fix(wasm): lockup eligibility queries count withdrawn locks for incentives

[Unique-Divine]

Summary

External report (gist) shows that lockup eligibility queries can return locks that are already withdrawn or no longer actively locked, and incentives uses those query results for epoch accounting and WithdrawRewards.

Code lives in NibiruChain/nibiru-wasm; tracked from this repo for visibility.

Severity / triage

• Priority: p3 — utility reference contract correctness
• Nibiru does not deploy or operate lockup / incentives for funded protocol incentive programs (per support ticket #833-daniel526, 2026-07-10)
• Still worth fixing so reference code is correct if third parties copy or deploy it

Production context

From contracts/README.md:

• lockup and incentives are Utility reference building blocks, not core-* production contracts
• Nibiru uses core-* contracts where Wasm is part of production infrastructure (e.g. Treasury / Hot Wallet multisigs)

Problem

LocksByDenomBetween and LocksByDenomAndAddressBetween filter with:

env.block.height + lock.duration_blocks > unlocking_after

They do not:

• exclude lock.funds_withdrawn == true
• use the lock's actual end_block lifecycle state

incentives consumes these queries in execute_process_epoch and execute_withdraw_rewards, so withdrawn locks can still count toward total_locked and reward payouts.

Affected code

• lockup/src/contract.rs — query filters (~L244–246, ~L267–269)
• incentives/src/contract.rs — epoch processing and reward withdrawal

Proposed fix

1. Exclude withdrawn locks: !lock.funds_withdrawn
2. Use actual lifecycle in eligibility checks (end_block / NOT_UNLOCKING_BLOCK_IDENTIFIER) instead of current_height + original_duration
3. Add or adapt integration regression test (gist provides withdrawn_lock_can_still_receive_incentive_rewards)

Acceptance criteria

• Lockup query filters exclude withdrawn locks
• Eligibility uses real end_block state
• Integration test proves withdrawn lock no longer receives rewards after fix
• README note under Utility contracts: reference-only, not production-operated by Nibiru

Out of scope

• Auditing third-party mainnet deployments unless reporter supplies contract addresses
• nibi-stargate example contract docs (see docs(wasm): warn that nibi-stargate example is non-production and permissionless #2683)

[Unique-Divine]

External reproduction (gist)

Source: @Odhiambo526 — Discord ticket #833-daniel526, 2026-06-03.

Vulnerable query filters

// LocksByDenomBetween
.filter(|lock| -> bool {
    env.block.height + lock.duration_blocks > unlocking_after
})

// LocksByDenomAndAddressBetween
.filter(|lock| -> bool {
    lock.duration_blocks + env.block.height > unlocking_after
})

Missing checks:

lock.end_block > unlocking_after
!lock.funds_withdrawn

Links:

• lockup/contract.rs#L244-L246
• lockup/contract.rs#L267-L269

Integration test (reporter)

#[test]
fn withdrawn_lock_can_still_receive_incentive_rewards() -> TestResult {
    // Alice locks 100 NIBI_LP, creates/funds incentives program
    // Alice initiates unlock, waits lock_blocks, withdraws funds
    // Lock query still returns lock with funds_withdrawn == true
    // ProcessEpoch stores total_locked == 100
    // WithdrawRewards pays 200 ATOM
    // ...
    assert_eq!(qualified_locks.len(), 1);
    assert!(qualified_locks[0].funds_withdrawn);
    assert_eq!(epoch_info.total_locked, Uint128::new(100));
    assert_eq!(atom_balance, Coin::new(200u128, "ATOM"));
    Ok(())
}

Reporter test output

cargo test -p incentives withdrawn_lock_can_still_receive_incentive_rewards -- --nocapture

running 1 test
[Lock { id: 1, coin: Coin { 100 "NIBI_LP" }, ..., funds_withdrawn: true }]
qualified locked amount: Uint128(100), 12395
distributing: [Coin { 200 "ATOM" }]
test testing::integration_test::withdrawn_lock_can_still_receive_incentive_rewards ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 5 filtered out

Suggested mitigation (from reporter)

Update the lockup eligibility queries to include only locks whose actual lifecycle satisfies the qualification condition by requiring !lock.funds_withdrawn and lock.end_block > unlocking_after or lock.end_block == NOT_UNLOCKING_BLOCK_IDENTIFIER where appropriate, instead of using env.block.height + lock.duration_blocks > unlocking_after.

Reporter framing vs triage

Reporter labeled this HIGH for funded incentive programs. We accept the logic bug in the utility reference contracts. For Nibiru ops this is p3 because these contracts are not deployed or operated for protocol incentive programs. Fix is still warranted for reference correctness.