Security audit: fix all remaining findings before mainnet deployment

H-01: Fee now transferred to treasury instead of burned
  - Mint total-owed to receiver; burn only amount; transfer fee to treasury
  - Supply invariant updated: supply-after == supply-before + fee
  - New set-treasury / get-treasury admin functions added

H-03: All receivers now query fee dynamically from flashstack-core
  - example-arbitrage-receiver, collateral-swap-receiver, leverage-loop-receiver,
    liquidation-receiver, yield-optimization-receiver all updated
  - Eliminates desync when admin changes fee rate

L-01: Minimum fee of 1 sat enforced (prevents free flash loans on tiny amounts)
  - raw-fee computed, then floored to 1 if zero

L-02: set-fee now returns ERR-INVALID-AMOUNT (104) on out-of-range fee
  - Was incorrectly returning ERR-UNAUTHORIZED (102)

M-02: block-height is correct for Clarity 2 epoch 2.5
  - stacks-block-height not available until epoch 3.0; no change needed

M-03: DEX price setters in example-arbitrage-receiver restricted to CONTRACT-OWNER

I-02: Deleted incomplete flashstack-core-v2.clar from repo

All 86 tests passing

Author: Glory Matthew

contracts/collateral-swap-receiver.clar

@@ -12,11 +12,15 @@
 (define-constant ERR-SWAP-FAILED (err u501))
 (define-constant ERR-INSUFFICIENT-COLLATERAL (err u502))
 (define-constant ERR-REPAYMENT-FAILED (err u503))
+(define-constant ERR-FEE-FETCH-FAILED (err u504))
 
 ;; Main flash loan execution
 (define-public (execute-flash (amount uint) (borrower principal))
   (let (
-    (fee (/ (* amount u5) u10000))  ;; 0.05% FlashStack fee
+    ;; H-03 fix: query fee dynamically from core contract
+    (fee-bp (unwrap! (contract-call? .flashstack-core get-fee-basis-points) ERR-FEE-FETCH-FAILED))
+    (raw-fee (/ (* amount fee-bp) u10000))
+    (fee (if (> raw-fee u0) raw-fee u1))
     (total-owed (+ amount fee))
   )
     ;; Verify this is called by FlashStack

contracts/example-arbitrage-receiver.clar

@@ -7,6 +7,7 @@
 ;; Error Codes
 (define-constant ERR-ARBITRAGE-FAILED (err u200))
 (define-constant ERR-INSUFFICIENT-PROFIT (err u201))
+(define-constant ERR-FEE-FETCH-FAILED (err u202))
 
 ;; Simulated DEX prices for demo
 (define-data-var dex-a-price uint u1000000)
@@ -16,7 +17,10 @@
 ;; Receiver gets amount + fee, must return amount + fee
 (define-public (execute-flash (amount uint) (borrower principal))
   (let (
-    (fee (/ (* amount u5) u10000))
+    ;; H-03 fix: query fee dynamically from core contract
+    (fee-bp (unwrap! (contract-call? .flashstack-core get-fee-basis-points) ERR-FEE-FETCH-FAILED))
+    (raw-fee (/ (* amount fee-bp) u10000))
+    (fee (if (> raw-fee u0) raw-fee u1))
     (total-owed (+ amount fee))
   )
     ;; In production: Use the sBTC for arbitrage
@@ -57,16 +61,20 @@
   )
 )
 
-;; Admin functions for testing
+;; Admin-only price setters (M-03 fix: restricted to contract deployer)
+(define-constant CONTRACT-OWNER tx-sender)
+
 (define-public (set-dex-a-price (price uint))
   (begin
+    (asserts! (is-eq tx-sender CONTRACT-OWNER) ERR-ARBITRAGE-FAILED)
     (asserts! (> price u0) ERR-ARBITRAGE-FAILED)
     (ok (var-set dex-a-price price))
   )
 )
 
 (define-public (set-dex-b-price (price uint))
   (begin
+    (asserts! (is-eq tx-sender CONTRACT-OWNER) ERR-ARBITRAGE-FAILED)
     (asserts! (> price u0) ERR-ARBITRAGE-FAILED)
     (ok (var-set dex-b-price price))
   )

contracts/flashstack-core-v2.clar

@@ -39,9 +39,12 @@
 ;; Whitelist for approved receiver contracts
 (define-map approved-receivers principal bool)
 
-;; Per-block volume tracking
+;; Per-block volume tracking (uses block-height - M-02 fix)
 (define-map block-loan-volume uint uint)
 
+;; Treasury address for collected fees (H-01 fix)
+(define-data-var treasury principal tx-sender)
+
 ;; Collateral ratio: 300% = 3x leverage max
 (define-constant MIN-COLLATERAL-RATIO u300)
 
