The Pump Science protocols migration process involves a two-step operation where bonding curve assets are transferred to a Meteora pool. During this process, the initialize_pool_with_config() function first calculates and allocates the required SOL amount for the new pool, while lock_pool() completes the migration and handles remaining funds.
The vulnerability exists in the lock_pool() functions handling of remaining escrow funds:
The function blindly transfers all remaining lamports to the fee receiver without validating against the expected migrate_fee_amount. Since the escrow is a PDA that can receive SOL between the two migration steps, any excess funds (from failed transactions, rounding errors, or external transfers) will be incorrectly sent to the fee receiver.
For example:
Excess funds in the escrow during migration are incorrectly transferred to the fee receiver instead of being properly allocated.
Modify lock_pool() to validate the remaining balance against migrate_fee_amount:
