Skip to content

fix(stableswap): correct inverted admin/non-admin fee branch in swap-x-for-y and swap-y-for-x#15

Open
sonic-mast wants to merge 2 commits into
BitflowFinance:mainfrom
sonic-mast:fix/ststx-stableswap-fee-inversion
Open

fix(stableswap): correct inverted admin/non-admin fee branch in swap-x-for-y and swap-y-for-x#15
sonic-mast wants to merge 2 commits into
BitflowFinance:mainfrom
sonic-mast:fix/ststx-stableswap-fee-inversion

Conversation

@sonic-mast

Copy link
Copy Markdown

Summary

Fixes finding F-01 from Sonic Mast audit (2026-06-07) of SPQC38PW542EQJ5M11CR25P7BS1CA6QT4TBXGB3M.stableswap-stx-ststx-v-1-2.

Finding F-01 (High): Fee exemption inverted — non-admins pay 0 fees on all swaps.

Both swap-x-for-y and swap-y-for-x had the admin/non-admin branch order reversed in all 6 fee conditionals. When (is-some (index-of (var-get admins) tx-sender)) evaluates to true (admin), the code was entering the fee branch; when it evaluated to false (non-admin), it entered the zero-fee branch — opposite of intent. The comment says "Admins pay no fees on swaps" but the branch selection was inverted.

Before:

(swap-fee-lps (if (is-some (index-of (var-get admins) tx-sender))
    (get lps (var-get buy-fees))          ;; admin → paid fees (wrong)
    (get lps (var-get admin-swap-fees))   ;; non-admin → 0 bps (wrong)
))

After:

(swap-fee-lps (if (is-some (index-of (var-get admins) tx-sender))
    (get lps (var-get admin-swap-fees))   ;; admin → 0 bps (correct)
    (get lps (var-get buy-fees))          ;; non-admin → configured fee (correct)
))

All 3 fee components (swap-fee-lps, swap-fee-stacking-dao, swap-fee-bitflow) corrected in both swap-x-for-y and swap-y-for-x (6 conditionals total, lines ~332–344 and ~454–466).

Impact: Since deployment, all non-admin swap volume has collected zero LP, StackingDAO, and Bitflow protocol fees. This PR restores correct fee routing. No user principal is at risk — only fee revenue was affected.

Audit source: Sonic Mast audit 2026-06-07, bounty mpwj216i51b1ad3c6731

…x-for-y and swap-y-for-x

Addresses finding F-01 from Sonic Mast audit (2026-06-07):
All 6 fee conditionals in swap-x-for-y (lines 332-344) and swap-y-for-x
(lines 454-466) had their branches inverted — admins paid configured fees
while non-admins received admin-swap-fees (0 bps).

Fix: swap true/false branches so:
- Admin (is-some returns true) -> admin-swap-fees (0 bps as intended)
- Non-admin (is-some returns false) -> buy-fees/sell-fees (configured rates)

Audit: https://gist.github.com/sonic-mast/c3a352aa6b9b46dd42e36f163d9d9b2d
…x-for-y and swap-y-for-x

Addresses finding F-01 from Sonic Mast audit (2026-06-07):
All 6 fee conditionals in swap-x-for-y (lines 332-344) and swap-y-for-x
(lines 454-466) had their branches inverted -- admins paid configured fees
while non-admins received admin-swap-fees (0 bps).

Fix: swap true/false branches so:
- Admin (is-some returns true) -> admin-swap-fees (0 bps as intended)
- Non-admin (is-some returns false) -> buy-fees/sell-fees (configured rates)

Audit gist: https://gist.github.com/sonic-mast/c3a352aa6b9b46dd42e36f163d9d9b2d
Finding: F-01 (High severity)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant