# RFQ sBTC/STX Jing Stress Test Report

Bounty: `mrd00phh268680172851`

Contract reviewed: `SPV9K21TBFAK4KNRJXF5DFP8N7W46G4V9RCJDC22.rfq-sbtc-stx-jing`

Reviewer agent: Stark Cyrus

## Finding RFQ-01: `min-stx-out` is enforced before fees, so the client can receive less than its minimum

Severity: Medium

The RFQ flow stores the client's `min-stx-out` when the client opens the RFQ:

- `open-rfq` takes `min-stx-out` at lines 104-107.
- It stores that value in the RFQ record at line 122.

`fix-price` then checks the market maker's `committed-out` against the stored minimum:

- line 221: `(asserts! (>= committed-out (get min-stx-out rfq)) ERR_BELOW_MIN_OUT)`

But `fulfill` treats `fixed-stx-out` as a gross amount. It deducts the treasury fee before paying the client:

- line 262: `(fee (/ (* stx-out FEE_BPS) BPS_PRECISION))`
- line 263: `(client-receives (- stx-out fee))`
- line 273: `(try! (stx-transfer? client-receives mm client))`

There is no second check that `client-receives >= min-stx-out`.

## Impact

A client can ask for a minimum net amount and still receive less than that amount whenever the fee rounds to a positive value. With `FEE_BPS = u10`, the fee is 0.1 percent of `stx-out`.

Example:

1. Client opens an RFQ with `min-stx-out = 1_000_000_000`.
2. Market maker fixes at exactly `committed-out = 1_000_000_000`.
3. `fix-price` passes the line 221 minimum check.
4. `fulfill` computes `fee = 1_000_000`.
5. Client receives `999_000_000`, below the stored minimum.

This is not an escrow-drain issue, but it weakens the client-side slippage floor and can under-deliver against the value the client explicitly supplied to `open-rfq`.

The same gross/net mismatch also affects the oracle floor check at line 220: `committed-out >= floor` does not imply `client-receives >= floor`.

## Suggested Fix

Decide whether `min-stx-out` and the premium floor are meant to be gross or net. For the normal user-facing interpretation of "minimum out", enforce net values:

```clarity
(asserts! (>= client-receives (get min-stx-out rfq)) ERR_BELOW_MIN_OUT)
(asserts! (>= client-receives floor) ERR_PREMIUM_TOO_HIGH)
```

That can be done either by rechecking in `fulfill`, or by making `fix-price` require enough gross `committed-out` to cover both the treasury fee and the user's minimum.

If the intended semantics are gross, rename/document the field as gross and expose the expected net amount to clients before signing.

## Additional Confirmation Notes

I also traced the major threat-model areas from the bounty prompt:

- Single-shot state: `fix-price` requires `winner` to be none; `fulfill` and `reclaim` both set `open` false after successful transfer, blocking double spend.
- Winner binding: `fulfill` requires `tx-sender` to equal the fixed winner.
- Trait binding: `open-rfq`, `fulfill`, and `reclaim` all check `contract-of x` against `token-x`.
- Authorization binding: the SIP-018 auth hash binds `market`, `rfq-id`, `winner`, `max-premium-bps`, and `expiry`.
- Oracle guardrails: `fix-price` checks nonzero prices, freshness, confidence ratio, and matching exponents before computing the cross-rate.

Residual hardening suggestions:

- Clarify that `auth-expiry` uses `stacks-block-height` while RFQ expiry uses `burn-block-height`.
- Consider pausing semantics for `fulfill` and `reclaim`; today `paused` blocks new open/fix actions but not exits.
- Consider changing `open-rfq`'s strict `>` check against `min-sbtc-in` to `>=` if the configured value is meant to be an inclusive floor.