fix(drive): prevent overflow in SetPrices direct purchase pricing

[QuantumExplorer]

Summary

• Replace unchecked multiplication with checked_mul in SetPrices direct purchase pricing
• Overflow now returns an error instead of silently wrapping to a small value

Issue

Security audit found that *matched_price * token_count in the SetPrices branch uses bare multiplication. In release builds, this silently wraps around, allowing an attacker to pay almost nothing for tokens. The SinglePrice branch already uses saturating_mul.

Test plan

• Test verifies overflow returns error (not wrapped value)
• Test verifies normal purchases still work
• cargo test passes
• cargo clippy clean

🤖 Generated with Claude Code

[coderabbitai]

Warning

Rate limit exceeded

@QuantumExplorer has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 9 minutes and 50 seconds before requesting another review.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 8eef9023-b954-4c1c-8c27-d8f900e5ec6b

📥 Commits

Reviewing files that changed from the base of the PR and between 658d02d and 4e837f4.

📒 Files selected for processing (1)

• packages/rs-drive/src/state_transition_action/batch/batched_transition/token_transition/token_direct_purchase_transition_action/v0/transformer.rs

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch test/prove-setprices-overflow

📝 Coding Plan

• Generate coding plan for human review comments

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codecov]

Codecov Report

❌ Patch coverage is 56.52174% with 30 lines in your changes missing coverage. Please review.
✅ Project coverage is 68.28%. Comparing base (d82ca97) to head (4e837f4).
⚠️ Report is 2 commits behind head on v3.1-dev.

Files with missing lines	Patch %	Lines
...irect_purchase_transition_action/v0/transformer.rs	56.52%	30 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##           v3.1-dev    #3292      +/-   ##
============================================
- Coverage     70.42%   68.28%   -2.15%     
============================================
  Files          3293     3293              
  Lines        262598   262666      +68     
============================================
- Hits         184935   179349    -5586     
- Misses        77663    83317    +5654     

Components	Coverage Δ
dpp	56.61% <ø> (-1.82%)	⬇️
drive	74.75% <56.52%> (-3.45%)	⬇️
drive-abci	81.44% <ø> (-1.49%)	⬇️
sdk	30.34% <ø> (-0.91%)	⬇️
dapi-client	39.08% <ø> (ø)
platform-version	∅ <ø> (∅)
platform-value	39.35% <ø> (ø)
platform-wallet	60.40% <ø> (ø)
drive-proof-verifier	∅ <ø> (∅)

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[QuantumExplorer]

Approved