FLO-7: Minimum Position Balance Invariant Can Be Circumvented via Deposits and Are Ignored in View Functions #216

Severity: Medium

Files Affected

• cadence/contracts/FlowALPv1.cdc

Description

The protocol intends to prevent dust balances and state bloat by enforcing a minimumTokenBalancePerPosition limit. The positionSatisfiesMinimumBalance() helper is correctly validated during position creation and at the end of withdrawals. However, this invariant check is entirely omitted within the _depositEffectsOnly() execution path. This allows users to deposit funds into a debit position to partially repay debt, leaving a residual dust balance that violates the protocol's minimum limit. Furthermore, view functions like maxWithdraw() and computeAvailableWithdrawal() do not factor in this minimum threshold. This discrepancy causes frontends to suggest "maximum" withdrawal amounts that leave a dust balance, guaranteeing the transaction will revert when the withdrawal execution enforces the invariant. Exploit Scenario:

• Governance configures a minimumTokenBalancePerPosition of 10.0 tokens to prevent state bloat and inefficient dust tracking.
• A user holds a valid position and borrows 100.0 tokens, cleanly satisfying the minimum balance threshold.
• The user later submits a depositToPosition() transaction to partially repay exactly 99.9 tokens of their debt.
• The _depositEffectsOnly() function processes the repayment and updates the internal accounting without ever verifying the post- deposit balance against the minimum threshold.
• The user is left with a microscopic dust debit balance of 0.1 tokens, successfully circumventing the protocol's minimum balance invariant.

Recommendation

Enforce the minimum balance invariant at the end of the _depositEffectsOnly() function, mirroring the logic used in the withdrawal flow. Additionally, adjust the math in the view functions to restrict the maximum available withdrawal so it does not suggest amounts that would strand a dust balance and thus revert on execution.

Parent Issue: #209