mock-amm.initialize doesn't validate rate_bps bounds

Stellar-contracts-v1/mock-amm/src/lib.rs

@@ -16,6 +16,9 @@ const MAINNET_NETWORK_ID: [u8; 32] = [
     0xdb, 0x16, 0x50, 0x8c, 0x01, 0x16, 0x3f, 0x26, 0xe5, 0xcb, 0x2a, 0x3e, 0x10, 0x45, 0xa9, 0x79,
 ];
 
+const MIN_RATE_BPS: u32 = 1;
+const MAX_RATE_BPS: u32 = 1_000_000;
+
 #[contracttype]
 #[derive(Clone)]
 pub enum DataKey {
@@ -31,7 +34,8 @@ pub enum Error {
     NotAdmin = 1,
     InsufficientLiquidity = 2,
     SlippageExceeded = 3,
-    MainnetNotSupported = 4,
+    InvalidRate = 4,
+    MainnetNotSupported = 5,
 }
 
 #[contract]
@@ -49,14 +53,22 @@ impl MockAmm {
         if env.ledger().network_id() == BytesN::from_array(&env, &MAINNET_NETWORK_ID) {
             return Err(Error::MainnetNotSupported);
         }
+
         if env.storage().instance().has(&DataKey::Admin) {
             panic!("already initialized");
         }
+
         admin.require_auth();
+
+        if !(MIN_RATE_BPS..=MAX_RATE_BPS).contains(&rate_bps) {
+            return Err(Error::InvalidRate);
+        }
+
         env.storage().instance().set(&DataKey::Admin, &admin);
         env.storage().instance().set(&DataKey::TokenIn, &token_in);
         env.storage().instance().set(&DataKey::TokenOut, &token_out);
         env.storage().instance().set(&DataKey::Rate, &rate_bps);
+
         Ok(())
     }
 
@@ -69,8 +81,18 @@ impl MockAmm {
     ) -> Result<i128, Error> {
         to.require_auth();
 
-        let token_in_addr: Address = env.storage().instance().get(&DataKey::TokenIn).unwrap();
-        let token_out_addr: Address = env.storage().instance().get(&DataKey::TokenOut).unwrap();
+        let token_in_addr: Address = env
+            .storage()
+            .instance()
+            .get(&DataKey::TokenIn)
+            .unwrap();
+
+        let token_out_addr: Address = env
+            .storage()
+            .instance()
+            .get(&DataKey::TokenOut)
+            .unwrap();
+
         let rate: u32 = env.storage().instance().get(&DataKey::Rate).unwrap();
 
         let amount_out = (amount_in * rate as i128) / 1_000_000;
@@ -96,9 +118,64 @@ impl MockAmm {
 
     pub fn deposit_liquidity(env: Env, from: Address, amount_out: i128) {
         from.require_auth();
-        let token_out_addr: Address = env.storage().instance().get(&DataKey::TokenOut).unwrap();
+
+        let token_out_addr: Address = env
+            .storage()
+            .instance()
+            .get(&DataKey::TokenOut)
+            .unwrap();
+
         let token_out = token::Client::new(&env, &token_out_addr);
         let pool_address = env.current_contract_address();
+
         token_out.transfer(&from, &pool_address, &amount_out);
     }
 }
+
+#[cfg(test)]
+mod test {
+    use super::*;
+    use soroban_sdk::testutils::Address as _;
+
+    fn setup_client(env: &Env) -> MockAmmClient<'_> {
+        env.mock_all_auths();
+
+        let contract_id = env.register(MockAmm, ());
+        MockAmmClient::new(env, &contract_id)
+    }
+
+    #[test]
+    fn initialize_rejects_zero_rate() {
+        let env = Env::default();
+        let client = setup_client(&env);
+
+        let admin = Address::generate(&env);
+        let token_in = Address::generate(&env);
+        let token_out = Address::generate(&env);
+
+        assert_eq!(
+            client.try_initialize(&admin, &token_in, &token_out, &0),
+            Err(Ok(Error::InvalidRate))
+        );
+    }
+
+    #[test]
+    fn initialize_rejects_excessive_rate() {
+        let env = Env::default();
+        let client = setup_client(&env);
+
+        let admin = Address::generate(&env);
+        let token_in = Address::generate(&env);
+        let token_out = Address::generate(&env);
+
+        assert_eq!(
+            client.try_initialize(
+                &admin,
+                &token_in,
+                &token_out,
+                &(MAX_RATE_BPS + 1)
+            ),
+            Err(Ok(Error::InvalidRate))
+        );
+    }
+}

