Skip to content

fix(options_market): pin trusted vault and verify escrow post-condition - #158

Merged
dami-005 merged 2 commits into
Zenith-options:mainfrom
brightpedrofr-gif:fix/pin-trusted-vault-escrow
Sep 30, 2026
Merged

dami-005 merged 2 commits into
Zenith-options:mainfrom
brightpedrofr-gif:fix/pin-trusted-vault-escrow

Conversation

@brightpedrofr-gif

Copy link
Copy Markdown

Description

Closes a griefing vector in escrow_series_to_vault and claim_refund_from_vault where untrusted vault addresses could be passed to zero series escrow without transferring funds.

Key changes:

  • Added DataKey::Vault to store the pinned trusted Vault contract address.
  • Added set_vault (admin) and set_vault_via_multisig along with vault_updated event.
  • Enforced that escrow_series_to_vault validates the vault against the pinned vault address.
  • Added post-condition check verifying that vault.balance_of(series_id) increases by exactly amount.
  • Added DataKey::SeriesVault(series_id) to record per-series which vault holds its escrow so future rotations do not strand funds.
  • Updated claim_refund_from_vault to validate against the series' recorded vault.
  • Added regression tests covering unauthorized vault rejection, post-condition verification, and vault rotation.

Closes #7

@drips-wave

drips-wave Bot commented Sep 30, 2026

Copy link
Copy Markdown

@brightpedrofr-gif Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

…lt-escrow

# Conflicts:
#	options_market/src/error.rs
#	options_market/src/events.rs
#	options_market/src/lib.rs
#	options_market/src/math.rs
#	options_market/src/storage.rs
@dami-005
dami-005 merged commit a3bd326 into Zenith-options:main Sep 30, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[High] Pin the Trusted Vault in escrow_series_to_vault / claim_refund_from_vault to Close a Griefing Vector

2 participants