stake - [mainnet]

inline fun check_stake_permission(s: &signer) {
    assert!(
        permissioned_signer::check_permission_exists(s, StakeManagementPermission {}),
        error::permission_denied(ENO_STAKE_PERMISSION),
    );
}

public fun grant_permission(master: &signer, permissioned_signer: &signer) {
    permissioned_signer::authorize_unlimited(master, permissioned_signer, StakeManagementPermission {})
}

public fun get_lockup_secs(pool_address: address): u64 acquires StakePool {
    assert_stake_pool_exists(pool_address);
    borrow_global<StakePool>(pool_address).locked_until_secs
}

public fun get_remaining_lockup_secs(pool_address: address): u64 acquires StakePool {
    assert_stake_pool_exists(pool_address);
    let lockup_time = borrow_global<StakePool>(pool_address).locked_until_secs;
    if (lockup_time <= timestamp::now_seconds()) {
        0
    } else {
        lockup_time - timestamp::now_seconds()
    }
}

public fun get_stake(pool_address: address): (u64, u64, u64, u64) acquires StakePool {
    assert_stake_pool_exists(pool_address);
    let stake_pool = borrow_global<StakePool>(pool_address);
    (
        coin::value(&stake_pool.active),
        coin::value(&stake_pool.inactive),
        coin::value(&stake_pool.pending_active),
        coin::value(&stake_pool.pending_inactive),
    )
}

public fun get_validator_state(pool_address: address): u64 acquires ValidatorSet {
    let validator_set = borrow_global<ValidatorSet>(@aptos_framework);
    if (option::is_some(&find_validator(&validator_set.pending_active, pool_address))) {
        VALIDATOR_STATUS_PENDING_ACTIVE
    } else if (option::is_some(&find_validator(&validator_set.active_validators, pool_address))) {
        VALIDATOR_STATUS_ACTIVE
    } else if (option::is_some(&find_validator(&validator_set.pending_inactive, pool_address))) {
        VALIDATOR_STATUS_PENDING_INACTIVE
    } else {
        VALIDATOR_STATUS_INACTIVE
    }
}

public fun get_current_epoch_voting_power(pool_address: address): u64 acquires StakePool, ValidatorSet {
    assert_stake_pool_exists(pool_address);
    let validator_state = get_validator_state(pool_address);
    // Both active and pending inactive validators can still vote in the current epoch.
    if (validator_state == VALIDATOR_STATUS_ACTIVE || validator_state == VALIDATOR_STATUS_PENDING_INACTIVE) {
        let active_stake = coin::value(&borrow_global<StakePool>(pool_address).active);
        let pending_inactive_stake = coin::value(&borrow_global<StakePool>(pool_address).pending_inactive);
        active_stake + pending_inactive_stake
    } else {
        0
    }
}

public fun get_delegated_voter(pool_address: address): address acquires StakePool {
    assert_stake_pool_exists(pool_address);
    borrow_global<StakePool>(pool_address).delegated_voter
}

public fun get_operator(pool_address: address): address acquires StakePool {
    assert_stake_pool_exists(pool_address);
    borrow_global<StakePool>(pool_address).operator_address
}

public fun get_owned_pool_address(owner_cap: &OwnerCapability): address {
    owner_cap.pool_address
}

public fun get_validator_index(pool_address: address): u64 acquires ValidatorConfig {
    assert_stake_pool_exists(pool_address);
    borrow_global<ValidatorConfig>(pool_address).validator_index
}

public fun get_current_epoch_proposal_counts(validator_index: u64): (u64, u64) acquires ValidatorPerformance {
    let validator_performances = &borrow_global<ValidatorPerformance>(@aptos_framework).validators;
    let validator_performance = vector::borrow(validator_performances, validator_index);
    (validator_performance.successful_proposals, validator_performance.failed_proposals)
}

public fun get_validator_config(
    pool_address: address
): (vector<u8>, vector<u8>, vector<u8>) acquires ValidatorConfig {
    assert_stake_pool_exists(pool_address);
    let validator_config = borrow_global<ValidatorConfig>(pool_address);
    (validator_config.consensus_pubkey, validator_config.network_addresses, validator_config.fullnode_addresses)
}

public fun stake_pool_exists(addr: address): bool {
    exists<StakePool>(addr)
}

public(friend) fun initialize(aptos_framework: &signer) {
    system_addresses::assert_aptos_framework(aptos_framework);

    move_to(aptos_framework, ValidatorSet {
        consensus_scheme: 0,
        active_validators: vector::empty(),
        pending_active: vector::empty(),
        pending_inactive: vector::empty(),
        total_voting_power: 0,
        total_joining_power: 0,
    });

    move_to(aptos_framework, ValidatorPerformance {
        validators: vector::empty(),
    });
}

public(friend) fun store_aptos_coin_mint_cap(aptos_framework: &signer, mint_cap: MintCapability<AptosCoin>) {
    system_addresses::assert_aptos_framework(aptos_framework);
    move_to(aptos_framework, AptosCoinCapabilities { mint_cap })
}

public fun remove_validators(
    aptos_framework: &signer,
    validators: &vector<address>,
) acquires ValidatorSet {
    assert_reconfig_not_in_progress();
    system_addresses::assert_aptos_framework(aptos_framework);
    let validator_set = borrow_global_mut<ValidatorSet>(@aptos_framework);
    let active_validators = &mut validator_set.active_validators;
    let pending_inactive = &mut validator_set.pending_inactive;
    spec {
        update ghost_active_num = len(active_validators);
        update ghost_pending_inactive_num = len(pending_inactive);
    };
    let len_validators = vector::length(validators);
    let i = 0;
    // Remove each validator from the validator set.
    while ({
        spec {
            invariant i <= len_validators;
            invariant spec_validators_are_initialized(active_validators);
            invariant spec_validator_indices_are_valid(active_validators);
            invariant spec_validators_are_initialized(pending_inactive);
            invariant spec_validator_indices_are_valid(pending_inactive);
            invariant ghost_active_num + ghost_pending_inactive_num == len(active_validators) + len(pending_inactive);
        };
        i < len_validators
    }) {
        let validator = *vector::borrow(validators, i);
        let validator_index = find_validator(active_validators, validator);
        if (option::is_some(&validator_index)) {
            let validator_info = vector::swap_remove(active_validators, *option::borrow(&validator_index));
            vector::push_back(pending_inactive, validator_info);
            spec {
                update ghost_active_num = ghost_active_num - 1;
                update ghost_pending_inactive_num = ghost_pending_inactive_num + 1;
            };
        };
        i = i + 1;
    };
}

public entry fun initialize_stake_owner(
    owner: &signer,
    initial_stake_amount: u64,
    operator: address,
    voter: address,
) acquires AllowedValidators, OwnerCapability, StakePool, ValidatorSet {
    check_stake_permission(owner);
    initialize_owner(owner);
    move_to(owner, ValidatorConfig {
        consensus_pubkey: vector::empty(),
        network_addresses: vector::empty(),
        fullnode_addresses: vector::empty(),
        validator_index: 0,
    });

    if (initial_stake_amount > 0) {
        add_stake(owner, initial_stake_amount);
    };

    let account_address = signer::address_of(owner);
    if (account_address != operator) {
        set_operator(owner, operator)
    };
    if (account_address != voter) {
        set_delegated_voter(owner, voter)
    };
}

public entry fun initialize_validator(
    account: &signer,
    consensus_pubkey: vector<u8>,
    proof_of_possession: vector<u8>,
    network_addresses: vector<u8>,
    fullnode_addresses: vector<u8>,
) acquires AllowedValidators {
    check_stake_permission(account);
    // Checks the public key has a valid proof-of-possession to prevent rogue-key attacks.
    let pubkey_from_pop = &bls12381::public_key_from_bytes_with_pop(
        consensus_pubkey,
        &proof_of_possession_from_bytes(proof_of_possession)
    );
    assert!(option::is_some(pubkey_from_pop), error::invalid_argument(EINVALID_PUBLIC_KEY));

    initialize_owner(account);
    move_to(account, ValidatorConfig {
        consensus_pubkey,
        network_addresses,
        fullnode_addresses,
        validator_index: 0,
    });
}

