# Geth (Go Ethereum) - El cliente más popular
docker run -d \
  --name ethereum-geth \
  --restart unless-stopped \
  -v ethereum-data:/root/.ethereum \
  -p 8545:8545 \
  -p 8546:8546 \
  -p 30303:30303 \
  ethereum/client-go:stable \
    --http \
    --http.addr 0.0.0.0 \
    --http.port 8545 \
    --http.corsdomain "*" \
    --http.api eth,net,web3,txpool,debug \
    --ws \
    --ws.addr 0.0.0.0 \
    --ws.port 8546 \
    --ws.origins "*" \
    --ws.api eth,net,web3,txpool,debug \
    --metrics \
    --metrics.addr 0.0.0.0 \
    --metrics.port 6060 \
    --syncmode snap \
    --cache 4096 \
    --maxpeers 50 \
    --nat extip:$(curl -s ifconfig.me)

# Prysm Beacon Chain
docker run -d \
  --name ethereum-beacon \
  --restart unless-stopped \
  -v beacon-data:/data \
  -p 4000:4000 \
  -p 13000:13000 \
  -p 12000:12000/udp \
  gcr.io/prysmaticlabs/prysm/beacon-chain:stable \
    --datadir=/data \
    --rpc-host=0.0.0.0 \
    --rpc-port=4000 \
    --grpc-gateway-host=0.0.0.0 \
    --grpc-gateway-port=3500 \
    --monitoring-host=0.0.0.0 \
    --monitoring-port=8080 \
    --p2p-host-ip=$(curl -s ifconfig.me) \
    --execution-endpoint=http://geth:8551 \
    --jwt-secret=/data/jwt.hex \
    --accept-terms-of-use

# docker-compose.yml - Stack completo de nodo Ethereum con monitoreo
version: '3.8'

services:
  # Cliente de ejecución
  geth:
    image: ethereum/client-go:stable
    container_name: ethereum-geth
    restart: unless-stopped
    volumes:
      - geth-data:/root/.ethereum
      - ./jwt.hex:/root/.ethereum/jwt.hex
    ports:
      - "8545:8545"   # HTTP RPC
      - "8546:8546"   # WebSocket RPC
      - "30303:30303" # P2P
      - "6060:6060"   # Metrics
    command: >
      --http --http.addr=0.0.0.0 --http.port=8545 
      --http.corsdomain="*" --http.vhosts="*"
      --http.api=eth,net,web3,txpool,debug,admin
      --ws --ws.addr=0.0.0.0 --ws.port=8546 
      --ws.origins="*" --ws.api=eth,net,web3,txpool,debug
      --authrpc.addr=0.0.0.0 --authrpc.port=8551
      --authrpc.jwtsecret=/root/.ethereum/jwt.hex
      --metrics --metrics.addr=0.0.0.0 --metrics.port=6060
      --syncmode=snap --gcmode=archive
      --cache=4096 --maxpeers=50
    networks:
      - ethereum-net

  # Cliente de consenso
  beacon:
    image: gcr.io/prysmaticlabs/prysm/beacon-chain:stable
    container_name: ethereum-beacon
    restart: unless-stopped
    depends_on:
      - geth
    volumes:
      - beacon-data:/data
      - ./jwt.hex:/data/jwt.hex
    ports:
      - "4000:4000"     # gRPC
      - "3500:3500"     # Gateway
      - "13000:13000"   # P2P
      - "12000:12000/udp" # Discovery
      - "8080:8080"     # Monitoring
    command: >
      --datadir=/data
      --rpc-host=0.0.0.0 --rpc-port=4000
      --grpc-gateway-host=0.0.0.0 --grpc-gateway-port=3500
      --monitoring-host=0.0.0.0 --monitoring-port=8080
      --execution-endpoint=http://geth:8551
      --jwt-secret=/data/jwt.hex
      --accept-terms-of-use
      --checkpoint-sync-url=https://beaconstate.ethstaker.cc
      --genesis-beacon-api-url=https://beaconstate.ethstaker.cc
    networks:
      - ethereum-net

  # Validador (opcional, para staking)
  validator:
    image: gcr.io/prysmaticlabs/prysm/validator:stable
    container_name: ethereum-validator
    restart: unless-stopped
    depends_on:
      - beacon
    volumes:
      - validator-data:/data
      - ./validator-keys:/validator-keys
    command: >
      --datadir=/data
      --beacon-rpc-provider=beacon:4000
      --wallet-dir=/data/wallets
      --wallet-password-file=/data/wallet-password.txt
      --accept-terms-of-use
      --monitoring-host=0.0.0.0
      --monitoring-port=8081
    networks:
      - ethereum-net
    profiles:
      - validator

  # Monitoreo con Prometheus
  prometheus:
    image: prom/prometheus:latest
    container_name: prometheus
    restart: unless-stopped
    volumes:
      - ./monitoring/prometheus.yml:/etc/prometheus/prometheus.yml
      - ./monitoring/rules:/etc/prometheus/rules
      - prometheus-data:/prometheus
    ports:
      - "9090:9090"
    command:
      - '--config.file=/etc/prometheus/prometheus.yml'
      - '--storage.tsdb.path=/prometheus'
      - '--web.console.libraries=/etc/prometheus/console_libraries'
      - '--web.console.templates=/etc/prometheus/consoles'
      - '--storage.tsdb.retention.time=90d'
      - '--web.enable-lifecycle'
    networks:
      - ethereum-net

