PotlockPortal for Public Goods and Funding Security Review

for (project_id, v_app) in self.applications_by_id.iter() {            // TODO: update this to only go through approved applications            // mapping            self.assert_approved_application(&project_id); // TODO: check that the project is not owner, admin or chef            let application = Application::from(v_app);            // ...if there are payouts for the project...            if let Some(payout_ids_for_project) =                self.payout_ids_by_project_id.get(&project_id)            {                // TODO: handle milestones (for now just paying out all payouts)                for payout_id in payout_ids_for_project.iter() {                    let payout = Payout::from(                        self.payouts_by_id.get(&payout_id).expect("no payout"),                    );                     if payout.paid_at.is_none() {                        // ...transfer funds...                        Promise::new(application.project_id.clone())                            .transfer(payout.amount.0)                            .then(                                Self::ext(env::current_account_id())                                    .with_static_gas(XCC_GAS)                                    .transfer_payout_callback(payout),                            );                    }                }            }        }        self.all_paid_out = true;    }

#[tokio::test]async fn dos_on_admin_process_payments() -> color_eyre::Result<()> {    // disabled self.assert_cooldown_period_complete(); &    // self.assert_round_closed(); To make it easier to test     let EnvData {        pot_contract,        admin,        malicious_actor,        malicious_actor2,        chef,        ..    } = prepare().await?;     malicious_actor        .call(pot_contract.id(), "apply")        .args_json(json!({}))        .max_gas()        .deposit(NearToken::from_near(1))        .transact()        .await?        .into_result()?;     malicious_actor2        .call(pot_contract.id(), "apply")        .args_json(json!({}))        .max_gas()        .deposit(NearToken::from_near(1))        .transact()        .await?        .into_result()?;

        // Only approve one                        chef.call(pot_contract.id(), "chef_mark_application_approved")                            .args_json(                                json!({"project_id": malicious_actor.id(), "notes": String::new()}),                            )                            .max_gas()                            .transact()                            .await?                            .into_result()?;                         // process payouts                        let outcome = admin                            .call(pot_contract.id(), "admin_process_payouts")                            .args_json(json!({}))                            .max_gas()                            .transact()                            .await?                            .into_result();                         assert!(outcome.is_err());                        assert!(outcome                            .err()                            .unwrap()                            .to_string()                            .contains("Approved application does not exist"));                         Ok(())                    }

for application_id in self.approved_application_ids.iter() {            if let Some(payout_ids_for_application) =                self.payout_ids_by_project_id.get(&application_id)            {                for payout_id in payout_ids_for_application.iter() {                    self.payouts_by_id.remove(&payout_id);                    test_payout_id = payout_id;                }                self.payout_ids_by_project_id.remove(&application_id);            }        }

#[tokio::test]async fn chef_set_payout_corrupted_state() -> color_eyre::Result<()> {    let EnvData {        pot_contract,        malicious_actor,        chef,        ..    } = prepare().await?;     malicious_actor        .call(pot_contract.id(), "apply")        .args_json(json!({}))        .max_gas()        .deposit(NearToken::from_near(1))        .transact()        .await?        .into_result()?;     chef.call(pot_contract.id(), "chef_mark_application_approved")        .args_json(            json!({"project_id": malicious_actor.id(), "notes": String::new()}),        )        .max_gas()        .transact()        .await?        .into_result()?;         let outcome = chef            .call(pot_contract.id(), "chef_set_payouts")            .args_json(json!({"payouts": vec![PayoutInput{                project_id: malicious_actor.id().as_str().parse()?,                amount: NearToken::from_near(1).as_yoctonear().into(),            }]}))            .max_gas()            .transact()            .await?            .into_result()?;         println!("OUTCOME LOGS: {:#?}", outcome.logs());

          let outcome = chef              .call(pot_contract.id(), "chef_set_payouts")              .args_json(json!({"payouts": vec![PayoutInput{                  project_id: malicious_actor.id().as_str().parse()?,                  amount: NearToken::from_near(1).as_yoctonear().into(),              }]}))              .max_gas()              .transact()              .await?              .into_result()?;           println!("OUTCOME LOGS: {:#?}", outcome.logs());           Ok(())      }