fun initialize_owner(owner: &signer) acquires AllowedValidators {
    check_stake_permission(owner);
    let owner_address = signer::address_of(owner);
    assert!(is_allowed(owner_address), error::not_found(EINELIGIBLE_VALIDATOR));
    assert!(!stake_pool_exists(owner_address), error::already_exists(EALREADY_REGISTERED));

    move_to(owner, StakePool {
        active: coin::zero<AptosCoin>(),
        pending_active: coin::zero<AptosCoin>(),
        pending_inactive: coin::zero<AptosCoin>(),
        inactive: coin::zero<AptosCoin>(),
        locked_until_secs: 0,
        operator_address: owner_address,
        delegated_voter: owner_address,
        // Events.
        initialize_validator_events: account::new_event_handle<RegisterValidatorCandidateEvent>(owner),
        set_operator_events: account::new_event_handle<SetOperatorEvent>(owner),
        add_stake_events: account::new_event_handle<AddStakeEvent>(owner),
        reactivate_stake_events: account::new_event_handle<ReactivateStakeEvent>(owner),
        rotate_consensus_key_events: account::new_event_handle<RotateConsensusKeyEvent>(owner),
        update_network_and_fullnode_addresses_events: account::new_event_handle<UpdateNetworkAndFullnodeAddressesEvent>(
            owner
        ),
        increase_lockup_events: account::new_event_handle<IncreaseLockupEvent>(owner),
        join_validator_set_events: account::new_event_handle<JoinValidatorSetEvent>(owner),
        distribute_rewards_events: account::new_event_handle<DistributeRewardsEvent>(owner),
        unlock_stake_events: account::new_event_handle<UnlockStakeEvent>(owner),
        withdraw_stake_events: account::new_event_handle<WithdrawStakeEvent>(owner),
        leave_validator_set_events: account::new_event_handle<LeaveValidatorSetEvent>(owner),
    });

    move_to(owner, OwnerCapability { pool_address: owner_address });
}

public fun extract_owner_cap(owner: &signer): OwnerCapability acquires OwnerCapability {
    check_stake_permission(owner);
    let owner_address = signer::address_of(owner);
    assert_owner_cap_exists(owner_address);
    move_from<OwnerCapability>(owner_address)
}

public fun deposit_owner_cap(owner: &signer, owner_cap: OwnerCapability) {
    check_stake_permission(owner);
    assert!(!exists<OwnerCapability>(signer::address_of(owner)), error::not_found(EOWNER_CAP_ALREADY_EXISTS));
    move_to(owner, owner_cap);
}

public fun destroy_owner_cap(owner_cap: OwnerCapability) {
    let OwnerCapability { pool_address: _ } = owner_cap;
}

public entry fun set_operator(owner: &signer, new_operator: address) acquires OwnerCapability, StakePool {
    check_stake_permission(owner);
    let owner_address = signer::address_of(owner);
    assert_owner_cap_exists(owner_address);
    let ownership_cap = borrow_global<OwnerCapability>(owner_address);
    set_operator_with_cap(ownership_cap, new_operator);
}

public fun set_operator_with_cap(owner_cap: &OwnerCapability, new_operator: address) acquires StakePool {
    let pool_address = owner_cap.pool_address;
    assert_stake_pool_exists(pool_address);
    let stake_pool = borrow_global_mut<StakePool>(pool_address);
    let old_operator = stake_pool.operator_address;
    stake_pool.operator_address = new_operator;

    if (std::features::module_event_migration_enabled()) {
        event::emit(
            SetOperator {
                pool_address,
                old_operator,
                new_operator,
            },
        );
    } else {
        event::emit_event(
            &mut stake_pool.set_operator_events,
            SetOperatorEvent {
                pool_address,
                old_operator,
                new_operator,
            },
        );
    };
}

public entry fun set_delegated_voter(owner: &signer, new_voter: address) acquires OwnerCapability, StakePool {
    check_stake_permission(owner);
    let owner_address = signer::address_of(owner);
    assert_owner_cap_exists(owner_address);
    let ownership_cap = borrow_global<OwnerCapability>(owner_address);
    set_delegated_voter_with_cap(ownership_cap, new_voter);
}

public fun set_delegated_voter_with_cap(owner_cap: &OwnerCapability, new_voter: address) acquires StakePool {
    let pool_address = owner_cap.pool_address;
    assert_stake_pool_exists(pool_address);
    let stake_pool = borrow_global_mut<StakePool>(pool_address);
    stake_pool.delegated_voter = new_voter;
}

public entry fun add_stake(owner: &signer, amount: u64) acquires OwnerCapability, StakePool, ValidatorSet {
    check_stake_permission(owner);
    let owner_address = signer::address_of(owner);
    assert_owner_cap_exists(owner_address);
    let ownership_cap = borrow_global<OwnerCapability>(owner_address);
    add_stake_with_cap(ownership_cap, coin::withdraw<AptosCoin>(owner, amount));
}

public fun add_stake_with_cap(owner_cap: &OwnerCapability, coins: Coin<AptosCoin>) acquires StakePool, ValidatorSet {
    assert_reconfig_not_in_progress();
    let pool_address = owner_cap.pool_address;
    assert_stake_pool_exists(pool_address);

    let amount = coin::value(&coins);
    if (amount == 0) {
        coin::destroy_zero(coins);
        return
    };

    // Only track and validate voting power increase for active and pending_active validator.
    // Pending_inactive validator will be removed from the validator set in the next epoch.
    // Inactive validator's total stake will be tracked when they join the validator set.
    let validator_set = borrow_global<ValidatorSet>(@aptos_framework);
    // Search directly rather using get_validator_state to save on unnecessary loops.
    if (option::is_some(&find_validator(&validator_set.active_validators, pool_address)) ||
        option::is_some(&find_validator(&validator_set.pending_active, pool_address))) {
        update_voting_power_increase(amount);
    };

    // Add to pending_active if it's a current validator because the stake is not counted until the next epoch.
    // Otherwise, the delegation can be added to active directly as the validator is also activated in the epoch.
    let stake_pool = borrow_global_mut<StakePool>(pool_address);
    if (is_current_epoch_validator(pool_address)) {
        coin::merge<AptosCoin>(&mut stake_pool.pending_active, coins);
    } else {
        coin::merge<AptosCoin>(&mut stake_pool.active, coins);
    };

    let (_, maximum_stake) = staking_config::get_required_stake(&staking_config::get());
    let voting_power = get_next_epoch_voting_power(stake_pool);
    assert!(voting_power <= maximum_stake, error::invalid_argument(ESTAKE_EXCEEDS_MAX));

    if (std::features::module_event_migration_enabled()) {
        event::emit(
            AddStake {
                pool_address,
                amount_added: amount,
            },
        );
    } else {
        event::emit_event(
            &mut stake_pool.add_stake_events,
            AddStakeEvent {
                pool_address,
                amount_added: amount,
            },
        );
    };
}

public entry fun reactivate_stake(owner: &signer, amount: u64) acquires OwnerCapability, StakePool {
    check_stake_permission(owner);
    assert_reconfig_not_in_progress();
    let owner_address = signer::address_of(owner);
    assert_owner_cap_exists(owner_address);
    let ownership_cap = borrow_global<OwnerCapability>(owner_address);
    reactivate_stake_with_cap(ownership_cap, amount);
}

public fun reactivate_stake_with_cap(owner_cap: &OwnerCapability, amount: u64) acquires StakePool {
    assert_reconfig_not_in_progress();
    let pool_address = owner_cap.pool_address;
    assert_stake_pool_exists(pool_address);

    // Cap the amount to reactivate by the amount in pending_inactive.
    let stake_pool = borrow_global_mut<StakePool>(pool_address);
    let total_pending_inactive = coin::value(&stake_pool.pending_inactive);
    amount = min(amount, total_pending_inactive);

    // Since this does not count as a voting power change (pending inactive still counts as voting power in the
    // current epoch), stake can be immediately moved from pending inactive to active.
    // We also don't need to check voting power increase as there's none.
    let reactivated_coins = coin::extract(&mut stake_pool.pending_inactive, amount);
    coin::merge(&mut stake_pool.active, reactivated_coins);

    if (std::features::module_event_migration_enabled()) {
        event::emit(
            ReactivateStake {
                pool_address,
                amount,
            },
        );
    } else {
        event::emit_event(
            &mut stake_pool.reactivate_stake_events,
            ReactivateStakeEvent {
                pool_address,
                amount,
            },
        );
    };
}

public entry fun rotate_consensus_key(
    operator: &signer,
    pool_address: address,
    new_consensus_pubkey: vector<u8>,
    proof_of_possession: vector<u8>,
) acquires StakePool, ValidatorConfig {
    check_stake_permission(operator);
    assert_reconfig_not_in_progress();
    assert_stake_pool_exists(pool_address);

    let stake_pool = borrow_global_mut<StakePool>(pool_address);
    assert!(signer::address_of(operator) == stake_pool.operator_address, error::unauthenticated(ENOT_OPERATOR));

    assert!(exists<ValidatorConfig>(pool_address), error::not_found(EVALIDATOR_CONFIG));
    let validator_info = borrow_global_mut<ValidatorConfig>(pool_address);
    let old_consensus_pubkey = validator_info.consensus_pubkey;
    // Checks the public key has a valid proof-of-possession to prevent rogue-key attacks.
    let pubkey_from_pop = &bls12381::public_key_from_bytes_with_pop(
        new_consensus_pubkey,
        &proof_of_possession_from_bytes(proof_of_possession)
    );
    assert!(option::is_some(pubkey_from_pop), error::invalid_argument(EINVALID_PUBLIC_KEY));
    validator_info.consensus_pubkey = new_consensus_pubkey;

    if (std::features::module_event_migration_enabled()) {
        event::emit(
            RotateConsensusKey {
                pool_address,
                old_consensus_pubkey,
                new_consensus_pubkey,
            },
        );
    } else {
        event::emit_event(
            &mut stake_pool.rotate_consensus_key_events,
            RotateConsensusKeyEvent {
                pool_address,
                old_consensus_pubkey,
                new_consensus_pubkey,
            },
        );
    };
}

public entry fun update_network_and_fullnode_addresses(
    operator: &signer,
    pool_address: address,
    new_network_addresses: vector<u8>,
    new_fullnode_addresses: vector<u8>,
) acquires StakePool, ValidatorConfig {
    check_stake_permission(operator);
    assert_reconfig_not_in_progress();
    assert_stake_pool_exists(pool_address);
    let stake_pool = borrow_global_mut<StakePool>(pool_address);
    assert!(signer::address_of(operator) == stake_pool.operator_address, error::unauthenticated(ENOT_OPERATOR));
    assert!(exists<ValidatorConfig>(pool_address), error::not_found(EVALIDATOR_CONFIG));
    let validator_info = borrow_global_mut<ValidatorConfig>(pool_address);
    let old_network_addresses = validator_info.network_addresses;
    validator_info.network_addresses = new_network_addresses;
    let old_fullnode_addresses = validator_info.fullnode_addresses;
    validator_info.fullnode_addresses = new_fullnode_addresses;

    if (std::features::module_event_migration_enabled()) {
        event::emit(
            UpdateNetworkAndFullnodeAddresses {
                pool_address,
                old_network_addresses,
                new_network_addresses,
                old_fullnode_addresses,
                new_fullnode_addresses,
            },
        );
    } else {
        event::emit_event(
            &mut stake_pool.update_network_and_fullnode_addresses_events,
            UpdateNetworkAndFullnodeAddressesEvent {
                pool_address,
                old_network_addresses,
                new_network_addresses,
                old_fullnode_addresses,
                new_fullnode_addresses,
            },
        );
    };
}

public entry fun increase_lockup(owner: &signer) acquires OwnerCapability, StakePool {
    check_stake_permission(owner);
    let owner_address = signer::address_of(owner);
    assert_owner_cap_exists(owner_address);
    let ownership_cap = borrow_global<OwnerCapability>(owner_address);
    increase_lockup_with_cap(ownership_cap);
}

public fun increase_lockup_with_cap(owner_cap: &OwnerCapability) acquires StakePool {
    let pool_address = owner_cap.pool_address;
    assert_stake_pool_exists(pool_address);
    let config = staking_config::get();

    let stake_pool = borrow_global_mut<StakePool>(pool_address);
    let old_locked_until_secs = stake_pool.locked_until_secs;
    let new_locked_until_secs = timestamp::now_seconds() + staking_config::get_recurring_lockup_duration(&config);
    assert!(old_locked_until_secs < new_locked_until_secs, error::invalid_argument(EINVALID_LOCKUP));
    stake_pool.locked_until_secs = new_locked_until_secs;

    if (std::features::module_event_migration_enabled()) {
        event::emit(
            IncreaseLockup {
                pool_address,
                old_locked_until_secs,
                new_locked_until_secs,
            },
        );
    } else {
        event::emit_event(
            &mut stake_pool.increase_lockup_events,
            IncreaseLockupEvent {
                pool_address,
                old_locked_until_secs,
                new_locked_until_secs,
            },
        );
    }
}

public entry fun join_validator_set(
    operator: &signer,
    pool_address: address
) acquires StakePool, ValidatorConfig, ValidatorSet {
    check_stake_permission(operator);
    assert!(
        staking_config::get_allow_validator_set_change(&staking_config::get()),
        error::invalid_argument(ENO_POST_GENESIS_VALIDATOR_SET_CHANGE_ALLOWED),
    );

    join_validator_set_internal(operator, pool_address);
}

public(friend) fun join_validator_set_internal(
    operator: &signer,
    pool_address: address
) acquires StakePool, ValidatorConfig, ValidatorSet {
    assert_reconfig_not_in_progress();
    assert_stake_pool_exists(pool_address);
    let stake_pool = borrow_global_mut<StakePool>(pool_address);
    assert!(signer::address_of(operator) == stake_pool.operator_address, error::unauthenticated(ENOT_OPERATOR));
    assert!(
        get_validator_state(pool_address) == VALIDATOR_STATUS_INACTIVE,
        error::invalid_state(EALREADY_ACTIVE_VALIDATOR),
    );

    let config = staking_config::get();
    let (minimum_stake, maximum_stake) = staking_config::get_required_stake(&config);
    let voting_power = get_next_epoch_voting_power(stake_pool);
    assert!(voting_power >= minimum_stake, error::invalid_argument(ESTAKE_TOO_LOW));
    assert!(voting_power <= maximum_stake, error::invalid_argument(ESTAKE_TOO_HIGH));

    // Track and validate voting power increase.
    update_voting_power_increase(voting_power);

    // Add validator to pending_active, to be activated in the next epoch.
    let validator_config = borrow_global<ValidatorConfig>(pool_address);
    assert!(!vector::is_empty(&validator_config.consensus_pubkey), error::invalid_argument(EINVALID_PUBLIC_KEY));

    // Validate the current validator set size has not exceeded the limit.
    let validator_set = borrow_global_mut<ValidatorSet>(@aptos_framework);
    vector::push_back(
        &mut validator_set.pending_active,
        generate_validator_info(pool_address, stake_pool, *validator_config)
    );
    let validator_set_size = vector::length(&validator_set.active_validators) + vector::length(
        &validator_set.pending_active
    );
    assert!(validator_set_size <= MAX_VALIDATOR_SET_SIZE, error::invalid_argument(EVALIDATOR_SET_TOO_LARGE));

    if (std::features::module_event_migration_enabled()) {
        event::emit(JoinValidatorSet { pool_address });
    } else {
        event::emit_event(
            &mut stake_pool.join_validator_set_events,
            JoinValidatorSetEvent { pool_address },
        );
    }
}

public entry fun unlock(owner: &signer, amount: u64) acquires OwnerCapability, StakePool {
    check_stake_permission(owner);
    assert_reconfig_not_in_progress();
    let owner_address = signer::address_of(owner);
    assert_owner_cap_exists(owner_address);
    let ownership_cap = borrow_global<OwnerCapability>(owner_address);
    unlock_with_cap(amount, ownership_cap);
}

public fun unlock_with_cap(amount: u64, owner_cap: &OwnerCapability) acquires StakePool {
    assert_reconfig_not_in_progress();
    // Short-circuit if amount to unlock is 0 so we don't emit events.
    if (amount == 0) {
        return
    };

    // Unlocked coins are moved to pending_inactive. When the current lockup cycle expires, they will be moved into
    // inactive in the earliest possible epoch transition.
    let pool_address = owner_cap.pool_address;
    assert_stake_pool_exists(pool_address);
    let stake_pool = borrow_global_mut<StakePool>(pool_address);
    // Cap amount to unlock by maximum active stake.
    let amount = min(amount, coin::value(&stake_pool.active));
    let unlocked_stake = coin::extract(&mut stake_pool.active, amount);
    coin::merge<AptosCoin>(&mut stake_pool.pending_inactive, unlocked_stake);

    if (std::features::module_event_migration_enabled()) {
        event::emit(
            UnlockStake {
                pool_address,
                amount_unlocked: amount,
            },
        );
    } else {
        event::emit_event(
            &mut stake_pool.unlock_stake_events,
            UnlockStakeEvent {
                pool_address,
                amount_unlocked: amount,
            },
        );
    };
}

public entry fun withdraw(
    owner: &signer,
    withdraw_amount: u64
) acquires OwnerCapability, StakePool, ValidatorSet {
    check_stake_permission(owner);
    let owner_address = signer::address_of(owner);
    assert_owner_cap_exists(owner_address);
    let ownership_cap = borrow_global<OwnerCapability>(owner_address);
    let coins = withdraw_with_cap(ownership_cap, withdraw_amount);
    coin::deposit<AptosCoin>(owner_address, coins);
}

public fun withdraw_with_cap(
    owner_cap: &OwnerCapability,
    withdraw_amount: u64
): Coin<AptosCoin> acquires StakePool, ValidatorSet {
    assert_reconfig_not_in_progress();
    let pool_address = owner_cap.pool_address;
    assert_stake_pool_exists(pool_address);
    let stake_pool = borrow_global_mut<StakePool>(pool_address);
    // There's an edge case where a validator unlocks their stake and leaves the validator set before
    // the stake is fully unlocked (the current lockup cycle has not expired yet).
    // This can leave their stake stuck in pending_inactive even after the current lockup cycle expires.
    if (get_validator_state(pool_address) == VALIDATOR_STATUS_INACTIVE &&
        timestamp::now_seconds() >= stake_pool.locked_until_secs) {
        let pending_inactive_stake = coin::extract_all(&mut stake_pool.pending_inactive);
        coin::merge(&mut stake_pool.inactive, pending_inactive_stake);
    };

    // Cap withdraw amount by total inactive coins.
    withdraw_amount = min(withdraw_amount, coin::value(&stake_pool.inactive));
    if (withdraw_amount == 0) return coin::zero<AptosCoin>();

    if (std::features::module_event_migration_enabled()) {
        event::emit(
            WithdrawStake {
                pool_address,
                amount_withdrawn: withdraw_amount,
            },
        );
    } else {
        event::emit_event(
            &mut stake_pool.withdraw_stake_events,
            WithdrawStakeEvent {
                pool_address,
                amount_withdrawn: withdraw_amount,
            },
        );
    };

    coin::extract(&mut stake_pool.inactive, withdraw_amount)
}

public entry fun leave_validator_set(
    operator: &signer,
    pool_address: address
) acquires StakePool, ValidatorSet {
    check_stake_permission(operator);
    assert_reconfig_not_in_progress();
    let config = staking_config::get();
    assert!(
        staking_config::get_allow_validator_set_change(&config),
        error::invalid_argument(ENO_POST_GENESIS_VALIDATOR_SET_CHANGE_ALLOWED),
    );

    assert_stake_pool_exists(pool_address);
    let stake_pool = borrow_global_mut<StakePool>(pool_address);
    // Account has to be the operator.
    assert!(signer::address_of(operator) == stake_pool.operator_address, error::unauthenticated(ENOT_OPERATOR));

    let validator_set = borrow_global_mut<ValidatorSet>(@aptos_framework);
    // If the validator is still pending_active, directly kick the validator out.
    let maybe_pending_active_index = find_validator(&validator_set.pending_active, pool_address);
    if (option::is_some(&maybe_pending_active_index)) {
        vector::swap_remove(
            &mut validator_set.pending_active, option::extract(&mut maybe_pending_active_index));

        // Decrease the voting power increase as the pending validator's voting power was added when they requested
        // to join. Now that they changed their mind, their voting power should not affect the joining limit of this
        // epoch.
        let validator_stake = (get_next_epoch_voting_power(stake_pool) as u128);
        // total_joining_power should be larger than validator_stake but just in case there has been a small
        // rounding error somewhere that can lead to an underflow, we still want to allow this transaction to
        // succeed.
        if (validator_set.total_joining_power > validator_stake) {
            validator_set.total_joining_power = validator_set.total_joining_power - validator_stake;
        } else {
            validator_set.total_joining_power = 0;
        };
    } else {
        // Validate that the validator is already part of the validator set.
        let maybe_active_index = find_validator(&validator_set.active_validators, pool_address);
        assert!(option::is_some(&maybe_active_index), error::invalid_state(ENOT_VALIDATOR));
        let validator_info = vector::swap_remove(
            &mut validator_set.active_validators, option::extract(&mut maybe_active_index));
        assert!(vector::length(&validator_set.active_validators) > 0, error::invalid_state(ELAST_VALIDATOR));
        vector::push_back(&mut validator_set.pending_inactive, validator_info);

        if (std::features::module_event_migration_enabled()) {
            event::emit(LeaveValidatorSet { pool_address });
        } else {
            event::emit_event(
                &mut stake_pool.leave_validator_set_events,
                LeaveValidatorSetEvent {
                    pool_address,
                },
            );
        };
    };
}

public fun is_current_epoch_validator(pool_address: address): bool acquires ValidatorSet {
    assert_stake_pool_exists(pool_address);
    let validator_state = get_validator_state(pool_address);
    validator_state == VALIDATOR_STATUS_ACTIVE || validator_state == VALIDATOR_STATUS_PENDING_INACTIVE
}

public(friend) fun update_performance_statistics(
    proposer_index: Option<u64>,
    failed_proposer_indices: vector<u64>
) acquires ValidatorPerformance {
    // Validator set cannot change until the end of the epoch, so the validator index in arguments should
    // match with those of the validators in ValidatorPerformance resource.
    let validator_perf = borrow_global_mut<ValidatorPerformance>(@aptos_framework);
    let validator_len = vector::length(&validator_perf.validators);

    spec {
        update ghost_valid_perf = validator_perf;
        update ghost_proposer_idx = proposer_index;
    };
    // proposer_index is an option because it can be missing (for NilBlocks)
    if (option::is_some(&proposer_index)) {
        let cur_proposer_index = option::extract(&mut proposer_index);
        // Here, and in all other vector::borrow, skip any validator indices that are out of bounds,
        // this ensures that this function doesn't abort if there are out of bounds errors.
        if (cur_proposer_index < validator_len) {
            let validator = vector::borrow_mut(&mut validator_perf.validators, cur_proposer_index);
            spec {
                assume validator.successful_proposals + 1 <= MAX_U64;
            };
            validator.successful_proposals = validator.successful_proposals + 1;
        };
    };

    let f = 0;
    let f_len = vector::length(&failed_proposer_indices);
    while ({
        spec {
            invariant len(validator_perf.validators) == validator_len;
            invariant (option::spec_is_some(ghost_proposer_idx) && option::spec_borrow(
                ghost_proposer_idx
            ) < validator_len) ==>
                (validator_perf.validators[option::spec_borrow(ghost_proposer_idx)].successful_proposals ==
                    ghost_valid_perf.validators[option::spec_borrow(ghost_proposer_idx)].successful_proposals + 1);
        };
        f < f_len
    }) {
        let validator_index = *vector::borrow(&failed_proposer_indices, f);
        if (validator_index < validator_len) {
            let validator = vector::borrow_mut(&mut validator_perf.validators, validator_index);
            spec {
                assume validator.failed_proposals + 1 <= MAX_U64;
            };
            validator.failed_proposals = validator.failed_proposals + 1;
        };
        f = f + 1;
    };
}