  # Dashboard con Grafana
  grafana:
    image: grafana/grafana:latest
    container_name: grafana
    restart: unless-stopped
    depends_on:
      - prometheus
    volumes:
      - grafana-data:/var/lib/grafana
      - ./monitoring/grafana/dashboards:/etc/grafana/provisioning/dashboards
      - ./monitoring/grafana/datasources:/etc/grafana/provisioning/datasources
    ports:
      - "3000:3000"
    environment:
      - GF_SECURITY_ADMIN_PASSWORD=admin
      - GF_USERS_ALLOW_SIGN_UP=false
      - GF_INSTALL_PLUGINS=grafana-piechart-panel
    networks:
      - ethereum-net

  # Node exporter para métricas del sistema
  node-exporter:
    image: prom/node-exporter:latest
    container_name: node-exporter
    restart: unless-stopped
    volumes:
      - /proc:/host/proc:ro
      - /sys:/host/sys:ro
      - /:/host/rootfs:ro
    command:
      - '--path.procfs=/host/proc'
      - '--path.rootfs=/host/rootfs'
      - '--path.sysfs=/host/sys'
      - '--collector.filesystem.mount-points-exclude=^/(sys|proc|dev|host|etc)($$|/)'
    ports:
      - "9100:9100"
    networks:
      - ethereum-net

  # Reverse proxy con nginx
  nginx:
    image: nginx:alpine
    container_name: ethereum-proxy
    restart: unless-stopped
    depends_on:
      - geth
      - grafana
    volumes:
      - ./nginx/nginx.conf:/etc/nginx/nginx.conf
      - ./ssl:/etc/ssl/certs
    ports:
      - "80:80"
      - "443:443"
    networks:
      - ethereum-net

networks:
  ethereum-net:
    driver: bridge

volumes:
  geth-data:
  beacon-data:
  validator-data:
  prometheus-data:
  grafana-data:

# monitoring/prometheus.yml
global:
  scrape_interval: 15s
  evaluation_interval: 15s

rule_files:
  - "/etc/prometheus/rules/*.yml"

scrape_configs:
  # Geth metrics
  - job_name: 'geth'
    static_configs:
      - targets: ['geth:6060']
    scrape_interval: 10s
    metrics_path: /debug/metrics/prometheus

  # Beacon chain metrics
  - job_name: 'beacon-chain'
    static_configs:
      - targets: ['beacon:8080']
    scrape_interval: 10s

  # Validator metrics
  - job_name: 'validator'
    static_configs:
      - targets: ['validator:8081']
    scrape_interval: 10s

  # System metrics
  - job_name: 'node-exporter'
    static_configs:
      - targets: ['node-exporter:9100']
    scrape_interval: 15s

  # Prometheus self-monitoring
  - job_name: 'prometheus'
    static_configs:
      - targets: ['localhost:9090']

alerting:
  alertmanagers:
    - static_configs:
        - targets:
          - alertmanager:9093

# monitoring/rules/ethereum-alerts.yml
groups:
- name: ethereum-node
  rules:
  
  # Nodo desconectado
  - alert: NodeDown
    expr: up{job=~"geth|beacon-chain"} == 0
    for: 5m
    labels:
      severity: critical
    annotations:
      summary: "Ethereum node {{ $labels.instance }} is down"
      description: "Node {{ $labels.instance }} has been down for more than 5 minutes"

  # Nodo fuera de sincronización
  - alert: NodeOutOfSync
    expr: |
      (
        ethereum_chain_head_block - 
        on() group_right() 
        max(ethereum_chain_head_block)
      ) -100
    for: 10m
    labels:
      severity: warning
    annotations:
      summary: "Node is out of sync"
      description: "Node is {{ $value }} blocks behind"

  # Uso alto de disco
  - alert: HighDiskUsage
    expr: |
      (
        node_filesystem_size_bytes{fstype!="tmpfs"} - 
        node_filesystem_free_bytes{fstype!="tmpfs"}
      ) / node_filesystem_size_bytes{fstype!="tmpfs"} > 0.85
    for: 5m
    labels:
      severity: warning
    annotations:
      summary: "High disk usage on {{ $labels.instance }}"
      description: "Disk usage is {{ $value | humanizePercentage }}"

  # Pocos peers conectados
  - alert: LowPeerCount
    expr: ethereum_p2p_peers 5
    for: 10m
    labels:
      severity: warning
    annotations:
      summary: "Low peer count on {{ $labels.instance }}"
      description: "Only {{ $value }} peers connected"

  # Alto uso de memoria
  - alert: HighMemoryUsage
    expr: |
      (
        node_memory_MemTotal_bytes - 
        node_memory_MemAvailable_bytes
      ) / node_memory_MemTotal_bytes > 0.9
    for: 5m
    labels:
      severity: critical
    annotations:
      summary: "High memory usage on {{ $labels.instance }}"
      description: "Memory usage is {{ $value | humanizePercentage }}"

// hardhat.config.js - Configuración completa de Hardhat
require("@nomicfoundation/hardhat-toolbox");
require("@openzeppelin/hardhat-upgrades");
require("hardhat-gas-reporter");
require("solidity-coverage");
require("hardhat-contract-sizer");

const dotenv = require("dotenv");
dotenv.config();

/** @type import('hardhat/config').HardhatUserConfig */
module.exports = {
  solidity: {
    version: "0.8.20",
    settings: {
      optimizer: {
        enabled: true,
        runs: 200,
      },
      viaIR: true, // Mejorar optimización para contratos grandes
    },
  },

  networks: {
    // Red local
    localhost: {
      url: "http://127.0.0.1:8545",
      chainId: 31337,
    },

    // Testnets
    sepolia: {
      url: `https://sepolia.infura.io/v3/${process.env.INFURA_API_KEY}`,
      accounts: [process.env.PRIVATE_KEY_TESTNET],
      chainId: 11155111,
      gasPrice: 20000000000, // 20 gwei
    },

    goerli: {
      url: `https://goerli.infura.io/v3/${process.env.INFURA_API_KEY}`,
      accounts: [process.env.PRIVATE_KEY_TESTNET],
      chainId: 5,
      gasPrice: "auto",
    },

    // Mainnet (usar con precaución)
    mainnet: {
      url: `https://mainnet.infura.io/v3/${process.env.INFURA_API_KEY}`,
      accounts: [process.env.PRIVATE_KEY_MAINNET],
      chainId: 1,
      gasPrice: "auto",
    },

    // Layer 2
    optimism: {
      url: "https://mainnet.optimism.io",
      accounts: [process.env.PRIVATE_KEY_MAINNET],
      chainId: 10,
    },

    arbitrum: {
      url: "https://arb1.arbitrum.io/rpc",
      accounts: [process.env.PRIVATE_KEY_MAINNET],
      chainId: 42161,
    },

    polygon: {
      url: "https://polygon-rpc.com",
      accounts: [process.env.PRIVATE_KEY_MAINNET],
      chainId: 137,
      gasPrice: 30000000000, // 30 gwei
    },
  },

  // Verificación en exploradores
  etherscan: {
    apiKey: {
      mainnet: process.env.ETHERSCAN_API_KEY,
      sepolia: process.env.ETHERSCAN_API_KEY,
      goerli: process.env.ETHERSCAN_API_KEY,
      optimisticEthereum: process.env.OPTIMISTIC_ETHERSCAN_API_KEY,
      arbitrumOne: process.env.ARBISCAN_API_KEY,
      polygon: process.env.POLYGONSCAN_API_KEY,
    },
  },

  // Reportes de gas
  gasReporter: {
    enabled: process.env.REPORT_GAS !== undefined,
    currency: "USD",
    outputFile: "gas-report.txt",
    noColors: true,
    coinmarketcap: process.env.COINMARKETCAP_API_KEY,
  },

  // Coverage
  mocha: {
    timeout: 100000000,
  },

  // Contract sizer
  contractSizer: {
    alphaSort: true,
    disambiguatePaths: false,
    runOnCompile: true,
    strict: true,
    only: [],
  },
};

// contracts/SecureProtocol.sol - Contrato con todas las mejores prácticas
// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;

import "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol";
import "@openzeppelin/contracts-upgradeable/access/OwnableUpgradeable.sol";
import "@openzeppelin/contracts-upgradeable/security/PausableUpgradeable.sol";
import "@openzeppelin/contracts-upgradeable/security/ReentrancyGuardUpgradeable.sol";
import "@openzeppelin/contracts-upgradeable/utils/cryptography/EIP712Upgradeable.sol";
import "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";
import "@openzeppelin/contracts/utils/math/SafeMath.sol";

/**
 * @title SecureProtocol
 * @dev Protocolo DeFi seguro con todas las mejores prácticas
 */
contract SecureProtocol is 
    Initializable,
    OwnableUpgradeable,
    PausableUpgradeable,
    ReentrancyGuardUpgradeable,
    EIP712Upgradeable
{
    using SafeERC20 for IERC20;
    using SafeMath for uint256;

    // ============ State Variables ============
    
    struct UserDeposit {
        uint256 amount;
        uint256 timestamp;
        uint256 lockPeriod;
        bool claimed;
    }

    mapping(address => UserDeposit[]) public userDeposits;
    mapping(address => bool) public authorizedTokens;
    mapping(address => uint256) public tokenMinAmounts;
    
    uint256 public totalValueLocked;
    uint256 public rewardRate; // Basis points (10000 = 100%)
    uint256 public minimumLockPeriod;
    uint256 public maximumLockPeriod;
    
    address public treasury;
    address public emergencyAdmin;

    // ============ Events ============
    
    event Deposited(
        address indexed user,
        address indexed token,
        uint256 amount,
        uint256 lockPeriod,
        uint256 depositId
    );
    
    event Withdrawn(
        address indexed user,
        address indexed token,
        uint256 amount,
        uint256 reward,
        uint256 depositId
    );
    
    event TokenAuthorized(address indexed token, uint256 minAmount);
    event TokenDeauthorized(address indexed token);
    event EmergencyWithdraw(address indexed user, address indexed token, uint256 amount);
    event ParametersUpdated(uint256 rewardRate, uint256 minLock, uint256 maxLock);

    // ============ Errors ============
    
    error UnauthorizedToken();
    error InsufficientAmount();
    error InvalidLockPeriod();
    error DepositNotMatured();
    error AlreadyClaimed();
    error NoDepositsFound();
    error TransferFailed();

    // ============ Modifiers ============
    
    modifier onlyEmergencyAdmin() {
        require(msg.sender == emergencyAdmin, "Not emergency admin");
        _;
    }

    modifier validToken(address token) {
        if (!authorizedTokens[token]) revert UnauthorizedToken();
        _;
    }

    // ============ Initialization ============
    
    /// @custom:oz-upgrades-unsafe-allow constructor
    constructor() {
        _disableInitializers();
    }

    function initialize(
        address _initialOwner,
        address _treasury,
        address _emergencyAdmin,
        uint256 _rewardRate,
        uint256 _minLockPeriod,
        uint256 _maxLockPeriod
    ) public initializer {
        require(_initialOwner != address(0), "Invalid owner");
        require(_treasury != address(0), "Invalid treasury");
        require(_emergencyAdmin != address(0), "Invalid emergency admin");
        require(_rewardRate <= 10000, "Invalid reward rate"); // Max 100%
        require(_minLockPeriod _maxLockPeriod, "Invalid lock periods");

        __Ownable_init(_initialOwner);
        __Pausable_init();
        __ReentrancyGuard_init();
        __EIP712_init("SecureProtocol", "1");

        treasury = _treasury;
        emergencyAdmin = _emergencyAdmin;
        rewardRate = _rewardRate;
        minimumLockPeriod = _minLockPeriod;
        maximumLockPeriod = _maxLockPeriod;
    }

    // ============ Core Functions ============
    
    /**
     * @dev Deposit tokens with lock period
     */
    function deposit(
        address token,
        uint256 amount,
        uint256 lockPeriod
    ) external nonReentrant whenNotPaused validToken(token) {
        if (amount tokenMinAmounts[token]) revert InsufficientAmount();
        if (lockPeriod minimumLockPeriod || lockPeriod > maximumLockPeriod) {
            revert InvalidLockPeriod();
        }

        // Transfer tokens from user
        IERC20(token).safeTransferFrom(msg.sender, address(this), amount);

        // Record deposit
        userDeposits[msg.sender].push(UserDeposit({
            amount: amount,
            timestamp: block.timestamp,
            lockPeriod: lockPeriod,
            claimed: false
        }));

        // Update TVL
        totalValueLocked = totalValueLocked.add(amount);

        emit Deposited(
            msg.sender,
            token,
            amount,
            lockPeriod,
            userDeposits[msg.sender].length - 1
        );
    }

    /**
     * @dev Withdraw deposit with rewards after lock period
     */
    function withdraw(
        address token,
        uint256 depositId
    ) external nonReentrant whenNotPaused validToken(token) {
        UserDeposit storage userDeposit = userDeposits[msg.sender][depositId];
        
        if (userDeposit.amount == 0) revert NoDepositsFound();
        if (userDeposit.claimed) revert AlreadyClaimed();
        if (block.timestamp userDeposit.timestamp + userDeposit.lockPeriod) {
            revert DepositNotMatured();
        }

        uint256 principal = userDeposit.amount;
        uint256 reward = calculateReward(principal, userDeposit.lockPeriod);
        
        // Mark as claimed
        userDeposit.claimed = true;
        
        // Update TVL
        totalValueLocked = totalValueLocked.sub(principal);

        // Transfer principal + rewards
        IERC20(token).safeTransfer(msg.sender, principal);
        if (reward > 0) {
            IERC20(token).safeTransferFrom(treasury, msg.sender, reward);
        }

        emit Withdrawn(msg.sender, token, principal, reward, depositId);
    }

    /**
     * @dev Calculate reward based on amount and lock period
     */
    function calculateReward(
        uint256 amount,
        uint256 lockPeriod
    ) public view returns (uint256) {
        // Reward increases with lock period (linear)
        uint256 periodMultiplier = lockPeriod.mul(10000).div(maximumLockPeriod);
        uint256 finalRate = rewardRate.mul(periodMultiplier).div(10000);
        
        return amount.mul(finalRate).div(10000);
    }

    /**
     * @dev Get user's deposit count
     */
    function getUserDepositCount(address user) external view returns (uint256) {
        return userDeposits[user].length;
    }

    /**
     * @dev Get user's specific deposit
     */
    function getUserDeposit(
        address user,
        uint256 depositId
    ) external view returns (UserDeposit memory) {
        return userDeposits[user][depositId];
    }

    /**
     * @dev Check if deposit can be withdrawn
     */
    function canWithdraw(
        address user,
        uint256 depositId
    ) external view returns (bool) {
        UserDeposit storage userDeposit = userDeposits[user][depositId];
        return !userDeposit.claimed && 
               block.timestamp >= userDeposit.timestamp + userDeposit.lockPeriod;
    }

    // ============ Admin Functions ============
    
    /**
     * @dev Authorize a token for deposits
     */
    function authorizeToken(
        address token,
        uint256 minAmount
    ) external onlyOwner {
        require(token != address(0), "Invalid token");
        authorizedTokens[token] = true;
        tokenMinAmounts[token] = minAmount;
        emit TokenAuthorized(token, minAmount);
    }

    /**
     * @dev Deauthorize a token
     */
    function deauthorizeToken(address token) external onlyOwner {
        authorizedTokens[token] = false;
        emit TokenDeauthorized(token);
    }

    /**
     * @dev Update protocol parameters
     */
    function updateParameters(
        uint256 _rewardRate,
        uint256 _minLockPeriod,
        uint256 _maxLockPeriod
    ) external onlyOwner {
        require(_rewardRate <= 10000, "Invalid reward rate");
        require(_minLockPeriod _maxLockPeriod, "Invalid lock periods");
        
        rewardRate = _rewardRate;
        minimumLockPeriod = _minLockPeriod;
        maximumLockPeriod = _maxLockPeriod;
        
        emit ParametersUpdated(_rewardRate, _minLockPeriod, _maxLockPeriod);
    }

    /**
     * @dev Update treasury address
     */
    function updateTreasury(address newTreasury) external onlyOwner {
        require(newTreasury != address(0), "Invalid treasury");
        treasury = newTreasury;
    }

    /**
     * @dev Update emergency admin
     */
    function updateEmergencyAdmin(address newAdmin) external onlyOwner {
        require(newAdmin != address(0), "Invalid admin");
        emergencyAdmin = newAdmin;
    }

    // ============ Emergency Functions ============
    
    /**
     * @dev Pause the protocol
     */
    function pause() external onlyOwner {
        _pause();
    }

    /**
     * @dev Unpause the protocol
     */
    function unpause() external onlyOwner {
        _unpause();
    }

    /**
     * @dev Emergency withdrawal (only in paused state)
     */
    function emergencyWithdraw(
        address token,
        uint256 depositId
    ) external nonReentrant whenPaused {
        UserDeposit storage userDeposit = userDeposits[msg.sender][depositId];
        
        if (userDeposit.amount == 0) revert NoDepositsFound();
        if (userDeposit.claimed) revert AlreadyClaimed();

        uint256 amount = userDeposit.amount;
        userDeposit.claimed = true;
        
        // Update TVL
        totalValueLocked = totalValueLocked.sub(amount);

        // Transfer only principal (no rewards in emergency)
        IERC20(token).safeTransfer(msg.sender, amount);

        emit EmergencyWithdraw(msg.sender, token, amount);
    }

    // ============ View Functions ============
    
    /**
     * @dev Get contract version
     */
    function version() external pure returns (string memory) {
        return "1.0.0";
    }

    /**
     * @dev Check if contract is initialized
     */
    function isInitialized() external view returns (bool) {
        return _getInitializedVersion() != 0;
    }
}

// test/SecureProtocol.test.js - Tests completos del protocolo
const { expect } = require("chai");
const { ethers, upgrades } = require("hardhat");
const { time, loadFixture } = require("@nomicfoundation/hardhat-network-helpers");

describe("SecureProtocol", function () {
  
  // Fixture para configuración reutilizable
  async function deploySecureProtocolFixture() {
    const [owner, treasury, emergencyAdmin, user1, user2] = await ethers.getSigners();

    // Deploy mock ERC20 token
    const MockToken = await ethers.getContractFactory("MockERC20");
    const token = await MockToken.deploy("Test Token", "TEST", ethers.parseEther("1000000"));

    // Deploy protocol as upgradeable proxy
    const SecureProtocol = await ethers.getContractFactory("SecureProtocol");
    const protocol = await upgrades.deployProxy(SecureProtocol, [
      owner.address,
      treasury.address,
      emergencyAdmin.address,
      1000, // 10% reward rate
      86400, // 1 day min lock
      31536000, // 1 year max lock
    ]);

    // Authorize token for deposits
    await protocol.connect(owner).authorizeToken(token.target, ethers.parseEther("1"));

    // Transfer tokens to users for testing
    await token.transfer(user1.address, ethers.parseEther("10000"));
    await token.transfer(user2.address, ethers.parseEther("10000"));
    await token.transfer(treasury.address, ethers.parseEther("100000")); // For rewards

    return { protocol, token, owner, treasury, emergencyAdmin, user1, user2 };
  }

  describe("Deployment and Initialization", function () {
    it("Should initialize with correct parameters", async function () {
      const { protocol, owner, treasury, emergencyAdmin } = await loadFixture(deploySecureProtocolFixture);
      
      expect(await protocol.owner()).to.equal(owner.address);
      expect(await protocol.treasury()).to.equal(treasury.address);
      expect(await protocol.emergencyAdmin()).to.equal(emergencyAdmin.address);
      expect(await protocol.rewardRate()).to.equal(1000);
      expect(await protocol.minimumLockPeriod()).to.equal(86400);
      expect(await protocol.maximumLockPeriod()).to.equal(31536000);
    });

    it("Should not allow double initialization", async function () {
      const { protocol, owner, treasury, emergencyAdmin } = await loadFixture(deploySecureProtocolFixture);
      
