fee processor distribute hdx above ed

Author: enthusiastmartin

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "runtime-integration-tests"
-version = "1.99.0"
+version = "1.100.0"
 description = "Integration tests"
 authors = ["GalacticCouncil"]
 edition = "2021"

integration-tests/Cargo.toml

@@ -2404,6 +2404,62 @@ fn crash_st_hdx_price(oracle: EvmAddress, st_hdx_evm: EvmAddress) {
 	set_oracle_price_source(oracle, st_hdx_evm, mock);
 }
 
+/// Attempt `Pool.borrow(asset, amount)` as `user` without asserting success,
+/// returning the raw EVM exit reason so the caller can assert on a revert.
+fn try_aave_borrow(pool: EvmAddress, user: EvmAddress, asset: EvmAddress, amount: Balance) -> fp_evm::ExitReason {
+	let data = EvmDataWriter::new_with_selector(liquidation_worker_support::Function::Borrow)
+		.write(asset)
+		.write(amount)
+		.write(2u32) // variable interest rate mode
+		.write(0u32) // referral code
+		.write(user) // onBehalfOf
+		.build();
+	Executor::<Runtime>::call(CallContext::new_call(pool, user), data, U256::zero(), 50_000_000).exit_reason
+}
+
+#[test]
+fn aave_borrow_should_revert_when_asset_is_sthdx() {
+	// stHDX must be non-borrowable on the GIGAHDX AAVE pool (zero borrow cap /
+	// IRM returning 0). If it ever became borrowable, a drifting liquidityIndex
+	// would break the `aToken : stHDX = 1 : 1` invariant and leak unlocked
+	// aTokens past the lock-manager (see the stHDX invariants in `assets.rs`).
+	// Enforcement lives in the AAVE reserve config, not in runtime code, so this
+	// pins the deploy/snapshot setup against silent regression.
+	TestNet::reset();
+	hydra_live_ext(PATH_TO_SNAPSHOT).execute_with(|| {
+		use crate::liquidation::get_user_account_data;
+
+		let (alice, _bob, alice_evm, pool, _oracle, _hollar) = liquidation_test_setup();
+		let st_hdx_evm = HydraErc20Mapping::asset_address(ST_HDX);
+
+		// Large stake → ample GIGAHDX collateral, so a stHDX borrow would clear
+		// the collateral check if the asset were borrowable. This makes the
+		// revert attributable to the disabled reserve, not thin collateral.
+		assert_ok!(GigaHdx::giga_stake(
+			RuntimeOrigin::signed(alice.clone()),
+			10_000 * UNITS
+		));
+
+		let data = get_user_account_data(pool, alice_evm).unwrap();
+		assert!(
+			data.available_borrows_base > U256::zero(),
+			"precondition: Alice must have borrowing power so the revert is attributable to stHDX being non-borrowable",
+		);
+
+		let st_hdx_before = Currencies::free_balance(ST_HDX, &alice);
+
+		let exit = try_aave_borrow(pool, alice_evm, st_hdx_evm, UNITS);
+		assert!(
+			matches!(exit, fp_evm::ExitReason::Revert(_)),
+			"borrowing stHDX must revert (reserve must be non-borrowable); got {:?}",
+			exit,
+		);
+
+		// No stHDX may reach the user.
+		assert_eq!(Currencies::free_balance(ST_HDX, &alice), st_hdx_before);
+	});
+}
+
 /// Executes the same flow as `pallet_liquidation::liquidate_gigahdx` step by
 /// step from the test, so we exercise the real building blocks (AAVE pool,
 /// LockableAToken precompile, Seize trait, lock refresh) end-to-end against

integration-tests/src/gigahdx.rs

@@ -1,6 +1,6 @@
 [package]
 name = "pallet-fee-processor"
-version = "1.0.0"
+version = "1.1.0"
 authors = ["GalacticCouncil"]
 edition = "2021"
 license = "Apache-2.0"

