FLO-10: asyncUpdate Single Position Revert Blocks Entire Batch

[liobrasil]

Severity: Medium

Files Affected

• cadence/contracts/FlowALPv1.cdc

Description

asyncUpdate() processes queued positions sequentially in a single transaction: Inside asyncUpdatePosition() calls are made to topUpSource.withdrawAvailable() and drawDownSink.depositCapacity() where both are external contracts configured by position owners. If any of these calls panic, the entire asyncUpdate transaction reverts, rolling back all previously processed positions in the batch. A single malicious or buggy source/sink can indefinitely block all queued positions from being processed. Since positions are re-queued, the malicious position will repeatedly appear in the queue, blocking every batch. The contract has a TODO acknowledging this should be fixed.

Recommendation

Wrap each asyncUpdatePosition call in a try/catch (or schedule each as a separate callback as the TODO suggests), so that one position's failure doesn't prevent other positions from being processed. Additionally, consider removing a position from the queue after repeated failures to prevent permanent blocking.

---

Parent Issue: #209