fix(stake): 5 verified v17 bounty findings — senior pricing (HIGH), JIT-fee snipe, distribute_fees, cooldown bound, tranche coverage

[dcccrypto]

Consolidates the 5 verified v17-relevant stake findings from the 2026-06-17 bounty wave, applied + adapted to the current v17 stake program (the contributors' PRs branched off pre-v17 c3a617a and auto-merged into the v17 CRITICAL-1 admin redesign incorrectly, so each fix was reviewed and integrated manually). Each was independently verified against source (adversarial review) before integration.

Fixes

Finding	Sev	Fix	Credit
#134	HIGH	Senior deposits priced against the senior sub-pool (mirrors the withdraw basis) + reject deposit into orphaned senior value (C9), no unconditional 1:1 bootstrap. Closes the deposit-cheap/redeem-dear value extraction from senior LPs after a junior-absorbed loss.	@0x-SquidSol (#135)
#136	MED	Crystallize pending trading-fee surplus into share price BEFORE pricing deposits/withdraws (shared accrue_fees_inner), closing the JIT fee-snipe.	@0x-SquidSol (#137)
#120	LOW	Overflow-safe mul_div_floor in distribute_fees (was handing junior 100% on u128 overflow).	@Nullguy42069 (#133)
#121	LOW	Upper-bound cooldown_slots (MAX_COOLDOWN_SLOTS ~1yr) so an admin can't set u64::MAX and freeze withdrawals.	@Nullguy42069 (#132)
#140	cov	Proptest coverage for tranche math (round-trips, conservation, partition invariants).	@0x-SquidSol (#141)

Verification

• cargo test: ~325 tests pass, 0 failures (incl. new PoCs poc_senior_deposit_mispricing, poc_senior_bootstrap_orphan, poc_jit_fee_snipe, and proptest_math).
• cargo build-sbf: BPF artifact compiles clean (189 KB).

Notes / deferred

• The contributor stack also bundled hardening commits fix: validate authority == vault_auth PDA in AdminSetInsurancePolicy (privilege escalation) #126 (AdminSetInsurancePolicy vault_auth check) — obviated: that handler doesn't exist in v17 (replaced by bind/burn/rotate insurance_authority) — and fix: lock junior_fee_mult_bps once juniors are deposited #127/ci: add BPF tree-shake verification for dev-only CVE ignores #129/test: add Kani proofs for effective_junior_balance wrapper composition #130, left out of this PR (separate optional hardening, not in the verified-findings set).
• Kani proofs from test(tranche): Kani proofs + proptests for tranche math (close coverage gap) #141 deferred — they need merging into v17's existing kani-proofs crate + the kani toolchain to run; proptest coverage lands now.

Closes #120, #121, #134, #136, #140. Supersedes #132, #133, #135, #137, #141 (integrated here with attribution).

Summary by CodeRabbit

Release Notes

• Bug Fixes

  • Fixed fee distribution calculation at extreme balances to prevent incorrect tranche allocation
  • Enhanced LP minting for senior tranches with improved safety guardrails
  • Added validation to prevent withdrawal cooldowns from permanently freezing withdrawals
  • Fixed deposit and withdrawal pricing in trading pools to properly account for pending fees
  • Blocked potential exploit in senior tranche deposits during bootstrap phase

• Tests

  • Added comprehensive regression and property tests covering edge cases and tranche scenarios

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: ec4c784e-fa16-4f24-b565-4a2caaeca3b3

📥 Commits

Reviewing files that changed from the base of the PR and between bdd0539 and 3cabf8e.

📒 Files selected for processing (6)

• src/math.rs
• src/processor.rs
• tests/poc_jit_fee_snipe.rs
• tests/poc_senior_bootstrap_orphan.rs
• tests/poc_senior_deposit_mispricing.rs
• tests/proptest_math.rs

---

📝 Walkthrough

Walkthrough

Fixes three exploitable tranche/trading-pool vulnerabilities: senior LP deposits are repriced against the senior sub-pool via a new calc_senior_lp_for_deposit (with orphaned-value guard); trading-pool deposits and withdrawals now crystallize unaccrued vault surplus via a new accrue_fees_inner helper before pricing; and distribute_fees switches to an overflow-safe mul_div_floor to correct extreme-balance fee splits. Also adds MAX_COOLDOWN_SLOTS validation and comprehensive PoC/property-test coverage.

Changes

Tranche security fixes: senior deposit pricing, JIT fee-snipe prevention, overflow-safe math

Layer / File(s)	Summary
mul_div_floor helper and distribute_fees overflow fix src/math.rs	Introduces mul_div_floor using a 256-bit-style fast/slow long-division path, and replaces the overflow-clamping fallback in distribute_fees with the exact helper, preventing incorrect 100%-to-junior allocation at extreme u128 balance ranges (fixes #120).
calc_senior_lp_for_deposit with orphan guard src/math.rs	Adds pub fn calc_senior_lp_for_deposit delegating to calc_lp_for_deposit against senior sub-pool parameters, inheriting orphaned-value blocking (senior_total_lp == 0 && senior_balance > 0 → None) and round-down semantics; extends unit tests for all guard cases.
accrue_fees_inner extraction and JIT pre-crystallization src/processor.rs	Extracts fee accrual into accrue_fees_inner; wires both process_deposit and process_withdraw in trading-pool mode to crystallize pending vault surplus before LP pricing/burn; deposit path also switches to calc_senior_lp_for_deposit when tranches are enabled.
MAX_COOLDOWN_SLOTS config bound src/processor.rs	Introduces MAX_COOLDOWN_SLOTS and extends validate_cooldown_slots to reject both zero-valued and over-maximum cooldown configuration.
JIT fee-snipe PoC and regression tests tests/poc_jit_fee_snipe.rs	Models current vs. fixed deposit helpers; demonstrates attacker profitability with uncrystallized surplus at stale pricing, then asserts the fixed pre-accrual path prevents the snipe and preserves honest LP fair value.
Senior bootstrap orphan (C9-bypass) PoC tests tests/poc_senior_bootstrap_orphan.rs	Constructs orphaned-state pools; demonstrates the prior 1:1 bootstrap drained orphaned balance; asserts the fix returns None for orphan deposits while legitimate first-senior deposits still mint 1:1.
Senior deposit mispricing PoC tests tests/poc_senior_deposit_mispricing.rs	Reproduces the global-price exploit path, asserts sub-pool pricing prevents extraction without diluting incumbents, and verifies first-senior bootstrap correctness.
Proptest tranche math property suite tests/proptest_math.rs	Adds tranche_pool helper and proptest! suite asserting loss/fee conservation, orphan blocking, first-depositor 1:1, no-profit round-trips, and valuation partitioning invariants against real production functions.

Sequence Diagram(s)

sequenceDiagram
  rect rgba(180, 60, 60, 0.5)
    note over Attacker,process_deposit: Vulnerable path (before fix)
    Attacker->>process_deposit: deposit at stale total_pool_value()
    process_deposit->>calc_lp_for_deposit: price LP (surplus not crystallized)
    calc_lp_for_deposit-->>process_deposit: over-minted LP shares
    Attacker->>process_accrue_fees: trigger AccrueFees
    process_accrue_fees->>accrue_fees_inner: crystallize surplus
    Attacker->>process_withdraw: withdraw (profit extracted)
  end
  rect rgba(40, 140, 80, 0.5)
    note over Depositor,process_deposit: Fixed path
    Depositor->>process_deposit: deposit(amount)
    process_deposit->>accrue_fees_inner: crystallize vault surplus first
    accrue_fees_inner->>distribute_fees: allocate delta to junior (mul_div_floor)
    process_deposit->>calc_senior_lp_for_deposit: price LP against senior sub-pool
    calc_senior_lp_for_deposit-->>process_deposit: correct LP shares (or None if orphaned)
    process_deposit-->>Depositor: mint LP
  end

Loading

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~60 minutes

Possibly related issues

• #120 (linked): distribute_fees double-overflow fallback gives 100% to junior at extreme u64 values — directly fixed by the new mul_div_floor helper replacing the overflow-clamping fallback in distribute_fees, with the exact scenario from the issue reproduced in test_distribute_fees_overflow_proportional.
• Trading-LP deposits do not crystallize pending fees before pricing — JIT depositor captures fees earned by existing LPs #136: JIT fee-snipe via uncrystallized vault surplus — directly addressed by accrue_fees_inner pre-crystallization in deposit and withdraw paths, with tests/poc_jit_fee_snipe.rs as the exact PoC regression.
• Senior LP deposits priced against the global pool but redeemed against the senior sub-pool — unprivileged value extraction from senior LPs after a junior-absorbed loss #134: Senior deposit/withdraw pricing asymmetry — directly fixed by calc_senior_lp_for_deposit pricing against the senior sub-pool, with tests/poc_senior_deposit_mispricing.rs as the regression.
• Coverage gap: tranche (senior/junior) math has no Kani or proptest coverage #140: Missing proptest coverage for tranche math — addressed by the new proptest! suite in tests/proptest_math.rs covering all listed invariants.
• HIGH: First-depositor share-inflation lets an unprivileged depositor steal the next depositor's entire stake in trading-LP pools #138: First-depositor share-inflation via permissionless AccrueFees — mitigated by the fee crystallization guard added in process_deposit.

Possibly related PRs

• dcccrypto/percolator-stake#22: Both PRs modify validate_cooldown_slots in src/processor.rs to add bounds checking on the cooldown configuration value.
• dcccrypto/percolator-stake#98: Both PRs change tranche fee-accrual and junior/senior allocation logic driven by distribute_fees in processor.rs.
• dcccrypto/percolator-stake#112: The new calc_senior_lp_for_deposit delegates to calc_lp_for_deposit, whose None-propagation behavior for total_pool_value() == None directly affects orphan-guard and senior deposit tests introduced here.

Poem

🐇 Hoppity-hop through the tranche we go,
No orphaned value shall sneak past my nose!
I crystallize fees before prices are set,
And mul-div-floor keeps the math correct yet.
The JIT sniper finds nothing to steal —
This bunny patched math with arithmetic zeal! 🌟

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch bounty/stake-fixes

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}