HEE IN THIS CONTRACT // SPDX-License-Identifier: GPL-3.0-or-later
pragma solidity 0.8.13;

import {ERC20} from “@openzeppelin/contracts/token/ERC20/ERC20.sol”;
import {SafeCastLib} from “@src/external/solmate/SafeCastLib.sol”;

/**
@title An ERC20 with rebase capabilities. Anyone can sacrifice tokens to rebase up the balance
of all addresses that are currently rebasing.
@author eswak
@notice This contract is meant to be used to distribute rewards proportionately to all holders of
a token, for instance to distribute buybacks or income generated by a protocol.

Anyone can subscribe to rebasing by calling enterRebase(), and unsubcribe with exitRebase().
Anyone can burn tokens they own to distribute(uint256) proportionately to rebasing addresses.

The following conditions are always met :


totalSupply() == nonRebasingSupply() + rebasingSupply()
sum of balanceOf(x) == totalSupply() [+= rounding down errors of 1 wei for each balanceOf]



Internally, when a user subscribes to the rebase, their balance is converted to a number of
shares, and the total number of shares is updated. When a user unsubscribes, their shares are
converted back to a balance, and the total number of shares is updated.

On each distribution, the share price of rebasing tokens is updated to reflect the new value
of rebasing shares. The formula is as follow :


newSharePrice = oldSharePrice * (rebasingSupply + amount) / rebasingSupply



If the rebasingSupply is 0 (nobody subscribed to rebasing), the tokens distributed are burnt
but nobody benefits for the share price increase, since the share price cannot be updated.

/!\ The first user subscribing to rebase should have a meaningful balance in order to avoid
share price manipulation (see hundred finance exploit).
It is advised to keep a minimum balance rebasing at all times, for instance with a small
rebasing balance held by the deployer address or address(0) or the token itself.
/
abstract contract ERC20RebaseDistributor is ERC20 {
////////////////////////////////////////////////////////////////
EVENTS
////////////////////////////////////////////////////////////////

/// @notice Emitted when an account enters rebasing.
event RebaseEnter(address indexed account, uint256 indexed timestamp);
/// @notice Emitted when an account exits rebasing.
event RebaseExit(address indexed account, uint256 indexed timestamp);
/// @notice Emitted when an amount of tokens is distributed by source to the rebasing accounts.
event RebaseDistribution(
address indexed source,
uint256 indexed timestamp,
uint256 amountDistributed,
uint256 amountRebasing
);
/// @notice Emitted when an amount of tokens is realized as rebase rewards for account.
/// @dev totalSupply(), rebasingSupply(), and balanceOf() reflect the rebase rewards
/// in real time, but the internal storage only realizes rebase rewards if the user has an
/// interaction with the token contract in one of the following functions:
/// - exitRebase()
/// - burn()
/// - mint()
/// - transfer() received or sent
/// - transferFrom() received or sent
event RebaseReward(
address indexed account,
uint256 indexed timestamp,
uint256 amount
);

////////////////////////////////////////////////////////////////
INTERNAL STATE
////////////////////////////////////////////////////////////////

struct RebasingState {
uint8 isRebasing;
uint248 nShares;
}

/// @notice For internal accounting. Number of rebasing shares for each rebasing accounts. 0 if account is not rebasing.
mapping(address => RebasingState) internal rebasingState;

/// @notice For internal accounting. Total number of rebasing shares
uint256 internal totalRebasingShares;

/// @notice The starting share price for rebasing addresses.
/// @dev rounding errors start to appear when balances of users are near rebasingSharePrice(),
/// due to rounding down in the number of shares attributed, and rounding down in the number of
/// tokens per share. We use a high base to ensure no crazy rounding errors happen at runtime
/// (balances of users would have to be > START_REBASING_SHARE_PRICE for rounding errors to start to materialize).
uint256 internal constant START_REBASING_SHARE_PRICE = 1e30;

/// @notice share price increase and pending rebase rewards from distribute() are
/// interpolated linearly over a period of DISTRIBUTION_PERIOD seconds after a distribution.
uint256 public constant DISTRIBUTION_PERIOD = 30 days;

struct InterpolatedValue {
uint32 lastTimestamp;
uint224 lastValue;
uint32 targetTimestamp;
uint224 targetValue;
}

