hiero-ledger / hiero-ledger/hiero-consensus-node

Long overflow when merging claim-airdrop transfers

Open
#23,767 0 comments 0 reactions 1 assignee Claimed by @derektriley View on GitHub
Dominant language
Java
Stars
406
Forks
226
Avg merge
3d 4h
Merged PRs (30d)
210

Description

### Background

**Problem**
TokenClaimAirdropHandler.mergeTransfer() merges multiple AccountAmount entries for the same account using long +. When claiming multiple pending fungible airdrops for the same token+receiver (from different senders), the receiver credit can overflow silently (e.g. Long.MAX_VALUE - 5 + 10 wraps negative).
Today this manifests as a confusing failure: the synthetic CryptoTransfer fails pure checks with TRANSFERS_NOT_ZERO_SUM_FOR_TOKEN (net-zero is validated using BigInteger, so wraparound breaks the invariant).

**Proposed fix**
Replace a + b with Math.addExact(a, b) in TokenClaimAirdropHandler.mergeTransfer().
On ArithmeticException, throw HandleException(INSUFFICIENT_TOKEN_BALANCE) (consistent with existing overflow handling in airdrop pending-value merging).

**Tests**
Add an embedded HAPI test that constructs oversubscribed pending airdrops causing merge overflow; verify:
pre-fix: TRANSFERS_NOT_ZERO_SUM_FOR_TOKEN
post-fix: INSUFFICIENT_TOKEN_BALANCE
Add a focused unit test in TokenClaimAirdropHandlerTest asserting overflow in mergeTransfer() is caught and mapped to INSUFFICIENT_TOKEN_BALANCE.

### Acceptance Criteria

- See above

### Dependencies

_No response_

### Definition of Ready (DoR) Checklist

- [ ] Clear acceptance criteria
- [ ] Clear and detailed description
- [ ] Dependencies identified
- [ ] Links to documentation
- [ ] Should be completable in 2-3 Days
- [ ] Initial draft of Low-level design document
- [ ] At least high level test plan
- [ ] Groomed/Estimated

### Definition of Done (DoD) Checklist

- [ ] Acceptance Criteria complete
- [ ] No Codacy issues greater than minor (in new code)
- [ ] JavaDocs updated/created
- [ ] Code commented
- [ ] Unit tests created/updated
- [ ] 80% test code coverage (in new code)
- [ ] Happy Path and major negative cases in HAPI tests as applicable

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.