Lince DPM - Lince

The withdraw instruction allows a user to redeem their LP tokens in exchange for their share of stables and underlying assets from the pool. It calculates the user’s proportional share based on LP tokens burned, transfers the corresponding amounts of stablecoins and other assets into reserve accounts for future swaps, and deducts management and success fees. The net stable profit is then sent back to the user. However, the instruction relies on reserve_ata_acc_infos being passed via remaining_accounts without verifying that it is owned by the expected config PDA. This opens up few potential issues:

• A user could pass the pool's own reserve ATA twice, causing assets to remain in the pool account rather than being reserved for future swaps leading to inaccurate tracking of available liquidity.

• A user could pass a reserve ATA they control as the destination. This would cause intended reserve assets to be transferred directly to their wallet instead of the protocol reserves. As a result, no assets would be left in the reserve for swap logic, leaving the protocol under-collateralized.

programs/dpm/src/instructions/withdraw.rs

pub fn withdraw<'info>(
    ctx: Context<'_, '_, '_, 'info, Withdraw<'info>>,
    strategy: Strategy,
    amount_to_withdraw: u64,
) -> Result<()> {
    let user_lince_pk = &ctx.accounts.user_lince_pk;
    let pool = &ctx.accounts.pool;
    let pool_stable_ata = &ctx.accounts.pool_stable_ata;
    let user_pda = &mut ctx.accounts.user_pda;
    let user_lince_lp_ata = &ctx.accounts.user_lince_lp_ata;
    let user_lince_stable_ata = &ctx.accounts.user_lince_stable_ata;
    let management_stable_ata = &ctx.accounts.management_stable_ata;
    let success_stable_ata = &ctx.accounts.success_stable_ata;
    let reserve_stable_ata = &mut ctx.accounts.reserve_stable_ata;
    let lp_mint = &mut ctx.accounts.lp_mint;
    let config = &ctx.accounts.config;
    let rem_accs = ctx.remaining_accounts;
    let stable = &ctx.accounts.stablecoin;
    let token_program = &ctx.accounts.token_program;

    require!(
        amount_to_withdraw
            >= MIN_WITHDRAW_AMOUNT_ALLOWED
                .checked_mul(10u64.pow(stable.decimals as u32))
                .ok_or(DpmError::Overflow)?,
        DpmError::LessThanMinAmountAllowed
    );

    // *****************************************************
    // Get, deserialize and check req accounts from rem_accs
    // *****************************************************
    // We are expecting exactly an Asset, a pool Ata, a PriceUpdateV2 and a reserve Ata account for each composition
    let n = pool.compositions.len();

    require!(
        rem_accs.len() == n * 4,
        DpmError::RemainingAccountsLengthMismatch
    );

    // For snapshots we only need Asset, pool Ata, PriceUpdate accs
    let rem_accs_for_snapshot = &rem_accs[..n * 3];

    let snapshots = get_pool_assets_snapshots(
        rem_accs_for_snapshot,
        pool,
        config,
        stable.decimals,
        ctx.program_id,
    )?;

    require!(snapshots.len() == n, DpmError::SnapshotMissing);

    // ************
    // Prepare vars
    // ************
    let deposit = user_pda.get_deposit(strategy)?;
    let user_lp_balance = user_lince_lp_ata.amount;
    let lp_supply_before = lp_mint.supply;
    let user_lince_pubkey = user_lince_pk.key();

    let principal = deposit.amount;

    // ***************************
    // Get User Lp Tokens Value
    // ***************************
    let pool_value = get_pool_value_internal(pool_stable_ata.amount, &snapshots)?;

    let user_lp_tokens_value =
        get_lp_value_internal(user_lp_balance, pool_value, lp_supply_before)?;

    require!(
        amount_to_withdraw <= user_lp_tokens_value,
        DpmError::NotEnoughForReqWithdrawal
    );

    // TODO - Improve this logic
    // - Define the max amount allowed to withdraw, is 50% ok?
    // - Emit an event if the stable reserve amount is below a % of the TVL
    // - Thus, we need a way of knowing the TVL
    // - Last 2 things can be done off-chain
    // - Mabe we can put something simple on-chain, like emit a warning if is below a hardcoded amount, and let the backend
    // find if it's needed to deposit stable on the reserve.
    require!(
        reserve_stable_ata.amount / 2 >= amount_to_withdraw,
        DpmError::NotEnoughFundsOnReserve
    );

