[VPD-984] fix(TokenBuyback): Hashdit findings L02 (gap) and I06 (cap clamp)#162
Merged
Conversation
- I06 — Clamp `usdConsumedInWindow` down to the new cap inside `setDailyCapUsd`. Without the clamp, lowering the cap below the current accumulator locks `executeBuyback` for up to WINDOW seconds while the bucket decays naturally — bad timing if the cap was cut in response to a security incident. Trade-off: the strict "any rolling 24h interval ≤ cap" invariant now holds within a cap epoch only; spending under the previous (higher) cap is forgiven under the new policy. - L02 — Restore `__gap` from 43 to 44 so contract-local storage totals 50 slots again. The gap was left at 43 after a transient fifth state variable was added and removed during development of the daily-cap fix. Both findings are Informational on the deployed contract; bundled here so they deploy with the next functional upgrade of TokenBuyback rather than burning a separate redeploy + VIP cycle for each.
Debugger022
added a commit
that referenced
this pull request
May 13, 2026
…ep 3 Update 10 TokenBuyback proxy addresses to PR #162 redeploy. Move Shortfall.pauseAuctions out of _runPrimeAllocation into _pauseRevenueFlows so revenue-flow pause is atomic with converter pause (single step 3 rather than split across step 3 and step 5). Rewrite trust-model docstring to reflect deploy scripts setting pendingOwner = helper directly, dropping the timelock-hop preparatory acceptOwnership step.
Debugger022
added a commit
that referenced
this pull request
May 13, 2026
Add the PLP USDC handoff + executeSwap call between execute1 and execute2, update buyback addresses to the PR #162 redeploy, pin FORK_BLOCK past it, and add asserts for: executedSwap flag, USDT/U landing in PLP above MIN_OUT, USDC leftover refunded to timelock, and Shortfall.auctionsPaused (now set in execute1's _pauseRevenueFlows, not the swap block).
6 tasks
Contributor
|
probably can attach 2 audit reports as well ? |
fred-venus
previously approved these changes
May 13, 2026
Merged
2 tasks
|
fred-venus
approved these changes
May 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Addresses two Hashdit audit findings on
TokenBuyback. Both are Informational on the deployed contract; bundled here so they deploy with the next functional upgrade rather than burning a separate redeploy + VIP cycle for each.I06 —
setDailyCapUsdcap reduction can brickexecuteBuyback. ClampusdConsumedInWindowdown to the new cap insidesetDailyCapUsd. Without the clamp, lowering the cap below the current accumulator locksexecuteBuybackfor up toWINDOWseconds while the bucket decays naturally — bad timing if the cap was cut in response to a security incident.L02 —
__gapunder-allocated by one slot. Restore__gapfrom[43]to[44]so contract-local storage totals 50 slots again. The gap was left at 43 after a transient fifth state variable was added and removed during development of the daily-cap fix.Test plan
yarn hardhat test tests/ProtocolReserve/TokenBuyback.ts— 60 passing)setDailyCapUsd clamps usdConsumedInWindow when new cap is below accumulatorsetDailyCapUsd does not touch usdConsumedInWindow when new cap is above accumulator__gapresize is the canonical OZ pattern)