Handle balancer misbalance on injection#2758
Conversation
gztensor
added
the
skip-cargo-audit
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| BalancerTaoReservoir::<T>::insert(netuid, TaoBalance::ZERO); | ||
| BalancerAlphaReservoir::<T>::insert(netuid, AlphaBalance::ZERO); | ||
| SwapBalancer::<T>::insert(netuid, new_balancer); | ||
| return (pending_tao, pending_alpha); |
There was a problem hiding this comment.
[HIGH] TAO reservoir can inject unescrowed prior-block credit
pending_tao includes BalancerTaoReservoir from earlier blocks, but TAO credit is not escrowed when it is stored there. In inject_and_maybe_swap, the unspent TAO credit from a failed/withheld injection is recycled at the end of that block; a later call that returns pending_tao asks the caller to fund old TAO from the current block's remaining_credit. If that spend fails, this function has already cleared the reservoir and inserted the updated SwapBalancer; if it succeeds, this subnet can consume emission credit that belonged to the current block's other allocations. The TAO-only branch below has the same issue. Fix by either escrowing/reserving TAO alongside the reservoir and committing the balancer update only after funding succeeds, or by not carrying TAO reservoir amounts across blocks under this interface.
🛡️ AI Review — Skeptic (security review)VERDICT: SAFE BASELINE scrutiny: established contributor with repo write permission; no Gittensor allowlist hit; branch fix/handle-misbalance-on-injection -> devnet-ready. Static review used only the trusted instructions and pre-fetched context. The diff does not modify FindingsNo findings. Prior-comment reconciliation
ConclusionNo malicious intent or security vulnerability was found in the current diff. Reservoir balances are materialized into reserve accounting before subnet dissolution/direct swap cleanup clears them, and the runtime storage change includes a 🔍 AI Review — Auditor (domain review)VERDICT: 👍 LIKELY Gittensor/ecosystem contributor: not in trusted allowlists, but has repo write permission and substantial recent subtensor contribution history; no better duplicate candidate found. PR body is substantive and matches the implementation. The runtime Validation: Duplicate-work check: overlapping open PRs touch shared runtime/pallet files, but their titles/scopes address different work, so I do not see a better duplicate candidate. Findings
Other findings
Prior-comment reconciliation
ConclusionThe reservoir accounting changes are covered by focused tests and I do not see a blocking domain issue. The only carried concern is low-severity PR hygiene around unrelated generated contract-test metadata. 📜 Previous run (superseded)
|
|
🔄 AI review updated — Skeptic: VULNERABLE |
|
🔄 AI review updated — Skeptic: SAFE Auditor: 👍 |
|
🔄 AI review updated — Skeptic: SAFE Auditor: 👎 |
|
🔄 AI review updated — Skeptic: VULNERABLE |
|
🔄 AI review updated — Skeptic: VULNERABLE |
|
🔄 AI review updated — Skeptic: SAFE Auditor: 👍 |
|
🔄 AI review updated — Skeptic: SAFE Auditor: 👍 |
|
🔄 AI review updated — Skeptic: SAFE Auditor: 👍 |
|
Closing: superseded by #2832, which squashes this change together with the other pending fixes. |
3 participants
Description
Fixes balancer emission injection when a block's TAO/alpha liquidity would push swap balancer weights outside the allowed range. Instead of dropping the whole injection attempt, the swap pallet now stores non-price-active TAO or alpha in per-subnet reservoirs and retries those reservoirs on later injection updates.
What Changed
SwapHandler::adjust_protocol_liquidityto return separate price-active and materialization amounts for TAO and alpha.BalancerTaoReservoirandBalancerAlphaReservoirstorage inpallets/swap.Behavioral Impact
Out-of-range protocol liquidity is no longer silently skipped. TAO/alpha that cannot be made price-active immediately is retained for later balancer updates while price-active reserve changes remain bounded by balancer weight constraints.
Runtime / Migration Notes
This changes pallet storage and runtime behavior. A
spec_versionbump may be required by the devnet-ready spec-version check depending on the live devnet runtime version.Testing
The PR adds unit coverage in
pallets/swap/src/pallet/tests.rs,pallets/subtensor/src/tests/coinbase.rs, andpallets/subtensor/src/tests/networks.rsfor the new reservoir behavior and cleanup paths.