0xMiden / 0xMiden/wallet

Stress conservation number is contaminated by foreign faucets: getBalance ignores its token symbol

Aberta
#770 1 comentário 0 reações 0 responsáveis Ver no GitHub
Linguagem predominante
TypeScript
Estrelas
5
Forks
28
Merge médio
9h 50min
PRs com merge (30d)
123

Descrição

`getBalance(_tokenSymbol?)` in the E2E harness ignores its symbol argument and sums **every** faucet in the wallet, so unrelated dust lands in the stress suite's conservation assertion signed — it can invent a violation, shrink a real one, or invert it.

**Where** — `playwright/e2e/helpers/wallet-page.ts:1464`. The parameter is underscore-prefixed and referenced exactly once, in the signature. Two separate sums are unfiltered: the `freshState.balances` loop (~1491) and the `miden_sync_data.notes` loop (~1502).

**Symptom** — `conservationHeld: false` on a run where the tracked asset is conserved to the unit.

**Repro** — 25-note all-private stress run on testnet today (`e4fadde3`, `seed 942930517`):

```
A = 3004 B = 2996.0304 total = 6000.0304
expectedDeltaA = +4 expectedDeltaB = -4 conservationHeld = FALSE
```

TST is exact: 3004 + 2996 = 6000, matching the driver's expected ±4. The entire reported deviation is 0.0304 of foreign-faucet dust.

**Expected** — the conservation assertion measures only the harness's own faucet.

**Impact** — both directions, and both are load-bearing:
- **False positive** (above): a clean run reports a conservation violation.
- **False negative**: on the 2026-08-17 run the same defect masked **72% of a −70 TST loss**. On 2026-08-24 it was small (≈0.35 against −151) but still signed.

Because the headline number of every stress run passes through this function, a real fund-loss regression can be hidden by dust from an unrelated faucet.

Fix sketch

Filter both loops by the harness faucet id (the one `deploy_and_fund` creates), resolving the symbol argument to a faucet id and skipping non-matching entries. `quickBalanceSnapshot()`/`totalReportable` should get the same treatment so the settle loop and the final assertion agree.

Callers that legitimately want an all-asset total should ask for it explicitly rather than getting it by accident from an ignored parameter.

Status on branches

Unfixed on both `origin/main` and `origin/next` as of 2026-08-25 — the two files are byte-identical at this function.

**Reviewers:** the part worth your time is whether to filter by symbol or by faucet id — `deploy_and_fund` knows the faucet id, but `getBalance` currently takes a symbol, and the swap/earn specs may rely on the current all-asset behaviour.

Guia de contribuição

Abrir o guia de contribuição

Avaliação

Esta issue ainda não foi avaliada.

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.