Refund Unused Extrinsic Weight (fee) - #2997
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
eco-tests changed — indexer review requiredThis PR modifies files under Changed files
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
🛡️ AI Review — Skeptic (security review)VERDICT: SAFE VERY HIGH scrutiny due to account age/public-repo tier, mitigated by repository write permission and explained benchmark-bot commits; no Gittensor association found. Branch: feat/subtensor-actual-weight-refunds → main. The maximum dispatch reservation now belongs to each variable-work call, so nested dispatch wrappers inherit it and propagate the call’s measured post-dispatch refund. No security vulnerabilities or malicious behavior were found by static analysis. FindingsNo findings. Prior-comment reconciliation
ConclusionThe previously reported nested-dispatch undercharge is addressed, and no new security findings remain. 📜 Previous run (superseded)
🔍 AI Review — Auditor (domain review)VERDICT: 👍 Gittensor association UNKNOWN; repository write access and substantial Subtensor activity, but the account is under 90 days old. Static inspection was sufficient; no runtime test or auto-fix was needed. Description discrepancyThe runtime bumps Overlapping workThis PR is the better candidate for the weight-accounting changes also touched by #2993 because it integrates claim-root accounting into the comprehensive refund implementation and associated tests. Recommend closing #2993 once its release-branch requirements are confirmed covered. FindingsNo findings. Prior-comment reconciliation
ConclusionThe variable dispatch paths conservatively precharge admission weight and return benchmark-derived actual weight on success and failure, with corresponding chain-extension refunds and parameterized generated weights. The PR is ready from a domain-review perspective. |
|
🔄 AI review updated — Skeptic: VULNERABLE |
|
🔄 AI review updated — Skeptic: SAFE Auditor: 👎 |
|
🔄 AI review updated — Skeptic: SAFE Auditor: 👎 |
|
🔄 AI review updated — Skeptic: SAFE Auditor: 👎 |
|
🔄 AI review updated — Skeptic: SAFE Auditor: 👎 |
|
🔄 AI review updated — Skeptic: VULNERABLE |
|
🔄 AI review updated — Skeptic: SAFE Auditor: 👍 |
|
🔄 AI review updated — Skeptic: SAFE Auditor: 👍 |
| pub fn precharge_maximum(benchmark_model: Weight) -> Weight { | ||
| benchmark_model |
There was a problem hiding this comment.
[HIGH] Nested dispatch bypasses the maximum-weight reserve
This leaves nested variable-work calls charged only at their benchmark-model metadata weight, while the maximum reserve is added exclusively by SubtensorTransactionExtension when the top-level call matches reserves_maximum_dispatch_weight. Wrappers such as utility batch, proxy, multisig, and sudo present their outer call to that extension, so an inner claim_root, swap_coldkey_announced, or root swap_coldkey receives no reserve. Several such calls now declare state-dependent parameters as zero and report the larger value only post-dispatch; FRAME's nested-dispatch accounting caps refunds/actual weight against the inner declared weight. An attacker can therefore batch expensive state fan-out while admission and block accounting see the small zero-parameter weights. Provide a conservative composable declaration for nested calls, or make every wrapper path reserve and propagate the uncapped actual weight safely.
|
🔄 AI review updated — Skeptic: VULNERABLE |
|
🔄 AI review updated — Skeptic: SAFE Auditor: 👍 |
1 participant
Motivation
Subtensor extrinsics with state-dependent work currently charge their declared worst-case weight without consistently returning the weight actually consumed. This overcharges transaction fees and contract chain-extension gas for smaller executions.
Changes
Files of interest
pallets/subtensor/src/weight_accounting.rspallets/subtensor/src/macros/dispatches.rspallets/subtensor/src/swap/swap_hotkey.rspallets/subtensor/src/benchmarks/pallets/subtensor/src/weights.rschain-extensions/src/lib.rsruntime/src/lib.rsBehavioral impact
Variable-work extrinsics reserve sufficient weight for admission and refund unused weight after execution. Failed dispatches also report their actual consumed weight. Contract chain-extension callers receive corresponding gas adjustments.
Runtime upgrade
This changes runtime dispatch and fee behavior.
spec_versionis bumped from 440 to 441. No storage migration is introduced.Testing
Unit and runtime tests cover post-dispatch weights, failure-path refunds, chain-extension adjustments, and claim-root accounting. The affected benchmarks must be regenerated and checked to ensure each variable component produces the expected weight slope before merge.