Summary
The vote counter in the contract is a 64-bit integer. If a ballot receives more than 2^63 votes, the counter will overflow. While overflow is unlikely in practice, a production system must handle it gracefully. The contract should detect overflow and reject votes when the counter is near its limit.
This is a Milestone 2 hardening issue. Edge case handling is required before mainnet.
Background
In contracts/anonvote/src/lib.rs, the vote counter is a u64. Mathematically, overflow is nearly impossible with realistic vote counts, but the contract must not silently wrap around or produce incorrect results.
Scope
Contract
- Add a constant
MAX_VOTES_PER_BALLOT = 2^63 - 1 (leaving one bit of headroom)
- Before incrementing the vote counter, check if it has reached
MAX_VOTES_PER_BALLOT
- If so, return an error code
COUNTER_OVERFLOW and reject the vote
- Log a warning event indicating the counter is near limit
- Document this limit in the contract README
Tests
- Vote counter increments correctly up to the limit
- Votes at the limit are accepted
- Vote beyond the limit is rejected with
COUNTER_OVERFLOW
- Error message is descriptive
Relevant Files
contracts/anonvote/src/lib.rscontracts/README.md
Acceptance Criteria
Out of Scope
- Dynamic counter resizing — not applicable for blockchain
- Custom limits per ballot — use global constant
Note for Contributors
This is defensive programming. The likelihood of hitting this limit is near zero with realistic usage, but the code must fail gracefully rather than silently produce incorrect results. Include the limit in documentation so deployers are aware of it.
Summary
The vote counter in the contract is a 64-bit integer. If a ballot receives more than 2^63 votes, the counter will overflow. While overflow is unlikely in practice, a production system must handle it gracefully. The contract should detect overflow and reject votes when the counter is near its limit.
This is a Milestone 2 hardening issue. Edge case handling is required before mainnet.
Background
In
contracts/anonvote/src/lib.rs, the vote counter is au64. Mathematically, overflow is nearly impossible with realistic vote counts, but the contract must not silently wrap around or produce incorrect results.Scope
Contract
MAX_VOTES_PER_BALLOT = 2^63 - 1(leaving one bit of headroom)MAX_VOTES_PER_BALLOTCOUNTER_OVERFLOWand reject the voteTests
COUNTER_OVERFLOWRelevant Files
contracts/anonvote/src/lib.rscontracts/README.mdAcceptance Criteria
Out of Scope
Note for Contributors
This is defensive programming. The likelihood of hitting this limit is near zero with realistic usage, but the code must fail gracefully rather than silently produce incorrect results. Include the limit in documentation so deployers are aware of it.