    // **************************
    // Get user lp amount to burn
    // **************************
    let lp_price = get_lp_price_internal(pool_value, lp_supply_before, lp_mint.decimals)?;
    let lp_amount_to_burn = get_lp_amount_to_burn(lp_price, amount_to_withdraw, lp_mint.decimals);

    // ************************
    // Get pool share withdrawn
    // ************************
    let pool_share_withdrawn = get_share(lp_amount_to_burn, lp_supply_before);

    // ***************************************************
    // Calculate each asset amount and transfer to reserve
    // ***************************************************
    let mut assets_transferred_to_reserve: HashMap<Pubkey, u64> = HashMap::new();

    let pool_seeds = &[Pool::SEED.as_bytes(), &strategy.as_bytes(), &[pool.bump]];
    let pool_signer_seeds = [&pool_seeds[..]];

    // Send stable first
    let stable_amount = get_share_amount(pool_stable_ata.amount, pool_share_withdrawn);

    if stable_amount > 0 {
        // CHECK: deprecated state acknowledged.
        // Using it to avoid having to pass the mint account with transfer_checked
        transfer(
            CpiContext::new_with_signer(
                token_program.to_account_info(),
                Transfer {
                    from: pool_stable_ata.to_account_info(),
                    to: reserve_stable_ata.to_account_info(),
                    authority: pool.to_account_info(),
                },
                &pool_signer_seeds,
            ),
            stable_amount,
        )?;
    }

    // Iterate through each asset
    let pool_ata_acc_infos = &rem_accs[n..n * 2];
    let reserve_ata_acc_infos = &rem_accs[n * 3..n * 4];

    for i in 0..n {
        let pool_ata_acc_info = &pool_ata_acc_infos[i];
        let reserve_ata_acc_info = &reserve_ata_acc_infos[i];

        let pool_asset_ata =
            ITokenAccount::try_deserialize(&mut &**pool_ata_acc_info.data.borrow())
                .map_err(|_| DpmError::InvalidTokenAccount)?;

        let asset_amount = get_share_amount(pool_asset_ata.amount, pool_share_withdrawn);

        let asset_token_program: &AccountInfo<'info> = if pool_ata_acc_info.owner == &Token::id() {
            &ctx.accounts.token_program
        } else {
            &ctx.accounts.token_2022
        };

        if asset_amount > 0 {
            // CHECK: deprecated state acknowledged.
            // Using it to avoid having to pass the mint account with transfer_checked
            transfer(
                CpiContext::new_with_signer(
                    asset_token_program.to_account_info(),
                    Transfer {
                        from: pool_ata_acc_info.to_account_info(),
                        to: reserve_ata_acc_info.to_account_info(),
                        authority: pool.to_account_info(),
                    },
                    &pool_signer_seeds,
                ),
                asset_amount,
            )?;
        }

        // Store to emit later
        assets_transferred_to_reserve.insert(pool_asset_ata.mint, asset_amount);
    }

    // Additional code skipped
}

It is recommended to validate that the provided reserve_ata_acc_infos via remaining_accounts are owned by the config PDA.

SOLVED: The Lince team resolved the finding by validating that reserve_ata_acc_infos passed in via remaining_accounts is owned by the config PDA account.

The admin_transfer, pool_swap_jupiter (during Liquidate), and reserve_swap_jupiter instructions rely on default SPL Token program assumptions when deriving associated token accounts (ATAs). However, for Token-2022 mints, ATA derivation must use the Token-2022 program instead. Since the code does not account for this, any instruction involving Token-2022 assets will fail at runtime due to invalid or missing ATAs blocking transfers and causing operations like liquidation or reserve swaps to break.

programs/dpm/src/instructions/admin_transfer.rs

#[derive(Accounts)]
#[instruction(strategy: Strategy)]
pub struct AdminTransfer<'info> {
    #[account(mut)]
    pub admin: Signer<'info>,

    #[account(
        has_one = admin,
        seeds = [Config::SEED.as_bytes()],
        bump = config.bump,
    )]
    pub config: Account<'info, Config>,

    #[account(mut,
        seeds = [Pool::SEED.as_bytes(), &strategy.as_bytes()],
        bump = pool.bump
    )]
    pub pool: Account<'info, Pool>,

    pub mint: InterfaceAccount<'info, Mint>,

    #[account(
      mut,
      associated_token::mint = mint,
      associated_token::authority = pool,
    )]
    pub from: InterfaceAccount<'info, TokenAccount>,

    #[account(mut)]
    pub to: InterfaceAccount<'info, TokenAccount>,

    pub token_program: Interface<'info, TokenInterface>,
}

programs/dpm/src/instructions/reserve_swap_jupiter.rs

#[derive(Accounts)]
pub struct ReserveSwapJupiter<'info> {
    #[account(mut)]
    pub lince_manager: Signer<'info>,

    #[account(
        has_one = lince_manager,
        constraint = !config.is_paused @ DpmError::Paused,
        seeds = [Config::SEED.as_bytes()],
        bump = config.bump,
    )]
    pub config: Box<Account<'info, Config>>,

    /// CHECK: Mint out
    #[account(
        address = config.stablecoin
    )]
    pub stablecoin: Box<Account<'info, Mint>>,

    /// CHECK: From - Enough checking auth.
    #[account(
      mut,
      token::authority = config,
    )]
    pub reserve_mint_in_ata: Box<InterfaceAccount<'info, ITokenAccount>>,

    /// CHECK: To
    #[account(
      mut,
      associated_token::mint = stablecoin,
      associated_token::authority = config,
    )]
    pub reserve_mint_out_ata: Box<Account<'info, TokenAccount>>,

    #[account(
        address = JUPITER_V6_PROGRAM_ID
    )]
    pub jupiter_program: Program<'info, Jupiter>,
}

programs/dpm/src/instructions/pool_swap_jupiter.rs

#[derive(Accounts)]
#[instruction(strategy: Strategy, mint_in_asset_type: AssetType, mint_out_asset_type: AssetType)]
pub struct PoolSwapJupiter<'info> {
    #[account(mut)]
    pub lince_manager: Signer<'info>,

    #[account(
        has_one = lince_manager,
        constraint = !config.is_paused @ DpmError::Paused,
        seeds = [Config::SEED.as_bytes()],
        bump = config.bump,
    )]
    pub config: Box<Account<'info, Config>>,
    #[account(
        mut,
        seeds = [Pool::SEED.as_bytes(), &strategy.as_bytes()],
        bump = pool.bump
       )]
    pub pool: Box<Account<'info, Pool>>,

    pub mint_in: Box<InterfaceAccount<'info, Mint>>,

    /// CHECK: If exists, asset is registered (ok if not active at this point)
    #[account(
        seeds = [Asset::SEED.as_bytes(), mint_in_asset_type.as_seed()],
        bump = mint_in_asset.bump,
        constraint = mint_in_asset.mint == mint_in.key() @ DpmError::InvalidAssetAccount
    )]
    pub mint_in_asset: Box<Account<'info, Asset>>,

    pub mint_out: Box<InterfaceAccount<'info, Mint>>,

    /// CHECK: If exists, asset is registered (ok if not active at this point)
    #[account(
        seeds = [Asset::SEED.as_bytes(), mint_out_asset_type.as_seed()],
        bump = mint_out_asset.bump,
        constraint = mint_out_asset.mint == mint_out.key() @ DpmError::InvalidAssetAccount
    )]
    pub mint_out_asset: Box<Account<'info, Asset>>,

    #[account(
      mut,
      associated_token::mint = mint_in,
      associated_token::authority = pool,
    )]
    pub pool_mint_in_ata: Box<InterfaceAccount<'info, TokenAccount>>,

    #[account(
      init_if_needed,
      payer = lince_manager,
      associated_token::mint = mint_out,
      associated_token::authority = pool,
      associated_token::token_program = mint_out_program,
    )]
    pub pool_mint_out_ata: Box<InterfaceAccount<'info, TokenAccount>>,

    pub mint_out_program: Interface<'info, TokenInterface>,

    pub associated_token_program: Program<'info, AssociatedToken>,

    pub system_program: Program<'info, System>,
    #[account(
        address = JUPITER_V6_PROGRAM_ID
    )]
    pub jupiter_program: Program<'info, Jupiter>,
}

It is recommended to include the constraint associated_token::token_program = token_program for transfer_admin instruction when deriving ATAs for known mints. For reserve_swap_jupiter and pool_swap_jupiter, accept two token_program accounts and derive the ATAs using the appropriate program for each mint.

SOLVED: The Lince team resolved the finding by adding associated_token::token_program = token_program constraint in reserve_swap_jupiter, pool_swap_jupiter and transfer_admin instructions.

The initialize_pool instruction sets up a new pool by recording its strategy and asset composition, transferring an initial stablecoin deposit from the pool manager, minting an equal amount of LP tokens. It initializes the pool’s configuration and prepares it for future deposits, swaps, and withdrawals.

The instruction assumes that both the stablecoin and LP mint have 6 decimal places, which is implicitly relied upon during share and LP token calculations. However, the program does not validate this assumption at runtime. If a stablecoin or LP mint with a different decimal configuration is used, it could lead to incorrect share calculations, pool imbalance, or unexpected behavior during deposits and withdrawals.

programs/dpm/src/instructions/initialize_pool.rs

pub fn initialize_pool(
    ctx: Context<InitializePool>,
    strategy: Strategy,
    compositions: Vec<Composition>,
    first_deposit_amount: u64,
    args: PoolMetadataArgs,
) -> Result<()> {
    let pools_manager = &ctx.accounts.pools_manager;
    let pools_manager_stable_ata = &ctx.accounts.pools_manager_stable_ata;
    let pools_manager_user_pda = &mut ctx.accounts.pools_manager_user_pda;
    let pools_manager_lp_ata = &ctx.accounts.pools_manager_lp_ata;
    let pool_stable_ata = &ctx.accounts.pool_stable_ata;
    let token_program = &ctx.accounts.token_program;
    let lp_mint = &ctx.accounts.lp_mint;
    let pool = &mut ctx.accounts.pool;
    let admin = &ctx.accounts.admin;
    let rem_accs = ctx.remaining_accounts;
    let stable = &ctx.accounts.stablecoin;
    let bump = ctx.bumps.pool;
    let prog_id = ctx.program_id;
    let token_metadata_program = &ctx.accounts.token_metadata_program;

    // **********
    // Pre-checks
    // **********
    require!(
        first_deposit_amount
            >= MIN_INIT_DEPOSIT_AMOUNT_ALLOWED
                .checked_mul(10u64.pow(stable.decimals as u32))
                .ok_or(DpmError::Overflow)?,
        DpmError::LessThanMinAmountAllowed
    );

    require!(
        pools_manager_stable_ata.amount >= first_deposit_amount,
        DpmError::NotEnoughFundsForDeposit
    );

    require!(args.name.len() <= 32, DpmError::NameTooLong);
    require!(args.symbol.len() <= 10, DpmError::SymbolTooLong);
    require!(args.uri.len() <= 200, DpmError::UriTooLong);

    // *****************************************************
    // Get, deserialize and check req accounts from rem_accs
    // *****************************************************
    let assets = get_deserialized_assets_from_rem_accs(rem_accs, prog_id)?;

    require!(
        assets.len() == compositions.len(),
        DpmError::AssetAccsMissing
    );

    // ************************************************
    // Transfer first deposit amount to pool_stable_ata
    // ************************************************
    transfer_spl_tokens(
        pools_manager_stable_ata,
        pool_stable_ata,
        first_deposit_amount,
        pools_manager,
        token_program,
    )?;

    // ****************************
    // Update pools_manager deposit
    // ****************************
    let new_deposit = Deposit {
        amount: first_deposit_amount,
        strategy: strategy,
    };

    pools_manager_user_pda.update_deposit(new_deposit)?;

    // *******************************************************************
    // Create metadata for LP mint
    // *******************************************************************
    let pool_seeds = &[Pool::SEED.as_bytes(), &strategy.as_bytes(), &[bump]];
    let pool_signer_seeds = [&pool_seeds[..]];

    let mut builder = mpl_token_metadata::instructions::CreateMetadataAccountV3CpiBuilder::new(
        &token_metadata_program,
    );

    let lp_mint_info = lp_mint.to_account_info();
    let pool_info = pool.to_account_info();

    builder.mint(&lp_mint_info);
    builder.mint_authority(&pool_info);
    builder.metadata(&ctx.accounts.metadata);
    builder.is_mutable(true);
    builder.update_authority(&admin, false);
    builder.payer(&pools_manager);
    builder.system_program(&ctx.accounts.system_program);

    let data = DataV2 {
        collection: None,
        creators: None,
        name: args.name.to_string(),
        symbol: args.symbol.to_string(),
        seller_fee_basis_points: 0,
        uses: None,
        uri: args.uri.to_string(),
    };
    builder.data(data);

    builder.invoke_signed(&pool_signer_seeds)?;

    // *******************************************************************
    // Mint Lp Tokens to pools_manager in the same amount as first deposit
    // *******************************************************************

    let mint_to_ctx = MintTo {
        mint: lp_mint.to_account_info(),
        to: pools_manager_lp_ata.to_account_info(),
        authority: pool.to_account_info(),
    };

    mint_to(
        CpiContext::new_with_signer(
            token_program.to_account_info(),
            mint_to_ctx,
            &pool_signer_seeds,
        ),
        first_deposit_amount,
    )?;

    // ***************
    // Initiliaze pool
    // ***************
    pool.init(lp_mint.key(), strategy, &compositions, &assets, bump)?;

    emit!(PoolInitialized {
        pool_address: pool.key(),
        pools_manager: pools_manager.key(),
        strategy: pool.strategy,
        compositions: pool.compositions.clone(),
        lp_mint: pool.lp_mint,
        first_deposit_amount,
        lp_tokens_minted: first_deposit_amount,
    });

    Ok(())
}

It is recommended to enforce a runtime check to ensure both the stablecoin and LP mint use 6 decimals.

SOLVED: The Lince team resolved the finding by ensuring that stablecoin and LP mint use the same decimals.

The pool_swap_jupiter instruction lets the lince_manager swap tokens using Jupiter v6 as part of a pool rebalance. It ensures swaps follow the expected phase (Invest or Liquidate), checks token amounts and order, and tracks progress using a bitmask. Once all strategy assets are swapped, the rebalance cycle ends. The instruction uses check_is_swap_ix to verify that the provided swap_data matches one of three supported Jupiter swap types. It then extracts in_amount and quoted_out_amount using the get_swap_data_amounts() helper.

However get_swap_data_amounts assumes a fixed layout for these values in the serialized instruction data. While this layout works for route and shared_accounts_route types, it does not match shared_accounts_exact_out_route (used for exact-out swaps). As a result, the program mistakenly interprets in_amount as quoted_out_amount and later checks if require!(amounts.quoted_out_amount > 0, DpmError::SwapAmountError); . This issue is also present in reserve_swap_jupiter instruction.

The impact is limited to cases where the input amount is set to zero, which causes the transaction to fail due to an incorrect quoted_out_amount check.

programs/dpm/src/utils/helpers.rs

#[inline(always)]
pub fn check_is_swap_ix(discriminator: &[u8]) -> Result<()> {
    match discriminator
        .try_into()
        .map_err(|_| DpmError::MalformedSwapInstructionData)
        .unwrap()
    {
        SHARED_ACCOUNTS_ROUTE_DISCRIMINATOR => (),
        ROUTE_DISCRIMINATOR => (),
        SHARED_ACCOUNTS_EXACT_OUT_DISCRIMINATOR => (),
        _ => err!(DpmError::InvalidSwapInstructionDiscriminator)?,
    }

    Ok(())
}

programs/dpm/src/utils/helpers.rs

#[inline(always)]
pub fn get_swap_data_amounts(data: &[u8]) -> RouteAmounts {
    let len = data.len();
    let quoted_out_amount_bytes: [u8; 8] = data[len - 11..len - 3].try_into().unwrap();
    let in_amount_bytes: [u8; 8] = data[len - 19..len - 11].try_into().unwrap();
    RouteAmounts {
        in_amount: u64::from_le_bytes(in_amount_bytes),
        quoted_out_amount: u64::from_le_bytes(quoted_out_amount_bytes),
    }
}

It is recommended to update get_swap_data_amounts() to correctly parse quoted_in_amount and out_amount for shared_accounts_exact_out_route;.if this swap type is not used, consider removing it entirely for clarity and safety.

SOLVED: The Lince team resolved the issue by removing SHARED_ACCOUNTS_EXACT_OUT_DISCRIMINATOR route in check_is_swap_ix function.