Repository navigation
Conversation
LotteryBuy only checked amount > 0. amount*coinPrecision is then used for the transfer and freeze and can wrap past int64: e.g. amount=184467440738 pays 0.90448384 coin while Fund/BuyAmount record 184467440738. The draw later computes factor from precision*Fund, which overflows as well and leaves factor=0, so the round can never be drawn and the funds stay locked until close. Reject amounts that would overflow amount*precision or exceed MaxCoin behind ForkLotteryFixOverflow (default height 0). Add regression tests for the rejection, the normal buy/draw path and the close path.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
问题
LotteryBuy只检查amount > 0，随后用amount*coinPrecision做转账/冻结：Amount=184467440738时乘积回绕成 90448384（0.90448384 枚），但Fund/BuyAmount记成 184467440738；factor = precision*Fund/2/totalFund再次 int64 溢出，factor=0，随后 0 金额转账返回ErrAmount，本轮无法开奖，资金锁到关奖。实测（v1.76.3 执行器）：溢出买入成功、开奖失败、关奖按回绕额退款。属资金锁定/DoS，同时暴露出资金会计被绕过。
修复
ForkLotteryFixOverflow：LotteryBuy拒绝amount*precision溢出及amount >= MaxCoin。验证
go build ./plugin/dapp/lottery/...通过go test ./plugin/dapp/lottery/executor/ -count=1通过