hiero-ledger / hiero-ledger/hiero-consensus-node
Long overflow when merging claim-airdrop transfers
- Dominant language
- Java
- Stars
- 406
- Forks
- 226
- Avg merge
- 3d 4h
- Merged PRs (30d)
- 210
Description
### Background
**Problem**
TokenClaimAirdropHandler.mergeTransfer() merges multiple AccountAmount entries for the same account using long +. When claiming multiple pending fungible airdrops for the same token+receiver (from different senders), the receiver credit can overflow silently (e.g. Long.MAX_VALUE - 5 + 10 wraps negative).
Today this manifests as a confusing failure: the synthetic CryptoTransfer fails pure checks with TRANSFERS_NOT_ZERO_SUM_FOR_TOKEN (net-zero is validated using BigInteger, so wraparound breaks the invariant).
**Proposed fix**
Replace a + b with Math.addExact(a, b) in TokenClaimAirdropHandler.mergeTransfer().
On ArithmeticException, throw HandleException(INSUFFICIENT_TOKEN_BALANCE) (consistent with existing overflow handling in airdrop pending-value merging).
**Tests**
Add an embedded HAPI test that constructs oversubscribed pending airdrops causing merge overflow; verify:
pre-fix: TRANSFERS_NOT_ZERO_SUM_FOR_TOKEN
post-fix: INSUFFICIENT_TOKEN_BALANCE
Add a focused unit test in TokenClaimAirdropHandlerTest asserting overflow in mergeTransfer() is caught and mapped to INSUFFICIENT_TOKEN_BALANCE.
### Acceptance Criteria
- See above
### Dependencies
_No response_
### Definition of Ready (DoR) Checklist
- [ ] Clear acceptance criteria
- [ ] Clear and detailed description
- [ ] Dependencies identified
- [ ] Links to documentation
- [ ] Should be completable in 2-3 Days
- [ ] Initial draft of Low-level design document
- [ ] At least high level test plan
- [ ] Groomed/Estimated
### Definition of Done (DoD) Checklist
- [ ] Acceptance Criteria complete
- [ ] No Codacy issues greater than minor (in new code)
- [ ] JavaDocs updated/created
- [ ] Code commented
- [ ] Unit tests created/updated
- [ ] 80% test code coverage (in new code)
- [ ] Happy Path and major negative cases in HAPI tests as applicable
Contributor guide
Assessment
This issue has not been assessed yet.