Contract Source Code:

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.23;

import "@openzeppelin/contracts/access/Ownable.sol";
import "@openzeppelin/contracts/token/ERC721/IERC721.sol";
import "./interfaces/INFTStats.sol";
import "./interfaces/ICollectionRegistry.sol";

/// @title NFTStats
/// @notice Manages individual NFT stats, experience, and leveling
contract NFTStats is INFTStats, Ownable {
    // Reference to the collection registry
    ICollectionRegistry public immutable collectionRegistry;

    // Mapping from collection address and token ID to its stats
    mapping(address => mapping(uint256 => NFTStatsData)) private nftStats;

    // Constants for XP and leveling
    uint256 private constant BASE_XP_PER_LEVEL = 1000;
    uint256 private constant XP_MULTIPLIER = 150; // 150% increase per level
    uint256 private constant BASE_STAT_INCREASE_PERCENT = 5; // 5% increase per level
    uint256 private constant STARTING_LEVEL = 1;

    // Authorized contracts that can modify stats
    mapping(address => bool) private authorizedContracts;

    modifier onlyAuthorized() {
        require(msg.sender == owner() || authorizedContracts[msg.sender], "Not authorized");
        _;
    }

    constructor(address _collectionRegistry) Ownable() {
        require(_collectionRegistry != address(0), "Invalid registry address");
        collectionRegistry = ICollectionRegistry(_collectionRegistry);
    }

    /// @notice Set authorization for a contract to modify stats
    /// @param contract_ Address of the contract
    /// @param authorized Whether the contract should be authorized
    function setContractAuthorization(address contract_, bool authorized) external onlyOwner {
        require(contract_ != address(0), "Invalid contract address");
        authorizedContracts[contract_] = authorized;
    }

    /// @notice Initialize stats for an NFT based on its collection's base stats
    /// @param collection Address of the NFT collection
    /// @param tokenId Token ID of the NFT
    function initializeStats(address collection, uint256 tokenId) external onlyAuthorized {
        require(!nftStats[collection][tokenId].initialized, "Stats already initialized");
        require(collectionRegistry.isWhitelisted(collection), "Collection not whitelisted");

        // Verify NFT ownership
        try IERC721(collection).ownerOf(tokenId) returns (address) {
            // NFT exists, proceed with initialization
        } catch {
            revert("NFT does not exist");
        }

        // Get base stats from collection registry
        ICollectionRegistry.CollectionStats memory baseStats = collectionRegistry.getCollectionStats(collection);

        // Initialize NFT stats
        nftStats[collection][tokenId] = NFTStatsData({
            hp: baseStats.baseHp,
            attack: baseStats.baseAttack,
            speed: baseStats.baseSpeed,
            level: STARTING_LEVEL,
            currentXP: 0,
            xpToNextLevel: getXPForNextLevel(STARTING_LEVEL),
            dungeonRuns: 0,
            successfulRuns: 0,
            roomsCleared: 0,
            initialized: true
        });

        emit StatsInitialized(collection, tokenId, baseStats.baseHp, baseStats.baseAttack, baseStats.baseSpeed);
    }

    /// @notice Award XP for dungeon progress
    /// @param collection Address of the NFT collection
    /// @param tokenId Token ID of the NFT
    /// @param xpAmount Amount of XP to award
    /// @param roomsCleared Number of rooms cleared in this run
    function awardXP(
        address collection,
        uint256 tokenId,
        uint256 xpAmount,
        uint256 roomsCleared
    ) external onlyAuthorized {
        require(nftStats[collection][tokenId].initialized, "Stats not initialized");

        NFTStatsData storage stats = nftStats[collection][tokenId];
        
        // Update XP and rooms cleared
        stats.currentXP += xpAmount;
        stats.roomsCleared += roomsCleared;

        emit XPGained(collection, tokenId, xpAmount, stats.currentXP);

        // Check for level ups
        while (stats.currentXP >= stats.xpToNextLevel) {
            // Level up
            stats.level += 1;
            
            // Calculate stat increases
            (uint256 hpIncrease, uint256 attackIncrease, uint256 speedIncrease) = _calculateStatIncreases(stats);
            
            // Apply stat increases
            stats.hp += hpIncrease;
            stats.attack += attackIncrease;
            stats.speed += speedIncrease;

            // Set new XP threshold
            stats.currentXP -= stats.xpToNextLevel;
            stats.xpToNextLevel = getXPForNextLevel(stats.level);

            emit LevelUp(collection, tokenId, stats.level, stats.hp, stats.attack, stats.speed);
        }
    }

    /// @notice Record a dungeon run attempt
    /// @param collection Address of the NFT collection
    /// @param tokenId Token ID of the NFT
    /// @param success Whether the run was successful
    function recordRun(
        address collection,
        uint256 tokenId,
        bool success
    ) external onlyAuthorized {
        require(nftStats[collection][tokenId].initialized, "Stats not initialized");

        NFTStatsData storage stats = nftStats[collection][tokenId];
        stats.dungeonRuns += 1;
        if (success) {
            stats.successfulRuns += 1;
        }

        emit RunRecorded(collection, tokenId, success, stats.roomsCleared, stats.currentXP);
    }

    /// @notice Calculate XP required for next level
    /// @param currentLevel Current level of the NFT
    /// @return uint256 XP required for next level
    function getXPForNextLevel(uint256 currentLevel) public pure returns (uint256) {
        return BASE_XP_PER_LEVEL * (currentLevel * XP_MULTIPLIER / 100);
    }

    /// @notice Get the stat increases for a level up
    /// @param collection Address of the NFT collection
    /// @param tokenId Token ID of the NFT
    /// @return hpIncrease Amount HP increases
    /// @return attackIncrease Amount Attack increases
    /// @return speedIncrease Amount Speed increases
    function getLevelUpStats(
        address collection,
        uint256 tokenId
    ) external view returns (
        uint256 hpIncrease,
        uint256 attackIncrease,
        uint256 speedIncrease
    ) {
        require(nftStats[collection][tokenId].initialized, "Stats not initialized");
        return _calculateStatIncreases(nftStats[collection][tokenId]);
    }

    /// @notice Get current stats for an NFT
    /// @param collection Address of the NFT collection
    /// @param tokenId Token ID of the NFT
    /// @return NFTStatsData struct containing current stats
    function getStats(
        address collection,
        uint256 tokenId
    ) external view returns (NFTStatsData memory) {
        return nftStats[collection][tokenId];
    }

    /// @notice Check if an NFT has been initialized
    /// @param collection Address of the NFT collection
    /// @param tokenId Token ID of the NFT
    /// @return bool True if NFT has been initialized
    function isInitialized(
        address collection,
        uint256 tokenId
    ) external view returns (bool) {
        return nftStats[collection][tokenId].initialized;
    }

    /// @notice Calculate stat increases for a level up
    /// @param stats Current stats of the NFT
    /// @return hpIncrease Amount HP increases
    /// @return attackIncrease Amount Attack increases
    /// @return speedIncrease Amount Speed increases
    function _calculateStatIncreases(
        NFTStatsData memory stats
    ) internal pure returns (
        uint256 hpIncrease,
        uint256 attackIncrease,
        uint256 speedIncrease
    ) {
        hpIncrease = (stats.hp * BASE_STAT_INCREASE_PERCENT) / 100;
        attackIncrease = (stats.attack * BASE_STAT_INCREASE_PERCENT) / 100;
        speedIncrease = (stats.speed * BASE_STAT_INCREASE_PERCENT) / 100;
    }
}

// SPDX-License-Identifier: MIT
// OpenZeppelin Contracts (last updated v4.7.0) (access/Ownable.sol)

pragma solidity ^0.8.0;

import "../utils/Context.sol";

/**
 * @dev Contract module which provides a basic access control mechanism, where
 * there is an account (an owner) that can be granted exclusive access to
 * specific functions.
 *
 * By default, the owner account will be the one that deploys the contract. This
 * can later be changed with {transferOwnership}.
 *
 * This module is used through inheritance. It will make available the modifier
 * `onlyOwner`, which can be applied to your functions to restrict their use to
 * the owner.
 */
abstract contract Ownable is Context {
    address private _owner;

    event OwnershipTransferred(address indexed previousOwner, address indexed newOwner);

    /**
     * @dev Initializes the contract setting the deployer as the initial owner.
     */
    constructor() {
        _transferOwnership(_msgSender());
    }

    /**
     * @dev Throws if called by any account other than the owner.
     */
    modifier onlyOwner() {
        _checkOwner();
        _;
    }

    /**
     * @dev Returns the address of the current owner.
     */
    function owner() public view virtual returns (address) {
        return _owner;
    }

    /**
     * @dev Throws if the sender is not the owner.
     */
    function _checkOwner() internal view virtual {
        require(owner() == _msgSender(), "Ownable: caller is not the owner");
    }

    /**
     * @dev Leaves the contract without owner. It will not be possible to call
     * `onlyOwner` functions anymore. Can only be called by the current owner.
     *
     * NOTE: Renouncing ownership will leave the contract without an owner,
     * thereby removing any functionality that is only available to the owner.
     */
    function renounceOwnership() public virtual onlyOwner {
        _transferOwnership(address(0));
    }

    /**
     * @dev Transfers ownership of the contract to a new account (`newOwner`).
     * Can only be called by the current owner.
     */
    function transferOwnership(address newOwner) public virtual onlyOwner {
        require(newOwner != address(0), "Ownable: new owner is the zero address");
        _transferOwnership(newOwner);
    }

    /**
     * @dev Transfers ownership of the contract to a new account (`newOwner`).
     * Internal function without access restriction.
     */
    function _transferOwnership(address newOwner) internal virtual {
        address oldOwner = _owner;
        _owner = newOwner;
        emit OwnershipTransferred(oldOwner, newOwner);
    }
}

// SPDX-License-Identifier: MIT
// OpenZeppelin Contracts (last updated v4.8.0) (token/ERC721/IERC721.sol)

pragma solidity ^0.8.0;

import "../../utils/introspection/IERC165.sol";

/**
 * @dev Required interface of an ERC721 compliant contract.
 */
interface IERC721 is IERC165 {
    /**
     * @dev Emitted when `tokenId` token is transferred from `from` to `to`.
     */
    event Transfer(address indexed from, address indexed to, uint256 indexed tokenId);

    /**
     * @dev Emitted when `owner` enables `approved` to manage the `tokenId` token.
     */
    event Approval(address indexed owner, address indexed approved, uint256 indexed tokenId);

    /**
     * @dev Emitted when `owner` enables or disables (`approved`) `operator` to manage all of its assets.
     */
    event ApprovalForAll(address indexed owner, address indexed operator, bool approved);

    /**
     * @dev Returns the number of tokens in ``owner``'s account.
     */
    function balanceOf(address owner) external view returns (uint256 balance);

    /**
     * @dev Returns the owner of the `tokenId` token.
     *
     * Requirements:
     *
     * - `tokenId` must exist.
     */
    function ownerOf(uint256 tokenId) external view returns (address owner);

    /**
     * @dev Safely transfers `tokenId` token from `from` to `to`.
     *
     * Requirements:
     *
     * - `from` cannot be the zero address.
     * - `to` cannot be the zero address.
     * - `tokenId` token must exist and be owned by `from`.
     * - If the caller is not `from`, it must be approved to move this token by either {approve} or {setApprovalForAll}.
     * - If `to` refers to a smart contract, it must implement {IERC721Receiver-onERC721Received}, which is called upon a safe transfer.
     *
     * Emits a {Transfer} event.
     */
    function safeTransferFrom(
        address from,
        address to,
        uint256 tokenId,
        bytes calldata data
    ) external;

    /**
     * @dev Safely transfers `tokenId` token from `from` to `to`, checking first that contract recipients
     * are aware of the ERC721 protocol to prevent tokens from being forever locked.
     *
     * Requirements:
     *
     * - `from` cannot be the zero address.
     * - `to` cannot be the zero address.
     * - `tokenId` token must exist and be owned by `from`.
     * - If the caller is not `from`, it must have been allowed to move this token by either {approve} or {setApprovalForAll}.
     * - If `to` refers to a smart contract, it must implement {IERC721Receiver-onERC721Received}, which is called upon a safe transfer.
     *
     * Emits a {Transfer} event.
     */
    function safeTransferFrom(
        address from,
        address to,
        uint256 tokenId
    ) external;

    /**
     * @dev Transfers `tokenId` token from `from` to `to`.
     *
     * WARNING: Note that the caller is responsible to confirm that the recipient is capable of receiving ERC721
     * or else they may be permanently lost. Usage of {safeTransferFrom} prevents loss, though the caller must
     * understand this adds an external call which potentially creates a reentrancy vulnerability.
     *
     * Requirements:
     *
     * - `from` cannot be the zero address.
     * - `to` cannot be the zero address.
     * - `tokenId` token must be owned by `from`.
     * - If the caller is not `from`, it must be approved to move this token by either {approve} or {setApprovalForAll}.
     *
     * Emits a {Transfer} event.
     */
    function transferFrom(
        address from,
        address to,
        uint256 tokenId
    ) external;

