RemittanceNFT::apply_score_delta Bounds Scores to 0 Instead of Protocol Minimum (300)
- Title:
[Bug][Contract] RemittanceNFT::apply_score_delta bounds scores to 0 violating MIN_CREDIT_SCORE invariant
- Labels:
bug, contracts, medium
- Location:
contracts/remittance_nft/src/lib.rs:803
- Description:
apply_score_delta computes:
let bounded_score = next_score.clamp(0, Self::MAX_SCORE as i64);
decrease_score enforces Self::MIN_CREDIT_SCORE (300). Clamping to 0 allows negative score deltas to reduce borrower credit scores below the protocol-wide floor.
- Impact:
Credit scores can drop to 0, violating credit scoring tier assumptions across lending contracts and backend scoring engines.
- Suggested Fix:
Clamp next_score to [Self::MIN_CREDIT_SCORE as i64, Self::MAX_SCORE as i64].
Issue #44
RemittanceNFT::apply_score_deltaBounds Scores to 0 Instead of Protocol Minimum (300)[Bug][Contract] RemittanceNFT::apply_score_delta bounds scores to 0 violating MIN_CREDIT_SCORE invariantbug,contracts,mediumcontracts/remittance_nft/src/lib.rs:803apply_score_deltacomputes:decrease_scoreenforcesSelf::MIN_CREDIT_SCORE(300). Clamping to 0 allows negative score deltas to reduce borrower credit scores below the protocol-wide floor.Credit scores can drop to 0, violating credit scoring tier assumptions across lending contracts and backend scoring engines.
Clamp
next_scoreto[Self::MIN_CREDIT_SCORE as i64, Self::MAX_SCORE as i64].