Chain extension `AddStakeRecycleV1` / `AddStakeBurnV1` are non-atomic

[Maksandre]

Describe the bug

The composite chain-extension entry points AddStakeRecycleV1 / AddStakeBurnV1 (chain-extensions/src/lib.rs:792-853) invoke pallet-level pub fn helpers that are not #[pallet::call] dispatchables - so FRAME's automatic with_storage_layer wrap does not apply. If the second leg (do_recycle_alpha or do_burn_alpha) returns Err after the first leg (do_add_stake) succeeded, the first leg's storage writes persist. The doc-comment on the helper still claims atomicity ("without leaving residual stake if the second leg fails").

This is a silent regression: commit 46989aaba (2026-04-17) originally wrapped both helpers in transactional::with_transaction to deliver the documented atomicity; commit d0702db5a (2026-05-04, "add migration part") removed the wrapper without mention in the commit message.

To Reproduce

Simplest trigger: netuid = NetUid::ROOT. do_add_stake succeeds on the root subnet, then do_recycle_alpha / do_burn_alpha returns Error::CannotBurnOrRecycleOnRootSubnet (pallets/subtensor/src/staking/recycle_alpha.rs:28-31 and :89-92).

1. Deploy any ink! contract whose #[ink(message)] calling the chain extension returns a non-Result type (so ink!'s automatic revert-on-Err dispatch wrapper does not trip). Raw WASM / PolkaVM contracts naturally expose the bug.
2. From the contract, invoke AddStakeRecycleV1(hotkey, netuid = NetUid::ROOT, tao_amount = 100 TAO) (or the burn variant).
3. The chain extension returns Output::CannotBurnOrRecycleOnRootSubnet = 21.
4. Inspect the contract's TAO balance, AlphaV2((hotkey, contract, ROOT)), SubnetTAO[ROOT], SubnetAlphaOut[ROOT], TotalStake.

Observed: contract TAO debited by 100 TAO; root alpha credited 100e9 to (hotkey, contract, ROOT); SubnetTAO[ROOT], SubnetAlphaOut[ROOT], TotalStake all bumped - despite the chain extension returning a failure code that the composite was supposed to roll back.

Other plausible failure modes for the second leg:

• A pre-existing Lock row on (contract-account, netuid, hotkey) reduces available_stake = total - locked - unlocked below the freshly-minted alpha, so ensure_available_stake (recycle_alpha.rs:54) returns StakeUnavailable.
• An intermediate state-change inside do_add_stake -> stake_into_subnet can also commit partially: transfer_tao_to_subnet moves real pallet-balances TAO before the internal swap_tao_for_alpha, leaving the TAO stranded if the swap fails.

Expected behavior

AddStakeRecycleV1 / AddStakeBurnV1 must be atomic - either both legs succeed or no storage writes persist. The doc-comment on do_add_stake_recycle already states this contract: "so that contracts can compose the two operations without leaving residual stake if the second leg fails."

Screenshots

No response

Environment

opentensor/subtensor testnet @ e6a5f56cefeb96b9c63ea3ce6553a8e1066aaeb9

Additional context

Affected code

chain-extensions/src/lib.rs:792-853:

FunctionId::AddStakeRecycleV1 => {
    // ...
    Pallet::<T>::do_add_stake_recycle(origin, hotkey, netuid, amount) // <-- no with_storage_layer
}

FunctionId::AddStakeBurnV1 => {
    // ...
    Pallet::<T>::do_add_stake_burn_permissionless(origin, hotkey, netuid, amount) // <-- no with_storage_layer
}

pallets/subtensor/src/staking/recycle_alpha.rs:157-178:

pub fn do_add_stake_recycle(origin, hotkey, netuid, amount) -> Result<AlphaBalance, _> {
    let alpha = Self::do_add_stake(origin.clone(), hotkey.clone(), netuid, amount)?;
    Self::do_recycle_alpha(origin, hotkey, alpha, netuid)
}

pub fn do_add_stake_burn_permissionless(origin, hotkey, netuid, amount) -> Result<AlphaBalance, _> {
    let alpha = Self::do_add_stake(origin.clone(), hotkey.clone(), netuid, amount)?;
    Self::do_burn_alpha(origin, hotkey, alpha, netuid)
}

[open-junius]

I think we don't need with_transaction to make the storage atomic. The message from Ink contract should be executed in the call extrinsic in pallet_contracts. It should be in #[pallet::call] dispatchables.
You can check the test I added https://github.com/opentensor/subtensor/pull/2669/changes#diff-50ba2d2f6e9e1fbe6abfed62280cf0c0c9cd3ad607c16d42618353a67ca7ec11R935

[Maksandre]

Your test passes because add_stake_recycle returns Result<u64, _> - ink! 5.x auto-sets ReturnFlags::REVERT on Result::Err, and ContractReverted in the tx events confirms it's ink! reverting, not the pallet.

If the contract returns something other than Result ink! doesn't auto-revert and the partial state from do_add_stake commits.

If we add these to the bittensor contract:

#[ink(message)]
pub fn add_stake_recycle_no_revert(&self, hotkey: [u8;32], netuid: u16, amount: u64) -> u64 {
    match self.env().extension().add_stake_recycle(hotkey.into(), netuid, amount) {
        Ok(real_amount) => real_amount,
        Err(_) => 0,
    }
}

#[ink(message)]
pub fn add_stake_burn_no_revert(&self, hotkey: [u8;32], netuid: u16, amount: u64) -> u64 {
    match self.env().extension().add_stake_burn(hotkey.into(), netuid, amount) {
        Ok(real_amount) => real_amount,
        Err(_) => 0,
    }
}

Then replace your tests with these:

it("Check add_stake_recycle is not atomic operation", async () => {
    const stakeBefore = await getContractStakeOnRoot()
    const balanceBefore = await getBalance(api, convertPublicKeyToSs58(coldkey.publicKey))
    const contractBalanceBefore = (await api.query.System.Account.getValue(contractAddress)).data.free

    const message = inkClient.message("add_stake_recycle_no_revert")
    const data = message.encode({
        hotkey: Binary.fromBytes(hotkey.publicKey),
        netuid: 0,
        amount: tao(100),
    })

    const signer = getSignerFromKeypair(coldkey)
    await api.tx.Contracts.call({
        value: BigInt(0),
        dest: MultiAddress.Id(contractAddress),
        data: Binary.fromBytes(data.asBytes()),
        gas_limit: { ref_time: BigInt(10_000_000_000), proof_size: BigInt(10_000_000) },
        storage_deposit_limit: BigInt(1_000_000_000),
    }).signAndSubmit(signer)

    const stakeAfter = await getContractStakeOnRoot()
    const balanceAfter = await getBalance(api, convertPublicKeyToSs58(coldkey.publicKey))
    const contractBalanceAfter = (await api.query.System.Account.getValue(contractAddress)).data.free

    assert.ok(balanceBefore - balanceAfter < 10_000_000)

    // BUG: root stake credited even though chain ext returned CannotBurnOrRecycleOnRootSubnet.
    assert.ok(
        stakeAfter > stakeBefore,
        `BUG: not atomic root stake credited: before=${stakeBefore}, after=${stakeAfter}`,
    )

    // BUG: TAO withdrawn from the CONTRACT account (env.caller()).
    const contractDebit = contractBalanceBefore - contractBalanceAfter
    assert.ok(
        contractDebit >= tao(100) / 2n,
        `BUG: not atomic contract debited: debit=${contractDebit}`,
    )
})

[open-junius]

@Maksandre will try it, thank you!

[open-junius]

I just tried, following the code you put in the comment. and the test is passed, I also print out the variable values. there is no change for stake and coldkey's / contract's balance. Did you try it in the local

[Maksandre]

@open-junius note the test is inverted, green = bug present. Did you run on the testnet branch?

Here is my console:

    ✔ Can instantiate contract (6687ms)
Transaction is finalized in block: 0xbd5ec10f3712f78c16f11036f1d74c23e87a21fcf178162c7cfeed4d3ab9ab3c
Transaction is finalized in block: 0xb12d9ba3dad9f6c1268f4e6aa84d6fb2d77a97cb18106d9644f892359718ec05
Transaction is finalized in block: 0xac5810f26613bc82e642dc390dcf12fa86d2f45cc62f245cde44445ffb200f2a
stake:     0n -> 100000000000n
contract:  2000000000500n -> 1900000000500n
coldkey:   9999999999085419392n -> 9999999999083034634n
    ✔ Check add_stake_recycle is not atomic operation (1683ms)


  2 passing (1m)

The test with logs:

    it("Check add_stake_recycle is not atomic operation", async () => {
        const stakeBefore = await getContractStakeOnRoot()
        const balanceBefore = await getBalance(api, convertPublicKeyToSs58(coldkey.publicKey))
        const contractBalanceBefore = (await api.query.System.Account.getValue(contractAddress)).data.free

        const message = inkClient.message("add_stake_recycle_no_revert")
        const data = message.encode({
            hotkey: Binary.fromBytes(hotkey.publicKey),
            netuid: 0,
            amount: tao(100),
        })

        const signer = getSignerFromKeypair(coldkey)
        await api.tx.Contracts.call({
            value: BigInt(0),
            dest: MultiAddress.Id(contractAddress),
            data: Binary.fromBytes(data.asBytes()),
            gas_limit: { ref_time: BigInt(10_000_000_000), proof_size: BigInt(10_000_000) },
            storage_deposit_limit: BigInt(1_000_000_000),
        }).signAndSubmit(signer)

        const stakeAfter = await getContractStakeOnRoot()
        const balanceAfter = await getBalance(api, convertPublicKeyToSs58(coldkey.publicKey))
        const contractBalanceAfter = (await api.query.System.Account.getValue(contractAddress)).data.free

        console.log("stake:    ", stakeBefore, "->", stakeAfter)
        console.log("contract: ", contractBalanceBefore, "->", contractBalanceAfter)
        console.log("coldkey:  ", balanceBefore, "->", balanceAfter)

        assert.ok(balanceBefore - balanceAfter < 10_000_000)

        // BUG: root stake credited even though chain ext returned CannotBurnOrRecycleOnRootSubnet.
        assert.ok(
            stakeAfter > stakeBefore,
            `BUG: not atomic root stake credited: before=${stakeBefore}, after=${stakeAfter}`,
        )

        // BUG: TAO withdrawn from the CONTRACT account (env.caller()).
        const contractDebit = contractBalanceBefore - contractBalanceAfter
        assert.ok(
            contractDebit >= tao(100) / 2n,
            `BUG: not atomic contract debited: debit=${contractDebit}`,
        )
    })

[open-junius]

I tested in devnet-ready, will check it in testnet branch soon

[open-junius]

I just tried it in testnet, the test result is different with yours. I pushed a commit to the PR, just keep one test case. Let's see the result in the CI. You can help to check if code change is the same as you did.

[open-junius]

https://github.com/opentensor/subtensor/actions/runs/26131693386/job/76858003520?pr=2669#step:7:2707

[Maksandre]

Got it. On fresh --dev, SubtokenEnabled[0] = false (testnet/mainnet are true). So first leg never runs, nothing to roll back. My local had it set, sorry.

Add this before the call:

const inner = api.tx.AdminUtils.sudo_set_subtoken_enabled({ netuid: 0, subtoken_enabled: true })
await waitForTransactionWithRetry(api, api.tx.Sudo.sudo({ call: inner.decodedCall }), getAliceSigner())

Here is my test:
Maksandre@75c9c5c

I verified it works from a fresh state.

[open-junius]

No worry! thank you very much for opening the issue and discussion. I will revert my PR to last commit which including two new test cases for atomic state check. Then close the issue after the PR is merged.