    /**
     * @dev Gives permission to `to` to transfer `tokenId` token to another account.
     * The approval is cleared when the token is transferred.
     *
     * Only a single account can be approved at a time, so approving the zero address clears previous approvals.
     *
     * Requirements:
     *
     * - The caller must own the token or be an approved operator.
     * - `tokenId` must exist.
     *
     * Emits an {Approval} event.
     */
    function approve(address to, uint256 tokenId) external;

    /**
     * @dev Approve or remove `operator` as an operator for the caller.
     * Operators can call {transferFrom} or {safeTransferFrom} for any token owned by the caller.
     *
     * Requirements:
     *
     * - The `operator` cannot be the caller.
     *
     * Emits an {ApprovalForAll} event.
     */
    function setApprovalForAll(address operator, bool _approved) external;

    /**
     * @dev Returns the account approved for `tokenId` token.
     *
     * Requirements:
     *
     * - `tokenId` must exist.
     */
    function getApproved(uint256 tokenId) external view returns (address operator);

    /**
     * @dev Returns if the `operator` is allowed to manage all of the assets of `owner`.
     *
     * See {setApprovalForAll}
     */
    function isApprovedForAll(address owner, address operator) external view returns (bool);
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.23;

/// @title INFTStats
/// @notice Interface for managing individual NFT stats and progression
interface INFTStats {
    /// @notice Structure for NFT permanent stats
    struct NFTStatsData {
        uint256 hp;
        uint256 attack;
        uint256 speed;
        uint256 level;
        uint256 currentXP;
        uint256 xpToNextLevel;
        uint256 dungeonRuns;
        uint256 successfulRuns;
        uint256 roomsCleared;
        bool initialized;
    }

    /// @notice Event emitted when an NFT's stats are initialized
    event StatsInitialized(address indexed collection, uint256 indexed tokenId, uint256 hp, uint256 attack, uint256 speed);
    
    /// @notice Event emitted when an NFT's stats are boosted
    event StatsBoosted(address indexed collection, uint256 indexed tokenId, uint256 newHp, uint256 newAttack, uint256 newSpeed);
    
    /// @notice Event emitted when XP is gained
    event XPGained(address indexed collection, uint256 indexed tokenId, uint256 xpGained, uint256 newTotalXP);
    
    /// @notice Event emitted when a level up occurs
    event LevelUp(address indexed collection, uint256 indexed tokenId, uint256 newLevel, uint256 newHp, uint256 newAttack, uint256 newSpeed);
    
    /// @notice Event emitted when a run is recorded
    event RunRecorded(address indexed collection, uint256 indexed tokenId, bool success, uint256 roomsCleared, uint256 xpGained);

    /// @notice Initialize stats for an NFT based on its collection's base stats
    /// @param collection Address of the NFT collection
    /// @param tokenId Token ID of the NFT
    function initializeStats(address collection, uint256 tokenId) external;

    /// @notice Award XP for dungeon progress
    /// @param collection Address of the NFT collection
    /// @param tokenId Token ID of the NFT
    /// @param xpAmount Amount of XP to award
    /// @param roomsCleared Number of rooms cleared in this run
    function awardXP(
        address collection,
        uint256 tokenId,
        uint256 xpAmount,
        uint256 roomsCleared
    ) external;

    /// @notice Calculate XP required for next level
    /// @param currentLevel Current level of the NFT
    /// @return uint256 XP required for next level
    function getXPForNextLevel(uint256 currentLevel) external pure returns (uint256);

    /// @notice Get the stat increases for a level up
    /// @param collection Address of the NFT collection
    /// @param tokenId Token ID of the NFT
    /// @return hpIncrease Amount HP increases
    /// @return attackIncrease Amount Attack increases
    /// @return speedIncrease Amount Speed increases
    function getLevelUpStats(
        address collection,
        uint256 tokenId
    ) external view returns (
        uint256 hpIncrease,
        uint256 attackIncrease,
        uint256 speedIncrease
    );

    /// @notice Record a dungeon run attempt
    /// @param collection Address of the NFT collection
    /// @param tokenId Token ID of the NFT
    /// @param success Whether the run was successful
    function recordRun(address collection, uint256 tokenId, bool success) external;

