-
Notifications
You must be signed in to change notification settings - Fork 1.6k
Description
Issue Description
In AMMVote::applyVote (src/libxrpl/tx/transactors/dex/AMMVote.cpp, line ~155), minTokens (a std::optional<STAmount>) is dereferenced without a guard:
else if (lpTokensNew > *minTokens || (lpTokensNew == *minTokens && feeNew > minFee))minTokens is only set inside the loop body for slots where lpTokens != beast::zero. Under careful analysis, the dereference is only reached when updatedVoteSlots.size() >= VOTE_MAX_SLOTS (8), which requires at least 8 non-skipped entries — meaning minTokens will have been set. The access is therefore not reachable in practice, but the parallel tracking of minTokens and updatedVoteSlots is fragile; a future refactor could introduce undefined behavior.
Steps to Reproduce
Not currently reproducible — the dereference path requires updatedVoteSlots.size() >= 8, which guarantees minTokens has been set.
Expected Result
A defensive XRPL_ASSERT(minTokens.has_value(), ...) should be added before line 155 to catch any future invariant violations early.
Actual Result
The std::optional is dereferenced without an assertion, relying on an implicit invariant that is not self-documenting.
Environment
All versions with AMM support (XLS-30).
Supporting Files
N/A