Skip to content

NaN / inf rates bypass commitment parser #184

@wmagev

Description

@wmagev

In allways/commitments.py:40-42, float("inf") and float("nan") parse without raising, and the surrounding except only catches ValueError / IndexError — so neither value is rejected.

Impact: an inf rate sorts to the top of crown-holder ranking; a NaN rate silently drops out of comparisons (all comparisons with NaN are false). Easy to exploit, easy to fix.

Direction: after float(...), assert math.isfinite(rate) and rate > 0.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions