Fix unsafe usage of arithmetic ops (SlowMist N2) #138
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
Slowmist problem description:
In Rust, numeric variables used in calculations without proper overflow checks, such as checked_add ,
checked_mul , or checked_sub , may be susceptible to integer overflow. Integer overflow occurs when the result
of an arithmetic operation exceeds the maximum value that the data type can represent, leading to an unexpected
and potentially unsafe outcome.
Our response:
Suggested changes partially applied.
For some of the required interfaces (e.g
pallet-custom-balances
) there is no possibility for throwing an error other than panicking. This mechanism is unwanted because could lead to unexpected behaviour so we decided to decided to interpret which case is better in each case to do in case of overflow. For most of the cases, the best solution has been to useSaturating
trait and lose some precision in those cases.This loose of precision are not real potential risks since in most cases these saturating ops. are referred to block numbers or nonces. Having a 32-byte long number make our blockchain invulnerable for trillions of years.
Types of changes
What types of changes does your code introduce?