Merge branch 'master' into feat/add-weight-comparison-task

Author: dmoka

CLAUDE.md

@@ -147,6 +147,68 @@ Types: `feat`, `fix`, `refactor`, `perf`, `test`, `docs`, `style`, `ci`, `build`
 
 **Branches:** `fix/description` or `feat/description`
 
+## Code comments and docs
+
+Default to **no comment**. Only write one when the *why* is non-obvious — a hidden
+invariant, a surprising decision, a workaround. If removing the comment wouldn't
+confuse a future reader who can see the code, don't write it.
+
+**Never restate what the code already says.** Well-named identifiers and types are
+the documentation. Comments that paraphrase the next line are noise.
+
+### Module / file headers
+One paragraph max. State what lives here; don't enumerate every item or describe
+the flow step-by-step.
+
+### Struct / enum field docs
+Skip the obvious (`pub unstaking: Balance`, `pub voters_count: u32`). Document a
+field only when its semantics are surprising — e.g. it stacks instead of replacing,
+must match an external balance, doubles as an idempotency signal.
+
+### Error variants
+One line each, or none if the name already tells the story. Don't write a
+paragraph explaining the policy that produces the error — that belongs at the
+check site.
+
+### Extrinsic docs
+Follow the Description / Parameters / Emits structure from the "Extrinsic
+documentation" section above, but keep the **Description to 1–2 lines plus at
+most one short paragraph** for genuinely load-bearing context. In particular:
+
+- Do not enumerate `Error` variants in the Description — the `#[pallet::error]`
+  enum is the source of truth.
+- Do not list internal implementation steps ("locks X, then mints Y, then calls
+  Z"). The code shows that.
+- Keep the *why* of any non-obvious constraint (e.g. "refuses while stHDX is in
+  circulation — outstanding aTokens would be stranded").
+
+### Trait method docs
+One line. If the trait-level doc already explains the contract, leave method
+docs out entirely.
+
+### Inline comments inside function bodies
+Reserve for:
+- Non-obvious invariants the next line relies on.
+- Why a defensive branch exists / why an error is intentionally swallowed.
+- Why an unusual construct (`drain_prefix(...).count()` to actually drain,
+  `set_lock` vs `extend_lock`, pre-decrement before an external call) is correct.
+
+Skip:
+- Narrating control flow ("// new record: increment voter count" above
+  `voters_count += 1`).
+- Explaining what a well-named helper does at its call site.
+- Restating the assertion in the next `ensure!`.
+
+### What to keep
+Comments that warn a future reader about something they would otherwise miss:
+- "Must match `LockableAToken.sol`'s `freeBalance` check"
+- "Saturating math — hooks must never block voting"
+- "Pool presence ⇔ allocation has run" (load-bearing idempotency signal)
+- "stHDX invariants — verify on AAVE config change: (1)…(2)…"
+
+If in doubt, delete the comment and see if the code still reads. If it does,
+leave it out.
+
 ## Versioning
 
 - **SemVer** on all crates — bump `Cargo.toml` version on changes

Cargo.lock

@@ -1 +1,2 @@
 cc 22ef4648bbc715696260418b2fb3790628c7788f9258b8b9a4f704dc424ee536 # shrinks to asset_out = AssetReserveState { reserve: 190635865358630188, hub_reserve: 1430674154905521092, shares: 100000000000000000, protocol_shares: 100000000000000000 }, amount = 5307728205712486, asset_fee = Permill(300), imbalance = I129 { value: 8936367638875155, negative: true }
+cc 611689fb0af263ea5f079f78b2907a0d86a5a841e52c6ab6d4c781f5ba4b59d0 # shrinks to asset = AssetReserveState { reserve: 2951077894421946163, hub_reserve: 5203031156877507362, shares: 100000000000000000, protocol_shares: 100000000000000000 }, position = Position { amount: 1000000000, shares: 1000000000, price: (1763095357072293632, 1000000000000000000) }

math/proptest-regressions/omnipool/invariants.txt

@@ -0,0 +1,12 @@
+# Seeds for failure cases proptest has generated in the past. It is
+# automatically read and these particular cases re-run before any
+# novel cases are generated.
+#
+# It is recommended to check this file in to source control so that
+# everyone who runs the test benefits from these saved cases.
+cc 25c9d46027af5640b9cce25c1970d5378de64752dd1c9520f5757251db333d27 # shrinks to pool = [AssetReserve { amount: 368323000000, decimals: 6 }, AssetReserve { amount: 380987625000000, decimals: 6 }, AssetReserve { amount: 488969232000000, decimals: 6 }, AssetReserve { amount: 12656000000, decimals: 6 }], amount = 241, amp = 6682, (idx_in, idx_out) = (1, 3)
+cc b8acd18b42aad7c2bf2fb1869de4f133a49e05a5fd165865f781cadd006488c9
+cc b8ffdc09a03ed41698bc59c46d68585ee05e238c14fd8d53d3b7fb0cedfabe3b
+cc 3b86f211644d954ca6a8212758cd01d579c3b1d0cfe5cc615ff25726df7d1fb0
+cc 63a30c69dc9a73f7cfc9c21fc4cc75e88026f721c3fa9b2b8eaa514e988e2649
+cc 464e37423f75de7afd23eef91ca5b097a1aa5e4f9bd839325571089ef256f924

math/proptest-regressions/stableswap/tests/invariants.txt

@@ -60,7 +60,7 @@ fn high_asset_state() -> impl Strategy<Value = AssetReserveState<Balance>> {
 }
 
 fn trade_amount() -> impl Strategy<Value = Balance> {
-	1_000_000_000..10000 * ONE
+	ONE / 10..10000 * ONE
 }
 
 fn price() -> impl Strategy<Value = FixedU128> {

math/src/omnipool/invariants.rs

@@ -7,7 +7,8 @@ use proptest::proptest;
 const D_ITERATIONS: u8 = 128;
 const Y_ITERATIONS: u8 = 64;
 
-const RESERVE_RANGE: (Balance, Balance) = (10_000, 1_000_000_000);
+// Floor lower than 30k with the 1B ceiling lets in-pool imbalance exceed ~33_000:1, past the assertion's absolute tolerance.
+const RESERVE_RANGE: (Balance, Balance) = (30_000, 1_000_000_000);
 const TRADE_RANGE: (Balance, Balance) = (1, 5_000);
 
 fn asset_reserve() -> impl Strategy<Value = Balance> {
@@ -22,10 +23,16 @@ fn amplification() -> impl Strategy<Value = Balance> {
 	2..10000u128
 }
 
+// Sample j from the (size - 1) indices that aren't i, instead of rejecting (i, i)
+// after the fact — the old prop_filter approach hit proptest's local-reject ceiling
+// at high case counts.
 fn trade_pair(size: usize) -> impl Strategy<Value = (usize, usize)> {
-	(0..size, 0..size)
-		.prop_filter("cannot be equal", |(i, j)| i != j)
-		.prop_map(|(i, j)| (i, j))
+	(0..size).prop_flat_map(move |i| {
+		(
+			Just(i),
+			(0..(size - 1)).prop_map(move |j| if j >= i { j + 1 } else { j }),
+		)
+	})
 }
 
 fn to_precision(value: Balance, precision: u8) -> Balance {

math/src/stableswap/tests/invariants.rs

@@ -1,6 +1,6 @@
 [package]
 name = "pallet-omnipool"
-version = "7.4.0"
+version = "7.4.1"
 authors = ['GalacticCouncil']
 edition = "2021"
 license = "Apache-2.0"

pallets/omnipool/Cargo.toml

@@ -0,0 +1,10 @@
+# Seeds for failure cases proptest has generated in the past. It is
+# automatically read and these particular cases re-run before any
+# novel cases are generated.
+#
+# It is recommended to check this file in to source control so that
+# everyone who runs the test benefits from these saved cases.
+cc b5615762d1d28f231d3ea961960f65a06479d6e1ddce516f0cd7a77fea7849f0
+cc 9786c92da35b3c68727ddd8bdcc569386f36e2eb702520448e63d834cf352759
+cc 5d47b539d9721d7d14c1b7ec50dfe1ef3236c1b0c89bdba0d7d6edb7e1e56eb8
+cc d5f6d6ad933b479696b936b91148a198b5ceed8701c97d9521c184a2e70b20a8

pallets/omnipool/proptest-regressions/tests/slip_fee_invariants.txt

@@ -979,3 +979,52 @@ fn on_finalize_clears_with_defensive_check() {
 			assert!(SlipFeeHubReserveAtBlockStart::<Test>::get(100).is_none());
 		});
 }
+
+// A sizeable buy of a high-priced asset_out, paid for with a low-priced asset_in
+// under a large slip cap (40+%), inflates the required LRNA past the discriminant
+// threshold of the uncapped sell-side inversion, so the math returns Overflow.
+
+// Since maxSlipFee is 25% on prod, this scenario should never really happen
+#[test]
+fn buy_should_fail_with_overflow_when_low_priced_asset_in_pays_for_large_high_priced_buy() {
+	use sp_runtime::{ArithmeticError, DispatchError};
+
+	let amount: Balance = 3_622_468_058_278_488;
+	let stable_price = FixedU128::from_float(0.1);
+	let stable_reserve: Balance = 100_000_000_000_000_000;
+	let native_reserve: Balance = 100_000_000_000_000_000;
+	let token_in_price = FixedU128::from_float(0.1);
+	let token_in_reserve: Balance = 100_000_000_000_000_000;
+	let token_out_price = FixedU128::from_float(1.981_763_482_850_658_5);
+	let token_out_reserve: Balance = 100_000_000_000_000_000;
+	let asset_fee = Permill::from_rational(22u32, 1_000u32);
+	let protocol_fee = Permill::from_percent(3);
+	let max_slip_fee = Permill::from_percent(46);
+
+	let lp_in: u64 = 200;
+	let lp_out: u64 = 300;
+	let buyer: u64 = 500;
+
+	ExtBuilder::default()
+		.with_endowed_accounts(vec![
+			(Omnipool::protocol_account(), DAI, stable_reserve),
+			(Omnipool::protocol_account(), HDX, native_reserve),
+			(lp_in, 200, token_in_reserve + 2 * ONE),
+			(lp_out, 300, token_out_reserve + 2 * ONE),
+			(buyer, 200, amount * 1000 + 200 * ONE),
+		])
+		.with_registered_asset(200)
+		.with_registered_asset(300)
+		.with_asset_fee(asset_fee)
+		.with_protocol_fee(protocol_fee)
+		.with_initial_pool(stable_price, FixedU128::from(1))
+		.with_token(200, token_in_price, lp_in, token_in_reserve)
+		.with_token(300, token_out_price, lp_out, token_out_reserve)
+		.build()
+		.execute_with(|| {
+			SlipFee::<Test>::put(SlipFeeConfig { max_slip_fee });
+
+			let result = Omnipool::buy(RuntimeOrigin::signed(buyer), 300, 200, amount, Balance::MAX);
+			assert_noop!(result, DispatchError::Arithmetic(ArithmeticError::Overflow));
+		});
+}

pallets/omnipool/src/tests/slip_fee.rs

@@ -5,7 +5,8 @@ use proptest::prelude::*;
 
 pub const ONE: Balance = 1_000_000_000_000;
 
-const BALANCE_RANGE: (Balance, Balance) = (100_000 * ONE, 10_000_000 * ONE);
+// Starting from 1m units as tiny pools push the slip-fee inversion past its discriminant threshold and the math returns Overflow.
+const BALANCE_RANGE: (Balance, Balance) = (500_000 * ONE, 10_000_000 * ONE);
 
 fn asset_reserve() -> impl Strategy<Value = Balance> {
 	BALANCE_RANGE.0..BALANCE_RANGE.1