SEC-C03: commission treasury unchanged on non-hook swap revert (#402) #931

Merged

PlasticDigits merged 1 commit from issue-402-commission-treasury-revert-tests into main

2026-06-19 13:47:21 +00:00

PlasticDigits commented

2026-06-19 13:15:40 +00:00

(Migrated from gitlab.com)

Summary

Adds contract regression tests for SEC-C03 (#402): swap commission is transferred to treasury atomically with swap execution, so a reverted swap must leave commission treasury balances unchanged.

New tests in audit_invariant_tests: commission_treasury_unchanged_after_max_spread_rejected_swap, commission_treasury_unchanged_after_deadline_rejected_swap (snapshot treasury after a successful swap, then assert no change on revert).
Documents invariant P10 in docs/contracts-security-audit.md and cross-links from docs/security-model.md § Treasury Management.

Acceptance checklist

Criterion	Verification	Result
Test records commission treasury balance before max_spread-rejected swap	`cargo test -p cl8y-dex-tests commission_treasury_unchanged_after_max_spread`	PASS
Commission treasury unchanged after max_spread revert	same test	PASS
Same pattern for deadline-exceeded failure	`cargo test -p cl8y-dex-tests commission_treasury_unchanged_after_deadline`	PASS
All new tests pass in CI	`cargo test -p cl8y-dex-tests commission_treasury_unchanged` (2/2 ok locally)	PASS

Third-party verification

cd smartcontracts
cargo test -p cl8y-dex-tests commission_treasury_unchanged -- --nocapture

Expected: 2 tests pass (max_spread_rejected_swap, deadline_rejected_swap).

Docs: confirm invariant P10 row in docs/contracts-security-audit.md and SEC-C03 paragraph in docs/security-model.md § Treasury Management.

## Summary Adds contract regression tests for **SEC-C03** ([#402](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/issues/402)): swap commission is transferred to treasury atomically with swap execution, so a reverted swap must leave commission treasury balances unchanged. - New tests in `audit_invariant_tests`: `commission_treasury_unchanged_after_max_spread_rejected_swap`, `commission_treasury_unchanged_after_deadline_rejected_swap` (snapshot treasury after a successful swap, then assert no change on revert). - Documents invariant **P10** in `docs/contracts-security-audit.md` and cross-links from `docs/security-model.md` § Treasury Management. ## Acceptance checklist | Criterion | Verification | Result | |-----------|--------------|--------| | Test records commission treasury balance before max_spread-rejected swap | `cargo test -p cl8y-dex-tests commission_treasury_unchanged_after_max_spread` | PASS | | Commission treasury unchanged after max_spread revert | same test | PASS | | Same pattern for deadline-exceeded failure | `cargo test -p cl8y-dex-tests commission_treasury_unchanged_after_deadline` | PASS | | All new tests pass in CI | `cargo test -p cl8y-dex-tests commission_treasury_unchanged` (2/2 ok locally) | PASS | ## Third-party verification ```bash cd smartcontracts cargo test -p cl8y-dex-tests commission_treasury_unchanged -- --nocapture ``` Expected: 2 tests pass (`max_spread_rejected_swap`, `deadline_rejected_swap`). Docs: confirm invariant **P10** row in `docs/contracts-security-audit.md` and SEC-C03 paragraph in `docs/security-model.md` § Treasury Management.

PlasticDigits commented

2026-06-19 13:17:46 +00:00

(Migrated from gitlab.com)

Security review — MR !931

Commit reviewed: ccab0ae342239f007fe2254c4b088e6d59a787e3

Scope: Documentation (docs/contracts-security-audit.md, docs/security-model.md) and regression tests (audit_invariant_tests::commission_treasury_unchanged_after_max_spread_rejected_swap, commission_treasury_unchanged_after_deadline_rejected_swap). No production contract, indexer, or frontend code changes.

Method: Traced pair execute_swap / cw20_receive settlement order against SEC-C03 (P10): assert_deadline runs before execute_swap; assert_max_spread and min_return run before treasury CW20 Transfer messages are emitted in the response; CosmWasm transaction atomicity rolls back storage (including RESERVES updates) and undispatched submessages on Err. Confirmed new tests pass locally (cargo test -p cl8y-dex-tests commission_treasury_unchanged — 2/2).

Outcome: FINDINGS: 0 medium+

Security review: no medium+ findings on this diff. No inline threads (nothing to flag).

Prior MR security-review notes: none found.

## Security review — MR !931 **Commit reviewed:** `ccab0ae342239f007fe2254c4b088e6d59a787e3` **Scope:** Documentation (`docs/contracts-security-audit.md`, `docs/security-model.md`) and regression tests (`audit_invariant_tests::commission_treasury_unchanged_after_max_spread_rejected_swap`, `commission_treasury_unchanged_after_deadline_rejected_swap`). No production contract, indexer, or frontend code changes. **Method:** Traced pair `execute_swap` / `cw20_receive` settlement order against SEC-C03 (P10): `assert_deadline` runs before `execute_swap`; `assert_max_spread` and `min_return` run before treasury CW20 `Transfer` messages are emitted in the response; CosmWasm transaction atomicity rolls back storage (including `RESERVES` updates) and undispatched submessages on `Err`. Confirmed new tests pass locally (`cargo test -p cl8y-dex-tests commission_treasury_unchanged` — 2/2). **Outcome:** `FINDINGS: 0` medium+ Security review: no medium+ findings on this diff. No inline threads (nothing to flag). Prior MR security-review notes: none found.

PlasticDigits commented

2026-06-19 13:47:21 +00:00

(Migrated from gitlab.com)

mentioned in commit 6d893483d3

mentioned in commit 6d893483d305fe74d283e76015ec5be069da0786