MEDIUM: manual_extend_ttl missing caller authentication — maintenance fund drain

[leanworld7-netizen]

MEDIUM: manual_extend_ttl missing caller authentication — maintenance fund drain

Function Affected

• manual_extend_ttl (L6163) — public, zero require_auth() on caller

Root Cause

manual_extend_ttl deducts 1 XLM (1,000,000 stroops) from the maintenance fund and extends meter TTL. No caller authentication. Anyone can repeatedly call this to drain the maintenance fund.

Attack

1. Attacker calls manual_extend_ttl(meter_id) on any meter with a maintenance fund balance
2. 1 XLM is deducted from maintenance fund each call
3. Attacker repeats until maintenance fund is empty
4. Meter TTL can no longer be extended — meter data eventually expires from storage

Impact

• Fund drain: Maintenance fund depleted by unauthenticated calls
• Meter expiry: Without maintenance funds, meters cannot extend TTL and expire from Soroban storage
• Service disruption: Expired meters stop billing/claiming operations

Severity

MEDIUM — per SECURITY.md section 4.1, Medium = $1K-$5K bounty.

Fix

Add require_admin_auth(&env) or meter.provider.require_auth() before deducting from maintenance fund.

[Naajih09]

Hey maintainer, i have read your description and i have worked on several issues like this, kindly assign to me

[Naajih09]

Hey maintainer, i have read your description and i have worked on several issues like this, kindly assign to me