/// @notice For internal accounting. Number of tokens per share for the rebasing supply.
/// Starts at START_REBASING_SHARE_PRICE and goes up only.
InterpolatedValue internal __rebasingSharePrice =
InterpolatedValue({
lastTimestamp: SafeCastLib.safeCastTo32(block.timestamp),
lastValue: uint224(START_REBASING_SHARE_PRICE), // safe initial value
targetTimestamp: SafeCastLib.safeCastTo32(block.timestamp),
targetValue: uint224(START_REBASING_SHARE_PRICE) // safe initial value
});

/// @notice For internal accounting. Number of tokens distributed to rebasing addresses that have not
/// yet been materialized by a movement in the rebasing addresses.
InterpolatedValue internal __unmintedRebaseRewards =
InterpolatedValue({
lastTimestamp: SafeCastLib.safeCastTo32(block.timestamp),
lastValue: 0,
targetTimestamp: SafeCastLib.safeCastTo32(block.timestamp),
targetValue: 0
});

////////////////////////////////////////////////////////////////
INTERNAL UTILS
////////////////////////////////////////////////////////////////

/// @notice get the current value of an interpolated value
function interpolatedValue(
InterpolatedValue memory val
) internal view returns (uint256) {
// load state
uint256 lastTimestamp = uint256(val.lastTimestamp); // safe upcast
uint256 lastValue = uint256(val.lastValue); // safe upcast
uint256 targetTimestamp = uint256(val.targetTimestamp); // safe upcast
uint256 targetValue = uint256(val.targetValue); // safe upcast

// interpolate increase over period
if (block.timestamp >= targetTimestamp) {
// if period is passed, return target value
return targetValue;
} else {
// block.timestamp is within [lastTimestamp, targetTimestamp[
uint256 elapsed = block.timestamp - lastTimestamp;
uint256 delta = targetValue - lastValue;
return
lastValue +
(delta * elapsed) /
(targetTimestamp - lastTimestamp);
}
}

/// @notice called to update the number of rebasing shares.
/// This can happen in multiple situations:
/// - enterRebase()
/// - exitRebase()
/// - burn() from a rebasing address
/// - mint() to a rebasing address
/// - transfer() from a rebasing address
/// - transfer() to a rebasing address
/// - transferFrom() from a rebasing address
/// - transferFrom() to a rebasing address
/// If the number of shares is updated during the interpolation, the target share price
/// of the interpolation should be changed to reflect the reduced or increased number of shares
/// and keep a constant rebasing supply value (current & target).
function updateTotalRebasingShares(
uint256 currentRebasingSharePrice,
int256 sharesDelta
) internal {
if (sharesDelta == 0) return;
uint256 sharesBefore = totalRebasingShares;
uint256 sharesAfter;
if (sharesDelta > 0) {
sharesAfter = sharesBefore + uint256(sharesDelta);
} else {
uint256 shareDecrease = uint256(-sharesDelta);
if (shareDecrease < sharesBefore) {
unchecked {
sharesAfter = sharesBefore - shareDecrease;
}
}
// else sharesAfter stays 0
}
totalRebasingShares = sharesAfter;

// reset interpolation & share price if going to 0 rebasing supply
if (sharesAfter == 0) {
__rebasingSharePrice = InterpolatedValue({
lastTimestamp: SafeCastLib.safeCastTo32(block.timestamp), // now
lastValue: uint224(START_REBASING_SHARE_PRICE), // safe initial value
targetTimestamp: SafeCastLib.safeCastTo32(block.timestamp), // now
targetValue: uint224(START_REBASING_SHARE_PRICE) // safe initial value
});
__unmintedRebaseRewards = InterpolatedValue({
lastTimestamp: SafeCastLib.safeCastTo32(block.timestamp),
lastValue: 0,
targetTimestamp: SafeCastLib.safeCastTo32(block.timestamp),
targetValue: 0
});
return;
}

// when total shares is multiplied by x, the remaining share price change (“delta” below)
// should be multiplied by 1/x, e.g. going from a share price of 1.0 to 1.5, and current
// value is 1.25, the remaining share price change “delta” is 0.25.
// if the rebasing supply 2x, the share price change should 0.5x to 0.125.
// at the end of the interpolation period, the share price will be 1.375.
InterpolatedValue memory val = __rebasingSharePrice;
uint256 delta = uint256(val.targetValue) - currentRebasingSharePrice;
if (delta != 0) {
uint256 percentChange = (sharesAfter * START_REBASING_SHARE_PRICE) /
sharesBefore;
uint256 targetNewSharePrice = currentRebasingSharePrice +
(delta * START_REBASING_SHARE_PRICE) /
percentChange;
__rebasingSharePrice = InterpolatedValue({
lastTimestamp: SafeCastLib.safeCastTo32(block.timestamp), // now
lastValue: SafeCastLib.safeCastTo224(currentRebasingSharePrice), // current value
targetTimestamp: val.targetTimestamp, // unchanged
targetValue: SafeCastLib.safeCastTo224(targetNewSharePrice) // adjusted target
});
}
}

