Filed from the second-wave repository audit (issue 95/100). See the audit summary for full category context.
- Location:
contracts/stream_contract/src/test.rs
- Problem: Existing overflow tests (
test_claimable_max_i128_rate_overflow, test_fuzz_large_amount_no_overflow, test_fuzz_claimable_overflow_and_cancel_invariants) only exercise calculate_claimable's checked-arithmetic path; none assert behavior for the five unchecked +=/*/+ sites identified in Functional Edge Case #22.
- Evidence: No test targets
collect_fee, top_up_stream's deposited_amount +=, or apply_withdrawal's withdrawn_amount += at boundary values.
- Suggested implementation: Add boundary-value tests (near
i128::MAX/u64::MAX) for each of the five sites, asserting a typed Err rather than a panic once Functional Edge Case #22 is fixed.
- Acceptance criteria: All five sites have a passing boundary test after the fix, each of which would panic (test failure) against the current unfixed code.
- Difficulty: M
- Expected impact: Ensures the overflow-handling fix in #22 is actually enforced going forward, not just fixed once.
contracts/stream_contract/src/test.rstest_claimable_max_i128_rate_overflow,test_fuzz_large_amount_no_overflow,test_fuzz_claimable_overflow_and_cancel_invariants) only exercisecalculate_claimable's checked-arithmetic path; none assert behavior for the five unchecked+=/*/+sites identified in Functional Edge Case #22.collect_fee,top_up_stream'sdeposited_amount +=, orapply_withdrawal'swithdrawn_amount +=at boundary values.i128::MAX/u64::MAX) for each of the five sites, asserting a typedErrrather than a panic once Functional Edge Case #22 is fixed.