[Audit M-08] Bonding asset rotation can strand or mis-account outstanding balances

[hmzakhalid]

Finding

Severity: Medium

Confirmed against baseline commit d4277510d. The bonding token could be rotated while balances and liabilities denominated in the previous asset remained outstanding.

Full audit report

Required remediation

Gate bonding-asset rotation until all old-asset balances, exits, reservations, and liabilities are cleared.

The dedicated fixing commit and remediation PR will be linked in a follow-up comment.

[hmzakhalid]

Fixed by commit fe2e1c11677f7821d2fd39d103d8fc835c742683 in PR #1727.

[hmzakhalid]

Supersedes the earlier remediation reference after the cleanup of PR #1727. Fixed by commit 4669254 (M-08): bonding asset rotation is blocked until old liabilities are drained.

[hmzakhalid]

Confirmed fixed in final commit df5c580. Rotation is fail-closed until old ticket supply/payables or the registry old-licence-token balance are fully drained. This deliberately means unsolicited licence-token dust must be cleared before rotation.

[hmzakhalid]

Final remediation in PR #1727: df5c580 gates bonding-asset rotation until old liabilities drain, and f4c9ba9 permits sweeping only donated licence-token surplus so dust cannot permanently block rotation.