Skip to content

fix(vault): enforce checked arithmetic on balance changes - #279

Merged
greatest0fallt1me merged 2 commits into
CalloraOrg:mainfrom
anoncon:chore/vault-checked-math
Apr 23, 2026
Merged

fix(vault): enforce checked arithmetic on balance changes#279
greatest0fallt1me merged 2 commits into
CalloraOrg:mainfrom
anoncon:chore/vault-checked-math

Conversation

@anoncon

@anoncon anoncon commented Apr 22, 2026

Copy link
Copy Markdown
Contributor
  • Remove duplicate get_max_deduct() definition (compile fix)
  • Add require_not_paused to batch_deduct (was missing unlike deduct)
  • Replace bare .unwrap() on all i128 balance mutations with descriptive panics
  • Fix fuzz run_sequence to handle pause state for deduct/batch_deduct ops
  • Add withdraw_near_i128_max_succeeds and batch_deduct_to_zero_succeeds boundary tests
  • Fix clippy warnings in vault and settlement test files
  • Document checked arithmetic audit and i128::MAX behavior in SECURITY.md

Closes #233

- Remove duplicate get_max_deduct() definition
- Replace bare .unwrap() on checked operations with descriptive panics
- Add batch_deduct require_not_paused guard (was missing unlike deduct)
- Fix fuzz run_sequence pause handling for deduct and batch_deduct ops
- Add withdraw_near_i128_max_succeeds and batch_deduct_to_zero_succeeds tests
- Fix unused-variable warning in settlement test (dead third_party binding)
- Fix type mismatch in vault test (pass Some(addr) to set_allowed_depositor)
- Document i128::MAX boundary behavior in SECURITY.md (Issue #233)
@drips-wave

drips-wave Bot commented Apr 22, 2026

Copy link
Copy Markdown

@anoncon Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

@greatest0fallt1me
greatest0fallt1me merged commit 0289e8d into CalloraOrg:main Apr 23, 2026
0 of 3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Vault: checked arithmetic audit for i128 balances

2 participants