fix: Reject stale AMM swaps in the mempool; one swap per pool per template - #55
Open
giaki3003 wants to merge 3 commits into
Conversation
Bug: w3-20260630-1952-kimiclaw-confirm-openclaw- (primary) Finding: findings/20260630-1952-kimiclaw-confirm-openclaw-plain-bitassets-dutch-auction-dust-bid-drain.md Severity: R4-T1 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> (cherry picked from commit b3baea9)
…ty check on a mis-assigned n_unique_bitasset_outputs variable (filled from spent BitAsset INPUTS via unique_spent_bitassets() instead of the computed-but-unused bitasset_outputs() count), so a normal LP-redemption burn is deterministically rejected by block validation with Error::Amm(InvalidBurn) Bug: w3-20260611-0220-bitassets-amm-burn-validat (primary) Finding: findings/20260611-0220-bitassets-amm-burn-validator-counts-spent-bitassets-not-outputs-rejects-normal-burn.md Severity: R4-T2 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> (cherry picked from commit caeb6d5)
… block Bug: w3-20260702-2346-kimiclaw-confirm-glmclaw-p (primary) Finding: findings/20260702-2346-kimiclaw-confirm-glmclaw-plain-bitassets-amm-swap-prevalidate-connect-gap.md Severity: R4-T2 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> (cherry picked from commit 574f79d)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What's wrong
An
AmmSwapdeclaresamount_receive, and that declaration is only checked against pool state inamm::apply_swap, at block connection.State::validate_transactionnever checks it, so a swap that is stale with respect to the current pool state is accepted into the mempool and is not evicted by the checks inNode::get_transactions, which keeps selecting it into block templates that then fail to connect withAmm(InvalidSwap), stalling block production. The same happens with two swaps on one pool in a single template: both are validated against the pre-block state, but the second is applied after the first has moved the pool.The fix
apply_swap's pool computation moves into a sharedswap_pool_state, and a newamm::validate_swapis called fromState::validate_transactionfor swaps, so stale swaps are rejected on entry and dropped at template time. Block validation is unchanged — swaps in a block are still applied sequentially.Node::get_transactionsalso records theAmmPairs already swapped into the template and skips (leaving in the mempool) later swaps on the same pool;AmmPairgainsPartialEq/Eq/Hashfor that.Tests
Adds
validate_swap_rejects_stale_swap. It currently replacesapply_mint_burn_wrong_lp_baselinein that module, which wasn't intended scope — happy to restore that test alongside it.Finding report (access-controlled): https://giaki3003.tech/#/findings/20260702-2346-kimiclaw-confirm-glmclaw-plain-bitassets-amm-swap-prevalidate-connect-gap
Part of a short series for this repo (fix 3 of 4); builds on #54, so it reads best merged after that one. Happy to rebase or split if you'd prefer them independent.