@@ -82,7 +85,10 @@
     (locked-stx (get-stx-locked borrower))
     (min-required (/ (* amount MIN-COLLATERAL-RATIO) u100))
     (receiver-principal (contract-of receiver))
-    (fee (/ (* amount (var-get flash-fee-basis-points)) u10000))
+    ;; L-01 fix: enforce minimum fee of 1 sat to prevent free flash loans
+    (raw-fee (/ (* amount (var-get flash-fee-basis-points)) u10000))
+    ;; L-01 fix: enforce minimum fee of 1 sat to prevent free flash loans on tiny amounts
+    (fee (if (> raw-fee u0) raw-fee u1))
     (total-owed (+ amount fee))
   )
     ;; ===== SECURITY CHECKS =====
@@ -99,7 +105,7 @@
     ;; Circuit breaker: Check single loan limit
     (asserts! (<= amount (var-get max-single-loan)) ERR-LOAN-TOO-LARGE)
 
-    ;; Circuit breaker: Check block volume limit
+    ;; Circuit breaker: Check block volume limit (M-02: use block-height)
     (let (
       (current-block-volume (default-to u0 (map-get? block-loan-volume block-height)))
       (new-block-volume (+ current-block-volume amount))
@@ -124,15 +130,27 @@
       ;; Execute callback
       (match (contract-call? receiver execute-flash amount borrower)
         success (begin
-            ;; Burn the returned tokens to complete the cycle
-            (try! (as-contract (contract-call? .sbtc-token burn total-owed tx-sender)))
-
-            ;; Verify supply invariant: total supply must equal pre-mint level,
-            ;; proving the exact minted amount was burned (not satisfied via pre-existing tokens)
+            ;; H-01 fix: Burn only the principal (amount), not the fee.
+            ;; The receiver returns total-owed to this contract; we burn
+            ;; only amount and transfer the fee to treasury.
+            (try! (as-contract (contract-call? .sbtc-token burn amount tx-sender)))
+
+            ;; Transfer fee to treasury (H-01: protocol earns the fee)
+            (try! (as-contract (contract-call? .sbtc-token transfer
+              fee
+              tx-sender
+              (var-get treasury)
+              (some 0x464c415348)
+            )))
+
+            ;; Verify supply invariant: supply must have decreased by exactly amount
+            ;; (amount burned + fee still exists in treasury, so supply-after = supply-before + fee)
+            ;; The invariant we enforce: supply-after == supply-before + fee
+            ;; This proves amount was burned and fee was not destroyed.
             (let (
               (supply-after (unwrap! (contract-call? .sbtc-token get-total-supply) ERR-REPAY-FAILED))
             )
-              (asserts! (is-eq supply-after supply-before) ERR-REPAY-FAILED)
+              (asserts! (is-eq supply-after (+ supply-before fee)) ERR-REPAY-FAILED)
 
               (var-set total-flash-mints (+ (var-get total-flash-mints) u1))
               (var-set total-volume (+ (var-get total-volume) amount))
@@ -204,11 +222,23 @@
 (define-public (set-fee (new-fee-bp uint))
   (begin
     (asserts! (is-eq contract-caller (var-get admin)) ERR-UNAUTHORIZED)
-    (asserts! (<= new-fee-bp u100) ERR-UNAUTHORIZED)
+    ;; L-02 fix: use ERR-INVALID-AMOUNT for fee validation (not ERR-UNAUTHORIZED)
+    (asserts! (<= new-fee-bp u100) ERR-INVALID-AMOUNT)
     (ok (var-set flash-fee-basis-points new-fee-bp))
   )
 )
 
+(define-public (set-treasury (new-treasury principal))
+  (begin
+    (asserts! (is-eq contract-caller (var-get admin)) ERR-UNAUTHORIZED)
+    (ok (var-set treasury new-treasury))
+  )
+)
+
+(define-read-only (get-treasury)
+  (ok (var-get treasury))
+)
+
 (define-public (set-admin (new-admin principal))
   (begin
     (asserts! (is-eq contract-caller (var-get admin)) ERR-UNAUTHORIZED)

contracts/flashstack-core.clar

@@ -14,14 +14,18 @@
 (define-constant ERR-DEPOSIT-FAILED (err u503))
 (define-constant ERR-BORROW-FAILED (err u504))
 (define-constant ERR-REPAYMENT-FAILED (err u505))
+(define-constant ERR-FEE-FETCH-FAILED (err u506))
 
 ;; Maximum leverage allowed (in basis points, 30000 = 3x)
 (define-constant MAX-LEVERAGE-BP u30000)
 
 ;; Main flash loan execution for leverage
 (define-public (execute-flash (amount uint) (borrower principal))
   (let (
-    (fee (/ (* amount u5) u10000))  ;; 0.05% FlashStack fee
+    ;; H-03 fix: query fee dynamically from core contract
+    (fee-bp (unwrap! (contract-call? .flashstack-core get-fee-basis-points) ERR-FEE-FETCH-FAILED))
+    (raw-fee (/ (* amount fee-bp) u10000))
+    (fee (if (> raw-fee u0) raw-fee u1))
     (total-owed (+ amount fee))
   )
     ;; Verify this is called by FlashStack

contracts/leverage-loop-receiver.clar

@@ -13,14 +13,18 @@
 (define-constant ERR-INSUFFICIENT-PROFIT (err u502))
 (define-constant ERR-REPAYMENT-FAILED (err u503))
 (define-constant ERR-MOCK-ERROR (err u999))
+(define-constant ERR-FEE-FETCH-FAILED (err u504))
 
 ;; Example liquidation parameters
 (define-data-var liquidation-bonus-bp uint u1000) ;; 10% liquidation bonus
 
 ;; Main flash loan execution
 (define-public (execute-flash (amount uint) (borrower principal))
   (let (
-    (fee (/ (* amount u5) u10000))  ;; 0.05% FlashStack fee
+    ;; H-03 fix: query fee dynamically from core contract
+    (fee-bp (unwrap! (contract-call? .flashstack-core get-fee-basis-points) ERR-FEE-FETCH-FAILED))
+    (raw-fee (/ (* amount fee-bp) u10000))
+    (fee (if (> raw-fee u0) raw-fee u1))
     (total-owed (+ amount fee))
     (liquidation-bonus (/ (* amount (var-get liquidation-bonus-bp)) u10000))
     (expected-profit (- liquidation-bonus fee))

contracts/liquidation-receiver.clar

@@ -13,11 +13,15 @@
 (define-constant ERR-COMPOUND-FAILED (err u502))
 (define-constant ERR-REPAYMENT-FAILED (err u503))
 (define-constant ERR-STRATEGY-FAILED (err u504))
+(define-constant ERR-FEE-FETCH-FAILED (err u505))
 
 ;; Main flash loan execution for yield optimization
 (define-public (execute-flash (amount uint) (borrower principal))
   (let (
-    (fee (/ (* amount u5) u10000))  ;; 0.05% FlashStack fee
+    ;; H-03 fix: query fee dynamically from core contract
+    (fee-bp (unwrap! (contract-call? .flashstack-core get-fee-basis-points) ERR-FEE-FETCH-FAILED))
+    (raw-fee (/ (* amount fee-bp) u10000))
+    (fee (if (> raw-fee u0) raw-fee u1))
     (total-owed (+ amount fee))
   )
     ;; Verify this is called by FlashStack

contracts/yield-optimization-receiver.clar

@@ -175,7 +175,7 @@ describe("FlashStack Core - Comprehensive Test Suite", () => {
           [Cl.uint(101)],
           deployer
         );
-        expect(result).toBeErr(Cl.uint(102)); // ERR-UNAUTHORIZED
+        expect(result).toBeErr(Cl.uint(104)); // ERR-INVALID-AMOUNT (L-02 fix)
       });
 
       it("can set fee to maximum (1%)", () => {

tests/flashstack-comprehensive.test.ts

@@ -159,8 +159,8 @@ describe("FlashStack Core Tests", () => {
       [Cl.uint(101)], // Above 1% max (100 basis points)
       deployer
     );
-    // Contract returns ERR-UNAUTHORIZED (102) for invalid fee
-    expect(result).toBeErr(Cl.uint(102));
+    // L-02 fix: now returns ERR-INVALID-AMOUNT (104) for invalid fee, not ERR-UNAUTHORIZED
+    expect(result).toBeErr(Cl.uint(104));
   });
 
   it("gets protocol statistics", () => {

tests/flashstack-core_test.ts

@@ -106,7 +106,11 @@ describe("FlashStack - Edge Cases & Integration", () => {
       expect(stats["total-fees-collected"].value).toBe(50000n); // 5bp fee
     });
 
-    it("maintains zero sBTC supply after flash mint (mint-burn cycle)", () => {
+    it("supply increases by exactly fee after flash mint (H-01: fee kept in treasury)", () => {
+      const amount = 100000000; // 1 sBTC
+      const feeBp = 5n;
+      const expectedFee = (BigInt(amount) * feeBp) / 10000n; // 5000 sats
+
       const { result: supplyBefore } = simnet.callReadOnlyFn(
         "sbtc-token",
         "get-total-supply",
@@ -117,7 +121,7 @@ describe("FlashStack - Edge Cases & Integration", () => {
       simnet.callPublicFn(
         "flashstack-core",
         "flash-mint",
-        [Cl.uint(100000000), Cl.principal(`${deployer}.test-receiver`)],
+        [Cl.uint(amount), Cl.principal(`${deployer}.test-receiver`)],
         wallet1
       );
 
@@ -128,8 +132,11 @@ describe("FlashStack - Edge Cases & Integration", () => {
         deployer
       );
 
-      // Supply should be identical — minted tokens were burned
-      expect(supplyAfter).toBeOk(supplyBefore.value);
+      // H-01 fix: only principal is burned; fee remains in treasury.
+      // supply-after = supply-before + fee
+      const beforeVal = (supplyBefore as any).value.value;
+      const afterVal = (supplyAfter as any).value.value;
+      expect(afterVal - beforeVal).toBe(expectedFee);
     });
   });