Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix unsafe usage of arithmetic ops (SlowMist N2) #138

Merged
merged 3 commits into from
Nov 16, 2023

Conversation

clostao
Copy link
Contributor

@clostao clostao commented Nov 7, 2023

Description

Slowmist problem description:

In Rust, numeric variables used in calculations without proper overflow checks, such as checked_add ,
checked_mul , or checked_sub , may be susceptible to integer overflow. Integer overflow occurs when the result
of an arithmetic operation exceeds the maximum value that the data type can represent, leading to an unexpected
and potentially unsafe outcome.

Our response:

Suggested changes partially applied.

For some of the required interfaces (e.g pallet-custom-balances) there is no possibility for throwing an error other than panicking. This mechanism is unwanted because could lead to unexpected behaviour so we decided to decided to interpret which case is better in each case to do in case of overflow. For most of the cases, the best solution has been to use Saturating trait and lose some precision in those cases.

This loose of precision are not real potential risks since in most cases these saturating ops. are referred to block numbers or nonces. Having a 32-byte long number make our blockchain invulnerable for trillions of years.

Types of changes

What types of changes does your code introduce?

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)

Copy link
Contributor

@GabrielMartinezRodriguez GabrielMartinezRodriguez left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

deblanco
deblanco previously approved these changes Nov 9, 2023
@deblanco deblanco dismissed stale reviews from GabrielMartinezRodriguez and themself via c47cd3a November 15, 2023 21:47
@deblanco deblanco force-pushed the fix-unsafe-arithmetic branch from 3666c21 to c47cd3a Compare November 15, 2023 21:47
@deblanco deblanco merged commit 220ee8e into main Nov 16, 2023
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants