Skip to content

[yAudit-03] Fix swap fee accrual on realized gain - #306

Merged
clement-ux merged 2 commits into
mainfrom
clement/yaudit_03-realized-swap-fees
Jul 22, 2026
Merged

[yAudit-03] Fix swap fee accrual on realized gain#306
clement-ux merged 2 commits into
mainfrom
clement/yaudit_03-realized-swap-fees

Conversation

@clement-ux

@clement-ux clement-ux commented Jul 21, 2026

Copy link
Copy Markdown
Collaborator

Summary

  • accrue buy-side performance fees from the value of the actual settled input rather than the quoted notional spread
  • pass amountIn through swap liquidity validation so exact-input and exact-output swaps use the same realized-gain basis
  • update fork, fuzz, and invariant fee expectations and add a regression test for 18-to-6 decimal truncation below one base unit
  • harden the Ethena and Lido invariant handlers so corpus mutations remain ABI-decodable in strict mode

Invariant harness

The invariant handlers accept full-word uint256 inputs and derive booleans or bound narrower values internally. This prevents mutated calldata from reverting in the Solidity ABI dispatcher before handler execution.

Testing

  • Full suite excluding invariants: 531 passed, 0 failed, 3 skipped
  • Ethena invariants with FOUNDRY_INVARIANT_FAIL_ON_REVERT=true: 256 runs, 12,800 calls, 0 reverts
  • Lido invariants with FOUNDRY_INVARIANT_FAIL_ON_REVERT=true: 256 runs, 12,800 calls, 0 reverts

Audit report

Related yAudit issue: https://github.com/yAudit/origin-paxos-adapter-review/issues/3

@clement-ux clement-ux changed the title Fix swap fee accrual on realized gain [yAudit-03] Fix swap fee accrual on realized gain Jul 21, 2026
@clement-ux clement-ux added the Audit Fix Resolves findings from security audit. label Jul 21, 2026
@clement-ux clement-ux self-assigned this Jul 21, 2026

@naddison36 naddison36 left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is a good find.
I've checked the new method is economically equivalent without rounding issues. The new method is better as it handles the rounding.

@clement-ux
clement-ux merged commit f953506 into main Jul 22, 2026
7 checks passed
@clement-ux
clement-ux deleted the clement/yaudit_03-realized-swap-fees branch July 22, 2026 07:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Audit Fix Resolves findings from security audit.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants