Corvid AMM

The Withdraw accounts struct declares lp_mint: Account<'info, Mint> without an address = pool.lp_mint or has_one = lp_mint constraint. Anchor therefore verifies only that the account is a valid mint owned by the SPL Token program, not that it is this pool’s mint.

The share of reserves returned is computed as lp_amount / lp_mint.supply applied to both vaults, and the burn is performed against the supplied mint. An attacker can create a new mint, mint a single token to themselves, and pass that mint and token account to withdraw.

The program burns the attacker’s one token from the fake mint, computes a share of 1/1 = 100%, and transfers the entire contents of both vaults.

Complete loss of both reserves in every pool, in a single transaction per pool, with no capital required.

Constrain lp_mint to pool.lp_mint (for example #[account(mut, address = pool.lp_mint)] or has_one = lp_mint on the pool), and add a negative test that passes a foreign mint and expects failure.

Address constraint added, plus has_one constraints for the mint and both vaults. Negative tests pass a foreign mint and foreign vaults and expect ConstraintHasOne errors.

collect_fees takes authority: UncheckedAccount<'info> and checks authority.key() == pool.fee_authority. The comparison proves only that the caller knows the authority’s public key, which is public. The account is never required to sign the transaction.

On Solana, authorisation comes from the signer flag on the account meta. Without Signer<'info> (or an explicit is_signer check), any caller can satisfy the comparison.

Loss of all accumulated protocol fees across all pools. LP reserves are not affected because fees are tracked separately.

Declare the account as Signer<'info> and keep the key comparison through has_one = fee_authority on the pool.

Account changed to Signer with a has_one constraint; negative test with an unsigned authority added.

The invariant reserve_a * reserve_b is computed in u64. Rust release builds wrap on integer overflow unless overflow-checks = true is set in the release profile, and the workspace did not set it.

Two vaults of a 9-decimal token holding about 4.3 million whole tokens each already exceed u64::MAX when multiplied. At that point the computed product wraps to a small number and the invariant check after a swap compares against a meaningless value.

Swaps can succeed at incorrect prices once reserves are large, extracting value from liquidity providers.

Compute in u128 with checked_mul, return an explicit error on overflow, and enable overflow-checks = true in the release profile as defence in depth.

Moved to u128 checked arithmetic throughout; overflow-checks enabled in Cargo.toml.

The fee is computed as amount_in / 10_000 * fee_bps. Division before multiplication truncates the intermediate result, so any trade below 10,000 base units pays no fee at all, and larger trades are under-charged by up to fee_bps − 1 units.

On Solana, transaction fees are low enough that splitting a large trade into many small ones can be cheaper than paying the swap fee.

Liquidity providers lose fee income; value transfers to traders who split orders.

Multiply before dividing and round the fee up: (amount_in * fee_bps + 9_999) / 10_000 computed in u128.

Formula corrected with upward rounding; PB-03 holds.

Swaps enforce minimum_amount_out, but deposits accept any LP amount. A deposit that lands after a large price move (or after a sandwiching trade) mints fewer LP tokens than the user was quoted.

Depositors can receive materially fewer LP tokens than quoted.

Add a min_lp_out argument and revert when it is not met.

Parameter added; SDK passes quoted values with a tolerance.

Pool creation and the first deposit are separate instructions. Between them, any third party can make the first deposit at an arbitrary ratio, setting the pool’s opening price.

The pool opens at a misleading price; the cost falls on whoever trades first.

Combine initialisation with the first deposit, or restrict the first deposit to the pool creator.

Acknowledged. The front end creates and seeds pools atomically in one transaction; the program behaviour is documented for integrators.