Merge pull request #1059 from brightMedina5050/feature/reentrancy-guards-and-safety

Add reentrancy guards to payable functions and handle attached value safely

Author: nanaf6203-bit

contracts/factory/src/lib.rs

@@ -67,6 +67,9 @@ pub mod contract_factory {
         CodeHashNotSet,
         ContractNotFound,
         InvalidParameters,
+        /// Native tokens were attached to `deploy_contract` but deployment
+        /// fees are not supported. Send zero value.
+        UnexpectedValue,
     }
 
     /// Contract Factory storage
@@ -151,13 +154,19 @@ pub mod contract_factory {
             self.code_hashes.get(contract_type)
         }
 
-        /// Deploys a new contract instance
+        /// Deploys a new contract instance.
+        ///
+        /// Attaching native tokens is not supported; deployment is free.
+        /// Send zero value with this call.
         #[ink(message, payable)]
         pub fn deploy_contract(
             &mut self,
             config: DeploymentConfig,
             version: String,
         ) -> Result<AccountId, Error> {
+            if self.env().transferred_value() > 0 {
+                return Err(Error::UnexpectedValue);
+            }
             let code_hash = self
                 .code_hashes
                 .get(config.contract_type)

contracts/fractional/src/lib.rs

@@ -978,61 +978,65 @@ pub mod fractional {
 
         /// Bid on a Dutch auction at the current descending price.
         /// Buyer must attach sufficient payment for the current price of all shares.
+        ///
+        /// Wrapped in a reentrancy guard, matching `buy_shares` and `add_liquidity`.
         #[ink(message, payable)]
         pub fn bid_dutch_auction(&mut self, auction_id: u64) -> Result<(), FractionalError> {
-            let caller = self.env().caller();
-            let payment = self.env().transferred_value();
+            non_reentrant!(self, {
+                let caller = self.env().caller();
+                let payment = self.env().transferred_value();
 
-            let mut auction = self
-                .dutch_auctions
-                .get(auction_id)
-                .ok_or(FractionalError::AuctionNotFound)?;
+                let mut auction = self
+                    .dutch_auctions
+                    .get(auction_id)
+                    .ok_or(FractionalError::AuctionNotFound)?;
 
-            if auction.has_bids {
-                return Err(FractionalError::AuctionAlreadyBid);
-            }
+                if auction.has_bids {
+                    return Err(FractionalError::AuctionAlreadyBid);
+                }
 
-            let current_block = self.env().block_number() as u64;
-            let current_price = self.calculate_dutch_price(&auction, current_block);
-            let total_price = current_price.saturating_mul(auction.shares);
+                let current_block = self.env().block_number() as u64;
+                let current_price = self.calculate_dutch_price(&auction, current_block);
+                let total_price = current_price.saturating_mul(auction.shares);
 
-            if payment < total_price {
-                return Err(FractionalError::InsufficientPayment);
-            }
+                if payment < total_price {
+                    return Err(FractionalError::InsufficientPayment);
+                }
 
-            // Transfer shares from seller to buyer
-            let seller_held = self
-                .balances
-                .get((auction.seller, auction.token_id))
-                .unwrap_or(0);
-            self.balances.insert(
-                (auction.seller, auction.token_id),
-                &seller_held.saturating_sub(auction.shares),
-            );
+                // Transfer shares from seller to buyer
+                let seller_held = self
+                    .balances
+                    .get((auction.seller, auction.token_id))
+                    .unwrap_or(0);
+                self.balances.insert(
+                    (auction.seller, auction.token_id),
+                    &seller_held.saturating_sub(auction.shares),
+                );
 
-            let buyer_held = self.balances.get((caller, auction.token_id)).unwrap_or(0);
-            self.balances.insert(
-                (caller, auction.token_id),
-                &buyer_held.saturating_add(auction.shares),
-            );
+                let buyer_held = self.balances.get((caller, auction.token_id)).unwrap_or(0);
+                self.balances.insert(
+                    (caller, auction.token_id),
+                    &buyer_held.saturating_add(auction.shares),
+                );
 
-            // Mark auction as complete
-            auction.has_bids = true;
-            self.dutch_auctions.insert(auction_id, &auction);
+                // Mark auction as complete
+                auction.has_bids = true;
+                self.dutch_auctions.insert(auction_id, &auction);
 
-            // Pay the seller
-            if self.env().transfer(auction.seller, total_price).is_err() {
-                // Non-fatal: payment forwarding failed (e.g. in unit tests)
-            }
+                // Pay the seller
+                if self.env().transfer(auction.seller, total_price).is_err() {
+                    // Non-fatal: payment forwarding failed (e.g. in unit tests)
+                }
 
-            self.env().emit_event(DutchAuctionBid {
-                auction_id,
-                buyer: caller,
-                shares: auction.shares,
-                price_paid: total_price,
-            });
+                self.env().emit_event(DutchAuctionBid {
+                    auction_id,
+                    buyer: caller,
+                    shares: auction.shares,
+                    price_paid: total_price,
+                });
 
-            Ok(())
+                Ok(())
+            })
         }
 
         /// Cancel a Dutch auction (seller only, before any bid).