Protect against donation-based price manipulation#402
Open
TUPM96 wants to merge 1 commit into
Open
Conversation
|
@TUPM96 is attempting to deploy a commit to the smartdevs17's projects Team on Vercel. A member of the Team first needs to authorize it. |
6 tasks
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
This PR introduces donation-based price manipulation defenses for deposits and adds variable/stable rate borrowing APIs, alongside related accounting updates and tests.
Changes:
- Add donation detection/quarantine flow, virtual share price calculation, and admin acknowledgment APIs.
- Introduce variable/stable borrowing entrypoints and related rate configuration plumbing.
- Update withdraw path to adjust per-asset accounting and expand test coverage for donation defenses.
Reviewed changes
Copilot reviewed 9 out of 9 changed files in this pull request and generated 8 comments.
Show a summary per file
| File | Description |
|---|---|
| stellar-lend/docs/donation-price-manipulation.md | Documents the donation/quarantine threat model and mitigation approach. |
| stellar-lend/contracts/lending/src/deposit.rs | Implements donation defense config/reporting, virtual price calc, and per-asset accounting keys. |
| stellar-lend/contracts/lending/src/lib.rs | Exposes new public contract APIs (donation defense + rate-type borrow) and blocks liquidation on donation alert. |
| stellar-lend/contracts/lending/src/withdraw.rs | Deducts per-asset accounting on withdraw. |
| stellar-lend/contracts/lending/src/deposit_test.rs | Adds tests for detection/quarantine, min deposit dust defense, and liquidation blocking. |
| stellar-lend/contracts/lending/src/borrow.rs | Tweaks stable-rate state init and legacy debt position loading; modifies variable borrow rate setter. |
| stellar-lend/contracts/lending/src/math_safety_test.rs | Updates debt position construction with new rate fields. |
| stellar-lend/contracts/lending/src/borrow_test.rs | Updates imports for new RateType usage. |
| stellar-lend/contracts/lending/src/interest_rate.rs | Adjusts default borrow rate config (base rate). |
Comments suppressed due to low confidence (1)
stellar-lend/contracts/lending/src/deposit.rs:395
get_deposit_positionis parameterized byasset, but the storage key shown only usesuser(UserCollateral(user.clone())). This makes per-asset deposits overwrite each other for the same user and breaks multi-asset accounting (especially now that per-asset share/asset totals were added). Use a storage key that includes bothuserandassetso positions are truly per-user-per-asset.
fn get_deposit_position(env: &Env, user: &Address, asset: &Address) -> DepositCollateral {
env.storage()
.persistent()
.get(&DepositDataKey::UserCollateral(user.clone()))
.unwrap_or(DepositCollateral {
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
198
to
203
| if *admin != current { | ||
| return Err(BorrowError::Unauthorized); | ||
| } | ||
| admin.require_auth(); | ||
| if !(0..=10000).contains(&rate_bps) { | ||
| return Err(BorrowError::InvalidAmount); | ||
| } |
Comment on lines
759
to
+770
| .get::<BorrowDataKey, DebtPosition>(&BorrowDataKey::BorrowUserDebt(user.clone())) | ||
| { | ||
| return DebtPosition { | ||
| borrowed_amount: legacy.borrowed_amount, | ||
| interest_accrued: legacy.interest_accrued, | ||
| last_update: legacy.last_update, | ||
| asset: legacy.asset, | ||
| rate_type: RateType::Variable, | ||
| stable_rate_bps: 0, | ||
| }; | ||
| if legacy.rate_type == RateType::Variable { | ||
| return DebtPosition { | ||
| borrowed_amount: legacy.borrowed_amount, | ||
| interest_accrued: legacy.interest_accrued, | ||
| last_update: legacy.last_update, | ||
| asset: legacy.asset, | ||
| rate_type: RateType::Variable, | ||
| stable_rate_bps: 0, | ||
| }; | ||
| } |
Comment on lines
+114
to
117
| let min_deposit = get_effective_min_deposit_amount(env); | ||
| if amount < min_deposit { | ||
| return Err(DepositError::InvalidAmount); | ||
| } |
Comment on lines
+129
to
133
| add_asset_accounting(env, &asset, amount)?; | ||
|
|
||
| let mut position = get_deposit_position(env, &user, &asset); | ||
| position.amount = position | ||
| .amount |
Comment on lines
+286
to
+306
| pub(crate) fn subtract_asset_accounting( | ||
| env: &Env, | ||
| asset: &Address, | ||
| amount: i128, | ||
| ) -> Result<(), DepositError> { | ||
| if amount < 0 { | ||
| return Err(DepositError::InvalidAmount); | ||
| } | ||
|
|
||
| let accounted = get_asset_accounted_amount(env, asset); | ||
| let shares = get_asset_total_shares(env, asset); | ||
| env.storage().persistent().set( | ||
| &DepositDataKey::AssetAccountedAmount(asset.clone()), | ||
| &accounted.checked_sub(amount).unwrap_or(0), | ||
| ); | ||
| env.storage().persistent().set( | ||
| &DepositDataKey::AssetTotalShares(asset.clone()), | ||
| &shares.checked_sub(amount).unwrap_or(0), | ||
| ); | ||
| Ok(()) | ||
| } |
Comment on lines
95
to
+102
| let total_deposits = get_total_deposits(env); | ||
| let new_total = total_deposits.checked_sub(amount).unwrap_or(0); | ||
| set_total_deposits(env, new_total); | ||
| crate::deposit::subtract_asset_accounting(env, &asset, amount).map_err(|e| match e { | ||
| crate::deposit::DepositError::InvalidAmount => WithdrawError::InvalidAmount, | ||
| crate::deposit::DepositError::Overflow => WithdrawError::Overflow, | ||
| _ => WithdrawError::Overflow, | ||
| })?; |
Comment on lines
+305
to
+307
| let admin = Address::generate(&env); | ||
| let user = Address::generate(&env); | ||
| let asset = Address::generate(&env); |
Comment on lines
+235
to
+238
| if is_donation_detected(&env, &debt_asset) || is_donation_detected(&env, &collateral_asset) | ||
| { | ||
| return Err(BorrowError::ProtocolPaused); | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #389
Summary
Tests
Note
cargo check -p hello-world --libis currently blocked by pre-existing hello-world baseline errors such as duplicatecross_asset_borrow/DataKeydefinitions and testutils-gated imports.