-safe-assembly
        assembly {
            mstore(0x14, to) // Store the `to` argument.
            mstore(0x34, amount) // Store the `amount` argument.
            mstore(0x00, 0x095ea7b3000000000000000000000000) // `approve(address,uint256)`.
            // Perform the approval, reverting upon failure.
            if iszero(
                and( // The arguments of `and` are evaluated from right to left.
                    or(eq(mload(0x00), 1), iszero(returndatasize())), // Returned 1 or nothing.
                    call(gas(), token, 0, 0x10, 0x44, 0x00, 0x20)
                )
            ) {
                mstore(0x00, 0x3e3f8f73) // `ApproveFailed()`.
                revert(0x1c, 0x04)
            }
            mstore(0x34, 0) // Restore the part of the free memory pointer that was overwritten.
        }
    }

    /// @dev Sets `amount` of ERC20 `token` for `to` to manage on behalf of the current contract.
    /// If the initial attempt to approve fails, attempts to reset the approved amount to zero,
    /// then retries the approval again (some tokens, e.g. USDT, requires this).
    /// Reverts upon failure.
    function safeApproveWithRetry(address token, address to, uint256 amount) internal {
        /// @solidity memory-safe-assembly
        assembly {
            mstore(0x14, to) // Store the `to` argument.
            mstore(0x34, amount) // Store the `amount` argument.
            mstore(0x00, 0x095ea7b3000000000000000000000000) // `approve(address,uint256)`.
            // Perform the approval, retrying upon failure.
            if iszero(
                and( // The arguments of `and` are evaluated from right to left.
                    or(eq(mload(0x00), 1), iszero(returndatasize())), // Returned 1 or nothing.
                    call(gas(), token, 0, 0x10, 0x44, 0x00, 0x20)
                )
            ) {
                mstore(0x34, 0) // Store 0 for the `amount`.
                mstore(0x00, 0x095ea7b3000000000000000000000000) // `approve(address,uint256)`.
                pop(call(gas(), token, 0, 0x10, 0x44, codesize(), 0x00)) // Reset the approval.
                mstore(0x34, amount) // Store back the original `amount`.
                // Retry the approval, reverting upon failure.
                if iszero(
                    and(
                        or(eq(mload(0x00), 1), iszero(returndatasize())), // Returned 1 or nothing.
                        call(gas(), token, 0, 0x10, 0x44, 0x00, 0x20)
                    )
                ) {
                    mstore(0x00, 0x3e3f8f73) // `ApproveFailed()`.
                    revert(0x1c, 0x04)
                }
            }
            mstore(0x34, 0) // Restore the part of the free memory pointer that was overwritten.
        }
    }

    /// @dev Returns the amount of ERC20 `token` owned by `account`.
    /// Returns zero if the `token` does not exist.
    function balanceOf(address token, address account) internal view returns (uint256 amount) {
        /// @solidity memory-safe-assembly
        assembly {
            mstore(0x14, account) // Store the `account` argument.
            mstore(0x00, 0x70a08231000000000000000000000000) // `balanceOf(address)`.
            amount :=
                mul( // The arguments of `mul` are evaluated from right to left.
                    mload(0x20),
                    and( // The arguments of `and` are evaluated from right to left.
                        gt(returndatasize(), 0x1f), // At least 32 bytes returned.
                        staticcall(gas(), token, 0x10, 0x24, 0x20, 0x20)
                    )
                )
        }
    }

    /// @dev Sends `amount` of ERC20 `token` from `from` to `to`.
    /// If the initial attempt fails, try to use Permit2 to transfer the token.
    /// Reverts upon failure.
    ///
    /// The `from` account must have at least `amount` approved for the current contract to manage.
    function safeTransferFrom2(address token, address from, address to, uint256 amount) internal {
        if (!trySafeTransferFrom(token, from, to, amount)) {
            permit2TransferFrom(token, from, to, amount);
        }
    }