pub fn chef_set_payouts(&mut self, payouts: Vec<PayoutInput>) {    self.assert_chef_or_greater();    // verify that the round has closed    // self.assert_round_closed();    // verify that payouts have not already been processed    assert!(        self.all_paid_out == false,        "Payouts have already been processed"    );    // clear any existing payouts (in case this is a reset, e.g. fixing an    // error)    //    let mut test_payout_id = String::new();    for application_id in self.approved_application_ids.iter() {        if let Some(payout_ids_for_application) =            self.payout_ids_by_project_id.get(&application_id)        {            for payout_id in payout_ids_for_application.iter() {                self.payouts_by_id.remove(&payout_id);                test_payout_id = payout_id;            }            self.payout_ids_by_project_id.remove(&application_id);  }    }    // get down to business    let mut running_total: u128 = 0;    // for each payout:    for payout in payouts.iter() {        // verify that the project exists and is approved        self.assert_approved_application(&payout.project_id);         // TODO: check that the project is not owner, admin or chef        // add amount to running total        running_total += payout.amount.0;                // set cooldown_end to now + 1 week (?)                self.cooldown_end_ms                    .set(&(env::block_timestamp_ms() + ONE_WEEK_MS)); // TODO: remove

        //hardcoding to one week, allow owner/admin to        //configure add payout to payouts        let mut payout_ids_for_application = self                    .payout_ids_by_project_id                    .get(&payout.project_id)                    .unwrap_or(UnorderedSet::new(                        StorageKey::PayoutIdsByProjectIdInner {                            project_id: payout.project_id.clone(),                        },                    ));                 let test_payout = payout_ids_for_application.is_empty();                 log!("TEST PAYOUT IS_EMPTY: {}", test_payout);                 let test_payout =                    payout_ids_for_application.contains(&test_payout_id);                 log!("TEST PAYOUT CONTAINS: {}", test_payout);                 let payout_id = format!(                                        "{}{}{}",                                        payout.project_id,                                        PAYOUT_ID_DELIMITER,                                        payout_ids_for_application.len() + 1                                    );                                    let payout = Payout {                                        id: payout_id.clone(),                                        amount: U128::from(payout.amount.0),                                        project_id: payout.project_id.clone(),                                        paid_at: None,                                    };                                    payout_ids_for_application.insert(&payout_id);                                    self.payout_ids_by_project_id                                        .insert(&payout.project_id, &payout_ids_for_application);                                    self.payouts_by_id                                        .insert(&payout_id, &VersionedPayout::Current(payout));                                }

#[private] // Public - but only callable by env::current_account_id()    pub fn sybil_callback(        &mut self,        deposit: Balance,        project_id: Option<ProjectId>,        message: Option<String>,        referrer_id: Option<AccountId>,        matching_pool: bool,        #[callback_result] call_result: Result<bool, PromiseError>,    ) -> Promise {        let caller_id = env::predecessor_account_id();         if call_result.is_err() {            log!(format!(                "Error verifying sybil check; returning donation {} to donor                              {}",                deposit, caller_id            ));            Promise::new(caller_id).transfer(deposit);            env::panic_str(                "There was an error querying sybil check. Donation has been returned to donor.",            );        }        ...

pub(crate) fn calculate_fee(        &self,        amount: u128,        basis_points: u32,    ) -> u128 {        let total_basis_points = 10_000u128;        let amount_per_basis_point = amount / total_basis_points;         basis_points as u128 * amount_per_basis_point    }}

pub(crate) fn calculate_protocol_fee(&self, amount: u128) -> u128 {        let total_basis_points = 10_000u128;        let amount_per_basis_point = amount / total_basis_points;        self.protocol_fee_basis_points as u128 * amount_per_basis_point    }

pub(crate) fn calculate_referrer_fee(&self, amount: u128) -> u128 {        let total_basis_points = 10_000u128;        let amount_per_basis_point = amount / total_basis_points;        self.referral_fee_basis_points as u128 * amount_per_basis_point    }

fn calculate_fee(        amount: u128,        basis_points: u32,    ) -> u128 {        let total_basis_points = 10_000u128;        let amount_per_basis_point = amount / total_basis_points;        basis_points as u128 * amount_per_basis_point    }         fn calculate_fee_better(        amount: u128,        basis_points: u32,    ) -> u128 {        let total_basis_points = 10_000u128;        basis_points as u128 * amount / total_basis_points    }    fn calculate_fee_best(    amount: u128,    basis_points: u32,    is_protocol: bool    ) -> u128 {                let total_basis_points = 10_000u128;                let amount = basis_points as u128 * amount;                 if !is_protocol {                        return amount / total_basis_points                         }                amount.div_ceil(total_basis_points)                }            }             fn main () {             let incorrect = calculate_fee(13133313113777313, 135);            let better = calculate_fee_better(13133313113777313, 135);            let best_referral = calculate_fee_best(13133313113777313, 135, false);            let best_chef = calculate_fee_best(13133313113777313, 135, false);            let best_protocol = calculate_fee_best(13133313113777313, 135, true);

            println!("{incorrect}");            println!("{better}");            println!("{best_referral}");            println!("{best_chef}");            println!("{best_protocol}");             }

