Unconfirmed IDVTC claims can trigger member initialization and terminal success

[exromany]

Locations

• csm-widget/features/claim-type/claim-idvtc-form/context/use-claim-idvtc-flow.tsx:101-132
• csm-widget/features/claim-type/claim-idvtc-form/hooks/use-tx-modal-stages-claim-idvtc.tsx:30-40

Summary

The IDVTC workflow treats resolution of sdk.idvtcGate.claimCurve as confirmation that the curve changed. It can therefore initialize cluster members and report the operator as claimed after a cancelled or reverted transaction, or while a multisig proposal remains unexecuted.

Root cause

• useClaimIdvtcFlowResolver.submit discards the SDK result and immediately calls initStaged when initialization was planned.
• The transaction-stage callback maps the SDK's DONE stage directly to initialization or success without validating receipt status or replacement identity.
• The pinned SDK's EOA path emits DONE for the receipt returned by waitForTransactionReceipt without checking receipt.status or rejecting a cancellation/replacement; its multisig path resolves when the proposal is created rather than executed.

Impact

The required on-chain IDVTC claim can be skipped while the widget attempts the dependent off-chain member mutation and presents a terminal state asserting that the claim succeeded.

• If the Survey API accepts initialization, an approved form can be bound before the operator actually has the IDVTC curve.
• If it rejects initialization, the modal still says “IDVTC type claimed — cluster members not initialized,” and the form advances as though the claim completed.
• The mismatch is detectable and recoverable by reloading and resubmitting the claim, so this is a low-severity, correctable non-financial state error rather than an authorization bypass.

Scenario

1. An eligible operator with an approved unbound IDVTC form submits the curve claim, and willInitMembers becomes true.
2. After broadcasting, the operator cancels the claim with a successful same-nonce self-transfer.
3. Receipt polling returns the cancellation receipt; the SDK emits DONE and resolves because it does not reject semantically different replacements.
4. The widget calls initStaged for the captured operator even though its curve never changed.
5. Whether initialization succeeds or fails, the resulting terminal modal asserts that the IDVTC type was claimed, and the form advances to its claimed state.

---

Drafted from LidoLens finding IDMI-01