    /// @dev Sends `amount` of ERC20 `token` from `from` to `to` via Permit2.
    /// Reverts upon failure.
    function permit2TransferFrom(address token, address from, address to, uint256 amount)
        internal
    {
        /// @solidity memory-safe-assembly
        assembly {
            let m := mload(0x40)
            mstore(add(m, 0x74), shr(96, shl(96, token)))
            mstore(add(m, 0x54), amount)
            mstore(add(m, 0x34), to)
            mstore(add(m, 0x20), shl(96, from))
            // `transferFrom(address,address,uint160,address)`.
            mstore(m, 0x36c78516000000000000000000000000)
            let p := PERMIT2
            let exists := eq(chainid(), 1)
            if iszero(exists) { exists := iszero(iszero(extcodesize(p))) }
            if iszero(and(call(gas(), p, 0, add(m, 0x10), 0x84, codesize(), 0x00), exists)) {
                mstore(0x00, 0x7939f4248757f0fd) // `TransferFromFailed()` or `Permit2AmountOverflow()`.
                revert(add(0x18, shl(2, iszero(iszero(shr(160, amount))))), 0x04)
            }
        }
    }

    /// @dev Permit a user to spend a given amount of
    /// another user's tokens via native EIP-2612 permit if possible, falling
    /// back to Permit2 if native permit fails or is not implemented on the token.
    function permit2(
        address token,
        address owner,
        address spender,
        uint256 amount,
        uint256 deadline,
        uint8 v,
        bytes32 r,
        bytes32 s
    ) internal {
        bool success;
        /// @solidity memory-safe-assembly
        assembly {
            for {} shl(96, xor(token, WETH9)) {} {
                mstore(0x00, 0x3644e515) // `DOMAIN_SEPARATOR()`.
                if iszero(
                    and( // The arguments of `and` are evaluated from right to left.
                        lt(iszero(mload(0x00)), eq(returndatasize(), 0x20)), // Returns 1 non-zero word.
                        // Gas stipend to limit gas burn for tokens that don't refund gas when
                        // an non-existing function is called. 5K should be enough for a SLOAD.
                        staticcall(5000, token, 0x1c, 0x04, 0x00, 0x20)
                    )
                ) { break }
                // After here, we can be sure that token is a contract.
                let m := mload(0x40)
                mstore(add(m, 0x34), spender)
                mstore(add(m, 0x20), shl(96, owner))
                mstore(add(m, 0x74), deadline)
                if eq(mload(0x00), DAI_DOMAIN_SEPARATOR) {
                    mstore(0x14, owner)
                    mstore(0x00, 0x7ecebe00000000000000000000000000) // `nonces(address)`.
                    mstore(add(m, 0x94), staticcall(gas(), token, 0x10, 0x24, add(m, 0x54), 0x20))
                    mstore(m, 0x8fcbaf0c000000000000000000000000) // `IDAIPermit.permit`.
                    // `nonces` is already at `add(m, 0x54)`.
                    // `1` is already stored at `add(m, 0x94)`.
                    mstore(add(m, 0xb4), and(0xff, v))
                    mstore(add(m, 0xd4), r)
                    mstore(add(m, 0xf4), s)
                    success := call(gas(), token, 0, add(m, 0x10), 0x104, codesize(), 0x00)
                    break
                }
                mstore(m, 0xd505accf000000000000000000000000) // `IERC20Permit.permit`.
                mstore(add(m, 0x54), amount)
                mstore(add(m, 0x94), and(0xff, v))
                mstore(add(m, 0xb4), r)
                mstore(add(m, 0xd4), s)
                success := call(gas(), token, 0, add(m, 0x10), 0xe4, codesize(), 0x00)
                break
            }
        }
        if (!success) simplePermit2(token, owner, spender, amount, deadline, v, r, s);
    }

