Repository navigation
MaintenancePoolService.assignReward's balance check is a TOCTOU race — concurrent calls can overdraw a pool's real balance despite #51's atomic-decrement fix #274
Description
src/maintenance-pool/maintenance-pool.service.ts:87-133. The balance check reads:
if (Number(amount) > Number(pool.balance)) {
throw new BadRequestException(...)
}— pool.balance is read from this.findOne(id) at the top of the function, then, only after the on-chain poolWithdraw call succeeds, an atomic this.poolRepo.decrement(...) is applied. The decrement itself is atomic and correctly fixes the lost-update race from #51 ("MaintenancePool.balance is a hand-maintained running total with a lost-update race across concurrent deposit/assignReward calls") — verified by the passing regression test in maintenance-pool.service.spec.ts ("two concurrent assignReward calls both apply — no lost decrement (#51)").
But that test only proves neither decrement is lost — it does not (and cannot, given the current code) prove the pool never goes negative. If a pool has balance = 100 and two concurrent assignReward calls each request 80, both read pool.balance = 100 before either writes, both pass the 80 > 100 check, both successfully call escrowService.poolWithdraw (which has no balance ceiling of its own — src/escrow/escrow.service.ts only checks assertLocked/assertValidAmount, not against pool.balance), and both decrement — leaving pool.balance = -60 and, if the on-chain contract doesn't independently enforce a floor either, potentially over-releasing real funds from escrow. poolRepo.decrement has no WHERE balance >= :amount guard that would make the whole operation self-limiting.
Fix: make the balance check part of the same atomic statement, e.g. UPDATE maintenance_pools SET balance = balance - :amount WHERE id = :id AND balance >= :amount RETURNING balance, and only proceed to poolWithdraw if a row was actually updated (or wrap the check+decrement+withdraw in a SELECT ... FOR UPDATE transaction).
Activity
shobhamerabacha-star commentedon Sep 18, 2026
Hello @maintainers,
I can tackle
MaintenancePoolService.assignReward's balance check is a TOCTOU race — concurrent calls can overdraw a pool's real balance despite #51's atomic-decrement fix. Proposed implementation roadmap:MergeFi/backendMaintenancePoolService.assignReward's balance check is a TOCTOU race — concurrent calls can overdraw a pool's real balance despite #51's atomic-decrement fixwith strict schema validation and idempotent execution.Looking forward to collaborating on this—please assign!
Tobi-8 commentedon Sep 23, 2026
@Tobi-8 has applied to work on this issue as part of the Stellar Wave Program's 9th wave.
ℹ️ Repo Maintainers: To accept this application, review their application or assign @Tobi-8 to this issue.
jaynomyaro commentedon Sep 23, 2026
@jaynomyaro has applied to work on this issue as part of the Stellar Wave Program's 9th wave.
ℹ️ Repo Maintainers: To accept this application, review their application or assign @jaynomyaro to this issue.
chidii commentedon Sep 23, 2026
@chidii has applied to work on this issue as part of the Stellar Wave Program's 9th wave.
ℹ️ Repo Maintainers: To accept this application, review their application or assign @chidii to this issue.
danielchukuma-dev commentedon Sep 23, 2026
@danielchukuma-dev has applied to work on this issue as part of the Stellar Wave Program's 9th wave.
ℹ️ Repo Maintainers: To accept this application, review their application or assign @danielchukuma-dev to this issue.
Uchechukwu-Ekezie commentedon Sep 23, 2026
@Uchechukwu-Ekezie has applied to work on this issue as part of the Stellar Wave Program's 9th wave.
ℹ️ Repo Maintainers: To accept this application, review their application or assign @Uchechukwu-Ekezie to this issue.
drips-wave commentedon Sep 23, 2026
Congratulations, @Uchechukwu-Ekezie! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on September 30, 2026.
🧑💻 @Uchechukwu-Ekezie: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.
Warning
When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.
🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.
🌊 Happy Wave 🌊
drips-wave commentedon Sep 23, 2026
This issue has been completed by @Uchechukwu-Ekezie as part of the Stellar Wave Program's 9th Wave 🥳
😎 @Uchechukwu-Ekezie: You earned 200 Points for completing this issue! After the current Wave ends, you'll be eligible for a percentage of the Wave's reward pool based on the percentage of total points you've earned. Learn more here. You can also Leave a review to share your experience working on this issue.
🧑💻 Repo maintainers: How'd the contributor do? Leave a review to share your experience working with them.
fix: resolve maintenance pool and stats bugs (MergeFi#272-MergeFi#275)