Skip to content

fix: fix (warn/medium/high) audit from AG#613

Open
Lchangliang wants to merge 7 commits intomainfrom
dev-0316-audit1
Open

fix: fix (warn/medium/high) audit from AG#613
Lchangliang wants to merge 7 commits intomainfrom
dev-0316-audit1

Conversation

@Lchangliang
Copy link
Contributor

@Lchangliang Lchangliang commented Mar 18, 2026

  1. Mitigation of Arithmetic Overflows in Consensus Leader Reputation

Replaced direct additions (*count += 1) with saturating_add(1) to prevent potential integer overflows.
Added explicit type casting to u64 for multiplication thresholds (cur_failed_proposals as u64 * 100) to guarantee safety against overflows when calculating reputation heuristics.
Improved logging severity for critical database or sync failures from warn! to error!, explicitly noting that "leader election may degrade".
2. Safe Error Handling Practices (Removing Panics/Unwraps)

Removed unsafe .unwrap() calls across multiple core modules (gravity_node, reth_coordinator).
Replaced them with safe fallback handling such as .expect() with descriptive messages (e.g., "Failed to read block hash from DB") or properly structured .unwrap_or_else(|| panic!(...)) to ensure the exact missing block/layer causing the crash is fully verbosed.
Handled previously ignored Result objects properly. For instance, in consensus_mempool_handler.rs, an ignored let _ = ... result was replaced with an if let Err(e) check to output a warning log if the notification response fails.
3. State Transition Ordering Fixes

In block-buffer-manager.rs, the execution order was slightly adjusted during an epoch change. The BufferState is now explicitly stored as EpochChange before the internal state machine prunes (retain) older blocks, avoiding a potentially unsafe intermediate state.
4. General Cleanup

Removed leftover debugging println! macros (e.g., in config_storage.rs).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant