[Confidential Transfer Extension] `Available Balance` Can Be Overwritten If `ConfidentialTransferInstruction::Deposit` And `ConfidentialTransferInstruction::ApplyPendingBalance` Are Submitted In The Same Transaction

[bonedaddy]

Overview

If a transaction is submitted which contains a ConfidentialTransferInstruction::Deposit instruction 1, and ConfidentialTransferInstruction::ApplyPendingBalance instruction 2, then the relationship between Available Balance and Decryptable Available Balance is corrupted, resulting in "lost" funds.

I'm not sure if the funds are truly lost, however the amount of tokens that were deposited in ConfidentialTransferInstruction::Deposit are deducted from the token account's non confidential balance, but subsequently not made available as the confidential balance.

For example if your non confidential balance is 100, and you submit tx1 which contains a ConfidentialTransferInstruction::Deposit instruction for 10 tokens, and a ConfidentialTransferInstruction::ApplyPendingBalance, once the transaction is finalized your non confidential balance will now be 90.

If you then submit tx2 which contains a ConfidentialTransferInstruction::Withdraw for 10 tokens, the transaction will fail with an error InsufficientFunds.

If however you broke tx1 into two separate transactions:

• tx1 with ConfidentialTransferInstruction::Deposit
• tx2 with ConfidentialTransferInstruction::ApplyPendingBalance
• tx3 with ConfidentialTransferInstruction::Withdraw

You will succesfully be able with withdraw the 10 tokens that were deposited.

[samkim-crypto]

Thanks for reporting! My guess is that the decryptable balance is not updated properly when the ApplyPendingBalance instruction is generated, but I will need to double check this:

Let's look at the first example, where tx1 contains both Deposit and ApplyPendingBalance instructions,. Let's assume for simplicity that both confidential transfer pending and available balance is 0 to begin with. When ApplyPendingBalance instruction is generated, it will look up the current confidential transfer (pending) balance and see that it currently has balance 0. So it will encrypt(0) and overwrite the decryptable available balance with this ciphertext without knowing that a Deposit instruction prepends it in the same tx. The available balance should still contain 10 tokens that were deposited.

Now, when the Withdraw instruction is generated, it will look up the current decryptable balance and see that the current withdrawable balance is 0, but it is trying to withdraw 10, and so return an InsufficientFunds error at the client level.

This is my initial guess at what is happening. To confirm, does the InsufficientFunds error happening when you are generating the Withdraw instruction at the client side? Or is this error actually happening at the program execution level?

If this is indeed the case, then this seems to be mainly an issue with the inflexibility of the rust token client interface for generating the instructions.

[bonedaddy]

Let's look at the first example, where tx1 contains both Deposit and ApplyPendingBalance instructions,. Let's assume for simplicity that both confidential transfer pending and available balance is 0 to begin with. When ApplyPendingBalance instruction is generated, it will look up the current confidential transfer (pending) balance and see that it currently has balance 0. So it will encrypt(0) and overwrite the decryptable available balance with this ciphertext without knowing that a Deposit instruction prepends it in the same tx. The available balance should still contain 10 tokens that were deposited.

Yea that does seem to be correct.

This is my initial guess at what is happening. To confirm, does the InsufficientFunds error happening when you are generating the Withdraw instruction at the client side? Or is this error actually happening at the program execution level?

It happens client side during generation of the proof data.

If this is indeed the case, then this seems to be mainly an issue with the inflexibility of the rust token client interface for generating the instructions.

What would be the steps to recover the tokens in this scenario? I've taken a look at the various instructions available with confidential transfers, and don't see anything that can be used, however this is my first time working with this token extension so I may be overlooking something.

--

I have some working code that can be ran to demonstrate the issue

In terminal 1 run:

$> git clone https://github.com/rangesecurity/confidential-blink-api.git
$> cd confidential-blink-api
$> git checkout bug
$> make test-validator

Once the test validator is up and running, In terminal 2 run this command from the confidential-blink-api folder (takes around 90-120 seconds to complete):

$> cargo test tests::test_withdraw::test_withdraw -- --nocapture --show-output

This line should be displayed on the terminal which comes from the call attempting to withdraw tokens and shows the pending balance of 0, and available balance of 200

pending_balance(0) non_confidential_balance(999800) decrypted_available_balance 0, available_balance 200

Code responsible for generating the data used to output that message https://github.com/rangesecurity/confidential-blink-api/blob/99bfe31c526e00720710ae8ff8ca143ebfe32827/crates/api/src/handlers/withdraw.rs#L212-L274