Fluid DEX v2: Stored payouts had no usable recovery route

Summary

Fluid’s settlement fallback was intended to preserve money owed when a payout could not complete. The review found that a recorded credit could remain inaccessible to its recipient, defeating the purpose of that recovery mechanism.

Root cause

The rules for recording an unpaid balance did not match the rules for redeeming it. The system could recognize that a recipient was owed tokens without giving that recipient a usable way to claim them.

Attack scenario

The reported failure could arise during ordinary withdrawals, borrowing, or fee collection. A payout problem could become a lasting loss of access, even as the surrounding operation continued and updated its records.

Impact

Affected users could lose access to withdrawal proceeds, borrowed funds, or earned fees. A recorded balance would not provide practical recovery, and completed bookkeeping could make simply retrying the original operation insufficient.

Fix recommendation

Align credit ownership with redemption permissions and give intended recipients a tested recovery route. Verify that failed payouts remain recoverable across supported account types. The public report does not establish a completed fix for this finding.