Repository navigation
[security] Risk pool NFT minting does not prevent duplicate provider positions #468
Description
Summary
RiskPool mints LP NFTs for providers, but there is no check preventing a provider from having multiple NFTs. A provider could deposit multiple times, get multiple NFTs, and potentially bypass position limits or gain disproportionate governance weight.
Severity
Medium
Steps to Reproduce
- Provider deposits USDC and receives NFT feat: implement risk-pool and governance-dao contracts with full test suites (v2) #1
- Provider deposits again and receives NFT policy-engine.rs: buy_policy does not verify that payment (premium) was actually received from caller — free policies possible #2
- Provider now has 2 NFTs with full voting weight on each
Expected Behavior
Each provider should have at most one LP position/NFT, or the system should account for multiple positions correctly.
Actual Behavior
Multiple NFTs per provider are allowed without restriction.
Suggested Fix
Check ProviderNft storage before minting; if a provider already has an NFT, add to their existing position instead of minting a new one.
Activity
johnson7104 commentedon Sep 25, 2026
@johnson7104 has applied to work on this issue as part of the Stellar Wave Program's 9th wave.
ℹ️ Repo Maintainers: To accept this application, review their application or assign @johnson7104 to this issue.
Morenike20 commentedon Sep 25, 2026
@Morenike20 has applied to work on this issue as part of the Stellar Wave Program's 9th wave.
ℹ️ Repo Maintainers: To accept this application, review their application or assign @Morenike20 to this issue.
Sharon-dev-create commentedon Sep 25, 2026
@Sharon-dev-create has applied to work on this issue as part of the Stellar Wave Program's 9th wave.
ℹ️ Repo Maintainers: To accept this application, review their application or assign @Sharon-dev-create to this issue.
De-hunterJS commentedon Sep 25, 2026
@De-hunterJS has applied to work on this issue as part of the Stellar Wave Program's 9th wave.
ℹ️ Repo Maintainers: To accept this application, review their application or assign @De-hunterJS to this issue.
drips-wave commentedon Sep 25, 2026
Congratulations, @De-hunterJS! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on September 30, 2026.
🧑💻 @De-hunterJS: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.
Warning
When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.
🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.
🌊 Happy Wave 🌊
drips-wave commentedon Sep 26, 2026
This issue has been completed by @De-hunterJS as part of the Stellar Wave Program's 9th Wave 🥳
😎 @De-hunterJS: You earned 200 Points for completing this issue! After the current Wave ends, you'll be eligible for a percentage of the Wave's reward pool based on the percentage of total points you've earned. Learn more here. You can also Leave a review to share your experience working on this issue.
🧑💻 Repo maintainers: How'd the contributor do? Leave a review to share your experience working with them.