Skip to content

Savings Goals: Add overflow-safe arithmetic tests for batch_add_to_goals aggregate totals #618

@Baskarayelu

Description

@Baskarayelu

Description

batch_add_to_goals accepts a Vec<ContributionItem> (bounded by MAX_BATCH_SIZE = 50) and credits multiple goals in one call. Summing contributions and updating each goal's current_amount against its target_amount must be overflow-safe; with overflow-checks = true an i128 overflow aborts the transaction, but we want explicit InvalidAmount/Overflow handling rather than a panic-abort, plus tests covering near-i128::MAX goal balances and a duplicate-goal-id item list.

Requirements and context

  • Secure: Use checked arithmetic returning SavingsGoalError::Overflow; reject amount <= 0 with InvalidAmount; enforce BatchTooLarge at >50 items.
  • Tested: near-max balances, duplicate goal ids in one batch, oversize batch rejection, zero/negative amounts.
  • Documented: Document batch semantics in docs/.
  • Reference real symbols: batch_add_to_goals, ContributionItem { goal_id, amount }, MAX_BATCH_SIZE, SavingsGoalError::{Overflow, InvalidAmount, BatchTooLarge}, SavingsGoal { current_amount, target_amount }.

Suggested execution

  • Branch feature/sg-batch-overflow-safety.
  • Replace any unchecked add with checked ops in savings_goals/src/lib.rs; add tests in savings_goals/tests/stress_test_large_amounts.rs.
  • Add docs docs/savings-goals-batch-arithmetic.md.
  • Add /// comments on overflow handling.
  • Validate security assumptions: graceful error, not abort, on overflow.

Test and commit

  • Run cargo test -p savings_goals.
  • Cover edge cases: duplicate ids, 51-item batch, i128::MAX - 1 balance.
  • Include test output and an overflow-handling note.

Example commit message

fix: use checked i128 arithmetic in batch_add_to_goals and add overflow tests

Guidelines

  • Minimum 95% test coverage
  • Clear documentation in docs/ and inline /// comments
  • Timeframe: 96 hours

Metadata

Metadata

Assignees

Labels

Stellar WaveIssues in the Stellar wave programsecuritySecurity hardening and auditssmart-contractSoroban/Rust smart contract worksorobanStellar Soroban specifictestingTests and coverage

Type

No fields configured for Task.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions