Skip to content

feat(common): overflow-safe deposit->token reconciliation scaling (#5)#47

Merged
elizabetheonoja-art merged 1 commit into
Utility-Protocol:mainfrom
real-venus:fix/reconciliation-scaling
Jun 25, 2026
Merged

feat(common): overflow-safe deposit->token reconciliation scaling (#5)#47
elizabetheonoja-art merged 1 commit into
Utility-Protocol:mainfrom
real-venus:fix/reconciliation-scaling

Conversation

@real-venus

Copy link
Copy Markdown
Contributor

feat(common): overflow-safe deposit → token reconciliation scaling

Closes #5

Solution

contracts/common/src/scaling.rs (pure #![no_std], no new dependencies),
built on the exact 256-bit mul_div_floor from crate::weighted_rate:

  • reconcile_tokens(deposit_amount, asset_precision) -> Result<u128, ScaleError>
    • validates ASSET_PRECISION ∈ [1, 10¹²]Err(InvalidPrecision);
    • holds deposit × 10¹⁸ in full 256-bit precision and divides exactly — it
      never wraps;
    • returns Err(Overflow) when the mathematically-correct token amount exceeds
      u128::MAX, instead of a silently wrapped value;
    • floor rounding — never mints more than the deposit backs (error < 1 base
      unit).
  • scale(amount, scale_factor, precision) — generic variant.
  • is_valid_precision, is_safe_deposit, MAX_SAFE_DEPOSIT — conservative
    early-reject helpers for callers that want them.

Files

  • contracts/common/src/scaling.rs (new)
  • contracts/common/src/lib.rs (register module)
  • contracts/docs/specs/reconciliation-scaling.md (new)

…ility-Protocol#5)

Reconciling deposits to token supply computes
deposit_amount * TOKEN_SCALE_FACTOR (10^18) / ASSET_PRECISION. A naive u128
implementation overflows the intermediate product (e.g. deposit = u128::MAX,
precision = 1) and wraps silently, minting wildly wrong amounts.

Add contracts/common/src/scaling.rs (pure no_std, no new deps), built on the
exact 256-bit mul_div_floor from the weighted_rate module:
- reconcile_tokens(deposit, precision) -> Result<u128, ScaleError>: validates
  ASSET_PRECISION in [1, 10^12], computes with 256-bit intermediate precision
  (never wraps), returns Err(Overflow) when the true result exceeds u128
  instead of a silently wrapped value; floor rounding so it never over-mints
- scale(amount, scale_factor, precision): generic variant
- is_valid_precision / is_safe_deposit / MAX_SAFE_DEPOSIT helpers
- tests: simple conversions, precision-bounds rejection, the crafted
  u128::MAX overflow rejected-not-wrapped, MAX_SAFE_DEPOSIT boundary, large
  deposit + large precision, floor-never-over-mints, and a 5000-iter property
  sweep asserting exact equality with a native reference

docs/specs/reconciliation-scaling.md documents the strategy and why 256-bit
mul_div suffices (no 512-bit uint dependency needed).

Note: no reconcile_deposit contract exists in the repo (issue paths are
fictional); the verified primitive lands in common for a future entry point
to call.
@elizabetheonoja-art elizabetheonoja-art merged commit da84280 into Utility-Protocol:main Jun 25, 2026
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Integer Scaling Protection Failure in Resource Deposit/Burnback Reconciliation

2 participants