[workspace]members = [    "donation",    "pot",    "pot_factory",    "registry",    "sybil",    "sybil_provider_simulator"]

let initial_storage_usage = env::storage_usage();            self.insert_stamp_record(                stamp_id.clone(),                stamp.clone(),                provider_id.clone(),                user_id.clone(),            );             provider.stamp_count += 1;            self.providers_by_id.insert(                &provider_id,                &VersionedProvider::Current(provider.clone()),            )

#[tokio::test]async fn overflow_checks_not_applied() -> color_eyre::Result<()> {    let EnvData {        pot_contract,        malicious_actor,        ..    } = prepare().await?;     // pub fn test_underflow(num: u8) -> u8 {    //     num - 1    // }     let val = malicious_actor        .call(pot_contract.id(), "test_underflow")        .args_json(json!({"num": 0}))        .max_gas()        .transact()        .await?        .into_result()?        .json::<u8>()?;     assert_eq!(val, 255);     Ok(())}

for payout_id in payout_ids_for_project.iter() {                  let payout = Payout::from(                      self.payouts_by_id.get(&payout_id).expect("no payout"),                  );                  if payout.paid_at.is_none() {                      let payout_amount = payout.amount.0;                       // ...transfer funds...                      Promise::new(application.project_id.clone())                          .transfer(payout_amount)                          .then(                              Self::ext(env::current_account_id())                                  .with_static_gas(XCC_GAS)                                  .transfer_payout_callback(payout),                          );                  }              }          }      }      self.all_paid_out = true;

#[private] // Public - but only callable by env::current_account_id()pub fn transfer_payout_callback(    &mut self,    mut payout: Payout,    #[callback_result] call_result: Result<(), PromiseError>,) {    if call_result.is_err() {        log!(format!(            "Error paying out amount {:#?} to project {}",            payout.amount, payout.project_id        ));         payout.paid_at = None;        self.payouts_by_id            .insert(&payout.id.clone(), &VersionedPayout::Current(payout));    } else {        log!(format!(            "Successfully paid out amount {:#?} to project {}",            payout.amount, payout.project_id        ));        // update payout to indicate that funds have been transferred        payout.paid_at = Some(env::block_timestamp_ms());        let payout_id = payout.id.clone();        self.payouts_by_id            .insert(&payout_id, &VersionedPayout::Current(payout));    }}

// moved self.all_paid_out = true; inside of callback#[tokio::test]async fn admin_process_payouts_race_condition() -> color_eyre::Result<()> {    let EnvData {        pot_contract,        malicious_actor,        chef,        admin,        ..    } = prepare().await?;     malicious_actor        .call(pot_contract.id(), "apply")        .args_json(json!({}))        .max_gas()        .deposit(NearToken::from_near(1))        .transact()        .await?        .into_result()?;     chef.call(pot_contract.id(), "chef_mark_application_approved")        .args_json(            json!({"project_id": malicious_actor.id(), "notes": String::new()}),        )        .max_gas()        .transact()        .await?        .into_result()?;    let malicous_account_before = malicious_actor.view_account().await?.balance;     println!("BALANCE BEFORE: {}", malicous_account_before.as_near());

            let outcome = chef.call(pot_contract.id(), "chef_set_payouts").args_json(json!({"payouts": vec![PayoutInput{                    project_id: malicious_actor.id().as_str().parse()?,                    amount: NearToken::from_near(3).as_yoctonear().into(),                }, PayoutInput{                    project_id: malicious_actor.id().as_str().parse()?,                    amount: NearToken::from_near(2).as_yoctonear().into(),                }, PayoutInput{                    project_id: malicious_actor.id().as_str().parse()?,                    amount: NearToken::from_near(1).as_yoctonear().into(),                }]})).max_gas().transact().await?.into_result()?;            println!("OUTCOME LOGS: {:#?}", outcome.logs());             let outcome = admin                .batch(pot_contract.id())                .call(                    Function::new("admin_process_payouts").gas(NearGas::from_tgas(100)),                )                .call(                    Function::new("admin_process_payouts").gas(NearGas::from_tgas(100)),                )                .transact()                .await?;            println!("OUTCOME LOGS: {:#?}", outcome);             let malicous_account_after = malicious_actor.view_account().await?.balance;            println!("BALANCE AFTER: {}", malicous_account_after.as_near());             assert_eq!(                malicous_account_after.as_near(),                malicous_account_before.as_near() + NearToken::from_near(12).as_near()            );            Ok(())}

pub(crate) fn handle_apply(        &mut self,        project_id: ProjectId,        message: Option<String>,        deposit: Balance,    ) -> Application {        // check that application doesn't already exist for this project        if self.applications_by_id.get(&project_id).is_some() {            // application already exists            env::panic_str("Application already exists for this project");        }        // check that application period is open        self.assert_application_period_open();        // check that max_projects hasn't been reached        self.assert_max_projects_not_reached();        let application = Application {            project_id,            message,            status: ApplicationStatus::Pending,            submitted_at: env::block_timestamp_ms(),            updated_at: None,            review_notes: None,        };

pub(crate) fn assert_max_projects_not_reached(&self) {        assert!(            self.approved_application_ids.len() < self.max_projects.into(),            "Max projects reached"        );    }

#[tokio::test]async fn can_set_more_than_max_projects() -> color_eyre::Result<()> {    let EnvData {        pot_contract,        malicious_actor,        malicious_actor2,        ..    } = prepare().await?;     malicious_actor        .call(pot_contract.id(), "apply")        .args_json(json!({}))        .max_gas()        .deposit(NearToken::from_near(1))        .transact()        .await?        .into_result()?;

    malicious_actor2        .call(pot_contract.id(), "apply")        .args_json(json!({}))        .max_gas()        .deposit(NearToken::from_near(1))        .transact()        .await?        .into_result()?;     let applicaitons = pot_contract        .view("get_applications")        .args_json(json!({}))        .await?        .json::<Vec<Application>>()?;     println!("Applications: {:?}", applicaitons);     assert_eq!(applicaitons.len(), 2);     Ok(())}

#[payable]  pub fn admin_deactivate_provider(      &mut self,      provider_id: ProviderId,  ) -> Provider {      self.assert_owner_or_admin();      // check that provider exists      if let Some(versioned_provider) = self.providers_by_id.get(&provider_id)      {          // update provider          let mut provider = Provider::from(versioned_provider);          provider.is_active = false;          self.providers_by_id.insert(              &provider_id,              &VersionedProvider::Current(provider.clone()),          );          provider      } else {          env::panic_str("Provider does not exist");      }  }

#[payable]  pub fn admin_deactivate_provider(      &mut self,      provider_id: ProviderId,  ) -> Provider {      self.assert_owner_or_admin();      // check that provider exists      if let Some(versioned_provider) = self.providers_by_id.get(&provider_id)      {          // update provider          let mut provider = Provider::from(versioned_provider);          provider.is_active = false;          self.providers_by_id.insert(              &provider_id,              &VersionedProvider::Current(provider.clone()),          );          provider      } else {          env::panic_str("Provider does not exist");      }  }

pub fn owner_set_admins(&mut self, account_ids: Vec<AccountId>) {    self.assert_owner();    for account_id in account_ids {        self.admins.remove(&account_id);  implementation    }}

pub fn get_providers(&self) -> Vec<ProviderExternal> {        self.providers_by_id            .iter()            .map(|(provider_id, provider)| {                ProviderExternal::from_provider_id(                    &provider_id.0,                    Provider::from(provider),                )            })            .collect()    }

pub fn get_default_providers(&self) -> Vec<ProviderExternal> {        self.default_provider_ids            .iter()            .map(|provider_id| {                ProviderExternal::from_provider_id(                    &provider_id.0,                    Provider::from(                        self.providers_by_id.get(&provider_id).unwrap(),                    ),)}).collect()}

#[payable]    pub fn admin_flag_provider(&mut self, provider_id: ProviderId) -> Provider {        self.assert_owner_or_admin();        // check that provider exists        if let Some(versioned_provider) = self.providers_by_id.get(&provider_id)        {            // update provider            let mut provider = Provider::from(versioned_provider);            provider.is_flagged = true;            self.providers_by_id.insert(                &provider_id,                &VersionedProvider::Current(provider.clone()),            );            provider        } else {env::panic_str("Provider does not exist");}}

[lib]crate-type = ["cdylib", "rlib"]