🐛 market: fix double-count in max supply check

[itofarina]

---

Summary by CodeRabbit

Release Notes

• Bug Fixes

  • Fixed the maximum supply validation in deposit logic that was incorrectly limiting deposits; deposits can now properly reach the maximum supply threshold.

• Tests

  • Added test coverage validating deposits are accepted when bringing total supply to the maximum limit.

[changeset-bot]

🦋 Changeset detected

Latest commit: 91c1048

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@exactly/protocol	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[coderabbitai]

Warning

Rate limit exceeded

@itofarina has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 46 minutes and 35 seconds before requesting another review.

Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 46 minutes and 35 seconds.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 5df25312-2ae6-4918-b71a-33903be8167c

📥 Commits

Reviewing files that changed from the base of the PR and between 4cedf4c and 91c1048.

📒 Files selected for processing (4)

• .changeset/busy-chicken-win.md
• .gas-snapshot
• contracts/Market.sol
• test/Market.t.sol

Walkthrough

A bugfix correction to market logic's maximum supply validation in the afterDeposit() function, changing from checking shares + totalSupply > maxSupply to only totalSupply > maxSupply, accompanied by a test case validating the corrected behavior and updated gas snapshots.

Changes

Cohort / File(s)	Summary
Changesets & Documentation .changeset/busy-chicken-win.md	Added changelog entry marking patch release for @exactly/protocol documenting the bugfix in market maximum supply logic.
Core Logic Fix contracts/Market.sol	Modified afterDeposit() to check only totalSupply > maxSupply instead of shares + totalSupply > maxSupply, removing the double-count of shares from the limit validation.
Test Coverage test/Market.t.sol	Added test_deposit_allowsDepositUpToMaxSupply() test validating that consecutive deposits can bring total supply exactly to the configured maximum.
Gas Snapshots .gas-snapshot	Updated gas consumption figures across multiple test suites (DebtRollerTest, InstallmentsRouterTest, IntegrationPreviewerTest, MarketTest, PreviewerTest, RewardsControllerTest, VerifiedMarketTest) reflecting changes from the logic modification.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Suggested reviewers

• cruzdanilo

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: fixing a double-count bug in the market's max supply check. It is specific, concise, and directly reflects the core modification in contracts/Market.sol.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix-max-supply

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[devin-ai-integration]

Devin Review found 1 potential issue.

[devin-ai-integration]

🚩 Treasury minting can push totalSupply above maxSupply

depositToTreasury(treasuryFee) at contracts/Market.sol:716 calls _mint(treasury, previewDeposit(fee)) (see contracts/MarketBase.sol:97), which increases totalSupply AFTER the max supply check at line 710. If a treasury fee is accrued during the deposit, the final totalSupply could exceed maxSupply. This is a pre-existing issue (the old code also checked before depositToTreasury), and treasury fees are typically small, but it means maxSupply is not a strict hard cap. Worth noting for protocol operators setting tight supply limits.

(Refers to line 716)

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[gemini-code-assist]

Code Review

This pull request fixes a bug in the Market contract where the max supply check was double-counting shares in the afterDeposit hook. The changes ensure that the check correctly accounts for the updated total supply, and a new test case has been added to verify this behavior. Feedback points out an opportunity to improve gas efficiency by moving the supply check to the beforeDeposit hook, which would avoid unnecessary asset transfers when the transaction is destined to revert.

[openzeppelin-code]

🐛 market: fix double-count in max supply check

Generated at commit: 91c104808a5ad547b95ecf102245a9199d8a42ad

🚨 Report Summary

	Severity Level	Results
Contracts	Critical High Medium Low Note Total	2 4 0 7 26 39
Dependencies	Critical High Medium Low Note Total	0 0 0 0 0 0

---

For more details view the full report in OpenZeppelin Code Inspector

[sentry]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.82%. Comparing base (048f54a) to head (91c1048).

Additional details and impacted files

@@           Coverage Diff            @@
##              ito     #801    +/-   ##
========================================
  Coverage   94.82%   94.82%            
========================================
  Files          31       31            
  Lines        2724     2724            
  Branches      354      457   +103     
========================================
  Hits         2583     2583            
  Misses        140      140            
  Partials        1        1            

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.