Bug: New rate limiting breaks 6 existing security tests (173/179)

Brouie commented

2026-03-26 03:28:03 +00:00

(Migrated from gitlab.com)

After pulling rate limit + nonce replay push, make solana-test gives 173/179 (6 failing). All failures are RateLimitExceededPerPeriod (error 6035) in existing tests that were not updated to configure rate limits before withdrawals. Affected: full_security_audit (2), security_audit (2), spl_security (2). New rate_limit test passes. Tests need to call set_rate_limit with sufficient limits in setup.

Brouie commented

2026-03-26 03:40:53 +00:00

(Migrated from gitlab.com)

mentioned in issue #67

PlasticDigits commented

2026-03-26 13:49:45 +00:00

(Migrated from gitlab.com)

mentioned in commit 77f7b14358

mentioned in commit 77f7b14358ac44eba03d2186536be7fc38a7df45

PlasticDigits commented

2026-03-26 13:49:51 +00:00

(Migrated from gitlab.com)

@brouie Please verify when you have a moment.

#76 fix pushed on feat/solana-integration (77f7b14).

Added setExplicitUnlimitedWithdrawRateLimit in test setup and wired it in security_audit, full_security_audit, and spl_security (native SOL + each SPL fixture mint) so implicit supply/1000 withdraw caps do not hit RateLimitExceededPerPeriod (6035).
deposit_withdraw: corrected native withdraw amount to 18-decimal scale for the EVM mapping so the normalized payout is actually 0.5 SOL (the old constant normalized to 0 lamports and broke the balance assertion).
full_security_audit “attacker execute” case: extra 2s sleep after the wrong-recipient attempt avoids flaky DelayNotElapsed on the strict delay boundary.

anchor test in packages/contracts-solana: 179 passing.

@brouie Please verify when you have a moment. **#76 fix pushed** on `feat/solana-integration` (77f7b14). - Added `setExplicitUnlimitedWithdrawRateLimit` in test setup and wired it in `security_audit`, `full_security_audit`, and `spl_security` (native SOL + each SPL fixture mint) so implicit `supply/1000` withdraw caps do not hit `RateLimitExceededPerPeriod` (6035). - `deposit_withdraw`: corrected native withdraw amount to 18-decimal scale for the EVM mapping so the normalized payout is actually 0.5 SOL (the old constant normalized to 0 lamports and broke the balance assertion). - `full_security_audit` “attacker execute” case: extra 2s sleep after the wrong-recipient attempt avoids flaky `DelayNotElapsed` on the strict delay boundary. `anchor test` in `packages/contracts-solana`: **179 passing**.

PlasticDigits commented

2026-03-26 13:50:09 +00:00

(Migrated from gitlab.com)

@brouie Could you please verify the #76 fix on feat/solana-integration when you have time (Solana anchor test / make solana-test in packages/contracts-solana)? Leaving this issue open until you confirm.

@brouie Could you please verify the #76 fix on `feat/solana-integration` when you have time (Solana `anchor test` / `make solana-test` in `packages/contracts-solana`)? Leaving this issue open until you confirm.

Brouie commented

2026-03-27 01:07:31 +00:00

(Migrated from gitlab.com)

Verified. 179/179 ALL PASS on make solana-test after pulling fix. Rate limit setup added to security test suites. Closing.

Brouie (Migrated from gitlab.com) closed this issue

2026-03-27 01:07:32 +00:00

PlasticDigits referenced this issue

2026-09-12 11:53:17 +00:00

security(evm): fail closed when guard and rate-limit bridge are unset #178

Rows
Columns

Bug: New rate limiting breaks 6 existing security tests (173/179) #76