Percolator Launch

Description

In percolator-stake, both market_resolved() (line 196) and hwm_enabled() (line 300) read/write to _reserved[9]. Enabling HWM protection writes 1 to _reserved[9], which simultaneously causes market_resolved() to return true, immediately blocking all deposits. Conversely, resolving the market unintentionally enables HWM logic. The layout comments at lines 184 and 291 document conflicting assignments.

Location

// Line 196
pub fn market_resolved(&self) -> bool {
    self._reserved[9] != 0
}
// Line 300
pub fn hwm_enabled(&self) -> bool {
    self._reserved[9] == 1
}

Description

The percolator-prog codebase contains an unsafe_close feature flag that completely skips ALL CloseSlab validation — no admin check, no vault balance check, no insurance check, no account count check, and no data zeroing. Any signer could drain all lamports from any slab. Compile-time guards at lines 15-20 prevent this from compiling with mainnet or without test features.

Location

#[cfg(all(feature = "unsafe_close", feature = "mainnet"))]
compile_error!("unsafe_close MUST NOT be enabled on mainnet builds!");
#[cfg(all(feature = "unsafe_close", not(feature = "test")))]
compile_error!("unsafe_close requires `test` feature");

Description

The matcher program (DHP6DtwXP1yJsz8YzfoeigRFPB979gzmumkmCxDLSkUX) has upgrade authority set to CTNRpc2N1Jhgjk4GfmoQuzHKC5HcxiSTE5Bh471yU6FP, which is a regular system account (EOA), not a multisig. A single private key can upgrade the matcher program to arbitrary code. The main percolator program is immutable (upgrade authority = None).

Location

Description

The percolator-prog source contains declare_id!('Perco1ator111111111111111111111111111111111') — a vanity/placeholder program ID. The actual deployed mainnet program uses a different ID (GM8zjJ8LTBMv9xEsverh6H6wLyevgMHEJXcEzyY3rY24). If the source were deployed as-is, the slab_guard owner check would use the wrong address.

Location

declare_id!("Perco1ator111111111111111111111111111111111");

Description

In percolator-stake, validate_discriminator() accepts both the correct discriminator AND an all-zeros pattern for backward compatibility with pre-versioning accounts. Combined with bytemuck::from_bytes (which accepts any byte pattern), a zeroed account could theoretically pass validation. PDA derivation checks prevent exploitation in practice.

Location

pub fn validate_discriminator(&self) -> bool {
    let disc = &self._reserved[..8];
    disc == [0u8; 8] || disc == STAKE_POOL_DISCRIMINATOR
}

Description

In percolator-prog, invoke_signed_trade uses invoke_signed_unchecked which skips RefCell borrow validation. Safety comments are thorough and explain the invariants, but any future code change that holds a borrow across the CPI call could cause undefined behavior in BPF runtime.

Location

pub fn invoke_signed_trade<'a>(...) -> Result<(), ProgramError> {
    // Safety reasoning documented in comments
    invoke_signed_unchecked(ix, &infos, &[seeds])
}

Description

The airdrop and devnet-airdrop API routes return {allowed: true} on unexpected DB errors ('fail open to avoid blocking users'). A DB outage allows unlimited airdrops. Mitigated by: devnet-only endpoints minting test tokens with no real value.

Location

Description

Several endpoints (ideas, applications, stats) use per-process Map rate limiters that reset on Vercel cold starts. An attacker distributing requests across instances bypasses these limits. The main middleware uses Upstash Redis (distributed) which is not affected.

Location

Description

During InitPool in percolator-stake, the percolator_program account is stored directly without verifying it is executable or checking its program ID. A malicious admin could point to an attacker-controlled program. Mitigated by: admin is already trusted (they create the pool).

Location

pool.percolator_program = percolator_program.key.to_bytes();

Description

The AccrueFees instruction in percolator-stake is permissionless and idempotent (uses balance delta). While idempotent, an attacker could spam it to consume compute units.

Location