Repository navigation
MaintenancePoolService.assignReward has no guard against being called twice for the same issueId — double/triple payout of a single completed task #273
Description
src/maintenance-pool/maintenance-pool.service.ts:87-133. assignReward validates that the issue exists, is isMaintenanceType, and belongs to the pool's repository, then unconditionally calls escrowService.poolWithdraw(...) and decrements the pool balance. Nothing anywhere checks whether this issueId has already received a reward from this (or any) pool. Issue (src/common/entities/issue.entity.ts) has no rewardedAt/maintenancePoolRewardId/similar field, and the service never queries Payment for a prior withdrawal tied to this issue before paying again.
Concretely: a maintainer calls POST /maintenance-pools/:id/assign-reward with { issueId: X, amount: 50, recipientAddress: G... }, gets paid. They (or a colleague with MAINTAINER role) can immediately call it again with the same issueId: X and a different Idempotency-Key — the @Idempotent('pool.assignReward') decorator only dedupes identical (key, scope, caller) tuples, so a fresh key sails through — and drain the pool a second time for the same already-completed work, as many times as the balance allows.
This is the same class of bug as the (closed) issue "release() and splitRelease() never check for pre-existing Payment rows, so calling them after releasePartial causes a double payout of the full escrow amount" (#44), but in a different, unguarded code path that #44's fix never touched.
Fix: before paying, query for an existing Payment (or a new dedicated join table) keyed by (maintenancePoolId, issueId) and reject the call with a 409/400 if one already exists; or add a rewardedAt/rewardedByPoolId column on Issue set transactionally alongside the payment.
Activity
shobhamerabacha-star commentedon Sep 17, 2026
Hello! I would like to work on this issue.
I would love to take this on. My planned approach:
MaintenancePoolService.assignReward has no guard against being called twice for the same issueId — double/triple payout of a single completed taskensuring proper HTTP status codes and error propagation.Looking forward to contributing—please assign whenever convenient!
flexocode442 commentedon Sep 23, 2026
@flexocode442 has applied to work on this issue as part of the Stellar Wave Program's 9th wave.
ℹ️ Repo Maintainers: To accept this application, review their application or assign @flexocode442 to this issue.
Hope-0735 commentedon Sep 23, 2026
@Hope-0735 has applied to work on this issue as part of the Stellar Wave Program's 9th wave.
ℹ️ Repo Maintainers: To accept this application, review their application or assign @Hope-0735 to this issue.
doctorlight0 commentedon Sep 23, 2026
@doctorlight0 has applied to work on this issue as part of the Stellar Wave Program's 9th wave.
ℹ️ Repo Maintainers: To accept this application, review their application or assign @doctorlight0 to this issue.
aemmanueloke commentedon Sep 23, 2026
@aemmanueloke has applied to work on this issue as part of the Stellar Wave Program's 9th wave.
ℹ️ Repo Maintainers: To accept this application, review their application or assign @aemmanueloke to this issue.
Uchechukwu-Ekezie commentedon Sep 23, 2026
@Uchechukwu-Ekezie has applied to work on this issue as part of the Stellar Wave Program's 9th wave.
ℹ️ Repo Maintainers: To accept this application, review their application or assign @Uchechukwu-Ekezie to this issue.
drips-wave commentedon Sep 23, 2026
Congratulations, @Uchechukwu-Ekezie! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on September 30, 2026.
🧑💻 @Uchechukwu-Ekezie: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.
Warning
When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.
🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.
🌊 Happy Wave 🌊
drips-wave commentedon Sep 23, 2026
This issue has been completed by @Uchechukwu-Ekezie as part of the Stellar Wave Program's 9th Wave 🥳
😎 @Uchechukwu-Ekezie: You earned 200 Points for completing this issue! After the current Wave ends, you'll be eligible for a percentage of the Wave's reward pool based on the percentage of total points you've earned. Learn more here. You can also Leave a review to share your experience working on this issue.
🧑💻 Repo maintainers: How'd the contributor do? Leave a review to share your experience working with them.
fix: resolve maintenance pool and stats bugs (MergeFi#272-MergeFi#275)