[timiturn3r]

#closes #16
Description
Fixes an input validation vulnerability in the risk-pool contract where negative integer inputs were accepted by the withdraw, lock_for_policy, and release_for_claim functions.

Allowing negative amounts (i128) into automated automated-market-maker/share calculation algorithms can allow callers to bypass authorization guards. For instance, passing negative shares into the fractional withdrawal calculation (shares * total_deposited) / total_shares could cause arithmetic underflows, unintended state adjustments, or unauthorized pool mints.

This PR introduces strict lower-bound entry validations directly into the execution methods within the risk-pool workspace.

Fix Details
risk-pool/src/lib.rs:

Injected explicit checks against zero or negative values (<= 0) using panic_with_error!(&env, Error::ZeroAmount) into withdraw.

Added corresponding entry checks to lock_for_policy to block under-collateralization vector manipulation.

Added explicit validation to release_for_claim to ensure historical lock states cannot resolve negative numbers during aggregate subtraction.

risk-pool/src/test.rs:

Added test_withdraw_negative_shares_panics to ensure arbitrary negative share removals fail predictably.

Added test_lock_negative_coverage_panics to prove malicious negative risk allocations trigger contract aborts.

Related Issues
Closes #16

Testing Checklist
[x] Verified via local isolated unit and integration test runners.

[x] Clean workspace compilation with 0 warnings or code style issues.

Bash

Output from localized verification run:

running 29 tests
test test::initialize_sets_state ... ok
test test::cannot_initialize_twice - should panic ... ok
test test::get_position_none_for_non_participant ... ok
test test::first_deposit_mints_one_to_one_shares ... ok
test test::get_position_returns_correct_state ... ok
test test::double_release_fails - should panic ... ok
test test::double_lock_fails - should panic ... ok
test test::claim_yield_proportional_to_shares ... ok
test test::pool_deposit_while_paused_fails - should panic ... ok
test test::lock_and_release_round_trip ... ok
test test::resume_allows_deposit ... ok
test test::test_lock_negative_coverage_panics - should panic ... ok
test test::test_withdraw_negative_shares_panics - should panic ... ok
test test::second_deposit_proportional_shares ... ok
test test::receive_premium_adds_lp_share ... ok
test test::test_deposit_precision_loss_prevented ... ok
test test::utilization_zero_before_locks ... ok
test test::withdraw_without_position_fails - should panic ... ok
test test::withdraw_partial_position_decrements_shares ... ok
test test::withdraw_full_position ... ok
test test::withdraw_locked_capital_fails - should panic ... ok
test test_advanced::available_liquidity_decreases_with_locks ... ok
test test_advanced::get_stats_reflects_all_operations ... ok
test test_edge::full_deposit_withdraw_round_trip_no_premium ... ok
test test_advanced::lp_count_tracks_unique_depositors ... ok
test test_edge::utilization_100_pct_after_locking_all ... ok
test test_edge::zero_accumulated_premium_yields_zero_claim ... ok
test test_advanced::two_lps_receive_proportional_yield ... ok
test test_edge::multiple_locks_and_releases_track_correctly ... ok

test result: ok. 29 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.54s
Security Impact
Enforcing strict lower boundaries on value fields blocks reverse-accounting attacks and ensures the integrity of precision multipliers (1_000_000_000) across all user tracking states.
#closes

[drips-wave]

@Oluwasuyi-Timilehin Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits