Skip to content

Add reentrancy-style regression test for double-invocation of collect_fees in one ledger #80

Description

@Jagadeeshftw

📌 Description

collect_fees(asset) (admin-only) collects accrued protocol fees for an asset, and fees_accrued(asset) reads the uncollected amount. There should be an explicit test proving fees can't be double-counted if collect_fees is somehow invoked twice for the same asset before fees_accrued is properly zeroed (e.g. via a cross-contract call re-entering during the token transfer, if SEP-41 transfers are involved on this path).

🧩 Requirements and context

  • Add a test invoking collect_fees(asset) twice in immediate succession and asserting the second call either collects 0 or errors, never re-collecting the same accrued amount.
  • Confirm fees_accrued(asset) is zeroed (or decremented) before any external call/transfer within collect_fees, following checks-effects-interactions ordering.
  • If a token transfer is involved on this path, verify it can't be used to reenter collect_fees mid-execution.

🛠️ Suggested execution

  • Add the double-invocation test to src/test.rs.
  • Review collect_fees's implementation order in src/lib.rs for checks-effects-interactions compliance; reorder if needed.

✅ Acceptance criteria

  • Double-invocation of collect_fees never double-collects accrued fees.
  • State is zeroed/decremented before any external interaction.
  • Regression test locks in the guarantee.

🔒 Security notes

Directly protects protocol fee accounting from a reentrancy or race-style double-spend.

📋 Guidelines

  • Minimum 95% test coverage
  • Clear documentation
  • Timeframe: 96 hours

Metadata

Metadata

Assignees

No one assigned

    Labels

    GrantFox OSSGrantFox open-source programMaybe RewardedGrantFox: potentially rewarded contributionOfficial Campaign | FWC26GrantFox official campaign issuesecuritySecurity hardening / audittestingTests and coverage

    Type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions