📌 Description
Each of execute_settlement, cancel_settlement, and cancel_expired_settlement independently checks settlement.status != SettlementStatus::Pending and returns Error::InvalidSettlementState, but there is no single regression test exercising all three against the same already-Executed settlement id to confirm none of them can be tricked into double-releasing or double-crediting liquidity for a settlement that has already been finalized.
🧩 Requirements and context
- Add a regression test that opens and executes a settlement, then calls
execute_settlement, cancel_settlement, and cancel_expired_settlement (with expiry configured and elapsed) against the same id in sequence.
- Assert all three calls fail with
Error::InvalidSettlementState and that neither Pool.total nor fees_accrued change as a result of any of the three failed calls.
- Repeat the same three-way check against an already-
Cancelled and an already-Expired settlement for full lifecycle coverage.
🛠️ Suggested execution
- Add the test to
src/test.rs, snapshotting pool/fees_accrued before the three post-finalization calls and reasserting after each.
- Reuse existing settlement-lifecycle test setup helpers.
- No production code changes expected given each function already independently guards on
status; this closes a cross-function, same-id regression gap.
✅ Acceptance criteria
🔒 Security notes
A double-release bug here (e.g. cancelling an already-executed settlement and crediting the pool a second time for liquidity that was already released to the anchor) would directly inflate a pool's reported liquidity beyond what was ever actually deposited — a serious fund-accounting integrity issue.
📋 Guidelines
- Minimum 95% test coverage
- Clear documentation
- Timeframe: 96 hours
📌 Description
Each of
execute_settlement,cancel_settlement, andcancel_expired_settlementindependently checkssettlement.status != SettlementStatus::Pendingand returnsError::InvalidSettlementState, but there is no single regression test exercising all three against the same already-Executedsettlement id to confirm none of them can be tricked into double-releasing or double-crediting liquidity for a settlement that has already been finalized.🧩 Requirements and context
execute_settlement,cancel_settlement, andcancel_expired_settlement(with expiry configured and elapsed) against the same id in sequence.Error::InvalidSettlementStateand that neitherPool.totalnorfees_accruedchange as a result of any of the three failed calls.Cancelledand an already-Expiredsettlement for full lifecycle coverage.🛠️ Suggested execution
src/test.rs, snapshottingpool/fees_accruedbefore the three post-finalization calls and reasserting after each.status; this closes a cross-function, same-id regression gap.✅ Acceptance criteria
Executedsettlement.Cancelledand already-Expiredsettlements.🔒 Security notes
A double-release bug here (e.g. cancelling an already-executed settlement and crediting the pool a second time for liquidity that was already released to the anchor) would directly inflate a pool's reported liquidity beyond what was ever actually deposited — a serious fund-accounting integrity issue.
📋 Guidelines