    /// @notice Get current stats for an NFT
    /// @param collection Address of the NFT collection
    /// @param tokenId Token ID of the NFT
    /// @return NFTStatsData struct containing current stats
    function getStats(address collection, uint256 tokenId) external view returns (NFTStatsData memory);

    /// @notice Check if an NFT has been initialized
    /// @param collection Address of the NFT collection
    /// @param tokenId Token ID of the NFT
    /// @return bool True if NFT has been initialized
    function isInitialized(address collection, uint256 tokenId) external view returns (bool);
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.23;

/// @title ICollectionRegistry
/// @notice Interface for managing whitelisted NFT collections and their base stats
interface ICollectionRegistry {
    /// @notice Stats structure for NFT collections
    struct CollectionStats {
        uint256 baseHp;
        uint256 baseAttack;
        uint256 baseSpeed;
        bool isWhitelisted;
    }

    /// @notice Event emitted when a collection is whitelisted
    event CollectionWhitelisted(address indexed collection, uint256 baseHp, uint256 baseAttack, uint256 baseSpeed);
    
    /// @notice Event emitted when a collection's stats are updated
    event CollectionStatsUpdated(address indexed collection, uint256 baseHp, uint256 baseAttack, uint256 baseSpeed);
    
    /// @notice Event emitted when a collection is removed from whitelist
    event CollectionRemoved(address indexed collection);

    /// @notice Whitelist a new NFT collection with base stats
    /// @param collection Address of the NFT collection
    /// @param baseHp Initial HP for NFTs from this collection
    /// @param baseAttack Initial Attack for NFTs from this collection
    /// @param baseSpeed Initial Speed for NFTs from this collection
    function whitelistCollection(
        address collection,
        uint256 baseHp,
        uint256 baseAttack,
        uint256 baseSpeed
    ) external;

    /// @notice Update base stats for a whitelisted collection
    /// @param collection Address of the NFT collection
    /// @param baseHp New base HP
    /// @param baseAttack New base Attack
    /// @param baseSpeed New base Speed
    function updateCollectionStats(
        address collection,
        uint256 baseHp,
        uint256 baseAttack,
        uint256 baseSpeed
    ) external;

    /// @notice Remove a collection from the whitelist
    /// @param collection Address of the NFT collection to remove
    function removeCollection(address collection) external;

    /// @notice Check if a collection is whitelisted
    /// @param collection Address of the NFT collection to check
    /// @return bool True if collection is whitelisted
    function isWhitelisted(address collection) external view returns (bool);

    /// @notice Get base stats for a collection
    /// @param collection Address of the NFT collection
    /// @return CollectionStats struct containing base stats
    function getCollectionStats(address collection) external view returns (CollectionStats memory);
}

// SPDX-License-Identifier: MIT
// OpenZeppelin Contracts v4.4.1 (utils/Context.sol)

pragma solidity ^0.8.0;

/**
 * @dev Provides information about the current execution context, including the
 * sender of the transaction and its data. While these are generally available
 * via msg.sender and msg.data, they should not be accessed in such a direct
 * manner, since when dealing with meta-transactions the account sending and
 * paying for execution may not be the actual sender (as far as an application
 * is concerned).
 *
 * This contract is only required for intermediate, library-like contracts.
 */
abstract contract Context {
    function _msgSender() internal view virtual returns (address) {
        return msg.sender;
    }

    function _msgData() internal view virtual returns (bytes calldata) {
        return msg.data;
    }
}

// SPDX-License-Identifier: MIT
// OpenZeppelin Contracts v4.4.1 (utils/introspection/IERC165.sol)

pragma solidity ^0.8.0;

/**
 * @dev Interface of the ERC165 standard, as defined in the
 * https://eips.ethereum.org/EIPS/eip-165[EIP].
 *
 * Implementers can declare support of contract interfaces, which can then be
 * queried by others ({ERC165Checker}).
 *
 * For an implementation, see {ERC165}.
 */
interface IERC165 {
    /**
     * @dev Returns true if this contract implements the interface defined by
     * `interfaceId`. See the corresponding
     * https://eips.ethereum.org/EIPS/eip-165#how-interfaces-are-identified[EIP section]
     * to learn more about how these ids are created.
     *
     * This function call must use less than 30 000 gas.
     */
    function supportsInterface(bytes4 interfaceId) external view returns (bool);
}