Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(client/tx): avoid integer uint64->int64 overflow by big.Int conversion #18622

Merged
merged 1 commit into from
Dec 4, 2023

Conversation

odeke-em
Copy link
Collaborator

@odeke-em odeke-em commented Dec 4, 2023

Avoids a potential uint64->int64 overflow when creating math.LegacyDec, instead opting to use big.Int.SetUint64(x)

Fixes https://github.com/cosmos/cosmos-sdk/security/code-scanning/9412

Summary by CodeRabbit

  • Bug Fixes
    • Improved the fee derivation logic to prevent potential underflow or overflow issues during gas fee calculations.
    • Enhanced the keys delete command to terminate correctly when a specified key is not found.
    • Resolved a configuration parsing error by adjusting the delimiter for minimum gas settings.
    • Updated the GetConsensusParams function to return an empty struct instead of causing a panic when no parameters are detected.

@odeke-em odeke-em requested a review from a team as a code owner December 4, 2023 07:44
Copy link
Contributor

coderabbitai bot commented Dec 4, 2023

Warning

Rate Limit Exceeded

@odeke-em has exceeded the limit for the number of files or commits that can be reviewed per hour. Please wait 12 minutes and 49 seconds before requesting another review.

How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.
Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.
Please see our FAQ for further information.

Commits Files that changed from the base of the PR and between e049998 and 0651ad6.

Walkthrough

Recent updates to the codebase have focused on enhancing robustness and stability, particularly in the areas of fee calculation and error handling. The conversion of gas values to a decimal representation has been improved to prevent numerical issues. Additionally, the software now handles missing keys and configuration errors more gracefully, avoiding abrupt terminations and panics. These changes contribute to a more reliable and user-friendly system.

Changes

File Path Change Summary
client/tx/factory.go Updated BuildUnsignedTx method to use math.LegacyDec for gas conversion, preventing under/overflow issues.
CHANGELOG.md Documented fixes for under/overflow in gas fee calculation, improved error handling for key deletion, resolved panic on gas config, and ensured GetConsensusParams returns an empty struct instead of panicking.

Tips

Chat with CodeRabbit Bot (@coderabbitai)

  • If you reply to a review comment from CodeRabbit, the bot will automatically respond.
  • To engage with CodeRabbit bot directly around the specific lines of code in the PR, mention @coderabbitai in your review comment
  • Note: Review comments are made on code diffs or files, not on the PR overview.
  • Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.

CodeRabbit Commands (invoked as PR comments)

  • @coderabbitai pause to pause the reviews on a PR.
  • @coderabbitai resume to resume the paused reviews.
  • @coderabbitai review to trigger a review. This is useful when automatic reviews are disabled for the repository.
  • @coderabbitai resolve resolve all the CodeRabbit review comments.
  • @coderabbitai help to get help.

Note: For conversation with the bot, please use the review comments on code diffs or files.

CodeRabbit Configration File (.coderabbit.yaml)

  • You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
  • The JSON schema for the configuration file is available here.
  • If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/coderabbit-overrides.v2.json

@github-actions github-actions bot added the C:CLI label Dec 4, 2023

This comment has been minimized.

Copy link
Contributor

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Review Status

Actionable comments generated: 0

Configuration used: CodeRabbit UI

Commits Files that changed from the base of the PR and between e049998 and d1b9e60.
Files selected for processing (1)
  • client/tx/factory.go (1 hunks)
Additional comments: 1
client/tx/factory.go (1)
  • 311-319: The changes in the BuildUnsignedTx method correctly implement the conversion of f.gas to math.LegacyDec using big.Int.SetUint64(f.gas) to prevent overflow issues, as per the PR objective. The logic for deriving fees based on gas prices and limits has been updated accordingly.

@odeke-em odeke-em force-pushed the client-use-big.Int-to-construct-LegacyDec branch from d1b9e60 to 8b328ba Compare December 4, 2023 07:48
Copy link
Contributor

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Review Status

Actionable comments generated: 0

Configuration used: CodeRabbit UI

Commits Files that changed from the base of the PR and between e049998 and 8b328ba.
Files selected for processing (2)
  • CHANGELOG.md (1 hunks)
  • client/tx/factory.go (1 hunks)
Files skipped from review as they are similar to previous changes (1)
  • client/tx/factory.go
Additional comments: 2
CHANGELOG.md (2)
  • 74-74: There is an inconsistency between the PR objectives and the hunk regarding the behavior of the keys delete command. The PR objectives state that the command has been updated to terminate gracefully when a key is not found, while the hunk suggests that it won't terminate under the same condition. Please clarify the intended behavior.

  • 74-74: The changes listed in the hunk for the CHANGELOG.md correctly reflect the fixes and improvements described in the PR objectives and the generated summaries. The fixes address potential under/overflow issues, configuration parsing, and error handling enhancements.

…rsion

Avoids a potential uint64->int64 overflow when creating math.LegacyDec,
instead opting to use big.Int.SetUint64(x)

Fixes https://github.com/cosmos/cosmos-sdk/security/code-scanning/9412
@odeke-em odeke-em force-pushed the client-use-big.Int-to-construct-LegacyDec branch from 8b328ba to 0651ad6 Compare December 4, 2023 07:51
@julienrbrt julienrbrt added this pull request to the merge queue Dec 4, 2023
Merged via the queue into main with commit 0a7567d Dec 4, 2023
59 of 60 checks passed
@julienrbrt julienrbrt deleted the client-use-big.Int-to-construct-LegacyDec branch December 4, 2023 10:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants