UpdateAssetLifecycle ACTIVATE future-slot DoS

handle_update_asset_lifecycle ACTIVATE arm accepts caller-supplied future now_slot — permanent permissionless-cranker DoS via future-stamped header.current_slot

Affected code

• Wrapper percolator-prog/src/v16_program.rs:7754-7764 (handle_update_asset_lifecycle append-activation branch). Passes raw now_slot to state::activate_dynamic_asset_slot.
• Wrapper percolator-prog/src/v16_program.rs:7696-7704 (reuse-activation branch). Same — passes raw now_slot to activate_empty_market_slot_not_atomic.
• Wrapper percolator-prog/src/v16_program.rs:7810 (SHUTDOWN arm, for contrast). Correctly wraps: let authenticated_slot = authenticated_slot_or_fallback(now_slot);
• Engine percolator/src/v16.rs:4453-4587 (activate_empty_market_slot_not_atomic). Guard at line 4468 only rejects PAST slots; no upper-bound check.
• Engine cascade percolator/src/v16.rs:7542 (view-mut accrue_asset_to_not_atomic) and :14513 (runtime mirror). Returns Err(InvalidConfig) when now_slot < self.header.current_slot.get().

Bug

The engine guard:

// percolator/src/v16.rs:4465-4471
if decode_market_mode(self.mode)? != MarketModeV16::Live
    || authenticated_price == 0
    || authenticated_price > MAX_ORACLE_PRICE
    || now_slot < self.current_slot.get()    // past-slot reject only
{
    return Err(V16Error::InvalidConfig);
}

With now_slot = u64::MAX, the guard passes. The engine then stamps:

• self.current_slot = V16PodU64::new(now_slot) (line 4581) → header.current_slot = u64::MAX
• asset.slot_last = now_slot (line 4552) → asset[i].slot_last = u64::MAX

This state is committed to the on-chain market account and persists across instructions. Every subsequent cranker entry point that calls accrue_asset_to_not_atomic hits the guard at v16.rs:7542:

// percolator/src/v16.rs:7537-7545 (view-mut accrue)
if asset_index >= config.max_market_slots as usize
    || asset_index >= self.markets.len()
    || effective_price == 0
    || effective_price > MAX_ORACLE_PRICE
    || funding_rate_e9.unsigned_abs() > config.max_abs_funding_e9_per_slot as u128
    || now_slot < self.header.current_slot.get()    // bug cascade fires here
{
    return Err(V16Error::InvalidConfig);
}

With header.current_slot = u64::MAX and any real Clock.slot < u64::MAX, every cranker call reverts.

Impact

Class: permanent DoS of all permissionless cranker progress on the affected market.

Reverted entry points:

• PermissionlessCrank (Refresh, Recover, Liquidate, SettleB)
• SyncMaintenanceFee — the only path that grows header.insurance from accrued fees
• ResolveStalePermissionless
• ForceCloseAbandonedAsset
• Any internal path that invokes accruable_asset_slot_summary

Consequences: permanent insurance starvation (no fee accrual), bankrupt-account accumulation (no liquidation), resolution-mode blocked, operator-funded insurance becomes a one-way deposit.

The bounty 6 win condition is "drop engine.insurance_fund.balance via public-instruction calls." This bug doesn't drop insurance directly; it freezes the only mechanism that allows insurance to grow and to disburse, leaving operator/protocol value stranded.

Status

LATENT on the live bounty 6 market BhkMic5gHLjj5Uxkg6rBBXofUzeTZVwmV4uFzfhwtgQw as of 2026-05-26.

On-chain configuration (queried via Solana RPC solana account BhkMic5g… + parsed WrapperConfigV16 at byte offsets 144 / 390 within the market account):

• permissionless_market_init_fee = 5,864,605 lamports (~0.00586 SOL) — public ACTIVATE path is open
• max_market_slots = 4, currently 4 configured (m0, m1, m2, retired m3), free_market_slot_count = 0

Both reachable code paths into the buggy engine call are currently closed:

• APPEND (asset_index == configured_slots): wrapper guard at v16_program.rs:7683-7686 requires free_market_slot_count == 0 (currently true), but engine guard at v16.rs:4462 rejects asset_index ≥ max_market_slots = 4.
• REUSE (asset_index < configured_slots): wrapper guard at :7621 requires free_market_slot_count != 0 (currently false). Only admin can RETIRE a slot to increment the counter.

The bug fires on any market where one of:

• configured_slots < max_market_slots (APPEND open) — applies to any fresh deployment with headroom
• free_market_slot_count > 0 (REUSE open) — applies whenever admin RETIRE has been called and the slot hasn't been re-claimed

Existing PoC

Engine-direct L2 (3 tests, passing on engine HEAD 9bcf002b):

percolator/tests/v16_bounty6_h2.rs
  bounty6_h2_activate_accepts_u64_max_future_slot          PASS
  bounty6_h2_accrue_dos_after_future_slot_activation       PASS
  bounty6_h2_source_pin_engine_only_rejects_past_slot      PASS

Wrapper-BPF L4 LiteSVM (2 tests, passing against the deployed-binary path at wrapper HEAD 0925ed4):

percolator-prog/tests/v16_cu.rs
  v16_bpf_bounty6_h2_update_asset_lifecycle_activate_accepts_spoofed_future_slot    PASS
  v16_bpf_bounty6_h2_permissionless_crank_dos_after_future_slot_activation         PASS

L4 tests cargo build-sbf --no-default-features against wrapper 0925ed4, then exercise the full instruction round-trip through LiteSVM (BPF binary at target/deploy/percolator_prog.so). The cascade test verifies that PermissionlessCrank reverts both immediately after activation and after warping the SVM clock to slot 1,000,000.

Fix (two patches — both should land)

Wrapper: wrap now_slot with authenticated_slot_or_fallback in both ACTIVATE branches, matching the SHUTDOWN arm pattern at :7810:

--- a/src/v16_program.rs
+++ b/src/v16_program.rs
@@ -7693,7 +7693,7 @@
                         group
                             .header
                             .activate_empty_market_slot_not_atomic(
                                 asset_index as u32,
                                 &mut group.markets[asset_index],
                                 initial_price,
-                                now_slot,
+                                authenticated_slot_or_fallback(now_slot),
                             )
                             .map_err(map_v16_error)?;
@@ -7751,7 +7751,7 @@
                 if !reuse_activated && asset_index == configured_slots {
                     let profile = state::activate_dynamic_asset_slot(
                         &mut data,
                         asset_index,
-                        now_slot,
+                        authenticated_slot_or_fallback(now_slot),
                         initial_price,
                         insurance_authority,
                         insurance_operator,
                         backing_bucket_authority,

Engine: defense-in-depth — reject now_slot more than 2 × asset_activation_cooldown_slots past self.current_slot in activate_empty_market_slot_not_atomic:

--- a/src/v16.rs
+++ b/src/v16.rs
@@ -4465,11 +4465,18 @@ impl MarketGroupV16HeaderAccount {
         if decode_market_mode(self.mode)? != MarketModeV16::Live
             || authenticated_price == 0
             || authenticated_price > MAX_ORACLE_PRICE
             || now_slot < self.current_slot.get()
         {
             return Err(V16Error::InvalidConfig);
         }
+        // Reject far-future slots. `now_slot` is caller-supplied through the
+        // wrapper's UpdateAssetLifecycle ACTIVATE arm; without an upper bound,
+        // a permissionless caller can stamp `current_slot = u64::MAX` and
+        // permanently freeze every subsequent `accrue_asset_to_not_atomic`
+        // call (which guards `now_slot < self.current_slot.get()`).
+        let max_drift = config.asset_activation_cooldown_slots.saturating_mul(2);
+        if now_slot > self.current_slot.get().saturating_add(max_drift) {
+            return Err(V16Error::InvalidConfig);
+        }
         config.validate_public_user_fund_shape()?;

Verification verdict

PASS_VERIFIED. Both fix patches applied to engine working tree + cargo git cache + wrapper working tree. Wrapper target/sbpf-solana-solana/release/deps/libpercolator-*.rlib scrubbed and target/debug/deps/libpercolator-*.rlib scrubbed. BPF rebuilt via cargo build-sbf --no-default-features (recompiled engine + wrapper). L2 and L4 tests re-run:

• L2: all 3 tests flipped PASS → FAIL. bounty6_h2_activate_accepts_u64_max_future_slot now sees Err(InvalidConfig) from the new engine upper-bound guard. bounty6_h2_source_pin_engine_only_rejects_past_slot panics on the new saturating_add string the source-pin asserts absent.
• L4: both BPF tests flipped PASS → FAIL. activate_permissionless_asset_with_fee(..., u64::MAX, ...) now returns FailedTransactionMetadata { err: InstructionError(2, InvalidAccountData), ... "Program failed: invalid account data for instruction" }. The wrapper's authenticated_slot_or_fallback resolves the spoofed slot to Clock.slot, and the engine's defense-in-depth upper-bound rejects any residual future-slot attempt.

Patches reverted post-verification; baseline restored; baseline tests re-PASS (bug reproduces on baseline). The disclosure ships engine + wrapper patches; the team chooses whether to land one, the other, or both — both are recommended for defense-in-depth.