Skip to content

fix(v2): use checked arithmetic in register position and weight calculation (#131) - #139

Closed
s6pa1rta3n-lab wants to merge 1 commit into
drydocs:mainfrom
s6pa1rta3n-lab:fix-issue-131
Closed

fix(v2): use checked arithmetic in register position and weight calculation (#131)#139
s6pa1rta3n-lab wants to merge 1 commit into
drydocs:mainfrom
s6pa1rta3n-lab:fix-issue-131

Conversation

@s6pa1rta3n-lab

Copy link
Copy Markdown

Description

In tholos-v2, register computed a voter's new position amount and the assertion's updated eligible total weight using plain integer addition and subtraction:

let new_amount = previous_amount + amount;
...
let new_total = resolution.eligible_total - previous_amount + new_amount;

While values are checked against policy.max_position and policy.max_total_weight immediately after, plain arithmetic in release Wasm builds could silently wrap before reaching the bound checks.

Changes Made

  • Replaced plain +/- operations in register with checked_add and checked_sub.
  • Added Error::RegistrationArithmeticOverflow = 37 to pub enum Error.
  • Documented RegistrationArithmeticOverflow in docs/src/CONTRACT_V2.md.
  • Added unit tests in contracts/tholos-v2/src/test.rs:
    • test_register_position_amount_overflow_returns_error: validates that top-up position amount arithmetic overflow returns Error::RegistrationArithmeticOverflow.
    • test_register_eligible_total_overflow_returns_error: validates that eligible_total arithmetic overflow returns Error::RegistrationArithmeticOverflow.
  • Generated and committed deterministic test snapshots.

Closes #131

Payout Routing

  • EVM (Base/Arbitrum/Polygon/ETH): 0xF46C9F6d70C50BF81ef3588AB523a90a594a2F89
  • Stellar: GCL6OXAMLD75BMTINA6EMRUDWK5THQUSHMYNLSNBCJAPZJHNYJTUNIBC

@collinsezedike

Copy link
Copy Markdown
Collaborator

@s6pa1rta3n-lab Closing — #131 is assigned to ZacLou, not you.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Chore] register's position/weight arithmetic is unchecked in tholos-v2

2 participants