make integer overflow/underflow handling explicit

Author: zoedberg

src/database/enums.rs

@@ -354,9 +354,19 @@ impl Assignment {
     #[cfg(any(feature = "electrum", feature = "esplora"))]
     pub(crate) fn add_to_assignments(&self, assignments: &mut AssignmentsCollection) {
         match self {
-            Self::Fungible(amt) => assignments.fungible += amt,
+            Self::Fungible(amt) => {
+                assignments.fungible = assignments
+                    .fungible
+                    .checked_add(*amt)
+                    .expect("total fungible amount cannot exceed u64::MAX")
+            }
             Self::NonFungible => assignments.non_fungible = true,
-            Self::InflationRight(amt) => assignments.inflation += amt,
+            Self::InflationRight(amt) => {
+                assignments.inflation = assignments
+                    .inflation
+                    .checked_add(*amt)
+                    .expect("total inflation amount cannot exceed u64::MAX")
+            }
             _ => unreachable!("when using this method we should know the assignment type"),
         }
     }

src/database/mod.rs

@@ -739,7 +739,7 @@ impl DbTxn {
             .map(|a| a.assignment.main_amount())
             .sum();
 
-        let mut ass_pending_incoming: u64 = ass_allocations
+        let allocations_pending_incoming: u64 = ass_allocations
             .iter()
             .filter(|a| !a.txo_spent && a.incoming && a.status.pending())
             .map(|a| a.assignment.main_amount())
@@ -767,7 +767,9 @@ impl DbTxn {
                 }
             })
             .sum();
-        ass_pending_incoming += witness_pending;
+        let ass_pending_incoming = allocations_pending_incoming
+            .checked_add(witness_pending)
+            .expect("total pending incoming amount cannot exceed u64::MAX");
         let ass_pending_outgoing: u64 = ass_allocations
             .iter()
             .filter(|a| !a.incoming && a.status.pending())
@@ -807,11 +809,14 @@ impl DbTxn {
             })
             .sum();
 
-        let spendable = settled - unspendable;
+        let spendable = settled
+            .checked_sub(unspendable)
+            .expect("unspendable allocations are a subset of settled ones");
 
         Ok(Balance {
             settled,
-            future: future as u64,
+            future: u64::try_from(future)
+                .expect("pending outgoing cannot exceed available balance"),
             spendable,
         })
     }

src/wallet/multisig.rs

@@ -259,7 +259,9 @@ impl WalletOffline for MultisigWallet {
         let is_internal = keychain == KeychainKind::Internal;
         let start_index = self.hub_client().bump_address_indices(count, is_internal)?;
         let local_index = self.bdk_wallet().derivation_index(keychain).unwrap_or(0);
-        let target_index = start_index + count;
+        let target_index = start_index
+            .checked_add(count)
+            .expect("address derivation index cannot exceed u32::MAX");
         let (bdk_wallet, bdk_database) = self.bdk_wallet_db_mut();
         for _ in local_index..target_index {
             bdk_wallet.reveal_next_address(keychain);
@@ -1826,7 +1828,10 @@ impl MultisigWallet {
 
         let op_idx = self.get_local_last_processed_operation_idx_impl(&txn)?;
         txn.commit()?;
-        let Some(op) = self.hub_client().get_operation_by_idx(op_idx + 1)? else {
+        let next_op_idx = op_idx
+            .checked_add(1)
+            .expect("operation index cannot exceed i32::MAX");
+        let Some(op) = self.hub_client().get_operation_by_idx(next_op_idx)? else {
             return Ok(None);
         };
 

src/wallet/objects.rs

@@ -808,15 +808,21 @@ pub struct AssignmentsCollection {
 #[cfg(any(feature = "electrum", feature = "esplora"))]
 impl AssignmentsCollection {
     fn add_fungible(&mut self, amt: u64) {
-        self.fungible += amt;
+        self.fungible = self
+            .fungible
+            .checked_add(amt)
+            .expect("total fungible amount cannot exceed u64::MAX");
     }
 
     fn add_non_fungible(&mut self) {
         self.non_fungible = true;
     }
 
     fn add_inflation(&mut self, amt: u64) {
-        self.inflation += amt;
+        self.inflation = self
+            .inflation
+            .checked_add(amt)
+            .expect("total inflation amount cannot exceed u64::MAX");
     }
 
     pub(crate) fn add_opout_state(&mut self, opout: &Opout, state: &AllocatedState) {

src/wallet/offline.rs

@@ -124,7 +124,12 @@ pub trait WalletOffline: WalletBackup {
         mut_unspents
             .iter_mut()
             .for_each(|u| u.rgb_allocations.retain(|a| !a.status.failed()));
-        let max_allocs = max_allocations.unwrap_or(self.max_allocations_per_utxo() - 1);
+        let max_allocs = max_allocations.unwrap_or_else(|| {
+            // guaranteed > 0; guard here too to avoid future regression
+            self.max_allocations_per_utxo()
+                .checked_sub(1)
+                .expect("max allocations per UTXO must be greater than 0")
+        });
         Ok(mut_unspents
             .iter()
             .filter(|u| u.utxo.exists)
@@ -1453,7 +1458,10 @@ pub trait WalletOffline: WalletBackup {
         Ok(Balance {
             settled: balance.confirmed.to_sat(),
             future: future.to_sat(),
-            spendable: future.to_sat() - balance.immature.to_sat(),
+            spendable: future
+                .to_sat()
+                .checked_sub(balance.immature.to_sat())
+                .expect("immature balance cannot exceed the total balance"),
         })
     }
 

src/wallet/online.rs

@@ -255,7 +255,10 @@ pub trait WalletOnline: WalletOffline {
                     (inputs, usable_btc_amount)
                 } else {
                     inputs.push(outpoint);
-                    (inputs, usable_btc_amount + value)
+                    let usable_btc_amount = usable_btc_amount
+                        .checked_add(value)
+                        .expect("total UTXO value cannot exceed u64::MAX");
+                    (inputs, usable_btc_amount)
                 }
             },
         );
@@ -1809,7 +1812,7 @@ pub trait WalletOnline: WalletOffline {
         }
 
         let mut assignments_collected = AssignmentsCollection::default();
-        let mut input_btc_amt = 0;
+        let mut input_btc_amt: u64 = 0;
         for unspent in mut_unspents {
             // get spendable allocations for the required asset
             let asset_allocations: Vec<LocalRgbAllocation> = unspent
@@ -1857,7 +1860,14 @@ pub trait WalletOnline: WalletOffline {
                 .for_each(|a| a.assignment.add_to_assignments(&mut assignments_collected));
             input_outpoints.push(unspent.utxo.outpoint());
 
-            input_btc_amt += unspent.utxo.btc_amount.parse::<u64>().unwrap();
+            let utxo_btc_amt = unspent
+                .utxo
+                .btc_amount
+                .parse::<u64>()
+                .expect("DB should contain a valid BTC amount");
+            input_btc_amt = input_btc_amt
+                .checked_add(utxo_btc_amt)
+                .expect("total input BTC value cannot exceed u64::MAX");
 
             // stop as soon as we have the needed assignments
             if assignments_collected.enough(assignments_needed) {
@@ -1961,7 +1971,12 @@ pub trait WalletOnline: WalletOffline {
                                     details: e.to_string(),
                                 })?;
                         }
-                        free_utxos.sort_by_key(|u| u.utxo.btc_amount.parse::<u64>().unwrap());
+                        free_utxos.sort_by_key(|u| {
+                            u.utxo
+                                .btc_amount
+                                .parse::<u64>()
+                                .expect("DB should contain a valid BTC amount")
+                        });
                     }
                     if let Some(a) = free_utxos.pop() {
                         all_inputs.insert(a.utxo.into());
@@ -3493,13 +3508,15 @@ pub trait WalletOnline: WalletOffline {
         let (asset_id, transfer_info) = info_contents.transfers.into_iter().next().unwrap();
         let inflation = transfer_info.original_assignments_needed.inflation;
         let db_asset = txn.get_asset(asset_id).unwrap().unwrap();
-        let updated_known_circulating_supply = db_asset
+        let known_circulating_supply = db_asset
             .known_circulating_supply
             .as_ref()
             .unwrap()
             .parse::<u64>()
-            .unwrap()
-            + inflation;
+            .expect("DB should contain a valid known circulating supply");
+        let updated_known_circulating_supply = known_circulating_supply
+            .checked_add(inflation)
+            .expect("known circulating supply plus inflation cannot exceed u64::MAX");
         let mut updated_asset: DbAssetActMod = db_asset.into();
         updated_asset.known_circulating_supply =
             ActiveValue::Set(Some(updated_known_circulating_supply.to_string()));

src/wallet/rust_only.rs

@@ -135,14 +135,16 @@ impl Wallet {
             let mut asset_transition_builder =
                 runtime.transition_builder(contract_id, "transfer")?;
 
-            let mut asset_available_amt = 0;
+            let mut asset_available_amt: u64 = 0;
             let mut uda_state = None;
             for (_, opout_state_map) in
                 runtime.contract_assignments_for(contract_id, prev_outputs.iter().copied())?
             {
                 for (opout, state) in opout_state_map {
                     if let AllocatedState::Amount(amt) = &state {
-                        asset_available_amt += amt.as_u64();
+                        asset_available_amt = asset_available_amt
+                            .checked_add(amt.as_u64())
+                            .expect("total available asset amount cannot exceed u64::MAX");
                     } else if let AllocatedState::Data(_) = &state {
                         asset_available_amt = 1;
                         // there can be only a single state when contract is UDA