pallets/fee-processor/Cargo.toml

@@ -18,7 +18,7 @@ pub mod pallet {
 	use frame_support::traits::tokens::Preservation;
 	use frame_support::PalletId;
 	use frame_system::pallet_prelude::*;
-	use hydradx_traits::fee_processor::{Convert, FeeReceiver};
+	use hydradx_traits::fee_processor::{Convert, FeeDestination, FeeReceiver};
 	use sp_runtime::helpers_128bit::multiply_by_rational_with_rounding;
 	use sp_runtime::traits::AccountIdConversion;
 	use sp_runtime::{Permill, Rounding, Saturating};
@@ -71,6 +71,14 @@ pub mod pallet {
 	#[pallet::getter(fn pending_conversions)]
 	pub type PendingConversions<T: Config> = CountedStorageMap<_, Blake2_128Concat, T::AssetId, (), OptionQuery>;
 
+	/// HDX held in the pot for a `hold_until_ed` receiver whose account is still
+	/// below the existential deposit. The HDX physically lives in
+	/// `pot_account_id()`; this map only earmarks how much of it belongs to each
+	/// destination. Flushed to the destination once `balance + held + slice ≥ ED`.
+	#[pallet::storage]
+	#[pallet::getter(fn held_fees)]
+	pub type HeldFees<T: Config> = StorageMap<_, Blake2_128Concat, T::AccountId, Balance, ValueQuery>;
+
 	#[pallet::event]
 	#[pallet::generate_deposit(pub(super) fn deposit_event)]
 	pub enum Event<T: Config> {
@@ -208,6 +216,7 @@ pub mod pallet {
 			};
 
 			let pot = Self::pot_account_id();
+			Self::ensure_pot_exists();
 			let mut total_taken: Balance = 0;
 
 			// Raw-asset receivers: each reports how much of its slice it actually wants
@@ -257,6 +266,7 @@ pub mod pallet {
 			ensure!(asset_id != T::HdxAssetId::get(), Error::<T>::AlreadyHdx);
 
 			let pot = Self::pot_account_id();
+			Self::ensure_pot_exists();
 			let balance = T::Currency::balance(asset_id, &pot);
 
 			let hdx_received = T::Convert::convert(pot.clone(), asset_id, T::HdxAssetId::get(), balance)?;
@@ -276,36 +286,78 @@ pub mod pallet {
 			Ok(())
 		}
 
+		/// Give the pot a provider reference if it has none, so it survives at a
+		/// zero balance between trades. Without this a fresh-chain pot is created
+		/// and reaped within a single distribution, surfacing as
+		/// `Token::FundsUnavailable`. Idempotent: a no-op once the pot holds a
+		/// balance or has already been provided.
+		fn ensure_pot_exists() {
+			let pot = Self::pot_account_id();
+			if frame_system::Pallet::<T>::providers(&pot) == 0 {
+				let _ = frame_system::Pallet::<T>::inc_providers(&pot);
+			}
+		}
+
 		/// Sum of percentages of the HDX-target (non-raw) receivers.
-		fn convert_percentage(destinations: &[(T::AccountId, Permill, bool)]) -> Permill {
+		fn convert_percentage(destinations: &[FeeDestination<T::AccountId>]) -> Permill {
 			destinations
 				.iter()
-				.filter(|(_, _, accepts_raw)| !accepts_raw)
-				.fold(Permill::zero(), |acc, (_, pct, _)| acc.saturating_add(*pct))
+				.filter(|d| !d.accepts_raw)
+				.fold(Permill::zero(), |acc, d| acc.saturating_add(d.percentage))
 		}
 
 		/// Distribute `total` HDX among the HDX-target `destinations` proportionally to
 		/// each destination's percentage relative to `total_pct`. Raw-asset receivers are
 		/// skipped — they were already paid in the original asset.
+		///
+		/// `total` is already sitting in `source` (the pot). For a `hold_until_ed`
+		/// destination whose account would still be below ED after receiving its
+		/// slice, the slice is left in the pot and tracked in `HeldFees` instead of
+		/// transferred — avoiding a `Token::BelowMinimum` revert. The buffer is
+		/// flushed (held + new slice) the moment `balance + held + slice ≥ ED`.
 		fn distribute_proportionally(
 			source: &T::AccountId,
 			total: Balance,
-			destinations: Vec<(T::AccountId, Permill, bool)>,
+			destinations: Vec<FeeDestination<T::AccountId>>,
 			total_pct: Permill,
 		) -> DispatchResult {
 			if total == 0 || total_pct.is_zero() {
 				return Ok(());
 			}
+			let hdx = T::HdxAssetId::get();
+			let ed = T::Currency::minimum_balance(hdx);
 			let denom = total_pct.deconstruct() as u128;
-			for (dest, pct, accepts_raw) in destinations {
+			for FeeDestination {
+				account,
+				percentage,
+				accepts_raw,
+				hold_until_ed,
+			} in destinations
+			{
 				if accepts_raw {
 					continue;
 				}
-				let numer = pct.deconstruct() as u128;
-				let amount = multiply_by_rational_with_rounding(total, numer, denom, Rounding::Down)
+				let numer = percentage.deconstruct() as u128;
+				let slice = multiply_by_rational_with_rounding(total, numer, denom, Rounding::Down)
 					.ok_or(Error::<T>::Arithmetic)?;
-				if amount > 0 {
-					T::Currency::transfer(T::HdxAssetId::get(), source, &dest, amount, Preservation::Expendable)?;
+				if slice == 0 {
+					continue;
+				}
+
+				if hold_until_ed {
+					// `slice` is already in the pot; flush the accumulated buffer
+					// only if the account would then reach ED, else keep holding.
+					let held = HeldFees::<T>::get(&account);
+					let pending = held.saturating_add(slice);
+					let balance = T::Currency::balance(hdx, &account);
+					if balance.saturating_add(pending) >= ed {
+						T::Currency::transfer(hdx, source, &account, pending, Preservation::Expendable)?;
+						HeldFees::<T>::remove(&account);
+					} else {
+						HeldFees::<T>::insert(&account, pending);
+					}
+				} else {
+					T::Currency::transfer(hdx, source, &account, slice, Preservation::Expendable)?;
 				}
 			}
 			Ok(())

pallets/fee-processor/src/lib.rs

@@ -0,0 +1,116 @@
+use super::mock::*;
+use crate::*;
+use frame_support::assert_ok;
+use frame_support::traits::fungibles::{Inspect, Mutate};
+use frame_support::traits::tokens::Preservation;
+use pallet_currencies::fungibles::FungibleCurrencies;
+
+fn balance(asset: AssetId, who: &AccountId) -> u128 {
+	<FungibleCurrencies<Test> as Inspect<AccountId>>::balance(asset, who)
+}
+
+// Empty an account (reaped) so it starts below ED.
+fn drain(asset: AssetId, who: &AccountId) {
+	let bal = balance(asset, who);
+	if bal > 0 {
+		assert_ok!(<FungibleCurrencies<Test> as Mutate<AccountId>>::transfer(
+			asset,
+			who,
+			&BOB,
+			bal,
+			Preservation::Expendable
+		));
+	}
+}
+
+// HDX path: HdxStakingFeeReceiver (50%, HDX-target, hold_until_ed) -> HDX_STAKING_POT,
+// HdxReferralsFeeReceiver (50%, raw) -> HDX_REFERRALS_POT. With one non-raw receiver
+// the pot `take` equals that receiver's slice, so the numbers stay clean. Genesis
+// funds HDX_STAKING_POT / HDX_REFERRALS_POT / pot with ONE each.
+
+#[test]
+fn hdx_fee_should_hold_staking_slice_when_pot_below_ed() {
+	ExtBuilder::default().build().execute_with(|| {
+		set_hdx_existential_deposit(ONE);
+		drain(HDX, &HDX_STAKING_POT); // receiver below ED
+
+		let pot = FeeProcessor::pot_account_id();
+		let pot_before = balance(HDX, &pot);
+
+		// Staking slice = ONE/2 < ED -> held, not delivered.
+		assert_ok!(Pallet::<Test>::process_trade_fee(FEE_SOURCE, ALICE, HDX, ONE));
+
+		assert_eq!(balance(HDX, &HDX_STAKING_POT), 0, "nothing delivered to the receiver");
+		assert_eq!(HeldFees::<Test>::get(HDX_STAKING_POT), ONE / 2, "slice earmarked");
+		// The held HDX physically sits in the pot.
+		assert_eq!(balance(HDX, &pot), pot_before + ONE / 2);
+	});
+}
+
+#[test]
+fn hdx_fee_should_flush_staking_buffer_when_accumulation_reaches_ed() {
+	ExtBuilder::default().build().execute_with(|| {
+		set_hdx_existential_deposit(ONE);
+		drain(HDX, &HDX_STAKING_POT);
+
+		// First trade: ONE/2 held.
+		assert_ok!(Pallet::<Test>::process_trade_fee(FEE_SOURCE, ALICE, HDX, ONE));
+		assert_eq!(balance(HDX, &HDX_STAKING_POT), 0);
+		assert_eq!(HeldFees::<Test>::get(HDX_STAKING_POT), ONE / 2);
+
+		// Second trade: held(ONE/2) + slice(ONE/2) = ONE >= ED -> flush.
+		assert_ok!(Pallet::<Test>::process_trade_fee(FEE_SOURCE, ALICE, HDX, ONE));
+		assert_eq!(balance(HDX, &HDX_STAKING_POT), ONE, "buffer flushed to the receiver");
+		assert_eq!(HeldFees::<Test>::get(HDX_STAKING_POT), 0, "buffer cleared");
+	});
+}
+
+#[test]
+fn hdx_fee_should_deliver_immediately_when_pot_already_above_ed() {
+	ExtBuilder::default().build().execute_with(|| {
+		set_hdx_existential_deposit(ONE);
+		// Receiver already at/above ED (genesis ONE) -> even a sub-ED slice flows straight through.
+		let before = balance(HDX, &HDX_STAKING_POT);
+
+		// amount = 2 -> staking slice = 1 (< ED).
+		assert_ok!(Pallet::<Test>::process_trade_fee(FEE_SOURCE, ALICE, HDX, 2));
+
+		assert_eq!(balance(HDX, &HDX_STAKING_POT), before + 1);
+		assert_eq!(HeldFees::<Test>::get(HDX_STAKING_POT), 0);
+	});
+}
+
+#[test]
+fn hdx_fee_should_revert_below_ed_when_hold_until_ed_disabled() {
+	ExtBuilder::default().build().execute_with(|| {
+		set_hdx_existential_deposit(ONE);
+		set_hdx_staking_hold(false);
+		drain(HDX, &HDX_STAKING_POT);
+
+		// Without buffering, the sub-ED slice is transferred straight into the empty
+		// receiver and reverts — the original failure mode this feature removes.
+		let err = Pallet::<Test>::process_trade_fee(FEE_SOURCE, ALICE, HDX, ONE).unwrap_err();
+		assert_eq!(err, sp_runtime::TokenError::BelowMinimum.into());
+	});
+}
+
+#[test]
+fn hdx_fee_should_not_revert_when_pot_account_starts_empty() {
+	ExtBuilder::default().build().execute_with(|| {
+		set_hdx_existential_deposit(ONE);
+		let pot = FeeProcessor::pot_account_id();
+		drain(HDX, &pot); // reaped pot mimics a fresh chain
+		assert_eq!(balance(HDX, &pot), 0);
+
+		// `ensure_pot_exists` provider-backs the reaped pot so distributing the full
+		// `take` through it does not revert with FundsUnavailable. amount = 2*ONE so
+		// take = ONE (>= ED) is deposited and the slice is delivered to the receiver.
+		let before = balance(HDX, &HDX_STAKING_POT);
+		assert_ok!(Pallet::<Test>::process_trade_fee(FEE_SOURCE, ALICE, HDX, 2 * ONE));
+		assert_eq!(balance(HDX, &HDX_STAKING_POT), before + ONE, "slice delivered");
+		assert!(
+			frame_system::Pallet::<Test>::providers(&pot) >= 1,
+			"pot kept alive by ensure_pot_exists",
+		);
+	});
+}