/// @notice decrease unminted rebase rewards, when rewards are minted to users
function decreaseUnmintedRebaseRewards(uint256 amount) internal {
InterpolatedValue memory val = __unmintedRebaseRewards;
uint256 _unmintedRebaseRewards = interpolatedValue(val);
__unmintedRebaseRewards = InterpolatedValue({
lastTimestamp: SafeCastLib.safeCastTo32(block.timestamp), // now
lastValue: SafeCastLib.safeCastTo224(
_unmintedRebaseRewards - amount
), // adjusted current
targetTimestamp: val.targetTimestamp, // unchanged
targetValue: val.targetValue - SafeCastLib.safeCastTo224(amount) // adjusted target
});
}

/// @notice get the current rebasing share price
function rebasingSharePrice() internal view returns (uint256) {
return interpolatedValue(__rebasingSharePrice);
}

/// @notice get the current unminted rebase rewards
function unmintedRebaseRewards() internal view returns (uint256) {
return interpolatedValue(__unmintedRebaseRewards);
}

/// @notice convert a balance to a number of shares
function _balance2shares(
uint256 balance,
uint256 sharePrice
) internal pure returns (uint256) {
return (balance * START_REBASING_SHARE_PRICE) / sharePrice;
}

/// @notice convert a number of shares to a balance
function _shares2balance(
uint256 shares,
uint256 sharePrice,
uint256 deltaBalance,
uint256 minBalance
) internal pure returns (uint256) {
uint256 rebasedBalance = (shares * sharePrice) /
START_REBASING_SHARE_PRICE +
deltaBalance;
if (rebasedBalance < minBalance) {
rebasedBalance = minBalance;
}
return rebasedBalance;
}

////////////////////////////////////////////////////////////////
EXTERNAL API
///////////////////////////////////////////////////////////////*/

/// @notice Enter rebasing supply. All subsequent distributions will increase the balance
/// of msg.sender proportionately.
function enterRebase() external {
require(
rebasingState[msg.sender].isRebasing == 0,
“ERC20RebaseDistributor: already rebasing”
);
_enterRebase(msg.sender);
}

function _enterRebase(address account) internal {
uint256 balance = ERC20.balanceOf(account);
uint256 currentRebasingSharePrice = rebasingSharePrice();
uint256 shares = _balance2shares(balance, currentRebasingSharePrice);
rebasingState[account] = RebasingState({
isRebasing: 1,
nShares: uint248(shares)
});
updateTotalRebasingShares(currentRebasingSharePrice, int256(shares));
emit RebaseEnter(account, block.timestamp);
}

/// @notice Exit rebasing supply. All unminted rebasing rewards are physically minted to the user,
/// and they won’t be affected by rebases anymore.
function exitRebase() external {
require(
rebasingState[msg.sender].isRebasing == 1,
“ERC20RebaseDistributor: not rebasing”
);
_exitRebase(msg.sender);
}

function _exitRebase(address account) internal {
uint256 rawBalance = ERC20.balanceOf(account);
RebasingState memory _rebasingState = rebasingState[account];
uint256 shares = uint256(_rebasingState.nShares);
uint256 currentRebasingSharePrice = rebasingSharePrice();
uint256 rebasedBalance = _shares2balance(
shares,
currentRebasingSharePrice,
0,
rawBalance
);
uint256 mintAmount = rebasedBalance - rawBalance;
if (mintAmount != 0) {
ERC20._mint(account, mintAmount);
decreaseUnmintedRebaseRewards(mintAmount);
emit RebaseReward(account, block.timestamp, mintAmount);
}

rebasingState[account] = RebasingState({isRebasing: 0, nShares: 0});
updateTotalRebasingShares(currentRebasingSharePrice, -int256(shares));

emit RebaseExit(account, block.timestamp);
}

/// @notice distribute tokens proportionately to all rebasing accounts.
/// @dev if no addresses are rebasing, calling this function will burn tokens
/// from msg.sender and emit an event, but won’t rebase up any balances.
function distribute(uint256 amount) external {
require(amount != 0, “ERC20RebaseDistributor: cannot distribute zero”);

// burn the tokens received
_burn(msg.sender, amount);

// emit event
uint256 _rebasingSharePrice = rebasingSharePrice();
uint256 _totalRebasingShares = totalRebasingShares;
uint256 _rebasingSupply = _shares2balance(
_totalRebasingShares,
_rebasingSharePrice,
0,
0
);
emit RebaseDistribution(
msg.sender,
block.timestamp,
amount,
_rebasingSupply
);

// adjust up the balance of all accounts that are rebasing by increasing
// the share price of rebasing tokens
if (_rebasingSupply != 0) {
// update rebasingSharePrice interpolation
uint256 endTimestamp = block.timestamp + DISTRIBUTION_PERIOD;
uint256 newTargetSharePrice = (amount
START_REBASING_SHARE_PRICE +
__rebasingSharePrice.targetValue
_totalRebasingShares) / _totalRebasingShares;
__rebasingSharePrice = InterpolatedValue({
lastTimestamp: SafeCastLib.safeCastTo32(block.timestamp),
lastValue: SafeCastLib.safeCastTo224(_rebasingSharePrice),
targetTimestamp: SafeCastLib.safeCastTo32(endTimestamp),
targetValue: SafeCastLib.safeCastTo224(newTargetSharePrice)
});

// update unmintedRebaseRewards interpolation
uint256 _unmintedRebaseRewards = unmintedRebaseRewards();
__unmintedRebaseRewards = InterpolatedValue({
lastTimestamp: SafeCastLib.safeCastTo32(block.timestamp),
lastValue: SafeCastLib.safeCastTo224(_unmintedRebaseRewards),
targetTimestamp: SafeCastLib.safeCastTo32(endTimestamp),
targetValue: __unmintedRebaseRewards.targetValue +
SafeCastLib.safeCastTo224(amount)
});
}
}

/// @notice True if an address subscribed to rebasing.
function isRebasing(address account) public view returns (bool) {
return rebasingState[account].isRebasing == 1;
}

/// @notice Total number of the tokens that are rebasing.
function rebasingSupply() public view returns (uint256) {
return _shares2balance(totalRebasingShares, rebasingSharePrice(), 0, 0);
}

/// @notice Total number of the tokens that are not rebasing.
function nonRebasingSupply() external view virtual returns (uint256) {
uint256 _totalSupply = totalSupply();
uint256 _rebasingSupply = rebasingSupply();

// compare rebasing supply to total supply :
// rounding errors due to share price & number of shares could otherwise
// make this function revert due to an underflow
if (_rebasingSupply > _totalSupply) {
return 0;
} else {
return _totalSupply - _rebasingSupply;
}
}

/// @notice get the number of distributed tokens that have not yet entered
/// circulation through rebase due to the interpolation of rewards over time.
function pendingDistributedSupply() external view returns (uint256) {
InterpolatedValue memory val = __unmintedRebaseRewards;
uint256 _unmintedRebaseRewards = interpolatedValue(val);
return __unmintedRebaseRewards.targetValue - _unmintedRebaseRewards;
}

////////////////////////////////////////////////////////////////
ERC20 OVERRIDE
////////////////////////////////////////////////////////////////

/// @notice Override of balanceOf() that takes into account the unminted rebase rewards.
function balanceOf(
address account
) public view virtual override returns (uint256) {
RebasingState memory _rebasingState = rebasingState[account];
if (_rebasingState.isRebasing == 0) {
return ERC20.balanceOf(account);
} else {
return
_shares2balance(
_rebasingState.nShares,
rebasingSharePrice(),
0,
ERC20.balanceOf(account)
);
}
}

/// @notice Total number of the tokens in existence.
function totalSupply() public view virtual override returns (uint256) {
return ERC20.totalSupply() + unmintedRebaseRewards();
}

/// @notice Target total number of the tokens in existence after interpolations
/// of rebase rewards will have completed.
/// @dev Equal to totalSupply() + pendingDistributedSupply().
function targetTotalSupply() external view returns (uint256) {
return ERC20.totalSupply() + __unmintedRebaseRewards.targetValue;
}

/// @notice Override of default ERC20 behavior: exit rebase before movement (if rebasing),
/// and re-enter rebasing after movement (if rebasing).
/// @dev for _burn(), _mint(), transfer(), and transferFrom() overrides, a naive
/// and concise implementation would be to just _exitRebase(), call the default ERC20 behavior,
/// and then _enterRebase(), on the 2 addresses affected by the movement, but this is highly gas
/// inefficient and the more complex implementations below are saving up to 40% gas costs.
function _burn(address account, uint256 amount) internal virtual override {
// if account is rebasing, materialize the tokens from rebase first, to ensure
// proper behavior in ERC20._burn().
RebasingState memory _rebasingState = rebasingState[account];
uint256 balanceBefore;
uint256 _rebasingSharePrice;
if (_rebasingState.isRebasing == 1) {
balanceBefore = ERC20.balanceOf(account);
_rebasingSharePrice = rebasingSharePrice();
uint256 rebasedBalance = _shares2balance(
_rebasingState.nShares,
_rebasingSharePrice,
0,
balanceBefore
);
uint256 mintAmount = rebasedBalance - balanceBefore;
if (mintAmount != 0) {
ERC20._mint(account, mintAmount);
balanceBefore += mintAmount;
decreaseUnmintedRebaseRewards(mintAmount);
emit RebaseReward(account, block.timestamp, mintAmount);
}
}

// do ERC20._burn()
ERC20._burn(account, amount);

// if account is rebasing, update its number of shares
if (_rebasingState.isRebasing == 1) {
uint256 balanceAfter = balanceBefore - amount;
uint256 sharesAfter = _balance2shares(
balanceAfter,
_rebasingSharePrice
);
uint256 sharesBurnt = _rebasingState.nShares - sharesAfter;
rebasingState[account] = RebasingState({
isRebasing: 1,
nShares: uint248(sharesAfter)
});
updateTotalRebasingShares(
_rebasingSharePrice,
-int256(sharesBurnt)
);
}
}

/// @notice Override of default ERC20 behavior: exit rebase before movement (if rebasing),
/// and re-enter rebasing after movement (if rebasing).
function _mint(address account, uint256 amount) internal virtual override {
// do ERC20._mint()
ERC20._mint(account, amount);

// if account is rebasing, update its number of shares
RebasingState memory _rebasingState = rebasingState[account];
if (_rebasingState.isRebasing == 1) {
// compute rebased balance
uint256 _rebasingSharePrice = rebasingSharePrice();
uint256 rawBalance = ERC20.balanceOf(account);
uint256 rebasedBalance = _shares2balance(
_rebasingState.nShares,
_rebasingSharePrice,
amount,
rawBalance
);

// update number of shares
uint256 sharesAfter = _balance2shares(
rebasedBalance,
_rebasingSharePrice
);
uint256 sharesReceived = sharesAfter - _rebasingState.nShares;
rebasingState[account] = RebasingState({
isRebasing: 1,
nShares: uint248(sharesAfter)
});
updateTotalRebasingShares(
_rebasingSharePrice,
int256(sharesReceived)
);

// “realize” unminted rebase rewards
uint256 mintAmount = rebasedBalance - rawBalance;
if (mintAmount != 0) {
ERC20._mint(account, mintAmount);
decreaseUnmintedRebaseRewards(mintAmount);
emit RebaseReward(account, block.timestamp, mintAmount);
}
}
}

/// @notice Override of default ERC20 behavior: exit rebase before movement (if rebasing),
/// and re-enter rebasing after movement (if rebasing).
function transfer(
address to,
uint256 amount
) public virtual override returns (bool) {
// if from is rebasing, materialize the tokens from rebase to ensure
// proper behavior in ERC20.transfer().
RebasingState memory rebasingStateFrom = rebasingState[msg.sender];
RebasingState memory rebasingStateTo = rebasingState[to];
uint256 fromBalanceBefore = ERC20.balanceOf(msg.sender);
uint256 _rebasingSharePrice = (rebasingStateFrom.isRebasing == 1 ||
rebasingStateTo.isRebasing == 1)
? rebasingSharePrice()
: 0; // only SLOAD if at least one address is rebasing
if (rebasingStateFrom.isRebasing == 1) {
uint256 shares = uint256(rebasingStateFrom.nShares);
uint256 rebasedBalance = _shares2balance(
shares,
_rebasingSharePrice,
0,
fromBalanceBefore
);
uint256 mintAmount = rebasedBalance - fromBalanceBefore;
if (mintAmount != 0) {
ERC20._mint(msg.sender, mintAmount);
fromBalanceBefore += mintAmount;
decreaseUnmintedRebaseRewards(mintAmount);
emit RebaseReward(msg.sender, block.timestamp, mintAmount);
}
}

