You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
maintenance-pool::reclaim_deposit refunds the full original deposit, even if most of it was already paid out as rewards #534
reclaim_deposit transfers deposit.amount as long as deposit.amount <= pool.balance. Pool balances are fungible, and withdraw pays rewards from the shared balance. If sponsors A and B each deposit 100 and 150 is paid out, then once the window passes A can reclaim the full 100 out of the remaining 50 + … and leave B with nothing. A's own share of the spending is effectively charged to B. This is separate from the double-reclaim bug (#413 regression): it happens on the first reclaim.
Suggested fix
Refund at most the sponsor's pro-rata share of the current balance (balance * deposit.amount / total_deposited_unreclaimed), and test it with two sponsors and prior withdrawals.
@D-Bluemoon has applied to work on this issue as part of the Stellar Wave Program's 10th wave.
Hi maintainer, I'd like to take this on.
The vulnerability here is clear: reclaim_deposit currently transfers the full deposit.amount as long as it doesn't exceed the total pool balance. Because pool balances are fungible and rewards are paid out from the shared pool, an early claimer can drain the remaining funds—effectively charging their portion of past spending onto other sponsors.
My plan for the PR:
Update reclaim_deposit to cap the refund at the sponsor's pro-rata share of the current balance (
balance
×
deposit.amount
/
total_deposited_unreclaimed
balance×deposit.amount/total_deposited_unreclaimed).
Add comprehensive test coverage simulating two sponsors making deposits, subsequent reward withdrawals, and partial/pro-rata reclaims to ensure equitable distribution.
Congratulations, @D-Bluemoon! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on October 22, 2026.
🧑💻 @D-Bluemoon: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.
Warning
When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.
🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.
😎 @D-Bluemoon: You earned 200 Points for completing this issue! Once the Wave's rewards are finalized, you'll be eligible for a percentage of the Wave's reward pool based on the percentage of total points you've earned. Learn more here. You can also Leave a review to share your experience working on this issue.
🧑💻 Repo maintainers: How'd the contributor do? Leave a review to share your experience working with them.
Activity
test: pro-rata reclaim coverage (MergeFi#534)
test: pro-rata reclaim coverage (MergeFi#534)
test: pro-rata reclaim coverage (MergeFi#534)
gbolly122 commentedon Oct 19, 2026
@gbolly122 has applied to work on this issue as part of the Stellar Wave Program's 10th wave.
ℹ️ Repo Maintainers: To accept this application, review their application or assign @gbolly122 to this issue.
D-Bluemoon commentedon Oct 19, 2026
@D-Bluemoon has applied to work on this issue as part of the Stellar Wave Program's 10th wave.
ℹ️ Repo Maintainers: To accept this application, review their application or assign @D-Bluemoon to this issue.
drips-wave commentedon Oct 19, 2026
Congratulations, @D-Bluemoon! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on October 22, 2026.
🧑💻 @D-Bluemoon: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.
Warning
When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.
🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.
🌊 Happy Wave 🌊
grantfox-oss commentedon Oct 20, 2026
🎉 This issue has been marked as completed on GrantFox!
@D-Bluemoon's PR #750 was approved and merged by @chonilius.
🏆 @D-Bluemoon: You earned 35 FoxPoints for this contribution! Your current tier: Explorer (914 total points). Track your full progress on GrantFox.
👏 Great work, @D-Bluemoon! Keep contributing to MergeFi.
drips-wave commentedon Oct 20, 2026
This issue has been completed by @D-Bluemoon as part of the Stellar Wave Program's 10th Wave 🥳
😎 @D-Bluemoon: You earned 200 Points for completing this issue! Once the Wave's rewards are finalized, you'll be eligible for a percentage of the Wave's reward pool based on the percentage of total points you've earned. Learn more here. You can also Leave a review to share your experience working on this issue.
🧑💻 Repo maintainers: How'd the contributor do? Leave a review to share your experience working with them.