Skip to content

Fix for arithmetic side effect#2721

Merged
open-junius merged 2 commits into
chore/adapt-rate-limitsfrom
fix/arith-side-effect
Jun 5, 2026
Merged

Fix for arithmetic side effect#2721
open-junius merged 2 commits into
chore/adapt-rate-limitsfrom
fix/arith-side-effect

Conversation

@evgeny-s
Copy link
Copy Markdown
Collaborator

@evgeny-s evgeny-s commented Jun 5, 2026

Description

This PR fixes the suppressed clippy error for advanced order types.

Related Issue(s)

  • Closes #[issue number]

Type of Change

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • Documentation update
  • Other (please describe):

Breaking Change

If this PR introduces a breaking change, please provide a detailed description of the impact and the migration path for existing applications.

Checklist

  • I have performed a self-review of my own code
  • I have commented my code, particularly in hard-to-understand areas
  • I have run ./scripts/fix_rust.sh to ensure my code is formatted and linted correctly
  • I have made corresponding changes to the documentation
  • My changes generate no new warnings
  • I have added tests that prove my fix is effective or that my feature works
  • New and existing unit tests pass locally with my changes
  • Any dependent changes have been merged and published in downstream modules

Screenshots (if applicable)

Please include any relevant screenshots or GIFs that demonstrate the changes made.

Additional Notes

Please provide any additional information or context that may be helpful for reviewers.

@evgeny-s evgeny-s force-pushed the fix/arith-side-effect branch 3 times, most recently from ba6b4ba to 1bb983e Compare June 5, 2026 10:00
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Jun 5, 2026

🛡️ AI Review — Skeptic (security review)

VERDICT: SAFE

Baseline scrutiny: established contributor with repo write permission and substantial contribution history; branch fix/arith-side-effect -> chore/adapt-rate-limits.

Static review covered the trusted persona rules, cached PR metadata, prior Skeptic comment, contributor signals, changed-file list, comments, and full diff. The PR changes only pallets/limit-orders/src/lib.rs and pallets/limit-orders/src/tests/auxiliary.rs; it does not touch .github/ai-review/*, .github/copilot-instructions.md, dependency manifests, lockfiles, or build scripts.

The change replaces the prior fixed-point conversion/division path with saturating_from_num plus checked_div, and propagates conversion overflow as ArithmeticOverflow. I checked the post-asset-collection callers: under the runtime batch bound of 100 u64 orders, the sell-dominant branch condition implies total_buy_net / price < total_sell_net, so the new tao_to_alpha overflow path is not reachable in the settlement paths that execute after collect_assets. No backdoor, origin bypass, supply-chain risk, or reachable runtime-panic path was found.

Findings

No findings.

Conclusion

No Skeptic finding is warranted. The diff removes an arithmetic panic/overflow risk and does not introduce a reachable security issue under the existing order amount and batch-size bounds.


🔍 AI Review — Auditor (domain review)

VERDICT: 👍

Gittensor: UNKNOWN; author has write permission and substantial subtensor/GitHub history, but is not in the trusted allowlists or on-chain index.

The Auditor proposed a replacement PR description, but the current body is non-trivial; not overwriting. Maintainers: ask the Auditor to regenerate if you want it.

Spec version auto-fix: not applied. This PR targets chore/adapt-rate-limits, which has no configured spec-version check in the trusted branch mapping.

Duplicate-work check: overlapping-prs.json lists PR #2685, but that appears to be the underlying advanced-order work rather than a competing fix for this overflow-handling change.

No tests were run by the Auditor; the prior issue is resolved by static review of the conversion helper and all changed call sites.

Findings

No findings.

Prior-comment reconciliation

  • 4fcdc877: addresseddistribute_alpha_pro_rata now calls Self::tao_to_alpha(total_buy_net, current_price)?, and tao_to_alpha maps checked fixed-point division failure to ArithmeticOverflow instead of returning zero.

Conclusion

The previously blocking overflow path has been addressed: tao_to_alpha now returns a DispatchError, and the sell-dominant settlement/event paths propagate it instead of treating conversion failure as zero alpha. I do not see a remaining domain issue in this narrow fix.


📜 Previous run (superseded)
Sev File Finding Status
HIGH pallets/limit-orders/src/lib.rs:1060 Do not treat conversion overflow as zero alpha ✅ Addressed
distribute_alpha_pro_rata now calls Self::tao_to_alpha(total_buy_net, current_price)?, and tao_to_alpha maps checked fixed-point division failure to ArithmeticOverflow instead of returning zero.

Copy link
Copy Markdown
Contributor

@github-actions github-actions Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

AI review — see the sticky summary comment for the verdict and the inline comments below for specific findings.

Comment thread pallets/limit-orders/src/lib.rs Outdated
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Jun 5, 2026

🔄 AI review updated — Skeptic: SAFE Auditor: 👎

@evgeny-s evgeny-s added the skip-cargo-audit This PR fails cargo audit but needs to be merged anyway label Jun 5, 2026
Copy link
Copy Markdown
Contributor

@github-actions github-actions Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

AI review — see the sticky summary comment for the verdict and the inline comments below for specific findings.

Comment thread pallets/limit-orders/src/lib.rs Outdated
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Jun 5, 2026

🔄 AI review updated — Skeptic: SAFE Auditor: 👎

@evgeny-s evgeny-s force-pushed the fix/arith-side-effect branch from 78fefbb to 71d97f1 Compare June 5, 2026 11:16
@evgeny-s evgeny-s force-pushed the fix/arith-side-effect branch from 71d97f1 to e517e66 Compare June 5, 2026 11:17
Copy link
Copy Markdown
Contributor

@github-actions github-actions Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

AI review — see the sticky summary comment for the verdict and the inline comments below for specific findings.

Comment thread pallets/limit-orders/src/lib.rs Outdated
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Jun 5, 2026

🔄 AI review updated — Skeptic: SAFE Auditor: 👎

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Jun 5, 2026

🔄 AI review updated — Skeptic: SAFE Auditor: 👍

@open-junius open-junius merged commit 9fa0c2a into chore/adapt-rate-limits Jun 5, 2026
26 of 28 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

skip-cargo-audit This PR fails cargo audit but needs to be merged anyway

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants