Skip to content

Commit 6676e7e

Browse files
fix(dex): reject same-token (base==quote) pools on create and remove
addInternal used Java reference equality (!=) on freshly-deserialized score.Address params, so the base!=quote guard was a silent no-op and base==quote pools could be created. Switch to value equality (.equals). Add the same guard to _remove so any pre-existing same-token pool cannot be drained via the DictDB key-collision double-credit. Bump DEX to v1.1.9. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
1 parent 10ab2f4 commit 6676e7e

2 files changed

Lines changed: 3 additions & 2 deletions

File tree

  • core-contracts/Dex/src/main/java/network/balanced/score/core/dex
  • score-lib/src/main/java/network/balanced/score/lib/utils

core-contracts/Dex/src/main/java/network/balanced/score/core/dex/DexImpl.java

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -289,6 +289,7 @@ void _remove(BigInteger _id, NetworkAddress _user, BigInteger _value, @Optional
289289
require(_value.compareTo(userBalance) <= 0, TAG + ": Insufficient balance");
290290

291291
Address quoteToken = poolQuote.get(_id.intValue());
292+
require(!baseToken.equals(quoteToken), TAG + ": Invalid same-token pool, removal blocked");
292293
DictDB<Address, BigInteger> totalTokensInPool = poolTotal.at(_id.intValue());
293294
BigInteger totalBase = totalTokensInPool.get(baseToken);
294295
BigInteger totalQuote = totalTokensInPool.get(quoteToken);
@@ -350,7 +351,7 @@ public void addInternal(NetworkAddress _from, Address _baseToken, Address _quote
350351
// If none is found (return 0), we create a new pool.
351352
Integer id = poolId.at(_baseToken).getOrDefault(_quoteToken, 0);
352353

353-
require(_baseToken != _quoteToken, TAG + ": Pool must contain two token contracts");
354+
require(!_baseToken.equals(_quoteToken), TAG + ": Pool must contain two token contracts");
354355
// Check base/quote balances are valid
355356
require(_baseValue.compareTo(BigInteger.ZERO) > 0,
356357
TAG + ": Cannot send 0 or negative base token");

score-lib/src/main/java/network/balanced/score/lib/utils/Versions.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ public class Versions {
3030
public final static String STABILITY = "v1.1.1";
3131
public final static String BALANCEDORACLE = "v1.2.0";
3232
public final static String DAOFUND = "v1.1.4";
33-
public final static String DEX = "v1.1.8";
33+
public final static String DEX = "v1.1.9";
3434
public final static String GOVERNANCE = "v1.0.2";
3535
public final static String REBALANCING = "v1.0.0";
3636
public final static String ROUTER = "v1.2.4";

0 commit comments

Comments
 (0)