Skip to content

feat(contract): flash-loan prevention via sequence ID and price snapshot checks#294

Merged
Solomonsolomonsolomon merged 2 commits intogear5labs:masterfrom
success-OG:feat/flash-loan-prevention
Mar 30, 2026
Merged

feat(contract): flash-loan prevention via sequence ID and price snapshot checks#294
Solomonsolomonsolomon merged 2 commits intogear5labs:masterfrom
success-OG:feat/flash-loan-prevention

Conversation

@success-OG
Copy link
Copy Markdown
Contributor

closes #267

[Contract] Flash-Loan Prevention via Sequence ID Checks

Summary

Implements an on-chain price snapshot guard that detects and blocks flash-loan-driven
price manipulation within the same ledger close, protecting the Chen Pilot vault.

What's included

  • New flash_loan_guard contract added to the workspace
  • initialize / update_config — configures oracle, guarded asset, deviation
    threshold (bps), and minimum ledger gap between snapshots
  • record_snapshot — pulls the current oracle price and stores it with the current
    ledger sequence number. Enforces min_ledger_gap so an attacker cannot reset the
    baseline and exploit in the same ledger.
  • assert_price_safe — the guard gate called before any price-sensitive vault op:
    1. Panics if no snapshot exists (cold-start protection)
    2. Panics if the snapshot was taken in the same ledger as the current call
      (same-block manipulation detection — the core flash-loan defense)
    3. Fetches the live oracle price and computes deviation from the snapshot
    4. Panics if deviation_bps > max_intra_ledger_deviation_bps
    5. Emits FlashBlk event on block, PriceSafe event on pass
  • get_snapshot / get_config — read-only views
  • 9 unit tests: happy path, no snapshot blocks op, same-ledger snapshot blocked,
    price spike blocked, small move allowed, min ledger gap enforced, snapshot update
    after gap, price drop blocked, double-init blocked

@drips-wave
Copy link
Copy Markdown

drips-wave bot commented Mar 29, 2026

@success-OG Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

@Solomonsolomonsolomon Solomonsolomonsolomon merged commit 2b681aa into gear5labs:master Mar 30, 2026
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Contract] Flash-Loan Prevention via Sequence ID Checks

2 participants