Skip to content

fix(R-W-03): reject stablePercent > multiplier^2 at commission config time#43

Open
sh3ifu wants to merge 1 commit into
multisig-timelock-duration-testsfrom
CM-R-W-03-fee-shape-invariant-fix
Open

fix(R-W-03): reject stablePercent > multiplier^2 at commission config time#43
sh3ifu wants to merge 1 commit into
multisig-timelock-duration-testsfrom
CM-R-W-03-fee-shape-invariant-fix

Conversation

@sh3ifu

@sh3ifu sh3ifu commented Jun 12, 2026

Copy link
Copy Markdown
Contributor

R-W-03 — Commission config can accept fee shapes that brick the route

Problem

CommissionManager.setGlobalDefaults and setCommissionRule validated
stablePercent and multiplier only individually. The fee formula
stableFee = amount * stablePercent / multiplier^2 means that when
stablePercent > multiplier^2 the quoted fee exceeds the bridged amount,
netAmount = amount - fee underflows with Panic(0x11), and every subsequent
fundsIn/fundsOut on that route reverts until the federation fixes the config
through the timelock. Example brick config: (stablePercent = 9000, multiplier = 1).

Fix

Enforce the joint invariant stablePercent <= multiplier^2 at both setters,
reverting InvalidFeeShape(stablePercent, multiplier) otherwise.
stablePercent == multiplier^2 (100% fee, netAmount = 0) is intentionally
still allowed — it does not underflow.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant