fix: hacken auditing finding F-2024-1979

contracts/linear/src/errors.rs

@@ -1,5 +1,5 @@
 // initialization
-pub const ERR_ALREADY_INITIALZED: &str = "Already initialized";
+pub const ERR_ALREADY_INITIALIZED: &str = "Already initialized";
 pub const ERR_ACCOUNT_STAKING_WHILE_INIT: &str =
     "The current account has staking balance while initialization";
 pub const ERR_NO_ENOUGH_INIT_DEPOSIT: &str =
@@ -53,6 +53,9 @@ pub const ERR_DRAINING: &str = "Validator is currently in draining process";
 pub const ERR_NOT_IN_DRAINING: &str =
     "Validator is not in draining process. Cannot run drain withdraw";
 
+// deposit
+pub const ERR_NON_POSITIVE_DEPOSIT_AMOUNT: &str = "Deposit amount should be positive";
+
 // withdraw
 pub const ERR_NON_POSITIVE_WITHDRAWAL_AMOUNT: &str = "Withdrawal amount should be positive";
 pub const ERR_NO_ENOUGH_UNSTAKED_BALANCE_TO_WITHDRAW: &str =

contracts/linear/src/internal.rs

@@ -15,6 +15,7 @@ impl LiquidStakingContract {
 
     pub(crate) fn internal_deposit(&mut self, amount: Balance) {
         self.assert_running();
+        require!(amount > 0, ERR_NON_POSITIVE_DEPOSIT_AMOUNT);
 
         let account_id = env::predecessor_account_id();
         let mut account = self.internal_get_account(&account_id);

contracts/linear/src/lib.rs

@@ -108,7 +108,7 @@ impl LiquidStakingContract {
     /// It prevents inflating the price of the share too much.
     #[init]
     pub fn new(owner_id: AccountId) -> Self {
-        require!(!env::state_exists(), ERR_ALREADY_INITIALZED);
+        require!(!env::state_exists(), ERR_ALREADY_INITIALIZED);
         require!(
             env::account_locked_balance() == 0,
             ERR_ACCOUNT_STAKING_WHILE_INIT

tests/__tests__/linear/staking-pool-interface.ava.ts

@@ -7,6 +7,7 @@ import {
   test,
 } from './helper';
 
+const ERR_NON_POSITIVE_DEPOSIT_AMOUNT = "Deposit amount should be positive";
 const ERR_UNSTAKED_BALANCE_NOT_AVAILABLE =
   'The unstaked balance is not yet available due to unstaking delay';
 
@@ -18,7 +19,7 @@ test.afterEach(async (t) => {
   await t.context.worker.tearDown();
 });
 
-test('check balances after initlization', async (t) => {
+test('check balances after initialization', async (t) => {
   const { contract, alice } = t.context;
   t.is(
     await contract.view('get_account_staked_balance', { account_id: alice }),
@@ -36,6 +37,16 @@ test('check balances after initlization', async (t) => {
   );
 });
 
+test('deposit 0 NEAR is not allowed', async (t) => {
+  const { contract, alice } = t.context;
+  // deposit 0 NEAR will fail
+  await assertFailure(
+    t,
+    alice.call(contract, 'deposit', {}, { attachedDeposit: '0' }),
+    ERR_NON_POSITIVE_DEPOSIT_AMOUNT
+  );
+});
+
 test('deposit first and stake later', async (t) => {
   const { contract, alice } = t.context;
   // deposit

tests/__tests__/mock-staking-pool/mock-staking-pool.ava.ts

@@ -34,7 +34,7 @@ async function initWorkSpace(): Promise<WorkSpace> {
   return { worker, contract, alice };
 }
 
-test('check balance after initlization', async (t) => {
+test('check balance after initialization', async (t) => {
   const { contract, alice } = t.context;
   // await root.call(contract, 'set_status', {message: 'lol'});
   t.is(