Skip to content

fix: remove erroneous 10^6 multiplier in claim_payout accounting#15

Open
optimus-fulcria wants to merge 1 commit intoStockpileLabs:masterfrom
optimus-fulcria:fix/claim-payout-accounting
Open

fix: remove erroneous 10^6 multiplier in claim_payout accounting#15
optimus-fulcria wants to merge 1 commit intoStockpileLabs:masterfrom
optimus-fulcria:fix/claim-payout-accounting

Conversation

@optimus-fulcria
Copy link
Copy Markdown

Summary

This PR fixes a critical accounting bug in the claim_payout function where project.balance and project.raised were being inflated by a factor of 10^6 compared to the actual tokens transferred.

Bug Details

File: programs/stockpile-v2/src/instructions/claim_payout.rs

The adj_payout variable was being multiplied by 10^6 after the token transfer but before updating project accounting:

// Tokens transferred: adj_payout
token::transfer(..., adj_payout)?;

// Bug: multiplied AFTER transfer
adj_payout *= 10_u64.pow(6) as u64;

// project.balance now 10^6x higher than actual tokens
project.raised += adj_payout;
project.balance += adj_payout;

Impact

  1. Fund Locking: withdraw_all uses project.balance.into() as the transfer amount, which would fail due to insufficient funds (trying to transfer 10^6x more tokens than available)

  2. Accounting Inconsistency: Projects would report inflated raised amounts

Fix

Removed the erroneous 10^6 multiplication so project accounting matches actual token amounts.

Testing

The fix is straightforward - removing one line of code. The existing test suite should validate that claims and withdrawals work correctly with consistent amounts.


Found during Superteam Earn security bounty audit

The adj_payout variable was being multiplied by 10^6 AFTER the token
transfer but BEFORE updating project.raised and project.balance. This
caused a severe accounting mismatch where:

- Actual tokens transferred: adj_payout
- project.balance recorded: adj_payout * 10^6

This bug would cause withdraw_all to fail (trying to transfer more
tokens than available) or lead to incorrect financial reporting.

The fix removes the 10^6 multiplication so that project accounting
matches the actual token amounts transferred.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant