audit: enhance collateral type validation and funding rate logic by ZouBadCode · Pull Request #31 · Bucket-Protocol/waterx-sdk

ZouBadCode · 2026-04-13T17:00:05Z

This pull request introduces comprehensive improvements to type safety, correctness, and robustness in the WaterX perpetual trading contracts. The most significant changes enforce collateral type consistency throughout position and order management, enhance the accuracy of funding rate updates (especially when multiple intervals elapse), and improve test coverage for these scenarios.

Type safety and collateral validation:

Added strict collateral type checks for positions and orders by introducing assert_position_collateral_type and assert_order_collateral_type functions. These assertions are now enforced throughout the codebase whenever positions or orders are accessed, modified, or liquidated, preventing accidental collateral mismatches.

Funding rate logic improvements:

Enhanced funding rate update logic to correctly handle cases where multiple funding intervals have elapsed. The update now accrues the funding rate over all missed intervals and updates the cumulative funding index and timestamp accordingly, ensuring accurate funding calculations even if updates are delayed.
Added a new test, funding_rate_update_catches_up_multiple_intervals, to verify that the funding rate update logic works correctly when several intervals pass between updates.

Test and developer experience:

Introduced an alternate collateral token (CHEAP) for testing collateral mismatch scenarios, improving test coverage and clarity.

These changes significantly improve the safety, correctness, and maintainability of the codebase, especially around collateral handling and funding rate calculations.

- Introduced new functions for staking, unstaking, and claiming rewards in the reward distributor. - Updated trading interface to include collateralDecimal in ResolveSizeArguments. - Enhanced index exports to include reward distributor related functions and types. - Added new view type for RewardDistributorStakeData. - Updated transaction builders to support reward distributor operations. - Configured sui-codegen to generate types and functions for the reward distributor contract.

…ckage IDs

- Added collateral type assertions in order and position management functions to ensure consistency. - Improved funding rate calculation by adjusting timestamp handling and accrued rate application. - Introduced new tests to validate collateral type mismatches and funding rate updates across multiple intervals.

bucket-bot

Code review

No issues found. Checked collateral-type safety hardening paths and funding catch-up logic; both changes are consistent with existing architecture and tests cover key regressions.

🤖 Generated with Rex (OpenClaw)

bucket-bot

✅ Code Review — Approved

PR #31: audit: enhance collateral type validation and funding rate logic

Both change categories are well-implemented:

1. Collateral Type Validation

assert_position_collateral_type<C_TOKEN> and assert_order_collateral_type<C_TOKEN> consistently applied across all mutation paths in position.move and trading.move
Generic C_TOKEN parameter correctly added to borrow_owned_position_mut and take_owned_position
All 6 request functions (close, increase, decrease, deposit, withdraw collateral + cancel order) now validate collateral type at entry
liquidate_request and batch_liquidate_request also covered; batch gracefully skips mismatched positions (continue instead of abort) — good defensive design
match_orders validates linked position collateral before proceeding

2. Funding Rate Multi-Interval Catch-Up

Correctly computes elapsed_intervals = elapsed_ms / interval and multiplies rate
Timestamp aligned to last_funding_timestamp + elapsed_intervals * interval (not now_ms) — prevents drift accumulation
Sign tracking via is_positive preserved correctly through multi-interval accrual

Tests

funding_rate_update_catches_up_multiple_intervals — verifies 4-interval catch-up produces 4× single-interval rate
4 collateral mismatch tests using CHEAP dummy token cover close, deposit, liquidate, and cancel order paths

No issues found. Clean audit fix. 👍

june-in-exile · 2026-04-14T00:40:36Z


    events::emit_funding_rate_updated(
-        market_id, rate_float, new_index, long_oi, short_oi, now_ms,
+        market_id, accrued_rate_float, new_index, long_oi, short_oi, next_funding_timestamp,


要不要直接更新 event 定義把 funding_rate 改成 accrued_funding_rate 比較明確？

或是兩個都列出來，比如
public(package) fun emit_funding_rate_updated(
market_id: ID,
funding_rate: Float, // per-interval rate（保持原語意）
accrued_funding_rate: Float, // = funding_rate × elapsed_intervals
elapsed_intervals: u64, // 補齊了幾個 interval
cumulative_index: Double,
long_oi: u64,
short_oi: u64,
timestamp: u64, // 對齊後的 next_funding_timestamp
)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Query all markets in one simulateTransaction call instead of N calls. getAllAccountPositions takes prices per market, skips markets without price. getAllAccountOrders needs no prices (oracle_price unused for orders). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Query all markets in one simulateTransaction call instead of N calls. getAllAccountPositions takes prices per market, skips markets without price. getAllAccountOrders needs no prices (oracle_price unused for orders). Results grouped by market config order, same types as per-market versions. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

- Assert lot/min sizing via parsed bounds instead of hardcoded values - Skip open invalid-size MoveAbort case when min_size is zero (unreachable) - Share helpers in market-summary-assertions for view and trading tests Made-with: Cursor

Made-with: Cursor

feat: on-chain fallback view functions for positions and orders

Replace dynamic `new RegExp(functionName)` with hardcoded patterns per factory function (VecSet, LinkedTable, Node). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

feat: integrate reward distributor flow and APR support into SDK

do0x0ob · 2026-04-14T04:56:37Z

調整測試針對抵押品錯配問題新增測試 errcode 208，稍後 commit

- Added collateral type assertions in order and position management functions to ensure consistency. - Improved funding rate calculation by adjusting timestamp handling and accrued rate application. - Introduced new tests to validate collateral type mismatches and funding rate updates across multiple intervals.

…s://github.com/Bucket-Protocol/waterx-sdk into audit/fix-colleteral-type-and-funding-rate-cal

do0x0ob · 2026-04-14T06:38:21Z

攻擊腳本可以考慮移除

do0x0ob · 2026-04-14T06:38:46Z

這是不是也是配置腳本

do0x0ob · 2026-04-14T06:39:17Z

這應該也是測試腳本，可考慮移除

do0x0ob · 2026-04-14T06:39:44Z

應該是腳本執行的命令配置，看看又沒有要留

do0x0ob · 2026-04-14T06:40:14Z

這個是不是也是腳本用的

do0x0ob

有一些測試腳本等等可以考慮要不要提交進來，或是找其他地方組織一起

ZouBadCode added 17 commits April 10, 2026 20:36

feat: add mock sui and publish rewarder

9317209

feat: add script to setup rewarder

d0242aa

fix: update reward distributor code

74357eb

refactor: update sdk

f3486f2

test: add test for rewader distributor sdk

d1cf5d2

feat(update_package): remove unnessary data field and function

6a98ca0

refactor: update script

5acd2e5

feat: complete fetch apr, mint stake, unstake redeem

8fbe35e

fix: remove missing field

832cdd5

Merge origin/main into wlp-staking-sdk

76ebd04

Fix lint and prettier issues in rewarder PR

1045b13

fix: rewarder exploit

4c678f5

style: prettier

6bdf83b

feat: add security attack checks for reward distributor and update pa…

4689831

…ckage IDs

fix: some calculate error

8f2925d

ZouBadCode requested review from JustaLiang, allen-hsu, do0x0ob and june-in-exile April 13, 2026 17:00

bucket-bot approved these changes Apr 13, 2026

View reviewed changes

june-in-exile reviewed Apr 14, 2026

View reviewed changes

JustaLiang and others added 6 commits April 14, 2026 08:44

add get_account_positions() & get_account_orders() in contracts

d9ff7fe

add get_market_positions() in contracts

55bc661

add getters for fallback

0622d2e

refactoring

b7da94f

merge main: resolve import and log message conflicts

02079ba

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

style: format fetch-view-data test

7549a0c

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

JustaLiang and others added 12 commits April 14, 2026 10:09

style: format trading-negative-simulate test with Prettier

7ecd55a

Made-with: Cursor

remove WATERX_PERP_VIEW

5f3ba48

fix lint

36d61d4

Merge pull request #32 from Bucket-Protocol/feat/on-chain-fallback

606eb24

feat: on-chain fallback view functions for positions and orders

Merge branch 'main' into wlp-staking-sdk

6bfbbcf

fix: use literal RegExp to satisfy semgrep ReDoS rule

02065e3

Replace dynamic `new RegExp(functionName)` with hardcoded patterns per factory function (VecSet, LinkedTable, Node). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

style: format fix-generated-imports

4a5e73f

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Merge pull request #30 from Bucket-Protocol/wlp-staking-sdk

4451b8c

feat: integrate reward distributor flow and APR support into SDK

chore: bump sdk version

012949b

ZouBadCode added 2 commits April 14, 2026 13:10

Merge branch 'audit/fix-colleteral-type-and-funding-rate-cal' of http…

ae0fd44

…s://github.com/Bucket-Protocol/waterx-sdk into audit/fix-colleteral-type-and-funding-rate-cal

do0x0ob reviewed Apr 14, 2026

View reviewed changes

Comment thread contracts/reward_distributor/scripts/security-attack-check.ts

Copy link
Copy Markdown

Contributor

do0x0ob Apr 14, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

攻擊腳本可以考慮移除

do0x0ob reviewed Apr 14, 2026

View reviewed changes

Comment thread contracts/reward_distributor/scripts/setup-rewarder-wlp-mock-sui.ts

Copy link
Copy Markdown

Contributor

do0x0ob Apr 14, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

這是不是也是配置腳本

do0x0ob reviewed Apr 14, 2026

View reviewed changes

Comment thread contracts/reward_distributor/parameter.json

Copy link
Copy Markdown

Contributor

do0x0ob Apr 14, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

這個是不是也是腳本用的

do0x0ob approved these changes Apr 14, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

audit: enhance collateral type validation and funding rate logic#31

audit: enhance collateral type validation and funding rate logic#31
ZouBadCode wants to merge 37 commits intomainfrom
audit/fix-colleteral-type-and-funding-rate-cal

ZouBadCode commented Apr 13, 2026

Uh oh!

bucket-bot left a comment

Uh oh!

bucket-bot left a comment

Uh oh!

june-in-exile Apr 14, 2026

Uh oh!

do0x0ob commented Apr 14, 2026

Uh oh!

do0x0ob Apr 14, 2026

Uh oh!

do0x0ob Apr 14, 2026

Uh oh!

do0x0ob Apr 14, 2026

Uh oh!

do0x0ob Apr 14, 2026

Uh oh!

do0x0ob Apr 14, 2026

Uh oh!

do0x0ob left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

ZouBadCode commented Apr 13, 2026

Uh oh!

bucket-bot left a comment

Choose a reason for hiding this comment

Code review

Uh oh!

bucket-bot left a comment

Choose a reason for hiding this comment

✅ Code Review — Approved

1. Collateral Type Validation

2. Funding Rate Multi-Interval Catch-Up

Tests

Uh oh!

june-in-exile Apr 14, 2026

Choose a reason for hiding this comment

Uh oh!

do0x0ob commented Apr 14, 2026

Uh oh!

do0x0ob Apr 14, 2026

Choose a reason for hiding this comment

Uh oh!

do0x0ob Apr 14, 2026

Choose a reason for hiding this comment

Uh oh!

do0x0ob Apr 14, 2026

Choose a reason for hiding this comment

Uh oh!

do0x0ob Apr 14, 2026

Choose a reason for hiding this comment

Uh oh!

do0x0ob Apr 14, 2026

Choose a reason for hiding this comment

Uh oh!

do0x0ob left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants