[devin-ai-integration]

Summary

Note

Lend orders can park funds in Blue idle markets, so integrators need to distinguish harmless share-price changes from losses. These tests exercise the actual Midnight bundle with no collateral or interest and reproduce a one-smallest-token-unit attacker profit after three dust parking round trips. This is accounting evidence, not a demonstrated gas-profitable exploit.

Context

Direct token donations do not change Blue's recorded market assets. However, share-denominated supplies round assets up, and full-share withdrawals round assets down; no interest is needed to move the conversion rate.

Concrete sequence, in smallest token units:

Attacker: supply 999,999 raw shares -> pay 1 asset unit
Lender:   park 1, redeem all shares -> receive 0 (repeat 3 times)
Attacker: redeem all shares        -> receive 2 asset units
Result:  attacker +1 before gas; lender -3; virtual shares retain 2

Impact of merging

Maintainers gain executable evidence for evaluating idle-market parking safeguards. This is test-only: contracts, deployments and SDK guards remain unchanged.

Special things to note

The positive-profit case depends on repeated one-unit victim round trips; the attacker does not control the lender. One unit would be 0.000001 USDC for a six-decimal token. No general immunity or economically viable attack is established. The tests call the contract directly and do not exercise SDK validation.

Change outline

• One behavior-characterization unit on main, no parent PR: measure actual token balances after idle-market parking and redemption.
• Cover donation accounting, fuzzed single-cycle rounding in both exit orders, and deterministic repeated-dust profit together as evidence for the same economic question.

Evidence

• forge test --match-contract MidnightBundlesV2MakerTest --match-test testIdleMarket -vv: 3 passed, including 256 fuzz runs.
• Single-cycle fuzz bounds: attacker starts with 1–1,000,000 shares costing one asset unit; lender parks 1–1,000e18 units. No attacker profit, lender loss at most one unit in this tested family.
• Test-file lint, repository formatting and diff whitespace checks passed. Broader checks pending.

Link to Devin session: https://app.devin.ai/sessions/046b7521e4914cb6b6963a03528c9d72
Open in Devin Desktop: https://app.devin.ai/desktop/session/046b7521e4914cb6b6963a03528c9d72?variant=devin

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-30T16:53:42.058868Z	95a6c3b	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.