    /// @dev Simple permit on the Permit2 contract.
    function simplePermit2(
        address token,
        address owner,
        address spender,
        uint256 amount,
        uint256 deadline,
        uint8 v,
        bytes32 r,
        bytes32 s
    ) internal {
        /// @solidity memory-safe-assembly
        assembly {
            let m := mload(0x40)
            mstore(m, 0x927da105) // `allowance(address,address,address)`.
            {
                let addressMask := shr(96, not(0))
                mstore(add(m, 0x20), and(addressMask, owner))
                mstore(add(m, 0x40), and(addressMask, token))
                mstore(add(m, 0x60), and(addressMask, spender))
                mstore(add(m, 0xc0), and(addressMask, spender))
            }
            let p := mul(PERMIT2, iszero(shr(160, amount)))
            if iszero(
                and( // The arguments of `and` are evaluated from right to left.
                    gt(returndatasize(), 0x5f), // Returns 3 words: `amount`, `expiration`, `nonce`.
                    staticcall(gas(), p, add(m, 0x1c), 0x64, add(m, 0x60), 0x60)
                )
            ) {
                mstore(0x00, 0x6b836e6b8757f0fd) // `Permit2Failed()` or `Permit2AmountOverflow()`.
                revert(add(0x18, shl(2, iszero(p))), 0x04)
            }
            mstore(m, 0x2b67b570) // `Permit2.permit` (PermitSingle variant).
            // `owner` is already `add(m, 0x20)`.
            // `token` is already at `add(m, 0x40)`.
            mstore(add(m, 0x60), amount)
            mstore(add(m, 0x80), 0xffffffffffff) // `expiration = type(uint48).max`.
            // `nonce` is already at `add(m, 0xa0)`.
            // `spender` is already at `add(m, 0xc0)`.
            mstore(add(m, 0xe0), deadline)
            mstore(add(m, 0x100), 0x100) // `signature` offset.
            mstore(add(m, 0x120), 0x41) // `signature` length.
            mstore(add(m, 0x140), r)
            mstore(add(m, 0x160), s)
            mstore(add(m, 0x180), shl(248, v))
            if iszero(call(gas(), p, 0, add(m, 0x1c), 0x184, codesize(), 0x00)) {
                mstore(0x00, 0x6b836e6b) // `Permit2Failed()`.
                revert(0x1c, 0x04)
            }
        }
    }
}

// SPDX-License-Identifier: MIT
pragma solidity >=0.8.0;

import { Input } from "./ISettlementContract.sol";

//////////////////
// Order types ///
//////////////////

/**
 * @notice The progressive order status of cross-chain orders:
 * - Unfilled: Default state. Progresses to Claimed.
 * - Claimed: A solver has claimed this order. Progresses to Challenged or OptimiscallyFilled.
 * - Challenged: A claimed order was challenged. Progresses to Fraud or Proven.
 * - Fraud: The solver did not prove delivery & Challenger claiemd the collateral. Final.
 * - OptimiscallyFilled: A claimed order was not challenged. Paid inputs to solver. Final.
 * - Proven: A solver proved settlement. Paid inputs to solver. Final.
 */
enum OrderStatus {
    Unfilled,
    Deposited,
    Claimed,
    Challenged,
    Fraud,
    OptimiscallyFilled,
    Proven
}

/**
 * @notice Storage Slot used for initiated orders.
 * @param status Description of the status. Is OrderStatus Enum.
 * @param fillerAddress Address of the filler (Address that will get the inputs after successful order).
 * @param orderPurchaseDeadline If configured, an initiated order can be purchased until this deadline.
 * @param orderPurchaseDiscount The discount that an order gets by being purchased. Is of type(uint16).max.
 * @param challenger If the order has been challenged, is the address of challenger otherwise address(0).
 * @param identifier A hash used to configure the input payment with extra logic.
 */
struct OrderContext {
    OrderStatus status;
    address fillerAddress;
    uint32 orderPurchaseDeadline;
    uint16 orderPurchaseDiscount;
    address challenger;
    bytes32 identifier;
}

struct OutputDescription {
    /**
     * @dev Contract on the destination that tells whether an order was filled.
     * Format is bytes32() slice of the encoded bytearray from the messaging protocol.
     * If local: bytes32(uint256(uint160(address(localOracle)))).
     */
    bytes32 remoteOracle;
    /**
     * @dev The address of the token on the destination chain.
     */
    bytes32 token;
    /**
     * @dev The amount of the token to be sent.
     */
    uint256 amount;
    /**
     * @dev The address to receive the output tokens.
     */
    bytes32 recipient;
    /**
     * @dev The destination chain for this output.
     */
    uint32 chainId;
    /**
     * @dev Additional data that is relevant for the caller.
     */
    bytes remoteCall;
}

/**
 * @notice This is the simplified order after it has been validated and evaluated.
 * @dev Is used to keep the order context in calldata to save gas.
 * The hash of the orderKey is used to identify orders.
 * - Validated: We check that the signature of the order matches the relevant order.
 * - Evaluated: The order has been evaluated for its respective inputs and outputs
 */
struct OrderKey {
    /**
     * @dev The contract that is managing this order.
     */
    ReactorInfo reactorContext;
    /**
     * @dev Who this order was claimed for.
     */
    address swapper;
    /**
     * @dev Nonce is unused in code but aids to make orderKeyHashes unique between orders.
     * This is because swapper & nonce makes a unique pair. (via permit2)
     */
    uint96 nonce;
    /**
     * @dev Collateral
     */
    Collateral collateral;
    uint32 originChainId;
    /**
     * @dev The oracle that can satisfy a dispute.
     */
    address localOracle;
    /**
     * @dev Inputs for order.
     * Reserved for OrderContext.fillerAddress but still belongs to OrderKey.swapper.
     */
    Input[] inputs;
    /**
     * @dev Expected outputs in exchange for inputs.
     */
    OutputDescription[] outputs;
}

struct ReactorInfo {
    /**
     * @dev The contract that is managing this order.
     */
    address reactor;
    // Order resolution times
    // If fillDeadline == challengeDeadline && challengerCollateralAmount == 0
    // Then the order will be pre-challenged.
    uint32 fillDeadline;
    uint32 challengeDeadline;
    uint32 proofDeadline;
}

struct Collateral {
    address collateralToken;
    uint256 fillerCollateralAmount;
    uint256 challengerCollateralAmount;
}

{
  "compilationTarget": {
    "src/reactors/LimitOrderReactor.sol": "LimitOrderReactor"
  },
  "evmVersion": "paris",
  "libraries": {},
  "metadata": {
    "bytecodeHash": "ipfs"
  },
  "optimizer": {
    "enabled": true,
    "runs": 10000
  },
  "remappings": [
    ":@lazyledger/protobuf3-solidity-lib/=lib/GeneralisedIncentives/lib/vibc-core-smart-contracts/lib/protobuf3-solidity-lib/",
    ":@openzeppelin-upgradeable/=lib/GeneralisedIncentives/lib/vibc-core-smart-contracts/lib/openzeppelin-contracts-upgradeable/",
    ":@openzeppelin/=lib/GeneralisedIncentives/lib/vibc-core-smart-contracts/lib/openzeppelin-contracts/",
    ":GeneralisedIncentives/=lib/GeneralisedIncentives/src/",
    ":base64/=lib/GeneralisedIncentives/lib/vibc-core-smart-contracts/lib/base64/",
    ":bitcoinprism-evm/=lib/bitcoinprism-evm/",
    ":clones-with-immutable-args/=lib/GeneralisedIncentives/lib/vibc-core-smart-contracts/lib/optimism/packages/contracts-bedrock/lib/clones-with-immutable-args/src/",
    ":ds-test/=lib/forge-std/lib/ds-test/src/",
    ":erc4626-tests/=lib/GeneralisedIncentives/lib/openzeppelin-contracts/lib/erc4626-tests/",
    ":forge-gas-snapshot/=lib/permit2/lib/forge-gas-snapshot/src/",
    ":forge-std/=lib/forge-std/src/",
    ":openzeppelin-contracts-upgradeable/=lib/GeneralisedIncentives/lib/vibc-core-smart-contracts/lib/openzeppelin-contracts-upgradeable/",
    ":openzeppelin-contracts/=lib/GeneralisedIncentives/lib/openzeppelin-contracts/",
    ":openzeppelin/=lib/GeneralisedIncentives/lib/openzeppelin-contracts/contracts/",
    ":optimism/=lib/GeneralisedIncentives/lib/vibc-core-smart-contracts/lib/",
    ":permit2/=lib/permit2/",
    ":proto/=lib/GeneralisedIncentives/lib/vibc-core-smart-contracts/lib/proto/",
    ":protobuf3-solidity-lib/=lib/GeneralisedIncentives/lib/vibc-core-smart-contracts/lib/protobuf3-solidity-lib/contracts/",
    ":safe-contracts/=lib/GeneralisedIncentives/lib/vibc-core-smart-contracts/lib/optimism/packages/contracts-bedrock/lib/safe-contracts/contracts/",
    ":solady/=lib/solady/",
    ":solmate/=lib/permit2/lib/solmate/",
    ":vibc-core-smart-contracts/=lib/GeneralisedIncentives/lib/vibc-core-smart-contracts/"
  ],
  "viaIR": true
}