      await expect(
        protocol.initialize(
          owner.address,
          treasury.address,
          emergencyAdmin.address,
          1000,
          86400,
          31536000
        )
      ).to.be.revertedWith("Initializable: contract is already initialized");
    });
  });

  describe("Token Authorization", function () {
    it("Should authorize token correctly", async function () {
      const { protocol, token, owner } = await loadFixture(deploySecureProtocolFixture);
      
      expect(await protocol.authorizedTokens(token.target)).to.be.true;
      expect(await protocol.tokenMinAmounts(token.target)).to.equal(ethers.parseEther("1"));
    });

    it("Should only allow owner to authorize tokens", async function () {
      const { protocol, token, user1 } = await loadFixture(deploySecureProtocolFixture);
      
      await expect(
        protocol.connect(user1).authorizeToken(token.target, ethers.parseEther("1"))
      ).to.be.revertedWithCustomError(protocol, "OwnableUnauthorizedAccount");
    });

    it("Should deauthorize token correctly", async function () {
      const { protocol, token, owner } = await loadFixture(deploySecureProtocolFixture);
      
      await protocol.connect(owner).deauthorizeToken(token.target);
      expect(await protocol.authorizedTokens(token.target)).to.be.false;
    });
  });

  describe("Deposits", function () {
    it("Should allow valid deposits", async function () {
      const { protocol, token, user1 } = await loadFixture(deploySecureProtocolFixture);
      
      const amount = ethers.parseEther("100");
      const lockPeriod = 86400 * 30; // 30 days
      
      // Approve protocol to spend tokens
      await token.connect(user1).approve(protocol.target, amount);
      
      // Deposit
      await expect(
        protocol.connect(user1).deposit(token.target, amount, lockPeriod)
      ).to.emit(protocol, "Deposited")
        .withArgs(user1.address, token.target, amount, lockPeriod, 0);
      
      // Check deposit was recorded
      const deposit = await protocol.getUserDeposit(user1.address, 0);
      expect(deposit.amount).to.equal(amount);
      expect(deposit.lockPeriod).to.equal(lockPeriod);
      expect(deposit.claimed).to.be.false;
      
      // Check TVL updated
      expect(await protocol.totalValueLocked()).to.equal(amount);
    });

    it("Should reject deposits below minimum amount", async function () {
      const { protocol, token, user1 } = await loadFixture(deploySecureProtocolFixture);
      
      const amount = ethers.parseEther("0.5"); // Below minimum
      const lockPeriod = 86400 * 30;
      
      await token.connect(user1).approve(protocol.target, amount);
      
      await expect(
        protocol.connect(user1).deposit(token.target, amount, lockPeriod)
      ).to.be.revertedWithCustomError(protocol, "InsufficientAmount");
    });

    it("Should reject invalid lock periods", async function () {
      const { protocol, token, user1 } = await loadFixture(deploySecureProtocolFixture);
      
      const amount = ethers.parseEther("100");
      
      await token.connect(user1).approve(protocol.target, amount);
      
      // Too short
      await expect(
        protocol.connect(user1).deposit(token.target, amount, 3600)
      ).to.be.revertedWithCustomError(protocol, "InvalidLockPeriod");
      
      // Too long
      await expect(
        protocol.connect(user1).deposit(token.target, amount, 86400 * 400)
      ).to.be.revertedWithCustomError(protocol, "InvalidLockPeriod");
    });

    it("Should reject unauthorized tokens", async function () {
      const { protocol, user1 } = await loadFixture(deploySecureProtocolFixture);
      
      // Deploy another token without authorization
      const MockToken = await ethers.getContractFactory("MockERC20");
      const unauthorizedToken = await MockToken.deploy("Bad Token", "BAD", ethers.parseEther("1000"));
      
      const amount = ethers.parseEther("100");
      const lockPeriod = 86400 * 30;
      
      await expect(
        protocol.connect(user1).deposit(unauthorizedToken.target, amount, lockPeriod)
      ).to.be.revertedWithCustomError(protocol, "UnauthorizedToken");
    });
  });

  describe("Withdrawals", function () {
    async function setupDeposit() {
      const fixture = await loadFixture(deploySecureProtocolFixture);
      const { protocol, token, user1 } = fixture;
      
      const amount = ethers.parseEther("100");
      const lockPeriod = 86400 * 30; // 30 days
      
      await token.connect(user1).approve(protocol.target, amount);
      await protocol.connect(user1).deposit(token.target, amount, lockPeriod);
      
      return { ...fixture, amount, lockPeriod };
    }

    it("Should allow withdrawal after lock period", async function () {
      const { protocol, token, treasury, user1, amount, lockPeriod } = await setupDeposit();
      
      // Fast forward time
      await time.increase(lockPeriod);
      
      // Approve treasury to spend tokens for rewards
      const expectedReward = await protocol.calculateReward(amount, lockPeriod);
      await token.connect(treasury).approve(protocol.target, expectedReward);
      
      const initialBalance = await token.balanceOf(user1.address);
      
      await expect(
        protocol.connect(user1).withdraw(token.target, 0)
      ).to.emit(protocol, "Withdrawn");
      
      const finalBalance = await token.balanceOf(user1.address);
      expect(finalBalance - initialBalance).to.equal(amount + expectedReward);
      
      // Check deposit marked as claimed
      const deposit = await protocol.getUserDeposit(user1.address, 0);
      expect(deposit.claimed).to.be.true;
    });

    it("Should reject early withdrawal", async function () {
      const { protocol, token, user1 } = await setupDeposit();
      
      await expect(
        protocol.connect(user1).withdraw(token.target, 0)
      ).to.be.revertedWithCustomError(protocol, "DepositNotMatured");
    });

    it("Should reject double withdrawal", async function () {
      const { protocol, token, treasury, user1, lockPeriod } = await setupDeposit();
      
      await time.increase(lockPeriod);
      
      const expectedReward = await protocol.calculateReward(ethers.parseEther("100"), lockPeriod);
      await token.connect(treasury).approve(protocol.target, expectedReward);
      
      // First withdrawal
      await protocol.connect(user1).withdraw(token.target, 0);
      
      // Second withdrawal should fail
      await expect(
        protocol.connect(user1).withdraw(token.target, 0)
      ).to.be.revertedWithCustomError(protocol, "AlreadyClaimed");
    });
  });

  describe("Reward Calculation", function () {
    it("Should calculate rewards correctly", async function () {
      const { protocol } = await loadFixture(deploySecureProtocolFixture);
      
      const amount = ethers.parseEther("1000");
      const lockPeriod = 86400 * 365; // 1 year (max period)
      
      const expectedReward = amount * BigInt(1000) / BigInt(10000); // 10% of amount
      const calculatedReward = await protocol.calculateReward(amount, lockPeriod);
      
      expect(calculatedReward).to.equal(expectedReward);
    });

    it("Should scale rewards with lock period", async function () {
      const { protocol } = await loadFixture(deploySecureProtocolFixture);
      
      const amount = ethers.parseEther("1000");
      const halfPeriod = 86400 * 182; // ~6 months
      const fullPeriod = 86400 * 365; // 1 year
      
      const halfReward = await protocol.calculateReward(amount, halfPeriod);
      const fullReward = await protocol.calculateReward(amount, fullPeriod);
      
      // Half period should give approximately half rewards
      expect(halfReward * BigInt(2)).to.be.closeTo(fullReward, ethers.parseEther("1"));
    });
  });

  describe("Emergency Functions", function () {
    it("Should allow owner to pause/unpause", async function () {
      const { protocol, owner } = await loadFixture(deploySecureProtocolFixture);
      
      await protocol.connect(owner).pause();
      expect(await protocol.paused()).to.be.true;
      
      await protocol.connect(owner).unpause();
      expect(await protocol.paused()).to.be.false;
    });

    it("Should allow emergency withdrawal when paused", async function () {
      const { protocol, token, owner, user1 } = await loadFixture(deploySecureProtocolFixture);
      
      // Setup deposit
      const amount = ethers.parseEther("100");
      await token.connect(user1).approve(protocol.target, amount);
      await protocol.connect(user1).deposit(token.target, amount, 86400 * 30);
      
      // Pause protocol
      await protocol.connect(owner).pause();
      
      // Emergency withdrawal
      await expect(
        protocol.connect(user1).emergencyWithdraw(token.target, 0)
      ).to.emit(protocol, "EmergencyWithdraw");
    });

    it("Should reject emergency withdrawal when not paused", async function () {
      const { protocol, token, user1 } = await loadFixture(deploySecureProtocolFixture);
      
      // Setup deposit
      const amount = ethers.parseEther("100");
      await token.connect(user1).approve(protocol.target, amount);
      await protocol.connect(user1).deposit(token.target, amount, 86400 * 30);
      
      // Try emergency withdrawal without pausing
      await expect(
        protocol.connect(user1).emergencyWithdraw(token.target, 0)
      ).to.be.revertedWith("Pausable: not paused");
    });
  });

  describe("Gas Usage Optimization", function () {
    it("Should have reasonable gas costs for deposits", async function () {
      const { protocol, token, user1 } = await loadFixture(deploySecureProtocolFixture);
      
      const amount = ethers.parseEther("100");
      await token.connect(user1).approve(protocol.target, amount);
      
      const tx = await protocol.connect(user1).deposit(token.target, amount, 86400 * 30);
      const receipt = await tx.wait();
      
      // Should be under 200k gas
      expect(receipt.gasUsed).to.be.below(200000);
    });
  });

  describe("Upgradeability", function () {
    it("Should be upgradeable", async function () {
      const { protocol } = await loadFixture(deploySecureProtocolFixture);
      
      // Deploy V2
      const SecureProtocolV2 = await ethers.getContractFactory("SecureProtocolV2");
      const upgraded = await upgrades.upgradeProxy(protocol.target, SecureProtocolV2);
      
      // Should maintain storage
      expect(await upgraded.rewardRate()).to.equal(1000);
    });
  });
});

// scripts/deploy-production.js - Script de despliegue para producción
const { ethers, upgrades, network } = require("hardhat");
const fs = require('fs');
const path = require('path');

