Harden CosmWasm hooks and document CW20/hook ops policy (#377) #901

2026-06-13T09:43:00Z

PlasticDigits commented

2026-06-13 09:43:00 +00:00

(Migrated from gitlab.com)

Summary

Remediation for GitLab #377 (parent #376): H-01, H-02, H-03, I-02.

H-01: CW20 whitelist runbook forbids fee-on-transfer templates; scripts/verify-cw20-code-ids.sh + launch-checklist cross-links.
H-02: Hook registration playbook (docs/runbooks/hook-registration.md) documents audit requirement and intentional swap-blocking policy.
H-03: LP-burn hook requires AfterSwap.pair == info.sender, queries pair liquidity_token, and rejects non-pair allowlist entries.
I-02: Pair settles tax/burn fees from ask-token swap output via dex-common::hook_settlement; net return to receiver is reduced accordingly.

Acceptance checklist

Criterion	Verification	Result
Runbook forbids fee-on-transfer CW20; GDEX/TerraPort verification script/checklist	`docs/runbooks/cw20-whitelist-policy.md`, `scripts/verify-cw20-code-ids.sh`	PASS
Hook registration playbook (audit + blocking policy)	`docs/runbooks/hook-registration.md`, `docs/security-model.md`	PASS
LP-burn hook rejects spoofed pair / validates pair state	`cd smartcontracts && cargo test lp_burn_hook_rejects`	PASS
Tax/burn charge from swap I/O (no treasury subsidy)	`cd smartcontracts && cargo test tax_hook_collects_from_swap_flow`	PASS
`cargo test adversarial` + hook tests + `make test-contracts`	Commands below	PASS

Verification checklist (third parties)

cd smartcontracts && cargo test adversarial
cd smartcontracts && cargo test -p cl8y-dex-lp-burn-hook -p cl8y-dex-tax-hook -p cl8y-dex-burn-hook
make test-contracts
bash scripts/verify-cw20-code-ids.sh   # set EXPECTED_* env vars for your deployment

Manual doc review:

docs/runbooks/cw20-whitelist-policy.md
docs/runbooks/hook-registration.md
docs/security-model.md (Hook safety + whitelist sections)
smartcontracts/contracts/hooks/README.md

Test plan

fee_on_transfer_creates_reserve_imbalance still passes (documents H-01 risk)
lp_burn_hook_rejects_spoofed_pair_when_spoofer_allowlisted fails attack path
swap_fails_atomically_when_allowlisted_hook_reverts unchanged (H-02)
tax_hook_collects_from_swap_flow_with_zero_treasury_balance added (I-02)

Related: #377

Note

High Risk
Changes swap payout accounting (min_return, net vs gross) and hook settlement paths on the pair—integrators and deployed hooks must align with new semantics; LP-burn allowlist rules are stricter at registration.

Overview
Addresses GitLab #377 by tightening on-chain hook behavior and adding operator runbooks for CW20 whitelist and hook registration.

Pair swap settlement (I-02): The pair now uses dex-common::hook_settlement to query tax/burn hook configs, deduct fees from gross ask-token return, emit hook CW20 transfers before paying the user, and enforce min_return on net payout (new attrs net_return_amount, hook_fee_amount). Tax hook AfterSwap no longer pulls from hook balance; burn hook expects tokens forwarded by the pair and errors if settlement is missing.

LP-burn hook (H-03): Requires AfterSwap.pair == info.sender, validates caller via pair Pair {} and liquidity_token, and rejects non-pair addresses in UpdateAllowedPairs. Adversarial tests flip from accepting to rejecting spoofed callers.

Documentation / ops (H-01, H-02): New runbooks for CW20 whitelist (fee-on-transfer prohibition) and hook registration; scripts/verify-cw20-code-ids.sh; security audit matrix updates for H2, I2, and agent playbook AGENTS_HOOK_CW20_OPS.md.

^{Reviewed by Cursor Bugbot for commit 29c47c132a. Bugbot is set up for automated code reviews on this repo. Configure here.}

## Summary Remediation for GitLab #377 (parent #376): **H-01**, **H-02**, **H-03**, **I-02**. - **H-01:** CW20 whitelist runbook forbids fee-on-transfer templates; `scripts/verify-cw20-code-ids.sh` + launch-checklist cross-links. - **H-02:** Hook registration playbook (`docs/runbooks/hook-registration.md`) documents audit requirement and intentional swap-blocking policy. - **H-03:** LP-burn hook requires `AfterSwap.pair == info.sender`, queries pair `liquidity_token`, and rejects non-pair allowlist entries. - **I-02:** Pair settles tax/burn fees from ask-token swap output via `dex-common::hook_settlement`; net return to receiver is reduced accordingly. ## Acceptance checklist | Criterion | Verification | Result | |-----------|--------------|--------| | Runbook forbids fee-on-transfer CW20; GDEX/TerraPort verification script/checklist | `docs/runbooks/cw20-whitelist-policy.md`, `scripts/verify-cw20-code-ids.sh` | PASS | | Hook registration playbook (audit + blocking policy) | `docs/runbooks/hook-registration.md`, `docs/security-model.md` | PASS | | LP-burn hook rejects spoofed pair / validates pair state | `cd smartcontracts && cargo test lp_burn_hook_rejects` | PASS | | Tax/burn charge from swap I/O (no treasury subsidy) | `cd smartcontracts && cargo test tax_hook_collects_from_swap_flow` | PASS | | `cargo test adversarial` + hook tests + `make test-contracts` | Commands below | PASS | ## Verification checklist (third parties) ```bash cd smartcontracts && cargo test adversarial cd smartcontracts && cargo test -p cl8y-dex-lp-burn-hook -p cl8y-dex-tax-hook -p cl8y-dex-burn-hook make test-contracts bash scripts/verify-cw20-code-ids.sh # set EXPECTED_* env vars for your deployment ``` Manual doc review: - `docs/runbooks/cw20-whitelist-policy.md` - `docs/runbooks/hook-registration.md` - `docs/security-model.md` (Hook safety + whitelist sections) - `smartcontracts/contracts/hooks/README.md` ## Test plan - [x] `fee_on_transfer_creates_reserve_imbalance` still passes (documents H-01 risk) - [x] `lp_burn_hook_rejects_spoofed_pair_when_spoofer_allowlisted` fails attack path - [x] `swap_fails_atomically_when_allowlisted_hook_reverts` unchanged (H-02) - [x] `tax_hook_collects_from_swap_flow_with_zero_treasury_balance` added (I-02) Related: #377  --- > [!NOTE] > **High Risk** > Changes swap payout accounting (`min_return`, net vs gross) and hook settlement paths on the pair—integrators and deployed hooks must align with new semantics; LP-burn allowlist rules are stricter at registration. > > **Overview** > Addresses GitLab **#377** by tightening on-chain hook behavior and adding operator runbooks for CW20 whitelist and hook registration. > > **Pair swap settlement (I-02):** The pair now uses `dex-common::hook_settlement` to query tax/burn hook configs, deduct fees from gross ask-token return, emit hook CW20 transfers before paying the user, and enforce **`min_return` on net payout** (new attrs `net_return_amount`, `hook_fee_amount`). Tax hook `AfterSwap` no longer pulls from hook balance; burn hook expects tokens forwarded by the pair and errors if settlement is missing. > > **LP-burn hook (H-03):** Requires `AfterSwap.pair == info.sender`, validates caller via pair `Pair {}` and `liquidity_token`, and rejects non-pair addresses in `UpdateAllowedPairs`. Adversarial tests flip from accepting to rejecting spoofed callers. > > **Documentation / ops (H-01, H-02):** New runbooks for CW20 whitelist (fee-on-transfer prohibition) and hook registration; `scripts/verify-cw20-code-ids.sh`; security audit matrix updates for **H2**, **I2**, and agent playbook `AGENTS_HOOK_CW20_OPS.md`. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 29c47c132a1a64a56ab51317719a8c09d06bd6fd. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>

ghost1 commented

2026-06-13 09:43:08 +00:00

(Migrated from gitlab.com)

changed the description

ghost1 commented

2026-06-13 09:43:18 +00:00

(Migrated from gitlab.com)

changed the description

ghost1 commented

2026-06-13 09:44:12 +00:00

(Migrated from gitlab.com)

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue.}

^{Reviewed by Cursor Bugbot for commit be82f63e28. Configure here.}

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.  <a href="https://cursor.com/open?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9BTExfSU5fQ1VSU09SIiwiZGF0YSI6eyJyZWRpc0tleSI6ImJ1Z2JvdC1tdWx0aToyMzI2YjBmMi01Mjc3LTQ5ZjQtOGNkZi00OGIzZDk2OTQzZjUiLCJlbmNyeXB0aW9uS2V5IjoiQjFXX29OdFBNVFBrREhVNlhmZ2dOT2lJdExYUGIxNF9fd2FxdF9tSUVnSSIsImJyYW5jaCI6Imlzc3VlLTM3Ny1oYXJkZW4taG9va3MtY3cyMC1wb2xpY3kiLCJyZXBvT3duZXIiOiJQbGFzdGljRGlnaXRzIiwicmVwb05hbWUiOiJjbDh5LWRleC10ZXJyYWNsYXNzaWMifX0" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-cursor-light.png"><img alt="Fix All in Cursor" width="115" height="28" src="https://cursor.com/assets/images/fix-in-cursor-dark.png"></picture></a>   <sup>Bugbot Autofix is [ON](https://www.cursor.com/dashboard/bugbot). A cloud agent has been kicked off to fix the reported issue. </sup>  <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit be82f63e28c7dfed807e0ea7e40db23312319f00. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>

ghost1 commented

2026-06-13 09:44:13 +00:00

(Migrated from gitlab.com)

min_return ignores hook fee deductions

Medium Severity

The swap min_return check still compares against gross total_return, but the taker CW20 transfer uses net_return after tax/burn hook settlement. A swap can pass min_return while the receiver gets less than that floor once hook fees apply.

^{Reviewed by Cursor Bugbot for commit be82f63e28. Configure here.}

### min_return ignores hook fee deductions **Medium Severity**  The swap `min_return` check still compares against gross `total_return`, but the taker CW20 transfer uses `net_return` after tax/burn hook settlement. A swap can pass `min_return` while the receiver gets less than that floor once hook fees apply.    <div><a href="https://cursor.com/open?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9DVVJTT1IiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OjczMTExNmEzLTQxZmMtNDgxZC1iOTBkLTY0MGYyYTU2ZDhhOCIsImVuY3J5cHRpb25LZXkiOiI5ajhOTi1MWl9Ob0lrd0gtSHF3SDR0TXo4U29yUExsa0dkQXNJcmlVTG53IiwiYnJhbmNoIjoiaXNzdWUtMzc3LWhhcmRlbi1ob29rcy1jdzIwLXBvbGljeSIsInJlcG9Pd25lciI6IlBsYXN0aWNEaWdpdHMiLCJyZXBvTmFtZSI6ImNsOHktZGV4LXRlcnJhY2xhc3NpYyJ9fQ" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-cursor-light.png"><img alt="Fix in Cursor" width="115" height="28" src="https://cursor.com/assets/images/fix-in-cursor-dark.png"></picture></a> <a href="https://cursor.com/agents?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9XRUIiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OjczMTExNmEzLTQxZmMtNDgxZC1iOTBkLTY0MGYyYTU2ZDhhOCIsImVuY3J5cHRpb25LZXkiOiI5ajhOTi1MWl9Ob0lrd0gtSHF3SDR0TXo4U29yUExsa0dkQXNJcmlVTG53IiwiYnJhbmNoIjoiaXNzdWUtMzc3LWhhcmRlbi1ob29rcy1jdzIwLXBvbGljeSIsInJlcG9Pd25lciI6IlBsYXN0aWNEaWdpdHMiLCJyZXBvTmFtZSI6ImNsOHktZGV4LXRlcnJhY2xhc3NpYyIsInByTnVtYmVyIjoxODMsImNvbW1pdFNoYSI6ImJlODJmNjNlMjhjN2RmZWQ4MDdlMGVhN2U0MGRiMjMzMTIzMTlmMDAiLCJwcm92aWRlciI6ImdpdGxhYiIsImhvc3RuYW1lIjoiZ2l0bGFiLmNvbSJ9fQ" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-web-light.png"><img alt="Fix in Web" width="99" height="28" src="https://cursor.com/assets/images/fix-in-web-dark.png"></picture></a></div> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit be82f63e28c7dfed807e0ea7e40db23312319f00. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>

PlasticDigits commented

2026-06-13 09:46:06 +00:00

(Migrated from gitlab.com)

Medium — Slippage floor checked on gross return, user paid net

min_return is asserted against total_return (L1149–1155) before hook settlement, but the taker CW20 transfer uses net_return after tax/burn deductions (this hunk).

Impact: On pairs with registered tax/burn hooks, a swap can succeed while the receiver gets less than min_return (e.g. gross 1000, 10% hook, min_return=950 → net 900, tx passes).

Attack path: No privileged caller required beyond normal hooked-pair swaps. Integrators/bots that set min_return from simulation return_amount (gross) or users specifying a wallet floor are not protected from hook fee deductions introduced by I-02 settlement.

Fix: Assert min_return against net_return after collect_fee_hook_deductions, or document and enforce gross semantics explicitly in API + simulation.

**Medium — Slippage floor checked on gross return, user paid net** `min_return` is asserted against `total_return` (L1149–1155) before hook settlement, but the taker CW20 transfer uses `net_return` after tax/burn deductions (this hunk). **Impact:** On pairs with registered tax/burn hooks, a swap can succeed while the receiver gets less than `min_return` (e.g. gross 1000, 10% hook, `min_return=950` → net 900, tx passes). **Attack path:** No privileged caller required beyond normal hooked-pair swaps. Integrators/bots that set `min_return` from simulation `return_amount` (gross) or users specifying a wallet floor are not protected from hook fee deductions introduced by I-02 settlement. **Fix:** Assert `min_return` against `net_return` after `collect_fee_hook_deductions`, or document and enforce gross semantics explicitly in API + simulation.

ghost1 commented

2026-06-13 09:46:07 +00:00

(Migrated from gitlab.com)

added 1 commit

d2dcb7a9 - fix(pair): enforce min_return against net payout after hook fees

Compare with previous version

added 1 commit <ul><li>d2dcb7a9 - fix(pair): enforce min_return against net payout after hook fees</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/183/diffs?diff_id=1850265766&start_sha=be82f63e28c7dfed807e0ea7e40db23312319f00)

PlasticDigits commented

2026-06-13 09:46:12 +00:00

(Migrated from gitlab.com)

Security review — MR !901

Commit reviewed: be82f63e28c7dfed807e0ea7e40db23312319f00

Scope: CosmWasm hook hardening (H-03 LP-burn caller validation, I-02 pair-side tax/burn settlement), dex-common::hook_settlement, adversarial test updates, ops runbooks/scripts.

Outcome: FINDINGS: 1 medium+

Summary

Reviewed added/modified contract paths for auth bypass, settlement accounting, hook spoofing, and slippage controls. H-03 LP-burn changes (pair == info.sender, pair liquidity_token check, non-pair allowlist rejection) close the documented spoof path. I-02 settlement correctly deducts hook fees from ask-token flow with HookFeeExceedsReturn guard; tax/burn hooks no longer pull from pre-funded balances.

One medium finding remains (inline thread on pair/src/contract.rs ~L1187): min_return is still checked against gross total_return before hook fee deductions, while the taker transfer pays net_return. Swaps on hooked pairs can succeed below the user/integrator slippage floor — regression introduced by I-02 settlement.

No other medium+ injection, authz bypass, or treasury drain paths identified on this diff.

Label: block:security applied pending fix or accepted-risk disposition.

## Security review — MR !901 **Commit reviewed:** `be82f63e28c7dfed807e0ea7e40db23312319f00` **Scope:** CosmWasm hook hardening (H-03 LP-burn caller validation, I-02 pair-side tax/burn settlement), `dex-common::hook_settlement`, adversarial test updates, ops runbooks/scripts. **Outcome:** `FINDINGS: 1` medium+ ### Summary Reviewed added/modified contract paths for auth bypass, settlement accounting, hook spoofing, and slippage controls. H-03 LP-burn changes (`pair == info.sender`, pair `liquidity_token` check, non-pair allowlist rejection) close the documented spoof path. I-02 settlement correctly deducts hook fees from ask-token flow with `HookFeeExceedsReturn` guard; tax/burn hooks no longer pull from pre-funded balances. **One medium finding remains** (inline thread on `pair/src/contract.rs` ~L1187): `min_return` is still checked against gross `total_return` before hook fee deductions, while the taker transfer pays `net_return`. Swaps on hooked pairs can succeed below the user/integrator slippage floor — regression introduced by I-02 settlement. No other medium+ injection, authz bypass, or treasury drain paths identified on this diff. **Label:** `block:security` applied pending fix or accepted-risk disposition.

ghost1 commented

2026-06-13 09:46:24 +00:00

(Migrated from gitlab.com)

changed the description

PlasticDigits commented

2026-06-13 10:03:09 +00:00

(Migrated from gitlab.com)

mentioned in commit 29c47c132a

mentioned in commit 29c47c132a1a64a56ab51317719a8c09d06bd6fd

PlasticDigits commented

2026-06-13 10:03:09 +00:00

(Migrated from gitlab.com)

added 1 commit

29c47c13 - test(adversarial): assert min_return enforced on net payout with tax hook

Compare with previous version

added 1 commit <ul><li>29c47c13 - test(adversarial): assert min_return enforced on net payout with tax hook</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/183/diffs?diff_id=1850271389&start_sha=d2dcb7a905d2948bc748b54f99c93a15ea317d03)

PlasticDigits commented

2026-06-13 10:03:14 +00:00

(Migrated from gitlab.com)

Security remediation — MR !901

Commits: d2dcb7a9 (pair fix), 29c47c13 (regression test)

Finding → fix

Finding	Severity	Resolution
`min_return` checked against gross `total_return` while taker receives `net_return` after tax/burn hook deductions (Bugbot + inline on `pair/src/contract.rs`)	Medium	Fixed. `collect_fee_hook_deductions` runs first; `min_return` is asserted against `net_return` (post-hook), matching the CW20 transfer to the receiver. Regression: `tax_hook_min_return_checked_against_net_payout`.

Verification

cd smartcontracts && cargo test adversarial
cd smartcontracts && cargo test tax_hook_min_return

No other medium+ findings from the prior review remain open on this diff.

## Security remediation — MR !901 **Commits:** `d2dcb7a9` (pair fix), `29c47c13` (regression test) ### Finding → fix | Finding | Severity | Resolution | |---------|----------|------------| | **`min_return` checked against gross `total_return` while taker receives `net_return` after tax/burn hook deductions** (Bugbot + inline on `pair/src/contract.rs`) | Medium | **Fixed.** `collect_fee_hook_deductions` runs first; `min_return` is asserted against `net_return` (post-hook), matching the CW20 transfer to the receiver. Regression: `tax_hook_min_return_checked_against_net_payout`. | ### Verification ```bash cd smartcontracts && cargo test adversarial cd smartcontracts && cargo test tax_hook_min_return ``` No other medium+ findings from the prior review remain open on this diff.

ghost1 commented

2026-06-13 10:03:24 +00:00

(Migrated from gitlab.com)

changed the description

PlasticDigits commented

2026-06-13 10:07:17 +00:00

(Migrated from gitlab.com)

Security review — MR !901

Commit reviewed: 29c47c132a1a64a56ab51317719a8c09d06bd6fd

Scope: CosmWasm hook hardening (H-03 LP-burn caller validation, I-02 pair-side tax/burn settlement via dex-common::hook_settlement), min_return / net-payout accounting, adversarial test updates, ops runbooks (cw20-whitelist-policy, hook-registration), scripts/verify-cw20-code-ids.sh.

Outcome: FINDINGS: 0 — Security review: no medium+ findings on this diff.

Prior thread disposition

The earlier medium finding (min_return checked against gross total_return while taker received net_return after hook fees) is remediated on this SHA: collect_fee_hook_deductions runs before the slippage floor; MinReturnAssertion compares net_return (matches the CW20 transfer). Regression: tax_hook_min_return_checked_against_net_payout.

Review notes (no new issues)

Area	Result
H-03 LP-burn spoofing	`pair == info.sender`, pair `Pair {}` query + `liquidity_token` match, non-pair addresses rejected in `UpdateAllowedPairs`. Spoof path in adversarial tests now rejects.
I-02 settlement	Pair queries hook `GetConfig`, emits tax/burn CW20 transfers from ask-token flow before net payout; `HookFeeExceedsReturn` guards over-deduction; tax hook no longer pulls from pre-funded balance; burn hook errors if settlement tokens missing.
Message ordering	Fee transfers precede `AfterSwap` hook dispatch; burn hook balance is populated before callback in the same tx.
Router path	Final-hop `minimum_receive` uses router balance delta (post-pair net payout); per-hop `min_return` delegates to hardened pair logic.
Authz	Hook allowlist / factory `SetPairHooks` remain governance/admin gated; no non-privileged auth bypass identified on modified paths.

Inline threads: none (no medium+ findings to anchor).

block:security not applied.

## Security review — MR !901 **Commit reviewed:** `29c47c132a1a64a56ab51317719a8c09d06bd6fd` **Scope:** CosmWasm hook hardening (H-03 LP-burn caller validation, I-02 pair-side tax/burn settlement via `dex-common::hook_settlement`), `min_return` / net-payout accounting, adversarial test updates, ops runbooks (`cw20-whitelist-policy`, `hook-registration`), `scripts/verify-cw20-code-ids.sh`. **Outcome:** `FINDINGS: 0` — **Security review: no medium+ findings on this diff.** ### Prior thread disposition The earlier **medium** finding (`min_return` checked against gross `total_return` while taker received `net_return` after hook fees) is **remediated** on this SHA: `collect_fee_hook_deductions` runs before the slippage floor; `MinReturnAssertion` compares `net_return` (matches the CW20 transfer). Regression: `tax_hook_min_return_checked_against_net_payout`. ### Review notes (no new issues) | Area | Result | |------|--------| | **H-03 LP-burn spoofing** | `pair == info.sender`, pair `Pair {}` query + `liquidity_token` match, non-pair addresses rejected in `UpdateAllowedPairs`. Spoof path in adversarial tests now rejects. | | **I-02 settlement** | Pair queries hook `GetConfig`, emits tax/burn CW20 transfers from ask-token flow before net payout; `HookFeeExceedsReturn` guards over-deduction; tax hook no longer pulls from pre-funded balance; burn hook errors if settlement tokens missing. | | **Message ordering** | Fee transfers precede `AfterSwap` hook dispatch; burn hook balance is populated before callback in the same tx. | | **Router path** | Final-hop `minimum_receive` uses router balance delta (post-pair net payout); per-hop `min_return` delegates to hardened pair logic. | | **Authz** | Hook allowlist / factory `SetPairHooks` remain governance/admin gated; no non-privileged auth bypass identified on modified paths. | **Inline threads:** none (no medium+ findings to anchor). `block:security` not applied.

PlasticDigits commented

2026-06-13 10:34:52 +00:00

(Migrated from gitlab.com)

mentioned in commit 908618d2a7

mentioned in commit 908618d2a7c16a210a596fb816bafc8445172c7e