Skip to content

fix(safe-math): fix #20 by implementing overflow-safe arithmetic across contracts#29

Merged
EmeditWeb merged 1 commit into
StepFi-app:mainfrom
Dopezapha:fix/issue-20-overflow-safe-arithmetic
Jun 18, 2026
Merged

fix(safe-math): fix #20 by implementing overflow-safe arithmetic across contracts#29
EmeditWeb merged 1 commit into
StepFi-app:mainfrom
Dopezapha:fix/issue-20-overflow-safe-arithmetic

Conversation

@Dopezapha

Copy link
Copy Markdown
Contributor

Closes #20

PR Description

This PR resolves issue #20 by addressing arithmetic overflow and underflow risks in calculations across the StepFi contracts. Multiple contracts performing math on i128 values for loans, late fees, share calculations, and boosts previously had no explicit overflow checks, which posed a security risk where extremely large numbers could wrap or cause unhandled panics.

I replaced raw operators (+, -, *) on financial values with explicit checked methods inside a standardized safe_math utility module implemented in each contract. When an overflow or underflow occurs, the contract now returns a custom, typed error (e.g., Overflow or Underflow) instead of panicking, which allows client applications and invoking contracts to handle the error properly.

Changes Made

  • Added local safe_math.rs utility modules to all 5 core contracts (and the vouching contract) to implement checked addition, subtraction, multiplication, and division on i128, u64, and u32 variables.
  • Modified contract lib.rs and errors.rs files for creditline-contract, liquidity-pool-contract, reputation-contract, parameters-contract, vendor-registry-contract, and vouching-contract to integrate the safe math helper functions and custom error variants.
  • Added Overflow and Underflow variants to all contract-specific error enums to replace unhandled VM panics with typed error responses.
  • Added a test_safe_math_boundaries unit test in contracts/creditline-contract/src/tests.rs verifying that overflow, underflow, and divide-by-zero occurrences on extreme boundary values return the correct typed errors.

@EmeditWeb EmeditWeb merged commit f9ab956 into StepFi-app:main Jun 18, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

core: add overflow-safe arithmetic across all contracts

2 participants