[P0] Security: Minor #342

Closed @tcharchian opened 2025-09-04 21:21 UTC 0 comments Updated 2025-10-09 20:05 UTC
  • GOC-19 | Count Participant With Zero Balance Is Missing Balance Check
  • GOC-20 | Go Package Dependency Issues
  • GOC-22 | Inconsistent Epoch ID Handling In GetPreviousEpochMLNodesWithInferenceAllocation
  • GOC-29 | New Participants Initialized As ACTIVE Instead Of RAMPING
  • GOC-24 | Misleading Function Name In storeMLNodeInfo
  • GOC-25 | Misleading Log In Function SetComputeValidators
  • GOC-32 | Missing Error Handling For GetPreservedNodesByParticipant
  • GOC-33 | Println Usage In Production Code
  • GOC-34 | Var Can Be Declared As Constant
  • GOC-35 | Unhandled Error In Function submitValidationProposals
  • GOC-37 | Unused Variable
  • GOC-38 | Incorrect Comments
  • GOC-06 | Redundant SetParticipant In handleExpiredInference
  • GOC-36 | Redundant Maps And Double-Pass Iteration In SetComputeValidators
  • GOI-15 | Potential Division By Zero Leads To Panic
  • GOI-20 | Incorrect Remainder Distribution In Legacy Weight Allocation
  • GOI-05 | Stale Object Used For Completion Check In FinishInference
  • GOI-19 | Missing nil Check For GetPubKey() Could Lead To Panic
  • GOI-29 | Interface Mismatch In RunMembershipService Vs RunManager
  • GOI-07 | Constants Declaration Should Be Grouped At The Top Of The File
  • GOI-08 | Inconsistent Constant Declaration Pattern
  • GOI-31 | Unused Errors
  • GOI-33 | Duplicated Constant DefaultMaxTokens
  • GOI-34 | Incorrect Timeout Logging Value
  • GOI-35 | Redundant Boolean Comparison
  • GOI-09 | In distributeLegacyWeight, for each hardware node the code linearly scans newMLNodes to find an existing node with matching NodeId. This is O(H*N) and can degrade when many nodes exist.
  • GOI-10 | For each governance model, the code scans all originalMLNodes and callsslices.Contains(supportedModelsByNode[mlNode.NodeId], model.Id)to decide assignment. This is O(MNK) where K ismodels per node.

Ignore the following:

  • GOC-10 | Subsidy Calculation Mints Total Payout Instead Of Reward Causing Systematic Over-Mint: Irrelevant given the switch to Bitcoin style rewards
  • GOI-12 | Cryptographic Signature Collision In Sign/Verify Functions: we acknowledge that it's a good point but it's not a vulnerability. Going to fix it in the future
  • GOC-09 | Reputation-Based Validation Reduction Undermines Byzantine Fault Tolerance: we're not lowering P to zero, only to 1% => we still have regular check (like every couple seconds under high load)

🔄 Auto-synced from Issue #342 every hour.