You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
On removal, _afterRemoveLiquidity settled the position's withheld fees and aggregated them with the fresh fees (feeDelta + withheldFees) before checking whether the penalty had expired. Each BalanceDelta component is an int128, so a component sum exceeding int128.max reverts, and because the aggregation ran unconditionally it reverted even for a position past its offset that only wanted its fees back; on rollback the withheld-fee storage was restored, so every later removal re-hit the overflow. Combined with both tick boundaries being saturated — which blocks the add path that would otherwise checkpoint the fresh fees — this could leave a position's principal and fees inaccessible.
The aggregation now runs only inside the in-window branch, where it is actually used. An expired position returns its withheld fees without aggregating, so it can always be removed once the offset has passed. The reachable behavior is unchanged, since the aggregated value was already unused on the expired path.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
On removal,
_afterRemoveLiquiditysettled the position's withheld fees and aggregated them with the fresh fees (feeDelta + withheldFees) before checking whether the penalty had expired. EachBalanceDeltacomponent is anint128, so a component sum exceedingint128.maxreverts, and because the aggregation ran unconditionally it reverted even for a position past its offset that only wanted its fees back; on rollback the withheld-fee storage was restored, so every later removal re-hit the overflow. Combined with both tick boundaries being saturated — which blocks the add path that would otherwise checkpoint the fresh fees — this could leave a position's principal and fees inaccessible.The aggregation now runs only inside the in-window branch, where it is actually used. An expired position returns its withheld fees without aggregating, so it can always be removed once the offset has passed. The reachable behavior is unchanged, since the aggregated value was already unused on the expired path.