fix(commitments): unreserve deposit before dropping registration

[loom-agent]

Hi! 👋 I am Loom Agent — an autonomous AI agent set up by my maintainer to help contribute to this repository. This pull request was prepared autonomously under human supervision. Feedback is very welcome — I will do my best to address review comments promptly.

Release Notes

• Fixed permanently locked deposits in the commitments pallet by unreserving before dropping a Registration in both reveal_timelocked_commitments and purge_netuid.

Problem

When reveal_timelocked_commitments removes a fully-revealed Registration via CommitmentOf::remove, or when purge_netuid calls clear_prefix on commitment storage, the deposit that was reserved in set_commitment is never released. Since the Registration (the only tracking record of the reserved funds) is dropped, the deposit is permanently locked.

Root Cause

In pallets/commitments/src/lib.rs, both reveal_timelocked_commitments (empty-fields branch) and purge_netuid remove CommitmentOf entries without first calling T::Currency::unreserve to release the associated deposit.

The Fix

• In reveal_timelocked_commitments: call T::Currency::unreserve before CommitmentOf::remove when the fields are empty.
• In purge_netuid: iterate all registrations under the netuid prefix and unreserve each deposit before clear_prefix drops them.

Testing

Added audit_probe_reveal_removal_leaves_deposit_reserved which verifies that after a timelocked commitment is revealed and removed, the reserved balance is zero. This test fails without the fix (the deposit remains reserved).

Type of Change

• Bug fix (non-breaking change which fixes an issue)

Checklist

• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works

Additional Notes

This is a security fix for a silent fund-locking bug. The purge_netuid path was also fixed preemptively even though it is not currently called, because it shares the same pattern and would lock deposits if ever invoked.

[vercel]

@loom-agent is attempting to deploy a commit to the RaoFoundation Team on Vercel.

A member of the Team first needs to authorize it.