Merge pull request #7314 from brice-stacks/feat/unstake-during-prepare

fix: reject unstake-sbtc and announce-l1-early-exit during prepare

Author: brice-stacks

changelog.d/pox-wf-integration.changed

@@ -0,0 +1 @@
+Reject `unstake-sbtc` and `announce-l1-early-exit` calls during a prepare phase.

contrib/core-contract-tests/tests/pox-5/pox-5.test.ts

@@ -4436,6 +4436,104 @@ test('unstake is rejected when called during the prepare phase', () => {
   expect(result.value).toBe(errorCodes.ERR_UNSTAKE_IN_PREPARE_PHASE);
 });
 
+/**
+ * Regression for stacks-network/stacks-core#7295. `unstake-sbtc` mutates
+ * next-cycle bond / signer shares, and the next-cycle signer set is frozen
+ * during the current cycle's prepare phase. The other share-mutating
+ * entry-points (`stake`, `stake-update`, `register-for-bond`,
+ * `update-bond-registration`) all gate on `verify-not-prepare-phase`;
+ * `unstake-sbtc` previously side-stepped it. After the fix it returns
+ * `ERR_STAKE_IN_PREPARE_PHASE` mid-prepare and succeeds once the next
+ * cycle starts.
+ */
+test('unstake-sbtc is rejected during the prepare phase', () => {
+  const signer = testSigner.identifier;
+  const aliceSbtc = 100000n;
+  const unstakeAmount = 40000n;
+
+  registerSigner();
+  setupBondForAllowlist([{ maxSats: aliceSbtc, staker: alice }]);
+  txOk(
+    pox5.registerForBond({
+      bondIndex: 0n,
+      signerManager: signer,
+      amountUstx: stxToUStx(50_000),
+      btcLockup: err(aliceSbtc),
+      signerCalldata: null,
+    }),
+    alice,
+  );
+
+  // Cycle 0 prepare phase begins at (cycle-1-start - 10). Land mid-prepare.
+  mineUntil(rov(pox5.rewardCycleToBurnHeight(1n)) - 9n);
+  expect(rov(pox5.isInPreparePhase(rov(pox5.currentPoxRewardCycle())))).toBe(
+    true,
+  );
+
+  expect(
+    txErr(
+      pox5.unstakeSbtc({
+        signerManager: signer,
+        amountToWithdrawalSats: unstakeAmount,
+      }),
+      alice,
+    ).value,
+  ).toBe(pox5Errors.ERR_STAKE_IN_PREPARE_PHASE);
+
+  // Crossing into the next cycle clears the prepare phase: the same call
+  // now succeeds, confirming the guard was the sole blocker.
+  mineUntil(rov(pox5.rewardCycleToBurnHeight(1n)));
+  expect(rov(pox5.isInPreparePhase(rov(pox5.currentPoxRewardCycle())))).toBe(
+    false,
+  );
+  txOk(
+    pox5.unstakeSbtc({
+      signerManager: signer,
+      amountToWithdrawalSats: unstakeAmount,
+    }),
+    alice,
+  );
+});
+
+/**
+ * Regression for stacks-network/stacks-core#7295. `announce-l1-early-exit`
+ * also mutates next-cycle bond / signer shares (zeros the staker's
+ * `amount-sats`, debits `protocol-bonds-total-staked`, and rewrites the
+ * per-cycle bond-share maps via `remove-staker-from-bond-cycles`), so it
+ * must reject during the current cycle's prepare phase too. Simnet can't
+ * register a real L1-lock bond (fake burn header hashes fail
+ * `ERR_INVALID_BTC_HEADER`), so we exercise the guard on an sBTC bond:
+ * pre-fix the call falls through to `ERR_CANNOT_ANNOUNCE_L1_EARLY_UNLOCK`
+ * at the `is-l1-lock` assertion; post-fix the prepare-phase guard fires
+ * first.
+ */
+test('announce-l1-early-exit is rejected during the prepare phase', () => {
+  const signer = testSigner.identifier;
+  const aliceSbtc = 100000n;
+
+  registerSigner();
+  setupBondForAllowlist([{ maxSats: aliceSbtc, staker: alice }]);
+  txOk(
+    pox5.registerForBond({
+      bondIndex: 0n,
+      signerManager: signer,
+      amountUstx: stxToUStx(50_000),
+      btcLockup: err(aliceSbtc),
+      signerCalldata: null,
+    }),
+    alice,
+  );
+
+  mineUntil(rov(pox5.rewardCycleToBurnHeight(1n)) - 9n);
+  expect(rov(pox5.isInPreparePhase(rov(pox5.currentPoxRewardCycle())))).toBe(
+    true,
+  );
+
+  expect(txErr(pox5.announceL1EarlyExit(alice, signer), alice).value).toBe(
+    pox5Errors.ERR_STAKE_IN_PREPARE_PHASE,
+  );
+});
+
 /**
  * After the bond period ends, an sBTC bond participant should still be able to
  * retrieve their locked sBTC.

stackslib/src/chainstate/stacks/boot/pox-5.clar

@@ -675,6 +675,7 @@
             (stx-balance (stx-account tx-sender))
             (total-balance (+ (get locked stx-balance) (get unlocked stx-balance)))
         )
+        ;; Reject during the prepare phase since next-cycle data is mutated
         (try! (verify-not-prepare-phase))
         ;; Verify that they're sending enough STX
         (asserts!
@@ -836,6 +837,7 @@
             (amount-sats (get amount-sats current-membership))
             (num-cycles (- bond-end-cycle first-reward-cycle))
         )
+        ;; Reject during the prepare phase since next-cycle data is mutated
         (try! (verify-not-prepare-phase))
 
         ;; Check that the old signer is the current signer
@@ -967,6 +969,7 @@
             (stx-balance (stx-account tx-sender))
             (total-balance (+ (get locked stx-balance) (get unlocked stx-balance)))
         )
+        ;; Reject during the prepare phase since next-cycle data is mutated
         (try! (verify-not-prepare-phase))
 
         ;; Validate that the staker can join this signer
@@ -1081,6 +1084,7 @@
             (first-reward-cycle (+ current-cycle u1))
             (num-cycles (- unlock-cycle current-cycle u1))
         )
+        ;; Reject during the prepare phase since next-cycle data is mutated
         (try! (verify-not-prepare-phase))
 
         ;; Validate that the staker can join this signer
@@ -1182,6 +1186,9 @@
             (first-changed-reward-cycle (clamp current-cycle bond-start-cycle bond-end-cycle))
             (amount-sats (get amount-sats membership))
         )
+        ;; Reject during the prepare phase since next-cycle data is mutated
+        (try! (verify-not-prepare-phase))
+
         ;; ensure no reentrancy through signer-manager trait calls
         (try! (validate-no-reentrancy))
 
@@ -1256,6 +1263,9 @@
                 ERR_INVALID_UNSTAKE_SBTC_AMOUNT
             )))
         )
+        ;; Reject during the prepare phase since next-cycle data is mutated
+        (try! (verify-not-prepare-phase))
+
         ;; `signer-manager` must match the current signer
         (asserts! (is-eq (contract-of signer-manager) signer)
             ERR_INVALID_OLD_SIGNER_MANAGER