Skip to content

Feature/fw overflow safety #642#710

Merged
Baskarayelu merged 2 commits into
Remitwise-Org:mainfrom
web3nova:feature/fw-overflow-safety
Jun 3, 2026
Merged

Feature/fw overflow safety #642#710
Baskarayelu merged 2 commits into
Remitwise-Org:mainfrom
web3nova:feature/fw-overflow-safety

Conversation

@web3nova

@web3nova web3nova commented Jun 2, 2026

Copy link
Copy Markdown

Overview

This PR mitigates a critical Denial-of-Service (DoS) and incorrect accounting vector within the family_wallet crate by replacing potential panicking/silently-saturating raw integer addition with explicit overflow-safe logic.

Changes

  • Arithmetic Safety: Patched validate_precision_spending_internal and record_precision_spending to utilize checked_add with proper error mapping back to Error::InvalidSpendingLimit. This shields accumulation logic involving SpendingTracker and PrecisionSpendingLimit paths from exploitation using hostile boundary amounts.
  • Defensive Test Assertions: Added a targeted test variant test_precision_spending_overflow_graceful to family_wallet/src/test.rs ensuring extreme values near i128::MAX trigger graceful errors rather than full transaction abort panics.
  • Security Trail: Documented the threat design changes clearly in docs/fw-overflow-safety.md.

Closes #642

@Baskarayelu Baskarayelu merged commit 93ad812 into Remitwise-Org:main Jun 3, 2026
2 of 6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Family Wallet: i128 overflow safety audit for spending limits and precision tracker arithmetic

3 participants