From 1494ae38e127cc4f37c0bab5c966c09cb687eab2 Mon Sep 17 00:00:00 2001
From: Bronek Kozicki <brok@incorrekt.com>
Date: Fri, 4 Apr 2025 12:36:05 +0100
Subject: [PATCH] Fix VaultDeposit::preclaim checks

---
 src/test/app/Vault_test.cpp              | 17 ++++++++++++++++-
 src/xrpld/app/tx/detail/VaultDeposit.cpp | 12 ++++++------
 2 files changed, 22 insertions(+), 7 deletions(-)

diff --git a/src/test/app/Vault_test.cpp b/src/test/app/Vault_test.cpp
index 86bf034bbe..c786b558a7 100644
--- a/src/test/app/Vault_test.cpp
+++ b/src/test/app/Vault_test.cpp
@@ -1037,6 +1037,7 @@ class Vault_test : public beast::unit_test::suite
         Account issuer{"issuer"};
         Account owner{"owner"};
         Account depositor{"depositor"};
+        Account charlie{"charlie"};
         Account pdOwner{"pdOwner"};
         Account credIssuer1{"credIssuer1"};
         Account credIssuer2{"credIssuer2"};
@@ -1047,6 +1048,7 @@ class Vault_test : public beast::unit_test::suite
             issuer,
             owner,
             depositor,
+            charlie,
             pdOwner,
             credIssuer1,
             credIssuer2);
@@ -1055,7 +1057,13 @@ class Vault_test : public beast::unit_test::suite
         env.close();
         env.require(flags(issuer, asfAllowTrustLineClawback));
 
-        PrettyAsset asset{xrpIssue(), 1'000'000};
+        PrettyAsset asset = issuer["IOU"];
+        env.trust(asset(1000), owner);
+        env(pay(issuer, owner, asset(500)));
+        env.trust(asset(1000), depositor);
+        env(pay(issuer, depositor, asset(500)));
+        env.close();
+
         auto [tx, keylet] = vault.create(
             {.owner = owner, .asset = asset, .flags = tfVaultPrivate});
         env(tx);
@@ -1142,6 +1150,8 @@ class Vault_test : public beast::unit_test::suite
             testcase("private vault depositor now authorized");
             env(credentials::create(depositor, credIssuer1, credType));
             env(credentials::accept(depositor, credIssuer1, credType));
+            env(credentials::create(charlie, credIssuer1, credType));
+            env(credentials::accept(charlie, credIssuer1, credType));
             env.close();
             auto credSle = env.le(credKeylet);
             BEAST_EXPECT(credSle != nullptr);
@@ -1152,6 +1162,11 @@ class Vault_test : public beast::unit_test::suite
                  .amount = asset(50)});
             env(tx);
             env.close();
+
+            tx = vault.deposit(
+                {.depositor = charlie, .id = keylet.key, .amount = asset(50)});
+            env(tx, ter{tecINSUFFICIENT_FUNDS});
+            env.close();
         }
 
         {
diff --git a/src/xrpld/app/tx/detail/VaultDeposit.cpp b/src/xrpld/app/tx/detail/VaultDeposit.cpp
index 92d9f8a433..e9c3aa053e 100644
--- a/src/xrpld/app/tx/detail/VaultDeposit.cpp
+++ b/src/xrpld/app/tx/detail/VaultDeposit.cpp
@@ -86,12 +86,12 @@ VaultDeposit::preclaim(PreclaimContext const& ctx)
         // would allow authorization granted by the issuer explicitly, but Vault
         // does not have an MPT issuer (instead it uses pseudo-account, which is
         // blackholed and cannot create any transactions).
-        auto const err = requireAuth(ctx.view, share, account);
-
-        // As per requireAuth spec, we suppress tecEXPIRED error here, so we can
-        // delete any expired credentials inside doApply.
-        if (err != tecEXPIRED)
-            return err;
+        //
+        // As per requireAuth documentation, we suppress tecEXPIRED error here,
+        // so we can delete any expired credentials inside doApply.
+        if (auto const ter = requireAuth(ctx.view, share, account);
+            !isTesSuccess(ter) && ter != tecEXPIRED)
+            return ter;
     }
 
     if (assets.holds<MPTIssue>())