Repository navigation
fix(M1/M2/L4): revert-resilience for emergency & redemption paths - #17
Merged
Merged
Conversation
Groups the audit's revert-resilience mediums/lows so no PT or swap leg can brick the paths the spec calls never-blocked: - M1: SafeLegManager.provide wraps pt.withdraw in try/catch (PT that can't meet its bound reduces delivered assets, never reverts) and takes an oracle-free fast path when the request fits the buffer (a Pendle-oracle outage no longer blocks a buffer-only payout). provide is now best-effort: it delivers what's available instead of reverting. - M2: onInflow/rebalanceBuffer buy PT best-effort; a dislocated Pendle market leaves the assets in the buffer (reclaimed from the adapter) instead of reverting the caller, so a PT-buy revert can't unwind the permissionless emergency rebalance. PT-buy search window is now configurable (setApproxWindowBps) so spot-vs-TWAP divergence is tolerable without a redeploy. Adds IPTAdapter.reclaim. - L4: freeAssets self-calls the risky shortfall sale under try/catch so the safe-leg portion always delivers even when the risky sale can't clear its bound. L6's large-delta chunking is deferred (a distinct mechanism; its acute parts were handled in H6). 6 regression tests; 123 -> 127, 9 fork green.
This was referenced Jul 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Category PR grouping the audit's revert-resilience findings (M1, M2, L4) so no PT or swap leg can brick the paths the spec calls never-blocked. Branched off main, targets main.
M1 — SafeLegManager.provide
pt.withdrawwrapped in try/catch: a PT sale that can't meet its slippage bound reduces delivered assets instead of reverting the emergency de-risk / redemption funding.pt.value(), so a Pendle-oracle outage can't block a buffer-only payout.provideis now best-effort (delivers what's available) rather than revertingInsufficientValue.M2 — onInflow / rebalanceBuffer
IPTAdapter.reclaim) instead of reverting the caller.onInflowruns inside the permissionless emergency rebalance, so a PT-buy revert must not unwind the de-risk.setApproxWindowBps, default 10%) so spot-vs-TWAP divergence is tolerable without a redeploy.L4 — freeAssets
try/catchself-call, so the safe-leg portion always delivers even when the risky sale can't clear its bound.Deferred
L6's large-delta chunking is a distinct mechanism and is deferred; its acute parts (degraded bound, corrected invariant comment) were already handled in H6.
Tests
6 regressions: PT-withdraw revert delivers buffer best-effort; buffer-only path is oracle-free; over-ask is best-effort not revert; onInflow PT-buy revert leaves assets in the buffer; freeAssets delivers the safe portion when the risky sale reverts. Suite 123 -> 127; 9/9 fork tests green (adapter changes validated against live Pendle).