Special holders can pre-bank an opt-out while the market is unlisted or revoked and escape the ascending auction

// SPDX-License-Identifier: MIT
pragma solidity 0.8.30;

import {Test} from "forge-std/Test.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {PlakxioBadge} from "../../src/PlakxioBadge.sol";
import {PlakxioSpecialMarket} from "../../src/PlakxioSpecialMarket.sol";

contract QuoteStub {
    function decimals() external pure returns (uint8) {
        return 6;
    }
}

contract OptOutSpecialEscape is Test {
    PlakxioBadge badge;
    QuoteStub quote;

    address admin = address(0xA11CE);
    address issuer = address(0x1553E);
    address holder = address(0xB0B);
    address cleanHolder = address(0xC1EA);
    address buyer = address(0xBEEF);

    uint256 specialMask;
    uint256 constant ORDINAL = 893;
    uint256 constant ID = 2_000_000_000 + ORDINAL;
    uint256 constant CONTROL_ID = ID + 1;

    function setUp() public {
        vm.warp(1_000_000);
        quote = new QuoteStub();
        vm.startPrank(admin);
        badge = new PlakxioBadge(admin, "u", uint48(2 days), 2 days);
        badge.grantRole(badge.MINTER_ROLE(), issuer);
        vm.stopPrank();
        specialMask = badge.CLASS_MASK_SPECIAL();
    }

    function _deployMarket(address deployer) internal returns (PlakxioSpecialMarket m) {
        vm.prank(deployer);
        m = new PlakxioSpecialMarket(
            admin,
            badge,
            IERC20(address(quote)),
            admin,
            3000,
            1500,
            1000,
            500,
            500_000,
            1_000_000_000,
            uint48(2 days)
        );
    }

    function _marketCanMove(PlakxioSpecialMarket m, address from, uint256 id) internal returns (bool moved) {
        uint256 before = badge.balanceOf(from, id);
        vm.prank(address(m));
        (bool ok,) = address(badge).call(
            abi.encodeWithSignature(
                "safeTransferFrom(address,address,uint256,uint256,bytes)",
                from,
                buyer,
                id,
                1,
                bytes("")
            )
        );
        moved = ok && badge.balanceOf(from, id) == before - 1 && badge.balanceOf(buyer, id) >= 1;
    }

    function test_optOutBeforeWhitelist_badgeBecomesPermanentlyUnsellable() public {
        address deployer = address(0xDEAD);
        address predicted = vm.computeCreateAddress(deployer, vm.getNonce(deployer));

        vm.prank(holder);
        badge.setSettlementOptOut(predicted, true);

        PlakxioSpecialMarket market = _deployMarket(deployer);
        assertEq(address(market), predicted, "address prediction holds");

        vm.prank(admin);
        badge.setSettlementContract(address(market), true, specialMask);
        vm.warp(block.timestamp + 3 days);

        vm.prank(issuer);
        badge.mintSpecial(holder, ID, ORDINAL);
        vm.prank(issuer);
        badge.mintSpecial(cleanHolder, CONTROL_ID, ORDINAL + 1);

        vm.prank(holder);
        vm.expectRevert(PlakxioBadge.CannotOptOutOfSpecial.selector);
        badge.setSettlementOptOut(address(market), true);

        assertFalse(_marketCanMove(market, holder, ID), "HARM: escaped Special is unmovable by the market");
        assertEq(badge.balanceOf(holder, ID), 1, "HARM: holder still owns it");
        assertTrue(_marketCanMove(market, cleanHolder, CONTROL_ID), "CONTROL: a normal Special does sell");
    }

    function test_optOutDuringRevocationWindow_badgeBecomesPermanentlyUnsellable() public {
        PlakxioSpecialMarket market = _deployMarket(admin);
        vm.prank(admin);
        badge.setSettlementContract(address(market), true, specialMask);
        vm.warp(block.timestamp + 3 days);

        vm.prank(issuer);
        badge.mintSpecial(holder, ID, ORDINAL);
        vm.prank(issuer);
        badge.mintSpecial(cleanHolder, CONTROL_ID, ORDINAL + 1);

        vm.prank(admin);
        badge.setSettlementContract(address(market), false, 0);
        assertEq(badge.settlementClassMask(address(market)), 0, "revocation zeroes the mask");

        vm.prank(holder);
        badge.setSettlementOptOut(address(market), true);

        vm.prank(admin);
        badge.setSettlementContract(address(market), true, specialMask);
        vm.warp(block.timestamp + 3 days);

        assertFalse(_marketCanMove(market, holder, ID), "HARM: escaped Special is unmovable by the market");
        assertEq(badge.balanceOf(holder, ID), 1, "HARM: holder still owns it");
        assertTrue(_marketCanMove(market, cleanHolder, CONTROL_ID), "CONTROL: a normal Special does sell");
    }
}

forge test --match-path "test/poc/OptOutSpecialEscape.t.sol" -vv

Ran 2 tests for test/poc/OptOutSpecialEscape.t.sol:OptOutSpecialEscape
[PASS] test_optOutBeforeWhitelist_badgeBecomesPermanentlyUnsellable() (gas: 2465997)
[PASS] test_optOutDuringRevocationWindow_badgeBecomesPermanentlyUnsellable() (gas: 2476802)
Suite result: ok. 2 passed; 0 failed; 0 skipped

-function _checkHolderPermits(address holder, address operator) internal view {
-    if (settlementOptOut[holder][operator]) revert HolderOptedOut(holder, operator);
+function _checkHolderPermits(address holder, address operator, uint256 id) internal view {
+    if (settlementOptOut[holder][operator] && tokenClass(id) != TokenClass.Special) {
+        revert HolderOptedOut(holder, operator);
+    }
 }