// do ERC20.transfer()
bool success = ERC20.transfer(to, amount);

// if from is rebasing, update its number of shares
int256 sharesDelta;
if (rebasingStateFrom.isRebasing == 1) {
uint256 fromBalanceAfter = fromBalanceBefore - amount;
uint256 fromSharesAfter = _balance2shares(
fromBalanceAfter,
_rebasingSharePrice
);
uint256 sharesSpent = rebasingStateFrom.nShares - fromSharesAfter;
sharesDelta -= int256(sharesSpent);
rebasingState[msg.sender] = RebasingState({
isRebasing: 1,
nShares: uint248(fromSharesAfter)
});
}

// if to is rebasing, update its number of shares
if (rebasingStateTo.isRebasing == 1) {
// compute rebased balance
uint256 rawToBalanceAfter = ERC20.balanceOf(to);
uint256 toBalanceAfter = _shares2balance(
rebasingStateTo.nShares,
_rebasingSharePrice,
amount,
rawToBalanceAfter
);

// update number of shares
uint256 toSharesAfter = _balance2shares(
toBalanceAfter,
_rebasingSharePrice
);
uint256 sharesReceived = toSharesAfter - rebasingStateTo.nShares;
sharesDelta += int256(sharesReceived);
rebasingState[to] = RebasingState({
isRebasing: 1,
nShares: uint248(toSharesAfter)
});

// “realize” unminted rebase rewards
uint256 mintAmount = toBalanceAfter - rawToBalanceAfter;
if (mintAmount != 0) {
ERC20._mint(to, mintAmount);
decreaseUnmintedRebaseRewards(mintAmount);
emit RebaseReward(to, block.timestamp, mintAmount);
}
}

// if from or to was rebasing, update the total number of shares
if (
rebasingStateFrom.isRebasing == 1 || rebasingStateTo.isRebasing == 1
) {
updateTotalRebasingShares(_rebasingSharePrice, sharesDelta);
}

return success;
}

/// @notice Override of default ERC20 behavior: exit rebase before movement (if rebasing),
/// and re-enter rebasing after movement (if rebasing).
function transferFrom(
address from,
address to,
uint256 amount
) public virtual override returns (bool) {
// if from is rebasing, materialize the tokens from rebase to ensure
// proper behavior in ERC20.transfer().
RebasingState memory rebasingStateFrom = rebasingState[from];
RebasingState memory rebasingStateTo = rebasingState[to];
uint256 fromBalanceBefore = ERC20.balanceOf(from);
uint256 _rebasingSharePrice = (rebasingStateFrom.isRebasing == 1 ||
rebasingStateTo.isRebasing == 1)
? rebasingSharePrice()
: 0;
if (rebasingStateFrom.isRebasing == 1) {
uint256 shares = uint256(rebasingStateFrom.nShares);
uint256 rebasedBalance = _shares2balance(
shares,
_rebasingSharePrice,
0,
fromBalanceBefore
);
uint256 mintAmount = rebasedBalance - fromBalanceBefore;
if (mintAmount != 0) {
ERC20._mint(from, mintAmount);
fromBalanceBefore += mintAmount;
decreaseUnmintedRebaseRewards(mintAmount);
emit RebaseReward(from, block.timestamp, mintAmount);
}
}

// do ERC20.transferFrom()
bool success = ERC20.transferFrom(from, to, amount);

// if from is rebasing, update its number of shares
int256 sharesDelta;
if (rebasingStateFrom.isRebasing == 1) {
uint256 fromBalanceAfter = fromBalanceBefore - amount;
uint256 fromSharesAfter = _balance2shares(
fromBalanceAfter,
_rebasingSharePrice
);
uint256 sharesSpent = rebasingStateFrom.nShares - fromSharesAfter;
sharesDelta -= int256(sharesSpent);
rebasingState[from] = RebasingState({
isRebasing: 1,
nShares: uint248(fromSharesAfter)
});
}

// if to is rebasing, update its number of shares
if (rebasingStateTo.isRebasing == 1) {
// compute rebased balance
uint256 rawToBalanceAfter = ERC20.balanceOf(to);
uint256 toBalanceAfter = _shares2balance(
rebasingStateTo.nShares,
_rebasingSharePrice,
amount,
rawToBalanceAfter
);

// update number of shares
uint256 toSharesAfter = _balance2shares(
toBalanceAfter,
_rebasingSharePrice
);
uint256 sharesReceived = toSharesAfter - rebasingStateTo.nShares;
sharesDelta += int256(sharesReceived);
rebasingState[to] = RebasingState({
isRebasing: 1,
nShares: uint248(toSharesAfter)
});

// “realize” unminted rebase rewards
uint256 mintAmount = toBalanceAfter - rawToBalanceAfter;
if (mintAmount != 0) {
ERC20._mint(to, mintAmount);
decreaseUnmintedRebaseRewards(mintAmount);
emit RebaseReward(to, block.timestamp, mintAmount);
}
}

// if from or to was rebasing, update the total number of shares
if (
rebasingStateFrom.isRebasing == 1 || rebasingStateTo.isRebasing == 1
) {
updateTotalRebasingShares(_rebasingSharePrice, sharesDelta);
}

return success;
}
} in the function distribute is calculates a new share price based on the total amount of tokens being distributed and the total number of rebasing shares , in this rebasing logic can arise due to an incorrect share price calculation when rebasing shares are updated, particularly when a large amount of supply is concentrated within few accounts or if the rebasing supply drops to zero I see the problem is exactly is linked to the algorithm that computes the new share price and updates it over a 30-day distribution period let’s an attacker accumulates a large amount of the token and waits until they are one of the few (or the only) holders who have tokens in the rebasing state.

They then call distribute with a large number of tokens.
The newTargetSharePrice is calculated with an increased total due to the large amount, disproportionately increasing the attacker’s share price due to their significant rebasing share compared to others This line that calculates the new share price is this one https://github.com/code-423n4/2023-12-ethereumcreditguild/blob/2376d9af792584e3d15ec9c32578daa33bb56b43/src/tokens/ERC20RebaseDistributor.sol#L365 AND ALSO HERE __rebasingSharePrice = InterpolatedValue({
lastTimestamp: SafeCastLib.safeCastTo32(block.timestamp), // now
lastValue: SafeCastLib.safeCastTo224(currentRebasingSharePrice), // current value
targetTimestamp: val.targetTimestamp, // unchanged
targetValue: SafeCastLib.safeCastTo224(targetNewSharePrice) // adjusted target
}); The grief it’s happen when a very large amount of tokens are distributed, and the total number of rebasing shares is small. This could happen if a large number of tokens are concentrated in a few addresses, or if the rebasing supply drops to zero , In the distribute function If amount is very large compared to _totalRebasingShares, the new target share price will be significantly increased, which could disproportionately benefit the few addresses that hold a large amount of tokens or I miss understand something if the total supply of tokens is expected to be between 1e18 and 1e28, If the total supply is towards the higher end of this range, and the number of rebasing shares is small, the new target share price could be significantly increased, potentially leading to unfair distribution of tokens

The issue you’ve described involves a potential vulnerability in the way a rebase mechanism distributes tokens and adjusts share prices over a period. The key problem arises when the supply is highly concentrated in the hands of a few accounts, or if there is a drastic reduction in the rebasing supply (for instance, if it drops to zero). The function in question is distribute and particularly the line that calculates the new share price.

Here’s a closer look at the problem:

### Concentration of Tokens
If a single account or a few accounts hold a large portion of the rebasing shares and call distribute with a significant number of tokens, the calculation of the new target share price could favor these accounts disproportionately. The new share price is calculated based on the total amount being distributed in relation to the total rebasing shares. A large distribution with few rebasing shares would result in a substantial increase in share price.

### Distribution Mechanism
The distribution mechanism spreads the rewards over a 30-day period. As the price per share increases smoothly over this time, it means that early withdrawers (people who exit rebasing early) might not receive the full potential of their share compared to those who exit later, depending somewhat on the distribution of the entry and exit points of all participating accounts.

### Dropping to Zero Rebasing Supply
Another problem arises if the rebasing supply drops to zero. When this happens, there are no shares to rebase against, which means that despite tokens being burned from the sender, no active accounts benefit from the distribution at that moment since the share price increase updates an attribute (__rebasingSharePrice) that isn’t impacting anyone directly at that time. This could lead to a situation where the tokens are essentially burned without effectively distributing value to anyone else.

### Potential Solution Paths
To mitigate these kinds of attacks, the following mechanisms might be considered for implementation:

1. Checks on Distribution Amount: Implement checks or limits on the amount one can distribute relative to the number of rebasing shares or the total supply.

2. Minimum Rebasing Threshold: Ensure that there is always a minimum amount of supply in the rebasing pool to prevent the total rebasing shares from dropping to zero and to deter concentration of power.

3. Sliding Window or Decay Rate: Alter the share price update logic to include a sliding window or decay rate so that large distributions don’t disproportionately affect the share price or benefit large holders unevenly.

4. Cap on Rewards: Place a cap on the maximum increase in share price due to a single distribution event.

5. Distribution Curve Alteration: Adjust the distribution curve to consider the time elapsed and the number of rebasing shares at each point, making the curve dynamic based on current state variables.

6. Governance and Multi-Sig: In some cases, adding governance or multi-signature requirements to large distributions can prevent abuse by requiring more consensus.

It’s important that these or other mitigation mechanisms are explored and, ideally, simulated or formally verified to ensure they handle edge cases effectively and do not introduce further vulnerabilities.
give an example of the values and write a PoC ?
To illustrate the vulnerability and create a Proof of Concept (PoC), let’s go step-by-step through an example scenario.

### Initial Assumptions:

- We’ll assume that there are initially 1e28 (10,000,000,000,000,000,000,000,000,000) tokens in total supply.
- The totalRebasingShares is small, say 100 (very few accounts opted for rebasing).
- The attacker controls 90 of the 100 rebasing shares.

### Scenario:

The attacker calls distribute with a large amount. For simplicity, let’s say they distribute 1e26 (100,000,000,000,000,000,000,000,000) tokens.

### Current State Before Attack:

- totalRebasingShares: 100
- The attacker’s shares: 90
- START_REBASING_SHARE_PRICE: 1e30
- The current share price (oldSharePrice): 1e30

### Calculations During Attack:


// Simplified version directly from the code
amount = 1e26;
_totalRebasingShares = 100;
__rebasingSharePrice.targetValue = 1e30; // For example

newTargetSharePrice = (amount * START_REBASING_SHARE_PRICE + (__rebasingSharePrice.targetValue * _totalRebasingShares)) / _totalRebasingShares;



### Simplified PoC:

The PoC won’t be a full code implementation due to complexity and dependencies but will follow the mathematical logic to compute what would happen during the attack:


uint256 amount = 1e26;
uint256 _totalRebasingShares = 100;
uint256 oldTargetSharePrice = 1e30;

uint256 newTargetSharePrice = (amount * 1e30 + (oldTargetSharePrice * _totalRebasingShares)) / _totalRebasingShares;
// This simplifies to:
// newTargetSharePrice = (1e26 * 1e30 + 100 * 1e30) / 100;
// newTargetSharePrice = (1e26 + 1) * 1e30;
// newTargetSharePrice ≈ 1e56;

// Remember that the attacker controls 90 shares.
// So the new total value held by attacker after the attack can be approximated as:
uint256 attackerValue = 90 * newTargetSharePrice / 1e30;
// => attackerValue ≈ 90 * 1e26;
// => attackerValue ≈ 9e27;

// The new rebasing supply after the attack is the same as
// attackerValue plus the value of the remaining rebasing shares:
uint256 newRebasingSupply = attackerValue + (10 * oldTargetSharePrice / 1e30);
// => newRebasingSupply ≈ 9e27 + 10 * 1e30 / 1e30;
// => newRebasingSupply ≈ 9e27 + 10;
// => newRebasingSupply ≈ 9e27;

// Notice that the rebasing supply has increased drastically, almost entirely to the benefit of the attacker.



### Conclusion of PoC:

As indicated by the simplified PoC, the attacker ends up with a rebased balance of approximately 9e27, which is significantly higher because they distributed a gargantuan amount of tokens relative to a small rebasing share count.

This example demonstrates how the attacker can game the system by waiting until they hold a significant majority of the rebasing shares and then calling distribute with a large token amount. The calculation of newTargetSharePrice significantly increases their share price unfairly, at a detriment to smaller shareholders. This could be considered a kind of economic attack.

Please note that this is a theoretical example and a simplified PoC to illustrate the vulnerability. Actual code execution would involve more checks, event emissions, and interactions with the blockchain state.
give PoC won’t be a full code fic the poc and give full po c as Foundry test below demonstrates that the vulnerbaility is correct aand valid and give the command that be run with