Skip to content

[rosetta] Audit fixes for currency config, construction, balances#20231

Open
gregnazario wants to merge 3 commits into
mainfrom
greg/aptos-rosetta-audit-984b
Open

[rosetta] Audit fixes for currency config, construction, balances#20231
gregnazario wants to merge 3 commits into
mainfrom
greg/aptos-rosetta-audit-984b

Conversation

@gregnazario

@gregnazario gregnazario commented Jul 16, 2026

Copy link
Copy Markdown
Contributor

Summary

Fixes a few correctness bugs in crates/aptos-rosetta found during review:

  • Accept FA-only currencies from --currency-config-file (previously skipped when move_type was absent)
  • Skip /construction/metadata simulation when both max gas and gas price are provided
  • Require public keys for preprocess unless both gas fields are set (with a TODO to support simulation without them)
  • Use checked_mul for suggested fee calculation
  • Avoid panicking on invalid FA addresses during balance lookup

Test plan

  • cargo test -p aptos-rosetta --lib
Open in Web Open in Cursor 

Address correctness bugs found while auditing aptos-rosetta:
- Accept FA-only currencies from the currency config file
- Skip metadata simulation when both max gas and gas price are set
- Require public keys unless both gas fields are provided
- Validate block index/hash agreement
- Avoid silent stake balance parse failures and fee mul overflow

Co-authored-by: Greg Nazario <greg@gnazar.io>
Comment thread crates/aptos-rosetta/src/account.rs Outdated
Comment thread crates/aptos-rosetta/src/common.rs Outdated
Comment thread crates/aptos-rosetta/src/construction.rs
Keep unparsable stake balances as zero, restore ignore-hash-when-index
block lookup with documentation, and note a TODO for simulation without
public keys.

Co-authored-by: Greg Nazario <greg@gnazar.io>
@gregnazario
gregnazario marked this pull request as ready for review July 20, 2026 18:07
@gregnazario
gregnazario requested a review from a team as a code owner July 20, 2026 18:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants