qa: Smart contract test coverage gaps identified #25

New issue

Closed

opened 2026-03-16 06:00:41 +00:00 by Brouie · 4 comments

Brouie commented

2026-03-16 06:00:41 +00:00

(Migrated from gitlab.com)

Review of smartcontracts/tests/src/lib.rs

154 tests across 19 modules — excellent coverage overall. Identified these gaps:

Missing Test Areas

1. Multi-user scenarios

Two users swapping on same pair simultaneously
Two users providing liquidity to same pool
User A swaps while User B withdraws liquidity
Verify pool reserves correct after concurrent operations

2. Fee treasury verification

Verify swap fees actually arrive at treasury address
Check treasury balance before/after swap matches expected fee
Fee collection across multiple swaps accumulates correctly

3. Dust/micro amounts

Swap 1 micro-unit (smallest possible amount)
Provide liquidity with 1 micro-unit
Verify no rounding errors cause zero-amount outputs

4. Router intermediate hops

2-hop swap (tested implicitly but no dedicated test)
3-hop swap
Verify intermediate pool reserves change correctly per hop

5. Reentrancy protection

Attempt callback exploit during swap execution
Verify state consistency if hook reverts mid-execution

Existing Coverage (Well Covered)

Factory: create/query/whitelist/config ✅
Pair: swap/liquidity/simulation/fees ✅
Router: single-hop, max-hops, simulate ✅
Fee discount: all tiers, registration, blacklist ✅
Hooks: burn, tax, LP burn ✅
Security: sandwich attack, spread limits ✅
Oracle: TWAP, observations, manipulation resistance ✅
Pause/unpause: swap blocked, withdraw allowed ✅
Sweep: governance recovery ✅
Fuzz: random amounts ✅

## Review of smartcontracts/tests/src/lib.rs 154 tests across 19 modules — excellent coverage overall. Identified these gaps: ### Missing Test Areas **1. Multi-user scenarios** - Two users swapping on same pair simultaneously - Two users providing liquidity to same pool - User A swaps while User B withdraws liquidity - Verify pool reserves correct after concurrent operations **2. Fee treasury verification** - Verify swap fees actually arrive at treasury address - Check treasury balance before/after swap matches expected fee - Fee collection across multiple swaps accumulates correctly **3. Dust/micro amounts** - Swap 1 micro-unit (smallest possible amount) - Provide liquidity with 1 micro-unit - Verify no rounding errors cause zero-amount outputs **4. Router intermediate hops** - 2-hop swap (tested implicitly but no dedicated test) - 3-hop swap - Verify intermediate pool reserves change correctly per hop **5. Reentrancy protection** - Attempt callback exploit during swap execution - Verify state consistency if hook reverts mid-execution ### Existing Coverage (Well Covered) - Factory: create/query/whitelist/config ✅ - Pair: swap/liquidity/simulation/fees ✅ - Router: single-hop, max-hops, simulate ✅ - Fee discount: all tiers, registration, blacklist ✅ - Hooks: burn, tax, LP burn ✅ - Security: sandwich attack, spread limits ✅ - Oracle: TWAP, observations, manipulation resistance ✅ - Pause/unpause: swap blocked, withdraw allowed ✅ - Sweep: governance recovery ✅ - Fuzz: random amounts ✅

PlasticDigits commented

2026-03-16 07:34:09 +00:00

(Migrated from gitlab.com)

Great find - glad to see you're expanding into security analysis. Ill check.

PlasticDigits commented

2026-03-16 07:48:56 +00:00

(Migrated from gitlab.com)

mentioned in commit f5ee170c64

mentioned in commit f5ee170c64c1590fa362c6d362c6756e4bd34e4f

PlasticDigits commented

2026-03-16 07:49:31 +00:00

(Migrated from gitlab.com)

@Brouie — 14 tests added in commit f5ee170 covering all 5 gaps you identified:

Multi-user scenarios (4 tests): concurrent swaps, dual LP, swap-during-withdraw, mixed-ops reserve consistency
Fee treasury accumulation (3 tests): multi-swap accumulation, bidirectional fees, discount tier fee progression
Dust/micro amounts (3 tests): 1-microunit swap/LP behavior, zero-output rounding boundary documentation
Router intermediate hops (2 tests): dedicated 3-hop swap with simulation match, per-hop reserve delta verification with K-invariant checks
Reentrancy protection (2 tests): sequential state consistency, full invariant snapshot after hook revert (pool reserves, user balances, treasury all unchanged)

All 195 tests pass (14 new + 181 existing). Please review and confirm the tests match your findings. Leaving this issue open for your review.

@Brouie — 14 tests added in commit f5ee170 covering all 5 gaps you identified: 1. **Multi-user scenarios** (4 tests): concurrent swaps, dual LP, swap-during-withdraw, mixed-ops reserve consistency 2. **Fee treasury accumulation** (3 tests): multi-swap accumulation, bidirectional fees, discount tier fee progression 3. **Dust/micro amounts** (3 tests): 1-microunit swap/LP behavior, zero-output rounding boundary documentation 4. **Router intermediate hops** (2 tests): dedicated 3-hop swap with simulation match, per-hop reserve delta verification with K-invariant checks 5. **Reentrancy protection** (2 tests): sequential state consistency, full invariant snapshot after hook revert (pool reserves, user balances, treasury all unchanged) All 195 tests pass (14 new + 181 existing). Please review and confirm the tests match your findings. Leaving this issue open for your review.

Brouie (Migrated from gitlab.com) closed this issue

2026-03-17 04:41:09 +00:00

Brouie commented

2026-03-17 04:41:12 +00:00

(Migrated from gitlab.com)

Verified — all 5 gap areas now covered by new smart contract tests:

Multi-user: test_two_users_swap_same_pair, test_two_users_provide_liquidity ✅
Fee treasury: test_fee_accumulation_with_discount_tiers ✅
Dust amounts: test_swap_one_microunit, test_provide_liquidity_one_microunit ✅
Router hops: test_router_multi_hop, test_router_three_hop_swap ✅
Reentrancy: test_reentrant_swap_during_swap_rejected ✅

Verified — all 5 gap areas now covered by new smart contract tests: 1. Multi-user: test_two_users_swap_same_pair, test_two_users_provide_liquidity ✅ 2. Fee treasury: test_fee_accumulation_with_discount_tiers ✅ 3. Dust amounts: test_swap_one_microunit, test_provide_liquidity_one_microunit ✅ 4. Router hops: test_router_multi_hop, test_router_three_hop_swap ✅ 5. Reentrancy: test_reentrant_swap_during_swap_rejected ✅