Skip to content

fix: resolve remaining arithmetic safety findings #50

Merged
hackercf merged 1 commit intomasterfrom
fix/phase3-arithmetic-safety
Mar 16, 2026
Merged

fix: resolve remaining arithmetic safety findings #50
hackercf merged 1 commit intomasterfrom
fix/phase3-arithmetic-safety

Conversation

@hackercf
Copy link
Contributor

Summary

  • Replace raw (-) with safe-sub for open-interest calculations in liquidator-v1 (execute-liquidation and socialize-bad-debt) and borrower-v1 (repay) to prevent underflow panics from rounding edge cases
  • Guard all calculate-interest-portions callers with (>= current-debt borrowed-amount) — treats entire repayment as principal when rounding makes debt slightly less than borrowed amount
  • Replace unwrap-panic with unwrap! + dedicated ERR-SYNC-FAILED error in withdrawal-caps-v1 check-withdrawal-debt-cap

No changes to immutable contracts (state-v1, math-v1).

Replace raw subtractions with safe-sub and guard calculate-interest-portions
callers to prevent underflow panics in liquidation, bad-debt socialization,
and repayment paths. Replace unwrap-panic with unwrap! in withdrawal-caps-v1.
@hackercf hackercf requested a review from talhasch March 12, 2026 09:03
Copy link
Contributor

@talhasch talhasch left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

@hackercf hackercf merged commit 67942fb into master Mar 16, 2026
1 check passed
@hackercf hackercf deleted the fix/phase3-arithmetic-safety branch March 16, 2026 07:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants