Skip to content

maintenance-pool::reclaim_deposit refunds the full original deposit, even if most of it was already paid out as rewards #534

Closed

Description

@chonilius

Problem

reclaim_deposit transfers deposit.amount as long as deposit.amount <= pool.balance. Pool balances are fungible, and withdraw pays rewards from the shared balance. If sponsors A and B each deposit 100 and 150 is paid out, then once the window passes A can reclaim the full 100 out of the remaining 50 + … and leave B with nothing. A's own share of the spending is effectively charged to B. This is separate from the double-reclaim bug (#413 regression): it happens on the first reclaim.

Suggested fix

Refund at most the sponsor's pro-rata share of the current balance (balance * deposit.amount / total_deposited_unreclaimed), and test it with two sponsors and prior withdrawals.

Related: #413, #414

Activity

  1. added
    bugSomething isn't working
    securitySecurity-related issue
    Stellar WaveIssues in the Stellar wave program
    and removed
    Stellar WaveIssues in the Stellar wave program
    on Oct 13, 2026
  2. gbolly122 commented on Oct 19, 2026

    @gbolly122

    @gbolly122 has applied to work on this issue as part of the Stellar Wave Program's 10th wave.

    Hi Maintainer I would love to work on this issue

    ℹ️ Repo Maintainers: To accept this application, review their application or assign @gbolly122 to this issue.

  3. D-Bluemoon commented on Oct 19, 2026

    @D-Bluemoon
    Contributor

    @D-Bluemoon has applied to work on this issue as part of the Stellar Wave Program's 10th wave.

    Hi maintainer, I'd like to take this on.

    The vulnerability here is clear: reclaim_deposit currently transfers the full deposit.amount as long as it doesn't exceed the total pool balance. Because pool balances are fungible and rewards are paid out from the shared pool, an early claimer can drain the remaining funds—effectively charging their portion of past spending onto other sponsors.

    My plan for the PR:

    Update reclaim_deposit to cap the refund at the sponsor's pro-rata share of the current balance (
    balance
    ×
    deposit.amount
    /
    total_deposited_unreclaimed
    balance×deposit.amount/total_deposited_unreclaimed).

    Add comprehensive test coverage simulating two sponsors making deposits, subsequent reward withdrawals, and partial/pro-rata reclaims to ensure equitable distribution.

    I'll have a clean PR ready promptly.

    ℹ️ Repo Maintainers: To accept this application, review their application or assign @D-Bluemoon to this issue.

  4. drips-wave commented on Oct 19, 2026

    @drips-wave

    Congratulations, @D-Bluemoon! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on October 22, 2026.

    🧑‍💻 @D-Bluemoon: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

    Warning

    When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

    🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

    🌊 Happy Wave 🌊

  5. grantfox-oss commented on Oct 20, 2026

    @grantfox-oss

    🎉 This issue has been marked as completed on GrantFox!

    @D-Bluemoon's PR #750 was approved and merged by @chonilius.

    🏆 @D-Bluemoon: You earned 35 FoxPoints for this contribution! Your current tier: Explorer (914 total points). Track your full progress on GrantFox.

    👏 Great work, @D-Bluemoon! Keep contributing to MergeFi.

  6. drips-wave commented on Oct 20, 2026

    @drips-wave

    This issue has been completed by @D-Bluemoon as part of the Stellar Wave Program's 10th Wave 🥳

    😎 @D-Bluemoon: You earned 200 Points for completing this issue! Once the Wave's rewards are finalized, you'll be eligible for a percentage of the Wave's reward pool based on the percentage of total points you've earned. Learn more here. You can also Leave a review to share your experience working on this issue.

    🧑‍💻 Repo maintainers: How'd the contributor do? Leave a review to share your experience working with them.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

Stellar WaveIssues in the Stellar wave programbugSomething isn't workingsecuritySecurity-related issue

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions