lib.rs

//! Withdrawal Handler — create, execute, and cancel LP token withdrawals.
//!
//! Mirrors GMX's WithdrawalHandler.sol + ExecuteWithdrawalUtils.sol:
//!
//! Flow:
//!   1. User approves LP tokens to withdrawal_handler.
//!   2. User calls `create_withdrawal` → LP tokens pulled to withdrawal_vault.
//!   3. Keeper sets oracle prices, then calls `execute_withdrawal`:
//!      - Splits the withdrawal by the pool's current USD-value weight between
//!        long/short (issue #255), using prices fresh for this ledger.
//!      - Burns LP tokens from vault.
//!      - Transfers pool tokens from market_token contract → receiver.
//!      - Updates pool amounts.
//!   4. On cancel: LP tokens refunded from vault.
#![no_std]
#![allow(dependency_on_unit_never_type_fallback)]

use gmx_keys::{
    account_withdrawal_list_key, is_market_paused_key, market_index_token_key,
    market_long_token_key, market_short_token_key, roles, withdrawal_key, withdrawal_list_key,
};
use gmx_market_utils::{apply_delta_to_pool_amount, get_pool_amount};
use gmx_math::{mul_div_wide, TOKEN_PRECISION};
pub use gmx_types::CreateWithdrawalParams;
use gmx_types::{MarketProps, WithdrawalProps};
use soroban_sdk::{
    contract, contracterror, contractimpl, contracttype, panic_with_error, symbol_short, token,
    Address, BytesN, Env,
};

// ─── Errors ───────────────────────────────────────────────────────────────────

#[contracterror]
#[derive(Copy, Clone, Debug, Eq, PartialEq, PartialOrd, Ord)]
#[repr(u32)]
pub enum Error {
    AlreadyInitialized = 1,
    NotInitialized = 2,
    Unauthorized = 3,
    WithdrawalNotFound = 4,
    InsufficientLongOut = 5,
    InsufficientShortOut = 6,
    ZeroWithdrawal = 7,
    InvalidMarket = 8,
    InvalidReceiver = 9,
    /// Issue #370: execution_fee is below the configured global minimum.
    InsufficientExecutionFee = 10,
    /// Issue #366: market is paused due to oracle circuit breaker.
    MarketPaused = 11,
}

// ─── Storage ──────────────────────────────────────────────────────────────────

#[contracttype]
enum InstanceKey {
    Initialized,
    Admin,
    RoleStore,
    DataStore,
    Oracle,
    WithdrawalVault,
}

#[contracttype]
enum LocalKey {
    Withdrawal(BytesN<32>),
}
// WithdrawalProps are stored in this contract's own persistent storage (not DataStore)
// because DataStore supports only primitive/set types, not arbitrary structs.
// DataStore holds only the index sets (withdrawal_list_key, account_withdrawal_list_key)
// for enumeration. This matches the deposit and order handler patterns (issue #24).

// ─── Cross-contract clients ───────────────────────────────────────────────────

#[allow(dead_code)]
#[soroban_sdk::contractclient(name = "RoleStoreClient")]
trait IRoleStore {
    fn has_role(env: Env, account: Address, role: BytesN<32>) -> bool;
}

#[allow(dead_code)]
#[soroban_sdk::contractclient(name = "DataStoreClient")]
trait IDataStore {
    fn get_bool(env: Env, key: BytesN<32>) -> bool;
    fn get_u128(env: Env, key: BytesN<32>) -> u128;
    fn set_u128(env: Env, caller: Address, key: BytesN<32>, value: u128) -> u128;
    fn get_i128(env: Env, key: BytesN<32>) -> i128;
    fn set_i128(env: Env, caller: Address, key: BytesN<32>, value: i128) -> i128;
    fn apply_delta_to_u128(env: Env, caller: Address, key: BytesN<32>, delta: i128) -> u128;
    fn apply_delta_to_i128(env: Env, caller: Address, key: BytesN<32>, delta: i128) -> i128;
    fn get_address(env: Env, key: BytesN<32>) -> Option<Address>;
    fn add_bytes32_to_set(env: Env, caller: Address, set_key: BytesN<32>, value: BytesN<32>);
    fn remove_bytes32_from_set(env: Env, caller: Address, set_key: BytesN<32>, value: BytesN<32>);
    fn contains_bytes32(env: Env, set_key: BytesN<32>, value: BytesN<32>) -> bool;
    fn increment_nonce(env: Env, caller: Address) -> u64;
    fn get_min_execution_fee(env: Env) -> u128;
}

#[allow(dead_code)]
#[soroban_sdk::contractclient(name = "OracleClient")]
trait IOracle {
    fn get_primary_price(env: Env, token: Address) -> gmx_types::PriceProps;
    fn require_price_fresh(env: Env, token: Address, expected_ledger_seq: u32) -> gmx_types::PriceProps;
}

#[allow(dead_code)]
#[soroban_sdk::contractclient(name = "WithdrawalVaultClient")]
trait IWithdrawalVault {
    fn transfer_out(env: Env, caller: Address, token: Address, receiver: Address, amount: i128);
}

#[allow(dead_code)]
#[soroban_sdk::contractclient(name = "MarketTokenClient")]
trait IMarketToken {
    fn burn(env: Env, from: Address, amount: i128);
    fn total_supply(env: Env) -> i128;
    fn withdraw_from_pool(
        env: Env,
        caller: Address,
        pool_token: Address,
        receiver: Address,
        amount: i128,
    );
}

// ─── Contract ─────────────────────────────────────────────────────────────────

#[contract]
pub struct WithdrawalHandler;

#[contractimpl]
impl WithdrawalHandler {
    // ── Init ─────────────────────────────────────────────────────────────────

    pub fn initialize(
        env: Env,
        admin: Address,
        role_store: Address,
        data_store: Address,
        oracle: Address,
        withdrawal_vault: Address,
    ) {
        admin.require_auth();
        if env.storage().instance().has(&InstanceKey::Initialized) {
            panic_with_error!(&env, Error::AlreadyInitialized);
        }
        env.storage()
            .instance()
            .set(&InstanceKey::Initialized, &true);
        env.storage().instance().set(&InstanceKey::Admin, &admin);
        env.storage()
            .instance()
            .set(&InstanceKey::RoleStore, &role_store);
        env.storage()
            .instance()
            .set(&InstanceKey::DataStore, &data_store);
        env.storage().instance().set(&InstanceKey::Oracle, &oracle);
        env.storage()
            .instance()
            .set(&InstanceKey::WithdrawalVault, &withdrawal_vault);
    }

    pub fn upgrade(env: Env, new_wasm_hash: BytesN<32>) {
        let admin: Address = env
            .storage()
            .instance()
            .get(&InstanceKey::Admin)
            .unwrap_or_else(|| panic_with_error!(&env, Error::NotInitialized));
        admin.require_auth();
        env.deployer().update_current_contract_wasm(new_wasm_hash);
    }

    pub fn update_oracle(env: Env, caller: Address, new_oracle: Address) {
        caller.require_auth();
        let admin: Address = env
            .storage()
            .instance()
            .get(&InstanceKey::Admin)
            .unwrap_or_else(|| panic_with_error!(&env, Error::NotInitialized));
        if caller != admin {
            panic_with_error!(&env, Error::Unauthorized);
        }
        env.storage().instance().set(&InstanceKey::Oracle, &new_oracle);
    }

    // ── Create withdrawal ─────────────────────────────────────────────────────

    /// Pull LP tokens from caller into the withdrawal_vault and record the withdrawal.
    pub fn create_withdrawal(
        env: Env,
        caller: Address,
        params: CreateWithdrawalParams,
    ) -> BytesN<32> {
        caller.require_auth();

        // ── Input validation (issue #39) ──────────────────────────────────────
        if params.market_token_amount <= 0 {
            panic_with_error!(&env, Error::ZeroWithdrawal);
        }
        // Receiver must not be the zero/contract address — use the contract itself
        // as a sentinel: a real receiver must differ from the handler.
        if params.receiver == env.current_contract_address() {
            panic_with_error!(&env, Error::InvalidReceiver);
        }

        let data_store: Address = env
            .storage()
            .instance()
            .get(&InstanceKey::DataStore)
            .unwrap_or_else(|| panic_with_error!(&env, Error::NotInitialized));
        let withdrawal_vault: Address = env
            .storage()
            .instance()
            .get(&InstanceKey::WithdrawalVault)
            .unwrap_or_else(|| panic_with_error!(&env, Error::NotInitialized));
        let handler = env.current_contract_address();
        let ds = DataStoreClient::new(&env, &data_store);

        // Validate that the market token is a known market (index token must exist)
        if ds
            .get_address(&gmx_keys::market_index_token_key(&env, &params.market))
            .is_none()
        {
            panic_with_error!(&env, Error::InvalidMarket);
        }

        // Issue #366: reject withdrawals when the market is paused (oracle circuit breaker)
        if ds.get_bool(&is_market_paused_key(&env, &params.market)) {
            panic_with_error!(&env, Error::MarketPaused);
        }

        // Issue #370: validate execution_fee against the global minimum before
        // any tokens move. execution_fee is collected in the market (LP) token; 0
        // means no fee required.
        let exec_fee = params.execution_fee;
        if exec_fee < 0 {
            panic_with_error!(&env, Error::InsufficientExecutionFee);
        }
        let min_fee = ds.get_min_execution_fee();
        if min_fee > 0 && (exec_fee as u128) < min_fee {
            panic_with_error!(&env, Error::InsufficientExecutionFee);
        }

        // Pull LP tokens from caller → withdrawal_vault
        let market_addr = params.market.clone();
        token::Client::new(&env, &params.market).transfer(
            &caller,
            &withdrawal_vault,
            &params.market_token_amount,
        );

        // Issue #370: collect execution_fee in the market (LP) token.
        if exec_fee > 0 {
            token::Client::new(&env, &params.market).transfer(
                &caller,
                &withdrawal_vault,
                &exec_fee,
            );
        }

        // Allocate withdrawal key from nonce
        let nonce = ds.increment_nonce(&handler);
        let key = withdrawal_key(&env, nonce);

        let withdrawal = WithdrawalProps {
            account: caller.clone(),
            receiver: params.receiver,
            market: params.market,
            market_token_amount: params.market_token_amount,
            min_long_token_amount: params.min_long_token_amount,
            min_short_token_amount: params.min_short_token_amount,
            execution_fee: params.execution_fee,
            updated_at_time: env.ledger().timestamp(),
        };
        env.storage()
            .persistent()
            .set(&LocalKey::Withdrawal(key.clone()), &withdrawal);

        ds.add_bytes32_to_set(&handler, &withdrawal_list_key(&env), &key);
        ds.add_bytes32_to_set(&handler, &account_withdrawal_list_key(&env, &caller), &key);

        // Issue #442: include the market-token amount being redeemed so pending
        // withdrawals can be displayed from the creation event without an extra
        // RPC round-trip.
        env.events().publish(
            (symbol_short!("wth_crt"),),
            (key.clone(), caller, market_addr, withdrawal.market_token_amount),
        );
        key
    }

    // ── Execute withdrawal ────────────────────────────────────────────────────

    /// Keeper executes a pending withdrawal: burns LP tokens, returns pool tokens.
    pub fn execute_withdrawal(env: Env, keeper: Address, key: BytesN<32>) {
        keeper.require_auth();
        require_order_keeper(&env, &keeper);

        let data_store: Address = env
            .storage()
            .instance()
            .get(&InstanceKey::DataStore)
            .unwrap_or_else(|| panic_with_error!(&env, Error::NotInitialized));
        let withdrawal_vault: Address = env
            .storage()
            .instance()
            .get(&InstanceKey::WithdrawalVault)
            .unwrap_or_else(|| panic_with_error!(&env, Error::NotInitialized));
        let oracle: Address = env
            .storage()
            .instance()
            .get(&InstanceKey::Oracle)
            .unwrap_or_else(|| panic_with_error!(&env, Error::NotInitialized));
        let handler = env.current_contract_address();

        let withdrawal: WithdrawalProps = env
            .storage()
            .persistent()
            .get(&LocalKey::Withdrawal(key.clone()))
            .unwrap_or_else(|| panic_with_error!(&env, Error::WithdrawalNotFound));

        let market = load_market_props(&env, &data_store, &withdrawal.market);

        // Issue #366: reject execution when the market is paused (oracle circuit breaker)
        let ds = DataStoreClient::new(&env, &data_store);
        if ds.get_bool(&is_market_paused_key(&env, &withdrawal.market)) {
            panic_with_error!(&env, Error::MarketPaused);
        }

        let mt_client = MarketTokenClient::new(&env, &market.market_token);
        let total_supply = mt_client.total_supply();
        let lp_amount = withdrawal.market_token_amount;

        // Issue #255: split the withdrawal by the pool's CURRENT USD-value weight
        // between long/short, not a fixed 50/50 or amount-only split. Prices must
        // be fresh for this ledger (mirrors deposit_handler's #253 fix) so the
        // weight reflects the keeper's just-submitted price.
        let oracle_client = OracleClient::new(&env, &oracle);
        let current_seq = env.ledger().sequence();
        let long_price = oracle_client
            .require_price_fresh(&market.long_token, &current_seq)
            .mid_price();
        let short_price = oracle_client
            .require_price_fresh(&market.short_token, &current_seq)
            .mid_price();

        let long_pool = get_pool_amount(&env, &data_store, &market, &market.long_token) as i128;
        let short_pool = get_pool_amount(&env, &data_store, &market, &market.short_token) as i128;
        let long_pool_usd = mul_div_wide(&env, long_pool, long_price, TOKEN_PRECISION);
        let short_pool_usd = mul_div_wide(&env, short_pool, short_price, TOKEN_PRECISION);
        let total_pool_usd = long_pool_usd + short_pool_usd;

        let (long_out, short_out) = if total_pool_usd == 0 {
            (0, 0)
        } else {
            // USD value of the LP tokens being burned, at the pool's current total value.
            let withdrawal_value_usd = mul_div_wide(&env, total_pool_usd, lp_amount, total_supply);

            // Split by each side's USD weight (long_pool_usd / total_pool_usd), as a
            // single fused division rather than normalizing the weight to a separate
            // FLOAT_PRECISION fraction first and re-applying it: chaining two roundings
            // can leave 1-unit dust behind even on a full (100%) withdrawal, where this
            // fused form is exact.
            let long_out_usd = mul_div_wide(&env, withdrawal_value_usd, long_pool_usd, total_pool_usd);
            let short_out_usd = mul_div_wide(&env, withdrawal_value_usd, short_pool_usd, total_pool_usd);

            let long_out = if long_price > 0 {
                mul_div_wide(&env, long_out_usd, TOKEN_PRECISION, long_price)
            } else {
                0
            };
            let short_out = if short_price > 0 {
                mul_div_wide(&env, short_out_usd, TOKEN_PRECISION, short_price)
            } else {
                0
            };
            (long_out, short_out)
        };

        // Slippage guard checked AFTER the weight-adjusted amounts are computed.
        if long_out < withdrawal.min_long_token_amount {
            panic_with_error!(&env, Error::InsufficientLongOut);
        }
        if short_out < withdrawal.min_short_token_amount {
            panic_with_error!(&env, Error::InsufficientShortOut);
        }

        // Burn LP tokens from vault
        WithdrawalVaultClient::new(&env, &withdrawal_vault).transfer_out(
            &handler,
            &market.market_token,
            &handler,
            &lp_amount,
        );
        mt_client.burn(&handler, &lp_amount);

        // CEI fix (#295): delete the withdrawal record before any pool transfer so that
        // a re-entrant callback on the receiving contract cannot replay this execution.
        remove_withdrawal(&env, &data_store, &handler, &key, &withdrawal.account);

        // Transfer pool tokens from market_token contract → receiver
        if long_out > 0 {
            apply_delta_to_pool_amount(
                &env,
                &data_store,
                &handler,
                &market,
                &market.long_token,
                -long_out,
            );
            mt_client.withdraw_from_pool(
                &handler,
                &market.long_token,
                &withdrawal.receiver,
                &long_out,
            );
        }
        if short_out > 0 {
            apply_delta_to_pool_amount(
                &env,
                &data_store,
                &handler,
                &market,
                &market.short_token,
                -short_out,
            );
            mt_client.withdraw_from_pool(
                &handler,
                &market.short_token,
                &withdrawal.receiver,
                &short_out,
            );
        }

        env.events().publish(
            (symbol_short!("wth_exe"),),
            (key, withdrawal.receiver, long_out, short_out),
        );
    }

    // ── Cancel withdrawal ─────────────────────────────────────────────────────

    pub fn cancel_withdrawal(env: Env, caller: Address, key: BytesN<32>) {
        caller.require_auth();

        let data_store: Address = env
            .storage()
            .instance()
            .get(&InstanceKey::DataStore)
            .unwrap_or_else(|| panic_with_error!(&env, Error::NotInitialized));
        let withdrawal_vault: Address = env
            .storage()
            .instance()
            .get(&InstanceKey::WithdrawalVault)
            .unwrap_or_else(|| panic_with_error!(&env, Error::NotInitialized));
        let role_store: Address = env
            .storage()
            .instance()
            .get(&InstanceKey::RoleStore)
            .unwrap_or_else(|| panic_with_error!(&env, Error::NotInitialized));
        let handler = env.current_contract_address();

        let withdrawal: WithdrawalProps = env
            .storage()
            .persistent()
            .get(&LocalKey::Withdrawal(key.clone()))
            .unwrap_or_else(|| panic_with_error!(&env, Error::WithdrawalNotFound));

        let is_keeper =
            RoleStoreClient::new(&env, &role_store).has_role(&caller, &roles::order_keeper(&env));
        if caller != withdrawal.account && !is_keeper {
            panic_with_error!(&env, Error::Unauthorized);
        }

        // Refund LP tokens
        WithdrawalVaultClient::new(&env, &withdrawal_vault).transfer_out(
            &handler,
            &withdrawal.market,
            &withdrawal.account,
            &withdrawal.market_token_amount,
        );

        // Issue #370: refund execution_fee to the user on cancellation.
        // The keeper earns execution_fee only when it actually attempts execution;
        // a cancelled withdrawal did no keeper work, so the full fee is refunded.
        if withdrawal.execution_fee > 0 {
            WithdrawalVaultClient::new(&env, &withdrawal_vault).transfer_out(
                &handler,
                &withdrawal.market,
                &withdrawal.account,
                &withdrawal.execution_fee,
            );
        }

        remove_withdrawal(&env, &data_store, &handler, &key, &withdrawal.account);

        env.events()
            .publish((symbol_short!("wth_can"),), (key, withdrawal.account));
    }

    // ── Views ─────────────────────────────────────────────────────────────────

    pub fn get_withdrawal(env: Env, key: BytesN<32>) -> Option<WithdrawalProps> {
        env.storage().persistent().get(&LocalKey::Withdrawal(key))
    }
}

// ─── Helpers ──────────────────────────────────────────────────────────────────

fn require_order_keeper(env: &Env, caller: &Address) {
    let role_store: Address = env
        .storage()
        .instance()
        .get(&InstanceKey::RoleStore)
        .unwrap_or_else(|| panic_with_error!(env, Error::NotInitialized));
    if !RoleStoreClient::new(env, &role_store).has_role(caller, &roles::order_keeper(env)) {
        panic_with_error!(env, Error::Unauthorized);
    }
}

fn load_market_props(env: &Env, data_store: &Address, market_token: &Address) -> MarketProps {
    let ds = DataStoreClient::new(env, data_store);
    MarketProps {
        market_token: market_token.clone(),
        index_token: ds
            .get_address(&market_index_token_key(env, market_token))
            .unwrap_or_else(|| panic_with_error!(env, Error::InvalidMarket)),
        long_token: ds
            .get_address(&market_long_token_key(env, market_token))
            .unwrap_or_else(|| panic_with_error!(env, Error::InvalidMarket)),
        short_token: ds
            .get_address(&market_short_token_key(env, market_token))
            .unwrap_or_else(|| panic_with_error!(env, Error::InvalidMarket)),
    }
}

fn remove_withdrawal(
    env: &Env,
    data_store: &Address,
    handler: &Address,
    key: &BytesN<32>,
    account: &Address,
) {
    env.storage()
        .persistent()
        .remove(&LocalKey::Withdrawal(key.clone()));
    let ds = DataStoreClient::new(env, data_store);
    ds.remove_bytes32_from_set(handler, &withdrawal_list_key(env), key);
    ds.remove_bytes32_from_set(handler, &account_withdrawal_list_key(env, account), key);
}

// ─── Tests ────────────────────────────────────────────────────────────────────

#[cfg(test)]
mod tests {
    use super::*;
    use data_store::{DataStore, DataStoreClient as DsClient};
    use deposit_handler::{CreateDepositParams, DepositHandler, DepositHandlerClient};
    use deposit_vault::{DepositVault, DepositVaultClient as DVClient};
    use gmx_keys::roles;
    use gmx_types::TokenPrice;
    use market_token::{MarketToken, MarketTokenClient as MtClient};
    use oracle::{Oracle, OracleClient as OClient};
    use role_store::{RoleStore, RoleStoreClient as RsClient};
    use soroban_sdk::{
        testutils::{Address as _, Ledger as _},
        token::StellarAssetClient,
        Env, Vec,
    };
    use withdrawal_vault::{WithdrawalVault, WithdrawalVaultClient as WVClient};

    struct World {
        env: Env,
        admin: Address,
        keeper: Address,
        rs: Address,
        ds: Address,
        oracle: Address,
        dep_vault: Address,
        wth_vault: Address,
        dep_handler: Address,
        wth_handler: Address,
        market_tk: Address,
        long_tk: Address,
        short_tk: Address,
        index_tk: Address,
    }

    fn setup() -> World {
        let env = Env::default();
        env.mock_all_auths();

        let admin = Address::generate(&env);
        let keeper = Address::generate(&env);

        let rs = env.register(RoleStore, ());
        RsClient::new(&env, &rs).initialize(&admin);
        let rs_c = RsClient::new(&env, &rs);
        rs_c.grant_role(&admin, &admin, &roles::controller(&env));
        rs_c.grant_role(&admin, &keeper, &roles::order_keeper(&env));

        let ds = env.register(DataStore, ());
        DsClient::new(&env, &ds).initialize(&admin, &rs);

        let oracle_addr = env.register(Oracle, ());
        let passphrase = soroban_sdk::Bytes::from_slice(&env, b"Test SDF Network ; September 2015");
        OClient::new(&env, &oracle_addr).initialize(&admin, &rs, &ds, &passphrase);

        let dep_vault = env.register(DepositVault, ());
        DVClient::new(&env, &dep_vault).initialize(&admin, &rs);

        let wth_vault = env.register(WithdrawalVault, ());
        WVClient::new(&env, &wth_vault).initialize(&admin, &rs);

        let market_tk = env.register(MarketToken, ());
        MtClient::new(&env, &market_tk).initialize(
            &admin,
            &rs,
            &7u32,
            &soroban_sdk::String::from_str(&env, "GMX Market Token"),
            &soroban_sdk::String::from_str(&env, "GM"),
        );

        let dep_handler = env.register(DepositHandler, ());
        DepositHandlerClient::new(&env, &dep_handler).initialize(
            &admin,
            &rs,
            &ds,
            &oracle_addr,
            &dep_vault,
        );

        let wth_handler = env.register(WithdrawalHandler, ());
        WithdrawalHandlerClient::new(&env, &wth_handler).initialize(
            &admin,
            &rs,
            &ds,
            &oracle_addr,
            &wth_vault,
        );

        rs_c.grant_role(&admin, &dep_handler, &roles::controller(&env));
        rs_c.grant_role(&admin, &wth_handler, &roles::controller(&env));

        let long_tk = env
            .register_stellar_asset_contract_v2(admin.clone())
            .address();
        let short_tk = env
            .register_stellar_asset_contract_v2(admin.clone())
            .address();
        let index_tk = Address::generate(&env);

        let ds_c = DsClient::new(&env, &ds);
        ds_c.set_address(
            &dep_handler,
            &gmx_keys::market_index_token_key(&env, &market_tk),
            &index_tk,
        );
        ds_c.set_address(
            &dep_handler,
            &gmx_keys::market_long_token_key(&env, &market_tk),
            &long_tk,
        );
        ds_c.set_address(
            &dep_handler,
            &gmx_keys::market_short_token_key(&env, &market_tk),
            &short_tk,
        );

        World {
            env,
            admin,
            keeper,
            rs,
            ds,
            oracle: oracle_addr,
            dep_vault,
            wth_vault,
            dep_handler,
            wth_handler,
            market_tk,
            long_tk,
            short_tk,
            index_tk,
        }
    }

    fn set_prices(w: &World) {
        let fp = gmx_math::FLOAT_PRECISION;
        OClient::new(&w.env, &w.oracle).set_prices_simple(
            &w.keeper,
            &Vec::from_array(
                &w.env,
                [
                    TokenPrice {
                        token: w.long_tk.clone(),
                        min: 2000 * fp,
                        max: 2000 * fp,
                    },
                    TokenPrice {
                        token: w.short_tk.clone(),
                        min: fp,
                        max: fp,
                    },
                    TokenPrice {
                        token: w.index_tk.clone(),
                        min: 2000 * fp,
                        max: 2000 * fp,
                    },
                ],
            ),
        );
    }

    /// Helper: deposit long+short tokens and return the minted LP balance.
    fn do_deposit(w: &World, user: &Address, long_amount: i128, short_amount: i128) -> i128 {
        let dep_key = DepositHandlerClient::new(&w.env, &w.dep_handler).create_deposit(
            user,
            &CreateDepositParams {
                receiver: user.clone(),
                market: w.market_tk.clone(),
                initial_long_token: w.long_tk.clone(),
                initial_short_token: w.short_tk.clone(),
                long_token_amount: long_amount,
                short_token_amount: short_amount,
                min_market_tokens: 1,
                execution_fee: 0,
            },
        );
        DepositHandlerClient::new(&w.env, &w.dep_handler).execute_deposit(&w.keeper, &dep_key);
        MtClient::new(&w.env, &w.market_tk).balance(user)
    }

    // ── Issue #39: withdrawal input validation ────────────────────────────────

    /// Zero LP amount must revert before any token movement.
    #[test]
    #[should_panic]
    fn create_withdrawal_zero_lp_amount_reverts() {
        let w = setup();
        let user = Address::generate(&w.env);
        WithdrawalHandlerClient::new(&w.env, &w.wth_handler).create_withdrawal(
            &user,
            &CreateWithdrawalParams {
                receiver: user.clone(),
                market: w.market_tk.clone(),
                market_token_amount: 0,
                min_long_token_amount: 0,
                min_short_token_amount: 0,
                execution_fee: 0,
            },
        );
    }

    /// Unknown market (not registered in data_store) must revert.
    #[test]
    #[should_panic]
    fn create_withdrawal_unknown_market_reverts() {
        let w = setup();
        let user = Address::generate(&w.env);
        let fake_market = Address::generate(&w.env);
        WithdrawalHandlerClient::new(&w.env, &w.wth_handler).create_withdrawal(
            &user,
            &CreateWithdrawalParams {
                receiver: user.clone(),
                market: fake_market,
                market_token_amount: 1_000,
                min_long_token_amount: 0,
                min_short_token_amount: 0,
                execution_fee: 0,
            },
        );
    }

    /// Receiver set to the handler contract itself must revert.
    #[test]
    #[should_panic]
    fn create_withdrawal_invalid_receiver_reverts() {
        let w = setup();
        let user = Address::generate(&w.env);
        // Use the handler address as receiver — should be rejected
        let bad_receiver = w.wth_handler.clone();
        WithdrawalHandlerClient::new(&w.env, &w.wth_handler).create_withdrawal(
            &user,
            &CreateWithdrawalParams {
                receiver: bad_receiver,
                market: w.market_tk.clone(),
                market_token_amount: 1_000,
                min_long_token_amount: 0,
                min_short_token_amount: 0,
                execution_fee: 0,
            },
        );
    }

    // ── Issue #41: min output enforcement ────────────────────────────────────

    /// Withdrawal where long output falls below min_long_token_amount must revert
    /// and leave state unchanged (no tokens moved, no LP burned).
    #[test]
    #[should_panic]
    fn execute_withdrawal_below_min_long_reverts() {
        let w = setup();
        let env = &w.env;
        let user = Address::generate(env);

        StellarAssetClient::new(env, &w.long_tk).mint(&user, &1_000_0000i128);
        set_prices(&w);
        let lp = do_deposit(&w, &user, 1_000_0000, 0);

        set_prices(&w);
        let wth_key = WithdrawalHandlerClient::new(env, &w.wth_handler).create_withdrawal(
            &user,
            &CreateWithdrawalParams {
                receiver: user.clone(),
                market: w.market_tk.clone(),
                market_token_amount: lp,
                // demand more long tokens than the pool can provide
                min_long_token_amount: i128::MAX,
                min_short_token_amount: 0,
                execution_fee: 0,
            },
        );
        WithdrawalHandlerClient::new(env, &w.wth_handler).execute_withdrawal(&w.keeper, &wth_key);
    }

    /// Withdrawal where short output falls below min_short_token_amount must revert.
    #[test]
    #[should_panic]
    fn execute_withdrawal_below_min_short_reverts() {
        let w = setup();
        let env = &w.env;
        let user = Address::generate(env);

        StellarAssetClient::new(env, &w.short_tk).mint(&user, &500_0000i128);
        set_prices(&w);
        let lp = do_deposit(&w, &user, 0, 500_0000);

        set_prices(&w);
        let wth_key = WithdrawalHandlerClient::new(env, &w.wth_handler).create_withdrawal(
            &user,
            &CreateWithdrawalParams {
                receiver: user.clone(),
                market: w.market_tk.clone(),
                market_token_amount: lp,
                min_long_token_amount: 0,
                // demand more short tokens than the pool can provide
                min_short_token_amount: i128::MAX,
                execution_fee: 0,
            },
        );
        WithdrawalHandlerClient::new(env, &w.wth_handler).execute_withdrawal(&w.keeper, &wth_key);
    }

    /// Partial pool state: only long tokens in pool, short pool is empty.
    /// min_short_token_amount = 0 should succeed; min_short > 0 should revert.
    #[test]
    #[should_panic]
    fn execute_withdrawal_partial_pool_short_empty_reverts_when_min_short_nonzero() {
        let w = setup();
        let env = &w.env;
        let user = Address::generate(env);

        // Deposit only long tokens → short pool stays empty
        StellarAssetClient::new(env, &w.long_tk).mint(&user, &1_000_0000i128);
        set_prices(&w);
        let lp = do_deposit(&w, &user, 1_000_0000, 0);

        set_prices(&w);
        let wth_key = WithdrawalHandlerClient::new(env, &w.wth_handler).create_withdrawal(
            &user,
            &CreateWithdrawalParams {
                receiver: user.clone(),
                market: w.market_tk.clone(),
                market_token_amount: lp,
                min_long_token_amount: 0,
                min_short_token_amount: 1, // short pool is empty → must revert
                execution_fee: 0,
            },
        );
        WithdrawalHandlerClient::new(env, &w.wth_handler).execute_withdrawal(&w.keeper, &wth_key);
    }

    /// Partial pool state: only long tokens, min_short = 0 → succeeds.
    #[test]
    fn execute_withdrawal_partial_pool_long_only_succeeds() {
        let w = setup();
        let env = &w.env;
        let user = Address::generate(env);

        StellarAssetClient::new(env, &w.long_tk).mint(&user, &1_000_0000i128);
        set_prices(&w);
        let lp = do_deposit(&w, &user, 1_000_0000, 0);

        set_prices(&w);
        let wth_key = WithdrawalHandlerClient::new(env, &w.wth_handler).create_withdrawal(
            &user,
            &CreateWithdrawalParams {
                receiver: user.clone(),
                market: w.market_tk.clone(),
                market_token_amount: lp,
                min_long_token_amount: 0,
                min_short_token_amount: 0,
                execution_fee: 0,
            },
        );
        WithdrawalHandlerClient::new(env, &w.wth_handler).execute_withdrawal(&w.keeper, &wth_key);

        let long_back = StellarAssetClient::new(env, &w.long_tk).balance(&user);
        assert!(long_back > 0, "should receive long tokens back");
        assert_eq!(MtClient::new(env, &w.market_tk).balance(&user), 0);
    }

    // ── Issue #32: storage cleanup ────────────────────────────────────────────

    /// After cancel_withdrawal, the record must be gone from local storage AND
    /// from both the global and per-account withdrawal lists in data_store.
    #[test]
    fn cancel_withdrawal_cleans_up_storage_and_lists() {
        let w = setup();
        let env = &w.env;
        let user = Address::generate(env);

        StellarAssetClient::new(env, &w.long_tk).mint(&user, &1_000_0000i128);
        set_prices(&w);
        let lp = do_deposit(&w, &user, 1_000_0000, 0);
        assert!(lp > 0);

        let wth_key = WithdrawalHandlerClient::new(env, &w.wth_handler).create_withdrawal(
            &user,
            &CreateWithdrawalParams {
                receiver: user.clone(),
                market: w.market_tk.clone(),
                market_token_amount: lp,
                min_long_token_amount: 0,
                min_short_token_amount: 0,
                execution_fee: 0,
            },
        );

        let ds_c = DsClient::new(env, &w.ds);
        assert!(WithdrawalHandlerClient::new(env, &w.wth_handler)
            .get_withdrawal(&wth_key)
            .is_some());
        assert!(ds_c.contains_bytes32(&gmx_keys::withdrawal_list_key(env), &wth_key));
        assert!(ds_c.contains_bytes32(&gmx_keys::account_withdrawal_list_key(env, &user), &wth_key));

        WithdrawalHandlerClient::new(env, &w.wth_handler).cancel_withdrawal(&user, &wth_key);

        assert!(
            WithdrawalHandlerClient::new(env, &w.wth_handler)
                .get_withdrawal(&wth_key)
                .is_none(),
            "record must be removed after cancel"
        );
        assert!(
            !ds_c.contains_bytes32(&gmx_keys::withdrawal_list_key(env), &wth_key),
            "global withdrawal list must not contain key after cancel"
        );
        assert!(
            !ds_c.contains_bytes32(&gmx_keys::account_withdrawal_list_key(env, &user), &wth_key),
            "account withdrawal list must not contain key after cancel"
        );
    }

    /// After execute_withdrawal, the record must be gone from local storage AND
    /// from both the global and per-account withdrawal lists in data_store.
    #[test]
    fn execute_withdrawal_cleans_up_storage_and_lists() {
        let w = setup();
        let env = &w.env;
        let user = Address::generate(env);

        StellarAssetClient::new(env, &w.long_tk).mint(&user, &1_000_0000i128);
        set_prices(&w);
        let lp = do_deposit(&w, &user, 1_000_0000, 0);
        assert!(lp > 0);

        set_prices(&w);
        let wth_key = WithdrawalHandlerClient::new(env, &w.wth_handler).create_withdrawal(
            &user,
            &CreateWithdrawalParams {
                receiver: user.clone(),
                market: w.market_tk.clone(),
                market_token_amount: lp,
                min_long_token_amount: 0,
                min_short_token_amount: 0,
                execution_fee: 0,
            },
        );

        let ds_c = DsClient::new(env, &w.ds);
        assert!(WithdrawalHandlerClient::new(env, &w.wth_handler)
            .get_withdrawal(&wth_key)
            .is_some());
        assert!(ds_c.contains_bytes32(&gmx_keys::withdrawal_list_key(env), &wth_key));
        assert!(ds_c.contains_bytes32(&gmx_keys::account_withdrawal_list_key(env, &user), &wth_key));

        WithdrawalHandlerClient::new(env, &w.wth_handler).execute_withdrawal(&w.keeper, &wth_key);

        assert!(
            WithdrawalHandlerClient::new(env, &w.wth_handler)
                .get_withdrawal(&wth_key)
                .is_none(),
            "record must be removed after execute"
        );
        assert!(
            !ds_c.contains_bytes32(&gmx_keys::withdrawal_list_key(env), &wth_key),
            "global withdrawal list must not contain key after execute"
        );
        assert!(
            !ds_c.contains_bytes32(&gmx_keys::account_withdrawal_list_key(env, &user), &wth_key),
            "account withdrawal list must not contain key after execute"
        );
    }

    // ── Existing integration tests ────────────────────────────────────────────

    #[test]
    fn full_deposit_then_withdrawal() {
        let w = setup();
        let env = &w.env;
        let user = Address::generate(env);

        StellarAssetClient::new(env, &w.long_tk).mint(&user, &1_000_0000i128);
        StellarAssetClient::new(env, &w.short_tk).mint(&user, &500_0000i128);
        set_prices(&w);

        let lp_balance = do_deposit(&w, &user, 1_000_0000, 500_0000);
        assert!(lp_balance > 0);

        set_prices(&w);
        let half_lp = lp_balance / 2;
        let wth_key = WithdrawalHandlerClient::new(env, &w.wth_handler).create_withdrawal(
            &user,
            &CreateWithdrawalParams {
                receiver: user.clone(),
                market: w.market_tk.clone(),
                market_token_amount: half_lp,
                min_long_token_amount: 0,
                min_short_token_amount: 0,
                execution_fee: 0,
            },
        );
        WithdrawalHandlerClient::new(env, &w.wth_handler).execute_withdrawal(&w.keeper, &wth_key);

        assert!(StellarAssetClient::new(env, &w.long_tk).balance(&user) > 0);
        assert!(StellarAssetClient::new(env, &w.short_tk).balance(&user) > 0);
        assert_eq!(
            MtClient::new(env, &w.market_tk).balance(&user),
            lp_balance - half_lp
        );
    }

    // ── Issue #28: global withdrawal list lifecycle ────────────────────────────

    /// Create three withdrawals, cancel one, execute another, leave the third
    /// pending.  The global list and per-account list must reflect exactly the
    /// pending withdrawal at each stage.
    #[test]
    fn withdrawal_list_reflects_full_lifecycle() {
        let w = setup();
        let env = &w.env;

        // Three separate users each get LP tokens from a deposit.
        let user_a = Address::generate(env);
        let user_b = Address::generate(env);
        let user_c = Address::generate(env);

        for u in [&user_a, &user_b, &user_c] {
            StellarAssetClient::new(env, &w.long_tk).mint(u, &1_000_0000i128);
        }
        set_prices(&w);

        let lp_a = do_deposit(&w, &user_a, 1_000_0000, 0);
        set_prices(&w);
        let lp_b = do_deposit(&w, &user_b, 1_000_0000, 0);
        set_prices(&w);
        let lp_c = do_deposit(&w, &user_c, 1_000_0000, 0);

        assert!(lp_a > 0);
        assert!(lp_b > 0);
        assert!(lp_c > 0);

        let wh = WithdrawalHandlerClient::new(env, &w.wth_handler);
        let ds = DsClient::new(env, &w.ds);

        // ── Create three withdrawals ──────────────────────────────────────────
        set_prices(&w);
        let params_for = |user: &Address, lp: i128| CreateWithdrawalParams {
            receiver: user.clone(),
            market: w.market_tk.clone(),
            market_token_amount: lp,
            min_long_token_amount: 0,
            min_short_token_amount: 0,
            execution_fee: 0,
        };

        let key_a = wh.create_withdrawal(&user_a, &params_for(&user_a, lp_a));
        let key_b = wh.create_withdrawal(&user_b, &params_for(&user_b, lp_b));
        let key_c = wh.create_withdrawal(&user_c, &params_for(&user_c, lp_c));

        // All three must appear in the global list.
        assert_eq!(
            ds.get_bytes32_set_count(&gmx_keys::withdrawal_list_key(env)),
            3,
            "global list must have 3 entries after three creates"
        );
        for key in [&key_a, &key_b, &key_c] {
            assert!(
                ds.contains_bytes32(&gmx_keys::withdrawal_list_key(env), key),
                "global list must contain each key after create"
            );
        }

        // Each user's account list must have exactly their key.
        for (user, key) in [(&user_a, &key_a), (&user_b, &key_b), (&user_c, &key_c)] {
            assert_eq!(
                ds.get_bytes32_set_count(&gmx_keys::account_withdrawal_list_key(env, user)),
                1
            );
            assert!(ds.contains_bytes32(&gmx_keys::account_withdrawal_list_key(env, user), key));
        }

        // ── Cancel user_a's withdrawal ────────────────────────────────────────
        wh.cancel_withdrawal(&user_a, &key_a);

        assert_eq!(
            ds.get_bytes32_set_count(&gmx_keys::withdrawal_list_key(env)),
            2,
            "global list must have 2 entries after one cancel"
        );
        assert!(
            !ds.contains_bytes32(&gmx_keys::withdrawal_list_key(env), &key_a),
            "cancelled key must be absent from global list"
        );
        assert_eq!(
            ds.get_bytes32_set_count(&gmx_keys::account_withdrawal_list_key(env, &user_a)),
            0,
            "cancelled user account list must be empty"
        );

        // ── Execute user_b's withdrawal ───────────────────────────────────────
        set_prices(&w);
        wh.execute_withdrawal(&w.keeper, &key_b);

        assert_eq!(
            ds.get_bytes32_set_count(&gmx_keys::withdrawal_list_key(env)),
            1,
            "global list must have 1 entry after cancel + execute"
        );
        assert!(
            !ds.contains_bytes32(&gmx_keys::withdrawal_list_key(env), &key_b),
            "executed key must be absent from global list"
        );
        assert_eq!(
            ds.get_bytes32_set_count(&gmx_keys::account_withdrawal_list_key(env, &user_b)),
            0,
            "executed user account list must be empty"
        );

        // ── user_c's withdrawal is still pending ─────────────────────────────
        assert!(
            ds.contains_bytes32(&gmx_keys::withdrawal_list_key(env), &key_c),
            "pending key must remain in global list"
        );
        assert!(
            wh.get_withdrawal(&key_c).is_some(),
            "pending withdrawal record must still exist"
        );
    }

    #[test]
    fn cancel_withdrawal_refunds_lp() {
        let w = setup();
        let env = &w.env;
        let user = Address::generate(env);

        StellarAssetClient::new(env, &w.long_tk).mint(&user, &1_000_0000i128);
        set_prices(&w);
        let lp_balance = do_deposit(&w, &user, 1_000_0000, 0);

        let wth_key = WithdrawalHandlerClient::new(env, &w.wth_handler).create_withdrawal(
            &user,
            &CreateWithdrawalParams {
                receiver: user.clone(),
                market: w.market_tk.clone(),
                market_token_amount: lp_balance,
                min_long_token_amount: 0,
                min_short_token_amount: 0,
                execution_fee: 0,
            },
        );

        assert_eq!(MtClient::new(env, &w.market_tk).balance(&user), 0);
        WithdrawalHandlerClient::new(env, &w.wth_handler).cancel_withdrawal(&user, &wth_key);
        assert_eq!(MtClient::new(env, &w.market_tk).balance(&user), lp_balance);
        assert!(WithdrawalHandlerClient::new(env, &w.wth_handler)
            .get_withdrawal(&wth_key)
            .is_none());
    }

    // ── Issue #109: ORDER_KEEPER authorization matrix ─────────────────────────

    /// execute_withdrawal must reject a caller that does not hold ORDER_KEEPER.
    #[test]
    #[should_panic]
    fn execute_withdrawal_by_non_keeper_panics() {
        let w = setup();
        let user = Address::generate(&w.env);
        StellarAssetClient::new(&w.env, &w.long_tk).mint(&user, &5_000_0000i128);
        StellarAssetClient::new(&w.env, &w.short_tk).mint(&user, &2_000_0000i128);
        set_prices(&w);
        let lp_balance = do_deposit(&w, &user, 5_000_0000, 2_000_0000);

        // Create a withdrawal to get a key.
        let wth_key = WithdrawalHandlerClient::new(&w.env, &w.wth_handler).create_withdrawal(
            &user,
            &CreateWithdrawalParams {
                receiver: user.clone(),
                market: w.market_tk.clone(),
                market_token_amount: lp_balance,
                min_long_token_amount: 0,
                min_short_token_amount: 0,
                execution_fee: 0,
            },
        );

        let impostor = Address::generate(&w.env);
        // impostor has no ORDER_KEEPER role — must panic with Unauthorized.
        WithdrawalHandlerClient::new(&w.env, &w.wth_handler)
            .execute_withdrawal(&impostor, &wth_key);
    }

    // ── Issue #255: withdrawal output matches current pool weight ────────────

    /// Withdraw from a 70/30 imbalanced pool (USD terms) and assert the output
    /// ratio matches the pool weight within 1 bps, not a hardcoded 50/50 split.
    #[test]
    fn execute_withdrawal_imbalanced_pool_matches_weight_ratio() {
        let w = setup();
        let env = &w.env;
        let user = Address::generate(env);

        // 70/30 imbalanced pool in USD terms:
        // long price = 2000, short price = 1 (from set_prices)
        // long_amount * 2000 = 700_000 (usd)  => long_amount = 350
        // short_amount * 1   = 300_000 (usd)  => short_amount = 300_000
        let long_amount = 350 * 10_000_000i128; // 350 tokens @ 7 decimals
        let short_amount = 300_000 * 10_000_000i128; // 300,000 tokens @ 7 decimals

        StellarAssetClient::new(env, &w.long_tk).mint(&user, &long_amount);
        StellarAssetClient::new(env, &w.short_tk).mint(&user, &short_amount);
        set_prices(&w);
        let lp_balance = do_deposit(&w, &user, long_amount, short_amount);
        assert!(lp_balance > 0);

        set_prices(&w);
        let wth_key = WithdrawalHandlerClient::new(env, &w.wth_handler).create_withdrawal(
            &user,
            &CreateWithdrawalParams {
                receiver: user.clone(),
                market: w.market_tk.clone(),
                market_token_amount: lp_balance,
                min_long_token_amount: 0,
                min_short_token_amount: 0,
                execution_fee: 0,
            },
        );
        WithdrawalHandlerClient::new(env, &w.wth_handler).execute_withdrawal(&w.keeper, &wth_key);

        let long_out = StellarAssetClient::new(env, &w.long_tk).balance(&user);
        let short_out = StellarAssetClient::new(env, &w.short_tk).balance(&user);

        let long_out_usd = long_out * 2000;
        let short_out_usd = short_out;
        let total_usd = long_out_usd + short_out_usd;

        // expect ~70% long, 30% short (within 1 bps = 0.01%)
        let long_bps = long_out_usd * 10_000 / total_usd;
        assert!((long_bps - 7000).abs() <= 1, "long_bps={} expected ~7000", long_bps);
    }

    /// execute_withdrawal must revert once the ledger has advanced past the price
    /// submission, rather than computing the pool weight from a stale price.
    #[test]
    #[should_panic]
    fn execute_withdrawal_reverts_on_stale_price() {
        let w = setup();
        let env = &w.env;
        let user = Address::generate(env);

        StellarAssetClient::new(env, &w.long_tk).mint(&user, &1_000_0000i128);
        set_prices(&w);
        let lp = do_deposit(&w, &user, 1_000_0000, 0);

        set_prices(&w);
        let wth_key = WithdrawalHandlerClient::new(env, &w.wth_handler).create_withdrawal(
            &user,
            &CreateWithdrawalParams {
                receiver: user.clone(),
                market: w.market_tk.clone(),
                market_token_amount: lp,
                min_long_token_amount: 0,
                min_short_token_amount: 0,
                execution_fee: 0,
            },
        );

        // Ledger advances with no fresh price submitted — the stored price is now stale.
        let seq = env.ledger().sequence();
        env.ledger().set_sequence_number(seq + 1);

        WithdrawalHandlerClient::new(env, &w.wth_handler).execute_withdrawal(&w.keeper, &wth_key);
    }
}