Merge pull request #9 from halotrade-zone/fix-audit-issue

fix reserved 1 LP token in provide_liquidity msg
halotrade-zone · May 23, 2023 · f56934c · f56934c
2 parents cdcc734 + f6dcc6b
commit f56934c
Show file tree

Hide file tree

Showing 2 changed files with 23 additions and 6 deletions.
diff --git a/contracts/halo-pair/src/contract.rs b/contracts/halo-pair/src/contract.rs
@@ -284,7 +284,7 @@ pub fn provide_liquidity(
     let total_share = query_token_info(&deps.querier, liquidity_token)?.total_supply;
 
     // calculate the amount of LP token is minted to the user
-    let share =
+    let mut share =
         calculate_lp_token_amount_to_user(&info, &pair_info, total_share, deposits, pools).unwrap();
 
     // prevent providing free token (one of the deposits is zero)
@@ -312,6 +312,7 @@ pub fn provide_liquidity(
             })?,
             funds: vec![],
         }));
+        share = share.checked_sub(Uint128::from(LP_TOKEN_RESERVED_AMOUNT))?;
     }
 
     // mint amount of 'share' LP token to the receiver
@@ -322,7 +323,7 @@ pub fn provide_liquidity(
             .to_string(),
         msg: to_binary(&Cw20ExecuteMsg::Mint {
             recipient: receiver.to_string(),
-            amount: share - Uint128::from(LP_TOKEN_RESERVED_AMOUNT),
+            amount: share,
         })?,
         funds: vec![],
     }));

diff --git a/contracts/halo-pair/src/tests/test.rs b/contracts/halo-pair/src/tests/test.rs
@@ -341,7 +341,8 @@ fn provide_liquidity() {
     );
     let res = execute(deps.as_mut(), env, info, msg).unwrap();
     let transfer_from_msg = res.messages.get(0).expect("no message");
-    let mint_msg = res.messages.get(1).expect("no message");
+    let mint_for_liquidity0000_msg = res.messages.get(1).expect("no message");
+    let mint_for_addr0000_msg = res.messages.get(2).expect("no message");
     assert_eq!(
         transfer_from_msg,
         &SubMsg::new(CosmosMsg::Wasm(WasmMsg::Execute {
@@ -356,18 +357,32 @@ fn provide_liquidity() {
         }))
     );
     assert_eq!(
-        mint_msg,
+        mint_for_liquidity0000_msg,
         &SubMsg::new(CosmosMsg::Wasm(WasmMsg::Execute {
             contract_addr: "liquidity0000".to_string(),
             msg: to_binary(&Cw20ExecuteMsg::Mint {
-                // Verify minting 1 reserve LP token to lp token
+                // Verify minting 1 reserve LP token to lp token contract address
                 recipient: "liquidity0000".to_string(),
                 amount: Uint128::from(1u128),
             })
             .unwrap(),
             funds: vec![],
         }))
     );
+    assert_eq!(
+        mint_for_addr0000_msg,
+        &SubMsg::new(CosmosMsg::Wasm(WasmMsg::Execute {
+            contract_addr: "liquidity0000".to_string(),
+            msg: to_binary(&Cw20ExecuteMsg::Mint {
+                recipient: "addr0000".to_string(),
+                // addr0000 will receive 100 - 1 share of LP token
+                // because 1 share of LP token is minted to lp token contract address
+                amount: Uint128::from(99u128),
+            })
+            .unwrap(),
+            funds: vec![],
+        }))
+    );
 
     // provide liquidity with slippage tolerance greater than 100%
     let msg = ExecuteMsg::ProvideLiquidity {
@@ -479,7 +494,8 @@ fn provide_liquidity() {
             contract_addr: "liquidity0000".to_string(),
             msg: to_binary(&Cw20ExecuteMsg::Mint {
                 recipient: "staking0000".to_string(),
-                amount: Uint128::from(49u128), // 1uLP reserved token sent to contract
+                // staking0000 will receive 50 share of LP token (100 * (100 / 200))
+                amount: Uint128::from(50u128),
             })
             .unwrap(),
             funds: vec![],