From 21a149ff43d7be3f6d933816102ac056c09de589 Mon Sep 17 00:00:00 2001 From: rushikeshgarad2024-dev Date: Fri, 2 Oct 2026 19:55:22 +0530 Subject: [PATCH] fix(maintenance-pool): reject contract's own address as sweep recipient (closes #329) Signed-off-by: rushikeshgarad2024-dev --- contracts/maintenance-pool/src/lib.rs | 4 ++++ contracts/maintenance-pool/src/test.rs | 19 +++++++++++++++++++ 2 files changed, 23 insertions(+) diff --git a/contracts/maintenance-pool/src/lib.rs b/contracts/maintenance-pool/src/lib.rs index e51a66b..9236829 100644 --- a/contracts/maintenance-pool/src/lib.rs +++ b/contracts/maintenance-pool/src/lib.rs @@ -381,6 +381,10 @@ mod contract { ) -> Result { require_admin(&env)?.require_auth(); + if recipient == env.current_contract_address() { + return Err(Error::InvalidTreasury); + } + let pkey = DataKey::Pool(pool_id); let pool: MaintenancePool = env .storage() diff --git a/contracts/maintenance-pool/src/test.rs b/contracts/maintenance-pool/src/test.rs index 1b0c34c..cece97d 100644 --- a/contracts/maintenance-pool/src/test.rs +++ b/contracts/maintenance-pool/src/test.rs @@ -1060,3 +1060,22 @@ fn test_reclaim_deposit_requires_sponsor_auth() { let err = client.try_reclaim_deposit(&303u64, &0u32, &sponsor); assert!(err.is_err(), "reclaim_deposit must require the sponsor's own authorization"); } + +#[test] +fn test_sweep_rejects_self_referential_recipient() { + let env = Env::default(); + env.mock_all_auths(); + let (_admin, _treasury, client) = setup(&env); + + let token_admin = Address::generate(&env); + let (token_addr, asset_client, _token_client) = create_token(&env, &token_admin); + let sponsor = Address::generate(&env); + asset_client.mint(&sponsor, &1_000_0000000i128); + + client.deposit(&304u64, &sponsor, &token_addr, &100_0000000i128); + + let self_addr = client.address.clone(); + let err = client.try_sweep(&304u64, &token_addr, &self_addr); + assert_eq!(err, Err(Ok(Error::InvalidTreasury))); +} +