// Configuraciones por red
const NETWORK_CONFIG = {
  mainnet: {
    treasury: "0x...", // Treasury multisig
    emergencyAdmin: "0x...", // Emergency admin multisig
    rewardRate: 500, // 5%
    minLockPeriod: 86400 * 7, // 1 week
    maxLockPeriod: 86400 * 365, // 1 year
    authorizedTokens: [
      {
        address: "0xA0b86a33E6417Dc40441c7395F4aDD0fB0F74a01", // USDC
        minAmount: "1000000" // 1 USDC (6 decimals)
      },
      {
        address: "0xdAC17F958D2ee523a2206206994597C13D831ec7", // USDT
        minAmount: "1000000" // 1 USDT (6 decimals)
      },
      {
        address: "0x6B175474E89094C44Da98b954EedeAC495271d0F", // DAI
        minAmount: ethers.parseEther("1") // 1 DAI
      }
    ]
  },
  
  sepolia: {
    treasury: "0x...", // Test treasury
    emergencyAdmin: "0x...", // Test admin
    rewardRate: 1000, // 10% for testing
    minLockPeriod: 3600, // 1 hour for testing
    maxLockPeriod: 86400 * 30, // 1 month for testing
    authorizedTokens: [
      {
        address: "0x...", // Test USDC
        minAmount: "1000000"
      }
    ]
  }
};

async function main() {
  console.log(`Deploying to ${network.name}...`);
  
  const [deployer] = await ethers.getSigners();
  console.log(`Deploying with account: ${deployer.address}`);
  
  const balance = await ethers.provider.getBalance(deployer.address);
  console.log(`Account balance: ${ethers.formatEther(balance)} ETH`);
  
  const config = NETWORK_CONFIG[network.name];
  if (!config) {
    throw new Error(`No configuration for network: ${network.name}`);
  }
  
  // 1. Deploy the proxy contract
  console.log("\n1. Deploying SecureProtocol proxy...");
  const SecureProtocol = await ethers.getContractFactory("SecureProtocol");
  
  const protocol = await upgrades.deployProxy(SecureProtocol, [
    deployer.address, // Initial owner (will be transferred later)
    config.treasury,
    config.emergencyAdmin,
    config.rewardRate,
    config.minLockPeriod,
    config.maxLockPeriod
  ], {
    initializer: 'initialize',
    kind: 'uups'
  });
  
  await protocol.waitForDeployment();
  console.log(`SecureProtocol deployed to: ${protocol.target}`);
  
  // 2. Wait for confirmations
  console.log("\n2. Waiting for confirmations...");
  const deployTx = protocol.deploymentTransaction();
  await deployTx.wait(5);
  
  // 3. Authorize tokens
  console.log("\n3. Authorizing tokens...");
  for (const token of config.authorizedTokens) {
    console.log(`Authorizing ${token.address} with min amount ${token.minAmount}...`);
    const tx = await protocol.authorizeToken(token.address, token.minAmount);
    await tx.wait();
    console.log(`Token authorized: ${tx.hash}`);
  }
  
  // 4. Verify contracts if not local
  if (network.name !== "hardhat" && network.name !== "localhost") {
    console.log("\n4. Verifying contracts on block explorer...");
    
    try {
      // Get implementation address
      const implAddress = await upgrades.erc1967.getImplementationAddress(protocol.target);
      console.log(`Implementation address: ${implAddress}`);
      
      // Verify implementation
      await hre.run("verify:verify", {
        address: implAddress,
        constructorArguments: [],
      });
      
      console.log("Contract verified successfully");
    } catch (error) {
      console.log("Verification failed:", error.message);
    }
  }
  
  // 5. Save deployment info
  const deploymentInfo = {
    network: network.name,
    proxy: protocol.target,
    implementation: await upgrades.erc1967.getImplementationAddress(protocol.target),
    deployer: deployer.address,
    deploymentTransaction: deployTx.hash,
    blockNumber: deployTx.blockNumber,
    timestamp: new Date().toISOString(),
    config: config,
    gasUsed: deployTx.gasLimit.toString()
  };
  
  const deploymentsDir = path.join(__dirname, '..', 'deployments');
  if (!fs.existsSync(deploymentsDir)) {
    fs.mkdirSync(deploymentsDir, { recursive: true });
  }
  
  fs.writeFileSync(
    path.join(deploymentsDir, `${network.name}.json`),
    JSON.stringify(deploymentInfo, null, 2)
  );
  
  console.log(`\n✅ Deployment completed!`);
  console.log(`Proxy: ${protocol.target}`);
  console.log(`Implementation: ${await upgrades.erc1967.getImplementationAddress(protocol.target)}`);
  console.log(`Deployment info saved to: deployments/${network.name}.json`);
  
  // 6. Post-deployment checklist
  console.log(`\n📋 Post-deployment checklist:`);
  console.log(`□ Transfer ownership to multisig`);
  console.log(`□ Setup monitoring and alerts`);
  console.log(`□ Configure treasury token approvals`);
  console.log(`□ Test all functions on testnet first`);
  console.log(`□ Coordinate with frontend team for integration`);
  console.log(`□ Schedule security audit`);
}

// Handle errors
main()
  .then(() => process.exit(0))
  .catch((error) => {
    console.error("Deployment failed:", error);
    process.exit(1);
  });