Nomination pools payout bug report. 0622 Update: New Findings

[Acaishiba]

When I was performing the payout operation on the nomination pools, I mistakenly used another account to execute staking (payout_stakers). The transaction was successful, but I noticed that the rewards were not transferred to the pool's Reward account as expected.

After conducting an investigation, I have discovered that when sending a payout request using a non-administrative account, the rewards are erroneously directed to the stash account instead of the reward account.

My pools:#88 stash account: 13UVJyLnbVp8c4FQeiGJACqjZ67DNHxD4FLZnpnzrVy16xRx reward account: 13UVJyLnbVp8c4FQeiGZuEPKfanQpr45nvH5LmUqKKqjNQSy

payout hash:0xd3ae7106ad19791d2db3707c5fe1159a41b6604c432f66468007d5b5ce321b47 validator_stash : 13Q48Ep3PVpvXA1BeVcUhNJerLshsaeq4EdgPUHnemqJYmND era :1107

TX code:

[
  {
    type: "docs",
    value: "The nominator has been rewarded by this amount."
  },
  {
    type: "params",
    value: [
      {
        type: "[U8; 32]",
        type_name: "AccountId",
        value: "0x6d6f646c70792f6e6f706c730058000000000000000000000000000000000000",
        name: "stash"
      },
      {
        type: "U128",
        type_name: "BalanceOf",
        value: "38683866782",
        name: "amount"
      }
    ]
  }
]

[bkchr]

CC @rossbulat

[Acaishiba]

If I directly send DOT to the rewards account, will pool members receive a proportionate share of these DOT?

[rossbulat]

I have discovered that when sending a payout request using a non-administrative account, the rewards are erroneously directed to the stash account instead of the reward account.

Thank you for raising this. I think first port of call is to write a test for this, if we have not a similar one in place now, and reproduce the behaviour.

If I directly send DOT to the rewards account, will pool members receive a proportionate share of these DOT?

Yes, that is what would happen. The balance of the reward pool is applied to a reward counter mechanism, that takes this raw balance of the RewardPool and factors the pool points to get the final reward amount owed.

But ultimately I believe sending DOT to reward pools is effectively sponsoring all members in the pool. The amount each member could claim would be based on their share of the pool points.

[Acaishiba]

But ultimately I believe sending DOT to reward pools is effectively sponsoring all members in the pool. The amount each member could claim would be based on their share of the pool points.

Thank you for your reply. As my pool members suffered a loss in rewards due to this bug, I would like to prioritize the members' interests by directly sending DOT to the pool88 reward account to compensate for their rewards.

By the way, I triggered this bug by using the staking payout section in polkadotJS. When it showed that I could perform a payout, I simply used another imported account to send a transaction and it triggered the bug. I haven't tried sending a transaction directly through the Extrinsics section, so I'm not sure if it would trigger in other scenarios.

[Acaishiba]

I've noticed that the bug has occurred again, and what's different this time is that I didn't perform any actions, yet it still happened. So if my speculation is correct, it means that unrelated accounts can trigger this bug.

I have noticed that other pool stash accounts are also experiencing this bug.

etc.

[rossbulat]

By the way, I triggered this bug by using the staking payout section in polkadotJS. When it showed that I could perform a payout, I simply used another imported account to send a transaction and it triggered the bug. I haven't tried sending a transaction directly through the Extrinsics section, so I'm not sure if it would trigger in other scenarios.

So the pool's reward account is passed to StakingInterfaces bond call as the pool is created (see code here) - so regardless of who is triggering a payout, the rewards should always go to this provided address.

The payee for the pool stash is indeed still the pool reward account (13UVJyLnbVp8c4FQeiGZuEPKfanQpr45nvH5LmUqKKqjNQSy). So the chain state is correct. This is the value that payout_stakers refers to when sending funds to the nominators.

So it is not obvious at all why 13UVJyLnbVp8c4FQeiGJACqjZ67DNHxD4FLZnpnzrVy16xRx has received rewards.

• Has 13UVJyLnbVp8c4FQeiGJACqjZ67DNHxD4FLZnpnzrVy16xRx been mistakenly set as a payee from another stash?
• Query erasStakers at eras 1112 and 1107 to see if the pool stash was active in others. If it was not then another nominator had the pool reward account as the payee.

[Acaishiba]

Has 13UVJyLnbVp8c4FQeiGJACqjZ67DNHxD4FLZnpnzrVy16xRx been mistakenly set as a payee from another stash?

I believe No one has set 13UVJyLnbVp8c4FQeiGJACqjZ67DNHxD4FLZnpnzrVy16xRx as the payee.

Query erasStakers at eras 1112 and 1107 to see if the pool stash was active in others. If it was not then another nominator had the pool reward account as the payee.

I was observing during that period, and I can confirm that pool88 has been consistently active. Its nominees were always the same as the nominees of my other account.

I have compiled the stash account information for a total of 139 pools, and among them, 23 stash accounts have shown abnormal rewards. One common observation is that the era in which the rewards occurred in their stash account often corresponds to the era in which the rewards were missing for the respective rewards accounts. Below is a list showing the specific pool stash accounts and era numbers:

Pool2 stash: 13UVJyLnbVp8c4FQeiGCsV63YihAstUrqj3AGcK7gaj8eubS era:1113 Pool8 stash: 13UVJyLnbVp8c4FQeiGDEtEVGZPxusRNaQvHJiaYqNFmtnwd era:1118 Pool13 stash: 13UVJyLnbVp8c4FQeiGDYiXC36KHwXCoMepYqUU5TgrybNzB era:1110, 1108 Pool16 stash: 13UVJyLnbVp8c4FQeiGDjR6Qu1fgxWg4Dzm7MXbo35dJDZiH era:1110 Pool20 stash: 13UVJyLnbVp8c4FQeiGDygXNiEoYyqJQ3ngXNw7R8wK4NfqE era:1110 Pool25 stash: 13UVJyLnbVp8c4FQeiGEHWp5Umit1V5pq2anugzwmFvG5JCG era:1112 Pool26 stash: 13UVJyLnbVp8c4FQeiGEM5fpS5WM1pEunUZeR3NrHiqhcdTc era:1111 Pool27 stash: 13UVJyLnbVp8c4FQeiGEQeXZPPHp29PzjvYVvPkkpBm99qYr era:1110 Pool33 stash: 13UVJyLnbVp8c4FQeiGEn3g17Dzc48LWUcRcxW2BxyHnPuv3 era:1110 Pool34 stash: 13UVJyLnbVp8c4FQeiGEqcXk4Xn54TVbS4QUTrQ6VSDDwA9c era:1110 Pool44 stash: 13UVJyLnbVp8c4FQeiGFTH79bbcj7m4SzYD1XNB9k5RdLg3u era:1110 Pool50 stash: 13UVJyLnbVp8c4FQeiGFpgFbKSKX9jzxjE68ZUSatrxGabsc era:1110 Pool62 stash: 13UVJyLnbVp8c4FQeiGGZUYUm7j7DhszCbrNdgyTCS1Z4HZw era:1110 Pool64 stash: 13UVJyLnbVp8c4FQeiGGgcFxfjJ3ENCA7Vp5ePjGFMrS9FAL era:1110 Pool80 statsh: 13UVJyLnbVp8c4FQeiGHffyovdqVKehXQfVjk1mkenbUnFDK era:1115 Pool88 stash: 13UVJyLnbVp8c4FQeiGJACqjZ67DNHxD4FLZnpnzrVy16xRx era:1107, 1112 Pool91 stash: 13UVJyLnbVp8c4FQeiGJLuQxR1TcPHRTvbH8JsviRtjKizh8 era:1110 Pool92 stash: 13UVJyLnbVp8c4FQeiGJQUGhNKF5PcaYt3FypEJcxMemG9bB era:1112 Pool102 stash: 13UVJyLnbVp8c4FQeiGK28r6uP5jSv9QSX4Wsk5gCzsAfVMC era:1113 Pool108 stash: 13UVJyLnbVp8c4FQeiGKPXzYdDnXUu5vBCwdurM7MnPouQgU era:1112 Pool115 stash: 13UVJyLnbVp8c4FQeiGKpVzjJNGnXDBWsLocTJzT32qtghfT era:1111 Pool130 stash: 13UVJyLnbVp8c4FQeiGLjzrqby2mcAXoD4WR3af2uzfVngja era:1107 Pool133 stash: 13UVJyLnbVp8c4FQeiGLvhS4TtPAdA145QSyZdnkVPRpQY8E era:1107, 1112

There is the same issue with Kusama. for example: Pool1 stash: F3opxRbN5ZavB4LTn2FZim9tPCHyvapGAAZzdDp5pzfg3sy era:5054, 5093, 5102, 5151

[Acaishiba]

So the pool's reward account is passed to StakingInterfaces bond call as the pool is created (see code here) - so regardless of who is triggering a payout, the rewards should always go to this provided address.

By the way, can you help me identify where the payout code is? I'd like to take a look at it when I have some free time.

[frankwolfman]

H

When I was performing the payout operation on the nomination pools, I mistakenly used another account to execute staking (payout_stakers). The transaction was successful, but I noticed that the rewards were not transferred to the pool's Reward account as expected.

After conducting an investigation, I have discovered that when sending a payout request using a non-administrative account, the rewards are erroneously directed to the stash account instead of the reward account.

My pools:#88 stash account: 13UVJyLnbVp8c4FQeiGJACqjZ67DNHxD4FLZnpnzrVy16xRx reward account: 13UVJyLnbVp8c4FQeiGZuEPKfanQpr45nvH5LmUqKKqjNQSy

payout hash:0xd3ae7106ad19791d2db3707c5fe1159a41b6604c432f66468007d5b5ce321b47 validator_stash : 13Q48Ep3PVpvXA1BeVcUhNJerLshsaeq4EdgPUHnemqJYmND era :1107

TX code:

[
  {
    type: "docs",
    value: "The nominator has been rewarded by this amount."
  },
  {
    type: "params",
    value: [
      {
        type: "[U8; 32]",
        type_name: "AccountId",
        value: "0x6d6f646c70792f6e6f706c730058000000000000000000000000000000000000",
        name: "stash"
      },
      {
        type: "U128",
        type_name: "BalanceOf",
        value: "38683866782",
        name: "amount"
      }
    ]
  }
]

Hey there Quick question for you. I transferred some Polka Dot into the first pool you mentioned a couple months ago and cannot find that pool anywhere. This is the only lead I have at the moment to find my missing Polka Dot.

Here's the wallet address in question.

13UVJyLnbVp8c4FQeiGJACqjZ67DNHxD4FLZnpnzrVy16xRx (pool 88 stash)

My question is- where is this wallet? Ive looked literally everywhere I can remember and can't seem to find it anywhere.

Thanks in advance!

[Acaishiba]

I transferred some Polka Dot into the first pool you mentioned a couple months ago and cannot find that pool anywhere.

Do you mean you directly transform your DOT into this pool? or just join the pool?

if you join the pool, you can find your DOT on this page:https://polkadot.js.org/apps/?rpc=wss%3A%2F%2Fpolkadot-rpc-tn.dwellir.com#/staking/actions