Skip to content

fix(maintenance-pool): prevent double-reclaim drain in reclaim_deposit - #725

Merged
chonilius merged 2 commits into
MergeFi:mainfrom
christianahtemitope2005:fix/issues-476-479-475-480
Oct 18, 2026
Merged

chonilius merged 2 commits into
MergeFi:mainfrom
christianahtemitope2005:fix/issues-476-479-475-480

Conversation

@christianahtemitope2005

Copy link
Copy Markdown
Contributor

Problem

reclaim_deposit never marked a deposit as consumed after transferring funds. The same (pool_id, deposit_index) pair could be reclaimed repeatedly, draining other sponsors' funds until the pool balance fell below the deposit amount.

Fix

Zero deposit.amount and persist the record before the transfer (checks-effects-interactions pattern). A second call on the same index finds amount == 0 and returns the new AlreadyReclaimed = 17 error.

Tests added

Closes #479
Closes #476
Closes #475
Closes #480

MergeFi#479)

Zero the deposit record before transferring so a repeated call on the
same index is rejected with AlreadyReclaimed instead of draining other
sponsors' funds.  Add AlreadyReclaimed = 17 to the error enum.

Also add regression tests:
- test_reclaim_deposit_second_call_rejected_with_already_reclaimed (MergeFi#479)
- test_keep_alive_succeeds_on_existing_pool (MergeFi#476)
- test_keep_alive_fails_on_nonexistent_pool (MergeFi#476)
- test_keep_alive_succeeds_on_existing_milestone (MergeFi#475)
- test_keep_alive_fails_on_nonexistent_milestone (MergeFi#475)

Closes MergeFi#479
Closes MergeFi#476
Closes MergeFi#475
Closes MergeFi#480
@drips-wave

drips-wave Bot commented Oct 18, 2026

Copy link
Copy Markdown

@christianahtemitope2005 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

@vercel

vercel Bot commented Oct 18, 2026

Copy link
Copy Markdown

@christianahtemitope2005 is attempting to deploy a commit to the chonilius' projects Team on Vercel.

A member of the Team first needs to authorize it.

@chonilius
chonilius merged commit 1814e60 into MergeFi:main Oct 18, 2026
1 check failed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment