Repository navigation
Conversation
Bumps [eslint](https://github.com/eslint/eslint) from 10.9.1 to 10.10.0. - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v10.9.1...v10.10.0) --- updated-dependencies: - dependency-name: eslint dependency-version: 10.10.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
…dev/eslint-10.10.0 build(deps-dev): bump eslint from 10.9.1 to 10.10.0
Bumps [eslint](https://github.com/eslint/eslint) from 10.10.0 to 10.11.0. - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v10.10.0...v10.11.0) --- updated-dependencies: - dependency-name: eslint dependency-version: 10.11.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
…dev/eslint-10.11.0 build(deps-dev): bump eslint from 10.10.0 to 10.11.0
Bumps [tsx](https://github.com/privatenumber/tsx) from 4.23.13 to 4.23.15. - [Release notes](https://github.com/privatenumber/tsx/releases) - [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs) - [Commits](privatenumber/tsx@v4.23.13...v4.23.15) --- updated-dependencies: - dependency-name: tsx dependency-version: 4.23.15 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [release-plz/action](https://github.com/release-plz/action) from 0.5.131 to 0.5.139. - [Release notes](https://github.com/release-plz/action/releases) - [Commits](release-plz/action@2eb1d8b...b8d6b54) --- updated-dependencies: - dependency-name: release-plz/action dependency-version: 0.5.139 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 26.4.1 to 26.6.3. - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) --- updated-dependencies: - dependency-name: "@types/node" dependency-version: 26.6.3 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [chalk](https://github.com/chalk/chalk) from 6.0.0 to 6.0.1. - [Release notes](https://github.com/chalk/chalk/releases) - [Commits](chalk/chalk@v6.0.0...v6.0.1) --- updated-dependencies: - dependency-name: chalk dependency-version: 6.0.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
tiamo
changed the title
There was a problem hiding this comment.
Copilot review overview
🔵 Needs a closer look
It changes critical flash-loan share-pricing and accounting invariants on a live DeFi market across many interdependent files, which requires human verification before approval.
Review effort: Balanced
Findings: None
What changed in this PR
This PR applies one critical fix plus a series of hardening fixes to the market (and farms) Soroban contracts, found in an internal review of deployed v1.1.0. The headline change reworks how a batch FlashBorrow interacts with pool accounting: the flashed principal is now reserved in a new FlashReserved(Address) instance key rather than subtracted from total_available, so supply/accrual/caps see the whole pool and only payouts are limited to the unreserved part. The remaining commits close governance-rollback, farm-liveness, constructor-validation, division-by-zero, liquidation-crediting, and rate-controller edge cases, each with a regression test. The client SDK is updated to surface unpriced-pool cases via a UsdTotal discriminated union and to add getGlobalState/getOraclePriceDecimals.
Changes:
- Reserve (not remove) flashed assets via
FlashReserved, addingpayable_available/reducible_availablehelpers and threading&Envthroughrequire_total_available. - Carry instant config writes (status flags, fee beneficiaries) into a ripe queued set via
patch_queued_pool_set; gracefully degrade farm stake pushes; bound constructor params and reject over-scaled oracles; validate IR models at queue time; fix supply-only (open_ltv_bps = 0) withdrawals and batch-liquidation seed crediting. - Client SDK:
calcUserTotal*InUsdnow returnUsdTotal;getPoolDatareturnsPoolData; new global-state/oracle-decimals getters; dependency/lockfile bumps and large test additions.
| File | Description |
|---|---|
| contracts/market/src/pool.rs | Reservation-aware adjust_total_available, payable_available/reducible_available, IR-model validation, cooldown-without-fee rejection |
| contracts/market/src/processors.rs | Flash reserve set/guard, liquidation now keyed by full obligation key, settled count in claim event |
| contracts/market/src/request.rs | Clears reservation on flash repay; zero-amount market transfers for transfer-gated collateral |
| contracts/market/src/storage.rs | FlashReserved key + accessors; patch_queued_pool_set preserving timelock |
| contracts/market/src/obligation.rs | Zero-scalar (supply-only) branch; reservation-aware borrow/withdraw caps |
| contracts/market/src/contract.rs | Oracle-decimals guard, queue-period bounds, beneficiary accrual-persist, queued-set patch calls, doc comments |
| contracts/market/src/interest_rate.rs / constants.rs | Clamp controller integration to MAX_IR_INTEGRATION_SECONDS; new bound constants |
| contracts/market/src/interest_rate_model/* | validate promoted to the InterestRate trait |
| contracts/market/src/farms.rs / events.rs / error.rs | Fallible farm push + FarmStakePushFailed; settled field; error 503 |
| contracts/farms/src/contract.rs | Frozen farm accepts a stake decrease |
| packages/client-sdk/* | UsdTotal union, new getters, SDK tests, dependency bumps |
| tests/*, docs/parameters.md, Cargo.lock, pnpm-lock.yaml | Regression/fuzz tests, doc and lockfile updates |
Files not reviewed (1)
- pnpm-lock.yaml: Generated file
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
There was a problem hiding this comment.
Copilot review overview
🔵 Needs a closer look
It changes critical share-pricing/payout accounting in a deployed DeFi lending market and ships rebuilt market.wasm/farms.wasm binaries that cannot be verified from the diff, so it warrants final human review.
Review effort: Balanced
Findings: None
Files not reviewed (1)
- pnpm-lock.yaml: Generated file
…s/dev/release-plz/action-0.5.139 build(deps): bump release-plz/action from 0.5.131 to 0.5.139
…dev/types/node-26.6.3 build(deps-dev): bump @types/node from 26.4.1 to 26.6.3
…dev/chalk-6.0.1 build(deps): bump chalk from 6.0.0 to 6.0.1
…dev/tsx-4.23.15 build(deps-dev): bump tsx from 4.23.13 to 4.23.15
Bumps [eslint](https://github.com/eslint/eslint) from 10.11.0 to 10.12.0. - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v10.11.0...v10.12.0) --- updated-dependencies: - dependency-name: eslint dependency-version: 10.12.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
…dev/eslint-10.12.0 build(deps-dev): bump eslint from 10.11.0 to 10.12.0
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Security fixes for the market, found in an internal review of the deployed v1.1.0 code.
Each fix is its own commit with a regression test that fails without it.
Critical. A
FlashBorrowinsidesubmit_requests_batchsubtracted its principal from the pool'stotal_available, so later requests in the same batch priced shares against an understated pool. Theprincipal is now reserved (
FlashReserved), not removed: supply, accrual and caps see the whole pool,and only payouts are limited to the unreserved part (
1ef46d53, fuzzed inc5ad8d78).Flash loans stay disabled on the deployed market until this fix is live.
Fixes
1ef46d53c6940ef225320f4fFarmStakePushFailed5fd05304ee8addd5582f57e4update_in_queue_periodto 60 s ..= 10 years45e3c187bc32edcd6d4393eaopen_ltv_bps = 0) no longer traps withdrawals by dividing by zero3441ea12Liquidatecredits the batch's own (seeded) obligationc366c60bClaimCoverBadDebtResultsreports how many requests were settled3dffd4357bcd1ba8Plus documentation corrections (
6b698753,0af9d03b), test-only commits, client SDK fixes, and therebuilt
wasms/market.wasmandwasms/farms.wasmthat the integration tests import.Interface changes
MCError::OracleUnusableAtConstruction = 503.ClaimCoverBadDebtResultsgainssettled: u32.FarmStakePushFailed { pool, farm_id, obligation_key, stake }.FlashReserved(Address); absent at every transaction boundary. Existing storagelayout is unchanged.
set_stake_delegatedon a frozen farm accepts a decrease.calcUserTotal*InUsdreturnUsdTotal, notnumber.getPoolDatais typedPoolData. NewgetGlobalStateandgetOraclePriceDecimals.Upgrade
Deploy artifact built from this head (
--features deploy): sha2560e460ef2ab044d25888e6a6af76b79d488b8f654c3ba79315daa35aefb3748ea, 113,344 bytes. Compare the attestedrelease build against it. The upgrade goes through the market manager queue (12 h on the live market).
Verification
On
bf8e76b7:cargo fmt --check(stable and nightly), the three clippy runs from CI and the Makefile,cargo docwith--deny warnings,cargo check --locked, andcargo nextest run --workspace:356 passed, 1 ignored (
test_consecutive_borrows_can_lead_to_unpaid_interest_become_negative, ignoredbefore this PR). Every fix's regression test fails with that fix reverted. Client SDK:
bun test8/8.