Skip to content

Reject transactions with negative fees#109

Open
Jiyacodex wants to merge 2 commits into
StabilityNexus:mainfrom
Jiyacodex:fix-negative-fee-validation
Open

Reject transactions with negative fees#109
Jiyacodex wants to merge 2 commits into
StabilityNexus:mainfrom
Jiyacodex:fix-negative-fee-validation

Conversation

@Jiyacodex

@Jiyacodex Jiyacodex commented Jun 30, 2026

Copy link
Copy Markdown

Addressed Issues:

Fixes #108

Screenshots/Recordings:

Not applicable. This PR modifies transaction validation logic and adds regression tests.

Additional Notes:

This PR adds validation to reject transactions with negative fees before state execution and includes a regression test to prevent this issue from recurring. The changes were tested locally.

AI Usage Disclosure:

We encourage contributors to use AI tools responsibly when creating Pull Requests. While AI can be a valuable aid, it is essential to ensure that your contributions meet the task requirements, build successfully, include relevant tests, and pass all linters. Submissions that do not meet these standards may be closed without warning to maintain the quality and integrity of the project. Please take the time to understand the changes you are proposing and their impact. AI slop is strongly discouraged and may lead to banning and blocking. Do not spam our repos with AI slop.

Check one of the checkboxes below:

  • This PR does not contain AI-generated code at all.
  • This PR contains AI-generated code. I have read the AI Usage Policy and this PR complies with this policy. I have tested the code locally and I am responsible for it.

I have used the following AI models and tools: Claude Sonnet 4.6

Checklist

  • My PR addresses a single issue, fixes a single bug or makes a single improvement.
  • My code follows the project's code style and conventions.
  • If applicable, I have made corresponding changes or additions to the documentation.
  • If applicable, I have made corresponding changes or additions to tests.
  • My changes generate no new warnings or errors.
  • I have joined the Discord server and I will share a link to this PR with the project maintainers there.
  • I have read the Contribution Guidelines.
  • Once I submit my PR, CodeRabbit AI will automatically review it and I will address CodeRabbit's comments.
  • I have filled this PR template completely and carefully, and I understand that my PR may be closed without review otherwise.

Summary by CodeRabbit

  • Bug Fixes

    • Improved transaction validation to reject invalid fee and nonce values, including negative and non-integer inputs.
    • Prevented rejected transactions from affecting account balance or nonce.
    • Kept valid zero and positive-fee transactions working as expected.
  • Tests

    • Added coverage for negative, non-integer, and large invalid fee cases.
    • Added checks to confirm valid transactions are accepted and processed correctly.
  • Chores

    • Added a new ignore rule for local virtual environment files.

@coderabbitai

coderabbitai Bot commented Jun 30, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

Walkthrough

State.validate_and_apply gains explicit type and range checks for fee and tx.nonce, returning None for non-integer or negative values, replacing a prior placeholder comment. A new test module covers these rejection and acceptance cases. A .venv/ entry is added to .gitignore.

Changes

Fee and Nonce Validation

Layer / File(s) Summary
validate_and_apply checks + tests
minichain/state.py, tests/test_negative_fee.py, .gitignore
validate_and_apply now rejects transactions with non-integer or negative fee/nonce values by returning None. The new TestNegativeFeePrevention suite covers negative fees, large negative fees, balance/nonce immutability on rejection, float fees, zero fee acceptance, positive fee deduction, and negative nonce rejection. .venv/ is added to .gitignore.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Suggested labels

Python Lang

Poem

🐇 A negative fee? Not on my watch!
The nonce must be whole, not a fractional notch.
I validate, check, and return None with care,
While .venv stays hidden — no longer laid bare.
Hop hop, the chain stays clean and fair! 🌟

🚥 Pre-merge checks | ✅ 4
✅ Passed checks (4 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly matches the main change: adding validation to reject transactions with negative fees.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@minichain/state.py`:
- Around line 95-105: The numeric validation in the state transaction checks
still accepts booleans because `isinstance(..., int)` matches `bool`; update the
guards in the transaction validation logic to explicitly reject `True`/`False`.
In the code around the `tx.amount`, `fee`, and `tx.nonce` checks, switch to
exact integer-type validation so only real integers pass, keeping the existing
non-negative constraints unchanged.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: dfb1d7ce-cabc-465f-aed0-5f61b9070be3

📥 Commits

Reviewing files that changed from the base of the PR and between 3ea9909 and fcafe37.

📒 Files selected for processing (3)
  • .gitignore
  • minichain/state.py
  • tests/test_negative_fee.py

Comment thread minichain/state.py
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[BUG]: Negative transaction fees allow arbitrary balance inflation

1 participant