Skip to content

AdjustWeightsByCollateral missing baseWeightRatio range validation — weight inflation for uncollateralized participants #933

Closed @unameisfine opened 2026-03-23 01:42 UTC 3 comments Updated 2026-04-27 22:28 UTC

Description

calculateRequiredCollateral (collateral.go:53) correctly validates that baseWeightRatio is in the range [0, 1):

if err != nil || bwr.IsNegative() || bwr.GTE(math.LegacyOneDec()) {
    return math.ZeroInt()
}

AdjustWeightsByCollateral (collateral.go:100) converts the same parameter but has no equivalent guard. If governance sets baseWeightRatio >= 1.0:

  • baseWeight = potentialWeight × ratio exceeds potentialWeight
  • collateralEligibleWeight = potentialWeight - baseWeight goes negative
  • Participant without collateral: effectiveWeight = baseWeight (inflated)
  • Participant with collateral: activatedWeight = min(negative, positive) = negative, so effective weight is reduced

Example with baseWeightRatio = 1.5, potentialWeight = 100: - No collateral: effectiveWeight = 150 (50% inflation) - With collateral: effectiveWeight = 100 (normal)

This inverts the collateral incentive — participants are rewarded for NOT depositing collateral.

Fix

Add the same range guard after baseWeightRatio conversion in AdjustWeightsByCollateral:

if baseWeightRatio.IsNegative() || baseWeightRatio.GTE(math.LegacyOneDec()) {
    return fmt.Errorf("base_weight_ratio %s is out of valid range [0, 1)", baseWeightRatio.String())
}

💬 Comments (3)

@tcharchian commented 2026-03-23 05:10 UTC

@unameisfine, new issues need to go through the triage process first. To help move things forward a bit faster, I’d recommend posting them in Discord or any other available channels so the community can take a look and share early feedback.

@gmorgachev commented 2026-04-26 20:00 UTC

If governance sets baseWeightRatio >= 1.0

why would do that? that's contradict of the idea of base weight ratio

@unameisfine commented 2026-04-26 22:03 UTC

Fair point — governance setting an invalid ratio is unrealistic. Closing the PR.

🔄 Auto-synced from Issue #933 every hour.