Stellar-contracts-v1/mock-amm/test_snapshots/test/initialize_rejects_excessive_rate.1.json

@@ -0,0 +1,77 @@
+{
+  "generators": {
+    "address": 4,
+    "nonce": 0,
+    "mux_id": 0
+  },
+  "auth": [
+    [],
+    []
+  ],
+  "ledger": {
+    "protocol_version": 23,
+    "sequence_number": 0,
+    "timestamp": 0,
+    "network_id": "0000000000000000000000000000000000000000000000000000000000000000",
+    "base_reserve": 0,
+    "min_persistent_entry_ttl": 4096,
+    "min_temp_entry_ttl": 16,
+    "max_entry_ttl": 6312000,
+    "ledger_entries": [
+      [
+        {
+          "contract_data": {
+            "contract": "CAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD2KM",
+            "key": "ledger_key_contract_instance",
+            "durability": "persistent"
+          }
+        },
+        [
+          {
+            "last_modified_ledger_seq": 0,
+            "data": {
+              "contract_data": {
+                "ext": "v0",
+                "contract": "CAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD2KM",
+                "key": "ledger_key_contract_instance",
+                "durability": "persistent",
+                "val": {
+                  "contract_instance": {
+                    "executable": {
+                      "wasm": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+                    },
+                    "storage": null
+                  }
+                }
+              }
+            },
+            "ext": "v0"
+          },
+          4095
+        ]
+      ],
+      [
+        {
+          "contract_code": {
+            "hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+          }
+        },
+        [
+          {
+            "last_modified_ledger_seq": 0,
+            "data": {
+              "contract_code": {
+                "ext": "v0",
+                "hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+                "code": ""
+              }
+            },
+            "ext": "v0"
+          },
+          4095
+        ]
+      ]
+    ]
+  },
+  "events": []
+}

Stellar-contracts-v1/mock-amm/test_snapshots/test/initialize_rejects_zero_rate.1.json

@@ -0,0 +1,77 @@
+{
+  "generators": {
+    "address": 4,
+    "nonce": 0,
+    "mux_id": 0
+  },
+  "auth": [
+    [],
+    []
+  ],
+  "ledger": {
+    "protocol_version": 23,
+    "sequence_number": 0,
+    "timestamp": 0,
+    "network_id": "0000000000000000000000000000000000000000000000000000000000000000",
+    "base_reserve": 0,
+    "min_persistent_entry_ttl": 4096,
+    "min_temp_entry_ttl": 16,
+    "max_entry_ttl": 6312000,
+    "ledger_entries": [
+      [
+        {
+          "contract_data": {
+            "contract": "CAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD2KM",
+            "key": "ledger_key_contract_instance",
+            "durability": "persistent"
+          }
+        },
+        [
+          {
+            "last_modified_ledger_seq": 0,
+            "data": {
+              "contract_data": {
+                "ext": "v0",
+                "contract": "CAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD2KM",
+                "key": "ledger_key_contract_instance",
+                "durability": "persistent",
+                "val": {
+                  "contract_instance": {
+                    "executable": {
+                      "wasm": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+                    },
+                    "storage": null
+                  }
+                }
+              }
+            },
+            "ext": "v0"
+          },
+          4095
+        ]
+      ],
+      [
+        {
+          "contract_code": {
+            "hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+          }
+        },
+        [
+          {
+            "last_modified_ledger_seq": 0,
+            "data": {
+              "contract_code": {
+                "ext": "v0",
+                "hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+                "code": ""
+              }
+            },
+            "ext": "v0"
+          },
+          4095
+        ]
+      ]
+    ]
+  },
+  "events": []
+}