Skip to content

fix(minter): reject deposit cycle parameters that cannot cover the RPC cost and fee - #212

Draft
gregorydemay wants to merge 2 commits into
mainfrom
fix/validate-deposit-cycles
Draft

gregorydemay wants to merge 2 commits into
mainfrom
fix/validate-deposit-cycles

Conversation

@gregorydemay

Copy link
Copy Markdown
Contributor

process_deposit checks that the caller attached at least process_deposit_required_cycles, then charges the cycles attached to the getTransaction call minus the refund plus, on success, the consolidation fee. If the two parameters are ever configured so that the required amount is below that sum, the charge asserts inside the reply callback; a trap there skips destructors, so the per-account guard is never released and the account stays blocked until the next upgrade.

This adds the constraint process_deposit_required_cycles >= GET_TRANSACTION_CYCLES + deposit_consolidation_fee to the state validation run on init and upgrade, documents it in section 3.3.4 of the design, and pins the boundary with a test that charges exactly the required amount with no refund. The current defaults and the staging minter's history satisfy it with a wide margin; since validation also runs when the event log is replayed, the design note says that raising the cycles budget constant requires checking deployment histories first.

Found during the review of #211, where deposit_sol would have added a second consumer of the same parameters.

🤖 Generated with Claude Code

gregorydemay and others added 2 commits September 23, 2026 08:44
…C cost and fee

process_deposit checks that the caller attached process_deposit_required_cycles
and later charges the getTransaction RPC cost plus the consolidation fee. If
the configured required cycles were below that sum, the charge would trap in
the reply callback and leave the per-account guard held until the next upgrade.
Validate the constraint on init and upgrade like the other parameter
constraints and document it in the design.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…undary

Rename the error field to get_transaction_cycles since it reports the
cycles budget attached to the getTransaction call, not its actual cost.
Reword the design constraint so operators size the parameter from that
budget and know the constraint is re-checked on event replay. Add a test
that a caller attaching exactly the required cycles with no refund is
charged exactly that amount.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Copilot AI lite review requested due to automatic review settings September 23, 2026 08:50

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🟢 Approval recommended

No unresolved issues were identified.

Review effort: Lite
Findings: None

What changed in this PR

Adds cycle-parameter validation to prevent underfunded deposit processing, with boundary tests and documentation.

Changes:

  • Validates the required cycle invariant during initialization and upgrades.
  • Adds state-validation and exact-charge tests.
  • Documents configuration and deployment-history considerations.
File Description
minter/​src/​state/​tests.rs Tests invalid and boundary configurations.
minter/​src/​state/​mod.rs Adds cycle-configuration validation and error reporting.
minter/​src/​deposit/​manual/​tests.rs Tests exact cycle charging without refunds.
docs/​design.md Documents the parameter constraint.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants