Feat/deepbook#1
Conversation
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 5 potential issues.
Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.
This PR is being reviewed by Cursor Bugbot
Details
You are on the Bugbot Free tier. On this plan, Bugbot will review limited PRs each billing cycle.
To receive Bugbot reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.
| │ │ loan_vault::liquidate(vault, loan_id, borrowed_sui) │ │ | ||
| │ │ → Returns: SupporterPass │ │ | ||
| │ └────────────────────────────┬────────────────────────────────────┘ │ | ||
| │ │ │ |
There was a problem hiding this comment.
Duplicate error code values make debugging ambiguous
Medium Severity
EInsufficientLiquidity and EInsufficientProceeds are both assigned the value 3. When an error occurs, it will be impossible to distinguish between these two different failure conditions, making debugging difficult and potentially causing incorrect error handling in callers.
| Advanced integration allowing SupporterPass collateral to enable margin trading on DeepBook. | ||
|
|
||
| **Warning:** This is high-complexity and should only be considered after Phases 1-4 are stable. | ||
|
|
There was a problem hiding this comment.
DEEP rewards can be claimed multiple times
High Severity
The claim_deep function lacks any mechanism to track whether a pass has already claimed for the current distribution round. A user could call this function repeatedly with the same SupporterPass to drain the entire DEEP pool. The DeepRewardsPool struct has no field tracking claims, and the function doesn't update any state to prevent re-claiming.
Additional Locations (1)
| let amount = coin.value(); | ||
| balance_manager::deposit(balance_manager, coin); | ||
| pool.outstanding = pool.outstanding - amount; | ||
| } |
There was a problem hiding this comment.
Repay function accounting mismatch causes underflow
Medium Severity
The repay function subtracts the full repayment amount from pool.outstanding, but outstanding only tracks principal (incremented by borrowed amount in borrow). Since loans accrue interest via get_rate(), repayments include principal plus interest. This asymmetry causes pool.outstanding to underflow when total repayments exceed total principal borrowed.
Additional Locations (1)
| assert!( | ||
| vault.deepbook_exposure() + amount <= vault.bridge_config.max_deepbook_exposure, | ||
| EExceedsMaxExposure, | ||
| ); |
There was a problem hiding this comment.
No validation that balance_manager matches the pool
High Severity
The TideLendingPool stores balance_manager_id to track its associated BalanceManager, but deposit_liquidity, withdraw_liquidity, borrow, and repay all accept balance_manager as a separate parameter without validating that object::id(balance_manager) == pool.balance_manager_id. A caller could pass a mismatched balance manager, causing funds to flow to/from the wrong account while the pool's accounting is updated incorrectly.
Additional Locations (2)
| coin::from_balance(deep, ctx) | ||
| pool.distribution_amount = amount; | ||
| pool.snapshot_epoch = ctx.epoch(); | ||
| pool.snapshot_total_shares = capital_vault.total_shares(); |
There was a problem hiding this comment.
Division by zero when total shares is zero
Medium Severity
The start_distribution function sets snapshot_total_shares from capital_vault.total_shares() without checking if it's zero. If called when there are no backers, claim_deep will crash with a division by zero when computing share_bps = (pass.shares * 10000) / pool.snapshot_total_shares.
Additional Locations (1)
1 participant
Note
Deferred future work
DeepBookintegration andMarketplace v2 (Bid System)as ⏸️ deferred acrossREADME.md,LOANS.md,MARKETPLACE.md,PLAN.md, andspec/tide-core-v1.mdspec/deepbook-integration-v1.mdwith a simplified 3-phase roadmap (rates + liquidity via BalanceManager, flash liquidations (keep only), DEEP rewards) and removal/deferment of complex featuresspec/marketplace-v2.mdas deferred reference; updates links/status labels in related docsCurrent v1 stance
Scope
Written by Cursor Bugbot for commit 82f65f9. This will update automatically on new commits. Configure here.