fix: lock junior_fee_mult_bps once juniors are deposited

[0x-SquidSol]

Summary

process_admin_set_tranche_config allowed the admin to change junior_fee_mult_bps at any time, even while junior LPs were already deposited. Because process_accrue_fees reads the multiplier live (no per-epoch snapshot, see distribute_fees call at L1696), a mid-life change immediately rewrites the fee split for every junior LP.

Attack

1. Juniors deposit at multiplier M_1 (economic term they accepted)
2. Vault accumulates trading fees
3. Admin bumps multiplier to M_2 > M_1
4. Anyone calls AccrueFees — junior sub-pool captures outsized share
5. Admin (holding a junior position) withdraws at the inflated rate
6. Admin resets multiplier to M_1 to cover tracks

Inverse attack: Admin depresses multiplier to silently reduce junior yield below what was promised at deposit time. Depositors have no recourse — they can't back out without losing cooldown/HWM protections.

Severity

MEDIUM — governance/economic risk. Not immediate theft but a clear avenue for admin value extraction or unilateral repricing of outstanding obligations.

Fix

Block any multiplier change when junior_total_lp() > 0. Idempotent re-writes (same value) still succeed so admin tooling can reapply config. Once all juniors withdraw (junior_total_lp back to 0), the multiplier is freely configurable for the next cohort.

if pool.junior_total_lp() > 0
    && pool.junior_fee_mult_bps() != junior_fee_mult_bps
{
    return Err(StakeError::Unauthorized.into());
}

Design rationale

• Locking post-deposit enforces the economic contract. Junior LPs take first-loss exposure specifically because of the advertised multiplier. Mutating it is unilateral repricing.
• Epoch lifecycle works naturally: deposit window → fees accrue → market resolves → juniors exit → reconfigure → next cohort.
• Idempotent no-op allowed so admin tooling re-applying config doesn't trigger false positives.
• The "no disable" design limitation (set_tranche_enabled(true) hardcoded) is left as-is. Agents A/C raised a "disable mid-flight" attack vector, but because the current code literally cannot disable tranches, that attack surface doesn't exist in practice. A separate follow-up PR can add a proper enabled: bool parameter (wire-format change) if the product requires it.

Verification

• 3 independent agents confirmed the bug and traced the live-multiplier read path through AccrueFees
• Chose Agent B's minimal approach over Agents A/C's full (wire-breaking) approach for consistency with fix: validate user_ata in process_withdraw to block vault self-transfer #123/fix: junior withdrawal ordering unfairness during active insurance loss #124/docs: fix AdminWithdrawInsurance account order to match processor #125/fix: validate authority == vault_auth PDA in AdminSetInsurancePolicy (privilege escalation) #126 pattern
• cargo check via sbpf toolchain — compiles cleanly
• 28 lines added, 0 removed — no ABI change

🤖 Generated with Claude Code

[coderabbitai]

Warning

Rate limit exceeded

@0x-SquidSol has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 46 minutes and 20 seconds before requesting another review.

Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 46 minutes and 20 seconds.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 6a82bec0-a3f3-4730-bed1-d4fb3af9452d

📥 Commits

Reviewing files that changed from the base of the PR and between c3a617a and 890f5cd.

📒 Files selected for processing (1)

• src/processor.rs

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}