fix: limit possible underflows/overflows

[LesnyRumcajs]

Summary of changes

Changes introduced in this pull request:

• limits possible underflows and overflows + adds tests to improve coverage around those
• most of those are pretty benign (we kind of assume drand HTTP relay won't be malicious but it might have a bad day...), but it's good to deal with those proactively

Reference issue to close (if applicable)

Closes

Other information and links

Change checklist

• I have performed a self-review of my own code,
• I have made corresponding changes to the documentation. All new code adheres to the team's documentation standards,
• I have added tests that prove my fix is effective or that my feature works (if possible),
• I have made sure the CHANGELOG is up-to-date. All user-facing changes should be reflected in this document.

Outside contributions

• This pull request is based on an issue that a maintainer has accepted (see Before Opening a Pull Request).
• I have read and agree to the CONTRIBUTING document.
• I have read and agree to the AI Policy document. I understand that failure to comply with the guidelines will lead to rejection of the pull request.

Summary by CodeRabbit

• Bug Fixes
  • Improved validation for negative, invalid, and out-of-range epochs across chain, RPC, state, and beacon operations.
  • Prevented arithmetic overflows and underflows during timestamp, checkpoint, lookback, lease, and backfill calculations.
  • Added safer handling for malformed hexadecimal values and invalid database offsets.
  • Improved beacon traversal and error reporting when entries or rounds are invalid.
  • Prevented invalid sector durations and unsafe chain export ranges from being accepted.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 12882873-6448-4191-bc9e-f42572d17665

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Walkthrough

The PR adds checked and saturating arithmetic across beacon, chain, RPC, storage, and state paths. It introduces fallible beacon round calculations, explicit negative-height validation, shared hexadecimal parsing, and regression tests for boundary and overflow cases.

Changes

Beacon round calculations

Layer / File(s)	Summary
Fallible beacon round calculations src/beacon/drand.rs, src/beacon/mock_beacon.rs, src/beacon/tests/drand.rs, src/blocks/header.rs, src/rpc/methods/beacon.rs, src/rpc/methods/state.rs, src/state_manager/chain_rand.rs	Beacon round calculations and traversal now use checked arithmetic and return errors. Callers propagate these errors. Tests cover network versions, invalid epochs, chained traversal, forks, and wait timing.

Epoch and boundary validation

Layer / File(s)	Summary
Epoch boundary and lookback handling src/chain/..., src/chain_sync/validation.rs, src/rpc/methods/chain.rs, src/state_manager/message_search.rs	Epoch subtraction, checkpoint navigation, lookback calculations, timestamp validation, and backfill calculations now handle negative and extreme values with checked or saturating arithmetic.
Input and storage validation src/db/car/forest/index/mod.rs, src/fil_cns/weight.rs, src/rpc/methods/eth/filter/mod.rs, src/rpc/methods/f3/types.rs, src/rpc/methods/state.rs	Storage offsets, election weights, lease ranges, sector durations, and Ethereum filter inputs now validate bounds and reject overflow cases.

Shared hexadecimal parsing

Layer / File(s)	Summary
Shared hexadecimal parsing src/utils/encoding/hex.rs, src/lotus_json/mod.rs, src/wallet/subcommands/wallet_cmd.rs	Added parse_prefixed_int and updated JSON deserialization and Ethereum chain ID parsing to use it. Tests cover prefixes, signs, digits, bounds, and panic safety.

Estimated code review effort: 4 (Complex) | ~60 minutes

Possibly related PRs

• ChainSafe/forest#7408: Both changes update index-backfill epoch handling in src/rpc/methods/chain.rs.
• ChainSafe/forest#7427: Both changes update unchained beacon retrieval and maximum round handling.
• ChainSafe/forest#7441: Both changes update beacon validation and round error handling.

Suggested reviewers: hanabi1224, sudo-shashank, akaladarshi

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the PR's main change: preventing possible integer underflows and overflows.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch limit-possible-over-underflows

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch limit-possible-over-underflows

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 4

🧹 Nitpick comments (2)

src/beacon/mock_beacon.rs (1)

53-54: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Add context to the epoch conversion error.

u64::try_from(fil_epoch)? returns a generic conversion error. Add context that identifies the invalid mock-beacon epoch.

As per coding guidelines, add context with .context() when errors occur.

Proposed fix

-        Ok(u64::try_from(fil_epoch)?)
+        u64::try_from(fil_epoch).context("mock beacon epoch must be non-negative")

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/beacon/mock_beacon.rs` around lines 53 - 54, Update the epoch conversion
in the mock beacon method returning anyhow::Result<u64> to attach context with
.context() before propagating the error, identifying the invalid fil_epoch value
while preserving the successful u64 conversion result.

Source: Coding guidelines

src/state_manager/chain_rand.rs (1)

129-129: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Add context to the beacon-round error.

Line 129 returns the raw error. Add .context() with the epoch before ?. This makes failures actionable across the state-manager and RPC call paths.

As per coding guidelines, use anyhow::Result<T> for most operations and add context with .context() when errors occur.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/state_manager/chain_rand.rs` at line 129, Update the error propagation in
the beacon round lookup within the surrounding epoch-processing function by
adding anyhow context containing the current epoch before the `?` operator.
Preserve the existing `max_beacon_round_for_epoch` call and return behavior
while making the failure context available to state-manager and RPC callers.

