Fix alpha accounting and conviction terms - #3078
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| // Intentionally not gated by genesis hash so this can run on mainnet state clones. | ||
| for &(netuid, correction) in ALPHA_OUT_CORRECTIONS { |
There was a problem hiding this comment.
[HIGH] Mainnet accounting constants execute on every chain
This migration is wired into every runtime upgrade and deliberately omits a chain-identity guard. Consequently, any devnet, testnet, or independent chain upgrading to this runtime receives all 56 mainnet-specific SubnetAlphaOut increases, even though its state has no relationship to the historical reconstruction. The PR body says the migration runs “only on mainnet,” but the implementation provides no such restriction. Gate production execution using a verified target-chain/state fingerprint; clone testing should not require making the production migration universally applicable.
🛡️ AI Review — Skeptic (security review)VERDICT: SAFE VERY HIGH scrutiny by account signals (<3 public repos; account ~6 weeks old), moderated by repository write access and matching author/committer identity; no Gittensor association found. Branch fix/alpha-accounting-446 → release-v446 (open integration PR #3077 → main). FindingsNo findings. Prior-comment reconciliation
ConclusionThe prior cross-chain corruption path is now guarded by the mainnet genesis hash and subnet-generation checks. Static review found no remaining security vulnerability or malicious behavior. 📜 Previous run (superseded)
🔍 AI Review — Auditor (domain review)VERDICT: 👎 Gittensor association UNKNOWN; author is a newer contributor with write access and prior merged subtensor work, so the historical constants and migration invariants receive elevated scrutiny. The implementation is well documented, generation-guarded, bounded, and covered by focused unit tests. The PR body is substantive and matches the implementation. No overlapping open PR is a functional duplicate, and no spec-version auto-fix applies because the base is Findings
ConclusionThe accounting and ownership-threshold changes appear coherent, but the new mainnet storage migrations need try-runtime pre/post validation before this release is safe to merge. |
|
🔄 AI review updated — Skeptic: VULNERABLE |
| pub fn migrate_backfill_historical_alpha_burned<T: Config>() -> Weight { | ||
| let migration_name = MIGRATION_NAME.to_vec(); | ||
| let mut weight = T::DbWeight::get().reads(1); | ||
|
|
There was a problem hiding this comment.
[HIGH] Add try-runtime checks for the mainnet accounting migrations
This and the two companion migrations mutate economically significant mainnet counters without pre_upgrade/post_upgrade validation. Unit tests exercise mocked state, but they cannot validate the embedded reconstruction against the actual upgrade state. Add try-runtime checks that snapshot expected eligible generations/counters, verify every intended row (or explicitly justified generation mismatch), confirm each marker, and assert the resulting accounting invariants for all three migrations. A failed or silently skipped correction would permanently change ownership quorum calculations.
|
🔄 AI review updated — Skeptic: SAFE Auditor: 👎 |
1 participant
Subnet ownership conviction and alpha accounting correction
Summary
Fixes two historical
SubnetAlphaOutaccounting deviations and updates the subnet ownership-transfer quorum to exclude alpha that cannot support a challenger.The migration only corrects accounting counters. It does not mint alpha, modify stake, or replay historical chain state.
The pre-upgrade ownership threshold is
10% × SubnetAlphaOut. The post-upgrade threshold is10% × (SubnetAlphaOut - AlphaBurned - SubnetProtocolAlpha). Conviction forecasts roll the four aggregate lock buckets forward with the runtime exponential equations and evaluate only scheduled epoch checks. Clone-local block numbers are rebased onto the preserved mainnet BlockHash window before evaluating registration age or lock evolution. Forecasts assume no future lock transactions. They extrapolate owner-UID incentive withholding from the currentMinerBurnedfraction:SubnetAlphaOutEmission × (1 - enabled owner cut) × 50% miner share × MinerBurned. In burn mode this increases futureAlphaBurned; in recycle mode it reduces futureSubnetAlphaOut. The current emission, owner-cut, and withholding rates are held constant, as is future protocol-owned alpha. A takeover prediction also requires the subnet to pass its one-year ownership age gate. A threshold crossing is reported as an ownership change only when the projected king belongs to a different coldkey than the current owner; otherwise the result isowner remains king.Ownership-transfer threshold
Changes the challenger requirement from:
to:
Subtraction is saturating, and ownership cannot transfer when the resulting eligible alpha is zero.
AlphaBurnedis exposed throughAlphaAssetsInterfaceto avoid coupling Subtensor directly to alpha-assets storage.Historical accounting reconstruction
Every block from the RAO activation at block
4,920,351through block8,780,303was scanned across the applicable runtime versions.Duplicated RAO dividends
Between blocks
4,920,351and4,962,968, local dividends were duplicated: participant stake received both the full local dividend and the root portion, whileSubnetAlphaOutrecorded only the intended issuance.At hotfix block
4,962,968, the per-subnet difference betweenTotalHotkeyAlphaandSubnetAlphaOutwas used to calculate the missing accounting amount. The migration increasesSubnetAlphaOutby that stabilized difference.Subnets 65 and 66 were not missed:
4,950,813and accumulated a correction of4,932.684752021alpha.4,958,013and accumulated a correction of2,003.518827049alpha.Their corrections are smaller because they were exposed to the duplication only from their registration blocks until the hotfix.
Root accounting
Legacy root dividends were credited directly to root stake without increasing
SubnetAlphaOut(0).The root discrepancy was measured immediately before Root Reborn at block
8,765,683and verified again at block8,822,961. The difference remained unchanged at728,652.620877147alpha, confirming that the deviation had stopped before applying the correction.Excluded subnet generations
Eleven netuids were excluded:
15, 16, 26, 31, 36, 38, 40, 47, 49, 57, 58Their affected historical subnet generations were dissolved and the netuids were subsequently reused. Applying the old correction would modify an unrelated current subnet asset.
Migration behavior
SubnetAlphaOutby a total of1,618,308.219994798alpha.TaoSwap gate-estimate comparison
TaoSwap's API field
gate_eta_daysforecasts when total conviction reaches the moving 10% threshold. The TaoSwap observations below came from its public subnet API near the clone snapshot.5E6yHkm…MUpnqG5ED4s3B…qpwW2Q5ELpkVn…e6YVcL5GP7c3f…SWVCMi5H47sFL…n4wdDaChanged subnet ownership takeover predictions
5E6yHkm…MUpnqG5E6yHkm…MUpnqG5ED4s3B…qpwW2Q5ED4s3B…qpwW2Q5GP7c3f…SWVCMi5GP7c3f…SWVCMi5H47sFL…n4wdDa5H47sFL…n4wdDaBefore upgrade: staked alpha consistency
After upgrade: staked alpha consistency
Accounting definitions
TotalHotkeyAlpha(hotkey, netuid)value.PendingServerEmission + PendingValidatorEmission + PendingRootAlphaDivs + PendingOwnerCut + PendingBasketDeposits.SubnetAlphaOut - AlphaBurned - SubnetProtocolAlpha - pending alpha.abs(actual - calculated) / calculated × 100.