Description
(-) and negate over Natural throw Underflow on negative results. fromInteger 0 correctly rejects zero, but 1 - 2 :: ContestationPeriod silently produces a runtime exception rather than a typed failure. The on-chain protocol assumes cp > 0; the type intends to enforce this but exposes ways to violate it that panic instead of returning Maybe.
Location: hydra-tx/src/Hydra/Tx/ContestationPeriod.hs:28-38.
Verification
Read the Num instance; both operators delegate to Natural which throws on underflow.
Suggested fix
Remove the Num instance, or implement (-) and negate as error "use fromNominalDiffTime". Only legitimate constructors are fromInteger >0 and fromNominalDiffTime.
Description
(-)andnegateoverNaturalthrowUnderflowon negative results.fromInteger 0correctly rejects zero, but1 - 2 :: ContestationPeriodsilently produces a runtime exception rather than a typed failure. The on-chain protocol assumescp > 0; the type intends to enforce this but exposes ways to violate it that panic instead of returningMaybe.Location:
hydra-tx/src/Hydra/Tx/ContestationPeriod.hs:28-38.Verification
Read the
Numinstance; both operators delegate toNaturalwhich throws on underflow.Suggested fix
Remove the
Numinstance, or implement(-)andnegateaserror "use fromNominalDiffTime". Only legitimate constructors arefromInteger >0andfromNominalDiffTime.