Skip to content

Add overflow protection to claimable amount calculation #366

@ogazboiz

Description

@ogazboiz

Join our community: https://t.me/+DOylgFv1jyJlNzM0

Description

get_claimable_amount() multiplies rate_per_second * elapsed_seconds in i128. For very high-rate or long-duration streams this multiplication can overflow, returning a negative or incorrect value with no panic.

What Needs to Happen

  • Replace raw * with checked_mul in the claimable calculation
  • On overflow: cap at deposited_amount - withdrawn_amount
  • Apply the same protection to claimable.service.ts in the backend (BigInt arithmetic)
  • Add test: test_claimable_near_max_i128_no_overflow
  • Add test: test_claimable_always_capped_at_remaining_balance

Files

  • contracts/stream_contract/src/lib.rs (get_claimable_amount)
  • backend/src/services/claimable.service.ts

Acceptance Criteria

  • No panic or incorrect result for any valid i128 input
  • Capped at deposited amount on overflow
  • Both contract and service protected

Metadata

Metadata

Assignees

Labels

Stellar WaveIssues in the Stellar wave programsecuritySecurity related taskssmart-contractSoroban smart contract

Type

No type
No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions