-
Notifications
You must be signed in to change notification settings - Fork 1.6k
Description
Issue Description
In AMMVote::applyVote (src/libxrpl/tx/transactors/dex/AMMVote.cpp, lines 181–203), the sfDiscountedFee field on the auction slot is unconditionally updated without checking whether the auction slot has expired:
if (ammSle->isFieldPresent(sfAuctionSlot))
{
auto& auctionSlot = ammSle->peekFieldObject(sfAuctionSlot);
if (auto const discountedFee = fee / AUCTION_SLOT_DISCOUNTED_FEE_FRACTION)
{
auctionSlot.setFieldU16(sfDiscountedFee, discountedFee);
}
// ...
}The read side (getTradingFee in AMMUtils.cpp) correctly checks the auction slot's sfExpiration before applying the discounted fee. So the stale write is never actually used during swaps. However, it is unnecessary state pollution — writing a field that will never be read until the slot is re-bid.
Steps to Reproduce
- Create an AMM with an auction slot.
- Let the auction slot expire.
- Submit an
AMMVotetransaction. - Observe that
sfDiscountedFeeis written to the expired auction slot.
Expected Result
applyVote should check the auction slot's sfExpiration before writing sfDiscountedFee. If the slot is expired, the discounted fee write should be skipped.
Actual Result
sfDiscountedFee is unconditionally written to the auction slot, even when expired.
Environment
All versions with AMM support (XLS-30).
Supporting Files
N/A