mirror of
https://github.com/luxfi/consensus.git
synced 2026-09-24 00:26:58 +00:00
zeekayandHanzo Dev
c220da75b1
Both rungs decided by comparing a summed stake against a floor read off the total, and both summed with a bare +. Go's + is modular, so a StakeSource reporting weights past 2^64 did not fail the tally — it returned a different number and the comparison proceeded. The wrapped value can land above the floor: three voters at 2^63 wrap to 2^63, which clears floor(total/2) for a total of 2^64-1 by one, and the certificate was accepted on arithmetic rather than on votes. At the Quasar rung, which carries no signer floor, the tally was the only thing between such a cert and export-grade finality. Rust has held this clause all along (Cert::voted_stake, checked_add -> WeightOverflow). This is the Go side of the same rule, written once as votedStake rather than twice at the two call sites, and returning the ErrWeightOverflow both admission doors already return. Not remotely exploitable: Verify's strictly-increasing-signer clause refuses a duplicated voter before the tally, and Register and FlattenValidatorSet both refuse a set whose weights overflow, so no admitted set can reach it. Reaching it is evidence about the source, not about the votes. The tests state the wrap outright — the value the old loop produced and the floor it cleared — before asserting the refusal, so they fail against the unchecked loop rather than passing against anything that refuses everything. Co-authored-by: Hanzo Dev <[email protected]>