Skip to content

batch_claim_reward bypasses pause check while claim_reward checks it #497

Open
Open
batch_claim_reward bypasses pause check while claim_reward checks it#497
Labels
Stellar WaveIssues in the Stellar wave programbugSomething isn't workinghighSignificant functionality broken, no workaround, affects multiple usersrustRust language

Description

@DeFiVC
DeFiVC
opened on Sep 30, 2026

What

batch_claim_reward (learn-token lib.rs:717) does not call Self::require_not_paused(&env), while the single claim_reward (lib.rs:634) does. This means batch reward claims can mint tokens even when the contract is emergency-paused.

// claim_reward checks pause:
pub fn claim_reward(...) {
    Self::require_not_paused(&env);  // line 634
    ...
}

// batch_claim_reward does NOT:
pub fn batch_claim_reward(...) {
    learner.require_auth();  // line 723 -- no pause check
    ...
}

Why

batch_claim_reward mints tokens just like claim_reward. If the contract is paused to stop token minting (e.g., due to a discovered exploit), batch_claim_reward remains functional and can still mint tokens.

Scope

Add Self::require_not_paused(&env); at line 723, before learner.require_auth().

Acceptance Criteria

  • batch_claim_reward panics when the contract is paused
  • Test verifies batch claims are blocked during pause

Technical Context

  • contracts/learn-token/src/lib.rs:634 -- claim_reward (checks pause)
  • contracts/learn-token/src/lib.rs:717-780 -- batch_claim_reward (missing pause check)

Activity

  1. DeFiVC
    added
    bugSomething isn't working
    rustRust language
    Stellar WaveIssues in the Stellar wave program
    highSignificant functionality broken, no workaround, affects multiple users
    on Sep 30, 2026

  2. MorsH14 commented on Sep 30, 2026

    @MorsH14
    MorsH14
    on Sep 30, 2026 – with Drips Wave

    @MorsH14 has applied to work on this issue as part of the Stellar Wave Program's 9th wave.

    I'll love to work on this issue asap

    ℹ️ Repo Maintainers: To accept this application, review their application or assign @MorsH14 to this issue.

  3. dvreolv-ux commented on Sep 30, 2026

    @dvreolv-ux
    dvreolv-ux
    on Sep 30, 2026 – with Drips Wave

    @dvreolv-ux has applied to work on this issue as part of the Stellar Wave Program's 9th wave.

    I’m interested in taking this up and would appreciate the assignment.

    ℹ️ Repo Maintainers: To accept this application, review their application or assign @dvreolv-ux to this issue.

  4. demola13777 commented on Sep 30, 2026

    @demola13777
    demola13777
    on Sep 30, 2026 – with Drips Wave

    @demola13777 has applied to work on this issue as part of the Stellar Wave Program's 9th wave.

    Hi maintainer, I can resolve this issue very quickly. Pls assign it to me, thanks

    ℹ️ Repo Maintainers: To accept this application, review their application or assign @demola13777 to this issue.

  5. Tinu-ola commented on Sep 30, 2026

    @Tinu-ola
    Tinu-ola
    on Sep 30, 2026 – with Drips Wave

    @Tinu-ola has applied to work on this issue as part of the Stellar Wave Program's 9th wave.

    Hi. Kindly assign me to this issue.

    ℹ️ Repo Maintainers: To accept this application, review their application or assign @Tinu-ola to this issue.

  6. 339mon commented on Sep 30, 2026

    @339mon
    339mon
    on Sep 30, 2026 – with Drips Wave

    @339mon has applied to work on this issue as part of the Stellar Wave Program's 9th wave.

    Hi, kindly assign, i would love to fix

    ℹ️ Repo Maintainers: To accept this application, review their application or assign @339mon to this issue.

  7. Sophie2704 commented on Sep 30, 2026

    @Sophie2704
    Sophie2704
    on Sep 30, 2026 – with Drips Wave

    @Sophie2704 has applied to work on this issue as part of the Stellar Wave Program's 9th wave.

    Hello Maintainer I'd like to help in fixing this issue please kindly assign it to me

    ℹ️ Repo Maintainers: To accept this application, review their application or assign @Sophie2704 to this issue.

  8. Husinat commented on Sep 30, 2026

    @Husinat
    Husinat
    on Sep 30, 2026 – with Drips Wave

    @Husinat has applied to work on this issue as part of the Stellar Wave Program's 9th wave.

    Hello! I understand and can quickly fix this issue up please assign to me🙏

    ℹ️ Repo Maintainers: To accept this application, review their application or assign @Husinat to this issue.

  9. Demilade10 commented on Sep 30, 2026

    @Demilade10
    Demilade10
    on Sep 30, 2026 – with Drips Wave

    @Demilade10 has applied to work on this issue as part of the Stellar Wave Program's 9th wave.

    Hi I can fix this

    ℹ️ Repo Maintainers: To accept this application, review their application or assign @Demilade10 to this issue.

  10. lmduy2612 commented on Oct 2, 2026

    @lmduy2612
    lmduy2612
    on Oct 2, 2026

    I have submitted a pull request fixing this issue in #516. batch_claim_reward now calls Self::require_not_paused(&env) before learner auth, with unit tests passing green.

  11. Ranjeet2063 commented on Oct 5, 2026

    @Ranjeet2063
    Ranjeet2063
    on Oct 5, 2026

    Hi maintainers,

    I reviewed this issue and would like to contribute the fix.

    Technical outline:

    1. Audit storage layout and state invariants ensuring strict auth guards.
    2. Implement deterministic state transitions with safe checked arithmetic.
    3. Add hermetic unit and regression tests covering authorized, unauthorized, and boundary edge cases.
    4. Profile instruction and CPU/gas limits under Soroban host environment.

    Please assign this to me if the plan looks good. Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    Stellar WaveIssues in the Stellar wave programbugSomething isn't workinghighSignificant functionality broken, no workaround, affects multiple usersrustRust language

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions