Skip to content

[contracts] batchExecute multiplies hot-wallet profit sweep across N flashloan callbacks #205

@obchain

Description

@obchain

PR: #45 (feat/20-multi-liq-batcher)
File: contracts/src/CharonLiquidator.sol, executeOperation

executeOperation contains:

if (profit > 0) {
    IERC20(p.debtToken).transfer(owner, profit);
}

This sweeps profit to owner — the bot hot wallet. Issue #120 tracks this as a pre-existing violation of the CLAUDE.md safety invariant: 'profit is swept to the cold wallet inside every flash-loan callback.'

This PR introduces batchExecute, which calls _initiateFlashLoan in a loop of up to 10 iterations. Each iteration triggers a synchronous flashLoanSimpleexecuteOperation cycle. Every callback sweeps its profit to the hot wallet. The bug from #120 is now multiplied by the batch count N.

Impact: Every batchExecute(N) call parks N separate profit amounts in the hot wallet instead of the cold wallet. CLAUDE.md safety invariant is violated N times per batch. If the hot wallet is compromised, all batched profits are at risk.

Fix: Resolve issue #120 first: add an immutable COLD_WALLET constructor arg and replace owner with COLD_WALLET in the profit transfer inside executeOperation. Do not merge this PR until #120 is resolved.

Refs #45

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't workinglayer:contractsSolidity / Foundrypr-reviewFindings from PR review processpriority:p0-blockerBlocks the critical pathstatus:readyScoped and ready to pick up

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions