Skip to content

fix: receiver validation (2A $200) + fee accumulation system (2C $200)#8

Open
wyslsz wants to merge 3 commits into
intuition-box:mainfrom
wyslsz:main
Open

fix: receiver validation (2A $200) + fee accumulation system (2C $200)#8
wyslsz wants to merge 3 commits into
intuition-box:mainfrom
wyslsz:main

Conversation

@wyslsz
Copy link
Copy Markdown

@wyslsz wyslsz commented May 11, 2026

Bounties Included

2A: Fix Issue #1 — Receiver Validation ($200 USDC)

  • Added receiver == msg.sender check to deposit(), createAtoms(), createTriples(), depositBatch()
  • New IntuitionFeeProxy_ReceiverMismatch error
  • 9 Foundry test cases

2C: Withdraw Function — Fee Accumulation ($200 USDC)

  • Replaced auto-forwarding with accumulation model
  • withdrawFees() — fee recipient claims accumulated fees
  • withdrawFeesTo(address) — admin emergency withdrawal
  • getAccumulatedFees() — view function
  • FeesWithdrawn event
  • State restoration on transfer failure

Total Bounty: $400 USDC

wyslsz and others added 3 commits May 12, 2026 00:06
- Add IntuitionFeeProxy_ReceiverMismatch error to Errors library
- Add receiver validation in deposit(), createAtoms(), createTriples(), depositBatch()
- Add Foundry test suite (ReceiverValidation.t.sol) with 9 test cases
- Tests cover: happy path, revert on mismatch, attack scenario prevention

Fixes intuition-box#1
Bounty: #2A (00 USDC)
- accumulatedFees state replacing auto-forwarding
- withdrawFees() for fee recipient
- withdrawFeesTo() for admin emergency
- getAccumulatedFees() view function
- FeesWithdrawn event
- Reentrancy-safe: state restored on transfer failure

Bounty: #2C ($200 USDC)
@wyslsz wyslsz changed the title fix: validate receiver == msg.sender to prevent share theft (Bounty #2A — $200 USDC) fix: receiver validation (2A $200) + fee accumulation system (2C $200) May 11, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant