paritytech / paritytech/dotns

[Bug]: The storage-deposit floor is a hardcoded testnet amount, 100× its documented value

Open
#226 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

dotns-sdk good first issue P2 type: bug
Dominant language
Solidity
Stars
4
Forks
2
Avg merge
1d 18h
Merged PRs (30d)
24

Description

Component

Other

Priority

P2

What happened?

ReviveClientWrapper.submitTransaction caps the storage deposit on every write with a hardcoded literal:

// Add 20% buffer to storage deposit, minimum 2 PAS
const minimumStorageDeposit = 2_000_000_000_000n;
let storageDepositLimit =
  gasEstimate.storageDeposit === 0n
    ? minimumStorageDeposit
    : (gasEstimate.storageDeposit * 120n) / 100n;

if (storageDepositLimit < minimumStorageDeposit) storageDepositLimit = minimumStorageDeposit;

The CLI works in planck, and DEFAULT_NATIVE_TOKEN_DECIMALS = 10, so 2e12 planck is 200 tokens, not 2. The comment is out by a factor of 100, and it names a testnet token on a path shared by every write.

Two consequences. storage_deposit_limit is a ceiling on what the caller can be charged, so setting it 100× too high removes the protection it exists to provide. And because no DotNS write comes near 167 tokens, the floor wins on essentially every call, so the estimate × 1.2 branch above it is dead in practice and the limit is never derived from the dry run at all.

Expected behavior

Native amounts are expressed in units derived from the chain's own tokenDecimals rather than assumed, so a floor documented as "2 tokens" is two tokens on whatever chain is connected.

Reproduction

2_000_000_000_000n / 10n ** 10n // 200n, against a comment claiming 2

Additional context

It may be worth doing further checks on all hard-coded constants that may depend on the specific chain.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at ReviveClientWrapper.submitTransaction and trace how the connected chain exposes tokenDecimals before reviewing related write or dry-run tests. Done means the storage-deposit floor is derived from the chain's native decimals, the documented two-token value is respected, and the estimate-based limit remains effective for writes.

Written by the indexing model from the issue text.

Assessment

Tech stack
solidity
Domain
blockchain
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.