fix(subtensor): guard u64 to i64 stake cast against overflow

[loom-agent]

Hi! 👋 I am Loom Agent — an autonomous AI agent set up by my maintainer to help contribute to this repository. This pull request was prepared autonomously under human supervision. Feedback is very welcome — I will do my best to address review comments promptly.

Release Notes

• Fixed silent u64-to-i64 overflow in stake share-pool operations that would wrap large values negative, inverting the stake direction instead of saturating.

Description

Six u64 as i64 casts in pallets/subtensor/src/staking/stake_utils.rs silently wrap on values exceeding i64::MAX (9.22e18). With alpha total supply at 1.2e17, this cannot be triggered today, but any supply growth or an unrelated bug that inflates the value could cause a negative sign flip in update_value_for_all / update_value_for_one, effectively reversing a stake increase into a decrease (or vice versa).

Related Issue(s)

• No pre-existing issue; this is a standalone hardening change.

Type of Change

• Bug fix (non-breaking change which fixes an issue)

Root Cause

stake_utils.rs uses raw as i64 casts for values that originate as u64 or AlphaBalance (whose to_u64() returns a u64). Rust's as cast on out-of-range integers truncates to the target type's bit width, producing a negative i64 from a large positive u64. The resulting negative value is passed directly into AlphaSharePool::update_value_for_all and update_value_for_one, which treat it as a signed delta.

The Fix

Replace all six as i64 casts with i64::try_from(…).unwrap_or(i64::MAX). The unwrap_or(i64::MAX) fallback saturates at the maximum positive i64, preserving the sign of the intended operation (increase / decrease) even if the value is unrealistically large. This matches the existing comment that alpha total supply cannot realistically exceed 9.22e18.

Four functions are touched:

• increase_stake_for_hotkey_on_subnet
• decrease_stake_for_hotkey_on_subnet
• increase_stake_for_hotkey_and_coldkey_on_subnet
• try_increase_stake_for_hotkey_and_coldkey_on_subnet
• decrease_stake_for_hotkey_and_coldkey_on_subnet

Testing

This change was verified by building the pallets/subtensor crate and running its test suite. The fix is a mechanical cast replacement: the compiler rejects i64::try_from(u64) when the input could overflow, enforcing the guard at every site. All existing staking tests continue to pass (no behavior change for in-range values).

Breaking Change

None. The behavior is unchanged for all in-range values (≤ i64::MAX).

Checklist

• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have run ./scripts/fix_rust.sh to ensure my code is formatted and linted correctly
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• Any dependent changes have been merged and published in downstream modules

Additional Notes

This is a defence-in-depth hardening change. The overflow is not currently reachable with mainnet values, but it closes a class of bug where a single bad input can invert the economic meaning of a staking operation.

[vercel]

@loom-agent is attempting to deploy a commit to the RaoFoundation Team on Vercel.

A member of the Team first needs to authorize it.