Repository navigation
fix(vm): reject a pull whose destination aliases its cap or overdraft - #225
Merged
Merged
Conversation
funds.Pull writes the destination before it reads the bounds, so an aliased cap no longer bounds the pull and an aliased overdraft doubles the balance. The verifier now rejects that shape.
NumaryBot
added
risk: medium
NumaryBot
approved these changes
Oct 21, 2026
NumaryBot
left a comment
NumaryBot
left a comment
Contributor
There was a problem hiding this comment.
The required automated review completed with no remaining findings.
Azorlogh
approved these changes
Oct 22, 2026
NumaryBot
removed
the
review-approved
ascandone
enabled auto-merge (squash)
October 22, 2026 08:47
NumaryBot
added
the
review-approved
NumaryBot
approved these changes
Oct 22, 2026
NumaryBot
left a comment
NumaryBot
left a comment
Contributor
There was a problem hiding this comment.
The required automated review completed with no remaining findings.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
A
pull_accountwhose destination register is also its cap or overdraft passesvm.Verifyand produces wrong postings with no error.funds.Pullwrites the destination before it reads the bounds on the bounded path, so an aliased cap stops bounding the pull and an aliased overdraft doubles the balance. Balance 30, cap 100, overdraft 0 pulls 60, leaving the source at -30 with a zero overdraft.Compiled numscript never emits this: the allocator never aliases a destination with an operand of the same instruction. It matters for bytecode that did not come out of this process's compiler, which is what the ledger replays.
Fix
Verifyrejects the shape (two byte compares indecodeInstr). Nothing changes inExec: verify-first stays the contract.bytecode-verifier.md,instruction-encoding.mdand the opcode comment document the rule.Tests
TestVerifyPullDestAliasesCapOrOverdraft: both aliasings rejected; cap and overdraft may share a register.TestIRPullDestAliasingItsBoundIsRejected: the same shapes written as IR.FuzzExecseed for the aliased shape.go test ./...,-raceoninternal/vmandinternal/compiler,TestCompiledCorpusPassesVerifyand 15s ofFuzzExecpass.Split out of #217, which keeps the queued-funds work.