Skip to content

[PAYOUT AUDIT] Missing idempotency label for weekly-cap-reached causes perpetual duplicate comment spam on cron sweeps #16711

Description

@ravendevhub

Bounty route

• Audit bounty: #16471
• Reporter: @ravendevhub
• Wallet Address: RTC14241718572ec3bd1c0c4ee26ed2fc4bf6fca15
• Scope: scripts/docstring_gate.py (Lines 215–217, 282–298)

Silent-success path

  1. When a contributor's weekly earnings exceed MAX_RTC_PER_WEEK (40 RTC), Line 283 executes add_labels("weekly-cap-reached") and posts a multi-paragraph explanation comment.
  2. However, the gate's top-level skip check at Line 215 only checks:
    if {"bounty-eligible", "docstring-verified", "gate-processed"} & labels: return 0
  3. Because weekly-cap-reached is not included in the skip set, every subsequent sweep (or issue edit) re-runs the entire verification logic, recalculates already + amount > MAX_RTC_PER_WEEK, and posts an identical multi-paragraph cap comment again.

Impact

Contributor claims hitting the weekly limit trigger spam comment storms on every scheduled workflow execution until the rolling 7-day window expires.

Suggested Fix

Include weekly-cap-reached in the initial skip filter, or check whether the issue already carries the label before posting the notification comment.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    needs-humanGate flagged for human review

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions