SEC-C01: swap math u128 and imbalance boundary tests (#401) #936

2026-06-25T11:42:56Z

PlasticDigits commented

2026-06-25 11:42:56 +00:00

(Migrated from gitlab.com)

Summary

Adds sec_c01_swap_boundary_tests integration tests for GitLab #401 / SEC-C01:

Near-u128-max reserves (u128::MAX / 2 and u128::MAX - 1 paired with minimal counter-reserve) confirm constant-product swap math completes without arithmetic overflow and gross output never exceeds the ask-side reserve.
1:1_000_000 reserve imbalance covered in both directions (offer scarce A, offer abundant B) with simulation + on-chain swap execution, verifying output ≤ reserve and exact floor fee split.

Verification checklist

Acceptance item	Command / result
Test with reserves near u128 maximum confirms no arithmetic overflow	`cargo test -p cl8y-dex-tests sec_c01_swap_boundary::test_swap_reserves_near_u128_max_no_overflow` → PASS (3 cases, no panic/overflow)
Test with 1:1_000_000 reserve ratio in offer and ask directions confirms output is within bounds	`cargo test -p cl8y-dex-tests sec_c01_swap_boundary::test_swap_extreme_imbalance_one_to_one_million_offer_scarce_side` → PASS; `…offer_abundant_side` → PASS
All new tests pass in CI	`make test-contracts` → PASS (full workspace `cargo test`)
No zero-output or negative-output case reachable under any reserve configuration	Existing `test_no_zero_output_from_rounding` still PASS (documents sub-threshold zero-output boundary on 10M:10M pool); new boundary tests assert `gross ≤ output_reserve` and exact fee accounting (no over-withdrawal)
Prior coverage retained	`test_swap_one_microunit`, `test_swap_large_amount` still present and passing under `make test-contracts`

Follow-ups

Extend property-test generators (prop_k_maintained_*, prop_swap_output_never_exceeds_ideal) to sample reserve ratios up to 1:1_000_000 and larger reserve magnitudes (currently capped at 1_000_000_000).

## Summary Adds `sec_c01_swap_boundary_tests` integration tests for GitLab #401 / SEC-C01: - Near-u128-max reserves (`u128::MAX / 2` and `u128::MAX - 1` paired with minimal counter-reserve) confirm constant-product swap math completes without arithmetic overflow and gross output never exceeds the ask-side reserve. - 1:1_000_000 reserve imbalance covered in both directions (offer scarce A, offer abundant B) with simulation + on-chain swap execution, verifying output ≤ reserve and exact floor fee split. ## Verification checklist | Acceptance item | Command / result | |-----------------|------------------| | Test with reserves near u128 maximum confirms no arithmetic overflow | `cargo test -p cl8y-dex-tests sec_c01_swap_boundary::test_swap_reserves_near_u128_max_no_overflow` → **PASS** (3 cases, no panic/overflow) | | Test with 1:1_000_000 reserve ratio in offer and ask directions confirms output is within bounds | `cargo test -p cl8y-dex-tests sec_c01_swap_boundary::test_swap_extreme_imbalance_one_to_one_million_offer_scarce_side` → **PASS**; `…offer_abundant_side` → **PASS** | | All new tests pass in CI | `make test-contracts` → **PASS** (full workspace `cargo test`) | | No zero-output or negative-output case reachable under any reserve configuration | Existing `test_no_zero_output_from_rounding` still **PASS** (documents sub-threshold zero-output boundary on 10M:10M pool); new boundary tests assert `gross ≤ output_reserve` and exact fee accounting (no over-withdrawal) | | Prior coverage retained | `test_swap_one_microunit`, `test_swap_large_amount` still present and passing under `make test-contracts` | ## Follow-ups - Extend property-test generators (`prop_k_maintained_*`, `prop_swap_output_never_exceeds_ideal`) to sample reserve ratios up to 1:1_000_000 and larger reserve magnitudes (currently capped at `1_000_000_000`).

PlasticDigits commented

2026-06-25 11:44:44 +00:00

(Migrated from gitlab.com)

Security review — MR !936

Commit reviewed: 72aedf30245be56ae4e7ba41c8822735c98ee0cc
Scope: smartcontracts/tests/src/lib.rs — new sec_c01_swap_boundary_tests module (SEC-C01 / #401): u128-max reserve boundary tests, 1:1_000_000 imbalance swap tests, simulation + on-chain execution assertions.

Outcome: FINDINGS: 0 medium+

Summary: This MR adds integration tests only (#[cfg(test)]); no production contract, router, factory, or dependency changes. Reviewed added helpers (setup_env_with_supply, pool_sim, assert_pool_swap_accounting, swap_with_belief) and all three test cases.

Attack-path analysis (no exploitable sink in diff):

Attacker-controlled swap inputs are exercised against the existing pair execute_swap path via cw_multi_test; the diff does not alter on-chain logic, auth gates, fee math, or invariant checks.
max_spread: Some(Decimal::one()) and belief_price: Some(Decimal::one()) appear only in the test harness to avoid slippage assertion failures in simulation/execution parity checks — not deployed code.
u128::MAX token supply and near-max reserves are sandbox fixtures; they do not weaken production limits or introduce overflow-prone code in this diff.
No injection, authn/authz bypass, secret leakage, SSRF/XSS/deserialization, or supply-chain changes in the diff.

Prior review threads: None on this MR; no re-opened findings.

Inline threads: None (no medium+ findings).

## Security review — MR !936 **Commit reviewed:** `72aedf30245be56ae4e7ba41c8822735c98ee0cc` **Scope:** `smartcontracts/tests/src/lib.rs` — new `sec_c01_swap_boundary_tests` module (SEC-C01 / #401): u128-max reserve boundary tests, 1:1_000_000 imbalance swap tests, simulation + on-chain execution assertions. **Outcome:** `FINDINGS: 0` medium+ **Summary:** This MR adds integration tests only (`#[cfg(test)]`); no production contract, router, factory, or dependency changes. Reviewed added helpers (`setup_env_with_supply`, `pool_sim`, `assert_pool_swap_accounting`, `swap_with_belief`) and all three test cases. **Attack-path analysis (no exploitable sink in diff):** - Attacker-controlled swap inputs are exercised against the existing pair `execute_swap` path via `cw_multi_test`; the diff does not alter on-chain logic, auth gates, fee math, or invariant checks. - `max_spread: Some(Decimal::one())` and `belief_price: Some(Decimal::one())` appear only in the test harness to avoid slippage assertion failures in simulation/execution parity checks — not deployed code. - `u128::MAX` token supply and near-max reserves are sandbox fixtures; they do not weaken production limits or introduce overflow-prone code in this diff. - No injection, authn/authz bypass, secret leakage, SSRF/XSS/deserialization, or supply-chain changes in the diff. **Prior review threads:** None on this MR; no re-opened findings. **Inline threads:** None (no medium+ findings).