Skip to content
Snippets Groups Projects
Commit ad5fe549 authored by Valery Gantchev's avatar Valery Gantchev Committed by github-actions[bot]
Browse files

Use checked math in frame-balances named_reserve (#7365)


This PR modifies `named_reserve()` in frame-balances to use checked math
instead of defensive saturating math.

The use of saturating math relies on the assumption that the sum of the
values will always fit in `u128::MAX`. However, there is nothing
preventing the implementing pallet from passing a larger value which
overflows. This can happen if the implementing pallet does not validate
user input and instead relies on `named_reserve()` to return an error
(this saves an additional read)

This is not a security concern, as the method will subsequently return
an error thanks to `<Self as ReservableCurrency<_>>::reserve(who,
value)?;`. However, the `defensive_saturating_add` will panic in
`--all-features`, creating false positive crashes in fuzzing operations.

---------

Co-authored-by: default avatarcmd[bot] <41898282+github-actions[bot]@users.noreply.github.com>
(cherry picked from commit f373af0d)
parent 3b4867e0
No related merge requests found
Pipeline #513549 waiting for manual action with stages
in 1 hour, 1 minute, and 40 seconds
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment