Repository navigation
compute_split accepts duplicate recipients and 0-bps entries #540
Description
Problem
mergefi_common::compute_split only checks non-empty, Σbps == 10_000 and no self-payout. [(A, 5000), (A, 5000)] and [(A, 10000), (B, 0)] are both accepted. Duplicates make two separate transfers to the same address (wasting fees and confusing indexers). A 0-bps recipient gets a zero transfer that release silently skips, and it can still win a dust stroop. mergefi-backend rejects duplicates (#358 there), but the contract, which is the source of truth, doesn't.
Suggested fix
Reject bps == 0 and duplicate addresses with InvalidSplit, and add cases to test_fuzz.rs.
Related: #17
Activity
urielit1313-creator commentedon Oct 14, 2026
Submitted PR #595 addressing this issue by validating recipient addresses and shares in
compute_split:bps == 0withSplitError::InvalidSplit.SplitError::InvalidSplit.mergefi-commonand integration test coverage inmergefi-escrowandmergefi-milestones.Bounty Payout Address (Base USDC):
0xfE777c43e4B0A24fFA1527eD520d1E7f9ECED483fix(MergeFi#540): Address equality without deref; duplicate-recipient…
opencode13241-eng commentedon Oct 19, 2026
traced loop in
contracts/common/src/split.rs:59-67. missing zero-bps (bps == 0) and duplicate address guards before allocation loop. addedSplitError::InvalidSplitchecks +test_fuzz.rscases.cargo test -p mergefi-commonclean. please assign so i can open the pr.Michael997glitch commentedon Oct 20, 2026
@Michael997glitch has applied to work on this issue as part of the Stellar Wave Program's 10th wave.
ℹ️ Repo Maintainers: To accept this application, review their application or assign @Michael997glitch to this issue.
ArtaXerxes-oss commentedon Oct 20, 2026
@ArtaXerxes-oss has applied to work on this issue as part of the Stellar Wave Program's 10th wave.
ℹ️ Repo Maintainers: To accept this application, review their application or assign @ArtaXerxes-oss to this issue.
drips-wave commentedon Oct 20, 2026
Congratulations, @ArtaXerxes-oss! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on October 22, 2026.
🧑💻 @ArtaXerxes-oss: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.
Warning
When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.
🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.
🌊 Happy Wave 🌊
grantfox-oss commentedon Oct 20, 2026
🎉 This issue has been marked as completed on GrantFox!
@ArtaXerxes-oss's PR #753 was approved and merged by @chonilius.
🏆 @ArtaXerxes-oss: You earned 35 FoxPoints for this contribution! Your current tier: Explorer (525 total points). Track your full progress on GrantFox.
👏 Great work, @ArtaXerxes-oss! Keep contributing to MergeFi.
drips-wave commentedon Oct 20, 2026
This issue has been completed by @ArtaXerxes-oss as part of the Stellar Wave Program's 10th Wave 🥳
😎 @ArtaXerxes-oss: You earned 200 Points for completing this issue! Once the Wave's rewards are finalized, you'll be eligible for a percentage of the Wave's reward pool based on the percentage of total points you've earned. Learn more here. You can also Leave a review to share your experience working on this issue.
🧑💻 Repo maintainers: How'd the contributor do? Leave a review to share your experience working with them.