mirror of
https://github.com/luxfi/chains.git
synced 2026-09-24 00:26:00 +00:00
zeekay
98b2a7fce7
Every VM in this repo burns through this package, and its fail-secure guards were the part with no tests: the overflow arms, the corrupt-state refusal, and every storage-failure path. 82.7% -> 100.0%. An unreadable balance is not a balance of zero. Reporting zero would make an unfunded account and an unreachable store indistinguishable, and the caller would charge the one it could not read. Same for a stored value of the wrong width: that is corruption, not a number, and decoding it invents a balance from whatever bytes are there. Burn's two writes are ordered on purpose. Either can fail, and whichever half stages alone is wrong -- the caller must abort, because the Balances contract puts both writes in the block's commit. But they are not equally wrong if one ever did commit: debit-then-record destroys value, record-then-debit invents it, and an overstated burn counter is unrecoverable because nobody can say which account should have paid. The survivable failure is the chosen one. Conservation is now asserted rather than assumed: across an interleaving of credits and burns, including refused ones, everything credited is still either spendable or burned -- never both, never neither. That is what makes this a ledger instead of two counters that happen to move together. 8/8 mutation checks caught, including the write order.