Source: Coding guidelines

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/beacon/drand.rs`:
- Around line 136-140: Validate that the `entry.round()` returned by
`curr_beacon.entry(cur)` matches `cur` before decrementing it. Reject mismatched
rounds, including `cur + 1`, and retain the existing `checked_sub(1)` handling
for a matching round.

In `@src/chain_sync/validation.rs`:
- Around line 307-309: Replace the saturating arithmetic used to compute
expected in the timestamp validation with checked multiplication and addition,
rejecting validation when either operation overflows before comparing the block
timestamp. Extend the related regression test to use timestamp u64::MAX and
assert that the block is rejected.

In `@src/rpc/methods/eth/filter/mod.rs`:
- Around line 684-688: Update the min_height validation before the range-walk
branches to require min_height >= 0, removing acceptance of the -1 sentinel. Add
a regression test alongside the existing negative-height test covering
from_block_number(-1) and verify it is rejected.

In `@src/rpc/methods/state.rs`:
- Around line 2254-2259: In the beacon-entry wait flow, update the genesis
timestamp conversion before calling beacon_entry_wait to use i64::try_from(...),
adding the requested context message and propagating conversion failure.
Preserve the existing wait calculation while rejecting u64 timestamps that
cannot be represented as i64.

---

Nitpick comments:
In `@src/beacon/mock_beacon.rs`:
- Around line 53-54: Update the epoch conversion in the mock beacon method
returning anyhow::Result<u64> to attach context with .context() before
propagating the error, identifying the invalid fil_epoch value while preserving
the successful u64 conversion result.

In `@src/state_manager/chain_rand.rs`:
- Line 129: Update the error propagation in the beacon round lookup within the
surrounding epoch-processing function by adding anyhow context containing the
current epoch before the `?` operator. Preserve the existing
`max_beacon_round_for_epoch` call and return behavior while making the failure
context available to state-manager and RPC callers.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: ac8dd4e2-b749-46df-812c-3b6b1193a065

📥 Commits

Reviewing files that changed from the base of the PR and between 9c30523 and b8dfa6f.

📒 Files selected for processing (22)

• src/beacon/drand.rs
• src/beacon/mock_beacon.rs
• src/beacon/tests/drand.rs
• src/blocks/header.rs
• src/chain/mod.rs
• src/chain/store/chain_store.rs
• src/chain/store/errors.rs
• src/chain/store/index.rs
• src/chain/tests.rs
• src/chain_sync/validation.rs
• src/db/car/forest/index/mod.rs
• src/fil_cns/weight.rs
• src/lotus_json/mod.rs
• src/rpc/methods/beacon.rs
• src/rpc/methods/chain.rs
• src/rpc/methods/eth/filter/mod.rs
• src/rpc/methods/f3/types.rs
• src/rpc/methods/state.rs
• src/state_manager/chain_rand.rs
• src/state_manager/message_search.rs
• src/utils/encoding/hex.rs
• src/wallet/subcommands/wallet_cmd.rs

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• filecoin-project/lotus (manual)

[codecov]

Codecov Report

❌ Patch coverage is 87.98283% with 28 lines in your changes missing coverage. Please review.
✅ Project coverage is 65.20%. Comparing base (9c30523) to head (b8dfa6f).
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
src/beacon/drand.rs	77.41%	0 Missing and 7 partials ⚠️
src/rpc/methods/chain.rs	71.42%	4 Missing ⚠️
src/rpc/methods/state.rs	89.74%	2 Missing and 2 partials ⚠️
src/chain/mod.rs	80.00%	1 Missing and 1 partial ⚠️
src/wallet/subcommands/wallet_cmd.rs	0.00%	2 Missing ⚠️
src/beacon/mock_beacon.rs	50.00%	0 Missing and 1 partial ⚠️
src/blocks/header.rs	66.66%	0 Missing and 1 partial ⚠️
src/chain/store/chain_store.rs	0.00%	0 Missing and 1 partial ⚠️
src/chain_sync/validation.rs	93.33%	0 Missing and 1 partial ⚠️
src/db/car/forest/index/mod.rs	95.45%	0 Missing and 1 partial ⚠️
... and 4 more

Additional details and impacted files

Files with missing lines	Coverage Δ
src/chain/store/errors.rs	12.50% <ø> (ø)
src/chain/store/index.rs	93.84% <100.00%> (+0.18%)	⬆️
src/lotus_json/mod.rs	77.53% <100.00%> (-0.17%)	⬇️
src/rpc/methods/eth/filter/mod.rs	89.57% <100.00%> (+0.10%)	⬆️
src/rpc/methods/f3/types.rs	63.63% <100.00%> (+1.33%)	⬆️
src/utils/encoding/hex.rs	96.11% <100.00%> (+1.11%)	⬆️
src/beacon/mock_beacon.rs	56.25% <50.00%> (+25.00%)	⬆️
src/blocks/header.rs	65.69% <66.66%> (-0.14%)	⬇️
src/chain/store/chain_store.rs	73.51% <0.00%> (-0.18%)	⬇️
src/chain_sync/validation.rs	88.64% <93.33%> (+0.12%)	⬆️
... and 10 more

... and 7 files with indirect coverage changes

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 9c30523...b8dfa6f. Read the comment docs.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.