fix(stake): junior JIT fee-snipe (#146) + junior-mult lock & tranche Kani (#143)

[dcccrypto]

Integrates two verified stake fixes (cherry-picked with attribution; build-sbf clean + 327 tests pass):

• Junior deposit path omits the mode-1 fee pre-accrue — permissionless JIT trading-fee snipe on the junior tranche #146/fix(stake,v17): pre-accrue mode-1 fees on the junior deposit path (closes #146) #147: process_deposit_junior omitted the mode-1 fee pre-accrue (junior twin of the senior Trading-LP deposits do not crystallize pending fees before pricing — JIT depositor captures fees earned by existing LPs #136 fix) → permissionless JIT fee-snipe on the junior tranche. Centralizes the guard into pre_accrue_mode1(pool, vault) used by senior deposit, withdraw, AND junior deposit.
• v17 convergence dropped two pre-v17 protections: junior_fee_mult_bps lock + tranche-math Kani proofs #143/fix(stake,v17): restore junior_fee_mult_bps lock + tranche-math Kani proofs dropped in v17 convergence #144: restores the junior_fee_mult_bps lock (block value-change in AdminSetTrancheConfig while junior_total_lp>0; idempotent same-value allowed; unlocks when juniors exit) + tranche-math Kani proofs. (Low/hardening — verified it does NOT break the existing admin-set-tranche tests.)

Closes #146, #143. Supersedes #147, #144.

Summary by CodeRabbit

• New Features

  • Added governance lock for tranche configuration to prevent changes when junior LPs are active.

• Bug Fixes

  • Fixed fee crystallization in junior deposit pricing to prevent LP price manipulation.

• Tests

  • Expanded formal verification from 44 to 54 harnesses.
  • Added regression test for junior tranche fee exploit scenario.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: a17c5391-ebd1-4692-a3d9-3d49c2e112dc

📥 Commits

Reviewing files that changed from the base of the PR and between a5562ef and 8200b1f.

📒 Files selected for processing (3)

• kani-proofs/src/lib.rs
• src/processor.rs
• tests/poc_junior_jit_fee_snipe.rs

---

📝 Walkthrough

Walkthrough

Fixes a permissionless junior-tranche JIT fee-snipe by adding a pre_accrue_mode1 helper that crystallizes pending trading fees before pricing, called from process_deposit_junior (the missing site), process_deposit, and process_withdraw. Adds a governance lock on junior_fee_mult_bps while junior LPs exist. Extends kani-proofs/src/lib.rs with tranche math helpers and 9 new proof harnesses, plus a PoC regression test.

Changes

Junior JIT Fee Snipe Fix, Tranche Math Proofs, and Regression Tests

Layer / File(s)	Summary
Tranche math helpers kani-proofs/src/lib.rs	Adds calc_subpool_lp_for_deposit, calc_subpool_collateral_for_withdraw, distribute_loss, distribute_fees, total_pool_value_mode0, effective_junior_balance, and senior_balance as pub functions; updates Kani suite harness count header.
Kani SECTION 15 tranche proof harnesses kani-proofs/src/lib.rs	Adds 9 Kani harnesses verifying loss/fee conservation, junior-first absorption, all-fees-to-junior when senior is zero, sub-pool C9 orphan rejection, 1:1 first deposit, deposit→withdraw no-profit, senior valuation non-underflow, and senior_balance + effective_junior_balance == pool_value.
pre_accrue_mode1 helper and processor wiring src/processor.rs	Extracts the mode-1 pre-accrue inline blocks from process_deposit and process_withdraw into shared private helper pre_accrue_mode1(pool, vault); adds the missing call in process_deposit_junior before LP pricing.
junior_fee_mult_bps governance lock src/processor.rs	process_admin_set_tranche_config rejects multiplier changes while junior_total_lp() > 0; rewrites to the same stored value are still allowed.
PoC regression tests tests/poc_junior_jit_fee_snipe.rs	Two-test file: first test asserts the snipe is profitable with current (unfixed) pricing; second test asserts the fixed pre-accrue path yields no profit for the attacker.

Sequence Diagram(s)

sequenceDiagram
  participant Eve as Eve (Attacker)
  participant process_deposit_junior
  participant pre_accrue_mode1
  participant accrue_fees_inner
  participant AccrueFees as AccrueFees (permissionless)
  participant process_withdraw_junior

  Note over process_deposit_junior: BEFORE FIX — no pre-accrue
  Eve->>process_deposit_junior: DepositJunior(1_000_000)
  process_deposit_junior->>process_deposit_junior: price LP at stale junior balance (no fee crystallization)
  process_deposit_junior-->>Eve: 1_000_000 junior LP minted at stale price

  Eve->>AccrueFees: AccrueFees (permissionless)
  AccrueFees->>accrue_fees_inner: fold 1_000_000 surplus into balances
  accrue_fees_inner-->>AccrueFees: junior_balance += 800_000

  Eve->>process_withdraw_junior: Withdraw(1_000_000 LP)
  process_withdraw_junior-->>Eve: 1_400_000 collateral (profit +400_000)

  Note over process_deposit_junior: AFTER FIX — pre_accrue_mode1 added
  Eve->>process_deposit_junior: DepositJunior(1_000_000)
  process_deposit_junior->>pre_accrue_mode1: pool, vault (pre-transfer balance)
  pre_accrue_mode1->>accrue_fees_inner: crystallize surplus before pricing
  accrue_fees_inner-->>pre_accrue_mode1: fees already folded
  pre_accrue_mode1-->>process_deposit_junior: done
  process_deposit_junior->>process_deposit_junior: price LP at updated junior balance
  process_deposit_junior-->>Eve: fewer LP minted at fair post-accrue price

  Eve->>process_withdraw_junior: Withdraw(LP)
  process_withdraw_junior-->>Eve: ≤1_000_000 collateral (no profit)

Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related issues

• Junior deposit path omits the mode-1 fee pre-accrue — permissionless JIT trading-fee snipe on the junior tranche #146 — This PR directly implements the exact fix described in the issue: adding pre_accrue_mode1 to process_deposit_junior before junior LP pricing, plus the PoC regression test (tests/poc_junior_jit_fee_snipe.rs) that matches the issue's proof-of-concept code almost exactly.
• v17 convergence dropped two pre-v17 protections: junior_fee_mult_bps lock + tranche-math Kani proofs #143 — The junior_fee_mult_bps governance lock added to process_admin_set_tranche_config and the new tranche Kani proof harnesses directly address the two missing protections identified in that issue.

Possibly related PRs

• dcccrypto/percolator-stake#98: Introduces the same effective_junior_balance / tranche accounting functions and distribute_fees logic that this PR mirrors in kani-proofs/src/lib.rs and applies in processor.rs.
• dcccrypto/percolator-stake#142: Fixes production distribute_fees / senior pricing that feeds the same tranche accounting invariants now formally proven in this PR's Kani SECTION 15.

Poem

🐇 Hop hop, the sniper set a trap so sly,
Minting LP shares while fees slipped by.
But now we pre-accrue before the price,
The junior tranche is guarded — nice!
No free lunch for Eve, the math rings true,
Senior, junior, balanced as dew. 🌿

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch bounty/stake-junior-jit-lock

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}