fix: 9 HIGH-severity tranche/insurance security fixes

[dcccrypto]

Summary

Implements 9 HIGH-severity security fixes identified during comprehensive PR review. These address vulnerabilities in the tranche system, insurance accounting, and admin withdrawal paths.

Fixes included:

• PR fix: close tranche anti-mixing bypass via full LP withdrawal #46 (CVSS 7.5): Close tranche anti-mixing bypass via full LP withdrawal
• PR fix: use senior sub-pool formula for withdrawal when tranches are enabled #70 (CVSS 8.1): Senior withdrawal uses senior sub-pool formula when tranches active
• PR fix: call distribute_fees in AccrueFees so junior LPs receive their fee multiplier #73 (CVSS 6.5): Call distribute_fees in AccrueFees so junior LPs receive fee multiplier
• PR fix: skip fee accrual in AccrueFees when no LP holders exist #85 (CVSS 7.5): Skip fee accrual when no LP holders exist (prevents dust attack pool brick)
• PR fix: junior tranche absorbs insurance losses first via effective_junior_balance() #77 (CVSS 7.5): Junior tranche absorbs insurance losses first via effective_junior_balance()
• PR fix: price junior deposits against effective_junior_balance after losses #86 (CVSS 6.5): Price junior deposits against effective_junior_balance after losses
• PR fix: include total_returned in FlushToInsurance available-balance guard #92 (CVSS 6.5): Include total_returned in FlushToInsurance available-balance guard
• PR fix: validate stake_vault matches pool.vault in AdminWithdrawInsurance #58 (CVSS 7.2): Validate stake_vault matches pool.vault in AdminWithdrawInsurance
• PR fix: reject FlushToInsurance on trading LP pools (pool_mode == 1) #69 (CVSS 7.1): Reject FlushToInsurance on trading LP pools (pool_mode == 1)

Test results

• cargo check: clean
• cargo test: 57 passed, 0 failed
• No IDL changes

Security review

All fixes passed two rounds of security review. Original PRs from 0x-SquidSol — reimplemented here to resolve merge conflicts.

Closes #46, #58, #69, #70, #73, #77, #85, #86, #92

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes
  • Enhanced deposit security by strengthening tranche-mixing prevention
  • Improved withdrawal valuation accuracy for junior and senior tranches
  • Fixed insurance balance accounting and added pool mode validation
  • Added vault address verification for insurance operations
  • Refined fee accrual logic with LP supply guards and improved tranche fee distribution
  • Corrected junior deposit LP pricing calculations

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: ce0dad37-6b16-4c30-8927-27edc352bf1a

📥 Commits

Reviewing files that changed from the base of the PR and between c4b6852 and ef30f81.

📒 Files selected for processing (2)

• src/processor.rs
• src/state.rs

---

📝 Walkthrough

Walkthrough

This pull request modifies deposit, withdrawal, insurance, and fee-handling instruction processors in src/processor.rs and introduces a loss-adjusted junior balance calculation in src/state.rs. Changes include deposit PDA tranche-mixing prevention, withdrawal valuation using loss-adjusted balances, insurance accounting updates, fee accrual guards, and a new pool state method to compute junior balance net of unreturned insurance losses.

Changes

Cohort / File(s)	Summary
Deposit PDA Tranche-Mixing Prevention & LP Pricing src/processor.rs (process_deposit, process_deposit_junior)	process_deposit now rejects all senior deposits into junior-flagged PDAs unconditionally. process_deposit_junior rejects senior deposits into already-initialized PDAs. Both changes remove reliance on LP balance checks. process_deposit_junior also switches to effective_junior_balance() for LP-to-mint calculation.
Withdrawal Valuation src/processor.rs (process_withdraw)	Junior withdrawals now use effective_junior_balance() instead of raw junior balance. Senior withdrawals when tranches are enabled are valued against senior sub-pool only via calc_senior_collateral_for_withdraw(). Non-tranche withdrawals remain valued against global pool.
Insurance & Vault Management src/processor.rs (process_flush_to_insurance, process_admin_withdraw_insurance)	process_flush_to_insurance adds pool-mode validation and updates available vault balance computation to include total_returned. process_admin_withdraw_insurance validates that provided vault key matches the pool's stored vault address.
Fee Accrual & Tranche Distribution src/processor.rs (process_accrue_fees)	Accrual now requires both current_balance > pool_value and pool.total_lp_supply > 0. When tranches are active and junior LP exists, fees are distributed between junior and senior sub-pools via distribute_fees(), with junior balance share adjusted accordingly.
Pool State Loss Adjustment src/state.rs	New public method effective_junior_balance() computes junior balance net of unreturned insurance losses using distribute_loss(). Updated senior_balance() uses effective_junior_balance() instead of raw junior_balance() when subtracting from total pool value.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

Poem

🐰 Deposits now stand proud, each in their rightful lane,
No mixing tranches, no clever bypass game!
With losses dispersed and fees justly shared,
The pool runs truer, with safeguards prepared. ✨

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/stake-security-batch-2

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}