🔴 Critical · contracts/token-factory/src/test.rs, contracts/token-factory/src/lib.rs:167-204
Description
The fee-split distribution logic performs per-recipient checked_mul/division/checked_add and an external transfer call per recipient inside a loop. Existing tests (inferred from test.rs naming conventions visible in test_snapshots/) appear to cover basic pause/burn/batch scenarios but there's no evidence of a test exercising set_fee_split + a subsequent fee-paying call (create_token/mint_tokens/set_metadata) with more than a trivial number of recipients, uneven basis-point distributions that produce rounding remainders, or a recipient with bps low enough that share floors to 0 (the if share > 0 skip at line 187). This is exactly the kind of arithmetic-heavy, loop-driven code most likely to hide an off-by-one, an unexpected zero-transfer skip that silently under-pays a recipient, or a remainder-accounting bug that leaks or double-counts fee-token units.
Tasks
Acceptance Criteria
🔴 Critical ·
contracts/token-factory/src/test.rs,contracts/token-factory/src/lib.rs:167-204Description
The fee-split distribution logic performs per-recipient
checked_mul/division/checked_addand an externaltransfercall per recipient inside a loop. Existing tests (inferred fromtest.rsnaming conventions visible intest_snapshots/) appear to cover basic pause/burn/batch scenarios but there's no evidence of a test exercisingset_fee_split+ a subsequent fee-paying call (create_token/mint_tokens/set_metadata) with more than a trivial number of recipients, uneven basis-point distributions that produce rounding remainders, or a recipient withbpslow enough thatsharefloors to0(theif share > 0skip at line 187). This is exactly the kind of arithmetic-heavy, loop-driven code most likely to hide an off-by-one, an unexpected zero-transfer skip that silently under-pays a recipient, or a remainder-accounting bug that leaks or double-counts fee-token units.Tasks
treasury.bpslow enough relative to a smallfee_paymentthat its computedshareis0, asserting the transfer is correctly skipped and the recipient's full notional share is folded into the remainder sent totreasury(verify this matches the intended product behavior — currently a "skipped" small-share recipient's funds silently go totreasuryrather than accumulating for them, which may itself be worth flagging as a product decision to confirm).MAX_FEE_SPLIT_RECIPIENTS(once issue Expand Contract Test Coverage #6 lands) verifying total distributed equalsfee_paymentexactly (no leaked or double-spent stroops), summed across all recipient balance deltas plus the remainder.fuzz_fee_arithmetic) that generates random(fee_payment, splits)pairs (with valid bps summing to 10,000) and asserts the invariantsum(all transfers) == fee_paymentalways holds.Acceptance Criteria
cargo tarpaulinor similar) showsdistribute_fee's split branch as covered by more than the "happy path, 1 recipient" case.