Skip to content

Validate LoanManager min score bounds#974

Open
Lucas-FManager wants to merge 1 commit into
LabsCrypt:mainfrom
Lucas-FManager:code/remitlend-min-score-bounds-941
Open

Validate LoanManager min score bounds#974
Lucas-FManager wants to merge 1 commit into
LabsCrypt:mainfrom
Lucas-FManager:code/remitlend-min-score-bounds-941

Conversation

@Lucas-FManager
Copy link
Copy Markdown

Summary

Refs #941.

This hardens LoanManager::set_min_score so the admin setter follows the same Result<(), LoanError> pattern as the other guarded configuration setters and rejects unsafe score bounds.

Approach

  • Added a local MAX_CREDIT_SCORE ceiling of 850, matching the RemittanceNFT score cap referenced by the issue.
  • Changed set_min_score to return Result<(), LoanError>.
  • Rejects 0 and values above 850 with LoanError::InvalidConfiguration before writing storage.
  • Keeps the existing successful update path, including min_score_updated, unchanged after validation succeeds.
  • Added focused tests for a normal update, boundary value 850, and rejected out-of-bounds values.

Security

  • Prevents a misconfigured or compromised admin flow from setting min_score > 850, which would make all borrowers fail the score gate.
  • Prevents min_score = 0, which would effectively disable the score gate.
  • Does not alter loan balances, repayments, pool transfers, collateral logic, or borrower state.
  • Failed updates do not write the new config value.

Verification

  • docker run --rm -v "C:\\Users\\ADMIN\\.openclaw\\github-jobs\\remitlend:/work" -w /work/contracts rust:1.95 bash -lc "/usr/local/cargo/bin/cargo test -p loan_manager set_min_score"
  • git diff --check

@Lucas-FManager
Copy link
Copy Markdown
Author

CI note after re-checking the failing workflow:

  • CodeQL and supply-chain checks are passing.
  • The contracts failure is from contracts/lending_pool/src/test.rs, which is outside this PR's loan_manager scope.
  • The backend and frontend failures are also full-repo lint/format issues outside this PR.
  • The targeted verification for this branch still holds: cargo test -p loan_manager set_min_score passed, and cargo fmt -p loan_manager -- --check passed in Docker.

I am leaving the branch scoped to the min-score validation fix unless you want a separate cleanup for the repository-wide formatting issues.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant