fix: skip fee accrual in AccrueFees when no LP holders exist

[0x-SquidSol]

Summary

• When total_lp_supply == 0 (no depositors yet), accruing fees sets total_fees_earned > 0 while lp supply is still 0
• The first-depositor path in calc_lp_for_deposit requires both total_lp_supply == 0 AND total_pool_value == 0 to grant 1:1 pricing; any positive pool_value with zero LP causes every deposit call to return None
• Attack: send 1 token directly to the vault, call AccrueFees → total_fees_earned = 1 → all future deposits blocked permanently. Cost: 1 token
• Fix: guard the fee delta block with && pool.total_lp_supply > 0; surplus vault balance is ignored when there are no LP holders (it will be naturally recaptured after the first deposit)

Test plan

• cargo test passes (57/57)
• Sending tokens directly to vault before first deposit no longer locks the pool
• Normal fee accrual still works correctly when LP holders exist

[coderabbitai]

Warning

Rate limit exceeded

@0x-SquidSol has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 4 minutes and 46 seconds before requesting another review.

Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 4 minutes and 46 seconds.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 72e8bb4e-b44f-40a2-bfe9-6cf6af89d937

📥 Commits

Reviewing files that changed from the base of the PR and between 1881738 and 2c1b895.

📒 Files selected for processing (1)

• src/processor.rs

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[dcccrypto]

Security review — Skip fee accrual when no LP holders exist. Prevents division by zero / phantom fee accumulation. Security APPROVED ✅

[dcccrypto]

🛡️ Security APPROVED. Prevents permanent pool lock via direct vault token transfer before first deposit. When total_lp_supply==0, accruing fees would make pool_value>0 and block all future deposits (calc_lp_for_deposit first-depositor check fails). Guard is correct and minimal.

[dcccrypto]

Superseded by PR#95 (merged) and PR#96 (omnibus test coverage). All changes in this PR are already in master. Closing as part of PERC-8433 cleanup.

[dcccrypto]

Implemented in PR #98 and merged to master. Thank you for identifying this vulnerability — the fix was applied based on your diff after two rounds of security review.