Skip to content

yash/fix/remove-acceptable-share-rate#450

Merged
0xpanicError merged 2 commits into
yash/security-upgrade-fixesfrom
yash/fix/remove-acceptable-share-rate
Jun 2, 2026
Merged

yash/fix/remove-acceptable-share-rate#450
0xpanicError merged 2 commits into
yash/security-upgrade-fixesfrom
yash/fix/remove-acceptable-share-rate

Conversation

@0xpanicError
Copy link
Copy Markdown

@0xpanicError 0xpanicError commented Jun 2, 2026

Note

High Risk
Changes withdrawal finalize and claim payout math by allowing any liquidity-pool share rate at snapshot and on legacy live-rate fallback, with no on-chain circuit breaker.

Overview
WithdrawRequestNFT no longer enforces configurable min/max acceptable share rates. The constructor drops the two rate immutables and their validation; finalizeRequests always snapshots liquidityPool.amountPerShareCeil() without a bounds check; and the legacy-claim path in _getClaimableAmount uses the live rate with no min/max guard. Related errors (InvalidShareRate, InvalidLiveRate, etc.) are removed.

All upgrade scripts, fork tests, integration tests, and WithdrawRequestNFT test helpers are updated to deploy the shorter constructor. Invariant coverage that asserted frozen rates stayed within [min, max] is deleted or simplified accordingly.

Reviewed by Cursor Bugbot for commit aedf156. Bugbot is set up for automated code reviews on this repo. Configure here.

@chatgpt-codex-connector
Copy link
Copy Markdown

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Credits must be used to enable repository wide code reviews.

Copy link
Copy Markdown

@cursor cursor Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Fix All in Cursor

❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.

Reviewed by Cursor Bugbot for commit 92457d3. Configure here.

Comment thread src/withdrawals/WithdrawRequestNFT.sol
@0xpanicError 0xpanicError changed the base branch from yash/refactor/natspec to yash/security-upgrade-fixes June 2, 2026 17:58
@0xpanicError 0xpanicError merged commit 3ed699c into yash/security-upgrade-fixes Jun 2, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants